[linux-2.6-block.git] / net / netfilter / xt_CT.c

/*
 * Copyright (c) 2010 Patrick McHardy <kaber@trash.net>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/module.h>
#include <linux/gfp.h>
#include <linux/skbuff.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv6/ip6_tables.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_CT.h>
#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_l4proto.h>
#include <net/netfilter/nf_conntrack_helper.h>
#include <net/netfilter/nf_conntrack_ecache.h>
#include <net/netfilter/nf_conntrack_timeout.h>
#include <net/netfilter/nf_conntrack_zones.h>

static unsigned int xt_ct_target_v0(struct sk_buff *skb,
				    const struct xt_action_param *par)
{
	const struct xt_ct_target_info *info = par->targinfo;
	struct nf_conn *ct = info->ct;

	/* Previously seen (loopback)? Ignore. */
	if (skb->nfct != NULL)
		return XT_CONTINUE;

	atomic_inc(&ct->ct_general.use);
	skb->nfct = &ct->ct_general;
	skb->nfctinfo = IP_CT_NEW;

	return XT_CONTINUE;
}

static unsigned int xt_ct_target_v1(struct sk_buff *skb,
				    const struct xt_action_param *par)
{
	const struct xt_ct_target_info_v1 *info = par->targinfo;
	struct nf_conn *ct = info->ct;

	/* Previously seen (loopback)? Ignore. */
	if (skb->nfct != NULL)
		return XT_CONTINUE;

	atomic_inc(&ct->ct_general.use);
	skb->nfct = &ct->ct_general;
	skb->nfctinfo = IP_CT_NEW;

	return XT_CONTINUE;
}

static u8 xt_ct_find_proto(const struct xt_tgchk_param *par)
{
	if (par->family == NFPROTO_IPV4) {
		const struct ipt_entry *e = par->entryinfo;

		if (e->ip.invflags & IPT_INV_PROTO)
			return 0;
		return e->ip.proto;
	} else if (par->family == NFPROTO_IPV6) {
		const struct ip6t_entry *e = par->entryinfo;

		if (e->ipv6.invflags & IP6T_INV_PROTO)
			return 0;
		return e->ipv6.proto;
	} else
		return 0;
}

static int xt_ct_tg_check_v0(const struct xt_tgchk_param *par)
{
	struct xt_ct_target_info *info = par->targinfo;
	struct nf_conntrack_tuple t;
	struct nf_conn_help *help;
	struct nf_conn *ct;
	int ret = 0;
	u8 proto;

	if (info->flags & ~XT_CT_NOTRACK)
		return -EINVAL;

	if (info->flags & XT_CT_NOTRACK) {
		ct = nf_ct_untracked_get();
		atomic_inc(&ct->ct_general.use);
		goto out;
	}

#ifndef CONFIG_NF_CONNTRACK_ZONES
	if (info->zone)
		goto err1;
#endif

	ret = nf_ct_l3proto_try_module_get(par->family);
	if (ret < 0)
		goto err1;

	memset(&t, 0, sizeof(t));
	ct = nf_conntrack_alloc(par->net, info->zone, &t, &t, GFP_KERNEL);
	ret = PTR_ERR(ct);
	if (IS_ERR(ct))
		goto err2;

	ret = 0;
	if ((info->ct_events || info->exp_events) &&
	    !nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events,
				  GFP_KERNEL))
		goto err3;

	if (info->helper[0]) {
		struct nf_conntrack_helper *helper;

		ret = -ENOENT;
		proto = xt_ct_find_proto(par);
		if (!proto) {
			pr_info("You must specify a L4 protocol, "
				"and not use inversions on it.\n");
			goto err3;
		}

		ret = -ENOENT;
		helper = nf_conntrack_helper_try_module_get(info->helper,
							    par->family,
							    proto);
		if (helper == NULL) {
			pr_info("No such helper \"%s\"\n", info->helper);
			goto err3;
		}

		ret = -ENOMEM;
		help = nf_ct_helper_ext_add(ct, helper, GFP_KERNEL);
		if (help == NULL)
			goto err3;

		help->helper = helper;
	}

	__set_bit(IPS_TEMPLATE_BIT, &ct->status);
	__set_bit(IPS_CONFIRMED_BIT, &ct->status);
out:
	info->ct = ct;
	return 0;

err3:
	nf_conntrack_free(ct);
err2:
	nf_ct_l3proto_module_put(par->family);
err1:
	return ret;
}

#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
static void __xt_ct_tg_timeout_put(struct ctnl_timeout *timeout)
{
	typeof(nf_ct_timeout_put_hook) timeout_put;

	timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
	if (timeout_put)
		timeout_put(timeout);
}
#endif

static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
{
	struct xt_ct_target_info_v1 *info = par->targinfo;
	struct nf_conntrack_tuple t;
	struct nf_conn_help *help;
	struct nf_conn *ct;
	int ret = 0;
	u8 proto;
#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
	struct ctnl_timeout *timeout;
#endif
	if (info->flags & ~XT_CT_NOTRACK)
		return -EINVAL;

	if (info->flags & XT_CT_NOTRACK) {
		ct = nf_ct_untracked_get();
		atomic_inc(&ct->ct_general.use);
		goto out;
	}

#ifndef CONFIG_NF_CONNTRACK_ZONES
	if (info->zone)
		goto err1;
#endif

	ret = nf_ct_l3proto_try_module_get(par->family);
	if (ret < 0)
		goto err1;

	memset(&t, 0, sizeof(t));
	ct = nf_conntrack_alloc(par->net, info->zone, &t, &t, GFP_KERNEL);
	ret = PTR_ERR(ct);
	if (IS_ERR(ct))
		goto err2;

	ret = 0;
	if ((info->ct_events || info->exp_events) &&
	    !nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events,
				  GFP_KERNEL))
		goto err3;

	if (info->helper[0]) {
		struct nf_conntrack_helper *helper;

		ret = -ENOENT;
		proto = xt_ct_find_proto(par);
		if (!proto) {
			pr_info("You must specify a L4 protocol, "
				"and not use inversions on it.\n");
			goto err3;
		}

		ret = -ENOENT;
		helper = nf_conntrack_helper_try_module_get(info->helper,
							    par->family,
							    proto);
		if (helper == NULL) {
			pr_info("No such helper \"%s\"\n", info->helper);
			goto err3;
		}

		ret = -ENOMEM;
		help = nf_ct_helper_ext_add(ct, helper, GFP_KERNEL);
		if (help == NULL)
			goto err3;

		help->helper = helper;
	}

#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
	if (info->timeout[0]) {
		typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
		struct nf_conn_timeout *timeout_ext;

		rcu_read_lock();
		timeout_find_get =
			rcu_dereference(nf_ct_timeout_find_get_hook);

		if (timeout_find_get) {
			const struct ipt_entry *e = par->entryinfo;
			struct nf_conntrack_l4proto *l4proto;

			if (e->ip.invflags & IPT_INV_PROTO) {
				ret = -EINVAL;
				pr_info("You cannot use inversion on "
					 "L4 protocol\n");
				goto err4;
			}
			timeout = timeout_find_get(info->timeout);
			if (timeout == NULL) {
				ret = -ENOENT;
				pr_info("No such timeout policy \"%s\"\n",
					info->timeout);
				goto err4;
			}
			if (timeout->l3num != par->family) {
				ret = -EINVAL;
				pr_info("Timeout policy `%s' can only be "
					"used by L3 protocol number %d\n",
					info->timeout, timeout->l3num);
				goto err5;
			}
			/* Make sure the timeout policy matches any existing
			 * protocol tracker, otherwise default to generic.
			 */
			l4proto = __nf_ct_l4proto_find(par->family,
						       e->ip.proto);
			if (timeout->l4proto->l4proto != l4proto->l4proto) {
				ret = -EINVAL;
				pr_info("Timeout policy `%s' can only be "
					"used by L4 protocol number %d\n",
					info->timeout,
					timeout->l4proto->l4proto);
				goto err5;
			}
			timeout_ext = nf_ct_timeout_ext_add(ct, timeout,
							    GFP_ATOMIC);
			if (timeout_ext == NULL) {
				ret = -ENOMEM;
				goto err5;
			}
		} else {
			ret = -ENOENT;
			pr_info("Timeout policy base is empty\n");
			goto err4;
		}
		rcu_read_unlock();
	}
#endif

	__set_bit(IPS_TEMPLATE_BIT, &ct->status);
	__set_bit(IPS_CONFIRMED_BIT, &ct->status);
out:
	info->ct = ct;
	return 0;

#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
err5:
	__xt_ct_tg_timeout_put(timeout);
err4:
	rcu_read_unlock();
#endif
err3:
	nf_conntrack_free(ct);
err2:
	nf_ct_l3proto_module_put(par->family);
err1:
	return ret;
}

static void xt_ct_tg_destroy_v0(const struct xt_tgdtor_param *par)
{
	struct xt_ct_target_info *info = par->targinfo;
	struct nf_conn *ct = info->ct;
	struct nf_conn_help *help;

	if (!nf_ct_is_untracked(ct)) {
		help = nfct_help(ct);
		if (help)
			module_put(help->helper->me);

		nf_ct_l3proto_module_put(par->family);
	}
	nf_ct_put(info->ct);
}

static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param *par)
{
	struct xt_ct_target_info_v1 *info = par->targinfo;
	struct nf_conn *ct = info->ct;
	struct nf_conn_help *help;
#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
	struct nf_conn_timeout *timeout_ext;
	typeof(nf_ct_timeout_put_hook) timeout_put;
#endif
	if (!nf_ct_is_untracked(ct)) {
		help = nfct_help(ct);
		if (help)
			module_put(help->helper->me);

		nf_ct_l3proto_module_put(par->family);

#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
		rcu_read_lock();
		timeout_put = rcu_dereference(nf_ct_timeout_put_hook);

		if (timeout_put) {
			timeout_ext = nf_ct_timeout_find(ct);
			if (timeout_ext)
				timeout_put(timeout_ext->timeout);
		}
		rcu_read_unlock();
#endif
	}
	nf_ct_put(info->ct);
}

static struct xt_target xt_ct_tg_reg[] __read_mostly = {
	{
		.name		= "CT",
		.family		= NFPROTO_UNSPEC,
		.targetsize	= sizeof(struct xt_ct_target_info),
		.checkentry	= xt_ct_tg_check_v0,
		.destroy	= xt_ct_tg_destroy_v0,
		.target		= xt_ct_target_v0,
		.table		= "raw",
		.me		= THIS_MODULE,
	},
	{
		.name		= "CT",
		.family		= NFPROTO_UNSPEC,
		.revision	= 1,
		.targetsize	= sizeof(struct xt_ct_target_info_v1),
		.checkentry	= xt_ct_tg_check_v1,
		.destroy	= xt_ct_tg_destroy_v1,
		.target		= xt_ct_target_v1,
		.table		= "raw",
		.me		= THIS_MODULE,
	},
};

static int __init xt_ct_tg_init(void)
{
	return xt_register_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
}

static void __exit xt_ct_tg_exit(void)
{
	xt_unregister_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
}

module_init(xt_ct_tg_init);
module_exit(xt_ct_tg_exit);

MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("Xtables: connection tracking target");
MODULE_ALIAS("ipt_CT");
MODULE_ALIAS("ip6t_CT");
Commit	Line	Data
84f3bb9a PM	1	/*
	2	* Copyright (c) 2010 Patrick McHardy <kaber@trash.net>
	3	*
	4	* This program is free software; you can redistribute it and/or modify
	5	* it under the terms of the GNU General Public License version 2 as
	6	* published by the Free Software Foundation.
	7	*/
a7fed762	8	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
84f3bb9a	9	#include <linux/module.h>
5a0e3ad6	10	#include <linux/gfp.h>
84f3bb9a	11	#include <linux/skbuff.h>
84f3bb9a PM	12	#include <linux/netfilter_ipv4/ip_tables.h>
	13	#include <linux/netfilter_ipv6/ip6_tables.h>
	14	#include <linux/netfilter/x_tables.h>
	15	#include <linux/netfilter/xt_CT.h>
	16	#include <net/netfilter/nf_conntrack.h>
eeb4cb95	17	#include <net/netfilter/nf_conntrack_l4proto.h>
84f3bb9a PM	18	#include <net/netfilter/nf_conntrack_helper.h>
84f3bb9a PM	19	#include <net/netfilter/nf_conntrack_ecache.h>
24de58f4	20	#include <net/netfilter/nf_conntrack_timeout.h>
5d0aa2cc	21	#include <net/netfilter/nf_conntrack_zones.h>
84f3bb9a	22
24de58f4 PNA	23	static unsigned int xt_ct_target_v0(struct sk_buff *skb,
24de58f4 PNA	24	const struct xt_action_param *par)
84f3bb9a PM	25	{
	26	const struct xt_ct_target_info *info = par->targinfo;
	27	struct nf_conn *ct = info->ct;
	28
	29	/* Previously seen (loopback)? Ignore. */
	30	if (skb->nfct != NULL)
	31	return XT_CONTINUE;
	32
	33	atomic_inc(&ct->ct_general.use);
	34	skb->nfct = &ct->ct_general;
	35	skb->nfctinfo = IP_CT_NEW;
	36
	37	return XT_CONTINUE;
	38	}
	39
24de58f4 PNA	40	static unsigned int xt_ct_target_v1(struct sk_buff *skb,
	41	const struct xt_action_param *par)
	42	{
	43	const struct xt_ct_target_info_v1 *info = par->targinfo;
	44	struct nf_conn *ct = info->ct;
	45
	46	/* Previously seen (loopback)? Ignore. */
	47	if (skb->nfct != NULL)
	48	return XT_CONTINUE;
	49
	50	atomic_inc(&ct->ct_general.use);
	51	skb->nfct = &ct->ct_general;
	52	skb->nfctinfo = IP_CT_NEW;
	53
	54	return XT_CONTINUE;
	55	}
	56
84f3bb9a PM	57	static u8 xt_ct_find_proto(const struct xt_tgchk_param *par)
84f3bb9a PM	58	{
076f7839	59	if (par->family == NFPROTO_IPV4) {
84f3bb9a PM	60	const struct ipt_entry *e = par->entryinfo;
	61
	62	if (e->ip.invflags & IPT_INV_PROTO)
	63	return 0;
	64	return e->ip.proto;
076f7839	65	} else if (par->family == NFPROTO_IPV6) {
84f3bb9a PM	66	const struct ip6t_entry *e = par->entryinfo;
	67
	68	if (e->ipv6.invflags & IP6T_INV_PROTO)
	69	return 0;
	70	return e->ipv6.proto;
	71	} else
	72	return 0;
	73	}
	74
24de58f4	75	static int xt_ct_tg_check_v0(const struct xt_tgchk_param *par)
84f3bb9a PM	76	{
	77	struct xt_ct_target_info *info = par->targinfo;
	78	struct nf_conntrack_tuple t;
	79	struct nf_conn_help *help;
	80	struct nf_conn *ct;
4a5a5c73	81	int ret = 0;
84f3bb9a PM	82	u8 proto;
84f3bb9a PM	83
9bf04646 PNA	84	if (info->flags & ~XT_CT_NOTRACK)
9bf04646 PNA	85	return -EINVAL;
84f3bb9a PM	86
84f3bb9a PM	87	if (info->flags & XT_CT_NOTRACK) {
5bfddbd4	88	ct = nf_ct_untracked_get();
84f3bb9a PM	89	atomic_inc(&ct->ct_general.use);
	90	goto out;
	91	}
	92
5d0aa2cc PM	93	#ifndef CONFIG_NF_CONNTRACK_ZONES
	94	if (info->zone)
	95	goto err1;
	96	#endif
	97
4a5a5c73 JE	98	ret = nf_ct_l3proto_try_module_get(par->family);
4a5a5c73 JE	99	if (ret < 0)
84f3bb9a PM	100	goto err1;
	101
	102	memset(&t, 0, sizeof(t));
5d0aa2cc	103	ct = nf_conntrack_alloc(par->net, info->zone, &t, &t, GFP_KERNEL);
4a5a5c73	104	ret = PTR_ERR(ct);
84f3bb9a PM	105	if (IS_ERR(ct))
	106	goto err2;
	107
4a5a5c73	108	ret = 0;
84f3bb9a PM	109	if ((info->ct_events \|\| info->exp_events) &&
	110	!nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events,
	111	GFP_KERNEL))
	112	goto err3;
	113
9bf04646	114	if (info->helper[0]) {
1afc5679 PNA	115	struct nf_conntrack_helper *helper;
1afc5679 PNA	116
4a5a5c73	117	ret = -ENOENT;
84f3bb9a	118	proto = xt_ct_find_proto(par);
a7fed762 JE	119	if (!proto) {
	120	pr_info("You must specify a L4 protocol, "
	121	"and not use inversions on it.\n");
84f3bb9a	122	goto err3;
a7fed762	123	}
84f3bb9a	124
4a5a5c73	125	ret = -ENOENT;
1afc5679 PNA	126	helper = nf_conntrack_helper_try_module_get(info->helper,
	127	par->family,
	128	proto);
	129	if (helper == NULL) {
a7fed762	130	pr_info("No such helper \"%s\"\n", info->helper);
84f3bb9a	131	goto err3;
a7fed762	132	}
1afc5679 PNA	133
	134	ret = -ENOMEM;
	135	help = nf_ct_helper_ext_add(ct, helper, GFP_KERNEL);
	136	if (help == NULL)
	137	goto err3;
	138
	139	help->helper = helper;
84f3bb9a PM	140	}
	141
	142	__set_bit(IPS_TEMPLATE_BIT, &ct->status);
	143	__set_bit(IPS_CONFIRMED_BIT, &ct->status);
	144	out:
	145	info->ct = ct;
d6b00a53	146	return 0;
84f3bb9a PM	147
	148	err3:
	149	nf_conntrack_free(ct);
	150	err2:
	151	nf_ct_l3proto_module_put(par->family);
	152	err1:
4a5a5c73	153	return ret;
84f3bb9a PM	154	}
84f3bb9a PM	155
ee14186f PNA	156	#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
	157	static void __xt_ct_tg_timeout_put(struct ctnl_timeout *timeout)
	158	{
	159	typeof(nf_ct_timeout_put_hook) timeout_put;
	160
	161	timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
	162	if (timeout_put)
	163	timeout_put(timeout);
	164	}
	165	#endif
	166
24de58f4 PNA	167	static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
	168	{
	169	struct xt_ct_target_info_v1 *info = par->targinfo;
	170	struct nf_conntrack_tuple t;
	171	struct nf_conn_help *help;
	172	struct nf_conn *ct;
	173	int ret = 0;
	174	u8 proto;
ee14186f PNA	175	#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
	176	struct ctnl_timeout *timeout;
	177	#endif
24de58f4 PNA	178	if (info->flags & ~XT_CT_NOTRACK)
	179	return -EINVAL;
	180
	181	if (info->flags & XT_CT_NOTRACK) {
	182	ct = nf_ct_untracked_get();
	183	atomic_inc(&ct->ct_general.use);
	184	goto out;
	185	}
	186
	187	#ifndef CONFIG_NF_CONNTRACK_ZONES
	188	if (info->zone)
	189	goto err1;
	190	#endif
	191
	192	ret = nf_ct_l3proto_try_module_get(par->family);
	193	if (ret < 0)
	194	goto err1;
	195
	196	memset(&t, 0, sizeof(t));
	197	ct = nf_conntrack_alloc(par->net, info->zone, &t, &t, GFP_KERNEL);
	198	ret = PTR_ERR(ct);
	199	if (IS_ERR(ct))
	200	goto err2;
	201
	202	ret = 0;
	203	if ((info->ct_events \|\| info->exp_events) &&
	204	!nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events,
	205	GFP_KERNEL))
	206	goto err3;
	207
	208	if (info->helper[0]) {
1afc5679 PNA	209	struct nf_conntrack_helper *helper;
1afc5679 PNA	210
24de58f4 PNA	211	ret = -ENOENT;
	212	proto = xt_ct_find_proto(par);
	213	if (!proto) {
	214	pr_info("You must specify a L4 protocol, "
	215	"and not use inversions on it.\n");
	216	goto err3;
	217	}
	218
24de58f4	219	ret = -ENOENT;
1afc5679 PNA	220	helper = nf_conntrack_helper_try_module_get(info->helper,
	221	par->family,
	222	proto);
	223	if (helper == NULL) {
24de58f4 PNA	224	pr_info("No such helper \"%s\"\n", info->helper);
	225	goto err3;
	226	}
1afc5679 PNA	227
	228	ret = -ENOMEM;
	229	help = nf_ct_helper_ext_add(ct, helper, GFP_KERNEL);
	230	if (help == NULL)
	231	goto err3;
	232
	233	help->helper = helper;
24de58f4 PNA	234	}
	235
	236	#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
6cf51852	237	if (info->timeout[0]) {
24de58f4	238	typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
24de58f4 PNA	239	struct nf_conn_timeout *timeout_ext;
24de58f4 PNA	240
1ac0bf99	241	rcu_read_lock();
24de58f4 PNA	242	timeout_find_get =
	243	rcu_dereference(nf_ct_timeout_find_get_hook);
	244
	245	if (timeout_find_get) {
	246	const struct ipt_entry *e = par->entryinfo;
eeb4cb95	247	struct nf_conntrack_l4proto *l4proto;
24de58f4 PNA	248
	249	if (e->ip.invflags & IPT_INV_PROTO) {
	250	ret = -EINVAL;
	251	pr_info("You cannot use inversion on "
	252	"L4 protocol\n");
1ac0bf99	253	goto err4;
24de58f4 PNA	254	}
	255	timeout = timeout_find_get(info->timeout);
	256	if (timeout == NULL) {
	257	ret = -ENOENT;
	258	pr_info("No such timeout policy \"%s\"\n",
	259	info->timeout);
1ac0bf99	260	goto err4;
24de58f4 PNA	261	}
	262	if (timeout->l3num != par->family) {
	263	ret = -EINVAL;
	264	pr_info("Timeout policy `%s' can only be "
	265	"used by L3 protocol number %d\n",
	266	info->timeout, timeout->l3num);
ee14186f	267	goto err5;
24de58f4	268	}
eeb4cb95 PNA	269	/* Make sure the timeout policy matches any existing
	270	* protocol tracker, otherwise default to generic.
	271	*/
	272	l4proto = __nf_ct_l4proto_find(par->family,
	273	e->ip.proto);
	274	if (timeout->l4proto->l4proto != l4proto->l4proto) {
24de58f4 PNA	275	ret = -EINVAL;
	276	pr_info("Timeout policy `%s' can only be "
	277	"used by L4 protocol number %d\n",
c1ebd7df PNA	278	info->timeout,
c1ebd7df PNA	279	timeout->l4proto->l4proto);
ee14186f	280	goto err5;
24de58f4 PNA	281	}
24de58f4 PNA	282	timeout_ext = nf_ct_timeout_ext_add(ct, timeout,
ca53e440	283	GFP_ATOMIC);
24de58f4 PNA	284	if (timeout_ext == NULL) {
24de58f4 PNA	285	ret = -ENOMEM;
ee14186f	286	goto err5;
24de58f4 PNA	287	}
	288	} else {
	289	ret = -ENOENT;
	290	pr_info("Timeout policy base is empty\n");
1ac0bf99	291	goto err4;
24de58f4	292	}
1ac0bf99	293	rcu_read_unlock();
24de58f4 PNA	294	}
	295	#endif
	296
	297	__set_bit(IPS_TEMPLATE_BIT, &ct->status);
	298	__set_bit(IPS_CONFIRMED_BIT, &ct->status);
	299	out:
	300	info->ct = ct;
	301	return 0;
	302
44b52bcc	303	#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
ee14186f PNA	304	err5:
ee14186f PNA	305	__xt_ct_tg_timeout_put(timeout);
1ac0bf99 PNA	306	err4:
1ac0bf99 PNA	307	rcu_read_unlock();
44b52bcc	308	#endif
24de58f4 PNA	309	err3:
	310	nf_conntrack_free(ct);
	311	err2:
	312	nf_ct_l3proto_module_put(par->family);
	313	err1:
	314	return ret;
	315	}
	316
	317	static void xt_ct_tg_destroy_v0(const struct xt_tgdtor_param *par)
84f3bb9a PM	318	{
	319	struct xt_ct_target_info *info = par->targinfo;
	320	struct nf_conn *ct = info->ct;
	321	struct nf_conn_help *help;
	322
5bfddbd4	323	if (!nf_ct_is_untracked(ct)) {
84f3bb9a PM	324	help = nfct_help(ct);
	325	if (help)
	326	module_put(help->helper->me);
	327
	328	nf_ct_l3proto_module_put(par->family);
	329	}
	330	nf_ct_put(info->ct);
	331	}
	332
24de58f4 PNA	333	static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param *par)
	334	{
	335	struct xt_ct_target_info_v1 *info = par->targinfo;
	336	struct nf_conn *ct = info->ct;
	337	struct nf_conn_help *help;
	338	#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
	339	struct nf_conn_timeout *timeout_ext;
	340	typeof(nf_ct_timeout_put_hook) timeout_put;
	341	#endif
	342	if (!nf_ct_is_untracked(ct)) {
	343	help = nfct_help(ct);
	344	if (help)
	345	module_put(help->helper->me);
	346
	347	nf_ct_l3proto_module_put(par->family);
	348
	349	#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1ac0bf99	350	rcu_read_lock();
24de58f4 PNA	351	timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
	352
	353	if (timeout_put) {
	354	timeout_ext = nf_ct_timeout_find(ct);
	355	if (timeout_ext)
	356	timeout_put(timeout_ext->timeout);
	357	}
1ac0bf99	358	rcu_read_unlock();
24de58f4 PNA	359	#endif
	360	}
	361	nf_ct_put(info->ct);
	362	}
	363
	364	static struct xt_target xt_ct_tg_reg[] __read_mostly = {
	365	{
	366	.name = "CT",
	367	.family = NFPROTO_UNSPEC,
	368	.targetsize = sizeof(struct xt_ct_target_info),
	369	.checkentry = xt_ct_tg_check_v0,
	370	.destroy = xt_ct_tg_destroy_v0,
	371	.target = xt_ct_target_v0,
	372	.table = "raw",
	373	.me = THIS_MODULE,
	374	},
	375	{
	376	.name = "CT",
	377	.family = NFPROTO_UNSPEC,
	378	.revision = 1,
	379	.targetsize = sizeof(struct xt_ct_target_info_v1),
	380	.checkentry = xt_ct_tg_check_v1,
	381	.destroy = xt_ct_tg_destroy_v1,
	382	.target = xt_ct_target_v1,
	383	.table = "raw",
	384	.me = THIS_MODULE,
	385	},
84f3bb9a PM	386	};
	387
	388	static int __init xt_ct_tg_init(void)
	389	{
24de58f4	390	return xt_register_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
84f3bb9a PM	391	}
	392
	393	static void __exit xt_ct_tg_exit(void)
	394	{
24de58f4	395	xt_unregister_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
84f3bb9a PM	396	}
	397
	398	module_init(xt_ct_tg_init);
	399	module_exit(xt_ct_tg_exit);
	400
	401	MODULE_LICENSE("GPL");
	402	MODULE_DESCRIPTION("Xtables: connection tracking target");
	403	MODULE_ALIAS("ipt_CT");
	404	MODULE_ALIAS("ip6t_CT");