[mirror_ubuntu-bionic-kernel.git] / net / netfilter / nf_conntrack_expect.c

/* Expectation handling for nf_conntrack. */

/* (C) 1999-2001 Paul `Rusty' Russell
 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
 * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/types.h>
#include <linux/netfilter.h>
#include <linux/skbuff.h>
#include <linux/proc_fs.h>
#include <linux/seq_file.h>
#include <linux/stddef.h>
#include <linux/slab.h>
#include <linux/err.h>
#include <linux/percpu.h>
#include <linux/kernel.h>

#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_core.h>
#include <net/netfilter/nf_conntrack_expect.h>
#include <net/netfilter/nf_conntrack_helper.h>
#include <net/netfilter/nf_conntrack_tuple.h>

LIST_HEAD(nf_conntrack_expect_list);
EXPORT_SYMBOL_GPL(nf_conntrack_expect_list);

struct kmem_cache *nf_conntrack_expect_cachep __read_mostly;
static unsigned int nf_conntrack_expect_next_id;

/* nf_conntrack_expect helper functions */
void nf_ct_unlink_expect(struct nf_conntrack_expect *exp)
{
	struct nf_conn_help *master_help = nfct_help(exp->master);

	NF_CT_ASSERT(master_help);
	NF_CT_ASSERT(!timer_pending(&exp->timeout));

	list_del(&exp->list);
	NF_CT_STAT_INC(expect_delete);
	master_help->expecting--;
	nf_conntrack_expect_put(exp);
}
EXPORT_SYMBOL_GPL(nf_ct_unlink_expect);

static void expectation_timed_out(unsigned long ul_expect)
{
	struct nf_conntrack_expect *exp = (void *)ul_expect;

	write_lock_bh(&nf_conntrack_lock);
	nf_ct_unlink_expect(exp);
	write_unlock_bh(&nf_conntrack_lock);
	nf_conntrack_expect_put(exp);
}

struct nf_conntrack_expect *
__nf_conntrack_expect_find(const struct nf_conntrack_tuple *tuple)
{
	struct nf_conntrack_expect *i;

	list_for_each_entry(i, &nf_conntrack_expect_list, list) {
		if (nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask))
			return i;
	}
	return NULL;
}
EXPORT_SYMBOL_GPL(__nf_conntrack_expect_find);

/* Just find a expectation corresponding to a tuple. */
struct nf_conntrack_expect *
nf_conntrack_expect_find_get(const struct nf_conntrack_tuple *tuple)
{
	struct nf_conntrack_expect *i;

	read_lock_bh(&nf_conntrack_lock);
	i = __nf_conntrack_expect_find(tuple);
	if (i)
		atomic_inc(&i->use);
	read_unlock_bh(&nf_conntrack_lock);

	return i;
}
EXPORT_SYMBOL_GPL(nf_conntrack_expect_find_get);

/* If an expectation for this connection is found, it gets delete from
 * global list then returned. */
struct nf_conntrack_expect *
find_expectation(const struct nf_conntrack_tuple *tuple)
{
	struct nf_conntrack_expect *i;

	list_for_each_entry(i, &nf_conntrack_expect_list, list) {
	/* If master is not in hash table yet (ie. packet hasn't left
	   this machine yet), how can other end know about expected?
	   Hence these are not the droids you are looking for (if
	   master ct never got confirmed, we'd hold a reference to it
	   and weird things would happen to future packets). */
		if (nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask)
		    && nf_ct_is_confirmed(i->master)) {
			if (i->flags & NF_CT_EXPECT_PERMANENT) {
				atomic_inc(&i->use);
				return i;
			} else if (del_timer(&i->timeout)) {
				nf_ct_unlink_expect(i);
				return i;
			}
		}
	}
	return NULL;
}

/* delete all expectations for this conntrack */
void nf_ct_remove_expectations(struct nf_conn *ct)
{
	struct nf_conntrack_expect *i, *tmp;
	struct nf_conn_help *help = nfct_help(ct);

	/* Optimization: most connection never expect any others. */
	if (!help || help->expecting == 0)
		return;

	list_for_each_entry_safe(i, tmp, &nf_conntrack_expect_list, list) {
		if (i->master == ct && del_timer(&i->timeout)) {
			nf_ct_unlink_expect(i);
			nf_conntrack_expect_put(i);
 		}
	}
}
EXPORT_SYMBOL_GPL(nf_ct_remove_expectations);

/* Would two expected things clash? */
static inline int expect_clash(const struct nf_conntrack_expect *a,
			       const struct nf_conntrack_expect *b)
{
	/* Part covered by intersection of masks must be unequal,
	   otherwise they clash */
	struct nf_conntrack_tuple intersect_mask;
	int count;

	intersect_mask.src.l3num = a->mask.src.l3num & b->mask.src.l3num;
	intersect_mask.src.u.all = a->mask.src.u.all & b->mask.src.u.all;
	intersect_mask.dst.u.all = a->mask.dst.u.all & b->mask.dst.u.all;
	intersect_mask.dst.protonum = a->mask.dst.protonum
					& b->mask.dst.protonum;

	for (count = 0; count < NF_CT_TUPLE_L3SIZE; count++){
		intersect_mask.src.u3.all[count] =
			a->mask.src.u3.all[count] & b->mask.src.u3.all[count];
	}

	for (count = 0; count < NF_CT_TUPLE_L3SIZE; count++){
		intersect_mask.dst.u3.all[count] =
			a->mask.dst.u3.all[count] & b->mask.dst.u3.all[count];
	}

	return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask);
}

static inline int expect_matches(const struct nf_conntrack_expect *a,
				 const struct nf_conntrack_expect *b)
{
	return a->master == b->master
		&& nf_ct_tuple_equal(&a->tuple, &b->tuple)
		&& nf_ct_tuple_equal(&a->mask, &b->mask);
}

/* Generally a bad idea to call this: could have matched already. */
void nf_conntrack_unexpect_related(struct nf_conntrack_expect *exp)
{
	struct nf_conntrack_expect *i;

	write_lock_bh(&nf_conntrack_lock);
	/* choose the the oldest expectation to evict */
	list_for_each_entry_reverse(i, &nf_conntrack_expect_list, list) {
		if (expect_matches(i, exp) && del_timer(&i->timeout)) {
			nf_ct_unlink_expect(i);
			write_unlock_bh(&nf_conntrack_lock);
			nf_conntrack_expect_put(i);
			return;
		}
	}
	write_unlock_bh(&nf_conntrack_lock);
}
EXPORT_SYMBOL_GPL(nf_conntrack_unexpect_related);

/* We don't increase the master conntrack refcount for non-fulfilled
 * conntracks. During the conntrack destruction, the expectations are
 * always killed before the conntrack itself */
struct nf_conntrack_expect *nf_conntrack_expect_alloc(struct nf_conn *me)
{
	struct nf_conntrack_expect *new;

	new = kmem_cache_alloc(nf_conntrack_expect_cachep, GFP_ATOMIC);
	if (!new)
		return NULL;

	new->master = me;
	atomic_set(&new->use, 1);
	return new;
}
EXPORT_SYMBOL_GPL(nf_conntrack_expect_alloc);

void nf_conntrack_expect_init(struct nf_conntrack_expect *exp, int family,
			      union nf_conntrack_address *saddr,
			      union nf_conntrack_address *daddr,
			      u_int8_t proto, __be16 *src, __be16 *dst)
{
	int len;

	if (family == AF_INET)
		len = 4;
	else
		len = 16;

	exp->flags = 0;
	exp->expectfn = NULL;
	exp->helper = NULL;
	exp->tuple.src.l3num = family;
	exp->tuple.dst.protonum = proto;
	exp->mask.src.l3num = 0xFFFF;
	exp->mask.dst.protonum = 0xFF;

	if (saddr) {
		memcpy(&exp->tuple.src.u3, saddr, len);
		if (sizeof(exp->tuple.src.u3) > len)
			/* address needs to be cleared for nf_ct_tuple_equal */
			memset((void *)&exp->tuple.src.u3 + len, 0x00,
			       sizeof(exp->tuple.src.u3) - len);
		memset(&exp->mask.src.u3, 0xFF, len);
		if (sizeof(exp->mask.src.u3) > len)
			memset((void *)&exp->mask.src.u3 + len, 0x00,
			       sizeof(exp->mask.src.u3) - len);
	} else {
		memset(&exp->tuple.src.u3, 0x00, sizeof(exp->tuple.src.u3));
		memset(&exp->mask.src.u3, 0x00, sizeof(exp->mask.src.u3));
	}

	if (daddr) {
		memcpy(&exp->tuple.dst.u3, daddr, len);
		if (sizeof(exp->tuple.dst.u3) > len)
			/* address needs to be cleared for nf_ct_tuple_equal */
			memset((void *)&exp->tuple.dst.u3 + len, 0x00,
			       sizeof(exp->tuple.dst.u3) - len);
		memset(&exp->mask.dst.u3, 0xFF, len);
		if (sizeof(exp->mask.dst.u3) > len)
			memset((void *)&exp->mask.dst.u3 + len, 0x00,
			       sizeof(exp->mask.dst.u3) - len);
	} else {
		memset(&exp->tuple.dst.u3, 0x00, sizeof(exp->tuple.dst.u3));
		memset(&exp->mask.dst.u3, 0x00, sizeof(exp->mask.dst.u3));
	}

	if (src) {
		exp->tuple.src.u.all = (__force u16)*src;
		exp->mask.src.u.all = 0xFFFF;
	} else {
		exp->tuple.src.u.all = 0;
		exp->mask.src.u.all = 0;
	}

	if (dst) {
		exp->tuple.dst.u.all = (__force u16)*dst;
		exp->mask.dst.u.all = 0xFFFF;
	} else {
		exp->tuple.dst.u.all = 0;
		exp->mask.dst.u.all = 0;
	}
}
EXPORT_SYMBOL_GPL(nf_conntrack_expect_init);

void nf_conntrack_expect_put(struct nf_conntrack_expect *exp)
{
	if (atomic_dec_and_test(&exp->use))
		kmem_cache_free(nf_conntrack_expect_cachep, exp);
}
EXPORT_SYMBOL_GPL(nf_conntrack_expect_put);

static void nf_conntrack_expect_insert(struct nf_conntrack_expect *exp)
{
	struct nf_conn_help *master_help = nfct_help(exp->master);

	atomic_inc(&exp->use);
	master_help->expecting++;
	list_add(&exp->list, &nf_conntrack_expect_list);

	init_timer(&exp->timeout);
	exp->timeout.data = (unsigned long)exp;
	exp->timeout.function = expectation_timed_out;
	exp->timeout.expires = jiffies + master_help->helper->timeout * HZ;
	add_timer(&exp->timeout);

	exp->id = ++nf_conntrack_expect_next_id;
	atomic_inc(&exp->use);
	NF_CT_STAT_INC(expect_create);
}

/* Race with expectations being used means we could have none to find; OK. */
static void evict_oldest_expect(struct nf_conn *master)
{
	struct nf_conntrack_expect *i;

	list_for_each_entry_reverse(i, &nf_conntrack_expect_list, list) {
		if (i->master == master) {
			if (del_timer(&i->timeout)) {
				nf_ct_unlink_expect(i);
				nf_conntrack_expect_put(i);
			}
			break;
		}
	}
}

static inline int refresh_timer(struct nf_conntrack_expect *i)
{
	struct nf_conn_help *master_help = nfct_help(i->master);

	if (!del_timer(&i->timeout))
		return 0;

	i->timeout.expires = jiffies + master_help->helper->timeout*HZ;
	add_timer(&i->timeout);
	return 1;
}

int nf_conntrack_expect_related(struct nf_conntrack_expect *expect)
{
	struct nf_conntrack_expect *i;
	struct nf_conn *master = expect->master;
	struct nf_conn_help *master_help = nfct_help(master);
	int ret;

	NF_CT_ASSERT(master_help);

	write_lock_bh(&nf_conntrack_lock);
	list_for_each_entry(i, &nf_conntrack_expect_list, list) {
		if (expect_matches(i, expect)) {
			/* Refresh timer: if it's dying, ignore.. */
			if (refresh_timer(i)) {
				ret = 0;
				goto out;
			}
		} else if (expect_clash(i, expect)) {
			ret = -EBUSY;
			goto out;
		}
	}
	/* Will be over limit? */
	if (master_help->helper->max_expected &&
	    master_help->expecting >= master_help->helper->max_expected)
		evict_oldest_expect(master);

	nf_conntrack_expect_insert(expect);
	nf_conntrack_expect_event(IPEXP_NEW, expect);
	ret = 0;
out:
	write_unlock_bh(&nf_conntrack_lock);
	return ret;
}
EXPORT_SYMBOL_GPL(nf_conntrack_expect_related);

#ifdef CONFIG_PROC_FS
static void *exp_seq_start(struct seq_file *s, loff_t *pos)
{
	struct list_head *e = &nf_conntrack_expect_list;
	loff_t i;

	/* strange seq_file api calls stop even if we fail,
	 * thus we need to grab lock since stop unlocks */
	read_lock_bh(&nf_conntrack_lock);

	if (list_empty(e))
		return NULL;

	for (i = 0; i <= *pos; i++) {
		e = e->next;
		if (e == &nf_conntrack_expect_list)
			return NULL;
	}
	return e;
}

static void *exp_seq_next(struct seq_file *s, void *v, loff_t *pos)
{
	struct list_head *e = v;

	++*pos;
	e = e->next;

	if (e == &nf_conntrack_expect_list)
		return NULL;

	return e;
}

static void exp_seq_stop(struct seq_file *s, void *v)
{
	read_unlock_bh(&nf_conntrack_lock);
}

static int exp_seq_show(struct seq_file *s, void *v)
{
	struct nf_conntrack_expect *expect = v;

	if (expect->timeout.function)
		seq_printf(s, "%ld ", timer_pending(&expect->timeout)
			   ? (long)(expect->timeout.expires - jiffies)/HZ : 0);
	else
		seq_printf(s, "- ");
	seq_printf(s, "l3proto = %u proto=%u ",
		   expect->tuple.src.l3num,
		   expect->tuple.dst.protonum);
	print_tuple(s, &expect->tuple,
		    __nf_ct_l3proto_find(expect->tuple.src.l3num),
		    __nf_ct_l4proto_find(expect->tuple.src.l3num,
				       expect->tuple.dst.protonum));
	return seq_putc(s, '\n');
}

static struct seq_operations exp_seq_ops = {
	.start = exp_seq_start,
	.next = exp_seq_next,
	.stop = exp_seq_stop,
	.show = exp_seq_show
};

static int exp_open(struct inode *inode, struct file *file)
{
	return seq_open(file, &exp_seq_ops);
}

struct file_operations exp_file_ops = {
	.owner   = THIS_MODULE,
	.open    = exp_open,
	.read    = seq_read,
	.llseek  = seq_lseek,
	.release = seq_release
};
#endif /* CONFIG_PROC_FS */
Commit	Line	Data
77ab9cff MJ	1	/* Expectation handling for nf_conntrack. */
	2
	3	/* (C) 1999-2001 Paul `Rusty' Russell
	4	* (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
	5	* (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
	6	*
	7	* This program is free software; you can redistribute it and/or modify
	8	* it under the terms of the GNU General Public License version 2 as
	9	* published by the Free Software Foundation.
	10	*/
	11
	12	#include <linux/types.h>
	13	#include <linux/netfilter.h>
	14	#include <linux/skbuff.h>
	15	#include <linux/proc_fs.h>
	16	#include <linux/seq_file.h>
	17	#include <linux/stddef.h>
	18	#include <linux/slab.h>
	19	#include <linux/err.h>
	20	#include <linux/percpu.h>
	21	#include <linux/kernel.h>
	22
	23	#include <net/netfilter/nf_conntrack.h>
	24	#include <net/netfilter/nf_conntrack_core.h>
	25	#include <net/netfilter/nf_conntrack_expect.h>
	26	#include <net/netfilter/nf_conntrack_helper.h>
	27	#include <net/netfilter/nf_conntrack_tuple.h>
	28
	29	LIST_HEAD(nf_conntrack_expect_list);
13b18339 PM	30	EXPORT_SYMBOL_GPL(nf_conntrack_expect_list);
13b18339 PM	31
e18b890b	32	struct kmem_cache *nf_conntrack_expect_cachep __read_mostly;
77ab9cff MJ	33	static unsigned int nf_conntrack_expect_next_id;
	34
	35	/* nf_conntrack_expect helper functions */
	36	void nf_ct_unlink_expect(struct nf_conntrack_expect *exp)
	37	{
	38	struct nf_conn_help *master_help = nfct_help(exp->master);
	39
	40	NF_CT_ASSERT(master_help);
	41	NF_CT_ASSERT(!timer_pending(&exp->timeout));
	42
	43	list_del(&exp->list);
	44	NF_CT_STAT_INC(expect_delete);
	45	master_help->expecting--;
	46	nf_conntrack_expect_put(exp);
	47	}
13b18339	48	EXPORT_SYMBOL_GPL(nf_ct_unlink_expect);
77ab9cff MJ	49
	50	static void expectation_timed_out(unsigned long ul_expect)
	51	{
	52	struct nf_conntrack_expect exp = (void )ul_expect;
	53
	54	write_lock_bh(&nf_conntrack_lock);
	55	nf_ct_unlink_expect(exp);
	56	write_unlock_bh(&nf_conntrack_lock);
	57	nf_conntrack_expect_put(exp);
	58	}
	59
	60	struct nf_conntrack_expect *
	61	__nf_conntrack_expect_find(const struct nf_conntrack_tuple *tuple)
	62	{
	63	struct nf_conntrack_expect *i;
	64
	65	list_for_each_entry(i, &nf_conntrack_expect_list, list) {
	66	if (nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask))
	67	return i;
	68	}
	69	return NULL;
	70	}
13b18339	71	EXPORT_SYMBOL_GPL(__nf_conntrack_expect_find);
77ab9cff MJ	72
	73	/* Just find a expectation corresponding to a tuple. */
	74	struct nf_conntrack_expect *
468ec44b	75	nf_conntrack_expect_find_get(const struct nf_conntrack_tuple *tuple)
77ab9cff MJ	76	{
	77	struct nf_conntrack_expect *i;
	78
	79	read_lock_bh(&nf_conntrack_lock);
	80	i = __nf_conntrack_expect_find(tuple);
	81	if (i)
	82	atomic_inc(&i->use);
	83	read_unlock_bh(&nf_conntrack_lock);
	84
	85	return i;
	86	}
13b18339	87	EXPORT_SYMBOL_GPL(nf_conntrack_expect_find_get);
77ab9cff MJ	88
	89	/* If an expectation for this connection is found, it gets delete from
	90	* global list then returned. */
	91	struct nf_conntrack_expect *
	92	find_expectation(const struct nf_conntrack_tuple *tuple)
	93	{
	94	struct nf_conntrack_expect *i;
	95
	96	list_for_each_entry(i, &nf_conntrack_expect_list, list) {
	97	/* If master is not in hash table yet (ie. packet hasn't left
	98	this machine yet), how can other end know about expected?
	99	Hence these are not the droids you are looking for (if
	100	master ct never got confirmed, we'd hold a reference to it
	101	and weird things would happen to future packets). */
	102	if (nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask)
	103	&& nf_ct_is_confirmed(i->master)) {
	104	if (i->flags & NF_CT_EXPECT_PERMANENT) {
	105	atomic_inc(&i->use);
	106	return i;
	107	} else if (del_timer(&i->timeout)) {
	108	nf_ct_unlink_expect(i);
	109	return i;
	110	}
	111	}
	112	}
	113	return NULL;
	114	}
	115
	116	/* delete all expectations for this conntrack */
	117	void nf_ct_remove_expectations(struct nf_conn *ct)
	118	{
	119	struct nf_conntrack_expect i, tmp;
	120	struct nf_conn_help *help = nfct_help(ct);
	121
	122	/* Optimization: most connection never expect any others. */
	123	if (!help \|\| help->expecting == 0)
	124	return;
	125
	126	list_for_each_entry_safe(i, tmp, &nf_conntrack_expect_list, list) {
	127	if (i->master == ct && del_timer(&i->timeout)) {
	128	nf_ct_unlink_expect(i);
	129	nf_conntrack_expect_put(i);
	130	}
	131	}
	132	}
13b18339	133	EXPORT_SYMBOL_GPL(nf_ct_remove_expectations);
77ab9cff MJ	134
	135	/* Would two expected things clash? */
	136	static inline int expect_clash(const struct nf_conntrack_expect *a,
	137	const struct nf_conntrack_expect *b)
	138	{
	139	/* Part covered by intersection of masks must be unequal,
	140	otherwise they clash */
	141	struct nf_conntrack_tuple intersect_mask;
	142	int count;
	143
	144	intersect_mask.src.l3num = a->mask.src.l3num & b->mask.src.l3num;
	145	intersect_mask.src.u.all = a->mask.src.u.all & b->mask.src.u.all;
	146	intersect_mask.dst.u.all = a->mask.dst.u.all & b->mask.dst.u.all;
	147	intersect_mask.dst.protonum = a->mask.dst.protonum
	148	& b->mask.dst.protonum;
	149
	150	for (count = 0; count < NF_CT_TUPLE_L3SIZE; count++){
	151	intersect_mask.src.u3.all[count] =
	152	a->mask.src.u3.all[count] & b->mask.src.u3.all[count];
	153	}
	154
	155	for (count = 0; count < NF_CT_TUPLE_L3SIZE; count++){
	156	intersect_mask.dst.u3.all[count] =
	157	a->mask.dst.u3.all[count] & b->mask.dst.u3.all[count];
	158	}
	159
	160	return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask);
	161	}
	162
	163	static inline int expect_matches(const struct nf_conntrack_expect *a,
	164	const struct nf_conntrack_expect *b)
	165	{
	166	return a->master == b->master
	167	&& nf_ct_tuple_equal(&a->tuple, &b->tuple)
	168	&& nf_ct_tuple_equal(&a->mask, &b->mask);
	169	}
	170
	171	/* Generally a bad idea to call this: could have matched already. */
	172	void nf_conntrack_unexpect_related(struct nf_conntrack_expect *exp)
	173	{
	174	struct nf_conntrack_expect *i;
	175
	176	write_lock_bh(&nf_conntrack_lock);
	177	/* choose the the oldest expectation to evict */
	178	list_for_each_entry_reverse(i, &nf_conntrack_expect_list, list) {
	179	if (expect_matches(i, exp) && del_timer(&i->timeout)) {
	180	nf_ct_unlink_expect(i);
	181	write_unlock_bh(&nf_conntrack_lock);
	182	nf_conntrack_expect_put(i);
	183	return;
	184	}
	185	}
	186	write_unlock_bh(&nf_conntrack_lock);
	187	}
13b18339	188	EXPORT_SYMBOL_GPL(nf_conntrack_unexpect_related);
77ab9cff MJ	189
	190	/* We don't increase the master conntrack refcount for non-fulfilled
	191	* conntracks. During the conntrack destruction, the expectations are
	192	* always killed before the conntrack itself */
	193	struct nf_conntrack_expect nf_conntrack_expect_alloc(struct nf_conn me)
	194	{
	195	struct nf_conntrack_expect *new;
	196
	197	new = kmem_cache_alloc(nf_conntrack_expect_cachep, GFP_ATOMIC);
	198	if (!new)
	199	return NULL;
	200
	201	new->master = me;
	202	atomic_set(&new->use, 1);
	203	return new;
	204	}
13b18339	205	EXPORT_SYMBOL_GPL(nf_conntrack_expect_alloc);
77ab9cff	206
d6a9b650 PM	207	void nf_conntrack_expect_init(struct nf_conntrack_expect *exp, int family,
	208	union nf_conntrack_address *saddr,
	209	union nf_conntrack_address *daddr,
	210	u_int8_t proto, __be16 src, __be16 dst)
	211	{
	212	int len;
	213
	214	if (family == AF_INET)
	215	len = 4;
	216	else
	217	len = 16;
	218
	219	exp->flags = 0;
	220	exp->expectfn = NULL;
	221	exp->helper = NULL;
	222	exp->tuple.src.l3num = family;
	223	exp->tuple.dst.protonum = proto;
	224	exp->mask.src.l3num = 0xFFFF;
	225	exp->mask.dst.protonum = 0xFF;
	226
	227	if (saddr) {
	228	memcpy(&exp->tuple.src.u3, saddr, len);
	229	if (sizeof(exp->tuple.src.u3) > len)
	230	/* address needs to be cleared for nf_ct_tuple_equal */
	231	memset((void *)&exp->tuple.src.u3 + len, 0x00,
	232	sizeof(exp->tuple.src.u3) - len);
	233	memset(&exp->mask.src.u3, 0xFF, len);
	234	if (sizeof(exp->mask.src.u3) > len)
	235	memset((void *)&exp->mask.src.u3 + len, 0x00,
	236	sizeof(exp->mask.src.u3) - len);
	237	} else {
	238	memset(&exp->tuple.src.u3, 0x00, sizeof(exp->tuple.src.u3));
	239	memset(&exp->mask.src.u3, 0x00, sizeof(exp->mask.src.u3));
	240	}
	241
	242	if (daddr) {
	243	memcpy(&exp->tuple.dst.u3, daddr, len);
	244	if (sizeof(exp->tuple.dst.u3) > len)
	245	/* address needs to be cleared for nf_ct_tuple_equal */
	246	memset((void *)&exp->tuple.dst.u3 + len, 0x00,
	247	sizeof(exp->tuple.dst.u3) - len);
	248	memset(&exp->mask.dst.u3, 0xFF, len);
	249	if (sizeof(exp->mask.dst.u3) > len)
	250	memset((void *)&exp->mask.dst.u3 + len, 0x00,
	251	sizeof(exp->mask.dst.u3) - len);
	252	} else {
	253	memset(&exp->tuple.dst.u3, 0x00, sizeof(exp->tuple.dst.u3));
	254	memset(&exp->mask.dst.u3, 0x00, sizeof(exp->mask.dst.u3));
	255	}
	256
	257	if (src) {
	258	exp->tuple.src.u.all = (__force u16)*src;
	259	exp->mask.src.u.all = 0xFFFF;
	260	} else {
	261	exp->tuple.src.u.all = 0;
	262	exp->mask.src.u.all = 0;
	263	}
	264
	265	if (dst) {
	266	exp->tuple.dst.u.all = (__force u16)*dst;
	267	exp->mask.dst.u.all = 0xFFFF;
	268	} else {
	269	exp->tuple.dst.u.all = 0;
	270	exp->mask.dst.u.all = 0;
271	}
272	}
273	EXPORT_SYMBOL_GPL(nf_conntrack_expect_init);
274
77ab9cff MJ	275	void nf_conntrack_expect_put(struct nf_conntrack_expect *exp)
	276	{
	277	if (atomic_dec_and_test(&exp->use))
	278	kmem_cache_free(nf_conntrack_expect_cachep, exp);
	279	}
13b18339	280	EXPORT_SYMBOL_GPL(nf_conntrack_expect_put);
77ab9cff MJ	281
	282	static void nf_conntrack_expect_insert(struct nf_conntrack_expect *exp)
	283	{
	284	struct nf_conn_help *master_help = nfct_help(exp->master);
	285
	286	atomic_inc(&exp->use);
	287	master_help->expecting++;
	288	list_add(&exp->list, &nf_conntrack_expect_list);
	289
	290	init_timer(&exp->timeout);
	291	exp->timeout.data = (unsigned long)exp;
	292	exp->timeout.function = expectation_timed_out;
	293	exp->timeout.expires = jiffies + master_help->helper->timeout * HZ;
	294	add_timer(&exp->timeout);
	295
	296	exp->id = ++nf_conntrack_expect_next_id;
	297	atomic_inc(&exp->use);
	298	NF_CT_STAT_INC(expect_create);
	299	}
	300
	301	/* Race with expectations being used means we could have none to find; OK. */
	302	static void evict_oldest_expect(struct nf_conn *master)
	303	{
	304	struct nf_conntrack_expect *i;
	305
	306	list_for_each_entry_reverse(i, &nf_conntrack_expect_list, list) {
	307	if (i->master == master) {
	308	if (del_timer(&i->timeout)) {
	309	nf_ct_unlink_expect(i);
	310	nf_conntrack_expect_put(i);
	311	}
	312	break;
	313	}
	314	}
	315	}
	316
	317	static inline int refresh_timer(struct nf_conntrack_expect *i)
	318	{
	319	struct nf_conn_help *master_help = nfct_help(i->master);
	320
	321	if (!del_timer(&i->timeout))
	322	return 0;
	323
	324	i->timeout.expires = jiffies + master_help->helper->timeout*HZ;
	325	add_timer(&i->timeout);
	326	return 1;
	327	}
	328
	329	int nf_conntrack_expect_related(struct nf_conntrack_expect *expect)
	330	{
	331	struct nf_conntrack_expect *i;
	332	struct nf_conn *master = expect->master;
	333	struct nf_conn_help *master_help = nfct_help(master);
	334	int ret;
	335
	336	NF_CT_ASSERT(master_help);
	337
	338	write_lock_bh(&nf_conntrack_lock);
	339	list_for_each_entry(i, &nf_conntrack_expect_list, list) {
	340	if (expect_matches(i, expect)) {
	341	/* Refresh timer: if it's dying, ignore.. */
	342	if (refresh_timer(i)) {
	343	ret = 0;
	344	goto out;
345	}
346	} else if (expect_clash(i, expect)) {
347	ret = -EBUSY;
348	goto out;
349	}
350	}
351	/* Will be over limit? */
352	if (master_help->helper->max_expected &&
353	master_help->expecting >= master_help->helper->max_expected)
354	evict_oldest_expect(master);
355
356	nf_conntrack_expect_insert(expect);
357	nf_conntrack_expect_event(IPEXP_NEW, expect);
358	ret = 0;
359	out:
360	write_unlock_bh(&nf_conntrack_lock);
361	return ret;
362	}
13b18339	363	EXPORT_SYMBOL_GPL(nf_conntrack_expect_related);
77ab9cff MJ	364
	365	#ifdef CONFIG_PROC_FS
	366	static void exp_seq_start(struct seq_file s, loff_t *pos)
	367	{
	368	struct list_head *e = &nf_conntrack_expect_list;
	369	loff_t i;
	370
	371	/* strange seq_file api calls stop even if we fail,
	372	* thus we need to grab lock since stop unlocks */
	373	read_lock_bh(&nf_conntrack_lock);
	374
	375	if (list_empty(e))
	376	return NULL;
	377
	378	for (i = 0; i <= *pos; i++) {
	379	e = e->next;
	380	if (e == &nf_conntrack_expect_list)
	381	return NULL;
	382	}
	383	return e;
	384	}
	385
	386	static void exp_seq_next(struct seq_file s, void v, loff_t pos)
	387	{
	388	struct list_head *e = v;
	389
	390	++*pos;
	391	e = e->next;
	392
	393	if (e == &nf_conntrack_expect_list)
	394	return NULL;
	395
	396	return e;
	397	}
	398
	399	static void exp_seq_stop(struct seq_file s, void v)
	400	{
	401	read_unlock_bh(&nf_conntrack_lock);
	402	}
	403
	404	static int exp_seq_show(struct seq_file s, void v)
	405	{
	406	struct nf_conntrack_expect *expect = v;
	407
	408	if (expect->timeout.function)
	409	seq_printf(s, "%ld ", timer_pending(&expect->timeout)
	410	? (long)(expect->timeout.expires - jiffies)/HZ : 0);
	411	else
	412	seq_printf(s, "- ");
	413	seq_printf(s, "l3proto = %u proto=%u ",
	414	expect->tuple.src.l3num,
	415	expect->tuple.dst.protonum);
	416	print_tuple(s, &expect->tuple,
	417	__nf_ct_l3proto_find(expect->tuple.src.l3num),
605dcad6	418	__nf_ct_l4proto_find(expect->tuple.src.l3num,
77ab9cff MJ	419	expect->tuple.dst.protonum));
	420	return seq_putc(s, '\n');
	421	}
	422
	423	static struct seq_operations exp_seq_ops = {
	424	.start = exp_seq_start,
	425	.next = exp_seq_next,
	426	.stop = exp_seq_stop,
	427	.show = exp_seq_show
	428	};
	429
	430	static int exp_open(struct inode inode, struct file file)
	431	{
	432	return seq_open(file, &exp_seq_ops);
	433	}
	434
	435	struct file_operations exp_file_ops = {
	436	.owner = THIS_MODULE,
	437	.open = exp_open,
	438	.read = seq_read,
	439	.llseek = seq_lseek,
	440	.release = seq_release
	441	};
	442	#endif /* CONFIG_PROC_FS */