blob: 2a105db1330761f67030c3218f1243e848a820e7 [file] [log] [blame]
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001/* Connection state tracking for netfilter. This is separated from,
2 but required by, the NAT layer; it can also be used by an iptables
3 extension. */
4
5/* (C) 1999-2001 Paul `Rusty' Russell
Harald Weltedc808fe2006-03-20 17:56:32 -08006 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08007 * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
8 *
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License version 2 as
11 * published by the Free Software Foundation.
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080012 */
13
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080014#include <linux/types.h>
15#include <linux/netfilter.h>
16#include <linux/module.h>
17#include <linux/skbuff.h>
18#include <linux/proc_fs.h>
19#include <linux/vmalloc.h>
20#include <linux/stddef.h>
21#include <linux/slab.h>
22#include <linux/random.h>
23#include <linux/jhash.h>
24#include <linux/err.h>
25#include <linux/percpu.h>
26#include <linux/moduleparam.h>
27#include <linux/notifier.h>
28#include <linux/kernel.h>
29#include <linux/netdevice.h>
30#include <linux/socket.h>
Al Virod7fe0f22006-12-03 23:15:30 -050031#include <linux/mm.h>
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080032
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080033#include <net/netfilter/nf_conntrack.h>
34#include <net/netfilter/nf_conntrack_l3proto.h>
Martin Josefsson605dcad2006-11-29 02:35:06 +010035#include <net/netfilter/nf_conntrack_l4proto.h>
Martin Josefsson77ab9cf2006-11-29 02:34:58 +010036#include <net/netfilter/nf_conntrack_expect.h>
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080037#include <net/netfilter/nf_conntrack_helper.h>
38#include <net/netfilter/nf_conntrack_core.h>
Yasuyuki Kozakaiecfab2c2007-07-07 22:23:21 -070039#include <net/netfilter/nf_conntrack_extend.h>
Krzysztof Piotr Oledzki58401572008-07-21 10:01:34 -070040#include <net/netfilter/nf_conntrack_acct.h>
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080041
Harald Weltedc808fe2006-03-20 17:56:32 -080042#define NF_CONNTRACK_VERSION "0.5.0"
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080043
Patrick McHardyf8ba1af2008-01-31 04:38:58 -080044DEFINE_SPINLOCK(nf_conntrack_lock);
Patrick McHardy13b18332006-12-02 22:11:25 -080045EXPORT_SYMBOL_GPL(nf_conntrack_lock);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080046
Martin Josefssone2b76062006-11-29 02:35:04 +010047unsigned int nf_conntrack_htable_size __read_mostly;
Patrick McHardy13b18332006-12-02 22:11:25 -080048EXPORT_SYMBOL_GPL(nf_conntrack_htable_size);
49
Brian Haley94aec082006-09-18 00:05:22 -070050int nf_conntrack_max __read_mostly;
Patrick McHardya999e682006-11-29 02:35:20 +010051EXPORT_SYMBOL_GPL(nf_conntrack_max);
Patrick McHardy13b18332006-12-02 22:11:25 -080052
Martin Josefssone2b76062006-11-29 02:35:04 +010053struct nf_conn nf_conntrack_untracked __read_mostly;
Patrick McHardy13b18332006-12-02 22:11:25 -080054EXPORT_SYMBOL_GPL(nf_conntrack_untracked);
55
Brian Haley94aec082006-09-18 00:05:22 -070056unsigned int nf_ct_log_invalid __read_mostly;
Yasuyuki Kozakaidacd2a12007-07-07 22:25:51 -070057static struct kmem_cache *nf_conntrack_cachep __read_mostly;
Martin Josefsson77ab9cf2006-11-29 02:34:58 +010058
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080059DEFINE_PER_CPU(struct ip_conntrack_stat, nf_conntrack_stat);
60EXPORT_PER_CPU_SYMBOL(nf_conntrack_stat);
61
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080062static int nf_conntrack_hash_rnd_initted;
63static unsigned int nf_conntrack_hash_rnd;
64
65static u_int32_t __hash_conntrack(const struct nf_conntrack_tuple *tuple,
66 unsigned int size, unsigned int rnd)
67{
Patrick McHardy07949352008-01-31 04:40:52 -080068 unsigned int n;
69 u_int32_t h;
Sami Farin9b887902007-03-14 16:43:00 -070070
Patrick McHardy07949352008-01-31 04:40:52 -080071 /* The direction must be ignored, so we hash everything up to the
72 * destination ports (which is a multiple of 4) and treat the last
73 * three bytes manually.
74 */
75 n = (sizeof(tuple->src) + sizeof(tuple->dst.u3)) / sizeof(u32);
76 h = jhash2((u32 *)tuple, n,
77 rnd ^ (((__force __u16)tuple->dst.u.all << 16) |
78 tuple->dst.protonum));
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080079
Patrick McHardy07949352008-01-31 04:40:52 -080080 return ((u64)h * size) >> 32;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080081}
82
83static inline u_int32_t hash_conntrack(const struct nf_conntrack_tuple *tuple)
84{
85 return __hash_conntrack(tuple, nf_conntrack_htable_size,
86 nf_conntrack_hash_rnd);
87}
88
Jan Engelhardt5f2b4c92008-04-14 11:15:53 +020089bool
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080090nf_ct_get_tuple(const struct sk_buff *skb,
91 unsigned int nhoff,
92 unsigned int dataoff,
93 u_int16_t l3num,
94 u_int8_t protonum,
95 struct nf_conntrack_tuple *tuple,
96 const struct nf_conntrack_l3proto *l3proto,
Martin Josefsson605dcad2006-11-29 02:35:06 +010097 const struct nf_conntrack_l4proto *l4proto)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080098{
Philip Craig443a70d2008-04-29 03:35:10 -070099 memset(tuple, 0, sizeof(*tuple));
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800100
101 tuple->src.l3num = l3num;
102 if (l3proto->pkt_to_tuple(skb, nhoff, tuple) == 0)
Jan Engelhardt5f2b4c92008-04-14 11:15:53 +0200103 return false;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800104
105 tuple->dst.protonum = protonum;
106 tuple->dst.dir = IP_CT_DIR_ORIGINAL;
107
Martin Josefsson605dcad2006-11-29 02:35:06 +0100108 return l4proto->pkt_to_tuple(skb, dataoff, tuple);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800109}
Patrick McHardy13b18332006-12-02 22:11:25 -0800110EXPORT_SYMBOL_GPL(nf_ct_get_tuple);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800111
Jan Engelhardt5f2b4c92008-04-14 11:15:53 +0200112bool nf_ct_get_tuplepr(const struct sk_buff *skb, unsigned int nhoff,
113 u_int16_t l3num, struct nf_conntrack_tuple *tuple)
Yasuyuki Kozakaie2a31232007-07-14 20:45:14 -0700114{
115 struct nf_conntrack_l3proto *l3proto;
116 struct nf_conntrack_l4proto *l4proto;
117 unsigned int protoff;
118 u_int8_t protonum;
119 int ret;
120
121 rcu_read_lock();
122
123 l3proto = __nf_ct_l3proto_find(l3num);
124 ret = l3proto->get_l4proto(skb, nhoff, &protoff, &protonum);
125 if (ret != NF_ACCEPT) {
126 rcu_read_unlock();
Jan Engelhardt5f2b4c92008-04-14 11:15:53 +0200127 return false;
Yasuyuki Kozakaie2a31232007-07-14 20:45:14 -0700128 }
129
130 l4proto = __nf_ct_l4proto_find(l3num, protonum);
131
132 ret = nf_ct_get_tuple(skb, nhoff, protoff, l3num, protonum, tuple,
133 l3proto, l4proto);
134
135 rcu_read_unlock();
136 return ret;
137}
138EXPORT_SYMBOL_GPL(nf_ct_get_tuplepr);
139
Jan Engelhardt5f2b4c92008-04-14 11:15:53 +0200140bool
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800141nf_ct_invert_tuple(struct nf_conntrack_tuple *inverse,
142 const struct nf_conntrack_tuple *orig,
143 const struct nf_conntrack_l3proto *l3proto,
Martin Josefsson605dcad2006-11-29 02:35:06 +0100144 const struct nf_conntrack_l4proto *l4proto)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800145{
Philip Craig443a70d2008-04-29 03:35:10 -0700146 memset(inverse, 0, sizeof(*inverse));
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800147
148 inverse->src.l3num = orig->src.l3num;
149 if (l3proto->invert_tuple(inverse, orig) == 0)
Jan Engelhardt5f2b4c92008-04-14 11:15:53 +0200150 return false;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800151
152 inverse->dst.dir = !orig->dst.dir;
153
154 inverse->dst.protonum = orig->dst.protonum;
Martin Josefsson605dcad2006-11-29 02:35:06 +0100155 return l4proto->invert_tuple(inverse, orig);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800156}
Patrick McHardy13b18332006-12-02 22:11:25 -0800157EXPORT_SYMBOL_GPL(nf_ct_invert_tuple);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800158
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800159static void
160clean_from_lists(struct nf_conn *ct)
161{
Patrick McHardy0d537782007-07-07 22:39:38 -0700162 pr_debug("clean_from_lists(%p)\n", ct);
Patrick McHardy76507f62008-01-31 04:38:38 -0800163 hlist_del_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode);
164 hlist_del_rcu(&ct->tuplehash[IP_CT_DIR_REPLY].hnode);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800165
166 /* Destroy all pending expectations */
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800167 nf_ct_remove_expectations(ct);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800168}
169
170static void
171destroy_conntrack(struct nf_conntrack *nfct)
172{
173 struct nf_conn *ct = (struct nf_conn *)nfct;
Martin Josefsson605dcad2006-11-29 02:35:06 +0100174 struct nf_conntrack_l4proto *l4proto;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800175
Patrick McHardy0d537782007-07-07 22:39:38 -0700176 pr_debug("destroy_conntrack(%p)\n", ct);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800177 NF_CT_ASSERT(atomic_read(&nfct->use) == 0);
178 NF_CT_ASSERT(!timer_pending(&ct->timeout));
179
180 nf_conntrack_event(IPCT_DESTROY, ct);
181 set_bit(IPS_DYING_BIT, &ct->status);
182
183 /* To make sure we don't get any weird locking issues here:
184 * destroy_conntrack() MUST NOT be called with a write lock
185 * to nf_conntrack_lock!!! -HW */
Patrick McHardy923f4902007-02-12 11:12:57 -0800186 rcu_read_lock();
Patrick McHardy5e8fbe22008-04-14 11:15:52 +0200187 l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
Martin Josefsson605dcad2006-11-29 02:35:06 +0100188 if (l4proto && l4proto->destroy)
189 l4proto->destroy(ct);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800190
Patrick McHardy982d9a92007-02-12 11:14:11 -0800191 rcu_read_unlock();
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800192
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800193 spin_lock_bh(&nf_conntrack_lock);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800194 /* Expectations will have been removed in clean_from_lists,
195 * except TFTP can create an expectation on the first packet,
196 * before connection is in the list, so we need to clean here,
197 * too. */
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800198 nf_ct_remove_expectations(ct);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800199
200 /* We overload first tuple to link into unconfirmed list. */
201 if (!nf_ct_is_confirmed(ct)) {
Patrick McHardyf205c5e2007-07-07 22:28:14 -0700202 BUG_ON(hlist_unhashed(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode));
203 hlist_del(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800204 }
205
206 NF_CT_STAT_INC(delete);
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800207 spin_unlock_bh(&nf_conntrack_lock);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800208
209 if (ct->master)
210 nf_ct_put(ct->master);
211
Patrick McHardy0d537782007-07-07 22:39:38 -0700212 pr_debug("destroy_conntrack: returning ct=%p to slab\n", ct);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800213 nf_conntrack_free(ct);
214}
215
216static void death_by_timeout(unsigned long ul_conntrack)
217{
218 struct nf_conn *ct = (void *)ul_conntrack;
Patrick McHardy5397e972007-05-19 14:23:52 -0700219 struct nf_conn_help *help = nfct_help(ct);
Patrick McHarrdy3c158f72007-06-05 12:55:27 -0700220 struct nf_conntrack_helper *helper;
Patrick McHardy5397e972007-05-19 14:23:52 -0700221
Patrick McHarrdy3c158f72007-06-05 12:55:27 -0700222 if (help) {
223 rcu_read_lock();
224 helper = rcu_dereference(help->helper);
225 if (helper && helper->destroy)
226 helper->destroy(ct);
227 rcu_read_unlock();
228 }
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800229
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800230 spin_lock_bh(&nf_conntrack_lock);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800231 /* Inside lock so preempt is disabled on module removal path.
232 * Otherwise we can get spurious warnings. */
233 NF_CT_STAT_INC(delete_list);
234 clean_from_lists(ct);
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800235 spin_unlock_bh(&nf_conntrack_lock);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800236 nf_ct_put(ct);
237}
238
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800239struct nf_conntrack_tuple_hash *
Alexey Dobriyan400dad32008-10-08 11:35:03 +0200240__nf_conntrack_find(struct net *net, const struct nf_conntrack_tuple *tuple)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800241{
242 struct nf_conntrack_tuple_hash *h;
Patrick McHardyf205c5e2007-07-07 22:28:14 -0700243 struct hlist_node *n;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800244 unsigned int hash = hash_conntrack(tuple);
245
Patrick McHardy4e29e9e2008-02-27 12:07:47 -0800246 /* Disable BHs the entire time since we normally need to disable them
247 * at least once for the stats anyway.
248 */
249 local_bh_disable();
Alexey Dobriyan400dad32008-10-08 11:35:03 +0200250 hlist_for_each_entry_rcu(h, n, &net->ct.hash[hash], hnode) {
Patrick McHardyba419af2008-01-31 04:39:23 -0800251 if (nf_ct_tuple_equal(tuple, &h->tuple)) {
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800252 NF_CT_STAT_INC(found);
Patrick McHardy4e29e9e2008-02-27 12:07:47 -0800253 local_bh_enable();
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800254 return h;
255 }
256 NF_CT_STAT_INC(searched);
257 }
Patrick McHardy4e29e9e2008-02-27 12:07:47 -0800258 local_bh_enable();
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800259
260 return NULL;
261}
Patrick McHardy13b18332006-12-02 22:11:25 -0800262EXPORT_SYMBOL_GPL(__nf_conntrack_find);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800263
264/* Find a connection corresponding to a tuple. */
265struct nf_conntrack_tuple_hash *
Alexey Dobriyan400dad32008-10-08 11:35:03 +0200266nf_conntrack_find_get(struct net *net, const struct nf_conntrack_tuple *tuple)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800267{
268 struct nf_conntrack_tuple_hash *h;
Patrick McHardy76507f62008-01-31 04:38:38 -0800269 struct nf_conn *ct;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800270
Patrick McHardy76507f62008-01-31 04:38:38 -0800271 rcu_read_lock();
Alexey Dobriyan400dad32008-10-08 11:35:03 +0200272 h = __nf_conntrack_find(net, tuple);
Patrick McHardy76507f62008-01-31 04:38:38 -0800273 if (h) {
274 ct = nf_ct_tuplehash_to_ctrack(h);
275 if (unlikely(!atomic_inc_not_zero(&ct->ct_general.use)))
276 h = NULL;
277 }
278 rcu_read_unlock();
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800279
280 return h;
281}
Patrick McHardy13b18332006-12-02 22:11:25 -0800282EXPORT_SYMBOL_GPL(nf_conntrack_find_get);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800283
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800284static void __nf_conntrack_hash_insert(struct nf_conn *ct,
285 unsigned int hash,
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800286 unsigned int repl_hash)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800287{
Alexey Dobriyan400dad32008-10-08 11:35:03 +0200288 struct net *net = nf_ct_net(ct);
289
Patrick McHardy76507f62008-01-31 04:38:38 -0800290 hlist_add_head_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode,
Alexey Dobriyan400dad32008-10-08 11:35:03 +0200291 &net->ct.hash[hash]);
Patrick McHardy76507f62008-01-31 04:38:38 -0800292 hlist_add_head_rcu(&ct->tuplehash[IP_CT_DIR_REPLY].hnode,
Alexey Dobriyan400dad32008-10-08 11:35:03 +0200293 &net->ct.hash[repl_hash]);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800294}
295
296void nf_conntrack_hash_insert(struct nf_conn *ct)
297{
298 unsigned int hash, repl_hash;
299
300 hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
301 repl_hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
302
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800303 spin_lock_bh(&nf_conntrack_lock);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800304 __nf_conntrack_hash_insert(ct, hash, repl_hash);
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800305 spin_unlock_bh(&nf_conntrack_lock);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800306}
Patrick McHardy13b18332006-12-02 22:11:25 -0800307EXPORT_SYMBOL_GPL(nf_conntrack_hash_insert);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800308
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800309/* Confirm a connection given skb; places it in hash table */
310int
Herbert Xu3db05fe2007-10-15 00:53:15 -0700311__nf_conntrack_confirm(struct sk_buff *skb)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800312{
313 unsigned int hash, repl_hash;
Patrick McHardydf0933d2006-09-20 11:57:53 -0700314 struct nf_conntrack_tuple_hash *h;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800315 struct nf_conn *ct;
Patrick McHardydf0933d2006-09-20 11:57:53 -0700316 struct nf_conn_help *help;
Patrick McHardyf205c5e2007-07-07 22:28:14 -0700317 struct hlist_node *n;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800318 enum ip_conntrack_info ctinfo;
Alexey Dobriyan400dad32008-10-08 11:35:03 +0200319 struct net *net;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800320
Herbert Xu3db05fe2007-10-15 00:53:15 -0700321 ct = nf_ct_get(skb, &ctinfo);
Alexey Dobriyan400dad32008-10-08 11:35:03 +0200322 net = nf_ct_net(ct);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800323
324 /* ipt_REJECT uses nf_conntrack_attach to attach related
325 ICMP/TCP RST packets in other direction. Actual packet
326 which created connection will be IP_CT_NEW or for an
327 expected connection, IP_CT_RELATED. */
328 if (CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL)
329 return NF_ACCEPT;
330
331 hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
332 repl_hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
333
334 /* We're not in hash table, and we refuse to set up related
335 connections for unconfirmed conns. But packet copies and
336 REJECT will give spurious warnings here. */
337 /* NF_CT_ASSERT(atomic_read(&ct->ct_general.use) == 1); */
338
339 /* No external references means noone else could have
340 confirmed us. */
341 NF_CT_ASSERT(!nf_ct_is_confirmed(ct));
Patrick McHardy0d537782007-07-07 22:39:38 -0700342 pr_debug("Confirming conntrack %p\n", ct);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800343
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800344 spin_lock_bh(&nf_conntrack_lock);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800345
346 /* See if there's one in the list already, including reverse:
347 NAT could have grabbed it without realizing, since we're
348 not in the hash. If there is, we lost race. */
Alexey Dobriyan400dad32008-10-08 11:35:03 +0200349 hlist_for_each_entry(h, n, &net->ct.hash[hash], hnode)
Patrick McHardydf0933d2006-09-20 11:57:53 -0700350 if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
351 &h->tuple))
352 goto out;
Alexey Dobriyan400dad32008-10-08 11:35:03 +0200353 hlist_for_each_entry(h, n, &net->ct.hash[repl_hash], hnode)
Patrick McHardydf0933d2006-09-20 11:57:53 -0700354 if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_REPLY].tuple,
355 &h->tuple))
356 goto out;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800357
Patrick McHardydf0933d2006-09-20 11:57:53 -0700358 /* Remove from unconfirmed list */
Patrick McHardyf205c5e2007-07-07 22:28:14 -0700359 hlist_del(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode);
Patrick McHardydf0933d2006-09-20 11:57:53 -0700360
361 __nf_conntrack_hash_insert(ct, hash, repl_hash);
362 /* Timer relative to confirmation time, not original
363 setting time, otherwise we'd get timer wrap in
364 weird delay cases. */
365 ct->timeout.expires += jiffies;
366 add_timer(&ct->timeout);
367 atomic_inc(&ct->ct_general.use);
368 set_bit(IPS_CONFIRMED_BIT, &ct->status);
369 NF_CT_STAT_INC(insert);
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800370 spin_unlock_bh(&nf_conntrack_lock);
Patrick McHardydf0933d2006-09-20 11:57:53 -0700371 help = nfct_help(ct);
372 if (help && help->helper)
Herbert Xu3db05fe2007-10-15 00:53:15 -0700373 nf_conntrack_event_cache(IPCT_HELPER, skb);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800374#ifdef CONFIG_NF_NAT_NEEDED
Patrick McHardydf0933d2006-09-20 11:57:53 -0700375 if (test_bit(IPS_SRC_NAT_DONE_BIT, &ct->status) ||
376 test_bit(IPS_DST_NAT_DONE_BIT, &ct->status))
Herbert Xu3db05fe2007-10-15 00:53:15 -0700377 nf_conntrack_event_cache(IPCT_NATINFO, skb);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800378#endif
Patrick McHardydf0933d2006-09-20 11:57:53 -0700379 nf_conntrack_event_cache(master_ct(ct) ?
Herbert Xu3db05fe2007-10-15 00:53:15 -0700380 IPCT_RELATED : IPCT_NEW, skb);
Patrick McHardydf0933d2006-09-20 11:57:53 -0700381 return NF_ACCEPT;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800382
Patrick McHardydf0933d2006-09-20 11:57:53 -0700383out:
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800384 NF_CT_STAT_INC(insert_failed);
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800385 spin_unlock_bh(&nf_conntrack_lock);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800386 return NF_DROP;
387}
Patrick McHardy13b18332006-12-02 22:11:25 -0800388EXPORT_SYMBOL_GPL(__nf_conntrack_confirm);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800389
390/* Returns true if a connection correspondings to the tuple (required
391 for NAT). */
392int
393nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
394 const struct nf_conn *ignored_conntrack)
395{
Alexey Dobriyan400dad32008-10-08 11:35:03 +0200396 struct net *net = nf_ct_net(ignored_conntrack);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800397 struct nf_conntrack_tuple_hash *h;
Patrick McHardyba419af2008-01-31 04:39:23 -0800398 struct hlist_node *n;
399 unsigned int hash = hash_conntrack(tuple);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800400
Patrick McHardy4e29e9e2008-02-27 12:07:47 -0800401 /* Disable BHs the entire time since we need to disable them at
402 * least once for the stats anyway.
403 */
404 rcu_read_lock_bh();
Alexey Dobriyan400dad32008-10-08 11:35:03 +0200405 hlist_for_each_entry_rcu(h, n, &net->ct.hash[hash], hnode) {
Patrick McHardyba419af2008-01-31 04:39:23 -0800406 if (nf_ct_tuplehash_to_ctrack(h) != ignored_conntrack &&
407 nf_ct_tuple_equal(tuple, &h->tuple)) {
408 NF_CT_STAT_INC(found);
Patrick McHardy4e29e9e2008-02-27 12:07:47 -0800409 rcu_read_unlock_bh();
Patrick McHardyba419af2008-01-31 04:39:23 -0800410 return 1;
411 }
412 NF_CT_STAT_INC(searched);
413 }
Patrick McHardy4e29e9e2008-02-27 12:07:47 -0800414 rcu_read_unlock_bh();
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800415
Patrick McHardyba419af2008-01-31 04:39:23 -0800416 return 0;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800417}
Patrick McHardy13b18332006-12-02 22:11:25 -0800418EXPORT_SYMBOL_GPL(nf_conntrack_tuple_taken);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800419
Patrick McHardy7ae77302007-07-07 22:37:38 -0700420#define NF_CT_EVICTION_RANGE 8
421
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800422/* There's a small race here where we may free a just-assured
423 connection. Too bad: we're in trouble anyway. */
Alexey Dobriyan400dad32008-10-08 11:35:03 +0200424static noinline int early_drop(struct net *net, unsigned int hash)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800425{
Patrick McHardyf205c5e2007-07-07 22:28:14 -0700426 /* Use oldest entry, which is roughly LRU */
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800427 struct nf_conntrack_tuple_hash *h;
Patrick McHardydf0933d2006-09-20 11:57:53 -0700428 struct nf_conn *ct = NULL, *tmp;
Patrick McHardyf205c5e2007-07-07 22:28:14 -0700429 struct hlist_node *n;
Patrick McHardy7ae77302007-07-07 22:37:38 -0700430 unsigned int i, cnt = 0;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800431 int dropped = 0;
432
Patrick McHardy76507f62008-01-31 04:38:38 -0800433 rcu_read_lock();
Patrick McHardy7ae77302007-07-07 22:37:38 -0700434 for (i = 0; i < nf_conntrack_htable_size; i++) {
Alexey Dobriyan400dad32008-10-08 11:35:03 +0200435 hlist_for_each_entry_rcu(h, n, &net->ct.hash[hash],
Patrick McHardy76507f62008-01-31 04:38:38 -0800436 hnode) {
Patrick McHardy7ae77302007-07-07 22:37:38 -0700437 tmp = nf_ct_tuplehash_to_ctrack(h);
438 if (!test_bit(IPS_ASSURED_BIT, &tmp->status))
439 ct = tmp;
440 cnt++;
441 }
Patrick McHardy76507f62008-01-31 04:38:38 -0800442
443 if (ct && unlikely(!atomic_inc_not_zero(&ct->ct_general.use)))
444 ct = NULL;
Patrick McHardy7ae77302007-07-07 22:37:38 -0700445 if (ct || cnt >= NF_CT_EVICTION_RANGE)
446 break;
447 hash = (hash + 1) % nf_conntrack_htable_size;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800448 }
Patrick McHardy76507f62008-01-31 04:38:38 -0800449 rcu_read_unlock();
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800450
451 if (!ct)
452 return dropped;
453
454 if (del_timer(&ct->timeout)) {
455 death_by_timeout((unsigned long)ct);
456 dropped = 1;
Patrick McHardyc0e912d2007-02-12 11:13:43 -0800457 NF_CT_STAT_INC_ATOMIC(early_drop);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800458 }
459 nf_ct_put(ct);
460 return dropped;
461}
462
Alexey Dobriyan5a1fb392008-10-08 11:35:02 +0200463struct nf_conn *nf_conntrack_alloc(struct net *net,
464 const struct nf_conntrack_tuple *orig,
Pablo Neira Ayusob891c5a2008-07-08 02:35:55 -0700465 const struct nf_conntrack_tuple *repl,
466 gfp_t gfp)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800467{
Patrick McHardyc88130b2008-01-31 04:42:11 -0800468 struct nf_conn *ct = NULL;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800469
Harald Weltedc808fe2006-03-20 17:56:32 -0800470 if (unlikely(!nf_conntrack_hash_rnd_initted)) {
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800471 get_random_bytes(&nf_conntrack_hash_rnd, 4);
472 nf_conntrack_hash_rnd_initted = 1;
473 }
474
Pablo Neira Ayuso5251e2d2006-09-20 12:01:06 -0700475 /* We don't want any race condition at early drop stage */
Alexey Dobriyan49ac8712008-10-08 11:35:03 +0200476 atomic_inc(&net->ct.count);
Pablo Neira Ayuso5251e2d2006-09-20 12:01:06 -0700477
Patrick McHardy76eb9462008-01-31 04:41:44 -0800478 if (nf_conntrack_max &&
Alexey Dobriyan49ac8712008-10-08 11:35:03 +0200479 unlikely(atomic_read(&net->ct.count) > nf_conntrack_max)) {
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800480 unsigned int hash = hash_conntrack(orig);
Alexey Dobriyan400dad32008-10-08 11:35:03 +0200481 if (!early_drop(net, hash)) {
Alexey Dobriyan49ac8712008-10-08 11:35:03 +0200482 atomic_dec(&net->ct.count);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800483 if (net_ratelimit())
484 printk(KERN_WARNING
485 "nf_conntrack: table full, dropping"
486 " packet.\n");
487 return ERR_PTR(-ENOMEM);
488 }
489 }
490
Pablo Neira Ayusob891c5a2008-07-08 02:35:55 -0700491 ct = kmem_cache_zalloc(nf_conntrack_cachep, gfp);
Patrick McHardyc88130b2008-01-31 04:42:11 -0800492 if (ct == NULL) {
Patrick McHardy0d537782007-07-07 22:39:38 -0700493 pr_debug("nf_conntrack_alloc: Can't alloc conntrack.\n");
Alexey Dobriyan49ac8712008-10-08 11:35:03 +0200494 atomic_dec(&net->ct.count);
Yasuyuki Kozakaidacd2a12007-07-07 22:25:51 -0700495 return ERR_PTR(-ENOMEM);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800496 }
497
Patrick McHardyc88130b2008-01-31 04:42:11 -0800498 atomic_set(&ct->ct_general.use, 1);
499 ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple = *orig;
500 ct->tuplehash[IP_CT_DIR_REPLY].tuple = *repl;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800501 /* Don't set timer yet: wait for confirmation */
Patrick McHardyc88130b2008-01-31 04:42:11 -0800502 setup_timer(&ct->timeout, death_by_timeout, (unsigned long)ct);
Alexey Dobriyan5a1fb392008-10-08 11:35:02 +0200503#ifdef CONFIG_NET_NS
504 ct->ct_net = net;
505#endif
Patrick McHardyc88130b2008-01-31 04:42:11 -0800506 INIT_RCU_HEAD(&ct->rcu);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800507
Patrick McHardyc88130b2008-01-31 04:42:11 -0800508 return ct;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800509}
Patrick McHardy13b18332006-12-02 22:11:25 -0800510EXPORT_SYMBOL_GPL(nf_conntrack_alloc);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800511
Patrick McHardy76507f62008-01-31 04:38:38 -0800512static void nf_conntrack_free_rcu(struct rcu_head *head)
513{
514 struct nf_conn *ct = container_of(head, struct nf_conn, rcu);
Alexey Dobriyan49ac8712008-10-08 11:35:03 +0200515 struct net *net = nf_ct_net(ct);
Patrick McHardy76507f62008-01-31 04:38:38 -0800516
517 nf_ct_ext_free(ct);
518 kmem_cache_free(nf_conntrack_cachep, ct);
Alexey Dobriyan49ac8712008-10-08 11:35:03 +0200519 atomic_dec(&net->ct.count);
Patrick McHardy76507f62008-01-31 04:38:38 -0800520}
521
Patrick McHardyc88130b2008-01-31 04:42:11 -0800522void nf_conntrack_free(struct nf_conn *ct)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800523{
Patrick McHardyceeff752008-06-11 17:51:10 -0700524 nf_ct_ext_destroy(ct);
Patrick McHardyc88130b2008-01-31 04:42:11 -0800525 call_rcu(&ct->rcu, nf_conntrack_free_rcu);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800526}
Patrick McHardy13b18332006-12-02 22:11:25 -0800527EXPORT_SYMBOL_GPL(nf_conntrack_free);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800528
529/* Allocate a new conntrack: we return -ENOMEM if classification
530 failed due to stress. Otherwise it really is unclassifiable. */
531static struct nf_conntrack_tuple_hash *
Alexey Dobriyan5a1fb392008-10-08 11:35:02 +0200532init_conntrack(struct net *net,
533 const struct nf_conntrack_tuple *tuple,
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800534 struct nf_conntrack_l3proto *l3proto,
Martin Josefsson605dcad2006-11-29 02:35:06 +0100535 struct nf_conntrack_l4proto *l4proto,
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800536 struct sk_buff *skb,
537 unsigned int dataoff)
538{
Patrick McHardyc88130b2008-01-31 04:42:11 -0800539 struct nf_conn *ct;
Patrick McHarrdy3c158f72007-06-05 12:55:27 -0700540 struct nf_conn_help *help;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800541 struct nf_conntrack_tuple repl_tuple;
542 struct nf_conntrack_expect *exp;
543
Martin Josefsson605dcad2006-11-29 02:35:06 +0100544 if (!nf_ct_invert_tuple(&repl_tuple, tuple, l3proto, l4proto)) {
Patrick McHardy0d537782007-07-07 22:39:38 -0700545 pr_debug("Can't invert tuple.\n");
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800546 return NULL;
547 }
548
Alexey Dobriyan5a1fb392008-10-08 11:35:02 +0200549 ct = nf_conntrack_alloc(net, tuple, &repl_tuple, GFP_ATOMIC);
Patrick McHardyc88130b2008-01-31 04:42:11 -0800550 if (ct == NULL || IS_ERR(ct)) {
Patrick McHardy0d537782007-07-07 22:39:38 -0700551 pr_debug("Can't allocate conntrack.\n");
Patrick McHardyc88130b2008-01-31 04:42:11 -0800552 return (struct nf_conntrack_tuple_hash *)ct;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800553 }
554
Patrick McHardyc88130b2008-01-31 04:42:11 -0800555 if (!l4proto->new(ct, skb, dataoff)) {
556 nf_conntrack_free(ct);
Patrick McHardy0d537782007-07-07 22:39:38 -0700557 pr_debug("init conntrack: can't track with proto module\n");
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800558 return NULL;
559 }
560
Krzysztof Piotr Oledzki58401572008-07-21 10:01:34 -0700561 nf_ct_acct_ext_add(ct, GFP_ATOMIC);
562
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800563 spin_lock_bh(&nf_conntrack_lock);
Alexey Dobriyan9b03f382008-10-08 11:35:03 +0200564 exp = nf_ct_find_expectation(net, tuple);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800565 if (exp) {
Patrick McHardy0d537782007-07-07 22:39:38 -0700566 pr_debug("conntrack: expectation arrives ct=%p exp=%p\n",
Patrick McHardyc88130b2008-01-31 04:42:11 -0800567 ct, exp);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800568 /* Welcome, Mr. Bond. We've been expecting you... */
Patrick McHardyc88130b2008-01-31 04:42:11 -0800569 __set_bit(IPS_EXPECTED_BIT, &ct->status);
570 ct->master = exp->master;
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -0700571 if (exp->helper) {
Patrick McHardyc88130b2008-01-31 04:42:11 -0800572 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -0700573 if (help)
574 rcu_assign_pointer(help->helper, exp->helper);
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -0700575 }
576
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800577#ifdef CONFIG_NF_CONNTRACK_MARK
Patrick McHardyc88130b2008-01-31 04:42:11 -0800578 ct->mark = exp->master->mark;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800579#endif
James Morris7c9728c2006-06-09 00:31:46 -0700580#ifdef CONFIG_NF_CONNTRACK_SECMARK
Patrick McHardyc88130b2008-01-31 04:42:11 -0800581 ct->secmark = exp->master->secmark;
James Morris7c9728c2006-06-09 00:31:46 -0700582#endif
Patrick McHardyc88130b2008-01-31 04:42:11 -0800583 nf_conntrack_get(&ct->master->ct_general);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800584 NF_CT_STAT_INC(expect_new);
Yasuyuki Kozakai22e74102006-11-27 10:25:59 -0800585 } else {
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -0700586 struct nf_conntrack_helper *helper;
587
588 helper = __nf_ct_helper_find(&repl_tuple);
589 if (helper) {
Patrick McHardyc88130b2008-01-31 04:42:11 -0800590 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -0700591 if (help)
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -0700592 rcu_assign_pointer(help->helper, helper);
Patrick McHarrdy3c158f72007-06-05 12:55:27 -0700593 }
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800594 NF_CT_STAT_INC(new);
Yasuyuki Kozakai22e74102006-11-27 10:25:59 -0800595 }
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800596
597 /* Overload tuple linked list to put us in unconfirmed list. */
Alexey Dobriyan63c9a262008-10-08 11:35:04 +0200598 hlist_add_head(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode,
599 &net->ct.unconfirmed);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800600
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800601 spin_unlock_bh(&nf_conntrack_lock);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800602
603 if (exp) {
604 if (exp->expectfn)
Patrick McHardyc88130b2008-01-31 04:42:11 -0800605 exp->expectfn(ct, exp);
Patrick McHardy68236452007-07-07 22:30:49 -0700606 nf_ct_expect_put(exp);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800607 }
608
Patrick McHardyc88130b2008-01-31 04:42:11 -0800609 return &ct->tuplehash[IP_CT_DIR_ORIGINAL];
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800610}
611
612/* On success, returns conntrack ptr, sets skb->nfct and ctinfo */
613static inline struct nf_conn *
614resolve_normal_ct(struct sk_buff *skb,
615 unsigned int dataoff,
616 u_int16_t l3num,
617 u_int8_t protonum,
618 struct nf_conntrack_l3proto *l3proto,
Martin Josefsson605dcad2006-11-29 02:35:06 +0100619 struct nf_conntrack_l4proto *l4proto,
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800620 int *set_reply,
621 enum ip_conntrack_info *ctinfo)
622{
623 struct nf_conntrack_tuple tuple;
624 struct nf_conntrack_tuple_hash *h;
625 struct nf_conn *ct;
626
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -0300627 if (!nf_ct_get_tuple(skb, skb_network_offset(skb),
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800628 dataoff, l3num, protonum, &tuple, l3proto,
Martin Josefsson605dcad2006-11-29 02:35:06 +0100629 l4proto)) {
Patrick McHardy0d537782007-07-07 22:39:38 -0700630 pr_debug("resolve_normal_ct: Can't get tuple\n");
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800631 return NULL;
632 }
633
634 /* look for tuple match */
Alexey Dobriyan400dad32008-10-08 11:35:03 +0200635 h = nf_conntrack_find_get(&init_net, &tuple);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800636 if (!h) {
Alexey Dobriyan5a1fb392008-10-08 11:35:02 +0200637 h = init_conntrack(&init_net, &tuple, l3proto, l4proto, skb,
638 dataoff);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800639 if (!h)
640 return NULL;
641 if (IS_ERR(h))
642 return (void *)h;
643 }
644 ct = nf_ct_tuplehash_to_ctrack(h);
645
646 /* It exists; we have (non-exclusive) reference. */
647 if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY) {
648 *ctinfo = IP_CT_ESTABLISHED + IP_CT_IS_REPLY;
649 /* Please set reply bit if this packet OK */
650 *set_reply = 1;
651 } else {
652 /* Once we've had two way comms, always ESTABLISHED. */
653 if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
Patrick McHardy0d537782007-07-07 22:39:38 -0700654 pr_debug("nf_conntrack_in: normal packet for %p\n", ct);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800655 *ctinfo = IP_CT_ESTABLISHED;
656 } else if (test_bit(IPS_EXPECTED_BIT, &ct->status)) {
Patrick McHardy0d537782007-07-07 22:39:38 -0700657 pr_debug("nf_conntrack_in: related packet for %p\n",
658 ct);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800659 *ctinfo = IP_CT_RELATED;
660 } else {
Patrick McHardy0d537782007-07-07 22:39:38 -0700661 pr_debug("nf_conntrack_in: new packet for %p\n", ct);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800662 *ctinfo = IP_CT_NEW;
663 }
664 *set_reply = 0;
665 }
666 skb->nfct = &ct->ct_general;
667 skb->nfctinfo = *ctinfo;
668 return ct;
669}
670
671unsigned int
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200672nf_conntrack_in(u_int8_t pf, unsigned int hooknum, struct sk_buff *skb)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800673{
674 struct nf_conn *ct;
675 enum ip_conntrack_info ctinfo;
676 struct nf_conntrack_l3proto *l3proto;
Martin Josefsson605dcad2006-11-29 02:35:06 +0100677 struct nf_conntrack_l4proto *l4proto;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800678 unsigned int dataoff;
679 u_int8_t protonum;
680 int set_reply = 0;
681 int ret;
682
683 /* Previously seen (loopback or untracked)? Ignore. */
Herbert Xu3db05fe2007-10-15 00:53:15 -0700684 if (skb->nfct) {
Patrick McHardyc0e912d2007-02-12 11:13:43 -0800685 NF_CT_STAT_INC_ATOMIC(ignore);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800686 return NF_ACCEPT;
687 }
688
Patrick McHardy923f4902007-02-12 11:12:57 -0800689 /* rcu_read_lock()ed by nf_hook_slow */
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200690 l3proto = __nf_ct_l3proto_find(pf);
Herbert Xu3db05fe2007-10-15 00:53:15 -0700691 ret = l3proto->get_l4proto(skb, skb_network_offset(skb),
Yasuyuki Kozakaiffc30692007-07-14 20:44:50 -0700692 &dataoff, &protonum);
693 if (ret <= 0) {
Patrick McHardy0d537782007-07-07 22:39:38 -0700694 pr_debug("not prepared to track yet or error occured\n");
Yasuyuki Kozakaid87d8462007-07-14 20:44:23 -0700695 NF_CT_STAT_INC_ATOMIC(error);
696 NF_CT_STAT_INC_ATOMIC(invalid);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800697 return -ret;
698 }
699
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200700 l4proto = __nf_ct_l4proto_find(pf, protonum);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800701
702 /* It may be an special packet, error, unclean...
703 * inverse of the return code tells to the netfilter
704 * core what to do with the packet. */
Martin Josefsson605dcad2006-11-29 02:35:06 +0100705 if (l4proto->error != NULL &&
Herbert Xu3db05fe2007-10-15 00:53:15 -0700706 (ret = l4proto->error(skb, dataoff, &ctinfo, pf, hooknum)) <= 0) {
Patrick McHardyc0e912d2007-02-12 11:13:43 -0800707 NF_CT_STAT_INC_ATOMIC(error);
708 NF_CT_STAT_INC_ATOMIC(invalid);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800709 return -ret;
710 }
711
Herbert Xu3db05fe2007-10-15 00:53:15 -0700712 ct = resolve_normal_ct(skb, dataoff, pf, protonum, l3proto, l4proto,
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800713 &set_reply, &ctinfo);
714 if (!ct) {
715 /* Not valid part of a connection */
Patrick McHardyc0e912d2007-02-12 11:13:43 -0800716 NF_CT_STAT_INC_ATOMIC(invalid);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800717 return NF_ACCEPT;
718 }
719
720 if (IS_ERR(ct)) {
721 /* Too stressed to deal. */
Patrick McHardyc0e912d2007-02-12 11:13:43 -0800722 NF_CT_STAT_INC_ATOMIC(drop);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800723 return NF_DROP;
724 }
725
Herbert Xu3db05fe2007-10-15 00:53:15 -0700726 NF_CT_ASSERT(skb->nfct);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800727
Herbert Xu3db05fe2007-10-15 00:53:15 -0700728 ret = l4proto->packet(ct, skb, dataoff, ctinfo, pf, hooknum);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800729 if (ret < 0) {
730 /* Invalid: inverse of the return code tells
731 * the netfilter core what to do */
Patrick McHardy0d537782007-07-07 22:39:38 -0700732 pr_debug("nf_conntrack_in: Can't track with proto module\n");
Herbert Xu3db05fe2007-10-15 00:53:15 -0700733 nf_conntrack_put(skb->nfct);
734 skb->nfct = NULL;
Patrick McHardyc0e912d2007-02-12 11:13:43 -0800735 NF_CT_STAT_INC_ATOMIC(invalid);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800736 return -ret;
737 }
738
739 if (set_reply && !test_and_set_bit(IPS_SEEN_REPLY_BIT, &ct->status))
Herbert Xu3db05fe2007-10-15 00:53:15 -0700740 nf_conntrack_event_cache(IPCT_STATUS, skb);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800741
742 return ret;
743}
Patrick McHardy13b18332006-12-02 22:11:25 -0800744EXPORT_SYMBOL_GPL(nf_conntrack_in);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800745
Jan Engelhardt5f2b4c92008-04-14 11:15:53 +0200746bool nf_ct_invert_tuplepr(struct nf_conntrack_tuple *inverse,
747 const struct nf_conntrack_tuple *orig)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800748{
Jan Engelhardt5f2b4c92008-04-14 11:15:53 +0200749 bool ret;
Patrick McHardy923f4902007-02-12 11:12:57 -0800750
751 rcu_read_lock();
752 ret = nf_ct_invert_tuple(inverse, orig,
753 __nf_ct_l3proto_find(orig->src.l3num),
754 __nf_ct_l4proto_find(orig->src.l3num,
755 orig->dst.protonum));
756 rcu_read_unlock();
757 return ret;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800758}
Patrick McHardy13b18332006-12-02 22:11:25 -0800759EXPORT_SYMBOL_GPL(nf_ct_invert_tuplepr);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800760
Jozsef Kadlecsik5b1158e2006-12-02 22:07:13 -0800761/* Alter reply tuple (maybe alter helper). This is for NAT, and is
762 implicitly racy: see __nf_conntrack_confirm */
763void nf_conntrack_alter_reply(struct nf_conn *ct,
764 const struct nf_conntrack_tuple *newreply)
765{
766 struct nf_conn_help *help = nfct_help(ct);
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -0700767 struct nf_conntrack_helper *helper;
Jozsef Kadlecsik5b1158e2006-12-02 22:07:13 -0800768
Jozsef Kadlecsik5b1158e2006-12-02 22:07:13 -0800769 /* Should be unconfirmed, so not in hash table yet */
770 NF_CT_ASSERT(!nf_ct_is_confirmed(ct));
771
Patrick McHardy0d537782007-07-07 22:39:38 -0700772 pr_debug("Altering reply tuple of %p to ", ct);
Jan Engelhardt3c9fba62008-04-14 11:15:54 +0200773 nf_ct_dump_tuple(newreply);
Jozsef Kadlecsik5b1158e2006-12-02 22:07:13 -0800774
775 ct->tuplehash[IP_CT_DIR_REPLY].tuple = *newreply;
Patrick McHardyef1a5a52008-04-14 11:21:01 +0200776 if (ct->master || (help && !hlist_empty(&help->expectations)))
Patrick McHardyc52fbb42008-01-31 04:37:36 -0800777 return;
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -0700778
Patrick McHardyc52fbb42008-01-31 04:37:36 -0800779 rcu_read_lock();
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -0700780 helper = __nf_ct_helper_find(newreply);
781 if (helper == NULL) {
782 if (help)
783 rcu_assign_pointer(help->helper, NULL);
784 goto out;
Yasuyuki Kozakai5d78a842007-05-10 14:16:24 -0700785 }
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -0700786
787 if (help == NULL) {
Patrick McHardyb5605802007-07-07 22:35:56 -0700788 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
789 if (help == NULL)
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -0700790 goto out;
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -0700791 } else {
792 memset(&help->help, 0, sizeof(help->help));
793 }
794
795 rcu_assign_pointer(help->helper, helper);
796out:
Patrick McHardyc52fbb42008-01-31 04:37:36 -0800797 rcu_read_unlock();
Jozsef Kadlecsik5b1158e2006-12-02 22:07:13 -0800798}
Patrick McHardy13b18332006-12-02 22:11:25 -0800799EXPORT_SYMBOL_GPL(nf_conntrack_alter_reply);
Jozsef Kadlecsik5b1158e2006-12-02 22:07:13 -0800800
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800801/* Refresh conntrack for this many jiffies and do accounting if do_acct is 1 */
802void __nf_ct_refresh_acct(struct nf_conn *ct,
803 enum ip_conntrack_info ctinfo,
804 const struct sk_buff *skb,
805 unsigned long extra_jiffies,
806 int do_acct)
807{
808 int event = 0;
809
810 NF_CT_ASSERT(ct->timeout.data == (unsigned long)ct);
811 NF_CT_ASSERT(skb);
812
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800813 spin_lock_bh(&nf_conntrack_lock);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800814
Eric Leblond997ae832006-05-29 18:24:20 -0700815 /* Only update if this is not a fixed timeout */
Patrick McHardy47d95042008-01-31 04:36:31 -0800816 if (test_bit(IPS_FIXED_TIMEOUT_BIT, &ct->status))
817 goto acct;
Eric Leblond997ae832006-05-29 18:24:20 -0700818
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800819 /* If not in hash table, timer will not be active yet */
820 if (!nf_ct_is_confirmed(ct)) {
821 ct->timeout.expires = extra_jiffies;
822 event = IPCT_REFRESH;
823 } else {
Martin Josefssonbe00c8e2006-11-29 02:35:12 +0100824 unsigned long newtime = jiffies + extra_jiffies;
825
826 /* Only update the timeout if the new timeout is at least
827 HZ jiffies from the old timeout. Need del_timer for race
828 avoidance (may already be dying). */
829 if (newtime - ct->timeout.expires >= HZ
830 && del_timer(&ct->timeout)) {
831 ct->timeout.expires = newtime;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800832 add_timer(&ct->timeout);
833 event = IPCT_REFRESH;
834 }
835 }
836
Patrick McHardy47d95042008-01-31 04:36:31 -0800837acct:
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800838 if (do_acct) {
Krzysztof Piotr Oledzki58401572008-07-21 10:01:34 -0700839 struct nf_conn_counter *acct;
Martin Josefsson3ffd5ee2006-11-29 02:35:10 +0100840
Krzysztof Piotr Oledzki58401572008-07-21 10:01:34 -0700841 acct = nf_conn_acct_find(ct);
842 if (acct) {
843 acct[CTINFO2DIR(ctinfo)].packets++;
844 acct[CTINFO2DIR(ctinfo)].bytes +=
845 skb->len - skb_network_offset(skb);
846 }
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800847 }
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800848
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800849 spin_unlock_bh(&nf_conntrack_lock);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800850
851 /* must be unlocked when calling event cache */
852 if (event)
853 nf_conntrack_event_cache(event, skb);
854}
Patrick McHardy13b18332006-12-02 22:11:25 -0800855EXPORT_SYMBOL_GPL(__nf_ct_refresh_acct);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800856
David S. Miller4c889492008-07-14 20:22:38 -0700857bool __nf_ct_kill_acct(struct nf_conn *ct,
858 enum ip_conntrack_info ctinfo,
859 const struct sk_buff *skb,
860 int do_acct)
Patrick McHardy51091762008-06-09 15:59:06 -0700861{
Fabian Hugelshofer718d4ad2008-06-09 15:59:40 -0700862 if (do_acct) {
Krzysztof Piotr Oledzki58401572008-07-21 10:01:34 -0700863 struct nf_conn_counter *acct;
864
Fabian Hugelshofer718d4ad2008-06-09 15:59:40 -0700865 spin_lock_bh(&nf_conntrack_lock);
Krzysztof Piotr Oledzki58401572008-07-21 10:01:34 -0700866 acct = nf_conn_acct_find(ct);
867 if (acct) {
868 acct[CTINFO2DIR(ctinfo)].packets++;
869 acct[CTINFO2DIR(ctinfo)].bytes +=
870 skb->len - skb_network_offset(skb);
871 }
Fabian Hugelshofer718d4ad2008-06-09 15:59:40 -0700872 spin_unlock_bh(&nf_conntrack_lock);
873 }
Krzysztof Piotr Oledzki58401572008-07-21 10:01:34 -0700874
David S. Miller4c889492008-07-14 20:22:38 -0700875 if (del_timer(&ct->timeout)) {
Patrick McHardy51091762008-06-09 15:59:06 -0700876 ct->timeout.function((unsigned long)ct);
David S. Miller4c889492008-07-14 20:22:38 -0700877 return true;
878 }
879 return false;
Patrick McHardy51091762008-06-09 15:59:06 -0700880}
Fabian Hugelshofer718d4ad2008-06-09 15:59:40 -0700881EXPORT_SYMBOL_GPL(__nf_ct_kill_acct);
Patrick McHardy51091762008-06-09 15:59:06 -0700882
Patrick McHardye281db5c2007-03-04 15:57:25 -0800883#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800884
885#include <linux/netfilter/nfnetlink.h>
886#include <linux/netfilter/nfnetlink_conntrack.h>
Ingo Molnar57b47a52006-03-20 22:35:41 -0800887#include <linux/mutex.h>
888
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800889/* Generic function for tcp/udp/sctp/dccp and alike. This needs to be
890 * in ip_conntrack_core, since we don't want the protocols to autoload
891 * or depend on ctnetlink */
Patrick McHardyfdf70832007-09-28 14:37:41 -0700892int nf_ct_port_tuple_to_nlattr(struct sk_buff *skb,
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800893 const struct nf_conntrack_tuple *tuple)
894{
Patrick McHardy77236b62007-12-17 22:29:45 -0800895 NLA_PUT_BE16(skb, CTA_PROTO_SRC_PORT, tuple->src.u.tcp.port);
896 NLA_PUT_BE16(skb, CTA_PROTO_DST_PORT, tuple->dst.u.tcp.port);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800897 return 0;
898
Patrick McHardydf6fb862007-09-28 14:37:03 -0700899nla_put_failure:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800900 return -1;
901}
Patrick McHardyfdf70832007-09-28 14:37:41 -0700902EXPORT_SYMBOL_GPL(nf_ct_port_tuple_to_nlattr);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800903
Patrick McHardyf73e9242007-09-28 14:39:55 -0700904const struct nla_policy nf_ct_port_nla_policy[CTA_PROTO_MAX+1] = {
905 [CTA_PROTO_SRC_PORT] = { .type = NLA_U16 },
906 [CTA_PROTO_DST_PORT] = { .type = NLA_U16 },
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800907};
Patrick McHardyf73e9242007-09-28 14:39:55 -0700908EXPORT_SYMBOL_GPL(nf_ct_port_nla_policy);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800909
Patrick McHardyfdf70832007-09-28 14:37:41 -0700910int nf_ct_port_nlattr_to_tuple(struct nlattr *tb[],
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800911 struct nf_conntrack_tuple *t)
912{
Patrick McHardydf6fb862007-09-28 14:37:03 -0700913 if (!tb[CTA_PROTO_SRC_PORT] || !tb[CTA_PROTO_DST_PORT])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800914 return -EINVAL;
915
Patrick McHardy77236b62007-12-17 22:29:45 -0800916 t->src.u.tcp.port = nla_get_be16(tb[CTA_PROTO_SRC_PORT]);
917 t->dst.u.tcp.port = nla_get_be16(tb[CTA_PROTO_DST_PORT]);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800918
919 return 0;
920}
Patrick McHardyfdf70832007-09-28 14:37:41 -0700921EXPORT_SYMBOL_GPL(nf_ct_port_nlattr_to_tuple);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800922#endif
923
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800924/* Used by ipt_REJECT and ip6t_REJECT. */
Patrick McHardyb334aad2008-01-14 23:48:57 -0800925static void nf_conntrack_attach(struct sk_buff *nskb, struct sk_buff *skb)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800926{
927 struct nf_conn *ct;
928 enum ip_conntrack_info ctinfo;
929
930 /* This ICMP is in reverse direction to the packet which caused it */
931 ct = nf_ct_get(skb, &ctinfo);
932 if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL)
933 ctinfo = IP_CT_RELATED + IP_CT_IS_REPLY;
934 else
935 ctinfo = IP_CT_RELATED;
936
937 /* Attach to new skbuff, and increment count */
938 nskb->nfct = &ct->ct_general;
939 nskb->nfctinfo = ctinfo;
940 nf_conntrack_get(nskb->nfct);
941}
942
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800943/* Bring out ya dead! */
Patrick McHardydf0933d2006-09-20 11:57:53 -0700944static struct nf_conn *
Alexey Dobriyan400dad32008-10-08 11:35:03 +0200945get_next_corpse(struct net *net, int (*iter)(struct nf_conn *i, void *data),
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800946 void *data, unsigned int *bucket)
947{
Patrick McHardydf0933d2006-09-20 11:57:53 -0700948 struct nf_conntrack_tuple_hash *h;
949 struct nf_conn *ct;
Patrick McHardyf205c5e2007-07-07 22:28:14 -0700950 struct hlist_node *n;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800951
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800952 spin_lock_bh(&nf_conntrack_lock);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800953 for (; *bucket < nf_conntrack_htable_size; (*bucket)++) {
Alexey Dobriyan400dad32008-10-08 11:35:03 +0200954 hlist_for_each_entry(h, n, &net->ct.hash[*bucket], hnode) {
Patrick McHardydf0933d2006-09-20 11:57:53 -0700955 ct = nf_ct_tuplehash_to_ctrack(h);
956 if (iter(ct, data))
957 goto found;
958 }
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800959 }
Alexey Dobriyan63c9a262008-10-08 11:35:04 +0200960 hlist_for_each_entry(h, n, &net->ct.unconfirmed, hnode) {
Patrick McHardydf0933d2006-09-20 11:57:53 -0700961 ct = nf_ct_tuplehash_to_ctrack(h);
962 if (iter(ct, data))
Patrick McHardyec68e972007-03-04 15:57:01 -0800963 set_bit(IPS_DYING_BIT, &ct->status);
Patrick McHardydf0933d2006-09-20 11:57:53 -0700964 }
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800965 spin_unlock_bh(&nf_conntrack_lock);
Patrick McHardydf0933d2006-09-20 11:57:53 -0700966 return NULL;
967found:
Martin Josefssonc073e3f2006-10-30 15:13:58 -0800968 atomic_inc(&ct->ct_general.use);
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800969 spin_unlock_bh(&nf_conntrack_lock);
Patrick McHardydf0933d2006-09-20 11:57:53 -0700970 return ct;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800971}
972
Alexey Dobriyan400dad32008-10-08 11:35:03 +0200973void nf_ct_iterate_cleanup(struct net *net,
974 int (*iter)(struct nf_conn *i, void *data),
975 void *data)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800976{
Patrick McHardydf0933d2006-09-20 11:57:53 -0700977 struct nf_conn *ct;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800978 unsigned int bucket = 0;
979
Alexey Dobriyan400dad32008-10-08 11:35:03 +0200980 while ((ct = get_next_corpse(net, iter, data, &bucket)) != NULL) {
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800981 /* Time to push up daises... */
982 if (del_timer(&ct->timeout))
983 death_by_timeout((unsigned long)ct);
984 /* ... else the timer will get him soon. */
985
986 nf_ct_put(ct);
987 }
988}
Patrick McHardy13b18332006-12-02 22:11:25 -0800989EXPORT_SYMBOL_GPL(nf_ct_iterate_cleanup);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800990
991static int kill_all(struct nf_conn *i, void *data)
992{
993 return 1;
994}
995
Stephen Hemminger96eb24d2008-01-31 04:07:29 -0800996void nf_ct_free_hashtable(struct hlist_head *hash, int vmalloced, unsigned int size)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800997{
998 if (vmalloced)
999 vfree(hash);
1000 else
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001001 free_pages((unsigned long)hash,
Patrick McHardyf205c5e2007-07-07 22:28:14 -07001002 get_order(sizeof(struct hlist_head) * size));
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001003}
Patrick McHardyac565e52007-07-07 22:30:08 -07001004EXPORT_SYMBOL_GPL(nf_ct_free_hashtable);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001005
Alexey Dobriyan400dad32008-10-08 11:35:03 +02001006void nf_conntrack_flush(struct net *net)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001007{
Alexey Dobriyan400dad32008-10-08 11:35:03 +02001008 nf_ct_iterate_cleanup(net, kill_all, NULL);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001009}
Patrick McHardy13b18332006-12-02 22:11:25 -08001010EXPORT_SYMBOL_GPL(nf_conntrack_flush);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001011
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001012/* Mishearing the voices in his head, our hero wonders how he's
1013 supposed to kill the mall. */
Alexey Dobriyandfdb8d72008-10-08 11:35:02 +02001014void nf_conntrack_cleanup(struct net *net)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001015{
Patrick McHardyc3a47ab2007-02-12 11:09:19 -08001016 rcu_assign_pointer(ip_ct_attach, NULL);
Yasuyuki Kozakai7d3cdc62006-02-15 15:22:21 -08001017
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001018 /* This makes sure all current packets have passed through
1019 netfilter framework. Roll on, two-stage module
1020 delete... */
1021 synchronize_net();
1022
1023 nf_ct_event_cache_flush();
1024 i_see_dead_people:
Alexey Dobriyan400dad32008-10-08 11:35:03 +02001025 nf_conntrack_flush(net);
Alexey Dobriyan49ac8712008-10-08 11:35:03 +02001026 if (atomic_read(&net->ct.count) != 0) {
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001027 schedule();
1028 goto i_see_dead_people;
1029 }
Patrick McHardy66365682005-12-05 13:36:50 -08001030 /* wait until all references to nf_conntrack_untracked are dropped */
1031 while (atomic_read(&nf_conntrack_untracked.ct_general.use) > 1)
1032 schedule();
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001033
Yasuyuki Kozakaide6e05c2007-03-23 11:17:27 -07001034 rcu_assign_pointer(nf_ct_destroy, NULL);
1035
Yasuyuki Kozakaidacd2a12007-07-07 22:25:51 -07001036 kmem_cache_destroy(nf_conntrack_cachep);
Alexey Dobriyan400dad32008-10-08 11:35:03 +02001037 nf_ct_free_hashtable(net->ct.hash, net->ct.hash_vmalloc,
Patrick McHardyac565e52007-07-07 22:30:08 -07001038 nf_conntrack_htable_size);
KOVACS Krisztian5a6f294e42005-11-15 16:47:34 -08001039
Krzysztof Piotr Oledzki58401572008-07-21 10:01:34 -07001040 nf_conntrack_acct_fini();
Alexey Dobriyan9b03f382008-10-08 11:35:03 +02001041 nf_conntrack_expect_fini(net);
Krzysztof Piotr Oledzki9714be72008-08-06 02:35:44 -07001042 nf_conntrack_helper_fini();
1043 nf_conntrack_proto_fini();
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001044}
1045
Stephen Hemminger96eb24d2008-01-31 04:07:29 -08001046struct hlist_head *nf_ct_alloc_hashtable(unsigned int *sizep, int *vmalloced)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001047{
Patrick McHardyf205c5e2007-07-07 22:28:14 -07001048 struct hlist_head *hash;
Patrick McHardy8e5105a2007-07-07 22:27:33 -07001049 unsigned int size, i;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001050
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001051 *vmalloced = 0;
Patrick McHardy8e5105a2007-07-07 22:27:33 -07001052
Patrick McHardyf205c5e2007-07-07 22:28:14 -07001053 size = *sizep = roundup(*sizep, PAGE_SIZE / sizeof(struct hlist_head));
Andrew Morton29b67492007-10-29 21:41:19 -07001054 hash = (void*)__get_free_pages(GFP_KERNEL|__GFP_NOWARN,
Patrick McHardyf205c5e2007-07-07 22:28:14 -07001055 get_order(sizeof(struct hlist_head)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001056 * size));
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001057 if (!hash) {
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001058 *vmalloced = 1;
1059 printk(KERN_WARNING "nf_conntrack: falling back to vmalloc.\n");
Patrick McHardyf205c5e2007-07-07 22:28:14 -07001060 hash = vmalloc(sizeof(struct hlist_head) * size);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001061 }
1062
1063 if (hash)
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001064 for (i = 0; i < size; i++)
Patrick McHardyf205c5e2007-07-07 22:28:14 -07001065 INIT_HLIST_HEAD(&hash[i]);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001066
1067 return hash;
1068}
Patrick McHardyac565e52007-07-07 22:30:08 -07001069EXPORT_SYMBOL_GPL(nf_ct_alloc_hashtable);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001070
Patrick McHardyfae718d2007-12-24 21:09:10 -08001071int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001072{
Stephen Hemminger96eb24d2008-01-31 04:07:29 -08001073 int i, bucket, vmalloced, old_vmalloced;
1074 unsigned int hashsize, old_size;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001075 int rnd;
Patrick McHardyf205c5e2007-07-07 22:28:14 -07001076 struct hlist_head *hash, *old_hash;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001077 struct nf_conntrack_tuple_hash *h;
1078
1079 /* On boot, we can set this without any fancy locking. */
1080 if (!nf_conntrack_htable_size)
1081 return param_set_uint(val, kp);
1082
Stephen Hemminger96eb24d2008-01-31 04:07:29 -08001083 hashsize = simple_strtoul(val, NULL, 0);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001084 if (!hashsize)
1085 return -EINVAL;
1086
Patrick McHardyac565e52007-07-07 22:30:08 -07001087 hash = nf_ct_alloc_hashtable(&hashsize, &vmalloced);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001088 if (!hash)
1089 return -ENOMEM;
1090
1091 /* We have to rehahs for the new table anyway, so we also can
1092 * use a newrandom seed */
1093 get_random_bytes(&rnd, 4);
1094
Patrick McHardy76507f62008-01-31 04:38:38 -08001095 /* Lookups in the old hash might happen in parallel, which means we
1096 * might get false negatives during connection lookup. New connections
1097 * created because of a false negative won't make it into the hash
1098 * though since that required taking the lock.
1099 */
Patrick McHardyf8ba1af2008-01-31 04:38:58 -08001100 spin_lock_bh(&nf_conntrack_lock);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001101 for (i = 0; i < nf_conntrack_htable_size; i++) {
Alexey Dobriyan400dad32008-10-08 11:35:03 +02001102 while (!hlist_empty(&init_net.ct.hash[i])) {
1103 h = hlist_entry(init_net.ct.hash[i].first,
Patrick McHardyf205c5e2007-07-07 22:28:14 -07001104 struct nf_conntrack_tuple_hash, hnode);
Patrick McHardy76507f62008-01-31 04:38:38 -08001105 hlist_del_rcu(&h->hnode);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001106 bucket = __hash_conntrack(&h->tuple, hashsize, rnd);
Patrick McHardyf205c5e2007-07-07 22:28:14 -07001107 hlist_add_head(&h->hnode, &hash[bucket]);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001108 }
1109 }
1110 old_size = nf_conntrack_htable_size;
Alexey Dobriyan400dad32008-10-08 11:35:03 +02001111 old_vmalloced = init_net.ct.hash_vmalloc;
1112 old_hash = init_net.ct.hash;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001113
1114 nf_conntrack_htable_size = hashsize;
Alexey Dobriyan400dad32008-10-08 11:35:03 +02001115 init_net.ct.hash_vmalloc = vmalloced;
1116 init_net.ct.hash = hash;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001117 nf_conntrack_hash_rnd = rnd;
Patrick McHardyf8ba1af2008-01-31 04:38:58 -08001118 spin_unlock_bh(&nf_conntrack_lock);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001119
Patrick McHardyac565e52007-07-07 22:30:08 -07001120 nf_ct_free_hashtable(old_hash, old_vmalloced, old_size);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001121 return 0;
1122}
Patrick McHardyfae718d2007-12-24 21:09:10 -08001123EXPORT_SYMBOL_GPL(nf_conntrack_set_hashsize);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001124
Patrick McHardyfae718d2007-12-24 21:09:10 -08001125module_param_call(hashsize, nf_conntrack_set_hashsize, param_get_uint,
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001126 &nf_conntrack_htable_size, 0600);
1127
Alexey Dobriyandfdb8d72008-10-08 11:35:02 +02001128int nf_conntrack_init(struct net *net)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001129{
Patrick McHardyf205c5e2007-07-07 22:28:14 -07001130 int max_factor = 8;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001131 int ret;
1132
1133 /* Idea from tcp.c: use 1/16384 of memory. On i386: 32MB
Patrick McHardyf205c5e2007-07-07 22:28:14 -07001134 * machine has 512 buckets. >= 1GB machines have 16384 buckets. */
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001135 if (!nf_conntrack_htable_size) {
1136 nf_conntrack_htable_size
1137 = (((num_physpages << PAGE_SHIFT) / 16384)
Patrick McHardyf205c5e2007-07-07 22:28:14 -07001138 / sizeof(struct hlist_head));
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001139 if (num_physpages > (1024 * 1024 * 1024 / PAGE_SIZE))
Patrick McHardyf205c5e2007-07-07 22:28:14 -07001140 nf_conntrack_htable_size = 16384;
1141 if (nf_conntrack_htable_size < 32)
1142 nf_conntrack_htable_size = 32;
1143
1144 /* Use a max. factor of four by default to get the same max as
1145 * with the old struct list_heads. When a table size is given
1146 * we use the old value of 8 to avoid reducing the max.
1147 * entries. */
1148 max_factor = 4;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001149 }
Alexey Dobriyan49ac8712008-10-08 11:35:03 +02001150 atomic_set(&net->ct.count, 0);
Alexey Dobriyan400dad32008-10-08 11:35:03 +02001151 net->ct.hash = nf_ct_alloc_hashtable(&nf_conntrack_htable_size,
1152 &net->ct.hash_vmalloc);
1153 if (!net->ct.hash) {
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001154 printk(KERN_ERR "Unable to create nf_conntrack_hash\n");
1155 goto err_out;
1156 }
Alexey Dobriyan63c9a262008-10-08 11:35:04 +02001157 INIT_HLIST_HEAD(&net->ct.unconfirmed);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001158
Patrick McHardyf205c5e2007-07-07 22:28:14 -07001159 nf_conntrack_max = max_factor * nf_conntrack_htable_size;
Patrick McHardy8e5105a2007-07-07 22:27:33 -07001160
1161 printk("nf_conntrack version %s (%u buckets, %d max)\n",
1162 NF_CONNTRACK_VERSION, nf_conntrack_htable_size,
1163 nf_conntrack_max);
1164
Yasuyuki Kozakaidacd2a12007-07-07 22:25:51 -07001165 nf_conntrack_cachep = kmem_cache_create("nf_conntrack",
1166 sizeof(struct nf_conn),
Paul Mundt20c2df82007-07-20 10:11:58 +09001167 0, 0, NULL);
Yasuyuki Kozakaidacd2a12007-07-07 22:25:51 -07001168 if (!nf_conntrack_cachep) {
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001169 printk(KERN_ERR "Unable to create nf_conn slab cache\n");
1170 goto err_free_hash;
1171 }
1172
Patrick McHardyac5357e2007-03-14 16:38:25 -07001173 ret = nf_conntrack_proto_init();
Patrick McHardy933a41e2006-11-29 02:35:18 +01001174 if (ret < 0)
Patrick McHardye9c1b082007-07-07 22:32:53 -07001175 goto err_free_conntrack_slab;
1176
Alexey Dobriyan9b03f382008-10-08 11:35:03 +02001177 ret = nf_conntrack_expect_init(net);
Patrick McHardye9c1b082007-07-07 22:32:53 -07001178 if (ret < 0)
1179 goto out_fini_proto;
Patrick McHardy933a41e2006-11-29 02:35:18 +01001180
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -07001181 ret = nf_conntrack_helper_init();
1182 if (ret < 0)
Patrick McHardye9c1b082007-07-07 22:32:53 -07001183 goto out_fini_expect;
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -07001184
Krzysztof Piotr Oledzki58401572008-07-21 10:01:34 -07001185 ret = nf_conntrack_acct_init();
1186 if (ret < 0)
1187 goto out_fini_helper;
1188
Yasuyuki Kozakai7d3cdc62006-02-15 15:22:21 -08001189 /* For use by REJECT target */
Patrick McHardyb334aad2008-01-14 23:48:57 -08001190 rcu_assign_pointer(ip_ct_attach, nf_conntrack_attach);
Yasuyuki Kozakaide6e05c2007-03-23 11:17:27 -07001191 rcu_assign_pointer(nf_ct_destroy, destroy_conntrack);
Yasuyuki Kozakai7d3cdc62006-02-15 15:22:21 -08001192
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001193 /* Set up fake conntrack:
1194 - to never be deleted, not in any hashes */
Alexey Dobriyan5a1fb392008-10-08 11:35:02 +02001195#ifdef CONFIG_NET_NS
1196 nf_conntrack_untracked.ct_net = &init_net;
1197#endif
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001198 atomic_set(&nf_conntrack_untracked.ct_general.use, 1);
1199 /* - and look it like as a confirmed connection */
1200 set_bit(IPS_CONFIRMED_BIT, &nf_conntrack_untracked.status);
1201
1202 return ret;
1203
Krzysztof Piotr Oledzki58401572008-07-21 10:01:34 -07001204out_fini_helper:
1205 nf_conntrack_helper_fini();
Patrick McHardye9c1b082007-07-07 22:32:53 -07001206out_fini_expect:
Alexey Dobriyan9b03f382008-10-08 11:35:03 +02001207 nf_conntrack_expect_fini(net);
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -07001208out_fini_proto:
1209 nf_conntrack_proto_fini();
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001210err_free_conntrack_slab:
Yasuyuki Kozakaidacd2a12007-07-07 22:25:51 -07001211 kmem_cache_destroy(nf_conntrack_cachep);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001212err_free_hash:
Alexey Dobriyan400dad32008-10-08 11:35:03 +02001213 nf_ct_free_hashtable(net->ct.hash, net->ct.hash_vmalloc,
Patrick McHardyac565e52007-07-07 22:30:08 -07001214 nf_conntrack_htable_size);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001215err_out:
1216 return -ENOMEM;
1217}