git.oblomov.eu Git - linux-2.6/blob - net/netfilter/nf_conntrack_core.c

   1 /* Connection state tracking for netfilter.  This is separated from,
   2    but required by, the NAT layer; it can also be used by an iptables
   3    extension. */
   4
   5 /* (C) 1999-2001 Paul `Rusty' Russell
   6  * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
   7  * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
   8  *
   9  * This program is free software; you can redistribute it and/or modify
  10  * it under the terms of the GNU General Public License version 2 as
  11  * published by the Free Software Foundation.
  12  */
  13
  14 #include <linux/types.h>
  15 #include <linux/netfilter.h>
  16 #include <linux/module.h>
  17 #include <linux/skbuff.h>
  18 #include <linux/proc_fs.h>
  19 #include <linux/vmalloc.h>
  20 #include <linux/stddef.h>
  21 #include <linux/slab.h>
  22 #include <linux/random.h>
  23 #include <linux/jhash.h>
  24 #include <linux/err.h>
  25 #include <linux/percpu.h>
  26 #include <linux/moduleparam.h>
  27 #include <linux/notifier.h>
  28 #include <linux/kernel.h>
  29 #include <linux/netdevice.h>
  30 #include <linux/socket.h>
  31 #include <linux/mm.h>
  32
  33 #include <net/netfilter/nf_conntrack.h>
  34 #include <net/netfilter/nf_conntrack_l3proto.h>
  35 #include <net/netfilter/nf_conntrack_l4proto.h>
  36 #include <net/netfilter/nf_conntrack_expect.h>
  37 #include <net/netfilter/nf_conntrack_helper.h>
  38 #include <net/netfilter/nf_conntrack_core.h>
  39
  40 #define NF_CONNTRACK_VERSION    "0.5.0"
  41
  42 #if 0
  43 #define DEBUGP printk
  44 #else
  45 #define DEBUGP(format, args...)
  46 #endif
  47
  48 DEFINE_RWLOCK(nf_conntrack_lock);
  49 EXPORT_SYMBOL_GPL(nf_conntrack_lock);
  50
  51 /* nf_conntrack_standalone needs this */
  52 atomic_t nf_conntrack_count = ATOMIC_INIT(0);
  53 EXPORT_SYMBOL_GPL(nf_conntrack_count);
  54
  55 void (*nf_conntrack_destroyed)(struct nf_conn *conntrack);
  56 EXPORT_SYMBOL_GPL(nf_conntrack_destroyed);
  57
  58 unsigned int nf_conntrack_htable_size __read_mostly;
  59 EXPORT_SYMBOL_GPL(nf_conntrack_htable_size);
  60
  61 int nf_conntrack_max __read_mostly;
  62 EXPORT_SYMBOL_GPL(nf_conntrack_max);
  63
  64 struct list_head *nf_conntrack_hash __read_mostly;
  65 EXPORT_SYMBOL_GPL(nf_conntrack_hash);
  66
  67 struct nf_conn nf_conntrack_untracked __read_mostly;
  68 EXPORT_SYMBOL_GPL(nf_conntrack_untracked);
  69
  70 unsigned int nf_ct_log_invalid __read_mostly;
  71 LIST_HEAD(unconfirmed);
  72 static int nf_conntrack_vmalloc __read_mostly;
  73
  74 static unsigned int nf_conntrack_next_id;
  75
  76 DEFINE_PER_CPU(struct ip_conntrack_stat, nf_conntrack_stat);
  77 EXPORT_PER_CPU_SYMBOL(nf_conntrack_stat);
  78
  79 /*
  80  * This scheme offers various size of "struct nf_conn" dependent on
  81  * features(helper, nat, ...)
  82  */
  83
  84 #define NF_CT_FEATURES_NAMELEN  256
  85 static struct {
  86         /* name of slab cache. printed in /proc/slabinfo */
  87         char *name;
  88
  89         /* size of slab cache */
  90         size_t size;
  91
  92         /* slab cache pointer */
  93         struct kmem_cache *cachep;
  94
  95         /* allocated slab cache + modules which uses this slab cache */
  96         int use;
  97
  98 } nf_ct_cache[NF_CT_F_NUM];
  99
 100 /* protect members of nf_ct_cache except of "use" */
 101 DEFINE_RWLOCK(nf_ct_cache_lock);
 102
 103 /* This avoids calling kmem_cache_create() with same name simultaneously */
 104 static DEFINE_MUTEX(nf_ct_cache_mutex);
 105
 106 static int nf_conntrack_hash_rnd_initted;
 107 static unsigned int nf_conntrack_hash_rnd;
 108
 109 static u_int32_t __hash_conntrack(const struct nf_conntrack_tuple *tuple,
 110                                   unsigned int size, unsigned int rnd)
 111 {
 112         unsigned int a, b;
 113
 114         a = jhash2(tuple->src.u3.all, ARRAY_SIZE(tuple->src.u3.all),
 115                    (tuple->src.l3num << 16) | tuple->dst.protonum);
 116         b = jhash2(tuple->dst.u3.all, ARRAY_SIZE(tuple->dst.u3.all),
 117                    (tuple->src.u.all << 16) | tuple->dst.u.all);
 118
 119         return jhash_2words(a, b, rnd) % size;
 120 }
 121
 122 static inline u_int32_t hash_conntrack(const struct nf_conntrack_tuple *tuple)
 123 {
 124         return __hash_conntrack(tuple, nf_conntrack_htable_size,
 125                                 nf_conntrack_hash_rnd);
 126 }
 127
 128 int nf_conntrack_register_cache(u_int32_t features, const char *name,
 129                                 size_t size)
 130 {
 131         int ret = 0;
 132         char *cache_name;
 133         struct kmem_cache *cachep;
 134
 135         DEBUGP("nf_conntrack_register_cache: features=0x%x, name=%s, size=%d\n",
 136                features, name, size);
 137
 138         if (features < NF_CT_F_BASIC || features >= NF_CT_F_NUM) {
 139                 DEBUGP("nf_conntrack_register_cache: invalid features.: 0x%x\n",
 140                         features);
 141                 return -EINVAL;
 142         }
 143
 144         mutex_lock(&nf_ct_cache_mutex);
 145
 146         write_lock_bh(&nf_ct_cache_lock);
 147         /* e.g: multiple helpers are loaded */
 148         if (nf_ct_cache[features].use > 0) {
 149                 DEBUGP("nf_conntrack_register_cache: already resisterd.\n");
 150                 if ((!strncmp(nf_ct_cache[features].name, name,
 151                               NF_CT_FEATURES_NAMELEN))
 152                     && nf_ct_cache[features].size == size) {
 153                         DEBUGP("nf_conntrack_register_cache: reusing.\n");
 154                         nf_ct_cache[features].use++;
 155                         ret = 0;
 156                 } else
 157                         ret = -EBUSY;
 158
 159                 write_unlock_bh(&nf_ct_cache_lock);
 160                 mutex_unlock(&nf_ct_cache_mutex);
 161                 return ret;
 162         }
 163         write_unlock_bh(&nf_ct_cache_lock);
 164
 165         /*
 166          * The memory space for name of slab cache must be alive until
 167          * cache is destroyed.
 168          */
 169         cache_name = kmalloc(sizeof(char)*NF_CT_FEATURES_NAMELEN, GFP_ATOMIC);
 170         if (cache_name == NULL) {
 171                 DEBUGP("nf_conntrack_register_cache: can't alloc cache_name\n");
 172                 ret = -ENOMEM;
 173                 goto out_up_mutex;
 174         }
 175
 176         if (strlcpy(cache_name, name, NF_CT_FEATURES_NAMELEN)
 177                                                 >= NF_CT_FEATURES_NAMELEN) {
 178                 printk("nf_conntrack_register_cache: name too long\n");
 179                 ret = -EINVAL;
 180                 goto out_free_name;
 181         }
 182
 183         cachep = kmem_cache_create(cache_name, size, 0, 0,
 184                                    NULL, NULL);
 185         if (!cachep) {
 186                 printk("nf_conntrack_register_cache: Can't create slab cache "
 187                        "for the features = 0x%x\n", features);
 188                 ret = -ENOMEM;
 189                 goto out_free_name;
 190         }
 191
 192         write_lock_bh(&nf_ct_cache_lock);
 193         nf_ct_cache[features].use = 1;
 194         nf_ct_cache[features].size = size;
 195         nf_ct_cache[features].cachep = cachep;
 196         nf_ct_cache[features].name = cache_name;
 197         write_unlock_bh(&nf_ct_cache_lock);
 198
 199         goto out_up_mutex;
 200
 201 out_free_name:
 202         kfree(cache_name);
 203 out_up_mutex:
 204         mutex_unlock(&nf_ct_cache_mutex);
 205         return ret;
 206 }
 207 EXPORT_SYMBOL_GPL(nf_conntrack_register_cache);
 208
 209 /* FIXME: In the current, only nf_conntrack_cleanup() can call this function. */
 210 void nf_conntrack_unregister_cache(u_int32_t features)
 211 {
 212         struct kmem_cache *cachep;
 213         char *name;
 214
 215         /*
 216          * This assures that kmem_cache_create() isn't called before destroying
 217          * slab cache.
 218          */
 219         DEBUGP("nf_conntrack_unregister_cache: 0x%04x\n", features);
 220         mutex_lock(&nf_ct_cache_mutex);
 221
 222         write_lock_bh(&nf_ct_cache_lock);
 223         if (--nf_ct_cache[features].use > 0) {
 224                 write_unlock_bh(&nf_ct_cache_lock);
 225                 mutex_unlock(&nf_ct_cache_mutex);
 226                 return;
 227         }
 228         cachep = nf_ct_cache[features].cachep;
 229         name = nf_ct_cache[features].name;
 230         nf_ct_cache[features].cachep = NULL;
 231         nf_ct_cache[features].name = NULL;
 232         nf_ct_cache[features].size = 0;
 233         write_unlock_bh(&nf_ct_cache_lock);
 234
 235         synchronize_net();
 236
 237         kmem_cache_destroy(cachep);
 238         kfree(name);
 239
 240         mutex_unlock(&nf_ct_cache_mutex);
 241 }
 242 EXPORT_SYMBOL_GPL(nf_conntrack_unregister_cache);
 243
 244 int
 245 nf_ct_get_tuple(const struct sk_buff *skb,
 246                 unsigned int nhoff,
 247                 unsigned int dataoff,
 248                 u_int16_t l3num,
 249                 u_int8_t protonum,
 250                 struct nf_conntrack_tuple *tuple,
 251                 const struct nf_conntrack_l3proto *l3proto,
 252                 const struct nf_conntrack_l4proto *l4proto)
 253 {
 254         NF_CT_TUPLE_U_BLANK(tuple);
 255
 256         tuple->src.l3num = l3num;
 257         if (l3proto->pkt_to_tuple(skb, nhoff, tuple) == 0)
 258                 return 0;
 259
 260         tuple->dst.protonum = protonum;
 261         tuple->dst.dir = IP_CT_DIR_ORIGINAL;
 262
 263         return l4proto->pkt_to_tuple(skb, dataoff, tuple);
 264 }
 265 EXPORT_SYMBOL_GPL(nf_ct_get_tuple);
 266
 267 int
 268 nf_ct_invert_tuple(struct nf_conntrack_tuple *inverse,
 269                    const struct nf_conntrack_tuple *orig,
 270                    const struct nf_conntrack_l3proto *l3proto,
 271                    const struct nf_conntrack_l4proto *l4proto)
 272 {
 273         NF_CT_TUPLE_U_BLANK(inverse);
 274
 275         inverse->src.l3num = orig->src.l3num;
 276         if (l3proto->invert_tuple(inverse, orig) == 0)
 277                 return 0;
 278
 279         inverse->dst.dir = !orig->dst.dir;
 280
 281         inverse->dst.protonum = orig->dst.protonum;
 282         return l4proto->invert_tuple(inverse, orig);
 283 }
 284 EXPORT_SYMBOL_GPL(nf_ct_invert_tuple);
 285
 286 static void
 287 clean_from_lists(struct nf_conn *ct)
 288 {
 289         DEBUGP("clean_from_lists(%p)\n", ct);
 290         list_del(&ct->tuplehash[IP_CT_DIR_ORIGINAL].list);
 291         list_del(&ct->tuplehash[IP_CT_DIR_REPLY].list);
 292
 293         /* Destroy all pending expectations */
 294         nf_ct_remove_expectations(ct);
 295 }
 296
 297 static void
 298 destroy_conntrack(struct nf_conntrack *nfct)
 299 {
 300         struct nf_conn *ct = (struct nf_conn *)nfct;
 301         struct nf_conntrack_l4proto *l4proto;
 302         typeof(nf_conntrack_destroyed) destroyed;
 303
 304         DEBUGP("destroy_conntrack(%p)\n", ct);
 305         NF_CT_ASSERT(atomic_read(&nfct->use) == 0);
 306         NF_CT_ASSERT(!timer_pending(&ct->timeout));
 307
 308         nf_conntrack_event(IPCT_DESTROY, ct);
 309         set_bit(IPS_DYING_BIT, &ct->status);
 310
 311         /* To make sure we don't get any weird locking issues here:
 312          * destroy_conntrack() MUST NOT be called with a write lock
 313          * to nf_conntrack_lock!!! -HW */
 314         rcu_read_lock();
 315         l4proto = __nf_ct_l4proto_find(ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.l3num,
 316                                        ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.protonum);
 317         if (l4proto && l4proto->destroy)
 318                 l4proto->destroy(ct);
 319
 320         destroyed = rcu_dereference(nf_conntrack_destroyed);
 321         if (destroyed)
 322                 destroyed(ct);
 323
 324         rcu_read_unlock();
 325
 326         write_lock_bh(&nf_conntrack_lock);
 327         /* Expectations will have been removed in clean_from_lists,
 328          * except TFTP can create an expectation on the first packet,
 329          * before connection is in the list, so we need to clean here,
 330          * too. */
 331         nf_ct_remove_expectations(ct);
 332
 333         /* We overload first tuple to link into unconfirmed list. */
 334         if (!nf_ct_is_confirmed(ct)) {
 335                 BUG_ON(list_empty(&ct->tuplehash[IP_CT_DIR_ORIGINAL].list));
 336                 list_del(&ct->tuplehash[IP_CT_DIR_ORIGINAL].list);
 337         }
 338
 339         NF_CT_STAT_INC(delete);
 340         write_unlock_bh(&nf_conntrack_lock);
 341
 342         if (ct->master)
 343                 nf_ct_put(ct->master);
 344
 345         DEBUGP("destroy_conntrack: returning ct=%p to slab\n", ct);
 346         nf_conntrack_free(ct);
 347 }
 348
 349 static void death_by_timeout(unsigned long ul_conntrack)
 350 {
 351         struct nf_conn *ct = (void *)ul_conntrack;
 352         struct nf_conn_help *help = nfct_help(ct);
 353         struct nf_conntrack_helper *helper;
 354
 355         if (help) {
 356                 rcu_read_lock();
 357                 helper = rcu_dereference(help->helper);
 358                 if (helper && helper->destroy)
 359                         helper->destroy(ct);
 360                 rcu_read_unlock();
 361         }
 362
 363         write_lock_bh(&nf_conntrack_lock);
 364         /* Inside lock so preempt is disabled on module removal path.
 365          * Otherwise we can get spurious warnings. */
 366         NF_CT_STAT_INC(delete_list);
 367         clean_from_lists(ct);
 368         write_unlock_bh(&nf_conntrack_lock);
 369         nf_ct_put(ct);
 370 }
 371
 372 struct nf_conntrack_tuple_hash *
 373 __nf_conntrack_find(const struct nf_conntrack_tuple *tuple,
 374                     const struct nf_conn *ignored_conntrack)
 375 {
 376         struct nf_conntrack_tuple_hash *h;
 377         unsigned int hash = hash_conntrack(tuple);
 378
 379         list_for_each_entry(h, &nf_conntrack_hash[hash], list) {
 380                 if (nf_ct_tuplehash_to_ctrack(h) != ignored_conntrack &&
 381                     nf_ct_tuple_equal(tuple, &h->tuple)) {
 382                         NF_CT_STAT_INC(found);
 383                         return h;
 384                 }
 385                 NF_CT_STAT_INC(searched);
 386         }
 387
 388         return NULL;
 389 }
 390 EXPORT_SYMBOL_GPL(__nf_conntrack_find);
 391
 392 /* Find a connection corresponding to a tuple. */
 393 struct nf_conntrack_tuple_hash *
 394 nf_conntrack_find_get(const struct nf_conntrack_tuple *tuple,
 395                       const struct nf_conn *ignored_conntrack)
 396 {
 397         struct nf_conntrack_tuple_hash *h;
 398
 399         read_lock_bh(&nf_conntrack_lock);
 400         h = __nf_conntrack_find(tuple, ignored_conntrack);
 401         if (h)
 402                 atomic_inc(&nf_ct_tuplehash_to_ctrack(h)->ct_general.use);
 403         read_unlock_bh(&nf_conntrack_lock);
 404
 405         return h;
 406 }
 407 EXPORT_SYMBOL_GPL(nf_conntrack_find_get);
 408
 409 static void __nf_conntrack_hash_insert(struct nf_conn *ct,
 410                                        unsigned int hash,
 411                                        unsigned int repl_hash)
 412 {
 413         ct->id = ++nf_conntrack_next_id;
 414         list_add(&ct->tuplehash[IP_CT_DIR_ORIGINAL].list,
 415                  &nf_conntrack_hash[hash]);
 416         list_add(&ct->tuplehash[IP_CT_DIR_REPLY].list,
 417                  &nf_conntrack_hash[repl_hash]);
 418 }
 419
 420 void nf_conntrack_hash_insert(struct nf_conn *ct)
 421 {
 422         unsigned int hash, repl_hash;
 423
 424         hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
 425         repl_hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
 426
 427         write_lock_bh(&nf_conntrack_lock);
 428         __nf_conntrack_hash_insert(ct, hash, repl_hash);
 429         write_unlock_bh(&nf_conntrack_lock);
 430 }
 431 EXPORT_SYMBOL_GPL(nf_conntrack_hash_insert);
 432
 433 /* Confirm a connection given skb; places it in hash table */
 434 int
 435 __nf_conntrack_confirm(struct sk_buff **pskb)
 436 {
 437         unsigned int hash, repl_hash;
 438         struct nf_conntrack_tuple_hash *h;
 439         struct nf_conn *ct;
 440         struct nf_conn_help *help;
 441         enum ip_conntrack_info ctinfo;
 442
 443         ct = nf_ct_get(*pskb, &ctinfo);
 444
 445         /* ipt_REJECT uses nf_conntrack_attach to attach related
 446            ICMP/TCP RST packets in other direction.  Actual packet
 447            which created connection will be IP_CT_NEW or for an
 448            expected connection, IP_CT_RELATED. */
 449         if (CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL)
 450                 return NF_ACCEPT;
 451
 452         hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
 453         repl_hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
 454
 455         /* We're not in hash table, and we refuse to set up related
 456            connections for unconfirmed conns.  But packet copies and
 457            REJECT will give spurious warnings here. */
 458         /* NF_CT_ASSERT(atomic_read(&ct->ct_general.use) == 1); */
 459
 460         /* No external references means noone else could have
 461            confirmed us. */
 462         NF_CT_ASSERT(!nf_ct_is_confirmed(ct));
 463         DEBUGP("Confirming conntrack %p\n", ct);
 464
 465         write_lock_bh(&nf_conntrack_lock);
 466
 467         /* See if there's one in the list already, including reverse:
 468            NAT could have grabbed it without realizing, since we're
 469            not in the hash.  If there is, we lost race. */
 470         list_for_each_entry(h, &nf_conntrack_hash[hash], list)
 471                 if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
 472                                       &h->tuple))
 473                         goto out;
 474         list_for_each_entry(h, &nf_conntrack_hash[repl_hash], list)
 475                 if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_REPLY].tuple,
 476                                       &h->tuple))
 477                         goto out;
 478
 479         /* Remove from unconfirmed list */
 480         list_del(&ct->tuplehash[IP_CT_DIR_ORIGINAL].list);
 481
 482         __nf_conntrack_hash_insert(ct, hash, repl_hash);
 483         /* Timer relative to confirmation time, not original
 484            setting time, otherwise we'd get timer wrap in
 485            weird delay cases. */
 486         ct->timeout.expires += jiffies;
 487         add_timer(&ct->timeout);
 488         atomic_inc(&ct->ct_general.use);
 489         set_bit(IPS_CONFIRMED_BIT, &ct->status);
 490         NF_CT_STAT_INC(insert);
 491         write_unlock_bh(&nf_conntrack_lock);
 492         help = nfct_help(ct);
 493         if (help && help->helper)
 494                 nf_conntrack_event_cache(IPCT_HELPER, *pskb);
 495 #ifdef CONFIG_NF_NAT_NEEDED
 496         if (test_bit(IPS_SRC_NAT_DONE_BIT, &ct->status) ||
 497             test_bit(IPS_DST_NAT_DONE_BIT, &ct->status))
 498                 nf_conntrack_event_cache(IPCT_NATINFO, *pskb);
 499 #endif
 500         nf_conntrack_event_cache(master_ct(ct) ?
 501                                  IPCT_RELATED : IPCT_NEW, *pskb);
 502         return NF_ACCEPT;
 503
 504 out:
 505         NF_CT_STAT_INC(insert_failed);
 506         write_unlock_bh(&nf_conntrack_lock);
 507         return NF_DROP;
 508 }
 509 EXPORT_SYMBOL_GPL(__nf_conntrack_confirm);
 510
 511 /* Returns true if a connection correspondings to the tuple (required
 512    for NAT). */
 513 int
 514 nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
 515                          const struct nf_conn *ignored_conntrack)
 516 {
 517         struct nf_conntrack_tuple_hash *h;
 518
 519         read_lock_bh(&nf_conntrack_lock);
 520         h = __nf_conntrack_find(tuple, ignored_conntrack);
 521         read_unlock_bh(&nf_conntrack_lock);
 522
 523         return h != NULL;
 524 }
 525 EXPORT_SYMBOL_GPL(nf_conntrack_tuple_taken);
 526
 527 /* There's a small race here where we may free a just-assured
 528    connection.  Too bad: we're in trouble anyway. */
 529 static int early_drop(struct list_head *chain)
 530 {
 531         /* Traverse backwards: gives us oldest, which is roughly LRU */
 532         struct nf_conntrack_tuple_hash *h;
 533         struct nf_conn *ct = NULL, *tmp;
 534         int dropped = 0;
 535
 536         read_lock_bh(&nf_conntrack_lock);
 537         list_for_each_entry_reverse(h, chain, list) {
 538                 tmp = nf_ct_tuplehash_to_ctrack(h);
 539                 if (!test_bit(IPS_ASSURED_BIT, &tmp->status)) {
 540                         ct = tmp;
 541                         atomic_inc(&ct->ct_general.use);
 542                         break;
 543                 }
 544         }
 545         read_unlock_bh(&nf_conntrack_lock);
 546
 547         if (!ct)
 548                 return dropped;
 549
 550         if (del_timer(&ct->timeout)) {
 551                 death_by_timeout((unsigned long)ct);
 552                 dropped = 1;
 553                 NF_CT_STAT_INC_ATOMIC(early_drop);
 554         }
 555         nf_ct_put(ct);
 556         return dropped;
 557 }
 558
 559 static struct nf_conn *
 560 __nf_conntrack_alloc(const struct nf_conntrack_tuple *orig,
 561                      const struct nf_conntrack_tuple *repl,
 562                      const struct nf_conntrack_l3proto *l3proto,
 563                      u_int32_t features)
 564 {
 565         struct nf_conn *conntrack = NULL;
 566         struct nf_conntrack_helper *helper;
 567
 568         if (unlikely(!nf_conntrack_hash_rnd_initted)) {
 569                 get_random_bytes(&nf_conntrack_hash_rnd, 4);
 570                 nf_conntrack_hash_rnd_initted = 1;
 571         }
 572
 573         /* We don't want any race condition at early drop stage */
 574         atomic_inc(&nf_conntrack_count);
 575
 576         if (nf_conntrack_max
 577             && atomic_read(&nf_conntrack_count) > nf_conntrack_max) {
 578                 unsigned int hash = hash_conntrack(orig);
 579                 /* Try dropping from this hash chain. */
 580                 if (!early_drop(&nf_conntrack_hash[hash])) {
 581                         atomic_dec(&nf_conntrack_count);
 582                         if (net_ratelimit())
 583                                 printk(KERN_WARNING
 584                                        "nf_conntrack: table full, dropping"
 585                                        " packet.\n");
 586                         return ERR_PTR(-ENOMEM);
 587                 }
 588         }
 589
 590         /*  find features needed by this conntrack. */
 591         features |= l3proto->get_features(orig);
 592
 593         /* FIXME: protect helper list per RCU */
 594         read_lock_bh(&nf_conntrack_lock);
 595         helper = __nf_ct_helper_find(repl);
 596         /* NAT might want to assign a helper later */
 597         if (helper || features & NF_CT_F_NAT)
 598                 features |= NF_CT_F_HELP;
 599         read_unlock_bh(&nf_conntrack_lock);
 600
 601         DEBUGP("nf_conntrack_alloc: features=0x%x\n", features);
 602
 603         read_lock_bh(&nf_ct_cache_lock);
 604
 605         if (unlikely(!nf_ct_cache[features].use)) {
 606                 DEBUGP("nf_conntrack_alloc: not supported features = 0x%x\n",
 607                         features);
 608                 goto out;
 609         }
 610
 611         conntrack = kmem_cache_alloc(nf_ct_cache[features].cachep, GFP_ATOMIC);
 612         if (conntrack == NULL) {
 613                 DEBUGP("nf_conntrack_alloc: Can't alloc conntrack from cache\n");
 614                 goto out;
 615         }
 616
 617         memset(conntrack, 0, nf_ct_cache[features].size);
 618         conntrack->features = features;
 619         atomic_set(&conntrack->ct_general.use, 1);
 620         conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple = *orig;
 621         conntrack->tuplehash[IP_CT_DIR_REPLY].tuple = *repl;
 622         /* Don't set timer yet: wait for confirmation */
 623         setup_timer(&conntrack->timeout, death_by_timeout,
 624                     (unsigned long)conntrack);
 625         read_unlock_bh(&nf_ct_cache_lock);
 626
 627         return conntrack;
 628 out:
 629         read_unlock_bh(&nf_ct_cache_lock);
 630         atomic_dec(&nf_conntrack_count);
 631         return conntrack;
 632 }
 633
 634 struct nf_conn *nf_conntrack_alloc(const struct nf_conntrack_tuple *orig,
 635                                    const struct nf_conntrack_tuple *repl)
 636 {
 637         struct nf_conntrack_l3proto *l3proto;
 638         struct nf_conn *ct;
 639
 640         rcu_read_lock();
 641         l3proto = __nf_ct_l3proto_find(orig->src.l3num);
 642         ct = __nf_conntrack_alloc(orig, repl, l3proto, 0);
 643         rcu_read_unlock();
 644
 645         return ct;
 646 }
 647 EXPORT_SYMBOL_GPL(nf_conntrack_alloc);
 648
 649 void nf_conntrack_free(struct nf_conn *conntrack)
 650 {
 651         u_int32_t features = conntrack->features;
 652         NF_CT_ASSERT(features >= NF_CT_F_BASIC && features < NF_CT_F_NUM);
 653         DEBUGP("nf_conntrack_free: features = 0x%x, conntrack=%p\n", features,
 654                conntrack);
 655         kmem_cache_free(nf_ct_cache[features].cachep, conntrack);
 656         atomic_dec(&nf_conntrack_count);
 657 }
 658 EXPORT_SYMBOL_GPL(nf_conntrack_free);
 659
 660 /* Allocate a new conntrack: we return -ENOMEM if classification
 661    failed due to stress.  Otherwise it really is unclassifiable. */
 662 static struct nf_conntrack_tuple_hash *
 663 init_conntrack(const struct nf_conntrack_tuple *tuple,
 664                struct nf_conntrack_l3proto *l3proto,
 665                struct nf_conntrack_l4proto *l4proto,
 666                struct sk_buff *skb,
 667                unsigned int dataoff)
 668 {
 669         struct nf_conn *conntrack;
 670         struct nf_conn_help *help;
 671         struct nf_conntrack_tuple repl_tuple;
 672         struct nf_conntrack_expect *exp;
 673         u_int32_t features = 0;
 674
 675         if (!nf_ct_invert_tuple(&repl_tuple, tuple, l3proto, l4proto)) {
 676                 DEBUGP("Can't invert tuple.\n");
 677                 return NULL;
 678         }
 679
 680         read_lock_bh(&nf_conntrack_lock);
 681         exp = __nf_conntrack_expect_find(tuple);
 682         if (exp && exp->helper)
 683                 features = NF_CT_F_HELP;
 684         read_unlock_bh(&nf_conntrack_lock);
 685
 686         conntrack = __nf_conntrack_alloc(tuple, &repl_tuple, l3proto, features);
 687         if (conntrack == NULL || IS_ERR(conntrack)) {
 688                 DEBUGP("Can't allocate conntrack.\n");
 689                 return (struct nf_conntrack_tuple_hash *)conntrack;
 690         }
 691
 692         if (!l4proto->new(conntrack, skb, dataoff)) {
 693                 nf_conntrack_free(conntrack);
 694                 DEBUGP("init conntrack: can't track with proto module\n");
 695                 return NULL;
 696         }
 697
 698         write_lock_bh(&nf_conntrack_lock);
 699         exp = find_expectation(tuple);
 700
 701         help = nfct_help(conntrack);
 702         if (exp) {
 703                 DEBUGP("conntrack: expectation arrives ct=%p exp=%p\n",
 704                         conntrack, exp);
 705                 /* Welcome, Mr. Bond.  We've been expecting you... */
 706                 __set_bit(IPS_EXPECTED_BIT, &conntrack->status);
 707                 conntrack->master = exp->master;
 708                 if (exp->helper)
 709                         rcu_assign_pointer(help->helper, exp->helper);
 710 #ifdef CONFIG_NF_CONNTRACK_MARK
 711                 conntrack->mark = exp->master->mark;
 712 #endif
 713 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 714                 conntrack->secmark = exp->master->secmark;
 715 #endif
 716                 nf_conntrack_get(&conntrack->master->ct_general);
 717                 NF_CT_STAT_INC(expect_new);
 718         } else {
 719                 if (help) {
 720                         /* not in hash table yet, so not strictly necessary */
 721                         rcu_assign_pointer(help->helper,
 722                                            __nf_ct_helper_find(&repl_tuple));
 723                 }
 724                 NF_CT_STAT_INC(new);
 725         }
 726
 727         /* Overload tuple linked list to put us in unconfirmed list. */
 728         list_add(&conntrack->tuplehash[IP_CT_DIR_ORIGINAL].list, &unconfirmed);
 729
 730         write_unlock_bh(&nf_conntrack_lock);
 731
 732         if (exp) {
 733                 if (exp->expectfn)
 734                         exp->expectfn(conntrack, exp);
 735                 nf_conntrack_expect_put(exp);
 736         }
 737
 738         return &conntrack->tuplehash[IP_CT_DIR_ORIGINAL];
 739 }
 740
 741 /* On success, returns conntrack ptr, sets skb->nfct and ctinfo */
 742 static inline struct nf_conn *
 743 resolve_normal_ct(struct sk_buff *skb,
 744                   unsigned int dataoff,
 745                   u_int16_t l3num,
 746                   u_int8_t protonum,
 747                   struct nf_conntrack_l3proto *l3proto,
 748                   struct nf_conntrack_l4proto *l4proto,
 749                   int *set_reply,
 750                   enum ip_conntrack_info *ctinfo)
 751 {
 752         struct nf_conntrack_tuple tuple;
 753         struct nf_conntrack_tuple_hash *h;
 754         struct nf_conn *ct;
 755
 756         if (!nf_ct_get_tuple(skb, skb_network_offset(skb),
 757                              dataoff, l3num, protonum, &tuple, l3proto,
 758                              l4proto)) {
 759                 DEBUGP("resolve_normal_ct: Can't get tuple\n");
 760                 return NULL;
 761         }
 762
 763         /* look for tuple match */
 764         h = nf_conntrack_find_get(&tuple, NULL);
 765         if (!h) {
 766                 h = init_conntrack(&tuple, l3proto, l4proto, skb, dataoff);
 767                 if (!h)
 768                         return NULL;
 769                 if (IS_ERR(h))
 770                         return (void *)h;
 771         }
 772         ct = nf_ct_tuplehash_to_ctrack(h);
 773
 774         /* It exists; we have (non-exclusive) reference. */
 775         if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY) {
 776                 *ctinfo = IP_CT_ESTABLISHED + IP_CT_IS_REPLY;
 777                 /* Please set reply bit if this packet OK */
 778                 *set_reply = 1;
 779         } else {
 780                 /* Once we've had two way comms, always ESTABLISHED. */
 781                 if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
 782                         DEBUGP("nf_conntrack_in: normal packet for %p\n", ct);
 783                         *ctinfo = IP_CT_ESTABLISHED;
 784                 } else if (test_bit(IPS_EXPECTED_BIT, &ct->status)) {
 785                         DEBUGP("nf_conntrack_in: related packet for %p\n", ct);
 786                         *ctinfo = IP_CT_RELATED;
 787                 } else {
 788                         DEBUGP("nf_conntrack_in: new packet for %p\n", ct);
 789                         *ctinfo = IP_CT_NEW;
 790                 }
 791                 *set_reply = 0;
 792         }
 793         skb->nfct = &ct->ct_general;
 794         skb->nfctinfo = *ctinfo;
 795         return ct;
 796 }
 797
 798 unsigned int
 799 nf_conntrack_in(int pf, unsigned int hooknum, struct sk_buff **pskb)
 800 {
 801         struct nf_conn *ct;
 802         enum ip_conntrack_info ctinfo;
 803         struct nf_conntrack_l3proto *l3proto;
 804         struct nf_conntrack_l4proto *l4proto;
 805         unsigned int dataoff;
 806         u_int8_t protonum;
 807         int set_reply = 0;
 808         int ret;
 809
 810         /* Previously seen (loopback or untracked)?  Ignore. */
 811         if ((*pskb)->nfct) {
 812                 NF_CT_STAT_INC_ATOMIC(ignore);
 813                 return NF_ACCEPT;
 814         }
 815
 816         /* rcu_read_lock()ed by nf_hook_slow */
 817         l3proto = __nf_ct_l3proto_find((u_int16_t)pf);
 818
 819         if ((ret = l3proto->prepare(pskb, hooknum, &dataoff, &protonum)) <= 0) {
 820                 DEBUGP("not prepared to track yet or error occured\n");
 821                 return -ret;
 822         }
 823
 824         l4proto = __nf_ct_l4proto_find((u_int16_t)pf, protonum);
 825
 826         /* It may be an special packet, error, unclean...
 827          * inverse of the return code tells to the netfilter
 828          * core what to do with the packet. */
 829         if (l4proto->error != NULL &&
 830             (ret = l4proto->error(*pskb, dataoff, &ctinfo, pf, hooknum)) <= 0) {
 831                 NF_CT_STAT_INC_ATOMIC(error);
 832                 NF_CT_STAT_INC_ATOMIC(invalid);
 833                 return -ret;
 834         }
 835
 836         ct = resolve_normal_ct(*pskb, dataoff, pf, protonum, l3proto, l4proto,
 837                                &set_reply, &ctinfo);
 838         if (!ct) {
 839                 /* Not valid part of a connection */
 840                 NF_CT_STAT_INC_ATOMIC(invalid);
 841                 return NF_ACCEPT;
 842         }
 843
 844         if (IS_ERR(ct)) {
 845                 /* Too stressed to deal. */
 846                 NF_CT_STAT_INC_ATOMIC(drop);
 847                 return NF_DROP;
 848         }
 849
 850         NF_CT_ASSERT((*pskb)->nfct);
 851
 852         ret = l4proto->packet(ct, *pskb, dataoff, ctinfo, pf, hooknum);
 853         if (ret < 0) {
 854                 /* Invalid: inverse of the return code tells
 855                  * the netfilter core what to do */
 856                 DEBUGP("nf_conntrack_in: Can't track with proto module\n");
 857                 nf_conntrack_put((*pskb)->nfct);
 858                 (*pskb)->nfct = NULL;
 859                 NF_CT_STAT_INC_ATOMIC(invalid);
 860                 return -ret;
 861         }
 862
 863         if (set_reply && !test_and_set_bit(IPS_SEEN_REPLY_BIT, &ct->status))
 864                 nf_conntrack_event_cache(IPCT_STATUS, *pskb);
 865
 866         return ret;
 867 }
 868 EXPORT_SYMBOL_GPL(nf_conntrack_in);
 869
 870 int nf_ct_invert_tuplepr(struct nf_conntrack_tuple *inverse,
 871                          const struct nf_conntrack_tuple *orig)
 872 {
 873         int ret;
 874
 875         rcu_read_lock();
 876         ret = nf_ct_invert_tuple(inverse, orig,
 877                                  __nf_ct_l3proto_find(orig->src.l3num),
 878                                  __nf_ct_l4proto_find(orig->src.l3num,
 879                                                       orig->dst.protonum));
 880         rcu_read_unlock();
 881         return ret;
 882 }
 883 EXPORT_SYMBOL_GPL(nf_ct_invert_tuplepr);
 884
 885 /* Alter reply tuple (maybe alter helper).  This is for NAT, and is
 886    implicitly racy: see __nf_conntrack_confirm */
 887 void nf_conntrack_alter_reply(struct nf_conn *ct,
 888                               const struct nf_conntrack_tuple *newreply)
 889 {
 890         struct nf_conn_help *help = nfct_help(ct);
 891
 892         write_lock_bh(&nf_conntrack_lock);
 893         /* Should be unconfirmed, so not in hash table yet */
 894         NF_CT_ASSERT(!nf_ct_is_confirmed(ct));
 895
 896         DEBUGP("Altering reply tuple of %p to ", ct);
 897         NF_CT_DUMP_TUPLE(newreply);
 898
 899         ct->tuplehash[IP_CT_DIR_REPLY].tuple = *newreply;
 900         if (!ct->master && help && help->expecting == 0) {
 901                 struct nf_conntrack_helper *helper;
 902                 helper = __nf_ct_helper_find(newreply);
 903                 if (helper)
 904                         memset(&help->help, 0, sizeof(help->help));
 905                 /* not in hash table yet, so not strictly necessary */
 906                 rcu_assign_pointer(help->helper, helper);
 907         }
 908         write_unlock_bh(&nf_conntrack_lock);
 909 }
 910 EXPORT_SYMBOL_GPL(nf_conntrack_alter_reply);
 911
 912 /* Refresh conntrack for this many jiffies and do accounting if do_acct is 1 */
 913 void __nf_ct_refresh_acct(struct nf_conn *ct,
 914                           enum ip_conntrack_info ctinfo,
 915                           const struct sk_buff *skb,
 916                           unsigned long extra_jiffies,
 917                           int do_acct)
 918 {
 919         int event = 0;
 920
 921         NF_CT_ASSERT(ct->timeout.data == (unsigned long)ct);
 922         NF_CT_ASSERT(skb);
 923
 924         write_lock_bh(&nf_conntrack_lock);
 925
 926         /* Only update if this is not a fixed timeout */
 927         if (test_bit(IPS_FIXED_TIMEOUT_BIT, &ct->status)) {
 928                 write_unlock_bh(&nf_conntrack_lock);
 929                 return;
 930         }
 931
 932         /* If not in hash table, timer will not be active yet */
 933         if (!nf_ct_is_confirmed(ct)) {
 934                 ct->timeout.expires = extra_jiffies;
 935                 event = IPCT_REFRESH;
 936         } else {
 937                 unsigned long newtime = jiffies + extra_jiffies;
 938
 939                 /* Only update the timeout if the new timeout is at least
 940                    HZ jiffies from the old timeout. Need del_timer for race
 941                    avoidance (may already be dying). */
 942                 if (newtime - ct->timeout.expires >= HZ
 943                     && del_timer(&ct->timeout)) {
 944                         ct->timeout.expires = newtime;
 945                         add_timer(&ct->timeout);
 946                         event = IPCT_REFRESH;
 947                 }
 948         }
 949
 950 #ifdef CONFIG_NF_CT_ACCT
 951         if (do_acct) {
 952                 ct->counters[CTINFO2DIR(ctinfo)].packets++;
 953                 ct->counters[CTINFO2DIR(ctinfo)].bytes +=
 954                         skb->len - skb_network_offset(skb);
 955
 956                 if ((ct->counters[CTINFO2DIR(ctinfo)].packets & 0x80000000)
 957                     || (ct->counters[CTINFO2DIR(ctinfo)].bytes & 0x80000000))
 958                         event |= IPCT_COUNTER_FILLING;
 959         }
 960 #endif
 961
 962         write_unlock_bh(&nf_conntrack_lock);
 963
 964         /* must be unlocked when calling event cache */
 965         if (event)
 966                 nf_conntrack_event_cache(event, skb);
 967 }
 968 EXPORT_SYMBOL_GPL(__nf_ct_refresh_acct);
 969
 970 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 971
 972 #include <linux/netfilter/nfnetlink.h>
 973 #include <linux/netfilter/nfnetlink_conntrack.h>
 974 #include <linux/mutex.h>
 975
 976
 977 /* Generic function for tcp/udp/sctp/dccp and alike. This needs to be
 978  * in ip_conntrack_core, since we don't want the protocols to autoload
 979  * or depend on ctnetlink */
 980 int nf_ct_port_tuple_to_nfattr(struct sk_buff *skb,
 981                                const struct nf_conntrack_tuple *tuple)
 982 {
 983         NFA_PUT(skb, CTA_PROTO_SRC_PORT, sizeof(u_int16_t),
 984                 &tuple->src.u.tcp.port);
 985         NFA_PUT(skb, CTA_PROTO_DST_PORT, sizeof(u_int16_t),
 986                 &tuple->dst.u.tcp.port);
 987         return 0;
 988
 989 nfattr_failure:
 990         return -1;
 991 }
 992 EXPORT_SYMBOL_GPL(nf_ct_port_tuple_to_nfattr);
 993
 994 static const size_t cta_min_proto[CTA_PROTO_MAX] = {
 995         [CTA_PROTO_SRC_PORT-1]  = sizeof(u_int16_t),
 996         [CTA_PROTO_DST_PORT-1]  = sizeof(u_int16_t)
 997 };
 998
 999 int nf_ct_port_nfattr_to_tuple(struct nfattr *tb[],
1000                                struct nf_conntrack_tuple *t)
1001 {
1002         if (!tb[CTA_PROTO_SRC_PORT-1] || !tb[CTA_PROTO_DST_PORT-1])
1003                 return -EINVAL;
1004
1005         if (nfattr_bad_size(tb, CTA_PROTO_MAX, cta_min_proto))
1006                 return -EINVAL;
1007
1008         t->src.u.tcp.port = *(__be16 *)NFA_DATA(tb[CTA_PROTO_SRC_PORT-1]);
1009         t->dst.u.tcp.port = *(__be16 *)NFA_DATA(tb[CTA_PROTO_DST_PORT-1]);
1010
1011         return 0;
1012 }
1013 EXPORT_SYMBOL_GPL(nf_ct_port_nfattr_to_tuple);
1014 #endif
1015
1016 /* Used by ipt_REJECT and ip6t_REJECT. */
1017 void __nf_conntrack_attach(struct sk_buff *nskb, struct sk_buff *skb)
1018 {
1019         struct nf_conn *ct;
1020         enum ip_conntrack_info ctinfo;
1021
1022         /* This ICMP is in reverse direction to the packet which caused it */
1023         ct = nf_ct_get(skb, &ctinfo);
1024         if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL)
1025                 ctinfo = IP_CT_RELATED + IP_CT_IS_REPLY;
1026         else
1027                 ctinfo = IP_CT_RELATED;
1028
1029         /* Attach to new skbuff, and increment count */
1030         nskb->nfct = &ct->ct_general;
1031         nskb->nfctinfo = ctinfo;
1032         nf_conntrack_get(nskb->nfct);
1033 }
1034 EXPORT_SYMBOL_GPL(__nf_conntrack_attach);
1035
1036 static inline int
1037 do_iter(const struct nf_conntrack_tuple_hash *i,
1038         int (*iter)(struct nf_conn *i, void *data),
1039         void *data)
1040 {
1041         return iter(nf_ct_tuplehash_to_ctrack(i), data);
1042 }
1043
1044 /* Bring out ya dead! */
1045 static struct nf_conn *
1046 get_next_corpse(int (*iter)(struct nf_conn *i, void *data),
1047                 void *data, unsigned int *bucket)
1048 {
1049         struct nf_conntrack_tuple_hash *h;
1050         struct nf_conn *ct;
1051
1052         write_lock_bh(&nf_conntrack_lock);
1053         for (; *bucket < nf_conntrack_htable_size; (*bucket)++) {
1054                 list_for_each_entry(h, &nf_conntrack_hash[*bucket], list) {
1055                         ct = nf_ct_tuplehash_to_ctrack(h);
1056                         if (iter(ct, data))
1057                                 goto found;
1058                 }
1059         }
1060         list_for_each_entry(h, &unconfirmed, list) {
1061                 ct = nf_ct_tuplehash_to_ctrack(h);
1062                 if (iter(ct, data))
1063                         set_bit(IPS_DYING_BIT, &ct->status);
1064         }
1065         write_unlock_bh(&nf_conntrack_lock);
1066         return NULL;
1067 found:
1068         atomic_inc(&ct->ct_general.use);
1069         write_unlock_bh(&nf_conntrack_lock);
1070         return ct;
1071 }
1072
1073 void
1074 nf_ct_iterate_cleanup(int (*iter)(struct nf_conn *i, void *data), void *data)
1075 {
1076         struct nf_conn *ct;
1077         unsigned int bucket = 0;
1078
1079         while ((ct = get_next_corpse(iter, data, &bucket)) != NULL) {
1080                 /* Time to push up daises... */
1081                 if (del_timer(&ct->timeout))
1082                         death_by_timeout((unsigned long)ct);
1083                 /* ... else the timer will get him soon. */
1084
1085                 nf_ct_put(ct);
1086         }
1087 }
1088 EXPORT_SYMBOL_GPL(nf_ct_iterate_cleanup);
1089
1090 static int kill_all(struct nf_conn *i, void *data)
1091 {
1092         return 1;
1093 }
1094
1095 static void free_conntrack_hash(struct list_head *hash, int vmalloced, int size)
1096 {
1097         if (vmalloced)
1098                 vfree(hash);
1099         else
1100                 free_pages((unsigned long)hash,
1101                            get_order(sizeof(struct list_head) * size));
1102 }
1103
1104 void nf_conntrack_flush(void)
1105 {
1106         nf_ct_iterate_cleanup(kill_all, NULL);
1107 }
1108 EXPORT_SYMBOL_GPL(nf_conntrack_flush);
1109
1110 /* Mishearing the voices in his head, our hero wonders how he's
1111    supposed to kill the mall. */
1112 void nf_conntrack_cleanup(void)
1113 {
1114         int i;
1115
1116         rcu_assign_pointer(ip_ct_attach, NULL);
1117
1118         /* This makes sure all current packets have passed through
1119            netfilter framework.  Roll on, two-stage module
1120            delete... */
1121         synchronize_net();
1122
1123         nf_ct_event_cache_flush();
1124  i_see_dead_people:
1125         nf_conntrack_flush();
1126         if (atomic_read(&nf_conntrack_count) != 0) {
1127                 schedule();
1128                 goto i_see_dead_people;
1129         }
1130         /* wait until all references to nf_conntrack_untracked are dropped */
1131         while (atomic_read(&nf_conntrack_untracked.ct_general.use) > 1)
1132                 schedule();
1133
1134         rcu_assign_pointer(nf_ct_destroy, NULL);
1135
1136         for (i = 0; i < NF_CT_F_NUM; i++) {
1137                 if (nf_ct_cache[i].use == 0)
1138                         continue;
1139
1140                 NF_CT_ASSERT(nf_ct_cache[i].use == 1);
1141                 nf_ct_cache[i].use = 1;
1142                 nf_conntrack_unregister_cache(i);
1143         }
1144         kmem_cache_destroy(nf_conntrack_expect_cachep);
1145         free_conntrack_hash(nf_conntrack_hash, nf_conntrack_vmalloc,
1146                             nf_conntrack_htable_size);
1147
1148         nf_conntrack_proto_fini();
1149 }
1150
1151 static struct list_head *alloc_hashtable(int size, int *vmalloced)
1152 {
1153         struct list_head *hash;
1154         unsigned int i;
1155
1156         *vmalloced = 0;
1157         hash = (void*)__get_free_pages(GFP_KERNEL,
1158                                        get_order(sizeof(struct list_head)
1159                                                  * size));
1160         if (!hash) {
1161                 *vmalloced = 1;
1162                 printk(KERN_WARNING "nf_conntrack: falling back to vmalloc.\n");
1163                 hash = vmalloc(sizeof(struct list_head) * size);
1164         }
1165
1166         if (hash)
1167                 for (i = 0; i < size; i++)
1168                         INIT_LIST_HEAD(&hash[i]);
1169
1170         return hash;
1171 }
1172
1173 int set_hashsize(const char *val, struct kernel_param *kp)
1174 {
1175         int i, bucket, hashsize, vmalloced;
1176         int old_vmalloced, old_size;
1177         int rnd;
1178         struct list_head *hash, *old_hash;
1179         struct nf_conntrack_tuple_hash *h;
1180
1181         /* On boot, we can set this without any fancy locking. */
1182         if (!nf_conntrack_htable_size)
1183                 return param_set_uint(val, kp);
1184
1185         hashsize = simple_strtol(val, NULL, 0);
1186         if (!hashsize)
1187                 return -EINVAL;
1188
1189         hash = alloc_hashtable(hashsize, &vmalloced);
1190         if (!hash)
1191                 return -ENOMEM;
1192
1193         /* We have to rehahs for the new table anyway, so we also can
1194          * use a newrandom seed */
1195         get_random_bytes(&rnd, 4);
1196
1197         write_lock_bh(&nf_conntrack_lock);
1198         for (i = 0; i < nf_conntrack_htable_size; i++) {
1199                 while (!list_empty(&nf_conntrack_hash[i])) {
1200                         h = list_entry(nf_conntrack_hash[i].next,
1201                                        struct nf_conntrack_tuple_hash, list);
1202                         list_del(&h->list);
1203                         bucket = __hash_conntrack(&h->tuple, hashsize, rnd);
1204                         list_add_tail(&h->list, &hash[bucket]);
1205                 }
1206         }
1207         old_size = nf_conntrack_htable_size;
1208         old_vmalloced = nf_conntrack_vmalloc;
1209         old_hash = nf_conntrack_hash;
1210
1211         nf_conntrack_htable_size = hashsize;
1212         nf_conntrack_vmalloc = vmalloced;
1213         nf_conntrack_hash = hash;
1214         nf_conntrack_hash_rnd = rnd;
1215         write_unlock_bh(&nf_conntrack_lock);
1216
1217         free_conntrack_hash(old_hash, old_vmalloced, old_size);
1218         return 0;
1219 }
1220
1221 module_param_call(hashsize, set_hashsize, param_get_uint,
1222                   &nf_conntrack_htable_size, 0600);
1223
1224 int __init nf_conntrack_init(void)
1225 {
1226         int ret;
1227
1228         /* Idea from tcp.c: use 1/16384 of memory.  On i386: 32MB
1229          * machine has 256 buckets.  >= 1GB machines have 8192 buckets. */
1230         if (!nf_conntrack_htable_size) {
1231                 nf_conntrack_htable_size
1232                         = (((num_physpages << PAGE_SHIFT) / 16384)
1233                            / sizeof(struct list_head));
1234                 if (num_physpages > (1024 * 1024 * 1024 / PAGE_SIZE))
1235                         nf_conntrack_htable_size = 8192;
1236                 if (nf_conntrack_htable_size < 16)
1237                         nf_conntrack_htable_size = 16;
1238         }
1239         nf_conntrack_max = 8 * nf_conntrack_htable_size;
1240
1241         printk("nf_conntrack version %s (%u buckets, %d max)\n",
1242                NF_CONNTRACK_VERSION, nf_conntrack_htable_size,
1243                nf_conntrack_max);
1244
1245         nf_conntrack_hash = alloc_hashtable(nf_conntrack_htable_size,
1246                                             &nf_conntrack_vmalloc);
1247         if (!nf_conntrack_hash) {
1248                 printk(KERN_ERR "Unable to create nf_conntrack_hash\n");
1249                 goto err_out;
1250         }
1251
1252         ret = nf_conntrack_register_cache(NF_CT_F_BASIC, "nf_conntrack:basic",
1253                                           sizeof(struct nf_conn));
1254         if (ret < 0) {
1255                 printk(KERN_ERR "Unable to create nf_conn slab cache\n");
1256                 goto err_free_hash;
1257         }
1258
1259         nf_conntrack_expect_cachep = kmem_cache_create("nf_conntrack_expect",
1260                                         sizeof(struct nf_conntrack_expect),
1261                                         0, 0, NULL, NULL);
1262         if (!nf_conntrack_expect_cachep) {
1263                 printk(KERN_ERR "Unable to create nf_expect slab cache\n");
1264                 goto err_free_conntrack_slab;
1265         }
1266
1267         ret = nf_conntrack_proto_init();
1268         if (ret < 0)
1269                 goto out_free_expect_slab;
1270
1271         /* For use by REJECT target */
1272         rcu_assign_pointer(ip_ct_attach, __nf_conntrack_attach);
1273         rcu_assign_pointer(nf_ct_destroy, destroy_conntrack);
1274
1275         /* Set up fake conntrack:
1276             - to never be deleted, not in any hashes */
1277         atomic_set(&nf_conntrack_untracked.ct_general.use, 1);
1278         /*  - and look it like as a confirmed connection */
1279         set_bit(IPS_CONFIRMED_BIT, &nf_conntrack_untracked.status);
1280
1281         return ret;
1282
1283 out_free_expect_slab:
1284         kmem_cache_destroy(nf_conntrack_expect_cachep);
1285 err_free_conntrack_slab:
1286         nf_conntrack_unregister_cache(NF_CT_F_BASIC);
1287 err_free_hash:
1288         free_conntrack_hash(nf_conntrack_hash, nf_conntrack_vmalloc,
1289                             nf_conntrack_htable_size);
1290 err_out:
1291         return -ENOMEM;
1292 }