1 /* SPDX-License-Identifier: GPL-2.0 */
2 /*
3 * connection tracking expectations.
4 */
5
6 #ifndef _NF_CONNTRACK_EXPECT_H
7 #define _NF_CONNTRACK_EXPECT_H
8
9 #include <linux/refcount.h>
10
11 #include <net/netfilter/nf_conntrack.h>
12 #include <net/netfilter/nf_conntrack_zones.h>
13
14 extern unsigned int nf_ct_expect_hsize;
15 extern unsigned int nf_ct_expect_max;
16 extern struct hlist_head *nf_ct_expect_hash;
17
18 struct nf_conntrack_expect {
19 /* Conntrack expectation list member */
20 struct hlist_node lnode;
21
22 /* Hash member */
23 struct hlist_node hnode;
24
25 /* Network namespace */
26 possible_net_t net;
27
28 /* We expect this tuple, with the following mask */
29 struct nf_conntrack_tuple master_tuple;
30 struct nf_conntrack_tuple tuple;
31 struct nf_conntrack_tuple_mask mask;
32
33 #ifdef CONFIG_NF_CONNTRACK_ZONES
34 struct nf_conntrack_zone zone;
35 #endif
36 /* Usage count. */
37 refcount_t use;
38
39 /* Flags */
40 unsigned int flags;
41
42 /* Expectation class */
43 unsigned int class;
44
45 /* Event filter mask */
46 u16 event_mask;
47
48 /* Function to call after setup and insertion */
49 void (*expectfn)(struct nf_conn *new,
50 struct nf_conntrack_expect *this);
51
52 /* Helper that created this expectation */
53 struct nf_conntrack_helper __rcu *helper;
54
55 /* Helper to assign to new connection */
56 struct nf_conntrack_helper __rcu *assign_helper;
57
58 /* The conntrack of the master connection */
59 struct nf_conn *master;
60
61 /* jiffies32 when this expectation expires */
62 u32 timeout;
63
64 #if IS_ENABLED(CONFIG_NF_NAT)
65 union nf_inet_addr saved_addr;
66 /* This is the original per-proto part, used to map the
67 * expected connection the way the recipient expects. */
68 union nf_conntrack_man_proto saved_proto;
69 /* Direction relative to the master connection. */
70 enum ip_conntrack_dir dir;
71 #endif
72
73 struct rcu_head rcu;
74 };
75
nf_ct_exp_is_expired(const struct nf_conntrack_expect * exp)76 static inline bool nf_ct_exp_is_expired(const struct nf_conntrack_expect *exp)
77 {
78 if (READ_ONCE(exp->flags) & NF_CT_EXPECT_DEAD)
79 return true;
80
81 return (__s32)(READ_ONCE(exp->timeout) - nfct_time_stamp) <= 0;
82 }
83
nf_ct_exp_net(struct nf_conntrack_expect * exp)84 static inline struct net *nf_ct_exp_net(struct nf_conntrack_expect *exp)
85 {
86 return read_pnet(&exp->net);
87 }
88
nf_ct_exp_zone_equal_any(const struct nf_conntrack_expect * a,const struct nf_conntrack_zone * b)89 static inline bool nf_ct_exp_zone_equal_any(const struct nf_conntrack_expect *a,
90 const struct nf_conntrack_zone *b)
91 {
92 #ifdef CONFIG_NF_CONNTRACK_ZONES
93 return a->zone.id == b->id;
94 #else
95 return true;
96 #endif
97 }
98
99 #define NF_CT_EXP_POLICY_NAME_LEN 16
100
101 struct nf_conntrack_expect_policy {
102 unsigned int max_expected;
103 unsigned int timeout;
104 char name[NF_CT_EXP_POLICY_NAME_LEN];
105 };
106
107 #define NF_CT_EXPECT_CLASS_DEFAULT 0
108 #define NF_CT_EXPECT_MAX_CNT 255
109
110 /* Allow to reuse expectations with the same tuples from different master
111 * conntracks.
112 */
113 #define NF_CT_EXP_F_SKIP_MASTER 0x1
114
115 int nf_conntrack_expect_pernet_init(struct net *net);
116 void nf_conntrack_expect_pernet_fini(struct net *net);
117
118 int nf_conntrack_expect_init(void);
119 void nf_conntrack_expect_fini(void);
120
121 struct nf_conntrack_expect *
122 __nf_ct_expect_find(struct net *net,
123 const struct nf_conntrack_zone *zone,
124 const struct nf_conntrack_tuple *tuple);
125
126 struct nf_conntrack_expect *
127 nf_ct_expect_find_get(struct net *net,
128 const struct nf_conntrack_zone *zone,
129 const struct nf_conntrack_tuple *tuple);
130
131 struct nf_conntrack_expect *
132 nf_ct_find_expectation(struct net *net,
133 const struct nf_conntrack_zone *zone,
134 const struct nf_conntrack_tuple *tuple, bool unlink);
135
136 void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp,
137 u32 portid, int report);
nf_ct_unlink_expect(struct nf_conntrack_expect * exp)138 static inline void nf_ct_unlink_expect(struct nf_conntrack_expect *exp)
139 {
140 nf_ct_unlink_expect_report(exp, 0, 0);
141 }
142
143 void nf_ct_remove_expectations(struct nf_conn *ct);
144 void nf_ct_unexpect_related(struct nf_conntrack_expect *exp);
145
146 void nf_ct_expect_iterate_destroy(bool (*iter)(struct nf_conntrack_expect *e, void *data), void *data);
147 void nf_ct_expect_iterate_net(struct net *net,
148 bool (*iter)(struct nf_conntrack_expect *e, void *data),
149 void *data, u32 portid, int report);
150
151 /* Allocate space for an expectation: this is mandatory before calling
152 nf_ct_expect_related. You will have to call put afterwards. */
153 struct nf_conntrack_expect *nf_ct_expect_alloc(struct nf_conn *me);
154 void nf_ct_expect_init(struct nf_conntrack_expect *, unsigned int, u_int8_t,
155 const union nf_inet_addr *,
156 const union nf_inet_addr *,
157 u_int8_t, const __be16 *, const __be16 *);
158 void nf_ct_expect_put(struct nf_conntrack_expect *exp);
159 int nf_ct_expect_related_report(struct nf_conntrack_expect *expect,
160 u32 portid, int report, unsigned int flags);
nf_ct_expect_related(struct nf_conntrack_expect * expect,unsigned int flags)161 static inline int nf_ct_expect_related(struct nf_conntrack_expect *expect,
162 unsigned int flags)
163 {
164 return nf_ct_expect_related_report(expect, 0, 0, flags);
165 }
166
167 int nf_ct_expect_related_pair(struct nf_conntrack_expect *expect[],
168 unsigned int flag);
169
170 struct nf_conn_help;
171 void nf_ct_expectation_gc(struct nf_conn_help *master_help);
172
173 #endif /*_NF_CONNTRACK_EXPECT_H*/
174
175