nf_conntrack_helper.c revision 9858a3ae1d4b390fbaa9c30b83cb66d861b76294
1/* Helper handling for netfilter. */ 2 3/* (C) 1999-2001 Paul `Rusty' Russell 4 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org> 5 * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org> 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 as 9 * published by the Free Software Foundation. 10 */ 11 12#include <linux/types.h> 13#include <linux/netfilter.h> 14#include <linux/module.h> 15#include <linux/skbuff.h> 16#include <linux/vmalloc.h> 17#include <linux/stddef.h> 18#include <linux/slab.h> 19#include <linux/random.h> 20#include <linux/err.h> 21#include <linux/kernel.h> 22#include <linux/netdevice.h> 23#include <linux/rculist.h> 24#include <linux/rtnetlink.h> 25 26#include <net/netfilter/nf_conntrack.h> 27#include <net/netfilter/nf_conntrack_l3proto.h> 28#include <net/netfilter/nf_conntrack_l4proto.h> 29#include <net/netfilter/nf_conntrack_helper.h> 30#include <net/netfilter/nf_conntrack_core.h> 31#include <net/netfilter/nf_conntrack_extend.h> 32 33static DEFINE_MUTEX(nf_ct_helper_mutex); 34static struct hlist_head *nf_ct_helper_hash __read_mostly; 35static unsigned int nf_ct_helper_hsize __read_mostly; 36static unsigned int nf_ct_helper_count __read_mostly; 37static int nf_ct_helper_vmalloc; 38 39 40/* Stupid hash, but collision free for the default registrations of the 41 * helpers currently in the kernel. */ 42static unsigned int helper_hash(const struct nf_conntrack_tuple *tuple) 43{ 44 return (((tuple->src.l3num << 8) | tuple->dst.protonum) ^ 45 (__force __u16)tuple->src.u.all) % nf_ct_helper_hsize; 46} 47 48static struct nf_conntrack_helper * 49__nf_ct_helper_find(const struct nf_conntrack_tuple *tuple) 50{ 51 struct nf_conntrack_helper *helper; 52 struct nf_conntrack_tuple_mask mask = { .src.u.all = htons(0xFFFF) }; 53 struct hlist_node *n; 54 unsigned int h; 55 56 if (!nf_ct_helper_count) 57 return NULL; 58 59 h = helper_hash(tuple); 60 hlist_for_each_entry_rcu(helper, n, &nf_ct_helper_hash[h], hnode) { 61 if (nf_ct_tuple_src_mask_cmp(tuple, &helper->tuple, &mask)) 62 return helper; 63 } 64 return NULL; 65} 66 67struct nf_conntrack_helper * 68__nf_conntrack_helper_find_byname(const char *name) 69{ 70 struct nf_conntrack_helper *h; 71 struct hlist_node *n; 72 unsigned int i; 73 74 for (i = 0; i < nf_ct_helper_hsize; i++) { 75 hlist_for_each_entry_rcu(h, n, &nf_ct_helper_hash[i], hnode) { 76 if (!strcmp(h->name, name)) 77 return h; 78 } 79 } 80 return NULL; 81} 82EXPORT_SYMBOL_GPL(__nf_conntrack_helper_find_byname); 83 84struct nf_conn_help *nf_ct_helper_ext_add(struct nf_conn *ct, gfp_t gfp) 85{ 86 struct nf_conn_help *help; 87 88 help = nf_ct_ext_add(ct, NF_CT_EXT_HELPER, gfp); 89 if (help) 90 INIT_HLIST_HEAD(&help->expectations); 91 else 92 pr_debug("failed to add helper extension area"); 93 return help; 94} 95EXPORT_SYMBOL_GPL(nf_ct_helper_ext_add); 96 97int __nf_ct_try_assign_helper(struct nf_conn *ct, gfp_t flags) 98{ 99 int ret = 0; 100 struct nf_conntrack_helper *helper; 101 struct nf_conn_help *help = nfct_help(ct); 102 103 helper = __nf_ct_helper_find(&ct->tuplehash[IP_CT_DIR_REPLY].tuple); 104 if (helper == NULL) { 105 if (help) 106 rcu_assign_pointer(help->helper, NULL); 107 goto out; 108 } 109 110 if (help == NULL) { 111 help = nf_ct_helper_ext_add(ct, flags); 112 if (help == NULL) { 113 ret = -ENOMEM; 114 goto out; 115 } 116 } else { 117 memset(&help->help, 0, sizeof(help->help)); 118 } 119 120 rcu_assign_pointer(help->helper, helper); 121out: 122 return ret; 123} 124EXPORT_SYMBOL_GPL(__nf_ct_try_assign_helper); 125 126static inline int unhelp(struct nf_conntrack_tuple_hash *i, 127 const struct nf_conntrack_helper *me) 128{ 129 struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(i); 130 struct nf_conn_help *help = nfct_help(ct); 131 132 if (help && help->helper == me) { 133 nf_conntrack_event(IPCT_HELPER, ct); 134 rcu_assign_pointer(help->helper, NULL); 135 } 136 return 0; 137} 138 139void nf_ct_helper_destroy(struct nf_conn *ct) 140{ 141 struct nf_conn_help *help = nfct_help(ct); 142 struct nf_conntrack_helper *helper; 143 144 if (help) { 145 rcu_read_lock(); 146 helper = rcu_dereference(help->helper); 147 if (helper && helper->destroy) 148 helper->destroy(ct); 149 rcu_read_unlock(); 150 } 151} 152 153int nf_conntrack_helper_register(struct nf_conntrack_helper *me) 154{ 155 unsigned int h = helper_hash(&me->tuple); 156 157 BUG_ON(me->expect_policy == NULL); 158 BUG_ON(me->expect_class_max >= NF_CT_MAX_EXPECT_CLASSES); 159 BUG_ON(strlen(me->name) > NF_CT_HELPER_NAME_LEN - 1); 160 161 mutex_lock(&nf_ct_helper_mutex); 162 hlist_add_head_rcu(&me->hnode, &nf_ct_helper_hash[h]); 163 nf_ct_helper_count++; 164 mutex_unlock(&nf_ct_helper_mutex); 165 166 return 0; 167} 168EXPORT_SYMBOL_GPL(nf_conntrack_helper_register); 169 170static void __nf_conntrack_helper_unregister(struct nf_conntrack_helper *me, 171 struct net *net) 172{ 173 struct nf_conntrack_tuple_hash *h; 174 struct nf_conntrack_expect *exp; 175 const struct hlist_node *n, *next; 176 const struct hlist_nulls_node *nn; 177 unsigned int i; 178 179 /* Get rid of expectations */ 180 for (i = 0; i < nf_ct_expect_hsize; i++) { 181 hlist_for_each_entry_safe(exp, n, next, 182 &net->ct.expect_hash[i], hnode) { 183 struct nf_conn_help *help = nfct_help(exp->master); 184 if ((help->helper == me || exp->helper == me) && 185 del_timer(&exp->timeout)) { 186 nf_ct_unlink_expect(exp); 187 nf_ct_expect_put(exp); 188 } 189 } 190 } 191 192 /* Get rid of expecteds, set helpers to NULL. */ 193 hlist_nulls_for_each_entry(h, nn, &net->ct.unconfirmed, hnnode) 194 unhelp(h, me); 195 for (i = 0; i < nf_conntrack_htable_size; i++) { 196 hlist_nulls_for_each_entry(h, nn, &net->ct.hash[i], hnnode) 197 unhelp(h, me); 198 } 199} 200 201void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me) 202{ 203 struct net *net; 204 205 mutex_lock(&nf_ct_helper_mutex); 206 hlist_del_rcu(&me->hnode); 207 nf_ct_helper_count--; 208 mutex_unlock(&nf_ct_helper_mutex); 209 210 /* Make sure every nothing is still using the helper unless its a 211 * connection in the hash. 212 */ 213 synchronize_rcu(); 214 215 rtnl_lock(); 216 spin_lock_bh(&nf_conntrack_lock); 217 for_each_net(net) 218 __nf_conntrack_helper_unregister(me, net); 219 spin_unlock_bh(&nf_conntrack_lock); 220 rtnl_unlock(); 221} 222EXPORT_SYMBOL_GPL(nf_conntrack_helper_unregister); 223 224static struct nf_ct_ext_type helper_extend __read_mostly = { 225 .len = sizeof(struct nf_conn_help), 226 .align = __alignof__(struct nf_conn_help), 227 .id = NF_CT_EXT_HELPER, 228}; 229 230int nf_conntrack_helper_init(void) 231{ 232 int err; 233 234 nf_ct_helper_hsize = 1; /* gets rounded up to use one page */ 235 nf_ct_helper_hash = nf_ct_alloc_hashtable(&nf_ct_helper_hsize, 236 &nf_ct_helper_vmalloc, 0); 237 if (!nf_ct_helper_hash) 238 return -ENOMEM; 239 240 err = nf_ct_extend_register(&helper_extend); 241 if (err < 0) 242 goto err1; 243 244 return 0; 245 246err1: 247 nf_ct_free_hashtable(nf_ct_helper_hash, nf_ct_helper_vmalloc, 248 nf_ct_helper_hsize); 249 return err; 250} 251 252void nf_conntrack_helper_fini(void) 253{ 254 nf_ct_extend_unregister(&helper_extend); 255 nf_ct_free_hashtable(nf_ct_helper_hash, nf_ct_helper_vmalloc, 256 nf_ct_helper_hsize); 257} 258