1/* Helper handling for netfilter. */ 2 3/* (C) 1999-2001 Paul `Rusty' Russell 4 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org> 5 * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org> 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 as 9 * published by the Free Software Foundation. 10 */ 11 12#include <linux/types.h> 13#include <linux/netfilter.h> 14#include <linux/module.h> 15#include <linux/skbuff.h> 16#include <linux/vmalloc.h> 17#include <linux/stddef.h> 18#include <linux/random.h> 19#include <linux/err.h> 20#include <linux/kernel.h> 21#include <linux/netdevice.h> 22#include <linux/rculist.h> 23#include <linux/rtnetlink.h> 24 25#include <net/netfilter/nf_conntrack.h> 26#include <net/netfilter/nf_conntrack_l3proto.h> 27#include <net/netfilter/nf_conntrack_l4proto.h> 28#include <net/netfilter/nf_conntrack_helper.h> 29#include <net/netfilter/nf_conntrack_core.h> 30#include <net/netfilter/nf_conntrack_extend.h> 31 32static DEFINE_MUTEX(nf_ct_helper_mutex); 33static struct hlist_head *nf_ct_helper_hash __read_mostly; 34static unsigned int nf_ct_helper_hsize __read_mostly; 35static unsigned int nf_ct_helper_count __read_mostly; 36static int nf_ct_helper_vmalloc; 37 38 39/* Stupid hash, but collision free for the default registrations of the 40 * helpers currently in the kernel. */ 41static unsigned int helper_hash(const struct nf_conntrack_tuple *tuple) 42{ 43 return (((tuple->src.l3num << 8) | tuple->dst.protonum) ^ 44 (__force __u16)tuple->src.u.all) % nf_ct_helper_hsize; 45} 46 47static struct nf_conntrack_helper * 48__nf_ct_helper_find(const struct nf_conntrack_tuple *tuple) 49{ 50 struct nf_conntrack_helper *helper; 51 struct nf_conntrack_tuple_mask mask = { .src.u.all = htons(0xFFFF) }; 52 struct hlist_node *n; 53 unsigned int h; 54 55 if (!nf_ct_helper_count) 56 return NULL; 57 58 h = helper_hash(tuple); 59 hlist_for_each_entry_rcu(helper, n, &nf_ct_helper_hash[h], hnode) { 60 if (nf_ct_tuple_src_mask_cmp(tuple, &helper->tuple, &mask)) 61 return helper; 62 } 63 return NULL; 64} 65 66struct nf_conntrack_helper * 67__nf_conntrack_helper_find(const char *name, u16 l3num, u8 protonum) 68{ 69 struct nf_conntrack_helper *h; 70 struct hlist_node *n; 71 unsigned int i; 72 73 for (i = 0; i < nf_ct_helper_hsize; i++) { 74 hlist_for_each_entry_rcu(h, n, &nf_ct_helper_hash[i], hnode) { 75 if (!strcmp(h->name, name) && 76 h->tuple.src.l3num == l3num && 77 h->tuple.dst.protonum == protonum) 78 return h; 79 } 80 } 81 return NULL; 82} 83EXPORT_SYMBOL_GPL(__nf_conntrack_helper_find); 84 85struct nf_conntrack_helper * 86nf_conntrack_helper_try_module_get(const char *name, u16 l3num, u8 protonum) 87{ 88 struct nf_conntrack_helper *h; 89 90 h = __nf_conntrack_helper_find(name, l3num, protonum); 91#ifdef CONFIG_MODULES 92 if (h == NULL) { 93 if (request_module("nfct-helper-%s", name) == 0) 94 h = __nf_conntrack_helper_find(name, l3num, protonum); 95 } 96#endif 97 if (h != NULL && !try_module_get(h->me)) 98 h = NULL; 99 100 return h; 101} 102EXPORT_SYMBOL_GPL(nf_conntrack_helper_try_module_get); 103 104struct nf_conn_help *nf_ct_helper_ext_add(struct nf_conn *ct, gfp_t gfp) 105{ 106 struct nf_conn_help *help; 107 108 help = nf_ct_ext_add(ct, NF_CT_EXT_HELPER, gfp); 109 if (help) 110 INIT_HLIST_HEAD(&help->expectations); 111 else 112 pr_debug("failed to add helper extension area"); 113 return help; 114} 115EXPORT_SYMBOL_GPL(nf_ct_helper_ext_add); 116 117int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl, 118 gfp_t flags) 119{ 120 struct nf_conntrack_helper *helper = NULL; 121 struct nf_conn_help *help; 122 int ret = 0; 123 124 if (tmpl != NULL) { 125 help = nfct_help(tmpl); 126 if (help != NULL) 127 helper = help->helper; 128 } 129 130 help = nfct_help(ct); 131 if (helper == NULL) 132 helper = __nf_ct_helper_find(&ct->tuplehash[IP_CT_DIR_REPLY].tuple); 133 if (helper == NULL) { 134 if (help) 135 rcu_assign_pointer(help->helper, NULL); 136 goto out; 137 } 138 139 if (help == NULL) { 140 help = nf_ct_helper_ext_add(ct, flags); 141 if (help == NULL) { 142 ret = -ENOMEM; 143 goto out; 144 } 145 } else { 146 memset(&help->help, 0, sizeof(help->help)); 147 } 148 149 rcu_assign_pointer(help->helper, helper); 150out: 151 return ret; 152} 153EXPORT_SYMBOL_GPL(__nf_ct_try_assign_helper); 154 155static inline int unhelp(struct nf_conntrack_tuple_hash *i, 156 const struct nf_conntrack_helper *me) 157{ 158 struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(i); 159 struct nf_conn_help *help = nfct_help(ct); 160 161 if (help && help->helper == me) { 162 nf_conntrack_event(IPCT_HELPER, ct); 163 rcu_assign_pointer(help->helper, NULL); 164 } 165 return 0; 166} 167 168void nf_ct_helper_destroy(struct nf_conn *ct) 169{ 170 struct nf_conn_help *help = nfct_help(ct); 171 struct nf_conntrack_helper *helper; 172 173 if (help) { 174 rcu_read_lock(); 175 helper = rcu_dereference(help->helper); 176 if (helper && helper->destroy) 177 helper->destroy(ct); 178 rcu_read_unlock(); 179 } 180} 181 182int nf_conntrack_helper_register(struct nf_conntrack_helper *me) 183{ 184 unsigned int h = helper_hash(&me->tuple); 185 186 BUG_ON(me->expect_policy == NULL); 187 BUG_ON(me->expect_class_max >= NF_CT_MAX_EXPECT_CLASSES); 188 BUG_ON(strlen(me->name) > NF_CT_HELPER_NAME_LEN - 1); 189 190 mutex_lock(&nf_ct_helper_mutex); 191 hlist_add_head_rcu(&me->hnode, &nf_ct_helper_hash[h]); 192 nf_ct_helper_count++; 193 mutex_unlock(&nf_ct_helper_mutex); 194 195 return 0; 196} 197EXPORT_SYMBOL_GPL(nf_conntrack_helper_register); 198 199static void __nf_conntrack_helper_unregister(struct nf_conntrack_helper *me, 200 struct net *net) 201{ 202 struct nf_conntrack_tuple_hash *h; 203 struct nf_conntrack_expect *exp; 204 const struct hlist_node *n, *next; 205 const struct hlist_nulls_node *nn; 206 unsigned int i; 207 208 /* Get rid of expectations */ 209 for (i = 0; i < nf_ct_expect_hsize; i++) { 210 hlist_for_each_entry_safe(exp, n, next, 211 &net->ct.expect_hash[i], hnode) { 212 struct nf_conn_help *help = nfct_help(exp->master); 213 if ((help->helper == me || exp->helper == me) && 214 del_timer(&exp->timeout)) { 215 nf_ct_unlink_expect(exp); 216 nf_ct_expect_put(exp); 217 } 218 } 219 } 220 221 /* Get rid of expecteds, set helpers to NULL. */ 222 hlist_nulls_for_each_entry(h, nn, &net->ct.unconfirmed, hnnode) 223 unhelp(h, me); 224 for (i = 0; i < net->ct.htable_size; i++) { 225 hlist_nulls_for_each_entry(h, nn, &net->ct.hash[i], hnnode) 226 unhelp(h, me); 227 } 228} 229 230void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me) 231{ 232 struct net *net; 233 234 mutex_lock(&nf_ct_helper_mutex); 235 hlist_del_rcu(&me->hnode); 236 nf_ct_helper_count--; 237 mutex_unlock(&nf_ct_helper_mutex); 238 239 /* Make sure every nothing is still using the helper unless its a 240 * connection in the hash. 241 */ 242 synchronize_rcu(); 243 244 rtnl_lock(); 245 spin_lock_bh(&nf_conntrack_lock); 246 for_each_net(net) 247 __nf_conntrack_helper_unregister(me, net); 248 spin_unlock_bh(&nf_conntrack_lock); 249 rtnl_unlock(); 250} 251EXPORT_SYMBOL_GPL(nf_conntrack_helper_unregister); 252 253static struct nf_ct_ext_type helper_extend __read_mostly = { 254 .len = sizeof(struct nf_conn_help), 255 .align = __alignof__(struct nf_conn_help), 256 .id = NF_CT_EXT_HELPER, 257}; 258 259int nf_conntrack_helper_init(void) 260{ 261 int err; 262 263 nf_ct_helper_hsize = 1; /* gets rounded up to use one page */ 264 nf_ct_helper_hash = nf_ct_alloc_hashtable(&nf_ct_helper_hsize, 265 &nf_ct_helper_vmalloc, 0); 266 if (!nf_ct_helper_hash) 267 return -ENOMEM; 268 269 err = nf_ct_extend_register(&helper_extend); 270 if (err < 0) 271 goto err1; 272 273 return 0; 274 275err1: 276 nf_ct_free_hashtable(nf_ct_helper_hash, nf_ct_helper_vmalloc, 277 nf_ct_helper_hsize); 278 return err; 279} 280 281void nf_conntrack_helper_fini(void) 282{ 283 nf_ct_extend_unregister(&helper_extend); 284 nf_ct_free_hashtable(nf_ct_helper_hash, nf_ct_helper_vmalloc, 285 nf_ct_helper_hsize); 286} 287