[net-next-2.6.git] / net / netfilter / nf_conntrack_ecache.c

/* Event cache for netfilter. */

/* (C) 1999-2001 Paul `Rusty' Russell
 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
 * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/types.h>
#include <linux/netfilter.h>
#include <linux/skbuff.h>
#include <linux/vmalloc.h>
#include <linux/stddef.h>
#include <linux/err.h>
#include <linux/percpu.h>
#include <linux/kernel.h>
#include <linux/netdevice.h>
#include <linux/slab.h>

#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_core.h>
#include <net/netfilter/nf_conntrack_extend.h>

static DEFINE_MUTEX(nf_ct_ecache_mutex);

struct nf_ct_event_notifier *nf_conntrack_event_cb __read_mostly;
EXPORT_SYMBOL_GPL(nf_conntrack_event_cb);

struct nf_exp_event_notifier *nf_expect_event_cb __read_mostly;
EXPORT_SYMBOL_GPL(nf_expect_event_cb);

/* deliver cached events and clear cache entry - must be called with locally
 * disabled softirqs */
void nf_ct_deliver_cached_events(struct nf_conn *ct)
{
	unsigned long events;
	struct nf_ct_event_notifier *notify;
	struct nf_conntrack_ecache *e;

	rcu_read_lock();
	notify = rcu_dereference(nf_conntrack_event_cb);
	if (notify == NULL)
		goto out_unlock;

	e = nf_ct_ecache_find(ct);
	if (e == NULL)
		goto out_unlock;

	events = xchg(&e->cache, 0);

	if (nf_ct_is_confirmed(ct) && !nf_ct_is_dying(ct) && events) {
		struct nf_ct_event item = {
			.ct	= ct,
			.pid	= 0,
			.report	= 0
		};
		int ret;
		/* We make a copy of the missed event cache without taking
		 * the lock, thus we may send missed events twice. However,
		 * this does not harm and it happens very rarely. */
		unsigned long missed = e->missed;

		ret = notify->fcn(events | missed, &item);
		if (unlikely(ret < 0 || missed)) {
			spin_lock_bh(&ct->lock);
			if (ret < 0)
				e->missed |= events;
			else
				e->missed &= ~missed;
			spin_unlock_bh(&ct->lock);
		} 
	}

out_unlock:
	rcu_read_unlock();
}
EXPORT_SYMBOL_GPL(nf_ct_deliver_cached_events);

int nf_conntrack_register_notifier(struct nf_ct_event_notifier *new)
{
	int ret = 0;
	struct nf_ct_event_notifier *notify;

	mutex_lock(&nf_ct_ecache_mutex);
	notify = rcu_dereference_protected(nf_conntrack_event_cb,
					   lockdep_is_held(&nf_ct_ecache_mutex));
	if (notify != NULL) {
		ret = -EBUSY;
		goto out_unlock;
	}
	rcu_assign_pointer(nf_conntrack_event_cb, new);
	mutex_unlock(&nf_ct_ecache_mutex);
	return ret;

out_unlock:
	mutex_unlock(&nf_ct_ecache_mutex);
	return ret;
}
EXPORT_SYMBOL_GPL(nf_conntrack_register_notifier);

void nf_conntrack_unregister_notifier(struct nf_ct_event_notifier *new)
{
	struct nf_ct_event_notifier *notify;

	mutex_lock(&nf_ct_ecache_mutex);
	notify = rcu_dereference_protected(nf_conntrack_event_cb,
					   lockdep_is_held(&nf_ct_ecache_mutex));
	BUG_ON(notify != new);
	rcu_assign_pointer(nf_conntrack_event_cb, NULL);
	mutex_unlock(&nf_ct_ecache_mutex);
}
EXPORT_SYMBOL_GPL(nf_conntrack_unregister_notifier);

int nf_ct_expect_register_notifier(struct nf_exp_event_notifier *new)
{
	int ret = 0;
	struct nf_exp_event_notifier *notify;

	mutex_lock(&nf_ct_ecache_mutex);
	notify = rcu_dereference_protected(nf_expect_event_cb,
					   lockdep_is_held(&nf_ct_ecache_mutex));
	if (notify != NULL) {
		ret = -EBUSY;
		goto out_unlock;
	}
	rcu_assign_pointer(nf_expect_event_cb, new);
	mutex_unlock(&nf_ct_ecache_mutex);
	return ret;

out_unlock:
	mutex_unlock(&nf_ct_ecache_mutex);
	return ret;
}
EXPORT_SYMBOL_GPL(nf_ct_expect_register_notifier);

void nf_ct_expect_unregister_notifier(struct nf_exp_event_notifier *new)
{
	struct nf_exp_event_notifier *notify;

	mutex_lock(&nf_ct_ecache_mutex);
	notify = rcu_dereference_protected(nf_expect_event_cb,
					   lockdep_is_held(&nf_ct_ecache_mutex));
	BUG_ON(notify != new);
	rcu_assign_pointer(nf_expect_event_cb, NULL);
	mutex_unlock(&nf_ct_ecache_mutex);
}
EXPORT_SYMBOL_GPL(nf_ct_expect_unregister_notifier);

#define NF_CT_EVENTS_DEFAULT 1
static int nf_ct_events __read_mostly = NF_CT_EVENTS_DEFAULT;
static int nf_ct_events_retry_timeout __read_mostly = 15*HZ;

#ifdef CONFIG_SYSCTL
static struct ctl_table event_sysctl_table[] = {
	{
		.procname	= "nf_conntrack_events",
		.data		= &init_net.ct.sysctl_events,
		.maxlen		= sizeof(unsigned int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec,
	},
	{
		.procname	= "nf_conntrack_events_retry_timeout",
		.data		= &init_net.ct.sysctl_events_retry_timeout,
		.maxlen		= sizeof(unsigned int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec_jiffies,
	},
	{}
};
#endif /* CONFIG_SYSCTL */

static struct nf_ct_ext_type event_extend __read_mostly = {
	.len	= sizeof(struct nf_conntrack_ecache),
	.align	= __alignof__(struct nf_conntrack_ecache),
	.id	= NF_CT_EXT_ECACHE,
};

#ifdef CONFIG_SYSCTL
static int nf_conntrack_event_init_sysctl(struct net *net)
{
	struct ctl_table *table;

	table = kmemdup(event_sysctl_table, sizeof(event_sysctl_table),
			GFP_KERNEL);
	if (!table)
		goto out;

	table[0].data = &net->ct.sysctl_events;
	table[1].data = &net->ct.sysctl_events_retry_timeout;

	net->ct.event_sysctl_header =
		register_net_sysctl_table(net,
					  nf_net_netfilter_sysctl_path, table);
	if (!net->ct.event_sysctl_header) {
		printk(KERN_ERR "nf_ct_event: can't register to sysctl.\n");
		goto out_register;
	}
	return 0;

out_register:
	kfree(table);
out:
	return -ENOMEM;
}

static void nf_conntrack_event_fini_sysctl(struct net *net)
{
	struct ctl_table *table;

	table = net->ct.event_sysctl_header->ctl_table_arg;
	unregister_net_sysctl_table(net->ct.event_sysctl_header);
	kfree(table);
}
#else
static int nf_conntrack_event_init_sysctl(struct net *net)
{
	return 0;
}

static void nf_conntrack_event_fini_sysctl(struct net *net)
{
}
#endif /* CONFIG_SYSCTL */

int nf_conntrack_ecache_init(struct net *net)
{
	int ret;

	net->ct.sysctl_events = nf_ct_events;
	net->ct.sysctl_events_retry_timeout = nf_ct_events_retry_timeout;

	if (net_eq(net, &init_net)) {
		ret = nf_ct_extend_register(&event_extend);
		if (ret < 0) {
			printk(KERN_ERR "nf_ct_event: Unable to register "
					"event extension.\n");
			goto out_extend_register;
		}
	}

	ret = nf_conntrack_event_init_sysctl(net);
	if (ret < 0)
		goto out_sysctl;

	return 0;

out_sysctl:
	if (net_eq(net, &init_net))
		nf_ct_extend_unregister(&event_extend);
out_extend_register:
	return ret;
}

void nf_conntrack_ecache_fini(struct net *net)
{
	nf_conntrack_event_fini_sysctl(net);
	if (net_eq(net, &init_net))
		nf_ct_extend_unregister(&event_extend);
}
Commit	Line	Data
f6180121 MJ	1	/* Event cache for netfilter. */
	2
	3	/* (C) 1999-2001 Paul `Rusty' Russell
	4	* (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
	5	* (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
	6	*
	7	* This program is free software; you can redistribute it and/or modify
	8	* it under the terms of the GNU General Public License version 2 as
	9	* published by the Free Software Foundation.
	10	*/
	11
	12	#include <linux/types.h>
	13	#include <linux/netfilter.h>
	14	#include <linux/skbuff.h>
	15	#include <linux/vmalloc.h>
	16	#include <linux/stddef.h>
	17	#include <linux/err.h>
	18	#include <linux/percpu.h>
f6180121 MJ	19	#include <linux/kernel.h>
f6180121 MJ	20	#include <linux/netdevice.h>
5a0e3ad6	21	#include <linux/slab.h>
f6180121 MJ	22
f6180121 MJ	23	#include <net/netfilter/nf_conntrack.h>
f6180121	24	#include <net/netfilter/nf_conntrack_core.h>
a0891aa6	25	#include <net/netfilter/nf_conntrack_extend.h>
f6180121	26
e34d5c1a	27	static DEFINE_MUTEX(nf_ct_ecache_mutex);
13b18339	28
e34d5c1a PNA	29	struct nf_ct_event_notifier *nf_conntrack_event_cb __read_mostly;
	30	EXPORT_SYMBOL_GPL(nf_conntrack_event_cb);
	31
	32	struct nf_exp_event_notifier *nf_expect_event_cb __read_mostly;
	33	EXPORT_SYMBOL_GPL(nf_expect_event_cb);
f6180121	34
f6180121 MJ	35	/* deliver cached events and clear cache entry - must be called with locally
f6180121 MJ	36	* disabled softirqs */
a0891aa6	37	void nf_ct_deliver_cached_events(struct nf_conn *ct)
f6180121	38	{
a0891aa6	39	unsigned long events;
e34d5c1a	40	struct nf_ct_event_notifier *notify;
a0891aa6	41	struct nf_conntrack_ecache *e;
e34d5c1a PNA	42
	43	rcu_read_lock();
	44	notify = rcu_dereference(nf_conntrack_event_cb);
	45	if (notify == NULL)
	46	goto out_unlock;
	47
a0891aa6 PNA	48	e = nf_ct_ecache_find(ct);
	49	if (e == NULL)
	50	goto out_unlock;
	51
	52	events = xchg(&e->cache, 0);
	53
	54	if (nf_ct_is_confirmed(ct) && !nf_ct_is_dying(ct) && events) {
19abb7b0	55	struct nf_ct_event item = {
a0891aa6	56	.ct = ct,
19abb7b0 PNA	57	.pid = 0,
	58	.report = 0
	59	};
dd7669a9 PNA	60	int ret;
	61	/* We make a copy of the missed event cache without taking
	62	* the lock, thus we may send missed events twice. However,
	63	* this does not harm and it happens very rarely. */
	64	unsigned long missed = e->missed;
	65
	66	ret = notify->fcn(events \| missed, &item);
	67	if (unlikely(ret < 0 \|\| missed)) {
	68	spin_lock_bh(&ct->lock);
	69	if (ret < 0)
	70	e->missed \|= events;
	71	else
	72	e->missed &= ~missed;
	73	spin_unlock_bh(&ct->lock);
	74	}
19abb7b0	75	}
f6180121	76
e34d5c1a PNA	77	out_unlock:
e34d5c1a PNA	78	rcu_read_unlock();
f6180121	79	}
13b18339	80	EXPORT_SYMBOL_GPL(nf_ct_deliver_cached_events);
f6180121	81
e34d5c1a	82	int nf_conntrack_register_notifier(struct nf_ct_event_notifier *new)
010c7d6f	83	{
e34d5c1a	84	int ret = 0;
b56f2d55	85	struct nf_ct_event_notifier *notify;
e34d5c1a PNA	86
e34d5c1a PNA	87	mutex_lock(&nf_ct_ecache_mutex);
b56f2d55 PM	88	notify = rcu_dereference_protected(nf_conntrack_event_cb,
	89	lockdep_is_held(&nf_ct_ecache_mutex));
	90	if (notify != NULL) {
e34d5c1a PNA	91	ret = -EBUSY;
	92	goto out_unlock;
	93	}
	94	rcu_assign_pointer(nf_conntrack_event_cb, new);
	95	mutex_unlock(&nf_ct_ecache_mutex);
	96	return ret;
	97
	98	out_unlock:
	99	mutex_unlock(&nf_ct_ecache_mutex);
	100	return ret;
010c7d6f PM	101	}
	102	EXPORT_SYMBOL_GPL(nf_conntrack_register_notifier);
	103
e34d5c1a	104	void nf_conntrack_unregister_notifier(struct nf_ct_event_notifier *new)
010c7d6f	105	{
b56f2d55 PM	106	struct nf_ct_event_notifier *notify;
b56f2d55 PM	107
e34d5c1a	108	mutex_lock(&nf_ct_ecache_mutex);
b56f2d55 PM	109	notify = rcu_dereference_protected(nf_conntrack_event_cb,
	110	lockdep_is_held(&nf_ct_ecache_mutex));
	111	BUG_ON(notify != new);
e34d5c1a PNA	112	rcu_assign_pointer(nf_conntrack_event_cb, NULL);
e34d5c1a PNA	113	mutex_unlock(&nf_ct_ecache_mutex);
010c7d6f PM	114	}
	115	EXPORT_SYMBOL_GPL(nf_conntrack_unregister_notifier);
	116
e34d5c1a	117	int nf_ct_expect_register_notifier(struct nf_exp_event_notifier *new)
010c7d6f	118	{
e34d5c1a	119	int ret = 0;
b56f2d55	120	struct nf_exp_event_notifier *notify;
e34d5c1a PNA	121
e34d5c1a PNA	122	mutex_lock(&nf_ct_ecache_mutex);
b56f2d55 PM	123	notify = rcu_dereference_protected(nf_expect_event_cb,
	124	lockdep_is_held(&nf_ct_ecache_mutex));
	125	if (notify != NULL) {
e34d5c1a PNA	126	ret = -EBUSY;
	127	goto out_unlock;
	128	}
	129	rcu_assign_pointer(nf_expect_event_cb, new);
	130	mutex_unlock(&nf_ct_ecache_mutex);
	131	return ret;
	132
	133	out_unlock:
	134	mutex_unlock(&nf_ct_ecache_mutex);
	135	return ret;
010c7d6f	136	}
6823645d	137	EXPORT_SYMBOL_GPL(nf_ct_expect_register_notifier);
010c7d6f	138
e34d5c1a	139	void nf_ct_expect_unregister_notifier(struct nf_exp_event_notifier *new)
010c7d6f	140	{
b56f2d55 PM	141	struct nf_exp_event_notifier *notify;
b56f2d55 PM	142
e34d5c1a	143	mutex_lock(&nf_ct_ecache_mutex);
b56f2d55 PM	144	notify = rcu_dereference_protected(nf_expect_event_cb,
	145	lockdep_is_held(&nf_ct_ecache_mutex));
	146	BUG_ON(notify != new);
e34d5c1a PNA	147	rcu_assign_pointer(nf_expect_event_cb, NULL);
e34d5c1a PNA	148	mutex_unlock(&nf_ct_ecache_mutex);
010c7d6f	149	}
6823645d	150	EXPORT_SYMBOL_GPL(nf_ct_expect_unregister_notifier);
a0891aa6 PNA	151
	152	#define NF_CT_EVENTS_DEFAULT 1
	153	static int nf_ct_events __read_mostly = NF_CT_EVENTS_DEFAULT;
dd7669a9	154	static int nf_ct_events_retry_timeout __read_mostly = 15*HZ;
a0891aa6 PNA	155
	156	#ifdef CONFIG_SYSCTL
	157	static struct ctl_table event_sysctl_table[] = {
	158	{
a0891aa6 PNA	159	.procname = "nf_conntrack_events",
	160	.data = &init_net.ct.sysctl_events,
	161	.maxlen = sizeof(unsigned int),
	162	.mode = 0644,
	163	.proc_handler = proc_dointvec,
	164	},
dd7669a9	165	{
dd7669a9 PNA	166	.procname = "nf_conntrack_events_retry_timeout",
	167	.data = &init_net.ct.sysctl_events_retry_timeout,
	168	.maxlen = sizeof(unsigned int),
	169	.mode = 0644,
	170	.proc_handler = proc_dointvec_jiffies,
	171	},
a0891aa6 PNA	172	{}
	173	};
	174	#endif /* CONFIG_SYSCTL */
	175
	176	static struct nf_ct_ext_type event_extend __read_mostly = {
	177	.len = sizeof(struct nf_conntrack_ecache),
	178	.align = __alignof__(struct nf_conntrack_ecache),
	179	.id = NF_CT_EXT_ECACHE,
	180	};
	181
	182	#ifdef CONFIG_SYSCTL
	183	static int nf_conntrack_event_init_sysctl(struct net *net)
	184	{
	185	struct ctl_table *table;
	186
	187	table = kmemdup(event_sysctl_table, sizeof(event_sysctl_table),
	188	GFP_KERNEL);
	189	if (!table)
	190	goto out;
	191
	192	table[0].data = &net->ct.sysctl_events;
dd7669a9	193	table[1].data = &net->ct.sysctl_events_retry_timeout;
a0891aa6 PNA	194
	195	net->ct.event_sysctl_header =
	196	register_net_sysctl_table(net,
	197	nf_net_netfilter_sysctl_path, table);
	198	if (!net->ct.event_sysctl_header) {
	199	printk(KERN_ERR "nf_ct_event: can't register to sysctl.\n");
	200	goto out_register;
	201	}
	202	return 0;
	203
	204	out_register:
	205	kfree(table);
	206	out:
	207	return -ENOMEM;
	208	}
	209
	210	static void nf_conntrack_event_fini_sysctl(struct net *net)
	211	{
	212	struct ctl_table *table;
	213
	214	table = net->ct.event_sysctl_header->ctl_table_arg;
	215	unregister_net_sysctl_table(net->ct.event_sysctl_header);
	216	kfree(table);
	217	}
	218	#else
	219	static int nf_conntrack_event_init_sysctl(struct net *net)
	220	{
	221	return 0;
	222	}
	223
	224	static void nf_conntrack_event_fini_sysctl(struct net *net)
	225	{
	226	}
	227	#endif /* CONFIG_SYSCTL */
	228
	229	int nf_conntrack_ecache_init(struct net *net)
	230	{
	231	int ret;
	232
	233	net->ct.sysctl_events = nf_ct_events;
dd7669a9	234	net->ct.sysctl_events_retry_timeout = nf_ct_events_retry_timeout;
a0891aa6 PNA	235
	236	if (net_eq(net, &init_net)) {
	237	ret = nf_ct_extend_register(&event_extend);
	238	if (ret < 0) {
	239	printk(KERN_ERR "nf_ct_event: Unable to register "
	240	"event extension.\n");
	241	goto out_extend_register;
	242	}
	243	}
	244
	245	ret = nf_conntrack_event_init_sysctl(net);
	246	if (ret < 0)
	247	goto out_sysctl;
	248
	249	return 0;
	250
	251	out_sysctl:
	252	if (net_eq(net, &init_net))
	253	nf_ct_extend_unregister(&event_extend);
	254	out_extend_register:
	255	return ret;
	256	}
	257
	258	void nf_conntrack_ecache_fini(struct net *net)
	259	{
	260	nf_conntrack_event_fini_sysctl(net);
	261	if (net_eq(net, &init_net))
	262	nf_ct_extend_unregister(&event_extend);
	263	}