[linux-2.6-block.git] / net / netfilter / xt_CT.c

/*
 * Copyright (c) 2010 Patrick McHardy <kaber@trash.net>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/module.h>
#include <linux/gfp.h>
#include <linux/skbuff.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv6/ip6_tables.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_CT.h>
#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_l4proto.h>
#include <net/netfilter/nf_conntrack_helper.h>
#include <net/netfilter/nf_conntrack_ecache.h>
#include <net/netfilter/nf_conntrack_timeout.h>
#include <net/netfilter/nf_conntrack_zones.h>

static inline int xt_ct_target(struct sk_buff *skb, struct nf_conn *ct)
{
	/* Previously seen (loopback)? Ignore. */
	if (skb->nfct != NULL)
		return XT_CONTINUE;

	atomic_inc(&ct->ct_general.use);
	skb->nfct = &ct->ct_general;
	skb->nfctinfo = IP_CT_NEW;

	return XT_CONTINUE;
}

static unsigned int xt_ct_target_v0(struct sk_buff *skb,
				    const struct xt_action_param *par)
{
	const struct xt_ct_target_info *info = par->targinfo;
	struct nf_conn *ct = info->ct;

	return xt_ct_target(skb, ct);
}

static unsigned int xt_ct_target_v1(struct sk_buff *skb,
				    const struct xt_action_param *par)
{
	const struct xt_ct_target_info_v1 *info = par->targinfo;
	struct nf_conn *ct = info->ct;

	return xt_ct_target(skb, ct);
}

static u8 xt_ct_find_proto(const struct xt_tgchk_param *par)
{
	if (par->family == NFPROTO_IPV4) {
		const struct ipt_entry *e = par->entryinfo;

		if (e->ip.invflags & IPT_INV_PROTO)
			return 0;
		return e->ip.proto;
	} else if (par->family == NFPROTO_IPV6) {
		const struct ip6t_entry *e = par->entryinfo;

		if (e->ipv6.invflags & IP6T_INV_PROTO)
			return 0;
		return e->ipv6.proto;
	} else
		return 0;
}

static int
xt_ct_set_helper(struct nf_conn *ct, const char *helper_name,
		 const struct xt_tgchk_param *par)
{
	struct nf_conntrack_helper *helper;
	struct nf_conn_help *help;
	u8 proto;

	proto = xt_ct_find_proto(par);
	if (!proto) {
		pr_info("You must specify a L4 protocol, and not use "
			"inversions on it.\n");
		return -ENOENT;
	}

	helper = nf_conntrack_helper_try_module_get(helper_name, par->family,
						    proto);
	if (helper == NULL) {
		pr_info("No such helper \"%s\"\n", helper_name);
		return -ENOENT;
	}

	help = nf_ct_helper_ext_add(ct, helper, GFP_KERNEL);
	if (help == NULL) {
		module_put(helper->me);
		return -ENOMEM;
	}

	help->helper = helper;
	return 0;
}

#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
static void __xt_ct_tg_timeout_put(struct ctnl_timeout *timeout)
{
	typeof(nf_ct_timeout_put_hook) timeout_put;

	timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
	if (timeout_put)
		timeout_put(timeout);
}
#endif

static int
xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
		  const char *timeout_name)
{
#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
	typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
	struct ctnl_timeout *timeout;
	struct nf_conn_timeout *timeout_ext;
	struct nf_conntrack_l4proto *l4proto;
	int ret = 0;
	u8 proto;

	rcu_read_lock();
	timeout_find_get = rcu_dereference(nf_ct_timeout_find_get_hook);
	if (timeout_find_get == NULL) {
		ret = -ENOENT;
		pr_info("Timeout policy base is empty\n");
		goto out;
	}

	proto = xt_ct_find_proto(par);
	if (!proto) {
		ret = -EINVAL;
		pr_info("You must specify a L4 protocol, and not use "
			"inversions on it.\n");
		goto out;
	}

	timeout = timeout_find_get(timeout_name);
	if (timeout == NULL) {
		ret = -ENOENT;
		pr_info("No such timeout policy \"%s\"\n", timeout_name);
		goto out;
	}

	if (timeout->l3num != par->family) {
		ret = -EINVAL;
		pr_info("Timeout policy `%s' can only be used by L3 protocol "
			"number %d\n", timeout_name, timeout->l3num);
		goto err_put_timeout;
	}
	/* Make sure the timeout policy matches any existing protocol tracker,
	 * otherwise default to generic.
	 */
	l4proto = __nf_ct_l4proto_find(par->family, proto);
	if (timeout->l4proto->l4proto != l4proto->l4proto) {
		ret = -EINVAL;
		pr_info("Timeout policy `%s' can only be used by L4 protocol "
			"number %d\n",
			timeout_name, timeout->l4proto->l4proto);
		goto err_put_timeout;
	}
	timeout_ext = nf_ct_timeout_ext_add(ct, timeout, GFP_ATOMIC);
	if (timeout_ext == NULL)
		ret = -ENOMEM;

err_put_timeout:
	__xt_ct_tg_timeout_put(timeout);
out:
	rcu_read_unlock();
	return ret;
#else
	return -EOPNOTSUPP;
#endif
}

static int xt_ct_tg_check(const struct xt_tgchk_param *par,
			  struct xt_ct_target_info_v1 *info)
{
	struct nf_conntrack_tuple t;
	struct nf_conn *ct;
	int ret = -EOPNOTSUPP;

	if (info->flags & ~XT_CT_NOTRACK)
		return -EINVAL;

	if (info->flags & XT_CT_NOTRACK) {
		ct = nf_ct_untracked_get();
		atomic_inc(&ct->ct_general.use);
		goto out;
	}

#ifndef CONFIG_NF_CONNTRACK_ZONES
	if (info->zone)
		goto err1;
#endif

	ret = nf_ct_l3proto_try_module_get(par->family);
	if (ret < 0)
		goto err1;

	memset(&t, 0, sizeof(t));
	ct = nf_conntrack_alloc(par->net, info->zone, &t, &t, GFP_KERNEL);
	ret = PTR_ERR(ct);
	if (IS_ERR(ct))
		goto err2;

	ret = 0;
	if ((info->ct_events || info->exp_events) &&
	    !nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events,
				  GFP_KERNEL))
		goto err3;

	if (info->helper[0]) {
		ret = xt_ct_set_helper(ct, info->helper, par);
		if (ret < 0)
			goto err3;
	}

	if (info->timeout[0]) {
		ret = xt_ct_set_timeout(ct, par, info->timeout);
		if (ret < 0)
			goto err3;
	}

	__set_bit(IPS_TEMPLATE_BIT, &ct->status);
	__set_bit(IPS_CONFIRMED_BIT, &ct->status);

	/* Overload tuple linked list to put us in template list. */
	hlist_nulls_add_head_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode,
				 &par->net->ct.tmpl);
out:
	info->ct = ct;
	return 0;

err3:
	nf_conntrack_free(ct);
err2:
	nf_ct_l3proto_module_put(par->family);
err1:
	return ret;
}

static int xt_ct_tg_check_v0(const struct xt_tgchk_param *par)
{
	struct xt_ct_target_info *info = par->targinfo;
	struct xt_ct_target_info_v1 info_v1 = {
		.flags 		= info->flags,
		.zone		= info->zone,
		.ct_events	= info->ct_events,
		.exp_events	= info->exp_events,
	};
	int ret;

	memcpy(info_v1.helper, info->helper, sizeof(info->helper));

	ret = xt_ct_tg_check(par, &info_v1);
	if (ret < 0)
		return ret;

	info->ct = info_v1.ct;

	return ret;
}

static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
{
	return xt_ct_tg_check(par, par->targinfo);
}

static void xt_ct_destroy_timeout(struct nf_conn *ct)
{
#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
	struct nf_conn_timeout *timeout_ext;
	typeof(nf_ct_timeout_put_hook) timeout_put;

	rcu_read_lock();
	timeout_put = rcu_dereference(nf_ct_timeout_put_hook);

	if (timeout_put) {
		timeout_ext = nf_ct_timeout_find(ct);
		if (timeout_ext)
			timeout_put(timeout_ext->timeout);
	}
	rcu_read_unlock();
#endif
}

static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,
			     struct xt_ct_target_info_v1 *info)
{
	struct nf_conn *ct = info->ct;
	struct nf_conn_help *help;

	if (!nf_ct_is_untracked(ct)) {
		help = nfct_help(ct);
		if (help)
			module_put(help->helper->me);

		nf_ct_l3proto_module_put(par->family);

		xt_ct_destroy_timeout(ct);
	}
	nf_ct_put(info->ct);
}

static void xt_ct_tg_destroy_v0(const struct xt_tgdtor_param *par)
{
	struct xt_ct_target_info *info = par->targinfo;
	struct xt_ct_target_info_v1 info_v1 = {
		.flags 		= info->flags,
		.zone		= info->zone,
		.ct_events	= info->ct_events,
		.exp_events	= info->exp_events,
		.ct		= info->ct,
	};
	memcpy(info_v1.helper, info->helper, sizeof(info->helper));

	xt_ct_tg_destroy(par, &info_v1);
}

static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param *par)
{
	xt_ct_tg_destroy(par, par->targinfo);
}

static struct xt_target xt_ct_tg_reg[] __read_mostly = {
	{
		.name		= "CT",
		.family		= NFPROTO_UNSPEC,
		.targetsize	= sizeof(struct xt_ct_target_info),
		.checkentry	= xt_ct_tg_check_v0,
		.destroy	= xt_ct_tg_destroy_v0,
		.target		= xt_ct_target_v0,
		.table		= "raw",
		.me		= THIS_MODULE,
	},
	{
		.name		= "CT",
		.family		= NFPROTO_UNSPEC,
		.revision	= 1,
		.targetsize	= sizeof(struct xt_ct_target_info_v1),
		.checkentry	= xt_ct_tg_check_v1,
		.destroy	= xt_ct_tg_destroy_v1,
		.target		= xt_ct_target_v1,
		.table		= "raw",
		.me		= THIS_MODULE,
	},
};

static unsigned int
notrack_tg(struct sk_buff *skb, const struct xt_action_param *par)
{
	/* Previously seen (loopback)? Ignore. */
	if (skb->nfct != NULL)
		return XT_CONTINUE;

	skb->nfct = &nf_ct_untracked_get()->ct_general;
	skb->nfctinfo = IP_CT_NEW;
	nf_conntrack_get(skb->nfct);

	return XT_CONTINUE;
}

static int notrack_chk(const struct xt_tgchk_param *par)
{
	if (!par->net->xt.notrack_deprecated_warning) {
		pr_info("netfilter: NOTRACK target is deprecated, "
			"use CT instead or upgrade iptables\n");
		par->net->xt.notrack_deprecated_warning = true;
	}
	return 0;
}

static struct xt_target notrack_tg_reg __read_mostly = {
	.name		= "NOTRACK",
	.revision	= 0,
	.family		= NFPROTO_UNSPEC,
	.checkentry	= notrack_chk,
	.target		= notrack_tg,
	.table		= "raw",
	.me		= THIS_MODULE,
};

static int __init xt_ct_tg_init(void)
{
	int ret;

	ret = xt_register_target(&notrack_tg_reg);
	if (ret < 0)
		return ret;

	ret = xt_register_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
	if (ret < 0) {
		xt_unregister_target(&notrack_tg_reg);
		return ret;
	}
	return 0;
}

static void __exit xt_ct_tg_exit(void)
{
	xt_unregister_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
	xt_unregister_target(&notrack_tg_reg);
}

module_init(xt_ct_tg_init);
module_exit(xt_ct_tg_exit);

MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("Xtables: connection tracking target");
MODULE_ALIAS("ipt_CT");
MODULE_ALIAS("ip6t_CT");
MODULE_ALIAS("ipt_NOTRACK");
MODULE_ALIAS("ip6t_NOTRACK");
Commit	Line	Data
84f3bb9a PM	1	/*
	2	* Copyright (c) 2010 Patrick McHardy <kaber@trash.net>
	3	*
	4	* This program is free software; you can redistribute it and/or modify
	5	* it under the terms of the GNU General Public License version 2 as
	6	* published by the Free Software Foundation.
	7	*/
a7fed762	8	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
84f3bb9a	9	#include <linux/module.h>
5a0e3ad6	10	#include <linux/gfp.h>
84f3bb9a	11	#include <linux/skbuff.h>
84f3bb9a PM	12	#include <linux/netfilter_ipv4/ip_tables.h>
	13	#include <linux/netfilter_ipv6/ip6_tables.h>
	14	#include <linux/netfilter/x_tables.h>
	15	#include <linux/netfilter/xt_CT.h>
	16	#include <net/netfilter/nf_conntrack.h>
eeb4cb95	17	#include <net/netfilter/nf_conntrack_l4proto.h>
84f3bb9a PM	18	#include <net/netfilter/nf_conntrack_helper.h>
84f3bb9a PM	19	#include <net/netfilter/nf_conntrack_ecache.h>
24de58f4	20	#include <net/netfilter/nf_conntrack_timeout.h>
5d0aa2cc	21	#include <net/netfilter/nf_conntrack_zones.h>
84f3bb9a	22
d52ed437	23	static inline int xt_ct_target(struct sk_buff skb, struct nf_conn ct)
84f3bb9a	24	{
84f3bb9a PM	25	/* Previously seen (loopback)? Ignore. */
	26	if (skb->nfct != NULL)
	27	return XT_CONTINUE;
	28
	29	atomic_inc(&ct->ct_general.use);
	30	skb->nfct = &ct->ct_general;
	31	skb->nfctinfo = IP_CT_NEW;
	32
	33	return XT_CONTINUE;
	34	}
	35
d52ed437	36	static unsigned int xt_ct_target_v0(struct sk_buff *skb,
24de58f4 PNA	37	const struct xt_action_param *par)
24de58f4 PNA	38	{
d52ed437	39	const struct xt_ct_target_info *info = par->targinfo;
24de58f4 PNA	40	struct nf_conn *ct = info->ct;
24de58f4 PNA	41
d52ed437 PNA	42	return xt_ct_target(skb, ct);
d52ed437 PNA	43	}
24de58f4	44
d52ed437 PNA	45	static unsigned int xt_ct_target_v1(struct sk_buff *skb,
	46	const struct xt_action_param *par)
	47	{
	48	const struct xt_ct_target_info_v1 *info = par->targinfo;
	49	struct nf_conn *ct = info->ct;
24de58f4	50
d52ed437	51	return xt_ct_target(skb, ct);
24de58f4 PNA	52	}
24de58f4 PNA	53
84f3bb9a PM	54	static u8 xt_ct_find_proto(const struct xt_tgchk_param *par)
84f3bb9a PM	55	{
076f7839	56	if (par->family == NFPROTO_IPV4) {
84f3bb9a PM	57	const struct ipt_entry *e = par->entryinfo;
	58
	59	if (e->ip.invflags & IPT_INV_PROTO)
	60	return 0;
	61	return e->ip.proto;
076f7839	62	} else if (par->family == NFPROTO_IPV6) {
84f3bb9a PM	63	const struct ip6t_entry *e = par->entryinfo;
	64
	65	if (e->ipv6.invflags & IP6T_INV_PROTO)
	66	return 0;
	67	return e->ipv6.proto;
	68	} else
	69	return 0;
	70	}
	71
236df005 PNA	72	static int
	73	xt_ct_set_helper(struct nf_conn ct, const char helper_name,
	74	const struct xt_tgchk_param *par)
	75	{
	76	struct nf_conntrack_helper *helper;
	77	struct nf_conn_help *help;
	78	u8 proto;
	79
	80	proto = xt_ct_find_proto(par);
	81	if (!proto) {
	82	pr_info("You must specify a L4 protocol, and not use "
	83	"inversions on it.\n");
	84	return -ENOENT;
	85	}
	86
	87	helper = nf_conntrack_helper_try_module_get(helper_name, par->family,
	88	proto);
	89	if (helper == NULL) {
	90	pr_info("No such helper \"%s\"\n", helper_name);
	91	return -ENOENT;
	92	}
	93
	94	help = nf_ct_helper_ext_add(ct, helper, GFP_KERNEL);
	95	if (help == NULL) {
	96	module_put(helper->me);
	97	return -ENOMEM;
	98	}
	99
	100	help->helper = helper;
	101	return 0;
	102	}
	103
ee14186f PNA	104	#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
	105	static void __xt_ct_tg_timeout_put(struct ctnl_timeout *timeout)
	106	{
	107	typeof(nf_ct_timeout_put_hook) timeout_put;
	108
	109	timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
	110	if (timeout_put)
	111	timeout_put(timeout);
	112	}
	113	#endif
	114
236df005 PNA	115	static int
	116	xt_ct_set_timeout(struct nf_conn ct, const struct xt_tgchk_param par,
	117	const char *timeout_name)
	118	{
	119	#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
	120	typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
	121	struct ctnl_timeout *timeout;
	122	struct nf_conn_timeout *timeout_ext;
236df005 PNA	123	struct nf_conntrack_l4proto *l4proto;
236df005 PNA	124	int ret = 0;
0153d5a8	125	u8 proto;
236df005 PNA	126
	127	rcu_read_lock();
	128	timeout_find_get = rcu_dereference(nf_ct_timeout_find_get_hook);
	129	if (timeout_find_get == NULL) {
	130	ret = -ENOENT;
	131	pr_info("Timeout policy base is empty\n");
	132	goto out;
	133	}
	134
0153d5a8 PNA	135	proto = xt_ct_find_proto(par);
0153d5a8 PNA	136	if (!proto) {
236df005	137	ret = -EINVAL;
0153d5a8 PNA	138	pr_info("You must specify a L4 protocol, and not use "
0153d5a8 PNA	139	"inversions on it.\n");
236df005 PNA	140	goto out;
	141	}
	142
	143	timeout = timeout_find_get(timeout_name);
	144	if (timeout == NULL) {
	145	ret = -ENOENT;
	146	pr_info("No such timeout policy \"%s\"\n", timeout_name);
	147	goto out;
	148	}
	149
	150	if (timeout->l3num != par->family) {
	151	ret = -EINVAL;
	152	pr_info("Timeout policy `%s' can only be used by L3 protocol "
	153	"number %d\n", timeout_name, timeout->l3num);
	154	goto err_put_timeout;
	155	}
	156	/* Make sure the timeout policy matches any existing protocol tracker,
	157	* otherwise default to generic.
	158	*/
0153d5a8	159	l4proto = __nf_ct_l4proto_find(par->family, proto);
236df005 PNA	160	if (timeout->l4proto->l4proto != l4proto->l4proto) {
	161	ret = -EINVAL;
	162	pr_info("Timeout policy `%s' can only be used by L4 protocol "
	163	"number %d\n",
	164	timeout_name, timeout->l4proto->l4proto);
	165	goto err_put_timeout;
	166	}
	167	timeout_ext = nf_ct_timeout_ext_add(ct, timeout, GFP_ATOMIC);
	168	if (timeout_ext == NULL)
	169	ret = -ENOMEM;
	170
	171	err_put_timeout:
	172	__xt_ct_tg_timeout_put(timeout);
	173	out:
	174	rcu_read_unlock();
	175	return ret;
	176	#else
	177	return -EOPNOTSUPP;
	178	#endif
	179	}
	180
d52ed437 PNA	181	static int xt_ct_tg_check(const struct xt_tgchk_param *par,
d52ed437 PNA	182	struct xt_ct_target_info_v1 *info)
24de58f4	183	{
24de58f4	184	struct nf_conntrack_tuple t;
24de58f4	185	struct nf_conn *ct;
4610476d	186	int ret = -EOPNOTSUPP;
236df005	187
24de58f4 PNA	188	if (info->flags & ~XT_CT_NOTRACK)
	189	return -EINVAL;
	190
	191	if (info->flags & XT_CT_NOTRACK) {
	192	ct = nf_ct_untracked_get();
	193	atomic_inc(&ct->ct_general.use);
	194	goto out;
	195	}
	196
	197	#ifndef CONFIG_NF_CONNTRACK_ZONES
	198	if (info->zone)
	199	goto err1;
	200	#endif
	201
	202	ret = nf_ct_l3proto_try_module_get(par->family);
	203	if (ret < 0)
	204	goto err1;
	205
	206	memset(&t, 0, sizeof(t));
	207	ct = nf_conntrack_alloc(par->net, info->zone, &t, &t, GFP_KERNEL);
	208	ret = PTR_ERR(ct);
	209	if (IS_ERR(ct))
	210	goto err2;
	211
	212	ret = 0;
	213	if ((info->ct_events \|\| info->exp_events) &&
	214	!nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events,
	215	GFP_KERNEL))
	216	goto err3;
	217
	218	if (info->helper[0]) {
236df005 PNA	219	ret = xt_ct_set_helper(ct, info->helper, par);
236df005 PNA	220	if (ret < 0)
1afc5679	221	goto err3;
24de58f4 PNA	222	}
24de58f4 PNA	223
6cf51852	224	if (info->timeout[0]) {
236df005 PNA	225	ret = xt_ct_set_timeout(ct, par, info->timeout);
	226	if (ret < 0)
	227	goto err3;
24de58f4	228	}
24de58f4 PNA	229
	230	__set_bit(IPS_TEMPLATE_BIT, &ct->status);
	231	__set_bit(IPS_CONFIRMED_BIT, &ct->status);
252b3e8c PNA	232
	233	/* Overload tuple linked list to put us in template list. */
	234	hlist_nulls_add_head_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode,
	235	&par->net->ct.tmpl);
24de58f4 PNA	236	out:
	237	info->ct = ct;
	238	return 0;
	239
	240	err3:
	241	nf_conntrack_free(ct);
	242	err2:
	243	nf_ct_l3proto_module_put(par->family);
	244	err1:
	245	return ret;
	246	}
	247
d52ed437	248	static int xt_ct_tg_check_v0(const struct xt_tgchk_param *par)
84f3bb9a PM	249	{
84f3bb9a PM	250	struct xt_ct_target_info *info = par->targinfo;
d52ed437 PNA	251	struct xt_ct_target_info_v1 info_v1 = {
	252	.flags = info->flags,
	253	.zone = info->zone,
	254	.ct_events = info->ct_events,
	255	.exp_events = info->exp_events,
	256	};
	257	int ret;
84f3bb9a	258
d52ed437	259	memcpy(info_v1.helper, info->helper, sizeof(info->helper));
84f3bb9a	260
d52ed437 PNA	261	ret = xt_ct_tg_check(par, &info_v1);
	262	if (ret < 0)
	263	return ret;
	264
	265	info->ct = info_v1.ct;
	266
	267	return ret;
	268	}
	269
	270	static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
	271	{
	272	return xt_ct_tg_check(par, par->targinfo);
84f3bb9a PM	273	}
84f3bb9a PM	274
236df005	275	static void xt_ct_destroy_timeout(struct nf_conn *ct)
24de58f4	276	{
24de58f4 PNA	277	#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
	278	struct nf_conn_timeout *timeout_ext;
	279	typeof(nf_ct_timeout_put_hook) timeout_put;
236df005 PNA	280
	281	rcu_read_lock();
	282	timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
	283
	284	if (timeout_put) {
	285	timeout_ext = nf_ct_timeout_find(ct);
	286	if (timeout_ext)
	287	timeout_put(timeout_ext->timeout);
	288	}
	289	rcu_read_unlock();
24de58f4	290	#endif
236df005 PNA	291	}
236df005 PNA	292
d52ed437 PNA	293	static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,
d52ed437 PNA	294	struct xt_ct_target_info_v1 *info)
236df005	295	{
236df005 PNA	296	struct nf_conn *ct = info->ct;
	297	struct nf_conn_help *help;
	298
24de58f4 PNA	299	if (!nf_ct_is_untracked(ct)) {
	300	help = nfct_help(ct);
	301	if (help)
	302	module_put(help->helper->me);
	303
	304	nf_ct_l3proto_module_put(par->family);
	305
236df005	306	xt_ct_destroy_timeout(ct);
24de58f4 PNA	307	}
24de58f4 PNA	308	nf_ct_put(info->ct);
d52ed437 PNA	309	}
	310
	311	static void xt_ct_tg_destroy_v0(const struct xt_tgdtor_param *par)
	312	{
	313	struct xt_ct_target_info *info = par->targinfo;
	314	struct xt_ct_target_info_v1 info_v1 = {
	315	.flags = info->flags,
	316	.zone = info->zone,
	317	.ct_events = info->ct_events,
	318	.exp_events = info->exp_events,
	319	.ct = info->ct,
	320	};
	321	memcpy(info_v1.helper, info->helper, sizeof(info->helper));
	322
	323	xt_ct_tg_destroy(par, &info_v1);
	324	}
	325
	326	static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param *par)
	327	{
	328	xt_ct_tg_destroy(par, par->targinfo);
24de58f4 PNA	329	}
	330
	331	static struct xt_target xt_ct_tg_reg[] __read_mostly = {
	332	{
	333	.name = "CT",
	334	.family = NFPROTO_UNSPEC,
	335	.targetsize = sizeof(struct xt_ct_target_info),
	336	.checkentry = xt_ct_tg_check_v0,
	337	.destroy = xt_ct_tg_destroy_v0,
	338	.target = xt_ct_target_v0,
	339	.table = "raw",
	340	.me = THIS_MODULE,
	341	},
	342	{
	343	.name = "CT",
	344	.family = NFPROTO_UNSPEC,
	345	.revision = 1,
	346	.targetsize = sizeof(struct xt_ct_target_info_v1),
	347	.checkentry = xt_ct_tg_check_v1,
	348	.destroy = xt_ct_tg_destroy_v1,
	349	.target = xt_ct_target_v1,
	350	.table = "raw",
	351	.me = THIS_MODULE,
	352	},
84f3bb9a PM	353	};
84f3bb9a PM	354
10db9069 PNA	355	static unsigned int
	356	notrack_tg(struct sk_buff skb, const struct xt_action_param par)
	357	{
	358	/* Previously seen (loopback)? Ignore. */
	359	if (skb->nfct != NULL)
	360	return XT_CONTINUE;
	361
	362	skb->nfct = &nf_ct_untracked_get()->ct_general;
	363	skb->nfctinfo = IP_CT_NEW;
	364	nf_conntrack_get(skb->nfct);
	365
	366	return XT_CONTINUE;
	367	}
	368
	369	static int notrack_chk(const struct xt_tgchk_param *par)
	370	{
	371	if (!par->net->xt.notrack_deprecated_warning) {
	372	pr_info("netfilter: NOTRACK target is deprecated, "
	373	"use CT instead or upgrade iptables\n");
	374	par->net->xt.notrack_deprecated_warning = true;
	375	}
	376	return 0;
	377	}
	378
	379	static struct xt_target notrack_tg_reg __read_mostly = {
	380	.name = "NOTRACK",
	381	.revision = 0,
	382	.family = NFPROTO_UNSPEC,
	383	.checkentry = notrack_chk,
	384	.target = notrack_tg,
	385	.table = "raw",
	386	.me = THIS_MODULE,
	387	};
	388
84f3bb9a PM	389	static int __init xt_ct_tg_init(void)
84f3bb9a PM	390	{
10db9069 PNA	391	int ret;
	392
	393	ret = xt_register_target(&notrack_tg_reg);
	394	if (ret < 0)
	395	return ret;
	396
	397	ret = xt_register_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
	398	if (ret < 0) {
	399	xt_unregister_target(&notrack_tg_reg);
	400	return ret;
	401	}
	402	return 0;
84f3bb9a PM	403	}
	404
	405	static void __exit xt_ct_tg_exit(void)
	406	{
24de58f4	407	xt_unregister_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
10db9069	408	xt_unregister_target(&notrack_tg_reg);
84f3bb9a PM	409	}
	410
	411	module_init(xt_ct_tg_init);
	412	module_exit(xt_ct_tg_exit);
	413
	414	MODULE_LICENSE("GPL");
	415	MODULE_DESCRIPTION("Xtables: connection tracking target");
	416	MODULE_ALIAS("ipt_CT");
	417	MODULE_ALIAS("ip6t_CT");
10db9069 PNA	418	MODULE_ALIAS("ipt_NOTRACK");
10db9069 PNA	419	MODULE_ALIAS("ip6t_NOTRACK");