nf_conntrack_expect.c | Explore in Territory

// SPDX-License-Identifier: GPL-2.0-only
/* Expectation handling for nf_conntrack. */

/* (C) 1999-2001 Paul `Rusty' Russell
 * (C) 2002-2006 Netfilter Core Team <[email protected]>
 * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
 * (c) 2005-2012 Patrick McHardy <[email protected]>
 */

#include <linux/types.h>
#include <linux/netfilter.h>
#include <linux/skbuff.h>
#include <linux/proc_fs.h>
#include <linux/seq_file.h>
#include <linux/stddef.h>
#include <linux/slab.h>
#include <linux/err.h>
#include <linux/percpu.h>
#include <linux/kernel.h>
#include <linux/siphash.h>
#include <linux/moduleparam.h>
#include <linux/export.h>
#include <net/net_namespace.h>
#include <net/netns/hash.h>

#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_core.h>
#include <net/netfilter/nf_conntrack_ecache.h>
#include <net/netfilter/nf_conntrack_expect.h>
#include <net/netfilter/nf_conntrack_helper.h>
#include <net/netfilter/nf_conntrack_l4proto.h>
#include <net/netfilter/nf_conntrack_tuple.h>
#include <net/netfilter/nf_conntrack_zones.h>

unsigned int nf_ct_expect_hsize __read_mostly;
EXPORT_SYMBOL_GPL(…);

struct hlist_head *nf_ct_expect_hash __read_mostly;
EXPORT_SYMBOL_GPL(…);

unsigned int nf_ct_expect_max __read_mostly;

static struct kmem_cache *nf_ct_expect_cachep __read_mostly;
static siphash_aligned_key_t nf_ct_expect_hashrnd;

/* nf_conntrack_expect helper functions */
void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp,
				u32 portid, int report)
{ … }
EXPORT_SYMBOL_GPL(…);

static void nf_ct_expectation_timed_out(struct timer_list *t)
{ … }

static unsigned int nf_ct_expect_dst_hash(const struct net *n, const struct nf_conntrack_tuple *tuple)
{ … }

static bool
nf_ct_exp_equal(const struct nf_conntrack_tuple *tuple,
		const struct nf_conntrack_expect *i,
		const struct nf_conntrack_zone *zone,
		const struct net *net)
{ … }

bool nf_ct_remove_expect(struct nf_conntrack_expect *exp)
{ … }
EXPORT_SYMBOL_GPL(…);

struct nf_conntrack_expect *
__nf_ct_expect_find(struct net *net,
		    const struct nf_conntrack_zone *zone,
		    const struct nf_conntrack_tuple *tuple)
{ … }
EXPORT_SYMBOL_GPL(…);

/* Just find a expectation corresponding to a tuple. */
struct nf_conntrack_expect *
nf_ct_expect_find_get(struct net *net,
		      const struct nf_conntrack_zone *zone,
		      const struct nf_conntrack_tuple *tuple)
{ … }
EXPORT_SYMBOL_GPL(…);

/* If an expectation for this connection is found, it gets delete from
 * global list then returned. */
struct nf_conntrack_expect *
nf_ct_find_expectation(struct net *net,
		       const struct nf_conntrack_zone *zone,
		       const struct nf_conntrack_tuple *tuple, bool unlink)
{ … }

/* delete all expectations for this conntrack */
void nf_ct_remove_expectations(struct nf_conn *ct)
{ … }
EXPORT_SYMBOL_GPL(…);

/* Would two expected things clash? */
static inline int expect_clash(const struct nf_conntrack_expect *a,
			       const struct nf_conntrack_expect *b)
{ … }

static inline int expect_matches(const struct nf_conntrack_expect *a,
				 const struct nf_conntrack_expect *b)
{ … }

static bool master_matches(const struct nf_conntrack_expect *a,
			   const struct nf_conntrack_expect *b,
			   unsigned int flags)
{ … }

/* Generally a bad idea to call this: could have matched already. */
void nf_ct_unexpect_related(struct nf_conntrack_expect *exp)
{ … }
EXPORT_SYMBOL_GPL(…);

/* We don't increase the master conntrack refcount for non-fulfilled
 * conntracks. During the conntrack destruction, the expectations are
 * always killed before the conntrack itself */
struct nf_conntrack_expect *nf_ct_expect_alloc(struct nf_conn *me)
{ … }
EXPORT_SYMBOL_GPL(…);

void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class,
		       u_int8_t family,
		       const union nf_inet_addr *saddr,
		       const union nf_inet_addr *daddr,
		       u_int8_t proto, const __be16 *src, const __be16 *dst)
{ … }
EXPORT_SYMBOL_GPL(…);

static void nf_ct_expect_free_rcu(struct rcu_head *head)
{ … }

void nf_ct_expect_put(struct nf_conntrack_expect *exp)
{ … }
EXPORT_SYMBOL_GPL(…);

static void nf_ct_expect_insert(struct nf_conntrack_expect *exp)
{ … }

/* Race with expectations being used means we could have none to find; OK. */
static void evict_oldest_expect(struct nf_conn *master,
				struct nf_conntrack_expect *new)
{ … }

static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect,
				       unsigned int flags)
{ … }

int nf_ct_expect_related_report(struct nf_conntrack_expect *expect,
				u32 portid, int report, unsigned int flags)
{ … }
EXPORT_SYMBOL_GPL(…);

void nf_ct_expect_iterate_destroy(bool (*iter)(struct nf_conntrack_expect *e, void *data),
				  void *data)
{ … }
EXPORT_SYMBOL_GPL(…);

void nf_ct_expect_iterate_net(struct net *net,
			      bool (*iter)(struct nf_conntrack_expect *e, void *data),
			      void *data,
			      u32 portid, int report)
{ … }
EXPORT_SYMBOL_GPL(…);

#ifdef CONFIG_NF_CONNTRACK_PROCFS
struct ct_expect_iter_state { … };

static struct hlist_node *ct_expect_get_first(struct seq_file *seq)
{ … }

static struct hlist_node *ct_expect_get_next(struct seq_file *seq,
					     struct hlist_node *head)
{ … }

static struct hlist_node *ct_expect_get_idx(struct seq_file *seq, loff_t pos)
{ … }

static void *exp_seq_start(struct seq_file *seq, loff_t *pos)
	__acquires(RCU)
{ … }

static void *exp_seq_next(struct seq_file *seq, void *v, loff_t *pos)
{ … }

static void exp_seq_stop(struct seq_file *seq, void *v)
	__releases(RCU)
{ … }

static int exp_seq_show(struct seq_file *s, void *v)
{ … }

static const struct seq_operations exp_seq_ops = …;
#endif /* CONFIG_NF_CONNTRACK_PROCFS */

static int exp_proc_init(struct net *net)
{ … }

static void exp_proc_remove(struct net *net)
{ … }

module_param_named(expect_hashsize, nf_ct_expect_hsize, uint, 0400);

int nf_conntrack_expect_pernet_init(struct net *net)
{ … }

void nf_conntrack_expect_pernet_fini(struct net *net)
{ … }

int nf_conntrack_expect_init(void)
{ … }

void nf_conntrack_expect_fini(void)
{ … }
linux/net/netfilter/nf_conntrack_expect.c
