1
2
3
4
5
6
7
8
9
10
11
12#include <linux/types.h>
13#include <linux/netfilter.h>
14#include <linux/skbuff.h>
15#include <linux/proc_fs.h>
16#include <linux/seq_file.h>
17#include <linux/stddef.h>
18#include <linux/slab.h>
19#include <linux/err.h>
20#include <linux/percpu.h>
21#include <linux/kernel.h>
22#include <linux/jhash.h>
23#include <net/net_namespace.h>
24
25#include <net/netfilter/nf_conntrack.h>
26#include <net/netfilter/nf_conntrack_core.h>
27#include <net/netfilter/nf_conntrack_expect.h>
28#include <net/netfilter/nf_conntrack_helper.h>
29#include <net/netfilter/nf_conntrack_tuple.h>
30
31unsigned int nf_ct_expect_hsize __read_mostly;
32EXPORT_SYMBOL_GPL(nf_ct_expect_hsize);
33
34static unsigned int nf_ct_expect_hash_rnd __read_mostly;
35unsigned int nf_ct_expect_max __read_mostly;
36static int nf_ct_expect_hash_rnd_initted __read_mostly;
37
38static struct kmem_cache *nf_ct_expect_cachep __read_mostly;
39
40
41void nf_ct_unlink_expect(struct nf_conntrack_expect *exp)
42{
43 struct nf_conn_help *master_help = nfct_help(exp->master);
44 struct net *net = nf_ct_exp_net(exp);
45
46 NF_CT_ASSERT(master_help);
47 NF_CT_ASSERT(!timer_pending(&exp->timeout));
48
49 hlist_del_rcu(&exp->hnode);
50 net->ct.expect_count--;
51
52 hlist_del(&exp->lnode);
53 master_help->expecting[exp->class]--;
54 nf_ct_expect_put(exp);
55
56 NF_CT_STAT_INC(net, expect_delete);
57}
58EXPORT_SYMBOL_GPL(nf_ct_unlink_expect);
59
60static void nf_ct_expectation_timed_out(unsigned long ul_expect)
61{
62 struct nf_conntrack_expect *exp = (void *)ul_expect;
63
64 spin_lock_bh(&nf_conntrack_lock);
65 nf_ct_unlink_expect(exp);
66 spin_unlock_bh(&nf_conntrack_lock);
67 nf_ct_expect_put(exp);
68}
69
70static unsigned int nf_ct_expect_dst_hash(const struct nf_conntrack_tuple *tuple)
71{
72 unsigned int hash;
73
74 if (unlikely(!nf_ct_expect_hash_rnd_initted)) {
75 get_random_bytes(&nf_ct_expect_hash_rnd,
76 sizeof(nf_ct_expect_hash_rnd));
77 nf_ct_expect_hash_rnd_initted = 1;
78 }
79
80 hash = jhash2(tuple->dst.u3.all, ARRAY_SIZE(tuple->dst.u3.all),
81 (((tuple->dst.protonum ^ tuple->src.l3num) << 16) |
82 (__force __u16)tuple->dst.u.all) ^ nf_ct_expect_hash_rnd);
83 return ((u64)hash * nf_ct_expect_hsize) >> 32;
84}
85
86struct nf_conntrack_expect *
87__nf_ct_expect_find(struct net *net, const struct nf_conntrack_tuple *tuple)
88{
89 struct nf_conntrack_expect *i;
90 struct hlist_node *n;
91 unsigned int h;
92
93 if (!net->ct.expect_count)
94 return NULL;
95
96 h = nf_ct_expect_dst_hash(tuple);
97 hlist_for_each_entry_rcu(i, n, &net->ct.expect_hash[h], hnode) {
98 if (nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask))
99 return i;
100 }
101 return NULL;
102}
103EXPORT_SYMBOL_GPL(__nf_ct_expect_find);
104
105
106struct nf_conntrack_expect *
107nf_ct_expect_find_get(struct net *net, const struct nf_conntrack_tuple *tuple)
108{
109 struct nf_conntrack_expect *i;
110
111 rcu_read_lock();
112 i = __nf_ct_expect_find(net, tuple);
113 if (i && !atomic_inc_not_zero(&i->use))
114 i = NULL;
115 rcu_read_unlock();
116
117 return i;
118}
119EXPORT_SYMBOL_GPL(nf_ct_expect_find_get);
120
121
122
123struct nf_conntrack_expect *
124nf_ct_find_expectation(struct net *net, const struct nf_conntrack_tuple *tuple)
125{
126 struct nf_conntrack_expect *i, *exp = NULL;
127 struct hlist_node *n;
128 unsigned int h;
129
130 if (!net->ct.expect_count)
131 return NULL;
132
133 h = nf_ct_expect_dst_hash(tuple);
134 hlist_for_each_entry(i, n, &net->ct.expect_hash[h], hnode) {
135 if (!(i->flags & NF_CT_EXPECT_INACTIVE) &&
136 nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask)) {
137 exp = i;
138 break;
139 }
140 }
141 if (!exp)
142 return NULL;
143
144
145
146
147
148
149 if (!nf_ct_is_confirmed(exp->master))
150 return NULL;
151
152 if (exp->flags & NF_CT_EXPECT_PERMANENT) {
153 atomic_inc(&exp->use);
154 return exp;
155 } else if (del_timer(&exp->timeout)) {
156 nf_ct_unlink_expect(exp);
157 return exp;
158 }
159
160 return NULL;
161}
162
163
164void nf_ct_remove_expectations(struct nf_conn *ct)
165{
166 struct nf_conn_help *help = nfct_help(ct);
167 struct nf_conntrack_expect *exp;
168 struct hlist_node *n, *next;
169
170
171 if (!help)
172 return;
173
174 hlist_for_each_entry_safe(exp, n, next, &help->expectations, lnode) {
175 if (del_timer(&exp->timeout)) {
176 nf_ct_unlink_expect(exp);
177 nf_ct_expect_put(exp);
178 }
179 }
180}
181EXPORT_SYMBOL_GPL(nf_ct_remove_expectations);
182
183
184static inline int expect_clash(const struct nf_conntrack_expect *a,
185 const struct nf_conntrack_expect *b)
186{
187
188
189 struct nf_conntrack_tuple_mask intersect_mask;
190 int count;
191
192 intersect_mask.src.u.all = a->mask.src.u.all & b->mask.src.u.all;
193
194 for (count = 0; count < NF_CT_TUPLE_L3SIZE; count++){
195 intersect_mask.src.u3.all[count] =
196 a->mask.src.u3.all[count] & b->mask.src.u3.all[count];
197 }
198
199 return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask);
200}
201
202static inline int expect_matches(const struct nf_conntrack_expect *a,
203 const struct nf_conntrack_expect *b)
204{
205 return a->master == b->master && a->class == b->class
206 && nf_ct_tuple_equal(&a->tuple, &b->tuple)
207 && nf_ct_tuple_mask_equal(&a->mask, &b->mask);
208}
209
210
211void nf_ct_unexpect_related(struct nf_conntrack_expect *exp)
212{
213 spin_lock_bh(&nf_conntrack_lock);
214 if (del_timer(&exp->timeout)) {
215 nf_ct_unlink_expect(exp);
216 nf_ct_expect_put(exp);
217 }
218 spin_unlock_bh(&nf_conntrack_lock);
219}
220EXPORT_SYMBOL_GPL(nf_ct_unexpect_related);
221
222
223
224
225struct nf_conntrack_expect *nf_ct_expect_alloc(struct nf_conn *me)
226{
227 struct nf_conntrack_expect *new;
228
229 new = kmem_cache_alloc(nf_ct_expect_cachep, GFP_ATOMIC);
230 if (!new)
231 return NULL;
232
233 new->master = me;
234 atomic_set(&new->use, 1);
235 INIT_RCU_HEAD(&new->rcu);
236 return new;
237}
238EXPORT_SYMBOL_GPL(nf_ct_expect_alloc);
239
240void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class,
241 u_int8_t family,
242 const union nf_inet_addr *saddr,
243 const union nf_inet_addr *daddr,
244 u_int8_t proto, const __be16 *src, const __be16 *dst)
245{
246 int len;
247
248 if (family == AF_INET)
249 len = 4;
250 else
251 len = 16;
252
253 exp->flags = 0;
254 exp->class = class;
255 exp->expectfn = NULL;
256 exp->helper = NULL;
257 exp->tuple.src.l3num = family;
258 exp->tuple.dst.protonum = proto;
259
260 if (saddr) {
261 memcpy(&exp->tuple.src.u3, saddr, len);
262 if (sizeof(exp->tuple.src.u3) > len)
263
264 memset((void *)&exp->tuple.src.u3 + len, 0x00,
265 sizeof(exp->tuple.src.u3) - len);
266 memset(&exp->mask.src.u3, 0xFF, len);
267 if (sizeof(exp->mask.src.u3) > len)
268 memset((void *)&exp->mask.src.u3 + len, 0x00,
269 sizeof(exp->mask.src.u3) - len);
270 } else {
271 memset(&exp->tuple.src.u3, 0x00, sizeof(exp->tuple.src.u3));
272 memset(&exp->mask.src.u3, 0x00, sizeof(exp->mask.src.u3));
273 }
274
275 if (src) {
276 exp->tuple.src.u.all = *src;
277 exp->mask.src.u.all = htons(0xFFFF);
278 } else {
279 exp->tuple.src.u.all = 0;
280 exp->mask.src.u.all = 0;
281 }
282
283 memcpy(&exp->tuple.dst.u3, daddr, len);
284 if (sizeof(exp->tuple.dst.u3) > len)
285
286 memset((void *)&exp->tuple.dst.u3 + len, 0x00,
287 sizeof(exp->tuple.dst.u3) - len);
288
289 exp->tuple.dst.u.all = *dst;
290}
291EXPORT_SYMBOL_GPL(nf_ct_expect_init);
292
293static void nf_ct_expect_free_rcu(struct rcu_head *head)
294{
295 struct nf_conntrack_expect *exp;
296
297 exp = container_of(head, struct nf_conntrack_expect, rcu);
298 kmem_cache_free(nf_ct_expect_cachep, exp);
299}
300
301void nf_ct_expect_put(struct nf_conntrack_expect *exp)
302{
303 if (atomic_dec_and_test(&exp->use))
304 call_rcu(&exp->rcu, nf_ct_expect_free_rcu);
305}
306EXPORT_SYMBOL_GPL(nf_ct_expect_put);
307
308static void nf_ct_expect_insert(struct nf_conntrack_expect *exp)
309{
310 struct nf_conn_help *master_help = nfct_help(exp->master);
311 struct net *net = nf_ct_exp_net(exp);
312 const struct nf_conntrack_expect_policy *p;
313 unsigned int h = nf_ct_expect_dst_hash(&exp->tuple);
314
315 atomic_inc(&exp->use);
316
317 hlist_add_head(&exp->lnode, &master_help->expectations);
318 master_help->expecting[exp->class]++;
319
320 hlist_add_head_rcu(&exp->hnode, &net->ct.expect_hash[h]);
321 net->ct.expect_count++;
322
323 setup_timer(&exp->timeout, nf_ct_expectation_timed_out,
324 (unsigned long)exp);
325 p = &master_help->helper->expect_policy[exp->class];
326 exp->timeout.expires = jiffies + p->timeout * HZ;
327 add_timer(&exp->timeout);
328
329 atomic_inc(&exp->use);
330 NF_CT_STAT_INC(net, expect_create);
331}
332
333
334static void evict_oldest_expect(struct nf_conn *master,
335 struct nf_conntrack_expect *new)
336{
337 struct nf_conn_help *master_help = nfct_help(master);
338 struct nf_conntrack_expect *exp, *last = NULL;
339 struct hlist_node *n;
340
341 hlist_for_each_entry(exp, n, &master_help->expectations, lnode) {
342 if (exp->class == new->class)
343 last = exp;
344 }
345
346 if (last && del_timer(&last->timeout)) {
347 nf_ct_unlink_expect(last);
348 nf_ct_expect_put(last);
349 }
350}
351
352static inline int refresh_timer(struct nf_conntrack_expect *i)
353{
354 struct nf_conn_help *master_help = nfct_help(i->master);
355 const struct nf_conntrack_expect_policy *p;
356
357 if (!del_timer(&i->timeout))
358 return 0;
359
360 p = &master_help->helper->expect_policy[i->class];
361 i->timeout.expires = jiffies + p->timeout * HZ;
362 add_timer(&i->timeout);
363 return 1;
364}
365
366static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect)
367{
368 const struct nf_conntrack_expect_policy *p;
369 struct nf_conntrack_expect *i;
370 struct nf_conn *master = expect->master;
371 struct nf_conn_help *master_help = nfct_help(master);
372 struct net *net = nf_ct_exp_net(expect);
373 struct hlist_node *n;
374 unsigned int h;
375 int ret = 1;
376
377 if (!master_help->helper) {
378 ret = -ESHUTDOWN;
379 goto out;
380 }
381 h = nf_ct_expect_dst_hash(&expect->tuple);
382 hlist_for_each_entry(i, n, &net->ct.expect_hash[h], hnode) {
383 if (expect_matches(i, expect)) {
384
385 if (refresh_timer(i)) {
386 ret = 0;
387 goto out;
388 }
389 } else if (expect_clash(i, expect)) {
390 ret = -EBUSY;
391 goto out;
392 }
393 }
394
395 p = &master_help->helper->expect_policy[expect->class];
396 if (p->max_expected &&
397 master_help->expecting[expect->class] >= p->max_expected) {
398 evict_oldest_expect(master, expect);
399 if (master_help->expecting[expect->class] >= p->max_expected) {
400 ret = -EMFILE;
401 goto out;
402 }
403 }
404
405 if (net->ct.expect_count >= nf_ct_expect_max) {
406 if (net_ratelimit())
407 printk(KERN_WARNING
408 "nf_conntrack: expectation table full\n");
409 ret = -EMFILE;
410 }
411out:
412 return ret;
413}
414
415int nf_ct_expect_related_report(struct nf_conntrack_expect *expect,
416 u32 pid, int report)
417{
418 int ret;
419
420 spin_lock_bh(&nf_conntrack_lock);
421 ret = __nf_ct_expect_check(expect);
422 if (ret <= 0)
423 goto out;
424
425 ret = 0;
426 nf_ct_expect_insert(expect);
427 spin_unlock_bh(&nf_conntrack_lock);
428 nf_ct_expect_event_report(IPEXP_NEW, expect, pid, report);
429 return ret;
430out:
431 spin_unlock_bh(&nf_conntrack_lock);
432 return ret;
433}
434EXPORT_SYMBOL_GPL(nf_ct_expect_related_report);
435
436#ifdef CONFIG_PROC_FS
437struct ct_expect_iter_state {
438 struct seq_net_private p;
439 unsigned int bucket;
440};
441
442static struct hlist_node *ct_expect_get_first(struct seq_file *seq)
443{
444 struct net *net = seq_file_net(seq);
445 struct ct_expect_iter_state *st = seq->private;
446 struct hlist_node *n;
447
448 for (st->bucket = 0; st->bucket < nf_ct_expect_hsize; st->bucket++) {
449 n = rcu_dereference(net->ct.expect_hash[st->bucket].first);
450 if (n)
451 return n;
452 }
453 return NULL;
454}
455
456static struct hlist_node *ct_expect_get_next(struct seq_file *seq,
457 struct hlist_node *head)
458{
459 struct net *net = seq_file_net(seq);
460 struct ct_expect_iter_state *st = seq->private;
461
462 head = rcu_dereference(head->next);
463 while (head == NULL) {
464 if (++st->bucket >= nf_ct_expect_hsize)
465 return NULL;
466 head = rcu_dereference(net->ct.expect_hash[st->bucket].first);
467 }
468 return head;
469}
470
471static struct hlist_node *ct_expect_get_idx(struct seq_file *seq, loff_t pos)
472{
473 struct hlist_node *head = ct_expect_get_first(seq);
474
475 if (head)
476 while (pos && (head = ct_expect_get_next(seq, head)))
477 pos--;
478 return pos ? NULL : head;
479}
480
481static void *exp_seq_start(struct seq_file *seq, loff_t *pos)
482 __acquires(RCU)
483{
484 rcu_read_lock();
485 return ct_expect_get_idx(seq, *pos);
486}
487
488static void *exp_seq_next(struct seq_file *seq, void *v, loff_t *pos)
489{
490 (*pos)++;
491 return ct_expect_get_next(seq, v);
492}
493
494static void exp_seq_stop(struct seq_file *seq, void *v)
495 __releases(RCU)
496{
497 rcu_read_unlock();
498}
499
500static int exp_seq_show(struct seq_file *s, void *v)
501{
502 struct nf_conntrack_expect *expect;
503 struct hlist_node *n = v;
504 char *delim = "";
505
506 expect = hlist_entry(n, struct nf_conntrack_expect, hnode);
507
508 if (expect->timeout.function)
509 seq_printf(s, "%ld ", timer_pending(&expect->timeout)
510 ? (long)(expect->timeout.expires - jiffies)/HZ : 0);
511 else
512 seq_printf(s, "- ");
513 seq_printf(s, "l3proto = %u proto=%u ",
514 expect->tuple.src.l3num,
515 expect->tuple.dst.protonum);
516 print_tuple(s, &expect->tuple,
517 __nf_ct_l3proto_find(expect->tuple.src.l3num),
518 __nf_ct_l4proto_find(expect->tuple.src.l3num,
519 expect->tuple.dst.protonum));
520
521 if (expect->flags & NF_CT_EXPECT_PERMANENT) {
522 seq_printf(s, "PERMANENT");
523 delim = ",";
524 }
525 if (expect->flags & NF_CT_EXPECT_INACTIVE)
526 seq_printf(s, "%sINACTIVE", delim);
527
528 return seq_putc(s, '\n');
529}
530
531static const struct seq_operations exp_seq_ops = {
532 .start = exp_seq_start,
533 .next = exp_seq_next,
534 .stop = exp_seq_stop,
535 .show = exp_seq_show
536};
537
538static int exp_open(struct inode *inode, struct file *file)
539{
540 return seq_open_net(inode, file, &exp_seq_ops,
541 sizeof(struct ct_expect_iter_state));
542}
543
544static const struct file_operations exp_file_ops = {
545 .owner = THIS_MODULE,
546 .open = exp_open,
547 .read = seq_read,
548 .llseek = seq_lseek,
549 .release = seq_release_net,
550};
551#endif
552
553static int exp_proc_init(struct net *net)
554{
555#ifdef CONFIG_PROC_FS
556 struct proc_dir_entry *proc;
557
558 proc = proc_net_fops_create(net, "nf_conntrack_expect", 0440, &exp_file_ops);
559 if (!proc)
560 return -ENOMEM;
561#endif
562 return 0;
563}
564
565static void exp_proc_remove(struct net *net)
566{
567#ifdef CONFIG_PROC_FS
568 proc_net_remove(net, "nf_conntrack_expect");
569#endif
570}
571
572module_param_named(expect_hashsize, nf_ct_expect_hsize, uint, 0600);
573
574int nf_conntrack_expect_init(struct net *net)
575{
576 int err = -ENOMEM;
577
578 if (net_eq(net, &init_net)) {
579 if (!nf_ct_expect_hsize) {
580 nf_ct_expect_hsize = nf_conntrack_htable_size / 256;
581 if (!nf_ct_expect_hsize)
582 nf_ct_expect_hsize = 1;
583 }
584 nf_ct_expect_max = nf_ct_expect_hsize * 4;
585 }
586
587 net->ct.expect_count = 0;
588 net->ct.expect_hash = nf_ct_alloc_hashtable(&nf_ct_expect_hsize,
589 &net->ct.expect_vmalloc, 0);
590 if (net->ct.expect_hash == NULL)
591 goto err1;
592
593 if (net_eq(net, &init_net)) {
594 nf_ct_expect_cachep = kmem_cache_create("nf_conntrack_expect",
595 sizeof(struct nf_conntrack_expect),
596 0, 0, NULL);
597 if (!nf_ct_expect_cachep)
598 goto err2;
599 }
600
601 err = exp_proc_init(net);
602 if (err < 0)
603 goto err3;
604
605 return 0;
606
607err3:
608 if (net_eq(net, &init_net))
609 kmem_cache_destroy(nf_ct_expect_cachep);
610err2:
611 nf_ct_free_hashtable(net->ct.expect_hash, net->ct.expect_vmalloc,
612 nf_ct_expect_hsize);
613err1:
614 return err;
615}
616
617void nf_conntrack_expect_fini(struct net *net)
618{
619 exp_proc_remove(net);
620 if (net_eq(net, &init_net)) {
621 rcu_barrier();
622 kmem_cache_destroy(nf_ct_expect_cachep);
623 }
624 nf_ct_free_hashtable(net->ct.expect_hash, net->ct.expect_vmalloc,
625 nf_ct_expect_hsize);
626}
627