~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/nfnetlink_cttimeout.c

Version: ~ [ linux-5.7-rc7 ] ~ [ linux-5.6.14 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.42 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.124 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.181 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.224 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.224 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.84 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
  3  * (C) 2012 by Vyatta Inc. <http://www.vyatta.com>
  4  *
  5  * This program is free software; you can redistribute it and/or modify
  6  * it under the terms of the GNU General Public License version 2 as
  7  * published by the Free Software Foundation (or any later at your option).
  8  */
  9 #include <linux/init.h>
 10 #include <linux/module.h>
 11 #include <linux/kernel.h>
 12 #include <linux/rculist.h>
 13 #include <linux/rculist_nulls.h>
 14 #include <linux/types.h>
 15 #include <linux/timer.h>
 16 #include <linux/security.h>
 17 #include <linux/skbuff.h>
 18 #include <linux/errno.h>
 19 #include <linux/netlink.h>
 20 #include <linux/spinlock.h>
 21 #include <linux/interrupt.h>
 22 #include <linux/slab.h>
 23 
 24 #include <linux/netfilter.h>
 25 #include <net/netlink.h>
 26 #include <net/sock.h>
 27 #include <net/netfilter/nf_conntrack.h>
 28 #include <net/netfilter/nf_conntrack_core.h>
 29 #include <net/netfilter/nf_conntrack_l3proto.h>
 30 #include <net/netfilter/nf_conntrack_l4proto.h>
 31 #include <net/netfilter/nf_conntrack_tuple.h>
 32 #include <net/netfilter/nf_conntrack_timeout.h>
 33 
 34 #include <linux/netfilter/nfnetlink.h>
 35 #include <linux/netfilter/nfnetlink_cttimeout.h>
 36 
 37 MODULE_LICENSE("GPL");
 38 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
 39 MODULE_DESCRIPTION("cttimeout: Extended Netfilter Connection Tracking timeout tuning");
 40 
 41 static const struct nla_policy cttimeout_nla_policy[CTA_TIMEOUT_MAX+1] = {
 42         [CTA_TIMEOUT_NAME]      = { .type = NLA_NUL_STRING,
 43                                     .len  = CTNL_TIMEOUT_NAME_MAX - 1},
 44         [CTA_TIMEOUT_L3PROTO]   = { .type = NLA_U16 },
 45         [CTA_TIMEOUT_L4PROTO]   = { .type = NLA_U8 },
 46         [CTA_TIMEOUT_DATA]      = { .type = NLA_NESTED },
 47 };
 48 
 49 static int
 50 ctnl_timeout_parse_policy(void *timeouts, struct nf_conntrack_l4proto *l4proto,
 51                           struct net *net, const struct nlattr *attr)
 52 {
 53         int ret = 0;
 54 
 55         if (likely(l4proto->ctnl_timeout.nlattr_to_obj)) {
 56                 struct nlattr *tb[l4proto->ctnl_timeout.nlattr_max+1];
 57 
 58                 ret = nla_parse_nested(tb, l4proto->ctnl_timeout.nlattr_max,
 59                                        attr, l4proto->ctnl_timeout.nla_policy,
 60                                        NULL);
 61                 if (ret < 0)
 62                         return ret;
 63 
 64                 ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
 65         }
 66         return ret;
 67 }
 68 
 69 static int cttimeout_new_timeout(struct net *net, struct sock *ctnl,
 70                                  struct sk_buff *skb,
 71                                  const struct nlmsghdr *nlh,
 72                                  const struct nlattr * const cda[],
 73                                  struct netlink_ext_ack *extack)
 74 {
 75         __u16 l3num;
 76         __u8 l4num;
 77         struct nf_conntrack_l4proto *l4proto;
 78         struct ctnl_timeout *timeout, *matching = NULL;
 79         char *name;
 80         int ret;
 81 
 82         if (!cda[CTA_TIMEOUT_NAME] ||
 83             !cda[CTA_TIMEOUT_L3PROTO] ||
 84             !cda[CTA_TIMEOUT_L4PROTO] ||
 85             !cda[CTA_TIMEOUT_DATA])
 86                 return -EINVAL;
 87 
 88         name = nla_data(cda[CTA_TIMEOUT_NAME]);
 89         l3num = ntohs(nla_get_be16(cda[CTA_TIMEOUT_L3PROTO]));
 90         l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]);
 91 
 92         list_for_each_entry(timeout, &net->nfct_timeout_list, head) {
 93                 if (strncmp(timeout->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
 94                         continue;
 95 
 96                 if (nlh->nlmsg_flags & NLM_F_EXCL)
 97                         return -EEXIST;
 98 
 99                 matching = timeout;
100                 break;
101         }
102 
103         if (matching) {
104                 if (nlh->nlmsg_flags & NLM_F_REPLACE) {
105                         /* You cannot replace one timeout policy by another of
106                          * different kind, sorry.
107                          */
108                         if (matching->l3num != l3num ||
109                             matching->l4proto->l4proto != l4num)
110                                 return -EINVAL;
111 
112                         return ctnl_timeout_parse_policy(&matching->data,
113                                                          matching->l4proto, net,
114                                                          cda[CTA_TIMEOUT_DATA]);
115                 }
116 
117                 return -EBUSY;
118         }
119 
120         l4proto = nf_ct_l4proto_find_get(l3num, l4num);
121 
122         /* This protocol is not supportted, skip. */
123         if (l4proto->l4proto != l4num) {
124                 ret = -EOPNOTSUPP;
125                 goto err_proto_put;
126         }
127 
128         timeout = kzalloc(sizeof(struct ctnl_timeout) +
129                           l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
130         if (timeout == NULL) {
131                 ret = -ENOMEM;
132                 goto err_proto_put;
133         }
134 
135         ret = ctnl_timeout_parse_policy(&timeout->data, l4proto, net,
136                                         cda[CTA_TIMEOUT_DATA]);
137         if (ret < 0)
138                 goto err;
139 
140         strcpy(timeout->name, nla_data(cda[CTA_TIMEOUT_NAME]));
141         timeout->l3num = l3num;
142         timeout->l4proto = l4proto;
143         refcount_set(&timeout->refcnt, 1);
144         list_add_tail_rcu(&timeout->head, &net->nfct_timeout_list);
145 
146         return 0;
147 err:
148         kfree(timeout);
149 err_proto_put:
150         nf_ct_l4proto_put(l4proto);
151         return ret;
152 }
153 
154 static int
155 ctnl_timeout_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
156                        int event, struct ctnl_timeout *timeout)
157 {
158         struct nlmsghdr *nlh;
159         struct nfgenmsg *nfmsg;
160         unsigned int flags = portid ? NLM_F_MULTI : 0;
161         struct nf_conntrack_l4proto *l4proto = timeout->l4proto;
162 
163         event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_TIMEOUT, event);
164         nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
165         if (nlh == NULL)
166                 goto nlmsg_failure;
167 
168         nfmsg = nlmsg_data(nlh);
169         nfmsg->nfgen_family = AF_UNSPEC;
170         nfmsg->version = NFNETLINK_V0;
171         nfmsg->res_id = 0;
172 
173         if (nla_put_string(skb, CTA_TIMEOUT_NAME, timeout->name) ||
174             nla_put_be16(skb, CTA_TIMEOUT_L3PROTO, htons(timeout->l3num)) ||
175             nla_put_u8(skb, CTA_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) ||
176             nla_put_be32(skb, CTA_TIMEOUT_USE,
177                          htonl(refcount_read(&timeout->refcnt))))
178                 goto nla_put_failure;
179 
180         if (likely(l4proto->ctnl_timeout.obj_to_nlattr)) {
181                 struct nlattr *nest_parms;
182                 int ret;
183 
184                 nest_parms = nla_nest_start(skb,
185                                             CTA_TIMEOUT_DATA | NLA_F_NESTED);
186                 if (!nest_parms)
187                         goto nla_put_failure;
188 
189                 ret = l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data);
190                 if (ret < 0)
191                         goto nla_put_failure;
192 
193                 nla_nest_end(skb, nest_parms);
194         }
195 
196         nlmsg_end(skb, nlh);
197         return skb->len;
198 
199 nlmsg_failure:
200 nla_put_failure:
201         nlmsg_cancel(skb, nlh);
202         return -1;
203 }
204 
205 static int
206 ctnl_timeout_dump(struct sk_buff *skb, struct netlink_callback *cb)
207 {
208         struct net *net = sock_net(skb->sk);
209         struct ctnl_timeout *cur, *last;
210 
211         if (cb->args[2])
212                 return 0;
213 
214         last = (struct ctnl_timeout *)cb->args[1];
215         if (cb->args[1])
216                 cb->args[1] = 0;
217 
218         rcu_read_lock();
219         list_for_each_entry_rcu(cur, &net->nfct_timeout_list, head) {
220                 if (last) {
221                         if (cur != last)
222                                 continue;
223 
224                         last = NULL;
225                 }
226                 if (ctnl_timeout_fill_info(skb, NETLINK_CB(cb->skb).portid,
227                                            cb->nlh->nlmsg_seq,
228                                            NFNL_MSG_TYPE(cb->nlh->nlmsg_type),
229                                            IPCTNL_MSG_TIMEOUT_NEW, cur) < 0) {
230                         cb->args[1] = (unsigned long)cur;
231                         break;
232                 }
233         }
234         if (!cb->args[1])
235                 cb->args[2] = 1;
236         rcu_read_unlock();
237         return skb->len;
238 }
239 
240 static int cttimeout_get_timeout(struct net *net, struct sock *ctnl,
241                                  struct sk_buff *skb,
242                                  const struct nlmsghdr *nlh,
243                                  const struct nlattr * const cda[],
244                                  struct netlink_ext_ack *extack)
245 {
246         int ret = -ENOENT;
247         char *name;
248         struct ctnl_timeout *cur;
249 
250         if (nlh->nlmsg_flags & NLM_F_DUMP) {
251                 struct netlink_dump_control c = {
252                         .dump = ctnl_timeout_dump,
253                 };
254                 return netlink_dump_start(ctnl, skb, nlh, &c);
255         }
256 
257         if (!cda[CTA_TIMEOUT_NAME])
258                 return -EINVAL;
259         name = nla_data(cda[CTA_TIMEOUT_NAME]);
260 
261         list_for_each_entry(cur, &net->nfct_timeout_list, head) {
262                 struct sk_buff *skb2;
263 
264                 if (strncmp(cur->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
265                         continue;
266 
267                 skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
268                 if (skb2 == NULL) {
269                         ret = -ENOMEM;
270                         break;
271                 }
272 
273                 ret = ctnl_timeout_fill_info(skb2, NETLINK_CB(skb).portid,
274                                              nlh->nlmsg_seq,
275                                              NFNL_MSG_TYPE(nlh->nlmsg_type),
276                                              IPCTNL_MSG_TIMEOUT_NEW, cur);
277                 if (ret <= 0) {
278                         kfree_skb(skb2);
279                         break;
280                 }
281                 ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid,
282                                         MSG_DONTWAIT);
283                 if (ret > 0)
284                         ret = 0;
285 
286                 /* this avoids a loop in nfnetlink. */
287                 return ret == -EAGAIN ? -ENOBUFS : ret;
288         }
289         return ret;
290 }
291 
292 static int untimeout(struct nf_conn *ct, void *timeout)
293 {
294         struct nf_conn_timeout *timeout_ext = nf_ct_timeout_find(ct);
295 
296         if (timeout_ext && (!timeout || timeout_ext->timeout == timeout))
297                 RCU_INIT_POINTER(timeout_ext->timeout, NULL);
298 
299         /* We are not intended to delete this conntrack. */
300         return 0;
301 }
302 
303 static void ctnl_untimeout(struct net *net, struct ctnl_timeout *timeout)
304 {
305         nf_ct_iterate_cleanup_net(net, untimeout, timeout, 0, 0);
306 }
307 
308 /* try to delete object, fail if it is still in use. */
309 static int ctnl_timeout_try_del(struct net *net, struct ctnl_timeout *timeout)
310 {
311         int ret = 0;
312 
313         /* We want to avoid races with ctnl_timeout_put. So only when the
314          * current refcnt is 1, we decrease it to 0.
315          */
316         if (refcount_dec_if_one(&timeout->refcnt)) {
317                 /* We are protected by nfnl mutex. */
318                 list_del_rcu(&timeout->head);
319                 nf_ct_l4proto_put(timeout->l4proto);
320                 ctnl_untimeout(net, timeout);
321                 kfree_rcu(timeout, rcu_head);
322         } else {
323                 ret = -EBUSY;
324         }
325         return ret;
326 }
327 
328 static int cttimeout_del_timeout(struct net *net, struct sock *ctnl,
329                                  struct sk_buff *skb,
330                                  const struct nlmsghdr *nlh,
331                                  const struct nlattr * const cda[],
332                                  struct netlink_ext_ack *extack)
333 {
334         struct ctnl_timeout *cur, *tmp;
335         int ret = -ENOENT;
336         char *name;
337 
338         if (!cda[CTA_TIMEOUT_NAME]) {
339                 list_for_each_entry_safe(cur, tmp, &net->nfct_timeout_list,
340                                          head)
341                         ctnl_timeout_try_del(net, cur);
342 
343                 return 0;
344         }
345         name = nla_data(cda[CTA_TIMEOUT_NAME]);
346 
347         list_for_each_entry(cur, &net->nfct_timeout_list, head) {
348                 if (strncmp(cur->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
349                         continue;
350 
351                 ret = ctnl_timeout_try_del(net, cur);
352                 if (ret < 0)
353                         return ret;
354 
355                 break;
356         }
357         return ret;
358 }
359 
360 static int cttimeout_default_set(struct net *net, struct sock *ctnl,
361                                  struct sk_buff *skb,
362                                  const struct nlmsghdr *nlh,
363                                  const struct nlattr * const cda[],
364                                  struct netlink_ext_ack *extack)
365 {
366         __u16 l3num;
367         __u8 l4num;
368         struct nf_conntrack_l4proto *l4proto;
369         unsigned int *timeouts;
370         int ret;
371 
372         if (!cda[CTA_TIMEOUT_L3PROTO] ||
373             !cda[CTA_TIMEOUT_L4PROTO] ||
374             !cda[CTA_TIMEOUT_DATA])
375                 return -EINVAL;
376 
377         l3num = ntohs(nla_get_be16(cda[CTA_TIMEOUT_L3PROTO]));
378         l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]);
379         l4proto = nf_ct_l4proto_find_get(l3num, l4num);
380 
381         /* This protocol is not supported, skip. */
382         if (l4proto->l4proto != l4num) {
383                 ret = -EOPNOTSUPP;
384                 goto err;
385         }
386 
387         timeouts = l4proto->get_timeouts(net);
388 
389         ret = ctnl_timeout_parse_policy(timeouts, l4proto, net,
390                                         cda[CTA_TIMEOUT_DATA]);
391         if (ret < 0)
392                 goto err;
393 
394         nf_ct_l4proto_put(l4proto);
395         return 0;
396 err:
397         nf_ct_l4proto_put(l4proto);
398         return ret;
399 }
400 
401 static int
402 cttimeout_default_fill_info(struct net *net, struct sk_buff *skb, u32 portid,
403                             u32 seq, u32 type, int event,
404                             struct nf_conntrack_l4proto *l4proto)
405 {
406         struct nlmsghdr *nlh;
407         struct nfgenmsg *nfmsg;
408         unsigned int flags = portid ? NLM_F_MULTI : 0;
409 
410         event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_TIMEOUT, event);
411         nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
412         if (nlh == NULL)
413                 goto nlmsg_failure;
414 
415         nfmsg = nlmsg_data(nlh);
416         nfmsg->nfgen_family = AF_UNSPEC;
417         nfmsg->version = NFNETLINK_V0;
418         nfmsg->res_id = 0;
419 
420         if (nla_put_be16(skb, CTA_TIMEOUT_L3PROTO, htons(l4proto->l3proto)) ||
421             nla_put_u8(skb, CTA_TIMEOUT_L4PROTO, l4proto->l4proto))
422                 goto nla_put_failure;
423 
424         if (likely(l4proto->ctnl_timeout.obj_to_nlattr)) {
425                 struct nlattr *nest_parms;
426                 unsigned int *timeouts = l4proto->get_timeouts(net);
427                 int ret;
428 
429                 nest_parms = nla_nest_start(skb,
430                                             CTA_TIMEOUT_DATA | NLA_F_NESTED);
431                 if (!nest_parms)
432                         goto nla_put_failure;
433 
434                 ret = l4proto->ctnl_timeout.obj_to_nlattr(skb, timeouts);
435                 if (ret < 0)
436                         goto nla_put_failure;
437 
438                 nla_nest_end(skb, nest_parms);
439         }
440 
441         nlmsg_end(skb, nlh);
442         return skb->len;
443 
444 nlmsg_failure:
445 nla_put_failure:
446         nlmsg_cancel(skb, nlh);
447         return -1;
448 }
449 
450 static int cttimeout_default_get(struct net *net, struct sock *ctnl,
451                                  struct sk_buff *skb,
452                                  const struct nlmsghdr *nlh,
453                                  const struct nlattr * const cda[],
454                                  struct netlink_ext_ack *extack)
455 {
456         __u16 l3num;
457         __u8 l4num;
458         struct nf_conntrack_l4proto *l4proto;
459         struct sk_buff *skb2;
460         int ret, err;
461 
462         if (!cda[CTA_TIMEOUT_L3PROTO] || !cda[CTA_TIMEOUT_L4PROTO])
463                 return -EINVAL;
464 
465         l3num = ntohs(nla_get_be16(cda[CTA_TIMEOUT_L3PROTO]));
466         l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]);
467         l4proto = nf_ct_l4proto_find_get(l3num, l4num);
468 
469         /* This protocol is not supported, skip. */
470         if (l4proto->l4proto != l4num) {
471                 err = -EOPNOTSUPP;
472                 goto err;
473         }
474 
475         skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
476         if (skb2 == NULL) {
477                 err = -ENOMEM;
478                 goto err;
479         }
480 
481         ret = cttimeout_default_fill_info(net, skb2, NETLINK_CB(skb).portid,
482                                           nlh->nlmsg_seq,
483                                           NFNL_MSG_TYPE(nlh->nlmsg_type),
484                                           IPCTNL_MSG_TIMEOUT_DEFAULT_SET,
485                                           l4proto);
486         if (ret <= 0) {
487                 kfree_skb(skb2);
488                 err = -ENOMEM;
489                 goto err;
490         }
491         ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid, MSG_DONTWAIT);
492         if (ret > 0)
493                 ret = 0;
494 
495         /* this avoids a loop in nfnetlink. */
496         return ret == -EAGAIN ? -ENOBUFS : ret;
497 err:
498         nf_ct_l4proto_put(l4proto);
499         return err;
500 }
501 
502 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
503 static struct ctnl_timeout *
504 ctnl_timeout_find_get(struct net *net, const char *name)
505 {
506         struct ctnl_timeout *timeout, *matching = NULL;
507 
508         rcu_read_lock();
509         list_for_each_entry_rcu(timeout, &net->nfct_timeout_list, head) {
510                 if (strncmp(timeout->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
511                         continue;
512 
513                 if (!try_module_get(THIS_MODULE))
514                         goto err;
515 
516                 if (!refcount_inc_not_zero(&timeout->refcnt)) {
517                         module_put(THIS_MODULE);
518                         goto err;
519                 }
520                 matching = timeout;
521                 break;
522         }
523 err:
524         rcu_read_unlock();
525         return matching;
526 }
527 
528 static void ctnl_timeout_put(struct ctnl_timeout *timeout)
529 {
530         if (refcount_dec_and_test(&timeout->refcnt))
531                 kfree_rcu(timeout, rcu_head);
532 
533         module_put(THIS_MODULE);
534 }
535 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
536 
537 static const struct nfnl_callback cttimeout_cb[IPCTNL_MSG_TIMEOUT_MAX] = {
538         [IPCTNL_MSG_TIMEOUT_NEW]        = { .call = cttimeout_new_timeout,
539                                             .attr_count = CTA_TIMEOUT_MAX,
540                                             .policy = cttimeout_nla_policy },
541         [IPCTNL_MSG_TIMEOUT_GET]        = { .call = cttimeout_get_timeout,
542                                             .attr_count = CTA_TIMEOUT_MAX,
543                                             .policy = cttimeout_nla_policy },
544         [IPCTNL_MSG_TIMEOUT_DELETE]     = { .call = cttimeout_del_timeout,
545                                             .attr_count = CTA_TIMEOUT_MAX,
546                                             .policy = cttimeout_nla_policy },
547         [IPCTNL_MSG_TIMEOUT_DEFAULT_SET]= { .call = cttimeout_default_set,
548                                             .attr_count = CTA_TIMEOUT_MAX,
549                                             .policy = cttimeout_nla_policy },
550         [IPCTNL_MSG_TIMEOUT_DEFAULT_GET]= { .call = cttimeout_default_get,
551                                             .attr_count = CTA_TIMEOUT_MAX,
552                                             .policy = cttimeout_nla_policy },
553 };
554 
555 static const struct nfnetlink_subsystem cttimeout_subsys = {
556         .name                           = "conntrack_timeout",
557         .subsys_id                      = NFNL_SUBSYS_CTNETLINK_TIMEOUT,
558         .cb_count                       = IPCTNL_MSG_TIMEOUT_MAX,
559         .cb                             = cttimeout_cb,
560 };
561 
562 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_TIMEOUT);
563 
564 static int __net_init cttimeout_net_init(struct net *net)
565 {
566         INIT_LIST_HEAD(&net->nfct_timeout_list);
567 
568         return 0;
569 }
570 
571 static void __net_exit cttimeout_net_exit(struct net *net)
572 {
573         struct ctnl_timeout *cur, *tmp;
574 
575         ctnl_untimeout(net, NULL);
576 
577         list_for_each_entry_safe(cur, tmp, &net->nfct_timeout_list, head) {
578                 list_del_rcu(&cur->head);
579                 nf_ct_l4proto_put(cur->l4proto);
580 
581                 if (refcount_dec_and_test(&cur->refcnt))
582                         kfree_rcu(cur, rcu_head);
583         }
584 }
585 
586 static struct pernet_operations cttimeout_ops = {
587         .init   = cttimeout_net_init,
588         .exit   = cttimeout_net_exit,
589 };
590 
591 static int __init cttimeout_init(void)
592 {
593         int ret;
594 
595         ret = register_pernet_subsys(&cttimeout_ops);
596         if (ret < 0)
597                 return ret;
598 
599         ret = nfnetlink_subsys_register(&cttimeout_subsys);
600         if (ret < 0) {
601                 pr_err("cttimeout_init: cannot register cttimeout with "
602                         "nfnetlink.\n");
603                 goto err_out;
604         }
605 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
606         RCU_INIT_POINTER(nf_ct_timeout_find_get_hook, ctnl_timeout_find_get);
607         RCU_INIT_POINTER(nf_ct_timeout_put_hook, ctnl_timeout_put);
608 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
609         return 0;
610 
611 err_out:
612         unregister_pernet_subsys(&cttimeout_ops);
613         return ret;
614 }
615 
616 static void __exit cttimeout_exit(void)
617 {
618         pr_info("cttimeout: unregistering from nfnetlink.\n");
619 
620         nfnetlink_subsys_unregister(&cttimeout_subsys);
621 
622         unregister_pernet_subsys(&cttimeout_ops);
623 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
624         RCU_INIT_POINTER(nf_ct_timeout_find_get_hook, NULL);
625         RCU_INIT_POINTER(nf_ct_timeout_put_hook, NULL);
626         synchronize_rcu();
627 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
628 }
629 
630 module_init(cttimeout_init);
631 module_exit(cttimeout_exit);
632 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp