net/netfilter/nf_conntrack_proto.c

   1 /* L3/L4 protocol support for nf_conntrack. */
   2
   3 /* (C) 1999-2001 Paul `Rusty' Russell
   4  * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
   5  * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2 as
   9  * published by the Free Software Foundation.
  10  */
  11
  12 #include <linux/types.h>
  13 #include <linux/netfilter.h>
  14 #include <linux/module.h>
  15 #include <linux/slab.h>
  16 #include <linux/mutex.h>
  17 #include <linux/vmalloc.h>
  18 #include <linux/stddef.h>
  19 #include <linux/err.h>
  20 #include <linux/percpu.h>
  21 #include <linux/notifier.h>
  22 #include <linux/kernel.h>
  23 #include <linux/netdevice.h>
  24
  25 #include <net/netfilter/nf_conntrack.h>
  26 #include <net/netfilter/nf_conntrack_l3proto.h>
  27 #include <net/netfilter/nf_conntrack_l4proto.h>
  28 #include <net/netfilter/nf_conntrack_core.h>
  29
  30 static struct nf_conntrack_l4proto __rcu **nf_ct_protos[PF_MAX] __read_mostly;
  31 struct nf_conntrack_l3proto __rcu *nf_ct_l3protos[AF_MAX] __read_mostly;
  32 EXPORT_SYMBOL_GPL(nf_ct_l3protos);
  33
  34 static DEFINE_MUTEX(nf_ct_proto_mutex);
  35
  36 #ifdef CONFIG_SYSCTL
  37 static int
  38 nf_ct_register_sysctl(struct net *net,
  39                       struct ctl_table_header **header,
  40                       const char *path,
  41                       struct ctl_table *table)
  42 {
  43         if (*header == NULL) {
  44                 *header = register_net_sysctl(net, path, table);
  45                 if (*header == NULL)
  46                         return -ENOMEM;
  47         }
  48
  49         return 0;
  50 }
  51
  52 static void
  53 nf_ct_unregister_sysctl(struct ctl_table_header **header,
  54                         struct ctl_table **table,
  55                         unsigned int users)
  56 {
  57         if (users > 0)
  58                 return;
  59
  60         unregister_net_sysctl_table(*header);
  61         kfree(*table);
  62         *header = NULL;
  63         *table = NULL;
  64 }
  65 #endif
  66
  67 struct nf_conntrack_l4proto *
  68 __nf_ct_l4proto_find(u_int16_t l3proto, u_int8_t l4proto)
  69 {
  70         if (unlikely(l3proto >= AF_MAX || nf_ct_protos[l3proto] == NULL))
  71                 return &nf_conntrack_l4proto_generic;
  72
  73         return rcu_dereference(nf_ct_protos[l3proto][l4proto]);
  74 }
  75 EXPORT_SYMBOL_GPL(__nf_ct_l4proto_find);
  76
  77 /* this is guaranteed to always return a valid protocol helper, since
  78  * it falls back to generic_protocol */
  79 struct nf_conntrack_l3proto *
  80 nf_ct_l3proto_find_get(u_int16_t l3proto)
  81 {
  82         struct nf_conntrack_l3proto *p;
  83
  84         rcu_read_lock();
  85         p = __nf_ct_l3proto_find(l3proto);
  86         if (!try_module_get(p->me))
  87                 p = &nf_conntrack_l3proto_generic;
  88         rcu_read_unlock();
  89
  90         return p;
  91 }
  92 EXPORT_SYMBOL_GPL(nf_ct_l3proto_find_get);
  93
  94 void nf_ct_l3proto_put(struct nf_conntrack_l3proto *p)
  95 {
  96         module_put(p->me);
  97 }
  98 EXPORT_SYMBOL_GPL(nf_ct_l3proto_put);
  99
 100 int
 101 nf_ct_l3proto_try_module_get(unsigned short l3proto)
 102 {
 103         int ret;
 104         struct nf_conntrack_l3proto *p;
 105
 106 retry:  p = nf_ct_l3proto_find_get(l3proto);
 107         if (p == &nf_conntrack_l3proto_generic) {
 108                 ret = request_module("nf_conntrack-%d", l3proto);
 109                 if (!ret)
 110                         goto retry;
 111
 112                 return -EPROTOTYPE;
 113         }
 114
 115         return 0;
 116 }
 117 EXPORT_SYMBOL_GPL(nf_ct_l3proto_try_module_get);
 118
 119 void nf_ct_l3proto_module_put(unsigned short l3proto)
 120 {
 121         struct nf_conntrack_l3proto *p;
 122
 123         /* rcu_read_lock not necessary since the caller holds a reference, but
 124          * taken anyways to avoid lockdep warnings in __nf_ct_l3proto_find()
 125          */
 126         rcu_read_lock();
 127         p = __nf_ct_l3proto_find(l3proto);
 128         module_put(p->me);
 129         rcu_read_unlock();
 130 }
 131 EXPORT_SYMBOL_GPL(nf_ct_l3proto_module_put);
 132
 133 struct nf_conntrack_l4proto *
 134 nf_ct_l4proto_find_get(u_int16_t l3num, u_int8_t l4num)
 135 {
 136         struct nf_conntrack_l4proto *p;
 137
 138         rcu_read_lock();
 139         p = __nf_ct_l4proto_find(l3num, l4num);
 140         if (!try_module_get(p->me))
 141                 p = &nf_conntrack_l4proto_generic;
 142         rcu_read_unlock();
 143
 144         return p;
 145 }
 146 EXPORT_SYMBOL_GPL(nf_ct_l4proto_find_get);
 147
 148 void nf_ct_l4proto_put(struct nf_conntrack_l4proto *p)
 149 {
 150         module_put(p->me);
 151 }
 152 EXPORT_SYMBOL_GPL(nf_ct_l4proto_put);
 153
 154 static int kill_l3proto(struct nf_conn *i, void *data)
 155 {
 156         return nf_ct_l3num(i) == ((struct nf_conntrack_l3proto *)data)->l3proto;
 157 }
 158
 159 static int kill_l4proto(struct nf_conn *i, void *data)
 160 {
 161         struct nf_conntrack_l4proto *l4proto;
 162         l4proto = (struct nf_conntrack_l4proto *)data;
 163         return nf_ct_protonum(i) == l4proto->l4proto &&
 164                nf_ct_l3num(i) == l4proto->l3proto;
 165 }
 166
 167 static struct nf_ip_net *nf_ct_l3proto_net(struct net *net,
 168                                            struct nf_conntrack_l3proto *l3proto)
 169 {
 170         if (l3proto->l3proto == PF_INET)
 171                 return &net->ct.nf_ct_proto;
 172         else
 173                 return NULL;
 174 }
 175
 176 static int nf_ct_l3proto_register_sysctl(struct net *net,
 177                                          struct nf_conntrack_l3proto *l3proto)
 178 {
 179         int err = 0;
 180         struct nf_ip_net *in = nf_ct_l3proto_net(net, l3proto);
 181         /* nf_conntrack_l3proto_ipv6 doesn't support sysctl */
 182         if (in == NULL)
 183                 return 0;
 184
 185 #if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
 186         if (in->ctl_table != NULL) {
 187                 err = nf_ct_register_sysctl(net,
 188                                             &in->ctl_table_header,
 189                                             l3proto->ctl_table_path,
 190                                             in->ctl_table);
 191                 if (err < 0) {
 192                         kfree(in->ctl_table);
 193                         in->ctl_table = NULL;
 194                 }
 195         }
 196 #endif
 197         return err;
 198 }
 199
 200 static void nf_ct_l3proto_unregister_sysctl(struct net *net,
 201                                             struct nf_conntrack_l3proto *l3proto)
 202 {
 203         struct nf_ip_net *in = nf_ct_l3proto_net(net, l3proto);
 204
 205         if (in == NULL)
 206                 return;
 207 #if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
 208         if (in->ctl_table_header != NULL)
 209                 nf_ct_unregister_sysctl(&in->ctl_table_header,
 210                                         &in->ctl_table,
 211                                         0);
 212 #endif
 213 }
 214
 215 int nf_ct_l3proto_register(struct nf_conntrack_l3proto *proto)
 216 {
 217         int ret = 0;
 218         struct nf_conntrack_l3proto *old;
 219
 220         if (proto->l3proto >= AF_MAX)
 221                 return -EBUSY;
 222
 223         if (proto->tuple_to_nlattr && !proto->nlattr_tuple_size)
 224                 return -EINVAL;
 225
 226         mutex_lock(&nf_ct_proto_mutex);
 227         old = rcu_dereference_protected(nf_ct_l3protos[proto->l3proto],
 228                                         lockdep_is_held(&nf_ct_proto_mutex));
 229         if (old != &nf_conntrack_l3proto_generic) {
 230                 ret = -EBUSY;
 231                 goto out_unlock;
 232         }
 233
 234         if (proto->nlattr_tuple_size)
 235                 proto->nla_size = 3 * proto->nlattr_tuple_size();
 236
 237         rcu_assign_pointer(nf_ct_l3protos[proto->l3proto], proto);
 238
 239 out_unlock:
 240         mutex_unlock(&nf_ct_proto_mutex);
 241         return ret;
 242
 243 }
 244 EXPORT_SYMBOL_GPL(nf_ct_l3proto_register);
 245
 246 int nf_ct_l3proto_pernet_register(struct net *net,
 247                                   struct nf_conntrack_l3proto *proto)
 248 {
 249         int ret = 0;
 250
 251         if (proto->init_net) {
 252                 ret = proto->init_net(net);
 253                 if (ret < 0)
 254                         return ret;
 255         }
 256
 257         return nf_ct_l3proto_register_sysctl(net, proto);
 258 }
 259 EXPORT_SYMBOL_GPL(nf_ct_l3proto_pernet_register);
 260
 261 void nf_ct_l3proto_unregister(struct nf_conntrack_l3proto *proto)
 262 {
 263         BUG_ON(proto->l3proto >= AF_MAX);
 264
 265         mutex_lock(&nf_ct_proto_mutex);
 266         BUG_ON(rcu_dereference_protected(nf_ct_l3protos[proto->l3proto],
 267                                          lockdep_is_held(&nf_ct_proto_mutex)
 268                                          ) != proto);
 269         rcu_assign_pointer(nf_ct_l3protos[proto->l3proto],
 270                            &nf_conntrack_l3proto_generic);
 271         mutex_unlock(&nf_ct_proto_mutex);
 272
 273         synchronize_rcu();
 274 }
 275 EXPORT_SYMBOL_GPL(nf_ct_l3proto_unregister);
 276
 277 void nf_ct_l3proto_pernet_unregister(struct net *net,
 278                                      struct nf_conntrack_l3proto *proto)
 279 {
 280         nf_ct_l3proto_unregister_sysctl(net, proto);
 281
 282         /* Remove all contrack entries for this protocol */
 283         nf_ct_iterate_cleanup(net, kill_l3proto, proto);
 284 }
 285 EXPORT_SYMBOL_GPL(nf_ct_l3proto_pernet_unregister);
 286
 287 static struct nf_proto_net *nf_ct_l4proto_net(struct net *net,
 288                                               struct nf_conntrack_l4proto *l4proto)
 289 {
 290         if (l4proto->get_net_proto) {
 291                 /* statically built-in protocols use static per-net */
 292                 return l4proto->get_net_proto(net);
 293         } else if (l4proto->net_id) {
 294                 /* ... and loadable protocols use dynamic per-net */
 295                 return net_generic(net, *l4proto->net_id);
 296         }
 297         return NULL;
 298 }
 299
 300 static
 301 int nf_ct_l4proto_register_sysctl(struct net *net,
 302                                   struct nf_proto_net *pn,
 303                                   struct nf_conntrack_l4proto *l4proto)
 304 {
 305         int err = 0;
 306
 307 #ifdef CONFIG_SYSCTL
 308         if (pn->ctl_table != NULL) {
 309                 err = nf_ct_register_sysctl(net,
 310                                             &pn->ctl_table_header,
 311                                             "net/netfilter",
 312                                             pn->ctl_table);
 313                 if (err < 0) {
 314                         if (!pn->users) {
 315                                 kfree(pn->ctl_table);
 316                                 pn->ctl_table = NULL;
 317                         }
 318                 }
 319         }
 320 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
 321         if (l4proto->l3proto != AF_INET6 && pn->ctl_compat_table != NULL) {
 322                 if (err < 0) {
 323                         nf_ct_kfree_compat_sysctl_table(pn);
 324                         goto out;
 325                 }
 326                 err = nf_ct_register_sysctl(net,
 327                                             &pn->ctl_compat_header,
 328                                             "net/ipv4/netfilter",
 329                                             pn->ctl_compat_table);
 330                 if (err == 0)
 331                         goto out;
 332
 333                 nf_ct_kfree_compat_sysctl_table(pn);
 334                 nf_ct_unregister_sysctl(&pn->ctl_table_header,
 335                                         &pn->ctl_table,
 336                                         pn->users);
 337         }
 338 out:
 339 #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
 340 #endif /* CONFIG_SYSCTL */
 341         return err;
 342 }
 343
 344 static
 345 void nf_ct_l4proto_unregister_sysctl(struct net *net,
 346                                      struct nf_proto_net *pn,
 347                                      struct nf_conntrack_l4proto *l4proto)
 348 {
 349 #ifdef CONFIG_SYSCTL
 350         if (pn->ctl_table_header != NULL)
 351                 nf_ct_unregister_sysctl(&pn->ctl_table_header,
 352                                         &pn->ctl_table,
 353                                         pn->users);
 354
 355 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
 356         if (l4proto->l3proto != AF_INET6 && pn->ctl_compat_header != NULL)
 357                 nf_ct_unregister_sysctl(&pn->ctl_compat_header,
 358                                         &pn->ctl_compat_table,
 359                                         0);
 360 #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
 361 #endif /* CONFIG_SYSCTL */
 362 }
 363
 364 /* FIXME: Allow NULL functions and sub in pointers to generic for
 365    them. --RR */
 366 int nf_ct_l4proto_register(struct nf_conntrack_l4proto *l4proto)
 367 {
 368         int ret = 0;
 369
 370         if (l4proto->l3proto >= PF_MAX)
 371                 return -EBUSY;
 372
 373         if ((l4proto->to_nlattr && !l4proto->nlattr_size)
 374                 || (l4proto->tuple_to_nlattr && !l4proto->nlattr_tuple_size))
 375                 return -EINVAL;
 376
 377         mutex_lock(&nf_ct_proto_mutex);
 378         if (!nf_ct_protos[l4proto->l3proto]) {
 379                 /* l3proto may be loaded latter. */
 380                 struct nf_conntrack_l4proto __rcu **proto_array;
 381                 int i;
 382
 383                 proto_array = kmalloc(MAX_NF_CT_PROTO *
 384                                       sizeof(struct nf_conntrack_l4proto *),
 385                                       GFP_KERNEL);
 386                 if (proto_array == NULL) {
 387                         ret = -ENOMEM;
 388                         goto out_unlock;
 389                 }
 390
 391                 for (i = 0; i < MAX_NF_CT_PROTO; i++)
 392                         RCU_INIT_POINTER(proto_array[i], &nf_conntrack_l4proto_generic);
 393
 394                 /* Before making proto_array visible to lockless readers,
 395                  * we must make sure its content is committed to memory.
 396                  */
 397                 smp_wmb();
 398
 399                 nf_ct_protos[l4proto->l3proto] = proto_array;
 400         } else if (rcu_dereference_protected(
 401                         nf_ct_protos[l4proto->l3proto][l4proto->l4proto],
 402                         lockdep_is_held(&nf_ct_proto_mutex)
 403                         ) != &nf_conntrack_l4proto_generic) {
 404                 ret = -EBUSY;
 405                 goto out_unlock;
 406         }
 407
 408         l4proto->nla_size = 0;
 409         if (l4proto->nlattr_size)
 410                 l4proto->nla_size += l4proto->nlattr_size();
 411         if (l4proto->nlattr_tuple_size)
 412                 l4proto->nla_size += 3 * l4proto->nlattr_tuple_size();
 413
 414         rcu_assign_pointer(nf_ct_protos[l4proto->l3proto][l4proto->l4proto],
 415                            l4proto);
 416 out_unlock:
 417         mutex_unlock(&nf_ct_proto_mutex);
 418         return ret;
 419 }
 420 EXPORT_SYMBOL_GPL(nf_ct_l4proto_register);
 421
 422 int nf_ct_l4proto_pernet_register(struct net *net,
 423                                   struct nf_conntrack_l4proto *l4proto)
 424 {
 425         int ret = 0;
 426         struct nf_proto_net *pn = NULL;
 427
 428         if (l4proto->init_net) {
 429                 ret = l4proto->init_net(net, l4proto->l3proto);
 430                 if (ret < 0)
 431                         goto out;
 432         }
 433
 434         pn = nf_ct_l4proto_net(net, l4proto);
 435         if (pn == NULL)
 436                 goto out;
 437
 438         ret = nf_ct_l4proto_register_sysctl(net, pn, l4proto);
 439         if (ret < 0)
 440                 goto out;
 441
 442         pn->users++;
 443 out:
 444         return ret;
 445 }
 446 EXPORT_SYMBOL_GPL(nf_ct_l4proto_pernet_register);
 447
 448 void nf_ct_l4proto_unregister(struct nf_conntrack_l4proto *l4proto)
 449 {
 450         BUG_ON(l4proto->l3proto >= PF_MAX);
 451
 452         mutex_lock(&nf_ct_proto_mutex);
 453         BUG_ON(rcu_dereference_protected(
 454                         nf_ct_protos[l4proto->l3proto][l4proto->l4proto],
 455                         lockdep_is_held(&nf_ct_proto_mutex)
 456                         ) != l4proto);
 457         rcu_assign_pointer(nf_ct_protos[l4proto->l3proto][l4proto->l4proto],
 458                            &nf_conntrack_l4proto_generic);
 459         mutex_unlock(&nf_ct_proto_mutex);
 460
 461         synchronize_rcu();
 462 }
 463 EXPORT_SYMBOL_GPL(nf_ct_l4proto_unregister);
 464
 465 void nf_ct_l4proto_pernet_unregister(struct net *net,
 466                                      struct nf_conntrack_l4proto *l4proto)
 467 {
 468         struct nf_proto_net *pn = NULL;
 469
 470         pn = nf_ct_l4proto_net(net, l4proto);
 471         if (pn == NULL)
 472                 return;
 473
 474         pn->users--;
 475         nf_ct_l4proto_unregister_sysctl(net, pn, l4proto);
 476
 477         /* Remove all contrack entries for this protocol */
 478         nf_ct_iterate_cleanup(net, kill_l4proto, l4proto);
 479 }
 480 EXPORT_SYMBOL_GPL(nf_ct_l4proto_pernet_unregister);
 481
 482 int nf_conntrack_proto_pernet_init(struct net *net)
 483 {
 484         int err;
 485         struct nf_proto_net *pn = nf_ct_l4proto_net(net,
 486                                         &nf_conntrack_l4proto_generic);
 487
 488         err = nf_conntrack_l4proto_generic.init_net(net,
 489                                         nf_conntrack_l4proto_generic.l3proto);
 490         if (err < 0)
 491                 return err;
 492         err = nf_ct_l4proto_register_sysctl(net,
 493                                             pn,
 494                                             &nf_conntrack_l4proto_generic);
 495         if (err < 0)
 496                 return err;
 497
 498         pn->users++;
 499         return 0;
 500 }
 501
 502 void nf_conntrack_proto_pernet_fini(struct net *net)
 503 {
 504         struct nf_proto_net *pn = nf_ct_l4proto_net(net,
 505                                         &nf_conntrack_l4proto_generic);
 506
 507         pn->users--;
 508         nf_ct_l4proto_unregister_sysctl(net,
 509                                         pn,
 510                                         &nf_conntrack_l4proto_generic);
 511 }
 512
 513 int nf_conntrack_proto_init(void)
 514 {
 515         unsigned int i;
 516         for (i = 0; i < AF_MAX; i++)
 517                 rcu_assign_pointer(nf_ct_l3protos[i],
 518                                    &nf_conntrack_l3proto_generic);
 519         return 0;
 520 }
 521
 522 void nf_conntrack_proto_fini(void)
 523 {
 524         unsigned int i;
 525         /* free l3proto protocol tables */
 526         for (i = 0; i < PF_MAX; i++)
 527                 kfree(nf_ct_protos[i]);
 528 }