nf_conntrack_helper.c revision 226c0c0ef2abdf91b8d9cce1aaf7d4635a5e5926
1/* Helper handling for netfilter. */ 2 3/* (C) 1999-2001 Paul `Rusty' Russell 4 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org> 5 * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org> 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 as 9 * published by the Free Software Foundation. 10 */ 11 12#include <linux/types.h> 13#include <linux/netfilter.h> 14#include <linux/module.h> 15#include <linux/skbuff.h> 16#include <linux/vmalloc.h> 17#include <linux/stddef.h> 18#include <linux/slab.h> 19#include <linux/random.h> 20#include <linux/err.h> 21#include <linux/kernel.h> 22#include <linux/netdevice.h> 23#include <linux/rculist.h> 24 25#include <net/netfilter/nf_conntrack.h> 26#include <net/netfilter/nf_conntrack_l3proto.h> 27#include <net/netfilter/nf_conntrack_l4proto.h> 28#include <net/netfilter/nf_conntrack_helper.h> 29#include <net/netfilter/nf_conntrack_core.h> 30#include <net/netfilter/nf_conntrack_extend.h> 31 32static DEFINE_MUTEX(nf_ct_helper_mutex); 33static struct hlist_head *nf_ct_helper_hash __read_mostly; 34static unsigned int nf_ct_helper_hsize __read_mostly; 35static unsigned int nf_ct_helper_count __read_mostly; 36static int nf_ct_helper_vmalloc; 37 38 39/* Stupid hash, but collision free for the default registrations of the 40 * helpers currently in the kernel. */ 41static unsigned int helper_hash(const struct nf_conntrack_tuple *tuple) 42{ 43 return (((tuple->src.l3num << 8) | tuple->dst.protonum) ^ 44 (__force __u16)tuple->src.u.all) % nf_ct_helper_hsize; 45} 46 47static struct nf_conntrack_helper * 48__nf_ct_helper_find(const struct nf_conntrack_tuple *tuple) 49{ 50 struct nf_conntrack_helper *helper; 51 struct nf_conntrack_tuple_mask mask = { .src.u.all = htons(0xFFFF) }; 52 struct hlist_node *n; 53 unsigned int h; 54 55 if (!nf_ct_helper_count) 56 return NULL; 57 58 h = helper_hash(tuple); 59 hlist_for_each_entry_rcu(helper, n, &nf_ct_helper_hash[h], hnode) { 60 if (nf_ct_tuple_src_mask_cmp(tuple, &helper->tuple, &mask)) 61 return helper; 62 } 63 return NULL; 64} 65 66struct nf_conntrack_helper * 67__nf_conntrack_helper_find_byname(const char *name) 68{ 69 struct nf_conntrack_helper *h; 70 struct hlist_node *n; 71 unsigned int i; 72 73 for (i = 0; i < nf_ct_helper_hsize; i++) { 74 hlist_for_each_entry_rcu(h, n, &nf_ct_helper_hash[i], hnode) { 75 if (!strcmp(h->name, name)) 76 return h; 77 } 78 } 79 return NULL; 80} 81EXPORT_SYMBOL_GPL(__nf_conntrack_helper_find_byname); 82 83struct nf_conn_help *nf_ct_helper_ext_add(struct nf_conn *ct, gfp_t gfp) 84{ 85 struct nf_conn_help *help; 86 87 help = nf_ct_ext_add(ct, NF_CT_EXT_HELPER, gfp); 88 if (help) 89 INIT_HLIST_HEAD(&help->expectations); 90 else 91 pr_debug("failed to add helper extension area"); 92 return help; 93} 94EXPORT_SYMBOL_GPL(nf_ct_helper_ext_add); 95 96int __nf_ct_try_assign_helper(struct nf_conn *ct, gfp_t flags) 97{ 98 int ret = 0; 99 struct nf_conntrack_helper *helper; 100 struct nf_conn_help *help = nfct_help(ct); 101 102 helper = __nf_ct_helper_find(&ct->tuplehash[IP_CT_DIR_REPLY].tuple); 103 if (helper == NULL) { 104 if (help) 105 rcu_assign_pointer(help->helper, NULL); 106 goto out; 107 } 108 109 if (help == NULL) { 110 help = nf_ct_helper_ext_add(ct, flags); 111 if (help == NULL) { 112 ret = -ENOMEM; 113 goto out; 114 } 115 } else { 116 memset(&help->help, 0, sizeof(help->help)); 117 } 118 119 rcu_assign_pointer(help->helper, helper); 120out: 121 return ret; 122} 123EXPORT_SYMBOL_GPL(__nf_ct_try_assign_helper); 124 125static inline int unhelp(struct nf_conntrack_tuple_hash *i, 126 const struct nf_conntrack_helper *me) 127{ 128 struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(i); 129 struct nf_conn_help *help = nfct_help(ct); 130 131 if (help && help->helper == me) { 132 nf_conntrack_event(IPCT_HELPER, ct); 133 rcu_assign_pointer(help->helper, NULL); 134 } 135 return 0; 136} 137 138int nf_conntrack_helper_register(struct nf_conntrack_helper *me) 139{ 140 unsigned int h = helper_hash(&me->tuple); 141 142 BUG_ON(me->expect_policy == NULL); 143 BUG_ON(me->expect_class_max >= NF_CT_MAX_EXPECT_CLASSES); 144 145 mutex_lock(&nf_ct_helper_mutex); 146 hlist_add_head_rcu(&me->hnode, &nf_ct_helper_hash[h]); 147 nf_ct_helper_count++; 148 mutex_unlock(&nf_ct_helper_mutex); 149 150 return 0; 151} 152EXPORT_SYMBOL_GPL(nf_conntrack_helper_register); 153 154static void __nf_conntrack_helper_unregister(struct nf_conntrack_helper *me, 155 struct net *net) 156{ 157 struct nf_conntrack_tuple_hash *h; 158 struct nf_conntrack_expect *exp; 159 const struct hlist_node *n, *next; 160 unsigned int i; 161 162 /* Get rid of expectations */ 163 for (i = 0; i < nf_ct_expect_hsize; i++) { 164 hlist_for_each_entry_safe(exp, n, next, 165 &net->ct.expect_hash[i], hnode) { 166 struct nf_conn_help *help = nfct_help(exp->master); 167 if ((help->helper == me || exp->helper == me) && 168 del_timer(&exp->timeout)) { 169 nf_ct_unlink_expect(exp); 170 nf_ct_expect_put(exp); 171 } 172 } 173 } 174 175 /* Get rid of expecteds, set helpers to NULL. */ 176 hlist_for_each_entry(h, n, &net->ct.unconfirmed, hnode) 177 unhelp(h, me); 178 for (i = 0; i < nf_conntrack_htable_size; i++) { 179 hlist_for_each_entry(h, n, &net->ct.hash[i], hnode) 180 unhelp(h, me); 181 } 182} 183 184void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me) 185{ 186 struct net *net; 187 188 mutex_lock(&nf_ct_helper_mutex); 189 hlist_del_rcu(&me->hnode); 190 nf_ct_helper_count--; 191 mutex_unlock(&nf_ct_helper_mutex); 192 193 /* Make sure every nothing is still using the helper unless its a 194 * connection in the hash. 195 */ 196 synchronize_rcu(); 197 198 spin_lock_bh(&nf_conntrack_lock); 199 for_each_net(net) 200 __nf_conntrack_helper_unregister(me, net); 201 spin_unlock_bh(&nf_conntrack_lock); 202} 203EXPORT_SYMBOL_GPL(nf_conntrack_helper_unregister); 204 205static struct nf_ct_ext_type helper_extend __read_mostly = { 206 .len = sizeof(struct nf_conn_help), 207 .align = __alignof__(struct nf_conn_help), 208 .id = NF_CT_EXT_HELPER, 209}; 210 211int nf_conntrack_helper_init(void) 212{ 213 int err; 214 215 nf_ct_helper_hsize = 1; /* gets rounded up to use one page */ 216 nf_ct_helper_hash = nf_ct_alloc_hashtable(&nf_ct_helper_hsize, 217 &nf_ct_helper_vmalloc); 218 if (!nf_ct_helper_hash) 219 return -ENOMEM; 220 221 err = nf_ct_extend_register(&helper_extend); 222 if (err < 0) 223 goto err1; 224 225 return 0; 226 227err1: 228 nf_ct_free_hashtable(nf_ct_helper_hash, nf_ct_helper_vmalloc, 229 nf_ct_helper_hsize); 230 return err; 231} 232 233void nf_conntrack_helper_fini(void) 234{ 235 nf_ct_extend_unregister(&helper_extend); 236 nf_ct_free_hashtable(nf_ct_helper_hash, nf_ct_helper_vmalloc, 237 nf_ct_helper_hsize); 238} 239