net/netfilter/nf_conntrack_proto.c

   1 /* L3/L4 protocol support for nf_conntrack. */
   2
   3 /* (C) 1999-2001 Paul `Rusty' Russell
   4  * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
   5  * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2 as
   9  * published by the Free Software Foundation.
  10  */
  11
  12 #include <linux/types.h>
  13 #include <linux/netfilter.h>
  14 #include <linux/module.h>
  15 #include <linux/slab.h>
  16 #include <linux/mutex.h>
  17 #include <linux/vmalloc.h>
  18 #include <linux/stddef.h>
  19 #include <linux/err.h>
  20 #include <linux/percpu.h>
  21 #include <linux/notifier.h>
  22 #include <linux/kernel.h>
  23 #include <linux/netdevice.h>
  24 #include <linux/rtnetlink.h>
  25
  26 #include <net/netfilter/nf_conntrack.h>
  27 #include <net/netfilter/nf_conntrack_l3proto.h>
  28 #include <net/netfilter/nf_conntrack_l4proto.h>
  29 #include <net/netfilter/nf_conntrack_core.h>
  30
  31 static struct nf_conntrack_l4proto __rcu **nf_ct_protos[PF_MAX] __read_mostly;
  32 struct nf_conntrack_l3proto __rcu *nf_ct_l3protos[AF_MAX] __read_mostly;
  33 EXPORT_SYMBOL_GPL(nf_ct_l3protos);
  34
  35 static DEFINE_MUTEX(nf_ct_proto_mutex);
  36
  37 #ifdef CONFIG_SYSCTL
  38 static int
  39 nf_ct_register_sysctl(struct ctl_table_header **header, struct ctl_path *path,
  40                       struct ctl_table *table, unsigned int *users)
  41 {
  42         if (*header == NULL) {
  43                 *header = register_net_sysctl_table(&init_net, path, table);
  44                 if (*header == NULL)
  45                         return -ENOMEM;
  46         }
  47         if (users != NULL)
  48                 (*users)++;
  49         return 0;
  50 }
  51
  52 static void
  53 nf_ct_unregister_sysctl(struct ctl_table_header **header,
  54                         struct ctl_table *table, unsigned int *users)
  55 {
  56         if (users != NULL && --*users > 0)
  57                 return;
  58
  59         unregister_net_sysctl_table(*header);
  60         *header = NULL;
  61 }
  62 #endif
  63
  64 struct nf_conntrack_l4proto *
  65 __nf_ct_l4proto_find(u_int16_t l3proto, u_int8_t l4proto)
  66 {
  67         if (unlikely(l3proto >= AF_MAX || nf_ct_protos[l3proto] == NULL))
  68                 return &nf_conntrack_l4proto_generic;
  69
  70         return rcu_dereference(nf_ct_protos[l3proto][l4proto]);
  71 }
  72 EXPORT_SYMBOL_GPL(__nf_ct_l4proto_find);
  73
  74 /* this is guaranteed to always return a valid protocol helper, since
  75  * it falls back to generic_protocol */
  76 struct nf_conntrack_l3proto *
  77 nf_ct_l3proto_find_get(u_int16_t l3proto)
  78 {
  79         struct nf_conntrack_l3proto *p;
  80
  81         rcu_read_lock();
  82         p = __nf_ct_l3proto_find(l3proto);
  83         if (!try_module_get(p->me))
  84                 p = &nf_conntrack_l3proto_generic;
  85         rcu_read_unlock();
  86
  87         return p;
  88 }
  89 EXPORT_SYMBOL_GPL(nf_ct_l3proto_find_get);
  90
  91 void nf_ct_l3proto_put(struct nf_conntrack_l3proto *p)
  92 {
  93         module_put(p->me);
  94 }
  95 EXPORT_SYMBOL_GPL(nf_ct_l3proto_put);
  96
  97 int
  98 nf_ct_l3proto_try_module_get(unsigned short l3proto)
  99 {
 100         int ret;
 101         struct nf_conntrack_l3proto *p;
 102
 103 retry:  p = nf_ct_l3proto_find_get(l3proto);
 104         if (p == &nf_conntrack_l3proto_generic) {
 105                 ret = request_module("nf_conntrack-%d", l3proto);
 106                 if (!ret)
 107                         goto retry;
 108
 109                 return -EPROTOTYPE;
 110         }
 111
 112         return 0;
 113 }
 114 EXPORT_SYMBOL_GPL(nf_ct_l3proto_try_module_get);
 115
 116 void nf_ct_l3proto_module_put(unsigned short l3proto)
 117 {
 118         struct nf_conntrack_l3proto *p;
 119
 120         /* rcu_read_lock not necessary since the caller holds a reference, but
 121          * taken anyways to avoid lockdep warnings in __nf_ct_l3proto_find()
 122          */
 123         rcu_read_lock();
 124         p = __nf_ct_l3proto_find(l3proto);
 125         module_put(p->me);
 126         rcu_read_unlock();
 127 }
 128 EXPORT_SYMBOL_GPL(nf_ct_l3proto_module_put);
 129
 130 struct nf_conntrack_l4proto *
 131 nf_ct_l4proto_find_get(u_int16_t l3num, u_int8_t l4num)
 132 {
 133         struct nf_conntrack_l4proto *p;
 134
 135         rcu_read_lock();
 136         p = __nf_ct_l4proto_find(l3num, l4num);
 137         if (!try_module_get(p->me))
 138                 p = &nf_conntrack_l4proto_generic;
 139         rcu_read_unlock();
 140
 141         return p;
 142 }
 143 EXPORT_SYMBOL_GPL(nf_ct_l4proto_find_get);
 144
 145 void nf_ct_l4proto_put(struct nf_conntrack_l4proto *p)
 146 {
 147         module_put(p->me);
 148 }
 149 EXPORT_SYMBOL_GPL(nf_ct_l4proto_put);
 150
 151 static int kill_l3proto(struct nf_conn *i, void *data)
 152 {
 153         return nf_ct_l3num(i) == ((struct nf_conntrack_l3proto *)data)->l3proto;
 154 }
 155
 156 static int kill_l4proto(struct nf_conn *i, void *data)
 157 {
 158         struct nf_conntrack_l4proto *l4proto;
 159         l4proto = (struct nf_conntrack_l4proto *)data;
 160         return nf_ct_protonum(i) == l4proto->l4proto &&
 161                nf_ct_l3num(i) == l4proto->l3proto;
 162 }
 163
 164 static int nf_ct_l3proto_register_sysctl(struct nf_conntrack_l3proto *l3proto)
 165 {
 166         int err = 0;
 167
 168 #ifdef CONFIG_SYSCTL
 169         if (l3proto->ctl_table != NULL) {
 170                 err = nf_ct_register_sysctl(&l3proto->ctl_table_header,
 171                                             l3proto->ctl_table_path,
 172                                             l3proto->ctl_table, NULL);
 173         }
 174 #endif
 175         return err;
 176 }
 177
 178 static void nf_ct_l3proto_unregister_sysctl(struct nf_conntrack_l3proto *l3proto)
 179 {
 180 #ifdef CONFIG_SYSCTL
 181         if (l3proto->ctl_table_header != NULL)
 182                 nf_ct_unregister_sysctl(&l3proto->ctl_table_header,
 183                                         l3proto->ctl_table, NULL);
 184 #endif
 185 }
 186
 187 int nf_conntrack_l3proto_register(struct nf_conntrack_l3proto *proto)
 188 {
 189         int ret = 0;
 190         struct nf_conntrack_l3proto *old;
 191
 192         if (proto->l3proto >= AF_MAX)
 193                 return -EBUSY;
 194
 195         if (proto->tuple_to_nlattr && !proto->nlattr_tuple_size)
 196                 return -EINVAL;
 197
 198         mutex_lock(&nf_ct_proto_mutex);
 199         old = rcu_dereference_protected(nf_ct_l3protos[proto->l3proto],
 200                                         lockdep_is_held(&nf_ct_proto_mutex));
 201         if (old != &nf_conntrack_l3proto_generic) {
 202                 ret = -EBUSY;
 203                 goto out_unlock;
 204         }
 205
 206         ret = nf_ct_l3proto_register_sysctl(proto);
 207         if (ret < 0)
 208                 goto out_unlock;
 209
 210         if (proto->nlattr_tuple_size)
 211                 proto->nla_size = 3 * proto->nlattr_tuple_size();
 212
 213         rcu_assign_pointer(nf_ct_l3protos[proto->l3proto], proto);
 214
 215 out_unlock:
 216         mutex_unlock(&nf_ct_proto_mutex);
 217         return ret;
 218 }
 219 EXPORT_SYMBOL_GPL(nf_conntrack_l3proto_register);
 220
 221 void nf_conntrack_l3proto_unregister(struct nf_conntrack_l3proto *proto)
 222 {
 223         struct net *net;
 224
 225         BUG_ON(proto->l3proto >= AF_MAX);
 226
 227         mutex_lock(&nf_ct_proto_mutex);
 228         BUG_ON(rcu_dereference_protected(nf_ct_l3protos[proto->l3proto],
 229                                          lockdep_is_held(&nf_ct_proto_mutex)
 230                                          ) != proto);
 231         rcu_assign_pointer(nf_ct_l3protos[proto->l3proto],
 232                            &nf_conntrack_l3proto_generic);
 233         nf_ct_l3proto_unregister_sysctl(proto);
 234         mutex_unlock(&nf_ct_proto_mutex);
 235
 236         synchronize_rcu();
 237
 238         /* Remove all contrack entries for this protocol */
 239         rtnl_lock();
 240         for_each_net(net)
 241                 nf_ct_iterate_cleanup(net, kill_l3proto, proto);
 242         rtnl_unlock();
 243 }
 244 EXPORT_SYMBOL_GPL(nf_conntrack_l3proto_unregister);
 245
 246 static int nf_ct_l4proto_register_sysctl(struct nf_conntrack_l4proto *l4proto)
 247 {
 248         int err = 0;
 249
 250 #ifdef CONFIG_SYSCTL
 251         if (l4proto->ctl_table != NULL) {
 252                 err = nf_ct_register_sysctl(l4proto->ctl_table_header,
 253                                             nf_net_netfilter_sysctl_path,
 254                                             l4proto->ctl_table,
 255                                             l4proto->ctl_table_users);
 256                 if (err < 0)
 257                         goto out;
 258         }
 259 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
 260         if (l4proto->ctl_compat_table != NULL) {
 261                 err = nf_ct_register_sysctl(&l4proto->ctl_compat_table_header,
 262                                             nf_net_ipv4_netfilter_sysctl_path,
 263                                             l4proto->ctl_compat_table, NULL);
 264                 if (err == 0)
 265                         goto out;
 266                 nf_ct_unregister_sysctl(l4proto->ctl_table_header,
 267                                         l4proto->ctl_table,
 268                                         l4proto->ctl_table_users);
 269         }
 270 #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
 271 out:
 272 #endif /* CONFIG_SYSCTL */
 273         return err;
 274 }
 275
 276 static void nf_ct_l4proto_unregister_sysctl(struct nf_conntrack_l4proto *l4proto)
 277 {
 278 #ifdef CONFIG_SYSCTL
 279         if (l4proto->ctl_table_header != NULL &&
 280             *l4proto->ctl_table_header != NULL)
 281                 nf_ct_unregister_sysctl(l4proto->ctl_table_header,
 282                                         l4proto->ctl_table,
 283                                         l4proto->ctl_table_users);
 284 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
 285         if (l4proto->ctl_compat_table_header != NULL)
 286                 nf_ct_unregister_sysctl(&l4proto->ctl_compat_table_header,
 287                                         l4proto->ctl_compat_table, NULL);
 288 #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
 289 #endif /* CONFIG_SYSCTL */
 290 }
 291
 292 /* FIXME: Allow NULL functions and sub in pointers to generic for
 293    them. --RR */
 294 int nf_conntrack_l4proto_register(struct nf_conntrack_l4proto *l4proto)
 295 {
 296         int ret = 0;
 297
 298         if (l4proto->l3proto >= PF_MAX)
 299                 return -EBUSY;
 300
 301         if ((l4proto->to_nlattr && !l4proto->nlattr_size)
 302                 || (l4proto->tuple_to_nlattr && !l4proto->nlattr_tuple_size))
 303                 return -EINVAL;
 304
 305         mutex_lock(&nf_ct_proto_mutex);
 306         if (!nf_ct_protos[l4proto->l3proto]) {
 307                 /* l3proto may be loaded latter. */
 308                 struct nf_conntrack_l4proto __rcu **proto_array;
 309                 int i;
 310
 311                 proto_array = kmalloc(MAX_NF_CT_PROTO *
 312                                       sizeof(struct nf_conntrack_l4proto *),
 313                                       GFP_KERNEL);
 314                 if (proto_array == NULL) {
 315                         ret = -ENOMEM;
 316                         goto out_unlock;
 317                 }
 318
 319                 for (i = 0; i < MAX_NF_CT_PROTO; i++)
 320                         RCU_INIT_POINTER(proto_array[i], &nf_conntrack_l4proto_generic);
 321
 322                 /* Before making proto_array visible to lockless readers,
 323                  * we must make sure its content is committed to memory.
 324                  */
 325                 smp_wmb();
 326
 327                 nf_ct_protos[l4proto->l3proto] = proto_array;
 328         } else if (rcu_dereference_protected(
 329                         nf_ct_protos[l4proto->l3proto][l4proto->l4proto],
 330                         lockdep_is_held(&nf_ct_proto_mutex)
 331                         ) != &nf_conntrack_l4proto_generic) {
 332                 ret = -EBUSY;
 333                 goto out_unlock;
 334         }
 335
 336         ret = nf_ct_l4proto_register_sysctl(l4proto);
 337         if (ret < 0)
 338                 goto out_unlock;
 339
 340         l4proto->nla_size = 0;
 341         if (l4proto->nlattr_size)
 342                 l4proto->nla_size += l4proto->nlattr_size();
 343         if (l4proto->nlattr_tuple_size)
 344                 l4proto->nla_size += 3 * l4proto->nlattr_tuple_size();
 345
 346         rcu_assign_pointer(nf_ct_protos[l4proto->l3proto][l4proto->l4proto],
 347                            l4proto);
 348
 349 out_unlock:
 350         mutex_unlock(&nf_ct_proto_mutex);
 351         return ret;
 352 }
 353 EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_register);
 354
 355 void nf_conntrack_l4proto_unregister(struct nf_conntrack_l4proto *l4proto)
 356 {
 357         struct net *net;
 358
 359         BUG_ON(l4proto->l3proto >= PF_MAX);
 360
 361         mutex_lock(&nf_ct_proto_mutex);
 362         BUG_ON(rcu_dereference_protected(
 363                         nf_ct_protos[l4proto->l3proto][l4proto->l4proto],
 364                         lockdep_is_held(&nf_ct_proto_mutex)
 365                         ) != l4proto);
 366         rcu_assign_pointer(nf_ct_protos[l4proto->l3proto][l4proto->l4proto],
 367                            &nf_conntrack_l4proto_generic);
 368         nf_ct_l4proto_unregister_sysctl(l4proto);
 369         mutex_unlock(&nf_ct_proto_mutex);
 370
 371         synchronize_rcu();
 372
 373         /* Remove all contrack entries for this protocol */
 374         rtnl_lock();
 375         for_each_net(net)
 376                 nf_ct_iterate_cleanup(net, kill_l4proto, l4proto);
 377         rtnl_unlock();
 378 }
 379 EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_unregister);
 380
 381 int nf_conntrack_proto_init(void)
 382 {
 383         unsigned int i;
 384         int err;
 385
 386         err = nf_ct_l4proto_register_sysctl(&nf_conntrack_l4proto_generic);
 387         if (err < 0)
 388                 return err;
 389
 390         for (i = 0; i < AF_MAX; i++)
 391                 rcu_assign_pointer(nf_ct_l3protos[i],
 392                                    &nf_conntrack_l3proto_generic);
 393         return 0;
 394 }
 395
 396 void nf_conntrack_proto_fini(void)
 397 {
 398         unsigned int i;
 399
 400         nf_ct_l4proto_unregister_sysctl(&nf_conntrack_l4proto_generic);
 401
 402         /* free l3proto protocol tables */
 403         for (i = 0; i < PF_MAX; i++)
 404                 kfree(nf_ct_protos[i]);
 405 }