[linux-2.6-block.git] / net / netfilter / nfnetlink_cttimeout.c

/*
 * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
 * (C) 2012 by Vyatta Inc. <http://www.vyatta.com>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation (or any later at your option).
 */
#include <linux/init.h>
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/rculist.h>
#include <linux/rculist_nulls.h>
#include <linux/types.h>
#include <linux/timer.h>
#include <linux/security.h>
#include <linux/skbuff.h>
#include <linux/errno.h>
#include <linux/netlink.h>
#include <linux/spinlock.h>
#include <linux/interrupt.h>
#include <linux/slab.h>

#include <linux/netfilter.h>
#include <net/netlink.h>
#include <net/sock.h>
#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_core.h>
#include <net/netfilter/nf_conntrack_l3proto.h>
#include <net/netfilter/nf_conntrack_l4proto.h>
#include <net/netfilter/nf_conntrack_tuple.h>
#include <net/netfilter/nf_conntrack_timeout.h>

#include <linux/netfilter/nfnetlink.h>
#include <linux/netfilter/nfnetlink_cttimeout.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
MODULE_DESCRIPTION("cttimeout: Extended Netfilter Connection Tracking timeout tuning");

static LIST_HEAD(cttimeout_list);

static const struct nla_policy cttimeout_nla_policy[CTA_TIMEOUT_MAX+1] = {
	[CTA_TIMEOUT_NAME]	= { .type = NLA_NUL_STRING,
				    .len  = CTNL_TIMEOUT_NAME_MAX - 1},
	[CTA_TIMEOUT_L3PROTO]	= { .type = NLA_U16 },
	[CTA_TIMEOUT_L4PROTO]	= { .type = NLA_U8 },
	[CTA_TIMEOUT_DATA]	= { .type = NLA_NESTED },
};

static int
ctnl_timeout_parse_policy(void *timeouts, struct nf_conntrack_l4proto *l4proto,
			  struct net *net, const struct nlattr *attr)
{
	int ret = 0;

	if (likely(l4proto->ctnl_timeout.nlattr_to_obj)) {
		struct nlattr *tb[l4proto->ctnl_timeout.nlattr_max+1];

		ret = nla_parse_nested(tb, l4proto->ctnl_timeout.nlattr_max,
				       attr, l4proto->ctnl_timeout.nla_policy);
		if (ret < 0)
			return ret;

		ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
	}
	return ret;
}

static int
cttimeout_new_timeout(struct sock *ctnl, struct sk_buff *skb,
		      const struct nlmsghdr *nlh,
		      const struct nlattr * const cda[])
{
	__u16 l3num;
	__u8 l4num;
	struct nf_conntrack_l4proto *l4proto;
	struct ctnl_timeout *timeout, *matching = NULL;
	struct net *net = sock_net(skb->sk);
	char *name;
	int ret;

	if (!cda[CTA_TIMEOUT_NAME] ||
	    !cda[CTA_TIMEOUT_L3PROTO] ||
	    !cda[CTA_TIMEOUT_L4PROTO] ||
	    !cda[CTA_TIMEOUT_DATA])
		return -EINVAL;

	name = nla_data(cda[CTA_TIMEOUT_NAME]);
	l3num = ntohs(nla_get_be16(cda[CTA_TIMEOUT_L3PROTO]));
	l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]);

	list_for_each_entry(timeout, &cttimeout_list, head) {
		if (strncmp(timeout->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
			continue;

		if (nlh->nlmsg_flags & NLM_F_EXCL)
			return -EEXIST;

		matching = timeout;
		break;
	}

	l4proto = nf_ct_l4proto_find_get(l3num, l4num);

	/* This protocol is not supportted, skip. */
	if (l4proto->l4proto != l4num) {
		ret = -EOPNOTSUPP;
		goto err_proto_put;
	}

	if (matching) {
		if (nlh->nlmsg_flags & NLM_F_REPLACE) {
			/* You cannot replace one timeout policy by another of
			 * different kind, sorry.
			 */
			if (matching->l3num != l3num ||
			    matching->l4proto->l4proto != l4num) {
				ret = -EINVAL;
				goto err_proto_put;
			}

			ret = ctnl_timeout_parse_policy(&matching->data,
							l4proto, net,
							cda[CTA_TIMEOUT_DATA]);
			return ret;
		}
		ret = -EBUSY;
		goto err_proto_put;
	}

	timeout = kzalloc(sizeof(struct ctnl_timeout) +
			  l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
	if (timeout == NULL) {
		ret = -ENOMEM;
		goto err_proto_put;
	}

	ret = ctnl_timeout_parse_policy(&timeout->data, l4proto, net,
					cda[CTA_TIMEOUT_DATA]);
	if (ret < 0)
		goto err;

	strcpy(timeout->name, nla_data(cda[CTA_TIMEOUT_NAME]));
	timeout->l3num = l3num;
	timeout->l4proto = l4proto;
	atomic_set(&timeout->refcnt, 1);
	list_add_tail_rcu(&timeout->head, &cttimeout_list);

	return 0;
err:
	kfree(timeout);
err_proto_put:
	nf_ct_l4proto_put(l4proto);
	return ret;
}

static int
ctnl_timeout_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
		       int event, struct ctnl_timeout *timeout)
{
	struct nlmsghdr *nlh;
	struct nfgenmsg *nfmsg;
	unsigned int flags = portid ? NLM_F_MULTI : 0;
	struct nf_conntrack_l4proto *l4proto = timeout->l4proto;

	event |= NFNL_SUBSYS_CTNETLINK_TIMEOUT << 8;
	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
	if (nlh == NULL)
		goto nlmsg_failure;

	nfmsg = nlmsg_data(nlh);
	nfmsg->nfgen_family = AF_UNSPEC;
	nfmsg->version = NFNETLINK_V0;
	nfmsg->res_id = 0;

	if (nla_put_string(skb, CTA_TIMEOUT_NAME, timeout->name) ||
	    nla_put_be16(skb, CTA_TIMEOUT_L3PROTO, htons(timeout->l3num)) ||
	    nla_put_u8(skb, CTA_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) ||
	    nla_put_be32(skb, CTA_TIMEOUT_USE,
			 htonl(atomic_read(&timeout->refcnt))))
		goto nla_put_failure;

	if (likely(l4proto->ctnl_timeout.obj_to_nlattr)) {
		struct nlattr *nest_parms;
		int ret;

		nest_parms = nla_nest_start(skb,
					    CTA_TIMEOUT_DATA | NLA_F_NESTED);
		if (!nest_parms)
			goto nla_put_failure;

		ret = l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data);
		if (ret < 0)
			goto nla_put_failure;

		nla_nest_end(skb, nest_parms);
	}

	nlmsg_end(skb, nlh);
	return skb->len;

nlmsg_failure:
nla_put_failure:
	nlmsg_cancel(skb, nlh);
	return -1;
}

static int
ctnl_timeout_dump(struct sk_buff *skb, struct netlink_callback *cb)
{
	struct ctnl_timeout *cur, *last;

	if (cb->args[2])
		return 0;

	last = (struct ctnl_timeout *)cb->args[1];
	if (cb->args[1])
		cb->args[1] = 0;

	rcu_read_lock();
	list_for_each_entry_rcu(cur, &cttimeout_list, head) {
		if (last) {
			if (cur != last)
				continue;

			last = NULL;
		}
		if (ctnl_timeout_fill_info(skb, NETLINK_CB(cb->skb).portid,
					   cb->nlh->nlmsg_seq,
					   NFNL_MSG_TYPE(cb->nlh->nlmsg_type),
					   IPCTNL_MSG_TIMEOUT_NEW, cur) < 0) {
			cb->args[1] = (unsigned long)cur;
			break;
		}
	}
	if (!cb->args[1])
		cb->args[2] = 1;
	rcu_read_unlock();
	return skb->len;
}

static int
cttimeout_get_timeout(struct sock *ctnl, struct sk_buff *skb,
		      const struct nlmsghdr *nlh,
		      const struct nlattr * const cda[])
{
	int ret = -ENOENT;
	char *name;
	struct ctnl_timeout *cur;

	if (nlh->nlmsg_flags & NLM_F_DUMP) {
		struct netlink_dump_control c = {
			.dump = ctnl_timeout_dump,
		};
		return netlink_dump_start(ctnl, skb, nlh, &c);
	}

	if (!cda[CTA_TIMEOUT_NAME])
		return -EINVAL;
	name = nla_data(cda[CTA_TIMEOUT_NAME]);

	list_for_each_entry(cur, &cttimeout_list, head) {
		struct sk_buff *skb2;

		if (strncmp(cur->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
			continue;

		skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
		if (skb2 == NULL) {
			ret = -ENOMEM;
			break;
		}

		ret = ctnl_timeout_fill_info(skb2, NETLINK_CB(skb).portid,
					     nlh->nlmsg_seq,
					     NFNL_MSG_TYPE(nlh->nlmsg_type),
					     IPCTNL_MSG_TIMEOUT_NEW, cur);
		if (ret <= 0) {
			kfree_skb(skb2);
			break;
		}
		ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid,
					MSG_DONTWAIT);
		if (ret > 0)
			ret = 0;

		/* this avoids a loop in nfnetlink. */
		return ret == -EAGAIN ? -ENOBUFS : ret;
	}
	return ret;
}

/* try to delete object, fail if it is still in use. */
static int ctnl_timeout_try_del(struct ctnl_timeout *timeout)
{
	int ret = 0;

	/* we want to avoid races with nf_ct_timeout_find_get. */
	if (atomic_dec_and_test(&timeout->refcnt)) {
		/* We are protected by nfnl mutex. */
		list_del_rcu(&timeout->head);
		nf_ct_l4proto_put(timeout->l4proto);
		kfree_rcu(timeout, rcu_head);
	} else {
		/* still in use, restore reference counter. */
		atomic_inc(&timeout->refcnt);
		ret = -EBUSY;
	}
	return ret;
}

static int
cttimeout_del_timeout(struct sock *ctnl, struct sk_buff *skb,
		      const struct nlmsghdr *nlh,
		      const struct nlattr * const cda[])
{
	char *name;
	struct ctnl_timeout *cur;
	int ret = -ENOENT;

	if (!cda[CTA_TIMEOUT_NAME]) {
		list_for_each_entry(cur, &cttimeout_list, head)
			ctnl_timeout_try_del(cur);

		return 0;
	}
	name = nla_data(cda[CTA_TIMEOUT_NAME]);

	list_for_each_entry(cur, &cttimeout_list, head) {
		if (strncmp(cur->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
			continue;

		ret = ctnl_timeout_try_del(cur);
		if (ret < 0)
			return ret;

		break;
	}
	return ret;
}

static int
cttimeout_default_set(struct sock *ctnl, struct sk_buff *skb,
		      const struct nlmsghdr *nlh,
		      const struct nlattr * const cda[])
{
	__u16 l3num;
	__u8 l4num;
	struct nf_conntrack_l4proto *l4proto;
	struct net *net = sock_net(skb->sk);
	unsigned int *timeouts;
	int ret;

	if (!cda[CTA_TIMEOUT_L3PROTO] ||
	    !cda[CTA_TIMEOUT_L4PROTO] ||
	    !cda[CTA_TIMEOUT_DATA])
		return -EINVAL;

	l3num = ntohs(nla_get_be16(cda[CTA_TIMEOUT_L3PROTO]));
	l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]);
	l4proto = nf_ct_l4proto_find_get(l3num, l4num);

	/* This protocol is not supported, skip. */
	if (l4proto->l4proto != l4num) {
		ret = -EOPNOTSUPP;
		goto err;
	}

	timeouts = l4proto->get_timeouts(net);

	ret = ctnl_timeout_parse_policy(timeouts, l4proto, net,
					cda[CTA_TIMEOUT_DATA]);
	if (ret < 0)
		goto err;

	nf_ct_l4proto_put(l4proto);
	return 0;
err:
	nf_ct_l4proto_put(l4proto);
	return ret;
}

static int
cttimeout_default_fill_info(struct net *net, struct sk_buff *skb, u32 portid,
			    u32 seq, u32 type, int event,
			    struct nf_conntrack_l4proto *l4proto)
{
	struct nlmsghdr *nlh;
	struct nfgenmsg *nfmsg;
	unsigned int flags = portid ? NLM_F_MULTI : 0;

	event |= NFNL_SUBSYS_CTNETLINK_TIMEOUT << 8;
	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
	if (nlh == NULL)
		goto nlmsg_failure;

	nfmsg = nlmsg_data(nlh);
	nfmsg->nfgen_family = AF_UNSPEC;
	nfmsg->version = NFNETLINK_V0;
	nfmsg->res_id = 0;

	if (nla_put_be16(skb, CTA_TIMEOUT_L3PROTO, htons(l4proto->l3proto)) ||
	    nla_put_u8(skb, CTA_TIMEOUT_L4PROTO, l4proto->l4proto))
		goto nla_put_failure;

	if (likely(l4proto->ctnl_timeout.obj_to_nlattr)) {
		struct nlattr *nest_parms;
		unsigned int *timeouts = l4proto->get_timeouts(net);
		int ret;

		nest_parms = nla_nest_start(skb,
					    CTA_TIMEOUT_DATA | NLA_F_NESTED);
		if (!nest_parms)
			goto nla_put_failure;

		ret = l4proto->ctnl_timeout.obj_to_nlattr(skb, timeouts);
		if (ret < 0)
			goto nla_put_failure;

		nla_nest_end(skb, nest_parms);
	}

	nlmsg_end(skb, nlh);
	return skb->len;

nlmsg_failure:
nla_put_failure:
	nlmsg_cancel(skb, nlh);
	return -1;
}

static int cttimeout_default_get(struct sock *ctnl, struct sk_buff *skb,
				 const struct nlmsghdr *nlh,
				 const struct nlattr * const cda[])
{
	__u16 l3num;
	__u8 l4num;
	struct nf_conntrack_l4proto *l4proto;
	struct net *net = sock_net(skb->sk);
	struct sk_buff *skb2;
	int ret, err;

	if (!cda[CTA_TIMEOUT_L3PROTO] || !cda[CTA_TIMEOUT_L4PROTO])
		return -EINVAL;

	l3num = ntohs(nla_get_be16(cda[CTA_TIMEOUT_L3PROTO]));
	l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]);
	l4proto = nf_ct_l4proto_find_get(l3num, l4num);

	/* This protocol is not supported, skip. */
	if (l4proto->l4proto != l4num) {
		err = -EOPNOTSUPP;
		goto err;
	}

	skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
	if (skb2 == NULL) {
		err = -ENOMEM;
		goto err;
	}

	ret = cttimeout_default_fill_info(net, skb2, NETLINK_CB(skb).portid,
					  nlh->nlmsg_seq,
					  NFNL_MSG_TYPE(nlh->nlmsg_type),
					  IPCTNL_MSG_TIMEOUT_DEFAULT_SET,
					  l4proto);
	if (ret <= 0) {
		kfree_skb(skb2);
		err = -ENOMEM;
		goto err;
	}
	ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid, MSG_DONTWAIT);
	if (ret > 0)
		ret = 0;

	/* this avoids a loop in nfnetlink. */
	return ret == -EAGAIN ? -ENOBUFS : ret;
err:
	nf_ct_l4proto_put(l4proto);
	return err;
}

#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
static struct ctnl_timeout *ctnl_timeout_find_get(const char *name)
{
	struct ctnl_timeout *timeout, *matching = NULL;

	rcu_read_lock();
	list_for_each_entry_rcu(timeout, &cttimeout_list, head) {
		if (strncmp(timeout->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
			continue;

		if (!try_module_get(THIS_MODULE))
			goto err;

		if (!atomic_inc_not_zero(&timeout->refcnt)) {
			module_put(THIS_MODULE);
			goto err;
		}
		matching = timeout;
		break;
	}
err:
	rcu_read_unlock();
	return matching;
}

static void ctnl_timeout_put(struct ctnl_timeout *timeout)
{
	atomic_dec(&timeout->refcnt);
	module_put(THIS_MODULE);
}
#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */

static const struct nfnl_callback cttimeout_cb[IPCTNL_MSG_TIMEOUT_MAX] = {
	[IPCTNL_MSG_TIMEOUT_NEW]	= { .call = cttimeout_new_timeout,
					    .attr_count = CTA_TIMEOUT_MAX,
					    .policy = cttimeout_nla_policy },
	[IPCTNL_MSG_TIMEOUT_GET]	= { .call = cttimeout_get_timeout,
					    .attr_count = CTA_TIMEOUT_MAX,
					    .policy = cttimeout_nla_policy },
	[IPCTNL_MSG_TIMEOUT_DELETE]	= { .call = cttimeout_del_timeout,
					    .attr_count = CTA_TIMEOUT_MAX,
					    .policy = cttimeout_nla_policy },
	[IPCTNL_MSG_TIMEOUT_DEFAULT_SET]= { .call = cttimeout_default_set,
					    .attr_count = CTA_TIMEOUT_MAX,
					    .policy = cttimeout_nla_policy },
	[IPCTNL_MSG_TIMEOUT_DEFAULT_GET]= { .call = cttimeout_default_get,
					    .attr_count = CTA_TIMEOUT_MAX,
					    .policy = cttimeout_nla_policy },
};

static const struct nfnetlink_subsystem cttimeout_subsys = {
	.name				= "conntrack_timeout",
	.subsys_id			= NFNL_SUBSYS_CTNETLINK_TIMEOUT,
	.cb_count			= IPCTNL_MSG_TIMEOUT_MAX,
	.cb				= cttimeout_cb,
};

MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_TIMEOUT);

static int __init cttimeout_init(void)
{
	int ret;

	ret = nfnetlink_subsys_register(&cttimeout_subsys);
	if (ret < 0) {
		pr_err("cttimeout_init: cannot register cttimeout with "
			"nfnetlink.\n");
		goto err_out;
	}
#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
	RCU_INIT_POINTER(nf_ct_timeout_find_get_hook, ctnl_timeout_find_get);
	RCU_INIT_POINTER(nf_ct_timeout_put_hook, ctnl_timeout_put);
#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
	return 0;

err_out:
	return ret;
}

static void __exit cttimeout_exit(void)
{
	struct ctnl_timeout *cur, *tmp;

	pr_info("cttimeout: unregistering from nfnetlink.\n");

	nfnetlink_subsys_unregister(&cttimeout_subsys);
	list_for_each_entry_safe(cur, tmp, &cttimeout_list, head) {
		list_del_rcu(&cur->head);
		/* We are sure that our objects have no clients at this point,
		 * it's safe to release them all without checking refcnt.
		 */
		nf_ct_l4proto_put(cur->l4proto);
		kfree_rcu(cur, rcu_head);
	}
#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
	RCU_INIT_POINTER(nf_ct_timeout_find_get_hook, NULL);
	RCU_INIT_POINTER(nf_ct_timeout_put_hook, NULL);
#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
}

module_init(cttimeout_init);
module_exit(cttimeout_exit);
Commit	Line	Data
50978462 PNA	1	/*
	2	* (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
	3	* (C) 2012 by Vyatta Inc. <http://www.vyatta.com>
	4	*
	5	* This program is free software; you can redistribute it and/or modify
	6	* it under the terms of the GNU General Public License version 2 as
	7	* published by the Free Software Foundation (or any later at your option).
	8	*/
	9	#include <linux/init.h>
	10	#include <linux/module.h>
	11	#include <linux/kernel.h>
	12	#include <linux/rculist.h>
	13	#include <linux/rculist_nulls.h>
	14	#include <linux/types.h>
	15	#include <linux/timer.h>
	16	#include <linux/security.h>
	17	#include <linux/skbuff.h>
	18	#include <linux/errno.h>
	19	#include <linux/netlink.h>
	20	#include <linux/spinlock.h>
	21	#include <linux/interrupt.h>
	22	#include <linux/slab.h>
	23
	24	#include <linux/netfilter.h>
	25	#include <net/netlink.h>
	26	#include <net/sock.h>
	27	#include <net/netfilter/nf_conntrack.h>
	28	#include <net/netfilter/nf_conntrack_core.h>
	29	#include <net/netfilter/nf_conntrack_l3proto.h>
	30	#include <net/netfilter/nf_conntrack_l4proto.h>
	31	#include <net/netfilter/nf_conntrack_tuple.h>
24de58f4	32	#include <net/netfilter/nf_conntrack_timeout.h>
50978462 PNA	33
	34	#include <linux/netfilter/nfnetlink.h>
	35	#include <linux/netfilter/nfnetlink_cttimeout.h>
	36
	37	MODULE_LICENSE("GPL");
	38	MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
	39	MODULE_DESCRIPTION("cttimeout: Extended Netfilter Connection Tracking timeout tuning");
	40
50978462 PNA	41	static LIST_HEAD(cttimeout_list);
	42
	43	static const struct nla_policy cttimeout_nla_policy[CTA_TIMEOUT_MAX+1] = {
e93b5f9f FW	44	[CTA_TIMEOUT_NAME] = { .type = NLA_NUL_STRING,
e93b5f9f FW	45	.len = CTNL_TIMEOUT_NAME_MAX - 1},
50978462 PNA	46	[CTA_TIMEOUT_L3PROTO] = { .type = NLA_U16 },
	47	[CTA_TIMEOUT_L4PROTO] = { .type = NLA_U8 },
	48	[CTA_TIMEOUT_DATA] = { .type = NLA_NESTED },
	49	};
	50
	51	static int
91cb498e PNA	52	ctnl_timeout_parse_policy(void timeouts, struct nf_conntrack_l4proto l4proto,
91cb498e PNA	53	struct net net, const struct nlattr attr)
50978462 PNA	54	{
	55	int ret = 0;
	56
	57	if (likely(l4proto->ctnl_timeout.nlattr_to_obj)) {
	58	struct nlattr *tb[l4proto->ctnl_timeout.nlattr_max+1];
	59
130ffbc2 DB	60	ret = nla_parse_nested(tb, l4proto->ctnl_timeout.nlattr_max,
	61	attr, l4proto->ctnl_timeout.nla_policy);
	62	if (ret < 0)
	63	return ret;
50978462	64
91cb498e	65	ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
50978462 PNA	66	}
	67	return ret;
	68	}
	69
	70	static int
	71	cttimeout_new_timeout(struct sock ctnl, struct sk_buff skb,
	72	const struct nlmsghdr *nlh,
	73	const struct nlattr * const cda[])
	74	{
	75	__u16 l3num;
	76	__u8 l4num;
	77	struct nf_conntrack_l4proto *l4proto;
	78	struct ctnl_timeout timeout, matching = NULL;
8264deb8	79	struct net *net = sock_net(skb->sk);
50978462 PNA	80	char *name;
	81	int ret;
	82
	83	if (!cda[CTA_TIMEOUT_NAME] \|\|
	84	!cda[CTA_TIMEOUT_L3PROTO] \|\|
	85	!cda[CTA_TIMEOUT_L4PROTO] \|\|
	86	!cda[CTA_TIMEOUT_DATA])
	87	return -EINVAL;
	88
	89	name = nla_data(cda[CTA_TIMEOUT_NAME]);
	90	l3num = ntohs(nla_get_be16(cda[CTA_TIMEOUT_L3PROTO]));
	91	l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]);
	92
	93	list_for_each_entry(timeout, &cttimeout_list, head) {
	94	if (strncmp(timeout->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
	95	continue;
	96
	97	if (nlh->nlmsg_flags & NLM_F_EXCL)
	98	return -EEXIST;
	99
	100	matching = timeout;
	101	break;
	102	}
	103
c1ebd7df	104	l4proto = nf_ct_l4proto_find_get(l3num, l4num);
50978462 PNA	105
50978462 PNA	106	/* This protocol is not supportted, skip. */
c1ebd7df PNA	107	if (l4proto->l4proto != l4num) {
	108	ret = -EOPNOTSUPP;
	109	goto err_proto_put;
	110	}
50978462 PNA	111
	112	if (matching) {
	113	if (nlh->nlmsg_flags & NLM_F_REPLACE) {
	114	/* You cannot replace one timeout policy by another of
	115	* different kind, sorry.
	116	*/
	117	if (matching->l3num != l3num \|\|
c1ebd7df PNA	118	matching->l4proto->l4proto != l4num) {
	119	ret = -EINVAL;
	120	goto err_proto_put;
	121	}
50978462	122
91cb498e PNA	123	ret = ctnl_timeout_parse_policy(&matching->data,
91cb498e PNA	124	l4proto, net,
50978462 PNA	125	cda[CTA_TIMEOUT_DATA]);
	126	return ret;
	127	}
c1ebd7df PNA	128	ret = -EBUSY;
c1ebd7df PNA	129	goto err_proto_put;
50978462 PNA	130	}
	131
	132	timeout = kzalloc(sizeof(struct ctnl_timeout) +
	133	l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
c1ebd7df PNA	134	if (timeout == NULL) {
	135	ret = -ENOMEM;
	136	goto err_proto_put;
	137	}
50978462	138
91cb498e	139	ret = ctnl_timeout_parse_policy(&timeout->data, l4proto, net,
50978462 PNA	140	cda[CTA_TIMEOUT_DATA]);
	141	if (ret < 0)
	142	goto err;
	143
	144	strcpy(timeout->name, nla_data(cda[CTA_TIMEOUT_NAME]));
	145	timeout->l3num = l3num;
c1ebd7df	146	timeout->l4proto = l4proto;
50978462 PNA	147	atomic_set(&timeout->refcnt, 1);
	148	list_add_tail_rcu(&timeout->head, &cttimeout_list);
	149
	150	return 0;
	151	err:
	152	kfree(timeout);
c1ebd7df PNA	153	err_proto_put:
c1ebd7df PNA	154	nf_ct_l4proto_put(l4proto);
50978462 PNA	155	return ret;
	156	}
	157
	158	static int
15e47304	159	ctnl_timeout_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
50978462 PNA	160	int event, struct ctnl_timeout *timeout)
	161	{
	162	struct nlmsghdr *nlh;
	163	struct nfgenmsg *nfmsg;
15e47304	164	unsigned int flags = portid ? NLM_F_MULTI : 0;
c1ebd7df	165	struct nf_conntrack_l4proto *l4proto = timeout->l4proto;
50978462 PNA	166
50978462 PNA	167	event \|= NFNL_SUBSYS_CTNETLINK_TIMEOUT << 8;
15e47304	168	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
50978462 PNA	169	if (nlh == NULL)
	170	goto nlmsg_failure;
	171
	172	nfmsg = nlmsg_data(nlh);
	173	nfmsg->nfgen_family = AF_UNSPEC;
	174	nfmsg->version = NFNETLINK_V0;
	175	nfmsg->res_id = 0;
	176
48f03bda DM	177	if (nla_put_string(skb, CTA_TIMEOUT_NAME, timeout->name) \|\|
	178	nla_put_be16(skb, CTA_TIMEOUT_L3PROTO, htons(timeout->l3num)) \|\|
	179	nla_put_u8(skb, CTA_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) \|\|
	180	nla_put_be32(skb, CTA_TIMEOUT_USE,
	181	htonl(atomic_read(&timeout->refcnt))))
	182	goto nla_put_failure;
50978462	183
50978462 PNA	184	if (likely(l4proto->ctnl_timeout.obj_to_nlattr)) {
	185	struct nlattr *nest_parms;
	186	int ret;
	187
	188	nest_parms = nla_nest_start(skb,
	189	CTA_TIMEOUT_DATA \| NLA_F_NESTED);
	190	if (!nest_parms)
	191	goto nla_put_failure;
	192
	193	ret = l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data);
	194	if (ret < 0)
	195	goto nla_put_failure;
	196
	197	nla_nest_end(skb, nest_parms);
	198	}
c1ebd7df	199
50978462 PNA	200	nlmsg_end(skb, nlh);
	201	return skb->len;
	202
	203	nlmsg_failure:
	204	nla_put_failure:
	205	nlmsg_cancel(skb, nlh);
	206	return -1;
	207	}
	208
	209	static int
	210	ctnl_timeout_dump(struct sk_buff skb, struct netlink_callback cb)
	211	{
	212	struct ctnl_timeout cur, last;
	213
	214	if (cb->args[2])
	215	return 0;
	216
	217	last = (struct ctnl_timeout *)cb->args[1];
	218	if (cb->args[1])
	219	cb->args[1] = 0;
	220
	221	rcu_read_lock();
	222	list_for_each_entry_rcu(cur, &cttimeout_list, head) {
37bc4f8d PNA	223	if (last) {
	224	if (cur != last)
	225	continue;
50978462	226
37bc4f8d PNA	227	last = NULL;
37bc4f8d PNA	228	}
15e47304	229	if (ctnl_timeout_fill_info(skb, NETLINK_CB(cb->skb).portid,
50978462 PNA	230	cb->nlh->nlmsg_seq,
	231	NFNL_MSG_TYPE(cb->nlh->nlmsg_type),
	232	IPCTNL_MSG_TIMEOUT_NEW, cur) < 0) {
	233	cb->args[1] = (unsigned long)cur;
	234	break;
	235	}
	236	}
	237	if (!cb->args[1])
	238	cb->args[2] = 1;
	239	rcu_read_unlock();
	240	return skb->len;
	241	}
	242
	243	static int
	244	cttimeout_get_timeout(struct sock ctnl, struct sk_buff skb,
	245	const struct nlmsghdr *nlh,
	246	const struct nlattr * const cda[])
	247	{
	248	int ret = -ENOENT;
	249	char *name;
	250	struct ctnl_timeout *cur;
	251
	252	if (nlh->nlmsg_flags & NLM_F_DUMP) {
	253	struct netlink_dump_control c = {
	254	.dump = ctnl_timeout_dump,
	255	};
	256	return netlink_dump_start(ctnl, skb, nlh, &c);
	257	}
	258
	259	if (!cda[CTA_TIMEOUT_NAME])
	260	return -EINVAL;
	261	name = nla_data(cda[CTA_TIMEOUT_NAME]);
	262
	263	list_for_each_entry(cur, &cttimeout_list, head) {
	264	struct sk_buff *skb2;
	265
	266	if (strncmp(cur->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
	267	continue;
	268
	269	skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
	270	if (skb2 == NULL) {
	271	ret = -ENOMEM;
	272	break;
	273	}
	274
15e47304	275	ret = ctnl_timeout_fill_info(skb2, NETLINK_CB(skb).portid,
50978462 PNA	276	nlh->nlmsg_seq,
	277	NFNL_MSG_TYPE(nlh->nlmsg_type),
	278	IPCTNL_MSG_TIMEOUT_NEW, cur);
	279	if (ret <= 0) {
	280	kfree_skb(skb2);
	281	break;
	282	}
15e47304	283	ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid,
50978462 PNA	284	MSG_DONTWAIT);
	285	if (ret > 0)
	286	ret = 0;
	287
	288	/* this avoids a loop in nfnetlink. */
	289	return ret == -EAGAIN ? -ENOBUFS : ret;
	290	}
	291	return ret;
	292	}
	293
	294	/* try to delete object, fail if it is still in use. */
	295	static int ctnl_timeout_try_del(struct ctnl_timeout *timeout)
	296	{
	297	int ret = 0;
	298
	299	/* we want to avoid races with nf_ct_timeout_find_get. */
	300	if (atomic_dec_and_test(&timeout->refcnt)) {
	301	/* We are protected by nfnl mutex. */
	302	list_del_rcu(&timeout->head);
c1ebd7df	303	nf_ct_l4proto_put(timeout->l4proto);
50978462 PNA	304	kfree_rcu(timeout, rcu_head);
	305	} else {
	306	/* still in use, restore reference counter. */
	307	atomic_inc(&timeout->refcnt);
	308	ret = -EBUSY;
	309	}
	310	return ret;
	311	}
	312
	313	static int
	314	cttimeout_del_timeout(struct sock ctnl, struct sk_buff skb,
	315	const struct nlmsghdr *nlh,
	316	const struct nlattr * const cda[])
	317	{
	318	char *name;
	319	struct ctnl_timeout *cur;
	320	int ret = -ENOENT;
	321
	322	if (!cda[CTA_TIMEOUT_NAME]) {
	323	list_for_each_entry(cur, &cttimeout_list, head)
	324	ctnl_timeout_try_del(cur);
	325
	326	return 0;
	327	}
	328	name = nla_data(cda[CTA_TIMEOUT_NAME]);
	329
	330	list_for_each_entry(cur, &cttimeout_list, head) {
	331	if (strncmp(cur->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
	332	continue;
	333
	334	ret = ctnl_timeout_try_del(cur);
	335	if (ret < 0)
	336	return ret;
	337
	338	break;
	339	}
	340	return ret;
	341	}
	342
91cb498e PNA	343	static int
	344	cttimeout_default_set(struct sock ctnl, struct sk_buff skb,
	345	const struct nlmsghdr *nlh,
	346	const struct nlattr * const cda[])
	347	{
	348	__u16 l3num;
	349	__u8 l4num;
	350	struct nf_conntrack_l4proto *l4proto;
	351	struct net *net = sock_net(skb->sk);
	352	unsigned int *timeouts;
	353	int ret;
	354
	355	if (!cda[CTA_TIMEOUT_L3PROTO] \|\|
	356	!cda[CTA_TIMEOUT_L4PROTO] \|\|
	357	!cda[CTA_TIMEOUT_DATA])
	358	return -EINVAL;
	359
	360	l3num = ntohs(nla_get_be16(cda[CTA_TIMEOUT_L3PROTO]));
	361	l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]);
	362	l4proto = nf_ct_l4proto_find_get(l3num, l4num);
	363
	364	/* This protocol is not supported, skip. */
	365	if (l4proto->l4proto != l4num) {
	366	ret = -EOPNOTSUPP;
	367	goto err;
	368	}
	369
	370	timeouts = l4proto->get_timeouts(net);
	371
	372	ret = ctnl_timeout_parse_policy(timeouts, l4proto, net,
	373	cda[CTA_TIMEOUT_DATA]);
	374	if (ret < 0)
	375	goto err;
	376
	377	nf_ct_l4proto_put(l4proto);
	378	return 0;
	379	err:
	380	nf_ct_l4proto_put(l4proto);
	381	return ret;
	382	}
	383
	384	static int
	385	cttimeout_default_fill_info(struct net net, struct sk_buff skb, u32 portid,
	386	u32 seq, u32 type, int event,
	387	struct nf_conntrack_l4proto *l4proto)
	388	{
	389	struct nlmsghdr *nlh;
	390	struct nfgenmsg *nfmsg;
	391	unsigned int flags = portid ? NLM_F_MULTI : 0;
	392
	393	event \|= NFNL_SUBSYS_CTNETLINK_TIMEOUT << 8;
	394	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
	395	if (nlh == NULL)
	396	goto nlmsg_failure;
	397
	398	nfmsg = nlmsg_data(nlh);
	399	nfmsg->nfgen_family = AF_UNSPEC;
	400	nfmsg->version = NFNETLINK_V0;
	401	nfmsg->res_id = 0;
	402
	403	if (nla_put_be16(skb, CTA_TIMEOUT_L3PROTO, htons(l4proto->l3proto)) \|\|
	404	nla_put_u8(skb, CTA_TIMEOUT_L4PROTO, l4proto->l4proto))
	405	goto nla_put_failure;
	406
407	if (likely(l4proto->ctnl_timeout.obj_to_nlattr)) {
408	struct nlattr *nest_parms;
409	unsigned int *timeouts = l4proto->get_timeouts(net);
410	int ret;
411
412	nest_parms = nla_nest_start(skb,
413	CTA_TIMEOUT_DATA \| NLA_F_NESTED);
414	if (!nest_parms)
415	goto nla_put_failure;
416
417	ret = l4proto->ctnl_timeout.obj_to_nlattr(skb, timeouts);
418	if (ret < 0)
419	goto nla_put_failure;
420
421	nla_nest_end(skb, nest_parms);
422	}
423
424	nlmsg_end(skb, nlh);
425	return skb->len;
426
427	nlmsg_failure:
428	nla_put_failure:
429	nlmsg_cancel(skb, nlh);
430	return -1;
431	}
432
433	static int cttimeout_default_get(struct sock ctnl, struct sk_buff skb,
434	const struct nlmsghdr *nlh,
435	const struct nlattr * const cda[])
436	{
437	__u16 l3num;
438	__u8 l4num;
439	struct nf_conntrack_l4proto *l4proto;
440	struct net *net = sock_net(skb->sk);
441	struct sk_buff *skb2;
442	int ret, err;
443
444	if (!cda[CTA_TIMEOUT_L3PROTO] \|\| !cda[CTA_TIMEOUT_L4PROTO])
445	return -EINVAL;
446
447	l3num = ntohs(nla_get_be16(cda[CTA_TIMEOUT_L3PROTO]));
448	l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]);
449	l4proto = nf_ct_l4proto_find_get(l3num, l4num);
450
451	/* This protocol is not supported, skip. */
452	if (l4proto->l4proto != l4num) {
453	err = -EOPNOTSUPP;
454	goto err;
455	}
456
457	skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
458	if (skb2 == NULL) {
459	err = -ENOMEM;
460	goto err;
461	}
462
463	ret = cttimeout_default_fill_info(net, skb2, NETLINK_CB(skb).portid,
464	nlh->nlmsg_seq,
465	NFNL_MSG_TYPE(nlh->nlmsg_type),
466	IPCTNL_MSG_TIMEOUT_DEFAULT_SET,
467	l4proto);
468	if (ret <= 0) {
469	kfree_skb(skb2);
470	err = -ENOMEM;
471	goto err;
472	}
473	ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid, MSG_DONTWAIT);
474	if (ret > 0)
475	ret = 0;
476
477	/* this avoids a loop in nfnetlink. */
478	return ret == -EAGAIN ? -ENOBUFS : ret;
479	err:
480	nf_ct_l4proto_put(l4proto);
481	return err;
482	}
483
24de58f4 PNA	484	#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
	485	static struct ctnl_timeout ctnl_timeout_find_get(const char name)
	486	{
	487	struct ctnl_timeout timeout, matching = NULL;
	488
	489	rcu_read_lock();
	490	list_for_each_entry_rcu(timeout, &cttimeout_list, head) {
	491	if (strncmp(timeout->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
	492	continue;
	493
	494	if (!try_module_get(THIS_MODULE))
	495	goto err;
	496
	497	if (!atomic_inc_not_zero(&timeout->refcnt)) {
	498	module_put(THIS_MODULE);
	499	goto err;
	500	}
	501	matching = timeout;
	502	break;
	503	}
	504	err:
	505	rcu_read_unlock();
	506	return matching;
	507	}
	508
	509	static void ctnl_timeout_put(struct ctnl_timeout *timeout)
	510	{
	511	atomic_dec(&timeout->refcnt);
	512	module_put(THIS_MODULE);
	513	}
	514	#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
	515
50978462 PNA	516	static const struct nfnl_callback cttimeout_cb[IPCTNL_MSG_TIMEOUT_MAX] = {
	517	[IPCTNL_MSG_TIMEOUT_NEW] = { .call = cttimeout_new_timeout,
	518	.attr_count = CTA_TIMEOUT_MAX,
	519	.policy = cttimeout_nla_policy },
	520	[IPCTNL_MSG_TIMEOUT_GET] = { .call = cttimeout_get_timeout,
	521	.attr_count = CTA_TIMEOUT_MAX,
	522	.policy = cttimeout_nla_policy },
	523	[IPCTNL_MSG_TIMEOUT_DELETE] = { .call = cttimeout_del_timeout,
	524	.attr_count = CTA_TIMEOUT_MAX,
	525	.policy = cttimeout_nla_policy },
91cb498e PNA	526	[IPCTNL_MSG_TIMEOUT_DEFAULT_SET]= { .call = cttimeout_default_set,
	527	.attr_count = CTA_TIMEOUT_MAX,
	528	.policy = cttimeout_nla_policy },
	529	[IPCTNL_MSG_TIMEOUT_DEFAULT_GET]= { .call = cttimeout_default_get,
	530	.attr_count = CTA_TIMEOUT_MAX,
	531	.policy = cttimeout_nla_policy },
50978462 PNA	532	};
	533
	534	static const struct nfnetlink_subsystem cttimeout_subsys = {
	535	.name = "conntrack_timeout",
	536	.subsys_id = NFNL_SUBSYS_CTNETLINK_TIMEOUT,
	537	.cb_count = IPCTNL_MSG_TIMEOUT_MAX,
	538	.cb = cttimeout_cb,
	539	};
	540
	541	MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_TIMEOUT);
	542
	543	static int __init cttimeout_init(void)
	544	{
	545	int ret;
	546
	547	ret = nfnetlink_subsys_register(&cttimeout_subsys);
	548	if (ret < 0) {
	549	pr_err("cttimeout_init: cannot register cttimeout with "
	550	"nfnetlink.\n");
	551	goto err_out;
	552	}
24de58f4 PNA	553	#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
	554	RCU_INIT_POINTER(nf_ct_timeout_find_get_hook, ctnl_timeout_find_get);
	555	RCU_INIT_POINTER(nf_ct_timeout_put_hook, ctnl_timeout_put);
	556	#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
50978462 PNA	557	return 0;
	558
	559	err_out:
	560	return ret;
	561	}
	562
	563	static void __exit cttimeout_exit(void)
	564	{
	565	struct ctnl_timeout cur, tmp;
	566
	567	pr_info("cttimeout: unregistering from nfnetlink.\n");
	568
	569	nfnetlink_subsys_unregister(&cttimeout_subsys);
	570	list_for_each_entry_safe(cur, tmp, &cttimeout_list, head) {
	571	list_del_rcu(&cur->head);
	572	/* We are sure that our objects have no clients at this point,
	573	* it's safe to release them all without checking refcnt.
	574	*/
c1ebd7df	575	nf_ct_l4proto_put(cur->l4proto);
50978462 PNA	576	kfree_rcu(cur, rcu_head);
50978462 PNA	577	}
24de58f4 PNA	578	#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
	579	RCU_INIT_POINTER(nf_ct_timeout_find_get_hook, NULL);
	580	RCU_INIT_POINTER(nf_ct_timeout_put_hook, NULL);
	581	#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
50978462 PNA	582	}
	583
	584	module_init(cttimeout_init);
	585	module_exit(cttimeout_exit);