1 /* Expectation handling for nf_conntrack. */
3 /* (C) 1999-2001 Paul `Rusty' Russell
4 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
5 * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
12 #include <linux/types.h>
13 #include <linux/netfilter.h>
14 #include <linux/skbuff.h>
15 #include <linux/proc_fs.h>
16 #include <linux/seq_file.h>
17 #include <linux/stddef.h>
18 #include <linux/slab.h>
19 #include <linux/err.h>
20 #include <linux/percpu.h>
21 #include <linux/kernel.h>
22 #include <linux/jhash.h>
23 #include <net/net_namespace.h>
25 #include <net/netfilter/nf_conntrack.h>
26 #include <net/netfilter/nf_conntrack_core.h>
27 #include <net/netfilter/nf_conntrack_expect.h>
28 #include <net/netfilter/nf_conntrack_helper.h>
29 #include <net/netfilter/nf_conntrack_tuple.h>
30 #include <net/netfilter/nf_conntrack_zones.h>
32 unsigned int nf_ct_expect_hsize __read_mostly
;
33 EXPORT_SYMBOL_GPL(nf_ct_expect_hsize
);
35 static unsigned int nf_ct_expect_hash_rnd __read_mostly
;
36 unsigned int nf_ct_expect_max __read_mostly
;
37 static int nf_ct_expect_hash_rnd_initted __read_mostly
;
39 static struct kmem_cache
*nf_ct_expect_cachep __read_mostly
;
41 static HLIST_HEAD(nf_ct_userspace_expect_list
);
43 /* nf_conntrack_expect helper functions */
44 void nf_ct_unlink_expect(struct nf_conntrack_expect
*exp
)
46 struct nf_conn_help
*master_help
= nfct_help(exp
->master
);
47 struct net
*net
= nf_ct_exp_net(exp
);
49 NF_CT_ASSERT(!timer_pending(&exp
->timeout
));
51 hlist_del_rcu(&exp
->hnode
);
52 net
->ct
.expect_count
--;
54 hlist_del(&exp
->lnode
);
55 if (!(exp
->flags
& NF_CT_EXPECT_USERSPACE
))
56 master_help
->expecting
[exp
->class]--;
58 nf_ct_expect_put(exp
);
60 NF_CT_STAT_INC(net
, expect_delete
);
62 EXPORT_SYMBOL_GPL(nf_ct_unlink_expect
);
64 static void nf_ct_expectation_timed_out(unsigned long ul_expect
)
66 struct nf_conntrack_expect
*exp
= (void *)ul_expect
;
68 spin_lock_bh(&nf_conntrack_lock
);
69 nf_ct_unlink_expect(exp
);
70 spin_unlock_bh(&nf_conntrack_lock
);
71 nf_ct_expect_put(exp
);
74 static unsigned int nf_ct_expect_dst_hash(const struct nf_conntrack_tuple
*tuple
)
78 if (unlikely(!nf_ct_expect_hash_rnd_initted
)) {
79 get_random_bytes(&nf_ct_expect_hash_rnd
,
80 sizeof(nf_ct_expect_hash_rnd
));
81 nf_ct_expect_hash_rnd_initted
= 1;
84 hash
= jhash2(tuple
->dst
.u3
.all
, ARRAY_SIZE(tuple
->dst
.u3
.all
),
85 (((tuple
->dst
.protonum
^ tuple
->src
.l3num
) << 16) |
86 (__force __u16
)tuple
->dst
.u
.all
) ^ nf_ct_expect_hash_rnd
);
87 return ((u64
)hash
* nf_ct_expect_hsize
) >> 32;
90 struct nf_conntrack_expect
*
91 __nf_ct_expect_find(struct net
*net
, u16 zone
,
92 const struct nf_conntrack_tuple
*tuple
)
94 struct nf_conntrack_expect
*i
;
98 if (!net
->ct
.expect_count
)
101 h
= nf_ct_expect_dst_hash(tuple
);
102 hlist_for_each_entry_rcu(i
, n
, &net
->ct
.expect_hash
[h
], hnode
) {
103 if (nf_ct_tuple_mask_cmp(tuple
, &i
->tuple
, &i
->mask
) &&
104 nf_ct_zone(i
->master
) == zone
)
109 EXPORT_SYMBOL_GPL(__nf_ct_expect_find
);
111 /* Just find a expectation corresponding to a tuple. */
112 struct nf_conntrack_expect
*
113 nf_ct_expect_find_get(struct net
*net
, u16 zone
,
114 const struct nf_conntrack_tuple
*tuple
)
116 struct nf_conntrack_expect
*i
;
119 i
= __nf_ct_expect_find(net
, zone
, tuple
);
120 if (i
&& !atomic_inc_not_zero(&i
->use
))
126 EXPORT_SYMBOL_GPL(nf_ct_expect_find_get
);
128 /* If an expectation for this connection is found, it gets delete from
129 * global list then returned. */
130 struct nf_conntrack_expect
*
131 nf_ct_find_expectation(struct net
*net
, u16 zone
,
132 const struct nf_conntrack_tuple
*tuple
)
134 struct nf_conntrack_expect
*i
, *exp
= NULL
;
135 struct hlist_node
*n
;
138 if (!net
->ct
.expect_count
)
141 h
= nf_ct_expect_dst_hash(tuple
);
142 hlist_for_each_entry(i
, n
, &net
->ct
.expect_hash
[h
], hnode
) {
143 if (!(i
->flags
& NF_CT_EXPECT_INACTIVE
) &&
144 nf_ct_tuple_mask_cmp(tuple
, &i
->tuple
, &i
->mask
) &&
145 nf_ct_zone(i
->master
) == zone
) {
153 /* If master is not in hash table yet (ie. packet hasn't left
154 this machine yet), how can other end know about expected?
155 Hence these are not the droids you are looking for (if
156 master ct never got confirmed, we'd hold a reference to it
157 and weird things would happen to future packets). */
158 if (!nf_ct_is_confirmed(exp
->master
))
161 if (exp
->flags
& NF_CT_EXPECT_PERMANENT
) {
162 atomic_inc(&exp
->use
);
164 } else if (del_timer(&exp
->timeout
)) {
165 nf_ct_unlink_expect(exp
);
172 /* delete all expectations for this conntrack */
173 void nf_ct_remove_expectations(struct nf_conn
*ct
)
175 struct nf_conn_help
*help
= nfct_help(ct
);
176 struct nf_conntrack_expect
*exp
;
177 struct hlist_node
*n
, *next
;
179 /* Optimization: most connection never expect any others. */
183 hlist_for_each_entry_safe(exp
, n
, next
, &help
->expectations
, lnode
) {
184 if (del_timer(&exp
->timeout
)) {
185 nf_ct_unlink_expect(exp
);
186 nf_ct_expect_put(exp
);
190 EXPORT_SYMBOL_GPL(nf_ct_remove_expectations
);
192 /* Would two expected things clash? */
193 static inline int expect_clash(const struct nf_conntrack_expect
*a
,
194 const struct nf_conntrack_expect
*b
)
196 /* Part covered by intersection of masks must be unequal,
197 otherwise they clash */
198 struct nf_conntrack_tuple_mask intersect_mask
;
201 intersect_mask
.src
.u
.all
= a
->mask
.src
.u
.all
& b
->mask
.src
.u
.all
;
203 for (count
= 0; count
< NF_CT_TUPLE_L3SIZE
; count
++){
204 intersect_mask
.src
.u3
.all
[count
] =
205 a
->mask
.src
.u3
.all
[count
] & b
->mask
.src
.u3
.all
[count
];
208 return nf_ct_tuple_mask_cmp(&a
->tuple
, &b
->tuple
, &intersect_mask
);
211 static inline int expect_matches(const struct nf_conntrack_expect
*a
,
212 const struct nf_conntrack_expect
*b
)
214 return a
->master
== b
->master
&& a
->class == b
->class &&
215 nf_ct_tuple_equal(&a
->tuple
, &b
->tuple
) &&
216 nf_ct_tuple_mask_equal(&a
->mask
, &b
->mask
) &&
217 nf_ct_zone(a
->master
) == nf_ct_zone(b
->master
);
220 /* Generally a bad idea to call this: could have matched already. */
221 void nf_ct_unexpect_related(struct nf_conntrack_expect
*exp
)
223 spin_lock_bh(&nf_conntrack_lock
);
224 if (del_timer(&exp
->timeout
)) {
225 nf_ct_unlink_expect(exp
);
226 nf_ct_expect_put(exp
);
228 spin_unlock_bh(&nf_conntrack_lock
);
230 EXPORT_SYMBOL_GPL(nf_ct_unexpect_related
);
232 /* We don't increase the master conntrack refcount for non-fulfilled
233 * conntracks. During the conntrack destruction, the expectations are
234 * always killed before the conntrack itself */
235 struct nf_conntrack_expect
*nf_ct_expect_alloc(struct nf_conn
*me
)
237 struct nf_conntrack_expect
*new;
239 new = kmem_cache_alloc(nf_ct_expect_cachep
, GFP_ATOMIC
);
244 atomic_set(&new->use
, 1);
247 EXPORT_SYMBOL_GPL(nf_ct_expect_alloc
);
249 void nf_ct_expect_init(struct nf_conntrack_expect
*exp
, unsigned int class,
251 const union nf_inet_addr
*saddr
,
252 const union nf_inet_addr
*daddr
,
253 u_int8_t proto
, const __be16
*src
, const __be16
*dst
)
257 if (family
== AF_INET
)
264 exp
->expectfn
= NULL
;
266 exp
->tuple
.src
.l3num
= family
;
267 exp
->tuple
.dst
.protonum
= proto
;
270 memcpy(&exp
->tuple
.src
.u3
, saddr
, len
);
271 if (sizeof(exp
->tuple
.src
.u3
) > len
)
272 /* address needs to be cleared for nf_ct_tuple_equal */
273 memset((void *)&exp
->tuple
.src
.u3
+ len
, 0x00,
274 sizeof(exp
->tuple
.src
.u3
) - len
);
275 memset(&exp
->mask
.src
.u3
, 0xFF, len
);
276 if (sizeof(exp
->mask
.src
.u3
) > len
)
277 memset((void *)&exp
->mask
.src
.u3
+ len
, 0x00,
278 sizeof(exp
->mask
.src
.u3
) - len
);
280 memset(&exp
->tuple
.src
.u3
, 0x00, sizeof(exp
->tuple
.src
.u3
));
281 memset(&exp
->mask
.src
.u3
, 0x00, sizeof(exp
->mask
.src
.u3
));
285 exp
->tuple
.src
.u
.all
= *src
;
286 exp
->mask
.src
.u
.all
= htons(0xFFFF);
288 exp
->tuple
.src
.u
.all
= 0;
289 exp
->mask
.src
.u
.all
= 0;
292 memcpy(&exp
->tuple
.dst
.u3
, daddr
, len
);
293 if (sizeof(exp
->tuple
.dst
.u3
) > len
)
294 /* address needs to be cleared for nf_ct_tuple_equal */
295 memset((void *)&exp
->tuple
.dst
.u3
+ len
, 0x00,
296 sizeof(exp
->tuple
.dst
.u3
) - len
);
298 exp
->tuple
.dst
.u
.all
= *dst
;
300 EXPORT_SYMBOL_GPL(nf_ct_expect_init
);
302 static void nf_ct_expect_free_rcu(struct rcu_head
*head
)
304 struct nf_conntrack_expect
*exp
;
306 exp
= container_of(head
, struct nf_conntrack_expect
, rcu
);
307 kmem_cache_free(nf_ct_expect_cachep
, exp
);
310 void nf_ct_expect_put(struct nf_conntrack_expect
*exp
)
312 if (atomic_dec_and_test(&exp
->use
))
313 call_rcu(&exp
->rcu
, nf_ct_expect_free_rcu
);
315 EXPORT_SYMBOL_GPL(nf_ct_expect_put
);
317 static void nf_ct_expect_insert(struct nf_conntrack_expect
*exp
)
319 struct nf_conn_help
*master_help
= nfct_help(exp
->master
);
320 struct net
*net
= nf_ct_exp_net(exp
);
321 const struct nf_conntrack_expect_policy
*p
;
322 unsigned int h
= nf_ct_expect_dst_hash(&exp
->tuple
);
324 atomic_inc(&exp
->use
);
327 hlist_add_head(&exp
->lnode
, &master_help
->expectations
);
328 master_help
->expecting
[exp
->class]++;
329 } else if (exp
->flags
& NF_CT_EXPECT_USERSPACE
)
330 hlist_add_head(&exp
->lnode
, &nf_ct_userspace_expect_list
);
332 hlist_add_head_rcu(&exp
->hnode
, &net
->ct
.expect_hash
[h
]);
333 net
->ct
.expect_count
++;
335 setup_timer(&exp
->timeout
, nf_ct_expectation_timed_out
,
338 p
= &master_help
->helper
->expect_policy
[exp
->class];
339 exp
->timeout
.expires
= jiffies
+ p
->timeout
* HZ
;
341 add_timer(&exp
->timeout
);
343 atomic_inc(&exp
->use
);
344 NF_CT_STAT_INC(net
, expect_create
);
347 /* Race with expectations being used means we could have none to find; OK. */
348 static void evict_oldest_expect(struct nf_conn
*master
,
349 struct nf_conntrack_expect
*new)
351 struct nf_conn_help
*master_help
= nfct_help(master
);
352 struct nf_conntrack_expect
*exp
, *last
= NULL
;
353 struct hlist_node
*n
;
355 hlist_for_each_entry(exp
, n
, &master_help
->expectations
, lnode
) {
356 if (exp
->class == new->class)
360 if (last
&& del_timer(&last
->timeout
)) {
361 nf_ct_unlink_expect(last
);
362 nf_ct_expect_put(last
);
366 static inline int refresh_timer(struct nf_conntrack_expect
*i
)
368 struct nf_conn_help
*master_help
= nfct_help(i
->master
);
369 const struct nf_conntrack_expect_policy
*p
;
371 if (!del_timer(&i
->timeout
))
374 p
= &master_help
->helper
->expect_policy
[i
->class];
375 i
->timeout
.expires
= jiffies
+ p
->timeout
* HZ
;
376 add_timer(&i
->timeout
);
380 static inline int __nf_ct_expect_check(struct nf_conntrack_expect
*expect
)
382 const struct nf_conntrack_expect_policy
*p
;
383 struct nf_conntrack_expect
*i
;
384 struct nf_conn
*master
= expect
->master
;
385 struct nf_conn_help
*master_help
= nfct_help(master
);
386 struct net
*net
= nf_ct_exp_net(expect
);
387 struct hlist_node
*n
;
391 /* Don't allow expectations created from kernel-space with no helper */
392 if (!(expect
->flags
& NF_CT_EXPECT_USERSPACE
) &&
393 (!master_help
|| (master_help
&& !master_help
->helper
))) {
397 h
= nf_ct_expect_dst_hash(&expect
->tuple
);
398 hlist_for_each_entry(i
, n
, &net
->ct
.expect_hash
[h
], hnode
) {
399 if (expect_matches(i
, expect
)) {
400 /* Refresh timer: if it's dying, ignore.. */
401 if (refresh_timer(i
)) {
405 } else if (expect_clash(i
, expect
)) {
410 /* Will be over limit? */
412 p
= &master_help
->helper
->expect_policy
[expect
->class];
413 if (p
->max_expected
&&
414 master_help
->expecting
[expect
->class] >= p
->max_expected
) {
415 evict_oldest_expect(master
, expect
);
416 if (master_help
->expecting
[expect
->class]
417 >= p
->max_expected
) {
424 if (net
->ct
.expect_count
>= nf_ct_expect_max
) {
427 "nf_conntrack: expectation table full\n");
434 int nf_ct_expect_related_report(struct nf_conntrack_expect
*expect
,
439 spin_lock_bh(&nf_conntrack_lock
);
440 ret
= __nf_ct_expect_check(expect
);
445 nf_ct_expect_insert(expect
);
446 spin_unlock_bh(&nf_conntrack_lock
);
447 nf_ct_expect_event_report(IPEXP_NEW
, expect
, pid
, report
);
450 spin_unlock_bh(&nf_conntrack_lock
);
453 EXPORT_SYMBOL_GPL(nf_ct_expect_related_report
);
455 void nf_ct_remove_userspace_expectations(void)
457 struct nf_conntrack_expect
*exp
;
458 struct hlist_node
*n
, *next
;
460 hlist_for_each_entry_safe(exp
, n
, next
,
461 &nf_ct_userspace_expect_list
, lnode
) {
462 if (del_timer(&exp
->timeout
)) {
463 nf_ct_unlink_expect(exp
);
464 nf_ct_expect_put(exp
);
468 EXPORT_SYMBOL_GPL(nf_ct_remove_userspace_expectations
);
470 #ifdef CONFIG_PROC_FS
471 struct ct_expect_iter_state
{
472 struct seq_net_private p
;
476 static struct hlist_node
*ct_expect_get_first(struct seq_file
*seq
)
478 struct net
*net
= seq_file_net(seq
);
479 struct ct_expect_iter_state
*st
= seq
->private;
480 struct hlist_node
*n
;
482 for (st
->bucket
= 0; st
->bucket
< nf_ct_expect_hsize
; st
->bucket
++) {
483 n
= rcu_dereference(net
->ct
.expect_hash
[st
->bucket
].first
);
490 static struct hlist_node
*ct_expect_get_next(struct seq_file
*seq
,
491 struct hlist_node
*head
)
493 struct net
*net
= seq_file_net(seq
);
494 struct ct_expect_iter_state
*st
= seq
->private;
496 head
= rcu_dereference(head
->next
);
497 while (head
== NULL
) {
498 if (++st
->bucket
>= nf_ct_expect_hsize
)
500 head
= rcu_dereference(net
->ct
.expect_hash
[st
->bucket
].first
);
505 static struct hlist_node
*ct_expect_get_idx(struct seq_file
*seq
, loff_t pos
)
507 struct hlist_node
*head
= ct_expect_get_first(seq
);
510 while (pos
&& (head
= ct_expect_get_next(seq
, head
)))
512 return pos
? NULL
: head
;
515 static void *exp_seq_start(struct seq_file
*seq
, loff_t
*pos
)
519 return ct_expect_get_idx(seq
, *pos
);
522 static void *exp_seq_next(struct seq_file
*seq
, void *v
, loff_t
*pos
)
525 return ct_expect_get_next(seq
, v
);
528 static void exp_seq_stop(struct seq_file
*seq
, void *v
)
534 static int exp_seq_show(struct seq_file
*s
, void *v
)
536 struct nf_conntrack_expect
*expect
;
537 struct nf_conntrack_helper
*helper
;
538 struct hlist_node
*n
= v
;
541 expect
= hlist_entry(n
, struct nf_conntrack_expect
, hnode
);
543 if (expect
->timeout
.function
)
544 seq_printf(s
, "%ld ", timer_pending(&expect
->timeout
)
545 ? (long)(expect
->timeout
.expires
- jiffies
)/HZ
: 0);
548 seq_printf(s
, "l3proto = %u proto=%u ",
549 expect
->tuple
.src
.l3num
,
550 expect
->tuple
.dst
.protonum
);
551 print_tuple(s
, &expect
->tuple
,
552 __nf_ct_l3proto_find(expect
->tuple
.src
.l3num
),
553 __nf_ct_l4proto_find(expect
->tuple
.src
.l3num
,
554 expect
->tuple
.dst
.protonum
));
556 if (expect
->flags
& NF_CT_EXPECT_PERMANENT
) {
557 seq_printf(s
, "PERMANENT");
560 if (expect
->flags
& NF_CT_EXPECT_INACTIVE
) {
561 seq_printf(s
, "%sINACTIVE", delim
);
564 if (expect
->flags
& NF_CT_EXPECT_USERSPACE
)
565 seq_printf(s
, "%sUSERSPACE", delim
);
567 helper
= rcu_dereference(nfct_help(expect
->master
)->helper
);
569 seq_printf(s
, "%s%s", expect
->flags
? " " : "", helper
->name
);
570 if (helper
->expect_policy
[expect
->class].name
)
572 helper
->expect_policy
[expect
->class].name
);
575 return seq_putc(s
, '\n');
578 static const struct seq_operations exp_seq_ops
= {
579 .start
= exp_seq_start
,
580 .next
= exp_seq_next
,
581 .stop
= exp_seq_stop
,
585 static int exp_open(struct inode
*inode
, struct file
*file
)
587 return seq_open_net(inode
, file
, &exp_seq_ops
,
588 sizeof(struct ct_expect_iter_state
));
591 static const struct file_operations exp_file_ops
= {
592 .owner
= THIS_MODULE
,
596 .release
= seq_release_net
,
598 #endif /* CONFIG_PROC_FS */
600 static int exp_proc_init(struct net
*net
)
602 #ifdef CONFIG_PROC_FS
603 struct proc_dir_entry
*proc
;
605 proc
= proc_net_fops_create(net
, "nf_conntrack_expect", 0440, &exp_file_ops
);
608 #endif /* CONFIG_PROC_FS */
612 static void exp_proc_remove(struct net
*net
)
614 #ifdef CONFIG_PROC_FS
615 proc_net_remove(net
, "nf_conntrack_expect");
616 #endif /* CONFIG_PROC_FS */
619 module_param_named(expect_hashsize
, nf_ct_expect_hsize
, uint
, 0400);
621 int nf_conntrack_expect_init(struct net
*net
)
625 if (net_eq(net
, &init_net
)) {
626 if (!nf_ct_expect_hsize
) {
627 nf_ct_expect_hsize
= net
->ct
.htable_size
/ 256;
628 if (!nf_ct_expect_hsize
)
629 nf_ct_expect_hsize
= 1;
631 nf_ct_expect_max
= nf_ct_expect_hsize
* 4;
634 net
->ct
.expect_count
= 0;
635 net
->ct
.expect_hash
= nf_ct_alloc_hashtable(&nf_ct_expect_hsize
,
636 &net
->ct
.expect_vmalloc
, 0);
637 if (net
->ct
.expect_hash
== NULL
)
640 if (net_eq(net
, &init_net
)) {
641 nf_ct_expect_cachep
= kmem_cache_create("nf_conntrack_expect",
642 sizeof(struct nf_conntrack_expect
),
644 if (!nf_ct_expect_cachep
)
648 err
= exp_proc_init(net
);
655 if (net_eq(net
, &init_net
))
656 kmem_cache_destroy(nf_ct_expect_cachep
);
658 nf_ct_free_hashtable(net
->ct
.expect_hash
, net
->ct
.expect_vmalloc
,
664 void nf_conntrack_expect_fini(struct net
*net
)
666 exp_proc_remove(net
);
667 if (net_eq(net
, &init_net
)) {
668 rcu_barrier(); /* Wait for call_rcu() before destroy */
669 kmem_cache_destroy(nf_ct_expect_cachep
);
671 nf_ct_free_hashtable(net
->ct
.expect_hash
, net
->ct
.expect_vmalloc
,