1// SPDX-License-Identifier: GPL-2.0-or-later 2/* 3 * (C) 2012 Pablo Neira Ayuso <pablo@netfilter.org> 4 * 5 * This software has been sponsored by Vyatta Inc. <http://www.vyatta.com> 6 */ 7#include <linux/init.h> 8#include <linux/module.h> 9#include <linux/kernel.h> 10#include <linux/skbuff.h> 11#include <linux/netlink.h> 12#include <linux/rculist.h> 13#include <linux/slab.h> 14#include <linux/types.h> 15#include <linux/list.h> 16#include <linux/errno.h> 17#include <linux/capability.h> 18#include <net/netlink.h> 19#include <net/sock.h> 20 21#include <net/netfilter/nf_conntrack_helper.h> 22#include <net/netfilter/nf_conntrack_expect.h> 23#include <net/netfilter/nf_conntrack_ecache.h> 24 25#include <linux/netfilter/nfnetlink.h> 26#include <linux/netfilter/nfnetlink_conntrack.h> 27#include <linux/netfilter/nfnetlink_cthelper.h> 28 29MODULE_LICENSE("GPL"); 30MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>"); 31MODULE_DESCRIPTION("nfnl_cthelper: User-space connection tracking helpers"); 32 33struct nfnl_cthelper { 34 struct list_head list; 35 struct nf_conntrack_helper helper; 36}; 37 38static LIST_HEAD(nfnl_cthelper_list); 39 40static int 41nfnl_userspace_cthelper(struct sk_buff *skb, unsigned int protoff, 42 struct nf_conn *ct, enum ip_conntrack_info ctinfo) 43{ 44 const struct nf_conn_help *help; 45 struct nf_conntrack_helper *helper; 46 47 help = nfct_help(ct); 48 if (help == NULL) 49 return NF_DROP; 50 51 /* rcu_read_lock()ed by nf_hook_thresh */ 52 helper = rcu_dereference(help->helper); 53 if (helper == NULL) 54 return NF_DROP; 55 56 /* This is a user-space helper not yet configured, skip. */ 57 if ((helper->flags & 58 (NF_CT_HELPER_F_USERSPACE | NF_CT_HELPER_F_CONFIGURED)) == 59 NF_CT_HELPER_F_USERSPACE) 60 return NF_ACCEPT; 61 62 /* If the user-space helper is not available, don't block traffic. */ 63 return NF_QUEUE_NR(helper->queue_num) | NF_VERDICT_FLAG_QUEUE_BYPASS; 64} 65 66static const struct nla_policy nfnl_cthelper_tuple_pol[NFCTH_TUPLE_MAX+1] = { 67 [NFCTH_TUPLE_L3PROTONUM] = { .type = NLA_U16, }, 68 [NFCTH_TUPLE_L4PROTONUM] = { .type = NLA_U8, }, 69}; 70 71static int 72nfnl_cthelper_parse_tuple(struct nf_conntrack_tuple *tuple, 73 const struct nlattr *attr) 74{ 75 int err; 76 struct nlattr *tb[NFCTH_TUPLE_MAX+1]; 77 78 err = nla_parse_nested_deprecated(tb, NFCTH_TUPLE_MAX, attr, 79 nfnl_cthelper_tuple_pol, NULL); 80 if (err < 0) 81 return err; 82 83 if (!tb[NFCTH_TUPLE_L3PROTONUM] || !tb[NFCTH_TUPLE_L4PROTONUM]) 84 return -EINVAL; 85 86 /* Not all fields are initialized so first zero the tuple */ 87 memset(tuple, 0, sizeof(struct nf_conntrack_tuple)); 88 89 tuple->src.l3num = ntohs(nla_get_be16(tb[NFCTH_TUPLE_L3PROTONUM])); 90 tuple->dst.protonum = nla_get_u8(tb[NFCTH_TUPLE_L4PROTONUM]); 91 92 return 0; 93} 94 95static int 96nfnl_cthelper_from_nlattr(struct nlattr *attr, struct nf_conn *ct) 97{ 98 struct nf_conn_help *help = nfct_help(ct); 99 const struct nf_conntrack_helper *helper; 100 101 if (attr == NULL) 102 return -EINVAL; 103 104 helper = rcu_dereference(help->helper); 105 if (!helper || helper->data_len == 0) 106 return -EINVAL; 107 108 nla_memcpy(help->data, attr, sizeof(help->data)); 109 return 0; 110} 111 112static int 113nfnl_cthelper_to_nlattr(struct sk_buff *skb, const struct nf_conn *ct) 114{ 115 const struct nf_conn_help *help = nfct_help(ct); 116 const struct nf_conntrack_helper *helper; 117 118 helper = rcu_dereference(help->helper); 119 if (helper && helper->data_len && 120 nla_put(skb, CTA_HELP_INFO, helper->data_len, &help->data)) 121 goto nla_put_failure; 122 123 return 0; 124 125nla_put_failure: 126 return -ENOSPC; 127} 128 129static const struct nla_policy nfnl_cthelper_expect_pol[NFCTH_POLICY_MAX+1] = { 130 [NFCTH_POLICY_NAME] = { .type = NLA_NUL_STRING, 131 .len = NF_CT_HELPER_NAME_LEN-1 }, 132 [NFCTH_POLICY_EXPECT_MAX] = { .type = NLA_U32, }, 133 [NFCTH_POLICY_EXPECT_TIMEOUT] = { .type = NLA_U32, }, 134}; 135 136static int 137nfnl_cthelper_expect_policy(struct nf_conntrack_expect_policy *expect_policy, 138 const struct nlattr *attr) 139{ 140 int err; 141 struct nlattr *tb[NFCTH_POLICY_MAX+1]; 142 143 err = nla_parse_nested_deprecated(tb, NFCTH_POLICY_MAX, attr, 144 nfnl_cthelper_expect_pol, NULL); 145 if (err < 0) 146 return err; 147 148 if (!tb[NFCTH_POLICY_NAME] || 149 !tb[NFCTH_POLICY_EXPECT_MAX] || 150 !tb[NFCTH_POLICY_EXPECT_TIMEOUT]) 151 return -EINVAL; 152 153 nla_strscpy(expect_policy->name, 154 tb[NFCTH_POLICY_NAME], NF_CT_HELPER_NAME_LEN); 155 expect_policy->max_expected = 156 ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX])); 157 if (expect_policy->max_expected > NF_CT_EXPECT_MAX_CNT) 158 return -EINVAL; 159 160 expect_policy->timeout = 161 ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_TIMEOUT])); 162 163 return 0; 164} 165 166static const struct nla_policy 167nfnl_cthelper_expect_policy_set[NFCTH_POLICY_SET_MAX+1] = { 168 [NFCTH_POLICY_SET_NUM] = { .type = NLA_U32, }, 169}; 170 171static int 172nfnl_cthelper_parse_expect_policy(struct nf_conntrack_helper *helper, 173 const struct nlattr *attr) 174{ 175 int i, ret; 176 struct nf_conntrack_expect_policy *expect_policy; 177 struct nlattr *tb[NFCTH_POLICY_SET_MAX+1]; 178 unsigned int class_max; 179 180 ret = nla_parse_nested_deprecated(tb, NFCTH_POLICY_SET_MAX, attr, 181 nfnl_cthelper_expect_policy_set, 182 NULL); 183 if (ret < 0) 184 return ret; 185 186 if (!tb[NFCTH_POLICY_SET_NUM]) 187 return -EINVAL; 188 189 class_max = ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM])); 190 if (class_max == 0) 191 return -EINVAL; 192 if (class_max > NF_CT_MAX_EXPECT_CLASSES) 193 return -EOVERFLOW; 194 195 expect_policy = kcalloc(class_max, 196 sizeof(struct nf_conntrack_expect_policy), 197 GFP_KERNEL); 198 if (expect_policy == NULL) 199 return -ENOMEM; 200 201 for (i = 0; i < class_max; i++) { 202 if (!tb[NFCTH_POLICY_SET+i]) 203 goto err; 204 205 ret = nfnl_cthelper_expect_policy(&expect_policy[i], 206 tb[NFCTH_POLICY_SET+i]); 207 if (ret < 0) 208 goto err; 209 } 210 211 helper->expect_class_max = class_max - 1; 212 helper->expect_policy = expect_policy; 213 return 0; 214err: 215 kfree(expect_policy); 216 return -EINVAL; 217} 218 219static int 220nfnl_cthelper_create(const struct nlattr * const tb[], 221 struct nf_conntrack_tuple *tuple) 222{ 223 struct nf_conntrack_helper *helper; 224 struct nfnl_cthelper *nfcth; 225 unsigned int size; 226 int ret; 227 228 if (!tb[NFCTH_TUPLE] || !tb[NFCTH_POLICY] || !tb[NFCTH_PRIV_DATA_LEN]) 229 return -EINVAL; 230 231 nfcth = kzalloc(sizeof(*nfcth), GFP_KERNEL); 232 if (nfcth == NULL) 233 return -ENOMEM; 234 helper = &nfcth->helper; 235 236 ret = nfnl_cthelper_parse_expect_policy(helper, tb[NFCTH_POLICY]); 237 if (ret < 0) 238 goto err1; 239 240 nla_strscpy(helper->name, 241 tb[NFCTH_NAME], NF_CT_HELPER_NAME_LEN); 242 size = ntohl(nla_get_be32(tb[NFCTH_PRIV_DATA_LEN])); 243 if (size > sizeof_field(struct nf_conn_help, data)) { 244 ret = -ENOMEM; 245 goto err2; 246 } 247 helper->data_len = size; 248 249 helper->flags |= NF_CT_HELPER_F_USERSPACE; 250 memcpy(&helper->tuple, tuple, sizeof(struct nf_conntrack_tuple)); 251 252 helper->me = THIS_MODULE; 253 helper->help = nfnl_userspace_cthelper; 254 helper->from_nlattr = nfnl_cthelper_from_nlattr; 255 helper->to_nlattr = nfnl_cthelper_to_nlattr; 256 257 /* Default to queue number zero, this can be updated at any time. */ 258 if (tb[NFCTH_QUEUE_NUM]) 259 helper->queue_num = ntohl(nla_get_be32(tb[NFCTH_QUEUE_NUM])); 260 261 if (tb[NFCTH_STATUS]) { 262 int status = ntohl(nla_get_be32(tb[NFCTH_STATUS])); 263 264 switch(status) { 265 case NFCT_HELPER_STATUS_ENABLED: 266 helper->flags |= NF_CT_HELPER_F_CONFIGURED; 267 break; 268 case NFCT_HELPER_STATUS_DISABLED: 269 helper->flags &= ~NF_CT_HELPER_F_CONFIGURED; 270 break; 271 } 272 } 273 274 ret = nf_conntrack_helper_register(helper); 275 if (ret < 0) 276 goto err2; 277 278 list_add_tail(&nfcth->list, &nfnl_cthelper_list); 279 return 0; 280err2: 281 kfree(helper->expect_policy); 282err1: 283 kfree(nfcth); 284 return ret; 285} 286 287static int 288nfnl_cthelper_update_policy_one(const struct nf_conntrack_expect_policy *policy, 289 struct nf_conntrack_expect_policy *new_policy, 290 const struct nlattr *attr) 291{ 292 struct nlattr *tb[NFCTH_POLICY_MAX + 1]; 293 int err; 294 295 err = nla_parse_nested_deprecated(tb, NFCTH_POLICY_MAX, attr, 296 nfnl_cthelper_expect_pol, NULL); 297 if (err < 0) 298 return err; 299 300 if (!tb[NFCTH_POLICY_NAME] || 301 !tb[NFCTH_POLICY_EXPECT_MAX] || 302 !tb[NFCTH_POLICY_EXPECT_TIMEOUT]) 303 return -EINVAL; 304 305 if (nla_strcmp(tb[NFCTH_POLICY_NAME], policy->name)) 306 return -EBUSY; 307 308 new_policy->max_expected = 309 ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX])); 310 if (new_policy->max_expected > NF_CT_EXPECT_MAX_CNT) 311 return -EINVAL; 312 313 new_policy->timeout = 314 ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_TIMEOUT])); 315 316 return 0; 317} 318 319static int nfnl_cthelper_update_policy_all(struct nlattr *tb[], 320 struct nf_conntrack_helper *helper) 321{ 322 struct nf_conntrack_expect_policy *new_policy; 323 struct nf_conntrack_expect_policy *policy; 324 int i, ret = 0; 325 326 new_policy = kmalloc_array(helper->expect_class_max + 1, 327 sizeof(*new_policy), GFP_KERNEL); 328 if (!new_policy) 329 return -ENOMEM; 330 331 /* Check first that all policy attributes are well-formed, so we don't 332 * leave things in inconsistent state on errors. 333 */ 334 for (i = 0; i < helper->expect_class_max + 1; i++) { 335 336 if (!tb[NFCTH_POLICY_SET + i]) { 337 ret = -EINVAL; 338 goto err; 339 } 340 341 ret = nfnl_cthelper_update_policy_one(&helper->expect_policy[i], 342 &new_policy[i], 343 tb[NFCTH_POLICY_SET + i]); 344 if (ret < 0) 345 goto err; 346 } 347 /* Now we can safely update them. */ 348 for (i = 0; i < helper->expect_class_max + 1; i++) { 349 policy = (struct nf_conntrack_expect_policy *) 350 &helper->expect_policy[i]; 351 policy->max_expected = new_policy->max_expected; 352 policy->timeout = new_policy->timeout; 353 } 354 355err: 356 kfree(new_policy); 357 return ret; 358} 359 360static int nfnl_cthelper_update_policy(struct nf_conntrack_helper *helper, 361 const struct nlattr *attr) 362{ 363 struct nlattr *tb[NFCTH_POLICY_SET_MAX + 1]; 364 unsigned int class_max; 365 int err; 366 367 err = nla_parse_nested_deprecated(tb, NFCTH_POLICY_SET_MAX, attr, 368 nfnl_cthelper_expect_policy_set, 369 NULL); 370 if (err < 0) 371 return err; 372 373 if (!tb[NFCTH_POLICY_SET_NUM]) 374 return -EINVAL; 375 376 class_max = ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM])); 377 if (helper->expect_class_max + 1 != class_max) 378 return -EBUSY; 379 380 return nfnl_cthelper_update_policy_all(tb, helper); 381} 382 383static int 384nfnl_cthelper_update(const struct nlattr * const tb[], 385 struct nf_conntrack_helper *helper) 386{ 387 u32 size; 388 int ret; 389 390 if (tb[NFCTH_PRIV_DATA_LEN]) { 391 size = ntohl(nla_get_be32(tb[NFCTH_PRIV_DATA_LEN])); 392 if (size != helper->data_len) 393 return -EBUSY; 394 } 395 396 if (tb[NFCTH_POLICY]) { 397 ret = nfnl_cthelper_update_policy(helper, tb[NFCTH_POLICY]); 398 if (ret < 0) 399 return ret; 400 } 401 if (tb[NFCTH_QUEUE_NUM]) 402 helper->queue_num = ntohl(nla_get_be32(tb[NFCTH_QUEUE_NUM])); 403 404 if (tb[NFCTH_STATUS]) { 405 int status = ntohl(nla_get_be32(tb[NFCTH_STATUS])); 406 407 switch(status) { 408 case NFCT_HELPER_STATUS_ENABLED: 409 helper->flags |= NF_CT_HELPER_F_CONFIGURED; 410 break; 411 case NFCT_HELPER_STATUS_DISABLED: 412 helper->flags &= ~NF_CT_HELPER_F_CONFIGURED; 413 break; 414 } 415 } 416 return 0; 417} 418 419static int nfnl_cthelper_new(struct sk_buff *skb, const struct nfnl_info *info, 420 const struct nlattr * const tb[]) 421{ 422 const char *helper_name; 423 struct nf_conntrack_helper *cur, *helper = NULL; 424 struct nf_conntrack_tuple tuple; 425 struct nfnl_cthelper *nlcth; 426 int ret = 0; 427 428 if (!capable(CAP_NET_ADMIN)) 429 return -EPERM; 430 431 if (!tb[NFCTH_NAME] || !tb[NFCTH_TUPLE]) 432 return -EINVAL; 433 434 helper_name = nla_data(tb[NFCTH_NAME]); 435 436 ret = nfnl_cthelper_parse_tuple(&tuple, tb[NFCTH_TUPLE]); 437 if (ret < 0) 438 return ret; 439 440 list_for_each_entry(nlcth, &nfnl_cthelper_list, list) { 441 cur = &nlcth->helper; 442 443 if (strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN)) 444 continue; 445 446 if ((tuple.src.l3num != cur->tuple.src.l3num || 447 tuple.dst.protonum != cur->tuple.dst.protonum)) 448 continue; 449 450 if (info->nlh->nlmsg_flags & NLM_F_EXCL) 451 return -EEXIST; 452 453 helper = cur; 454 break; 455 } 456 457 if (helper == NULL) 458 ret = nfnl_cthelper_create(tb, &tuple); 459 else 460 ret = nfnl_cthelper_update(tb, helper); 461 462 return ret; 463} 464 465static int 466nfnl_cthelper_dump_tuple(struct sk_buff *skb, 467 struct nf_conntrack_helper *helper) 468{ 469 struct nlattr *nest_parms; 470 471 nest_parms = nla_nest_start(skb, NFCTH_TUPLE); 472 if (nest_parms == NULL) 473 goto nla_put_failure; 474 475 if (nla_put_be16(skb, NFCTH_TUPLE_L3PROTONUM, 476 htons(helper->tuple.src.l3num))) 477 goto nla_put_failure; 478 479 if (nla_put_u8(skb, NFCTH_TUPLE_L4PROTONUM, helper->tuple.dst.protonum)) 480 goto nla_put_failure; 481 482 nla_nest_end(skb, nest_parms); 483 return 0; 484 485nla_put_failure: 486 return -1; 487} 488 489static int 490nfnl_cthelper_dump_policy(struct sk_buff *skb, 491 struct nf_conntrack_helper *helper) 492{ 493 int i; 494 struct nlattr *nest_parms1, *nest_parms2; 495 496 nest_parms1 = nla_nest_start(skb, NFCTH_POLICY); 497 if (nest_parms1 == NULL) 498 goto nla_put_failure; 499 500 if (nla_put_be32(skb, NFCTH_POLICY_SET_NUM, 501 htonl(helper->expect_class_max + 1))) 502 goto nla_put_failure; 503 504 for (i = 0; i < helper->expect_class_max + 1; i++) { 505 nest_parms2 = nla_nest_start(skb, (NFCTH_POLICY_SET + i)); 506 if (nest_parms2 == NULL) 507 goto nla_put_failure; 508 509 if (nla_put_string(skb, NFCTH_POLICY_NAME, 510 helper->expect_policy[i].name)) 511 goto nla_put_failure; 512 513 if (nla_put_be32(skb, NFCTH_POLICY_EXPECT_MAX, 514 htonl(helper->expect_policy[i].max_expected))) 515 goto nla_put_failure; 516 517 if (nla_put_be32(skb, NFCTH_POLICY_EXPECT_TIMEOUT, 518 htonl(helper->expect_policy[i].timeout))) 519 goto nla_put_failure; 520 521 nla_nest_end(skb, nest_parms2); 522 } 523 nla_nest_end(skb, nest_parms1); 524 return 0; 525 526nla_put_failure: 527 return -1; 528} 529 530static int 531nfnl_cthelper_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type, 532 int event, struct nf_conntrack_helper *helper) 533{ 534 struct nlmsghdr *nlh; 535 unsigned int flags = portid ? NLM_F_MULTI : 0; 536 int status; 537 538 event = nfnl_msg_type(NFNL_SUBSYS_CTHELPER, event); 539 nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC, 540 NFNETLINK_V0, 0); 541 if (!nlh) 542 goto nlmsg_failure; 543 544 if (nla_put_string(skb, NFCTH_NAME, helper->name)) 545 goto nla_put_failure; 546 547 if (nla_put_be32(skb, NFCTH_QUEUE_NUM, htonl(helper->queue_num))) 548 goto nla_put_failure; 549 550 if (nfnl_cthelper_dump_tuple(skb, helper) < 0) 551 goto nla_put_failure; 552 553 if (nfnl_cthelper_dump_policy(skb, helper) < 0) 554 goto nla_put_failure; 555 556 if (nla_put_be32(skb, NFCTH_PRIV_DATA_LEN, htonl(helper->data_len))) 557 goto nla_put_failure; 558 559 if (helper->flags & NF_CT_HELPER_F_CONFIGURED) 560 status = NFCT_HELPER_STATUS_ENABLED; 561 else 562 status = NFCT_HELPER_STATUS_DISABLED; 563 564 if (nla_put_be32(skb, NFCTH_STATUS, htonl(status))) 565 goto nla_put_failure; 566 567 nlmsg_end(skb, nlh); 568 return skb->len; 569 570nlmsg_failure: 571nla_put_failure: 572 nlmsg_cancel(skb, nlh); 573 return -1; 574} 575 576static int 577nfnl_cthelper_dump_table(struct sk_buff *skb, struct netlink_callback *cb) 578{ 579 struct nf_conntrack_helper *cur, *last; 580 581 rcu_read_lock(); 582 last = (struct nf_conntrack_helper *)cb->args[1]; 583 for (; cb->args[0] < nf_ct_helper_hsize; cb->args[0]++) { 584restart: 585 hlist_for_each_entry_rcu(cur, 586 &nf_ct_helper_hash[cb->args[0]], hnode) { 587 588 /* skip non-userspace conntrack helpers. */ 589 if (!(cur->flags & NF_CT_HELPER_F_USERSPACE)) 590 continue; 591 592 if (cb->args[1]) { 593 if (cur != last) 594 continue; 595 cb->args[1] = 0; 596 } 597 if (nfnl_cthelper_fill_info(skb, 598 NETLINK_CB(cb->skb).portid, 599 cb->nlh->nlmsg_seq, 600 NFNL_MSG_TYPE(cb->nlh->nlmsg_type), 601 NFNL_MSG_CTHELPER_NEW, cur) < 0) { 602 cb->args[1] = (unsigned long)cur; 603 goto out; 604 } 605 } 606 } 607 if (cb->args[1]) { 608 cb->args[1] = 0; 609 goto restart; 610 } 611out: 612 rcu_read_unlock(); 613 return skb->len; 614} 615 616static int nfnl_cthelper_get(struct sk_buff *skb, const struct nfnl_info *info, 617 const struct nlattr * const tb[]) 618{ 619 int ret = -ENOENT; 620 struct nf_conntrack_helper *cur; 621 struct sk_buff *skb2; 622 char *helper_name = NULL; 623 struct nf_conntrack_tuple tuple; 624 struct nfnl_cthelper *nlcth; 625 bool tuple_set = false; 626 627 if (!capable(CAP_NET_ADMIN)) 628 return -EPERM; 629 630 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 631 struct netlink_dump_control c = { 632 .dump = nfnl_cthelper_dump_table, 633 }; 634 return netlink_dump_start(info->sk, skb, info->nlh, &c); 635 } 636 637 if (tb[NFCTH_NAME]) 638 helper_name = nla_data(tb[NFCTH_NAME]); 639 640 if (tb[NFCTH_TUPLE]) { 641 ret = nfnl_cthelper_parse_tuple(&tuple, tb[NFCTH_TUPLE]); 642 if (ret < 0) 643 return ret; 644 645 tuple_set = true; 646 } 647 648 list_for_each_entry(nlcth, &nfnl_cthelper_list, list) { 649 cur = &nlcth->helper; 650 if (helper_name && 651 strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN)) 652 continue; 653 654 if (tuple_set && 655 (tuple.src.l3num != cur->tuple.src.l3num || 656 tuple.dst.protonum != cur->tuple.dst.protonum)) 657 continue; 658 659 skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 660 if (skb2 == NULL) { 661 ret = -ENOMEM; 662 break; 663 } 664 665 ret = nfnl_cthelper_fill_info(skb2, NETLINK_CB(skb).portid, 666 info->nlh->nlmsg_seq, 667 NFNL_MSG_TYPE(info->nlh->nlmsg_type), 668 NFNL_MSG_CTHELPER_NEW, cur); 669 if (ret <= 0) { 670 kfree_skb(skb2); 671 break; 672 } 673 674 ret = nfnetlink_unicast(skb2, info->net, NETLINK_CB(skb).portid); 675 break; 676 } 677 678 return ret; 679} 680 681static int nfnl_cthelper_del(struct sk_buff *skb, const struct nfnl_info *info, 682 const struct nlattr * const tb[]) 683{ 684 char *helper_name = NULL; 685 struct nf_conntrack_helper *cur; 686 struct nf_conntrack_tuple tuple; 687 bool tuple_set = false, found = false; 688 struct nfnl_cthelper *nlcth, *n; 689 int j = 0, ret; 690 691 if (!capable(CAP_NET_ADMIN)) 692 return -EPERM; 693 694 if (tb[NFCTH_NAME]) 695 helper_name = nla_data(tb[NFCTH_NAME]); 696 697 if (tb[NFCTH_TUPLE]) { 698 ret = nfnl_cthelper_parse_tuple(&tuple, tb[NFCTH_TUPLE]); 699 if (ret < 0) 700 return ret; 701 702 tuple_set = true; 703 } 704 705 ret = -ENOENT; 706 list_for_each_entry_safe(nlcth, n, &nfnl_cthelper_list, list) { 707 cur = &nlcth->helper; 708 j++; 709 710 if (helper_name && 711 strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN)) 712 continue; 713 714 if (tuple_set && 715 (tuple.src.l3num != cur->tuple.src.l3num || 716 tuple.dst.protonum != cur->tuple.dst.protonum)) 717 continue; 718 719 if (refcount_dec_if_one(&cur->refcnt)) { 720 found = true; 721 nf_conntrack_helper_unregister(cur); 722 kfree(cur->expect_policy); 723 724 list_del(&nlcth->list); 725 kfree(nlcth); 726 } else { 727 ret = -EBUSY; 728 } 729 } 730 731 /* Make sure we return success if we flush and there is no helpers */ 732 return (found || j == 0) ? 0 : ret; 733} 734 735static const struct nla_policy nfnl_cthelper_policy[NFCTH_MAX+1] = { 736 [NFCTH_NAME] = { .type = NLA_NUL_STRING, 737 .len = NF_CT_HELPER_NAME_LEN-1 }, 738 [NFCTH_QUEUE_NUM] = { .type = NLA_U32, }, 739 [NFCTH_PRIV_DATA_LEN] = { .type = NLA_U32, }, 740 [NFCTH_STATUS] = { .type = NLA_U32, }, 741}; 742 743static const struct nfnl_callback nfnl_cthelper_cb[NFNL_MSG_CTHELPER_MAX] = { 744 [NFNL_MSG_CTHELPER_NEW] = { 745 .call = nfnl_cthelper_new, 746 .type = NFNL_CB_MUTEX, 747 .attr_count = NFCTH_MAX, 748 .policy = nfnl_cthelper_policy 749 }, 750 [NFNL_MSG_CTHELPER_GET] = { 751 .call = nfnl_cthelper_get, 752 .type = NFNL_CB_MUTEX, 753 .attr_count = NFCTH_MAX, 754 .policy = nfnl_cthelper_policy 755 }, 756 [NFNL_MSG_CTHELPER_DEL] = { 757 .call = nfnl_cthelper_del, 758 .type = NFNL_CB_MUTEX, 759 .attr_count = NFCTH_MAX, 760 .policy = nfnl_cthelper_policy 761 }, 762}; 763 764static const struct nfnetlink_subsystem nfnl_cthelper_subsys = { 765 .name = "cthelper", 766 .subsys_id = NFNL_SUBSYS_CTHELPER, 767 .cb_count = NFNL_MSG_CTHELPER_MAX, 768 .cb = nfnl_cthelper_cb, 769}; 770 771MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTHELPER); 772 773static int __init nfnl_cthelper_init(void) 774{ 775 int ret; 776 777 ret = nfnetlink_subsys_register(&nfnl_cthelper_subsys); 778 if (ret < 0) { 779 pr_err("nfnl_cthelper: cannot register with nfnetlink.\n"); 780 goto err_out; 781 } 782 return 0; 783err_out: 784 return ret; 785} 786 787static void __exit nfnl_cthelper_exit(void) 788{ 789 struct nf_conntrack_helper *cur; 790 struct nfnl_cthelper *nlcth, *n; 791 792 nfnetlink_subsys_unregister(&nfnl_cthelper_subsys); 793 794 list_for_each_entry_safe(nlcth, n, &nfnl_cthelper_list, list) { 795 cur = &nlcth->helper; 796 797 nf_conntrack_helper_unregister(cur); 798 kfree(cur->expect_policy); 799 kfree(nlcth); 800 } 801} 802 803module_init(nfnl_cthelper_init); 804module_exit(nfnl_cthelper_exit); 805