[NETFILTER]: ctnetlink: use netlink policy
[linux-2.6.git] / net / netfilter / nf_conntrack_core.c
1 /* Connection state tracking for netfilter.  This is separated from,
2    but required by, the NAT layer; it can also be used by an iptables
3    extension. */
4
5 /* (C) 1999-2001 Paul `Rusty' Russell
6  * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
7  * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
8  *
9  * This program is free software; you can redistribute it and/or modify
10  * it under the terms of the GNU General Public License version 2 as
11  * published by the Free Software Foundation.
12  */
13
14 #include <linux/types.h>
15 #include <linux/netfilter.h>
16 #include <linux/module.h>
17 #include <linux/skbuff.h>
18 #include <linux/proc_fs.h>
19 #include <linux/vmalloc.h>
20 #include <linux/stddef.h>
21 #include <linux/slab.h>
22 #include <linux/random.h>
23 #include <linux/jhash.h>
24 #include <linux/err.h>
25 #include <linux/percpu.h>
26 #include <linux/moduleparam.h>
27 #include <linux/notifier.h>
28 #include <linux/kernel.h>
29 #include <linux/netdevice.h>
30 #include <linux/socket.h>
31 #include <linux/mm.h>
32
33 #include <net/netfilter/nf_conntrack.h>
34 #include <net/netfilter/nf_conntrack_l3proto.h>
35 #include <net/netfilter/nf_conntrack_l4proto.h>
36 #include <net/netfilter/nf_conntrack_expect.h>
37 #include <net/netfilter/nf_conntrack_helper.h>
38 #include <net/netfilter/nf_conntrack_core.h>
39 #include <net/netfilter/nf_conntrack_extend.h>
40
41 #define NF_CONNTRACK_VERSION    "0.5.0"
42
43 DEFINE_RWLOCK(nf_conntrack_lock);
44 EXPORT_SYMBOL_GPL(nf_conntrack_lock);
45
46 /* nf_conntrack_standalone needs this */
47 atomic_t nf_conntrack_count = ATOMIC_INIT(0);
48 EXPORT_SYMBOL_GPL(nf_conntrack_count);
49
50 unsigned int nf_conntrack_htable_size __read_mostly;
51 EXPORT_SYMBOL_GPL(nf_conntrack_htable_size);
52
53 int nf_conntrack_max __read_mostly;
54 EXPORT_SYMBOL_GPL(nf_conntrack_max);
55
56 struct hlist_head *nf_conntrack_hash __read_mostly;
57 EXPORT_SYMBOL_GPL(nf_conntrack_hash);
58
59 struct nf_conn nf_conntrack_untracked __read_mostly;
60 EXPORT_SYMBOL_GPL(nf_conntrack_untracked);
61
62 unsigned int nf_ct_log_invalid __read_mostly;
63 HLIST_HEAD(unconfirmed);
64 static int nf_conntrack_vmalloc __read_mostly;
65 static struct kmem_cache *nf_conntrack_cachep __read_mostly;
66 static unsigned int nf_conntrack_next_id;
67
68 DEFINE_PER_CPU(struct ip_conntrack_stat, nf_conntrack_stat);
69 EXPORT_PER_CPU_SYMBOL(nf_conntrack_stat);
70
71 static int nf_conntrack_hash_rnd_initted;
72 static unsigned int nf_conntrack_hash_rnd;
73
74 static u_int32_t __hash_conntrack(const struct nf_conntrack_tuple *tuple,
75                                   unsigned int size, unsigned int rnd)
76 {
77         unsigned int a, b;
78
79         a = jhash2(tuple->src.u3.all, ARRAY_SIZE(tuple->src.u3.all),
80                    (tuple->src.l3num << 16) | tuple->dst.protonum);
81         b = jhash2(tuple->dst.u3.all, ARRAY_SIZE(tuple->dst.u3.all),
82                    ((__force __u16)tuple->src.u.all << 16) |
83                     (__force __u16)tuple->dst.u.all);
84
85         return jhash_2words(a, b, rnd) % size;
86 }
87
88 static inline u_int32_t hash_conntrack(const struct nf_conntrack_tuple *tuple)
89 {
90         return __hash_conntrack(tuple, nf_conntrack_htable_size,
91                                 nf_conntrack_hash_rnd);
92 }
93
94 int
95 nf_ct_get_tuple(const struct sk_buff *skb,
96                 unsigned int nhoff,
97                 unsigned int dataoff,
98                 u_int16_t l3num,
99                 u_int8_t protonum,
100                 struct nf_conntrack_tuple *tuple,
101                 const struct nf_conntrack_l3proto *l3proto,
102                 const struct nf_conntrack_l4proto *l4proto)
103 {
104         NF_CT_TUPLE_U_BLANK(tuple);
105
106         tuple->src.l3num = l3num;
107         if (l3proto->pkt_to_tuple(skb, nhoff, tuple) == 0)
108                 return 0;
109
110         tuple->dst.protonum = protonum;
111         tuple->dst.dir = IP_CT_DIR_ORIGINAL;
112
113         return l4proto->pkt_to_tuple(skb, dataoff, tuple);
114 }
115 EXPORT_SYMBOL_GPL(nf_ct_get_tuple);
116
117 int nf_ct_get_tuplepr(const struct sk_buff *skb,
118                       unsigned int nhoff,
119                       u_int16_t l3num,
120                       struct nf_conntrack_tuple *tuple)
121 {
122         struct nf_conntrack_l3proto *l3proto;
123         struct nf_conntrack_l4proto *l4proto;
124         unsigned int protoff;
125         u_int8_t protonum;
126         int ret;
127
128         rcu_read_lock();
129
130         l3proto = __nf_ct_l3proto_find(l3num);
131         ret = l3proto->get_l4proto(skb, nhoff, &protoff, &protonum);
132         if (ret != NF_ACCEPT) {
133                 rcu_read_unlock();
134                 return 0;
135         }
136
137         l4proto = __nf_ct_l4proto_find(l3num, protonum);
138
139         ret = nf_ct_get_tuple(skb, nhoff, protoff, l3num, protonum, tuple,
140                               l3proto, l4proto);
141
142         rcu_read_unlock();
143         return ret;
144 }
145 EXPORT_SYMBOL_GPL(nf_ct_get_tuplepr);
146
147 int
148 nf_ct_invert_tuple(struct nf_conntrack_tuple *inverse,
149                    const struct nf_conntrack_tuple *orig,
150                    const struct nf_conntrack_l3proto *l3proto,
151                    const struct nf_conntrack_l4proto *l4proto)
152 {
153         NF_CT_TUPLE_U_BLANK(inverse);
154
155         inverse->src.l3num = orig->src.l3num;
156         if (l3proto->invert_tuple(inverse, orig) == 0)
157                 return 0;
158
159         inverse->dst.dir = !orig->dst.dir;
160
161         inverse->dst.protonum = orig->dst.protonum;
162         return l4proto->invert_tuple(inverse, orig);
163 }
164 EXPORT_SYMBOL_GPL(nf_ct_invert_tuple);
165
166 static void
167 clean_from_lists(struct nf_conn *ct)
168 {
169         pr_debug("clean_from_lists(%p)\n", ct);
170         hlist_del(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode);
171         hlist_del(&ct->tuplehash[IP_CT_DIR_REPLY].hnode);
172
173         /* Destroy all pending expectations */
174         nf_ct_remove_expectations(ct);
175 }
176
177 static void
178 destroy_conntrack(struct nf_conntrack *nfct)
179 {
180         struct nf_conn *ct = (struct nf_conn *)nfct;
181         struct nf_conntrack_l4proto *l4proto;
182
183         pr_debug("destroy_conntrack(%p)\n", ct);
184         NF_CT_ASSERT(atomic_read(&nfct->use) == 0);
185         NF_CT_ASSERT(!timer_pending(&ct->timeout));
186
187         nf_conntrack_event(IPCT_DESTROY, ct);
188         set_bit(IPS_DYING_BIT, &ct->status);
189
190         /* To make sure we don't get any weird locking issues here:
191          * destroy_conntrack() MUST NOT be called with a write lock
192          * to nf_conntrack_lock!!! -HW */
193         rcu_read_lock();
194         l4proto = __nf_ct_l4proto_find(ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.l3num,
195                                        ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.protonum);
196         if (l4proto && l4proto->destroy)
197                 l4proto->destroy(ct);
198
199         nf_ct_ext_destroy(ct);
200
201         rcu_read_unlock();
202
203         write_lock_bh(&nf_conntrack_lock);
204         /* Expectations will have been removed in clean_from_lists,
205          * except TFTP can create an expectation on the first packet,
206          * before connection is in the list, so we need to clean here,
207          * too. */
208         nf_ct_remove_expectations(ct);
209
210         /* We overload first tuple to link into unconfirmed list. */
211         if (!nf_ct_is_confirmed(ct)) {
212                 BUG_ON(hlist_unhashed(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode));
213                 hlist_del(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode);
214         }
215
216         NF_CT_STAT_INC(delete);
217         write_unlock_bh(&nf_conntrack_lock);
218
219         if (ct->master)
220                 nf_ct_put(ct->master);
221
222         pr_debug("destroy_conntrack: returning ct=%p to slab\n", ct);
223         nf_conntrack_free(ct);
224 }
225
226 static void death_by_timeout(unsigned long ul_conntrack)
227 {
228         struct nf_conn *ct = (void *)ul_conntrack;
229         struct nf_conn_help *help = nfct_help(ct);
230         struct nf_conntrack_helper *helper;
231
232         if (help) {
233                 rcu_read_lock();
234                 helper = rcu_dereference(help->helper);
235                 if (helper && helper->destroy)
236                         helper->destroy(ct);
237                 rcu_read_unlock();
238         }
239
240         write_lock_bh(&nf_conntrack_lock);
241         /* Inside lock so preempt is disabled on module removal path.
242          * Otherwise we can get spurious warnings. */
243         NF_CT_STAT_INC(delete_list);
244         clean_from_lists(ct);
245         write_unlock_bh(&nf_conntrack_lock);
246         nf_ct_put(ct);
247 }
248
249 struct nf_conntrack_tuple_hash *
250 __nf_conntrack_find(const struct nf_conntrack_tuple *tuple,
251                     const struct nf_conn *ignored_conntrack)
252 {
253         struct nf_conntrack_tuple_hash *h;
254         struct hlist_node *n;
255         unsigned int hash = hash_conntrack(tuple);
256
257         hlist_for_each_entry(h, n, &nf_conntrack_hash[hash], hnode) {
258                 if (nf_ct_tuplehash_to_ctrack(h) != ignored_conntrack &&
259                     nf_ct_tuple_equal(tuple, &h->tuple)) {
260                         NF_CT_STAT_INC(found);
261                         return h;
262                 }
263                 NF_CT_STAT_INC(searched);
264         }
265
266         return NULL;
267 }
268 EXPORT_SYMBOL_GPL(__nf_conntrack_find);
269
270 /* Find a connection corresponding to a tuple. */
271 struct nf_conntrack_tuple_hash *
272 nf_conntrack_find_get(const struct nf_conntrack_tuple *tuple)
273 {
274         struct nf_conntrack_tuple_hash *h;
275
276         read_lock_bh(&nf_conntrack_lock);
277         h = __nf_conntrack_find(tuple, NULL);
278         if (h)
279                 atomic_inc(&nf_ct_tuplehash_to_ctrack(h)->ct_general.use);
280         read_unlock_bh(&nf_conntrack_lock);
281
282         return h;
283 }
284 EXPORT_SYMBOL_GPL(nf_conntrack_find_get);
285
286 static void __nf_conntrack_hash_insert(struct nf_conn *ct,
287                                        unsigned int hash,
288                                        unsigned int repl_hash)
289 {
290         ct->id = ++nf_conntrack_next_id;
291         hlist_add_head(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode,
292                        &nf_conntrack_hash[hash]);
293         hlist_add_head(&ct->tuplehash[IP_CT_DIR_REPLY].hnode,
294                        &nf_conntrack_hash[repl_hash]);
295 }
296
297 void nf_conntrack_hash_insert(struct nf_conn *ct)
298 {
299         unsigned int hash, repl_hash;
300
301         hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
302         repl_hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
303
304         write_lock_bh(&nf_conntrack_lock);
305         __nf_conntrack_hash_insert(ct, hash, repl_hash);
306         write_unlock_bh(&nf_conntrack_lock);
307 }
308 EXPORT_SYMBOL_GPL(nf_conntrack_hash_insert);
309
310 /* Confirm a connection given skb; places it in hash table */
311 int
312 __nf_conntrack_confirm(struct sk_buff **pskb)
313 {
314         unsigned int hash, repl_hash;
315         struct nf_conntrack_tuple_hash *h;
316         struct nf_conn *ct;
317         struct nf_conn_help *help;
318         struct hlist_node *n;
319         enum ip_conntrack_info ctinfo;
320
321         ct = nf_ct_get(*pskb, &ctinfo);
322
323         /* ipt_REJECT uses nf_conntrack_attach to attach related
324            ICMP/TCP RST packets in other direction.  Actual packet
325            which created connection will be IP_CT_NEW or for an
326            expected connection, IP_CT_RELATED. */
327         if (CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL)
328                 return NF_ACCEPT;
329
330         hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
331         repl_hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
332
333         /* We're not in hash table, and we refuse to set up related
334            connections for unconfirmed conns.  But packet copies and
335            REJECT will give spurious warnings here. */
336         /* NF_CT_ASSERT(atomic_read(&ct->ct_general.use) == 1); */
337
338         /* No external references means noone else could have
339            confirmed us. */
340         NF_CT_ASSERT(!nf_ct_is_confirmed(ct));
341         pr_debug("Confirming conntrack %p\n", ct);
342
343         write_lock_bh(&nf_conntrack_lock);
344
345         /* See if there's one in the list already, including reverse:
346            NAT could have grabbed it without realizing, since we're
347            not in the hash.  If there is, we lost race. */
348         hlist_for_each_entry(h, n, &nf_conntrack_hash[hash], hnode)
349                 if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
350                                       &h->tuple))
351                         goto out;
352         hlist_for_each_entry(h, n, &nf_conntrack_hash[repl_hash], hnode)
353                 if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_REPLY].tuple,
354                                       &h->tuple))
355                         goto out;
356
357         /* Remove from unconfirmed list */
358         hlist_del(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode);
359
360         __nf_conntrack_hash_insert(ct, hash, repl_hash);
361         /* Timer relative to confirmation time, not original
362            setting time, otherwise we'd get timer wrap in
363            weird delay cases. */
364         ct->timeout.expires += jiffies;
365         add_timer(&ct->timeout);
366         atomic_inc(&ct->ct_general.use);
367         set_bit(IPS_CONFIRMED_BIT, &ct->status);
368         NF_CT_STAT_INC(insert);
369         write_unlock_bh(&nf_conntrack_lock);
370         help = nfct_help(ct);
371         if (help && help->helper)
372                 nf_conntrack_event_cache(IPCT_HELPER, *pskb);
373 #ifdef CONFIG_NF_NAT_NEEDED
374         if (test_bit(IPS_SRC_NAT_DONE_BIT, &ct->status) ||
375             test_bit(IPS_DST_NAT_DONE_BIT, &ct->status))
376                 nf_conntrack_event_cache(IPCT_NATINFO, *pskb);
377 #endif
378         nf_conntrack_event_cache(master_ct(ct) ?
379                                  IPCT_RELATED : IPCT_NEW, *pskb);
380         return NF_ACCEPT;
381
382 out:
383         NF_CT_STAT_INC(insert_failed);
384         write_unlock_bh(&nf_conntrack_lock);
385         return NF_DROP;
386 }
387 EXPORT_SYMBOL_GPL(__nf_conntrack_confirm);
388
389 /* Returns true if a connection correspondings to the tuple (required
390    for NAT). */
391 int
392 nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
393                          const struct nf_conn *ignored_conntrack)
394 {
395         struct nf_conntrack_tuple_hash *h;
396
397         read_lock_bh(&nf_conntrack_lock);
398         h = __nf_conntrack_find(tuple, ignored_conntrack);
399         read_unlock_bh(&nf_conntrack_lock);
400
401         return h != NULL;
402 }
403 EXPORT_SYMBOL_GPL(nf_conntrack_tuple_taken);
404
405 #define NF_CT_EVICTION_RANGE    8
406
407 /* There's a small race here where we may free a just-assured
408    connection.  Too bad: we're in trouble anyway. */
409 static int early_drop(unsigned int hash)
410 {
411         /* Use oldest entry, which is roughly LRU */
412         struct nf_conntrack_tuple_hash *h;
413         struct nf_conn *ct = NULL, *tmp;
414         struct hlist_node *n;
415         unsigned int i, cnt = 0;
416         int dropped = 0;
417
418         read_lock_bh(&nf_conntrack_lock);
419         for (i = 0; i < nf_conntrack_htable_size; i++) {
420                 hlist_for_each_entry(h, n, &nf_conntrack_hash[hash], hnode) {
421                         tmp = nf_ct_tuplehash_to_ctrack(h);
422                         if (!test_bit(IPS_ASSURED_BIT, &tmp->status))
423                                 ct = tmp;
424                         cnt++;
425                 }
426                 if (ct || cnt >= NF_CT_EVICTION_RANGE)
427                         break;
428                 hash = (hash + 1) % nf_conntrack_htable_size;
429         }
430         if (ct)
431                 atomic_inc(&ct->ct_general.use);
432         read_unlock_bh(&nf_conntrack_lock);
433
434         if (!ct)
435                 return dropped;
436
437         if (del_timer(&ct->timeout)) {
438                 death_by_timeout((unsigned long)ct);
439                 dropped = 1;
440                 NF_CT_STAT_INC_ATOMIC(early_drop);
441         }
442         nf_ct_put(ct);
443         return dropped;
444 }
445
446 struct nf_conn *nf_conntrack_alloc(const struct nf_conntrack_tuple *orig,
447                                    const struct nf_conntrack_tuple *repl)
448 {
449         struct nf_conn *conntrack = NULL;
450
451         if (unlikely(!nf_conntrack_hash_rnd_initted)) {
452                 get_random_bytes(&nf_conntrack_hash_rnd, 4);
453                 nf_conntrack_hash_rnd_initted = 1;
454         }
455
456         /* We don't want any race condition at early drop stage */
457         atomic_inc(&nf_conntrack_count);
458
459         if (nf_conntrack_max
460             && atomic_read(&nf_conntrack_count) > nf_conntrack_max) {
461                 unsigned int hash = hash_conntrack(orig);
462                 if (!early_drop(hash)) {
463                         atomic_dec(&nf_conntrack_count);
464                         if (net_ratelimit())
465                                 printk(KERN_WARNING
466                                        "nf_conntrack: table full, dropping"
467                                        " packet.\n");
468                         return ERR_PTR(-ENOMEM);
469                 }
470         }
471
472         conntrack = kmem_cache_zalloc(nf_conntrack_cachep, GFP_ATOMIC);
473         if (conntrack == NULL) {
474                 pr_debug("nf_conntrack_alloc: Can't alloc conntrack.\n");
475                 atomic_dec(&nf_conntrack_count);
476                 return ERR_PTR(-ENOMEM);
477         }
478
479         atomic_set(&conntrack->ct_general.use, 1);
480         conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple = *orig;
481         conntrack->tuplehash[IP_CT_DIR_REPLY].tuple = *repl;
482         /* Don't set timer yet: wait for confirmation */
483         setup_timer(&conntrack->timeout, death_by_timeout,
484                     (unsigned long)conntrack);
485
486         return conntrack;
487 }
488 EXPORT_SYMBOL_GPL(nf_conntrack_alloc);
489
490 void nf_conntrack_free(struct nf_conn *conntrack)
491 {
492         nf_ct_ext_free(conntrack);
493         kmem_cache_free(nf_conntrack_cachep, conntrack);
494         atomic_dec(&nf_conntrack_count);
495 }
496 EXPORT_SYMBOL_GPL(nf_conntrack_free);
497
498 /* Allocate a new conntrack: we return -ENOMEM if classification
499    failed due to stress.  Otherwise it really is unclassifiable. */
500 static struct nf_conntrack_tuple_hash *
501 init_conntrack(const struct nf_conntrack_tuple *tuple,
502                struct nf_conntrack_l3proto *l3proto,
503                struct nf_conntrack_l4proto *l4proto,
504                struct sk_buff *skb,
505                unsigned int dataoff)
506 {
507         struct nf_conn *conntrack;
508         struct nf_conn_help *help;
509         struct nf_conntrack_tuple repl_tuple;
510         struct nf_conntrack_expect *exp;
511
512         if (!nf_ct_invert_tuple(&repl_tuple, tuple, l3proto, l4proto)) {
513                 pr_debug("Can't invert tuple.\n");
514                 return NULL;
515         }
516
517         conntrack = nf_conntrack_alloc(tuple, &repl_tuple);
518         if (conntrack == NULL || IS_ERR(conntrack)) {
519                 pr_debug("Can't allocate conntrack.\n");
520                 return (struct nf_conntrack_tuple_hash *)conntrack;
521         }
522
523         if (!l4proto->new(conntrack, skb, dataoff)) {
524                 nf_conntrack_free(conntrack);
525                 pr_debug("init conntrack: can't track with proto module\n");
526                 return NULL;
527         }
528
529         write_lock_bh(&nf_conntrack_lock);
530         exp = nf_ct_find_expectation(tuple);
531         if (exp) {
532                 pr_debug("conntrack: expectation arrives ct=%p exp=%p\n",
533                          conntrack, exp);
534                 /* Welcome, Mr. Bond.  We've been expecting you... */
535                 __set_bit(IPS_EXPECTED_BIT, &conntrack->status);
536                 conntrack->master = exp->master;
537                 if (exp->helper) {
538                         help = nf_ct_helper_ext_add(conntrack, GFP_ATOMIC);
539                         if (help)
540                                 rcu_assign_pointer(help->helper, exp->helper);
541                 }
542
543 #ifdef CONFIG_NF_CONNTRACK_MARK
544                 conntrack->mark = exp->master->mark;
545 #endif
546 #ifdef CONFIG_NF_CONNTRACK_SECMARK
547                 conntrack->secmark = exp->master->secmark;
548 #endif
549                 nf_conntrack_get(&conntrack->master->ct_general);
550                 NF_CT_STAT_INC(expect_new);
551         } else {
552                 struct nf_conntrack_helper *helper;
553
554                 helper = __nf_ct_helper_find(&repl_tuple);
555                 if (helper) {
556                         help = nf_ct_helper_ext_add(conntrack, GFP_ATOMIC);
557                         if (help)
558                                 rcu_assign_pointer(help->helper, helper);
559                 }
560                 NF_CT_STAT_INC(new);
561         }
562
563         /* Overload tuple linked list to put us in unconfirmed list. */
564         hlist_add_head(&conntrack->tuplehash[IP_CT_DIR_ORIGINAL].hnode,
565                        &unconfirmed);
566
567         write_unlock_bh(&nf_conntrack_lock);
568
569         if (exp) {
570                 if (exp->expectfn)
571                         exp->expectfn(conntrack, exp);
572                 nf_ct_expect_put(exp);
573         }
574
575         return &conntrack->tuplehash[IP_CT_DIR_ORIGINAL];
576 }
577
578 /* On success, returns conntrack ptr, sets skb->nfct and ctinfo */
579 static inline struct nf_conn *
580 resolve_normal_ct(struct sk_buff *skb,
581                   unsigned int dataoff,
582                   u_int16_t l3num,
583                   u_int8_t protonum,
584                   struct nf_conntrack_l3proto *l3proto,
585                   struct nf_conntrack_l4proto *l4proto,
586                   int *set_reply,
587                   enum ip_conntrack_info *ctinfo)
588 {
589         struct nf_conntrack_tuple tuple;
590         struct nf_conntrack_tuple_hash *h;
591         struct nf_conn *ct;
592
593         if (!nf_ct_get_tuple(skb, skb_network_offset(skb),
594                              dataoff, l3num, protonum, &tuple, l3proto,
595                              l4proto)) {
596                 pr_debug("resolve_normal_ct: Can't get tuple\n");
597                 return NULL;
598         }
599
600         /* look for tuple match */
601         h = nf_conntrack_find_get(&tuple);
602         if (!h) {
603                 h = init_conntrack(&tuple, l3proto, l4proto, skb, dataoff);
604                 if (!h)
605                         return NULL;
606                 if (IS_ERR(h))
607                         return (void *)h;
608         }
609         ct = nf_ct_tuplehash_to_ctrack(h);
610
611         /* It exists; we have (non-exclusive) reference. */
612         if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY) {
613                 *ctinfo = IP_CT_ESTABLISHED + IP_CT_IS_REPLY;
614                 /* Please set reply bit if this packet OK */
615                 *set_reply = 1;
616         } else {
617                 /* Once we've had two way comms, always ESTABLISHED. */
618                 if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
619                         pr_debug("nf_conntrack_in: normal packet for %p\n", ct);
620                         *ctinfo = IP_CT_ESTABLISHED;
621                 } else if (test_bit(IPS_EXPECTED_BIT, &ct->status)) {
622                         pr_debug("nf_conntrack_in: related packet for %p\n",
623                                  ct);
624                         *ctinfo = IP_CT_RELATED;
625                 } else {
626                         pr_debug("nf_conntrack_in: new packet for %p\n", ct);
627                         *ctinfo = IP_CT_NEW;
628                 }
629                 *set_reply = 0;
630         }
631         skb->nfct = &ct->ct_general;
632         skb->nfctinfo = *ctinfo;
633         return ct;
634 }
635
636 unsigned int
637 nf_conntrack_in(int pf, unsigned int hooknum, struct sk_buff **pskb)
638 {
639         struct nf_conn *ct;
640         enum ip_conntrack_info ctinfo;
641         struct nf_conntrack_l3proto *l3proto;
642         struct nf_conntrack_l4proto *l4proto;
643         unsigned int dataoff;
644         u_int8_t protonum;
645         int set_reply = 0;
646         int ret;
647
648         /* Previously seen (loopback or untracked)?  Ignore. */
649         if ((*pskb)->nfct) {
650                 NF_CT_STAT_INC_ATOMIC(ignore);
651                 return NF_ACCEPT;
652         }
653
654         /* rcu_read_lock()ed by nf_hook_slow */
655         l3proto = __nf_ct_l3proto_find((u_int16_t)pf);
656         ret = l3proto->get_l4proto(*pskb, skb_network_offset(*pskb),
657                                    &dataoff, &protonum);
658         if (ret <= 0) {
659                 pr_debug("not prepared to track yet or error occured\n");
660                 NF_CT_STAT_INC_ATOMIC(error);
661                 NF_CT_STAT_INC_ATOMIC(invalid);
662                 return -ret;
663         }
664
665         l4proto = __nf_ct_l4proto_find((u_int16_t)pf, protonum);
666
667         /* It may be an special packet, error, unclean...
668          * inverse of the return code tells to the netfilter
669          * core what to do with the packet. */
670         if (l4proto->error != NULL &&
671             (ret = l4proto->error(*pskb, dataoff, &ctinfo, pf, hooknum)) <= 0) {
672                 NF_CT_STAT_INC_ATOMIC(error);
673                 NF_CT_STAT_INC_ATOMIC(invalid);
674                 return -ret;
675         }
676
677         ct = resolve_normal_ct(*pskb, dataoff, pf, protonum, l3proto, l4proto,
678                                &set_reply, &ctinfo);
679         if (!ct) {
680                 /* Not valid part of a connection */
681                 NF_CT_STAT_INC_ATOMIC(invalid);
682                 return NF_ACCEPT;
683         }
684
685         if (IS_ERR(ct)) {
686                 /* Too stressed to deal. */
687                 NF_CT_STAT_INC_ATOMIC(drop);
688                 return NF_DROP;
689         }
690
691         NF_CT_ASSERT((*pskb)->nfct);
692
693         ret = l4proto->packet(ct, *pskb, dataoff, ctinfo, pf, hooknum);
694         if (ret < 0) {
695                 /* Invalid: inverse of the return code tells
696                  * the netfilter core what to do */
697                 pr_debug("nf_conntrack_in: Can't track with proto module\n");
698                 nf_conntrack_put((*pskb)->nfct);
699                 (*pskb)->nfct = NULL;
700                 NF_CT_STAT_INC_ATOMIC(invalid);
701                 return -ret;
702         }
703
704         if (set_reply && !test_and_set_bit(IPS_SEEN_REPLY_BIT, &ct->status))
705                 nf_conntrack_event_cache(IPCT_STATUS, *pskb);
706
707         return ret;
708 }
709 EXPORT_SYMBOL_GPL(nf_conntrack_in);
710
711 int nf_ct_invert_tuplepr(struct nf_conntrack_tuple *inverse,
712                          const struct nf_conntrack_tuple *orig)
713 {
714         int ret;
715
716         rcu_read_lock();
717         ret = nf_ct_invert_tuple(inverse, orig,
718                                  __nf_ct_l3proto_find(orig->src.l3num),
719                                  __nf_ct_l4proto_find(orig->src.l3num,
720                                                       orig->dst.protonum));
721         rcu_read_unlock();
722         return ret;
723 }
724 EXPORT_SYMBOL_GPL(nf_ct_invert_tuplepr);
725
726 /* Alter reply tuple (maybe alter helper).  This is for NAT, and is
727    implicitly racy: see __nf_conntrack_confirm */
728 void nf_conntrack_alter_reply(struct nf_conn *ct,
729                               const struct nf_conntrack_tuple *newreply)
730 {
731         struct nf_conn_help *help = nfct_help(ct);
732         struct nf_conntrack_helper *helper;
733
734         write_lock_bh(&nf_conntrack_lock);
735         /* Should be unconfirmed, so not in hash table yet */
736         NF_CT_ASSERT(!nf_ct_is_confirmed(ct));
737
738         pr_debug("Altering reply tuple of %p to ", ct);
739         NF_CT_DUMP_TUPLE(newreply);
740
741         ct->tuplehash[IP_CT_DIR_REPLY].tuple = *newreply;
742         if (ct->master || (help && help->expecting != 0))
743                 goto out;
744
745         helper = __nf_ct_helper_find(newreply);
746         if (helper == NULL) {
747                 if (help)
748                         rcu_assign_pointer(help->helper, NULL);
749                 goto out;
750         }
751
752         if (help == NULL) {
753                 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
754                 if (help == NULL)
755                         goto out;
756         } else {
757                 memset(&help->help, 0, sizeof(help->help));
758         }
759
760         rcu_assign_pointer(help->helper, helper);
761 out:
762         write_unlock_bh(&nf_conntrack_lock);
763 }
764 EXPORT_SYMBOL_GPL(nf_conntrack_alter_reply);
765
766 /* Refresh conntrack for this many jiffies and do accounting if do_acct is 1 */
767 void __nf_ct_refresh_acct(struct nf_conn *ct,
768                           enum ip_conntrack_info ctinfo,
769                           const struct sk_buff *skb,
770                           unsigned long extra_jiffies,
771                           int do_acct)
772 {
773         int event = 0;
774
775         NF_CT_ASSERT(ct->timeout.data == (unsigned long)ct);
776         NF_CT_ASSERT(skb);
777
778         write_lock_bh(&nf_conntrack_lock);
779
780         /* Only update if this is not a fixed timeout */
781         if (test_bit(IPS_FIXED_TIMEOUT_BIT, &ct->status)) {
782                 write_unlock_bh(&nf_conntrack_lock);
783                 return;
784         }
785
786         /* If not in hash table, timer will not be active yet */
787         if (!nf_ct_is_confirmed(ct)) {
788                 ct->timeout.expires = extra_jiffies;
789                 event = IPCT_REFRESH;
790         } else {
791                 unsigned long newtime = jiffies + extra_jiffies;
792
793                 /* Only update the timeout if the new timeout is at least
794                    HZ jiffies from the old timeout. Need del_timer for race
795                    avoidance (may already be dying). */
796                 if (newtime - ct->timeout.expires >= HZ
797                     && del_timer(&ct->timeout)) {
798                         ct->timeout.expires = newtime;
799                         add_timer(&ct->timeout);
800                         event = IPCT_REFRESH;
801                 }
802         }
803
804 #ifdef CONFIG_NF_CT_ACCT
805         if (do_acct) {
806                 ct->counters[CTINFO2DIR(ctinfo)].packets++;
807                 ct->counters[CTINFO2DIR(ctinfo)].bytes +=
808                         skb->len - skb_network_offset(skb);
809
810                 if ((ct->counters[CTINFO2DIR(ctinfo)].packets & 0x80000000)
811                     || (ct->counters[CTINFO2DIR(ctinfo)].bytes & 0x80000000))
812                         event |= IPCT_COUNTER_FILLING;
813         }
814 #endif
815
816         write_unlock_bh(&nf_conntrack_lock);
817
818         /* must be unlocked when calling event cache */
819         if (event)
820                 nf_conntrack_event_cache(event, skb);
821 }
822 EXPORT_SYMBOL_GPL(__nf_ct_refresh_acct);
823
824 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
825
826 #include <linux/netfilter/nfnetlink.h>
827 #include <linux/netfilter/nfnetlink_conntrack.h>
828 #include <linux/mutex.h>
829
830 /* Generic function for tcp/udp/sctp/dccp and alike. This needs to be
831  * in ip_conntrack_core, since we don't want the protocols to autoload
832  * or depend on ctnetlink */
833 int nf_ct_port_tuple_to_nlattr(struct sk_buff *skb,
834                                const struct nf_conntrack_tuple *tuple)
835 {
836         NLA_PUT(skb, CTA_PROTO_SRC_PORT, sizeof(u_int16_t),
837                 &tuple->src.u.tcp.port);
838         NLA_PUT(skb, CTA_PROTO_DST_PORT, sizeof(u_int16_t),
839                 &tuple->dst.u.tcp.port);
840         return 0;
841
842 nla_put_failure:
843         return -1;
844 }
845 EXPORT_SYMBOL_GPL(nf_ct_port_tuple_to_nlattr);
846
847 const struct nla_policy nf_ct_port_nla_policy[CTA_PROTO_MAX+1] = {
848         [CTA_PROTO_SRC_PORT]  = { .type = NLA_U16 },
849         [CTA_PROTO_DST_PORT]  = { .type = NLA_U16 },
850 };
851 EXPORT_SYMBOL_GPL(nf_ct_port_nla_policy);
852
853 int nf_ct_port_nlattr_to_tuple(struct nlattr *tb[],
854                                struct nf_conntrack_tuple *t)
855 {
856         if (!tb[CTA_PROTO_SRC_PORT] || !tb[CTA_PROTO_DST_PORT])
857                 return -EINVAL;
858
859         t->src.u.tcp.port = *(__be16 *)nla_data(tb[CTA_PROTO_SRC_PORT]);
860         t->dst.u.tcp.port = *(__be16 *)nla_data(tb[CTA_PROTO_DST_PORT]);
861
862         return 0;
863 }
864 EXPORT_SYMBOL_GPL(nf_ct_port_nlattr_to_tuple);
865 #endif
866
867 /* Used by ipt_REJECT and ip6t_REJECT. */
868 void __nf_conntrack_attach(struct sk_buff *nskb, struct sk_buff *skb)
869 {
870         struct nf_conn *ct;
871         enum ip_conntrack_info ctinfo;
872
873         /* This ICMP is in reverse direction to the packet which caused it */
874         ct = nf_ct_get(skb, &ctinfo);
875         if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL)
876                 ctinfo = IP_CT_RELATED + IP_CT_IS_REPLY;
877         else
878                 ctinfo = IP_CT_RELATED;
879
880         /* Attach to new skbuff, and increment count */
881         nskb->nfct = &ct->ct_general;
882         nskb->nfctinfo = ctinfo;
883         nf_conntrack_get(nskb->nfct);
884 }
885 EXPORT_SYMBOL_GPL(__nf_conntrack_attach);
886
887 static inline int
888 do_iter(const struct nf_conntrack_tuple_hash *i,
889         int (*iter)(struct nf_conn *i, void *data),
890         void *data)
891 {
892         return iter(nf_ct_tuplehash_to_ctrack(i), data);
893 }
894
895 /* Bring out ya dead! */
896 static struct nf_conn *
897 get_next_corpse(int (*iter)(struct nf_conn *i, void *data),
898                 void *data, unsigned int *bucket)
899 {
900         struct nf_conntrack_tuple_hash *h;
901         struct nf_conn *ct;
902         struct hlist_node *n;
903
904         write_lock_bh(&nf_conntrack_lock);
905         for (; *bucket < nf_conntrack_htable_size; (*bucket)++) {
906                 hlist_for_each_entry(h, n, &nf_conntrack_hash[*bucket], hnode) {
907                         ct = nf_ct_tuplehash_to_ctrack(h);
908                         if (iter(ct, data))
909                                 goto found;
910                 }
911         }
912         hlist_for_each_entry(h, n, &unconfirmed, hnode) {
913                 ct = nf_ct_tuplehash_to_ctrack(h);
914                 if (iter(ct, data))
915                         set_bit(IPS_DYING_BIT, &ct->status);
916         }
917         write_unlock_bh(&nf_conntrack_lock);
918         return NULL;
919 found:
920         atomic_inc(&ct->ct_general.use);
921         write_unlock_bh(&nf_conntrack_lock);
922         return ct;
923 }
924
925 void
926 nf_ct_iterate_cleanup(int (*iter)(struct nf_conn *i, void *data), void *data)
927 {
928         struct nf_conn *ct;
929         unsigned int bucket = 0;
930
931         while ((ct = get_next_corpse(iter, data, &bucket)) != NULL) {
932                 /* Time to push up daises... */
933                 if (del_timer(&ct->timeout))
934                         death_by_timeout((unsigned long)ct);
935                 /* ... else the timer will get him soon. */
936
937                 nf_ct_put(ct);
938         }
939 }
940 EXPORT_SYMBOL_GPL(nf_ct_iterate_cleanup);
941
942 static int kill_all(struct nf_conn *i, void *data)
943 {
944         return 1;
945 }
946
947 void nf_ct_free_hashtable(struct hlist_head *hash, int vmalloced, int size)
948 {
949         if (vmalloced)
950                 vfree(hash);
951         else
952                 free_pages((unsigned long)hash,
953                            get_order(sizeof(struct hlist_head) * size));
954 }
955 EXPORT_SYMBOL_GPL(nf_ct_free_hashtable);
956
957 void nf_conntrack_flush(void)
958 {
959         nf_ct_iterate_cleanup(kill_all, NULL);
960 }
961 EXPORT_SYMBOL_GPL(nf_conntrack_flush);
962
963 /* Mishearing the voices in his head, our hero wonders how he's
964    supposed to kill the mall. */
965 void nf_conntrack_cleanup(void)
966 {
967         rcu_assign_pointer(ip_ct_attach, NULL);
968
969         /* This makes sure all current packets have passed through
970            netfilter framework.  Roll on, two-stage module
971            delete... */
972         synchronize_net();
973
974         nf_ct_event_cache_flush();
975  i_see_dead_people:
976         nf_conntrack_flush();
977         if (atomic_read(&nf_conntrack_count) != 0) {
978                 schedule();
979                 goto i_see_dead_people;
980         }
981         /* wait until all references to nf_conntrack_untracked are dropped */
982         while (atomic_read(&nf_conntrack_untracked.ct_general.use) > 1)
983                 schedule();
984
985         rcu_assign_pointer(nf_ct_destroy, NULL);
986
987         kmem_cache_destroy(nf_conntrack_cachep);
988         nf_ct_free_hashtable(nf_conntrack_hash, nf_conntrack_vmalloc,
989                              nf_conntrack_htable_size);
990
991         nf_conntrack_proto_fini();
992         nf_conntrack_helper_fini();
993         nf_conntrack_expect_fini();
994 }
995
996 struct hlist_head *nf_ct_alloc_hashtable(int *sizep, int *vmalloced)
997 {
998         struct hlist_head *hash;
999         unsigned int size, i;
1000
1001         *vmalloced = 0;
1002
1003         size = *sizep = roundup(*sizep, PAGE_SIZE / sizeof(struct hlist_head));
1004         hash = (void*)__get_free_pages(GFP_KERNEL,
1005                                        get_order(sizeof(struct hlist_head)
1006                                                  * size));
1007         if (!hash) {
1008                 *vmalloced = 1;
1009                 printk(KERN_WARNING "nf_conntrack: falling back to vmalloc.\n");
1010                 hash = vmalloc(sizeof(struct hlist_head) * size);
1011         }
1012
1013         if (hash)
1014                 for (i = 0; i < size; i++)
1015                         INIT_HLIST_HEAD(&hash[i]);
1016
1017         return hash;
1018 }
1019 EXPORT_SYMBOL_GPL(nf_ct_alloc_hashtable);
1020
1021 int set_hashsize(const char *val, struct kernel_param *kp)
1022 {
1023         int i, bucket, hashsize, vmalloced;
1024         int old_vmalloced, old_size;
1025         int rnd;
1026         struct hlist_head *hash, *old_hash;
1027         struct nf_conntrack_tuple_hash *h;
1028
1029         /* On boot, we can set this without any fancy locking. */
1030         if (!nf_conntrack_htable_size)
1031                 return param_set_uint(val, kp);
1032
1033         hashsize = simple_strtol(val, NULL, 0);
1034         if (!hashsize)
1035                 return -EINVAL;
1036
1037         hash = nf_ct_alloc_hashtable(&hashsize, &vmalloced);
1038         if (!hash)
1039                 return -ENOMEM;
1040
1041         /* We have to rehahs for the new table anyway, so we also can
1042          * use a newrandom seed */
1043         get_random_bytes(&rnd, 4);
1044
1045         write_lock_bh(&nf_conntrack_lock);
1046         for (i = 0; i < nf_conntrack_htable_size; i++) {
1047                 while (!hlist_empty(&nf_conntrack_hash[i])) {
1048                         h = hlist_entry(nf_conntrack_hash[i].first,
1049                                         struct nf_conntrack_tuple_hash, hnode);
1050                         hlist_del(&h->hnode);
1051                         bucket = __hash_conntrack(&h->tuple, hashsize, rnd);
1052                         hlist_add_head(&h->hnode, &hash[bucket]);
1053                 }
1054         }
1055         old_size = nf_conntrack_htable_size;
1056         old_vmalloced = nf_conntrack_vmalloc;
1057         old_hash = nf_conntrack_hash;
1058
1059         nf_conntrack_htable_size = hashsize;
1060         nf_conntrack_vmalloc = vmalloced;
1061         nf_conntrack_hash = hash;
1062         nf_conntrack_hash_rnd = rnd;
1063         write_unlock_bh(&nf_conntrack_lock);
1064
1065         nf_ct_free_hashtable(old_hash, old_vmalloced, old_size);
1066         return 0;
1067 }
1068
1069 module_param_call(hashsize, set_hashsize, param_get_uint,
1070                   &nf_conntrack_htable_size, 0600);
1071
1072 int __init nf_conntrack_init(void)
1073 {
1074         int max_factor = 8;
1075         int ret;
1076
1077         /* Idea from tcp.c: use 1/16384 of memory.  On i386: 32MB
1078          * machine has 512 buckets. >= 1GB machines have 16384 buckets. */
1079         if (!nf_conntrack_htable_size) {
1080                 nf_conntrack_htable_size
1081                         = (((num_physpages << PAGE_SHIFT) / 16384)
1082                            / sizeof(struct hlist_head));
1083                 if (num_physpages > (1024 * 1024 * 1024 / PAGE_SIZE))
1084                         nf_conntrack_htable_size = 16384;
1085                 if (nf_conntrack_htable_size < 32)
1086                         nf_conntrack_htable_size = 32;
1087
1088                 /* Use a max. factor of four by default to get the same max as
1089                  * with the old struct list_heads. When a table size is given
1090                  * we use the old value of 8 to avoid reducing the max.
1091                  * entries. */
1092                 max_factor = 4;
1093         }
1094         nf_conntrack_hash = nf_ct_alloc_hashtable(&nf_conntrack_htable_size,
1095                                                   &nf_conntrack_vmalloc);
1096         if (!nf_conntrack_hash) {
1097                 printk(KERN_ERR "Unable to create nf_conntrack_hash\n");
1098                 goto err_out;
1099         }
1100
1101         nf_conntrack_max = max_factor * nf_conntrack_htable_size;
1102
1103         printk("nf_conntrack version %s (%u buckets, %d max)\n",
1104                NF_CONNTRACK_VERSION, nf_conntrack_htable_size,
1105                nf_conntrack_max);
1106
1107         nf_conntrack_cachep = kmem_cache_create("nf_conntrack",
1108                                                 sizeof(struct nf_conn),
1109                                                 0, 0, NULL);
1110         if (!nf_conntrack_cachep) {
1111                 printk(KERN_ERR "Unable to create nf_conn slab cache\n");
1112                 goto err_free_hash;
1113         }
1114
1115         ret = nf_conntrack_proto_init();
1116         if (ret < 0)
1117                 goto err_free_conntrack_slab;
1118
1119         ret = nf_conntrack_expect_init();
1120         if (ret < 0)
1121                 goto out_fini_proto;
1122
1123         ret = nf_conntrack_helper_init();
1124         if (ret < 0)
1125                 goto out_fini_expect;
1126
1127         /* For use by REJECT target */
1128         rcu_assign_pointer(ip_ct_attach, __nf_conntrack_attach);
1129         rcu_assign_pointer(nf_ct_destroy, destroy_conntrack);
1130
1131         /* Set up fake conntrack:
1132             - to never be deleted, not in any hashes */
1133         atomic_set(&nf_conntrack_untracked.ct_general.use, 1);
1134         /*  - and look it like as a confirmed connection */
1135         set_bit(IPS_CONFIRMED_BIT, &nf_conntrack_untracked.status);
1136
1137         return ret;
1138
1139 out_fini_expect:
1140         nf_conntrack_expect_fini();
1141 out_fini_proto:
1142         nf_conntrack_proto_fini();
1143 err_free_conntrack_slab:
1144         kmem_cache_destroy(nf_conntrack_cachep);
1145 err_free_hash:
1146         nf_ct_free_hashtable(nf_conntrack_hash, nf_conntrack_vmalloc,
1147                              nf_conntrack_htable_size);
1148 err_out:
1149         return -ENOMEM;
1150 }