[deliverable/linux.git] / net / netfilter / xt_CT.c

/*
 * Copyright (c) 2010 Patrick McHardy <kaber@trash.net>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/module.h>
#include <linux/gfp.h>
#include <linux/skbuff.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv6/ip6_tables.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_CT.h>
#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_l4proto.h>
#include <net/netfilter/nf_conntrack_helper.h>
#include <net/netfilter/nf_conntrack_ecache.h>
#include <net/netfilter/nf_conntrack_timeout.h>
#include <net/netfilter/nf_conntrack_zones.h>

static unsigned int xt_ct_target_v0(struct sk_buff *skb,
				    const struct xt_action_param *par)
{
	const struct xt_ct_target_info *info = par->targinfo;
	struct nf_conn *ct = info->ct;

	/* Previously seen (loopback)? Ignore. */
	if (skb->nfct != NULL)
		return XT_CONTINUE;

	atomic_inc(&ct->ct_general.use);
	skb->nfct = &ct->ct_general;
	skb->nfctinfo = IP_CT_NEW;

	return XT_CONTINUE;
}

static unsigned int xt_ct_target_v1(struct sk_buff *skb,
				    const struct xt_action_param *par)
{
	const struct xt_ct_target_info_v1 *info = par->targinfo;
	struct nf_conn *ct = info->ct;

	/* Previously seen (loopback)? Ignore. */
	if (skb->nfct != NULL)
		return XT_CONTINUE;

	atomic_inc(&ct->ct_general.use);
	skb->nfct = &ct->ct_general;
	skb->nfctinfo = IP_CT_NEW;

	return XT_CONTINUE;
}

static u8 xt_ct_find_proto(const struct xt_tgchk_param *par)
{
	if (par->family == NFPROTO_IPV4) {
		const struct ipt_entry *e = par->entryinfo;

		if (e->ip.invflags & IPT_INV_PROTO)
			return 0;
		return e->ip.proto;
	} else if (par->family == NFPROTO_IPV6) {
		const struct ip6t_entry *e = par->entryinfo;

		if (e->ipv6.invflags & IP6T_INV_PROTO)
			return 0;
		return e->ipv6.proto;
	} else
		return 0;
}

static int
xt_ct_set_helper(struct nf_conn *ct, const char *helper_name,
		 const struct xt_tgchk_param *par)
{
	struct nf_conntrack_helper *helper;
	struct nf_conn_help *help;
	u8 proto;

	proto = xt_ct_find_proto(par);
	if (!proto) {
		pr_info("You must specify a L4 protocol, and not use "
			"inversions on it.\n");
		return -ENOENT;
	}

	helper = nf_conntrack_helper_try_module_get(helper_name, par->family,
						    proto);
	if (helper == NULL) {
		pr_info("No such helper \"%s\"\n", helper_name);
		return -ENOENT;
	}

	help = nf_ct_helper_ext_add(ct, helper, GFP_KERNEL);
	if (help == NULL) {
		module_put(helper->me);
		return -ENOMEM;
	}

	help->helper = helper;
	return 0;
}

static int xt_ct_tg_check_v0(const struct xt_tgchk_param *par)
{
	struct xt_ct_target_info *info = par->targinfo;
	struct nf_conntrack_tuple t;
	struct nf_conn *ct;
	int ret;

	if (info->flags & ~XT_CT_NOTRACK)
		return -EINVAL;

	if (info->flags & XT_CT_NOTRACK) {
		ct = nf_ct_untracked_get();
		atomic_inc(&ct->ct_general.use);
		goto out;
	}

#ifndef CONFIG_NF_CONNTRACK_ZONES
	if (info->zone)
		goto err1;
#endif

	ret = nf_ct_l3proto_try_module_get(par->family);
	if (ret < 0)
		goto err1;

	memset(&t, 0, sizeof(t));
	ct = nf_conntrack_alloc(par->net, info->zone, &t, &t, GFP_KERNEL);
	ret = PTR_ERR(ct);
	if (IS_ERR(ct))
		goto err2;

	ret = 0;
	if ((info->ct_events || info->exp_events) &&
	    !nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events,
				  GFP_KERNEL))
		goto err3;

	if (info->helper[0]) {
		ret = xt_ct_set_helper(ct, info->helper, par);
		if (ret < 0)
			goto err3;
	}

	__set_bit(IPS_TEMPLATE_BIT, &ct->status);
	__set_bit(IPS_CONFIRMED_BIT, &ct->status);
out:
	info->ct = ct;
	return 0;

err3:
	nf_conntrack_free(ct);
err2:
	nf_ct_l3proto_module_put(par->family);
err1:
	return ret;
}

#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
static void __xt_ct_tg_timeout_put(struct ctnl_timeout *timeout)
{
	typeof(nf_ct_timeout_put_hook) timeout_put;

	timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
	if (timeout_put)
		timeout_put(timeout);
}
#endif

static int
xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
		  const char *timeout_name)
{
#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
	typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
	struct ctnl_timeout *timeout;
	struct nf_conn_timeout *timeout_ext;
	const struct ipt_entry *e = par->entryinfo;
	struct nf_conntrack_l4proto *l4proto;
	int ret = 0;

	rcu_read_lock();
	timeout_find_get = rcu_dereference(nf_ct_timeout_find_get_hook);
	if (timeout_find_get == NULL) {
		ret = -ENOENT;
		pr_info("Timeout policy base is empty\n");
		goto out;
	}

	if (e->ip.invflags & IPT_INV_PROTO) {
		ret = -EINVAL;
		pr_info("You cannot use inversion on L4 protocol\n");
		goto out;
	}

	timeout = timeout_find_get(timeout_name);
	if (timeout == NULL) {
		ret = -ENOENT;
		pr_info("No such timeout policy \"%s\"\n", timeout_name);
		goto out;
	}

	if (timeout->l3num != par->family) {
		ret = -EINVAL;
		pr_info("Timeout policy `%s' can only be used by L3 protocol "
			"number %d\n", timeout_name, timeout->l3num);
		goto err_put_timeout;
	}
	/* Make sure the timeout policy matches any existing protocol tracker,
	 * otherwise default to generic.
	 */
	l4proto = __nf_ct_l4proto_find(par->family, e->ip.proto);
	if (timeout->l4proto->l4proto != l4proto->l4proto) {
		ret = -EINVAL;
		pr_info("Timeout policy `%s' can only be used by L4 protocol "
			"number %d\n",
			timeout_name, timeout->l4proto->l4proto);
		goto err_put_timeout;
	}
	timeout_ext = nf_ct_timeout_ext_add(ct, timeout, GFP_ATOMIC);
	if (timeout_ext == NULL)
		ret = -ENOMEM;

err_put_timeout:
	__xt_ct_tg_timeout_put(timeout);
out:
	rcu_read_unlock();
	return ret;
#else
	return -EOPNOTSUPP;
#endif
}

static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
{
	struct xt_ct_target_info_v1 *info = par->targinfo;
	struct nf_conntrack_tuple t;
	struct nf_conn *ct;
	int ret;

	if (info->flags & ~XT_CT_NOTRACK)
		return -EINVAL;

	if (info->flags & XT_CT_NOTRACK) {
		ct = nf_ct_untracked_get();
		atomic_inc(&ct->ct_general.use);
		goto out;
	}

#ifndef CONFIG_NF_CONNTRACK_ZONES
	if (info->zone)
		goto err1;
#endif

	ret = nf_ct_l3proto_try_module_get(par->family);
	if (ret < 0)
		goto err1;

	memset(&t, 0, sizeof(t));
	ct = nf_conntrack_alloc(par->net, info->zone, &t, &t, GFP_KERNEL);
	ret = PTR_ERR(ct);
	if (IS_ERR(ct))
		goto err2;

	ret = 0;
	if ((info->ct_events || info->exp_events) &&
	    !nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events,
				  GFP_KERNEL))
		goto err3;

	if (info->helper[0]) {
		ret = xt_ct_set_helper(ct, info->helper, par);
		if (ret < 0)
			goto err3;
	}

	if (info->timeout[0]) {
		ret = xt_ct_set_timeout(ct, par, info->timeout);
		if (ret < 0)
			goto err3;
	}

	__set_bit(IPS_TEMPLATE_BIT, &ct->status);
	__set_bit(IPS_CONFIRMED_BIT, &ct->status);
out:
	info->ct = ct;
	return 0;

err3:
	nf_conntrack_free(ct);
err2:
	nf_ct_l3proto_module_put(par->family);
err1:
	return ret;
}

static void xt_ct_tg_destroy_v0(const struct xt_tgdtor_param *par)
{
	struct xt_ct_target_info *info = par->targinfo;
	struct nf_conn *ct = info->ct;
	struct nf_conn_help *help;

	if (!nf_ct_is_untracked(ct)) {
		help = nfct_help(ct);
		if (help)
			module_put(help->helper->me);

		nf_ct_l3proto_module_put(par->family);
	}
	nf_ct_put(info->ct);
}

static void xt_ct_destroy_timeout(struct nf_conn *ct)
{
#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
	struct nf_conn_timeout *timeout_ext;
	typeof(nf_ct_timeout_put_hook) timeout_put;

	rcu_read_lock();
	timeout_put = rcu_dereference(nf_ct_timeout_put_hook);

	if (timeout_put) {
		timeout_ext = nf_ct_timeout_find(ct);
		if (timeout_ext)
			timeout_put(timeout_ext->timeout);
	}
	rcu_read_unlock();
#endif
}

static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param *par)
{
	struct xt_ct_target_info_v1 *info = par->targinfo;
	struct nf_conn *ct = info->ct;
	struct nf_conn_help *help;

	if (!nf_ct_is_untracked(ct)) {
		help = nfct_help(ct);
		if (help)
			module_put(help->helper->me);

		nf_ct_l3proto_module_put(par->family);

		xt_ct_destroy_timeout(ct);
	}
	nf_ct_put(info->ct);
}

static struct xt_target xt_ct_tg_reg[] __read_mostly = {
	{
		.name		= "CT",
		.family		= NFPROTO_UNSPEC,
		.targetsize	= sizeof(struct xt_ct_target_info),
		.checkentry	= xt_ct_tg_check_v0,
		.destroy	= xt_ct_tg_destroy_v0,
		.target		= xt_ct_target_v0,
		.table		= "raw",
		.me		= THIS_MODULE,
	},
	{
		.name		= "CT",
		.family		= NFPROTO_UNSPEC,
		.revision	= 1,
		.targetsize	= sizeof(struct xt_ct_target_info_v1),
		.checkentry	= xt_ct_tg_check_v1,
		.destroy	= xt_ct_tg_destroy_v1,
		.target		= xt_ct_target_v1,
		.table		= "raw",
		.me		= THIS_MODULE,
	},
};

static int __init xt_ct_tg_init(void)
{
	return xt_register_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
}

static void __exit xt_ct_tg_exit(void)
{
	xt_unregister_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
}

module_init(xt_ct_tg_init);
module_exit(xt_ct_tg_exit);

MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("Xtables: connection tracking target");
MODULE_ALIAS("ipt_CT");
MODULE_ALIAS("ip6t_CT");
Commit	Line	Data
84f3bb9a PM	1	/*
	2	* Copyright (c) 2010 Patrick McHardy <kaber@trash.net>
	3	*
	4	* This program is free software; you can redistribute it and/or modify
	5	* it under the terms of the GNU General Public License version 2 as
	6	* published by the Free Software Foundation.
	7	*/
a7fed762	8	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
84f3bb9a	9	#include <linux/module.h>
5a0e3ad6	10	#include <linux/gfp.h>
84f3bb9a	11	#include <linux/skbuff.h>
84f3bb9a PM	12	#include <linux/netfilter_ipv4/ip_tables.h>
	13	#include <linux/netfilter_ipv6/ip6_tables.h>
	14	#include <linux/netfilter/x_tables.h>
	15	#include <linux/netfilter/xt_CT.h>
	16	#include <net/netfilter/nf_conntrack.h>
eeb4cb95	17	#include <net/netfilter/nf_conntrack_l4proto.h>
84f3bb9a PM	18	#include <net/netfilter/nf_conntrack_helper.h>
84f3bb9a PM	19	#include <net/netfilter/nf_conntrack_ecache.h>
24de58f4	20	#include <net/netfilter/nf_conntrack_timeout.h>
5d0aa2cc	21	#include <net/netfilter/nf_conntrack_zones.h>
84f3bb9a	22
24de58f4 PNA	23	static unsigned int xt_ct_target_v0(struct sk_buff *skb,
24de58f4 PNA	24	const struct xt_action_param *par)
84f3bb9a PM	25	{
	26	const struct xt_ct_target_info *info = par->targinfo;
	27	struct nf_conn *ct = info->ct;
	28
	29	/* Previously seen (loopback)? Ignore. */
	30	if (skb->nfct != NULL)
	31	return XT_CONTINUE;
	32
	33	atomic_inc(&ct->ct_general.use);
	34	skb->nfct = &ct->ct_general;
	35	skb->nfctinfo = IP_CT_NEW;
	36
	37	return XT_CONTINUE;
	38	}
	39
24de58f4 PNA	40	static unsigned int xt_ct_target_v1(struct sk_buff *skb,
	41	const struct xt_action_param *par)
	42	{
	43	const struct xt_ct_target_info_v1 *info = par->targinfo;
	44	struct nf_conn *ct = info->ct;
	45
	46	/* Previously seen (loopback)? Ignore. */
	47	if (skb->nfct != NULL)
	48	return XT_CONTINUE;
	49
	50	atomic_inc(&ct->ct_general.use);
	51	skb->nfct = &ct->ct_general;
	52	skb->nfctinfo = IP_CT_NEW;
	53
	54	return XT_CONTINUE;
	55	}
	56
84f3bb9a PM	57	static u8 xt_ct_find_proto(const struct xt_tgchk_param *par)
84f3bb9a PM	58	{
076f7839	59	if (par->family == NFPROTO_IPV4) {
84f3bb9a PM	60	const struct ipt_entry *e = par->entryinfo;
	61
	62	if (e->ip.invflags & IPT_INV_PROTO)
	63	return 0;
	64	return e->ip.proto;
076f7839	65	} else if (par->family == NFPROTO_IPV6) {
84f3bb9a PM	66	const struct ip6t_entry *e = par->entryinfo;
	67
	68	if (e->ipv6.invflags & IP6T_INV_PROTO)
	69	return 0;
	70	return e->ipv6.proto;
	71	} else
	72	return 0;
	73	}
	74
236df005 PNA	75	static int
	76	xt_ct_set_helper(struct nf_conn ct, const char helper_name,
	77	const struct xt_tgchk_param *par)
	78	{
	79	struct nf_conntrack_helper *helper;
	80	struct nf_conn_help *help;
	81	u8 proto;
	82
	83	proto = xt_ct_find_proto(par);
	84	if (!proto) {
	85	pr_info("You must specify a L4 protocol, and not use "
	86	"inversions on it.\n");
	87	return -ENOENT;
	88	}
	89
	90	helper = nf_conntrack_helper_try_module_get(helper_name, par->family,
	91	proto);
	92	if (helper == NULL) {
	93	pr_info("No such helper \"%s\"\n", helper_name);
	94	return -ENOENT;
	95	}
	96
	97	help = nf_ct_helper_ext_add(ct, helper, GFP_KERNEL);
	98	if (help == NULL) {
	99	module_put(helper->me);
	100	return -ENOMEM;
	101	}
	102
	103	help->helper = helper;
	104	return 0;
	105	}
	106
24de58f4	107	static int xt_ct_tg_check_v0(const struct xt_tgchk_param *par)
84f3bb9a PM	108	{
	109	struct xt_ct_target_info *info = par->targinfo;
	110	struct nf_conntrack_tuple t;
84f3bb9a	111	struct nf_conn *ct;
236df005	112	int ret;
84f3bb9a	113
9bf04646 PNA	114	if (info->flags & ~XT_CT_NOTRACK)
9bf04646 PNA	115	return -EINVAL;
84f3bb9a PM	116
84f3bb9a PM	117	if (info->flags & XT_CT_NOTRACK) {
5bfddbd4	118	ct = nf_ct_untracked_get();
84f3bb9a PM	119	atomic_inc(&ct->ct_general.use);
	120	goto out;
	121	}
	122
5d0aa2cc PM	123	#ifndef CONFIG_NF_CONNTRACK_ZONES
	124	if (info->zone)
	125	goto err1;
	126	#endif
	127
4a5a5c73 JE	128	ret = nf_ct_l3proto_try_module_get(par->family);
4a5a5c73 JE	129	if (ret < 0)
84f3bb9a PM	130	goto err1;
	131
	132	memset(&t, 0, sizeof(t));
5d0aa2cc	133	ct = nf_conntrack_alloc(par->net, info->zone, &t, &t, GFP_KERNEL);
4a5a5c73	134	ret = PTR_ERR(ct);
84f3bb9a PM	135	if (IS_ERR(ct))
	136	goto err2;
	137
4a5a5c73	138	ret = 0;
84f3bb9a PM	139	if ((info->ct_events \|\| info->exp_events) &&
	140	!nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events,
	141	GFP_KERNEL))
	142	goto err3;
	143
9bf04646	144	if (info->helper[0]) {
236df005 PNA	145	ret = xt_ct_set_helper(ct, info->helper, par);
236df005 PNA	146	if (ret < 0)
1afc5679	147	goto err3;
84f3bb9a PM	148	}
	149
	150	__set_bit(IPS_TEMPLATE_BIT, &ct->status);
	151	__set_bit(IPS_CONFIRMED_BIT, &ct->status);
	152	out:
	153	info->ct = ct;
d6b00a53	154	return 0;
84f3bb9a PM	155
	156	err3:
	157	nf_conntrack_free(ct);
	158	err2:
	159	nf_ct_l3proto_module_put(par->family);
	160	err1:
4a5a5c73	161	return ret;
84f3bb9a PM	162	}
84f3bb9a PM	163
ee14186f PNA	164	#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
	165	static void __xt_ct_tg_timeout_put(struct ctnl_timeout *timeout)
	166	{
	167	typeof(nf_ct_timeout_put_hook) timeout_put;
	168
	169	timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
	170	if (timeout_put)
	171	timeout_put(timeout);
	172	}
	173	#endif
	174
236df005 PNA	175	static int
	176	xt_ct_set_timeout(struct nf_conn ct, const struct xt_tgchk_param par,
	177	const char *timeout_name)
	178	{
	179	#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
	180	typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
	181	struct ctnl_timeout *timeout;
	182	struct nf_conn_timeout *timeout_ext;
	183	const struct ipt_entry *e = par->entryinfo;
	184	struct nf_conntrack_l4proto *l4proto;
	185	int ret = 0;
	186
	187	rcu_read_lock();
	188	timeout_find_get = rcu_dereference(nf_ct_timeout_find_get_hook);
	189	if (timeout_find_get == NULL) {
	190	ret = -ENOENT;
	191	pr_info("Timeout policy base is empty\n");
	192	goto out;
	193	}
	194
	195	if (e->ip.invflags & IPT_INV_PROTO) {
	196	ret = -EINVAL;
	197	pr_info("You cannot use inversion on L4 protocol\n");
	198	goto out;
	199	}
	200
	201	timeout = timeout_find_get(timeout_name);
	202	if (timeout == NULL) {
	203	ret = -ENOENT;
	204	pr_info("No such timeout policy \"%s\"\n", timeout_name);
	205	goto out;
	206	}
	207
	208	if (timeout->l3num != par->family) {
	209	ret = -EINVAL;
	210	pr_info("Timeout policy `%s' can only be used by L3 protocol "
	211	"number %d\n", timeout_name, timeout->l3num);
	212	goto err_put_timeout;
	213	}
	214	/* Make sure the timeout policy matches any existing protocol tracker,
	215	* otherwise default to generic.
	216	*/
	217	l4proto = __nf_ct_l4proto_find(par->family, e->ip.proto);
	218	if (timeout->l4proto->l4proto != l4proto->l4proto) {
	219	ret = -EINVAL;
	220	pr_info("Timeout policy `%s' can only be used by L4 protocol "
	221	"number %d\n",
	222	timeout_name, timeout->l4proto->l4proto);
	223	goto err_put_timeout;
	224	}
	225	timeout_ext = nf_ct_timeout_ext_add(ct, timeout, GFP_ATOMIC);
	226	if (timeout_ext == NULL)
	227	ret = -ENOMEM;
	228
	229	err_put_timeout:
	230	__xt_ct_tg_timeout_put(timeout);
	231	out:
	232	rcu_read_unlock();
	233	return ret;
	234	#else
	235	return -EOPNOTSUPP;
	236	#endif
	237	}
	238
24de58f4 PNA	239	static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
	240	{
	241	struct xt_ct_target_info_v1 *info = par->targinfo;
	242	struct nf_conntrack_tuple t;
24de58f4	243	struct nf_conn *ct;
236df005 PNA	244	int ret;
236df005 PNA	245
24de58f4 PNA	246	if (info->flags & ~XT_CT_NOTRACK)
	247	return -EINVAL;
	248
	249	if (info->flags & XT_CT_NOTRACK) {
	250	ct = nf_ct_untracked_get();
	251	atomic_inc(&ct->ct_general.use);
	252	goto out;
	253	}
	254
	255	#ifndef CONFIG_NF_CONNTRACK_ZONES
	256	if (info->zone)
	257	goto err1;
	258	#endif
	259
	260	ret = nf_ct_l3proto_try_module_get(par->family);
	261	if (ret < 0)
	262	goto err1;
	263
	264	memset(&t, 0, sizeof(t));
	265	ct = nf_conntrack_alloc(par->net, info->zone, &t, &t, GFP_KERNEL);
	266	ret = PTR_ERR(ct);
	267	if (IS_ERR(ct))
	268	goto err2;
	269
	270	ret = 0;
	271	if ((info->ct_events \|\| info->exp_events) &&
	272	!nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events,
	273	GFP_KERNEL))
	274	goto err3;
	275
	276	if (info->helper[0]) {
236df005 PNA	277	ret = xt_ct_set_helper(ct, info->helper, par);
236df005 PNA	278	if (ret < 0)
1afc5679	279	goto err3;
24de58f4 PNA	280	}
24de58f4 PNA	281
6cf51852	282	if (info->timeout[0]) {
236df005 PNA	283	ret = xt_ct_set_timeout(ct, par, info->timeout);
	284	if (ret < 0)
	285	goto err3;
24de58f4	286	}
24de58f4 PNA	287
	288	__set_bit(IPS_TEMPLATE_BIT, &ct->status);
	289	__set_bit(IPS_CONFIRMED_BIT, &ct->status);
	290	out:
	291	info->ct = ct;
	292	return 0;
	293
	294	err3:
	295	nf_conntrack_free(ct);
	296	err2:
	297	nf_ct_l3proto_module_put(par->family);
	298	err1:
	299	return ret;
	300	}
	301
	302	static void xt_ct_tg_destroy_v0(const struct xt_tgdtor_param *par)
84f3bb9a PM	303	{
	304	struct xt_ct_target_info *info = par->targinfo;
	305	struct nf_conn *ct = info->ct;
	306	struct nf_conn_help *help;
	307
5bfddbd4	308	if (!nf_ct_is_untracked(ct)) {
84f3bb9a PM	309	help = nfct_help(ct);
	310	if (help)
	311	module_put(help->helper->me);
	312
	313	nf_ct_l3proto_module_put(par->family);
	314	}
	315	nf_ct_put(info->ct);
	316	}
	317
236df005	318	static void xt_ct_destroy_timeout(struct nf_conn *ct)
24de58f4	319	{
24de58f4 PNA	320	#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
	321	struct nf_conn_timeout *timeout_ext;
	322	typeof(nf_ct_timeout_put_hook) timeout_put;
236df005 PNA	323
	324	rcu_read_lock();
	325	timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
	326
	327	if (timeout_put) {
	328	timeout_ext = nf_ct_timeout_find(ct);
	329	if (timeout_ext)
	330	timeout_put(timeout_ext->timeout);
	331	}
	332	rcu_read_unlock();
24de58f4	333	#endif
236df005 PNA	334	}
	335
	336	static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param *par)
	337	{
	338	struct xt_ct_target_info_v1 *info = par->targinfo;
	339	struct nf_conn *ct = info->ct;
	340	struct nf_conn_help *help;
	341
24de58f4 PNA	342	if (!nf_ct_is_untracked(ct)) {
	343	help = nfct_help(ct);
	344	if (help)
	345	module_put(help->helper->me);
	346
	347	nf_ct_l3proto_module_put(par->family);
	348
236df005	349	xt_ct_destroy_timeout(ct);
24de58f4 PNA	350	}
	351	nf_ct_put(info->ct);
	352	}
	353
	354	static struct xt_target xt_ct_tg_reg[] __read_mostly = {
	355	{
	356	.name = "CT",
	357	.family = NFPROTO_UNSPEC,
	358	.targetsize = sizeof(struct xt_ct_target_info),
	359	.checkentry = xt_ct_tg_check_v0,
	360	.destroy = xt_ct_tg_destroy_v0,
	361	.target = xt_ct_target_v0,
	362	.table = "raw",
	363	.me = THIS_MODULE,
	364	},
	365	{
	366	.name = "CT",
	367	.family = NFPROTO_UNSPEC,
	368	.revision = 1,
	369	.targetsize = sizeof(struct xt_ct_target_info_v1),
	370	.checkentry = xt_ct_tg_check_v1,
	371	.destroy = xt_ct_tg_destroy_v1,
	372	.target = xt_ct_target_v1,
	373	.table = "raw",
	374	.me = THIS_MODULE,
	375	},
84f3bb9a PM	376	};
	377
	378	static int __init xt_ct_tg_init(void)
	379	{
24de58f4	380	return xt_register_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
84f3bb9a PM	381	}
	382
	383	static void __exit xt_ct_tg_exit(void)
	384	{
24de58f4	385	xt_unregister_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
84f3bb9a PM	386	}
	387
	388	module_init(xt_ct_tg_init);
	389	module_exit(xt_ct_tg_exit);
	390
	391	MODULE_LICENSE("GPL");
	392	MODULE_DESCRIPTION("Xtables: connection tracking target");
	393	MODULE_ALIAS("ipt_CT");
	394	MODULE_ALIAS("ip6t_CT");