[net-next-2.6.git] / include / net / netfilter / nf_conntrack_ecache.h

/*
 * connection tracking event cache.
 */

#ifndef _NF_CONNTRACK_ECACHE_H
#define _NF_CONNTRACK_ECACHE_H
#include <net/netfilter/nf_conntrack.h>

#include <net/net_namespace.h>
#include <net/netfilter/nf_conntrack_expect.h>
#include <linux/netfilter/nf_conntrack_common.h>
#include <linux/netfilter/nf_conntrack_tuple_common.h>
#include <net/netfilter/nf_conntrack_extend.h>

/* Connection tracking event types */
enum ip_conntrack_events {
	IPCT_NEW,		/* new conntrack */
	IPCT_RELATED,		/* related conntrack */
	IPCT_DESTROY,		/* destroyed conntrack */
	IPCT_REPLY,		/* connection has seen two-way traffic */
	IPCT_ASSURED,		/* connection status has changed to assured */
	IPCT_PROTOINFO,		/* protocol information has changed */
	IPCT_HELPER,		/* new helper has been set */
	IPCT_MARK,		/* new mark has been set */
	IPCT_NATSEQADJ,		/* NAT is doing sequence adjustment */
	IPCT_SECMARK,		/* new security mark has been set */
};

enum ip_conntrack_expect_events {
	IPEXP_NEW,		/* new expectation */
};

struct nf_conntrack_ecache {
	unsigned long cache;		/* bitops want long */
	unsigned long missed;		/* missed events */
	u32 pid;			/* netlink pid of destroyer */
};

static inline struct nf_conntrack_ecache *
nf_ct_ecache_find(const struct nf_conn *ct)
{
	return nf_ct_ext_find(ct, NF_CT_EXT_ECACHE);
}

static inline struct nf_conntrack_ecache *
nf_ct_ecache_ext_add(struct nf_conn *ct, gfp_t gfp)
{
	struct net *net = nf_ct_net(ct);

	if (!net->ct.sysctl_events)
		return NULL;

	return nf_ct_ext_add(ct, NF_CT_EXT_ECACHE, gfp);
};

#ifdef CONFIG_NF_CONNTRACK_EVENTS
/* This structure is passed to event handler */
struct nf_ct_event {
	struct nf_conn *ct;
	u32 pid;
	int report;
};

struct nf_ct_event_notifier {
	int (*fcn)(unsigned int events, struct nf_ct_event *item);
};

extern struct nf_ct_event_notifier *nf_conntrack_event_cb;
extern int nf_conntrack_register_notifier(struct nf_ct_event_notifier *nb);
extern void nf_conntrack_unregister_notifier(struct nf_ct_event_notifier *nb);

extern void nf_ct_deliver_cached_events(struct nf_conn *ct);

static inline void
nf_conntrack_event_cache(enum ip_conntrack_events event, struct nf_conn *ct)
{
	struct nf_conntrack_ecache *e;

	if (nf_conntrack_event_cb == NULL)
		return;

	e = nf_ct_ecache_find(ct);
	if (e == NULL)
		return;

	set_bit(event, &e->cache);
}

static inline int
nf_conntrack_eventmask_report(unsigned int eventmask,
			      struct nf_conn *ct,
			      u32 pid,
			      int report)
{
	int ret = 0;
	struct net *net = nf_ct_net(ct);
	struct nf_ct_event_notifier *notify;
	struct nf_conntrack_ecache *e;

	rcu_read_lock();
	notify = rcu_dereference(nf_conntrack_event_cb);
	if (notify == NULL)
		goto out_unlock;

	if (!net->ct.sysctl_events)
		goto out_unlock;

	e = nf_ct_ecache_find(ct);
	if (e == NULL)
		goto out_unlock;

	if (nf_ct_is_confirmed(ct) && !nf_ct_is_dying(ct)) {
		struct nf_ct_event item = {
			.ct 	= ct,
			.pid	= e->pid ? e->pid : pid,
			.report = report
		};
		/* This is a resent of a destroy event? If so, skip missed */
		unsigned long missed = e->pid ? 0 : e->missed;

		ret = notify->fcn(eventmask | missed, &item);
		if (unlikely(ret < 0 || missed)) {
			spin_lock_bh(&ct->lock);
			if (ret < 0) {
				/* This is a destroy event that has been
				 * triggered by a process, we store the PID
				 * to include it in the retransmission. */
				if (eventmask & (1 << IPCT_DESTROY) &&
				    e->pid == 0 && pid != 0)
					e->pid = pid;
				else
					e->missed |= eventmask;
			} else
				e->missed &= ~missed;
			spin_unlock_bh(&ct->lock);
		}
	}
out_unlock:
	rcu_read_unlock();
	return ret;
}

static inline int
nf_conntrack_event_report(enum ip_conntrack_events event, struct nf_conn *ct,
			  u32 pid, int report)
{
	return nf_conntrack_eventmask_report(1 << event, ct, pid, report);
}

static inline int
nf_conntrack_event(enum ip_conntrack_events event, struct nf_conn *ct)
{
	return nf_conntrack_eventmask_report(1 << event, ct, 0, 0);
}

struct nf_exp_event {
	struct nf_conntrack_expect *exp;
	u32 pid;
	int report;
};

struct nf_exp_event_notifier {
	int (*fcn)(unsigned int events, struct nf_exp_event *item);
};

extern struct nf_exp_event_notifier *nf_expect_event_cb;
extern int nf_ct_expect_register_notifier(struct nf_exp_event_notifier *nb);
extern void nf_ct_expect_unregister_notifier(struct nf_exp_event_notifier *nb);

static inline void
nf_ct_expect_event_report(enum ip_conntrack_expect_events event,
			  struct nf_conntrack_expect *exp,
			  u32 pid,
			  int report)
{
	struct net *net = nf_ct_exp_net(exp);
	struct nf_exp_event_notifier *notify;

	rcu_read_lock();
	notify = rcu_dereference(nf_expect_event_cb);
	if (notify == NULL)
		goto out_unlock;

	if (!net->ct.sysctl_events)
		goto out_unlock;

	{
		struct nf_exp_event item = {
			.exp	= exp,
			.pid	= pid,
			.report = report
		};
		notify->fcn(1 << event, &item);
	}
out_unlock:
	rcu_read_unlock();
}

static inline void
nf_ct_expect_event(enum ip_conntrack_expect_events event,
		   struct nf_conntrack_expect *exp)
{
	nf_ct_expect_event_report(event, exp, 0, 0);
}

extern int nf_conntrack_ecache_init(struct net *net);
extern void nf_conntrack_ecache_fini(struct net *net);

#else /* CONFIG_NF_CONNTRACK_EVENTS */

static inline void nf_conntrack_event_cache(enum ip_conntrack_events event,
					    struct nf_conn *ct) {}
static inline int nf_conntrack_eventmask_report(unsigned int eventmask,
						struct nf_conn *ct,
						u32 pid,
						int report) { return 0; }
static inline int nf_conntrack_event(enum ip_conntrack_events event,
				     struct nf_conn *ct) { return 0; }
static inline int nf_conntrack_event_report(enum ip_conntrack_events event,
					    struct nf_conn *ct,
					    u32 pid,
					    int report) { return 0; }
static inline void nf_ct_deliver_cached_events(const struct nf_conn *ct) {}
static inline void nf_ct_expect_event(enum ip_conntrack_expect_events event,
				      struct nf_conntrack_expect *exp) {}
static inline void nf_ct_expect_event_report(enum ip_conntrack_expect_events e,
					     struct nf_conntrack_expect *exp,
 					     u32 pid,
 					     int report) {}

static inline int nf_conntrack_ecache_init(struct net *net)
{
	return 0;
}

static inline void nf_conntrack_ecache_fini(struct net *net)
{
}
#endif /* CONFIG_NF_CONNTRACK_EVENTS */

#endif /*_NF_CONNTRACK_ECACHE_H*/
Commit	Line	Data
f6180121 MJ	1	/*
	2	* connection tracking event cache.
	3	*/
	4
	5	#ifndef _NF_CONNTRACK_ECACHE_H
	6	#define _NF_CONNTRACK_ECACHE_H
	7	#include <net/netfilter/nf_conntrack.h>
	8
6058fa6b	9	#include <net/net_namespace.h>
f6180121	10	#include <net/netfilter/nf_conntrack_expect.h>
a0891aa6 PNA	11	#include <linux/netfilter/nf_conntrack_common.h>
	12	#include <linux/netfilter/nf_conntrack_tuple_common.h>
	13	#include <net/netfilter/nf_conntrack_extend.h>
f6180121	14
a0891aa6	15	/* Connection tracking event types */
fd2c3ef7	16	enum ip_conntrack_events {
858b3133 PM	17	IPCT_NEW, /* new conntrack */
	18	IPCT_RELATED, /* related conntrack */
	19	IPCT_DESTROY, /* destroyed conntrack */
	20	IPCT_REPLY, /* connection has seen two-way traffic */
	21	IPCT_ASSURED, /* connection status has changed to assured */
	22	IPCT_PROTOINFO, /* protocol information has changed */
	23	IPCT_HELPER, /* new helper has been set */
	24	IPCT_MARK, /* new mark has been set */
	25	IPCT_NATSEQADJ, /* NAT is doing sequence adjustment */
	26	IPCT_SECMARK, /* new security mark has been set */
a0891aa6	27	};
6bfea198	28
a0891aa6	29	enum ip_conntrack_expect_events {
858b3133	30	IPEXP_NEW, /* new expectation */
a0891aa6	31	};
6bfea198	32
a0891aa6 PNA	33	struct nf_conntrack_ecache {
a0891aa6 PNA	34	unsigned long cache; /* bitops want long */
dd7669a9 PNA	35	unsigned long missed; /* missed events */
dd7669a9 PNA	36	u32 pid; /* netlink pid of destroyer */
a0891aa6	37	};
6bfea198	38
a0891aa6 PNA	39	static inline struct nf_conntrack_ecache *
	40	nf_ct_ecache_find(const struct nf_conn *ct)
	41	{
	42	return nf_ct_ext_find(ct, NF_CT_EXT_ECACHE);
	43	}
6bfea198	44
a0891aa6 PNA	45	static inline struct nf_conntrack_ecache *
	46	nf_ct_ecache_ext_add(struct nf_conn *ct, gfp_t gfp)
	47	{
	48	struct net *net = nf_ct_net(ct);
6bfea198	49
a0891aa6 PNA	50	if (!net->ct.sysctl_events)
a0891aa6 PNA	51	return NULL;
6bfea198	52
a0891aa6	53	return nf_ct_ext_add(ct, NF_CT_EXT_ECACHE, gfp);
6bfea198 PNA	54	};
6bfea198 PNA	55
f6180121	56	#ifdef CONFIG_NF_CONNTRACK_EVENTS
19abb7b0 PNA	57	/* This structure is passed to event handler */
	58	struct nf_ct_event {
	59	struct nf_conn *ct;
	60	u32 pid;
	61	int report;
	62	};
	63
e34d5c1a PNA	64	struct nf_ct_event_notifier {
	65	int (fcn)(unsigned int events, struct nf_ct_event item);
	66	};
	67
	68	extern struct nf_ct_event_notifier *nf_conntrack_event_cb;
	69	extern int nf_conntrack_register_notifier(struct nf_ct_event_notifier *nb);
	70	extern void nf_conntrack_unregister_notifier(struct nf_ct_event_notifier *nb);
f6180121	71
a0891aa6	72	extern void nf_ct_deliver_cached_events(struct nf_conn *ct);
f6180121 MJ	73
f6180121 MJ	74	static inline void
a71996fc	75	nf_conntrack_event_cache(enum ip_conntrack_events event, struct nf_conn *ct)
f6180121	76	{
a0891aa6 PNA	77	struct nf_conntrack_ecache *e;
	78
	79	if (nf_conntrack_event_cb == NULL)
	80	return;
	81
	82	e = nf_ct_ecache_find(ct);
	83	if (e == NULL)
	84	return;
	85
	86	set_bit(event, &e->cache);
f6180121 MJ	87	}
f6180121 MJ	88
dd7669a9	89	static inline int
a0891aa6 PNA	90	nf_conntrack_eventmask_report(unsigned int eventmask,
	91	struct nf_conn *ct,
	92	u32 pid,
	93	int report)
f6180121	94	{
dd7669a9	95	int ret = 0;
a0891aa6	96	struct net *net = nf_ct_net(ct);
e34d5c1a	97	struct nf_ct_event_notifier *notify;
dd7669a9	98	struct nf_conntrack_ecache *e;
e34d5c1a PNA	99
	100	rcu_read_lock();
	101	notify = rcu_dereference(nf_conntrack_event_cb);
	102	if (notify == NULL)
	103	goto out_unlock;
	104
a0891aa6 PNA	105	if (!net->ct.sysctl_events)
	106	goto out_unlock;
	107
dd7669a9 PNA	108	e = nf_ct_ecache_find(ct);
	109	if (e == NULL)
	110	goto out_unlock;
	111
e34d5c1a PNA	112	if (nf_ct_is_confirmed(ct) && !nf_ct_is_dying(ct)) {
	113	struct nf_ct_event item = {
	114	.ct = ct,
dd7669a9	115	.pid = e->pid ? e->pid : pid,
e34d5c1a PNA	116	.report = report
e34d5c1a PNA	117	};
dd7669a9 PNA	118	/* This is a resent of a destroy event? If so, skip missed */
	119	unsigned long missed = e->pid ? 0 : e->missed;
	120
	121	ret = notify->fcn(eventmask \| missed, &item);
	122	if (unlikely(ret < 0 \|\| missed)) {
	123	spin_lock_bh(&ct->lock);
	124	if (ret < 0) {
	125	/* This is a destroy event that has been
	126	* triggered by a process, we store the PID
	127	* to include it in the retransmission. */
	128	if (eventmask & (1 << IPCT_DESTROY) &&
	129	e->pid == 0 && pid != 0)
	130	e->pid = pid;
	131	else
	132	e->missed \|= eventmask;
	133	} else
	134	e->missed &= ~missed;
	135	spin_unlock_bh(&ct->lock);
	136	}
e34d5c1a PNA	137	}
	138	out_unlock:
	139	rcu_read_unlock();
dd7669a9	140	return ret;
f6180121 MJ	141	}
f6180121 MJ	142
dd7669a9	143	static inline int
a0891aa6 PNA	144	nf_conntrack_event_report(enum ip_conntrack_events event, struct nf_conn *ct,
	145	u32 pid, int report)
	146	{
dd7669a9	147	return nf_conntrack_eventmask_report(1 << event, ct, pid, report);
a0891aa6 PNA	148	}
a0891aa6 PNA	149
dd7669a9	150	static inline int
19abb7b0 PNA	151	nf_conntrack_event(enum ip_conntrack_events event, struct nf_conn *ct)
19abb7b0 PNA	152	{
dd7669a9	153	return nf_conntrack_eventmask_report(1 << event, ct, 0, 0);
19abb7b0 PNA	154	}
	155
	156	struct nf_exp_event {
	157	struct nf_conntrack_expect *exp;
	158	u32 pid;
	159	int report;
	160	};
	161
e34d5c1a PNA	162	struct nf_exp_event_notifier {
	163	int (fcn)(unsigned int events, struct nf_exp_event item);
	164	};
	165
	166	extern struct nf_exp_event_notifier *nf_expect_event_cb;
	167	extern int nf_ct_expect_register_notifier(struct nf_exp_event_notifier *nb);
	168	extern void nf_ct_expect_unregister_notifier(struct nf_exp_event_notifier *nb);
010c7d6f	169
19abb7b0 PNA	170	static inline void
	171	nf_ct_expect_event_report(enum ip_conntrack_expect_events event,
	172	struct nf_conntrack_expect *exp,
	173	u32 pid,
	174	int report)
	175	{
a0891aa6	176	struct net *net = nf_ct_exp_net(exp);
e34d5c1a PNA	177	struct nf_exp_event_notifier *notify;
	178
	179	rcu_read_lock();
	180	notify = rcu_dereference(nf_expect_event_cb);
	181	if (notify == NULL)
	182	goto out_unlock;
	183
a0891aa6 PNA	184	if (!net->ct.sysctl_events)
	185	goto out_unlock;
	186
e34d5c1a PNA	187	{
	188	struct nf_exp_event item = {
	189	.exp = exp,
	190	.pid = pid,
	191	.report = report
	192	};
a0891aa6	193	notify->fcn(1 << event, &item);
e34d5c1a PNA	194	}
	195	out_unlock:
	196	rcu_read_unlock();
19abb7b0 PNA	197	}
19abb7b0 PNA	198
f6180121	199	static inline void
6823645d PM	200	nf_ct_expect_event(enum ip_conntrack_expect_events event,
6823645d PM	201	struct nf_conntrack_expect *exp)
f6180121	202	{
19abb7b0	203	nf_ct_expect_event_report(event, exp, 0, 0);
f6180121 MJ	204	}
f6180121 MJ	205
6058fa6b AD	206	extern int nf_conntrack_ecache_init(struct net *net);
	207	extern void nf_conntrack_ecache_fini(struct net *net);
	208
f6180121 MJ	209	#else /* CONFIG_NF_CONNTRACK_EVENTS */
	210
	211	static inline void nf_conntrack_event_cache(enum ip_conntrack_events event,
64f1b653	212	struct nf_conn *ct) {}
dd7669a9 PNA	213	static inline int nf_conntrack_eventmask_report(unsigned int eventmask,
	214	struct nf_conn *ct,
	215	u32 pid,
	216	int report) { return 0; }
	217	static inline int nf_conntrack_event(enum ip_conntrack_events event,
	218	struct nf_conn *ct) { return 0; }
	219	static inline int nf_conntrack_event_report(enum ip_conntrack_events event,
	220	struct nf_conn *ct,
	221	u32 pid,
	222	int report) { return 0; }
f6180121	223	static inline void nf_ct_deliver_cached_events(const struct nf_conn *ct) {}
6823645d PM	224	static inline void nf_ct_expect_event(enum ip_conntrack_expect_events event,
6823645d PM	225	struct nf_conntrack_expect *exp) {}
19abb7b0 PNA	226	static inline void nf_ct_expect_event_report(enum ip_conntrack_expect_events e,
	227	struct nf_conntrack_expect *exp,
	228	u32 pid,
	229	int report) {}
6058fa6b AD	230
	231	static inline int nf_conntrack_ecache_init(struct net *net)
	232	{
	233	return 0;
bb21c95e	234	}
6058fa6b AD	235
	236	static inline void nf_conntrack_ecache_fini(struct net *net)
	237	{
	238	}
f6180121 MJ	239	#endif /* CONFIG_NF_CONNTRACK_EVENTS */
	240
	241	#endif /_NF_CONNTRACK_ECACHE_H/
	242