net/netfilter/nf_conntrack_core.c

210 static u32 hash_conntrack_raw(const struct nf_conntrack_tuple *tuple,
223 	return siphash((void *)tuple,
234 			    const struct nf_conntrack_tuple *tuple,
238 	return reciprocal_scale(hash_conntrack_raw(tuple, zoneid, net), size);
242 			  const struct nf_conntrack_tuple *tuple,
245 	return scale_hash(hash_conntrack_raw(tuple, zoneid, net));
250 				  struct nf_conntrack_tuple *tuple)
261 	tuple->src.u.udp.port = inet_hdr->sport;
262 	tuple->dst.u.udp.port = inet_hdr->dport;
273 		struct nf_conntrack_tuple *tuple)
279 	memset(tuple, 0, sizeof(*tuple));
281 	tuple->src.l3num = l3num;
301 		tuple->src.u3.ip = ap[0];
302 		tuple->dst.u3.ip = ap[1];
305 		memcpy(tuple->src.u3.ip6, ap, sizeof(tuple->src.u3.ip6));
306 		memcpy(tuple->dst.u3.ip6, ap + 4, sizeof(tuple->dst.u3.ip6));
310 	tuple->dst.protonum = protonum;
311 	tuple->dst.dir = IP_CT_DIR_ORIGINAL;
316 		return icmpv6_pkt_to_tuple(skb, dataoff, net, tuple);
319 		return icmp_pkt_to_tuple(skb, dataoff, net, tuple);
322 		return gre_pkt_to_tuple(skb, dataoff, net, tuple);
336 		return nf_ct_get_tuple_ports(skb, dataoff, tuple);
421 		       struct net *net, struct nf_conntrack_tuple *tuple)
430 	return nf_ct_get_tuple(skb, nhoff, protoff, l3num, protonum, net, tuple);
485  * 4. the original direction tuple
497 	d = (unsigned long)siphash(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
498 				   sizeof(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple),
611 				      &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
614 					   &ct->tuplehash[IP_CT_DIR_REPLY].tuple,
687 		const struct nf_conntrack_tuple *tuple,
693 	/* A conntrack can be recreated with the equal tuple,
696 	return nf_ct_tuple_equal(tuple, &h->tuple) &&
705 	return nf_ct_tuple_equal(&ct1->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
706 				 &ct2->tuplehash[IP_CT_DIR_ORIGINAL].tuple) &&
707 	       nf_ct_tuple_equal(&ct1->tuplehash[IP_CT_DIR_REPLY].tuple,
708 				 &ct2->tuplehash[IP_CT_DIR_REPLY].tuple) &&
732  *   and recheck nf_ct_tuple_equal(tuple, &h->tuple)
736 		      const struct nf_conntrack_tuple *tuple, u32 hash)
756 		if (nf_ct_key_equal(h, tuple, zone, net))
772 /* Find a connection corresponding to a tuple. */
775 			const struct nf_conntrack_tuple *tuple, u32 hash)
780 	h = ____nf_conntrack_find(net, zone, tuple, hash);
782 		/* We have a candidate that matches the tuple we're interested
783 		 * in, try to obtain a reference and re-check tuple
790 			if (likely(nf_ct_key_equal(h, tuple, zone, net)))
805 		      const struct nf_conntrack_tuple *tuple)
812 	thash = __nf_conntrack_find_get(net, zone, tuple,
813 					hash_conntrack_raw(tuple, zone_id, net));
820 		thash = __nf_conntrack_find_get(net, zone, tuple,
821 						hash_conntrack_raw(tuple, rid, net));
888 				      &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
891 					   &ct->tuplehash[IP_CT_DIR_REPLY].tuple,
899 		if (nf_ct_key_equal(h, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
910 		if (nf_ct_key_equal(h, &ct->tuplehash[IP_CT_DIR_REPLY].tuple,
1030  * is unique or there the existing entry has the identical tuple in both
1053 				    &loser_ct->tuplehash[IP_CT_DIR_REPLY].tuple,
1091  * if there is no existing entry with an identical tuple.
1183 					   &ct->tuplehash[IP_CT_DIR_REPLY].tuple,
1226 		if (nf_ct_key_equal(h, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
1235 		if (nf_ct_key_equal(h, &ct->tuplehash[IP_CT_DIR_REPLY].tuple,
1290 /* Returns true if a connection corresponds to the tuple (required
1293 nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
1309 	hash = __hash_conntrack(net, tuple, nf_ct_zone_id(zone, IP_CT_DIR_REPLY), hsize);
1322 		if (nf_ct_key_equal(h, tuple, zone, net)) {
1335 			if (nf_ct_tuple_equal(&ignored_conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
1336 					      &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple) &&
1636 	ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple = *orig;
1638 	ct->tuplehash[IP_CT_DIR_REPLY].tuple = *repl;
1702 	       const struct nf_conntrack_tuple *tuple,
1718 	if (!nf_ct_invert_tuple(&repl_tuple, tuple))
1722 	ct = __nf_conntrack_alloc(net, zone, tuple, &repl_tuple, GFP_ATOMIC,
1757 		exp = nf_ct_find_expectation(net, zone, tuple, !tmpl || nf_ct_is_confirmed(tmpl));
1813 	struct nf_conntrack_tuple tuple;
1822 			     &tuple))
1825 	/* look for tuple match */
1829 	hash = hash_conntrack_raw(&tuple, zone_id, state->net);
1830 	h = __nf_conntrack_find_get(state->net, zone, &tuple, hash);
1835 			u32 tmp = hash_conntrack_raw(&tuple, rid, state->net);
1837 			h = __nf_conntrack_find_get(state->net, zone, &tuple, tmp);
1842 		h = init_conntrack(state->net, tmpl, &tuple,
2084 			       const struct nf_conntrack_tuple *tuple)
2086 	if (nla_put_be16(skb, CTA_PROTO_SRC_PORT, tuple->src.u.tcp.port) ||
2087 	    nla_put_be16(skb, CTA_PROTO_DST_PORT, tuple->dst.u.tcp.port))
2160 	struct nf_conntrack_tuple tuple;
2173 			     l4num, net, &tuple))
2177 		memcpy(tuple.src.u3.all,
2178 		       ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.all,
2179 		       sizeof(tuple.src.u3.all));
2180 		tuple.src.u.all =
2181 			ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.all;
2185 		memcpy(tuple.dst.u3.all,
2186 		       ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3.all,
2187 		       sizeof(tuple.dst.u3.all));
2188 		tuple.dst.u.all =
2189 			ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u.all;
2192 	h = nf_conntrack_find_get(net, nf_ct_zone(ct), &tuple);
2333 	src_tuple = nf_ct_tuple(ct, !hash->tuple.dst.dir);
2363 			 * for original direction tuple, once for the reply tuple.
2366 			 * tuple is added (the original tuple already existed for
2371 			 * tuple while iterating.
2619 						  &h->tuple, zone_id, hashsize);