/*
 * (C) 2005-2012 by Pablo Neira Ayuso <pablo@netfilter.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This code has been sponsored by Vyatta Inc. <http://www.vyatta.com>
 */

#include "internal/internal.h"
#include <libmnl/libmnl.h>
#include <limits.h>
#include <endian.h>

static int
nfct_parse_ip_attr_cb(const struct nlattr *attr, void *data)
{
	const struct nlattr **tb = data;
	int type = mnl_attr_get_type(attr);

	/* skip unsupported attribute in user-space */
	if (mnl_attr_type_valid(attr, CTA_IP_MAX) < 0)
		return MNL_CB_OK;

	switch(type) {
	case CTA_IP_V4_SRC:
	case CTA_IP_V4_DST:
		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
			return MNL_CB_ERROR;
		break;
	case CTA_IP_V6_SRC:
	case CTA_IP_V6_DST:
		if (mnl_attr_validate2(attr, MNL_TYPE_UNSPEC,
				       sizeof(struct in6_addr)) < 0) {
			return MNL_CB_ERROR;
		}
		break;
	}
	tb[type] = attr;
	return MNL_CB_OK;
}

static int
nfct_parse_ip(const struct nlattr *attr, struct __nfct_tuple *tuple,
	     const int dir, uint32_t *set)
{
	struct nlattr *tb[CTA_IP_MAX+1] = {};

	if (mnl_attr_parse_nested(attr, nfct_parse_ip_attr_cb, tb) < 0)
		return -1;

	if (tb[CTA_IP_V4_SRC]) {
		tuple->src.v4 = mnl_attr_get_u32(tb[CTA_IP_V4_SRC]);
		switch(dir) {
		case __DIR_ORIG:
			set_bit(ATTR_ORIG_IPV4_SRC, set);
			break;
		case __DIR_REPL:
			set_bit(ATTR_REPL_IPV4_SRC, set);
			break;
		case __DIR_MASTER:
			set_bit(ATTR_MASTER_IPV4_SRC, set);
			break;
		}
	}

	if (tb[CTA_IP_V4_DST]) {
		tuple->dst.v4 = mnl_attr_get_u32(tb[CTA_IP_V4_DST]);
		switch(dir) {
		case __DIR_ORIG:
			set_bit(ATTR_ORIG_IPV4_DST, set);
			break;
		case __DIR_REPL:
			set_bit(ATTR_REPL_IPV4_DST, set);
			break;
		case __DIR_MASTER:
			set_bit(ATTR_MASTER_IPV4_DST, set);
			break;
		}
	}

	if (tb[CTA_IP_V6_SRC]) {
		memcpy(&tuple->src.v6, mnl_attr_get_payload(tb[CTA_IP_V6_SRC]),
		       sizeof(struct in6_addr));
		switch(dir) {
		case __DIR_ORIG:
			set_bit(ATTR_ORIG_IPV6_SRC, set);
			break;
		case __DIR_REPL:
			set_bit(ATTR_REPL_IPV6_SRC, set);
			break;
		case __DIR_MASTER:
			set_bit(ATTR_MASTER_IPV6_SRC, set);
			break;
		}
	}

	if (tb[CTA_IP_V6_DST]) {
		memcpy(&tuple->dst.v6, mnl_attr_get_payload(tb[CTA_IP_V6_DST]),
		       sizeof(struct in6_addr));
		switch(dir) {
		case __DIR_ORIG:
			set_bit(ATTR_ORIG_IPV6_DST, set);
			break;
		case __DIR_REPL:
			set_bit(ATTR_REPL_IPV6_DST, set);
			break;
		case __DIR_MASTER:
			set_bit(ATTR_MASTER_IPV6_DST, set);
			break;
		}
	}
	return 0;
}

static int
nfct_parse_proto_attr_cb(const struct nlattr *attr, void *data)
{
	const struct nlattr **tb = data;
	int type = mnl_attr_get_type(attr);

	if (mnl_attr_type_valid(attr, CTA_PROTO_MAX) < 0)
		return MNL_CB_OK;

	switch(type) {
	case CTA_PROTO_SRC_PORT:
	case CTA_PROTO_DST_PORT:
	case CTA_PROTO_ICMP_ID:
	case CTA_PROTO_ICMPV6_ID:
		if (mnl_attr_validate(attr, MNL_TYPE_U16) < 0)
			return MNL_CB_ERROR;
		break;
	case CTA_PROTO_NUM:
	case CTA_PROTO_ICMP_TYPE:
	case CTA_PROTO_ICMP_CODE:
	case CTA_PROTO_ICMPV6_TYPE:
	case CTA_PROTO_ICMPV6_CODE:
		if (mnl_attr_validate(attr, MNL_TYPE_U8) < 0)
			return MNL_CB_ERROR;
		break;
	}
	tb[type] = attr;
	return MNL_CB_OK;
}

static int
nfct_parse_proto(const struct nlattr *attr, struct __nfct_tuple *tuple,
		const int dir, uint32_t *set)
{
	struct nlattr *tb[CTA_PROTO_MAX+1] = {};

	if (mnl_attr_parse_nested(attr, nfct_parse_proto_attr_cb, tb) < 0)
		return -1;

	if (tb[CTA_PROTO_NUM]) {
		tuple->protonum = mnl_attr_get_u8(tb[CTA_PROTO_NUM]);
		switch(dir) {
		case __DIR_ORIG:
			set_bit(ATTR_ORIG_L4PROTO, set);
			break;
		case __DIR_REPL:
			set_bit(ATTR_REPL_L4PROTO, set);
			break;
		case __DIR_MASTER:
			set_bit(ATTR_MASTER_L4PROTO, set);
			break;
		}
	}

	if (tb[CTA_PROTO_SRC_PORT]) {
		tuple->l4src.tcp.port =
			mnl_attr_get_u16(tb[CTA_PROTO_SRC_PORT]);
		switch(dir) {
		case __DIR_ORIG:
			set_bit(ATTR_ORIG_PORT_SRC, set);
			break;
		case __DIR_REPL:
			set_bit(ATTR_REPL_PORT_SRC, set);
			break;
		case __DIR_MASTER:
			set_bit(ATTR_MASTER_PORT_SRC, set);
			break;
		}
	}

	if (tb[CTA_PROTO_DST_PORT]) {
		tuple->l4dst.tcp.port =
			mnl_attr_get_u16(tb[CTA_PROTO_DST_PORT]);
		switch(dir) {
		case __DIR_ORIG:
			set_bit(ATTR_ORIG_PORT_DST, set);
			break;
		case __DIR_REPL:
			set_bit(ATTR_REPL_PORT_DST, set);
			break;
		case __DIR_MASTER:
			set_bit(ATTR_MASTER_PORT_DST, set);
			break;
		}
	}

	if (tb[CTA_PROTO_ICMP_TYPE]) {
		tuple->l4dst.icmp.type =
			mnl_attr_get_u8(tb[CTA_PROTO_ICMP_TYPE]);
		set_bit(ATTR_ICMP_TYPE, set);
	}

	if (tb[CTA_PROTO_ICMP_CODE]) {
		tuple->l4dst.icmp.code =
			mnl_attr_get_u8(tb[CTA_PROTO_ICMP_CODE]);
		set_bit(ATTR_ICMP_CODE, set);
	}

	if (tb[CTA_PROTO_ICMP_ID]) {
		tuple->l4src.icmp.id =
			mnl_attr_get_u16(tb[CTA_PROTO_ICMP_ID]);
		set_bit(ATTR_ICMP_ID, set);
	}

	if (tb[CTA_PROTO_ICMPV6_TYPE]) {
		tuple->l4dst.icmp.type =
			mnl_attr_get_u8(tb[CTA_PROTO_ICMPV6_TYPE]);
		set_bit(ATTR_ICMP_TYPE, set);
	}

	if (tb[CTA_PROTO_ICMPV6_CODE]) {
		tuple->l4dst.icmp.code =
			mnl_attr_get_u8(tb[CTA_PROTO_ICMPV6_CODE]);
		set_bit(ATTR_ICMP_CODE, set);
	}

	if (tb[CTA_PROTO_ICMPV6_ID]) {
		tuple->l4src.icmp.id =
			mnl_attr_get_u16(tb[CTA_PROTO_ICMPV6_ID]);
		set_bit(ATTR_ICMP_ID, set);
	}

	return 0;
}

static int nfct_parse_tuple_attr_cb(const struct nlattr *attr, void *data)
{
	const struct nlattr **tb = data;
	int type = mnl_attr_get_type(attr);

	if (mnl_attr_type_valid(attr, CTA_TUPLE_MAX) < 0)
		return MNL_CB_OK;

	switch(type) {
	case CTA_TUPLE_IP:
	case CTA_TUPLE_PROTO:
		if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
			return MNL_CB_ERROR;
		break;
	case CTA_TUPLE_ZONE:
		if (mnl_attr_validate(attr, MNL_TYPE_U16) < 0)
			return MNL_CB_ERROR;
		break;
	}

	tb[type] = attr;
	return MNL_CB_OK;
}

int
nfct_parse_tuple(const struct nlattr *attr, struct __nfct_tuple *tuple,
		int dir, uint32_t *set)
{
	struct nlattr *tb[CTA_TUPLE_MAX+1] = {};

	if (mnl_attr_parse_nested(attr, nfct_parse_tuple_attr_cb, tb) < 0)
		return -1;

	if (tb[CTA_TUPLE_IP]) {
		if (nfct_parse_ip(tb[CTA_TUPLE_IP], tuple, dir, set) < 0)
			return -1;
	}

	if (tb[CTA_TUPLE_PROTO]) {
		if (nfct_parse_proto(tb[CTA_TUPLE_PROTO], tuple, dir, set) < 0)
			return -1;
	}

	if (tb[CTA_TUPLE_ZONE]) {
		tuple->zone = ntohs(mnl_attr_get_u16(tb[CTA_TUPLE_ZONE]));
		switch(dir) {
		case __DIR_ORIG:
			set_bit(ATTR_ORIG_ZONE, set);
			break;
		case __DIR_REPL:
			set_bit(ATTR_REPL_ZONE, set);
			break;
		}
	}

	return 0;
}

static int
nfct_parse_pinfo_tcp_attr_cb(const struct nlattr *attr, void *data)
{
	const struct nlattr **tb = data;
	int type = mnl_attr_get_type(attr);

	if (mnl_attr_type_valid(attr, CTA_PROTOINFO_TCP_MAX) < 0)
		return MNL_CB_OK;

	switch(type) {
	case CTA_PROTOINFO_TCP_STATE:
	case CTA_PROTOINFO_TCP_WSCALE_ORIGINAL:
	case CTA_PROTOINFO_TCP_WSCALE_REPLY:
		if (mnl_attr_validate(attr, MNL_TYPE_U8) < 0)
			return MNL_CB_ERROR;
		break;
	case CTA_PROTOINFO_TCP_FLAGS_ORIGINAL:
	case CTA_PROTOINFO_TCP_FLAGS_REPLY:
		if (mnl_attr_validate2(attr, MNL_TYPE_UNSPEC,
					sizeof(struct nf_ct_tcp_flags)) < 0) {
			return MNL_CB_ERROR;
		}
		break;
	}
	tb[type] = attr;
	return MNL_CB_OK;
}

static int
nfct_parse_protoinfo_tcp(const struct nlattr *attr, struct nf_conntrack *ct)
{
	struct nlattr *tb[CTA_PROTOINFO_TCP_MAX+1] = {};

	if (mnl_attr_parse_nested(attr, nfct_parse_pinfo_tcp_attr_cb, tb) < 0)
		return -1;

	if (tb[CTA_PROTOINFO_TCP_STATE]) {
		ct->protoinfo.tcp.state =
			mnl_attr_get_u8(tb[CTA_PROTOINFO_TCP_STATE]);
		set_bit(ATTR_TCP_STATE, ct->head.set);
	}

	if (tb[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL]) {
		memcpy(&ct->protoinfo.tcp.wscale[__DIR_ORIG],
			mnl_attr_get_payload(tb[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL]),
			sizeof(uint8_t));
		set_bit(ATTR_TCP_WSCALE_ORIG, ct->head.set);
	}

	if (tb[CTA_PROTOINFO_TCP_WSCALE_REPLY]) {
		memcpy(&ct->protoinfo.tcp.wscale[__DIR_REPL],
			mnl_attr_get_payload(tb[CTA_PROTOINFO_TCP_WSCALE_REPLY]),
			sizeof(uint8_t));
		set_bit(ATTR_TCP_WSCALE_REPL, ct->head.set);
	}

	if (tb[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]) {
		memcpy(&ct->protoinfo.tcp.flags[0],
			mnl_attr_get_payload(tb[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]),
			sizeof(struct nf_ct_tcp_flags));
		set_bit(ATTR_TCP_FLAGS_ORIG, ct->head.set);
		set_bit(ATTR_TCP_MASK_ORIG, ct->head.set);
	}

	if (tb[CTA_PROTOINFO_TCP_FLAGS_REPLY]) {
		memcpy(&ct->protoinfo.tcp.flags[1],
			mnl_attr_get_payload(tb[CTA_PROTOINFO_TCP_FLAGS_REPLY]),
			sizeof(struct nf_ct_tcp_flags));
		set_bit(ATTR_TCP_FLAGS_REPL, ct->head.set);
		set_bit(ATTR_TCP_MASK_REPL, ct->head.set);
	}

	return 0;
}

static int
nfct_parse_pinfo_sctp_attr_cb(const struct nlattr *attr, void *data)
{
	const struct nlattr **tb = data;
	int type = mnl_attr_get_type(attr);

	if (mnl_attr_type_valid(attr, CTA_PROTOINFO_SCTP_MAX) < 0)
		return MNL_CB_OK;

	switch(type) {
	case CTA_PROTOINFO_SCTP_STATE:
		if (mnl_attr_validate(attr, MNL_TYPE_U8) < 0)
			return MNL_CB_ERROR;
		break;
	case CTA_PROTOINFO_SCTP_VTAG_ORIGINAL:
	case CTA_PROTOINFO_SCTP_VTAG_REPLY:
		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
			return MNL_CB_ERROR;
		break;
	}
	tb[type] = attr;
	return MNL_CB_OK;
}

static int
nfct_parse_protoinfo_sctp(const struct nlattr *attr, struct nf_conntrack *ct)
{
	struct nlattr *tb[CTA_PROTOINFO_SCTP_MAX+1] = {};

	if (mnl_attr_parse_nested(attr, nfct_parse_pinfo_sctp_attr_cb, tb) < 0)
		return -1;

	if (tb[CTA_PROTOINFO_SCTP_STATE]) {
		ct->protoinfo.sctp.state =
			mnl_attr_get_u8(tb[CTA_PROTOINFO_SCTP_STATE]);
		set_bit(ATTR_SCTP_STATE, ct->head.set);
	}

	if (tb[CTA_PROTOINFO_SCTP_VTAG_ORIGINAL]) {
		ct->protoinfo.sctp.vtag[__DIR_ORIG] =
		ntohl(mnl_attr_get_u32(tb[CTA_PROTOINFO_SCTP_VTAG_ORIGINAL]));
		set_bit(ATTR_SCTP_VTAG_ORIG, ct->head.set);
	}

	if (tb[CTA_PROTOINFO_SCTP_VTAG_REPLY]) {
		ct->protoinfo.sctp.vtag[__DIR_REPL] =
		ntohl(mnl_attr_get_u32(tb[CTA_PROTOINFO_SCTP_VTAG_REPLY]));
		set_bit(ATTR_SCTP_VTAG_REPL, ct->head.set);
	}

	return 0;
}

static int
nfct_parse_pinfo_dccp_attr_cb(const struct nlattr *attr, void *data)
{
	const struct nlattr **tb = data;
	int type = mnl_attr_get_type(attr);

	if (mnl_attr_type_valid(attr, CTA_PROTOINFO_DCCP_MAX) < 0)
		return MNL_CB_OK;

	switch(type) {
	case CTA_PROTOINFO_DCCP_STATE:
	case CTA_PROTOINFO_DCCP_ROLE:
		if (mnl_attr_validate(attr, MNL_TYPE_U8) < 0)
			return MNL_CB_ERROR;
		break;
	case CTA_PROTOINFO_DCCP_HANDSHAKE_SEQ:
		if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
			return MNL_CB_ERROR;
		break;
	}
	tb[type] = attr;
	return MNL_CB_OK;
}

static int
nfct_parse_protoinfo_dccp(const struct nlattr *attr, struct nf_conntrack *ct)
{
	struct nlattr *tb[CTA_PROTOINFO_DCCP_MAX+1] = {};

	if (mnl_attr_parse_nested(attr, nfct_parse_pinfo_dccp_attr_cb, tb) < 0)
		return -1;

	if (tb[CTA_PROTOINFO_DCCP_STATE]) {
		ct->protoinfo.dccp.state = mnl_attr_get_u8(tb[CTA_PROTOINFO_DCCP_STATE]);
		set_bit(ATTR_DCCP_STATE, ct->head.set);
	}
	if (tb[CTA_PROTOINFO_DCCP_ROLE]) {
		ct->protoinfo.dccp.role = mnl_attr_get_u8(tb[CTA_PROTOINFO_DCCP_ROLE]);
		set_bit(ATTR_DCCP_ROLE, ct->head.set);
	}
	if (tb[CTA_PROTOINFO_DCCP_HANDSHAKE_SEQ]) {
		ct->protoinfo.dccp.handshake_seq = be64toh(
		mnl_attr_get_u64(tb[CTA_PROTOINFO_DCCP_HANDSHAKE_SEQ]));
		set_bit(ATTR_DCCP_HANDSHAKE_SEQ, ct->head.set);
	}

	return 0;
}

static int
nfct_parse_protoinfo_attr_cb(const struct nlattr *attr, void *data)
{
	const struct nlattr **tb = data;
	int type = mnl_attr_get_type(attr);

	if (mnl_attr_type_valid(attr, CTA_PROTOINFO_TCP_MAX) < 0)
		return MNL_CB_OK;

	switch(type) {
	case CTA_PROTOINFO_TCP:
	case CTA_PROTOINFO_SCTP:
	case CTA_PROTOINFO_DCCP:
		if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
			return MNL_CB_ERROR;
		break;
	}
	tb[type] = attr;
	return MNL_CB_OK;
}

static int
nfct_parse_protoinfo(const struct nlattr *attr, struct nf_conntrack *ct)
{
	struct nlattr *tb[CTA_PROTOINFO_MAX+1] = {};

	if (mnl_attr_parse_nested(attr, nfct_parse_protoinfo_attr_cb, tb) < 0)
		return -1;

	if (tb[CTA_PROTOINFO_TCP])
		nfct_parse_protoinfo_tcp(tb[CTA_PROTOINFO_TCP], ct);

	if (tb[CTA_PROTOINFO_SCTP])
		nfct_parse_protoinfo_sctp(tb[CTA_PROTOINFO_SCTP], ct);

	if (tb[CTA_PROTOINFO_DCCP])
		nfct_parse_protoinfo_dccp(tb[CTA_PROTOINFO_DCCP], ct);

	return 0;
}

static int nfct_parse_counters_attr_cb(const struct nlattr *attr, void *data)
{
	const struct nlattr **tb = data;
	int type = mnl_attr_get_type(attr);

	if (mnl_attr_type_valid(attr, CTA_COUNTERS_MAX) < 0)
		return MNL_CB_OK;

	switch(type) {
	case CTA_COUNTERS_PACKETS:
	case CTA_COUNTERS_BYTES:
		if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
			return MNL_CB_ERROR;
		break;
	case CTA_COUNTERS32_PACKETS:
	case CTA_COUNTERS32_BYTES:
		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
			return MNL_CB_ERROR;
		break;
	}
	tb[type] = attr;
	return MNL_CB_OK;
}

static int
nfct_parse_counters(const struct nlattr *attr, struct nf_conntrack *ct,
		   int dir)
{
	struct nlattr *tb[CTA_COUNTERS_MAX+1] = {};

	if (mnl_attr_parse_nested(attr, nfct_parse_counters_attr_cb, tb) < 0)
		return -1;

	if (tb[CTA_COUNTERS_PACKETS] || tb[CTA_COUNTERS32_PACKETS]) {
		if (tb[CTA_COUNTERS32_PACKETS]) {
			ct->counters[dir].packets =
			ntohl(mnl_attr_get_u32(tb[CTA_COUNTERS32_PACKETS]));
		}
		if (tb[CTA_COUNTERS_PACKETS]) {
			ct->counters[dir].packets =
			be64toh(mnl_attr_get_u64(tb[CTA_COUNTERS_PACKETS]));
		}
		switch(dir) {
		case __DIR_ORIG:
			set_bit(ATTR_ORIG_COUNTER_PACKETS, ct->head.set);
			break;
		case __DIR_REPL:
			set_bit(ATTR_REPL_COUNTER_PACKETS, ct->head.set);
			break;
		}
	}
	if (tb[CTA_COUNTERS_BYTES] || tb[CTA_COUNTERS32_BYTES]) {
		if (tb[CTA_COUNTERS32_BYTES]) {
			ct->counters[dir].bytes =
			ntohl(mnl_attr_get_u32(tb[CTA_COUNTERS32_BYTES]));
		}
		if (tb[CTA_COUNTERS_BYTES]) {
			ct->counters[dir].bytes =
			be64toh(mnl_attr_get_u64(tb[CTA_COUNTERS_BYTES]));
		}

		switch(dir) {
		case __DIR_ORIG:
			set_bit(ATTR_ORIG_COUNTER_BYTES, ct->head.set);
			break;
		case __DIR_REPL:
			set_bit(ATTR_REPL_COUNTER_BYTES, ct->head.set);
			break;
		}
	}

	return 0;
}

static int
nfct_parse_nat_seq_attr_cb(const struct nlattr *attr, void *data)
{
	const struct nlattr **tb = data;
	int type = mnl_attr_get_type(attr);

	if (mnl_attr_type_valid(attr, CTA_NAT_SEQ_MAX) < 0)
		return MNL_CB_OK;

	switch(type) {
	case CTA_NAT_SEQ_CORRECTION_POS:
	case CTA_NAT_SEQ_OFFSET_BEFORE:
	case CTA_NAT_SEQ_OFFSET_AFTER:
		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
			return MNL_CB_ERROR;
		break;
	}
	tb[type] = attr;
	return MNL_CB_OK;
}

static int
nfct_parse_nat_seq(const struct nlattr *attr, struct nf_conntrack *ct, int dir)
{
	struct nlattr *tb[CTA_NAT_SEQ_MAX+1] = {};

	if (mnl_attr_parse_nested(attr, nfct_parse_nat_seq_attr_cb, tb) < 0)
		return -1;

	if (tb[CTA_NAT_SEQ_CORRECTION_POS]) {
		ct->natseq[dir].correction_pos =
			ntohl(mnl_attr_get_u32(tb[CTA_NAT_SEQ_CORRECTION_POS]));
		switch(dir) {
		case __DIR_ORIG:
			set_bit(ATTR_ORIG_NAT_SEQ_CORRECTION_POS, ct->head.set);
			break;
		case __DIR_REPL:
			set_bit(ATTR_REPL_NAT_SEQ_CORRECTION_POS, ct->head.set);
			break;
		}
	}

	if (tb[CTA_NAT_SEQ_OFFSET_BEFORE]) {
		ct->natseq[dir].offset_before =
			ntohl(mnl_attr_get_u32(tb[CTA_NAT_SEQ_OFFSET_BEFORE]));
		switch(dir) {
		case __DIR_ORIG:
			set_bit(ATTR_ORIG_NAT_SEQ_OFFSET_BEFORE, ct->head.set);
			break;
		case __DIR_REPL:
			set_bit(ATTR_REPL_NAT_SEQ_OFFSET_BEFORE, ct->head.set);
			break;
		}
	}

	if (tb[CTA_NAT_SEQ_OFFSET_AFTER]) {
		ct->natseq[dir].offset_after =
			ntohl(mnl_attr_get_u32(tb[CTA_NAT_SEQ_OFFSET_AFTER]));
		switch(dir) {
		case __DIR_ORIG:
			set_bit(ATTR_ORIG_NAT_SEQ_OFFSET_AFTER, ct->head.set);
			break;
		case __DIR_REPL:
			set_bit(ATTR_REPL_NAT_SEQ_OFFSET_AFTER, ct->head.set);
			break;
		}
	}

	return 0;
}

static int
nfct_parse_helper_attr_cb(const struct nlattr *attr, void *data)
{
	const struct nlattr **tb = data;
	int type = mnl_attr_get_type(attr);

	if (mnl_attr_type_valid(attr, CTA_HELP_MAX) < 0)
		return MNL_CB_OK;

	switch(type) {
	case CTA_HELP_NAME:
		if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
			return MNL_CB_ERROR;
		break;
	}
	tb[type] = attr;
	return MNL_CB_OK;
}

static int
nfct_parse_helper(const struct nlattr *attr, struct nf_conntrack *ct)
{
	struct nlattr *tb[CTA_HELP_MAX+1] = {};

	if (mnl_attr_parse_nested(attr, nfct_parse_helper_attr_cb, tb) < 0)
		return -1;

	if (!tb[CTA_HELP_NAME])
		return 0;

	strncpy(ct->helper_name, mnl_attr_get_str(tb[CTA_HELP_NAME]),
		NFCT_HELPER_NAME_MAX);
	ct->helper_name[NFCT_HELPER_NAME_MAX-1] = '\0';
	set_bit(ATTR_HELPER_NAME, ct->head.set);

	if (!tb[CTA_HELP_INFO])
		return 0;

	ct->helper_info_len = mnl_attr_get_payload_len(tb[CTA_HELP_INFO]);
	ct->helper_info = calloc(1, ct->helper_info_len);
	if (ct->helper_info == NULL)
		return -1;

	memcpy(ct->helper_info, mnl_attr_get_payload(tb[CTA_HELP_INFO]),
		ct->helper_info_len);
	set_bit(ATTR_HELPER_INFO, ct->head.set);

	return 0;
}

static int
nfct_parse_secctx_attr_cb(const struct nlattr *attr, void *data)
{
	const struct nlattr **tb = data;
	int type = mnl_attr_get_type(attr);

	if (mnl_attr_type_valid(attr, CTA_SECCTX_MAX) < 0)
		return MNL_CB_OK;

	switch(type) {
	case CTA_SECCTX_NAME:
		if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
			return MNL_CB_ERROR;
		break;
	}
	tb[type] = attr;
	return MNL_CB_OK;
}

static int
nfct_parse_secctx(const struct nlattr *attr, struct nf_conntrack *ct)
{
	struct nlattr *tb[CTA_SECCTX_MAX+1] = {};

	if (mnl_attr_parse_nested(attr, nfct_parse_secctx_attr_cb, tb) < 0)
		return -1;

	if (!tb[CTA_SECCTX_NAME])
		return 0;

	ct->secctx = strdup(NFA_DATA(tb[CTA_SECCTX_NAME]));
	if (ct->secctx)
		set_bit(ATTR_SECCTX, ct->head.set);

	return 0;
}

static int
nfct_parse_timestamp_attr_cb(const struct nlattr *attr, void *data)
{
	const struct nlattr **tb = data;
	int type = mnl_attr_get_type(attr);

	if (mnl_attr_type_valid(attr, CTA_TIMESTAMP_MAX) < 0)
		return MNL_CB_OK;

	switch(type) {
	case CTA_TIMESTAMP_START:
	case CTA_TIMESTAMP_STOP:
		if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
			return MNL_CB_ERROR;
		break;
	}
	tb[type] = attr;
	return MNL_CB_OK;
}

static int
nfct_parse_timestamp(const struct nlattr *attr, struct nf_conntrack *ct)
{
	struct nlattr *tb[CTA_TIMESTAMP_MAX+1] = {};

	if (mnl_attr_parse_nested(attr, nfct_parse_timestamp_attr_cb, tb) < 0)
		return -1;

	if (tb[CTA_TIMESTAMP_START]) {
		ct->timestamp.start =
			be64toh(mnl_attr_get_u64(tb[CTA_TIMESTAMP_START]));
		set_bit(ATTR_TIMESTAMP_START, ct->head.set);
	}
	if (tb[CTA_TIMESTAMP_STOP]) {
		ct->timestamp.stop =
			be64toh(mnl_attr_get_u64(tb[CTA_TIMESTAMP_STOP]));
		set_bit(ATTR_TIMESTAMP_STOP, ct->head.set);
	}

	return 0;
}

static int nfct_parse_labels(const struct nlattr *attr, struct nf_conntrack *ct)
{
	uint16_t len = mnl_attr_get_payload_len(attr);
	struct nfct_bitmask *mask;
	uint32_t *bits;

	if (len == 0)
		return 0;

	mask = nfct_bitmask_new((len * CHAR_BIT) - 1);
	if (!mask)
		return -1;
	bits = mnl_attr_get_payload(attr);

	memcpy(mask->bits, bits, len);
	nfct_set_attr(ct, ATTR_CONNLABELS, mask);
	return 0;
}

static int
nfct_parse_conntrack_attr_cb(const struct nlattr *attr, void *data)
{
	const struct nlattr **tb = data;
	int type = mnl_attr_get_type(attr);

	if (mnl_attr_type_valid(attr, CTA_MAX) < 0)
		return MNL_CB_OK;

	switch(type) {
	case CTA_TUPLE_ORIG:
	case CTA_TUPLE_REPLY:
	case CTA_TUPLE_MASTER:
	case CTA_NAT_SEQ_ADJ_ORIG:
	case CTA_NAT_SEQ_ADJ_REPLY:
	case CTA_PROTOINFO:
	case CTA_COUNTERS_ORIG:
	case CTA_COUNTERS_REPLY:
	case CTA_HELP:
	case CTA_SECCTX:
	case CTA_TIMESTAMP:
		if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
			return MNL_CB_ERROR;
		break;
	case CTA_STATUS:
	case CTA_TIMEOUT:
	case CTA_MARK:
	case CTA_SECMARK:
	case CTA_USE:
	case CTA_ID:
		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
			return MNL_CB_ERROR;
		break;
	case CTA_ZONE:
		if (mnl_attr_validate(attr, MNL_TYPE_U16) < 0)
			return MNL_CB_ERROR;
		break;
	case CTA_NAT_SRC:
	case CTA_NAT_DST:
		/* deprecated */
		break;
	}
	tb[type] = attr;
	return MNL_CB_OK;
}

int
nfct_payload_parse(const void *payload, size_t payload_len,
		   uint16_t l3num, struct nf_conntrack *ct)
{
	struct nlattr *tb[CTA_MAX+1] = {};

	if (mnl_attr_parse_payload(payload, payload_len,
				   nfct_parse_conntrack_attr_cb, tb) < 0)
		return -1;

	if (tb[CTA_TUPLE_ORIG]) {
		ct->head.orig.l3protonum = l3num;
		set_bit(ATTR_ORIG_L3PROTO, ct->head.set);

		if (nfct_parse_tuple(tb[CTA_TUPLE_ORIG], &ct->head.orig,
				     __DIR_ORIG, ct->head.set) < 0)
			return -1;
	}

	if (tb[CTA_TUPLE_REPLY]) {
		ct->repl.l3protonum = l3num;
		set_bit(ATTR_REPL_L3PROTO, ct->head.set);

		if (nfct_parse_tuple(tb[CTA_TUPLE_REPLY], &ct->repl,
				     __DIR_REPL, ct->head.set) < 0)
			return -1;
	}

	if (tb[CTA_TUPLE_MASTER]) {
		ct->master.l3protonum = l3num;
		set_bit(ATTR_MASTER_L3PROTO, ct->head.set);

		if (nfct_parse_tuple(tb[CTA_TUPLE_MASTER], &ct->master,
				     __DIR_MASTER, ct->head.set) < 0)
			return -1;
	}

	if (tb[CTA_NAT_SEQ_ADJ_ORIG]) {
		if (nfct_parse_nat_seq(tb[CTA_NAT_SEQ_ADJ_ORIG],
					ct, __DIR_ORIG) < 0)
			return -1;
	}

	if (tb[CTA_NAT_SEQ_ADJ_REPLY]) {
		if (nfct_parse_nat_seq(tb[CTA_NAT_SEQ_ADJ_REPLY],
					ct, __DIR_REPL) < 0)
			return -1;
	}

	if (tb[CTA_STATUS]) {
		ct->status = ntohl(mnl_attr_get_u32(tb[CTA_STATUS]));
		set_bit(ATTR_STATUS, ct->head.set);
	}

	if (tb[CTA_PROTOINFO]) {
		if (nfct_parse_protoinfo(tb[CTA_PROTOINFO], ct) < 0)
			return -1;
	}

	if (tb[CTA_TIMEOUT]) {
		ct->timeout = ntohl(mnl_attr_get_u32(tb[CTA_TIMEOUT]));
		set_bit(ATTR_TIMEOUT, ct->head.set);
	}

	if (tb[CTA_MARK]) {
		ct->mark = ntohl(mnl_attr_get_u32(tb[CTA_MARK]));
		set_bit(ATTR_MARK, ct->head.set);
	}

	if (tb[CTA_SECMARK]) {
		ct->secmark = ntohl(mnl_attr_get_u32(tb[CTA_SECMARK]));
		set_bit(ATTR_SECMARK, ct->head.set);
	}

	if (tb[CTA_COUNTERS_ORIG]) {
		if (nfct_parse_counters(tb[CTA_COUNTERS_ORIG],
					ct, __DIR_ORIG) < 0)
			return -1;
	}

	if (tb[CTA_COUNTERS_REPLY]) {
		if (nfct_parse_counters(tb[CTA_COUNTERS_REPLY],
					ct, __DIR_REPL) < 0)
			return -1;
	}

	if (tb[CTA_USE]) {
		ct->use = ntohl(mnl_attr_get_u32(tb[CTA_USE]));
		set_bit(ATTR_USE, ct->head.set);
	}

	if (tb[CTA_ID]) {
		ct->id = ntohl(mnl_attr_get_u32(tb[CTA_ID]));
		set_bit(ATTR_ID, ct->head.set);
	}

	if (tb[CTA_HELP]) {
		if (nfct_parse_helper(tb[CTA_HELP], ct) < 0)
			return -1;
	}

	if (tb[CTA_ZONE]) {
		ct->zone = ntohs(mnl_attr_get_u16(tb[CTA_ZONE]));
		set_bit(ATTR_ZONE, ct->head.set);
	}

	if (tb[CTA_SECCTX]) {
		if (nfct_parse_secctx(tb[CTA_SECCTX], ct) < 0)
			return -1;
	}

	if (tb[CTA_TIMESTAMP]) {
		if (nfct_parse_timestamp(tb[CTA_TIMESTAMP], ct) < 0)
			return -1;
	}

	if (tb[CTA_LABELS]) {
		if (nfct_parse_labels(tb[CTA_LABELS], ct) < 0)
			return -1;
	}
	/* CTA_LABELS_MASK: never sent by kernel */

	return 0;
}

int nfct_nlmsg_parse(const struct nlmsghdr *nlh, struct nf_conntrack *ct)
{
	struct nfgenmsg *nfhdr = mnl_nlmsg_get_payload(nlh);

	return nfct_payload_parse((uint8_t *)nfhdr + sizeof(struct nfgenmsg),
				  mnl_nlmsg_get_payload_len(nlh) - sizeof(struct nfgenmsg),
				  nfhdr->nfgen_family, ct);
}