1/* Expectation handling for nf_conntrack. */ 2 3/* (C) 1999-2001 Paul `Rusty' Russell 4 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org> 5 * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org> 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 as 9 * published by the Free Software Foundation. 10 */ 11 12#include <linux/types.h> 13#include <linux/netfilter.h> 14#include <linux/skbuff.h> 15#include <linux/proc_fs.h> 16#include <linux/seq_file.h> 17#include <linux/stddef.h> 18#include <linux/slab.h> 19#include <linux/err.h> 20#include <linux/percpu.h> 21#include <linux/kernel.h> 22#include <linux/jhash.h> 23#include <net/net_namespace.h> 24 25#include <net/netfilter/nf_conntrack.h> 26#include <net/netfilter/nf_conntrack_core.h> 27#include <net/netfilter/nf_conntrack_expect.h> 28#include <net/netfilter/nf_conntrack_helper.h> 29#include <net/netfilter/nf_conntrack_tuple.h> 30#include <net/netfilter/nf_conntrack_zones.h> 31 32unsigned int nf_ct_expect_hsize __read_mostly; 33EXPORT_SYMBOL_GPL(nf_ct_expect_hsize); 34 35static unsigned int nf_ct_expect_hash_rnd __read_mostly; 36unsigned int nf_ct_expect_max __read_mostly; 37static int nf_ct_expect_hash_rnd_initted __read_mostly; 38 39static struct kmem_cache *nf_ct_expect_cachep __read_mostly; 40 41/* nf_conntrack_expect helper functions */ 42void nf_ct_unlink_expect(struct nf_conntrack_expect *exp) 43{ 44 struct nf_conn_help *master_help = nfct_help(exp->master); 45 struct net *net = nf_ct_exp_net(exp); 46 47 NF_CT_ASSERT(master_help); 48 NF_CT_ASSERT(!timer_pending(&exp->timeout)); 49 50 hlist_del_rcu(&exp->hnode); 51 net->ct.expect_count--; 52 53 hlist_del(&exp->lnode); 54 master_help->expecting[exp->class]--; 55 nf_ct_expect_put(exp); 56 57 NF_CT_STAT_INC(net, expect_delete); 58} 59EXPORT_SYMBOL_GPL(nf_ct_unlink_expect); 60 61static void nf_ct_expectation_timed_out(unsigned long ul_expect) 62{ 63 struct nf_conntrack_expect *exp = (void *)ul_expect; 64 65 spin_lock_bh(&nf_conntrack_lock); 66 nf_ct_unlink_expect(exp); 67 spin_unlock_bh(&nf_conntrack_lock); 68 nf_ct_expect_put(exp); 69} 70 71static unsigned int nf_ct_expect_dst_hash(const struct nf_conntrack_tuple *tuple) 72{ 73 unsigned int hash; 74 75 if (unlikely(!nf_ct_expect_hash_rnd_initted)) { 76 get_random_bytes(&nf_ct_expect_hash_rnd, 77 sizeof(nf_ct_expect_hash_rnd)); 78 nf_ct_expect_hash_rnd_initted = 1; 79 } 80 81 hash = jhash2(tuple->dst.u3.all, ARRAY_SIZE(tuple->dst.u3.all), 82 (((tuple->dst.protonum ^ tuple->src.l3num) << 16) | 83 (__force __u16)tuple->dst.u.all) ^ nf_ct_expect_hash_rnd); 84 return ((u64)hash * nf_ct_expect_hsize) >> 32; 85} 86 87struct nf_conntrack_expect * 88__nf_ct_expect_find(struct net *net, u16 zone, 89 const struct nf_conntrack_tuple *tuple) 90{ 91 struct nf_conntrack_expect *i; 92 struct hlist_node *n; 93 unsigned int h; 94 95 if (!net->ct.expect_count) 96 return NULL; 97 98 h = nf_ct_expect_dst_hash(tuple); 99 hlist_for_each_entry_rcu(i, n, &net->ct.expect_hash[h], hnode) { 100 if (nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask) && 101 nf_ct_zone(i->master) == zone) 102 return i; 103 } 104 return NULL; 105} 106EXPORT_SYMBOL_GPL(__nf_ct_expect_find); 107 108/* Just find a expectation corresponding to a tuple. */ 109struct nf_conntrack_expect * 110nf_ct_expect_find_get(struct net *net, u16 zone, 111 const struct nf_conntrack_tuple *tuple) 112{ 113 struct nf_conntrack_expect *i; 114 115 rcu_read_lock(); 116 i = __nf_ct_expect_find(net, zone, tuple); 117 if (i && !atomic_inc_not_zero(&i->use)) 118 i = NULL; 119 rcu_read_unlock(); 120 121 return i; 122} 123EXPORT_SYMBOL_GPL(nf_ct_expect_find_get); 124 125/* If an expectation for this connection is found, it gets delete from 126 * global list then returned. */ 127struct nf_conntrack_expect * 128nf_ct_find_expectation(struct net *net, u16 zone, 129 const struct nf_conntrack_tuple *tuple) 130{ 131 struct nf_conntrack_expect *i, *exp = NULL; 132 struct hlist_node *n; 133 unsigned int h; 134 135 if (!net->ct.expect_count) 136 return NULL; 137 138 h = nf_ct_expect_dst_hash(tuple); 139 hlist_for_each_entry(i, n, &net->ct.expect_hash[h], hnode) { 140 if (!(i->flags & NF_CT_EXPECT_INACTIVE) && 141 nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask) && 142 nf_ct_zone(i->master) == zone) { 143 exp = i; 144 break; 145 } 146 } 147 if (!exp) 148 return NULL; 149 150 /* If master is not in hash table yet (ie. packet hasn't left 151 this machine yet), how can other end know about expected? 152 Hence these are not the droids you are looking for (if 153 master ct never got confirmed, we'd hold a reference to it 154 and weird things would happen to future packets). */ 155 if (!nf_ct_is_confirmed(exp->master)) 156 return NULL; 157 158 if (exp->flags & NF_CT_EXPECT_PERMANENT) { 159 atomic_inc(&exp->use); 160 return exp; 161 } else if (del_timer(&exp->timeout)) { 162 nf_ct_unlink_expect(exp); 163 return exp; 164 } 165 166 return NULL; 167} 168 169/* delete all expectations for this conntrack */ 170void nf_ct_remove_expectations(struct nf_conn *ct) 171{ 172 struct nf_conn_help *help = nfct_help(ct); 173 struct nf_conntrack_expect *exp; 174 struct hlist_node *n, *next; 175 176 /* Optimization: most connection never expect any others. */ 177 if (!help) 178 return; 179 180 hlist_for_each_entry_safe(exp, n, next, &help->expectations, lnode) { 181 if (del_timer(&exp->timeout)) { 182 nf_ct_unlink_expect(exp); 183 nf_ct_expect_put(exp); 184 } 185 } 186} 187EXPORT_SYMBOL_GPL(nf_ct_remove_expectations); 188 189/* Would two expected things clash? */ 190static inline int expect_clash(const struct nf_conntrack_expect *a, 191 const struct nf_conntrack_expect *b) 192{ 193 /* Part covered by intersection of masks must be unequal, 194 otherwise they clash */ 195 struct nf_conntrack_tuple_mask intersect_mask; 196 int count; 197 198 intersect_mask.src.u.all = a->mask.src.u.all & b->mask.src.u.all; 199 200 for (count = 0; count < NF_CT_TUPLE_L3SIZE; count++){ 201 intersect_mask.src.u3.all[count] = 202 a->mask.src.u3.all[count] & b->mask.src.u3.all[count]; 203 } 204 205 return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask); 206} 207 208static inline int expect_matches(const struct nf_conntrack_expect *a, 209 const struct nf_conntrack_expect *b) 210{ 211 return a->master == b->master && a->class == b->class && 212 nf_ct_tuple_equal(&a->tuple, &b->tuple) && 213 nf_ct_tuple_mask_equal(&a->mask, &b->mask) && 214 nf_ct_zone(a->master) == nf_ct_zone(b->master); 215} 216 217/* Generally a bad idea to call this: could have matched already. */ 218void nf_ct_unexpect_related(struct nf_conntrack_expect *exp) 219{ 220 spin_lock_bh(&nf_conntrack_lock); 221 if (del_timer(&exp->timeout)) { 222 nf_ct_unlink_expect(exp); 223 nf_ct_expect_put(exp); 224 } 225 spin_unlock_bh(&nf_conntrack_lock); 226} 227EXPORT_SYMBOL_GPL(nf_ct_unexpect_related); 228 229/* We don't increase the master conntrack refcount for non-fulfilled 230 * conntracks. During the conntrack destruction, the expectations are 231 * always killed before the conntrack itself */ 232struct nf_conntrack_expect *nf_ct_expect_alloc(struct nf_conn *me) 233{ 234 struct nf_conntrack_expect *new; 235 236 new = kmem_cache_alloc(nf_ct_expect_cachep, GFP_ATOMIC); 237 if (!new) 238 return NULL; 239 240 new->master = me; 241 atomic_set(&new->use, 1); 242 return new; 243} 244EXPORT_SYMBOL_GPL(nf_ct_expect_alloc); 245 246void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class, 247 u_int8_t family, 248 const union nf_inet_addr *saddr, 249 const union nf_inet_addr *daddr, 250 u_int8_t proto, const __be16 *src, const __be16 *dst) 251{ 252 int len; 253 254 if (family == AF_INET) 255 len = 4; 256 else 257 len = 16; 258 259 exp->flags = 0; 260 exp->class = class; 261 exp->expectfn = NULL; 262 exp->helper = NULL; 263 exp->tuple.src.l3num = family; 264 exp->tuple.dst.protonum = proto; 265 266 if (saddr) { 267 memcpy(&exp->tuple.src.u3, saddr, len); 268 if (sizeof(exp->tuple.src.u3) > len) 269 /* address needs to be cleared for nf_ct_tuple_equal */ 270 memset((void *)&exp->tuple.src.u3 + len, 0x00, 271 sizeof(exp->tuple.src.u3) - len); 272 memset(&exp->mask.src.u3, 0xFF, len); 273 if (sizeof(exp->mask.src.u3) > len) 274 memset((void *)&exp->mask.src.u3 + len, 0x00, 275 sizeof(exp->mask.src.u3) - len); 276 } else { 277 memset(&exp->tuple.src.u3, 0x00, sizeof(exp->tuple.src.u3)); 278 memset(&exp->mask.src.u3, 0x00, sizeof(exp->mask.src.u3)); 279 } 280 281 if (src) { 282 exp->tuple.src.u.all = *src; 283 exp->mask.src.u.all = htons(0xFFFF); 284 } else { 285 exp->tuple.src.u.all = 0; 286 exp->mask.src.u.all = 0; 287 } 288 289 memcpy(&exp->tuple.dst.u3, daddr, len); 290 if (sizeof(exp->tuple.dst.u3) > len) 291 /* address needs to be cleared for nf_ct_tuple_equal */ 292 memset((void *)&exp->tuple.dst.u3 + len, 0x00, 293 sizeof(exp->tuple.dst.u3) - len); 294 295 exp->tuple.dst.u.all = *dst; 296} 297EXPORT_SYMBOL_GPL(nf_ct_expect_init); 298 299static void nf_ct_expect_free_rcu(struct rcu_head *head) 300{ 301 struct nf_conntrack_expect *exp; 302 303 exp = container_of(head, struct nf_conntrack_expect, rcu); 304 kmem_cache_free(nf_ct_expect_cachep, exp); 305} 306 307void nf_ct_expect_put(struct nf_conntrack_expect *exp) 308{ 309 if (atomic_dec_and_test(&exp->use)) 310 call_rcu(&exp->rcu, nf_ct_expect_free_rcu); 311} 312EXPORT_SYMBOL_GPL(nf_ct_expect_put); 313 314static void nf_ct_expect_insert(struct nf_conntrack_expect *exp) 315{ 316 struct nf_conn_help *master_help = nfct_help(exp->master); 317 struct net *net = nf_ct_exp_net(exp); 318 const struct nf_conntrack_expect_policy *p; 319 unsigned int h = nf_ct_expect_dst_hash(&exp->tuple); 320 321 atomic_inc(&exp->use); 322 323 hlist_add_head(&exp->lnode, &master_help->expectations); 324 master_help->expecting[exp->class]++; 325 326 hlist_add_head_rcu(&exp->hnode, &net->ct.expect_hash[h]); 327 net->ct.expect_count++; 328 329 setup_timer(&exp->timeout, nf_ct_expectation_timed_out, 330 (unsigned long)exp); 331 p = &master_help->helper->expect_policy[exp->class]; 332 exp->timeout.expires = jiffies + p->timeout * HZ; 333 add_timer(&exp->timeout); 334 335 atomic_inc(&exp->use); 336 NF_CT_STAT_INC(net, expect_create); 337} 338 339/* Race with expectations being used means we could have none to find; OK. */ 340static void evict_oldest_expect(struct nf_conn *master, 341 struct nf_conntrack_expect *new) 342{ 343 struct nf_conn_help *master_help = nfct_help(master); 344 struct nf_conntrack_expect *exp, *last = NULL; 345 struct hlist_node *n; 346 347 hlist_for_each_entry(exp, n, &master_help->expectations, lnode) { 348 if (exp->class == new->class) 349 last = exp; 350 } 351 352 if (last && del_timer(&last->timeout)) { 353 nf_ct_unlink_expect(last); 354 nf_ct_expect_put(last); 355 } 356} 357 358static inline int refresh_timer(struct nf_conntrack_expect *i) 359{ 360 struct nf_conn_help *master_help = nfct_help(i->master); 361 const struct nf_conntrack_expect_policy *p; 362 363 if (!del_timer(&i->timeout)) 364 return 0; 365 366 p = &master_help->helper->expect_policy[i->class]; 367 i->timeout.expires = jiffies + p->timeout * HZ; 368 add_timer(&i->timeout); 369 return 1; 370} 371 372static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect) 373{ 374 const struct nf_conntrack_expect_policy *p; 375 struct nf_conntrack_expect *i; 376 struct nf_conn *master = expect->master; 377 struct nf_conn_help *master_help = nfct_help(master); 378 struct net *net = nf_ct_exp_net(expect); 379 struct hlist_node *n; 380 unsigned int h; 381 int ret = 1; 382 383 if (!master_help->helper) { 384 ret = -ESHUTDOWN; 385 goto out; 386 } 387 h = nf_ct_expect_dst_hash(&expect->tuple); 388 hlist_for_each_entry(i, n, &net->ct.expect_hash[h], hnode) { 389 if (expect_matches(i, expect)) { 390 /* Refresh timer: if it's dying, ignore.. */ 391 if (refresh_timer(i)) { 392 ret = 0; 393 goto out; 394 } 395 } else if (expect_clash(i, expect)) { 396 ret = -EBUSY; 397 goto out; 398 } 399 } 400 /* Will be over limit? */ 401 p = &master_help->helper->expect_policy[expect->class]; 402 if (p->max_expected && 403 master_help->expecting[expect->class] >= p->max_expected) { 404 evict_oldest_expect(master, expect); 405 if (master_help->expecting[expect->class] >= p->max_expected) { 406 ret = -EMFILE; 407 goto out; 408 } 409 } 410 411 if (net->ct.expect_count >= nf_ct_expect_max) { 412 if (net_ratelimit()) 413 printk(KERN_WARNING 414 "nf_conntrack: expectation table full\n"); 415 ret = -EMFILE; 416 } 417out: 418 return ret; 419} 420 421int nf_ct_expect_related_report(struct nf_conntrack_expect *expect, 422 u32 pid, int report) 423{ 424 int ret; 425 426 spin_lock_bh(&nf_conntrack_lock); 427 ret = __nf_ct_expect_check(expect); 428 if (ret <= 0) 429 goto out; 430 431 ret = 0; 432 nf_ct_expect_insert(expect); 433 spin_unlock_bh(&nf_conntrack_lock); 434 nf_ct_expect_event_report(IPEXP_NEW, expect, pid, report); 435 return ret; 436out: 437 spin_unlock_bh(&nf_conntrack_lock); 438 return ret; 439} 440EXPORT_SYMBOL_GPL(nf_ct_expect_related_report); 441 442#ifdef CONFIG_PROC_FS 443struct ct_expect_iter_state { 444 struct seq_net_private p; 445 unsigned int bucket; 446}; 447 448static struct hlist_node *ct_expect_get_first(struct seq_file *seq) 449{ 450 struct net *net = seq_file_net(seq); 451 struct ct_expect_iter_state *st = seq->private; 452 struct hlist_node *n; 453 454 for (st->bucket = 0; st->bucket < nf_ct_expect_hsize; st->bucket++) { 455 n = rcu_dereference(net->ct.expect_hash[st->bucket].first); 456 if (n) 457 return n; 458 } 459 return NULL; 460} 461 462static struct hlist_node *ct_expect_get_next(struct seq_file *seq, 463 struct hlist_node *head) 464{ 465 struct net *net = seq_file_net(seq); 466 struct ct_expect_iter_state *st = seq->private; 467 468 head = rcu_dereference(head->next); 469 while (head == NULL) { 470 if (++st->bucket >= nf_ct_expect_hsize) 471 return NULL; 472 head = rcu_dereference(net->ct.expect_hash[st->bucket].first); 473 } 474 return head; 475} 476 477static struct hlist_node *ct_expect_get_idx(struct seq_file *seq, loff_t pos) 478{ 479 struct hlist_node *head = ct_expect_get_first(seq); 480 481 if (head) 482 while (pos && (head = ct_expect_get_next(seq, head))) 483 pos--; 484 return pos ? NULL : head; 485} 486 487static void *exp_seq_start(struct seq_file *seq, loff_t *pos) 488 __acquires(RCU) 489{ 490 rcu_read_lock(); 491 return ct_expect_get_idx(seq, *pos); 492} 493 494static void *exp_seq_next(struct seq_file *seq, void *v, loff_t *pos) 495{ 496 (*pos)++; 497 return ct_expect_get_next(seq, v); 498} 499 500static void exp_seq_stop(struct seq_file *seq, void *v) 501 __releases(RCU) 502{ 503 rcu_read_unlock(); 504} 505 506static int exp_seq_show(struct seq_file *s, void *v) 507{ 508 struct nf_conntrack_expect *expect; 509 struct nf_conntrack_helper *helper; 510 struct hlist_node *n = v; 511 char *delim = ""; 512 513 expect = hlist_entry(n, struct nf_conntrack_expect, hnode); 514 515 if (expect->timeout.function) 516 seq_printf(s, "%ld ", timer_pending(&expect->timeout) 517 ? (long)(expect->timeout.expires - jiffies)/HZ : 0); 518 else 519 seq_printf(s, "- "); 520 seq_printf(s, "l3proto = %u proto=%u ", 521 expect->tuple.src.l3num, 522 expect->tuple.dst.protonum); 523 print_tuple(s, &expect->tuple, 524 __nf_ct_l3proto_find(expect->tuple.src.l3num), 525 __nf_ct_l4proto_find(expect->tuple.src.l3num, 526 expect->tuple.dst.protonum)); 527 528 if (expect->flags & NF_CT_EXPECT_PERMANENT) { 529 seq_printf(s, "PERMANENT"); 530 delim = ","; 531 } 532 if (expect->flags & NF_CT_EXPECT_INACTIVE) 533 seq_printf(s, "%sINACTIVE", delim); 534 535 helper = rcu_dereference(nfct_help(expect->master)->helper); 536 if (helper) { 537 seq_printf(s, "%s%s", expect->flags ? " " : "", helper->name); 538 if (helper->expect_policy[expect->class].name) 539 seq_printf(s, "/%s", 540 helper->expect_policy[expect->class].name); 541 } 542 543 return seq_putc(s, '\n'); 544} 545 546static const struct seq_operations exp_seq_ops = { 547 .start = exp_seq_start, 548 .next = exp_seq_next, 549 .stop = exp_seq_stop, 550 .show = exp_seq_show 551}; 552 553static int exp_open(struct inode *inode, struct file *file) 554{ 555 return seq_open_net(inode, file, &exp_seq_ops, 556 sizeof(struct ct_expect_iter_state)); 557} 558 559static const struct file_operations exp_file_ops = { 560 .owner = THIS_MODULE, 561 .open = exp_open, 562 .read = seq_read, 563 .llseek = seq_lseek, 564 .release = seq_release_net, 565}; 566#endif /* CONFIG_PROC_FS */ 567 568static int exp_proc_init(struct net *net) 569{ 570#ifdef CONFIG_PROC_FS 571 struct proc_dir_entry *proc; 572 573 proc = proc_net_fops_create(net, "nf_conntrack_expect", 0440, &exp_file_ops); 574 if (!proc) 575 return -ENOMEM; 576#endif /* CONFIG_PROC_FS */ 577 return 0; 578} 579 580static void exp_proc_remove(struct net *net) 581{ 582#ifdef CONFIG_PROC_FS 583 proc_net_remove(net, "nf_conntrack_expect"); 584#endif /* CONFIG_PROC_FS */ 585} 586 587module_param_named(expect_hashsize, nf_ct_expect_hsize, uint, 0400); 588 589int nf_conntrack_expect_init(struct net *net) 590{ 591 int err = -ENOMEM; 592 593 if (net_eq(net, &init_net)) { 594 if (!nf_ct_expect_hsize) { 595 nf_ct_expect_hsize = net->ct.htable_size / 256; 596 if (!nf_ct_expect_hsize) 597 nf_ct_expect_hsize = 1; 598 } 599 nf_ct_expect_max = nf_ct_expect_hsize * 4; 600 } 601 602 net->ct.expect_count = 0; 603 net->ct.expect_hash = nf_ct_alloc_hashtable(&nf_ct_expect_hsize, 604 &net->ct.expect_vmalloc, 0); 605 if (net->ct.expect_hash == NULL) 606 goto err1; 607 608 if (net_eq(net, &init_net)) { 609 nf_ct_expect_cachep = kmem_cache_create("nf_conntrack_expect", 610 sizeof(struct nf_conntrack_expect), 611 0, 0, NULL); 612 if (!nf_ct_expect_cachep) 613 goto err2; 614 } 615 616 err = exp_proc_init(net); 617 if (err < 0) 618 goto err3; 619 620 return 0; 621 622err3: 623 if (net_eq(net, &init_net)) 624 kmem_cache_destroy(nf_ct_expect_cachep); 625err2: 626 nf_ct_free_hashtable(net->ct.expect_hash, net->ct.expect_vmalloc, 627 nf_ct_expect_hsize); 628err1: 629 return err; 630} 631 632void nf_conntrack_expect_fini(struct net *net) 633{ 634 exp_proc_remove(net); 635 if (net_eq(net, &init_net)) { 636 rcu_barrier(); /* Wait for call_rcu() before destroy */ 637 kmem_cache_destroy(nf_ct_expect_cachep); 638 } 639 nf_ct_free_hashtable(net->ct.expect_hash, net->ct.expect_vmalloc, 640 nf_ct_expect_hsize); 641} 642