net/netfilter/nf_conntrack_proto.c

   1 /* L3/L4 protocol support for nf_conntrack. */
   2
   3 /* (C) 1999-2001 Paul `Rusty' Russell
   4  * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
   5  * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2 as
   9  * published by the Free Software Foundation.
  10  */
  11
  12 #include <linux/types.h>
  13 #include <linux/netfilter.h>
  14 #include <linux/module.h>
  15 #include <linux/mutex.h>
  16 #include <linux/skbuff.h>
  17 #include <linux/vmalloc.h>
  18 #include <linux/stddef.h>
  19 #include <linux/err.h>
  20 #include <linux/percpu.h>
  21 #include <linux/moduleparam.h>
  22 #include <linux/notifier.h>
  23 #include <linux/kernel.h>
  24 #include <linux/netdevice.h>
  25
  26 #include <net/netfilter/nf_conntrack.h>
  27 #include <net/netfilter/nf_conntrack_l3proto.h>
  28 #include <net/netfilter/nf_conntrack_l4proto.h>
  29 #include <net/netfilter/nf_conntrack_core.h>
  30
  31 struct nf_conntrack_l4proto **nf_ct_protos[PF_MAX] __read_mostly;
  32 struct nf_conntrack_l3proto *nf_ct_l3protos[AF_MAX] __read_mostly;
  33
  34 #ifdef CONFIG_SYSCTL
  35 static DEFINE_MUTEX(nf_ct_proto_sysctl_mutex);
  36
  37 static int
  38 nf_ct_register_sysctl(struct ctl_table_header **header, struct ctl_table *path,
  39                       struct ctl_table *table, unsigned int *users)
  40 {
  41         if (*header == NULL) {
  42                 *header = nf_register_sysctl_table(path, table);
  43                 if (*header == NULL)
  44                         return -ENOMEM;
  45         }
  46         if (users != NULL)
  47                 (*users)++;
  48         return 0;
  49 }
  50
  51 static void
  52 nf_ct_unregister_sysctl(struct ctl_table_header **header,
  53                         struct ctl_table *table, unsigned int *users)
  54 {
  55         if (users != NULL && --*users > 0)
  56                 return;
  57         nf_unregister_sysctl_table(*header, table);
  58         *header = NULL;
  59 }
  60 #endif
  61
  62 struct nf_conntrack_l4proto *
  63 __nf_ct_l4proto_find(u_int16_t l3proto, u_int8_t l4proto)
  64 {
  65         if (unlikely(l3proto >= AF_MAX || nf_ct_protos[l3proto] == NULL))
  66                 return &nf_conntrack_l4proto_generic;
  67
  68         return nf_ct_protos[l3proto][l4proto];
  69 }
  70
  71 /* this is guaranteed to always return a valid protocol helper, since
  72  * it falls back to generic_protocol */
  73 struct nf_conntrack_l4proto *
  74 nf_ct_l4proto_find_get(u_int16_t l3proto, u_int8_t l4proto)
  75 {
  76         struct nf_conntrack_l4proto *p;
  77
  78         preempt_disable();
  79         p = __nf_ct_l4proto_find(l3proto, l4proto);
  80         if (!try_module_get(p->me))
  81                 p = &nf_conntrack_l4proto_generic;
  82         preempt_enable();
  83
  84         return p;
  85 }
  86
  87 void nf_ct_l4proto_put(struct nf_conntrack_l4proto *p)
  88 {
  89         module_put(p->me);
  90 }
  91
  92 struct nf_conntrack_l3proto *
  93 nf_ct_l3proto_find_get(u_int16_t l3proto)
  94 {
  95         struct nf_conntrack_l3proto *p;
  96
  97         preempt_disable();
  98         p = __nf_ct_l3proto_find(l3proto);
  99         if (!try_module_get(p->me))
 100                 p = &nf_conntrack_l3proto_generic;
 101         preempt_enable();
 102
 103         return p;
 104 }
 105
 106 void nf_ct_l3proto_put(struct nf_conntrack_l3proto *p)
 107 {
 108         module_put(p->me);
 109 }
 110
 111 int
 112 nf_ct_l3proto_try_module_get(unsigned short l3proto)
 113 {
 114         int ret;
 115         struct nf_conntrack_l3proto *p;
 116
 117 retry:  p = nf_ct_l3proto_find_get(l3proto);
 118         if (p == &nf_conntrack_l3proto_generic) {
 119                 ret = request_module("nf_conntrack-%d", l3proto);
 120                 if (!ret)
 121                         goto retry;
 122
 123                 return -EPROTOTYPE;
 124         }
 125
 126         return 0;
 127 }
 128
 129 void nf_ct_l3proto_module_put(unsigned short l3proto)
 130 {
 131         struct nf_conntrack_l3proto *p;
 132
 133         preempt_disable();
 134         p = __nf_ct_l3proto_find(l3proto);
 135         preempt_enable();
 136
 137         module_put(p->me);
 138 }
 139
 140 static int kill_l3proto(struct nf_conn *i, void *data)
 141 {
 142         return (i->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num ==
 143                         ((struct nf_conntrack_l3proto *)data)->l3proto);
 144 }
 145
 146 static int kill_l4proto(struct nf_conn *i, void *data)
 147 {
 148         struct nf_conntrack_l4proto *l4proto;
 149         l4proto = (struct nf_conntrack_l4proto *)data;
 150         return (i->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum ==
 151                         l4proto->l4proto) &&
 152                (i->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num ==
 153                         l4proto->l3proto);
 154 }
 155
 156 static int nf_ct_l3proto_register_sysctl(struct nf_conntrack_l3proto *l3proto)
 157 {
 158         int err = 0;
 159
 160 #ifdef CONFIG_SYSCTL
 161         mutex_lock(&nf_ct_proto_sysctl_mutex);
 162         if (l3proto->ctl_table != NULL) {
 163                 err = nf_ct_register_sysctl(&l3proto->ctl_table_header,
 164                                             l3proto->ctl_table_path,
 165                                             l3proto->ctl_table, NULL);
 166         }
 167         mutex_unlock(&nf_ct_proto_sysctl_mutex);
 168 #endif
 169         return err;
 170 }
 171
 172 static void nf_ct_l3proto_unregister_sysctl(struct nf_conntrack_l3proto *l3proto)
 173 {
 174 #ifdef CONFIG_SYSCTL
 175         mutex_lock(&nf_ct_proto_sysctl_mutex);
 176         if (l3proto->ctl_table_header != NULL)
 177                 nf_ct_unregister_sysctl(&l3proto->ctl_table_header,
 178                                         l3proto->ctl_table, NULL);
 179         mutex_unlock(&nf_ct_proto_sysctl_mutex);
 180 #endif
 181 }
 182
 183 int nf_conntrack_l3proto_register(struct nf_conntrack_l3proto *proto)
 184 {
 185         int ret = 0;
 186
 187         if (proto->l3proto >= AF_MAX) {
 188                 ret = -EBUSY;
 189                 goto out;
 190         }
 191
 192         write_lock_bh(&nf_conntrack_lock);
 193         if (nf_ct_l3protos[proto->l3proto] != &nf_conntrack_l3proto_generic) {
 194                 ret = -EBUSY;
 195                 goto out_unlock;
 196         }
 197         nf_ct_l3protos[proto->l3proto] = proto;
 198         write_unlock_bh(&nf_conntrack_lock);
 199
 200         ret = nf_ct_l3proto_register_sysctl(proto);
 201         if (ret < 0)
 202                 nf_conntrack_l3proto_unregister(proto);
 203         return ret;
 204
 205 out_unlock:
 206         write_unlock_bh(&nf_conntrack_lock);
 207 out:
 208         return ret;
 209 }
 210
 211 int nf_conntrack_l3proto_unregister(struct nf_conntrack_l3proto *proto)
 212 {
 213         int ret = 0;
 214
 215         if (proto->l3proto >= AF_MAX) {
 216                 ret = -EBUSY;
 217                 goto out;
 218         }
 219
 220         write_lock_bh(&nf_conntrack_lock);
 221         if (nf_ct_l3protos[proto->l3proto] != proto) {
 222                 write_unlock_bh(&nf_conntrack_lock);
 223                 ret = -EBUSY;
 224                 goto out;
 225         }
 226
 227         nf_ct_l3protos[proto->l3proto] = &nf_conntrack_l3proto_generic;
 228         write_unlock_bh(&nf_conntrack_lock);
 229
 230         nf_ct_l3proto_unregister_sysctl(proto);
 231
 232         /* Somebody could be still looking at the proto in bh. */
 233         synchronize_net();
 234
 235         /* Remove all contrack entries for this protocol */
 236         nf_ct_iterate_cleanup(kill_l3proto, proto);
 237
 238 out:
 239         return ret;
 240 }
 241
 242 static int nf_ct_l4proto_register_sysctl(struct nf_conntrack_l4proto *l4proto)
 243 {
 244         int err = 0;
 245
 246 #ifdef CONFIG_SYSCTL
 247         mutex_lock(&nf_ct_proto_sysctl_mutex);
 248         if (l4proto->ctl_table != NULL) {
 249                 err = nf_ct_register_sysctl(l4proto->ctl_table_header,
 250                                             nf_net_netfilter_sysctl_path,
 251                                             l4proto->ctl_table,
 252                                             l4proto->ctl_table_users);
 253                 if (err < 0)
 254                         goto out;
 255         }
 256 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
 257         if (l4proto->ctl_compat_table != NULL) {
 258                 err = nf_ct_register_sysctl(&l4proto->ctl_compat_table_header,
 259                                             nf_net_ipv4_netfilter_sysctl_path,
 260                                             l4proto->ctl_compat_table, NULL);
 261                 if (err == 0)
 262                         goto out;
 263                 nf_ct_unregister_sysctl(l4proto->ctl_table_header,
 264                                         l4proto->ctl_table,
 265                                         l4proto->ctl_table_users);
 266         }
 267 #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
 268 out:
 269         mutex_unlock(&nf_ct_proto_sysctl_mutex);
 270 #endif /* CONFIG_SYSCTL */
 271         return err;
 272 }
 273
 274 static void nf_ct_l4proto_unregister_sysctl(struct nf_conntrack_l4proto *l4proto)
 275 {
 276 #ifdef CONFIG_SYSCTL
 277         mutex_lock(&nf_ct_proto_sysctl_mutex);
 278         if (l4proto->ctl_table_header != NULL &&
 279             *l4proto->ctl_table_header != NULL)
 280                 nf_ct_unregister_sysctl(l4proto->ctl_table_header,
 281                                         l4proto->ctl_table,
 282                                         l4proto->ctl_table_users);
 283 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
 284         if (l4proto->ctl_compat_table_header != NULL)
 285                 nf_ct_unregister_sysctl(&l4proto->ctl_compat_table_header,
 286                                         l4proto->ctl_compat_table, NULL);
 287 #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
 288         mutex_unlock(&nf_ct_proto_sysctl_mutex);
 289 #endif /* CONFIG_SYSCTL */
 290 }
 291
 292 /* FIXME: Allow NULL functions and sub in pointers to generic for
 293    them. --RR */
 294 int nf_conntrack_l4proto_register(struct nf_conntrack_l4proto *l4proto)
 295 {
 296         int ret = 0;
 297
 298         if (l4proto->l3proto >= PF_MAX) {
 299                 ret = -EBUSY;
 300                 goto out;
 301         }
 302
 303         if (l4proto == &nf_conntrack_l4proto_generic)
 304                 return nf_ct_l4proto_register_sysctl(l4proto);
 305
 306 retry:
 307         write_lock_bh(&nf_conntrack_lock);
 308         if (nf_ct_protos[l4proto->l3proto]) {
 309                 if (nf_ct_protos[l4proto->l3proto][l4proto->l4proto]
 310                                 != &nf_conntrack_l4proto_generic) {
 311                         ret = -EBUSY;
 312                         goto out_unlock;
 313                 }
 314         } else {
 315                 /* l3proto may be loaded latter. */
 316                 struct nf_conntrack_l4proto **proto_array;
 317                 int i;
 318
 319                 write_unlock_bh(&nf_conntrack_lock);
 320
 321                 proto_array = (struct nf_conntrack_l4proto **)
 322                                 kmalloc(MAX_NF_CT_PROTO *
 323                                          sizeof(struct nf_conntrack_l4proto *),
 324                                         GFP_KERNEL);
 325                 if (proto_array == NULL) {
 326                         ret = -ENOMEM;
 327                         goto out;
 328                 }
 329                 for (i = 0; i < MAX_NF_CT_PROTO; i++)
 330                         proto_array[i] = &nf_conntrack_l4proto_generic;
 331
 332                 write_lock_bh(&nf_conntrack_lock);
 333                 if (nf_ct_protos[l4proto->l3proto]) {
 334                         /* bad timing, but no problem */
 335                         write_unlock_bh(&nf_conntrack_lock);
 336                         kfree(proto_array);
 337                 } else {
 338                         nf_ct_protos[l4proto->l3proto] = proto_array;
 339                         write_unlock_bh(&nf_conntrack_lock);
 340                 }
 341
 342                 /*
 343                  * Just once because array is never freed until unloading
 344                  * nf_conntrack.ko
 345                  */
 346                 goto retry;
 347         }
 348
 349         nf_ct_protos[l4proto->l3proto][l4proto->l4proto] = l4proto;
 350         write_unlock_bh(&nf_conntrack_lock);
 351
 352         ret = nf_ct_l4proto_register_sysctl(l4proto);
 353         if (ret < 0)
 354                 nf_conntrack_l4proto_unregister(l4proto);
 355         return ret;
 356
 357 out_unlock:
 358         write_unlock_bh(&nf_conntrack_lock);
 359 out:
 360         return ret;
 361 }
 362
 363 int nf_conntrack_l4proto_unregister(struct nf_conntrack_l4proto *l4proto)
 364 {
 365         int ret = 0;
 366
 367         if (l4proto->l3proto >= PF_MAX) {
 368                 ret = -EBUSY;
 369                 goto out;
 370         }
 371
 372         if (l4proto == &nf_conntrack_l4proto_generic) {
 373                 nf_ct_l4proto_unregister_sysctl(l4proto);
 374                 goto out;
 375         }
 376
 377         write_lock_bh(&nf_conntrack_lock);
 378         if (nf_ct_protos[l4proto->l3proto][l4proto->l4proto]
 379             != l4proto) {
 380                 write_unlock_bh(&nf_conntrack_lock);
 381                 ret = -EBUSY;
 382                 goto out;
 383         }
 384         nf_ct_protos[l4proto->l3proto][l4proto->l4proto]
 385                 = &nf_conntrack_l4proto_generic;
 386         write_unlock_bh(&nf_conntrack_lock);
 387
 388         nf_ct_l4proto_unregister_sysctl(l4proto);
 389
 390         /* Somebody could be still looking at the proto in bh. */
 391         synchronize_net();
 392
 393         /* Remove all contrack entries for this protocol */
 394         nf_ct_iterate_cleanup(kill_l4proto, l4proto);
 395
 396 out:
 397         return ret;
 398 }