linux/net/netfilter/nf_conntrack_proto.c
<<
>>
Prefs
   1/* L3/L4 protocol support for nf_conntrack. */
   2
   3/* (C) 1999-2001 Paul `Rusty' Russell
   4 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
   5 * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
   6 *
   7 * This program is free software; you can redistribute it and/or modify
   8 * it under the terms of the GNU General Public License version 2 as
   9 * published by the Free Software Foundation.
  10 */
  11
  12#include <linux/types.h>
  13#include <linux/netfilter.h>
  14#include <linux/module.h>
  15#include <linux/mutex.h>
  16#include <linux/skbuff.h>
  17#include <linux/vmalloc.h>
  18#include <linux/stddef.h>
  19#include <linux/err.h>
  20#include <linux/percpu.h>
  21#include <linux/moduleparam.h>
  22#include <linux/notifier.h>
  23#include <linux/kernel.h>
  24#include <linux/netdevice.h>
  25#include <linux/rtnetlink.h>
  26
  27#include <net/netfilter/nf_conntrack.h>
  28#include <net/netfilter/nf_conntrack_l3proto.h>
  29#include <net/netfilter/nf_conntrack_l4proto.h>
  30#include <net/netfilter/nf_conntrack_core.h>
  31
  32static struct nf_conntrack_l4proto **nf_ct_protos[PF_MAX] __read_mostly;
  33struct nf_conntrack_l3proto *nf_ct_l3protos[AF_MAX] __read_mostly;
  34EXPORT_SYMBOL_GPL(nf_ct_l3protos);
  35
  36static DEFINE_MUTEX(nf_ct_proto_mutex);
  37
  38#ifdef CONFIG_SYSCTL
  39static int
  40nf_ct_register_sysctl(struct ctl_table_header **header, struct ctl_path *path,
  41                      struct ctl_table *table, unsigned int *users)
  42{
  43        if (*header == NULL) {
  44                *header = register_sysctl_paths(path, table);
  45                if (*header == NULL)
  46                        return -ENOMEM;
  47        }
  48        if (users != NULL)
  49                (*users)++;
  50        return 0;
  51}
  52
  53static void
  54nf_ct_unregister_sysctl(struct ctl_table_header **header,
  55                        struct ctl_table *table, unsigned int *users)
  56{
  57        if (users != NULL && --*users > 0)
  58                return;
  59
  60        unregister_sysctl_table(*header);
  61        *header = NULL;
  62}
  63#endif
  64
  65struct nf_conntrack_l4proto *
  66__nf_ct_l4proto_find(u_int16_t l3proto, u_int8_t l4proto)
  67{
  68        if (unlikely(l3proto >= AF_MAX || nf_ct_protos[l3proto] == NULL))
  69                return &nf_conntrack_l4proto_generic;
  70
  71        return rcu_dereference(nf_ct_protos[l3proto][l4proto]);
  72}
  73EXPORT_SYMBOL_GPL(__nf_ct_l4proto_find);
  74
  75/* this is guaranteed to always return a valid protocol helper, since
  76 * it falls back to generic_protocol */
  77struct nf_conntrack_l4proto *
  78nf_ct_l4proto_find_get(u_int16_t l3proto, u_int8_t l4proto)
  79{
  80        struct nf_conntrack_l4proto *p;
  81
  82        rcu_read_lock();
  83        p = __nf_ct_l4proto_find(l3proto, l4proto);
  84        if (!try_module_get(p->me))
  85                p = &nf_conntrack_l4proto_generic;
  86        rcu_read_unlock();
  87
  88        return p;
  89}
  90EXPORT_SYMBOL_GPL(nf_ct_l4proto_find_get);
  91
  92void nf_ct_l4proto_put(struct nf_conntrack_l4proto *p)
  93{
  94        module_put(p->me);
  95}
  96EXPORT_SYMBOL_GPL(nf_ct_l4proto_put);
  97
  98struct nf_conntrack_l3proto *
  99nf_ct_l3proto_find_get(u_int16_t l3proto)
 100{
 101        struct nf_conntrack_l3proto *p;
 102
 103        rcu_read_lock();
 104        p = __nf_ct_l3proto_find(l3proto);
 105        if (!try_module_get(p->me))
 106                p = &nf_conntrack_l3proto_generic;
 107        rcu_read_unlock();
 108
 109        return p;
 110}
 111EXPORT_SYMBOL_GPL(nf_ct_l3proto_find_get);
 112
 113void nf_ct_l3proto_put(struct nf_conntrack_l3proto *p)
 114{
 115        module_put(p->me);
 116}
 117EXPORT_SYMBOL_GPL(nf_ct_l3proto_put);
 118
 119int
 120nf_ct_l3proto_try_module_get(unsigned short l3proto)
 121{
 122        int ret;
 123        struct nf_conntrack_l3proto *p;
 124
 125retry:  p = nf_ct_l3proto_find_get(l3proto);
 126        if (p == &nf_conntrack_l3proto_generic) {
 127                ret = request_module("nf_conntrack-%d", l3proto);
 128                if (!ret)
 129                        goto retry;
 130
 131                return -EPROTOTYPE;
 132        }
 133
 134        return 0;
 135}
 136EXPORT_SYMBOL_GPL(nf_ct_l3proto_try_module_get);
 137
 138void nf_ct_l3proto_module_put(unsigned short l3proto)
 139{
 140        struct nf_conntrack_l3proto *p;
 141
 142        /* rcu_read_lock not necessary since the caller holds a reference */
 143        p = __nf_ct_l3proto_find(l3proto);
 144        module_put(p->me);
 145}
 146EXPORT_SYMBOL_GPL(nf_ct_l3proto_module_put);
 147
 148static int kill_l3proto(struct nf_conn *i, void *data)
 149{
 150        return nf_ct_l3num(i) == ((struct nf_conntrack_l3proto *)data)->l3proto;
 151}
 152
 153static int kill_l4proto(struct nf_conn *i, void *data)
 154{
 155        struct nf_conntrack_l4proto *l4proto;
 156        l4proto = (struct nf_conntrack_l4proto *)data;
 157        return nf_ct_protonum(i) == l4proto->l4proto &&
 158               nf_ct_l3num(i) == l4proto->l3proto;
 159}
 160
 161static int nf_ct_l3proto_register_sysctl(struct nf_conntrack_l3proto *l3proto)
 162{
 163        int err = 0;
 164
 165#ifdef CONFIG_SYSCTL
 166        if (l3proto->ctl_table != NULL) {
 167                err = nf_ct_register_sysctl(&l3proto->ctl_table_header,
 168                                            l3proto->ctl_table_path,
 169                                            l3proto->ctl_table, NULL);
 170        }
 171#endif
 172        return err;
 173}
 174
 175static void nf_ct_l3proto_unregister_sysctl(struct nf_conntrack_l3proto *l3proto)
 176{
 177#ifdef CONFIG_SYSCTL
 178        if (l3proto->ctl_table_header != NULL)
 179                nf_ct_unregister_sysctl(&l3proto->ctl_table_header,
 180                                        l3proto->ctl_table, NULL);
 181#endif
 182}
 183
 184int nf_conntrack_l3proto_register(struct nf_conntrack_l3proto *proto)
 185{
 186        int ret = 0;
 187
 188        if (proto->l3proto >= AF_MAX)
 189                return -EBUSY;
 190
 191        mutex_lock(&nf_ct_proto_mutex);
 192        if (nf_ct_l3protos[proto->l3proto] != &nf_conntrack_l3proto_generic) {
 193                ret = -EBUSY;
 194                goto out_unlock;
 195        }
 196
 197        ret = nf_ct_l3proto_register_sysctl(proto);
 198        if (ret < 0)
 199                goto out_unlock;
 200
 201        rcu_assign_pointer(nf_ct_l3protos[proto->l3proto], proto);
 202
 203out_unlock:
 204        mutex_unlock(&nf_ct_proto_mutex);
 205        return ret;
 206}
 207EXPORT_SYMBOL_GPL(nf_conntrack_l3proto_register);
 208
 209void nf_conntrack_l3proto_unregister(struct nf_conntrack_l3proto *proto)
 210{
 211        struct net *net;
 212
 213        BUG_ON(proto->l3proto >= AF_MAX);
 214
 215        mutex_lock(&nf_ct_proto_mutex);
 216        BUG_ON(nf_ct_l3protos[proto->l3proto] != proto);
 217        rcu_assign_pointer(nf_ct_l3protos[proto->l3proto],
 218                           &nf_conntrack_l3proto_generic);
 219        nf_ct_l3proto_unregister_sysctl(proto);
 220        mutex_unlock(&nf_ct_proto_mutex);
 221
 222        synchronize_rcu();
 223
 224        /* Remove all contrack entries for this protocol */
 225        rtnl_lock();
 226        for_each_net(net)
 227                nf_ct_iterate_cleanup(net, kill_l3proto, proto);
 228        rtnl_unlock();
 229}
 230EXPORT_SYMBOL_GPL(nf_conntrack_l3proto_unregister);
 231
 232static int nf_ct_l4proto_register_sysctl(struct nf_conntrack_l4proto *l4proto)
 233{
 234        int err = 0;
 235
 236#ifdef CONFIG_SYSCTL
 237        if (l4proto->ctl_table != NULL) {
 238                err = nf_ct_register_sysctl(l4proto->ctl_table_header,
 239                                            nf_net_netfilter_sysctl_path,
 240                                            l4proto->ctl_table,
 241                                            l4proto->ctl_table_users);
 242                if (err < 0)
 243                        goto out;
 244        }
 245#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
 246        if (l4proto->ctl_compat_table != NULL) {
 247                err = nf_ct_register_sysctl(&l4proto->ctl_compat_table_header,
 248                                            nf_net_ipv4_netfilter_sysctl_path,
 249                                            l4proto->ctl_compat_table, NULL);
 250                if (err == 0)
 251                        goto out;
 252                nf_ct_unregister_sysctl(l4proto->ctl_table_header,
 253                                        l4proto->ctl_table,
 254                                        l4proto->ctl_table_users);
 255        }
 256#endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
 257out:
 258#endif /* CONFIG_SYSCTL */
 259        return err;
 260}
 261
 262static void nf_ct_l4proto_unregister_sysctl(struct nf_conntrack_l4proto *l4proto)
 263{
 264#ifdef CONFIG_SYSCTL
 265        if (l4proto->ctl_table_header != NULL &&
 266            *l4proto->ctl_table_header != NULL)
 267                nf_ct_unregister_sysctl(l4proto->ctl_table_header,
 268                                        l4proto->ctl_table,
 269                                        l4proto->ctl_table_users);
 270#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
 271        if (l4proto->ctl_compat_table_header != NULL)
 272                nf_ct_unregister_sysctl(&l4proto->ctl_compat_table_header,
 273                                        l4proto->ctl_compat_table, NULL);
 274#endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
 275#endif /* CONFIG_SYSCTL */
 276}
 277
 278/* FIXME: Allow NULL functions and sub in pointers to generic for
 279   them. --RR */
 280int nf_conntrack_l4proto_register(struct nf_conntrack_l4proto *l4proto)
 281{
 282        int ret = 0;
 283
 284        if (l4proto->l3proto >= PF_MAX)
 285                return -EBUSY;
 286
 287        mutex_lock(&nf_ct_proto_mutex);
 288        if (!nf_ct_protos[l4proto->l3proto]) {
 289                /* l3proto may be loaded latter. */
 290                struct nf_conntrack_l4proto **proto_array;
 291                int i;
 292
 293                proto_array = kmalloc(MAX_NF_CT_PROTO *
 294                                      sizeof(struct nf_conntrack_l4proto *),
 295                                      GFP_KERNEL);
 296                if (proto_array == NULL) {
 297                        ret = -ENOMEM;
 298                        goto out_unlock;
 299                }
 300
 301                for (i = 0; i < MAX_NF_CT_PROTO; i++)
 302                        proto_array[i] = &nf_conntrack_l4proto_generic;
 303                nf_ct_protos[l4proto->l3proto] = proto_array;
 304        } else if (nf_ct_protos[l4proto->l3proto][l4proto->l4proto] !=
 305                                        &nf_conntrack_l4proto_generic) {
 306                ret = -EBUSY;
 307                goto out_unlock;
 308        }
 309
 310        ret = nf_ct_l4proto_register_sysctl(l4proto);
 311        if (ret < 0)
 312                goto out_unlock;
 313
 314        rcu_assign_pointer(nf_ct_protos[l4proto->l3proto][l4proto->l4proto],
 315                           l4proto);
 316
 317out_unlock:
 318        mutex_unlock(&nf_ct_proto_mutex);
 319        return ret;
 320}
 321EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_register);
 322
 323void nf_conntrack_l4proto_unregister(struct nf_conntrack_l4proto *l4proto)
 324{
 325        struct net *net;
 326
 327        BUG_ON(l4proto->l3proto >= PF_MAX);
 328
 329        mutex_lock(&nf_ct_proto_mutex);
 330        BUG_ON(nf_ct_protos[l4proto->l3proto][l4proto->l4proto] != l4proto);
 331        rcu_assign_pointer(nf_ct_protos[l4proto->l3proto][l4proto->l4proto],
 332                           &nf_conntrack_l4proto_generic);
 333        nf_ct_l4proto_unregister_sysctl(l4proto);
 334        mutex_unlock(&nf_ct_proto_mutex);
 335
 336        synchronize_rcu();
 337
 338        /* Remove all contrack entries for this protocol */
 339        rtnl_lock();
 340        for_each_net(net)
 341                nf_ct_iterate_cleanup(net, kill_l4proto, l4proto);
 342        rtnl_unlock();
 343}
 344EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_unregister);
 345
 346int nf_conntrack_proto_init(void)
 347{
 348        unsigned int i;
 349        int err;
 350
 351        err = nf_ct_l4proto_register_sysctl(&nf_conntrack_l4proto_generic);
 352        if (err < 0)
 353                return err;
 354
 355        for (i = 0; i < AF_MAX; i++)
 356                rcu_assign_pointer(nf_ct_l3protos[i],
 357                                   &nf_conntrack_l3proto_generic);
 358        return 0;
 359}
 360
 361void nf_conntrack_proto_fini(void)
 362{
 363        unsigned int i;
 364
 365        nf_ct_l4proto_unregister_sysctl(&nf_conntrack_l4proto_generic);
 366
 367        /* free l3proto protocol tables */
 368        for (i = 0; i < PF_MAX; i++)
 369                kfree(nf_ct_protos[i]);
 370}
 371