~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/nfnetlink_cttimeout.c

Version: ~ [ linux-5.10-rc1 ] ~ [ linux-5.9.1 ] ~ [ linux-5.8.16 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.72 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.152 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.202 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.240 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.240 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.85 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
  3  * (C) 2012 by Vyatta Inc. <http://www.vyatta.com>
  4  *
  5  * This program is free software; you can redistribute it and/or modify
  6  * it under the terms of the GNU General Public License version 2 as
  7  * published by the Free Software Foundation (or any later at your option).
  8  */
  9 #include <linux/init.h>
 10 #include <linux/module.h>
 11 #include <linux/kernel.h>
 12 #include <linux/rculist.h>
 13 #include <linux/rculist_nulls.h>
 14 #include <linux/types.h>
 15 #include <linux/timer.h>
 16 #include <linux/security.h>
 17 #include <linux/skbuff.h>
 18 #include <linux/errno.h>
 19 #include <linux/netlink.h>
 20 #include <linux/spinlock.h>
 21 #include <linux/interrupt.h>
 22 #include <linux/slab.h>
 23 
 24 #include <linux/netfilter.h>
 25 #include <net/netlink.h>
 26 #include <net/sock.h>
 27 #include <net/netfilter/nf_conntrack.h>
 28 #include <net/netfilter/nf_conntrack_core.h>
 29 #include <net/netfilter/nf_conntrack_l3proto.h>
 30 #include <net/netfilter/nf_conntrack_l4proto.h>
 31 #include <net/netfilter/nf_conntrack_tuple.h>
 32 #include <net/netfilter/nf_conntrack_timeout.h>
 33 
 34 #include <linux/netfilter/nfnetlink.h>
 35 #include <linux/netfilter/nfnetlink_cttimeout.h>
 36 
 37 MODULE_LICENSE("GPL");
 38 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
 39 MODULE_DESCRIPTION("cttimeout: Extended Netfilter Connection Tracking timeout tuning");
 40 
 41 static const struct nla_policy cttimeout_nla_policy[CTA_TIMEOUT_MAX+1] = {
 42         [CTA_TIMEOUT_NAME]      = { .type = NLA_NUL_STRING,
 43                                     .len  = CTNL_TIMEOUT_NAME_MAX - 1},
 44         [CTA_TIMEOUT_L3PROTO]   = { .type = NLA_U16 },
 45         [CTA_TIMEOUT_L4PROTO]   = { .type = NLA_U8 },
 46         [CTA_TIMEOUT_DATA]      = { .type = NLA_NESTED },
 47 };
 48 
 49 static int
 50 ctnl_timeout_parse_policy(void *timeouts, struct nf_conntrack_l4proto *l4proto,
 51                           struct net *net, const struct nlattr *attr)
 52 {
 53         int ret = 0;
 54 
 55         if (likely(l4proto->ctnl_timeout.nlattr_to_obj)) {
 56                 struct nlattr *tb[l4proto->ctnl_timeout.nlattr_max+1];
 57 
 58                 ret = nla_parse_nested(tb, l4proto->ctnl_timeout.nlattr_max,
 59                                        attr, l4proto->ctnl_timeout.nla_policy);
 60                 if (ret < 0)
 61                         return ret;
 62 
 63                 ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
 64         }
 65         return ret;
 66 }
 67 
 68 static int cttimeout_new_timeout(struct net *net, struct sock *ctnl,
 69                                  struct sk_buff *skb,
 70                                  const struct nlmsghdr *nlh,
 71                                  const struct nlattr * const cda[])
 72 {
 73         __u16 l3num;
 74         __u8 l4num;
 75         struct nf_conntrack_l4proto *l4proto;
 76         struct ctnl_timeout *timeout, *matching = NULL;
 77         char *name;
 78         int ret;
 79 
 80         if (!cda[CTA_TIMEOUT_NAME] ||
 81             !cda[CTA_TIMEOUT_L3PROTO] ||
 82             !cda[CTA_TIMEOUT_L4PROTO] ||
 83             !cda[CTA_TIMEOUT_DATA])
 84                 return -EINVAL;
 85 
 86         name = nla_data(cda[CTA_TIMEOUT_NAME]);
 87         l3num = ntohs(nla_get_be16(cda[CTA_TIMEOUT_L3PROTO]));
 88         l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]);
 89 
 90         list_for_each_entry(timeout, &net->nfct_timeout_list, head) {
 91                 if (strncmp(timeout->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
 92                         continue;
 93 
 94                 if (nlh->nlmsg_flags & NLM_F_EXCL)
 95                         return -EEXIST;
 96 
 97                 matching = timeout;
 98                 break;
 99         }
100 
101         l4proto = nf_ct_l4proto_find_get(l3num, l4num);
102 
103         /* This protocol is not supportted, skip. */
104         if (l4proto->l4proto != l4num) {
105                 ret = -EOPNOTSUPP;
106                 goto err_proto_put;
107         }
108 
109         if (matching) {
110                 if (nlh->nlmsg_flags & NLM_F_REPLACE) {
111                         /* You cannot replace one timeout policy by another of
112                          * different kind, sorry.
113                          */
114                         if (matching->l3num != l3num ||
115                             matching->l4proto->l4proto != l4num) {
116                                 ret = -EINVAL;
117                                 goto err_proto_put;
118                         }
119 
120                         ret = ctnl_timeout_parse_policy(&matching->data,
121                                                         l4proto, net,
122                                                         cda[CTA_TIMEOUT_DATA]);
123                         return ret;
124                 }
125                 ret = -EBUSY;
126                 goto err_proto_put;
127         }
128 
129         timeout = kzalloc(sizeof(struct ctnl_timeout) +
130                           l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
131         if (timeout == NULL) {
132                 ret = -ENOMEM;
133                 goto err_proto_put;
134         }
135 
136         ret = ctnl_timeout_parse_policy(&timeout->data, l4proto, net,
137                                         cda[CTA_TIMEOUT_DATA]);
138         if (ret < 0)
139                 goto err;
140 
141         strcpy(timeout->name, nla_data(cda[CTA_TIMEOUT_NAME]));
142         timeout->l3num = l3num;
143         timeout->l4proto = l4proto;
144         atomic_set(&timeout->refcnt, 1);
145         list_add_tail_rcu(&timeout->head, &net->nfct_timeout_list);
146 
147         return 0;
148 err:
149         kfree(timeout);
150 err_proto_put:
151         nf_ct_l4proto_put(l4proto);
152         return ret;
153 }
154 
155 static int
156 ctnl_timeout_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
157                        int event, struct ctnl_timeout *timeout)
158 {
159         struct nlmsghdr *nlh;
160         struct nfgenmsg *nfmsg;
161         unsigned int flags = portid ? NLM_F_MULTI : 0;
162         struct nf_conntrack_l4proto *l4proto = timeout->l4proto;
163 
164         event |= NFNL_SUBSYS_CTNETLINK_TIMEOUT << 8;
165         nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
166         if (nlh == NULL)
167                 goto nlmsg_failure;
168 
169         nfmsg = nlmsg_data(nlh);
170         nfmsg->nfgen_family = AF_UNSPEC;
171         nfmsg->version = NFNETLINK_V0;
172         nfmsg->res_id = 0;
173 
174         if (nla_put_string(skb, CTA_TIMEOUT_NAME, timeout->name) ||
175             nla_put_be16(skb, CTA_TIMEOUT_L3PROTO, htons(timeout->l3num)) ||
176             nla_put_u8(skb, CTA_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) ||
177             nla_put_be32(skb, CTA_TIMEOUT_USE,
178                          htonl(atomic_read(&timeout->refcnt))))
179                 goto nla_put_failure;
180 
181         if (likely(l4proto->ctnl_timeout.obj_to_nlattr)) {
182                 struct nlattr *nest_parms;
183                 int ret;
184 
185                 nest_parms = nla_nest_start(skb,
186                                             CTA_TIMEOUT_DATA | NLA_F_NESTED);
187                 if (!nest_parms)
188                         goto nla_put_failure;
189 
190                 ret = l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data);
191                 if (ret < 0)
192                         goto nla_put_failure;
193 
194                 nla_nest_end(skb, nest_parms);
195         }
196 
197         nlmsg_end(skb, nlh);
198         return skb->len;
199 
200 nlmsg_failure:
201 nla_put_failure:
202         nlmsg_cancel(skb, nlh);
203         return -1;
204 }
205 
206 static int
207 ctnl_timeout_dump(struct sk_buff *skb, struct netlink_callback *cb)
208 {
209         struct net *net = sock_net(skb->sk);
210         struct ctnl_timeout *cur, *last;
211 
212         if (cb->args[2])
213                 return 0;
214 
215         last = (struct ctnl_timeout *)cb->args[1];
216         if (cb->args[1])
217                 cb->args[1] = 0;
218 
219         rcu_read_lock();
220         list_for_each_entry_rcu(cur, &net->nfct_timeout_list, head) {
221                 if (last) {
222                         if (cur != last)
223                                 continue;
224 
225                         last = NULL;
226                 }
227                 if (ctnl_timeout_fill_info(skb, NETLINK_CB(cb->skb).portid,
228                                            cb->nlh->nlmsg_seq,
229                                            NFNL_MSG_TYPE(cb->nlh->nlmsg_type),
230                                            IPCTNL_MSG_TIMEOUT_NEW, cur) < 0) {
231                         cb->args[1] = (unsigned long)cur;
232                         break;
233                 }
234         }
235         if (!cb->args[1])
236                 cb->args[2] = 1;
237         rcu_read_unlock();
238         return skb->len;
239 }
240 
241 static int cttimeout_get_timeout(struct net *net, struct sock *ctnl,
242                                  struct sk_buff *skb,
243                                  const struct nlmsghdr *nlh,
244                                  const struct nlattr * const cda[])
245 {
246         int ret = -ENOENT;
247         char *name;
248         struct ctnl_timeout *cur;
249 
250         if (nlh->nlmsg_flags & NLM_F_DUMP) {
251                 struct netlink_dump_control c = {
252                         .dump = ctnl_timeout_dump,
253                 };
254                 return netlink_dump_start(ctnl, skb, nlh, &c);
255         }
256 
257         if (!cda[CTA_TIMEOUT_NAME])
258                 return -EINVAL;
259         name = nla_data(cda[CTA_TIMEOUT_NAME]);
260 
261         list_for_each_entry(cur, &net->nfct_timeout_list, head) {
262                 struct sk_buff *skb2;
263 
264                 if (strncmp(cur->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
265                         continue;
266 
267                 skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
268                 if (skb2 == NULL) {
269                         ret = -ENOMEM;
270                         break;
271                 }
272 
273                 ret = ctnl_timeout_fill_info(skb2, NETLINK_CB(skb).portid,
274                                              nlh->nlmsg_seq,
275                                              NFNL_MSG_TYPE(nlh->nlmsg_type),
276                                              IPCTNL_MSG_TIMEOUT_NEW, cur);
277                 if (ret <= 0) {
278                         kfree_skb(skb2);
279                         break;
280                 }
281                 ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid,
282                                         MSG_DONTWAIT);
283                 if (ret > 0)
284                         ret = 0;
285 
286                 /* this avoids a loop in nfnetlink. */
287                 return ret == -EAGAIN ? -ENOBUFS : ret;
288         }
289         return ret;
290 }
291 
292 static void untimeout(struct nf_conntrack_tuple_hash *i,
293                       struct ctnl_timeout *timeout)
294 {
295         struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(i);
296         struct nf_conn_timeout *timeout_ext = nf_ct_timeout_find(ct);
297 
298         if (timeout_ext && (!timeout || timeout_ext->timeout == timeout))
299                 RCU_INIT_POINTER(timeout_ext->timeout, NULL);
300 }
301 
302 static void ctnl_untimeout(struct net *net, struct ctnl_timeout *timeout)
303 {
304         struct nf_conntrack_tuple_hash *h;
305         const struct hlist_nulls_node *nn;
306         int i;
307 
308         local_bh_disable();
309         for (i = 0; i < nf_conntrack_htable_size; i++) {
310                 nf_conntrack_lock(&nf_conntrack_locks[i % CONNTRACK_LOCKS]);
311                 if (i < nf_conntrack_htable_size) {
312                         hlist_nulls_for_each_entry(h, nn, &nf_conntrack_hash[i], hnnode)
313                                 untimeout(h, timeout);
314                 }
315                 spin_unlock(&nf_conntrack_locks[i % CONNTRACK_LOCKS]);
316         }
317         local_bh_enable();
318 }
319 
320 /* try to delete object, fail if it is still in use. */
321 static int ctnl_timeout_try_del(struct net *net, struct ctnl_timeout *timeout)
322 {
323         int ret = 0;
324 
325         /* we want to avoid races with nf_ct_timeout_find_get. */
326         if (atomic_dec_and_test(&timeout->refcnt)) {
327                 /* We are protected by nfnl mutex. */
328                 list_del_rcu(&timeout->head);
329                 nf_ct_l4proto_put(timeout->l4proto);
330                 ctnl_untimeout(net, timeout);
331                 kfree_rcu(timeout, rcu_head);
332         } else {
333                 /* still in use, restore reference counter. */
334                 atomic_inc(&timeout->refcnt);
335                 ret = -EBUSY;
336         }
337         return ret;
338 }
339 
340 static int cttimeout_del_timeout(struct net *net, struct sock *ctnl,
341                                  struct sk_buff *skb,
342                                  const struct nlmsghdr *nlh,
343                                  const struct nlattr * const cda[])
344 {
345         struct ctnl_timeout *cur;
346         int ret = -ENOENT;
347         char *name;
348 
349         if (!cda[CTA_TIMEOUT_NAME]) {
350                 list_for_each_entry(cur, &net->nfct_timeout_list, head)
351                         ctnl_timeout_try_del(net, cur);
352 
353                 return 0;
354         }
355         name = nla_data(cda[CTA_TIMEOUT_NAME]);
356 
357         list_for_each_entry(cur, &net->nfct_timeout_list, head) {
358                 if (strncmp(cur->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
359                         continue;
360 
361                 ret = ctnl_timeout_try_del(net, cur);
362                 if (ret < 0)
363                         return ret;
364 
365                 break;
366         }
367         return ret;
368 }
369 
370 static int cttimeout_default_set(struct net *net, struct sock *ctnl,
371                                  struct sk_buff *skb,
372                                  const struct nlmsghdr *nlh,
373                                  const struct nlattr * const cda[])
374 {
375         __u16 l3num;
376         __u8 l4num;
377         struct nf_conntrack_l4proto *l4proto;
378         unsigned int *timeouts;
379         int ret;
380 
381         if (!cda[CTA_TIMEOUT_L3PROTO] ||
382             !cda[CTA_TIMEOUT_L4PROTO] ||
383             !cda[CTA_TIMEOUT_DATA])
384                 return -EINVAL;
385 
386         l3num = ntohs(nla_get_be16(cda[CTA_TIMEOUT_L3PROTO]));
387         l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]);
388         l4proto = nf_ct_l4proto_find_get(l3num, l4num);
389 
390         /* This protocol is not supported, skip. */
391         if (l4proto->l4proto != l4num) {
392                 ret = -EOPNOTSUPP;
393                 goto err;
394         }
395 
396         timeouts = l4proto->get_timeouts(net);
397 
398         ret = ctnl_timeout_parse_policy(timeouts, l4proto, net,
399                                         cda[CTA_TIMEOUT_DATA]);
400         if (ret < 0)
401                 goto err;
402 
403         nf_ct_l4proto_put(l4proto);
404         return 0;
405 err:
406         nf_ct_l4proto_put(l4proto);
407         return ret;
408 }
409 
410 static int
411 cttimeout_default_fill_info(struct net *net, struct sk_buff *skb, u32 portid,
412                             u32 seq, u32 type, int event,
413                             struct nf_conntrack_l4proto *l4proto)
414 {
415         struct nlmsghdr *nlh;
416         struct nfgenmsg *nfmsg;
417         unsigned int flags = portid ? NLM_F_MULTI : 0;
418 
419         event |= NFNL_SUBSYS_CTNETLINK_TIMEOUT << 8;
420         nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
421         if (nlh == NULL)
422                 goto nlmsg_failure;
423 
424         nfmsg = nlmsg_data(nlh);
425         nfmsg->nfgen_family = AF_UNSPEC;
426         nfmsg->version = NFNETLINK_V0;
427         nfmsg->res_id = 0;
428 
429         if (nla_put_be16(skb, CTA_TIMEOUT_L3PROTO, htons(l4proto->l3proto)) ||
430             nla_put_u8(skb, CTA_TIMEOUT_L4PROTO, l4proto->l4proto))
431                 goto nla_put_failure;
432 
433         if (likely(l4proto->ctnl_timeout.obj_to_nlattr)) {
434                 struct nlattr *nest_parms;
435                 unsigned int *timeouts = l4proto->get_timeouts(net);
436                 int ret;
437 
438                 nest_parms = nla_nest_start(skb,
439                                             CTA_TIMEOUT_DATA | NLA_F_NESTED);
440                 if (!nest_parms)
441                         goto nla_put_failure;
442 
443                 ret = l4proto->ctnl_timeout.obj_to_nlattr(skb, timeouts);
444                 if (ret < 0)
445                         goto nla_put_failure;
446 
447                 nla_nest_end(skb, nest_parms);
448         }
449 
450         nlmsg_end(skb, nlh);
451         return skb->len;
452 
453 nlmsg_failure:
454 nla_put_failure:
455         nlmsg_cancel(skb, nlh);
456         return -1;
457 }
458 
459 static int cttimeout_default_get(struct net *net, struct sock *ctnl,
460                                  struct sk_buff *skb,
461                                  const struct nlmsghdr *nlh,
462                                  const struct nlattr * const cda[])
463 {
464         __u16 l3num;
465         __u8 l4num;
466         struct nf_conntrack_l4proto *l4proto;
467         struct sk_buff *skb2;
468         int ret, err;
469 
470         if (!cda[CTA_TIMEOUT_L3PROTO] || !cda[CTA_TIMEOUT_L4PROTO])
471                 return -EINVAL;
472 
473         l3num = ntohs(nla_get_be16(cda[CTA_TIMEOUT_L3PROTO]));
474         l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]);
475         l4proto = nf_ct_l4proto_find_get(l3num, l4num);
476 
477         /* This protocol is not supported, skip. */
478         if (l4proto->l4proto != l4num) {
479                 err = -EOPNOTSUPP;
480                 goto err;
481         }
482 
483         skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
484         if (skb2 == NULL) {
485                 err = -ENOMEM;
486                 goto err;
487         }
488 
489         ret = cttimeout_default_fill_info(net, skb2, NETLINK_CB(skb).portid,
490                                           nlh->nlmsg_seq,
491                                           NFNL_MSG_TYPE(nlh->nlmsg_type),
492                                           IPCTNL_MSG_TIMEOUT_DEFAULT_SET,
493                                           l4proto);
494         if (ret <= 0) {
495                 kfree_skb(skb2);
496                 err = -ENOMEM;
497                 goto err;
498         }
499         ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid, MSG_DONTWAIT);
500         if (ret > 0)
501                 ret = 0;
502 
503         /* this avoids a loop in nfnetlink. */
504         return ret == -EAGAIN ? -ENOBUFS : ret;
505 err:
506         nf_ct_l4proto_put(l4proto);
507         return err;
508 }
509 
510 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
511 static struct ctnl_timeout *
512 ctnl_timeout_find_get(struct net *net, const char *name)
513 {
514         struct ctnl_timeout *timeout, *matching = NULL;
515 
516         rcu_read_lock();
517         list_for_each_entry_rcu(timeout, &net->nfct_timeout_list, head) {
518                 if (strncmp(timeout->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
519                         continue;
520 
521                 if (!try_module_get(THIS_MODULE))
522                         goto err;
523 
524                 if (!atomic_inc_not_zero(&timeout->refcnt)) {
525                         module_put(THIS_MODULE);
526                         goto err;
527                 }
528                 matching = timeout;
529                 break;
530         }
531 err:
532         rcu_read_unlock();
533         return matching;
534 }
535 
536 static void ctnl_timeout_put(struct ctnl_timeout *timeout)
537 {
538         atomic_dec(&timeout->refcnt);
539         module_put(THIS_MODULE);
540 }
541 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
542 
543 static const struct nfnl_callback cttimeout_cb[IPCTNL_MSG_TIMEOUT_MAX] = {
544         [IPCTNL_MSG_TIMEOUT_NEW]        = { .call = cttimeout_new_timeout,
545                                             .attr_count = CTA_TIMEOUT_MAX,
546                                             .policy = cttimeout_nla_policy },
547         [IPCTNL_MSG_TIMEOUT_GET]        = { .call = cttimeout_get_timeout,
548                                             .attr_count = CTA_TIMEOUT_MAX,
549                                             .policy = cttimeout_nla_policy },
550         [IPCTNL_MSG_TIMEOUT_DELETE]     = { .call = cttimeout_del_timeout,
551                                             .attr_count = CTA_TIMEOUT_MAX,
552                                             .policy = cttimeout_nla_policy },
553         [IPCTNL_MSG_TIMEOUT_DEFAULT_SET]= { .call = cttimeout_default_set,
554                                             .attr_count = CTA_TIMEOUT_MAX,
555                                             .policy = cttimeout_nla_policy },
556         [IPCTNL_MSG_TIMEOUT_DEFAULT_GET]= { .call = cttimeout_default_get,
557                                             .attr_count = CTA_TIMEOUT_MAX,
558                                             .policy = cttimeout_nla_policy },
559 };
560 
561 static const struct nfnetlink_subsystem cttimeout_subsys = {
562         .name                           = "conntrack_timeout",
563         .subsys_id                      = NFNL_SUBSYS_CTNETLINK_TIMEOUT,
564         .cb_count                       = IPCTNL_MSG_TIMEOUT_MAX,
565         .cb                             = cttimeout_cb,
566 };
567 
568 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_TIMEOUT);
569 
570 static int __net_init cttimeout_net_init(struct net *net)
571 {
572         INIT_LIST_HEAD(&net->nfct_timeout_list);
573 
574         return 0;
575 }
576 
577 static void __net_exit cttimeout_net_exit(struct net *net)
578 {
579         struct ctnl_timeout *cur, *tmp;
580 
581         ctnl_untimeout(net, NULL);
582 
583         list_for_each_entry_safe(cur, tmp, &net->nfct_timeout_list, head) {
584                 list_del_rcu(&cur->head);
585                 nf_ct_l4proto_put(cur->l4proto);
586                 kfree_rcu(cur, rcu_head);
587         }
588 }
589 
590 static struct pernet_operations cttimeout_ops = {
591         .init   = cttimeout_net_init,
592         .exit   = cttimeout_net_exit,
593 };
594 
595 static int __init cttimeout_init(void)
596 {
597         int ret;
598 
599         ret = register_pernet_subsys(&cttimeout_ops);
600         if (ret < 0)
601                 return ret;
602 
603         ret = nfnetlink_subsys_register(&cttimeout_subsys);
604         if (ret < 0) {
605                 pr_err("cttimeout_init: cannot register cttimeout with "
606                         "nfnetlink.\n");
607                 goto err_out;
608         }
609 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
610         RCU_INIT_POINTER(nf_ct_timeout_find_get_hook, ctnl_timeout_find_get);
611         RCU_INIT_POINTER(nf_ct_timeout_put_hook, ctnl_timeout_put);
612 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
613         return 0;
614 
615 err_out:
616         unregister_pernet_subsys(&cttimeout_ops);
617         return ret;
618 }
619 
620 static void __exit cttimeout_exit(void)
621 {
622         pr_info("cttimeout: unregistering from nfnetlink.\n");
623 
624         nfnetlink_subsys_unregister(&cttimeout_subsys);
625 
626         unregister_pernet_subsys(&cttimeout_ops);
627 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
628         RCU_INIT_POINTER(nf_ct_timeout_find_get_hook, NULL);
629         RCU_INIT_POINTER(nf_ct_timeout_put_hook, NULL);
630 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
631         rcu_barrier();
632 }
633 
634 module_init(cttimeout_init);
635 module_exit(cttimeout_exit);
636 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp