[deliverable/linux.git] / net / netfilter / nf_conntrack_ecache.c

/* Event cache for netfilter. */

/* (C) 1999-2001 Paul `Rusty' Russell
 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
 * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/types.h>
#include <linux/netfilter.h>
#include <linux/skbuff.h>
#include <linux/vmalloc.h>
#include <linux/stddef.h>
#include <linux/err.h>
#include <linux/percpu.h>
#include <linux/kernel.h>
#include <linux/netdevice.h>
#include <linux/slab.h>

#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_core.h>
#include <net/netfilter/nf_conntrack_extend.h>

static DEFINE_MUTEX(nf_ct_ecache_mutex);

struct nf_ct_event_notifier __rcu *nf_conntrack_event_cb __read_mostly;
EXPORT_SYMBOL_GPL(nf_conntrack_event_cb);

struct nf_exp_event_notifier __rcu *nf_expect_event_cb __read_mostly;
EXPORT_SYMBOL_GPL(nf_expect_event_cb);

/* deliver cached events and clear cache entry - must be called with locally
 * disabled softirqs */
void nf_ct_deliver_cached_events(struct nf_conn *ct)
{
	unsigned long events;
	struct nf_ct_event_notifier *notify;
	struct nf_conntrack_ecache *e;

	rcu_read_lock();
	notify = rcu_dereference(nf_conntrack_event_cb);
	if (notify == NULL)
		goto out_unlock;

	e = nf_ct_ecache_find(ct);
	if (e == NULL)
		goto out_unlock;

	events = xchg(&e->cache, 0);

	if (nf_ct_is_confirmed(ct) && !nf_ct_is_dying(ct) && events) {
		struct nf_ct_event item = {
			.ct	= ct,
			.pid	= 0,
			.report	= 0
		};
		int ret;
		/* We make a copy of the missed event cache without taking
		 * the lock, thus we may send missed events twice. However,
		 * this does not harm and it happens very rarely. */
		unsigned long missed = e->missed;

		if (!((events | missed) & e->ctmask))
			goto out_unlock;

		ret = notify->fcn(events | missed, &item);
		if (unlikely(ret < 0 || missed)) {
			spin_lock_bh(&ct->lock);
			if (ret < 0)
				e->missed |= events;
			else
				e->missed &= ~missed;
			spin_unlock_bh(&ct->lock);
		} 
	}

out_unlock:
	rcu_read_unlock();
}
EXPORT_SYMBOL_GPL(nf_ct_deliver_cached_events);

int nf_conntrack_register_notifier(struct nf_ct_event_notifier *new)
{
	int ret = 0;
	struct nf_ct_event_notifier *notify;

	mutex_lock(&nf_ct_ecache_mutex);
	notify = rcu_dereference_protected(nf_conntrack_event_cb,
					   lockdep_is_held(&nf_ct_ecache_mutex));
	if (notify != NULL) {
		ret = -EBUSY;
		goto out_unlock;
	}
	rcu_assign_pointer(nf_conntrack_event_cb, new);
	mutex_unlock(&nf_ct_ecache_mutex);
	return ret;

out_unlock:
	mutex_unlock(&nf_ct_ecache_mutex);
	return ret;
}
EXPORT_SYMBOL_GPL(nf_conntrack_register_notifier);

void nf_conntrack_unregister_notifier(struct nf_ct_event_notifier *new)
{
	struct nf_ct_event_notifier *notify;

	mutex_lock(&nf_ct_ecache_mutex);
	notify = rcu_dereference_protected(nf_conntrack_event_cb,
					   lockdep_is_held(&nf_ct_ecache_mutex));
	BUG_ON(notify != new);
	rcu_assign_pointer(nf_conntrack_event_cb, NULL);
	mutex_unlock(&nf_ct_ecache_mutex);
}
EXPORT_SYMBOL_GPL(nf_conntrack_unregister_notifier);

int nf_ct_expect_register_notifier(struct nf_exp_event_notifier *new)
{
	int ret = 0;
	struct nf_exp_event_notifier *notify;

	mutex_lock(&nf_ct_ecache_mutex);
	notify = rcu_dereference_protected(nf_expect_event_cb,
					   lockdep_is_held(&nf_ct_ecache_mutex));
	if (notify != NULL) {
		ret = -EBUSY;
		goto out_unlock;
	}
	rcu_assign_pointer(nf_expect_event_cb, new);
	mutex_unlock(&nf_ct_ecache_mutex);
	return ret;

out_unlock:
	mutex_unlock(&nf_ct_ecache_mutex);
	return ret;
}
EXPORT_SYMBOL_GPL(nf_ct_expect_register_notifier);

void nf_ct_expect_unregister_notifier(struct nf_exp_event_notifier *new)
{
	struct nf_exp_event_notifier *notify;

	mutex_lock(&nf_ct_ecache_mutex);
	notify = rcu_dereference_protected(nf_expect_event_cb,
					   lockdep_is_held(&nf_ct_ecache_mutex));
	BUG_ON(notify != new);
	rcu_assign_pointer(nf_expect_event_cb, NULL);
	mutex_unlock(&nf_ct_ecache_mutex);
}
EXPORT_SYMBOL_GPL(nf_ct_expect_unregister_notifier);

#define NF_CT_EVENTS_DEFAULT 1
static int nf_ct_events __read_mostly = NF_CT_EVENTS_DEFAULT;
static int nf_ct_events_retry_timeout __read_mostly = 15*HZ;

#ifdef CONFIG_SYSCTL
static struct ctl_table event_sysctl_table[] = {
	{
		.procname	= "nf_conntrack_events",
		.data		= &init_net.ct.sysctl_events,
		.maxlen		= sizeof(unsigned int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec,
	},
	{
		.procname	= "nf_conntrack_events_retry_timeout",
		.data		= &init_net.ct.sysctl_events_retry_timeout,
		.maxlen		= sizeof(unsigned int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec_jiffies,
	},
	{}
};
#endif /* CONFIG_SYSCTL */

static struct nf_ct_ext_type event_extend __read_mostly = {
	.len	= sizeof(struct nf_conntrack_ecache),
	.align	= __alignof__(struct nf_conntrack_ecache),
	.id	= NF_CT_EXT_ECACHE,
};

#ifdef CONFIG_SYSCTL
static int nf_conntrack_event_init_sysctl(struct net *net)
{
	struct ctl_table *table;

	table = kmemdup(event_sysctl_table, sizeof(event_sysctl_table),
			GFP_KERNEL);
	if (!table)
		goto out;

	table[0].data = &net->ct.sysctl_events;
	table[1].data = &net->ct.sysctl_events_retry_timeout;

	net->ct.event_sysctl_header =
		register_net_sysctl_table(net,
					  nf_net_netfilter_sysctl_path, table);
	if (!net->ct.event_sysctl_header) {
		printk(KERN_ERR "nf_ct_event: can't register to sysctl.\n");
		goto out_register;
	}
	return 0;

out_register:
	kfree(table);
out:
	return -ENOMEM;
}

static void nf_conntrack_event_fini_sysctl(struct net *net)
{
	struct ctl_table *table;

	table = net->ct.event_sysctl_header->ctl_table_arg;
	unregister_net_sysctl_table(net->ct.event_sysctl_header);
	kfree(table);
}
#else
static int nf_conntrack_event_init_sysctl(struct net *net)
{
	return 0;
}

static void nf_conntrack_event_fini_sysctl(struct net *net)
{
}
#endif /* CONFIG_SYSCTL */

int nf_conntrack_ecache_init(struct net *net)
{
	int ret;

	net->ct.sysctl_events = nf_ct_events;
	net->ct.sysctl_events_retry_timeout = nf_ct_events_retry_timeout;

	if (net_eq(net, &init_net)) {
		ret = nf_ct_extend_register(&event_extend);
		if (ret < 0) {
			printk(KERN_ERR "nf_ct_event: Unable to register "
					"event extension.\n");
			goto out_extend_register;
		}
	}

	ret = nf_conntrack_event_init_sysctl(net);
	if (ret < 0)
		goto out_sysctl;

	return 0;

out_sysctl:
	if (net_eq(net, &init_net))
		nf_ct_extend_unregister(&event_extend);
out_extend_register:
	return ret;
}

void nf_conntrack_ecache_fini(struct net *net)
{
	nf_conntrack_event_fini_sysctl(net);
	if (net_eq(net, &init_net))
		nf_ct_extend_unregister(&event_extend);
}
Commit	Line	Data
f6180121 MJ	1	/* Event cache for netfilter. */
	2
	3	/* (C) 1999-2001 Paul `Rusty' Russell
	4	* (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
	5	* (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
	6	*
	7	* This program is free software; you can redistribute it and/or modify
	8	* it under the terms of the GNU General Public License version 2 as
	9	* published by the Free Software Foundation.
	10	*/
	11
	12	#include <linux/types.h>
	13	#include <linux/netfilter.h>
	14	#include <linux/skbuff.h>
	15	#include <linux/vmalloc.h>
	16	#include <linux/stddef.h>
	17	#include <linux/err.h>
	18	#include <linux/percpu.h>
f6180121 MJ	19	#include <linux/kernel.h>
f6180121 MJ	20	#include <linux/netdevice.h>
5a0e3ad6	21	#include <linux/slab.h>
f6180121 MJ	22
f6180121 MJ	23	#include <net/netfilter/nf_conntrack.h>
f6180121	24	#include <net/netfilter/nf_conntrack_core.h>
a0891aa6	25	#include <net/netfilter/nf_conntrack_extend.h>
f6180121	26
e34d5c1a	27	static DEFINE_MUTEX(nf_ct_ecache_mutex);
13b18339	28
0906a372	29	struct nf_ct_event_notifier __rcu *nf_conntrack_event_cb __read_mostly;
e34d5c1a PNA	30	EXPORT_SYMBOL_GPL(nf_conntrack_event_cb);
e34d5c1a PNA	31
0906a372	32	struct nf_exp_event_notifier __rcu *nf_expect_event_cb __read_mostly;
e34d5c1a	33	EXPORT_SYMBOL_GPL(nf_expect_event_cb);
f6180121	34
f6180121 MJ	35	/* deliver cached events and clear cache entry - must be called with locally
f6180121 MJ	36	* disabled softirqs */
a0891aa6	37	void nf_ct_deliver_cached_events(struct nf_conn *ct)
f6180121	38	{
a0891aa6	39	unsigned long events;
e34d5c1a	40	struct nf_ct_event_notifier *notify;
a0891aa6	41	struct nf_conntrack_ecache *e;
e34d5c1a PNA	42
	43	rcu_read_lock();
	44	notify = rcu_dereference(nf_conntrack_event_cb);
	45	if (notify == NULL)
	46	goto out_unlock;
	47
a0891aa6 PNA	48	e = nf_ct_ecache_find(ct);
	49	if (e == NULL)
	50	goto out_unlock;
	51
	52	events = xchg(&e->cache, 0);
	53
	54	if (nf_ct_is_confirmed(ct) && !nf_ct_is_dying(ct) && events) {
19abb7b0	55	struct nf_ct_event item = {
a0891aa6	56	.ct = ct,
19abb7b0 PNA	57	.pid = 0,
	58	.report = 0
	59	};
dd7669a9 PNA	60	int ret;
	61	/* We make a copy of the missed event cache without taking
	62	* the lock, thus we may send missed events twice. However,
	63	* this does not harm and it happens very rarely. */
	64	unsigned long missed = e->missed;
	65
3db7e93d PNA	66	if (!((events \| missed) & e->ctmask))
	67	goto out_unlock;
	68
dd7669a9 PNA	69	ret = notify->fcn(events \| missed, &item);
	70	if (unlikely(ret < 0 \|\| missed)) {
	71	spin_lock_bh(&ct->lock);
	72	if (ret < 0)
	73	e->missed \|= events;
	74	else
	75	e->missed &= ~missed;
	76	spin_unlock_bh(&ct->lock);
	77	}
19abb7b0	78	}
f6180121	79
e34d5c1a PNA	80	out_unlock:
e34d5c1a PNA	81	rcu_read_unlock();
f6180121	82	}
13b18339	83	EXPORT_SYMBOL_GPL(nf_ct_deliver_cached_events);
f6180121	84
e34d5c1a	85	int nf_conntrack_register_notifier(struct nf_ct_event_notifier *new)
010c7d6f	86	{
e34d5c1a	87	int ret = 0;
b56f2d55	88	struct nf_ct_event_notifier *notify;
e34d5c1a PNA	89
e34d5c1a PNA	90	mutex_lock(&nf_ct_ecache_mutex);
b56f2d55 PM	91	notify = rcu_dereference_protected(nf_conntrack_event_cb,
	92	lockdep_is_held(&nf_ct_ecache_mutex));
	93	if (notify != NULL) {
e34d5c1a PNA	94	ret = -EBUSY;
	95	goto out_unlock;
	96	}
	97	rcu_assign_pointer(nf_conntrack_event_cb, new);
	98	mutex_unlock(&nf_ct_ecache_mutex);
	99	return ret;
	100
	101	out_unlock:
	102	mutex_unlock(&nf_ct_ecache_mutex);
	103	return ret;
010c7d6f PM	104	}
	105	EXPORT_SYMBOL_GPL(nf_conntrack_register_notifier);
	106
e34d5c1a	107	void nf_conntrack_unregister_notifier(struct nf_ct_event_notifier *new)
010c7d6f	108	{
b56f2d55 PM	109	struct nf_ct_event_notifier *notify;
b56f2d55 PM	110
e34d5c1a	111	mutex_lock(&nf_ct_ecache_mutex);
b56f2d55 PM	112	notify = rcu_dereference_protected(nf_conntrack_event_cb,
	113	lockdep_is_held(&nf_ct_ecache_mutex));
	114	BUG_ON(notify != new);
e34d5c1a PNA	115	rcu_assign_pointer(nf_conntrack_event_cb, NULL);
e34d5c1a PNA	116	mutex_unlock(&nf_ct_ecache_mutex);
010c7d6f PM	117	}
	118	EXPORT_SYMBOL_GPL(nf_conntrack_unregister_notifier);
	119
e34d5c1a	120	int nf_ct_expect_register_notifier(struct nf_exp_event_notifier *new)
010c7d6f	121	{
e34d5c1a	122	int ret = 0;
b56f2d55	123	struct nf_exp_event_notifier *notify;
e34d5c1a PNA	124
e34d5c1a PNA	125	mutex_lock(&nf_ct_ecache_mutex);
b56f2d55 PM	126	notify = rcu_dereference_protected(nf_expect_event_cb,
	127	lockdep_is_held(&nf_ct_ecache_mutex));
	128	if (notify != NULL) {
e34d5c1a PNA	129	ret = -EBUSY;
	130	goto out_unlock;
	131	}
	132	rcu_assign_pointer(nf_expect_event_cb, new);
	133	mutex_unlock(&nf_ct_ecache_mutex);
	134	return ret;
	135
	136	out_unlock:
	137	mutex_unlock(&nf_ct_ecache_mutex);
	138	return ret;
010c7d6f	139	}
6823645d	140	EXPORT_SYMBOL_GPL(nf_ct_expect_register_notifier);
010c7d6f	141
e34d5c1a	142	void nf_ct_expect_unregister_notifier(struct nf_exp_event_notifier *new)
010c7d6f	143	{
b56f2d55 PM	144	struct nf_exp_event_notifier *notify;
b56f2d55 PM	145
e34d5c1a	146	mutex_lock(&nf_ct_ecache_mutex);
b56f2d55 PM	147	notify = rcu_dereference_protected(nf_expect_event_cb,
	148	lockdep_is_held(&nf_ct_ecache_mutex));
	149	BUG_ON(notify != new);
e34d5c1a PNA	150	rcu_assign_pointer(nf_expect_event_cb, NULL);
e34d5c1a PNA	151	mutex_unlock(&nf_ct_ecache_mutex);
010c7d6f	152	}
6823645d	153	EXPORT_SYMBOL_GPL(nf_ct_expect_unregister_notifier);
a0891aa6 PNA	154
	155	#define NF_CT_EVENTS_DEFAULT 1
	156	static int nf_ct_events __read_mostly = NF_CT_EVENTS_DEFAULT;
dd7669a9	157	static int nf_ct_events_retry_timeout __read_mostly = 15*HZ;
a0891aa6 PNA	158
	159	#ifdef CONFIG_SYSCTL
	160	static struct ctl_table event_sysctl_table[] = {
	161	{
a0891aa6 PNA	162	.procname = "nf_conntrack_events",
	163	.data = &init_net.ct.sysctl_events,
	164	.maxlen = sizeof(unsigned int),
	165	.mode = 0644,
	166	.proc_handler = proc_dointvec,
	167	},
dd7669a9	168	{
dd7669a9 PNA	169	.procname = "nf_conntrack_events_retry_timeout",
	170	.data = &init_net.ct.sysctl_events_retry_timeout,
	171	.maxlen = sizeof(unsigned int),
	172	.mode = 0644,
	173	.proc_handler = proc_dointvec_jiffies,
	174	},
a0891aa6 PNA	175	{}
	176	};
	177	#endif /* CONFIG_SYSCTL */
	178
	179	static struct nf_ct_ext_type event_extend __read_mostly = {
	180	.len = sizeof(struct nf_conntrack_ecache),
	181	.align = __alignof__(struct nf_conntrack_ecache),
	182	.id = NF_CT_EXT_ECACHE,
	183	};
	184
	185	#ifdef CONFIG_SYSCTL
	186	static int nf_conntrack_event_init_sysctl(struct net *net)
	187	{
	188	struct ctl_table *table;
	189
	190	table = kmemdup(event_sysctl_table, sizeof(event_sysctl_table),
	191	GFP_KERNEL);
	192	if (!table)
	193	goto out;
	194
	195	table[0].data = &net->ct.sysctl_events;
dd7669a9	196	table[1].data = &net->ct.sysctl_events_retry_timeout;
a0891aa6 PNA	197
	198	net->ct.event_sysctl_header =
	199	register_net_sysctl_table(net,
	200	nf_net_netfilter_sysctl_path, table);
	201	if (!net->ct.event_sysctl_header) {
	202	printk(KERN_ERR "nf_ct_event: can't register to sysctl.\n");
	203	goto out_register;
	204	}
	205	return 0;
	206
	207	out_register:
	208	kfree(table);
	209	out:
	210	return -ENOMEM;
	211	}
	212
	213	static void nf_conntrack_event_fini_sysctl(struct net *net)
	214	{
	215	struct ctl_table *table;
	216
	217	table = net->ct.event_sysctl_header->ctl_table_arg;
	218	unregister_net_sysctl_table(net->ct.event_sysctl_header);
	219	kfree(table);
	220	}
	221	#else
	222	static int nf_conntrack_event_init_sysctl(struct net *net)
	223	{
	224	return 0;
	225	}
	226
	227	static void nf_conntrack_event_fini_sysctl(struct net *net)
	228	{
	229	}
	230	#endif /* CONFIG_SYSCTL */
	231
	232	int nf_conntrack_ecache_init(struct net *net)
	233	{
	234	int ret;
	235
	236	net->ct.sysctl_events = nf_ct_events;
dd7669a9	237	net->ct.sysctl_events_retry_timeout = nf_ct_events_retry_timeout;
a0891aa6 PNA	238
	239	if (net_eq(net, &init_net)) {
	240	ret = nf_ct_extend_register(&event_extend);
	241	if (ret < 0) {
	242	printk(KERN_ERR "nf_ct_event: Unable to register "
	243	"event extension.\n");
	244	goto out_extend_register;
	245	}
	246	}
	247
	248	ret = nf_conntrack_event_init_sysctl(net);
	249	if (ret < 0)
	250	goto out_sysctl;
	251
	252	return 0;
	253
	254	out_sysctl:
	255	if (net_eq(net, &init_net))
	256	nf_ct_extend_unregister(&event_extend);
	257	out_extend_register:
	258	return ret;
	259	}
	260
	261	void nf_conntrack_ecache_fini(struct net *net)
	262	{
	263	nf_conntrack_event_fini_sysctl(net);
	264	if (net_eq(net, &init_net))
	265	nf_ct_extend_unregister(&event_extend);
	266	}