kernel/linux/net/ipv4/netfilter/ip_conntrack_standalone.c

   1 /* This file contains all the functions required for the standalone
   2    ip_conntrack module.
   3
   4    These are not required by the compatibility layer.
   5 */
   6
   7 /* (C) 1999-2001 Paul `Rusty' Russell
   8  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
   9  *
  10  * This program is free software; you can redistribute it and/or modify
  11  * it under the terms of the GNU General Public License version 2 as
  12  * published by the Free Software Foundation.
  13  */
  14
  15 #include <linux/config.h>
  16 #include <linux/types.h>
  17 #include <linux/ip.h>
  18 #include <linux/netfilter.h>
  19 #include <linux/netfilter_ipv4.h>
  20 #include <linux/module.h>
  21 #include <linux/skbuff.h>
  22 #include <linux/proc_fs.h>
  23 #ifdef CONFIG_SYSCTL
  24 #include <linux/sysctl.h>
  25 #endif
  26 #include <net/checksum.h>
  27 #include <net/ip.h>
  28
  29 #define ASSERT_READ_LOCK(x) MUST_BE_READ_LOCKED(&ip_conntrack_lock)
  30 #define ASSERT_WRITE_LOCK(x) MUST_BE_WRITE_LOCKED(&ip_conntrack_lock)
  31
  32 #include <linux/netfilter_ipv4/ip_conntrack.h>
  33 #include <linux/netfilter_ipv4/ip_conntrack_protocol.h>
  34 #include <linux/netfilter_ipv4/ip_conntrack_core.h>
  35 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
  36 #include <linux/netfilter_ipv4/listhelp.h>
  37
  38 #if 0
  39 #define DEBUGP printk
  40 #else
  41 #define DEBUGP(format, args...)
  42 #endif
  43
  44 MODULE_LICENSE("GPL");
  45
  46 static int kill_proto(const struct ip_conntrack *i, void *data)
  47 {
  48         return (i->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum ==
  49                         *((u_int8_t *) data));
  50 }
  51
  52 static unsigned int
  53 print_tuple(char *buffer, const struct ip_conntrack_tuple *tuple,
  54             struct ip_conntrack_protocol *proto)
  55 {
  56         int len;
  57
  58         len = sprintf(buffer, "src=%u.%u.%u.%u dst=%u.%u.%u.%u ",
  59                       NIPQUAD(tuple->src.ip), NIPQUAD(tuple->dst.ip));
  60
  61         len += proto->print_tuple(buffer + len, tuple);
  62
  63         return len;
  64 }
  65
  66 /* FIXME: Don't print source proto part. --RR */
  67 static unsigned int
  68 print_expect(char *buffer, const struct ip_conntrack_expect *expect)
  69 {
  70         unsigned int len;
  71
  72         if (expect->expectant->helper->timeout)
  73                 len = sprintf(buffer, "EXPECTING: %lu ",
  74                               timer_pending(&expect->timeout)
  75                               ? (expect->timeout.expires - jiffies)/HZ : 0);
  76         else
  77                 len = sprintf(buffer, "EXPECTING: - ");
  78         len += sprintf(buffer + len, "use=%u proto=%u ",
  79                       atomic_read(&expect->use), expect->tuple.dst.protonum);
  80         len += print_tuple(buffer + len, &expect->tuple,
  81                            __ip_ct_find_proto(expect->tuple.dst.protonum));
  82         len += sprintf(buffer + len, "\n");
  83         return len;
  84 }
  85
  86 static unsigned int
  87 print_conntrack(char *buffer, struct ip_conntrack *conntrack)
  88 {
  89         unsigned int len;
  90         struct ip_conntrack_protocol *proto
  91                 = __ip_ct_find_proto(conntrack->tuplehash[IP_CT_DIR_ORIGINAL]
  92                                .tuple.dst.protonum);
  93
  94         len = sprintf(buffer, "%-8s %u %lu ",
  95                       proto->name,
  96                       conntrack->tuplehash[IP_CT_DIR_ORIGINAL]
  97                       .tuple.dst.protonum,
  98                       timer_pending(&conntrack->timeout)
  99                       ? (conntrack->timeout.expires - jiffies)/HZ : 0);
 100
 101         len += proto->print_conntrack(buffer + len, conntrack);
 102         len += print_tuple(buffer + len,
 103                            &conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
 104                            proto);
 105         if (!(test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)))
 106                 len += sprintf(buffer + len, "[UNREPLIED] ");
 107         len += print_tuple(buffer + len,
 108                            &conntrack->tuplehash[IP_CT_DIR_REPLY].tuple,
 109                            proto);
 110         if (test_bit(IPS_ASSURED_BIT, &conntrack->status))
 111                 len += sprintf(buffer + len, "[ASSURED] ");
 112         len += sprintf(buffer + len, "use=%u ",
 113                        atomic_read(&conntrack->ct_general.use));
 114         len += sprintf(buffer + len, "\n");
 115
 116         return len;
 117 }
 118
 119 /* Returns true when finished. */
 120 static inline int
 121 conntrack_iterate(const struct ip_conntrack_tuple_hash *hash,
 122                   char *buffer, off_t offset, off_t *upto,
 123                   unsigned int *len, unsigned int maxlen)
 124 {
 125         unsigned int newlen;
 126         IP_NF_ASSERT(hash->ctrack);
 127
 128         MUST_BE_READ_LOCKED(&ip_conntrack_lock);
 129
 130         /* Only count originals */
 131         if (DIRECTION(hash))
 132                 return 0;
 133
 134         if ((*upto)++ < offset)
 135                 return 0;
 136
 137         newlen = print_conntrack(buffer + *len, hash->ctrack);
 138         if (*len + newlen > maxlen)
 139                 return 1;
 140         else *len += newlen;
 141
 142         return 0;
 143 }
 144
 145 static int
 146 list_conntracks(char *buffer, char **start, off_t offset, int length)
 147 {
 148         unsigned int i;
 149         unsigned int len = 0;
 150         off_t upto = 0;
 151         struct list_head *e;
 152
 153         READ_LOCK(&ip_conntrack_lock);
 154         /* Traverse hash; print originals then reply. */
 155         for (i = 0; i < ip_conntrack_htable_size; i++) {
 156                 if (LIST_FIND(&ip_conntrack_hash[i], conntrack_iterate,
 157                               struct ip_conntrack_tuple_hash *,
 158                               buffer, offset, &upto, &len, length))
 159                         goto finished;
 160         }
 161
 162         /* Now iterate through expecteds. */
 163         READ_LOCK(&ip_conntrack_expect_tuple_lock);
 164         list_for_each(e, &ip_conntrack_expect_list) {
 165                 unsigned int last_len;
 166                 struct ip_conntrack_expect *expect
 167                         = (struct ip_conntrack_expect *)e;
 168                 if (upto++ < offset) continue;
 169
 170                 last_len = len;
 171                 len += print_expect(buffer + len, expect);
 172                 if (len > length) {
 173                         len = last_len;
 174                         goto finished_expects;
 175                 }
 176         }
 177
 178  finished_expects:
 179         READ_UNLOCK(&ip_conntrack_expect_tuple_lock);
 180  finished:
 181         READ_UNLOCK(&ip_conntrack_lock);
 182
 183         /* `start' hack - see fs/proc/generic.c line ~165 */
 184         *start = (char *)((unsigned int)upto - offset);
 185         return len;
 186 }
 187
 188 static unsigned int ip_confirm(unsigned int hooknum,
 189                                struct sk_buff **pskb,
 190                                const struct net_device *in,
 191                                const struct net_device *out,
 192                                int (*okfn)(struct sk_buff *))
 193 {
 194         /* We've seen it coming out the other side: confirm it */
 195         return ip_conntrack_confirm(*pskb);
 196 }
 197
 198 static unsigned int ip_conntrack_defrag(unsigned int hooknum,
 199                                         struct sk_buff **pskb,
 200                                         const struct net_device *in,
 201                                         const struct net_device *out,
 202                                         int (*okfn)(struct sk_buff *))
 203 {
 204         /* Previously seen (loopback)?  Ignore.  Do this before
 205            fragment check. */
 206         if ((*pskb)->nfct)
 207                 return NF_ACCEPT;
 208
 209         /* Gather fragments. */
 210         if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
 211                 *pskb = ip_ct_gather_frags(*pskb);
 212                 if (!*pskb)
 213                         return NF_STOLEN;
 214         }
 215         return NF_ACCEPT;
 216 }
 217
 218 static unsigned int ip_refrag(unsigned int hooknum,
 219                               struct sk_buff **pskb,
 220                               const struct net_device *in,
 221                               const struct net_device *out,
 222                               int (*okfn)(struct sk_buff *))
 223 {
 224         struct rtable *rt = (struct rtable *)(*pskb)->dst;
 225
 226         /* We've seen it coming out the other side: confirm */
 227         if (ip_confirm(hooknum, pskb, in, out, okfn) != NF_ACCEPT)
 228                 return NF_DROP;
 229
 230         /* Local packets are never produced too large for their
 231            interface.  We degfragment them at LOCAL_OUT, however,
 232            so we have to refragment them here. */
 233         if ((*pskb)->len > dst_pmtu(&rt->u.dst) &&
 234             !skb_shinfo(*pskb)->tso_size) {
 235                 /* No hook can be after us, so this should be OK. */
 236                 ip_fragment(*pskb, okfn);
 237                 return NF_STOLEN;
 238         }
 239         return NF_ACCEPT;
 240 }
 241
 242 static unsigned int ip_conntrack_local(unsigned int hooknum,
 243                                        struct sk_buff **pskb,
 244                                        const struct net_device *in,
 245                                        const struct net_device *out,
 246                                        int (*okfn)(struct sk_buff *))
 247 {
 248         /* root is playing with raw sockets. */
 249         if ((*pskb)->len < sizeof(struct iphdr)
 250             || (*pskb)->nh.iph->ihl * 4 < sizeof(struct iphdr)) {
 251                 if (net_ratelimit())
 252                         printk("ipt_hook: happy cracking.\n");
 253                 return NF_ACCEPT;
 254         }
 255         return ip_conntrack_in(hooknum, pskb, in, out, okfn);
 256 }
 257
 258 /* Connection tracking may drop packets, but never alters them, so
 259    make it the first hook. */
 260 static struct nf_hook_ops ip_conntrack_defrag_ops = {
 261         .hook           = ip_conntrack_defrag,
 262         .owner          = THIS_MODULE,
 263         .pf             = PF_INET,
 264         .hooknum        = NF_IP_PRE_ROUTING,
 265         .priority       = NF_IP_PRI_CONNTRACK_DEFRAG,
 266 };
 267
 268 static struct nf_hook_ops ip_conntrack_in_ops = {
 269         .hook           = ip_conntrack_in,
 270         .owner          = THIS_MODULE,
 271         .pf             = PF_INET,
 272         .hooknum        = NF_IP_PRE_ROUTING,
 273         .priority       = NF_IP_PRI_CONNTRACK,
 274 };
 275
 276 static struct nf_hook_ops ip_conntrack_defrag_local_out_ops = {
 277         .hook           = ip_conntrack_defrag,
 278         .owner          = THIS_MODULE,
 279         .pf             = PF_INET,
 280         .hooknum        = NF_IP_LOCAL_OUT,
 281         .priority       = NF_IP_PRI_CONNTRACK_DEFRAG,
 282 };
 283
 284 static struct nf_hook_ops ip_conntrack_local_out_ops = {
 285         .hook           = ip_conntrack_local,
 286         .owner          = THIS_MODULE,
 287         .pf             = PF_INET,
 288         .hooknum        = NF_IP_LOCAL_OUT,
 289         .priority       = NF_IP_PRI_CONNTRACK,
 290 };
 291
 292 /* Refragmenter; last chance. */
 293 static struct nf_hook_ops ip_conntrack_out_ops = {
 294         .hook           = ip_refrag,
 295         .owner          = THIS_MODULE,
 296         .pf             = PF_INET,
 297         .hooknum        = NF_IP_POST_ROUTING,
 298         .priority       = NF_IP_PRI_LAST,
 299 };
 300
 301 static struct nf_hook_ops ip_conntrack_local_in_ops = {
 302         .hook           = ip_confirm,
 303         .owner          = THIS_MODULE,
 304         .pf             = PF_INET,
 305         .hooknum        = NF_IP_LOCAL_IN,
 306         .priority       = NF_IP_PRI_LAST-1,
 307 };
 308
 309 /* Sysctl support */
 310
 311 #ifdef CONFIG_SYSCTL
 312
 313 /* From ip_conntrack_core.c */
 314 extern int ip_conntrack_max;
 315 extern unsigned int ip_conntrack_htable_size;
 316
 317 /* From ip_conntrack_proto_tcp.c */
 318 extern unsigned long ip_ct_tcp_timeout_syn_sent;
 319 extern unsigned long ip_ct_tcp_timeout_syn_recv;
 320 extern unsigned long ip_ct_tcp_timeout_established;
 321 extern unsigned long ip_ct_tcp_timeout_fin_wait;
 322 extern unsigned long ip_ct_tcp_timeout_close_wait;
 323 extern unsigned long ip_ct_tcp_timeout_last_ack;
 324 extern unsigned long ip_ct_tcp_timeout_time_wait;
 325 extern unsigned long ip_ct_tcp_timeout_close;
 326
 327 /* From ip_conntrack_proto_udp.c */
 328 extern unsigned long ip_ct_udp_timeout;
 329 extern unsigned long ip_ct_udp_timeout_stream;
 330
 331 /* From ip_conntrack_proto_icmp.c */
 332 extern unsigned long ip_ct_icmp_timeout;
 333
 334 /* From ip_conntrack_proto_icmp.c */
 335 extern unsigned long ip_ct_generic_timeout;
 336
 337 static struct ctl_table_header *ip_ct_sysctl_header;
 338
 339 static ctl_table ip_ct_sysctl_table[] = {
 340         {
 341                 .ctl_name       = NET_IPV4_NF_CONNTRACK_MAX,
 342                 .procname       = "ip_conntrack_max",
 343                 .data           = &ip_conntrack_max,
 344                 .maxlen         = sizeof(int),
 345                 .mode           = 0644,
 346                 .proc_handler   = &proc_dointvec,
 347         },
 348         {
 349                 .ctl_name       = NET_IPV4_NF_CONNTRACK_BUCKETS,
 350                 .procname       = "ip_conntrack_buckets",
 351                 .data           = &ip_conntrack_htable_size,
 352                 .maxlen         = sizeof(unsigned int),
 353                 .mode           = 0444,
 354                 .proc_handler   = &proc_dointvec,
 355         },
 356         {
 357                 .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_SYN_SENT,
 358                 .procname       = "ip_conntrack_tcp_timeout_syn_sent",
 359                 .data           = &ip_ct_tcp_timeout_syn_sent,
 360                 .maxlen         = sizeof(unsigned int),
 361                 .mode           = 0644,
 362                 .proc_handler   = &proc_dointvec_jiffies,
 363         },
 364         {
 365                 .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_SYN_RECV,
 366                 .procname       = "ip_conntrack_tcp_timeout_syn_recv",
 367                 .data           = &ip_ct_tcp_timeout_syn_recv,
 368                 .maxlen         = sizeof(unsigned int),
 369                 .mode           = 0644,
 370                 .proc_handler   = &proc_dointvec_jiffies,
 371         },
 372         {
 373                 .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_ESTABLISHED,
 374                 .procname       = "ip_conntrack_tcp_timeout_established",
 375                 .data           = &ip_ct_tcp_timeout_established,
 376                 .maxlen         = sizeof(unsigned int),
 377                 .mode           = 0644,
 378                 .proc_handler   = &proc_dointvec_jiffies,
 379         },
 380         {
 381                 .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_FIN_WAIT,
 382                 .procname       = "ip_conntrack_tcp_timeout_fin_wait",
 383                 .data           = &ip_ct_tcp_timeout_fin_wait,
 384                 .maxlen         = sizeof(unsigned int),
 385                 .mode           = 0644,
 386                 .proc_handler   = &proc_dointvec_jiffies,
 387         },
 388         {
 389                 .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_CLOSE_WAIT,
 390                 .procname       = "ip_conntrack_tcp_timeout_close_wait",
 391                 .data           = &ip_ct_tcp_timeout_close_wait,
 392                 .maxlen         = sizeof(unsigned int),
 393                 .mode           = 0644,
 394                 .proc_handler   = &proc_dointvec_jiffies,
 395         },
 396         {
 397                 .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_LAST_ACK,
 398                 .procname       = "ip_conntrack_tcp_timeout_last_ack",
 399                 .data           = &ip_ct_tcp_timeout_last_ack,
 400                 .maxlen         = sizeof(unsigned int),
 401                 .mode           = 0644,
 402                 .proc_handler   = &proc_dointvec_jiffies,
 403         },
 404         {
 405                 .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_TIME_WAIT,
 406                 .procname       = "ip_conntrack_tcp_timeout_time_wait",
 407                 .data           = &ip_ct_tcp_timeout_time_wait,
 408                 .maxlen         = sizeof(unsigned int),
 409                 .mode           = 0644,
 410                 .proc_handler   = &proc_dointvec_jiffies,
 411         },
 412         {
 413                 .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_CLOSE,
 414                 .procname       = "ip_conntrack_tcp_timeout_close",
 415                 .data           = &ip_ct_tcp_timeout_close,
 416                 .maxlen         = sizeof(unsigned int),
 417                 .mode           = 0644,
 418                 .proc_handler   = &proc_dointvec_jiffies,
 419         },
 420         {
 421                 .ctl_name       = NET_IPV4_NF_CONNTRACK_UDP_TIMEOUT,
 422                 .procname       = "ip_conntrack_udp_timeout",
 423                 .data           = &ip_ct_udp_timeout,
 424                 .maxlen         = sizeof(unsigned int),
 425                 .mode           = 0644,
 426                 .proc_handler   = &proc_dointvec_jiffies,
 427         },
 428         {
 429                 .ctl_name       = NET_IPV4_NF_CONNTRACK_UDP_TIMEOUT_STREAM,
 430                 .procname       = "ip_conntrack_udp_timeout_stream",
 431                 .data           = &ip_ct_udp_timeout_stream,
 432                 .maxlen         = sizeof(unsigned int),
 433                 .mode           = 0644,
 434                 .proc_handler   = &proc_dointvec_jiffies,
 435         },
 436         {
 437                 .ctl_name       = NET_IPV4_NF_CONNTRACK_ICMP_TIMEOUT,
 438                 .procname       = "ip_conntrack_icmp_timeout",
 439                 .data           = &ip_ct_icmp_timeout,
 440                 .maxlen         = sizeof(unsigned int),
 441                 .mode           = 0644,
 442                 .proc_handler   = &proc_dointvec_jiffies,
 443         },
 444         {
 445                 .ctl_name       = NET_IPV4_NF_CONNTRACK_GENERIC_TIMEOUT,
 446                 .procname       = "ip_conntrack_generic_timeout",
 447                 .data           = &ip_ct_generic_timeout,
 448                 .maxlen         = sizeof(unsigned int),
 449                 .mode           = 0644,
 450                 .proc_handler   = &proc_dointvec_jiffies,
 451         },
 452         { .ctl_name = 0 }
 453 };
 454
 455 #define NET_IP_CONNTRACK_MAX 2089
 456
 457 static ctl_table ip_ct_netfilter_table[] = {
 458         {
 459                 .ctl_name       = NET_IPV4_NETFILTER,
 460                 .procname       = "netfilter",
 461                 .mode           = 0555,
 462                 .child          = ip_ct_sysctl_table,
 463         },
 464         {
 465                 .ctl_name       = NET_IP_CONNTRACK_MAX,
 466                 .procname       = "ip_conntrack_max",
 467                 .data           = &ip_conntrack_max,
 468                 .maxlen         = sizeof(int),
 469                 .mode           = 0644,
 470                 .proc_handler   = &proc_dointvec
 471         },
 472         { .ctl_name = 0 }
 473 };
 474
 475 static ctl_table ip_ct_ipv4_table[] = {
 476         {
 477                 .ctl_name       = NET_IPV4,
 478                 .procname       = "ipv4",
 479                 .mode           = 0555,
 480                 .child          = ip_ct_netfilter_table,
 481         },
 482         { .ctl_name = 0 }
 483 };
 484
 485 static ctl_table ip_ct_net_table[] = {
 486         {
 487                 .ctl_name       = CTL_NET,
 488                 .procname       = "net",
 489                 .mode           = 0555,
 490                 .child          = ip_ct_ipv4_table,
 491         },
 492         { .ctl_name = 0 }
 493 };
 494 #endif
 495 static int init_or_cleanup(int init)
 496 {
 497         struct proc_dir_entry *proc;
 498         int ret = 0;
 499
 500         if (!init) goto cleanup;
 501
 502         ret = ip_conntrack_init();
 503         if (ret < 0)
 504                 goto cleanup_nothing;
 505
 506         proc = proc_net_create("ip_conntrack", 0440, list_conntracks);
 507         if (!proc) goto cleanup_init;
 508         proc->owner = THIS_MODULE;
 509
 510         ret = nf_register_hook(&ip_conntrack_defrag_ops);
 511         if (ret < 0) {
 512                 printk("ip_conntrack: can't register pre-routing defrag hook.\n");
 513                 goto cleanup_proc;
 514         }
 515         ret = nf_register_hook(&ip_conntrack_defrag_local_out_ops);
 516         if (ret < 0) {
 517                 printk("ip_conntrack: can't register local_out defrag hook.\n");
 518                 goto cleanup_defragops;
 519         }
 520         ret = nf_register_hook(&ip_conntrack_in_ops);
 521         if (ret < 0) {
 522                 printk("ip_conntrack: can't register pre-routing hook.\n");
 523                 goto cleanup_defraglocalops;
 524         }
 525         ret = nf_register_hook(&ip_conntrack_local_out_ops);
 526         if (ret < 0) {
 527                 printk("ip_conntrack: can't register local out hook.\n");
 528                 goto cleanup_inops;
 529         }
 530         ret = nf_register_hook(&ip_conntrack_out_ops);
 531         if (ret < 0) {
 532                 printk("ip_conntrack: can't register post-routing hook.\n");
 533                 goto cleanup_inandlocalops;
 534         }
 535         ret = nf_register_hook(&ip_conntrack_local_in_ops);
 536         if (ret < 0) {
 537                 printk("ip_conntrack: can't register local in hook.\n");
 538                 goto cleanup_inoutandlocalops;
 539         }
 540 #ifdef CONFIG_SYSCTL
 541         ip_ct_sysctl_header = register_sysctl_table(ip_ct_net_table, 0);
 542         if (ip_ct_sysctl_header == NULL) {
 543                 printk("ip_conntrack: can't register to sysctl.\n");
 544                 goto cleanup;
 545         }
 546 #endif
 547
 548         return ret;
 549
 550  cleanup:
 551 #ifdef CONFIG_SYSCTL
 552         unregister_sysctl_table(ip_ct_sysctl_header);
 553 #endif
 554         nf_unregister_hook(&ip_conntrack_local_in_ops);
 555  cleanup_inoutandlocalops:
 556         nf_unregister_hook(&ip_conntrack_out_ops);
 557  cleanup_inandlocalops:
 558         nf_unregister_hook(&ip_conntrack_local_out_ops);
 559  cleanup_inops:
 560         nf_unregister_hook(&ip_conntrack_in_ops);
 561  cleanup_defraglocalops:
 562         nf_unregister_hook(&ip_conntrack_defrag_local_out_ops);
 563  cleanup_defragops:
 564         nf_unregister_hook(&ip_conntrack_defrag_ops);
 565  cleanup_proc:
 566         proc_net_remove("ip_conntrack");
 567  cleanup_init:
 568         ip_conntrack_cleanup();
 569  cleanup_nothing:
 570         return ret;
 571 }
 572
 573 /* FIXME: Allow NULL functions and sub in pointers to generic for
 574    them. --RR */
 575 int ip_conntrack_protocol_register(struct ip_conntrack_protocol *proto)
 576 {
 577         int ret = 0;
 578         struct list_head *i;
 579
 580         WRITE_LOCK(&ip_conntrack_lock);
 581         list_for_each(i, &protocol_list) {
 582                 if (((struct ip_conntrack_protocol *)i)->proto
 583                     == proto->proto) {
 584                         ret = -EBUSY;
 585                         goto out;
 586                 }
 587         }
 588
 589         list_prepend(&protocol_list, proto);
 590
 591  out:
 592         WRITE_UNLOCK(&ip_conntrack_lock);
 593         return ret;
 594 }
 595
 596 void ip_conntrack_protocol_unregister(struct ip_conntrack_protocol *proto)
 597 {
 598         WRITE_LOCK(&ip_conntrack_lock);
 599
 600         /* ip_ct_find_proto() returns proto_generic in case there is no protocol
 601          * helper. So this should be enough - HW */
 602         LIST_DELETE(&protocol_list, proto);
 603         WRITE_UNLOCK(&ip_conntrack_lock);
 604
 605         /* Somebody could be still looking at the proto in bh. */
 606         synchronize_net();
 607
 608         /* Remove all contrack entries for this protocol */
 609         ip_ct_selective_cleanup(kill_proto, &proto->proto);
 610 }
 611
 612 static int __init init(void)
 613 {
 614         return init_or_cleanup(1);
 615 }
 616
 617 static void __exit fini(void)
 618 {
 619         init_or_cleanup(0);
 620 }
 621
 622 module_init(init);
 623 module_exit(fini);
 624
 625 /* Some modules need us, but don't depend directly on any symbol.
 626    They should call this. */
 627 void need_ip_conntrack(void)
 628 {
 629 }
 630
 631 EXPORT_SYMBOL(ip_conntrack_protocol_register);
 632 EXPORT_SYMBOL(ip_conntrack_protocol_unregister);
 633 EXPORT_SYMBOL(invert_tuplepr);
 634 EXPORT_SYMBOL(ip_conntrack_alter_reply);
 635 EXPORT_SYMBOL(ip_conntrack_destroyed);
 636 EXPORT_SYMBOL(ip_conntrack_get);
 637 EXPORT_SYMBOL(need_ip_conntrack);
 638 EXPORT_SYMBOL(ip_conntrack_helper_register);
 639 EXPORT_SYMBOL(ip_conntrack_helper_unregister);
 640 EXPORT_SYMBOL(ip_ct_selective_cleanup);
 641 EXPORT_SYMBOL(ip_ct_refresh);
 642 EXPORT_SYMBOL(ip_ct_find_proto);
 643 EXPORT_SYMBOL(__ip_ct_find_proto);
 644 EXPORT_SYMBOL(ip_ct_find_helper);
 645 EXPORT_SYMBOL(ip_conntrack_expect_alloc);
 646 EXPORT_SYMBOL(ip_conntrack_expect_related);
 647 EXPORT_SYMBOL(ip_conntrack_change_expect);
 648 EXPORT_SYMBOL(ip_conntrack_unexpect_related);
 649 EXPORT_SYMBOL_GPL(ip_conntrack_expect_find_get);
 650 EXPORT_SYMBOL_GPL(ip_conntrack_expect_put);
 651 EXPORT_SYMBOL(ip_conntrack_tuple_taken);
 652 EXPORT_SYMBOL(ip_ct_gather_frags);
 653 EXPORT_SYMBOL(ip_conntrack_htable_size);
 654 EXPORT_SYMBOL(ip_conntrack_expect_list);
 655 EXPORT_SYMBOL(ip_conntrack_lock);
 656 EXPORT_SYMBOL(ip_conntrack_hash);
 657 EXPORT_SYMBOL(ip_conntrack_untracked);
 658 EXPORT_SYMBOL_GPL(ip_conntrack_find_get);
 659 EXPORT_SYMBOL_GPL(ip_conntrack_put);