nf_conntrack_timeout.c 4.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
  4. * (C) 2012 by Vyatta Inc. <http://www.vyatta.com>
  5. */
  6. #include <linux/types.h>
  7. #include <linux/netfilter.h>
  8. #include <linux/skbuff.h>
  9. #include <linux/vmalloc.h>
  10. #include <linux/stddef.h>
  11. #include <linux/err.h>
  12. #include <linux/percpu.h>
  13. #include <linux/kernel.h>
  14. #include <linux/netdevice.h>
  15. #include <linux/slab.h>
  16. #include <linux/export.h>
  17. #include <net/netfilter/nf_conntrack.h>
  18. #include <net/netfilter/nf_conntrack_core.h>
  19. #include <net/netfilter/nf_conntrack_extend.h>
  20. #include <net/netfilter/nf_conntrack_l4proto.h>
  21. #include <net/netfilter/nf_conntrack_timeout.h>
  22. struct nf_ct_timeout *
  23. (*nf_ct_timeout_find_get_hook)(struct net *net, const char *name) __read_mostly;
  24. EXPORT_SYMBOL_GPL(nf_ct_timeout_find_get_hook);
  25. void (*nf_ct_timeout_put_hook)(struct nf_ct_timeout *timeout) __read_mostly;
  26. EXPORT_SYMBOL_GPL(nf_ct_timeout_put_hook);
  27. static int untimeout(struct nf_conn *ct, void *timeout)
  28. {
  29. struct nf_conn_timeout *timeout_ext = nf_ct_timeout_find(ct);
  30. if (timeout_ext && (!timeout || timeout_ext->timeout == timeout))
  31. RCU_INIT_POINTER(timeout_ext->timeout, NULL);
  32. /* We are not intended to delete this conntrack. */
  33. return 0;
  34. }
  35. void nf_ct_untimeout(struct net *net, struct nf_ct_timeout *timeout)
  36. {
  37. nf_ct_iterate_cleanup_net(net, untimeout, timeout, 0, 0);
  38. }
  39. EXPORT_SYMBOL_GPL(nf_ct_untimeout);
  40. static void __nf_ct_timeout_put(struct nf_ct_timeout *timeout)
  41. {
  42. typeof(nf_ct_timeout_put_hook) timeout_put;
  43. timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
  44. if (timeout_put)
  45. timeout_put(timeout);
  46. }
  47. int nf_ct_set_timeout(struct net *net, struct nf_conn *ct,
  48. u8 l3num, u8 l4num, const char *timeout_name)
  49. {
  50. typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
  51. struct nf_ct_timeout *timeout;
  52. struct nf_conn_timeout *timeout_ext;
  53. const char *errmsg = NULL;
  54. int ret = 0;
  55. rcu_read_lock();
  56. timeout_find_get = rcu_dereference(nf_ct_timeout_find_get_hook);
  57. if (!timeout_find_get) {
  58. ret = -ENOENT;
  59. errmsg = "Timeout policy base is empty";
  60. goto out;
  61. }
  62. timeout = timeout_find_get(net, timeout_name);
  63. if (!timeout) {
  64. ret = -ENOENT;
  65. pr_info_ratelimited("No such timeout policy \"%s\"\n",
  66. timeout_name);
  67. goto out;
  68. }
  69. if (timeout->l3num != l3num) {
  70. ret = -EINVAL;
  71. pr_info_ratelimited("Timeout policy `%s' can only be used by "
  72. "L%d protocol number %d\n",
  73. timeout_name, 3, timeout->l3num);
  74. goto err_put_timeout;
  75. }
  76. /* Make sure the timeout policy matches any existing protocol tracker,
  77. * otherwise default to generic.
  78. */
  79. if (timeout->l4proto->l4proto != l4num) {
  80. ret = -EINVAL;
  81. pr_info_ratelimited("Timeout policy `%s' can only be used by "
  82. "L%d protocol number %d\n",
  83. timeout_name, 4, timeout->l4proto->l4proto);
  84. goto err_put_timeout;
  85. }
  86. timeout_ext = nf_ct_timeout_ext_add(ct, timeout, GFP_ATOMIC);
  87. if (!timeout_ext) {
  88. ret = -ENOMEM;
  89. goto err_put_timeout;
  90. }
  91. rcu_read_unlock();
  92. return ret;
  93. err_put_timeout:
  94. __nf_ct_timeout_put(timeout);
  95. out:
  96. rcu_read_unlock();
  97. if (errmsg)
  98. pr_info_ratelimited("%s\n", errmsg);
  99. return ret;
  100. }
  101. EXPORT_SYMBOL_GPL(nf_ct_set_timeout);
  102. void nf_ct_destroy_timeout(struct nf_conn *ct)
  103. {
  104. struct nf_conn_timeout *timeout_ext;
  105. typeof(nf_ct_timeout_put_hook) timeout_put;
  106. rcu_read_lock();
  107. timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
  108. if (timeout_put) {
  109. timeout_ext = nf_ct_timeout_find(ct);
  110. if (timeout_ext) {
  111. timeout_put(timeout_ext->timeout);
  112. RCU_INIT_POINTER(timeout_ext->timeout, NULL);
  113. }
  114. }
  115. rcu_read_unlock();
  116. }
  117. EXPORT_SYMBOL_GPL(nf_ct_destroy_timeout);
  118. static const struct nf_ct_ext_type timeout_extend = {
  119. .len = sizeof(struct nf_conn_timeout),
  120. .align = __alignof__(struct nf_conn_timeout),
  121. .id = NF_CT_EXT_TIMEOUT,
  122. };
  123. int nf_conntrack_timeout_init(void)
  124. {
  125. int ret = nf_ct_extend_register(&timeout_extend);
  126. if (ret < 0)
  127. pr_err("nf_ct_timeout: Unable to register timeout extension.\n");
  128. return ret;
  129. }
  130. void nf_conntrack_timeout_fini(void)
  131. {
  132. nf_ct_extend_unregister(&timeout_extend);
  133. }