net/netfilter/nf_conntrack_netlink.c

925 static int ctnetlink_parse_tuple_filter(const struct nlattr * const cda[],
932 				       const struct nlattr * const cda[])
935 	if (cda[CTA_MARK]) {
936 		mark->val = ntohl(nla_get_be32(cda[CTA_MARK]));
938 		if (cda[CTA_MARK_MASK])
939 			mark->mask = ntohl(nla_get_be32(cda[CTA_MARK_MASK]));
942 	} else if (cda[CTA_MARK_MASK]) {
950 					 const struct nlattr * const cda[])
952 	if (cda[CTA_STATUS]) {
953 		status->val = ntohl(nla_get_be32(cda[CTA_STATUS]));
954 		if (cda[CTA_STATUS_MASK])
955 			status->mask = ntohl(nla_get_be32(cda[CTA_STATUS_MASK]));
962 	} else if (cda[CTA_STATUS_MASK]) {
972 ctnetlink_alloc_filter(const struct nlattr * const cda[], u8 family)
978 	if (cda[CTA_MARK] || cda[CTA_MARK_MASK])
988 	err = ctnetlink_filter_parse_mark(&filter->mark, cda);
992 	err = ctnetlink_filter_parse_status(&filter->status, cda);
996 	if (cda[CTA_ZONE]) {
997 		err = ctnetlink_parse_zone(cda[CTA_ZONE], &filter->zone);
1003 	if (!cda[CTA_FILTER])
1006 	err = ctnetlink_parse_filter(cda[CTA_FILTER], filter);
1011 		if (!cda[CTA_TUPLE_ORIG]) {
1016 		err = ctnetlink_parse_tuple_filter(cda, &filter->orig,
1026 		if (!cda[CTA_TUPLE_REPLY]) {
1031 		err = ctnetlink_parse_tuple_filter(cda, &filter->reply,
1048 static bool ctnetlink_needs_filter(u8 family, const struct nlattr * const *cda)
1050 	return family || cda[CTA_MARK] || cda[CTA_FILTER] || cda[CTA_STATUS] || cda[CTA_ZONE];
1055 	const struct nlattr * const *cda = cb->data;
1060 	if (ctnetlink_needs_filter(family, cda)) {
1061 		filter = ctnetlink_alloc_filter(cda, family);
1445 ctnetlink_parse_tuple_filter(const struct nlattr * const cda[],
1455 	err = nla_parse_nested_deprecated(tb, CTA_TUPLE_MAX, cda[type],
1506 ctnetlink_parse_tuple(const struct nlattr * const cda[],
1510 	return ctnetlink_parse_tuple_filter(cda, tuple, type, l3num, zone,
1571 				     const struct nlattr * const cda[],
1581 	if (ctnetlink_needs_filter(family, cda)) {
1582 		if (cda[CTA_FILTER])
1585 		filter = ctnetlink_alloc_filter(cda, family);
1600 				   const struct nlattr * const cda[])
1609 	err = ctnetlink_parse_zone(cda[CTA_ZONE], &zone);
1613 	if (cda[CTA_TUPLE_ORIG])
1614 		err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG,
1616 	else if (cda[CTA_TUPLE_REPLY])
1617 		err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY,
1622 		return ctnetlink_flush_conntrack(info->net, cda,
1636 	if (cda[CTA_ID]) {
1637 		__be32 id = nla_get_be32(cda[CTA_ID]);
1653 				   const struct nlattr * const cda[])
1668 			.data = (void *)cda,
1674 	err = ctnetlink_parse_zone(cda[CTA_ZONE], &zone);
1678 	if (cda[CTA_TUPLE_ORIG])
1679 		err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG,
1681 	else if (cda[CTA_TUPLE_REPLY])
1682 		err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY,
1824 				  const struct nlattr * const cda[])
1839 					const struct nlattr * const cda[])
1902 ctnetlink_change_status(struct nf_conn *ct, const struct nlattr * const cda[])
1904 	return nf_ct_change_status_common(ct, ntohl(nla_get_be32(cda[CTA_STATUS])));
1908 ctnetlink_setup_nat(struct nf_conn *ct, const struct nlattr * const cda[])
1913 	if (!cda[CTA_NAT_DST] && !cda[CTA_NAT_SRC])
1917 					cda[CTA_NAT_DST]);
1922 					 cda[CTA_NAT_SRC]);
1924 	if (!cda[CTA_NAT_DST] && !cda[CTA_NAT_SRC])
1931 				   const struct nlattr * const cda[])
1939 	err = ctnetlink_parse_help(cda[CTA_HELP], &helpname, &helpinfo);
1997 				    const struct nlattr * const cda[])
1999 	return __nf_ct_change_timeout(ct, (u64)ntohl(nla_get_be32(cda[CTA_TIMEOUT])) * HZ);
2004 				    const struct nlattr * const cda[])
2008 	if (cda[CTA_MARK_MASK])
2009 		mask = ~ntohl(nla_get_be32(cda[CTA_MARK_MASK]));
2011 	mark = ntohl(nla_get_be32(cda[CTA_MARK]));
2025 				      const struct nlattr * const cda[])
2027 	const struct nlattr *attr = cda[CTA_PROTOINFO];
2054 	struct nlattr *cda[CTA_SEQADJ_MAX+1];
2056 	err = nla_parse_nested_deprecated(cda, CTA_SEQADJ_MAX, attr,
2061 	if (!cda[CTA_SEQADJ_CORRECTION_POS])
2065 		ntohl(nla_get_be32(cda[CTA_SEQADJ_CORRECTION_POS]));
2067 	if (!cda[CTA_SEQADJ_OFFSET_BEFORE])
2071 		ntohl(nla_get_be32(cda[CTA_SEQADJ_OFFSET_BEFORE]));
2073 	if (!cda[CTA_SEQADJ_OFFSET_AFTER])
2077 		ntohl(nla_get_be32(cda[CTA_SEQADJ_OFFSET_AFTER]));
2084 			 const struct nlattr * const cda[])
2093 	if (cda[CTA_SEQ_ADJ_ORIG]) {
2095 				     cda[CTA_SEQ_ADJ_ORIG]);
2102 	if (cda[CTA_SEQ_ADJ_REPLY]) {
2104 				     cda[CTA_SEQ_ADJ_REPLY]);
2125 				     const struct nlattr * const cda[])
2135 					  cda[CTA_SYNPROXY], synproxy_policy,
2153 ctnetlink_attach_labels(struct nf_conn *ct, const struct nlattr * const cda[])
2156 	size_t len = nla_len(cda[CTA_LABELS]);
2157 	const void *mask = cda[CTA_LABELS_MASK];
2163 		if (nla_len(cda[CTA_LABELS_MASK]) == 0 ||
2164 		    nla_len(cda[CTA_LABELS_MASK]) != len)
2166 		mask = nla_data(cda[CTA_LABELS_MASK]);
2171 	return nf_connlabels_replace(ct, nla_data(cda[CTA_LABELS]), mask, len);
2179 			   const struct nlattr * const cda[])
2184 	if (cda[CTA_NAT_SRC] || cda[CTA_NAT_DST] || cda[CTA_TUPLE_MASTER])
2187 	if (cda[CTA_HELP]) {
2188 		err = ctnetlink_change_helper(ct, cda);
2193 	if (cda[CTA_TIMEOUT]) {
2194 		err = ctnetlink_change_timeout(ct, cda);
2199 	if (cda[CTA_STATUS]) {
2200 		err = ctnetlink_change_status(ct, cda);
2205 	if (cda[CTA_PROTOINFO]) {
2206 		err = ctnetlink_change_protoinfo(ct, cda);
2212 	if (cda[CTA_MARK])
2213 		ctnetlink_change_mark(ct, cda);
2216 	if (cda[CTA_SEQ_ADJ_ORIG] || cda[CTA_SEQ_ADJ_REPLY]) {
2217 		err = ctnetlink_change_seq_adj(ct, cda);
2222 	if (cda[CTA_SYNPROXY]) {
2223 		err = ctnetlink_change_synproxy(ct, cda);
2228 	if (cda[CTA_LABELS]) {
2229 		err = ctnetlink_attach_labels(ct, cda);
2240 			   const struct nlattr * const cda[],
2255 	if (!cda[CTA_TIMEOUT])
2259  	if (cda[CTA_HELP]) {
2263 		err = ctnetlink_parse_help(cda[CTA_HELP], &helpname, &helpinfo);
2307 	err = ctnetlink_setup_nat(ct, cda);
2321 	timeout = (u64)ntohl(nla_get_be32(cda[CTA_TIMEOUT])) * HZ;
2324 	if (cda[CTA_STATUS]) {
2325 		err = ctnetlink_change_status(ct, cda);
2330 	if (cda[CTA_SEQ_ADJ_ORIG] || cda[CTA_SEQ_ADJ_REPLY]) {
2331 		err = ctnetlink_change_seq_adj(ct, cda);
2337 	if (cda[CTA_PROTOINFO]) {
2338 		err = ctnetlink_change_protoinfo(ct, cda);
2343 	if (cda[CTA_SYNPROXY]) {
2344 		err = ctnetlink_change_synproxy(ct, cda);
2350 	if (cda[CTA_MARK])
2351 		ctnetlink_change_mark(ct, cda);
2355 	if (cda[CTA_TUPLE_MASTER]) {
2360 		err = ctnetlink_parse_tuple(cda, &master, CTA_TUPLE_MASTER,
2398 				   const struct nlattr * const cda[])
2407 	err = ctnetlink_parse_zone(cda[CTA_ZONE], &zone);
2411 	if (cda[CTA_TUPLE_ORIG]) {
2412 		err = ctnetlink_parse_tuple(cda, &otuple, CTA_TUPLE_ORIG,
2418 	if (cda[CTA_TUPLE_REPLY]) {
2419 		err = ctnetlink_parse_tuple(cda, &rtuple, CTA_TUPLE_REPLY,
2425 	if (cda[CTA_TUPLE_ORIG])
2427 	else if (cda[CTA_TUPLE_REPLY])
2435 			if (!cda[CTA_TUPLE_ORIG] || !cda[CTA_TUPLE_REPLY])
2440 			ct = ctnetlink_create_conntrack(info->net, &zone, cda,
2451 			if (cda[CTA_LABELS] &&
2452 			    ctnetlink_attach_labels(ct, cda) == 0)
2475 		err = ctnetlink_change_conntrack(ct, cda);
2562 				 const struct nlattr * const cda[])
2605 			     const struct nlattr * const cda[])
2642 ctnetlink_alloc_expect(const struct nlattr *const cda[], struct nf_conn *ct,
2780 ctnetlink_update_status(struct nf_conn *ct, const struct nlattr * const cda[])
2782 	unsigned int status = ntohl(nla_get_be32(cda[CTA_STATUS]));
2804 ctnetlink_glue_parse_ct(const struct nlattr *cda[], struct nf_conn *ct)
2808 	if (cda[CTA_TIMEOUT]) {
2809 		err = ctnetlink_change_timeout(ct, cda);
2813 	if (cda[CTA_STATUS]) {
2814 		err = ctnetlink_update_status(ct, cda);
2818 	if (cda[CTA_HELP]) {
2819 		err = ctnetlink_change_helper(ct, cda);
2823 	if (cda[CTA_LABELS]) {
2824 		err = ctnetlink_attach_labels(ct, cda);
2829 	if (cda[CTA_MARK]) {
2830 		ctnetlink_change_mark(ct, cda);
2839 	struct nlattr *cda[CTA_MAX+1];
2842 	ret = nla_parse_nested_deprecated(cda, CTA_MAX, attr, ct_nla_policy,
2847 	return ctnetlink_glue_parse_ct((const struct nlattr **)cda, ct);
2850 static int ctnetlink_glue_exp_parse(const struct nlattr * const *cda,
2857 	err = ctnetlink_parse_tuple(cda, tuple, CTA_EXPECT_TUPLE,
2862 	return ctnetlink_parse_tuple(cda, mask, CTA_EXPECT_MASK,
2870 	struct nlattr *cda[CTA_EXPECT_MAX+1];
2876 	err = nla_parse_nested_deprecated(cda, CTA_EXPECT_MAX, attr,
2881 	err = ctnetlink_glue_exp_parse((const struct nlattr * const *)cda,
2886 	if (cda[CTA_EXPECT_HELP_NAME]) {
2887 		const char *helpname = nla_data(cda[CTA_EXPECT_HELP_NAME]);
2895 	exp = ctnetlink_alloc_expect((const struct nlattr * const *)cda, ct,
3258 				 const struct nlattr * const cda[],
3273 	err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER,
3278 	err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone);
3303 				const struct nlattr * const cda[])
3313 		if (cda[CTA_EXPECT_MASTER])
3315 						     info->nlh, cda,
3326 	err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone);
3330 	if (cda[CTA_EXPECT_TUPLE])
3331 		err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE,
3333 	else if (cda[CTA_EXPECT_MASTER])
3334 		err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER,
3346 	if (cda[CTA_EXPECT_ID]) {
3347 		__be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);
3397 				const struct nlattr * const cda[])
3405 	if (cda[CTA_EXPECT_TUPLE]) {
3407 		err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone);
3411 		err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE,
3421 		if (cda[CTA_EXPECT_ID]) {
3422 			__be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);
3440 	} else if (cda[CTA_EXPECT_HELP_NAME]) {
3441 		char *name = nla_data(cda[CTA_EXPECT_HELP_NAME]);
3457 			const struct nlattr * const cda[])
3459 	if (cda[CTA_EXPECT_TIMEOUT]) {
3464 			ntohl(nla_get_be32(cda[CTA_EXPECT_TIMEOUT])) * HZ;
3512 ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,
3526 	if (cda[CTA_EXPECT_CLASS] && helper) {
3527 		class = ntohl(nla_get_be32(cda[CTA_EXPECT_CLASS]));
3535 	if (cda[CTA_EXPECT_FLAGS]) {
3536 		exp->flags = ntohl(nla_get_be32(cda[CTA_EXPECT_FLAGS]));
3541 	if (cda[CTA_EXPECT_FN]) {
3542 		const char *name = nla_data(cda[CTA_EXPECT_FN]);
3561 	if (cda[CTA_EXPECT_NAT]) {
3562 		err = ctnetlink_parse_expect_nat(cda[CTA_EXPECT_NAT],
3576 			const struct nlattr * const cda[],
3587 	err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE,
3591 	err = ctnetlink_parse_tuple(cda, &mask, CTA_EXPECT_MASK,
3595 	err = ctnetlink_parse_tuple(cda, &master_tuple, CTA_EXPECT_MASTER,
3607 	if (cda[CTA_EXPECT_HELP_NAME]) {
3608 		const char *helpname = nla_data(cda[CTA_EXPECT_HELP_NAME]);
3633 	exp = ctnetlink_alloc_expect(cda, ct, helper, &tuple, &mask);
3650 				const struct nlattr * const cda[])
3658 	if (!cda[CTA_EXPECT_TUPLE]
3659 	    || !cda[CTA_EXPECT_MASK]
3660 	    || !cda[CTA_EXPECT_MASTER])
3663 	err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone);
3667 	err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE,
3678 			err = ctnetlink_create_expect(info->net, &zone, cda, u3,
3687 		err = ctnetlink_change_expect(exp, cda);
3749 				  const struct nlattr * const cda[])