/* Connection tracking via netlink socket. Allows for user space
   * protocol helpers and general trouble making from userspace.
   *
   * (C) 2001 by Jay Schulist <jschlst@samba.org>

   * (C) 2002-2006 by Harald Welte <laforge@gnumonks.org>

   * (C) 2003 by Patrick Mchardy <kaber@trash.net>

   * (C) 2005-2012 by Pablo Neira Ayuso <pablo@netfilter.org>

   *

   * Initial connection tracking via netlink development funded and

   * generally made possible by Network Robots, Inc. (www.networkrobots.com)
   *
   * Further development of this code funded by Astaro AG (http://www.astaro.com)
   *
   * This software may be used and distributed according to the terms
   * of the GNU General Public License, incorporated herein by reference.

   */
  
  #include <linux/init.h>
  #include <linux/module.h>
  #include <linux/kernel.h>

  #include <linux/rculist.h>

  #include <linux/rculist_nulls.h>

  #include <linux/types.h>
  #include <linux/timer.h>

  #include <linux/security.h>

  #include <linux/skbuff.h>
  #include <linux/errno.h>
  #include <linux/netlink.h>
  #include <linux/spinlock.h>

  #include <linux/interrupt.h>

  #include <linux/slab.h>

  
  #include <linux/netfilter.h>

  #include <net/netlink.h>

  #include <net/sock.h>

  #include <net/netfilter/nf_conntrack.h>
  #include <net/netfilter/nf_conntrack_core.h>

  #include <net/netfilter/nf_conntrack_expect.h>

  #include <net/netfilter/nf_conntrack_helper.h>

  #include <net/netfilter/nf_conntrack_seqadj.h>

  #include <net/netfilter/nf_conntrack_l3proto.h>

  #include <net/netfilter/nf_conntrack_l4proto.h>

  #include <net/netfilter/nf_conntrack_tuple.h>

  #include <net/netfilter/nf_conntrack_acct.h>

  #include <net/netfilter/nf_conntrack_zones.h>

  #include <net/netfilter/nf_conntrack_timestamp.h>

  #include <net/netfilter/nf_conntrack_labels.h>

  #include <net/netfilter/nf_conntrack_seqadj.h>
  #include <net/netfilter/nf_conntrack_synproxy.h>

  #ifdef CONFIG_NF_NAT_NEEDED
  #include <net/netfilter/nf_nat_core.h>

  #include <net/netfilter/nf_nat_l4proto.h>

  #include <net/netfilter/nf_nat_helper.h>

  #endif

  
  #include <linux/netfilter/nfnetlink.h>
  #include <linux/netfilter/nfnetlink_conntrack.h>
  
  MODULE_LICENSE("GPL");

  static char __initdata version[] = "0.93";

  static int ctnetlink_dump_tuples_proto(struct sk_buff *skb,

  				const struct nf_conntrack_tuple *tuple,
  				const struct nf_conntrack_l4proto *l4proto)

  {

  	int ret = 0;

  	struct nlattr *nest_parms;

  	nest_parms = nla_nest_start(skb, CTA_TUPLE_PROTO | NLA_F_NESTED);
  	if (!nest_parms)
  		goto nla_put_failure;

  	if (nla_put_u8(skb, CTA_PROTO_NUM, tuple->dst.protonum))
  		goto nla_put_failure;

  	if (likely(l4proto->tuple_to_nlattr))
  		ret = l4proto->tuple_to_nlattr(skb, tuple);

  	nla_nest_end(skb, nest_parms);

  
  	return ret;

  nla_put_failure:

  	return -1;
  }

  static int ctnetlink_dump_tuples_ip(struct sk_buff *skb,
  				    const struct nf_conntrack_tuple *tuple,

  				    const struct nf_conntrack_l3proto *l3proto)

  {

  	int ret = 0;

  	struct nlattr *nest_parms;
  
  	nest_parms = nla_nest_start(skb, CTA_TUPLE_IP | NLA_F_NESTED);
  	if (!nest_parms)
  		goto nla_put_failure;

  	if (likely(l3proto->tuple_to_nlattr))
  		ret = l3proto->tuple_to_nlattr(skb, tuple);

  	nla_nest_end(skb, nest_parms);

  	return ret;

  nla_put_failure:

  	return -1;
  }

  static int ctnetlink_dump_tuples(struct sk_buff *skb,
  				 const struct nf_conntrack_tuple *tuple)

  {

  	const struct nf_conntrack_l3proto *l3proto;
  	const struct nf_conntrack_l4proto *l4proto;

  	int ret;

  	rcu_read_lock();

  	l3proto = __nf_ct_l3proto_find(tuple->src.l3num);

  	ret = ctnetlink_dump_tuples_ip(skb, tuple, l3proto);

  	if (ret >= 0) {
  		l4proto = __nf_ct_l4proto_find(tuple->src.l3num,
  					       tuple->dst.protonum);
  		ret = ctnetlink_dump_tuples_proto(skb, tuple, l4proto);
  	}
  	rcu_read_unlock();

  	return ret;

  }

  static int ctnetlink_dump_zone_id(struct sk_buff *skb, int attrtype,
  				  const struct nf_conntrack_zone *zone, int dir)

  {
  	if (zone->id == NF_CT_DEFAULT_ZONE_ID || zone->dir != dir)
  		return 0;
  	if (nla_put_be16(skb, attrtype, htons(zone->id)))
  		goto nla_put_failure;
  	return 0;
  
  nla_put_failure:
  	return -1;
  }

  static int ctnetlink_dump_status(struct sk_buff *skb, const struct nf_conn *ct)

  {

  	if (nla_put_be32(skb, CTA_STATUS, htonl(ct->status)))
  		goto nla_put_failure;

  	return 0;

  nla_put_failure:

  	return -1;
  }

  static int ctnetlink_dump_timeout(struct sk_buff *skb, const struct nf_conn *ct)

  {

  	long timeout = nf_ct_expires(ct) / HZ;

  	if (nla_put_be32(skb, CTA_TIMEOUT, htonl(timeout)))
  		goto nla_put_failure;

  	return 0;

  nla_put_failure:

  	return -1;
  }

  static int ctnetlink_dump_protoinfo(struct sk_buff *skb, struct nf_conn *ct)

  {

  	const struct nf_conntrack_l4proto *l4proto;

  	struct nlattr *nest_proto;

  	int ret;

  	l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
  	if (!l4proto->to_nlattr)

  		return 0;

  	nest_proto = nla_nest_start(skb, CTA_PROTOINFO | NLA_F_NESTED);
  	if (!nest_proto)
  		goto nla_put_failure;

  	ret = l4proto->to_nlattr(skb, nest_proto, ct);

  	nla_nest_end(skb, nest_proto);

  
  	return ret;

  nla_put_failure:

  	return -1;
  }

  static int ctnetlink_dump_helpinfo(struct sk_buff *skb,
  				   const struct nf_conn *ct)

  {

  	struct nlattr *nest_helper;

  	const struct nf_conn_help *help = nfct_help(ct);

  	struct nf_conntrack_helper *helper;

  	if (!help)

  		return 0;

  	helper = rcu_dereference(help->helper);
  	if (!helper)
  		goto out;

  	nest_helper = nla_nest_start(skb, CTA_HELP | NLA_F_NESTED);
  	if (!nest_helper)
  		goto nla_put_failure;

  	if (nla_put_string(skb, CTA_HELP_NAME, helper->name))
  		goto nla_put_failure;

  	if (helper->to_nlattr)
  		helper->to_nlattr(skb, ct);

  	nla_nest_end(skb, nest_helper);

  out:

  	return 0;

  nla_put_failure:

  	return -1;
  }

  static int

  dump_counters(struct sk_buff *skb, struct nf_conn_acct *acct,
  	      enum ip_conntrack_dir dir, int type)

  {

  	enum ctattr_type attr = dir ? CTA_COUNTERS_REPLY: CTA_COUNTERS_ORIG;
  	struct nf_conn_counter *counter = acct->counter;

  	struct nlattr *nest_count;

  	u64 pkts, bytes;

  	if (type == IPCTNL_MSG_CT_GET_CTRZERO) {
  		pkts = atomic64_xchg(&counter[dir].packets, 0);
  		bytes = atomic64_xchg(&counter[dir].bytes, 0);
  	} else {
  		pkts = atomic64_read(&counter[dir].packets);
  		bytes = atomic64_read(&counter[dir].bytes);
  	}
  
  	nest_count = nla_nest_start(skb, attr | NLA_F_NESTED);

  	if (!nest_count)
  		goto nla_put_failure;

  	if (nla_put_be64(skb, CTA_COUNTERS_PACKETS, cpu_to_be64(pkts),
  			 CTA_COUNTERS_PAD) ||
  	    nla_put_be64(skb, CTA_COUNTERS_BYTES, cpu_to_be64(bytes),
  			 CTA_COUNTERS_PAD))

  		goto nla_put_failure;

  	nla_nest_end(skb, nest_count);

  
  	return 0;

  nla_put_failure:

  	return -1;
  }

  static int

  ctnetlink_dump_acct(struct sk_buff *skb, const struct nf_conn *ct, int type)

  {

  	struct nf_conn_acct *acct = nf_conn_acct_find(ct);

  	if (!acct)
  		return 0;

  	if (dump_counters(skb, acct, IP_CT_DIR_ORIGINAL, type) < 0)
  		return -1;
  	if (dump_counters(skb, acct, IP_CT_DIR_REPLY, type) < 0)
  		return -1;
  
  	return 0;

  }
  
  static int

  ctnetlink_dump_timestamp(struct sk_buff *skb, const struct nf_conn *ct)
  {
  	struct nlattr *nest_count;
  	const struct nf_conn_tstamp *tstamp;
  
  	tstamp = nf_conn_tstamp_find(ct);
  	if (!tstamp)
  		return 0;
  
  	nest_count = nla_nest_start(skb, CTA_TIMESTAMP | NLA_F_NESTED);
  	if (!nest_count)
  		goto nla_put_failure;

  	if (nla_put_be64(skb, CTA_TIMESTAMP_START, cpu_to_be64(tstamp->start),
  			 CTA_TIMESTAMP_PAD) ||

  	    (tstamp->stop != 0 && nla_put_be64(skb, CTA_TIMESTAMP_STOP,

  					       cpu_to_be64(tstamp->stop),
  					       CTA_TIMESTAMP_PAD)))

  		goto nla_put_failure;

  	nla_nest_end(skb, nest_count);
  
  	return 0;
  
  nla_put_failure:
  	return -1;
  }

  #ifdef CONFIG_NF_CONNTRACK_MARK

  static int ctnetlink_dump_mark(struct sk_buff *skb, const struct nf_conn *ct)

  {

  	if (nla_put_be32(skb, CTA_MARK, htonl(ct->mark)))
  		goto nla_put_failure;

  	return 0;

  nla_put_failure:

  	return -1;
  }
  #else
  #define ctnetlink_dump_mark(a, b) (0)
  #endif

  #ifdef CONFIG_NF_CONNTRACK_SECMARK

  static int ctnetlink_dump_secctx(struct sk_buff *skb, const struct nf_conn *ct)

  {

  	struct nlattr *nest_secctx;
  	int len, ret;
  	char *secctx;
  
  	ret = security_secid_to_secctx(ct->secmark, &secctx, &len);
  	if (ret)

  		return 0;

  
  	ret = -1;
  	nest_secctx = nla_nest_start(skb, CTA_SECCTX | NLA_F_NESTED);
  	if (!nest_secctx)
  		goto nla_put_failure;

  	if (nla_put_string(skb, CTA_SECCTX_NAME, secctx))
  		goto nla_put_failure;

  	nla_nest_end(skb, nest_secctx);
  
  	ret = 0;

  nla_put_failure:

  	security_release_secctx(secctx, len);
  	return ret;

  }
  #else

  #define ctnetlink_dump_secctx(a, b) (0)

  #endif

  #ifdef CONFIG_NF_CONNTRACK_LABELS

  static inline int ctnetlink_label_size(const struct nf_conn *ct)

  {
  	struct nf_conn_labels *labels = nf_ct_labels_find(ct);
  
  	if (!labels)
  		return 0;

  	return nla_total_size(sizeof(labels->bits));

  }
  
  static int
  ctnetlink_dump_labels(struct sk_buff *skb, const struct nf_conn *ct)
  {
  	struct nf_conn_labels *labels = nf_ct_labels_find(ct);

  	unsigned int i;

  
  	if (!labels)
  		return 0;

  	i = 0;
  	do {
  		if (labels->bits[i] != 0)

  			return nla_put(skb, CTA_LABELS, sizeof(labels->bits),
  				       labels->bits);

  		i++;

  	} while (i < ARRAY_SIZE(labels->bits));

  
  	return 0;
  }
  #else
  #define ctnetlink_dump_labels(a, b) (0)
  #define ctnetlink_label_size(a)	(0)
  #endif

  #define master_tuple(ct) &(ct->master->tuplehash[IP_CT_DIR_ORIGINAL].tuple)

  static int ctnetlink_dump_master(struct sk_buff *skb, const struct nf_conn *ct)

  {
  	struct nlattr *nest_parms;
  
  	if (!(ct->status & IPS_EXPECTED))
  		return 0;
  
  	nest_parms = nla_nest_start(skb, CTA_TUPLE_MASTER | NLA_F_NESTED);
  	if (!nest_parms)
  		goto nla_put_failure;
  	if (ctnetlink_dump_tuples(skb, master_tuple(ct)) < 0)
  		goto nla_put_failure;
  	nla_nest_end(skb, nest_parms);
  
  	return 0;
  
  nla_put_failure:
  	return -1;
  }

  static int

  dump_ct_seq_adj(struct sk_buff *skb, const struct nf_ct_seqadj *seq, int type)

  {

  	struct nlattr *nest_parms;
  
  	nest_parms = nla_nest_start(skb, type | NLA_F_NESTED);
  	if (!nest_parms)
  		goto nla_put_failure;

  	if (nla_put_be32(skb, CTA_SEQADJ_CORRECTION_POS,
  			 htonl(seq->correction_pos)) ||
  	    nla_put_be32(skb, CTA_SEQADJ_OFFSET_BEFORE,
  			 htonl(seq->offset_before)) ||
  	    nla_put_be32(skb, CTA_SEQADJ_OFFSET_AFTER,
  			 htonl(seq->offset_after)))

  		goto nla_put_failure;

  
  	nla_nest_end(skb, nest_parms);
  
  	return 0;
  
  nla_put_failure:
  	return -1;
  }

  static int ctnetlink_dump_ct_seq_adj(struct sk_buff *skb, struct nf_conn *ct)

  {

  	struct nf_conn_seqadj *seqadj = nfct_seqadj(ct);
  	struct nf_ct_seqadj *seq;

  	if (!(ct->status & IPS_SEQ_ADJUST) || !seqadj)

  		return 0;

  	spin_lock_bh(&ct->lock);

  	seq = &seqadj->seq[IP_CT_DIR_ORIGINAL];
  	if (dump_ct_seq_adj(skb, seq, CTA_SEQ_ADJ_ORIG) == -1)

  		goto err;

  	seq = &seqadj->seq[IP_CT_DIR_REPLY];
  	if (dump_ct_seq_adj(skb, seq, CTA_SEQ_ADJ_REPLY) == -1)

  		goto err;

  	spin_unlock_bh(&ct->lock);

  	return 0;

  err:
  	spin_unlock_bh(&ct->lock);
  	return -1;

  }

  static int ctnetlink_dump_id(struct sk_buff *skb, const struct nf_conn *ct)

  {

  	if (nla_put_be32(skb, CTA_ID, htonl((unsigned long)ct)))
  		goto nla_put_failure;

  	return 0;

  nla_put_failure:

  	return -1;
  }

  static int ctnetlink_dump_use(struct sk_buff *skb, const struct nf_conn *ct)

  {

  	if (nla_put_be32(skb, CTA_USE, htonl(atomic_read(&ct->ct_general.use))))
  		goto nla_put_failure;

  	return 0;

  nla_put_failure:

  	return -1;
  }

  static int

  ctnetlink_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,

  		    struct nf_conn *ct)

  {

  	const struct nf_conntrack_zone *zone;

  	struct nlmsghdr *nlh;
  	struct nfgenmsg *nfmsg;

  	struct nlattr *nest_parms;

  	unsigned int flags = portid ? NLM_F_MULTI : 0, event;

  	event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK, IPCTNL_MSG_CT_NEW);

  	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);

  	if (nlh == NULL)
  		goto nlmsg_failure;

  	nfmsg = nlmsg_data(nlh);

  	nfmsg->nfgen_family = nf_ct_l3num(ct);

  	nfmsg->version      = NFNETLINK_V0;
  	nfmsg->res_id	    = 0;

  	zone = nf_ct_zone(ct);

  	nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG | NLA_F_NESTED);
  	if (!nest_parms)
  		goto nla_put_failure;

  	if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)

  		goto nla_put_failure;

  	if (ctnetlink_dump_zone_id(skb, CTA_TUPLE_ZONE, zone,
  				   NF_CT_ZONE_DIR_ORIG) < 0)
  		goto nla_put_failure;

  	nla_nest_end(skb, nest_parms);

  	nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY | NLA_F_NESTED);
  	if (!nest_parms)
  		goto nla_put_failure;

  	if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_REPLY)) < 0)

  		goto nla_put_failure;

  	if (ctnetlink_dump_zone_id(skb, CTA_TUPLE_ZONE, zone,
  				   NF_CT_ZONE_DIR_REPL) < 0)
  		goto nla_put_failure;

  	nla_nest_end(skb, nest_parms);

  	if (ctnetlink_dump_zone_id(skb, CTA_ZONE, zone,
  				   NF_CT_DEFAULT_ZONE_DIR) < 0)

  		goto nla_put_failure;

  	if (ctnetlink_dump_status(skb, ct) < 0 ||
  	    ctnetlink_dump_timeout(skb, ct) < 0 ||

  	    ctnetlink_dump_acct(skb, ct, type) < 0 ||

  	    ctnetlink_dump_timestamp(skb, ct) < 0 ||

  	    ctnetlink_dump_protoinfo(skb, ct) < 0 ||
  	    ctnetlink_dump_helpinfo(skb, ct) < 0 ||
  	    ctnetlink_dump_mark(skb, ct) < 0 ||

  	    ctnetlink_dump_secctx(skb, ct) < 0 ||

  	    ctnetlink_dump_labels(skb, ct) < 0 ||

  	    ctnetlink_dump_id(skb, ct) < 0 ||

  	    ctnetlink_dump_use(skb, ct) < 0 ||

  	    ctnetlink_dump_master(skb, ct) < 0 ||

  	    ctnetlink_dump_ct_seq_adj(skb, ct) < 0)

  		goto nla_put_failure;

  	nlmsg_end(skb, nlh);

  	return skb->len;
  
  nlmsg_failure:

  nla_put_failure:

  	nlmsg_cancel(skb, nlh);

  	return -1;
  }

  static inline size_t ctnetlink_proto_size(const struct nf_conn *ct)

  {

  	const struct nf_conntrack_l3proto *l3proto;
  	const struct nf_conntrack_l4proto *l4proto;
  	size_t len;

  	l3proto = __nf_ct_l3proto_find(nf_ct_l3num(ct));

  	len = l3proto->nla_size;
  	len *= 3u; /* ORIG, REPLY, MASTER */

  
  	l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
  	len += l4proto->nla_size;

  
  	return len;
  }

  static inline size_t ctnetlink_acct_size(const struct nf_conn *ct)

  {
  	if (!nf_ct_ext_exist(ct, NF_CT_EXT_ACCT))
  		return 0;
  	return 2 * nla_total_size(0) /* CTA_COUNTERS_ORIG|REPL */

  	       + 2 * nla_total_size_64bit(sizeof(uint64_t)) /* CTA_COUNTERS_PACKETS */
  	       + 2 * nla_total_size_64bit(sizeof(uint64_t)) /* CTA_COUNTERS_BYTES */

  	       ;
  }

  static inline int ctnetlink_secctx_size(const struct nf_conn *ct)

  {

  #ifdef CONFIG_NF_CONNTRACK_SECMARK
  	int len, ret;

  	ret = security_secid_to_secctx(ct->secmark, NULL, &len);
  	if (ret)
  		return 0;

  	return nla_total_size(0) /* CTA_SECCTX */
  	       + nla_total_size(sizeof(char) * len); /* CTA_SECCTX_NAME */
  #else
  	return 0;

  #endif

  }

  static inline size_t ctnetlink_timestamp_size(const struct nf_conn *ct)

  {
  #ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
  	if (!nf_ct_ext_exist(ct, NF_CT_EXT_TSTAMP))
  		return 0;

  	return nla_total_size(0) + 2 * nla_total_size_64bit(sizeof(uint64_t));

  #else
  	return 0;
  #endif
  }

  #ifdef CONFIG_NF_CONNTRACK_EVENTS
  static size_t ctnetlink_nlmsg_size(const struct nf_conn *ct)

  {
  	return NLMSG_ALIGN(sizeof(struct nfgenmsg))
  	       + 3 * nla_total_size(0) /* CTA_TUPLE_ORIG|REPL|MASTER */
  	       + 3 * nla_total_size(0) /* CTA_TUPLE_IP */
  	       + 3 * nla_total_size(0) /* CTA_TUPLE_PROTO */
  	       + 3 * nla_total_size(sizeof(u_int8_t)) /* CTA_PROTO_NUM */
  	       + nla_total_size(sizeof(u_int32_t)) /* CTA_ID */
  	       + nla_total_size(sizeof(u_int32_t)) /* CTA_STATUS */

  	       + ctnetlink_acct_size(ct)

  	       + ctnetlink_timestamp_size(ct)

  	       + nla_total_size(sizeof(u_int32_t)) /* CTA_TIMEOUT */
  	       + nla_total_size(0) /* CTA_PROTOINFO */
  	       + nla_total_size(0) /* CTA_HELP */
  	       + nla_total_size(NF_CT_HELPER_NAME_LEN) /* CTA_HELP_NAME */

  	       + ctnetlink_secctx_size(ct)

  #ifdef CONFIG_NF_NAT_NEEDED

  	       + 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG|REPL */
  	       + 6 * nla_total_size(sizeof(u_int32_t)) /* CTA_NAT_SEQ_OFFSET */

  #endif
  #ifdef CONFIG_NF_CONNTRACK_MARK

  	       + nla_total_size(sizeof(u_int32_t)) /* CTA_MARK */

  #endif

  #ifdef CONFIG_NF_CONNTRACK_ZONES

  	       + nla_total_size(sizeof(u_int16_t)) /* CTA_ZONE|CTA_TUPLE_ZONE */

  #endif

  	       + ctnetlink_proto_size(ct)

  	       + ctnetlink_label_size(ct)

  	       ;

  }

  static int
  ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item)

  {

  	const struct nf_conntrack_zone *zone;

  	struct net *net;

  	struct nlmsghdr *nlh;
  	struct nfgenmsg *nfmsg;

  	struct nlattr *nest_parms;

  	struct nf_conn *ct = item->ct;

  	struct sk_buff *skb;
  	unsigned int type;

  	unsigned int flags = 0, group;

  	int err;

  	if (events & (1 << IPCT_DESTROY)) {

  		type = IPCTNL_MSG_CT_DELETE;
  		group = NFNLGRP_CONNTRACK_DESTROY;

  	} else if (events & ((1 << IPCT_NEW) | (1 << IPCT_RELATED))) {

  		type = IPCTNL_MSG_CT_NEW;
  		flags = NLM_F_CREATE|NLM_F_EXCL;

  		group = NFNLGRP_CONNTRACK_NEW;

  	} else if (events) {

  		type = IPCTNL_MSG_CT_NEW;
  		group = NFNLGRP_CONNTRACK_UPDATE;
  	} else

  		return 0;

  	net = nf_ct_net(ct);
  	if (!item->report && !nfnetlink_has_listeners(net, group))

  		return 0;

  	skb = nlmsg_new(ctnetlink_nlmsg_size(ct), GFP_ATOMIC);
  	if (skb == NULL)

  		goto errout;

  	type = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK, type);

  	nlh = nlmsg_put(skb, item->portid, 0, type, sizeof(*nfmsg), flags);

  	if (nlh == NULL)
  		goto nlmsg_failure;

  	nfmsg = nlmsg_data(nlh);

  	nfmsg->nfgen_family = nf_ct_l3num(ct);

  	nfmsg->version	= NFNETLINK_V0;
  	nfmsg->res_id	= 0;

  	zone = nf_ct_zone(ct);

  	nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG | NLA_F_NESTED);
  	if (!nest_parms)
  		goto nla_put_failure;

  	if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)

  		goto nla_put_failure;

  	if (ctnetlink_dump_zone_id(skb, CTA_TUPLE_ZONE, zone,
  				   NF_CT_ZONE_DIR_ORIG) < 0)
  		goto nla_put_failure;

  	nla_nest_end(skb, nest_parms);

  	nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY | NLA_F_NESTED);
  	if (!nest_parms)
  		goto nla_put_failure;

  	if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_REPLY)) < 0)

  		goto nla_put_failure;

  	if (ctnetlink_dump_zone_id(skb, CTA_TUPLE_ZONE, zone,
  				   NF_CT_ZONE_DIR_REPL) < 0)
  		goto nla_put_failure;

  	nla_nest_end(skb, nest_parms);

  	if (ctnetlink_dump_zone_id(skb, CTA_ZONE, zone,
  				   NF_CT_DEFAULT_ZONE_DIR) < 0)

  		goto nla_put_failure;

  	if (ctnetlink_dump_id(skb, ct) < 0)
  		goto nla_put_failure;

  	if (ctnetlink_dump_status(skb, ct) < 0)
  		goto nla_put_failure;

  	if (events & (1 << IPCT_DESTROY)) {

  		if (ctnetlink_dump_acct(skb, ct, type) < 0 ||

  		    ctnetlink_dump_timestamp(skb, ct) < 0)

  			goto nla_put_failure;

  	} else {

  		if (ctnetlink_dump_timeout(skb, ct) < 0)

  			goto nla_put_failure;

  		if (events & (1 << IPCT_PROTOINFO)

  		    && ctnetlink_dump_protoinfo(skb, ct) < 0)

  			goto nla_put_failure;

  		if ((events & (1 << IPCT_HELPER) || nfct_help(ct))

  		    && ctnetlink_dump_helpinfo(skb, ct) < 0)

  			goto nla_put_failure;

  #ifdef CONFIG_NF_CONNTRACK_SECMARK

  		if ((events & (1 << IPCT_SECMARK) || ct->secmark)

  		    && ctnetlink_dump_secctx(skb, ct) < 0)

  			goto nla_put_failure;

  #endif

  		if (events & (1 << IPCT_LABEL) &&
  		     ctnetlink_dump_labels(skb, ct) < 0)
  			goto nla_put_failure;

  		if (events & (1 << IPCT_RELATED) &&

  		    ctnetlink_dump_master(skb, ct) < 0)
  			goto nla_put_failure;

  		if (events & (1 << IPCT_SEQADJ) &&
  		    ctnetlink_dump_ct_seq_adj(skb, ct) < 0)

  			goto nla_put_failure;

  	}

  #ifdef CONFIG_NF_CONNTRACK_MARK

  	if ((events & (1 << IPCT_MARK) || ct->mark)

  	    && ctnetlink_dump_mark(skb, ct) < 0)
  		goto nla_put_failure;
  #endif

  	nlmsg_end(skb, nlh);

  	err = nfnetlink_send(skb, net, item->portid, group, item->report,

  			     GFP_ATOMIC);

  	if (err == -ENOBUFS || err == -EAGAIN)
  		return -ENOBUFS;

  	return 0;

  nla_put_failure:

  	nlmsg_cancel(skb, nlh);

  nlmsg_failure:

  	kfree_skb(skb);

  errout:

  	if (nfnetlink_set_err(net, 0, group, -ENOBUFS) > 0)
  		return -ENOBUFS;

  	return 0;

  }
  #endif /* CONFIG_NF_CONNTRACK_EVENTS */
  
  static int ctnetlink_done(struct netlink_callback *cb)
  {

  	if (cb->args[1])
  		nf_ct_put((struct nf_conn *)cb->args[1]);

  	kfree(cb->data);

  	return 0;
  }

  struct ctnetlink_filter {

  	struct {
  		u_int32_t val;
  		u_int32_t mask;
  	} mark;
  };

  static struct ctnetlink_filter *
  ctnetlink_alloc_filter(const struct nlattr * const cda[])
  {
  #ifdef CONFIG_NF_CONNTRACK_MARK
  	struct ctnetlink_filter *filter;
  
  	filter = kzalloc(sizeof(*filter), GFP_KERNEL);
  	if (filter == NULL)
  		return ERR_PTR(-ENOMEM);
  
  	filter->mark.val = ntohl(nla_get_be32(cda[CTA_MARK]));
  	filter->mark.mask = ntohl(nla_get_be32(cda[CTA_MARK_MASK]));
  
  	return filter;
  #else
  	return ERR_PTR(-EOPNOTSUPP);
  #endif
  }

  static int ctnetlink_start(struct netlink_callback *cb)
  {
  	const struct nlattr * const *cda = cb->data;
  	struct ctnetlink_filter *filter = NULL;
  
  	if (cda[CTA_MARK] && cda[CTA_MARK_MASK]) {
  		filter = ctnetlink_alloc_filter(cda);
  		if (IS_ERR(filter))
  			return PTR_ERR(filter);
  	}
  
  	cb->data = filter;
  	return 0;
  }

  static int ctnetlink_filter_match(struct nf_conn *ct, void *data)
  {
  	struct ctnetlink_filter *filter = data;
  
  	if (filter == NULL)
  		return 1;
  
  #ifdef CONFIG_NF_CONNTRACK_MARK
  	if ((ct->mark & filter->mark.mask) == filter->mark.val)
  		return 1;
  #endif
  
  	return 0;
  }

  static int
  ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
  {

  	struct net *net = sock_net(skb->sk);

  	struct nf_conn *ct, *last;

  	struct nf_conntrack_tuple_hash *h;

  	struct hlist_nulls_node *n;

  	struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);

  	u_int8_t l3proto = nfmsg->nfgen_family;

  	struct nf_conn *nf_ct_evict[8];
  	int res, i;

  	spinlock_t *lockp;

  	last = (struct nf_conn *)cb->args[1];

  	i = 0;

  
  	local_bh_disable();

  	for (; cb->args[0] < nf_conntrack_htable_size; cb->args[0]++) {

  restart:

  		while (i) {
  			i--;
  			if (nf_ct_should_gc(nf_ct_evict[i]))
  				nf_ct_kill(nf_ct_evict[i]);
  			nf_ct_put(nf_ct_evict[i]);
  		}

  		lockp = &nf_conntrack_locks[cb->args[0] % CONNTRACK_LOCKS];

  		nf_conntrack_lock(lockp);

  		if (cb->args[0] >= nf_conntrack_htable_size) {

  			spin_unlock(lockp);
  			goto out;
  		}

  		hlist_nulls_for_each_entry(h, n, &nf_conntrack_hash[cb->args[0]],
  					   hnnode) {

  			if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)

  				continue;
  			ct = nf_ct_tuplehash_to_ctrack(h);

  			if (nf_ct_is_expired(ct)) {
  				if (i < ARRAY_SIZE(nf_ct_evict) &&
  				    atomic_inc_not_zero(&ct->ct_general.use))
  					nf_ct_evict[i++] = ct;
  				continue;
  			}

  			if (!net_eq(net, nf_ct_net(ct)))
  				continue;

  			/* Dump entries of a given L3 protocol number.
  			 * If it is not specified, ie. l3proto == 0,
  			 * then dump everything. */

  			if (l3proto && nf_ct_l3num(ct) != l3proto)

  				continue;

  			if (cb->args[1]) {
  				if (ct != last)

  					continue;

  				cb->args[1] = 0;

  			}

  			if (!ctnetlink_filter_match(ct, cb->data))

  				continue;

  			rcu_read_lock();
  			res =

  			ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).portid,

  					    cb->nlh->nlmsg_seq,
  					    NFNL_MSG_TYPE(cb->nlh->nlmsg_type),
  					    ct);
  			rcu_read_unlock();
  			if (res < 0) {

  				nf_conntrack_get(&ct->ct_general);

  				cb->args[1] = (unsigned long)ct;

  				spin_unlock(lockp);

  				goto out;

  			}
  		}

  		spin_unlock(lockp);

  		if (cb->args[1]) {

  			cb->args[1] = 0;
  			goto restart;

  		}
  	}

  out:

  	local_bh_enable();

  	if (last) {
  		/* nf ct hash resize happened, now clear the leftover. */
  		if ((struct nf_conn *)cb->args[1] == last)
  			cb->args[1] = 0;

  		nf_ct_put(last);

  	}

  	while (i) {
  		i--;
  		if (nf_ct_should_gc(nf_ct_evict[i]))
  			nf_ct_kill(nf_ct_evict[i]);
  		nf_ct_put(nf_ct_evict[i]);
  	}

  	return skb->len;
  }

  static int ctnetlink_parse_tuple_ip(struct nlattr *attr,
  				    struct nf_conntrack_tuple *tuple)

  {

  	struct nlattr *tb[CTA_IP_MAX+1];

  	struct nf_conntrack_l3proto *l3proto;
  	int ret = 0;

  	ret = nla_parse_nested(tb, CTA_IP_MAX, attr, NULL, NULL);

  	if (ret < 0)
  		return ret;

  	rcu_read_lock();
  	l3proto = __nf_ct_l3proto_find(tuple->src.l3num);

  	if (likely(l3proto->nlattr_to_tuple)) {
  		ret = nla_validate_nested(attr, CTA_IP_MAX,

  					  l3proto->nla_policy, NULL);

  		if (ret == 0)
  			ret = l3proto->nlattr_to_tuple(tb, tuple);
  	}

  	rcu_read_unlock();

  	return ret;
  }

  static const struct nla_policy proto_nla_policy[CTA_PROTO_MAX+1] = {
  	[CTA_PROTO_NUM]	= { .type = NLA_U8 },

  };

  static int ctnetlink_parse_tuple_proto(struct nlattr *attr,
  				       struct nf_conntrack_tuple *tuple)

  {

  	const struct nf_conntrack_l4proto *l4proto;

  	struct nlattr *tb[CTA_PROTO_MAX+1];

  	int ret = 0;

  	ret = nla_parse_nested(tb, CTA_PROTO_MAX, attr, proto_nla_policy,
  			       NULL);

  	if (ret < 0)
  		return ret;

  	if (!tb[CTA_PROTO_NUM])

  		return -EINVAL;

  	tuple->dst.protonum = nla_get_u8(tb[CTA_PROTO_NUM]);

  	rcu_read_lock();
  	l4proto = __nf_ct_l4proto_find(tuple->src.l3num, tuple->dst.protonum);

  	if (likely(l4proto->nlattr_to_tuple)) {
  		ret = nla_validate_nested(attr, CTA_PROTO_MAX,

  					  l4proto->nla_policy, NULL);

  		if (ret == 0)
  			ret = l4proto->nlattr_to_tuple(tb, tuple);
  	}

  	rcu_read_unlock();

  	return ret;
  }

  static int
  ctnetlink_parse_zone(const struct nlattr *attr,
  		     struct nf_conntrack_zone *zone)
  {

  	nf_ct_zone_init(zone, NF_CT_DEFAULT_ZONE_ID,
  			NF_CT_DEFAULT_ZONE_DIR, 0);

  #ifdef CONFIG_NF_CONNTRACK_ZONES
  	if (attr)
  		zone->id = ntohs(nla_get_be16(attr));
  #else
  	if (attr)
  		return -EOPNOTSUPP;
  #endif
  	return 0;
  }
  
  static int
  ctnetlink_parse_tuple_zone(struct nlattr *attr, enum ctattr_type type,
  			   struct nf_conntrack_zone *zone)
  {
  	int ret;
  
  	if (zone->id != NF_CT_DEFAULT_ZONE_ID)
  		return -EINVAL;
  
  	ret = ctnetlink_parse_zone(attr, zone);
  	if (ret < 0)
  		return ret;
  
  	if (type == CTA_TUPLE_REPLY)
  		zone->dir = NF_CT_ZONE_DIR_REPL;
  	else
  		zone->dir = NF_CT_ZONE_DIR_ORIG;
  
  	return 0;
  }

  static const struct nla_policy tuple_nla_policy[CTA_TUPLE_MAX+1] = {
  	[CTA_TUPLE_IP]		= { .type = NLA_NESTED },
  	[CTA_TUPLE_PROTO]	= { .type = NLA_NESTED },

  	[CTA_TUPLE_ZONE]	= { .type = NLA_U16 },

  };

  static int

  ctnetlink_parse_tuple(const struct nlattr * const cda[],

  		      struct nf_conntrack_tuple *tuple, u32 type,
  		      u_int8_t l3num, struct nf_conntrack_zone *zone)

  {

  	struct nlattr *tb[CTA_TUPLE_MAX+1];

  	int err;

  	memset(tuple, 0, sizeof(*tuple));

  	err = nla_parse_nested(tb, CTA_TUPLE_MAX, cda[type], tuple_nla_policy,
  			       NULL);

  	if (err < 0)
  		return err;

  	if (!tb[CTA_TUPLE_IP])

  		return -EINVAL;
  
  	tuple->src.l3num = l3num;

  	err = ctnetlink_parse_tuple_ip(tb[CTA_TUPLE_IP], tuple);

  	if (err < 0)
  		return err;

  	if (!tb[CTA_TUPLE_PROTO])

  		return -EINVAL;

  	err = ctnetlink_parse_tuple_proto(tb[CTA_TUPLE_PROTO], tuple);

  	if (err < 0)
  		return err;

  	if (tb[CTA_TUPLE_ZONE]) {
  		if (!zone)
  			return -EINVAL;
  
  		err = ctnetlink_parse_tuple_zone(tb[CTA_TUPLE_ZONE],
  						 type, zone);
  		if (err < 0)
  			return err;
  	}

  	/* orig and expect tuples get DIR_ORIGINAL */
  	if (type == CTA_TUPLE_REPLY)
  		tuple->dst.dir = IP_CT_DIR_REPLY;
  	else
  		tuple->dst.dir = IP_CT_DIR_ORIGINAL;

  	return 0;
  }

  static const struct nla_policy help_nla_policy[CTA_HELP_MAX+1] = {

  	[CTA_HELP_NAME]		= { .type = NLA_NUL_STRING,
  				    .len = NF_CT_HELPER_NAME_LEN - 1 },

  };

  static int ctnetlink_parse_help(const struct nlattr *attr, char **helper_name,
  				struct nlattr **helpinfo)

  {

  	int err;

  	struct nlattr *tb[CTA_HELP_MAX+1];

  	err = nla_parse_nested(tb, CTA_HELP_MAX, attr, help_nla_policy, NULL);

  	if (err < 0)
  		return err;

  	if (!tb[CTA_HELP_NAME])

  		return -EINVAL;

  	*helper_name = nla_data(tb[CTA_HELP_NAME]);

  	if (tb[CTA_HELP_INFO])
  		*helpinfo = tb[CTA_HELP_INFO];

  	return 0;
  }

  static const struct nla_policy ct_nla_policy[CTA_MAX+1] = {

  	[CTA_TUPLE_ORIG]	= { .type = NLA_NESTED },
  	[CTA_TUPLE_REPLY]	= { .type = NLA_NESTED },

  	[CTA_STATUS] 		= { .type = NLA_U32 },

  	[CTA_PROTOINFO]		= { .type = NLA_NESTED },
  	[CTA_HELP]		= { .type = NLA_NESTED },
  	[CTA_NAT_SRC]		= { .type = NLA_NESTED },

  	[CTA_TIMEOUT] 		= { .type = NLA_U32 },
  	[CTA_MARK]		= { .type = NLA_U32 },

  	[CTA_ID]		= { .type = NLA_U32 },

  	[CTA_NAT_DST]		= { .type = NLA_NESTED },
  	[CTA_TUPLE_MASTER]	= { .type = NLA_NESTED },

  	[CTA_NAT_SEQ_ADJ_ORIG]  = { .type = NLA_NESTED },
  	[CTA_NAT_SEQ_ADJ_REPLY] = { .type = NLA_NESTED },

  	[CTA_ZONE]		= { .type = NLA_U16 },

  	[CTA_MARK_MASK]		= { .type = NLA_U32 },

  	[CTA_LABELS]		= { .type = NLA_BINARY,

  				    .len = NF_CT_LABELS_MAX_SIZE },

  	[CTA_LABELS_MASK]	= { .type = NLA_BINARY,

  				    .len = NF_CT_LABELS_MAX_SIZE },

  };

  static int ctnetlink_flush_conntrack(struct net *net,
  				     const struct nlattr * const cda[],
  				     u32 portid, int report)
  {
  	struct ctnetlink_filter *filter = NULL;
  
  	if (cda[CTA_MARK] && cda[CTA_MARK_MASK]) {
  		filter = ctnetlink_alloc_filter(cda);
  		if (IS_ERR(filter))
  			return PTR_ERR(filter);
  	}

  	nf_ct_iterate_cleanup_net(net, ctnetlink_filter_match, filter,
  				  portid, report);

  	kfree(filter);
  
  	return 0;
  }

  static int ctnetlink_del_conntrack(struct net *net, struct sock *ctnl,
  				   struct sk_buff *skb,
  				   const struct nlmsghdr *nlh,

  				   const struct nlattr * const cda[],
  				   struct netlink_ext_ack *extack)

  {
  	struct nf_conntrack_tuple_hash *h;
  	struct nf_conntrack_tuple tuple;
  	struct nf_conn *ct;

  	struct nfgenmsg *nfmsg = nlmsg_data(nlh);

  	u_int8_t u3 = nfmsg->nfgen_family;

  	struct nf_conntrack_zone zone;

  	int err;
  
  	err = ctnetlink_parse_zone(cda[CTA_ZONE], &zone);
  	if (err < 0)
  		return err;

  	if (cda[CTA_TUPLE_ORIG])

  		err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG,
  					    u3, &zone);

  	else if (cda[CTA_TUPLE_REPLY])

  		err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY,
  					    u3, &zone);

  	else {

  		return ctnetlink_flush_conntrack(net, cda,
  						 NETLINK_CB(skb).portid,
  						 nlmsg_report(nlh));

  	}
  
  	if (err < 0)
  		return err;

  	h = nf_conntrack_find_get(net, &zone, &tuple);

  	if (!h)

  		return -ENOENT;

  
  	ct = nf_ct_tuplehash_to_ctrack(h);

  	if (cda[CTA_ID]) {

  		u_int32_t id = ntohl(nla_get_be32(cda[CTA_ID]));

  		if (id != (u32)(unsigned long)ct) {

  			nf_ct_put(ct);
  			return -ENOENT;
  		}

  	}

  	nf_ct_delete(ct, NETLINK_CB(skb).portid, nlmsg_report(nlh));

  	nf_ct_put(ct);

  
  	return 0;
  }

  static int ctnetlink_get_conntrack(struct net *net, struct sock *ctnl,
  				   struct sk_buff *skb,
  				   const struct nlmsghdr *nlh,

  				   const struct nlattr * const cda[],
  				   struct netlink_ext_ack *extack)

  {
  	struct nf_conntrack_tuple_hash *h;
  	struct nf_conntrack_tuple tuple;
  	struct nf_conn *ct;
  	struct sk_buff *skb2 = NULL;

  	struct nfgenmsg *nfmsg = nlmsg_data(nlh);

  	u_int8_t u3 = nfmsg->nfgen_family;

  	struct nf_conntrack_zone zone;

  	int err;

  	if (nlh->nlmsg_flags & NLM_F_DUMP) {
  		struct netlink_dump_control c = {

  			.start = ctnetlink_start,

  			.dump = ctnetlink_dump_table,
  			.done = ctnetlink_done,

  			.data = (void *)cda,

  		};

  		return netlink_dump_start(ctnl, skb, nlh, &c);
  	}

  	err = ctnetlink_parse_zone(cda[CTA_ZONE], &zone);
  	if (err < 0)
  		return err;

  	if (cda[CTA_TUPLE_ORIG])

  		err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG,
  					    u3, &zone);

  	else if (cda[CTA_TUPLE_REPLY])

  		err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY,
  					    u3, &zone);

  	else
  		return -EINVAL;
  
  	if (err < 0)
  		return err;

  	h = nf_conntrack_find_get(net, &zone, &tuple);

  	if (!h)

  		return -ENOENT;

  	ct = nf_ct_tuplehash_to_ctrack(h);
  
  	err = -ENOMEM;

  	skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
  	if (skb2 == NULL) {

  		nf_ct_put(ct);
  		return -ENOMEM;
  	}

  	rcu_read_lock();

  	err = ctnetlink_fill_info(skb2, NETLINK_CB(skb).portid, nlh->nlmsg_seq,

  				  NFNL_MSG_TYPE(nlh->nlmsg_type), ct);

  	rcu_read_unlock();

  	nf_ct_put(ct);
  	if (err <= 0)
  		goto free;

  	err = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid, MSG_DONTWAIT);

  	if (err < 0)
  		goto out;

  	return 0;
  
  free:
  	kfree_skb(skb2);
  out:

  	/* this avoids a loop in nfnetlink. */
  	return err == -EAGAIN ? -ENOBUFS : err;

  }

  static int ctnetlink_done_list(struct netlink_callback *cb)
  {
  	if (cb->args[1])
  		nf_ct_put((struct nf_conn *)cb->args[1]);
  	return 0;
  }
  
  static int

  ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb, bool dying)

  {

  	struct nf_conn *ct, *last;

  	struct nf_conntrack_tuple_hash *h;
  	struct hlist_nulls_node *n;
  	struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
  	u_int8_t l3proto = nfmsg->nfgen_family;
  	int res;

  	int cpu;
  	struct hlist_nulls_head *list;
  	struct net *net = sock_net(skb->sk);

  
  	if (cb->args[2])
  		return 0;

  	last = (struct nf_conn *)cb->args[1];