1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * (C) 2012 Pablo Neira Ayuso <pablo@netfilter.org> 4 * 5 * This software has been sponsored by Vyatta Inc. <http://www.vyatta.com> 6 */ 7 #include <linux/init.h> 8 #include <linux/module.h> 9 #include <linux/kernel.h> 10 #include <linux/skbuff.h> 11 #include <linux/netlink.h> 12 #include <linux/rculist.h> 13 #include <linux/slab.h> 14 #include <linux/types.h> 15 #include <linux/list.h> 16 #include <linux/errno.h> 17 #include <linux/capability.h> 18 #include <net/netlink.h> 19 #include <net/sock.h> 20 21 #include <net/netfilter/nf_conntrack_helper.h> 22 #include <net/netfilter/nf_conntrack_expect.h> 23 #include <net/netfilter/nf_conntrack_ecache.h> 24 25 #include <linux/netfilter/nfnetlink.h> 26 #include <linux/netfilter/nfnetlink_conntrack.h> 27 #include <linux/netfilter/nfnetlink_cthelper.h> 28 29 MODULE_LICENSE("GPL"); 30 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>"); 31 MODULE_DESCRIPTION("nfnl_cthelper: User-space connection tracking helpers"); 32 33 struct nfnl_cthelper { 34 struct list_head list; 35 struct nf_conntrack_helper helper; 36 }; 37 38 static LIST_HEAD(nfnl_cthelper_list); 39 40 static int 41 nfnl_userspace_cthelper(struct sk_buff *skb, unsigned int protoff, 42 struct nf_conn *ct, enum ip_conntrack_info ctinfo) 43 { 44 const struct nf_conn_help *help; 45 struct nf_conntrack_helper *helper; 46 47 help = nfct_help(ct); 48 if (help == NULL) 49 return NF_DROP; 50 51 /* rcu_read_lock()ed by nf_hook_thresh */ 52 helper = rcu_dereference(help->helper); 53 if (helper == NULL) 54 return NF_DROP; 55 56 /* This is a user-space helper not yet configured, skip. */ 57 if ((helper->flags & 58 (NF_CT_HELPER_F_USERSPACE | NF_CT_HELPER_F_CONFIGURED)) == 59 NF_CT_HELPER_F_USERSPACE) 60 return NF_ACCEPT; 61 62 /* If the user-space helper is not available, don't block traffic. */ 63 return NF_QUEUE_NR(helper->queue_num) | NF_VERDICT_FLAG_QUEUE_BYPASS; 64 } 65 66 static const struct nla_policy nfnl_cthelper_tuple_pol[NFCTH_TUPLE_MAX+1] = { 67 [NFCTH_TUPLE_L3PROTONUM] = { .type = NLA_U16, }, 68 [NFCTH_TUPLE_L4PROTONUM] = { .type = NLA_U8, }, 69 }; 70 71 static int 72 nfnl_cthelper_parse_tuple(struct nf_conntrack_tuple *tuple, 73 const struct nlattr *attr) 74 { 75 int err; 76 struct nlattr *tb[NFCTH_TUPLE_MAX+1]; 77 78 err = nla_parse_nested_deprecated(tb, NFCTH_TUPLE_MAX, attr, 79 nfnl_cthelper_tuple_pol, NULL); 80 if (err < 0) 81 return err; 82 83 if (!tb[NFCTH_TUPLE_L3PROTONUM] || !tb[NFCTH_TUPLE_L4PROTONUM]) 84 return -EINVAL; 85 86 /* Not all fields are initialized so first zero the tuple */ 87 memset(tuple, 0, sizeof(struct nf_conntrack_tuple)); 88 89 tuple->src.l3num = ntohs(nla_get_be16(tb[NFCTH_TUPLE_L3PROTONUM])); 90 tuple->dst.protonum = nla_get_u8(tb[NFCTH_TUPLE_L4PROTONUM]); 91 92 return 0; 93 } 94 95 static int 96 nfnl_cthelper_from_nlattr(struct nlattr *attr, struct nf_conn *ct) 97 { 98 struct nf_conn_help *help = nfct_help(ct); 99 100 if (attr == NULL) 101 return -EINVAL; 102 103 if (help->helper->data_len == 0) 104 return -EINVAL; 105 106 nla_memcpy(help->data, nla_data(attr), sizeof(help->data)); 107 return 0; 108 } 109 110 static int 111 nfnl_cthelper_to_nlattr(struct sk_buff *skb, const struct nf_conn *ct) 112 { 113 const struct nf_conn_help *help = nfct_help(ct); 114 115 if (help->helper->data_len && 116 nla_put(skb, CTA_HELP_INFO, help->helper->data_len, &help->data)) 117 goto nla_put_failure; 118 119 return 0; 120 121 nla_put_failure: 122 return -ENOSPC; 123 } 124 125 static const struct nla_policy nfnl_cthelper_expect_pol[NFCTH_POLICY_MAX+1] = { 126 [NFCTH_POLICY_NAME] = { .type = NLA_NUL_STRING, 127 .len = NF_CT_HELPER_NAME_LEN-1 }, 128 [NFCTH_POLICY_EXPECT_MAX] = { .type = NLA_U32, }, 129 [NFCTH_POLICY_EXPECT_TIMEOUT] = { .type = NLA_U32, }, 130 }; 131 132 static int 133 nfnl_cthelper_expect_policy(struct nf_conntrack_expect_policy *expect_policy, 134 const struct nlattr *attr) 135 { 136 int err; 137 struct nlattr *tb[NFCTH_POLICY_MAX+1]; 138 139 err = nla_parse_nested_deprecated(tb, NFCTH_POLICY_MAX, attr, 140 nfnl_cthelper_expect_pol, NULL); 141 if (err < 0) 142 return err; 143 144 if (!tb[NFCTH_POLICY_NAME] || 145 !tb[NFCTH_POLICY_EXPECT_MAX] || 146 !tb[NFCTH_POLICY_EXPECT_TIMEOUT]) 147 return -EINVAL; 148 149 nla_strlcpy(expect_policy->name, 150 tb[NFCTH_POLICY_NAME], NF_CT_HELPER_NAME_LEN); 151 expect_policy->max_expected = 152 ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX])); 153 if (expect_policy->max_expected > NF_CT_EXPECT_MAX_CNT) 154 return -EINVAL; 155 156 expect_policy->timeout = 157 ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_TIMEOUT])); 158 159 return 0; 160 } 161 162 static const struct nla_policy 163 nfnl_cthelper_expect_policy_set[NFCTH_POLICY_SET_MAX+1] = { 164 [NFCTH_POLICY_SET_NUM] = { .type = NLA_U32, }, 165 }; 166 167 static int 168 nfnl_cthelper_parse_expect_policy(struct nf_conntrack_helper *helper, 169 const struct nlattr *attr) 170 { 171 int i, ret; 172 struct nf_conntrack_expect_policy *expect_policy; 173 struct nlattr *tb[NFCTH_POLICY_SET_MAX+1]; 174 unsigned int class_max; 175 176 ret = nla_parse_nested_deprecated(tb, NFCTH_POLICY_SET_MAX, attr, 177 nfnl_cthelper_expect_policy_set, 178 NULL); 179 if (ret < 0) 180 return ret; 181 182 if (!tb[NFCTH_POLICY_SET_NUM]) 183 return -EINVAL; 184 185 class_max = ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM])); 186 if (class_max == 0) 187 return -EINVAL; 188 if (class_max > NF_CT_MAX_EXPECT_CLASSES) 189 return -EOVERFLOW; 190 191 expect_policy = kcalloc(class_max, 192 sizeof(struct nf_conntrack_expect_policy), 193 GFP_KERNEL); 194 if (expect_policy == NULL) 195 return -ENOMEM; 196 197 for (i = 0; i < class_max; i++) { 198 if (!tb[NFCTH_POLICY_SET+i]) 199 goto err; 200 201 ret = nfnl_cthelper_expect_policy(&expect_policy[i], 202 tb[NFCTH_POLICY_SET+i]); 203 if (ret < 0) 204 goto err; 205 } 206 207 helper->expect_class_max = class_max - 1; 208 helper->expect_policy = expect_policy; 209 return 0; 210 err: 211 kfree(expect_policy); 212 return -EINVAL; 213 } 214 215 static int 216 nfnl_cthelper_create(const struct nlattr * const tb[], 217 struct nf_conntrack_tuple *tuple) 218 { 219 struct nf_conntrack_helper *helper; 220 struct nfnl_cthelper *nfcth; 221 unsigned int size; 222 int ret; 223 224 if (!tb[NFCTH_TUPLE] || !tb[NFCTH_POLICY] || !tb[NFCTH_PRIV_DATA_LEN]) 225 return -EINVAL; 226 227 nfcth = kzalloc(sizeof(*nfcth), GFP_KERNEL); 228 if (nfcth == NULL) 229 return -ENOMEM; 230 helper = &nfcth->helper; 231 232 ret = nfnl_cthelper_parse_expect_policy(helper, tb[NFCTH_POLICY]); 233 if (ret < 0) 234 goto err1; 235 236 nla_strlcpy(helper->name, 237 tb[NFCTH_NAME], NF_CT_HELPER_NAME_LEN); 238 size = ntohl(nla_get_be32(tb[NFCTH_PRIV_DATA_LEN])); 239 if (size > FIELD_SIZEOF(struct nf_conn_help, data)) { 240 ret = -ENOMEM; 241 goto err2; 242 } 243 244 helper->flags |= NF_CT_HELPER_F_USERSPACE; 245 memcpy(&helper->tuple, tuple, sizeof(struct nf_conntrack_tuple)); 246 247 helper->me = THIS_MODULE; 248 helper->help = nfnl_userspace_cthelper; 249 helper->from_nlattr = nfnl_cthelper_from_nlattr; 250 helper->to_nlattr = nfnl_cthelper_to_nlattr; 251 252 /* Default to queue number zero, this can be updated at any time. */ 253 if (tb[NFCTH_QUEUE_NUM]) 254 helper->queue_num = ntohl(nla_get_be32(tb[NFCTH_QUEUE_NUM])); 255 256 if (tb[NFCTH_STATUS]) { 257 int status = ntohl(nla_get_be32(tb[NFCTH_STATUS])); 258 259 switch(status) { 260 case NFCT_HELPER_STATUS_ENABLED: 261 helper->flags |= NF_CT_HELPER_F_CONFIGURED; 262 break; 263 case NFCT_HELPER_STATUS_DISABLED: 264 helper->flags &= ~NF_CT_HELPER_F_CONFIGURED; 265 break; 266 } 267 } 268 269 ret = nf_conntrack_helper_register(helper); 270 if (ret < 0) 271 goto err2; 272 273 list_add_tail(&nfcth->list, &nfnl_cthelper_list); 274 return 0; 275 err2: 276 kfree(helper->expect_policy); 277 err1: 278 kfree(nfcth); 279 return ret; 280 } 281 282 static int 283 nfnl_cthelper_update_policy_one(const struct nf_conntrack_expect_policy *policy, 284 struct nf_conntrack_expect_policy *new_policy, 285 const struct nlattr *attr) 286 { 287 struct nlattr *tb[NFCTH_POLICY_MAX + 1]; 288 int err; 289 290 err = nla_parse_nested_deprecated(tb, NFCTH_POLICY_MAX, attr, 291 nfnl_cthelper_expect_pol, NULL); 292 if (err < 0) 293 return err; 294 295 if (!tb[NFCTH_POLICY_NAME] || 296 !tb[NFCTH_POLICY_EXPECT_MAX] || 297 !tb[NFCTH_POLICY_EXPECT_TIMEOUT]) 298 return -EINVAL; 299 300 if (nla_strcmp(tb[NFCTH_POLICY_NAME], policy->name)) 301 return -EBUSY; 302 303 new_policy->max_expected = 304 ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX])); 305 if (new_policy->max_expected > NF_CT_EXPECT_MAX_CNT) 306 return -EINVAL; 307 308 new_policy->timeout = 309 ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_TIMEOUT])); 310 311 return 0; 312 } 313 314 static int nfnl_cthelper_update_policy_all(struct nlattr *tb[], 315 struct nf_conntrack_helper *helper) 316 { 317 struct nf_conntrack_expect_policy *new_policy; 318 struct nf_conntrack_expect_policy *policy; 319 int i, ret = 0; 320 321 new_policy = kmalloc_array(helper->expect_class_max + 1, 322 sizeof(*new_policy), GFP_KERNEL); 323 if (!new_policy) 324 return -ENOMEM; 325 326 /* Check first that all policy attributes are well-formed, so we don't 327 * leave things in inconsistent state on errors. 328 */ 329 for (i = 0; i < helper->expect_class_max + 1; i++) { 330 331 if (!tb[NFCTH_POLICY_SET + i]) { 332 ret = -EINVAL; 333 goto err; 334 } 335 336 ret = nfnl_cthelper_update_policy_one(&helper->expect_policy[i], 337 &new_policy[i], 338 tb[NFCTH_POLICY_SET + i]); 339 if (ret < 0) 340 goto err; 341 } 342 /* Now we can safely update them. */ 343 for (i = 0; i < helper->expect_class_max + 1; i++) { 344 policy = (struct nf_conntrack_expect_policy *) 345 &helper->expect_policy[i]; 346 policy->max_expected = new_policy->max_expected; 347 policy->timeout = new_policy->timeout; 348 } 349 350 err: 351 kfree(new_policy); 352 return ret; 353 } 354 355 static int nfnl_cthelper_update_policy(struct nf_conntrack_helper *helper, 356 const struct nlattr *attr) 357 { 358 struct nlattr *tb[NFCTH_POLICY_SET_MAX + 1]; 359 unsigned int class_max; 360 int err; 361 362 err = nla_parse_nested_deprecated(tb, NFCTH_POLICY_SET_MAX, attr, 363 nfnl_cthelper_expect_policy_set, 364 NULL); 365 if (err < 0) 366 return err; 367 368 if (!tb[NFCTH_POLICY_SET_NUM]) 369 return -EINVAL; 370 371 class_max = ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM])); 372 if (helper->expect_class_max + 1 != class_max) 373 return -EBUSY; 374 375 return nfnl_cthelper_update_policy_all(tb, helper); 376 } 377 378 static int 379 nfnl_cthelper_update(const struct nlattr * const tb[], 380 struct nf_conntrack_helper *helper) 381 { 382 int ret; 383 384 if (tb[NFCTH_PRIV_DATA_LEN]) 385 return -EBUSY; 386 387 if (tb[NFCTH_POLICY]) { 388 ret = nfnl_cthelper_update_policy(helper, tb[NFCTH_POLICY]); 389 if (ret < 0) 390 return ret; 391 } 392 if (tb[NFCTH_QUEUE_NUM]) 393 helper->queue_num = ntohl(nla_get_be32(tb[NFCTH_QUEUE_NUM])); 394 395 if (tb[NFCTH_STATUS]) { 396 int status = ntohl(nla_get_be32(tb[NFCTH_STATUS])); 397 398 switch(status) { 399 case NFCT_HELPER_STATUS_ENABLED: 400 helper->flags |= NF_CT_HELPER_F_CONFIGURED; 401 break; 402 case NFCT_HELPER_STATUS_DISABLED: 403 helper->flags &= ~NF_CT_HELPER_F_CONFIGURED; 404 break; 405 } 406 } 407 return 0; 408 } 409 410 static int nfnl_cthelper_new(struct net *net, struct sock *nfnl, 411 struct sk_buff *skb, const struct nlmsghdr *nlh, 412 const struct nlattr * const tb[], 413 struct netlink_ext_ack *extack) 414 { 415 const char *helper_name; 416 struct nf_conntrack_helper *cur, *helper = NULL; 417 struct nf_conntrack_tuple tuple; 418 struct nfnl_cthelper *nlcth; 419 int ret = 0; 420 421 if (!capable(CAP_NET_ADMIN)) 422 return -EPERM; 423 424 if (!tb[NFCTH_NAME] || !tb[NFCTH_TUPLE]) 425 return -EINVAL; 426 427 helper_name = nla_data(tb[NFCTH_NAME]); 428 429 ret = nfnl_cthelper_parse_tuple(&tuple, tb[NFCTH_TUPLE]); 430 if (ret < 0) 431 return ret; 432 433 list_for_each_entry(nlcth, &nfnl_cthelper_list, list) { 434 cur = &nlcth->helper; 435 436 if (strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN)) 437 continue; 438 439 if ((tuple.src.l3num != cur->tuple.src.l3num || 440 tuple.dst.protonum != cur->tuple.dst.protonum)) 441 continue; 442 443 if (nlh->nlmsg_flags & NLM_F_EXCL) 444 return -EEXIST; 445 446 helper = cur; 447 break; 448 } 449 450 if (helper == NULL) 451 ret = nfnl_cthelper_create(tb, &tuple); 452 else 453 ret = nfnl_cthelper_update(tb, helper); 454 455 return ret; 456 } 457 458 static int 459 nfnl_cthelper_dump_tuple(struct sk_buff *skb, 460 struct nf_conntrack_helper *helper) 461 { 462 struct nlattr *nest_parms; 463 464 nest_parms = nla_nest_start(skb, NFCTH_TUPLE); 465 if (nest_parms == NULL) 466 goto nla_put_failure; 467 468 if (nla_put_be16(skb, NFCTH_TUPLE_L3PROTONUM, 469 htons(helper->tuple.src.l3num))) 470 goto nla_put_failure; 471 472 if (nla_put_u8(skb, NFCTH_TUPLE_L4PROTONUM, helper->tuple.dst.protonum)) 473 goto nla_put_failure; 474 475 nla_nest_end(skb, nest_parms); 476 return 0; 477 478 nla_put_failure: 479 return -1; 480 } 481 482 static int 483 nfnl_cthelper_dump_policy(struct sk_buff *skb, 484 struct nf_conntrack_helper *helper) 485 { 486 int i; 487 struct nlattr *nest_parms1, *nest_parms2; 488 489 nest_parms1 = nla_nest_start(skb, NFCTH_POLICY); 490 if (nest_parms1 == NULL) 491 goto nla_put_failure; 492 493 if (nla_put_be32(skb, NFCTH_POLICY_SET_NUM, 494 htonl(helper->expect_class_max + 1))) 495 goto nla_put_failure; 496 497 for (i = 0; i < helper->expect_class_max + 1; i++) { 498 nest_parms2 = nla_nest_start(skb, (NFCTH_POLICY_SET + i)); 499 if (nest_parms2 == NULL) 500 goto nla_put_failure; 501 502 if (nla_put_string(skb, NFCTH_POLICY_NAME, 503 helper->expect_policy[i].name)) 504 goto nla_put_failure; 505 506 if (nla_put_be32(skb, NFCTH_POLICY_EXPECT_MAX, 507 htonl(helper->expect_policy[i].max_expected))) 508 goto nla_put_failure; 509 510 if (nla_put_be32(skb, NFCTH_POLICY_EXPECT_TIMEOUT, 511 htonl(helper->expect_policy[i].timeout))) 512 goto nla_put_failure; 513 514 nla_nest_end(skb, nest_parms2); 515 } 516 nla_nest_end(skb, nest_parms1); 517 return 0; 518 519 nla_put_failure: 520 return -1; 521 } 522 523 static int 524 nfnl_cthelper_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type, 525 int event, struct nf_conntrack_helper *helper) 526 { 527 struct nlmsghdr *nlh; 528 struct nfgenmsg *nfmsg; 529 unsigned int flags = portid ? NLM_F_MULTI : 0; 530 int status; 531 532 event = nfnl_msg_type(NFNL_SUBSYS_CTHELPER, event); 533 nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags); 534 if (nlh == NULL) 535 goto nlmsg_failure; 536 537 nfmsg = nlmsg_data(nlh); 538 nfmsg->nfgen_family = AF_UNSPEC; 539 nfmsg->version = NFNETLINK_V0; 540 nfmsg->res_id = 0; 541 542 if (nla_put_string(skb, NFCTH_NAME, helper->name)) 543 goto nla_put_failure; 544 545 if (nla_put_be32(skb, NFCTH_QUEUE_NUM, htonl(helper->queue_num))) 546 goto nla_put_failure; 547 548 if (nfnl_cthelper_dump_tuple(skb, helper) < 0) 549 goto nla_put_failure; 550 551 if (nfnl_cthelper_dump_policy(skb, helper) < 0) 552 goto nla_put_failure; 553 554 if (nla_put_be32(skb, NFCTH_PRIV_DATA_LEN, htonl(helper->data_len))) 555 goto nla_put_failure; 556 557 if (helper->flags & NF_CT_HELPER_F_CONFIGURED) 558 status = NFCT_HELPER_STATUS_ENABLED; 559 else 560 status = NFCT_HELPER_STATUS_DISABLED; 561 562 if (nla_put_be32(skb, NFCTH_STATUS, htonl(status))) 563 goto nla_put_failure; 564 565 nlmsg_end(skb, nlh); 566 return skb->len; 567 568 nlmsg_failure: 569 nla_put_failure: 570 nlmsg_cancel(skb, nlh); 571 return -1; 572 } 573 574 static int 575 nfnl_cthelper_dump_table(struct sk_buff *skb, struct netlink_callback *cb) 576 { 577 struct nf_conntrack_helper *cur, *last; 578 579 rcu_read_lock(); 580 last = (struct nf_conntrack_helper *)cb->args[1]; 581 for (; cb->args[0] < nf_ct_helper_hsize; cb->args[0]++) { 582 restart: 583 hlist_for_each_entry_rcu(cur, 584 &nf_ct_helper_hash[cb->args[0]], hnode) { 585 586 /* skip non-userspace conntrack helpers. */ 587 if (!(cur->flags & NF_CT_HELPER_F_USERSPACE)) 588 continue; 589 590 if (cb->args[1]) { 591 if (cur != last) 592 continue; 593 cb->args[1] = 0; 594 } 595 if (nfnl_cthelper_fill_info(skb, 596 NETLINK_CB(cb->skb).portid, 597 cb->nlh->nlmsg_seq, 598 NFNL_MSG_TYPE(cb->nlh->nlmsg_type), 599 NFNL_MSG_CTHELPER_NEW, cur) < 0) { 600 cb->args[1] = (unsigned long)cur; 601 goto out; 602 } 603 } 604 } 605 if (cb->args[1]) { 606 cb->args[1] = 0; 607 goto restart; 608 } 609 out: 610 rcu_read_unlock(); 611 return skb->len; 612 } 613 614 static int nfnl_cthelper_get(struct net *net, struct sock *nfnl, 615 struct sk_buff *skb, const struct nlmsghdr *nlh, 616 const struct nlattr * const tb[], 617 struct netlink_ext_ack *extack) 618 { 619 int ret = -ENOENT; 620 struct nf_conntrack_helper *cur; 621 struct sk_buff *skb2; 622 char *helper_name = NULL; 623 struct nf_conntrack_tuple tuple; 624 struct nfnl_cthelper *nlcth; 625 bool tuple_set = false; 626 627 if (!capable(CAP_NET_ADMIN)) 628 return -EPERM; 629 630 if (nlh->nlmsg_flags & NLM_F_DUMP) { 631 struct netlink_dump_control c = { 632 .dump = nfnl_cthelper_dump_table, 633 }; 634 return netlink_dump_start(nfnl, skb, nlh, &c); 635 } 636 637 if (tb[NFCTH_NAME]) 638 helper_name = nla_data(tb[NFCTH_NAME]); 639 640 if (tb[NFCTH_TUPLE]) { 641 ret = nfnl_cthelper_parse_tuple(&tuple, tb[NFCTH_TUPLE]); 642 if (ret < 0) 643 return ret; 644 645 tuple_set = true; 646 } 647 648 list_for_each_entry(nlcth, &nfnl_cthelper_list, list) { 649 cur = &nlcth->helper; 650 if (helper_name && 651 strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN)) 652 continue; 653 654 if (tuple_set && 655 (tuple.src.l3num != cur->tuple.src.l3num || 656 tuple.dst.protonum != cur->tuple.dst.protonum)) 657 continue; 658 659 skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 660 if (skb2 == NULL) { 661 ret = -ENOMEM; 662 break; 663 } 664 665 ret = nfnl_cthelper_fill_info(skb2, NETLINK_CB(skb).portid, 666 nlh->nlmsg_seq, 667 NFNL_MSG_TYPE(nlh->nlmsg_type), 668 NFNL_MSG_CTHELPER_NEW, cur); 669 if (ret <= 0) { 670 kfree_skb(skb2); 671 break; 672 } 673 674 ret = netlink_unicast(nfnl, skb2, NETLINK_CB(skb).portid, 675 MSG_DONTWAIT); 676 if (ret > 0) 677 ret = 0; 678 679 /* this avoids a loop in nfnetlink. */ 680 return ret == -EAGAIN ? -ENOBUFS : ret; 681 } 682 return ret; 683 } 684 685 static int nfnl_cthelper_del(struct net *net, struct sock *nfnl, 686 struct sk_buff *skb, const struct nlmsghdr *nlh, 687 const struct nlattr * const tb[], 688 struct netlink_ext_ack *extack) 689 { 690 char *helper_name = NULL; 691 struct nf_conntrack_helper *cur; 692 struct nf_conntrack_tuple tuple; 693 bool tuple_set = false, found = false; 694 struct nfnl_cthelper *nlcth, *n; 695 int j = 0, ret; 696 697 if (!capable(CAP_NET_ADMIN)) 698 return -EPERM; 699 700 if (tb[NFCTH_NAME]) 701 helper_name = nla_data(tb[NFCTH_NAME]); 702 703 if (tb[NFCTH_TUPLE]) { 704 ret = nfnl_cthelper_parse_tuple(&tuple, tb[NFCTH_TUPLE]); 705 if (ret < 0) 706 return ret; 707 708 tuple_set = true; 709 } 710 711 ret = -ENOENT; 712 list_for_each_entry_safe(nlcth, n, &nfnl_cthelper_list, list) { 713 cur = &nlcth->helper; 714 j++; 715 716 if (helper_name && 717 strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN)) 718 continue; 719 720 if (tuple_set && 721 (tuple.src.l3num != cur->tuple.src.l3num || 722 tuple.dst.protonum != cur->tuple.dst.protonum)) 723 continue; 724 725 if (refcount_dec_if_one(&cur->refcnt)) { 726 found = true; 727 nf_conntrack_helper_unregister(cur); 728 kfree(cur->expect_policy); 729 730 list_del(&nlcth->list); 731 kfree(nlcth); 732 } else { 733 ret = -EBUSY; 734 } 735 } 736 737 /* Make sure we return success if we flush and there is no helpers */ 738 return (found || j == 0) ? 0 : ret; 739 } 740 741 static const struct nla_policy nfnl_cthelper_policy[NFCTH_MAX+1] = { 742 [NFCTH_NAME] = { .type = NLA_NUL_STRING, 743 .len = NF_CT_HELPER_NAME_LEN-1 }, 744 [NFCTH_QUEUE_NUM] = { .type = NLA_U32, }, 745 }; 746 747 static const struct nfnl_callback nfnl_cthelper_cb[NFNL_MSG_CTHELPER_MAX] = { 748 [NFNL_MSG_CTHELPER_NEW] = { .call = nfnl_cthelper_new, 749 .attr_count = NFCTH_MAX, 750 .policy = nfnl_cthelper_policy }, 751 [NFNL_MSG_CTHELPER_GET] = { .call = nfnl_cthelper_get, 752 .attr_count = NFCTH_MAX, 753 .policy = nfnl_cthelper_policy }, 754 [NFNL_MSG_CTHELPER_DEL] = { .call = nfnl_cthelper_del, 755 .attr_count = NFCTH_MAX, 756 .policy = nfnl_cthelper_policy }, 757 }; 758 759 static const struct nfnetlink_subsystem nfnl_cthelper_subsys = { 760 .name = "cthelper", 761 .subsys_id = NFNL_SUBSYS_CTHELPER, 762 .cb_count = NFNL_MSG_CTHELPER_MAX, 763 .cb = nfnl_cthelper_cb, 764 }; 765 766 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTHELPER); 767 768 static int __init nfnl_cthelper_init(void) 769 { 770 int ret; 771 772 ret = nfnetlink_subsys_register(&nfnl_cthelper_subsys); 773 if (ret < 0) { 774 pr_err("nfnl_cthelper: cannot register with nfnetlink.\n"); 775 goto err_out; 776 } 777 return 0; 778 err_out: 779 return ret; 780 } 781 782 static void __exit nfnl_cthelper_exit(void) 783 { 784 struct nf_conntrack_helper *cur; 785 struct nfnl_cthelper *nlcth, *n; 786 787 nfnetlink_subsys_unregister(&nfnl_cthelper_subsys); 788 789 list_for_each_entry_safe(nlcth, n, &nfnl_cthelper_list, list) { 790 cur = &nlcth->helper; 791 792 nf_conntrack_helper_unregister(cur); 793 kfree(cur->expect_policy); 794 kfree(nlcth); 795 } 796 } 797 798 module_init(nfnl_cthelper_init); 799 module_exit(nfnl_cthelper_exit); 800