1
2
3
4
5
6
7
8
9
10
11#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
12
13#include <linux/types.h>
14#include <linux/netfilter.h>
15#include <linux/skbuff.h>
16#include <linux/vmalloc.h>
17#include <linux/stddef.h>
18#include <linux/err.h>
19#include <linux/percpu.h>
20#include <linux/kernel.h>
21#include <linux/netdevice.h>
22#include <linux/slab.h>
23#include <linux/export.h>
24
25#include <net/netfilter/nf_conntrack.h>
26#include <net/netfilter/nf_conntrack_core.h>
27#include <net/netfilter/nf_conntrack_extend.h>
28
29static DEFINE_MUTEX(nf_ct_ecache_mutex);
30
31#define ECACHE_RETRY_WAIT (HZ/10)
32
33enum retry_state {
34 STATE_CONGESTED,
35 STATE_RESTART,
36 STATE_DONE,
37};
38
39static enum retry_state ecache_work_evict_list(struct ct_pcpu *pcpu)
40{
41 struct nf_conn *refs[16];
42 struct nf_conntrack_tuple_hash *h;
43 struct hlist_nulls_node *n;
44 unsigned int evicted = 0;
45 enum retry_state ret = STATE_DONE;
46
47 spin_lock(&pcpu->lock);
48
49 hlist_nulls_for_each_entry(h, n, &pcpu->dying, hnnode) {
50 struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
51 struct nf_conntrack_ecache *e;
52
53 if (!nf_ct_is_confirmed(ct))
54 continue;
55
56 e = nf_ct_ecache_find(ct);
57 if (!e || e->state != NFCT_ECACHE_DESTROY_FAIL)
58 continue;
59
60 if (nf_conntrack_event(IPCT_DESTROY, ct)) {
61 ret = STATE_CONGESTED;
62 break;
63 }
64
65 e->state = NFCT_ECACHE_DESTROY_SENT;
66 refs[evicted] = ct;
67
68 if (++evicted >= ARRAY_SIZE(refs)) {
69 ret = STATE_RESTART;
70 break;
71 }
72 }
73
74 spin_unlock(&pcpu->lock);
75
76
77 while (evicted)
78 nf_ct_put(refs[--evicted]);
79
80 return ret;
81}
82
83static void ecache_work(struct work_struct *work)
84{
85 struct netns_ct *ctnet =
86 container_of(work, struct netns_ct, ecache_dwork.work);
87 int cpu, delay = -1;
88 struct ct_pcpu *pcpu;
89
90 local_bh_disable();
91
92 for_each_possible_cpu(cpu) {
93 enum retry_state ret;
94
95 pcpu = per_cpu_ptr(ctnet->pcpu_lists, cpu);
96
97 ret = ecache_work_evict_list(pcpu);
98
99 switch (ret) {
100 case STATE_CONGESTED:
101 delay = ECACHE_RETRY_WAIT;
102 goto out;
103 case STATE_RESTART:
104 delay = 0;
105 break;
106 case STATE_DONE:
107 break;
108 }
109 }
110
111 out:
112 local_bh_enable();
113
114 ctnet->ecache_dwork_pending = delay > 0;
115 if (delay >= 0)
116 schedule_delayed_work(&ctnet->ecache_dwork, delay);
117}
118
119int nf_conntrack_eventmask_report(unsigned int eventmask, struct nf_conn *ct,
120 u32 portid, int report)
121{
122 int ret = 0;
123 struct net *net = nf_ct_net(ct);
124 struct nf_ct_event_notifier *notify;
125 struct nf_conntrack_ecache *e;
126
127 rcu_read_lock();
128 notify = rcu_dereference(net->ct.nf_conntrack_event_cb);
129 if (!notify)
130 goto out_unlock;
131
132 e = nf_ct_ecache_find(ct);
133 if (!e)
134 goto out_unlock;
135
136 if (nf_ct_is_confirmed(ct)) {
137 struct nf_ct_event item = {
138 .ct = ct,
139 .portid = e->portid ? e->portid : portid,
140 .report = report
141 };
142
143 unsigned long missed = e->portid ? 0 : e->missed;
144
145 if (!((eventmask | missed) & e->ctmask))
146 goto out_unlock;
147
148 ret = notify->fcn(eventmask | missed, &item);
149 if (unlikely(ret < 0 || missed)) {
150 spin_lock_bh(&ct->lock);
151 if (ret < 0) {
152
153
154
155
156 if (eventmask & (1 << IPCT_DESTROY)) {
157 if (e->portid == 0 && portid != 0)
158 e->portid = portid;
159 e->state = NFCT_ECACHE_DESTROY_FAIL;
160 } else {
161 e->missed |= eventmask;
162 }
163 } else {
164 e->missed &= ~missed;
165 }
166 spin_unlock_bh(&ct->lock);
167 }
168 }
169out_unlock:
170 rcu_read_unlock();
171 return ret;
172}
173EXPORT_SYMBOL_GPL(nf_conntrack_eventmask_report);
174
175
176
177void nf_ct_deliver_cached_events(struct nf_conn *ct)
178{
179 struct net *net = nf_ct_net(ct);
180 unsigned long events, missed;
181 struct nf_ct_event_notifier *notify;
182 struct nf_conntrack_ecache *e;
183 struct nf_ct_event item;
184 int ret;
185
186 rcu_read_lock();
187 notify = rcu_dereference(net->ct.nf_conntrack_event_cb);
188 if (notify == NULL)
189 goto out_unlock;
190
191 e = nf_ct_ecache_find(ct);
192 if (e == NULL)
193 goto out_unlock;
194
195 events = xchg(&e->cache, 0);
196
197 if (!nf_ct_is_confirmed(ct) || nf_ct_is_dying(ct))
198 goto out_unlock;
199
200
201
202
203 missed = e->missed;
204
205 if (!((events | missed) & e->ctmask))
206 goto out_unlock;
207
208 item.ct = ct;
209 item.portid = 0;
210 item.report = 0;
211
212 ret = notify->fcn(events | missed, &item);
213
214 if (likely(ret == 0 && !missed))
215 goto out_unlock;
216
217 spin_lock_bh(&ct->lock);
218 if (ret < 0)
219 e->missed |= events;
220 else
221 e->missed &= ~missed;
222 spin_unlock_bh(&ct->lock);
223
224out_unlock:
225 rcu_read_unlock();
226}
227EXPORT_SYMBOL_GPL(nf_ct_deliver_cached_events);
228
229void nf_ct_expect_event_report(enum ip_conntrack_expect_events event,
230 struct nf_conntrack_expect *exp,
231 u32 portid, int report)
232
233{
234 struct net *net = nf_ct_exp_net(exp);
235 struct nf_exp_event_notifier *notify;
236 struct nf_conntrack_ecache *e;
237
238 rcu_read_lock();
239 notify = rcu_dereference(net->ct.nf_expect_event_cb);
240 if (!notify)
241 goto out_unlock;
242
243 e = nf_ct_ecache_find(exp->master);
244 if (!e)
245 goto out_unlock;
246
247 if (e->expmask & (1 << event)) {
248 struct nf_exp_event item = {
249 .exp = exp,
250 .portid = portid,
251 .report = report
252 };
253 notify->fcn(1 << event, &item);
254 }
255out_unlock:
256 rcu_read_unlock();
257}
258
259int nf_conntrack_register_notifier(struct net *net,
260 struct nf_ct_event_notifier *new)
261{
262 int ret;
263 struct nf_ct_event_notifier *notify;
264
265 mutex_lock(&nf_ct_ecache_mutex);
266 notify = rcu_dereference_protected(net->ct.nf_conntrack_event_cb,
267 lockdep_is_held(&nf_ct_ecache_mutex));
268 if (notify != NULL) {
269 ret = -EBUSY;
270 goto out_unlock;
271 }
272 rcu_assign_pointer(net->ct.nf_conntrack_event_cb, new);
273 ret = 0;
274
275out_unlock:
276 mutex_unlock(&nf_ct_ecache_mutex);
277 return ret;
278}
279EXPORT_SYMBOL_GPL(nf_conntrack_register_notifier);
280
281void nf_conntrack_unregister_notifier(struct net *net,
282 struct nf_ct_event_notifier *new)
283{
284 struct nf_ct_event_notifier *notify;
285
286 mutex_lock(&nf_ct_ecache_mutex);
287 notify = rcu_dereference_protected(net->ct.nf_conntrack_event_cb,
288 lockdep_is_held(&nf_ct_ecache_mutex));
289 BUG_ON(notify != new);
290 RCU_INIT_POINTER(net->ct.nf_conntrack_event_cb, NULL);
291 mutex_unlock(&nf_ct_ecache_mutex);
292
293}
294EXPORT_SYMBOL_GPL(nf_conntrack_unregister_notifier);
295
296int nf_ct_expect_register_notifier(struct net *net,
297 struct nf_exp_event_notifier *new)
298{
299 int ret;
300 struct nf_exp_event_notifier *notify;
301
302 mutex_lock(&nf_ct_ecache_mutex);
303 notify = rcu_dereference_protected(net->ct.nf_expect_event_cb,
304 lockdep_is_held(&nf_ct_ecache_mutex));
305 if (notify != NULL) {
306 ret = -EBUSY;
307 goto out_unlock;
308 }
309 rcu_assign_pointer(net->ct.nf_expect_event_cb, new);
310 ret = 0;
311
312out_unlock:
313 mutex_unlock(&nf_ct_ecache_mutex);
314 return ret;
315}
316EXPORT_SYMBOL_GPL(nf_ct_expect_register_notifier);
317
318void nf_ct_expect_unregister_notifier(struct net *net,
319 struct nf_exp_event_notifier *new)
320{
321 struct nf_exp_event_notifier *notify;
322
323 mutex_lock(&nf_ct_ecache_mutex);
324 notify = rcu_dereference_protected(net->ct.nf_expect_event_cb,
325 lockdep_is_held(&nf_ct_ecache_mutex));
326 BUG_ON(notify != new);
327 RCU_INIT_POINTER(net->ct.nf_expect_event_cb, NULL);
328 mutex_unlock(&nf_ct_ecache_mutex);
329
330}
331EXPORT_SYMBOL_GPL(nf_ct_expect_unregister_notifier);
332
333#define NF_CT_EVENTS_DEFAULT 1
334static int nf_ct_events __read_mostly = NF_CT_EVENTS_DEFAULT;
335
336static const struct nf_ct_ext_type event_extend = {
337 .len = sizeof(struct nf_conntrack_ecache),
338 .align = __alignof__(struct nf_conntrack_ecache),
339 .id = NF_CT_EXT_ECACHE,
340};
341
342void nf_conntrack_ecache_pernet_init(struct net *net)
343{
344 net->ct.sysctl_events = nf_ct_events;
345 INIT_DELAYED_WORK(&net->ct.ecache_dwork, ecache_work);
346}
347
348void nf_conntrack_ecache_pernet_fini(struct net *net)
349{
350 cancel_delayed_work_sync(&net->ct.ecache_dwork);
351}
352
353int nf_conntrack_ecache_init(void)
354{
355 int ret = nf_ct_extend_register(&event_extend);
356 if (ret < 0)
357 pr_err("Unable to register event extension\n");
358
359 BUILD_BUG_ON(__IPCT_MAX >= 16);
360
361 return ret;
362}
363
364void nf_conntrack_ecache_fini(void)
365{
366 nf_ct_extend_unregister(&event_extend);
367}
368
