1 // SPDX-License-Identifier: GPL-2.0-only 2 /* Expectation handling for nf_conntrack. */ 3 4 /* (C) 1999-2001 Paul `Rusty' Russell 5 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org> 6 * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org> 7 * (c) 2005-2012 Patrick McHardy <kaber@trash.net> 8 */ 9 10 #include <linux/types.h> 11 #include <linux/netfilter.h> 12 #include <linux/skbuff.h> 13 #include <linux/proc_fs.h> 14 #include <linux/seq_file.h> 15 #include <linux/stddef.h> 16 #include <linux/slab.h> 17 #include <linux/err.h> 18 #include <linux/percpu.h> 19 #include <linux/kernel.h> 20 #include <linux/siphash.h> 21 #include <linux/moduleparam.h> 22 #include <linux/export.h> 23 #include <net/net_namespace.h> 24 #include <net/netns/hash.h> 25 26 #include <net/netfilter/nf_conntrack.h> 27 #include <net/netfilter/nf_conntrack_core.h> 28 #include <net/netfilter/nf_conntrack_ecache.h> 29 #include <net/netfilter/nf_conntrack_expect.h> 30 #include <net/netfilter/nf_conntrack_helper.h> 31 #include <net/netfilter/nf_conntrack_l4proto.h> 32 #include <net/netfilter/nf_conntrack_tuple.h> 33 #include <net/netfilter/nf_conntrack_zones.h> 34 35 unsigned int nf_ct_expect_hsize __read_mostly; 36 EXPORT_SYMBOL_GPL(nf_ct_expect_hsize); 37 38 struct hlist_head *nf_ct_expect_hash __read_mostly; 39 EXPORT_SYMBOL_GPL(nf_ct_expect_hash); 40 41 unsigned int nf_ct_expect_max __read_mostly; 42 43 static struct kmem_cache *nf_ct_expect_cachep __read_mostly; 44 static siphash_aligned_key_t nf_ct_expect_hashrnd; 45 46 /* nf_conntrack_expect helper functions */ 47 void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp, 48 u32 portid, int report) 49 { 50 struct nf_conn_help *master_help = nfct_help(exp->master); 51 struct net *net = nf_ct_exp_net(exp); 52 struct nf_conntrack_net *cnet; 53 54 lockdep_nfct_expect_lock_held(); 55 WARN_ON(!master_help); 56 WARN_ON(timer_pending(&exp->timeout)); 57 58 hlist_del_rcu(&exp->hnode); 59 60 cnet = nf_ct_pernet(net); 61 cnet->expect_count--; 62 63 hlist_del_rcu(&exp->lnode); 64 master_help->expecting[exp->class]--; 65 66 nf_ct_expect_event_report(IPEXP_DESTROY, exp, portid, report); 67 nf_ct_expect_put(exp); 68 69 NF_CT_STAT_INC(net, expect_delete); 70 } 71 EXPORT_SYMBOL_GPL(nf_ct_unlink_expect_report); 72 73 static void nf_ct_expectation_timed_out(struct timer_list *t) 74 { 75 struct nf_conntrack_expect *exp = timer_container_of(exp, t, timeout); 76 77 spin_lock_bh(&nf_conntrack_expect_lock); 78 nf_ct_unlink_expect(exp); 79 spin_unlock_bh(&nf_conntrack_expect_lock); 80 nf_ct_expect_put(exp); 81 } 82 83 static unsigned int nf_ct_expect_dst_hash(const struct net *n, const struct nf_conntrack_tuple *tuple) 84 { 85 struct { 86 union nf_inet_addr dst_addr; 87 u32 net_mix; 88 u16 dport; 89 u8 l3num; 90 u8 protonum; 91 } __aligned(SIPHASH_ALIGNMENT) combined; 92 u32 hash; 93 94 get_random_once(&nf_ct_expect_hashrnd, sizeof(nf_ct_expect_hashrnd)); 95 96 memset(&combined, 0, sizeof(combined)); 97 98 combined.dst_addr = tuple->dst.u3; 99 combined.net_mix = net_hash_mix(n); 100 combined.dport = (__force __u16)tuple->dst.u.all; 101 combined.l3num = tuple->src.l3num; 102 combined.protonum = tuple->dst.protonum; 103 104 hash = siphash(&combined, sizeof(combined), &nf_ct_expect_hashrnd); 105 106 return reciprocal_scale(hash, nf_ct_expect_hsize); 107 } 108 109 static bool 110 nf_ct_exp_equal(const struct nf_conntrack_tuple *tuple, 111 const struct nf_conntrack_expect *i, 112 const struct nf_conntrack_zone *zone, 113 const struct net *net) 114 { 115 return nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask) && 116 net_eq(net, read_pnet(&i->net)) && 117 nf_ct_exp_zone_equal_any(i, zone); 118 } 119 120 bool nf_ct_remove_expect(struct nf_conntrack_expect *exp) 121 { 122 lockdep_nfct_expect_lock_held(); 123 124 if (timer_delete(&exp->timeout)) { 125 nf_ct_unlink_expect(exp); 126 nf_ct_expect_put(exp); 127 return true; 128 } 129 return false; 130 } 131 EXPORT_SYMBOL_GPL(nf_ct_remove_expect); 132 133 struct nf_conntrack_expect * 134 __nf_ct_expect_find(struct net *net, 135 const struct nf_conntrack_zone *zone, 136 const struct nf_conntrack_tuple *tuple) 137 { 138 struct nf_conntrack_net *cnet = nf_ct_pernet(net); 139 struct nf_conntrack_expect *i; 140 unsigned int h; 141 142 if (!cnet->expect_count) 143 return NULL; 144 145 h = nf_ct_expect_dst_hash(net, tuple); 146 hlist_for_each_entry_rcu(i, &nf_ct_expect_hash[h], hnode) { 147 if (nf_ct_exp_equal(tuple, i, zone, net)) 148 return i; 149 } 150 return NULL; 151 } 152 EXPORT_SYMBOL_GPL(__nf_ct_expect_find); 153 154 /* Just find a expectation corresponding to a tuple. */ 155 struct nf_conntrack_expect * 156 nf_ct_expect_find_get(struct net *net, 157 const struct nf_conntrack_zone *zone, 158 const struct nf_conntrack_tuple *tuple) 159 { 160 struct nf_conntrack_expect *i; 161 162 rcu_read_lock(); 163 i = __nf_ct_expect_find(net, zone, tuple); 164 if (i && !refcount_inc_not_zero(&i->use)) 165 i = NULL; 166 rcu_read_unlock(); 167 168 return i; 169 } 170 EXPORT_SYMBOL_GPL(nf_ct_expect_find_get); 171 172 /* If an expectation for this connection is found, it gets delete from 173 * global list then returned. */ 174 struct nf_conntrack_expect * 175 nf_ct_find_expectation(struct net *net, 176 const struct nf_conntrack_zone *zone, 177 const struct nf_conntrack_tuple *tuple, bool unlink) 178 { 179 struct nf_conntrack_net *cnet = nf_ct_pernet(net); 180 struct nf_conntrack_expect *i, *exp = NULL; 181 unsigned int h; 182 183 lockdep_nfct_expect_lock_held(); 184 185 if (!cnet->expect_count) 186 return NULL; 187 188 h = nf_ct_expect_dst_hash(net, tuple); 189 hlist_for_each_entry(i, &nf_ct_expect_hash[h], hnode) { 190 if (!(i->flags & NF_CT_EXPECT_INACTIVE) && 191 nf_ct_exp_equal(tuple, i, zone, net)) { 192 exp = i; 193 break; 194 } 195 } 196 if (!exp) 197 return NULL; 198 199 /* If master is not in hash table yet (ie. packet hasn't left 200 this machine yet), how can other end know about expected? 201 Hence these are not the droids you are looking for (if 202 master ct never got confirmed, we'd hold a reference to it 203 and weird things would happen to future packets). */ 204 if (!nf_ct_is_confirmed(exp->master)) 205 return NULL; 206 207 /* Avoid race with other CPUs, that for exp->master ct, is 208 * about to invoke ->destroy(), or nf_ct_delete() via timeout 209 * or early_drop(). 210 * 211 * The refcount_inc_not_zero() check tells: If that fails, we 212 * know that the ct is being destroyed. If it succeeds, we 213 * can be sure the ct cannot disappear underneath. 214 */ 215 if (unlikely(nf_ct_is_dying(exp->master) || 216 !refcount_inc_not_zero(&exp->master->ct_general.use))) 217 return NULL; 218 219 if (exp->flags & NF_CT_EXPECT_PERMANENT || !unlink) { 220 refcount_inc(&exp->use); 221 return exp; 222 } else if (timer_delete(&exp->timeout)) { 223 nf_ct_unlink_expect(exp); 224 return exp; 225 } 226 /* Undo exp->master refcnt increase, if timer_delete() failed */ 227 nf_ct_put(exp->master); 228 229 return NULL; 230 } 231 232 /* delete all expectations for this conntrack */ 233 void nf_ct_remove_expectations(struct nf_conn *ct) 234 { 235 struct nf_conn_help *help = nfct_help(ct); 236 struct nf_conntrack_expect *exp; 237 struct hlist_node *next; 238 239 /* Optimization: most connection never expect any others. */ 240 if (!help) 241 return; 242 243 spin_lock_bh(&nf_conntrack_expect_lock); 244 hlist_for_each_entry_safe(exp, next, &help->expectations, lnode) { 245 nf_ct_remove_expect(exp); 246 } 247 spin_unlock_bh(&nf_conntrack_expect_lock); 248 } 249 EXPORT_SYMBOL_GPL(nf_ct_remove_expectations); 250 251 /* Would two expected things clash? */ 252 static inline int expect_clash(const struct nf_conntrack_expect *a, 253 const struct nf_conntrack_expect *b) 254 { 255 /* Part covered by intersection of masks must be unequal, 256 otherwise they clash */ 257 struct nf_conntrack_tuple_mask intersect_mask; 258 int count; 259 260 intersect_mask.src.u.all = a->mask.src.u.all & b->mask.src.u.all; 261 262 for (count = 0; count < NF_CT_TUPLE_L3SIZE; count++){ 263 intersect_mask.src.u3.all[count] = 264 a->mask.src.u3.all[count] & b->mask.src.u3.all[count]; 265 } 266 267 return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask) && 268 net_eq(nf_ct_net(a->master), nf_ct_net(b->master)) && 269 nf_ct_zone_equal_any(a->master, nf_ct_zone(b->master)); 270 } 271 272 static inline int expect_matches(const struct nf_conntrack_expect *a, 273 const struct nf_conntrack_expect *b) 274 { 275 return nf_ct_tuple_equal(&a->tuple, &b->tuple) && 276 nf_ct_tuple_mask_equal(&a->mask, &b->mask) && 277 net_eq(nf_ct_net(a->master), nf_ct_net(b->master)) && 278 nf_ct_zone_equal_any(a->master, nf_ct_zone(b->master)); 279 } 280 281 static bool master_matches(const struct nf_conntrack_expect *a, 282 const struct nf_conntrack_expect *b, 283 unsigned int flags) 284 { 285 if (flags & NF_CT_EXP_F_SKIP_MASTER) 286 return true; 287 288 return a->master == b->master; 289 } 290 291 /* Generally a bad idea to call this: could have matched already. */ 292 void nf_ct_unexpect_related(struct nf_conntrack_expect *exp) 293 { 294 spin_lock_bh(&nf_conntrack_expect_lock); 295 nf_ct_remove_expect(exp); 296 spin_unlock_bh(&nf_conntrack_expect_lock); 297 } 298 EXPORT_SYMBOL_GPL(nf_ct_unexpect_related); 299 300 /* We don't increase the master conntrack refcount for non-fulfilled 301 * conntracks. During the conntrack destruction, the expectations are 302 * always killed before the conntrack itself */ 303 struct nf_conntrack_expect *nf_ct_expect_alloc(struct nf_conn *me) 304 { 305 struct nf_conntrack_expect *new; 306 307 new = kmem_cache_alloc(nf_ct_expect_cachep, GFP_ATOMIC); 308 if (!new) 309 return NULL; 310 311 new->master = me; 312 refcount_set(&new->use, 1); 313 return new; 314 } 315 EXPORT_SYMBOL_GPL(nf_ct_expect_alloc); 316 317 /* This function can only be used from packet path, where accessing 318 * master's helper is safe, because the packet holds a reference on 319 * the conntrack object. Never use it from control plane. 320 */ 321 void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class, 322 u_int8_t family, 323 const union nf_inet_addr *saddr, 324 const union nf_inet_addr *daddr, 325 u_int8_t proto, const __be16 *src, const __be16 *dst) 326 { 327 struct nf_conntrack_helper *helper = NULL; 328 struct nf_conn *ct = exp->master; 329 struct net *net = read_pnet(&ct->ct_net); 330 struct nf_conn_help *help; 331 int len; 332 333 if (family == AF_INET) 334 len = 4; 335 else 336 len = 16; 337 338 exp->flags = 0; 339 exp->class = class; 340 exp->expectfn = NULL; 341 342 help = nfct_help(ct); 343 if (help) 344 helper = rcu_dereference(help->helper); 345 346 rcu_assign_pointer(exp->helper, helper); 347 rcu_assign_pointer(exp->assign_helper, NULL); 348 write_pnet(&exp->net, net); 349 #ifdef CONFIG_NF_CONNTRACK_ZONES 350 exp->zone = ct->zone; 351 #endif 352 exp->tuple.src.l3num = family; 353 exp->tuple.dst.protonum = proto; 354 355 if (saddr) { 356 memcpy(&exp->tuple.src.u3, saddr, len); 357 if (sizeof(exp->tuple.src.u3) > len) 358 /* address needs to be cleared for nf_ct_tuple_equal */ 359 memset((void *)&exp->tuple.src.u3 + len, 0x00, 360 sizeof(exp->tuple.src.u3) - len); 361 memset(&exp->mask.src.u3, 0xFF, len); 362 if (sizeof(exp->mask.src.u3) > len) 363 memset((void *)&exp->mask.src.u3 + len, 0x00, 364 sizeof(exp->mask.src.u3) - len); 365 } else { 366 memset(&exp->tuple.src.u3, 0x00, sizeof(exp->tuple.src.u3)); 367 memset(&exp->mask.src.u3, 0x00, sizeof(exp->mask.src.u3)); 368 } 369 370 if (src) { 371 exp->tuple.src.u.all = *src; 372 exp->mask.src.u.all = htons(0xFFFF); 373 } else { 374 exp->tuple.src.u.all = 0; 375 exp->mask.src.u.all = 0; 376 } 377 378 memcpy(&exp->tuple.dst.u3, daddr, len); 379 if (sizeof(exp->tuple.dst.u3) > len) 380 /* address needs to be cleared for nf_ct_tuple_equal */ 381 memset((void *)&exp->tuple.dst.u3 + len, 0x00, 382 sizeof(exp->tuple.dst.u3) - len); 383 384 exp->tuple.dst.u.all = *dst; 385 386 #if IS_ENABLED(CONFIG_NF_NAT) 387 memset(&exp->saved_addr, 0, sizeof(exp->saved_addr)); 388 memset(&exp->saved_proto, 0, sizeof(exp->saved_proto)); 389 #endif 390 } 391 EXPORT_SYMBOL_GPL(nf_ct_expect_init); 392 393 static void nf_ct_expect_free_rcu(struct rcu_head *head) 394 { 395 struct nf_conntrack_expect *exp; 396 397 exp = container_of(head, struct nf_conntrack_expect, rcu); 398 kmem_cache_free(nf_ct_expect_cachep, exp); 399 } 400 401 void nf_ct_expect_put(struct nf_conntrack_expect *exp) 402 { 403 if (refcount_dec_and_test(&exp->use)) 404 call_rcu(&exp->rcu, nf_ct_expect_free_rcu); 405 } 406 EXPORT_SYMBOL_GPL(nf_ct_expect_put); 407 408 static void nf_ct_expect_insert(struct nf_conntrack_expect *exp) 409 { 410 struct nf_conntrack_net *cnet; 411 struct nf_conn_help *master_help = nfct_help(exp->master); 412 struct nf_conntrack_helper *helper; 413 struct net *net = nf_ct_exp_net(exp); 414 unsigned int h = nf_ct_expect_dst_hash(net, &exp->tuple); 415 416 /* two references : one for hash insert, one for the timer */ 417 refcount_add(2, &exp->use); 418 419 timer_setup(&exp->timeout, nf_ct_expectation_timed_out, 0); 420 helper = rcu_dereference_protected(master_help->helper, 421 lockdep_is_held(&nf_conntrack_expect_lock)); 422 if (helper) { 423 exp->timeout.expires = jiffies + 424 helper->expect_policy[exp->class].timeout * HZ; 425 } 426 add_timer(&exp->timeout); 427 428 hlist_add_head_rcu(&exp->lnode, &master_help->expectations); 429 master_help->expecting[exp->class]++; 430 431 hlist_add_head_rcu(&exp->hnode, &nf_ct_expect_hash[h]); 432 cnet = nf_ct_pernet(net); 433 cnet->expect_count++; 434 435 NF_CT_STAT_INC(net, expect_create); 436 } 437 438 /* Race with expectations being used means we could have none to find; OK. */ 439 static void evict_oldest_expect(struct nf_conn *master, 440 struct nf_conntrack_expect *new) 441 { 442 struct nf_conn_help *master_help = nfct_help(master); 443 struct nf_conntrack_expect *exp, *last = NULL; 444 445 hlist_for_each_entry(exp, &master_help->expectations, lnode) { 446 if (exp->class == new->class) 447 last = exp; 448 } 449 450 if (last) 451 nf_ct_remove_expect(last); 452 } 453 454 static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect, 455 unsigned int flags) 456 { 457 const struct nf_conntrack_expect_policy *p; 458 struct nf_conntrack_expect *i; 459 struct nf_conntrack_net *cnet; 460 struct nf_conn *master = expect->master; 461 struct nf_conn_help *master_help = nfct_help(master); 462 struct nf_conntrack_helper *helper; 463 struct net *net = nf_ct_exp_net(expect); 464 struct hlist_node *next; 465 unsigned int h; 466 int ret = 0; 467 468 lockdep_nfct_expect_lock_held(); 469 470 if (!master_help) { 471 ret = -ESHUTDOWN; 472 goto out; 473 } 474 h = nf_ct_expect_dst_hash(net, &expect->tuple); 475 hlist_for_each_entry_safe(i, next, &nf_ct_expect_hash[h], hnode) { 476 if (master_matches(i, expect, flags) && 477 expect_matches(i, expect)) { 478 if (i->class != expect->class || 479 i->master != expect->master) 480 return -EALREADY; 481 482 if (nf_ct_remove_expect(i)) 483 break; 484 } else if (expect_clash(i, expect)) { 485 ret = -EBUSY; 486 goto out; 487 } 488 } 489 /* Will be over limit? */ 490 helper = rcu_dereference_protected(master_help->helper, 491 lockdep_is_held(&nf_conntrack_expect_lock)); 492 if (helper) { 493 p = &helper->expect_policy[expect->class]; 494 if (p->max_expected && 495 master_help->expecting[expect->class] >= p->max_expected) { 496 evict_oldest_expect(master, expect); 497 if (master_help->expecting[expect->class] 498 >= p->max_expected) { 499 ret = -EMFILE; 500 goto out; 501 } 502 } 503 } 504 505 cnet = nf_ct_pernet(net); 506 if (cnet->expect_count >= nf_ct_expect_max) { 507 net_warn_ratelimited("nf_conntrack: expectation table full\n"); 508 ret = -EMFILE; 509 } 510 out: 511 return ret; 512 } 513 514 int nf_ct_expect_related_report(struct nf_conntrack_expect *expect, 515 u32 portid, int report, unsigned int flags) 516 { 517 int ret; 518 519 spin_lock_bh(&nf_conntrack_expect_lock); 520 ret = __nf_ct_expect_check(expect, flags); 521 if (ret < 0) 522 goto out; 523 524 nf_ct_expect_insert(expect); 525 526 nf_ct_expect_event_report(IPEXP_NEW, expect, portid, report); 527 spin_unlock_bh(&nf_conntrack_expect_lock); 528 529 return 0; 530 out: 531 spin_unlock_bh(&nf_conntrack_expect_lock); 532 return ret; 533 } 534 EXPORT_SYMBOL_GPL(nf_ct_expect_related_report); 535 536 void nf_ct_expect_iterate_destroy(bool (*iter)(struct nf_conntrack_expect *e, void *data), 537 void *data) 538 { 539 struct nf_conntrack_expect *exp; 540 const struct hlist_node *next; 541 unsigned int i; 542 543 spin_lock_bh(&nf_conntrack_expect_lock); 544 545 for (i = 0; i < nf_ct_expect_hsize; i++) { 546 hlist_for_each_entry_safe(exp, next, 547 &nf_ct_expect_hash[i], 548 hnode) { 549 if (iter(exp, data) && timer_delete(&exp->timeout)) { 550 nf_ct_unlink_expect(exp); 551 nf_ct_expect_put(exp); 552 } 553 } 554 } 555 556 spin_unlock_bh(&nf_conntrack_expect_lock); 557 } 558 EXPORT_SYMBOL_GPL(nf_ct_expect_iterate_destroy); 559 560 void nf_ct_expect_iterate_net(struct net *net, 561 bool (*iter)(struct nf_conntrack_expect *e, void *data), 562 void *data, 563 u32 portid, int report) 564 { 565 struct nf_conntrack_expect *exp; 566 const struct hlist_node *next; 567 unsigned int i; 568 569 spin_lock_bh(&nf_conntrack_expect_lock); 570 571 for (i = 0; i < nf_ct_expect_hsize; i++) { 572 hlist_for_each_entry_safe(exp, next, 573 &nf_ct_expect_hash[i], 574 hnode) { 575 576 if (!net_eq(nf_ct_exp_net(exp), net)) 577 continue; 578 579 if (iter(exp, data) && timer_delete(&exp->timeout)) { 580 nf_ct_unlink_expect_report(exp, portid, report); 581 nf_ct_expect_put(exp); 582 } 583 } 584 } 585 586 spin_unlock_bh(&nf_conntrack_expect_lock); 587 } 588 EXPORT_SYMBOL_GPL(nf_ct_expect_iterate_net); 589 590 #ifdef CONFIG_NF_CONNTRACK_PROCFS 591 struct ct_expect_iter_state { 592 struct seq_net_private p; 593 unsigned int bucket; 594 }; 595 596 static struct hlist_node *ct_expect_get_first(struct seq_file *seq) 597 { 598 struct ct_expect_iter_state *st = seq->private; 599 struct hlist_node *n; 600 601 for (st->bucket = 0; st->bucket < nf_ct_expect_hsize; st->bucket++) { 602 n = rcu_dereference(hlist_first_rcu(&nf_ct_expect_hash[st->bucket])); 603 if (n) 604 return n; 605 } 606 return NULL; 607 } 608 609 static struct hlist_node *ct_expect_get_next(struct seq_file *seq, 610 struct hlist_node *head) 611 { 612 struct ct_expect_iter_state *st = seq->private; 613 614 head = rcu_dereference(hlist_next_rcu(head)); 615 while (head == NULL) { 616 if (++st->bucket >= nf_ct_expect_hsize) 617 return NULL; 618 head = rcu_dereference(hlist_first_rcu(&nf_ct_expect_hash[st->bucket])); 619 } 620 return head; 621 } 622 623 static struct hlist_node *ct_expect_get_idx(struct seq_file *seq, loff_t pos) 624 { 625 struct hlist_node *head = ct_expect_get_first(seq); 626 627 if (head) 628 while (pos && (head = ct_expect_get_next(seq, head))) 629 pos--; 630 return pos ? NULL : head; 631 } 632 633 static void *exp_seq_start(struct seq_file *seq, loff_t *pos) 634 __acquires(RCU) 635 { 636 rcu_read_lock(); 637 return ct_expect_get_idx(seq, *pos); 638 } 639 640 static void *exp_seq_next(struct seq_file *seq, void *v, loff_t *pos) 641 { 642 (*pos)++; 643 return ct_expect_get_next(seq, v); 644 } 645 646 static void exp_seq_stop(struct seq_file *seq, void *v) 647 __releases(RCU) 648 { 649 rcu_read_unlock(); 650 } 651 652 static int exp_seq_show(struct seq_file *s, void *v) 653 { 654 struct nf_conntrack_expect *expect; 655 struct nf_conntrack_helper *helper; 656 struct net *net = seq_file_net(s); 657 struct hlist_node *n = v; 658 char *delim = ""; 659 660 expect = hlist_entry(n, struct nf_conntrack_expect, hnode); 661 662 if (!net_eq(nf_ct_exp_net(expect), net)) 663 return 0; 664 665 if (expect->timeout.function) 666 seq_printf(s, "%ld ", timer_pending(&expect->timeout) 667 ? (long)(expect->timeout.expires - jiffies)/HZ : 0); 668 else 669 seq_puts(s, "- "); 670 seq_printf(s, "l3proto = %u proto=%u ", 671 expect->tuple.src.l3num, 672 expect->tuple.dst.protonum); 673 print_tuple(s, &expect->tuple, 674 nf_ct_l4proto_find(expect->tuple.dst.protonum)); 675 676 if (expect->flags & NF_CT_EXPECT_PERMANENT) { 677 seq_puts(s, "PERMANENT"); 678 delim = ","; 679 } 680 if (expect->flags & NF_CT_EXPECT_INACTIVE) { 681 seq_printf(s, "%sINACTIVE", delim); 682 delim = ","; 683 } 684 if (expect->flags & NF_CT_EXPECT_USERSPACE) 685 seq_printf(s, "%sUSERSPACE", delim); 686 687 helper = rcu_dereference(expect->helper); 688 if (helper) { 689 seq_printf(s, "%s%s", expect->flags ? " " : "", helper->name); 690 if (helper->expect_policy[expect->class].name[0]) 691 seq_printf(s, "/%s", 692 helper->expect_policy[expect->class].name); 693 } 694 695 seq_putc(s, '\n'); 696 697 return 0; 698 } 699 700 static const struct seq_operations exp_seq_ops = { 701 .start = exp_seq_start, 702 .next = exp_seq_next, 703 .stop = exp_seq_stop, 704 .show = exp_seq_show 705 }; 706 #endif /* CONFIG_NF_CONNTRACK_PROCFS */ 707 708 static int exp_proc_init(struct net *net) 709 { 710 #ifdef CONFIG_NF_CONNTRACK_PROCFS 711 struct proc_dir_entry *proc; 712 kuid_t root_uid; 713 kgid_t root_gid; 714 715 proc = proc_create_net("nf_conntrack_expect", 0440, net->proc_net, 716 &exp_seq_ops, sizeof(struct ct_expect_iter_state)); 717 if (!proc) 718 return -ENOMEM; 719 720 root_uid = make_kuid(net->user_ns, 0); 721 root_gid = make_kgid(net->user_ns, 0); 722 if (uid_valid(root_uid) && gid_valid(root_gid)) 723 proc_set_user(proc, root_uid, root_gid); 724 #endif /* CONFIG_NF_CONNTRACK_PROCFS */ 725 return 0; 726 } 727 728 static void exp_proc_remove(struct net *net) 729 { 730 #ifdef CONFIG_NF_CONNTRACK_PROCFS 731 remove_proc_entry("nf_conntrack_expect", net->proc_net); 732 #endif /* CONFIG_NF_CONNTRACK_PROCFS */ 733 } 734 735 module_param_named(expect_hashsize, nf_ct_expect_hsize, uint, 0400); 736 737 int nf_conntrack_expect_pernet_init(struct net *net) 738 { 739 return exp_proc_init(net); 740 } 741 742 void nf_conntrack_expect_pernet_fini(struct net *net) 743 { 744 exp_proc_remove(net); 745 } 746 747 int nf_conntrack_expect_init(void) 748 { 749 if (!nf_ct_expect_hsize) { 750 nf_ct_expect_hsize = nf_conntrack_htable_size / 256; 751 if (!nf_ct_expect_hsize) 752 nf_ct_expect_hsize = 1; 753 } 754 nf_ct_expect_max = nf_ct_expect_hsize * 4; 755 nf_ct_expect_cachep = KMEM_CACHE(nf_conntrack_expect, 0); 756 if (!nf_ct_expect_cachep) 757 return -ENOMEM; 758 759 nf_ct_expect_hash = nf_ct_alloc_hashtable(&nf_ct_expect_hsize, 0); 760 if (!nf_ct_expect_hash) { 761 kmem_cache_destroy(nf_ct_expect_cachep); 762 return -ENOMEM; 763 } 764 765 return 0; 766 } 767 768 void nf_conntrack_expect_fini(void) 769 { 770 rcu_barrier(); /* Wait for call_rcu() before destroy */ 771 kmem_cache_destroy(nf_ct_expect_cachep); 772 kvfree(nf_ct_expect_hash); 773 } 774