blob: e6d645221d5c1c0bd32faf843a7ff677b793293f [file] [log] [blame]
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001/* Connection state tracking for netfilter. This is separated from,
2 but required by, the NAT layer; it can also be used by an iptables
3 extension. */
4
5/* (C) 1999-2001 Paul `Rusty' Russell
Harald Weltedc808fe2006-03-20 17:56:32 -08006 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08007 * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
8 *
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License version 2 as
11 * published by the Free Software Foundation.
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080012 */
13
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080014#include <linux/types.h>
15#include <linux/netfilter.h>
16#include <linux/module.h>
17#include <linux/skbuff.h>
18#include <linux/proc_fs.h>
19#include <linux/vmalloc.h>
20#include <linux/stddef.h>
21#include <linux/slab.h>
22#include <linux/random.h>
23#include <linux/jhash.h>
24#include <linux/err.h>
25#include <linux/percpu.h>
26#include <linux/moduleparam.h>
27#include <linux/notifier.h>
28#include <linux/kernel.h>
29#include <linux/netdevice.h>
30#include <linux/socket.h>
Al Virod7fe0f22006-12-03 23:15:30 -050031#include <linux/mm.h>
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080032
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080033#include <net/netfilter/nf_conntrack.h>
34#include <net/netfilter/nf_conntrack_l3proto.h>
Martin Josefsson605dcad2006-11-29 02:35:06 +010035#include <net/netfilter/nf_conntrack_l4proto.h>
Martin Josefsson77ab9cf2006-11-29 02:34:58 +010036#include <net/netfilter/nf_conntrack_expect.h>
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080037#include <net/netfilter/nf_conntrack_helper.h>
38#include <net/netfilter/nf_conntrack_core.h>
Yasuyuki Kozakaiecfab2c2007-07-07 22:23:21 -070039#include <net/netfilter/nf_conntrack_extend.h>
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080040
Harald Weltedc808fe2006-03-20 17:56:32 -080041#define NF_CONNTRACK_VERSION "0.5.0"
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080042
Patrick McHardyf8ba1af2008-01-31 04:38:58 -080043DEFINE_SPINLOCK(nf_conntrack_lock);
Patrick McHardy13b18332006-12-02 22:11:25 -080044EXPORT_SYMBOL_GPL(nf_conntrack_lock);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080045
46/* nf_conntrack_standalone needs this */
47atomic_t nf_conntrack_count = ATOMIC_INIT(0);
Patrick McHardya999e682006-11-29 02:35:20 +010048EXPORT_SYMBOL_GPL(nf_conntrack_count);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080049
Martin Josefssone2b76062006-11-29 02:35:04 +010050unsigned int nf_conntrack_htable_size __read_mostly;
Patrick McHardy13b18332006-12-02 22:11:25 -080051EXPORT_SYMBOL_GPL(nf_conntrack_htable_size);
52
Brian Haley94aec082006-09-18 00:05:22 -070053int nf_conntrack_max __read_mostly;
Patrick McHardya999e682006-11-29 02:35:20 +010054EXPORT_SYMBOL_GPL(nf_conntrack_max);
Patrick McHardy13b18332006-12-02 22:11:25 -080055
Patrick McHardyf205c5e2007-07-07 22:28:14 -070056struct hlist_head *nf_conntrack_hash __read_mostly;
Patrick McHardy13b18332006-12-02 22:11:25 -080057EXPORT_SYMBOL_GPL(nf_conntrack_hash);
58
Martin Josefssone2b76062006-11-29 02:35:04 +010059struct nf_conn nf_conntrack_untracked __read_mostly;
Patrick McHardy13b18332006-12-02 22:11:25 -080060EXPORT_SYMBOL_GPL(nf_conntrack_untracked);
61
Brian Haley94aec082006-09-18 00:05:22 -070062unsigned int nf_ct_log_invalid __read_mostly;
Patrick McHardyf205c5e2007-07-07 22:28:14 -070063HLIST_HEAD(unconfirmed);
Brian Haley1192e402006-09-20 12:03:46 -070064static int nf_conntrack_vmalloc __read_mostly;
Yasuyuki Kozakaidacd2a12007-07-07 22:25:51 -070065static struct kmem_cache *nf_conntrack_cachep __read_mostly;
Martin Josefsson77ab9cf2006-11-29 02:34:58 +010066
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080067DEFINE_PER_CPU(struct ip_conntrack_stat, nf_conntrack_stat);
68EXPORT_PER_CPU_SYMBOL(nf_conntrack_stat);
69
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080070static int nf_conntrack_hash_rnd_initted;
71static unsigned int nf_conntrack_hash_rnd;
72
73static u_int32_t __hash_conntrack(const struct nf_conntrack_tuple *tuple,
74 unsigned int size, unsigned int rnd)
75{
Patrick McHardy07949352008-01-31 04:40:52 -080076 unsigned int n;
77 u_int32_t h;
Sami Farin9b887902007-03-14 16:43:00 -070078
Patrick McHardy07949352008-01-31 04:40:52 -080079 /* The direction must be ignored, so we hash everything up to the
80 * destination ports (which is a multiple of 4) and treat the last
81 * three bytes manually.
82 */
83 n = (sizeof(tuple->src) + sizeof(tuple->dst.u3)) / sizeof(u32);
84 h = jhash2((u32 *)tuple, n,
85 rnd ^ (((__force __u16)tuple->dst.u.all << 16) |
86 tuple->dst.protonum));
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080087
Patrick McHardy07949352008-01-31 04:40:52 -080088 return ((u64)h * size) >> 32;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080089}
90
91static inline u_int32_t hash_conntrack(const struct nf_conntrack_tuple *tuple)
92{
93 return __hash_conntrack(tuple, nf_conntrack_htable_size,
94 nf_conntrack_hash_rnd);
95}
96
Jan Engelhardt5f2b4c92008-04-14 11:15:53 +020097bool
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080098nf_ct_get_tuple(const struct sk_buff *skb,
99 unsigned int nhoff,
100 unsigned int dataoff,
101 u_int16_t l3num,
102 u_int8_t protonum,
103 struct nf_conntrack_tuple *tuple,
104 const struct nf_conntrack_l3proto *l3proto,
Martin Josefsson605dcad2006-11-29 02:35:06 +0100105 const struct nf_conntrack_l4proto *l4proto)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800106{
Philip Craig443a70d2008-04-29 03:35:10 -0700107 memset(tuple, 0, sizeof(*tuple));
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800108
109 tuple->src.l3num = l3num;
110 if (l3proto->pkt_to_tuple(skb, nhoff, tuple) == 0)
Jan Engelhardt5f2b4c92008-04-14 11:15:53 +0200111 return false;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800112
113 tuple->dst.protonum = protonum;
114 tuple->dst.dir = IP_CT_DIR_ORIGINAL;
115
Martin Josefsson605dcad2006-11-29 02:35:06 +0100116 return l4proto->pkt_to_tuple(skb, dataoff, tuple);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800117}
Patrick McHardy13b18332006-12-02 22:11:25 -0800118EXPORT_SYMBOL_GPL(nf_ct_get_tuple);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800119
Jan Engelhardt5f2b4c92008-04-14 11:15:53 +0200120bool nf_ct_get_tuplepr(const struct sk_buff *skb, unsigned int nhoff,
121 u_int16_t l3num, struct nf_conntrack_tuple *tuple)
Yasuyuki Kozakaie2a31232007-07-14 20:45:14 -0700122{
123 struct nf_conntrack_l3proto *l3proto;
124 struct nf_conntrack_l4proto *l4proto;
125 unsigned int protoff;
126 u_int8_t protonum;
127 int ret;
128
129 rcu_read_lock();
130
131 l3proto = __nf_ct_l3proto_find(l3num);
132 ret = l3proto->get_l4proto(skb, nhoff, &protoff, &protonum);
133 if (ret != NF_ACCEPT) {
134 rcu_read_unlock();
Jan Engelhardt5f2b4c92008-04-14 11:15:53 +0200135 return false;
Yasuyuki Kozakaie2a31232007-07-14 20:45:14 -0700136 }
137
138 l4proto = __nf_ct_l4proto_find(l3num, protonum);
139
140 ret = nf_ct_get_tuple(skb, nhoff, protoff, l3num, protonum, tuple,
141 l3proto, l4proto);
142
143 rcu_read_unlock();
144 return ret;
145}
146EXPORT_SYMBOL_GPL(nf_ct_get_tuplepr);
147
Jan Engelhardt5f2b4c92008-04-14 11:15:53 +0200148bool
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800149nf_ct_invert_tuple(struct nf_conntrack_tuple *inverse,
150 const struct nf_conntrack_tuple *orig,
151 const struct nf_conntrack_l3proto *l3proto,
Martin Josefsson605dcad2006-11-29 02:35:06 +0100152 const struct nf_conntrack_l4proto *l4proto)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800153{
Philip Craig443a70d2008-04-29 03:35:10 -0700154 memset(inverse, 0, sizeof(*inverse));
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800155
156 inverse->src.l3num = orig->src.l3num;
157 if (l3proto->invert_tuple(inverse, orig) == 0)
Jan Engelhardt5f2b4c92008-04-14 11:15:53 +0200158 return false;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800159
160 inverse->dst.dir = !orig->dst.dir;
161
162 inverse->dst.protonum = orig->dst.protonum;
Martin Josefsson605dcad2006-11-29 02:35:06 +0100163 return l4proto->invert_tuple(inverse, orig);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800164}
Patrick McHardy13b18332006-12-02 22:11:25 -0800165EXPORT_SYMBOL_GPL(nf_ct_invert_tuple);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800166
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800167static void
168clean_from_lists(struct nf_conn *ct)
169{
Patrick McHardy0d537782007-07-07 22:39:38 -0700170 pr_debug("clean_from_lists(%p)\n", ct);
Patrick McHardy76507f62008-01-31 04:38:38 -0800171 hlist_del_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode);
172 hlist_del_rcu(&ct->tuplehash[IP_CT_DIR_REPLY].hnode);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800173
174 /* Destroy all pending expectations */
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800175 nf_ct_remove_expectations(ct);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800176}
177
178static void
179destroy_conntrack(struct nf_conntrack *nfct)
180{
181 struct nf_conn *ct = (struct nf_conn *)nfct;
Martin Josefsson605dcad2006-11-29 02:35:06 +0100182 struct nf_conntrack_l4proto *l4proto;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800183
Patrick McHardy0d537782007-07-07 22:39:38 -0700184 pr_debug("destroy_conntrack(%p)\n", ct);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800185 NF_CT_ASSERT(atomic_read(&nfct->use) == 0);
186 NF_CT_ASSERT(!timer_pending(&ct->timeout));
187
188 nf_conntrack_event(IPCT_DESTROY, ct);
189 set_bit(IPS_DYING_BIT, &ct->status);
190
191 /* To make sure we don't get any weird locking issues here:
192 * destroy_conntrack() MUST NOT be called with a write lock
193 * to nf_conntrack_lock!!! -HW */
Patrick McHardy923f4902007-02-12 11:12:57 -0800194 rcu_read_lock();
Patrick McHardy5e8fbe22008-04-14 11:15:52 +0200195 l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
Martin Josefsson605dcad2006-11-29 02:35:06 +0100196 if (l4proto && l4proto->destroy)
197 l4proto->destroy(ct);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800198
Yasuyuki Kozakaiecfab2c2007-07-07 22:23:21 -0700199 nf_ct_ext_destroy(ct);
200
Patrick McHardy982d9a92007-02-12 11:14:11 -0800201 rcu_read_unlock();
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800202
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800203 spin_lock_bh(&nf_conntrack_lock);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800204 /* Expectations will have been removed in clean_from_lists,
205 * except TFTP can create an expectation on the first packet,
206 * before connection is in the list, so we need to clean here,
207 * too. */
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800208 nf_ct_remove_expectations(ct);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800209
210 /* We overload first tuple to link into unconfirmed list. */
211 if (!nf_ct_is_confirmed(ct)) {
Patrick McHardyf205c5e2007-07-07 22:28:14 -0700212 BUG_ON(hlist_unhashed(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode));
213 hlist_del(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800214 }
215
216 NF_CT_STAT_INC(delete);
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800217 spin_unlock_bh(&nf_conntrack_lock);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800218
219 if (ct->master)
220 nf_ct_put(ct->master);
221
Patrick McHardy0d537782007-07-07 22:39:38 -0700222 pr_debug("destroy_conntrack: returning ct=%p to slab\n", ct);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800223 nf_conntrack_free(ct);
224}
225
226static void death_by_timeout(unsigned long ul_conntrack)
227{
228 struct nf_conn *ct = (void *)ul_conntrack;
Patrick McHardy5397e972007-05-19 14:23:52 -0700229 struct nf_conn_help *help = nfct_help(ct);
Patrick McHarrdy3c158f72007-06-05 12:55:27 -0700230 struct nf_conntrack_helper *helper;
Patrick McHardy5397e972007-05-19 14:23:52 -0700231
Patrick McHarrdy3c158f72007-06-05 12:55:27 -0700232 if (help) {
233 rcu_read_lock();
234 helper = rcu_dereference(help->helper);
235 if (helper && helper->destroy)
236 helper->destroy(ct);
237 rcu_read_unlock();
238 }
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800239
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800240 spin_lock_bh(&nf_conntrack_lock);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800241 /* Inside lock so preempt is disabled on module removal path.
242 * Otherwise we can get spurious warnings. */
243 NF_CT_STAT_INC(delete_list);
244 clean_from_lists(ct);
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800245 spin_unlock_bh(&nf_conntrack_lock);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800246 nf_ct_put(ct);
247}
248
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800249struct nf_conntrack_tuple_hash *
Patrick McHardyba419af2008-01-31 04:39:23 -0800250__nf_conntrack_find(const struct nf_conntrack_tuple *tuple)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800251{
252 struct nf_conntrack_tuple_hash *h;
Patrick McHardyf205c5e2007-07-07 22:28:14 -0700253 struct hlist_node *n;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800254 unsigned int hash = hash_conntrack(tuple);
255
Patrick McHardy4e29e9e2008-02-27 12:07:47 -0800256 /* Disable BHs the entire time since we normally need to disable them
257 * at least once for the stats anyway.
258 */
259 local_bh_disable();
Patrick McHardy76507f62008-01-31 04:38:38 -0800260 hlist_for_each_entry_rcu(h, n, &nf_conntrack_hash[hash], hnode) {
Patrick McHardyba419af2008-01-31 04:39:23 -0800261 if (nf_ct_tuple_equal(tuple, &h->tuple)) {
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800262 NF_CT_STAT_INC(found);
Patrick McHardy4e29e9e2008-02-27 12:07:47 -0800263 local_bh_enable();
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800264 return h;
265 }
266 NF_CT_STAT_INC(searched);
267 }
Patrick McHardy4e29e9e2008-02-27 12:07:47 -0800268 local_bh_enable();
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800269
270 return NULL;
271}
Patrick McHardy13b18332006-12-02 22:11:25 -0800272EXPORT_SYMBOL_GPL(__nf_conntrack_find);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800273
274/* Find a connection corresponding to a tuple. */
275struct nf_conntrack_tuple_hash *
Patrick McHardy330f7db2007-07-07 22:28:42 -0700276nf_conntrack_find_get(const struct nf_conntrack_tuple *tuple)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800277{
278 struct nf_conntrack_tuple_hash *h;
Patrick McHardy76507f62008-01-31 04:38:38 -0800279 struct nf_conn *ct;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800280
Patrick McHardy76507f62008-01-31 04:38:38 -0800281 rcu_read_lock();
Patrick McHardyba419af2008-01-31 04:39:23 -0800282 h = __nf_conntrack_find(tuple);
Patrick McHardy76507f62008-01-31 04:38:38 -0800283 if (h) {
284 ct = nf_ct_tuplehash_to_ctrack(h);
285 if (unlikely(!atomic_inc_not_zero(&ct->ct_general.use)))
286 h = NULL;
287 }
288 rcu_read_unlock();
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800289
290 return h;
291}
Patrick McHardy13b18332006-12-02 22:11:25 -0800292EXPORT_SYMBOL_GPL(nf_conntrack_find_get);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800293
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800294static void __nf_conntrack_hash_insert(struct nf_conn *ct,
295 unsigned int hash,
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800296 unsigned int repl_hash)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800297{
Patrick McHardy76507f62008-01-31 04:38:38 -0800298 hlist_add_head_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode,
299 &nf_conntrack_hash[hash]);
300 hlist_add_head_rcu(&ct->tuplehash[IP_CT_DIR_REPLY].hnode,
301 &nf_conntrack_hash[repl_hash]);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800302}
303
304void nf_conntrack_hash_insert(struct nf_conn *ct)
305{
306 unsigned int hash, repl_hash;
307
308 hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
309 repl_hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
310
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800311 spin_lock_bh(&nf_conntrack_lock);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800312 __nf_conntrack_hash_insert(ct, hash, repl_hash);
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800313 spin_unlock_bh(&nf_conntrack_lock);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800314}
Patrick McHardy13b18332006-12-02 22:11:25 -0800315EXPORT_SYMBOL_GPL(nf_conntrack_hash_insert);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800316
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800317/* Confirm a connection given skb; places it in hash table */
318int
Herbert Xu3db05fe2007-10-15 00:53:15 -0700319__nf_conntrack_confirm(struct sk_buff *skb)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800320{
321 unsigned int hash, repl_hash;
Patrick McHardydf0933d2006-09-20 11:57:53 -0700322 struct nf_conntrack_tuple_hash *h;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800323 struct nf_conn *ct;
Patrick McHardydf0933d2006-09-20 11:57:53 -0700324 struct nf_conn_help *help;
Patrick McHardyf205c5e2007-07-07 22:28:14 -0700325 struct hlist_node *n;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800326 enum ip_conntrack_info ctinfo;
327
Herbert Xu3db05fe2007-10-15 00:53:15 -0700328 ct = nf_ct_get(skb, &ctinfo);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800329
330 /* ipt_REJECT uses nf_conntrack_attach to attach related
331 ICMP/TCP RST packets in other direction. Actual packet
332 which created connection will be IP_CT_NEW or for an
333 expected connection, IP_CT_RELATED. */
334 if (CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL)
335 return NF_ACCEPT;
336
337 hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
338 repl_hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
339
340 /* We're not in hash table, and we refuse to set up related
341 connections for unconfirmed conns. But packet copies and
342 REJECT will give spurious warnings here. */
343 /* NF_CT_ASSERT(atomic_read(&ct->ct_general.use) == 1); */
344
345 /* No external references means noone else could have
346 confirmed us. */
347 NF_CT_ASSERT(!nf_ct_is_confirmed(ct));
Patrick McHardy0d537782007-07-07 22:39:38 -0700348 pr_debug("Confirming conntrack %p\n", ct);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800349
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800350 spin_lock_bh(&nf_conntrack_lock);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800351
352 /* See if there's one in the list already, including reverse:
353 NAT could have grabbed it without realizing, since we're
354 not in the hash. If there is, we lost race. */
Patrick McHardyf205c5e2007-07-07 22:28:14 -0700355 hlist_for_each_entry(h, n, &nf_conntrack_hash[hash], hnode)
Patrick McHardydf0933d2006-09-20 11:57:53 -0700356 if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
357 &h->tuple))
358 goto out;
Patrick McHardyf205c5e2007-07-07 22:28:14 -0700359 hlist_for_each_entry(h, n, &nf_conntrack_hash[repl_hash], hnode)
Patrick McHardydf0933d2006-09-20 11:57:53 -0700360 if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_REPLY].tuple,
361 &h->tuple))
362 goto out;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800363
Patrick McHardydf0933d2006-09-20 11:57:53 -0700364 /* Remove from unconfirmed list */
Patrick McHardyf205c5e2007-07-07 22:28:14 -0700365 hlist_del(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode);
Patrick McHardydf0933d2006-09-20 11:57:53 -0700366
367 __nf_conntrack_hash_insert(ct, hash, repl_hash);
368 /* Timer relative to confirmation time, not original
369 setting time, otherwise we'd get timer wrap in
370 weird delay cases. */
371 ct->timeout.expires += jiffies;
372 add_timer(&ct->timeout);
373 atomic_inc(&ct->ct_general.use);
374 set_bit(IPS_CONFIRMED_BIT, &ct->status);
375 NF_CT_STAT_INC(insert);
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800376 spin_unlock_bh(&nf_conntrack_lock);
Patrick McHardydf0933d2006-09-20 11:57:53 -0700377 help = nfct_help(ct);
378 if (help && help->helper)
Herbert Xu3db05fe2007-10-15 00:53:15 -0700379 nf_conntrack_event_cache(IPCT_HELPER, skb);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800380#ifdef CONFIG_NF_NAT_NEEDED
Patrick McHardydf0933d2006-09-20 11:57:53 -0700381 if (test_bit(IPS_SRC_NAT_DONE_BIT, &ct->status) ||
382 test_bit(IPS_DST_NAT_DONE_BIT, &ct->status))
Herbert Xu3db05fe2007-10-15 00:53:15 -0700383 nf_conntrack_event_cache(IPCT_NATINFO, skb);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800384#endif
Patrick McHardydf0933d2006-09-20 11:57:53 -0700385 nf_conntrack_event_cache(master_ct(ct) ?
Herbert Xu3db05fe2007-10-15 00:53:15 -0700386 IPCT_RELATED : IPCT_NEW, skb);
Patrick McHardydf0933d2006-09-20 11:57:53 -0700387 return NF_ACCEPT;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800388
Patrick McHardydf0933d2006-09-20 11:57:53 -0700389out:
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800390 NF_CT_STAT_INC(insert_failed);
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800391 spin_unlock_bh(&nf_conntrack_lock);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800392 return NF_DROP;
393}
Patrick McHardy13b18332006-12-02 22:11:25 -0800394EXPORT_SYMBOL_GPL(__nf_conntrack_confirm);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800395
396/* Returns true if a connection correspondings to the tuple (required
397 for NAT). */
398int
399nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
400 const struct nf_conn *ignored_conntrack)
401{
402 struct nf_conntrack_tuple_hash *h;
Patrick McHardyba419af2008-01-31 04:39:23 -0800403 struct hlist_node *n;
404 unsigned int hash = hash_conntrack(tuple);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800405
Patrick McHardy4e29e9e2008-02-27 12:07:47 -0800406 /* Disable BHs the entire time since we need to disable them at
407 * least once for the stats anyway.
408 */
409 rcu_read_lock_bh();
Patrick McHardyba419af2008-01-31 04:39:23 -0800410 hlist_for_each_entry_rcu(h, n, &nf_conntrack_hash[hash], hnode) {
411 if (nf_ct_tuplehash_to_ctrack(h) != ignored_conntrack &&
412 nf_ct_tuple_equal(tuple, &h->tuple)) {
413 NF_CT_STAT_INC(found);
Patrick McHardy4e29e9e2008-02-27 12:07:47 -0800414 rcu_read_unlock_bh();
Patrick McHardyba419af2008-01-31 04:39:23 -0800415 return 1;
416 }
417 NF_CT_STAT_INC(searched);
418 }
Patrick McHardy4e29e9e2008-02-27 12:07:47 -0800419 rcu_read_unlock_bh();
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800420
Patrick McHardyba419af2008-01-31 04:39:23 -0800421 return 0;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800422}
Patrick McHardy13b18332006-12-02 22:11:25 -0800423EXPORT_SYMBOL_GPL(nf_conntrack_tuple_taken);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800424
Patrick McHardy7ae77302007-07-07 22:37:38 -0700425#define NF_CT_EVICTION_RANGE 8
426
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800427/* There's a small race here where we may free a just-assured
428 connection. Too bad: we're in trouble anyway. */
Patrick McHardy76eb9462008-01-31 04:41:44 -0800429static noinline int early_drop(unsigned int hash)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800430{
Patrick McHardyf205c5e2007-07-07 22:28:14 -0700431 /* Use oldest entry, which is roughly LRU */
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800432 struct nf_conntrack_tuple_hash *h;
Patrick McHardydf0933d2006-09-20 11:57:53 -0700433 struct nf_conn *ct = NULL, *tmp;
Patrick McHardyf205c5e2007-07-07 22:28:14 -0700434 struct hlist_node *n;
Patrick McHardy7ae77302007-07-07 22:37:38 -0700435 unsigned int i, cnt = 0;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800436 int dropped = 0;
437
Patrick McHardy76507f62008-01-31 04:38:38 -0800438 rcu_read_lock();
Patrick McHardy7ae77302007-07-07 22:37:38 -0700439 for (i = 0; i < nf_conntrack_htable_size; i++) {
Patrick McHardy76507f62008-01-31 04:38:38 -0800440 hlist_for_each_entry_rcu(h, n, &nf_conntrack_hash[hash],
441 hnode) {
Patrick McHardy7ae77302007-07-07 22:37:38 -0700442 tmp = nf_ct_tuplehash_to_ctrack(h);
443 if (!test_bit(IPS_ASSURED_BIT, &tmp->status))
444 ct = tmp;
445 cnt++;
446 }
Patrick McHardy76507f62008-01-31 04:38:38 -0800447
448 if (ct && unlikely(!atomic_inc_not_zero(&ct->ct_general.use)))
449 ct = NULL;
Patrick McHardy7ae77302007-07-07 22:37:38 -0700450 if (ct || cnt >= NF_CT_EVICTION_RANGE)
451 break;
452 hash = (hash + 1) % nf_conntrack_htable_size;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800453 }
Patrick McHardy76507f62008-01-31 04:38:38 -0800454 rcu_read_unlock();
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800455
456 if (!ct)
457 return dropped;
458
459 if (del_timer(&ct->timeout)) {
460 death_by_timeout((unsigned long)ct);
461 dropped = 1;
Patrick McHardyc0e912d2007-02-12 11:13:43 -0800462 NF_CT_STAT_INC_ATOMIC(early_drop);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800463 }
464 nf_ct_put(ct);
465 return dropped;
466}
467
Yasuyuki Kozakaidacd2a12007-07-07 22:25:51 -0700468struct nf_conn *nf_conntrack_alloc(const struct nf_conntrack_tuple *orig,
469 const struct nf_conntrack_tuple *repl)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800470{
Patrick McHardyc88130b2008-01-31 04:42:11 -0800471 struct nf_conn *ct = NULL;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800472
Harald Weltedc808fe2006-03-20 17:56:32 -0800473 if (unlikely(!nf_conntrack_hash_rnd_initted)) {
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800474 get_random_bytes(&nf_conntrack_hash_rnd, 4);
475 nf_conntrack_hash_rnd_initted = 1;
476 }
477
Pablo Neira Ayuso5251e2d2006-09-20 12:01:06 -0700478 /* We don't want any race condition at early drop stage */
479 atomic_inc(&nf_conntrack_count);
480
Patrick McHardy76eb9462008-01-31 04:41:44 -0800481 if (nf_conntrack_max &&
482 unlikely(atomic_read(&nf_conntrack_count) > nf_conntrack_max)) {
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800483 unsigned int hash = hash_conntrack(orig);
Patrick McHardy7ae77302007-07-07 22:37:38 -0700484 if (!early_drop(hash)) {
Pablo Neira Ayuso5251e2d2006-09-20 12:01:06 -0700485 atomic_dec(&nf_conntrack_count);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800486 if (net_ratelimit())
487 printk(KERN_WARNING
488 "nf_conntrack: table full, dropping"
489 " packet.\n");
490 return ERR_PTR(-ENOMEM);
491 }
492 }
493
Patrick McHardyc88130b2008-01-31 04:42:11 -0800494 ct = kmem_cache_zalloc(nf_conntrack_cachep, GFP_ATOMIC);
495 if (ct == NULL) {
Patrick McHardy0d537782007-07-07 22:39:38 -0700496 pr_debug("nf_conntrack_alloc: Can't alloc conntrack.\n");
Yasuyuki Kozakaidacd2a12007-07-07 22:25:51 -0700497 atomic_dec(&nf_conntrack_count);
498 return ERR_PTR(-ENOMEM);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800499 }
500
Patrick McHardyc88130b2008-01-31 04:42:11 -0800501 atomic_set(&ct->ct_general.use, 1);
502 ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple = *orig;
503 ct->tuplehash[IP_CT_DIR_REPLY].tuple = *repl;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800504 /* Don't set timer yet: wait for confirmation */
Patrick McHardyc88130b2008-01-31 04:42:11 -0800505 setup_timer(&ct->timeout, death_by_timeout, (unsigned long)ct);
506 INIT_RCU_HEAD(&ct->rcu);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800507
Patrick McHardyc88130b2008-01-31 04:42:11 -0800508 return ct;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800509}
Patrick McHardy13b18332006-12-02 22:11:25 -0800510EXPORT_SYMBOL_GPL(nf_conntrack_alloc);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800511
Patrick McHardy76507f62008-01-31 04:38:38 -0800512static void nf_conntrack_free_rcu(struct rcu_head *head)
513{
514 struct nf_conn *ct = container_of(head, struct nf_conn, rcu);
515
516 nf_ct_ext_free(ct);
517 kmem_cache_free(nf_conntrack_cachep, ct);
518 atomic_dec(&nf_conntrack_count);
519}
520
Patrick McHardyc88130b2008-01-31 04:42:11 -0800521void nf_conntrack_free(struct nf_conn *ct)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800522{
Patrick McHardyc88130b2008-01-31 04:42:11 -0800523 call_rcu(&ct->rcu, nf_conntrack_free_rcu);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800524}
Patrick McHardy13b18332006-12-02 22:11:25 -0800525EXPORT_SYMBOL_GPL(nf_conntrack_free);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800526
527/* Allocate a new conntrack: we return -ENOMEM if classification
528 failed due to stress. Otherwise it really is unclassifiable. */
529static struct nf_conntrack_tuple_hash *
530init_conntrack(const struct nf_conntrack_tuple *tuple,
531 struct nf_conntrack_l3proto *l3proto,
Martin Josefsson605dcad2006-11-29 02:35:06 +0100532 struct nf_conntrack_l4proto *l4proto,
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800533 struct sk_buff *skb,
534 unsigned int dataoff)
535{
Patrick McHardyc88130b2008-01-31 04:42:11 -0800536 struct nf_conn *ct;
Patrick McHarrdy3c158f72007-06-05 12:55:27 -0700537 struct nf_conn_help *help;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800538 struct nf_conntrack_tuple repl_tuple;
539 struct nf_conntrack_expect *exp;
540
Martin Josefsson605dcad2006-11-29 02:35:06 +0100541 if (!nf_ct_invert_tuple(&repl_tuple, tuple, l3proto, l4proto)) {
Patrick McHardy0d537782007-07-07 22:39:38 -0700542 pr_debug("Can't invert tuple.\n");
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800543 return NULL;
544 }
545
Patrick McHardyc88130b2008-01-31 04:42:11 -0800546 ct = nf_conntrack_alloc(tuple, &repl_tuple);
547 if (ct == NULL || IS_ERR(ct)) {
Patrick McHardy0d537782007-07-07 22:39:38 -0700548 pr_debug("Can't allocate conntrack.\n");
Patrick McHardyc88130b2008-01-31 04:42:11 -0800549 return (struct nf_conntrack_tuple_hash *)ct;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800550 }
551
Patrick McHardyc88130b2008-01-31 04:42:11 -0800552 if (!l4proto->new(ct, skb, dataoff)) {
553 nf_conntrack_free(ct);
Patrick McHardy0d537782007-07-07 22:39:38 -0700554 pr_debug("init conntrack: can't track with proto module\n");
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800555 return NULL;
556 }
557
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800558 spin_lock_bh(&nf_conntrack_lock);
Patrick McHardy68236452007-07-07 22:30:49 -0700559 exp = nf_ct_find_expectation(tuple);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800560 if (exp) {
Patrick McHardy0d537782007-07-07 22:39:38 -0700561 pr_debug("conntrack: expectation arrives ct=%p exp=%p\n",
Patrick McHardyc88130b2008-01-31 04:42:11 -0800562 ct, exp);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800563 /* Welcome, Mr. Bond. We've been expecting you... */
Patrick McHardyc88130b2008-01-31 04:42:11 -0800564 __set_bit(IPS_EXPECTED_BIT, &ct->status);
565 ct->master = exp->master;
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -0700566 if (exp->helper) {
Patrick McHardyc88130b2008-01-31 04:42:11 -0800567 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -0700568 if (help)
569 rcu_assign_pointer(help->helper, exp->helper);
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -0700570 }
571
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800572#ifdef CONFIG_NF_CONNTRACK_MARK
Patrick McHardyc88130b2008-01-31 04:42:11 -0800573 ct->mark = exp->master->mark;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800574#endif
James Morris7c9728c2006-06-09 00:31:46 -0700575#ifdef CONFIG_NF_CONNTRACK_SECMARK
Patrick McHardyc88130b2008-01-31 04:42:11 -0800576 ct->secmark = exp->master->secmark;
James Morris7c9728c2006-06-09 00:31:46 -0700577#endif
Patrick McHardyc88130b2008-01-31 04:42:11 -0800578 nf_conntrack_get(&ct->master->ct_general);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800579 NF_CT_STAT_INC(expect_new);
Yasuyuki Kozakai22e74102006-11-27 10:25:59 -0800580 } else {
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -0700581 struct nf_conntrack_helper *helper;
582
583 helper = __nf_ct_helper_find(&repl_tuple);
584 if (helper) {
Patrick McHardyc88130b2008-01-31 04:42:11 -0800585 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -0700586 if (help)
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -0700587 rcu_assign_pointer(help->helper, helper);
Patrick McHarrdy3c158f72007-06-05 12:55:27 -0700588 }
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800589 NF_CT_STAT_INC(new);
Yasuyuki Kozakai22e74102006-11-27 10:25:59 -0800590 }
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800591
592 /* Overload tuple linked list to put us in unconfirmed list. */
Patrick McHardyc88130b2008-01-31 04:42:11 -0800593 hlist_add_head(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode, &unconfirmed);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800594
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800595 spin_unlock_bh(&nf_conntrack_lock);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800596
597 if (exp) {
598 if (exp->expectfn)
Patrick McHardyc88130b2008-01-31 04:42:11 -0800599 exp->expectfn(ct, exp);
Patrick McHardy68236452007-07-07 22:30:49 -0700600 nf_ct_expect_put(exp);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800601 }
602
Patrick McHardyc88130b2008-01-31 04:42:11 -0800603 return &ct->tuplehash[IP_CT_DIR_ORIGINAL];
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800604}
605
606/* On success, returns conntrack ptr, sets skb->nfct and ctinfo */
607static inline struct nf_conn *
608resolve_normal_ct(struct sk_buff *skb,
609 unsigned int dataoff,
610 u_int16_t l3num,
611 u_int8_t protonum,
612 struct nf_conntrack_l3proto *l3proto,
Martin Josefsson605dcad2006-11-29 02:35:06 +0100613 struct nf_conntrack_l4proto *l4proto,
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800614 int *set_reply,
615 enum ip_conntrack_info *ctinfo)
616{
617 struct nf_conntrack_tuple tuple;
618 struct nf_conntrack_tuple_hash *h;
619 struct nf_conn *ct;
620
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -0300621 if (!nf_ct_get_tuple(skb, skb_network_offset(skb),
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800622 dataoff, l3num, protonum, &tuple, l3proto,
Martin Josefsson605dcad2006-11-29 02:35:06 +0100623 l4proto)) {
Patrick McHardy0d537782007-07-07 22:39:38 -0700624 pr_debug("resolve_normal_ct: Can't get tuple\n");
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800625 return NULL;
626 }
627
628 /* look for tuple match */
Patrick McHardy330f7db2007-07-07 22:28:42 -0700629 h = nf_conntrack_find_get(&tuple);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800630 if (!h) {
Martin Josefsson605dcad2006-11-29 02:35:06 +0100631 h = init_conntrack(&tuple, l3proto, l4proto, skb, dataoff);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800632 if (!h)
633 return NULL;
634 if (IS_ERR(h))
635 return (void *)h;
636 }
637 ct = nf_ct_tuplehash_to_ctrack(h);
638
639 /* It exists; we have (non-exclusive) reference. */
640 if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY) {
641 *ctinfo = IP_CT_ESTABLISHED + IP_CT_IS_REPLY;
642 /* Please set reply bit if this packet OK */
643 *set_reply = 1;
644 } else {
645 /* Once we've had two way comms, always ESTABLISHED. */
646 if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
Patrick McHardy0d537782007-07-07 22:39:38 -0700647 pr_debug("nf_conntrack_in: normal packet for %p\n", ct);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800648 *ctinfo = IP_CT_ESTABLISHED;
649 } else if (test_bit(IPS_EXPECTED_BIT, &ct->status)) {
Patrick McHardy0d537782007-07-07 22:39:38 -0700650 pr_debug("nf_conntrack_in: related packet for %p\n",
651 ct);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800652 *ctinfo = IP_CT_RELATED;
653 } else {
Patrick McHardy0d537782007-07-07 22:39:38 -0700654 pr_debug("nf_conntrack_in: new packet for %p\n", ct);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800655 *ctinfo = IP_CT_NEW;
656 }
657 *set_reply = 0;
658 }
659 skb->nfct = &ct->ct_general;
660 skb->nfctinfo = *ctinfo;
661 return ct;
662}
663
664unsigned int
Herbert Xu3db05fe2007-10-15 00:53:15 -0700665nf_conntrack_in(int pf, unsigned int hooknum, struct sk_buff *skb)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800666{
667 struct nf_conn *ct;
668 enum ip_conntrack_info ctinfo;
669 struct nf_conntrack_l3proto *l3proto;
Martin Josefsson605dcad2006-11-29 02:35:06 +0100670 struct nf_conntrack_l4proto *l4proto;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800671 unsigned int dataoff;
672 u_int8_t protonum;
673 int set_reply = 0;
674 int ret;
675
676 /* Previously seen (loopback or untracked)? Ignore. */
Herbert Xu3db05fe2007-10-15 00:53:15 -0700677 if (skb->nfct) {
Patrick McHardyc0e912d2007-02-12 11:13:43 -0800678 NF_CT_STAT_INC_ATOMIC(ignore);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800679 return NF_ACCEPT;
680 }
681
Patrick McHardy923f4902007-02-12 11:12:57 -0800682 /* rcu_read_lock()ed by nf_hook_slow */
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800683 l3proto = __nf_ct_l3proto_find((u_int16_t)pf);
Herbert Xu3db05fe2007-10-15 00:53:15 -0700684 ret = l3proto->get_l4proto(skb, skb_network_offset(skb),
Yasuyuki Kozakaiffc30692007-07-14 20:44:50 -0700685 &dataoff, &protonum);
686 if (ret <= 0) {
Patrick McHardy0d537782007-07-07 22:39:38 -0700687 pr_debug("not prepared to track yet or error occured\n");
Yasuyuki Kozakaid87d8462007-07-14 20:44:23 -0700688 NF_CT_STAT_INC_ATOMIC(error);
689 NF_CT_STAT_INC_ATOMIC(invalid);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800690 return -ret;
691 }
692
Martin Josefsson605dcad2006-11-29 02:35:06 +0100693 l4proto = __nf_ct_l4proto_find((u_int16_t)pf, protonum);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800694
695 /* It may be an special packet, error, unclean...
696 * inverse of the return code tells to the netfilter
697 * core what to do with the packet. */
Martin Josefsson605dcad2006-11-29 02:35:06 +0100698 if (l4proto->error != NULL &&
Herbert Xu3db05fe2007-10-15 00:53:15 -0700699 (ret = l4proto->error(skb, dataoff, &ctinfo, pf, hooknum)) <= 0) {
Patrick McHardyc0e912d2007-02-12 11:13:43 -0800700 NF_CT_STAT_INC_ATOMIC(error);
701 NF_CT_STAT_INC_ATOMIC(invalid);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800702 return -ret;
703 }
704
Herbert Xu3db05fe2007-10-15 00:53:15 -0700705 ct = resolve_normal_ct(skb, dataoff, pf, protonum, l3proto, l4proto,
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800706 &set_reply, &ctinfo);
707 if (!ct) {
708 /* Not valid part of a connection */
Patrick McHardyc0e912d2007-02-12 11:13:43 -0800709 NF_CT_STAT_INC_ATOMIC(invalid);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800710 return NF_ACCEPT;
711 }
712
713 if (IS_ERR(ct)) {
714 /* Too stressed to deal. */
Patrick McHardyc0e912d2007-02-12 11:13:43 -0800715 NF_CT_STAT_INC_ATOMIC(drop);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800716 return NF_DROP;
717 }
718
Herbert Xu3db05fe2007-10-15 00:53:15 -0700719 NF_CT_ASSERT(skb->nfct);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800720
Herbert Xu3db05fe2007-10-15 00:53:15 -0700721 ret = l4proto->packet(ct, skb, dataoff, ctinfo, pf, hooknum);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800722 if (ret < 0) {
723 /* Invalid: inverse of the return code tells
724 * the netfilter core what to do */
Patrick McHardy0d537782007-07-07 22:39:38 -0700725 pr_debug("nf_conntrack_in: Can't track with proto module\n");
Herbert Xu3db05fe2007-10-15 00:53:15 -0700726 nf_conntrack_put(skb->nfct);
727 skb->nfct = NULL;
Patrick McHardyc0e912d2007-02-12 11:13:43 -0800728 NF_CT_STAT_INC_ATOMIC(invalid);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800729 return -ret;
730 }
731
732 if (set_reply && !test_and_set_bit(IPS_SEEN_REPLY_BIT, &ct->status))
Herbert Xu3db05fe2007-10-15 00:53:15 -0700733 nf_conntrack_event_cache(IPCT_STATUS, skb);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800734
735 return ret;
736}
Patrick McHardy13b18332006-12-02 22:11:25 -0800737EXPORT_SYMBOL_GPL(nf_conntrack_in);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800738
Jan Engelhardt5f2b4c92008-04-14 11:15:53 +0200739bool nf_ct_invert_tuplepr(struct nf_conntrack_tuple *inverse,
740 const struct nf_conntrack_tuple *orig)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800741{
Jan Engelhardt5f2b4c92008-04-14 11:15:53 +0200742 bool ret;
Patrick McHardy923f4902007-02-12 11:12:57 -0800743
744 rcu_read_lock();
745 ret = nf_ct_invert_tuple(inverse, orig,
746 __nf_ct_l3proto_find(orig->src.l3num),
747 __nf_ct_l4proto_find(orig->src.l3num,
748 orig->dst.protonum));
749 rcu_read_unlock();
750 return ret;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800751}
Patrick McHardy13b18332006-12-02 22:11:25 -0800752EXPORT_SYMBOL_GPL(nf_ct_invert_tuplepr);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800753
Jozsef Kadlecsik5b1158e2006-12-02 22:07:13 -0800754/* Alter reply tuple (maybe alter helper). This is for NAT, and is
755 implicitly racy: see __nf_conntrack_confirm */
756void nf_conntrack_alter_reply(struct nf_conn *ct,
757 const struct nf_conntrack_tuple *newreply)
758{
759 struct nf_conn_help *help = nfct_help(ct);
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -0700760 struct nf_conntrack_helper *helper;
Jozsef Kadlecsik5b1158e2006-12-02 22:07:13 -0800761
Jozsef Kadlecsik5b1158e2006-12-02 22:07:13 -0800762 /* Should be unconfirmed, so not in hash table yet */
763 NF_CT_ASSERT(!nf_ct_is_confirmed(ct));
764
Patrick McHardy0d537782007-07-07 22:39:38 -0700765 pr_debug("Altering reply tuple of %p to ", ct);
Jan Engelhardt3c9fba62008-04-14 11:15:54 +0200766 nf_ct_dump_tuple(newreply);
Jozsef Kadlecsik5b1158e2006-12-02 22:07:13 -0800767
768 ct->tuplehash[IP_CT_DIR_REPLY].tuple = *newreply;
Patrick McHardyef1a5a52008-04-14 11:21:01 +0200769 if (ct->master || (help && !hlist_empty(&help->expectations)))
Patrick McHardyc52fbb42008-01-31 04:37:36 -0800770 return;
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -0700771
Patrick McHardyc52fbb42008-01-31 04:37:36 -0800772 rcu_read_lock();
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -0700773 helper = __nf_ct_helper_find(newreply);
774 if (helper == NULL) {
775 if (help)
776 rcu_assign_pointer(help->helper, NULL);
777 goto out;
Yasuyuki Kozakai5d78a842007-05-10 14:16:24 -0700778 }
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -0700779
780 if (help == NULL) {
Patrick McHardyb5605802007-07-07 22:35:56 -0700781 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
782 if (help == NULL)
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -0700783 goto out;
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -0700784 } else {
785 memset(&help->help, 0, sizeof(help->help));
786 }
787
788 rcu_assign_pointer(help->helper, helper);
789out:
Patrick McHardyc52fbb42008-01-31 04:37:36 -0800790 rcu_read_unlock();
Jozsef Kadlecsik5b1158e2006-12-02 22:07:13 -0800791}
Patrick McHardy13b18332006-12-02 22:11:25 -0800792EXPORT_SYMBOL_GPL(nf_conntrack_alter_reply);
Jozsef Kadlecsik5b1158e2006-12-02 22:07:13 -0800793
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800794/* Refresh conntrack for this many jiffies and do accounting if do_acct is 1 */
795void __nf_ct_refresh_acct(struct nf_conn *ct,
796 enum ip_conntrack_info ctinfo,
797 const struct sk_buff *skb,
798 unsigned long extra_jiffies,
799 int do_acct)
800{
801 int event = 0;
802
803 NF_CT_ASSERT(ct->timeout.data == (unsigned long)ct);
804 NF_CT_ASSERT(skb);
805
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800806 spin_lock_bh(&nf_conntrack_lock);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800807
Eric Leblond997ae832006-05-29 18:24:20 -0700808 /* Only update if this is not a fixed timeout */
Patrick McHardy47d95042008-01-31 04:36:31 -0800809 if (test_bit(IPS_FIXED_TIMEOUT_BIT, &ct->status))
810 goto acct;
Eric Leblond997ae832006-05-29 18:24:20 -0700811
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800812 /* If not in hash table, timer will not be active yet */
813 if (!nf_ct_is_confirmed(ct)) {
814 ct->timeout.expires = extra_jiffies;
815 event = IPCT_REFRESH;
816 } else {
Martin Josefssonbe00c8e2006-11-29 02:35:12 +0100817 unsigned long newtime = jiffies + extra_jiffies;
818
819 /* Only update the timeout if the new timeout is at least
820 HZ jiffies from the old timeout. Need del_timer for race
821 avoidance (may already be dying). */
822 if (newtime - ct->timeout.expires >= HZ
823 && del_timer(&ct->timeout)) {
824 ct->timeout.expires = newtime;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800825 add_timer(&ct->timeout);
826 event = IPCT_REFRESH;
827 }
828 }
829
Patrick McHardy47d95042008-01-31 04:36:31 -0800830acct:
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800831#ifdef CONFIG_NF_CT_ACCT
832 if (do_acct) {
833 ct->counters[CTINFO2DIR(ctinfo)].packets++;
834 ct->counters[CTINFO2DIR(ctinfo)].bytes +=
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -0300835 skb->len - skb_network_offset(skb);
Martin Josefsson3ffd5ee2006-11-29 02:35:10 +0100836
837 if ((ct->counters[CTINFO2DIR(ctinfo)].packets & 0x80000000)
838 || (ct->counters[CTINFO2DIR(ctinfo)].bytes & 0x80000000))
839 event |= IPCT_COUNTER_FILLING;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800840 }
841#endif
842
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800843 spin_unlock_bh(&nf_conntrack_lock);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800844
845 /* must be unlocked when calling event cache */
846 if (event)
847 nf_conntrack_event_cache(event, skb);
848}
Patrick McHardy13b18332006-12-02 22:11:25 -0800849EXPORT_SYMBOL_GPL(__nf_ct_refresh_acct);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800850
Fabian Hugelshofer718d4ad2008-06-09 15:59:40 -0700851void __nf_ct_kill_acct(struct nf_conn *ct,
852 enum ip_conntrack_info ctinfo,
853 const struct sk_buff *skb,
854 int do_acct)
Patrick McHardy51091762008-06-09 15:59:06 -0700855{
Fabian Hugelshofer718d4ad2008-06-09 15:59:40 -0700856#ifdef CONFIG_NF_CT_ACCT
857 if (do_acct) {
858 spin_lock_bh(&nf_conntrack_lock);
859 ct->counters[CTINFO2DIR(ctinfo)].packets++;
860 ct->counters[CTINFO2DIR(ctinfo)].bytes +=
861 skb->len - skb_network_offset(skb);
862 spin_unlock_bh(&nf_conntrack_lock);
863 }
864#endif
Patrick McHardy51091762008-06-09 15:59:06 -0700865 if (del_timer(&ct->timeout))
866 ct->timeout.function((unsigned long)ct);
867}
Fabian Hugelshofer718d4ad2008-06-09 15:59:40 -0700868EXPORT_SYMBOL_GPL(__nf_ct_kill_acct);
Patrick McHardy51091762008-06-09 15:59:06 -0700869
Patrick McHardye281db5c2007-03-04 15:57:25 -0800870#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800871
872#include <linux/netfilter/nfnetlink.h>
873#include <linux/netfilter/nfnetlink_conntrack.h>
Ingo Molnar57b47a52006-03-20 22:35:41 -0800874#include <linux/mutex.h>
875
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800876/* Generic function for tcp/udp/sctp/dccp and alike. This needs to be
877 * in ip_conntrack_core, since we don't want the protocols to autoload
878 * or depend on ctnetlink */
Patrick McHardyfdf70832007-09-28 14:37:41 -0700879int nf_ct_port_tuple_to_nlattr(struct sk_buff *skb,
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800880 const struct nf_conntrack_tuple *tuple)
881{
Patrick McHardy77236b62007-12-17 22:29:45 -0800882 NLA_PUT_BE16(skb, CTA_PROTO_SRC_PORT, tuple->src.u.tcp.port);
883 NLA_PUT_BE16(skb, CTA_PROTO_DST_PORT, tuple->dst.u.tcp.port);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800884 return 0;
885
Patrick McHardydf6fb862007-09-28 14:37:03 -0700886nla_put_failure:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800887 return -1;
888}
Patrick McHardyfdf70832007-09-28 14:37:41 -0700889EXPORT_SYMBOL_GPL(nf_ct_port_tuple_to_nlattr);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800890
Patrick McHardyf73e9242007-09-28 14:39:55 -0700891const struct nla_policy nf_ct_port_nla_policy[CTA_PROTO_MAX+1] = {
892 [CTA_PROTO_SRC_PORT] = { .type = NLA_U16 },
893 [CTA_PROTO_DST_PORT] = { .type = NLA_U16 },
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800894};
Patrick McHardyf73e9242007-09-28 14:39:55 -0700895EXPORT_SYMBOL_GPL(nf_ct_port_nla_policy);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800896
Patrick McHardyfdf70832007-09-28 14:37:41 -0700897int nf_ct_port_nlattr_to_tuple(struct nlattr *tb[],
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800898 struct nf_conntrack_tuple *t)
899{
Patrick McHardydf6fb862007-09-28 14:37:03 -0700900 if (!tb[CTA_PROTO_SRC_PORT] || !tb[CTA_PROTO_DST_PORT])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800901 return -EINVAL;
902
Patrick McHardy77236b62007-12-17 22:29:45 -0800903 t->src.u.tcp.port = nla_get_be16(tb[CTA_PROTO_SRC_PORT]);
904 t->dst.u.tcp.port = nla_get_be16(tb[CTA_PROTO_DST_PORT]);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800905
906 return 0;
907}
Patrick McHardyfdf70832007-09-28 14:37:41 -0700908EXPORT_SYMBOL_GPL(nf_ct_port_nlattr_to_tuple);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800909#endif
910
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800911/* Used by ipt_REJECT and ip6t_REJECT. */
Patrick McHardyb334aad2008-01-14 23:48:57 -0800912static void nf_conntrack_attach(struct sk_buff *nskb, struct sk_buff *skb)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800913{
914 struct nf_conn *ct;
915 enum ip_conntrack_info ctinfo;
916
917 /* This ICMP is in reverse direction to the packet which caused it */
918 ct = nf_ct_get(skb, &ctinfo);
919 if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL)
920 ctinfo = IP_CT_RELATED + IP_CT_IS_REPLY;
921 else
922 ctinfo = IP_CT_RELATED;
923
924 /* Attach to new skbuff, and increment count */
925 nskb->nfct = &ct->ct_general;
926 nskb->nfctinfo = ctinfo;
927 nf_conntrack_get(nskb->nfct);
928}
929
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800930/* Bring out ya dead! */
Patrick McHardydf0933d2006-09-20 11:57:53 -0700931static struct nf_conn *
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800932get_next_corpse(int (*iter)(struct nf_conn *i, void *data),
933 void *data, unsigned int *bucket)
934{
Patrick McHardydf0933d2006-09-20 11:57:53 -0700935 struct nf_conntrack_tuple_hash *h;
936 struct nf_conn *ct;
Patrick McHardyf205c5e2007-07-07 22:28:14 -0700937 struct hlist_node *n;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800938
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800939 spin_lock_bh(&nf_conntrack_lock);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800940 for (; *bucket < nf_conntrack_htable_size; (*bucket)++) {
Patrick McHardyf205c5e2007-07-07 22:28:14 -0700941 hlist_for_each_entry(h, n, &nf_conntrack_hash[*bucket], hnode) {
Patrick McHardydf0933d2006-09-20 11:57:53 -0700942 ct = nf_ct_tuplehash_to_ctrack(h);
943 if (iter(ct, data))
944 goto found;
945 }
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800946 }
Patrick McHardyf205c5e2007-07-07 22:28:14 -0700947 hlist_for_each_entry(h, n, &unconfirmed, hnode) {
Patrick McHardydf0933d2006-09-20 11:57:53 -0700948 ct = nf_ct_tuplehash_to_ctrack(h);
949 if (iter(ct, data))
Patrick McHardyec68e972007-03-04 15:57:01 -0800950 set_bit(IPS_DYING_BIT, &ct->status);
Patrick McHardydf0933d2006-09-20 11:57:53 -0700951 }
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800952 spin_unlock_bh(&nf_conntrack_lock);
Patrick McHardydf0933d2006-09-20 11:57:53 -0700953 return NULL;
954found:
Martin Josefssonc073e3f2006-10-30 15:13:58 -0800955 atomic_inc(&ct->ct_general.use);
Patrick McHardyf8ba1af2008-01-31 04:38:58 -0800956 spin_unlock_bh(&nf_conntrack_lock);
Patrick McHardydf0933d2006-09-20 11:57:53 -0700957 return ct;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800958}
959
960void
961nf_ct_iterate_cleanup(int (*iter)(struct nf_conn *i, void *data), void *data)
962{
Patrick McHardydf0933d2006-09-20 11:57:53 -0700963 struct nf_conn *ct;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800964 unsigned int bucket = 0;
965
Patrick McHardydf0933d2006-09-20 11:57:53 -0700966 while ((ct = get_next_corpse(iter, data, &bucket)) != NULL) {
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800967 /* Time to push up daises... */
968 if (del_timer(&ct->timeout))
969 death_by_timeout((unsigned long)ct);
970 /* ... else the timer will get him soon. */
971
972 nf_ct_put(ct);
973 }
974}
Patrick McHardy13b18332006-12-02 22:11:25 -0800975EXPORT_SYMBOL_GPL(nf_ct_iterate_cleanup);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800976
977static int kill_all(struct nf_conn *i, void *data)
978{
979 return 1;
980}
981
Stephen Hemminger96eb24d2008-01-31 04:07:29 -0800982void nf_ct_free_hashtable(struct hlist_head *hash, int vmalloced, unsigned int size)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800983{
984 if (vmalloced)
985 vfree(hash);
986 else
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800987 free_pages((unsigned long)hash,
Patrick McHardyf205c5e2007-07-07 22:28:14 -0700988 get_order(sizeof(struct hlist_head) * size));
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800989}
Patrick McHardyac565e52007-07-07 22:30:08 -0700990EXPORT_SYMBOL_GPL(nf_ct_free_hashtable);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800991
Randy Dunlap272491e2006-12-07 01:17:24 -0800992void nf_conntrack_flush(void)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800993{
994 nf_ct_iterate_cleanup(kill_all, NULL);
995}
Patrick McHardy13b18332006-12-02 22:11:25 -0800996EXPORT_SYMBOL_GPL(nf_conntrack_flush);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800997
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800998/* Mishearing the voices in his head, our hero wonders how he's
999 supposed to kill the mall. */
1000void nf_conntrack_cleanup(void)
1001{
Patrick McHardyc3a47ab2007-02-12 11:09:19 -08001002 rcu_assign_pointer(ip_ct_attach, NULL);
Yasuyuki Kozakai7d3cdc62006-02-15 15:22:21 -08001003
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001004 /* This makes sure all current packets have passed through
1005 netfilter framework. Roll on, two-stage module
1006 delete... */
1007 synchronize_net();
1008
1009 nf_ct_event_cache_flush();
1010 i_see_dead_people:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001011 nf_conntrack_flush();
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001012 if (atomic_read(&nf_conntrack_count) != 0) {
1013 schedule();
1014 goto i_see_dead_people;
1015 }
Patrick McHardy66365682005-12-05 13:36:50 -08001016 /* wait until all references to nf_conntrack_untracked are dropped */
1017 while (atomic_read(&nf_conntrack_untracked.ct_general.use) > 1)
1018 schedule();
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001019
Yasuyuki Kozakaide6e05c2007-03-23 11:17:27 -07001020 rcu_assign_pointer(nf_ct_destroy, NULL);
1021
Yasuyuki Kozakaidacd2a12007-07-07 22:25:51 -07001022 kmem_cache_destroy(nf_conntrack_cachep);
Patrick McHardyac565e52007-07-07 22:30:08 -07001023 nf_ct_free_hashtable(nf_conntrack_hash, nf_conntrack_vmalloc,
1024 nf_conntrack_htable_size);
KOVACS Krisztian5a6f294e42005-11-15 16:47:34 -08001025
Patrick McHardyac5357e2007-03-14 16:38:25 -07001026 nf_conntrack_proto_fini();
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -07001027 nf_conntrack_helper_fini();
Patrick McHardye9c1b082007-07-07 22:32:53 -07001028 nf_conntrack_expect_fini();
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001029}
1030
Stephen Hemminger96eb24d2008-01-31 04:07:29 -08001031struct hlist_head *nf_ct_alloc_hashtable(unsigned int *sizep, int *vmalloced)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001032{
Patrick McHardyf205c5e2007-07-07 22:28:14 -07001033 struct hlist_head *hash;
Patrick McHardy8e5105a2007-07-07 22:27:33 -07001034 unsigned int size, i;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001035
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001036 *vmalloced = 0;
Patrick McHardy8e5105a2007-07-07 22:27:33 -07001037
Patrick McHardyf205c5e2007-07-07 22:28:14 -07001038 size = *sizep = roundup(*sizep, PAGE_SIZE / sizeof(struct hlist_head));
Andrew Morton29b67492007-10-29 21:41:19 -07001039 hash = (void*)__get_free_pages(GFP_KERNEL|__GFP_NOWARN,
Patrick McHardyf205c5e2007-07-07 22:28:14 -07001040 get_order(sizeof(struct hlist_head)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001041 * size));
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001042 if (!hash) {
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001043 *vmalloced = 1;
1044 printk(KERN_WARNING "nf_conntrack: falling back to vmalloc.\n");
Patrick McHardyf205c5e2007-07-07 22:28:14 -07001045 hash = vmalloc(sizeof(struct hlist_head) * size);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001046 }
1047
1048 if (hash)
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001049 for (i = 0; i < size; i++)
Patrick McHardyf205c5e2007-07-07 22:28:14 -07001050 INIT_HLIST_HEAD(&hash[i]);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001051
1052 return hash;
1053}
Patrick McHardyac565e52007-07-07 22:30:08 -07001054EXPORT_SYMBOL_GPL(nf_ct_alloc_hashtable);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001055
Patrick McHardyfae718d2007-12-24 21:09:10 -08001056int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001057{
Stephen Hemminger96eb24d2008-01-31 04:07:29 -08001058 int i, bucket, vmalloced, old_vmalloced;
1059 unsigned int hashsize, old_size;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001060 int rnd;
Patrick McHardyf205c5e2007-07-07 22:28:14 -07001061 struct hlist_head *hash, *old_hash;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001062 struct nf_conntrack_tuple_hash *h;
1063
1064 /* On boot, we can set this without any fancy locking. */
1065 if (!nf_conntrack_htable_size)
1066 return param_set_uint(val, kp);
1067
Stephen Hemminger96eb24d2008-01-31 04:07:29 -08001068 hashsize = simple_strtoul(val, NULL, 0);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001069 if (!hashsize)
1070 return -EINVAL;
1071
Patrick McHardyac565e52007-07-07 22:30:08 -07001072 hash = nf_ct_alloc_hashtable(&hashsize, &vmalloced);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001073 if (!hash)
1074 return -ENOMEM;
1075
1076 /* We have to rehahs for the new table anyway, so we also can
1077 * use a newrandom seed */
1078 get_random_bytes(&rnd, 4);
1079
Patrick McHardy76507f62008-01-31 04:38:38 -08001080 /* Lookups in the old hash might happen in parallel, which means we
1081 * might get false negatives during connection lookup. New connections
1082 * created because of a false negative won't make it into the hash
1083 * though since that required taking the lock.
1084 */
Patrick McHardyf8ba1af2008-01-31 04:38:58 -08001085 spin_lock_bh(&nf_conntrack_lock);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001086 for (i = 0; i < nf_conntrack_htable_size; i++) {
Patrick McHardyf205c5e2007-07-07 22:28:14 -07001087 while (!hlist_empty(&nf_conntrack_hash[i])) {
1088 h = hlist_entry(nf_conntrack_hash[i].first,
1089 struct nf_conntrack_tuple_hash, hnode);
Patrick McHardy76507f62008-01-31 04:38:38 -08001090 hlist_del_rcu(&h->hnode);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001091 bucket = __hash_conntrack(&h->tuple, hashsize, rnd);
Patrick McHardyf205c5e2007-07-07 22:28:14 -07001092 hlist_add_head(&h->hnode, &hash[bucket]);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001093 }
1094 }
1095 old_size = nf_conntrack_htable_size;
1096 old_vmalloced = nf_conntrack_vmalloc;
1097 old_hash = nf_conntrack_hash;
1098
1099 nf_conntrack_htable_size = hashsize;
1100 nf_conntrack_vmalloc = vmalloced;
1101 nf_conntrack_hash = hash;
1102 nf_conntrack_hash_rnd = rnd;
Patrick McHardyf8ba1af2008-01-31 04:38:58 -08001103 spin_unlock_bh(&nf_conntrack_lock);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001104
Patrick McHardyac565e52007-07-07 22:30:08 -07001105 nf_ct_free_hashtable(old_hash, old_vmalloced, old_size);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001106 return 0;
1107}
Patrick McHardyfae718d2007-12-24 21:09:10 -08001108EXPORT_SYMBOL_GPL(nf_conntrack_set_hashsize);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001109
Patrick McHardyfae718d2007-12-24 21:09:10 -08001110module_param_call(hashsize, nf_conntrack_set_hashsize, param_get_uint,
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001111 &nf_conntrack_htable_size, 0600);
1112
1113int __init nf_conntrack_init(void)
1114{
Patrick McHardyf205c5e2007-07-07 22:28:14 -07001115 int max_factor = 8;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001116 int ret;
1117
1118 /* Idea from tcp.c: use 1/16384 of memory. On i386: 32MB
Patrick McHardyf205c5e2007-07-07 22:28:14 -07001119 * machine has 512 buckets. >= 1GB machines have 16384 buckets. */
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001120 if (!nf_conntrack_htable_size) {
1121 nf_conntrack_htable_size
1122 = (((num_physpages << PAGE_SHIFT) / 16384)
Patrick McHardyf205c5e2007-07-07 22:28:14 -07001123 / sizeof(struct hlist_head));
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001124 if (num_physpages > (1024 * 1024 * 1024 / PAGE_SIZE))
Patrick McHardyf205c5e2007-07-07 22:28:14 -07001125 nf_conntrack_htable_size = 16384;
1126 if (nf_conntrack_htable_size < 32)
1127 nf_conntrack_htable_size = 32;
1128
1129 /* Use a max. factor of four by default to get the same max as
1130 * with the old struct list_heads. When a table size is given
1131 * we use the old value of 8 to avoid reducing the max.
1132 * entries. */
1133 max_factor = 4;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001134 }
Patrick McHardyac565e52007-07-07 22:30:08 -07001135 nf_conntrack_hash = nf_ct_alloc_hashtable(&nf_conntrack_htable_size,
1136 &nf_conntrack_vmalloc);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001137 if (!nf_conntrack_hash) {
1138 printk(KERN_ERR "Unable to create nf_conntrack_hash\n");
1139 goto err_out;
1140 }
1141
Patrick McHardyf205c5e2007-07-07 22:28:14 -07001142 nf_conntrack_max = max_factor * nf_conntrack_htable_size;
Patrick McHardy8e5105a2007-07-07 22:27:33 -07001143
1144 printk("nf_conntrack version %s (%u buckets, %d max)\n",
1145 NF_CONNTRACK_VERSION, nf_conntrack_htable_size,
1146 nf_conntrack_max);
1147
Yasuyuki Kozakaidacd2a12007-07-07 22:25:51 -07001148 nf_conntrack_cachep = kmem_cache_create("nf_conntrack",
1149 sizeof(struct nf_conn),
Paul Mundt20c2df82007-07-20 10:11:58 +09001150 0, 0, NULL);
Yasuyuki Kozakaidacd2a12007-07-07 22:25:51 -07001151 if (!nf_conntrack_cachep) {
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001152 printk(KERN_ERR "Unable to create nf_conn slab cache\n");
1153 goto err_free_hash;
1154 }
1155
Patrick McHardyac5357e2007-03-14 16:38:25 -07001156 ret = nf_conntrack_proto_init();
Patrick McHardy933a41e2006-11-29 02:35:18 +01001157 if (ret < 0)
Patrick McHardye9c1b082007-07-07 22:32:53 -07001158 goto err_free_conntrack_slab;
1159
1160 ret = nf_conntrack_expect_init();
1161 if (ret < 0)
1162 goto out_fini_proto;
Patrick McHardy933a41e2006-11-29 02:35:18 +01001163
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -07001164 ret = nf_conntrack_helper_init();
1165 if (ret < 0)
Patrick McHardye9c1b082007-07-07 22:32:53 -07001166 goto out_fini_expect;
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -07001167
Yasuyuki Kozakai7d3cdc62006-02-15 15:22:21 -08001168 /* For use by REJECT target */
Patrick McHardyb334aad2008-01-14 23:48:57 -08001169 rcu_assign_pointer(ip_ct_attach, nf_conntrack_attach);
Yasuyuki Kozakaide6e05c2007-03-23 11:17:27 -07001170 rcu_assign_pointer(nf_ct_destroy, destroy_conntrack);
Yasuyuki Kozakai7d3cdc62006-02-15 15:22:21 -08001171
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001172 /* Set up fake conntrack:
1173 - to never be deleted, not in any hashes */
1174 atomic_set(&nf_conntrack_untracked.ct_general.use, 1);
1175 /* - and look it like as a confirmed connection */
1176 set_bit(IPS_CONFIRMED_BIT, &nf_conntrack_untracked.status);
1177
1178 return ret;
1179
Patrick McHardye9c1b082007-07-07 22:32:53 -07001180out_fini_expect:
1181 nf_conntrack_expect_fini();
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -07001182out_fini_proto:
1183 nf_conntrack_proto_fini();
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001184err_free_conntrack_slab:
Yasuyuki Kozakaidacd2a12007-07-07 22:25:51 -07001185 kmem_cache_destroy(nf_conntrack_cachep);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001186err_free_hash:
Patrick McHardyac565e52007-07-07 22:30:08 -07001187 nf_ct_free_hashtable(nf_conntrack_hash, nf_conntrack_vmalloc,
1188 nf_conntrack_htable_size);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001189err_out:
1190 return -ENOMEM;
1191}