[linux-block.git] / net / netfilter / nfnetlink_cttimeout.c

/*
 * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
 * (C) 2012 by Vyatta Inc. <http://www.vyatta.com>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation (or any later at your option).
 */
#include <linux/init.h>
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/rculist.h>
#include <linux/rculist_nulls.h>
#include <linux/types.h>
#include <linux/timer.h>
#include <linux/security.h>
#include <linux/skbuff.h>
#include <linux/errno.h>
#include <linux/netlink.h>
#include <linux/spinlock.h>
#include <linux/interrupt.h>
#include <linux/slab.h>

#include <linux/netfilter.h>
#include <net/netlink.h>
#include <net/sock.h>
#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_core.h>
#include <net/netfilter/nf_conntrack_l4proto.h>
#include <net/netfilter/nf_conntrack_tuple.h>
#include <net/netfilter/nf_conntrack_timeout.h>

#include <linux/netfilter/nfnetlink.h>
#include <linux/netfilter/nfnetlink_cttimeout.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
MODULE_DESCRIPTION("cttimeout: Extended Netfilter Connection Tracking timeout tuning");

static const struct nla_policy cttimeout_nla_policy[CTA_TIMEOUT_MAX+1] = {
	[CTA_TIMEOUT_NAME]	= { .type = NLA_NUL_STRING,
				    .len  = CTNL_TIMEOUT_NAME_MAX - 1},
	[CTA_TIMEOUT_L3PROTO]	= { .type = NLA_U16 },
	[CTA_TIMEOUT_L4PROTO]	= { .type = NLA_U8 },
	[CTA_TIMEOUT_DATA]	= { .type = NLA_NESTED },
};

static int
ctnl_timeout_parse_policy(void *timeout,
			  const struct nf_conntrack_l4proto *l4proto,
			  struct net *net, const struct nlattr *attr)
{
	struct nlattr **tb;
	int ret = 0;

	if (!l4proto->ctnl_timeout.nlattr_to_obj)
		return 0;

	tb = kcalloc(l4proto->ctnl_timeout.nlattr_max + 1, sizeof(*tb),
		     GFP_KERNEL);

	if (!tb)
		return -ENOMEM;

	ret = nla_parse_nested(tb, l4proto->ctnl_timeout.nlattr_max, attr,
			       l4proto->ctnl_timeout.nla_policy, NULL);
	if (ret < 0)
		goto err;

	ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeout);

err:
	kfree(tb);
	return ret;
}

static int cttimeout_new_timeout(struct net *net, struct sock *ctnl,
				 struct sk_buff *skb,
				 const struct nlmsghdr *nlh,
				 const struct nlattr * const cda[],
				 struct netlink_ext_ack *extack)
{
	__u16 l3num;
	__u8 l4num;
	const struct nf_conntrack_l4proto *l4proto;
	struct ctnl_timeout *timeout, *matching = NULL;
	char *name;
	int ret;

	if (!cda[CTA_TIMEOUT_NAME] ||
	    !cda[CTA_TIMEOUT_L3PROTO] ||
	    !cda[CTA_TIMEOUT_L4PROTO] ||
	    !cda[CTA_TIMEOUT_DATA])
		return -EINVAL;

	name = nla_data(cda[CTA_TIMEOUT_NAME]);
	l3num = ntohs(nla_get_be16(cda[CTA_TIMEOUT_L3PROTO]));
	l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]);

	list_for_each_entry(timeout, &net->nfct_timeout_list, head) {
		if (strncmp(timeout->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
			continue;

		if (nlh->nlmsg_flags & NLM_F_EXCL)
			return -EEXIST;

		matching = timeout;
		break;
	}

	if (matching) {
		if (nlh->nlmsg_flags & NLM_F_REPLACE) {
			/* You cannot replace one timeout policy by another of
			 * different kind, sorry.
			 */
			if (matching->timeout.l3num != l3num ||
			    matching->timeout.l4proto->l4proto != l4num)
				return -EINVAL;

			return ctnl_timeout_parse_policy(&matching->timeout.data,
							 matching->timeout.l4proto,
							 net, cda[CTA_TIMEOUT_DATA]);
		}

		return -EBUSY;
	}

	l4proto = nf_ct_l4proto_find_get(l3num, l4num);

	/* This protocol is not supportted, skip. */
	if (l4proto->l4proto != l4num) {
		ret = -EOPNOTSUPP;
		goto err_proto_put;
	}

	timeout = kzalloc(sizeof(struct ctnl_timeout) +
			  l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
	if (timeout == NULL) {
		ret = -ENOMEM;
		goto err_proto_put;
	}

	ret = ctnl_timeout_parse_policy(&timeout->timeout.data, l4proto, net,
					cda[CTA_TIMEOUT_DATA]);
	if (ret < 0)
		goto err;

	strcpy(timeout->name, nla_data(cda[CTA_TIMEOUT_NAME]));
	timeout->timeout.l3num = l3num;
	timeout->timeout.l4proto = l4proto;
	refcount_set(&timeout->refcnt, 1);
	list_add_tail_rcu(&timeout->head, &net->nfct_timeout_list);

	return 0;
err:
	kfree(timeout);
err_proto_put:
	nf_ct_l4proto_put(l4proto);
	return ret;
}

static int
ctnl_timeout_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
		       int event, struct ctnl_timeout *timeout)
{
	struct nlmsghdr *nlh;
	struct nfgenmsg *nfmsg;
	unsigned int flags = portid ? NLM_F_MULTI : 0;
	const struct nf_conntrack_l4proto *l4proto = timeout->timeout.l4proto;

	event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_TIMEOUT, event);
	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
	if (nlh == NULL)
		goto nlmsg_failure;

	nfmsg = nlmsg_data(nlh);
	nfmsg->nfgen_family = AF_UNSPEC;
	nfmsg->version = NFNETLINK_V0;
	nfmsg->res_id = 0;

	if (nla_put_string(skb, CTA_TIMEOUT_NAME, timeout->name) ||
	    nla_put_be16(skb, CTA_TIMEOUT_L3PROTO,
			 htons(timeout->timeout.l3num)) ||
	    nla_put_u8(skb, CTA_TIMEOUT_L4PROTO, l4proto->l4proto) ||
	    nla_put_be32(skb, CTA_TIMEOUT_USE,
			 htonl(refcount_read(&timeout->refcnt))))
		goto nla_put_failure;

	if (likely(l4proto->ctnl_timeout.obj_to_nlattr)) {
		struct nlattr *nest_parms;
		int ret;

		nest_parms = nla_nest_start(skb,
					    CTA_TIMEOUT_DATA | NLA_F_NESTED);
		if (!nest_parms)
			goto nla_put_failure;

		ret = l4proto->ctnl_timeout.obj_to_nlattr(skb,
							&timeout->timeout.data);
		if (ret < 0)
			goto nla_put_failure;

		nla_nest_end(skb, nest_parms);
	}

	nlmsg_end(skb, nlh);
	return skb->len;

nlmsg_failure:
nla_put_failure:
	nlmsg_cancel(skb, nlh);
	return -1;
}

static int
ctnl_timeout_dump(struct sk_buff *skb, struct netlink_callback *cb)
{
	struct net *net = sock_net(skb->sk);
	struct ctnl_timeout *cur, *last;

	if (cb->args[2])
		return 0;

	last = (struct ctnl_timeout *)cb->args[1];
	if (cb->args[1])
		cb->args[1] = 0;

	rcu_read_lock();
	list_for_each_entry_rcu(cur, &net->nfct_timeout_list, head) {
		if (last) {
			if (cur != last)
				continue;

			last = NULL;
		}
		if (ctnl_timeout_fill_info(skb, NETLINK_CB(cb->skb).portid,
					   cb->nlh->nlmsg_seq,
					   NFNL_MSG_TYPE(cb->nlh->nlmsg_type),
					   IPCTNL_MSG_TIMEOUT_NEW, cur) < 0) {
			cb->args[1] = (unsigned long)cur;
			break;
		}
	}
	if (!cb->args[1])
		cb->args[2] = 1;
	rcu_read_unlock();
	return skb->len;
}

static int cttimeout_get_timeout(struct net *net, struct sock *ctnl,
				 struct sk_buff *skb,
				 const struct nlmsghdr *nlh,
				 const struct nlattr * const cda[],
				 struct netlink_ext_ack *extack)
{
	int ret = -ENOENT;
	char *name;
	struct ctnl_timeout *cur;

	if (nlh->nlmsg_flags & NLM_F_DUMP) {
		struct netlink_dump_control c = {
			.dump = ctnl_timeout_dump,
		};
		return netlink_dump_start(ctnl, skb, nlh, &c);
	}

	if (!cda[CTA_TIMEOUT_NAME])
		return -EINVAL;
	name = nla_data(cda[CTA_TIMEOUT_NAME]);

	list_for_each_entry(cur, &net->nfct_timeout_list, head) {
		struct sk_buff *skb2;

		if (strncmp(cur->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
			continue;

		skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
		if (skb2 == NULL) {
			ret = -ENOMEM;
			break;
		}

		ret = ctnl_timeout_fill_info(skb2, NETLINK_CB(skb).portid,
					     nlh->nlmsg_seq,
					     NFNL_MSG_TYPE(nlh->nlmsg_type),
					     IPCTNL_MSG_TIMEOUT_NEW, cur);
		if (ret <= 0) {
			kfree_skb(skb2);
			break;
		}
		ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid,
					MSG_DONTWAIT);
		if (ret > 0)
			ret = 0;

		/* this avoids a loop in nfnetlink. */
		return ret == -EAGAIN ? -ENOBUFS : ret;
	}
	return ret;
}

/* try to delete object, fail if it is still in use. */
static int ctnl_timeout_try_del(struct net *net, struct ctnl_timeout *timeout)
{
	int ret = 0;

	/* We want to avoid races with ctnl_timeout_put. So only when the
	 * current refcnt is 1, we decrease it to 0.
	 */
	if (refcount_dec_if_one(&timeout->refcnt)) {
		/* We are protected by nfnl mutex. */
		list_del_rcu(&timeout->head);
		nf_ct_l4proto_put(timeout->timeout.l4proto);
		nf_ct_untimeout(net, &timeout->timeout);
		kfree_rcu(timeout, rcu_head);
	} else {
		ret = -EBUSY;
	}
	return ret;
}

static int cttimeout_del_timeout(struct net *net, struct sock *ctnl,
				 struct sk_buff *skb,
				 const struct nlmsghdr *nlh,
				 const struct nlattr * const cda[],
				 struct netlink_ext_ack *extack)
{
	struct ctnl_timeout *cur, *tmp;
	int ret = -ENOENT;
	char *name;

	if (!cda[CTA_TIMEOUT_NAME]) {
		list_for_each_entry_safe(cur, tmp, &net->nfct_timeout_list,
					 head)
			ctnl_timeout_try_del(net, cur);

		return 0;
	}
	name = nla_data(cda[CTA_TIMEOUT_NAME]);

	list_for_each_entry(cur, &net->nfct_timeout_list, head) {
		if (strncmp(cur->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
			continue;

		ret = ctnl_timeout_try_del(net, cur);
		if (ret < 0)
			return ret;

		break;
	}
	return ret;
}

static int cttimeout_default_set(struct net *net, struct sock *ctnl,
				 struct sk_buff *skb,
				 const struct nlmsghdr *nlh,
				 const struct nlattr * const cda[],
				 struct netlink_ext_ack *extack)
{
	const struct nf_conntrack_l4proto *l4proto;
	__u16 l3num;
	__u8 l4num;
	int ret;

	if (!cda[CTA_TIMEOUT_L3PROTO] ||
	    !cda[CTA_TIMEOUT_L4PROTO] ||
	    !cda[CTA_TIMEOUT_DATA])
		return -EINVAL;

	l3num = ntohs(nla_get_be16(cda[CTA_TIMEOUT_L3PROTO]));
	l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]);
	l4proto = nf_ct_l4proto_find_get(l3num, l4num);

	/* This protocol is not supported, skip. */
	if (l4proto->l4proto != l4num) {
		ret = -EOPNOTSUPP;
		goto err;
	}

	ret = ctnl_timeout_parse_policy(NULL, l4proto, net,
					cda[CTA_TIMEOUT_DATA]);
	if (ret < 0)
		goto err;

	nf_ct_l4proto_put(l4proto);
	return 0;
err:
	nf_ct_l4proto_put(l4proto);
	return ret;
}

static int
cttimeout_default_fill_info(struct net *net, struct sk_buff *skb, u32 portid,
			    u32 seq, u32 type, int event,
			    const struct nf_conntrack_l4proto *l4proto)
{
	struct nlmsghdr *nlh;
	struct nfgenmsg *nfmsg;
	unsigned int flags = portid ? NLM_F_MULTI : 0;

	event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_TIMEOUT, event);
	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
	if (nlh == NULL)
		goto nlmsg_failure;

	nfmsg = nlmsg_data(nlh);
	nfmsg->nfgen_family = AF_UNSPEC;
	nfmsg->version = NFNETLINK_V0;
	nfmsg->res_id = 0;

	if (nla_put_be16(skb, CTA_TIMEOUT_L3PROTO, htons(l4proto->l3proto)) ||
	    nla_put_u8(skb, CTA_TIMEOUT_L4PROTO, l4proto->l4proto))
		goto nla_put_failure;

	if (likely(l4proto->ctnl_timeout.obj_to_nlattr)) {
		struct nlattr *nest_parms;
		int ret;

		nest_parms = nla_nest_start(skb,
					    CTA_TIMEOUT_DATA | NLA_F_NESTED);
		if (!nest_parms)
			goto nla_put_failure;

		ret = l4proto->ctnl_timeout.obj_to_nlattr(skb, NULL);
		if (ret < 0)
			goto nla_put_failure;

		nla_nest_end(skb, nest_parms);
	}

	nlmsg_end(skb, nlh);
	return skb->len;

nlmsg_failure:
nla_put_failure:
	nlmsg_cancel(skb, nlh);
	return -1;
}

static int cttimeout_default_get(struct net *net, struct sock *ctnl,
				 struct sk_buff *skb,
				 const struct nlmsghdr *nlh,
				 const struct nlattr * const cda[],
				 struct netlink_ext_ack *extack)
{
	const struct nf_conntrack_l4proto *l4proto;
	struct sk_buff *skb2;
	int ret, err;
	__u16 l3num;
	__u8 l4num;

	if (!cda[CTA_TIMEOUT_L3PROTO] || !cda[CTA_TIMEOUT_L4PROTO])
		return -EINVAL;

	l3num = ntohs(nla_get_be16(cda[CTA_TIMEOUT_L3PROTO]));
	l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]);
	l4proto = nf_ct_l4proto_find_get(l3num, l4num);

	/* This protocol is not supported, skip. */
	if (l4proto->l4proto != l4num) {
		err = -EOPNOTSUPP;
		goto err;
	}

	skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
	if (skb2 == NULL) {
		err = -ENOMEM;
		goto err;
	}

	ret = cttimeout_default_fill_info(net, skb2, NETLINK_CB(skb).portid,
					  nlh->nlmsg_seq,
					  NFNL_MSG_TYPE(nlh->nlmsg_type),
					  IPCTNL_MSG_TIMEOUT_DEFAULT_SET,
					  l4proto);
	if (ret <= 0) {
		kfree_skb(skb2);
		err = -ENOMEM;
		goto err;
	}
	ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid, MSG_DONTWAIT);
	if (ret > 0)
		ret = 0;

	/* this avoids a loop in nfnetlink. */
	return ret == -EAGAIN ? -ENOBUFS : ret;
err:
	nf_ct_l4proto_put(l4proto);
	return err;
}

static struct nf_ct_timeout *ctnl_timeout_find_get(struct net *net,
						   const char *name)
{
	struct ctnl_timeout *timeout, *matching = NULL;

	list_for_each_entry_rcu(timeout, &net->nfct_timeout_list, head) {
		if (strncmp(timeout->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
			continue;

		if (!try_module_get(THIS_MODULE))
			goto err;

		if (!refcount_inc_not_zero(&timeout->refcnt)) {
			module_put(THIS_MODULE);
			goto err;
		}
		matching = timeout;
		break;
	}
err:
	return matching ? &matching->timeout : NULL;
}

static void ctnl_timeout_put(struct nf_ct_timeout *t)
{
	struct ctnl_timeout *timeout =
		container_of(t, struct ctnl_timeout, timeout);

	if (refcount_dec_and_test(&timeout->refcnt))
		kfree_rcu(timeout, rcu_head);

	module_put(THIS_MODULE);
}

static const struct nfnl_callback cttimeout_cb[IPCTNL_MSG_TIMEOUT_MAX] = {
	[IPCTNL_MSG_TIMEOUT_NEW]	= { .call = cttimeout_new_timeout,
					    .attr_count = CTA_TIMEOUT_MAX,
					    .policy = cttimeout_nla_policy },
	[IPCTNL_MSG_TIMEOUT_GET]	= { .call = cttimeout_get_timeout,
					    .attr_count = CTA_TIMEOUT_MAX,
					    .policy = cttimeout_nla_policy },
	[IPCTNL_MSG_TIMEOUT_DELETE]	= { .call = cttimeout_del_timeout,
					    .attr_count = CTA_TIMEOUT_MAX,
					    .policy = cttimeout_nla_policy },
	[IPCTNL_MSG_TIMEOUT_DEFAULT_SET]= { .call = cttimeout_default_set,
					    .attr_count = CTA_TIMEOUT_MAX,
					    .policy = cttimeout_nla_policy },
	[IPCTNL_MSG_TIMEOUT_DEFAULT_GET]= { .call = cttimeout_default_get,
					    .attr_count = CTA_TIMEOUT_MAX,
					    .policy = cttimeout_nla_policy },
};

static const struct nfnetlink_subsystem cttimeout_subsys = {
	.name				= "conntrack_timeout",
	.subsys_id			= NFNL_SUBSYS_CTNETLINK_TIMEOUT,
	.cb_count			= IPCTNL_MSG_TIMEOUT_MAX,
	.cb				= cttimeout_cb,
};

MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_TIMEOUT);

static int __net_init cttimeout_net_init(struct net *net)
{
	INIT_LIST_HEAD(&net->nfct_timeout_list);

	return 0;
}

static void __net_exit cttimeout_net_exit(struct net *net)
{
	struct ctnl_timeout *cur, *tmp;

	nf_ct_unconfirmed_destroy(net);
	nf_ct_untimeout(net, NULL);

	list_for_each_entry_safe(cur, tmp, &net->nfct_timeout_list, head) {
		list_del_rcu(&cur->head);
		nf_ct_l4proto_put(cur->timeout.l4proto);

		if (refcount_dec_and_test(&cur->refcnt))
			kfree_rcu(cur, rcu_head);
	}
}

static struct pernet_operations cttimeout_ops = {
	.init	= cttimeout_net_init,
	.exit	= cttimeout_net_exit,
};

static int __init cttimeout_init(void)
{
	int ret;

	ret = register_pernet_subsys(&cttimeout_ops);
	if (ret < 0)
		return ret;

	ret = nfnetlink_subsys_register(&cttimeout_subsys);
	if (ret < 0) {
		pr_err("cttimeout_init: cannot register cttimeout with "
			"nfnetlink.\n");
		goto err_out;
	}
	RCU_INIT_POINTER(nf_ct_timeout_find_get_hook, ctnl_timeout_find_get);
	RCU_INIT_POINTER(nf_ct_timeout_put_hook, ctnl_timeout_put);
	return 0;

err_out:
	unregister_pernet_subsys(&cttimeout_ops);
	return ret;
}

static void __exit cttimeout_exit(void)
{
	nfnetlink_subsys_unregister(&cttimeout_subsys);

	unregister_pernet_subsys(&cttimeout_ops);
	RCU_INIT_POINTER(nf_ct_timeout_find_get_hook, NULL);
	RCU_INIT_POINTER(nf_ct_timeout_put_hook, NULL);
	synchronize_rcu();
}

module_init(cttimeout_init);
module_exit(cttimeout_exit);
Commit	Line	Data
50978462 PNA	1	/*
	2	* (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
	3	* (C) 2012 by Vyatta Inc. <http://www.vyatta.com>
	4	*
	5	* This program is free software; you can redistribute it and/or modify
	6	* it under the terms of the GNU General Public License version 2 as
	7	* published by the Free Software Foundation (or any later at your option).
	8	*/
	9	#include <linux/init.h>
	10	#include <linux/module.h>
	11	#include <linux/kernel.h>
	12	#include <linux/rculist.h>
	13	#include <linux/rculist_nulls.h>
	14	#include <linux/types.h>
	15	#include <linux/timer.h>
	16	#include <linux/security.h>
	17	#include <linux/skbuff.h>
	18	#include <linux/errno.h>
	19	#include <linux/netlink.h>
	20	#include <linux/spinlock.h>
	21	#include <linux/interrupt.h>
	22	#include <linux/slab.h>
	23
	24	#include <linux/netfilter.h>
	25	#include <net/netlink.h>
	26	#include <net/sock.h>
	27	#include <net/netfilter/nf_conntrack.h>
	28	#include <net/netfilter/nf_conntrack_core.h>
50978462 PNA	29	#include <net/netfilter/nf_conntrack_l4proto.h>
50978462 PNA	30	#include <net/netfilter/nf_conntrack_tuple.h>
24de58f4	31	#include <net/netfilter/nf_conntrack_timeout.h>
50978462 PNA	32
	33	#include <linux/netfilter/nfnetlink.h>
	34	#include <linux/netfilter/nfnetlink_cttimeout.h>
	35
	36	MODULE_LICENSE("GPL");
	37	MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
	38	MODULE_DESCRIPTION("cttimeout: Extended Netfilter Connection Tracking timeout tuning");
	39
50978462	40	static const struct nla_policy cttimeout_nla_policy[CTA_TIMEOUT_MAX+1] = {
e93b5f9f FW	41	[CTA_TIMEOUT_NAME] = { .type = NLA_NUL_STRING,
e93b5f9f FW	42	.len = CTNL_TIMEOUT_NAME_MAX - 1},
50978462 PNA	43	[CTA_TIMEOUT_L3PROTO] = { .type = NLA_U16 },
	44	[CTA_TIMEOUT_L4PROTO] = { .type = NLA_U8 },
	45	[CTA_TIMEOUT_DATA] = { .type = NLA_NESTED },
	46	};
	47
	48	static int
c779e849	49	ctnl_timeout_parse_policy(void *timeout,
2a04aabf	50	const struct nf_conntrack_l4proto *l4proto,
91cb498e	51	struct net net, const struct nlattr attr)
50978462	52	{
8039ab43	53	struct nlattr **tb;
50978462 PNA	54	int ret = 0;
50978462 PNA	55
8039ab43 GS	56	if (!l4proto->ctnl_timeout.nlattr_to_obj)
8039ab43 GS	57	return 0;
50978462	58
8039ab43 GS	59	tb = kcalloc(l4proto->ctnl_timeout.nlattr_max + 1, sizeof(*tb),
8039ab43 GS	60	GFP_KERNEL);
50978462	61
8039ab43 GS	62	if (!tb)
	63	return -ENOMEM;
	64
	65	ret = nla_parse_nested(tb, l4proto->ctnl_timeout.nlattr_max, attr,
	66	l4proto->ctnl_timeout.nla_policy, NULL);
	67	if (ret < 0)
	68	goto err;
	69
c779e849	70	ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeout);
8039ab43 GS	71
	72	err:
	73	kfree(tb);
50978462 PNA	74	return ret;
	75	}
	76
7b8002a1 PNA	77	static int cttimeout_new_timeout(struct net net, struct sock ctnl,
	78	struct sk_buff *skb,
	79	const struct nlmsghdr *nlh,
04ba724b PNA	80	const struct nlattr * const cda[],
04ba724b PNA	81	struct netlink_ext_ack *extack)
50978462 PNA	82	{
	83	__u16 l3num;
	84	__u8 l4num;
b3480fe0	85	const struct nf_conntrack_l4proto *l4proto;
50978462 PNA	86	struct ctnl_timeout timeout, matching = NULL;
	87	char *name;
	88	int ret;
	89
	90	if (!cda[CTA_TIMEOUT_NAME] \|\|
	91	!cda[CTA_TIMEOUT_L3PROTO] \|\|
	92	!cda[CTA_TIMEOUT_L4PROTO] \|\|
	93	!cda[CTA_TIMEOUT_DATA])
	94	return -EINVAL;
	95
	96	name = nla_data(cda[CTA_TIMEOUT_NAME]);
	97	l3num = ntohs(nla_get_be16(cda[CTA_TIMEOUT_L3PROTO]));
	98	l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]);
	99
19576c94	100	list_for_each_entry(timeout, &net->nfct_timeout_list, head) {
50978462 PNA	101	if (strncmp(timeout->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
	102	continue;
	103
	104	if (nlh->nlmsg_flags & NLM_F_EXCL)
	105	return -EEXIST;
	106
	107	matching = timeout;
	108	break;
	109	}
	110
50978462 PNA	111	if (matching) {
	112	if (nlh->nlmsg_flags & NLM_F_REPLACE) {
	113	/* You cannot replace one timeout policy by another of
	114	* different kind, sorry.
	115	*/
6c1fd7dc PNA	116	if (matching->timeout.l3num != l3num \|\|
6c1fd7dc PNA	117	matching->timeout.l4proto->l4proto != l4num)
23aaba5a LZ	118	return -EINVAL;
23aaba5a LZ	119
6c1fd7dc PNA	120	return ctnl_timeout_parse_policy(&matching->timeout.data,
	121	matching->timeout.l4proto,
	122	net, cda[CTA_TIMEOUT_DATA]);
50978462	123	}
23aaba5a LZ	124
	125	return -EBUSY;
	126	}
	127
	128	l4proto = nf_ct_l4proto_find_get(l3num, l4num);
	129
	130	/* This protocol is not supportted, skip. */
	131	if (l4proto->l4proto != l4num) {
	132	ret = -EOPNOTSUPP;
c1ebd7df	133	goto err_proto_put;
50978462 PNA	134	}
	135
	136	timeout = kzalloc(sizeof(struct ctnl_timeout) +
	137	l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
c1ebd7df PNA	138	if (timeout == NULL) {
	139	ret = -ENOMEM;
	140	goto err_proto_put;
	141	}
50978462	142
6c1fd7dc	143	ret = ctnl_timeout_parse_policy(&timeout->timeout.data, l4proto, net,
50978462 PNA	144	cda[CTA_TIMEOUT_DATA]);
	145	if (ret < 0)
	146	goto err;
	147
	148	strcpy(timeout->name, nla_data(cda[CTA_TIMEOUT_NAME]));
6c1fd7dc PNA	149	timeout->timeout.l3num = l3num;
6c1fd7dc PNA	150	timeout->timeout.l4proto = l4proto;
b54ab92b	151	refcount_set(&timeout->refcnt, 1);
19576c94	152	list_add_tail_rcu(&timeout->head, &net->nfct_timeout_list);
50978462 PNA	153
	154	return 0;
	155	err:
	156	kfree(timeout);
c1ebd7df PNA	157	err_proto_put:
c1ebd7df PNA	158	nf_ct_l4proto_put(l4proto);
50978462 PNA	159	return ret;
	160	}
	161
	162	static int
15e47304	163	ctnl_timeout_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
50978462 PNA	164	int event, struct ctnl_timeout *timeout)
	165	{
	166	struct nlmsghdr *nlh;
	167	struct nfgenmsg *nfmsg;
15e47304	168	unsigned int flags = portid ? NLM_F_MULTI : 0;
6c1fd7dc	169	const struct nf_conntrack_l4proto *l4proto = timeout->timeout.l4proto;
50978462	170
dedb67c4	171	event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_TIMEOUT, event);
15e47304	172	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
50978462 PNA	173	if (nlh == NULL)
	174	goto nlmsg_failure;
	175
	176	nfmsg = nlmsg_data(nlh);
	177	nfmsg->nfgen_family = AF_UNSPEC;
	178	nfmsg->version = NFNETLINK_V0;
	179	nfmsg->res_id = 0;
	180
48f03bda	181	if (nla_put_string(skb, CTA_TIMEOUT_NAME, timeout->name) \|\|
6c1fd7dc PNA	182	nla_put_be16(skb, CTA_TIMEOUT_L3PROTO,
	183	htons(timeout->timeout.l3num)) \|\|
	184	nla_put_u8(skb, CTA_TIMEOUT_L4PROTO, l4proto->l4proto) \|\|
48f03bda	185	nla_put_be32(skb, CTA_TIMEOUT_USE,
b54ab92b	186	htonl(refcount_read(&timeout->refcnt))))
48f03bda	187	goto nla_put_failure;
50978462	188
50978462 PNA	189	if (likely(l4proto->ctnl_timeout.obj_to_nlattr)) {
	190	struct nlattr *nest_parms;
	191	int ret;
	192
	193	nest_parms = nla_nest_start(skb,
	194	CTA_TIMEOUT_DATA \| NLA_F_NESTED);
	195	if (!nest_parms)
	196	goto nla_put_failure;
	197
6c1fd7dc PNA	198	ret = l4proto->ctnl_timeout.obj_to_nlattr(skb,
6c1fd7dc PNA	199	&timeout->timeout.data);
50978462 PNA	200	if (ret < 0)
	201	goto nla_put_failure;
	202
	203	nla_nest_end(skb, nest_parms);
	204	}
c1ebd7df	205
50978462 PNA	206	nlmsg_end(skb, nlh);
	207	return skb->len;
	208
	209	nlmsg_failure:
	210	nla_put_failure:
	211	nlmsg_cancel(skb, nlh);
	212	return -1;
	213	}
	214
	215	static int
	216	ctnl_timeout_dump(struct sk_buff skb, struct netlink_callback cb)
	217	{
19576c94	218	struct net *net = sock_net(skb->sk);
50978462 PNA	219	struct ctnl_timeout cur, last;
	220
	221	if (cb->args[2])
	222	return 0;
	223
	224	last = (struct ctnl_timeout *)cb->args[1];
	225	if (cb->args[1])
	226	cb->args[1] = 0;
	227
	228	rcu_read_lock();
19576c94	229	list_for_each_entry_rcu(cur, &net->nfct_timeout_list, head) {
37bc4f8d PNA	230	if (last) {
	231	if (cur != last)
	232	continue;
50978462	233
37bc4f8d PNA	234	last = NULL;
37bc4f8d PNA	235	}
15e47304	236	if (ctnl_timeout_fill_info(skb, NETLINK_CB(cb->skb).portid,
50978462 PNA	237	cb->nlh->nlmsg_seq,
	238	NFNL_MSG_TYPE(cb->nlh->nlmsg_type),
	239	IPCTNL_MSG_TIMEOUT_NEW, cur) < 0) {
	240	cb->args[1] = (unsigned long)cur;
	241	break;
	242	}
	243	}
	244	if (!cb->args[1])
	245	cb->args[2] = 1;
	246	rcu_read_unlock();
	247	return skb->len;
	248	}
	249
7b8002a1 PNA	250	static int cttimeout_get_timeout(struct net net, struct sock ctnl,
	251	struct sk_buff *skb,
	252	const struct nlmsghdr *nlh,
04ba724b PNA	253	const struct nlattr * const cda[],
04ba724b PNA	254	struct netlink_ext_ack *extack)
50978462 PNA	255	{
	256	int ret = -ENOENT;
	257	char *name;
	258	struct ctnl_timeout *cur;
	259
	260	if (nlh->nlmsg_flags & NLM_F_DUMP) {
	261	struct netlink_dump_control c = {
	262	.dump = ctnl_timeout_dump,
	263	};
	264	return netlink_dump_start(ctnl, skb, nlh, &c);
	265	}
	266
	267	if (!cda[CTA_TIMEOUT_NAME])
	268	return -EINVAL;
	269	name = nla_data(cda[CTA_TIMEOUT_NAME]);
	270
19576c94	271	list_for_each_entry(cur, &net->nfct_timeout_list, head) {
50978462 PNA	272	struct sk_buff *skb2;
	273
	274	if (strncmp(cur->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
	275	continue;
	276
	277	skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
	278	if (skb2 == NULL) {
	279	ret = -ENOMEM;
	280	break;
	281	}
	282
15e47304	283	ret = ctnl_timeout_fill_info(skb2, NETLINK_CB(skb).portid,
50978462 PNA	284	nlh->nlmsg_seq,
	285	NFNL_MSG_TYPE(nlh->nlmsg_type),
	286	IPCTNL_MSG_TIMEOUT_NEW, cur);
	287	if (ret <= 0) {
	288	kfree_skb(skb2);
	289	break;
	290	}
15e47304	291	ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid,
50978462 PNA	292	MSG_DONTWAIT);
	293	if (ret > 0)
	294	ret = 0;
	295
	296	/* this avoids a loop in nfnetlink. */
	297	return ret == -EAGAIN ? -ENOBUFS : ret;
	298	}
	299	return ret;
	300	}
	301
	302	/* try to delete object, fail if it is still in use. */
19576c94	303	static int ctnl_timeout_try_del(struct net net, struct ctnl_timeout timeout)
50978462 PNA	304	{
	305	int ret = 0;
	306
b75911b6 LZ	307	/* We want to avoid races with ctnl_timeout_put. So only when the
	308	* current refcnt is 1, we decrease it to 0.
	309	*/
b54ab92b	310	if (refcount_dec_if_one(&timeout->refcnt)) {
50978462 PNA	311	/* We are protected by nfnl mutex. */
50978462 PNA	312	list_del_rcu(&timeout->head);
6c1fd7dc PNA	313	nf_ct_l4proto_put(timeout->timeout.l4proto);
6c1fd7dc PNA	314	nf_ct_untimeout(net, &timeout->timeout);
50978462 PNA	315	kfree_rcu(timeout, rcu_head);
50978462 PNA	316	} else {
50978462 PNA	317	ret = -EBUSY;
	318	}
	319	return ret;
	320	}
	321
7b8002a1 PNA	322	static int cttimeout_del_timeout(struct net net, struct sock ctnl,
	323	struct sk_buff *skb,
	324	const struct nlmsghdr *nlh,
04ba724b PNA	325	const struct nlattr * const cda[],
04ba724b PNA	326	struct netlink_ext_ack *extack)
50978462	327	{
93fac10b	328	struct ctnl_timeout cur, tmp;
50978462	329	int ret = -ENOENT;
7b8002a1	330	char *name;
50978462 PNA	331
50978462 PNA	332	if (!cda[CTA_TIMEOUT_NAME]) {
93fac10b LZ	333	list_for_each_entry_safe(cur, tmp, &net->nfct_timeout_list,
93fac10b LZ	334	head)
19576c94	335	ctnl_timeout_try_del(net, cur);
50978462 PNA	336
	337	return 0;
	338	}
	339	name = nla_data(cda[CTA_TIMEOUT_NAME]);
	340
19576c94	341	list_for_each_entry(cur, &net->nfct_timeout_list, head) {
50978462 PNA	342	if (strncmp(cur->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
	343	continue;
	344
19576c94	345	ret = ctnl_timeout_try_del(net, cur);
50978462 PNA	346	if (ret < 0)
	347	return ret;
	348
	349	break;
	350	}
	351	return ret;
	352	}
	353
7b8002a1 PNA	354	static int cttimeout_default_set(struct net net, struct sock ctnl,
	355	struct sk_buff *skb,
	356	const struct nlmsghdr *nlh,
04ba724b PNA	357	const struct nlattr * const cda[],
04ba724b PNA	358	struct netlink_ext_ack *extack)
91cb498e	359	{
b3480fe0	360	const struct nf_conntrack_l4proto *l4proto;
91cb498e PNA	361	__u16 l3num;
91cb498e PNA	362	__u8 l4num;
91cb498e PNA	363	int ret;
	364
	365	if (!cda[CTA_TIMEOUT_L3PROTO] \|\|
	366	!cda[CTA_TIMEOUT_L4PROTO] \|\|
	367	!cda[CTA_TIMEOUT_DATA])
	368	return -EINVAL;
	369
	370	l3num = ntohs(nla_get_be16(cda[CTA_TIMEOUT_L3PROTO]));
	371	l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]);
	372	l4proto = nf_ct_l4proto_find_get(l3num, l4num);
	373
	374	/* This protocol is not supported, skip. */
	375	if (l4proto->l4proto != l4num) {
	376	ret = -EOPNOTSUPP;
	377	goto err;
	378	}
	379
c779e849	380	ret = ctnl_timeout_parse_policy(NULL, l4proto, net,
91cb498e PNA	381	cda[CTA_TIMEOUT_DATA]);
	382	if (ret < 0)
	383	goto err;
	384
	385	nf_ct_l4proto_put(l4proto);
	386	return 0;
	387	err:
	388	nf_ct_l4proto_put(l4proto);
	389	return ret;
	390	}
	391
	392	static int
	393	cttimeout_default_fill_info(struct net net, struct sk_buff skb, u32 portid,
	394	u32 seq, u32 type, int event,
2a04aabf	395	const struct nf_conntrack_l4proto *l4proto)
91cb498e PNA	396	{
	397	struct nlmsghdr *nlh;
	398	struct nfgenmsg *nfmsg;
	399	unsigned int flags = portid ? NLM_F_MULTI : 0;
	400
dedb67c4	401	event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_TIMEOUT, event);
91cb498e PNA	402	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
	403	if (nlh == NULL)
	404	goto nlmsg_failure;
	405
	406	nfmsg = nlmsg_data(nlh);
	407	nfmsg->nfgen_family = AF_UNSPEC;
	408	nfmsg->version = NFNETLINK_V0;
	409	nfmsg->res_id = 0;
	410
	411	if (nla_put_be16(skb, CTA_TIMEOUT_L3PROTO, htons(l4proto->l3proto)) \|\|
	412	nla_put_u8(skb, CTA_TIMEOUT_L4PROTO, l4proto->l4proto))
	413	goto nla_put_failure;
	414
	415	if (likely(l4proto->ctnl_timeout.obj_to_nlattr)) {
	416	struct nlattr *nest_parms;
91cb498e PNA	417	int ret;
	418
	419	nest_parms = nla_nest_start(skb,
	420	CTA_TIMEOUT_DATA \| NLA_F_NESTED);
	421	if (!nest_parms)
	422	goto nla_put_failure;
	423
c779e849	424	ret = l4proto->ctnl_timeout.obj_to_nlattr(skb, NULL);
91cb498e PNA	425	if (ret < 0)
	426	goto nla_put_failure;
	427
	428	nla_nest_end(skb, nest_parms);
	429	}
	430
	431	nlmsg_end(skb, nlh);
	432	return skb->len;
	433
	434	nlmsg_failure:
	435	nla_put_failure:
	436	nlmsg_cancel(skb, nlh);
	437	return -1;
	438	}
	439
7b8002a1 PNA	440	static int cttimeout_default_get(struct net net, struct sock ctnl,
7b8002a1 PNA	441	struct sk_buff *skb,
91cb498e	442	const struct nlmsghdr *nlh,
04ba724b PNA	443	const struct nlattr * const cda[],
04ba724b PNA	444	struct netlink_ext_ack *extack)
91cb498e	445	{
b3480fe0	446	const struct nf_conntrack_l4proto *l4proto;
91cb498e PNA	447	struct sk_buff *skb2;
91cb498e PNA	448	int ret, err;
b3480fe0 FW	449	__u16 l3num;
b3480fe0 FW	450	__u8 l4num;
91cb498e PNA	451
	452	if (!cda[CTA_TIMEOUT_L3PROTO] \|\| !cda[CTA_TIMEOUT_L4PROTO])
	453	return -EINVAL;
	454
	455	l3num = ntohs(nla_get_be16(cda[CTA_TIMEOUT_L3PROTO]));
	456	l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]);
	457	l4proto = nf_ct_l4proto_find_get(l3num, l4num);
	458
	459	/* This protocol is not supported, skip. */
	460	if (l4proto->l4proto != l4num) {
	461	err = -EOPNOTSUPP;
	462	goto err;
	463	}
	464
	465	skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
	466	if (skb2 == NULL) {
	467	err = -ENOMEM;
	468	goto err;
	469	}
	470
	471	ret = cttimeout_default_fill_info(net, skb2, NETLINK_CB(skb).portid,
	472	nlh->nlmsg_seq,
	473	NFNL_MSG_TYPE(nlh->nlmsg_type),
	474	IPCTNL_MSG_TIMEOUT_DEFAULT_SET,
	475	l4proto);
	476	if (ret <= 0) {
	477	kfree_skb(skb2);
	478	err = -ENOMEM;
	479	goto err;
	480	}
	481	ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid, MSG_DONTWAIT);
	482	if (ret > 0)
	483	ret = 0;
	484
	485	/* this avoids a loop in nfnetlink. */
	486	return ret == -EAGAIN ? -ENOBUFS : ret;
	487	err:
	488	nf_ct_l4proto_put(l4proto);
	489	return err;
	490	}
	491
99e25d07 PNA	492	static struct nf_ct_timeout ctnl_timeout_find_get(struct net net,
99e25d07 PNA	493	const char *name)
24de58f4 PNA	494	{
	495	struct ctnl_timeout timeout, matching = NULL;
	496
19576c94	497	list_for_each_entry_rcu(timeout, &net->nfct_timeout_list, head) {
24de58f4 PNA	498	if (strncmp(timeout->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
	499	continue;
	500
	501	if (!try_module_get(THIS_MODULE))
	502	goto err;
	503
b54ab92b	504	if (!refcount_inc_not_zero(&timeout->refcnt)) {
24de58f4 PNA	505	module_put(THIS_MODULE);
	506	goto err;
	507	}
	508	matching = timeout;
	509	break;
	510	}
	511	err:
99e25d07	512	return matching ? &matching->timeout : NULL;
24de58f4 PNA	513	}
24de58f4 PNA	514
6c1fd7dc	515	static void ctnl_timeout_put(struct nf_ct_timeout *t)
24de58f4	516	{
6c1fd7dc PNA	517	struct ctnl_timeout *timeout =
	518	container_of(t, struct ctnl_timeout, timeout);
	519
b54ab92b	520	if (refcount_dec_and_test(&timeout->refcnt))
b75911b6 LZ	521	kfree_rcu(timeout, rcu_head);
b75911b6 LZ	522
24de58f4 PNA	523	module_put(THIS_MODULE);
24de58f4 PNA	524	}
24de58f4	525
50978462 PNA	526	static const struct nfnl_callback cttimeout_cb[IPCTNL_MSG_TIMEOUT_MAX] = {
	527	[IPCTNL_MSG_TIMEOUT_NEW] = { .call = cttimeout_new_timeout,
	528	.attr_count = CTA_TIMEOUT_MAX,
	529	.policy = cttimeout_nla_policy },
	530	[IPCTNL_MSG_TIMEOUT_GET] = { .call = cttimeout_get_timeout,
	531	.attr_count = CTA_TIMEOUT_MAX,
	532	.policy = cttimeout_nla_policy },
	533	[IPCTNL_MSG_TIMEOUT_DELETE] = { .call = cttimeout_del_timeout,
	534	.attr_count = CTA_TIMEOUT_MAX,
	535	.policy = cttimeout_nla_policy },
91cb498e PNA	536	[IPCTNL_MSG_TIMEOUT_DEFAULT_SET]= { .call = cttimeout_default_set,
	537	.attr_count = CTA_TIMEOUT_MAX,
	538	.policy = cttimeout_nla_policy },
	539	[IPCTNL_MSG_TIMEOUT_DEFAULT_GET]= { .call = cttimeout_default_get,
	540	.attr_count = CTA_TIMEOUT_MAX,
	541	.policy = cttimeout_nla_policy },
50978462 PNA	542	};
	543
	544	static const struct nfnetlink_subsystem cttimeout_subsys = {
	545	.name = "conntrack_timeout",
	546	.subsys_id = NFNL_SUBSYS_CTNETLINK_TIMEOUT,
	547	.cb_count = IPCTNL_MSG_TIMEOUT_MAX,
	548	.cb = cttimeout_cb,
	549	};
	550
	551	MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_TIMEOUT);
	552
19576c94 PN	553	static int __net_init cttimeout_net_init(struct net *net)
	554	{
	555	INIT_LIST_HEAD(&net->nfct_timeout_list);
	556
	557	return 0;
	558	}
	559
	560	static void __net_exit cttimeout_net_exit(struct net *net)
	561	{
	562	struct ctnl_timeout cur, tmp;
	563
84657984	564	nf_ct_unconfirmed_destroy(net);
4e665afb	565	nf_ct_untimeout(net, NULL);
19576c94 PN	566
	567	list_for_each_entry_safe(cur, tmp, &net->nfct_timeout_list, head) {
	568	list_del_rcu(&cur->head);
6c1fd7dc	569	nf_ct_l4proto_put(cur->timeout.l4proto);
b75911b6	570
b54ab92b	571	if (refcount_dec_and_test(&cur->refcnt))
b75911b6	572	kfree_rcu(cur, rcu_head);
19576c94 PN	573	}
	574	}
	575
	576	static struct pernet_operations cttimeout_ops = {
	577	.init = cttimeout_net_init,
	578	.exit = cttimeout_net_exit,
	579	};
	580
50978462 PNA	581	static int __init cttimeout_init(void)
	582	{
	583	int ret;
	584
19576c94 PN	585	ret = register_pernet_subsys(&cttimeout_ops);
	586	if (ret < 0)
	587	return ret;
	588
50978462 PNA	589	ret = nfnetlink_subsys_register(&cttimeout_subsys);
	590	if (ret < 0) {
	591	pr_err("cttimeout_init: cannot register cttimeout with "
	592	"nfnetlink.\n");
	593	goto err_out;
	594	}
24de58f4 PNA	595	RCU_INIT_POINTER(nf_ct_timeout_find_get_hook, ctnl_timeout_find_get);
24de58f4 PNA	596	RCU_INIT_POINTER(nf_ct_timeout_put_hook, ctnl_timeout_put);
50978462 PNA	597	return 0;
	598
	599	err_out:
19576c94	600	unregister_pernet_subsys(&cttimeout_ops);
50978462 PNA	601	return ret;
	602	}
	603
	604	static void __exit cttimeout_exit(void)
	605	{
50978462	606	nfnetlink_subsys_unregister(&cttimeout_subsys);
ae2d708e	607
19576c94	608	unregister_pernet_subsys(&cttimeout_ops);
24de58f4 PNA	609	RCU_INIT_POINTER(nf_ct_timeout_find_get_hook, NULL);
24de58f4 PNA	610	RCU_INIT_POINTER(nf_ct_timeout_put_hook, NULL);
3b7dabf0	611	synchronize_rcu();
50978462 PNA	612	}
	613
	614	module_init(cttimeout_init);
	615	module_exit(cttimeout_exit);