1 // SPDX-License-Identifier: GPL-2.0
3 #include <linux/types.h>
4 #include <linux/netfilter.h>
5 #include <linux/module.h>
6 #include <linux/slab.h>
7 #include <linux/mutex.h>
8 #include <linux/vmalloc.h>
9 #include <linux/stddef.h>
10 #include <linux/err.h>
11 #include <linux/percpu.h>
12 #include <linux/notifier.h>
13 #include <linux/kernel.h>
14 #include <linux/netdevice.h>
16 #include <net/netfilter/nf_conntrack.h>
17 #include <net/netfilter/nf_conntrack_l4proto.h>
18 #include <net/netfilter/nf_conntrack_core.h>
19 #include <net/netfilter/nf_log.h>
22 #include <linux/icmp.h>
23 #include <linux/sysctl.h>
24 #include <net/route.h>
27 #include <linux/netfilter_ipv4.h>
28 #include <linux/netfilter_ipv6.h>
29 #include <linux/netfilter_ipv6/ip6_tables.h>
30 #include <net/netfilter/nf_conntrack_helper.h>
31 #include <net/netfilter/nf_conntrack_zones.h>
32 #include <net/netfilter/nf_conntrack_seqadj.h>
33 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
34 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
35 #include <net/netfilter/nf_nat_helper.h>
36 #include <net/netfilter/ipv4/nf_defrag_ipv4.h>
37 #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
39 #include <linux/ipv6.h>
40 #include <linux/in6.h>
42 #include <net/inet_frag.h>
44 extern unsigned int nf_conntrack_net_id;
46 static struct nf_conntrack_l4proto __rcu **nf_ct_protos[NFPROTO_NUMPROTO] __read_mostly;
48 static DEFINE_MUTEX(nf_ct_proto_mutex);
52 nf_ct_register_sysctl(struct net *net,
53 struct ctl_table_header **header,
55 struct ctl_table *table)
57 if (*header == NULL) {
58 *header = register_net_sysctl(net, path, table);
67 nf_ct_unregister_sysctl(struct ctl_table_header **header,
68 struct ctl_table **table,
74 unregister_net_sysctl_table(*header);
81 void nf_l4proto_log_invalid(const struct sk_buff *skb,
89 if (net->ct.sysctl_log_invalid != protonum &&
90 net->ct.sysctl_log_invalid != IPPROTO_RAW)
97 nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
98 "nf_ct_proto_%d: %pV ", protonum, &vaf);
101 EXPORT_SYMBOL_GPL(nf_l4proto_log_invalid);
104 void nf_ct_l4proto_log_invalid(const struct sk_buff *skb,
105 const struct nf_conn *ct,
106 const char *fmt, ...)
108 struct va_format vaf;
113 if (likely(net->ct.sysctl_log_invalid == 0))
120 nf_l4proto_log_invalid(skb, net, nf_ct_l3num(ct),
121 nf_ct_protonum(ct), "%pV", &vaf);
124 EXPORT_SYMBOL_GPL(nf_ct_l4proto_log_invalid);
127 const struct nf_conntrack_l4proto *
128 __nf_ct_l4proto_find(u_int16_t l3proto, u_int8_t l4proto)
130 if (unlikely(l3proto >= NFPROTO_NUMPROTO || nf_ct_protos[l3proto] == NULL))
131 return &nf_conntrack_l4proto_generic;
133 return rcu_dereference(nf_ct_protos[l3proto][l4proto]);
135 EXPORT_SYMBOL_GPL(__nf_ct_l4proto_find);
137 const struct nf_conntrack_l4proto *
138 nf_ct_l4proto_find_get(u_int16_t l3num, u_int8_t l4num)
140 const struct nf_conntrack_l4proto *p;
143 p = __nf_ct_l4proto_find(l3num, l4num);
144 if (!try_module_get(p->me))
145 p = &nf_conntrack_l4proto_generic;
150 EXPORT_SYMBOL_GPL(nf_ct_l4proto_find_get);
152 void nf_ct_l4proto_put(const struct nf_conntrack_l4proto *p)
156 EXPORT_SYMBOL_GPL(nf_ct_l4proto_put);
158 static int kill_l4proto(struct nf_conn *i, void *data)
160 const struct nf_conntrack_l4proto *l4proto;
162 return nf_ct_protonum(i) == l4proto->l4proto &&
163 nf_ct_l3num(i) == l4proto->l3proto;
166 static struct nf_proto_net *nf_ct_l4proto_net(struct net *net,
167 const struct nf_conntrack_l4proto *l4proto)
169 if (l4proto->get_net_proto) {
170 /* statically built-in protocols use static per-net */
171 return l4proto->get_net_proto(net);
172 } else if (l4proto->net_id) {
173 /* ... and loadable protocols use dynamic per-net */
174 return net_generic(net, *l4proto->net_id);
180 int nf_ct_l4proto_register_sysctl(struct net *net,
181 struct nf_proto_net *pn,
182 const struct nf_conntrack_l4proto *l4proto)
187 if (pn->ctl_table != NULL) {
188 err = nf_ct_register_sysctl(net,
189 &pn->ctl_table_header,
194 kfree(pn->ctl_table);
195 pn->ctl_table = NULL;
199 #endif /* CONFIG_SYSCTL */
204 void nf_ct_l4proto_unregister_sysctl(struct net *net,
205 struct nf_proto_net *pn,
206 const struct nf_conntrack_l4proto *l4proto)
209 if (pn->ctl_table_header != NULL)
210 nf_ct_unregister_sysctl(&pn->ctl_table_header,
213 #endif /* CONFIG_SYSCTL */
216 /* FIXME: Allow NULL functions and sub in pointers to generic for
218 int nf_ct_l4proto_register_one(const struct nf_conntrack_l4proto *l4proto)
222 if (l4proto->l3proto >= ARRAY_SIZE(nf_ct_protos))
225 if ((l4proto->to_nlattr && l4proto->nlattr_size == 0) ||
226 (l4proto->tuple_to_nlattr && !l4proto->nlattr_tuple_size))
229 mutex_lock(&nf_ct_proto_mutex);
230 if (!nf_ct_protos[l4proto->l3proto]) {
231 /* l3proto may be loaded latter. */
232 struct nf_conntrack_l4proto __rcu **proto_array;
236 kmalloc_array(MAX_NF_CT_PROTO,
237 sizeof(struct nf_conntrack_l4proto *),
239 if (proto_array == NULL) {
244 for (i = 0; i < MAX_NF_CT_PROTO; i++)
245 RCU_INIT_POINTER(proto_array[i],
246 &nf_conntrack_l4proto_generic);
248 /* Before making proto_array visible to lockless readers,
249 * we must make sure its content is committed to memory.
253 nf_ct_protos[l4proto->l3proto] = proto_array;
254 } else if (rcu_dereference_protected(
255 nf_ct_protos[l4proto->l3proto][l4proto->l4proto],
256 lockdep_is_held(&nf_ct_proto_mutex)
257 ) != &nf_conntrack_l4proto_generic) {
262 rcu_assign_pointer(nf_ct_protos[l4proto->l3proto][l4proto->l4proto],
265 mutex_unlock(&nf_ct_proto_mutex);
268 EXPORT_SYMBOL_GPL(nf_ct_l4proto_register_one);
270 int nf_ct_l4proto_pernet_register_one(struct net *net,
271 const struct nf_conntrack_l4proto *l4proto)
274 struct nf_proto_net *pn = NULL;
276 if (l4proto->init_net) {
277 ret = l4proto->init_net(net, l4proto->l3proto);
282 pn = nf_ct_l4proto_net(net, l4proto);
286 ret = nf_ct_l4proto_register_sysctl(net, pn, l4proto);
294 EXPORT_SYMBOL_GPL(nf_ct_l4proto_pernet_register_one);
296 static void __nf_ct_l4proto_unregister_one(const struct nf_conntrack_l4proto *l4proto)
299 BUG_ON(l4proto->l3proto >= ARRAY_SIZE(nf_ct_protos));
301 BUG_ON(rcu_dereference_protected(
302 nf_ct_protos[l4proto->l3proto][l4proto->l4proto],
303 lockdep_is_held(&nf_ct_proto_mutex)
305 rcu_assign_pointer(nf_ct_protos[l4proto->l3proto][l4proto->l4proto],
306 &nf_conntrack_l4proto_generic);
309 void nf_ct_l4proto_unregister_one(const struct nf_conntrack_l4proto *l4proto)
311 mutex_lock(&nf_ct_proto_mutex);
312 __nf_ct_l4proto_unregister_one(l4proto);
313 mutex_unlock(&nf_ct_proto_mutex);
316 /* Remove all contrack entries for this protocol */
317 nf_ct_iterate_destroy(kill_l4proto, (void *)l4proto);
319 EXPORT_SYMBOL_GPL(nf_ct_l4proto_unregister_one);
321 void nf_ct_l4proto_pernet_unregister_one(struct net *net,
322 const struct nf_conntrack_l4proto *l4proto)
324 struct nf_proto_net *pn = nf_ct_l4proto_net(net, l4proto);
330 nf_ct_l4proto_unregister_sysctl(net, pn, l4proto);
332 EXPORT_SYMBOL_GPL(nf_ct_l4proto_pernet_unregister_one);
335 nf_ct_l4proto_unregister(const struct nf_conntrack_l4proto * const l4proto[],
336 unsigned int num_proto)
340 mutex_lock(&nf_ct_proto_mutex);
341 for (i = 0; i < num_proto; i++)
342 __nf_ct_l4proto_unregister_one(l4proto[i]);
343 mutex_unlock(&nf_ct_proto_mutex);
347 for (i = 0; i < num_proto; i++)
348 nf_ct_iterate_destroy(kill_l4proto, (void *)l4proto[i]);
352 nf_ct_l4proto_register(const struct nf_conntrack_l4proto * const l4proto[],
353 unsigned int num_proto)
355 int ret = -EINVAL, ver;
358 for (i = 0; i < num_proto; i++) {
359 ret = nf_ct_l4proto_register_one(l4proto[i]);
363 if (i != num_proto) {
364 ver = l4proto[i]->l3proto == PF_INET6 ? 6 : 4;
365 pr_err("nf_conntrack_ipv%d: can't register l4 %d proto.\n",
366 ver, l4proto[i]->l4proto);
367 nf_ct_l4proto_unregister(l4proto, i);
372 int nf_ct_l4proto_pernet_register(struct net *net,
373 const struct nf_conntrack_l4proto *const l4proto[],
374 unsigned int num_proto)
379 for (i = 0; i < num_proto; i++) {
380 ret = nf_ct_l4proto_pernet_register_one(net, l4proto[i]);
384 if (i != num_proto) {
385 pr_err("nf_conntrack_proto_%d %d: pernet registration failed\n",
387 l4proto[i]->l3proto == PF_INET6 ? 6 : 4);
388 nf_ct_l4proto_pernet_unregister(net, l4proto, i);
392 EXPORT_SYMBOL_GPL(nf_ct_l4proto_pernet_register);
394 void nf_ct_l4proto_pernet_unregister(struct net *net,
395 const struct nf_conntrack_l4proto *const l4proto[],
396 unsigned int num_proto)
398 while (num_proto-- != 0)
399 nf_ct_l4proto_pernet_unregister_one(net, l4proto[num_proto]);
401 EXPORT_SYMBOL_GPL(nf_ct_l4proto_pernet_unregister);
403 static unsigned int ipv4_helper(void *priv,
405 const struct nf_hook_state *state)
408 enum ip_conntrack_info ctinfo;
409 const struct nf_conn_help *help;
410 const struct nf_conntrack_helper *helper;
412 /* This is where we call the helper: as the packet goes out. */
413 ct = nf_ct_get(skb, &ctinfo);
414 if (!ct || ctinfo == IP_CT_RELATED_REPLY)
417 help = nfct_help(ct);
421 /* rcu_read_lock()ed by nf_hook_thresh */
422 helper = rcu_dereference(help->helper);
426 return helper->help(skb, skb_network_offset(skb) + ip_hdrlen(skb),
430 static unsigned int ipv4_confirm(void *priv,
432 const struct nf_hook_state *state)
435 enum ip_conntrack_info ctinfo;
437 ct = nf_ct_get(skb, &ctinfo);
438 if (!ct || ctinfo == IP_CT_RELATED_REPLY)
441 /* adjust seqs for loopback traffic only in outgoing direction */
442 if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) &&
443 !nf_is_loopback_packet(skb)) {
444 if (!nf_ct_seq_adjust(skb, ct, ctinfo, ip_hdrlen(skb))) {
445 NF_CT_STAT_INC_ATOMIC(nf_ct_net(ct), drop);
450 /* We've seen it coming out the other side: confirm it */
451 return nf_conntrack_confirm(skb);
454 static unsigned int ipv4_conntrack_in(void *priv,
456 const struct nf_hook_state *state)
458 return nf_conntrack_in(state->net, PF_INET, state->hook, skb);
461 static unsigned int ipv4_conntrack_local(void *priv,
463 const struct nf_hook_state *state)
465 if (ip_is_fragment(ip_hdr(skb))) { /* IP_NODEFRAG setsockopt set */
466 enum ip_conntrack_info ctinfo;
467 struct nf_conn *tmpl;
469 tmpl = nf_ct_get(skb, &ctinfo);
470 if (tmpl && nf_ct_is_template(tmpl)) {
471 /* when skipping ct, clear templates to avoid fooling
472 * later targets/matches
480 return nf_conntrack_in(state->net, PF_INET, state->hook, skb);
483 /* Connection tracking may drop packets, but never alters them, so
484 * make it the first hook.
486 static const struct nf_hook_ops ipv4_conntrack_ops[] = {
488 .hook = ipv4_conntrack_in,
490 .hooknum = NF_INET_PRE_ROUTING,
491 .priority = NF_IP_PRI_CONNTRACK,
494 .hook = ipv4_conntrack_local,
496 .hooknum = NF_INET_LOCAL_OUT,
497 .priority = NF_IP_PRI_CONNTRACK,
502 .hooknum = NF_INET_POST_ROUTING,
503 .priority = NF_IP_PRI_CONNTRACK_HELPER,
506 .hook = ipv4_confirm,
508 .hooknum = NF_INET_POST_ROUTING,
509 .priority = NF_IP_PRI_CONNTRACK_CONFIRM,
514 .hooknum = NF_INET_LOCAL_IN,
515 .priority = NF_IP_PRI_CONNTRACK_HELPER,
518 .hook = ipv4_confirm,
520 .hooknum = NF_INET_LOCAL_IN,
521 .priority = NF_IP_PRI_CONNTRACK_CONFIRM,
525 /* Fast function for those who don't want to parse /proc (and I don't
527 * Reversing the socket's dst/src point of view gives us the reply
531 getorigdst(struct sock *sk, int optval, void __user *user, int *len)
533 const struct inet_sock *inet = inet_sk(sk);
534 const struct nf_conntrack_tuple_hash *h;
535 struct nf_conntrack_tuple tuple;
537 memset(&tuple, 0, sizeof(tuple));
540 tuple.src.u3.ip = inet->inet_rcv_saddr;
541 tuple.src.u.tcp.port = inet->inet_sport;
542 tuple.dst.u3.ip = inet->inet_daddr;
543 tuple.dst.u.tcp.port = inet->inet_dport;
544 tuple.src.l3num = PF_INET;
545 tuple.dst.protonum = sk->sk_protocol;
548 /* We only do TCP and SCTP at the moment: is there a better way? */
549 if (tuple.dst.protonum != IPPROTO_TCP &&
550 tuple.dst.protonum != IPPROTO_SCTP) {
551 pr_debug("SO_ORIGINAL_DST: Not a TCP/SCTP socket\n");
555 if ((unsigned int)*len < sizeof(struct sockaddr_in)) {
556 pr_debug("SO_ORIGINAL_DST: len %d not %zu\n",
557 *len, sizeof(struct sockaddr_in));
561 h = nf_conntrack_find_get(sock_net(sk), &nf_ct_zone_dflt, &tuple);
563 struct sockaddr_in sin;
564 struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
566 sin.sin_family = AF_INET;
567 sin.sin_port = ct->tuplehash[IP_CT_DIR_ORIGINAL]
568 .tuple.dst.u.tcp.port;
569 sin.sin_addr.s_addr = ct->tuplehash[IP_CT_DIR_ORIGINAL]
571 memset(sin.sin_zero, 0, sizeof(sin.sin_zero));
573 pr_debug("SO_ORIGINAL_DST: %pI4 %u\n",
574 &sin.sin_addr.s_addr, ntohs(sin.sin_port));
576 if (copy_to_user(user, &sin, sizeof(sin)) != 0)
581 pr_debug("SO_ORIGINAL_DST: Can't find %pI4/%u-%pI4/%u.\n",
582 &tuple.src.u3.ip, ntohs(tuple.src.u.tcp.port),
583 &tuple.dst.u3.ip, ntohs(tuple.dst.u.tcp.port));
587 static struct nf_sockopt_ops so_getorigdst = {
589 .get_optmin = SO_ORIGINAL_DST,
590 .get_optmax = SO_ORIGINAL_DST + 1,
592 .owner = THIS_MODULE,
595 #if IS_ENABLED(CONFIG_IPV6)
597 ipv6_getorigdst(struct sock *sk, int optval, void __user *user, int *len)
599 struct nf_conntrack_tuple tuple = { .src.l3num = NFPROTO_IPV6 };
600 const struct ipv6_pinfo *inet6 = inet6_sk(sk);
601 const struct inet_sock *inet = inet_sk(sk);
602 const struct nf_conntrack_tuple_hash *h;
603 struct sockaddr_in6 sin6;
609 tuple.src.u3.in6 = sk->sk_v6_rcv_saddr;
610 tuple.src.u.tcp.port = inet->inet_sport;
611 tuple.dst.u3.in6 = sk->sk_v6_daddr;
612 tuple.dst.u.tcp.port = inet->inet_dport;
613 tuple.dst.protonum = sk->sk_protocol;
614 bound_dev_if = sk->sk_bound_dev_if;
615 flow_label = inet6->flow_label;
618 if (tuple.dst.protonum != IPPROTO_TCP &&
619 tuple.dst.protonum != IPPROTO_SCTP)
622 if (*len < 0 || (unsigned int)*len < sizeof(sin6))
625 h = nf_conntrack_find_get(sock_net(sk), &nf_ct_zone_dflt, &tuple);
627 pr_debug("IP6T_SO_ORIGINAL_DST: Can't find %pI6c/%u-%pI6c/%u.\n",
628 &tuple.src.u3.ip6, ntohs(tuple.src.u.tcp.port),
629 &tuple.dst.u3.ip6, ntohs(tuple.dst.u.tcp.port));
633 ct = nf_ct_tuplehash_to_ctrack(h);
635 sin6.sin6_family = AF_INET6;
636 sin6.sin6_port = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u.tcp.port;
637 sin6.sin6_flowinfo = flow_label & IPV6_FLOWINFO_MASK;
638 memcpy(&sin6.sin6_addr,
639 &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3.in6,
640 sizeof(sin6.sin6_addr));
643 sin6.sin6_scope_id = ipv6_iface_scope_id(&sin6.sin6_addr, bound_dev_if);
644 return copy_to_user(user, &sin6, sizeof(sin6)) ? -EFAULT : 0;
647 static struct nf_sockopt_ops so_getorigdst6 = {
649 .get_optmin = IP6T_SO_ORIGINAL_DST,
650 .get_optmax = IP6T_SO_ORIGINAL_DST + 1,
651 .get = ipv6_getorigdst,
652 .owner = THIS_MODULE,
655 static unsigned int ipv6_confirm(void *priv,
657 const struct nf_hook_state *state)
660 enum ip_conntrack_info ctinfo;
661 unsigned char pnum = ipv6_hdr(skb)->nexthdr;
665 ct = nf_ct_get(skb, &ctinfo);
666 if (!ct || ctinfo == IP_CT_RELATED_REPLY)
669 protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &pnum,
671 if (protoff < 0 || (frag_off & htons(~0x7)) != 0) {
672 pr_debug("proto header not found\n");
676 /* adjust seqs for loopback traffic only in outgoing direction */
677 if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) &&
678 !nf_is_loopback_packet(skb)) {
679 if (!nf_ct_seq_adjust(skb, ct, ctinfo, protoff)) {
680 NF_CT_STAT_INC_ATOMIC(nf_ct_net(ct), drop);
685 /* We've seen it coming out the other side: confirm it */
686 return nf_conntrack_confirm(skb);
689 static unsigned int ipv6_conntrack_in(void *priv,
691 const struct nf_hook_state *state)
693 return nf_conntrack_in(state->net, PF_INET6, state->hook, skb);
696 static unsigned int ipv6_conntrack_local(void *priv,
698 const struct nf_hook_state *state)
700 return nf_conntrack_in(state->net, PF_INET6, state->hook, skb);
703 static unsigned int ipv6_helper(void *priv,
705 const struct nf_hook_state *state)
708 const struct nf_conn_help *help;
709 const struct nf_conntrack_helper *helper;
710 enum ip_conntrack_info ctinfo;
715 /* This is where we call the helper: as the packet goes out. */
716 ct = nf_ct_get(skb, &ctinfo);
717 if (!ct || ctinfo == IP_CT_RELATED_REPLY)
720 help = nfct_help(ct);
723 /* rcu_read_lock()ed by nf_hook_thresh */
724 helper = rcu_dereference(help->helper);
728 nexthdr = ipv6_hdr(skb)->nexthdr;
729 protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr,
731 if (protoff < 0 || (frag_off & htons(~0x7)) != 0) {
732 pr_debug("proto header not found\n");
736 return helper->help(skb, protoff, ct, ctinfo);
739 static const struct nf_hook_ops ipv6_conntrack_ops[] = {
741 .hook = ipv6_conntrack_in,
743 .hooknum = NF_INET_PRE_ROUTING,
744 .priority = NF_IP6_PRI_CONNTRACK,
747 .hook = ipv6_conntrack_local,
749 .hooknum = NF_INET_LOCAL_OUT,
750 .priority = NF_IP6_PRI_CONNTRACK,
755 .hooknum = NF_INET_POST_ROUTING,
756 .priority = NF_IP6_PRI_CONNTRACK_HELPER,
759 .hook = ipv6_confirm,
761 .hooknum = NF_INET_POST_ROUTING,
762 .priority = NF_IP6_PRI_LAST,
767 .hooknum = NF_INET_LOCAL_IN,
768 .priority = NF_IP6_PRI_CONNTRACK_HELPER,
771 .hook = ipv6_confirm,
773 .hooknum = NF_INET_LOCAL_IN,
774 .priority = NF_IP6_PRI_LAST - 1,
779 static int nf_ct_tcp_fixup(struct nf_conn *ct, void *_nfproto)
781 u8 nfproto = (unsigned long)_nfproto;
783 if (nf_ct_l3num(ct) != nfproto)
786 if (nf_ct_protonum(ct) == IPPROTO_TCP &&
787 ct->proto.tcp.state == TCP_CONNTRACK_ESTABLISHED) {
788 ct->proto.tcp.seen[0].td_maxwin = 0;
789 ct->proto.tcp.seen[1].td_maxwin = 0;
795 static int nf_ct_netns_do_get(struct net *net, u8 nfproto)
797 struct nf_conntrack_net *cnet = net_generic(net, nf_conntrack_net_id);
798 bool fixup_needed = false;
801 mutex_lock(&nf_ct_proto_mutex);
806 if (cnet->users4 > 1)
808 err = nf_defrag_ipv4_enable(net);
814 err = nf_register_net_hooks(net, ipv4_conntrack_ops,
815 ARRAY_SIZE(ipv4_conntrack_ops));
821 #if IS_ENABLED(CONFIG_IPV6)
824 if (cnet->users6 > 1)
826 err = nf_defrag_ipv6_enable(net);
832 err = nf_register_net_hooks(net, ipv6_conntrack_ops,
833 ARRAY_SIZE(ipv6_conntrack_ops));
845 mutex_unlock(&nf_ct_proto_mutex);
848 nf_ct_iterate_cleanup_net(net, nf_ct_tcp_fixup,
849 (void *)(unsigned long)nfproto, 0, 0);
854 static void nf_ct_netns_do_put(struct net *net, u8 nfproto)
856 struct nf_conntrack_net *cnet = net_generic(net, nf_conntrack_net_id);
858 mutex_lock(&nf_ct_proto_mutex);
861 if (cnet->users4 && (--cnet->users4 == 0))
862 nf_unregister_net_hooks(net, ipv4_conntrack_ops,
863 ARRAY_SIZE(ipv4_conntrack_ops));
865 #if IS_ENABLED(CONFIG_IPV6)
867 if (cnet->users6 && (--cnet->users6 == 0))
868 nf_unregister_net_hooks(net, ipv6_conntrack_ops,
869 ARRAY_SIZE(ipv6_conntrack_ops));
874 mutex_unlock(&nf_ct_proto_mutex);
877 int nf_ct_netns_get(struct net *net, u8 nfproto)
881 if (nfproto == NFPROTO_INET) {
882 err = nf_ct_netns_do_get(net, NFPROTO_IPV4);
885 err = nf_ct_netns_do_get(net, NFPROTO_IPV6);
889 err = nf_ct_netns_do_get(net, nfproto);
896 nf_ct_netns_put(net, NFPROTO_IPV4);
900 EXPORT_SYMBOL_GPL(nf_ct_netns_get);
902 void nf_ct_netns_put(struct net *net, uint8_t nfproto)
904 if (nfproto == NFPROTO_INET) {
905 nf_ct_netns_do_put(net, NFPROTO_IPV4);
906 nf_ct_netns_do_put(net, NFPROTO_IPV6);
908 nf_ct_netns_do_put(net, nfproto);
911 EXPORT_SYMBOL_GPL(nf_ct_netns_put);
913 static const struct nf_conntrack_l4proto * const builtin_l4proto[] = {
914 &nf_conntrack_l4proto_tcp4,
915 &nf_conntrack_l4proto_udp4,
916 &nf_conntrack_l4proto_icmp,
917 #ifdef CONFIG_NF_CT_PROTO_DCCP
918 &nf_conntrack_l4proto_dccp4,
920 #ifdef CONFIG_NF_CT_PROTO_SCTP
921 &nf_conntrack_l4proto_sctp4,
923 #ifdef CONFIG_NF_CT_PROTO_UDPLITE
924 &nf_conntrack_l4proto_udplite4,
926 #if IS_ENABLED(CONFIG_IPV6)
927 &nf_conntrack_l4proto_tcp6,
928 &nf_conntrack_l4proto_udp6,
929 &nf_conntrack_l4proto_icmpv6,
930 #ifdef CONFIG_NF_CT_PROTO_DCCP
931 &nf_conntrack_l4proto_dccp6,
933 #ifdef CONFIG_NF_CT_PROTO_SCTP
934 &nf_conntrack_l4proto_sctp6,
936 #ifdef CONFIG_NF_CT_PROTO_UDPLITE
937 &nf_conntrack_l4proto_udplite6,
939 #endif /* CONFIG_IPV6 */
942 int nf_conntrack_proto_init(void)
946 ret = nf_register_sockopt(&so_getorigdst);
950 #if IS_ENABLED(CONFIG_IPV6)
951 ret = nf_register_sockopt(&so_getorigdst6);
953 goto cleanup_sockopt;
955 ret = nf_ct_l4proto_register(builtin_l4proto,
956 ARRAY_SIZE(builtin_l4proto));
958 goto cleanup_sockopt2;
962 nf_unregister_sockopt(&so_getorigdst);
963 #if IS_ENABLED(CONFIG_IPV6)
965 nf_unregister_sockopt(&so_getorigdst6);
970 void nf_conntrack_proto_fini(void)
974 nf_unregister_sockopt(&so_getorigdst);
975 #if IS_ENABLED(CONFIG_IPV6)
976 nf_unregister_sockopt(&so_getorigdst6);
978 /* No need to call nf_ct_l4proto_unregister(), the register
979 * tables are free'd here anyway.
981 for (i = 0; i < ARRAY_SIZE(nf_ct_protos); i++)
982 kfree(nf_ct_protos[i]);
985 int nf_conntrack_proto_pernet_init(struct net *net)
988 struct nf_proto_net *pn = nf_ct_l4proto_net(net,
989 &nf_conntrack_l4proto_generic);
991 err = nf_conntrack_l4proto_generic.init_net(net,
992 nf_conntrack_l4proto_generic.l3proto);
995 err = nf_ct_l4proto_register_sysctl(net,
997 &nf_conntrack_l4proto_generic);
1001 err = nf_ct_l4proto_pernet_register(net, builtin_l4proto,
1002 ARRAY_SIZE(builtin_l4proto));
1004 nf_ct_l4proto_unregister_sysctl(net, pn,
1005 &nf_conntrack_l4proto_generic);
1013 void nf_conntrack_proto_pernet_fini(struct net *net)
1015 struct nf_proto_net *pn = nf_ct_l4proto_net(net,
1016 &nf_conntrack_l4proto_generic);
1018 nf_ct_l4proto_pernet_unregister(net, builtin_l4proto,
1019 ARRAY_SIZE(builtin_l4proto));
1021 nf_ct_l4proto_unregister_sysctl(net,
1023 &nf_conntrack_l4proto_generic);
1027 module_param_call(hashsize, nf_conntrack_set_hashsize, param_get_uint,
1028 &nf_conntrack_htable_size, 0600);
1030 MODULE_ALIAS("ip_conntrack");
1031 MODULE_ALIAS("nf_conntrack-" __stringify(AF_INET));
1032 MODULE_ALIAS("nf_conntrack-" __stringify(AF_INET6));
1033 MODULE_LICENSE("GPL");