Commit | Line | Data |
---|---|---|
7e5d03bb MJ |
1 | /* Helper handling for netfilter. */ |
2 | ||
3 | /* (C) 1999-2001 Paul `Rusty' Russell | |
4 | * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org> | |
5 | * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org> | |
6 | * | |
7 | * This program is free software; you can redistribute it and/or modify | |
8 | * it under the terms of the GNU General Public License version 2 as | |
9 | * published by the Free Software Foundation. | |
10 | */ | |
11 | ||
12 | #include <linux/types.h> | |
13 | #include <linux/netfilter.h> | |
14 | #include <linux/module.h> | |
15 | #include <linux/skbuff.h> | |
16 | #include <linux/vmalloc.h> | |
17 | #include <linux/stddef.h> | |
18 | #include <linux/slab.h> | |
19 | #include <linux/random.h> | |
20 | #include <linux/err.h> | |
21 | #include <linux/kernel.h> | |
22 | #include <linux/netdevice.h> | |
23 | ||
7e5d03bb MJ |
24 | #include <net/netfilter/nf_conntrack.h> |
25 | #include <net/netfilter/nf_conntrack_l3proto.h> | |
605dcad6 | 26 | #include <net/netfilter/nf_conntrack_l4proto.h> |
7e5d03bb MJ |
27 | #include <net/netfilter/nf_conntrack_helper.h> |
28 | #include <net/netfilter/nf_conntrack_core.h> | |
ceceae1b | 29 | #include <net/netfilter/nf_conntrack_extend.h> |
7e5d03bb | 30 | |
58a3c9bb | 31 | static DEFINE_MUTEX(nf_ct_helper_mutex); |
b8a7fe6c PM |
32 | static struct hlist_head *nf_ct_helper_hash __read_mostly; |
33 | static unsigned int nf_ct_helper_hsize __read_mostly; | |
34 | static unsigned int nf_ct_helper_count __read_mostly; | |
35 | static int nf_ct_helper_vmalloc; | |
36 | ||
37 | ||
38 | /* Stupid hash, but collision free for the default registrations of the | |
39 | * helpers currently in the kernel. */ | |
40 | static unsigned int helper_hash(const struct nf_conntrack_tuple *tuple) | |
41 | { | |
42 | return (((tuple->src.l3num << 8) | tuple->dst.protonum) ^ | |
a34c4589 | 43 | (__force __u16)tuple->src.u.all) % nf_ct_helper_hsize; |
b8a7fe6c | 44 | } |
7e5d03bb MJ |
45 | |
46 | struct nf_conntrack_helper * | |
47 | __nf_ct_helper_find(const struct nf_conntrack_tuple *tuple) | |
48 | { | |
b8a7fe6c | 49 | struct nf_conntrack_helper *helper; |
d4156e8c | 50 | struct nf_conntrack_tuple_mask mask = { .src.u.all = htons(0xFFFF) }; |
b8a7fe6c PM |
51 | struct hlist_node *n; |
52 | unsigned int h; | |
7e5d03bb | 53 | |
b8a7fe6c PM |
54 | if (!nf_ct_helper_count) |
55 | return NULL; | |
56 | ||
57 | h = helper_hash(tuple); | |
58a3c9bb | 58 | hlist_for_each_entry_rcu(helper, n, &nf_ct_helper_hash[h], hnode) { |
b8a7fe6c PM |
59 | if (nf_ct_tuple_src_mask_cmp(tuple, &helper->tuple, &mask)) |
60 | return helper; | |
7e5d03bb MJ |
61 | } |
62 | return NULL; | |
63 | } | |
58a3c9bb | 64 | EXPORT_SYMBOL_GPL(__nf_ct_helper_find); |
7e5d03bb MJ |
65 | |
66 | struct nf_conntrack_helper * | |
67 | __nf_conntrack_helper_find_byname(const char *name) | |
68 | { | |
69 | struct nf_conntrack_helper *h; | |
b8a7fe6c PM |
70 | struct hlist_node *n; |
71 | unsigned int i; | |
7e5d03bb | 72 | |
b8a7fe6c | 73 | for (i = 0; i < nf_ct_helper_hsize; i++) { |
58a3c9bb | 74 | hlist_for_each_entry_rcu(h, n, &nf_ct_helper_hash[i], hnode) { |
b8a7fe6c PM |
75 | if (!strcmp(h->name, name)) |
76 | return h; | |
77 | } | |
7e5d03bb | 78 | } |
7e5d03bb MJ |
79 | return NULL; |
80 | } | |
13b18339 | 81 | EXPORT_SYMBOL_GPL(__nf_conntrack_helper_find_byname); |
7e5d03bb | 82 | |
b560580a PM |
83 | struct nf_conn_help *nf_ct_helper_ext_add(struct nf_conn *ct, gfp_t gfp) |
84 | { | |
85 | struct nf_conn_help *help; | |
86 | ||
87 | help = nf_ct_ext_add(ct, NF_CT_EXT_HELPER, gfp); | |
88 | if (help) | |
89 | INIT_HLIST_HEAD(&help->expectations); | |
90 | else | |
91 | pr_debug("failed to add helper extension area"); | |
92 | return help; | |
93 | } | |
94 | EXPORT_SYMBOL_GPL(nf_ct_helper_ext_add); | |
95 | ||
7e5d03bb MJ |
96 | static inline int unhelp(struct nf_conntrack_tuple_hash *i, |
97 | const struct nf_conntrack_helper *me) | |
98 | { | |
99 | struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(i); | |
100 | struct nf_conn_help *help = nfct_help(ct); | |
101 | ||
102 | if (help && help->helper == me) { | |
103 | nf_conntrack_event(IPCT_HELPER, ct); | |
3c158f7f | 104 | rcu_assign_pointer(help->helper, NULL); |
7e5d03bb MJ |
105 | } |
106 | return 0; | |
107 | } | |
108 | ||
109 | int nf_conntrack_helper_register(struct nf_conntrack_helper *me) | |
110 | { | |
b8a7fe6c PM |
111 | unsigned int h = helper_hash(&me->tuple); |
112 | ||
6002f266 PM |
113 | BUG_ON(me->expect_policy == NULL); |
114 | BUG_ON(me->expect_class_max >= NF_CT_MAX_EXPECT_CLASSES); | |
7e5d03bb | 115 | |
58a3c9bb PM |
116 | mutex_lock(&nf_ct_helper_mutex); |
117 | hlist_add_head_rcu(&me->hnode, &nf_ct_helper_hash[h]); | |
b8a7fe6c | 118 | nf_ct_helper_count++; |
58a3c9bb | 119 | mutex_unlock(&nf_ct_helper_mutex); |
7e5d03bb MJ |
120 | |
121 | return 0; | |
122 | } | |
13b18339 | 123 | EXPORT_SYMBOL_GPL(nf_conntrack_helper_register); |
7e5d03bb MJ |
124 | |
125 | void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me) | |
126 | { | |
7e5d03bb | 127 | struct nf_conntrack_tuple_hash *h; |
31f15875 | 128 | struct nf_conntrack_expect *exp; |
58c0fb0d | 129 | const struct hlist_node *n, *next; |
31f15875 | 130 | unsigned int i; |
7e5d03bb | 131 | |
58a3c9bb PM |
132 | mutex_lock(&nf_ct_helper_mutex); |
133 | hlist_del_rcu(&me->hnode); | |
b8a7fe6c | 134 | nf_ct_helper_count--; |
58a3c9bb PM |
135 | mutex_unlock(&nf_ct_helper_mutex); |
136 | ||
137 | /* Make sure every nothing is still using the helper unless its a | |
138 | * connection in the hash. | |
139 | */ | |
140 | synchronize_rcu(); | |
141 | ||
f8ba1aff | 142 | spin_lock_bh(&nf_conntrack_lock); |
7e5d03bb MJ |
143 | |
144 | /* Get rid of expectations */ | |
31f15875 PM |
145 | for (i = 0; i < nf_ct_expect_hsize; i++) { |
146 | hlist_for_each_entry_safe(exp, n, next, | |
147 | &nf_ct_expect_hash[i], hnode) { | |
148 | struct nf_conn_help *help = nfct_help(exp->master); | |
149 | if ((help->helper == me || exp->helper == me) && | |
150 | del_timer(&exp->timeout)) { | |
151 | nf_ct_unlink_expect(exp); | |
152 | nf_ct_expect_put(exp); | |
153 | } | |
7e5d03bb MJ |
154 | } |
155 | } | |
156 | ||
157 | /* Get rid of expecteds, set helpers to NULL. */ | |
f205c5e0 | 158 | hlist_for_each_entry(h, n, &unconfirmed, hnode) |
7e5d03bb MJ |
159 | unhelp(h, me); |
160 | for (i = 0; i < nf_conntrack_htable_size; i++) { | |
f205c5e0 | 161 | hlist_for_each_entry(h, n, &nf_conntrack_hash[i], hnode) |
7e5d03bb MJ |
162 | unhelp(h, me); |
163 | } | |
f8ba1aff | 164 | spin_unlock_bh(&nf_conntrack_lock); |
7e5d03bb | 165 | } |
13b18339 | 166 | EXPORT_SYMBOL_GPL(nf_conntrack_helper_unregister); |
ceceae1b | 167 | |
61eb3107 | 168 | static struct nf_ct_ext_type helper_extend __read_mostly = { |
ceceae1b YK |
169 | .len = sizeof(struct nf_conn_help), |
170 | .align = __alignof__(struct nf_conn_help), | |
171 | .id = NF_CT_EXT_HELPER, | |
172 | }; | |
173 | ||
8d4bc5b6 | 174 | int nf_conntrack_helper_init(void) |
ceceae1b | 175 | { |
b8a7fe6c PM |
176 | int err; |
177 | ||
178 | nf_ct_helper_hsize = 1; /* gets rounded up to use one page */ | |
179 | nf_ct_helper_hash = nf_ct_alloc_hashtable(&nf_ct_helper_hsize, | |
180 | &nf_ct_helper_vmalloc); | |
181 | if (!nf_ct_helper_hash) | |
182 | return -ENOMEM; | |
183 | ||
184 | err = nf_ct_extend_register(&helper_extend); | |
185 | if (err < 0) | |
186 | goto err1; | |
187 | ||
188 | return 0; | |
189 | ||
190 | err1: | |
191 | nf_ct_free_hashtable(nf_ct_helper_hash, nf_ct_helper_vmalloc, | |
192 | nf_ct_helper_hsize); | |
193 | return err; | |
ceceae1b YK |
194 | } |
195 | ||
8d4bc5b6 | 196 | void nf_conntrack_helper_fini(void) |
ceceae1b YK |
197 | { |
198 | nf_ct_extend_unregister(&helper_extend); | |
b8a7fe6c PM |
199 | nf_ct_free_hashtable(nf_ct_helper_hash, nf_ct_helper_vmalloc, |
200 | nf_ct_helper_hsize); | |
ceceae1b | 201 | } |