netfilter: ctnetlink: allow to set expectation class

This patch allows you to set the expectation class.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 11 insertions, 1 deletions

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 1b0aea620d62..b6ea39770c80 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1691,6 +1691,7 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb,
         NLA_PUT_BE32(skb, CTA_EXPECT_TIMEOUT, htonl(timeout));
         NLA_PUT_BE32(skb, CTA_EXPECT_ID, htonl((unsigned long)exp));
         NLA_PUT_BE32(skb, CTA_EXPECT_FLAGS, htonl(exp->flags));
+        NLA_PUT_BE32(skb, CTA_EXPECT_CLASS, htonl(exp->class));
         help = nfct_help(master);
         if (help) {
                 struct nf_conntrack_helper *helper;
@@ -1856,6 +1857,7 @@ static const struct nla_policy exp_nla_policy[CTA_EXPECT_MAX+1] = {
         [CTA_EXPECT_HELP_NAME]  = { .type = NLA_NUL_STRING },
         [CTA_EXPECT_ZONE]       = { .type = NLA_U16 },
         [CTA_EXPECT_FLAGS]      = { .type = NLA_U32 },
+        [CTA_EXPECT_CLASS]      = { .type = NLA_U32 },
 };
 
 static int
@@ -2043,6 +2045,7 @@ ctnetlink_create_expect(struct net *net, u16 zone,
         struct nf_conn *ct;
         struct nf_conn_help *help;
         struct nf_conntrack_helper *helper = NULL;
+        u_int32_t class = 0;
         int err = 0;
 
         /* caller guarantees that those three CTA_EXPECT_* exist */
@@ -2088,6 +2091,13 @@ ctnetlink_create_expect(struct net *net, u16 zone,
                 }
         }
 
+        if (cda[CTA_EXPECT_CLASS] && helper) {
+                class = ntohl(nla_get_be32(cda[CTA_EXPECT_CLASS]));
+                if (class > helper->expect_class_max) {
+                        err = -EINVAL;
+                        goto out;
+                }
+        }
         exp = nf_ct_expect_alloc(ct);
         if (!exp) {
                 err = -ENOMEM;
@@ -2115,7 +2125,7 @@ ctnetlink_create_expect(struct net *net, u16 zone,
                         exp->flags = 0;
         }
 
-        exp->class = 0;
+        exp->class = class;
         exp->expectfn = NULL;
         exp->master = ct;
         exp->helper = helper;