1 /* Expectation handling for nf_conntrack. */
3 /* (C) 1999-2001 Paul `Rusty' Russell
4 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
5 * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
12 #include <linux/types.h>
13 #include <linux/netfilter.h>
14 #include <linux/skbuff.h>
15 #include <linux/proc_fs.h>
16 #include <linux/seq_file.h>
17 #include <linux/stddef.h>
18 #include <linux/slab.h>
19 #include <linux/err.h>
20 #include <linux/percpu.h>
21 #include <linux/kernel.h>
22 #include <linux/jhash.h>
24 #include <net/netfilter/nf_conntrack.h>
25 #include <net/netfilter/nf_conntrack_core.h>
26 #include <net/netfilter/nf_conntrack_expect.h>
27 #include <net/netfilter/nf_conntrack_helper.h>
28 #include <net/netfilter/nf_conntrack_tuple.h>
30 struct hlist_head
*nf_ct_expect_hash __read_mostly
;
31 EXPORT_SYMBOL_GPL(nf_ct_expect_hash
);
33 unsigned int nf_ct_expect_hsize __read_mostly
;
34 EXPORT_SYMBOL_GPL(nf_ct_expect_hsize
);
36 static unsigned int nf_ct_expect_hash_rnd __read_mostly
;
37 static unsigned int nf_ct_expect_count
;
38 static int nf_ct_expect_hash_rnd_initted __read_mostly
;
39 static int nf_ct_expect_vmalloc
;
41 static struct kmem_cache
*nf_ct_expect_cachep __read_mostly
;
42 static unsigned int nf_ct_expect_next_id
;
44 /* nf_conntrack_expect helper functions */
45 void nf_ct_unlink_expect(struct nf_conntrack_expect
*exp
)
47 struct nf_conn_help
*master_help
= nfct_help(exp
->master
);
49 NF_CT_ASSERT(master_help
);
50 NF_CT_ASSERT(!timer_pending(&exp
->timeout
));
52 hlist_del(&exp
->hnode
);
55 hlist_del(&exp
->lnode
);
56 master_help
->expecting
--;
57 nf_ct_expect_put(exp
);
59 NF_CT_STAT_INC(expect_delete
);
61 EXPORT_SYMBOL_GPL(nf_ct_unlink_expect
);
63 static void nf_ct_expectation_timed_out(unsigned long ul_expect
)
65 struct nf_conntrack_expect
*exp
= (void *)ul_expect
;
67 write_lock_bh(&nf_conntrack_lock
);
68 nf_ct_unlink_expect(exp
);
69 write_unlock_bh(&nf_conntrack_lock
);
70 nf_ct_expect_put(exp
);
73 static unsigned int nf_ct_expect_dst_hash(const struct nf_conntrack_tuple
*tuple
)
75 if (unlikely(!nf_ct_expect_hash_rnd_initted
)) {
76 get_random_bytes(&nf_ct_expect_hash_rnd
, 4);
77 nf_ct_expect_hash_rnd_initted
= 1;
80 return jhash2(tuple
->dst
.u3
.all
, ARRAY_SIZE(tuple
->dst
.u3
.all
),
81 (((tuple
->dst
.protonum
^ tuple
->src
.l3num
) << 16) |
82 tuple
->dst
.u
.all
) ^ nf_ct_expect_hash_rnd
) %
86 struct nf_conntrack_expect
*
87 __nf_ct_expect_find(const struct nf_conntrack_tuple
*tuple
)
89 struct nf_conntrack_expect
*i
;
93 if (!nf_ct_expect_count
)
96 h
= nf_ct_expect_dst_hash(tuple
);
97 hlist_for_each_entry(i
, n
, &nf_ct_expect_hash
[h
], hnode
) {
98 if (nf_ct_tuple_mask_cmp(tuple
, &i
->tuple
, &i
->mask
))
103 EXPORT_SYMBOL_GPL(__nf_ct_expect_find
);
105 /* Just find a expectation corresponding to a tuple. */
106 struct nf_conntrack_expect
*
107 nf_ct_expect_find_get(const struct nf_conntrack_tuple
*tuple
)
109 struct nf_conntrack_expect
*i
;
111 read_lock_bh(&nf_conntrack_lock
);
112 i
= __nf_ct_expect_find(tuple
);
115 read_unlock_bh(&nf_conntrack_lock
);
119 EXPORT_SYMBOL_GPL(nf_ct_expect_find_get
);
121 /* If an expectation for this connection is found, it gets delete from
122 * global list then returned. */
123 struct nf_conntrack_expect
*
124 nf_ct_find_expectation(const struct nf_conntrack_tuple
*tuple
)
126 struct nf_conntrack_expect
*exp
;
128 exp
= __nf_ct_expect_find(tuple
);
132 /* If master is not in hash table yet (ie. packet hasn't left
133 this machine yet), how can other end know about expected?
134 Hence these are not the droids you are looking for (if
135 master ct never got confirmed, we'd hold a reference to it
136 and weird things would happen to future packets). */
137 if (!nf_ct_is_confirmed(exp
->master
))
140 if (exp
->flags
& NF_CT_EXPECT_PERMANENT
) {
141 atomic_inc(&exp
->use
);
143 } else if (del_timer(&exp
->timeout
)) {
144 nf_ct_unlink_expect(exp
);
151 /* delete all expectations for this conntrack */
152 void nf_ct_remove_expectations(struct nf_conn
*ct
)
154 struct nf_conn_help
*help
= nfct_help(ct
);
155 struct nf_conntrack_expect
*exp
;
156 struct hlist_node
*n
, *next
;
158 /* Optimization: most connection never expect any others. */
159 if (!help
|| help
->expecting
== 0)
162 hlist_for_each_entry_safe(exp
, n
, next
, &help
->expectations
, lnode
) {
163 if (del_timer(&exp
->timeout
)) {
164 nf_ct_unlink_expect(exp
);
165 nf_ct_expect_put(exp
);
169 EXPORT_SYMBOL_GPL(nf_ct_remove_expectations
);
171 /* Would two expected things clash? */
172 static inline int expect_clash(const struct nf_conntrack_expect
*a
,
173 const struct nf_conntrack_expect
*b
)
175 /* Part covered by intersection of masks must be unequal,
176 otherwise they clash */
177 struct nf_conntrack_tuple_mask intersect_mask
;
180 intersect_mask
.src
.u
.all
= a
->mask
.src
.u
.all
& b
->mask
.src
.u
.all
;
182 for (count
= 0; count
< NF_CT_TUPLE_L3SIZE
; count
++){
183 intersect_mask
.src
.u3
.all
[count
] =
184 a
->mask
.src
.u3
.all
[count
] & b
->mask
.src
.u3
.all
[count
];
187 return nf_ct_tuple_mask_cmp(&a
->tuple
, &b
->tuple
, &intersect_mask
);
190 static inline int expect_matches(const struct nf_conntrack_expect
*a
,
191 const struct nf_conntrack_expect
*b
)
193 return a
->master
== b
->master
194 && nf_ct_tuple_equal(&a
->tuple
, &b
->tuple
)
195 && nf_ct_tuple_mask_equal(&a
->mask
, &b
->mask
);
198 /* Generally a bad idea to call this: could have matched already. */
199 void nf_ct_unexpect_related(struct nf_conntrack_expect
*exp
)
201 write_lock_bh(&nf_conntrack_lock
);
202 if (del_timer(&exp
->timeout
)) {
203 nf_ct_unlink_expect(exp
);
204 nf_ct_expect_put(exp
);
206 write_unlock_bh(&nf_conntrack_lock
);
208 EXPORT_SYMBOL_GPL(nf_ct_unexpect_related
);
210 /* We don't increase the master conntrack refcount for non-fulfilled
211 * conntracks. During the conntrack destruction, the expectations are
212 * always killed before the conntrack itself */
213 struct nf_conntrack_expect
*nf_ct_expect_alloc(struct nf_conn
*me
)
215 struct nf_conntrack_expect
*new;
217 new = kmem_cache_alloc(nf_ct_expect_cachep
, GFP_ATOMIC
);
222 atomic_set(&new->use
, 1);
225 EXPORT_SYMBOL_GPL(nf_ct_expect_alloc
);
227 void nf_ct_expect_init(struct nf_conntrack_expect
*exp
, int family
,
228 union nf_conntrack_address
*saddr
,
229 union nf_conntrack_address
*daddr
,
230 u_int8_t proto
, __be16
*src
, __be16
*dst
)
234 if (family
== AF_INET
)
240 exp
->expectfn
= NULL
;
242 exp
->tuple
.src
.l3num
= family
;
243 exp
->tuple
.dst
.protonum
= proto
;
246 memcpy(&exp
->tuple
.src
.u3
, saddr
, len
);
247 if (sizeof(exp
->tuple
.src
.u3
) > len
)
248 /* address needs to be cleared for nf_ct_tuple_equal */
249 memset((void *)&exp
->tuple
.src
.u3
+ len
, 0x00,
250 sizeof(exp
->tuple
.src
.u3
) - len
);
251 memset(&exp
->mask
.src
.u3
, 0xFF, len
);
252 if (sizeof(exp
->mask
.src
.u3
) > len
)
253 memset((void *)&exp
->mask
.src
.u3
+ len
, 0x00,
254 sizeof(exp
->mask
.src
.u3
) - len
);
256 memset(&exp
->tuple
.src
.u3
, 0x00, sizeof(exp
->tuple
.src
.u3
));
257 memset(&exp
->mask
.src
.u3
, 0x00, sizeof(exp
->mask
.src
.u3
));
261 exp
->tuple
.src
.u
.all
= (__force u16
)*src
;
262 exp
->mask
.src
.u
.all
= 0xFFFF;
264 exp
->tuple
.src
.u
.all
= 0;
265 exp
->mask
.src
.u
.all
= 0;
268 memcpy(&exp
->tuple
.dst
.u3
, daddr
, len
);
269 if (sizeof(exp
->tuple
.dst
.u3
) > len
)
270 /* address needs to be cleared for nf_ct_tuple_equal */
271 memset((void *)&exp
->tuple
.dst
.u3
+ len
, 0x00,
272 sizeof(exp
->tuple
.dst
.u3
) - len
);
274 exp
->tuple
.dst
.u
.all
= (__force u16
)*dst
;
276 EXPORT_SYMBOL_GPL(nf_ct_expect_init
);
278 void nf_ct_expect_put(struct nf_conntrack_expect
*exp
)
280 if (atomic_dec_and_test(&exp
->use
))
281 kmem_cache_free(nf_ct_expect_cachep
, exp
);
283 EXPORT_SYMBOL_GPL(nf_ct_expect_put
);
285 static void nf_ct_expect_insert(struct nf_conntrack_expect
*exp
)
287 struct nf_conn_help
*master_help
= nfct_help(exp
->master
);
288 unsigned int h
= nf_ct_expect_dst_hash(&exp
->tuple
);
290 atomic_inc(&exp
->use
);
292 hlist_add_head(&exp
->lnode
, &master_help
->expectations
);
293 master_help
->expecting
++;
295 hlist_add_head(&exp
->hnode
, &nf_ct_expect_hash
[h
]);
296 nf_ct_expect_count
++;
298 setup_timer(&exp
->timeout
, nf_ct_expectation_timed_out
,
300 exp
->timeout
.expires
= jiffies
+ master_help
->helper
->timeout
* HZ
;
301 add_timer(&exp
->timeout
);
303 exp
->id
= ++nf_ct_expect_next_id
;
304 atomic_inc(&exp
->use
);
305 NF_CT_STAT_INC(expect_create
);
308 /* Race with expectations being used means we could have none to find; OK. */
309 static void evict_oldest_expect(struct nf_conn
*master
)
311 struct nf_conn_help
*master_help
= nfct_help(master
);
312 struct nf_conntrack_expect
*exp
= NULL
;
313 struct hlist_node
*n
;
315 hlist_for_each_entry(exp
, n
, &master_help
->expectations
, lnode
)
318 if (exp
&& del_timer(&exp
->timeout
)) {
319 nf_ct_unlink_expect(exp
);
320 nf_ct_expect_put(exp
);
324 static inline int refresh_timer(struct nf_conntrack_expect
*i
)
326 struct nf_conn_help
*master_help
= nfct_help(i
->master
);
328 if (!del_timer(&i
->timeout
))
331 i
->timeout
.expires
= jiffies
+ master_help
->helper
->timeout
*HZ
;
332 add_timer(&i
->timeout
);
336 int nf_ct_expect_related(struct nf_conntrack_expect
*expect
)
338 struct nf_conntrack_expect
*i
;
339 struct nf_conn
*master
= expect
->master
;
340 struct nf_conn_help
*master_help
= nfct_help(master
);
341 struct hlist_node
*n
;
345 NF_CT_ASSERT(master_help
);
347 write_lock_bh(&nf_conntrack_lock
);
348 if (!master_help
->helper
) {
352 h
= nf_ct_expect_dst_hash(&expect
->tuple
);
353 hlist_for_each_entry(i
, n
, &nf_ct_expect_hash
[h
], hnode
) {
354 if (expect_matches(i
, expect
)) {
355 /* Refresh timer: if it's dying, ignore.. */
356 if (refresh_timer(i
)) {
360 } else if (expect_clash(i
, expect
)) {
365 /* Will be over limit? */
366 if (master_help
->helper
->max_expected
&&
367 master_help
->expecting
>= master_help
->helper
->max_expected
)
368 evict_oldest_expect(master
);
370 nf_ct_expect_insert(expect
);
371 nf_ct_expect_event(IPEXP_NEW
, expect
);
374 write_unlock_bh(&nf_conntrack_lock
);
377 EXPORT_SYMBOL_GPL(nf_ct_expect_related
);
379 #ifdef CONFIG_PROC_FS
380 struct ct_expect_iter_state
{
384 static struct hlist_node
*ct_expect_get_first(struct seq_file
*seq
)
386 struct ct_expect_iter_state
*st
= seq
->private;
388 for (st
->bucket
= 0; st
->bucket
< nf_ct_expect_hsize
; st
->bucket
++) {
389 if (!hlist_empty(&nf_ct_expect_hash
[st
->bucket
]))
390 return nf_ct_expect_hash
[st
->bucket
].first
;
395 static struct hlist_node
*ct_expect_get_next(struct seq_file
*seq
,
396 struct hlist_node
*head
)
398 struct ct_expect_iter_state
*st
= seq
->private;
401 while (head
== NULL
) {
402 if (++st
->bucket
>= nf_ct_expect_hsize
)
404 head
= nf_ct_expect_hash
[st
->bucket
].first
;
409 static struct hlist_node
*ct_expect_get_idx(struct seq_file
*seq
, loff_t pos
)
411 struct hlist_node
*head
= ct_expect_get_first(seq
);
414 while (pos
&& (head
= ct_expect_get_next(seq
, head
)))
416 return pos
? NULL
: head
;
419 static void *exp_seq_start(struct seq_file
*seq
, loff_t
*pos
)
421 read_lock_bh(&nf_conntrack_lock
);
422 return ct_expect_get_idx(seq
, *pos
);
425 static void *exp_seq_next(struct seq_file
*seq
, void *v
, loff_t
*pos
)
428 return ct_expect_get_next(seq
, v
);
431 static void exp_seq_stop(struct seq_file
*seq
, void *v
)
433 read_unlock_bh(&nf_conntrack_lock
);
436 static int exp_seq_show(struct seq_file
*s
, void *v
)
438 struct nf_conntrack_expect
*expect
;
439 struct hlist_node
*n
= v
;
441 expect
= hlist_entry(n
, struct nf_conntrack_expect
, hnode
);
443 if (expect
->timeout
.function
)
444 seq_printf(s
, "%ld ", timer_pending(&expect
->timeout
)
445 ? (long)(expect
->timeout
.expires
- jiffies
)/HZ
: 0);
448 seq_printf(s
, "l3proto = %u proto=%u ",
449 expect
->tuple
.src
.l3num
,
450 expect
->tuple
.dst
.protonum
);
451 print_tuple(s
, &expect
->tuple
,
452 __nf_ct_l3proto_find(expect
->tuple
.src
.l3num
),
453 __nf_ct_l4proto_find(expect
->tuple
.src
.l3num
,
454 expect
->tuple
.dst
.protonum
));
455 return seq_putc(s
, '\n');
458 static struct seq_operations exp_seq_ops
= {
459 .start
= exp_seq_start
,
460 .next
= exp_seq_next
,
461 .stop
= exp_seq_stop
,
465 static int exp_open(struct inode
*inode
, struct file
*file
)
467 struct seq_file
*seq
;
468 struct ct_expect_iter_state
*st
;
471 st
= kmalloc(sizeof(struct ct_expect_iter_state
), GFP_KERNEL
);
474 ret
= seq_open(file
, &exp_seq_ops
);
477 seq
= file
->private_data
;
479 memset(st
, 0, sizeof(struct ct_expect_iter_state
));
486 static const struct file_operations exp_file_ops
= {
487 .owner
= THIS_MODULE
,
491 .release
= seq_release_private
,
493 #endif /* CONFIG_PROC_FS */
495 static int __init
exp_proc_init(void)
497 #ifdef CONFIG_PROC_FS
498 struct proc_dir_entry
*proc
;
500 proc
= proc_net_fops_create("nf_conntrack_expect", 0440, &exp_file_ops
);
503 #endif /* CONFIG_PROC_FS */
507 static void exp_proc_remove(void)
509 #ifdef CONFIG_PROC_FS
510 proc_net_remove("nf_conntrack_expect");
511 #endif /* CONFIG_PROC_FS */
514 module_param_named(expect_hashsize
, nf_ct_expect_hsize
, uint
, 0600);
516 int __init
nf_conntrack_expect_init(void)
520 if (!nf_ct_expect_hsize
) {
521 nf_ct_expect_hsize
= nf_conntrack_htable_size
/ 256;
522 if (!nf_ct_expect_hsize
)
523 nf_ct_expect_hsize
= 1;
526 nf_ct_expect_hash
= nf_ct_alloc_hashtable(&nf_ct_expect_hsize
,
527 &nf_ct_expect_vmalloc
);
528 if (nf_ct_expect_hash
== NULL
)
531 nf_ct_expect_cachep
= kmem_cache_create("nf_conntrack_expect",
532 sizeof(struct nf_conntrack_expect
),
534 if (!nf_ct_expect_cachep
)
537 err
= exp_proc_init();
544 nf_ct_free_hashtable(nf_ct_expect_hash
, nf_ct_expect_vmalloc
,
547 kmem_cache_destroy(nf_ct_expect_cachep
);
552 void nf_conntrack_expect_fini(void)
555 kmem_cache_destroy(nf_ct_expect_cachep
);
556 nf_ct_free_hashtable(nf_ct_expect_hash
, nf_ct_expect_vmalloc
,