[mirror_ubuntu-bionic-kernel.git] / net / netfilter / nfnetlink_cttimeout.c

/*
 * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
 * (C) 2012 by Vyatta Inc. <http://www.vyatta.com>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation (or any later at your option).
 */
#include <linux/init.h>
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/rculist.h>
#include <linux/rculist_nulls.h>
#include <linux/types.h>
#include <linux/timer.h>
#include <linux/security.h>
#include <linux/skbuff.h>
#include <linux/errno.h>
#include <linux/netlink.h>
#include <linux/spinlock.h>
#include <linux/interrupt.h>
#include <linux/slab.h>

#include <linux/netfilter.h>
#include <net/netlink.h>
#include <net/sock.h>
#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_core.h>
#include <net/netfilter/nf_conntrack_l3proto.h>
#include <net/netfilter/nf_conntrack_l4proto.h>
#include <net/netfilter/nf_conntrack_tuple.h>
#include <net/netfilter/nf_conntrack_timeout.h>

#include <linux/netfilter/nfnetlink.h>
#include <linux/netfilter/nfnetlink_cttimeout.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
MODULE_DESCRIPTION("cttimeout: Extended Netfilter Connection Tracking timeout tuning");

static const struct nla_policy cttimeout_nla_policy[CTA_TIMEOUT_MAX+1] = {
	[CTA_TIMEOUT_NAME]	= { .type = NLA_NUL_STRING,
				    .len  = CTNL_TIMEOUT_NAME_MAX - 1},
	[CTA_TIMEOUT_L3PROTO]	= { .type = NLA_U16 },
	[CTA_TIMEOUT_L4PROTO]	= { .type = NLA_U8 },
	[CTA_TIMEOUT_DATA]	= { .type = NLA_NESTED },
};

static int
ctnl_timeout_parse_policy(void *timeouts, struct nf_conntrack_l4proto *l4proto,
			  struct net *net, const struct nlattr *attr)
{
	int ret = 0;

	if (likely(l4proto->ctnl_timeout.nlattr_to_obj)) {
		struct nlattr *tb[l4proto->ctnl_timeout.nlattr_max+1];

		ret = nla_parse_nested(tb, l4proto->ctnl_timeout.nlattr_max,
				       attr, l4proto->ctnl_timeout.nla_policy,
				       NULL);
		if (ret < 0)
			return ret;

		ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
	}
	return ret;
}

static int cttimeout_new_timeout(struct net *net, struct sock *ctnl,
				 struct sk_buff *skb,
				 const struct nlmsghdr *nlh,
				 const struct nlattr * const cda[])
{
	__u16 l3num;
	__u8 l4num;
	struct nf_conntrack_l4proto *l4proto;
	struct ctnl_timeout *timeout, *matching = NULL;
	char *name;
	int ret;

	if (!cda[CTA_TIMEOUT_NAME] ||
	    !cda[CTA_TIMEOUT_L3PROTO] ||
	    !cda[CTA_TIMEOUT_L4PROTO] ||
	    !cda[CTA_TIMEOUT_DATA])
		return -EINVAL;

	name = nla_data(cda[CTA_TIMEOUT_NAME]);
	l3num = ntohs(nla_get_be16(cda[CTA_TIMEOUT_L3PROTO]));
	l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]);

	list_for_each_entry(timeout, &net->nfct_timeout_list, head) {
		if (strncmp(timeout->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
			continue;

		if (nlh->nlmsg_flags & NLM_F_EXCL)
			return -EEXIST;

		matching = timeout;
		break;
	}

	if (matching) {
		if (nlh->nlmsg_flags & NLM_F_REPLACE) {
			/* You cannot replace one timeout policy by another of
			 * different kind, sorry.
			 */
			if (matching->l3num != l3num ||
			    matching->l4proto->l4proto != l4num)
				return -EINVAL;

			return ctnl_timeout_parse_policy(&matching->data,
							 matching->l4proto, net,
							 cda[CTA_TIMEOUT_DATA]);
		}

		return -EBUSY;
	}

	l4proto = nf_ct_l4proto_find_get(l3num, l4num);

	/* This protocol is not supportted, skip. */
	if (l4proto->l4proto != l4num) {
		ret = -EOPNOTSUPP;
		goto err_proto_put;
	}

	timeout = kzalloc(sizeof(struct ctnl_timeout) +
			  l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
	if (timeout == NULL) {
		ret = -ENOMEM;
		goto err_proto_put;
	}

	ret = ctnl_timeout_parse_policy(&timeout->data, l4proto, net,
					cda[CTA_TIMEOUT_DATA]);
	if (ret < 0)
		goto err;

	strcpy(timeout->name, nla_data(cda[CTA_TIMEOUT_NAME]));
	timeout->l3num = l3num;
	timeout->l4proto = l4proto;
	refcount_set(&timeout->refcnt, 1);
	list_add_tail_rcu(&timeout->head, &net->nfct_timeout_list);

	return 0;
err:
	kfree(timeout);
err_proto_put:
	nf_ct_l4proto_put(l4proto);
	return ret;
}

static int
ctnl_timeout_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
		       int event, struct ctnl_timeout *timeout)
{
	struct nlmsghdr *nlh;
	struct nfgenmsg *nfmsg;
	unsigned int flags = portid ? NLM_F_MULTI : 0;
	struct nf_conntrack_l4proto *l4proto = timeout->l4proto;

	event |= NFNL_SUBSYS_CTNETLINK_TIMEOUT << 8;
	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
	if (nlh == NULL)
		goto nlmsg_failure;

	nfmsg = nlmsg_data(nlh);
	nfmsg->nfgen_family = AF_UNSPEC;
	nfmsg->version = NFNETLINK_V0;
	nfmsg->res_id = 0;

	if (nla_put_string(skb, CTA_TIMEOUT_NAME, timeout->name) ||
	    nla_put_be16(skb, CTA_TIMEOUT_L3PROTO, htons(timeout->l3num)) ||
	    nla_put_u8(skb, CTA_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) ||
	    nla_put_be32(skb, CTA_TIMEOUT_USE,
			 htonl(refcount_read(&timeout->refcnt))))
		goto nla_put_failure;

	if (likely(l4proto->ctnl_timeout.obj_to_nlattr)) {
		struct nlattr *nest_parms;
		int ret;

		nest_parms = nla_nest_start(skb,
					    CTA_TIMEOUT_DATA | NLA_F_NESTED);
		if (!nest_parms)
			goto nla_put_failure;

		ret = l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data);
		if (ret < 0)
			goto nla_put_failure;

		nla_nest_end(skb, nest_parms);
	}

	nlmsg_end(skb, nlh);
	return skb->len;

nlmsg_failure:
nla_put_failure:
	nlmsg_cancel(skb, nlh);
	return -1;
}

static int
ctnl_timeout_dump(struct sk_buff *skb, struct netlink_callback *cb)
{
	struct net *net = sock_net(skb->sk);
	struct ctnl_timeout *cur, *last;

	if (cb->args[2])
		return 0;

	last = (struct ctnl_timeout *)cb->args[1];
	if (cb->args[1])
		cb->args[1] = 0;

	rcu_read_lock();
	list_for_each_entry_rcu(cur, &net->nfct_timeout_list, head) {
		if (last) {
			if (cur != last)
				continue;

			last = NULL;
		}
		if (ctnl_timeout_fill_info(skb, NETLINK_CB(cb->skb).portid,
					   cb->nlh->nlmsg_seq,
					   NFNL_MSG_TYPE(cb->nlh->nlmsg_type),
					   IPCTNL_MSG_TIMEOUT_NEW, cur) < 0) {
			cb->args[1] = (unsigned long)cur;
			break;
		}
	}
	if (!cb->args[1])
		cb->args[2] = 1;
	rcu_read_unlock();
	return skb->len;
}

static int cttimeout_get_timeout(struct net *net, struct sock *ctnl,
				 struct sk_buff *skb,
				 const struct nlmsghdr *nlh,
				 const struct nlattr * const cda[])
{
	int ret = -ENOENT;
	char *name;
	struct ctnl_timeout *cur;

	if (nlh->nlmsg_flags & NLM_F_DUMP) {
		struct netlink_dump_control c = {
			.dump = ctnl_timeout_dump,
		};
		return netlink_dump_start(ctnl, skb, nlh, &c);
	}

	if (!cda[CTA_TIMEOUT_NAME])
		return -EINVAL;
	name = nla_data(cda[CTA_TIMEOUT_NAME]);

	list_for_each_entry(cur, &net->nfct_timeout_list, head) {
		struct sk_buff *skb2;

		if (strncmp(cur->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
			continue;

		skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
		if (skb2 == NULL) {
			ret = -ENOMEM;
			break;
		}

		ret = ctnl_timeout_fill_info(skb2, NETLINK_CB(skb).portid,
					     nlh->nlmsg_seq,
					     NFNL_MSG_TYPE(nlh->nlmsg_type),
					     IPCTNL_MSG_TIMEOUT_NEW, cur);
		if (ret <= 0) {
			kfree_skb(skb2);
			break;
		}
		ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid,
					MSG_DONTWAIT);
		if (ret > 0)
			ret = 0;

		/* this avoids a loop in nfnetlink. */
		return ret == -EAGAIN ? -ENOBUFS : ret;
	}
	return ret;
}

static void untimeout(struct nf_conntrack_tuple_hash *i,
		      struct ctnl_timeout *timeout)
{
	struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(i);
	struct nf_conn_timeout *timeout_ext = nf_ct_timeout_find(ct);

	if (timeout_ext && (!timeout || timeout_ext->timeout == timeout))
		RCU_INIT_POINTER(timeout_ext->timeout, NULL);
}

static void ctnl_untimeout(struct net *net, struct ctnl_timeout *timeout)
{
	struct nf_conntrack_tuple_hash *h;
	const struct hlist_nulls_node *nn;
	unsigned int last_hsize;
	spinlock_t *lock;
	int i, cpu;

	for_each_possible_cpu(cpu) {
		struct ct_pcpu *pcpu = per_cpu_ptr(net->ct.pcpu_lists, cpu);

		spin_lock_bh(&pcpu->lock);
		hlist_nulls_for_each_entry(h, nn, &pcpu->unconfirmed, hnnode)
			untimeout(h, timeout);
		spin_unlock_bh(&pcpu->lock);
	}

	local_bh_disable();
restart:
	last_hsize = nf_conntrack_htable_size;
	for (i = 0; i < last_hsize; i++) {
		lock = &nf_conntrack_locks[i % CONNTRACK_LOCKS];
		nf_conntrack_lock(lock);
		if (last_hsize != nf_conntrack_htable_size) {
			spin_unlock(lock);
			goto restart;
		}

		hlist_nulls_for_each_entry(h, nn, &nf_conntrack_hash[i], hnnode)
			untimeout(h, timeout);
		spin_unlock(lock);
	}
	local_bh_enable();
}

/* try to delete object, fail if it is still in use. */
static int ctnl_timeout_try_del(struct net *net, struct ctnl_timeout *timeout)
{
	int ret = 0;

	/* We want to avoid races with ctnl_timeout_put. So only when the
	 * current refcnt is 1, we decrease it to 0.
	 */
	if (refcount_dec_if_one(&timeout->refcnt)) {
		/* We are protected by nfnl mutex. */
		list_del_rcu(&timeout->head);
		nf_ct_l4proto_put(timeout->l4proto);
		ctnl_untimeout(net, timeout);
		kfree_rcu(timeout, rcu_head);
	} else {
		ret = -EBUSY;
	}
	return ret;
}

static int cttimeout_del_timeout(struct net *net, struct sock *ctnl,
				 struct sk_buff *skb,
				 const struct nlmsghdr *nlh,
				 const struct nlattr * const cda[])
{
	struct ctnl_timeout *cur, *tmp;
	int ret = -ENOENT;
	char *name;

	if (!cda[CTA_TIMEOUT_NAME]) {
		list_for_each_entry_safe(cur, tmp, &net->nfct_timeout_list,
					 head)
			ctnl_timeout_try_del(net, cur);

		return 0;
	}
	name = nla_data(cda[CTA_TIMEOUT_NAME]);

	list_for_each_entry(cur, &net->nfct_timeout_list, head) {
		if (strncmp(cur->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
			continue;

		ret = ctnl_timeout_try_del(net, cur);
		if (ret < 0)
			return ret;

		break;
	}
	return ret;
}

static int cttimeout_default_set(struct net *net, struct sock *ctnl,
				 struct sk_buff *skb,
				 const struct nlmsghdr *nlh,
				 const struct nlattr * const cda[])
{
	__u16 l3num;
	__u8 l4num;
	struct nf_conntrack_l4proto *l4proto;
	unsigned int *timeouts;
	int ret;

	if (!cda[CTA_TIMEOUT_L3PROTO] ||
	    !cda[CTA_TIMEOUT_L4PROTO] ||
	    !cda[CTA_TIMEOUT_DATA])
		return -EINVAL;

	l3num = ntohs(nla_get_be16(cda[CTA_TIMEOUT_L3PROTO]));
	l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]);
	l4proto = nf_ct_l4proto_find_get(l3num, l4num);

	/* This protocol is not supported, skip. */
	if (l4proto->l4proto != l4num) {
		ret = -EOPNOTSUPP;
		goto err;
	}

	timeouts = l4proto->get_timeouts(net);

	ret = ctnl_timeout_parse_policy(timeouts, l4proto, net,
					cda[CTA_TIMEOUT_DATA]);
	if (ret < 0)
		goto err;

	nf_ct_l4proto_put(l4proto);
	return 0;
err:
	nf_ct_l4proto_put(l4proto);
	return ret;
}

static int
cttimeout_default_fill_info(struct net *net, struct sk_buff *skb, u32 portid,
			    u32 seq, u32 type, int event,
			    struct nf_conntrack_l4proto *l4proto)
{
	struct nlmsghdr *nlh;
	struct nfgenmsg *nfmsg;
	unsigned int flags = portid ? NLM_F_MULTI : 0;

	event |= NFNL_SUBSYS_CTNETLINK_TIMEOUT << 8;
	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
	if (nlh == NULL)
		goto nlmsg_failure;

	nfmsg = nlmsg_data(nlh);
	nfmsg->nfgen_family = AF_UNSPEC;
	nfmsg->version = NFNETLINK_V0;
	nfmsg->res_id = 0;

	if (nla_put_be16(skb, CTA_TIMEOUT_L3PROTO, htons(l4proto->l3proto)) ||
	    nla_put_u8(skb, CTA_TIMEOUT_L4PROTO, l4proto->l4proto))
		goto nla_put_failure;

	if (likely(l4proto->ctnl_timeout.obj_to_nlattr)) {
		struct nlattr *nest_parms;
		unsigned int *timeouts = l4proto->get_timeouts(net);
		int ret;

		nest_parms = nla_nest_start(skb,
					    CTA_TIMEOUT_DATA | NLA_F_NESTED);
		if (!nest_parms)
			goto nla_put_failure;

		ret = l4proto->ctnl_timeout.obj_to_nlattr(skb, timeouts);
		if (ret < 0)
			goto nla_put_failure;

		nla_nest_end(skb, nest_parms);
	}

	nlmsg_end(skb, nlh);
	return skb->len;

nlmsg_failure:
nla_put_failure:
	nlmsg_cancel(skb, nlh);
	return -1;
}

static int cttimeout_default_get(struct net *net, struct sock *ctnl,
				 struct sk_buff *skb,
				 const struct nlmsghdr *nlh,
				 const struct nlattr * const cda[])
{
	__u16 l3num;
	__u8 l4num;
	struct nf_conntrack_l4proto *l4proto;
	struct sk_buff *skb2;
	int ret, err;

	if (!cda[CTA_TIMEOUT_L3PROTO] || !cda[CTA_TIMEOUT_L4PROTO])
		return -EINVAL;

	l3num = ntohs(nla_get_be16(cda[CTA_TIMEOUT_L3PROTO]));
	l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]);
	l4proto = nf_ct_l4proto_find_get(l3num, l4num);

	/* This protocol is not supported, skip. */
	if (l4proto->l4proto != l4num) {
		err = -EOPNOTSUPP;
		goto err;
	}

	skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
	if (skb2 == NULL) {
		err = -ENOMEM;
		goto err;
	}

	ret = cttimeout_default_fill_info(net, skb2, NETLINK_CB(skb).portid,
					  nlh->nlmsg_seq,
					  NFNL_MSG_TYPE(nlh->nlmsg_type),
					  IPCTNL_MSG_TIMEOUT_DEFAULT_SET,
					  l4proto);
	if (ret <= 0) {
		kfree_skb(skb2);
		err = -ENOMEM;
		goto err;
	}
	ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid, MSG_DONTWAIT);
	if (ret > 0)
		ret = 0;

	/* this avoids a loop in nfnetlink. */
	return ret == -EAGAIN ? -ENOBUFS : ret;
err:
	nf_ct_l4proto_put(l4proto);
	return err;
}

#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
static struct ctnl_timeout *
ctnl_timeout_find_get(struct net *net, const char *name)
{
	struct ctnl_timeout *timeout, *matching = NULL;

	rcu_read_lock();
	list_for_each_entry_rcu(timeout, &net->nfct_timeout_list, head) {
		if (strncmp(timeout->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
			continue;

		if (!try_module_get(THIS_MODULE))
			goto err;

		if (!refcount_inc_not_zero(&timeout->refcnt)) {
			module_put(THIS_MODULE);
			goto err;
		}
		matching = timeout;
		break;
	}
err:
	rcu_read_unlock();
	return matching;
}

static void ctnl_timeout_put(struct ctnl_timeout *timeout)
{
	if (refcount_dec_and_test(&timeout->refcnt))
		kfree_rcu(timeout, rcu_head);

	module_put(THIS_MODULE);
}
#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */

static const struct nfnl_callback cttimeout_cb[IPCTNL_MSG_TIMEOUT_MAX] = {
	[IPCTNL_MSG_TIMEOUT_NEW]	= { .call = cttimeout_new_timeout,
					    .attr_count = CTA_TIMEOUT_MAX,
					    .policy = cttimeout_nla_policy },
	[IPCTNL_MSG_TIMEOUT_GET]	= { .call = cttimeout_get_timeout,
					    .attr_count = CTA_TIMEOUT_MAX,
					    .policy = cttimeout_nla_policy },
	[IPCTNL_MSG_TIMEOUT_DELETE]	= { .call = cttimeout_del_timeout,
					    .attr_count = CTA_TIMEOUT_MAX,
					    .policy = cttimeout_nla_policy },
	[IPCTNL_MSG_TIMEOUT_DEFAULT_SET]= { .call = cttimeout_default_set,
					    .attr_count = CTA_TIMEOUT_MAX,
					    .policy = cttimeout_nla_policy },
	[IPCTNL_MSG_TIMEOUT_DEFAULT_GET]= { .call = cttimeout_default_get,
					    .attr_count = CTA_TIMEOUT_MAX,
					    .policy = cttimeout_nla_policy },
};

static const struct nfnetlink_subsystem cttimeout_subsys = {
	.name				= "conntrack_timeout",
	.subsys_id			= NFNL_SUBSYS_CTNETLINK_TIMEOUT,
	.cb_count			= IPCTNL_MSG_TIMEOUT_MAX,
	.cb				= cttimeout_cb,
};

MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_TIMEOUT);

static int __net_init cttimeout_net_init(struct net *net)
{
	INIT_LIST_HEAD(&net->nfct_timeout_list);

	return 0;
}

static void __net_exit cttimeout_net_exit(struct net *net)
{
	struct ctnl_timeout *cur, *tmp;

	ctnl_untimeout(net, NULL);

	list_for_each_entry_safe(cur, tmp, &net->nfct_timeout_list, head) {
		list_del_rcu(&cur->head);
		nf_ct_l4proto_put(cur->l4proto);

		if (refcount_dec_and_test(&cur->refcnt))
			kfree_rcu(cur, rcu_head);
	}
}

static struct pernet_operations cttimeout_ops = {
	.init	= cttimeout_net_init,
	.exit	= cttimeout_net_exit,
};

static int __init cttimeout_init(void)
{
	int ret;

	ret = register_pernet_subsys(&cttimeout_ops);
	if (ret < 0)
		return ret;

	ret = nfnetlink_subsys_register(&cttimeout_subsys);
	if (ret < 0) {
		pr_err("cttimeout_init: cannot register cttimeout with "
			"nfnetlink.\n");
		goto err_out;
	}
#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
	RCU_INIT_POINTER(nf_ct_timeout_find_get_hook, ctnl_timeout_find_get);
	RCU_INIT_POINTER(nf_ct_timeout_put_hook, ctnl_timeout_put);
#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
	return 0;

err_out:
	unregister_pernet_subsys(&cttimeout_ops);
	return ret;
}

static void __exit cttimeout_exit(void)
{
	pr_info("cttimeout: unregistering from nfnetlink.\n");

	nfnetlink_subsys_unregister(&cttimeout_subsys);

	unregister_pernet_subsys(&cttimeout_ops);
#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
	RCU_INIT_POINTER(nf_ct_timeout_find_get_hook, NULL);
	RCU_INIT_POINTER(nf_ct_timeout_put_hook, NULL);
	synchronize_rcu();
#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
}

module_init(cttimeout_init);
module_exit(cttimeout_exit);
Commit	Line	Data
50978462 PNA	1	/*
	2	* (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
	3	* (C) 2012 by Vyatta Inc. <http://www.vyatta.com>
	4	*
	5	* This program is free software; you can redistribute it and/or modify
	6	* it under the terms of the GNU General Public License version 2 as
	7	* published by the Free Software Foundation (or any later at your option).
	8	*/
	9	#include <linux/init.h>
	10	#include <linux/module.h>
	11	#include <linux/kernel.h>
	12	#include <linux/rculist.h>
	13	#include <linux/rculist_nulls.h>
	14	#include <linux/types.h>
	15	#include <linux/timer.h>
	16	#include <linux/security.h>
	17	#include <linux/skbuff.h>
	18	#include <linux/errno.h>
	19	#include <linux/netlink.h>
	20	#include <linux/spinlock.h>
	21	#include <linux/interrupt.h>
	22	#include <linux/slab.h>
	23
	24	#include <linux/netfilter.h>
	25	#include <net/netlink.h>
	26	#include <net/sock.h>
	27	#include <net/netfilter/nf_conntrack.h>
	28	#include <net/netfilter/nf_conntrack_core.h>
	29	#include <net/netfilter/nf_conntrack_l3proto.h>
	30	#include <net/netfilter/nf_conntrack_l4proto.h>
	31	#include <net/netfilter/nf_conntrack_tuple.h>
24de58f4	32	#include <net/netfilter/nf_conntrack_timeout.h>
50978462 PNA	33
	34	#include <linux/netfilter/nfnetlink.h>
	35	#include <linux/netfilter/nfnetlink_cttimeout.h>
	36
	37	MODULE_LICENSE("GPL");
	38	MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
	39	MODULE_DESCRIPTION("cttimeout: Extended Netfilter Connection Tracking timeout tuning");
	40
50978462	41	static const struct nla_policy cttimeout_nla_policy[CTA_TIMEOUT_MAX+1] = {
e93b5f9f FW	42	[CTA_TIMEOUT_NAME] = { .type = NLA_NUL_STRING,
e93b5f9f FW	43	.len = CTNL_TIMEOUT_NAME_MAX - 1},
50978462 PNA	44	[CTA_TIMEOUT_L3PROTO] = { .type = NLA_U16 },
	45	[CTA_TIMEOUT_L4PROTO] = { .type = NLA_U8 },
	46	[CTA_TIMEOUT_DATA] = { .type = NLA_NESTED },
	47	};
	48
	49	static int
91cb498e PNA	50	ctnl_timeout_parse_policy(void timeouts, struct nf_conntrack_l4proto l4proto,
91cb498e PNA	51	struct net net, const struct nlattr attr)
50978462 PNA	52	{
	53	int ret = 0;
	54
	55	if (likely(l4proto->ctnl_timeout.nlattr_to_obj)) {
	56	struct nlattr *tb[l4proto->ctnl_timeout.nlattr_max+1];
	57
130ffbc2	58	ret = nla_parse_nested(tb, l4proto->ctnl_timeout.nlattr_max,
fceb6435 JB	59	attr, l4proto->ctnl_timeout.nla_policy,
fceb6435 JB	60	NULL);
130ffbc2 DB	61	if (ret < 0)
130ffbc2 DB	62	return ret;
50978462	63
91cb498e	64	ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
50978462 PNA	65	}
	66	return ret;
	67	}
	68
7b8002a1 PNA	69	static int cttimeout_new_timeout(struct net net, struct sock ctnl,
	70	struct sk_buff *skb,
	71	const struct nlmsghdr *nlh,
	72	const struct nlattr * const cda[])
50978462 PNA	73	{
	74	__u16 l3num;
	75	__u8 l4num;
	76	struct nf_conntrack_l4proto *l4proto;
	77	struct ctnl_timeout timeout, matching = NULL;
	78	char *name;
	79	int ret;
	80
	81	if (!cda[CTA_TIMEOUT_NAME] \|\|
	82	!cda[CTA_TIMEOUT_L3PROTO] \|\|
	83	!cda[CTA_TIMEOUT_L4PROTO] \|\|
	84	!cda[CTA_TIMEOUT_DATA])
	85	return -EINVAL;
	86
	87	name = nla_data(cda[CTA_TIMEOUT_NAME]);
	88	l3num = ntohs(nla_get_be16(cda[CTA_TIMEOUT_L3PROTO]));
	89	l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]);
	90
19576c94	91	list_for_each_entry(timeout, &net->nfct_timeout_list, head) {
50978462 PNA	92	if (strncmp(timeout->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
	93	continue;
	94
	95	if (nlh->nlmsg_flags & NLM_F_EXCL)
	96	return -EEXIST;
	97
	98	matching = timeout;
	99	break;
	100	}
	101
50978462 PNA	102	if (matching) {
	103	if (nlh->nlmsg_flags & NLM_F_REPLACE) {
	104	/* You cannot replace one timeout policy by another of
	105	* different kind, sorry.
	106	*/
	107	if (matching->l3num != l3num \|\|
23aaba5a LZ	108	matching->l4proto->l4proto != l4num)
	109	return -EINVAL;
	110
	111	return ctnl_timeout_parse_policy(&matching->data,
	112	matching->l4proto, net,
	113	cda[CTA_TIMEOUT_DATA]);
50978462	114	}
23aaba5a LZ	115
	116	return -EBUSY;
	117	}
	118
	119	l4proto = nf_ct_l4proto_find_get(l3num, l4num);
	120
	121	/* This protocol is not supportted, skip. */
	122	if (l4proto->l4proto != l4num) {
	123	ret = -EOPNOTSUPP;
c1ebd7df	124	goto err_proto_put;
50978462 PNA	125	}
	126
	127	timeout = kzalloc(sizeof(struct ctnl_timeout) +
	128	l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
c1ebd7df PNA	129	if (timeout == NULL) {
	130	ret = -ENOMEM;
	131	goto err_proto_put;
	132	}
50978462	133
91cb498e	134	ret = ctnl_timeout_parse_policy(&timeout->data, l4proto, net,
50978462 PNA	135	cda[CTA_TIMEOUT_DATA]);
	136	if (ret < 0)
	137	goto err;
	138
	139	strcpy(timeout->name, nla_data(cda[CTA_TIMEOUT_NAME]));
	140	timeout->l3num = l3num;
c1ebd7df	141	timeout->l4proto = l4proto;
b54ab92b	142	refcount_set(&timeout->refcnt, 1);
19576c94	143	list_add_tail_rcu(&timeout->head, &net->nfct_timeout_list);
50978462 PNA	144
	145	return 0;
	146	err:
	147	kfree(timeout);
c1ebd7df PNA	148	err_proto_put:
c1ebd7df PNA	149	nf_ct_l4proto_put(l4proto);
50978462 PNA	150	return ret;
	151	}
	152
	153	static int
15e47304	154	ctnl_timeout_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
50978462 PNA	155	int event, struct ctnl_timeout *timeout)
	156	{
	157	struct nlmsghdr *nlh;
	158	struct nfgenmsg *nfmsg;
15e47304	159	unsigned int flags = portid ? NLM_F_MULTI : 0;
c1ebd7df	160	struct nf_conntrack_l4proto *l4proto = timeout->l4proto;
50978462 PNA	161
50978462 PNA	162	event \|= NFNL_SUBSYS_CTNETLINK_TIMEOUT << 8;
15e47304	163	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
50978462 PNA	164	if (nlh == NULL)
	165	goto nlmsg_failure;
	166
	167	nfmsg = nlmsg_data(nlh);
	168	nfmsg->nfgen_family = AF_UNSPEC;
	169	nfmsg->version = NFNETLINK_V0;
	170	nfmsg->res_id = 0;
	171
48f03bda DM	172	if (nla_put_string(skb, CTA_TIMEOUT_NAME, timeout->name) \|\|
	173	nla_put_be16(skb, CTA_TIMEOUT_L3PROTO, htons(timeout->l3num)) \|\|
	174	nla_put_u8(skb, CTA_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) \|\|
	175	nla_put_be32(skb, CTA_TIMEOUT_USE,
b54ab92b	176	htonl(refcount_read(&timeout->refcnt))))
48f03bda	177	goto nla_put_failure;
50978462	178
50978462 PNA	179	if (likely(l4proto->ctnl_timeout.obj_to_nlattr)) {
	180	struct nlattr *nest_parms;
	181	int ret;
	182
	183	nest_parms = nla_nest_start(skb,
	184	CTA_TIMEOUT_DATA \| NLA_F_NESTED);
	185	if (!nest_parms)
	186	goto nla_put_failure;
	187
	188	ret = l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data);
	189	if (ret < 0)
	190	goto nla_put_failure;
	191
	192	nla_nest_end(skb, nest_parms);
	193	}
c1ebd7df	194
50978462 PNA	195	nlmsg_end(skb, nlh);
	196	return skb->len;
	197
	198	nlmsg_failure:
	199	nla_put_failure:
	200	nlmsg_cancel(skb, nlh);
	201	return -1;
	202	}
	203
	204	static int
	205	ctnl_timeout_dump(struct sk_buff skb, struct netlink_callback cb)
	206	{
19576c94	207	struct net *net = sock_net(skb->sk);
50978462 PNA	208	struct ctnl_timeout cur, last;
	209
	210	if (cb->args[2])
	211	return 0;
	212
	213	last = (struct ctnl_timeout *)cb->args[1];
	214	if (cb->args[1])
	215	cb->args[1] = 0;
	216
	217	rcu_read_lock();
19576c94	218	list_for_each_entry_rcu(cur, &net->nfct_timeout_list, head) {
37bc4f8d PNA	219	if (last) {
	220	if (cur != last)
	221	continue;
50978462	222
37bc4f8d PNA	223	last = NULL;
37bc4f8d PNA	224	}
15e47304	225	if (ctnl_timeout_fill_info(skb, NETLINK_CB(cb->skb).portid,
50978462 PNA	226	cb->nlh->nlmsg_seq,
	227	NFNL_MSG_TYPE(cb->nlh->nlmsg_type),
	228	IPCTNL_MSG_TIMEOUT_NEW, cur) < 0) {
	229	cb->args[1] = (unsigned long)cur;
	230	break;
	231	}
	232	}
	233	if (!cb->args[1])
	234	cb->args[2] = 1;
	235	rcu_read_unlock();
	236	return skb->len;
	237	}
	238
7b8002a1 PNA	239	static int cttimeout_get_timeout(struct net net, struct sock ctnl,
	240	struct sk_buff *skb,
	241	const struct nlmsghdr *nlh,
	242	const struct nlattr * const cda[])
50978462 PNA	243	{
	244	int ret = -ENOENT;
	245	char *name;
	246	struct ctnl_timeout *cur;
	247
	248	if (nlh->nlmsg_flags & NLM_F_DUMP) {
	249	struct netlink_dump_control c = {
	250	.dump = ctnl_timeout_dump,
	251	};
	252	return netlink_dump_start(ctnl, skb, nlh, &c);
	253	}
	254
	255	if (!cda[CTA_TIMEOUT_NAME])
	256	return -EINVAL;
	257	name = nla_data(cda[CTA_TIMEOUT_NAME]);
	258
19576c94	259	list_for_each_entry(cur, &net->nfct_timeout_list, head) {
50978462 PNA	260	struct sk_buff *skb2;
	261
	262	if (strncmp(cur->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
	263	continue;
	264
	265	skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
	266	if (skb2 == NULL) {
	267	ret = -ENOMEM;
	268	break;
	269	}
	270
15e47304	271	ret = ctnl_timeout_fill_info(skb2, NETLINK_CB(skb).portid,
50978462 PNA	272	nlh->nlmsg_seq,
	273	NFNL_MSG_TYPE(nlh->nlmsg_type),
	274	IPCTNL_MSG_TIMEOUT_NEW, cur);
	275	if (ret <= 0) {
	276	kfree_skb(skb2);
	277	break;
	278	}
15e47304	279	ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid,
50978462 PNA	280	MSG_DONTWAIT);
	281	if (ret > 0)
	282	ret = 0;
	283
	284	/* this avoids a loop in nfnetlink. */
	285	return ret == -EAGAIN ? -ENOBUFS : ret;
	286	}
	287	return ret;
	288	}
	289
ae2d708e PNA	290	static void untimeout(struct nf_conntrack_tuple_hash *i,
	291	struct ctnl_timeout *timeout)
	292	{
	293	struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(i);
	294	struct nf_conn_timeout *timeout_ext = nf_ct_timeout_find(ct);
	295
	296	if (timeout_ext && (!timeout \|\| timeout_ext->timeout == timeout))
	297	RCU_INIT_POINTER(timeout_ext->timeout, NULL);
	298	}
	299
19576c94	300	static void ctnl_untimeout(struct net net, struct ctnl_timeout timeout)
ae2d708e PNA	301	{
	302	struct nf_conntrack_tuple_hash *h;
	303	const struct hlist_nulls_node *nn;
474803d3 LZ	304	unsigned int last_hsize;
474803d3 LZ	305	spinlock_t *lock;
533e3300 LZ	306	int i, cpu;
	307
	308	for_each_possible_cpu(cpu) {
	309	struct ct_pcpu *pcpu = per_cpu_ptr(net->ct.pcpu_lists, cpu);
	310
	311	spin_lock_bh(&pcpu->lock);
	312	hlist_nulls_for_each_entry(h, nn, &pcpu->unconfirmed, hnnode)
	313	untimeout(h, timeout);
	314	spin_unlock_bh(&pcpu->lock);
	315	}
ae2d708e PNA	316
ae2d708e PNA	317	local_bh_disable();
474803d3 LZ	318	restart:
	319	last_hsize = nf_conntrack_htable_size;
	320	for (i = 0; i < last_hsize; i++) {
	321	lock = &nf_conntrack_locks[i % CONNTRACK_LOCKS];
	322	nf_conntrack_lock(lock);
	323	if (last_hsize != nf_conntrack_htable_size) {
	324	spin_unlock(lock);
	325	goto restart;
ae2d708e	326	}
474803d3 LZ	327
	328	hlist_nulls_for_each_entry(h, nn, &nf_conntrack_hash[i], hnnode)
	329	untimeout(h, timeout);
	330	spin_unlock(lock);
ae2d708e PNA	331	}
	332	local_bh_enable();
	333	}
	334
50978462	335	/* try to delete object, fail if it is still in use. */
19576c94	336	static int ctnl_timeout_try_del(struct net net, struct ctnl_timeout timeout)
50978462 PNA	337	{
	338	int ret = 0;
	339
b75911b6 LZ	340	/* We want to avoid races with ctnl_timeout_put. So only when the
	341	* current refcnt is 1, we decrease it to 0.
	342	*/
b54ab92b	343	if (refcount_dec_if_one(&timeout->refcnt)) {
50978462 PNA	344	/* We are protected by nfnl mutex. */
50978462 PNA	345	list_del_rcu(&timeout->head);
c1ebd7df	346	nf_ct_l4proto_put(timeout->l4proto);
19576c94	347	ctnl_untimeout(net, timeout);
50978462 PNA	348	kfree_rcu(timeout, rcu_head);
50978462 PNA	349	} else {
50978462 PNA	350	ret = -EBUSY;
	351	}
	352	return ret;
	353	}
	354
7b8002a1 PNA	355	static int cttimeout_del_timeout(struct net net, struct sock ctnl,
	356	struct sk_buff *skb,
	357	const struct nlmsghdr *nlh,
	358	const struct nlattr * const cda[])
50978462	359	{
93fac10b	360	struct ctnl_timeout cur, tmp;
50978462	361	int ret = -ENOENT;
7b8002a1	362	char *name;
50978462 PNA	363
50978462 PNA	364	if (!cda[CTA_TIMEOUT_NAME]) {
93fac10b LZ	365	list_for_each_entry_safe(cur, tmp, &net->nfct_timeout_list,
93fac10b LZ	366	head)
19576c94	367	ctnl_timeout_try_del(net, cur);
50978462 PNA	368
	369	return 0;
	370	}
	371	name = nla_data(cda[CTA_TIMEOUT_NAME]);
	372
19576c94	373	list_for_each_entry(cur, &net->nfct_timeout_list, head) {
50978462 PNA	374	if (strncmp(cur->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
	375	continue;
	376
19576c94	377	ret = ctnl_timeout_try_del(net, cur);
50978462 PNA	378	if (ret < 0)
	379	return ret;
	380
	381	break;
	382	}
	383	return ret;
	384	}
	385
7b8002a1 PNA	386	static int cttimeout_default_set(struct net net, struct sock ctnl,
	387	struct sk_buff *skb,
	388	const struct nlmsghdr *nlh,
	389	const struct nlattr * const cda[])
91cb498e PNA	390	{
	391	__u16 l3num;
	392	__u8 l4num;
	393	struct nf_conntrack_l4proto *l4proto;
91cb498e PNA	394	unsigned int *timeouts;
	395	int ret;
	396
	397	if (!cda[CTA_TIMEOUT_L3PROTO] \|\|
	398	!cda[CTA_TIMEOUT_L4PROTO] \|\|
	399	!cda[CTA_TIMEOUT_DATA])
	400	return -EINVAL;
	401
	402	l3num = ntohs(nla_get_be16(cda[CTA_TIMEOUT_L3PROTO]));
	403	l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]);
	404	l4proto = nf_ct_l4proto_find_get(l3num, l4num);
	405
	406	/* This protocol is not supported, skip. */
	407	if (l4proto->l4proto != l4num) {
	408	ret = -EOPNOTSUPP;
	409	goto err;
	410	}
	411
	412	timeouts = l4proto->get_timeouts(net);
	413
	414	ret = ctnl_timeout_parse_policy(timeouts, l4proto, net,
	415	cda[CTA_TIMEOUT_DATA]);
	416	if (ret < 0)
	417	goto err;
	418
	419	nf_ct_l4proto_put(l4proto);
	420	return 0;
	421	err:
	422	nf_ct_l4proto_put(l4proto);
	423	return ret;
	424	}
	425
	426	static int
	427	cttimeout_default_fill_info(struct net net, struct sk_buff skb, u32 portid,
	428	u32 seq, u32 type, int event,
	429	struct nf_conntrack_l4proto *l4proto)
	430	{
	431	struct nlmsghdr *nlh;
	432	struct nfgenmsg *nfmsg;
	433	unsigned int flags = portid ? NLM_F_MULTI : 0;
	434
	435	event \|= NFNL_SUBSYS_CTNETLINK_TIMEOUT << 8;
	436	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
	437	if (nlh == NULL)
	438	goto nlmsg_failure;
	439
	440	nfmsg = nlmsg_data(nlh);
	441	nfmsg->nfgen_family = AF_UNSPEC;
	442	nfmsg->version = NFNETLINK_V0;
	443	nfmsg->res_id = 0;
	444
	445	if (nla_put_be16(skb, CTA_TIMEOUT_L3PROTO, htons(l4proto->l3proto)) \|\|
	446	nla_put_u8(skb, CTA_TIMEOUT_L4PROTO, l4proto->l4proto))
	447	goto nla_put_failure;
	448
	449	if (likely(l4proto->ctnl_timeout.obj_to_nlattr)) {
	450	struct nlattr *nest_parms;
	451	unsigned int *timeouts = l4proto->get_timeouts(net);
	452	int ret;
	453
	454	nest_parms = nla_nest_start(skb,
	455	CTA_TIMEOUT_DATA \| NLA_F_NESTED);
	456	if (!nest_parms)
	457	goto nla_put_failure;
458
459	ret = l4proto->ctnl_timeout.obj_to_nlattr(skb, timeouts);
460	if (ret < 0)
461	goto nla_put_failure;
462
463	nla_nest_end(skb, nest_parms);
464	}
465
466	nlmsg_end(skb, nlh);
467	return skb->len;
468
469	nlmsg_failure:
470	nla_put_failure:
471	nlmsg_cancel(skb, nlh);
472	return -1;
473	}
474
7b8002a1 PNA	475	static int cttimeout_default_get(struct net net, struct sock ctnl,
7b8002a1 PNA	476	struct sk_buff *skb,
91cb498e PNA	477	const struct nlmsghdr *nlh,
	478	const struct nlattr * const cda[])
	479	{
	480	__u16 l3num;
	481	__u8 l4num;
	482	struct nf_conntrack_l4proto *l4proto;
91cb498e PNA	483	struct sk_buff *skb2;
	484	int ret, err;
	485
	486	if (!cda[CTA_TIMEOUT_L3PROTO] \|\| !cda[CTA_TIMEOUT_L4PROTO])
	487	return -EINVAL;
	488
	489	l3num = ntohs(nla_get_be16(cda[CTA_TIMEOUT_L3PROTO]));
	490	l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]);
	491	l4proto = nf_ct_l4proto_find_get(l3num, l4num);
	492
	493	/* This protocol is not supported, skip. */
	494	if (l4proto->l4proto != l4num) {
	495	err = -EOPNOTSUPP;
	496	goto err;
	497	}
	498
	499	skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
	500	if (skb2 == NULL) {
	501	err = -ENOMEM;
	502	goto err;
	503	}
	504
	505	ret = cttimeout_default_fill_info(net, skb2, NETLINK_CB(skb).portid,
	506	nlh->nlmsg_seq,
	507	NFNL_MSG_TYPE(nlh->nlmsg_type),
	508	IPCTNL_MSG_TIMEOUT_DEFAULT_SET,
	509	l4proto);
	510	if (ret <= 0) {
	511	kfree_skb(skb2);
	512	err = -ENOMEM;
	513	goto err;
	514	}
	515	ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid, MSG_DONTWAIT);
	516	if (ret > 0)
	517	ret = 0;
	518
	519	/* this avoids a loop in nfnetlink. */
	520	return ret == -EAGAIN ? -ENOBUFS : ret;
	521	err:
	522	nf_ct_l4proto_put(l4proto);
	523	return err;
	524	}
	525
24de58f4	526	#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
19576c94 PN	527	static struct ctnl_timeout *
19576c94 PN	528	ctnl_timeout_find_get(struct net net, const char name)
24de58f4 PNA	529	{
	530	struct ctnl_timeout timeout, matching = NULL;
	531
	532	rcu_read_lock();
19576c94	533	list_for_each_entry_rcu(timeout, &net->nfct_timeout_list, head) {
24de58f4 PNA	534	if (strncmp(timeout->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
	535	continue;
	536
	537	if (!try_module_get(THIS_MODULE))
	538	goto err;
	539
b54ab92b	540	if (!refcount_inc_not_zero(&timeout->refcnt)) {
24de58f4 PNA	541	module_put(THIS_MODULE);
	542	goto err;
	543	}
	544	matching = timeout;
	545	break;
	546	}
	547	err:
	548	rcu_read_unlock();
	549	return matching;
	550	}
	551
	552	static void ctnl_timeout_put(struct ctnl_timeout *timeout)
	553	{
b54ab92b	554	if (refcount_dec_and_test(&timeout->refcnt))
b75911b6 LZ	555	kfree_rcu(timeout, rcu_head);
b75911b6 LZ	556
24de58f4 PNA	557	module_put(THIS_MODULE);
	558	}
	559	#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
	560
50978462 PNA	561	static const struct nfnl_callback cttimeout_cb[IPCTNL_MSG_TIMEOUT_MAX] = {
	562	[IPCTNL_MSG_TIMEOUT_NEW] = { .call = cttimeout_new_timeout,
	563	.attr_count = CTA_TIMEOUT_MAX,
	564	.policy = cttimeout_nla_policy },
	565	[IPCTNL_MSG_TIMEOUT_GET] = { .call = cttimeout_get_timeout,
	566	.attr_count = CTA_TIMEOUT_MAX,
	567	.policy = cttimeout_nla_policy },
	568	[IPCTNL_MSG_TIMEOUT_DELETE] = { .call = cttimeout_del_timeout,
	569	.attr_count = CTA_TIMEOUT_MAX,
	570	.policy = cttimeout_nla_policy },
91cb498e PNA	571	[IPCTNL_MSG_TIMEOUT_DEFAULT_SET]= { .call = cttimeout_default_set,
	572	.attr_count = CTA_TIMEOUT_MAX,
	573	.policy = cttimeout_nla_policy },
	574	[IPCTNL_MSG_TIMEOUT_DEFAULT_GET]= { .call = cttimeout_default_get,
	575	.attr_count = CTA_TIMEOUT_MAX,
	576	.policy = cttimeout_nla_policy },
50978462 PNA	577	};
	578
	579	static const struct nfnetlink_subsystem cttimeout_subsys = {
	580	.name = "conntrack_timeout",
	581	.subsys_id = NFNL_SUBSYS_CTNETLINK_TIMEOUT,
	582	.cb_count = IPCTNL_MSG_TIMEOUT_MAX,
	583	.cb = cttimeout_cb,
	584	};
	585
	586	MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_TIMEOUT);
	587
19576c94 PN	588	static int __net_init cttimeout_net_init(struct net *net)
	589	{
	590	INIT_LIST_HEAD(&net->nfct_timeout_list);
	591
	592	return 0;
	593	}
	594
	595	static void __net_exit cttimeout_net_exit(struct net *net)
	596	{
	597	struct ctnl_timeout cur, tmp;
	598
	599	ctnl_untimeout(net, NULL);
	600
	601	list_for_each_entry_safe(cur, tmp, &net->nfct_timeout_list, head) {
	602	list_del_rcu(&cur->head);
	603	nf_ct_l4proto_put(cur->l4proto);
b75911b6	604
b54ab92b	605	if (refcount_dec_and_test(&cur->refcnt))
b75911b6	606	kfree_rcu(cur, rcu_head);
19576c94 PN	607	}
	608	}
	609
	610	static struct pernet_operations cttimeout_ops = {
	611	.init = cttimeout_net_init,
	612	.exit = cttimeout_net_exit,
	613	};
	614
50978462 PNA	615	static int __init cttimeout_init(void)
	616	{
	617	int ret;
	618
19576c94 PN	619	ret = register_pernet_subsys(&cttimeout_ops);
	620	if (ret < 0)
	621	return ret;
	622
50978462 PNA	623	ret = nfnetlink_subsys_register(&cttimeout_subsys);
	624	if (ret < 0) {
	625	pr_err("cttimeout_init: cannot register cttimeout with "
	626	"nfnetlink.\n");
	627	goto err_out;
	628	}
24de58f4 PNA	629	#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
	630	RCU_INIT_POINTER(nf_ct_timeout_find_get_hook, ctnl_timeout_find_get);
	631	RCU_INIT_POINTER(nf_ct_timeout_put_hook, ctnl_timeout_put);
	632	#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
50978462 PNA	633	return 0;
	634
	635	err_out:
19576c94	636	unregister_pernet_subsys(&cttimeout_ops);
50978462 PNA	637	return ret;
	638	}
	639
	640	static void __exit cttimeout_exit(void)
	641	{
50978462 PNA	642	pr_info("cttimeout: unregistering from nfnetlink.\n");
	643
	644	nfnetlink_subsys_unregister(&cttimeout_subsys);
ae2d708e	645
19576c94	646	unregister_pernet_subsys(&cttimeout_ops);
24de58f4 PNA	647	#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
	648	RCU_INIT_POINTER(nf_ct_timeout_find_get_hook, NULL);
	649	RCU_INIT_POINTER(nf_ct_timeout_put_hook, NULL);
3b7dabf0	650	synchronize_rcu();
24de58f4	651	#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
50978462 PNA	652	}
	653
	654	module_init(cttimeout_init);
	655	module_exit(cttimeout_exit);