Eric Lee / smarc-fsl-linux-kernel

Commit 440f0d588555892601cfe511728a0fc0c8204063

Authored by Patrick McHardy 2009-06-10 20:32:47 +0800

netfilter: nf_conntrack: use per-conntrack locks for protocol data

Introduce per-conntrack locks and use them instead of the global protocol
locks to avoid contention. Especially tcp_lock shows up very high in
profiles on larger machines.

This will also allow to simplify the upcoming reliable event delivery patches.

Signed-off-by: Patrick McHardy <kaber@trash.net>

Showing 8 changed files with 49 additions and 55 deletions Inline Diff

include/net/netfilter/nf_conntrack.h
include/net/netfilter/nf_conntrack_l4proto.h
net/netfilter/nf_conntrack_core.c
net/netfilter/nf_conntrack_netlink.c
net/netfilter/nf_conntrack_proto_dccp.c
net/netfilter/nf_conntrack_proto_gre.c
net/netfilter/nf_conntrack_proto_sctp.c
net/netfilter/nf_conntrack_proto_tcp.c

include/net/netfilter/nf_conntrack.h

Diff comments View file @ 440f0d5

 /*
  * Connection state tracking for netfilter.  This is separated from,
  * but required by, the (future) NAT layer; it can also be used by an iptables
  * extension.
  *
  * 16 Dec 2003: Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp>
  *	- generalize L3 protocol dependent part.
  *
  * Derived from include/linux/netfiter_ipv4/ip_conntrack.h
  */
 #ifndef _NF_CONNTRACK_H
 #define _NF_CONNTRACK_H
 #include <linux/netfilter/nf_conntrack_common.h>
 #ifdef __KERNEL__
 #include <linux/bitops.h>
 #include <linux/compiler.h>
 #include <asm/atomic.h>
 #include <linux/netfilter/nf_conntrack_tcp.h>
 #include <linux/netfilter/nf_conntrack_dccp.h>
 #include <linux/netfilter/nf_conntrack_sctp.h>
 #include <linux/netfilter/nf_conntrack_proto_gre.h>
 #include <net/netfilter/ipv6/nf_conntrack_icmpv6.h>
 #include <net/netfilter/nf_conntrack_tuple.h>
 /* per conntrack: protocol private data */
 union nf_conntrack_proto {
 	/* insert conntrack proto private data here */
 	struct nf_ct_dccp dccp;
 	struct ip_ct_sctp sctp;
 	struct ip_ct_tcp tcp;
 	struct nf_ct_gre gre;
 };
 union nf_conntrack_expect_proto {
 	/* insert expect proto private data here */
 };
 /* Add protocol helper include file here */
 #include <linux/netfilter/nf_conntrack_ftp.h>
 #include <linux/netfilter/nf_conntrack_pptp.h>
 #include <linux/netfilter/nf_conntrack_h323.h>
 #include <linux/netfilter/nf_conntrack_sane.h>
 #include <linux/netfilter/nf_conntrack_sip.h>
 /* per conntrack: application helper private data */
 union nf_conntrack_help {
 	/* insert conntrack helper private data (master) here */
 	struct nf_ct_ftp_master ct_ftp_info;
 	struct nf_ct_pptp_master ct_pptp_info;
 	struct nf_ct_h323_master ct_h323_info;
 	struct nf_ct_sane_master ct_sane_info;
 	struct nf_ct_sip_master ct_sip_info;
 };
 #include <linux/types.h>
 #include <linux/skbuff.h>
 #include <linux/timer.h>
 #ifdef CONFIG_NETFILTER_DEBUG
 #define NF_CT_ASSERT(x)		WARN_ON(!(x))
 #else
 #define NF_CT_ASSERT(x)
 #endif
 struct nf_conntrack_helper;
 /* Must be kept in sync with the classes defined by helpers */
 #define NF_CT_MAX_EXPECT_CLASSES	3
 /* nf_conn feature for connections that have a helper */
 struct nf_conn_help {
 	/* Helper. if any */
 	struct nf_conntrack_helper *helper;
 	union nf_conntrack_help help;
 	struct hlist_head expectations;
 	/* Current number of expected connections */
 	u8 expecting[NF_CT_MAX_EXPECT_CLASSES];
 };
 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
 struct nf_conn {
 	/* Usage count in here is 1 for hash table/destruct timer, 1 per skb,
            plus 1 for any connection(s) we are `master' for */
 	struct nf_conntrack ct_general;
+	spinlock_t lock;
 	/* XXX should I move this to the tail ? - Y.K */
 	/* These are my tuples; original and reply */
 	struct nf_conntrack_tuple_hash tuplehash[IP_CT_DIR_MAX];
 	/* Have we seen traffic both ways yet? (bitset) */
 	unsigned long status;
 	/* If we were expected by an expectation, this will be it */
 	struct nf_conn *master;
 	/* Timer function; drops refcnt when it goes off. */
 	struct timer_list timeout;
 #if defined(CONFIG_NF_CONNTRACK_MARK)
 	u_int32_t mark;
 #endif
 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 	u_int32_t secmark;
 #endif
 	/* Storage reserved for other modules: */
 	union nf_conntrack_proto proto;
 	/* Extensions */
 	struct nf_ct_ext *ext;
 #ifdef CONFIG_NET_NS
 	struct net *ct_net;
 #endif
 };
 static inline struct nf_conn *
 nf_ct_tuplehash_to_ctrack(const struct nf_conntrack_tuple_hash *hash)
 {
 	return container_of(hash, struct nf_conn,
 			    tuplehash[hash->tuple.dst.dir]);
 }
 static inline u_int16_t nf_ct_l3num(const struct nf_conn *ct)
 {
 	return ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
 }
 static inline u_int8_t nf_ct_protonum(const struct nf_conn *ct)
 {
 	return ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum;
 }
 #define nf_ct_tuple(ct, dir) (&(ct)->tuplehash[dir].tuple)
 /* get master conntrack via master expectation */
 #define master_ct(conntr) (conntr->master)
 extern struct net init_net;
 static inline struct net *nf_ct_net(const struct nf_conn *ct)
 {
 #ifdef CONFIG_NET_NS
 	return ct->ct_net;
 #else
 	return &init_net;
 #endif
 }
 /* Alter reply tuple (maybe alter helper). */
 extern void
 nf_conntrack_alter_reply(struct nf_conn *ct,
 			 const struct nf_conntrack_tuple *newreply);
 /* Is this tuple taken? (ignoring any belonging to the given
    conntrack). */
 extern int
 nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
 			 const struct nf_conn *ignored_conntrack);
 /* Return conntrack_info and tuple hash for given skb. */
 static inline struct nf_conn *
 nf_ct_get(const struct sk_buff *skb, enum ip_conntrack_info *ctinfo)
 {
 	*ctinfo = skb->nfctinfo;
 	return (struct nf_conn *)skb->nfct;
 }
 /* decrement reference count on a conntrack */
 static inline void nf_ct_put(struct nf_conn *ct)
 {
 	NF_CT_ASSERT(ct);
 	nf_conntrack_put(&ct->ct_general);
 }
 /* Protocol module loading */
 extern int nf_ct_l3proto_try_module_get(unsigned short l3proto);
 extern void nf_ct_l3proto_module_put(unsigned short l3proto);
 /*
  * Allocate a hashtable of hlist_head (if nulls == 0),
  * or hlist_nulls_head (if nulls == 1)
  */
 extern void *nf_ct_alloc_hashtable(unsigned int *sizep, int *vmalloced, int nulls);
 extern void nf_ct_free_hashtable(void *hash, int vmalloced, unsigned int size);
 extern struct nf_conntrack_tuple_hash *
 __nf_conntrack_find(struct net *net, const struct nf_conntrack_tuple *tuple);
 extern void nf_conntrack_hash_insert(struct nf_conn *ct);
 extern void nf_conntrack_flush_report(struct net *net, u32 pid, int report);
 extern bool nf_ct_get_tuplepr(const struct sk_buff *skb,
 			      unsigned int nhoff, u_int16_t l3num,
 			      struct nf_conntrack_tuple *tuple);
 extern bool nf_ct_invert_tuplepr(struct nf_conntrack_tuple *inverse,
 				 const struct nf_conntrack_tuple *orig);
 extern void __nf_ct_refresh_acct(struct nf_conn *ct,
 				 enum ip_conntrack_info ctinfo,
 				 const struct sk_buff *skb,
 				 unsigned long extra_jiffies,
 				 int do_acct);
 /* Refresh conntrack for this many jiffies and do accounting */
 static inline void nf_ct_refresh_acct(struct nf_conn *ct,
 				      enum ip_conntrack_info ctinfo,
 				      const struct sk_buff *skb,
 				      unsigned long extra_jiffies)
 {
 	__nf_ct_refresh_acct(ct, ctinfo, skb, extra_jiffies, 1);
 }
 /* Refresh conntrack for this many jiffies */
 static inline void nf_ct_refresh(struct nf_conn *ct,
 				 const struct sk_buff *skb,
 				 unsigned long extra_jiffies)
 {
 	__nf_ct_refresh_acct(ct, 0, skb, extra_jiffies, 0);
 }
 extern bool __nf_ct_kill_acct(struct nf_conn *ct,
 			      enum ip_conntrack_info ctinfo,
 			      const struct sk_buff *skb,
 			      int do_acct);
 /* kill conntrack and do accounting */
 static inline bool nf_ct_kill_acct(struct nf_conn *ct,
 				   enum ip_conntrack_info ctinfo,
 				   const struct sk_buff *skb)
 {
 	return __nf_ct_kill_acct(ct, ctinfo, skb, 1);
 }
 /* kill conntrack without accounting */
 static inline bool nf_ct_kill(struct nf_conn *ct)
 {
 	return __nf_ct_kill_acct(ct, 0, NULL, 0);
 }
 /* These are for NAT.  Icky. */
 /* Update TCP window tracking data when NAT mangles the packet */
 extern void nf_conntrack_tcp_update(const struct sk_buff *skb,
 				    unsigned int dataoff,
 				    struct nf_conn *ct,
 				    int dir);
 /* Fake conntrack entry for untracked connections */
 extern struct nf_conn nf_conntrack_untracked;
 /* Iterate over all conntracks: if iter returns true, it's deleted. */
 extern void
 nf_ct_iterate_cleanup(struct net *net, int (*iter)(struct nf_conn *i, void *data), void *data);
 extern void nf_conntrack_free(struct nf_conn *ct);
 extern struct nf_conn *
 nf_conntrack_alloc(struct net *net,
 		   const struct nf_conntrack_tuple *orig,
 		   const struct nf_conntrack_tuple *repl,
 		   gfp_t gfp);
 /* It's confirmed if it is, or has been in the hash table. */
 static inline int nf_ct_is_confirmed(struct nf_conn *ct)
 {
 	return test_bit(IPS_CONFIRMED_BIT, &ct->status);
 }
 static inline int nf_ct_is_dying(struct nf_conn *ct)
 {
 	return test_bit(IPS_DYING_BIT, &ct->status);
 }
 static inline int nf_ct_is_untracked(const struct sk_buff *skb)
 {
 	return (skb->nfct == &nf_conntrack_untracked.ct_general);
 }
 extern int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp);
 extern unsigned int nf_conntrack_htable_size;
 extern unsigned int nf_conntrack_max;
 #define NF_CT_STAT_INC(net, count)	\
 	(per_cpu_ptr((net)->ct.stat, raw_smp_processor_id())->count++)
 #define NF_CT_STAT_INC_ATOMIC(net, count)		\
 do {							\
 	local_bh_disable();				\
 	per_cpu_ptr((net)->ct.stat, raw_smp_processor_id())->count++;	\
 	local_bh_enable();				\
 } while (0)
 #define MODULE_ALIAS_NFCT_HELPER(helper) \
         MODULE_ALIAS("nfct-helper-" helper)
 #endif /* __KERNEL__ */
 #endif /* _NF_CONNTRACK_H */

include/net/netfilter/nf_conntrack_l4proto.h

Diff comments View file @ 440f0d5

net/netfilter/nf_conntrack_core.c

Diff comments View file @ 440f0d5

 /* Connection state tracking for netfilter.  This is separated from,
    but required by, the NAT layer; it can also be used by an iptables
    extension. */
 /* (C) 1999-2001 Paul `Rusty' Russell
  * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
  * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
 #include <linux/types.h>
 #include <linux/netfilter.h>
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/proc_fs.h>
 #include <linux/vmalloc.h>
 #include <linux/stddef.h>
 #include <linux/slab.h>
 #include <linux/random.h>
 #include <linux/jhash.h>
 #include <linux/err.h>
 #include <linux/percpu.h>
 #include <linux/moduleparam.h>
 #include <linux/notifier.h>
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
 #include <linux/socket.h>
 #include <linux/mm.h>
 #include <linux/rculist_nulls.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_l3proto.h>
 #include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_expect.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_core.h>
 #include <net/netfilter/nf_conntrack_extend.h>
 #include <net/netfilter/nf_conntrack_acct.h>
 #include <net/netfilter/nf_nat.h>
 #include <net/netfilter/nf_nat_core.h>
 #define NF_CONNTRACK_VERSION	"0.5.0"
 int (*nfnetlink_parse_nat_setup_hook)(struct nf_conn *ct,
 				      enum nf_nat_manip_type manip,
 				      struct nlattr *attr) __read_mostly;
 EXPORT_SYMBOL_GPL(nfnetlink_parse_nat_setup_hook);
 DEFINE_SPINLOCK(nf_conntrack_lock);
 EXPORT_SYMBOL_GPL(nf_conntrack_lock);
 unsigned int nf_conntrack_htable_size __read_mostly;
 EXPORT_SYMBOL_GPL(nf_conntrack_htable_size);
 unsigned int nf_conntrack_max __read_mostly;
 EXPORT_SYMBOL_GPL(nf_conntrack_max);
 struct nf_conn nf_conntrack_untracked __read_mostly;
 EXPORT_SYMBOL_GPL(nf_conntrack_untracked);
 static struct kmem_cache *nf_conntrack_cachep __read_mostly;
 static int nf_conntrack_hash_rnd_initted;
 static unsigned int nf_conntrack_hash_rnd;
 static u_int32_t __hash_conntrack(const struct nf_conntrack_tuple *tuple,
 				  unsigned int size, unsigned int rnd)
 {
 	unsigned int n;
 	u_int32_t h;
 	/* The direction must be ignored, so we hash everything up to the
 	 * destination ports (which is a multiple of 4) and treat the last
 	 * three bytes manually.
 	 */
 	n = (sizeof(tuple->src) + sizeof(tuple->dst.u3)) / sizeof(u32);
 	h = jhash2((u32 *)tuple, n,
 		   rnd ^ (((__force __u16)tuple->dst.u.all << 16) |
 			  tuple->dst.protonum));
 	return ((u64)h * size) >> 32;
 }
 static inline u_int32_t hash_conntrack(const struct nf_conntrack_tuple *tuple)
 {
 	return __hash_conntrack(tuple, nf_conntrack_htable_size,
 				nf_conntrack_hash_rnd);
 }
 bool
 nf_ct_get_tuple(const struct sk_buff *skb,
 		unsigned int nhoff,
 		unsigned int dataoff,
 		u_int16_t l3num,
 		u_int8_t protonum,
 		struct nf_conntrack_tuple *tuple,
 		const struct nf_conntrack_l3proto *l3proto,
 		const struct nf_conntrack_l4proto *l4proto)
 {
 	memset(tuple, 0, sizeof(*tuple));
 	tuple->src.l3num = l3num;
 	if (l3proto->pkt_to_tuple(skb, nhoff, tuple) == 0)
 		return false;
 	tuple->dst.protonum = protonum;
 	tuple->dst.dir = IP_CT_DIR_ORIGINAL;
 	return l4proto->pkt_to_tuple(skb, dataoff, tuple);
 }
 EXPORT_SYMBOL_GPL(nf_ct_get_tuple);
 bool nf_ct_get_tuplepr(const struct sk_buff *skb, unsigned int nhoff,
 		       u_int16_t l3num, struct nf_conntrack_tuple *tuple)
 {
 	struct nf_conntrack_l3proto *l3proto;
 	struct nf_conntrack_l4proto *l4proto;
 	unsigned int protoff;
 	u_int8_t protonum;
 	int ret;
 	rcu_read_lock();
 	l3proto = __nf_ct_l3proto_find(l3num);
 	ret = l3proto->get_l4proto(skb, nhoff, &protoff, &protonum);
 	if (ret != NF_ACCEPT) {
 		rcu_read_unlock();
 		return false;
 	}
 	l4proto = __nf_ct_l4proto_find(l3num, protonum);
 	ret = nf_ct_get_tuple(skb, nhoff, protoff, l3num, protonum, tuple,
 			      l3proto, l4proto);
 	rcu_read_unlock();
 	return ret;
 }
 EXPORT_SYMBOL_GPL(nf_ct_get_tuplepr);
 bool
 nf_ct_invert_tuple(struct nf_conntrack_tuple *inverse,
 		   const struct nf_conntrack_tuple *orig,
 		   const struct nf_conntrack_l3proto *l3proto,
 		   const struct nf_conntrack_l4proto *l4proto)
 {
 	memset(inverse, 0, sizeof(*inverse));
 	inverse->src.l3num = orig->src.l3num;
 	if (l3proto->invert_tuple(inverse, orig) == 0)
 		return false;
 	inverse->dst.dir = !orig->dst.dir;
 	inverse->dst.protonum = orig->dst.protonum;
 	return l4proto->invert_tuple(inverse, orig);
 }
 EXPORT_SYMBOL_GPL(nf_ct_invert_tuple);
 static void
 clean_from_lists(struct nf_conn *ct)
 {
 	pr_debug("clean_from_lists(%p)\n", ct);
 	hlist_nulls_del_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode);
 	hlist_nulls_del_rcu(&ct->tuplehash[IP_CT_DIR_REPLY].hnnode);
 	/* Destroy all pending expectations */
 	nf_ct_remove_expectations(ct);
 }
 static void
 destroy_conntrack(struct nf_conntrack *nfct)
 {
 	struct nf_conn *ct = (struct nf_conn *)nfct;
 	struct net *net = nf_ct_net(ct);
 	struct nf_conntrack_l4proto *l4proto;
 	pr_debug("destroy_conntrack(%p)\n", ct);
 	NF_CT_ASSERT(atomic_read(&nfct->use) == 0);
 	NF_CT_ASSERT(!timer_pending(&ct->timeout));
 	if (!test_bit(IPS_DYING_BIT, &ct->status))
 		nf_conntrack_event(IPCT_DESTROY, ct);
 	set_bit(IPS_DYING_BIT, &ct->status);
 	/* To make sure we don't get any weird locking issues here:
 	 * destroy_conntrack() MUST NOT be called with a write lock
 	 * to nf_conntrack_lock!!! -HW */
 	rcu_read_lock();
 	l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
 	if (l4proto && l4proto->destroy)
 		l4proto->destroy(ct);
 	rcu_read_unlock();
 	spin_lock_bh(&nf_conntrack_lock);
 	/* Expectations will have been removed in clean_from_lists,
 	 * except TFTP can create an expectation on the first packet,
 	 * before connection is in the list, so we need to clean here,
 	 * too. */
 	nf_ct_remove_expectations(ct);
 	/* We overload first tuple to link into unconfirmed list. */
 	if (!nf_ct_is_confirmed(ct)) {
 		BUG_ON(hlist_nulls_unhashed(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode));
 		hlist_nulls_del_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode);
 	}
 	NF_CT_STAT_INC(net, delete);
 	spin_unlock_bh(&nf_conntrack_lock);
 	if (ct->master)
 		nf_ct_put(ct->master);
 	pr_debug("destroy_conntrack: returning ct=%p to slab\n", ct);
 	nf_conntrack_free(ct);
 }
 static void death_by_timeout(unsigned long ul_conntrack)
 {
 	struct nf_conn *ct = (void *)ul_conntrack;
 	struct net *net = nf_ct_net(ct);
 	struct nf_conn_help *help = nfct_help(ct);
 	struct nf_conntrack_helper *helper;
 	if (help) {
 		rcu_read_lock();
 		helper = rcu_dereference(help->helper);
 		if (helper && helper->destroy)
 			helper->destroy(ct);
 		rcu_read_unlock();
 	}
 	spin_lock_bh(&nf_conntrack_lock);
 	/* Inside lock so preempt is disabled on module removal path.
 	 * Otherwise we can get spurious warnings. */
 	NF_CT_STAT_INC(net, delete_list);
 	clean_from_lists(ct);
 	spin_unlock_bh(&nf_conntrack_lock);
 	nf_ct_put(ct);
 }
 /*
  * Warning :
  * - Caller must take a reference on returned object
  *   and recheck nf_ct_tuple_equal(tuple, &h->tuple)
  * OR
  * - Caller must lock nf_conntrack_lock before calling this function
  */
 struct nf_conntrack_tuple_hash *
 __nf_conntrack_find(struct net *net, const struct nf_conntrack_tuple *tuple)
 {
 	struct nf_conntrack_tuple_hash *h;
 	struct hlist_nulls_node *n;
 	unsigned int hash = hash_conntrack(tuple);
 	/* Disable BHs the entire time since we normally need to disable them
 	 * at least once for the stats anyway.
 	 */
 	local_bh_disable();
 begin:
 	hlist_nulls_for_each_entry_rcu(h, n, &net->ct.hash[hash], hnnode) {
 		if (nf_ct_tuple_equal(tuple, &h->tuple)) {
 			NF_CT_STAT_INC(net, found);
 			local_bh_enable();
 			return h;
 		}
 		NF_CT_STAT_INC(net, searched);
 	}
 	/*
 	 * if the nulls value we got at the end of this lookup is
 	 * not the expected one, we must restart lookup.
 	 * We probably met an item that was moved to another chain.
 	 */
 	if (get_nulls_value(n) != hash)
 		goto begin;
 	local_bh_enable();
 	return NULL;
 }
 EXPORT_SYMBOL_GPL(__nf_conntrack_find);
 /* Find a connection corresponding to a tuple. */
 struct nf_conntrack_tuple_hash *
 nf_conntrack_find_get(struct net *net, const struct nf_conntrack_tuple *tuple)
 {
 	struct nf_conntrack_tuple_hash *h;
 	struct nf_conn *ct;
 	rcu_read_lock();
 begin:
 	h = __nf_conntrack_find(net, tuple);
 	if (h) {
 		ct = nf_ct_tuplehash_to_ctrack(h);
 		if (unlikely(!atomic_inc_not_zero(&ct->ct_general.use)))
 			h = NULL;
 		else {
 			if (unlikely(!nf_ct_tuple_equal(tuple, &h->tuple))) {
 				nf_ct_put(ct);
 				goto begin;
 			}
 		}
 	}
 	rcu_read_unlock();
 	return h;
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_find_get);
 static void __nf_conntrack_hash_insert(struct nf_conn *ct,
 				       unsigned int hash,
 				       unsigned int repl_hash)
 {
 	struct net *net = nf_ct_net(ct);
 	hlist_nulls_add_head_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode,
 			   &net->ct.hash[hash]);
 	hlist_nulls_add_head_rcu(&ct->tuplehash[IP_CT_DIR_REPLY].hnnode,
 			   &net->ct.hash[repl_hash]);
 }
 void nf_conntrack_hash_insert(struct nf_conn *ct)
 {
 	unsigned int hash, repl_hash;
 	hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
 	repl_hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
 	__nf_conntrack_hash_insert(ct, hash, repl_hash);
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_hash_insert);
 /* Confirm a connection given skb; places it in hash table */
 int
 __nf_conntrack_confirm(struct sk_buff *skb)
 {
 	unsigned int hash, repl_hash;
 	struct nf_conntrack_tuple_hash *h;
 	struct nf_conn *ct;
 	struct nf_conn_help *help;
 	struct hlist_nulls_node *n;
 	enum ip_conntrack_info ctinfo;
 	struct net *net;
 	ct = nf_ct_get(skb, &ctinfo);
 	net = nf_ct_net(ct);
 	/* ipt_REJECT uses nf_conntrack_attach to attach related
 	   ICMP/TCP RST packets in other direction.  Actual packet
 	   which created connection will be IP_CT_NEW or for an
 	   expected connection, IP_CT_RELATED. */
 	if (CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL)
 		return NF_ACCEPT;
 	hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
 	repl_hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
 	/* We're not in hash table, and we refuse to set up related
 	   connections for unconfirmed conns.  But packet copies and
 	   REJECT will give spurious warnings here. */
 	/* NF_CT_ASSERT(atomic_read(&ct->ct_general.use) == 1); */
 	/* No external references means noone else could have
 	   confirmed us. */
 	NF_CT_ASSERT(!nf_ct_is_confirmed(ct));
 	pr_debug("Confirming conntrack %p\n", ct);
 	spin_lock_bh(&nf_conntrack_lock);
 	/* See if there's one in the list already, including reverse:
 	   NAT could have grabbed it without realizing, since we're
 	   not in the hash.  If there is, we lost race. */
 	hlist_nulls_for_each_entry(h, n, &net->ct.hash[hash], hnnode)
 		if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
 				      &h->tuple))
 			goto out;
 	hlist_nulls_for_each_entry(h, n, &net->ct.hash[repl_hash], hnnode)
 		if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_REPLY].tuple,
 				      &h->tuple))
 			goto out;
 	/* Remove from unconfirmed list */
 	hlist_nulls_del_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode);
 	__nf_conntrack_hash_insert(ct, hash, repl_hash);
 	/* Timer relative to confirmation time, not original
 	   setting time, otherwise we'd get timer wrap in
 	   weird delay cases. */
 	ct->timeout.expires += jiffies;
 	add_timer(&ct->timeout);
 	atomic_inc(&ct->ct_general.use);
 	set_bit(IPS_CONFIRMED_BIT, &ct->status);
 	NF_CT_STAT_INC(net, insert);
 	spin_unlock_bh(&nf_conntrack_lock);
 	help = nfct_help(ct);
 	if (help && help->helper)
 		nf_conntrack_event_cache(IPCT_HELPER, ct);
 	nf_conntrack_event_cache(master_ct(ct) ?
 				 IPCT_RELATED : IPCT_NEW, ct);
 	return NF_ACCEPT;
 out:
 	NF_CT_STAT_INC(net, insert_failed);
 	spin_unlock_bh(&nf_conntrack_lock);
 	return NF_DROP;
 }
 EXPORT_SYMBOL_GPL(__nf_conntrack_confirm);
 /* Returns true if a connection correspondings to the tuple (required
    for NAT). */
 int
 nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
 			 const struct nf_conn *ignored_conntrack)
 {
 	struct net *net = nf_ct_net(ignored_conntrack);
 	struct nf_conntrack_tuple_hash *h;
 	struct hlist_nulls_node *n;
 	unsigned int hash = hash_conntrack(tuple);
 	/* Disable BHs the entire time since we need to disable them at
 	 * least once for the stats anyway.
 	 */
 	rcu_read_lock_bh();
 	hlist_nulls_for_each_entry_rcu(h, n, &net->ct.hash[hash], hnnode) {
 		if (nf_ct_tuplehash_to_ctrack(h) != ignored_conntrack &&
 		    nf_ct_tuple_equal(tuple, &h->tuple)) {
 			NF_CT_STAT_INC(net, found);
 			rcu_read_unlock_bh();
 			return 1;
 		}
 		NF_CT_STAT_INC(net, searched);
 	}
 	rcu_read_unlock_bh();
 	return 0;
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_tuple_taken);
 #define NF_CT_EVICTION_RANGE	8
 /* There's a small race here where we may free a just-assured
    connection.  Too bad: we're in trouble anyway. */
 static noinline int early_drop(struct net *net, unsigned int hash)
 {
 	/* Use oldest entry, which is roughly LRU */
 	struct nf_conntrack_tuple_hash *h;
 	struct nf_conn *ct = NULL, *tmp;
 	struct hlist_nulls_node *n;
 	unsigned int i, cnt = 0;
 	int dropped = 0;
 	rcu_read_lock();
 	for (i = 0; i < nf_conntrack_htable_size; i++) {
 		hlist_nulls_for_each_entry_rcu(h, n, &net->ct.hash[hash],
 					 hnnode) {
 			tmp = nf_ct_tuplehash_to_ctrack(h);
 			if (!test_bit(IPS_ASSURED_BIT, &tmp->status))
 				ct = tmp;
 			cnt++;
 		}
 		if (ct && unlikely(!atomic_inc_not_zero(&ct->ct_general.use)))
 			ct = NULL;
 		if (ct || cnt >= NF_CT_EVICTION_RANGE)
 			break;
 		hash = (hash + 1) % nf_conntrack_htable_size;
 	}
 	rcu_read_unlock();
 	if (!ct)
 		return dropped;
 	if (del_timer(&ct->timeout)) {
 		death_by_timeout((unsigned long)ct);
 		dropped = 1;
 		NF_CT_STAT_INC_ATOMIC(net, early_drop);
 	}
 	nf_ct_put(ct);
 	return dropped;
 }
 struct nf_conn *nf_conntrack_alloc(struct net *net,
 				   const struct nf_conntrack_tuple *orig,
 				   const struct nf_conntrack_tuple *repl,
 				   gfp_t gfp)
 {
 	struct nf_conn *ct;
 	if (unlikely(!nf_conntrack_hash_rnd_initted)) {
 		get_random_bytes(&nf_conntrack_hash_rnd,
 				sizeof(nf_conntrack_hash_rnd));
 		nf_conntrack_hash_rnd_initted = 1;
 	}
 	/* We don't want any race condition at early drop stage */
 	atomic_inc(&net->ct.count);
 	if (nf_conntrack_max &&
 	    unlikely(atomic_read(&net->ct.count) > nf_conntrack_max)) {
 		unsigned int hash = hash_conntrack(orig);
 		if (!early_drop(net, hash)) {
 			atomic_dec(&net->ct.count);
 			if (net_ratelimit())
 				printk(KERN_WARNING
 				       "nf_conntrack: table full, dropping"
 				       " packet.\n");
 			return ERR_PTR(-ENOMEM);
 		}
 	}
 	ct = kmem_cache_zalloc(nf_conntrack_cachep, gfp);
 	if (ct == NULL) {
 		pr_debug("nf_conntrack_alloc: Can't alloc conntrack.\n");
 		atomic_dec(&net->ct.count);
 		return ERR_PTR(-ENOMEM);
 	}
+	spin_lock_init(&ct->lock);
 	atomic_set(&ct->ct_general.use, 1);
 	ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple = *orig;
 	ct->tuplehash[IP_CT_DIR_REPLY].tuple = *repl;
 	/* Don't set timer yet: wait for confirmation */
 	setup_timer(&ct->timeout, death_by_timeout, (unsigned long)ct);
 #ifdef CONFIG_NET_NS
 	ct->ct_net = net;
 #endif
 	return ct;
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_alloc);
 void nf_conntrack_free(struct nf_conn *ct)
 {
 	struct net *net = nf_ct_net(ct);
 	nf_ct_ext_destroy(ct);
 	atomic_dec(&net->ct.count);
 	nf_ct_ext_free(ct);
 	kmem_cache_free(nf_conntrack_cachep, ct);
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_free);
 /* Allocate a new conntrack: we return -ENOMEM if classification
    failed due to stress.  Otherwise it really is unclassifiable. */
 static struct nf_conntrack_tuple_hash *
 init_conntrack(struct net *net,
 	       const struct nf_conntrack_tuple *tuple,
 	       struct nf_conntrack_l3proto *l3proto,
 	       struct nf_conntrack_l4proto *l4proto,
 	       struct sk_buff *skb,
 	       unsigned int dataoff)
 {
 	struct nf_conn *ct;
 	struct nf_conn_help *help;
 	struct nf_conntrack_tuple repl_tuple;
 	struct nf_conntrack_expect *exp;
 	if (!nf_ct_invert_tuple(&repl_tuple, tuple, l3proto, l4proto)) {
 		pr_debug("Can't invert tuple.\n");
 		return NULL;
 	}
 	ct = nf_conntrack_alloc(net, tuple, &repl_tuple, GFP_ATOMIC);
 	if (IS_ERR(ct)) {
 		pr_debug("Can't allocate conntrack.\n");
 		return (struct nf_conntrack_tuple_hash *)ct;
 	}
 	if (!l4proto->new(ct, skb, dataoff)) {
 		nf_conntrack_free(ct);
 		pr_debug("init conntrack: can't track with proto module\n");
 		return NULL;
 	}
 	nf_ct_acct_ext_add(ct, GFP_ATOMIC);
 	spin_lock_bh(&nf_conntrack_lock);
 	exp = nf_ct_find_expectation(net, tuple);
 	if (exp) {
 		pr_debug("conntrack: expectation arrives ct=%p exp=%p\n",
 			 ct, exp);
 		/* Welcome, Mr. Bond.  We've been expecting you... */
 		__set_bit(IPS_EXPECTED_BIT, &ct->status);
 		ct->master = exp->master;
 		if (exp->helper) {
 			help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
 			if (help)
 				rcu_assign_pointer(help->helper, exp->helper);
 		}
 #ifdef CONFIG_NF_CONNTRACK_MARK
 		ct->mark = exp->master->mark;
 #endif
 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 		ct->secmark = exp->master->secmark;
 #endif
 		nf_conntrack_get(&ct->master->ct_general);
 		NF_CT_STAT_INC(net, expect_new);
 	} else {
 		__nf_ct_try_assign_helper(ct, GFP_ATOMIC);
 		NF_CT_STAT_INC(net, new);
 	}
 	/* Overload tuple linked list to put us in unconfirmed list. */
 	hlist_nulls_add_head_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode,
 		       &net->ct.unconfirmed);
 	spin_unlock_bh(&nf_conntrack_lock);
 	if (exp) {
 		if (exp->expectfn)
 			exp->expectfn(ct, exp);
 		nf_ct_expect_put(exp);
 	}
 	return &ct->tuplehash[IP_CT_DIR_ORIGINAL];
 }
 /* On success, returns conntrack ptr, sets skb->nfct and ctinfo */
 static inline struct nf_conn *
 resolve_normal_ct(struct net *net,
 		  struct sk_buff *skb,
 		  unsigned int dataoff,
 		  u_int16_t l3num,
 		  u_int8_t protonum,
 		  struct nf_conntrack_l3proto *l3proto,
 		  struct nf_conntrack_l4proto *l4proto,
 		  int *set_reply,
 		  enum ip_conntrack_info *ctinfo)
 {
 	struct nf_conntrack_tuple tuple;
 	struct nf_conntrack_tuple_hash *h;
 	struct nf_conn *ct;
 	if (!nf_ct_get_tuple(skb, skb_network_offset(skb),
 			     dataoff, l3num, protonum, &tuple, l3proto,
 			     l4proto)) {
 		pr_debug("resolve_normal_ct: Can't get tuple\n");
 		return NULL;
 	}
 	/* look for tuple match */
 	h = nf_conntrack_find_get(net, &tuple);
 	if (!h) {
 		h = init_conntrack(net, &tuple, l3proto, l4proto, skb, dataoff);
 		if (!h)
 			return NULL;
 		if (IS_ERR(h))
 			return (void *)h;
 	}
 	ct = nf_ct_tuplehash_to_ctrack(h);
 	/* It exists; we have (non-exclusive) reference. */
 	if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY) {
 		*ctinfo = IP_CT_ESTABLISHED + IP_CT_IS_REPLY;
 		/* Please set reply bit if this packet OK */
 		*set_reply = 1;
 	} else {
 		/* Once we've had two way comms, always ESTABLISHED. */
 		if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
 			pr_debug("nf_conntrack_in: normal packet for %p\n", ct);
 			*ctinfo = IP_CT_ESTABLISHED;
 		} else if (test_bit(IPS_EXPECTED_BIT, &ct->status)) {
 			pr_debug("nf_conntrack_in: related packet for %p\n",
 				 ct);
 			*ctinfo = IP_CT_RELATED;
 		} else {
 			pr_debug("nf_conntrack_in: new packet for %p\n", ct);
 			*ctinfo = IP_CT_NEW;
 		}
 		*set_reply = 0;
 	}
 	skb->nfct = &ct->ct_general;
 	skb->nfctinfo = *ctinfo;
 	return ct;
 }
 unsigned int
 nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum,
 		struct sk_buff *skb)
 {
 	struct nf_conn *ct;
 	enum ip_conntrack_info ctinfo;
 	struct nf_conntrack_l3proto *l3proto;
 	struct nf_conntrack_l4proto *l4proto;
 	unsigned int dataoff;
 	u_int8_t protonum;
 	int set_reply = 0;
 	int ret;
 	/* Previously seen (loopback or untracked)?  Ignore. */
 	if (skb->nfct) {
 		NF_CT_STAT_INC_ATOMIC(net, ignore);
 		return NF_ACCEPT;
 	}
 	/* rcu_read_lock()ed by nf_hook_slow */
 	l3proto = __nf_ct_l3proto_find(pf);
 	ret = l3proto->get_l4proto(skb, skb_network_offset(skb),
 				   &dataoff, &protonum);
 	if (ret <= 0) {
 		pr_debug("not prepared to track yet or error occured\n");
 		NF_CT_STAT_INC_ATOMIC(net, error);
 		NF_CT_STAT_INC_ATOMIC(net, invalid);
 		return -ret;
 	}
 	l4proto = __nf_ct_l4proto_find(pf, protonum);
 	/* It may be an special packet, error, unclean...
 	 * inverse of the return code tells to the netfilter
 	 * core what to do with the packet. */
 	if (l4proto->error != NULL) {
 		ret = l4proto->error(net, skb, dataoff, &ctinfo, pf, hooknum);
 		if (ret <= 0) {
 			NF_CT_STAT_INC_ATOMIC(net, error);
 			NF_CT_STAT_INC_ATOMIC(net, invalid);
 			return -ret;
 		}
 	}
 	ct = resolve_normal_ct(net, skb, dataoff, pf, protonum,
 			       l3proto, l4proto, &set_reply, &ctinfo);
 	if (!ct) {
 		/* Not valid part of a connection */
 		NF_CT_STAT_INC_ATOMIC(net, invalid);
 		return NF_ACCEPT;
 	}
 	if (IS_ERR(ct)) {
 		/* Too stressed to deal. */
 		NF_CT_STAT_INC_ATOMIC(net, drop);
 		return NF_DROP;
 	}
 	NF_CT_ASSERT(skb->nfct);
 	ret = l4proto->packet(ct, skb, dataoff, ctinfo, pf, hooknum);
 	if (ret <= 0) {
 		/* Invalid: inverse of the return code tells
 		 * the netfilter core what to do */
 		pr_debug("nf_conntrack_in: Can't track with proto module\n");
 		nf_conntrack_put(skb->nfct);
 		skb->nfct = NULL;
 		NF_CT_STAT_INC_ATOMIC(net, invalid);
 		if (ret == -NF_DROP)
 			NF_CT_STAT_INC_ATOMIC(net, drop);
 		return -ret;
 	}
 	if (set_reply && !test_and_set_bit(IPS_SEEN_REPLY_BIT, &ct->status))
 		nf_conntrack_event_cache(IPCT_STATUS, ct);
 	return ret;
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_in);
 bool nf_ct_invert_tuplepr(struct nf_conntrack_tuple *inverse,
 			  const struct nf_conntrack_tuple *orig)
 {
 	bool ret;
 	rcu_read_lock();
 	ret = nf_ct_invert_tuple(inverse, orig,
 				 __nf_ct_l3proto_find(orig->src.l3num),
 				 __nf_ct_l4proto_find(orig->src.l3num,
 						      orig->dst.protonum));
 	rcu_read_unlock();
 	return ret;
 }
 EXPORT_SYMBOL_GPL(nf_ct_invert_tuplepr);
 /* Alter reply tuple (maybe alter helper).  This is for NAT, and is
    implicitly racy: see __nf_conntrack_confirm */
 void nf_conntrack_alter_reply(struct nf_conn *ct,
 			      const struct nf_conntrack_tuple *newreply)
 {
 	struct nf_conn_help *help = nfct_help(ct);
 	/* Should be unconfirmed, so not in hash table yet */
 	NF_CT_ASSERT(!nf_ct_is_confirmed(ct));
 	pr_debug("Altering reply tuple of %p to ", ct);
 	nf_ct_dump_tuple(newreply);
 	ct->tuplehash[IP_CT_DIR_REPLY].tuple = *newreply;
 	if (ct->master || (help && !hlist_empty(&help->expectations)))
 		return;
 	rcu_read_lock();
 	__nf_ct_try_assign_helper(ct, GFP_ATOMIC);
 	rcu_read_unlock();
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_alter_reply);
 /* Refresh conntrack for this many jiffies and do accounting if do_acct is 1 */
 void __nf_ct_refresh_acct(struct nf_conn *ct,
 			  enum ip_conntrack_info ctinfo,
 			  const struct sk_buff *skb,
 			  unsigned long extra_jiffies,
 			  int do_acct)
 {
 	NF_CT_ASSERT(ct->timeout.data == (unsigned long)ct);
 	NF_CT_ASSERT(skb);
 	spin_lock_bh(&nf_conntrack_lock);
 	/* Only update if this is not a fixed timeout */
 	if (test_bit(IPS_FIXED_TIMEOUT_BIT, &ct->status))
 		goto acct;
 	/* If not in hash table, timer will not be active yet */
 	if (!nf_ct_is_confirmed(ct)) {
 		ct->timeout.expires = extra_jiffies;
 	} else {
 		unsigned long newtime = jiffies + extra_jiffies;
 		/* Only update the timeout if the new timeout is at least
 		   HZ jiffies from the old timeout. Need del_timer for race
 		   avoidance (may already be dying). */
 		if (newtime - ct->timeout.expires >= HZ
 		    && del_timer(&ct->timeout)) {
 			ct->timeout.expires = newtime;
 			add_timer(&ct->timeout);
 		}
 	}
 acct:
 	if (do_acct) {
 		struct nf_conn_counter *acct;
 		acct = nf_conn_acct_find(ct);
 		if (acct) {
 			acct[CTINFO2DIR(ctinfo)].packets++;
 			acct[CTINFO2DIR(ctinfo)].bytes +=
 				skb->len - skb_network_offset(skb);
 		}
 	}
 	spin_unlock_bh(&nf_conntrack_lock);
 }
 EXPORT_SYMBOL_GPL(__nf_ct_refresh_acct);
 bool __nf_ct_kill_acct(struct nf_conn *ct,
 		       enum ip_conntrack_info ctinfo,
 		       const struct sk_buff *skb,
 		       int do_acct)
 {
 	if (do_acct) {
 		struct nf_conn_counter *acct;
 		spin_lock_bh(&nf_conntrack_lock);
 		acct = nf_conn_acct_find(ct);
 		if (acct) {
 			acct[CTINFO2DIR(ctinfo)].packets++;
 			acct[CTINFO2DIR(ctinfo)].bytes +=
 				skb->len - skb_network_offset(skb);
 		}
 		spin_unlock_bh(&nf_conntrack_lock);
 	}
 	if (del_timer(&ct->timeout)) {
 		ct->timeout.function((unsigned long)ct);
 		return true;
 	}
 	return false;
 }
 EXPORT_SYMBOL_GPL(__nf_ct_kill_acct);
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_conntrack.h>
 #include <linux/mutex.h>
 /* Generic function for tcp/udp/sctp/dccp and alike. This needs to be
  * in ip_conntrack_core, since we don't want the protocols to autoload
  * or depend on ctnetlink */
 int nf_ct_port_tuple_to_nlattr(struct sk_buff *skb,
 			       const struct nf_conntrack_tuple *tuple)
 {
 	NLA_PUT_BE16(skb, CTA_PROTO_SRC_PORT, tuple->src.u.tcp.port);
 	NLA_PUT_BE16(skb, CTA_PROTO_DST_PORT, tuple->dst.u.tcp.port);
 	return 0;
 nla_put_failure:
 	return -1;
 }
 EXPORT_SYMBOL_GPL(nf_ct_port_tuple_to_nlattr);
 const struct nla_policy nf_ct_port_nla_policy[CTA_PROTO_MAX+1] = {
 	[CTA_PROTO_SRC_PORT]  = { .type = NLA_U16 },
 	[CTA_PROTO_DST_PORT]  = { .type = NLA_U16 },
 };
 EXPORT_SYMBOL_GPL(nf_ct_port_nla_policy);
 int nf_ct_port_nlattr_to_tuple(struct nlattr *tb[],
 			       struct nf_conntrack_tuple *t)
 {
 	if (!tb[CTA_PROTO_SRC_PORT] || !tb[CTA_PROTO_DST_PORT])
 		return -EINVAL;
 	t->src.u.tcp.port = nla_get_be16(tb[CTA_PROTO_SRC_PORT]);
 	t->dst.u.tcp.port = nla_get_be16(tb[CTA_PROTO_DST_PORT]);
 	return 0;
 }
 EXPORT_SYMBOL_GPL(nf_ct_port_nlattr_to_tuple);
 int nf_ct_port_nlattr_tuple_size(void)
 {
 	return nla_policy_len(nf_ct_port_nla_policy, CTA_PROTO_MAX + 1);
 }
 EXPORT_SYMBOL_GPL(nf_ct_port_nlattr_tuple_size);
 #endif
 /* Used by ipt_REJECT and ip6t_REJECT. */
 static void nf_conntrack_attach(struct sk_buff *nskb, struct sk_buff *skb)
 {
 	struct nf_conn *ct;
 	enum ip_conntrack_info ctinfo;
 	/* This ICMP is in reverse direction to the packet which caused it */
 	ct = nf_ct_get(skb, &ctinfo);
 	if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL)
 		ctinfo = IP_CT_RELATED + IP_CT_IS_REPLY;
 	else
 		ctinfo = IP_CT_RELATED;
 	/* Attach to new skbuff, and increment count */
 	nskb->nfct = &ct->ct_general;
 	nskb->nfctinfo = ctinfo;
 	nf_conntrack_get(nskb->nfct);
 }
 /* Bring out ya dead! */
 static struct nf_conn *
 get_next_corpse(struct net *net, int (*iter)(struct nf_conn *i, void *data),
 		void *data, unsigned int *bucket)
 {
 	struct nf_conntrack_tuple_hash *h;
 	struct nf_conn *ct;
 	struct hlist_nulls_node *n;
 	spin_lock_bh(&nf_conntrack_lock);
 	for (; *bucket < nf_conntrack_htable_size; (*bucket)++) {
 		hlist_nulls_for_each_entry(h, n, &net->ct.hash[*bucket], hnnode) {
 			ct = nf_ct_tuplehash_to_ctrack(h);
 			if (iter(ct, data))
 				goto found;
 		}
 	}
 	hlist_nulls_for_each_entry(h, n, &net->ct.unconfirmed, hnnode) {
 		ct = nf_ct_tuplehash_to_ctrack(h);
 		if (iter(ct, data))
 			set_bit(IPS_DYING_BIT, &ct->status);
 	}
 	spin_unlock_bh(&nf_conntrack_lock);
 	return NULL;
 found:
 	atomic_inc(&ct->ct_general.use);
 	spin_unlock_bh(&nf_conntrack_lock);
 	return ct;
 }
 void nf_ct_iterate_cleanup(struct net *net,
 			   int (*iter)(struct nf_conn *i, void *data),
 			   void *data)
 {
 	struct nf_conn *ct;
 	unsigned int bucket = 0;
 	while ((ct = get_next_corpse(net, iter, data, &bucket)) != NULL) {
 		/* Time to push up daises... */
 		if (del_timer(&ct->timeout))
 			death_by_timeout((unsigned long)ct);
 		/* ... else the timer will get him soon. */
 		nf_ct_put(ct);
 	}
 }
 EXPORT_SYMBOL_GPL(nf_ct_iterate_cleanup);
 struct __nf_ct_flush_report {
 	u32 pid;
 	int report;
 };
 static int kill_report(struct nf_conn *i, void *data)
 {
 	struct __nf_ct_flush_report *fr = (struct __nf_ct_flush_report *)data;
 	/* get_next_corpse sets the dying bit for us */
 	nf_conntrack_event_report(IPCT_DESTROY,
 				  i,
 				  fr->pid,
 				  fr->report);
 	return 1;
 }
 static int kill_all(struct nf_conn *i, void *data)
 {
 	return 1;
 }
 void nf_ct_free_hashtable(void *hash, int vmalloced, unsigned int size)
 {
 	if (vmalloced)
 		vfree(hash);
 	else
 		free_pages((unsigned long)hash,
 			   get_order(sizeof(struct hlist_head) * size));
 }
 EXPORT_SYMBOL_GPL(nf_ct_free_hashtable);
 void nf_conntrack_flush_report(struct net *net, u32 pid, int report)
 {
 	struct __nf_ct_flush_report fr = {
 		.pid 	= pid,
 		.report = report,
 	};
 	nf_ct_iterate_cleanup(net, kill_report, &fr);
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_flush_report);
 static void nf_conntrack_cleanup_init_net(void)
 {
 	nf_conntrack_helper_fini();
 	nf_conntrack_proto_fini();
 	kmem_cache_destroy(nf_conntrack_cachep);
 }
 static void nf_conntrack_cleanup_net(struct net *net)
 {
 	nf_ct_event_cache_flush(net);
 	nf_conntrack_ecache_fini(net);
  i_see_dead_people:
 	nf_ct_iterate_cleanup(net, kill_all, NULL);
 	if (atomic_read(&net->ct.count) != 0) {
 		schedule();
 		goto i_see_dead_people;
 	}
 	/* wait until all references to nf_conntrack_untracked are dropped */
 	while (atomic_read(&nf_conntrack_untracked.ct_general.use) > 1)
 		schedule();
 	nf_ct_free_hashtable(net->ct.hash, net->ct.hash_vmalloc,
 			     nf_conntrack_htable_size);
 	nf_conntrack_acct_fini(net);
 	nf_conntrack_expect_fini(net);
 	free_percpu(net->ct.stat);
 }
 /* Mishearing the voices in his head, our hero wonders how he's
    supposed to kill the mall. */
 void nf_conntrack_cleanup(struct net *net)
 {
 	if (net_eq(net, &init_net))
 		rcu_assign_pointer(ip_ct_attach, NULL);
 	/* This makes sure all current packets have passed through
 	   netfilter framework.  Roll on, two-stage module
 	   delete... */
 	synchronize_net();
 	nf_conntrack_cleanup_net(net);
 	if (net_eq(net, &init_net)) {
 		rcu_assign_pointer(nf_ct_destroy, NULL);
 		nf_conntrack_cleanup_init_net();
 	}
 }
 void *nf_ct_alloc_hashtable(unsigned int *sizep, int *vmalloced, int nulls)
 {
 	struct hlist_nulls_head *hash;
 	unsigned int nr_slots, i;
 	size_t sz;
 	*vmalloced = 0;
 	BUILD_BUG_ON(sizeof(struct hlist_nulls_head) != sizeof(struct hlist_head));
 	nr_slots = *sizep = roundup(*sizep, PAGE_SIZE / sizeof(struct hlist_nulls_head));
 	sz = nr_slots * sizeof(struct hlist_nulls_head);
 	hash = (void *)__get_free_pages(GFP_KERNEL | __GFP_NOWARN | __GFP_ZERO,
 					get_order(sz));
 	if (!hash) {
 		*vmalloced = 1;
 		printk(KERN_WARNING "nf_conntrack: falling back to vmalloc.\n");
 		hash = __vmalloc(sz, GFP_KERNEL | __GFP_ZERO, PAGE_KERNEL);
 	}
 	if (hash && nulls)
 		for (i = 0; i < nr_slots; i++)
 			INIT_HLIST_NULLS_HEAD(&hash[i], i);
 	return hash;
 }
 EXPORT_SYMBOL_GPL(nf_ct_alloc_hashtable);
 int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp)
 {
 	int i, bucket, vmalloced, old_vmalloced;
 	unsigned int hashsize, old_size;
 	int rnd;
 	struct hlist_nulls_head *hash, *old_hash;
 	struct nf_conntrack_tuple_hash *h;
 	/* On boot, we can set this without any fancy locking. */
 	if (!nf_conntrack_htable_size)
 		return param_set_uint(val, kp);
 	hashsize = simple_strtoul(val, NULL, 0);
 	if (!hashsize)
 		return -EINVAL;
 	hash = nf_ct_alloc_hashtable(&hashsize, &vmalloced, 1);
 	if (!hash)
 		return -ENOMEM;
 	/* We have to rehahs for the new table anyway, so we also can
 	 * use a newrandom seed */
 	get_random_bytes(&rnd, sizeof(rnd));
 	/* Lookups in the old hash might happen in parallel, which means we
 	 * might get false negatives during connection lookup. New connections
 	 * created because of a false negative won't make it into the hash
 	 * though since that required taking the lock.
 	 */
 	spin_lock_bh(&nf_conntrack_lock);
 	for (i = 0; i < nf_conntrack_htable_size; i++) {
 		while (!hlist_nulls_empty(&init_net.ct.hash[i])) {
 			h = hlist_nulls_entry(init_net.ct.hash[i].first,
 					struct nf_conntrack_tuple_hash, hnnode);
 			hlist_nulls_del_rcu(&h->hnnode);
 			bucket = __hash_conntrack(&h->tuple, hashsize, rnd);
 			hlist_nulls_add_head_rcu(&h->hnnode, &hash[bucket]);
 		}
 	}
 	old_size = nf_conntrack_htable_size;
 	old_vmalloced = init_net.ct.hash_vmalloc;
 	old_hash = init_net.ct.hash;
 	nf_conntrack_htable_size = hashsize;
 	init_net.ct.hash_vmalloc = vmalloced;
 	init_net.ct.hash = hash;
 	nf_conntrack_hash_rnd = rnd;
 	spin_unlock_bh(&nf_conntrack_lock);
 	nf_ct_free_hashtable(old_hash, old_vmalloced, old_size);
 	return 0;
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_set_hashsize);
 module_param_call(hashsize, nf_conntrack_set_hashsize, param_get_uint,
 		  &nf_conntrack_htable_size, 0600);
 static int nf_conntrack_init_init_net(void)
 {
 	int max_factor = 8;
 	int ret;
 	/* Idea from tcp.c: use 1/16384 of memory.  On i386: 32MB
 	 * machine has 512 buckets. >= 1GB machines have 16384 buckets. */
 	if (!nf_conntrack_htable_size) {
 		nf_conntrack_htable_size
 			= (((num_physpages << PAGE_SHIFT) / 16384)
 			   / sizeof(struct hlist_head));
 		if (num_physpages > (1024 * 1024 * 1024 / PAGE_SIZE))
 			nf_conntrack_htable_size = 16384;
 		if (nf_conntrack_htable_size < 32)
 			nf_conntrack_htable_size = 32;
 		/* Use a max. factor of four by default to get the same max as
 		 * with the old struct list_heads. When a table size is given
 		 * we use the old value of 8 to avoid reducing the max.
 		 * entries. */
 		max_factor = 4;
 	}
 	nf_conntrack_max = max_factor * nf_conntrack_htable_size;
 	printk("nf_conntrack version %s (%u buckets, %d max)\n",
 	       NF_CONNTRACK_VERSION, nf_conntrack_htable_size,
 	       nf_conntrack_max);
 	nf_conntrack_cachep = kmem_cache_create("nf_conntrack",
 						sizeof(struct nf_conn),
 						0, SLAB_DESTROY_BY_RCU, NULL);
 	if (!nf_conntrack_cachep) {
 		printk(KERN_ERR "Unable to create nf_conn slab cache\n");
 		ret = -ENOMEM;
 		goto err_cache;
 	}
 	ret = nf_conntrack_proto_init();
 	if (ret < 0)
 		goto err_proto;
 	ret = nf_conntrack_helper_init();
 	if (ret < 0)
 		goto err_helper;
 	return 0;
 err_helper:
 	nf_conntrack_proto_fini();
 err_proto:
 	kmem_cache_destroy(nf_conntrack_cachep);
 err_cache:
 	return ret;
 }
 static int nf_conntrack_init_net(struct net *net)
 {
 	int ret;
 	atomic_set(&net->ct.count, 0);
 	INIT_HLIST_NULLS_HEAD(&net->ct.unconfirmed, 0);
 	net->ct.stat = alloc_percpu(struct ip_conntrack_stat);
 	if (!net->ct.stat) {
 		ret = -ENOMEM;
 		goto err_stat;
 	}
 	ret = nf_conntrack_ecache_init(net);
 	if (ret < 0)
 		goto err_ecache;
 	net->ct.hash = nf_ct_alloc_hashtable(&nf_conntrack_htable_size,
 					     &net->ct.hash_vmalloc, 1);
 	if (!net->ct.hash) {
 		ret = -ENOMEM;
 		printk(KERN_ERR "Unable to create nf_conntrack_hash\n");
 		goto err_hash;
 	}
 	ret = nf_conntrack_expect_init(net);
 	if (ret < 0)
 		goto err_expect;
 	ret = nf_conntrack_acct_init(net);
 	if (ret < 0)
 		goto err_acct;
 	/* Set up fake conntrack:
 	    - to never be deleted, not in any hashes */
 #ifdef CONFIG_NET_NS
 	nf_conntrack_untracked.ct_net = &init_net;
 #endif
 	atomic_set(&nf_conntrack_untracked.ct_general.use, 1);
 	/*  - and look it like as a confirmed connection */
 	set_bit(IPS_CONFIRMED_BIT, &nf_conntrack_untracked.status);
 	return 0;
 err_acct:
 	nf_conntrack_expect_fini(net);
 err_expect:
 	nf_ct_free_hashtable(net->ct.hash, net->ct.hash_vmalloc,
 			     nf_conntrack_htable_size);
 err_hash:
 	nf_conntrack_ecache_fini(net);
 err_ecache:
 	free_percpu(net->ct.stat);
 err_stat:
 	return ret;
 }
 int nf_conntrack_init(struct net *net)
 {
 	int ret;
 	if (net_eq(net, &init_net)) {
 		ret = nf_conntrack_init_init_net();
 		if (ret < 0)
 			goto out_init_net;
 	}
 	ret = nf_conntrack_init_net(net);
 	if (ret < 0)
 		goto out_net;
 	if (net_eq(net, &init_net)) {
 		/* For use by REJECT target */
 		rcu_assign_pointer(ip_ct_attach, nf_conntrack_attach);
 		rcu_assign_pointer(nf_ct_destroy, destroy_conntrack);
 	}
 	return 0;
 out_net:
 	if (net_eq(net, &init_net))
 		nf_conntrack_cleanup_init_net();
 out_init_net:
 	return ret;
 }

net/netfilter/nf_conntrack_netlink.c

Diff comments View file @ 440f0d5

1	/* Connection tracking via netlink socket. Allows for user space	1	/* Connection tracking via netlink socket. Allows for user space
2	* protocol helpers and general trouble making from userspace.	2	* protocol helpers and general trouble making from userspace.
3	*	3	*
4	* (C) 2001 by Jay Schulist <jschlst@samba.org>	4	* (C) 2001 by Jay Schulist <jschlst@samba.org>
5	* (C) 2002-2006 by Harald Welte <laforge@gnumonks.org>	5	* (C) 2002-2006 by Harald Welte <laforge@gnumonks.org>
6	* (C) 2003 by Patrick Mchardy <kaber@trash.net>	6	* (C) 2003 by Patrick Mchardy <kaber@trash.net>
7	* (C) 2005-2008 by Pablo Neira Ayuso <pablo@netfilter.org>	7	* (C) 2005-2008 by Pablo Neira Ayuso <pablo@netfilter.org>
8	*	8	*
9	* Initial connection tracking via netlink development funded and	9	* Initial connection tracking via netlink development funded and
10	* generally made possible by Network Robots, Inc. (www.networkrobots.com)	10	* generally made possible by Network Robots, Inc. (www.networkrobots.com)
11	*	11	*
12	* Further development of this code funded by Astaro AG (http://www.astaro.com)	12	* Further development of this code funded by Astaro AG (http://www.astaro.com)
13	*	13	*
14	* This software may be used and distributed according to the terms	14	* This software may be used and distributed according to the terms
15	* of the GNU General Public License, incorporated herein by reference.	15	* of the GNU General Public License, incorporated herein by reference.
16	*/	16	*/
17		17
18	#include <linux/init.h>	18	#include <linux/init.h>
19	#include <linux/module.h>	19	#include <linux/module.h>
20	#include <linux/kernel.h>	20	#include <linux/kernel.h>
21	#include <linux/rculist.h>	21	#include <linux/rculist.h>
22	#include <linux/rculist_nulls.h>	22	#include <linux/rculist_nulls.h>
23	#include <linux/types.h>	23	#include <linux/types.h>
24	#include <linux/timer.h>	24	#include <linux/timer.h>
25	#include <linux/skbuff.h>	25	#include <linux/skbuff.h>
26	#include <linux/errno.h>	26	#include <linux/errno.h>
27	#include <linux/netlink.h>	27	#include <linux/netlink.h>
28	#include <linux/spinlock.h>	28	#include <linux/spinlock.h>
29	#include <linux/interrupt.h>	29	#include <linux/interrupt.h>
30		30
31	#include <linux/netfilter.h>	31	#include <linux/netfilter.h>
32	#include <net/netlink.h>	32	#include <net/netlink.h>
33	#include <net/netfilter/nf_conntrack.h>	33	#include <net/netfilter/nf_conntrack.h>
34	#include <net/netfilter/nf_conntrack_core.h>	34	#include <net/netfilter/nf_conntrack_core.h>
35	#include <net/netfilter/nf_conntrack_expect.h>	35	#include <net/netfilter/nf_conntrack_expect.h>
36	#include <net/netfilter/nf_conntrack_helper.h>	36	#include <net/netfilter/nf_conntrack_helper.h>
37	#include <net/netfilter/nf_conntrack_l3proto.h>	37	#include <net/netfilter/nf_conntrack_l3proto.h>
38	#include <net/netfilter/nf_conntrack_l4proto.h>	38	#include <net/netfilter/nf_conntrack_l4proto.h>
39	#include <net/netfilter/nf_conntrack_tuple.h>	39	#include <net/netfilter/nf_conntrack_tuple.h>
40	#include <net/netfilter/nf_conntrack_acct.h>	40	#include <net/netfilter/nf_conntrack_acct.h>
41	#ifdef CONFIG_NF_NAT_NEEDED	41	#ifdef CONFIG_NF_NAT_NEEDED
42	#include <net/netfilter/nf_nat_core.h>	42	#include <net/netfilter/nf_nat_core.h>
43	#include <net/netfilter/nf_nat_protocol.h>	43	#include <net/netfilter/nf_nat_protocol.h>
44	#endif	44	#endif
45		45
46	#include <linux/netfilter/nfnetlink.h>	46	#include <linux/netfilter/nfnetlink.h>
47	#include <linux/netfilter/nfnetlink_conntrack.h>	47	#include <linux/netfilter/nfnetlink_conntrack.h>
48		48
49	MODULE_LICENSE("GPL");	49	MODULE_LICENSE("GPL");
50		50
51	static char __initdata version[] = "0.93";	51	static char __initdata version[] = "0.93";
52		52
53	static inline int	53	static inline int
54	ctnetlink_dump_tuples_proto(struct sk_buff *skb,	54	ctnetlink_dump_tuples_proto(struct sk_buff *skb,
55	const struct nf_conntrack_tuple *tuple,	55	const struct nf_conntrack_tuple *tuple,
56	struct nf_conntrack_l4proto *l4proto)	56	struct nf_conntrack_l4proto *l4proto)
57	{	57	{
58	int ret = 0;	58	int ret = 0;
59	struct nlattr *nest_parms;	59	struct nlattr *nest_parms;
60		60
61	nest_parms = nla_nest_start(skb, CTA_TUPLE_PROTO \| NLA_F_NESTED);	61	nest_parms = nla_nest_start(skb, CTA_TUPLE_PROTO \| NLA_F_NESTED);
62	if (!nest_parms)	62	if (!nest_parms)
63	goto nla_put_failure;	63	goto nla_put_failure;
64	NLA_PUT_U8(skb, CTA_PROTO_NUM, tuple->dst.protonum);	64	NLA_PUT_U8(skb, CTA_PROTO_NUM, tuple->dst.protonum);
65		65
66	if (likely(l4proto->tuple_to_nlattr))	66	if (likely(l4proto->tuple_to_nlattr))
67	ret = l4proto->tuple_to_nlattr(skb, tuple);	67	ret = l4proto->tuple_to_nlattr(skb, tuple);
68		68
69	nla_nest_end(skb, nest_parms);	69	nla_nest_end(skb, nest_parms);
70		70
71	return ret;	71	return ret;
72		72
73	nla_put_failure:	73	nla_put_failure:
74	return -1;	74	return -1;
75	}	75	}
76		76
77	static inline int	77	static inline int
78	ctnetlink_dump_tuples_ip(struct sk_buff *skb,	78	ctnetlink_dump_tuples_ip(struct sk_buff *skb,
79	const struct nf_conntrack_tuple *tuple,	79	const struct nf_conntrack_tuple *tuple,
80	struct nf_conntrack_l3proto *l3proto)	80	struct nf_conntrack_l3proto *l3proto)
81	{	81	{
82	int ret = 0;	82	int ret = 0;
83	struct nlattr *nest_parms;	83	struct nlattr *nest_parms;
84		84
85	nest_parms = nla_nest_start(skb, CTA_TUPLE_IP \| NLA_F_NESTED);	85	nest_parms = nla_nest_start(skb, CTA_TUPLE_IP \| NLA_F_NESTED);
86	if (!nest_parms)	86	if (!nest_parms)
87	goto nla_put_failure;	87	goto nla_put_failure;
88		88
89	if (likely(l3proto->tuple_to_nlattr))	89	if (likely(l3proto->tuple_to_nlattr))
90	ret = l3proto->tuple_to_nlattr(skb, tuple);	90	ret = l3proto->tuple_to_nlattr(skb, tuple);
91		91
92	nla_nest_end(skb, nest_parms);	92	nla_nest_end(skb, nest_parms);
93		93
94	return ret;	94	return ret;
95		95
96	nla_put_failure:	96	nla_put_failure:
97	return -1;	97	return -1;
98	}	98	}
99		99
100	static int	100	static int
101	ctnetlink_dump_tuples(struct sk_buff *skb,	101	ctnetlink_dump_tuples(struct sk_buff *skb,
102	const struct nf_conntrack_tuple *tuple)	102	const struct nf_conntrack_tuple *tuple)
103	{	103	{
104	int ret;	104	int ret;
105	struct nf_conntrack_l3proto *l3proto;	105	struct nf_conntrack_l3proto *l3proto;
106	struct nf_conntrack_l4proto *l4proto;	106	struct nf_conntrack_l4proto *l4proto;
107		107
108	l3proto = __nf_ct_l3proto_find(tuple->src.l3num);	108	l3proto = __nf_ct_l3proto_find(tuple->src.l3num);
109	ret = ctnetlink_dump_tuples_ip(skb, tuple, l3proto);	109	ret = ctnetlink_dump_tuples_ip(skb, tuple, l3proto);
110		110
111	if (unlikely(ret < 0))	111	if (unlikely(ret < 0))
112	return ret;	112	return ret;
113		113
114	l4proto = __nf_ct_l4proto_find(tuple->src.l3num, tuple->dst.protonum);	114	l4proto = __nf_ct_l4proto_find(tuple->src.l3num, tuple->dst.protonum);
115	ret = ctnetlink_dump_tuples_proto(skb, tuple, l4proto);	115	ret = ctnetlink_dump_tuples_proto(skb, tuple, l4proto);
116		116
117	return ret;	117	return ret;
118	}	118	}
119		119
120	static inline int	120	static inline int
121	ctnetlink_dump_status(struct sk_buff skb, const struct nf_conn ct)	121	ctnetlink_dump_status(struct sk_buff skb, const struct nf_conn ct)
122	{	122	{
123	NLA_PUT_BE32(skb, CTA_STATUS, htonl(ct->status));	123	NLA_PUT_BE32(skb, CTA_STATUS, htonl(ct->status));
124	return 0;	124	return 0;
125		125
126	nla_put_failure:	126	nla_put_failure:
127	return -1;	127	return -1;
128	}	128	}
129		129
130	static inline int	130	static inline int
131	ctnetlink_dump_timeout(struct sk_buff skb, const struct nf_conn ct)	131	ctnetlink_dump_timeout(struct sk_buff skb, const struct nf_conn ct)
132	{	132	{
133	long timeout = (ct->timeout.expires - jiffies) / HZ;	133	long timeout = (ct->timeout.expires - jiffies) / HZ;
134		134
135	if (timeout < 0)	135	if (timeout < 0)
136	timeout = 0;	136	timeout = 0;
137		137
138	NLA_PUT_BE32(skb, CTA_TIMEOUT, htonl(timeout));	138	NLA_PUT_BE32(skb, CTA_TIMEOUT, htonl(timeout));
139	return 0;	139	return 0;
140		140
141	nla_put_failure:	141	nla_put_failure:
142	return -1;	142	return -1;
143	}	143	}
144		144
145	static inline int	145	static inline int
146	ctnetlink_dump_protoinfo(struct sk_buff skb, const struct nf_conn ct)	146	ctnetlink_dump_protoinfo(struct sk_buff skb, struct nf_conn ct)
147	{	147	{
148	struct nf_conntrack_l4proto *l4proto;	148	struct nf_conntrack_l4proto *l4proto;
149	struct nlattr *nest_proto;	149	struct nlattr *nest_proto;
150	int ret;	150	int ret;
151		151
152	l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));	152	l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
153	if (!l4proto->to_nlattr)	153	if (!l4proto->to_nlattr)
154	return 0;	154	return 0;
155		155
156	nest_proto = nla_nest_start(skb, CTA_PROTOINFO \| NLA_F_NESTED);	156	nest_proto = nla_nest_start(skb, CTA_PROTOINFO \| NLA_F_NESTED);
157	if (!nest_proto)	157	if (!nest_proto)
158	goto nla_put_failure;	158	goto nla_put_failure;
159		159
160	ret = l4proto->to_nlattr(skb, nest_proto, ct);	160	ret = l4proto->to_nlattr(skb, nest_proto, ct);
161		161
162	nla_nest_end(skb, nest_proto);	162	nla_nest_end(skb, nest_proto);
163		163
164	return ret;	164	return ret;
165		165
166	nla_put_failure:	166	nla_put_failure:
167	return -1;	167	return -1;
168	}	168	}
169		169
170	static inline int	170	static inline int
171	ctnetlink_dump_helpinfo(struct sk_buff skb, const struct nf_conn ct)	171	ctnetlink_dump_helpinfo(struct sk_buff skb, const struct nf_conn ct)
172	{	172	{
173	struct nlattr *nest_helper;	173	struct nlattr *nest_helper;
174	const struct nf_conn_help *help = nfct_help(ct);	174	const struct nf_conn_help *help = nfct_help(ct);
175	struct nf_conntrack_helper *helper;	175	struct nf_conntrack_helper *helper;
176		176
177	if (!help)	177	if (!help)
178	return 0;	178	return 0;
179		179
180	helper = rcu_dereference(help->helper);	180	helper = rcu_dereference(help->helper);
181	if (!helper)	181	if (!helper)
182	goto out;	182	goto out;
183		183
184	nest_helper = nla_nest_start(skb, CTA_HELP \| NLA_F_NESTED);	184	nest_helper = nla_nest_start(skb, CTA_HELP \| NLA_F_NESTED);
185	if (!nest_helper)	185	if (!nest_helper)
186	goto nla_put_failure;	186	goto nla_put_failure;
187	NLA_PUT_STRING(skb, CTA_HELP_NAME, helper->name);	187	NLA_PUT_STRING(skb, CTA_HELP_NAME, helper->name);
188		188
189	if (helper->to_nlattr)	189	if (helper->to_nlattr)
190	helper->to_nlattr(skb, ct);	190	helper->to_nlattr(skb, ct);
191		191
192	nla_nest_end(skb, nest_helper);	192	nla_nest_end(skb, nest_helper);
193	out:	193	out:
194	return 0;	194	return 0;
195		195
196	nla_put_failure:	196	nla_put_failure:
197	return -1;	197	return -1;
198	}	198	}
199		199
200	static int	200	static int
201	ctnetlink_dump_counters(struct sk_buff skb, const struct nf_conn ct,	201	ctnetlink_dump_counters(struct sk_buff skb, const struct nf_conn ct,
202	enum ip_conntrack_dir dir)	202	enum ip_conntrack_dir dir)
203	{	203	{
204	enum ctattr_type type = dir ? CTA_COUNTERS_REPLY: CTA_COUNTERS_ORIG;	204	enum ctattr_type type = dir ? CTA_COUNTERS_REPLY: CTA_COUNTERS_ORIG;
205	struct nlattr *nest_count;	205	struct nlattr *nest_count;
206	const struct nf_conn_counter *acct;	206	const struct nf_conn_counter *acct;
207		207
208	acct = nf_conn_acct_find(ct);	208	acct = nf_conn_acct_find(ct);
209	if (!acct)	209	if (!acct)
210	return 0;	210	return 0;
211		211
212	nest_count = nla_nest_start(skb, type \| NLA_F_NESTED);	212	nest_count = nla_nest_start(skb, type \| NLA_F_NESTED);
213	if (!nest_count)	213	if (!nest_count)
214	goto nla_put_failure;	214	goto nla_put_failure;
215		215
216	NLA_PUT_BE64(skb, CTA_COUNTERS_PACKETS,	216	NLA_PUT_BE64(skb, CTA_COUNTERS_PACKETS,
217	cpu_to_be64(acct[dir].packets));	217	cpu_to_be64(acct[dir].packets));
218	NLA_PUT_BE64(skb, CTA_COUNTERS_BYTES,	218	NLA_PUT_BE64(skb, CTA_COUNTERS_BYTES,
219	cpu_to_be64(acct[dir].bytes));	219	cpu_to_be64(acct[dir].bytes));
220		220
221	nla_nest_end(skb, nest_count);	221	nla_nest_end(skb, nest_count);
222		222
223	return 0;	223	return 0;
224		224
225	nla_put_failure:	225	nla_put_failure:
226	return -1;	226	return -1;
227	}	227	}
228		228
229	#ifdef CONFIG_NF_CONNTRACK_MARK	229	#ifdef CONFIG_NF_CONNTRACK_MARK
230	static inline int	230	static inline int
231	ctnetlink_dump_mark(struct sk_buff skb, const struct nf_conn ct)	231	ctnetlink_dump_mark(struct sk_buff skb, const struct nf_conn ct)
232	{	232	{
233	NLA_PUT_BE32(skb, CTA_MARK, htonl(ct->mark));	233	NLA_PUT_BE32(skb, CTA_MARK, htonl(ct->mark));
234	return 0;	234	return 0;
235		235
236	nla_put_failure:	236	nla_put_failure:
237	return -1;	237	return -1;
238	}	238	}
239	#else	239	#else
240	#define ctnetlink_dump_mark(a, b) (0)	240	#define ctnetlink_dump_mark(a, b) (0)
241	#endif	241	#endif
242		242
243	#ifdef CONFIG_NF_CONNTRACK_SECMARK	243	#ifdef CONFIG_NF_CONNTRACK_SECMARK
244	static inline int	244	static inline int
245	ctnetlink_dump_secmark(struct sk_buff skb, const struct nf_conn ct)	245	ctnetlink_dump_secmark(struct sk_buff skb, const struct nf_conn ct)
246	{	246	{
247	NLA_PUT_BE32(skb, CTA_SECMARK, htonl(ct->secmark));	247	NLA_PUT_BE32(skb, CTA_SECMARK, htonl(ct->secmark));
248	return 0;	248	return 0;
249		249
250	nla_put_failure:	250	nla_put_failure:
251	return -1;	251	return -1;
252	}	252	}
253	#else	253	#else
254	#define ctnetlink_dump_secmark(a, b) (0)	254	#define ctnetlink_dump_secmark(a, b) (0)
255	#endif	255	#endif
256		256
257	#define master_tuple(ct) &(ct->master->tuplehash[IP_CT_DIR_ORIGINAL].tuple)	257	#define master_tuple(ct) &(ct->master->tuplehash[IP_CT_DIR_ORIGINAL].tuple)
258		258
259	static inline int	259	static inline int
260	ctnetlink_dump_master(struct sk_buff skb, const struct nf_conn ct)	260	ctnetlink_dump_master(struct sk_buff skb, const struct nf_conn ct)
261	{	261	{
262	struct nlattr *nest_parms;	262	struct nlattr *nest_parms;
263		263
264	if (!(ct->status & IPS_EXPECTED))	264	if (!(ct->status & IPS_EXPECTED))
265	return 0;	265	return 0;
266		266
267	nest_parms = nla_nest_start(skb, CTA_TUPLE_MASTER \| NLA_F_NESTED);	267	nest_parms = nla_nest_start(skb, CTA_TUPLE_MASTER \| NLA_F_NESTED);
268	if (!nest_parms)	268	if (!nest_parms)
269	goto nla_put_failure;	269	goto nla_put_failure;
270	if (ctnetlink_dump_tuples(skb, master_tuple(ct)) < 0)	270	if (ctnetlink_dump_tuples(skb, master_tuple(ct)) < 0)
271	goto nla_put_failure;	271	goto nla_put_failure;
272	nla_nest_end(skb, nest_parms);	272	nla_nest_end(skb, nest_parms);
273		273
274	return 0;	274	return 0;
275		275
276	nla_put_failure:	276	nla_put_failure:
277	return -1;	277	return -1;
278	}	278	}
279		279
280	#ifdef CONFIG_NF_NAT_NEEDED	280	#ifdef CONFIG_NF_NAT_NEEDED
281	static int	281	static int
282	dump_nat_seq_adj(struct sk_buff skb, const struct nf_nat_seq natseq, int type)	282	dump_nat_seq_adj(struct sk_buff skb, const struct nf_nat_seq natseq, int type)
283	{	283	{
284	struct nlattr *nest_parms;	284	struct nlattr *nest_parms;
285		285
286	nest_parms = nla_nest_start(skb, type \| NLA_F_NESTED);	286	nest_parms = nla_nest_start(skb, type \| NLA_F_NESTED);
287	if (!nest_parms)	287	if (!nest_parms)
288	goto nla_put_failure;	288	goto nla_put_failure;
289		289
290	NLA_PUT_BE32(skb, CTA_NAT_SEQ_CORRECTION_POS,	290	NLA_PUT_BE32(skb, CTA_NAT_SEQ_CORRECTION_POS,
291	htonl(natseq->correction_pos));	291	htonl(natseq->correction_pos));
292	NLA_PUT_BE32(skb, CTA_NAT_SEQ_OFFSET_BEFORE,	292	NLA_PUT_BE32(skb, CTA_NAT_SEQ_OFFSET_BEFORE,
293	htonl(natseq->offset_before));	293	htonl(natseq->offset_before));
294	NLA_PUT_BE32(skb, CTA_NAT_SEQ_OFFSET_AFTER,	294	NLA_PUT_BE32(skb, CTA_NAT_SEQ_OFFSET_AFTER,
295	htonl(natseq->offset_after));	295	htonl(natseq->offset_after));
296		296
297	nla_nest_end(skb, nest_parms);	297	nla_nest_end(skb, nest_parms);
298		298
299	return 0;	299	return 0;
300		300
301	nla_put_failure:	301	nla_put_failure:
302	return -1;	302	return -1;
303	}	303	}
304		304
305	static inline int	305	static inline int
306	ctnetlink_dump_nat_seq_adj(struct sk_buff skb, const struct nf_conn ct)	306	ctnetlink_dump_nat_seq_adj(struct sk_buff skb, const struct nf_conn ct)
307	{	307	{
308	struct nf_nat_seq *natseq;	308	struct nf_nat_seq *natseq;
309	struct nf_conn_nat *nat = nfct_nat(ct);	309	struct nf_conn_nat *nat = nfct_nat(ct);
310		310
311	if (!(ct->status & IPS_SEQ_ADJUST) \|\| !nat)	311	if (!(ct->status & IPS_SEQ_ADJUST) \|\| !nat)
312	return 0;	312	return 0;
313		313
314	natseq = &nat->seq[IP_CT_DIR_ORIGINAL];	314	natseq = &nat->seq[IP_CT_DIR_ORIGINAL];
315	if (dump_nat_seq_adj(skb, natseq, CTA_NAT_SEQ_ADJ_ORIG) == -1)	315	if (dump_nat_seq_adj(skb, natseq, CTA_NAT_SEQ_ADJ_ORIG) == -1)
316	return -1;	316	return -1;
317		317
318	natseq = &nat->seq[IP_CT_DIR_REPLY];	318	natseq = &nat->seq[IP_CT_DIR_REPLY];
319	if (dump_nat_seq_adj(skb, natseq, CTA_NAT_SEQ_ADJ_REPLY) == -1)	319	if (dump_nat_seq_adj(skb, natseq, CTA_NAT_SEQ_ADJ_REPLY) == -1)
320	return -1;	320	return -1;
321		321
322	return 0;	322	return 0;
323	}	323	}
324	#else	324	#else
325	#define ctnetlink_dump_nat_seq_adj(a, b) (0)	325	#define ctnetlink_dump_nat_seq_adj(a, b) (0)
326	#endif	326	#endif
327		327
328	static inline int	328	static inline int
329	ctnetlink_dump_id(struct sk_buff skb, const struct nf_conn ct)	329	ctnetlink_dump_id(struct sk_buff skb, const struct nf_conn ct)
330	{	330	{
331	NLA_PUT_BE32(skb, CTA_ID, htonl((unsigned long)ct));	331	NLA_PUT_BE32(skb, CTA_ID, htonl((unsigned long)ct));
332	return 0;	332	return 0;
333		333
334	nla_put_failure:	334	nla_put_failure:
335	return -1;	335	return -1;
336	}	336	}
337		337
338	static inline int	338	static inline int
339	ctnetlink_dump_use(struct sk_buff skb, const struct nf_conn ct)	339	ctnetlink_dump_use(struct sk_buff skb, const struct nf_conn ct)
340	{	340	{
341	NLA_PUT_BE32(skb, CTA_USE, htonl(atomic_read(&ct->ct_general.use)));	341	NLA_PUT_BE32(skb, CTA_USE, htonl(atomic_read(&ct->ct_general.use)));
342	return 0;	342	return 0;
343		343
344	nla_put_failure:	344	nla_put_failure:
345	return -1;	345	return -1;
346	}	346	}
347		347
348	static int	348	static int
349	ctnetlink_fill_info(struct sk_buff *skb, u32 pid, u32 seq,	349	ctnetlink_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
350	int event, const struct nf_conn *ct)	350	int event, struct nf_conn *ct)
351	{	351	{
352	struct nlmsghdr *nlh;	352	struct nlmsghdr *nlh;
353	struct nfgenmsg *nfmsg;	353	struct nfgenmsg *nfmsg;
354	struct nlattr *nest_parms;	354	struct nlattr *nest_parms;
355	unsigned int flags = pid ? NLM_F_MULTI : 0;	355	unsigned int flags = pid ? NLM_F_MULTI : 0;
356		356
357	event \|= NFNL_SUBSYS_CTNETLINK << 8;	357	event \|= NFNL_SUBSYS_CTNETLINK << 8;
358	nlh = nlmsg_put(skb, pid, seq, event, sizeof(*nfmsg), flags);	358	nlh = nlmsg_put(skb, pid, seq, event, sizeof(*nfmsg), flags);
359	if (nlh == NULL)	359	if (nlh == NULL)
360	goto nlmsg_failure;	360	goto nlmsg_failure;
361		361
362	nfmsg = nlmsg_data(nlh);	362	nfmsg = nlmsg_data(nlh);
363	nfmsg->nfgen_family = nf_ct_l3num(ct);	363	nfmsg->nfgen_family = nf_ct_l3num(ct);
364	nfmsg->version = NFNETLINK_V0;	364	nfmsg->version = NFNETLINK_V0;
365	nfmsg->res_id = 0;	365	nfmsg->res_id = 0;
366		366
367	nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG \| NLA_F_NESTED);	367	nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG \| NLA_F_NESTED);
368	if (!nest_parms)	368	if (!nest_parms)
369	goto nla_put_failure;	369	goto nla_put_failure;
370	if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)	370	if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)
371	goto nla_put_failure;	371	goto nla_put_failure;
372	nla_nest_end(skb, nest_parms);	372	nla_nest_end(skb, nest_parms);
373		373
374	nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY \| NLA_F_NESTED);	374	nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY \| NLA_F_NESTED);
375	if (!nest_parms)	375	if (!nest_parms)
376	goto nla_put_failure;	376	goto nla_put_failure;
377	if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_REPLY)) < 0)	377	if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_REPLY)) < 0)
378	goto nla_put_failure;	378	goto nla_put_failure;
379	nla_nest_end(skb, nest_parms);	379	nla_nest_end(skb, nest_parms);
380		380
381	if (ctnetlink_dump_status(skb, ct) < 0 \|\|	381	if (ctnetlink_dump_status(skb, ct) < 0 \|\|
382	ctnetlink_dump_timeout(skb, ct) < 0 \|\|	382	ctnetlink_dump_timeout(skb, ct) < 0 \|\|
383	ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 \|\|	383	ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 \|\|
384	ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0 \|\|	384	ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0 \|\|
385	ctnetlink_dump_protoinfo(skb, ct) < 0 \|\|	385	ctnetlink_dump_protoinfo(skb, ct) < 0 \|\|
386	ctnetlink_dump_helpinfo(skb, ct) < 0 \|\|	386	ctnetlink_dump_helpinfo(skb, ct) < 0 \|\|
387	ctnetlink_dump_mark(skb, ct) < 0 \|\|	387	ctnetlink_dump_mark(skb, ct) < 0 \|\|
388	ctnetlink_dump_secmark(skb, ct) < 0 \|\|	388	ctnetlink_dump_secmark(skb, ct) < 0 \|\|
389	ctnetlink_dump_id(skb, ct) < 0 \|\|	389	ctnetlink_dump_id(skb, ct) < 0 \|\|
390	ctnetlink_dump_use(skb, ct) < 0 \|\|	390	ctnetlink_dump_use(skb, ct) < 0 \|\|
391	ctnetlink_dump_master(skb, ct) < 0 \|\|	391	ctnetlink_dump_master(skb, ct) < 0 \|\|
392	ctnetlink_dump_nat_seq_adj(skb, ct) < 0)	392	ctnetlink_dump_nat_seq_adj(skb, ct) < 0)
393	goto nla_put_failure;	393	goto nla_put_failure;
394		394
395	nlmsg_end(skb, nlh);	395	nlmsg_end(skb, nlh);
396	return skb->len;	396	return skb->len;
397		397
398	nlmsg_failure:	398	nlmsg_failure:
399	nla_put_failure:	399	nla_put_failure:
400	nlmsg_cancel(skb, nlh);	400	nlmsg_cancel(skb, nlh);
401	return -1;	401	return -1;
402	}	402	}
403		403
404	#ifdef CONFIG_NF_CONNTRACK_EVENTS	404	#ifdef CONFIG_NF_CONNTRACK_EVENTS
405	static inline size_t	405	static inline size_t
406	ctnetlink_proto_size(const struct nf_conn *ct)	406	ctnetlink_proto_size(const struct nf_conn *ct)
407	{	407	{
408	struct nf_conntrack_l3proto *l3proto;	408	struct nf_conntrack_l3proto *l3proto;
409	struct nf_conntrack_l4proto *l4proto;	409	struct nf_conntrack_l4proto *l4proto;
410	size_t len = 0;	410	size_t len = 0;
411		411
412	rcu_read_lock();	412	rcu_read_lock();
413	l3proto = __nf_ct_l3proto_find(nf_ct_l3num(ct));	413	l3proto = __nf_ct_l3proto_find(nf_ct_l3num(ct));
414	len += l3proto->nla_size;	414	len += l3proto->nla_size;
415		415
416	l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));	416	l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
417	len += l4proto->nla_size;	417	len += l4proto->nla_size;
418	rcu_read_unlock();	418	rcu_read_unlock();
419		419
420	return len;	420	return len;
421	}	421	}
422		422
423	static inline size_t	423	static inline size_t
424	ctnetlink_nlmsg_size(const struct nf_conn *ct)	424	ctnetlink_nlmsg_size(const struct nf_conn *ct)
425	{	425	{
426	return NLMSG_ALIGN(sizeof(struct nfgenmsg))	426	return NLMSG_ALIGN(sizeof(struct nfgenmsg))
427	+ 3 * nla_total_size(0) /* CTA_TUPLE_ORIG\|REPL\|MASTER */	427	+ 3 * nla_total_size(0) /* CTA_TUPLE_ORIG\|REPL\|MASTER */
428	+ 3 * nla_total_size(0) /* CTA_TUPLE_IP */	428	+ 3 * nla_total_size(0) /* CTA_TUPLE_IP */
429	+ 3 * nla_total_size(0) /* CTA_TUPLE_PROTO */	429	+ 3 * nla_total_size(0) /* CTA_TUPLE_PROTO */
430	+ 3 * nla_total_size(sizeof(u_int8_t)) /* CTA_PROTO_NUM */	430	+ 3 * nla_total_size(sizeof(u_int8_t)) /* CTA_PROTO_NUM */
431	+ nla_total_size(sizeof(u_int32_t)) /* CTA_ID */	431	+ nla_total_size(sizeof(u_int32_t)) /* CTA_ID */
432	+ nla_total_size(sizeof(u_int32_t)) /* CTA_STATUS */	432	+ nla_total_size(sizeof(u_int32_t)) /* CTA_STATUS */
433	#ifdef CONFIG_NF_CT_ACCT	433	#ifdef CONFIG_NF_CT_ACCT
434	+ 2 * nla_total_size(0) /* CTA_COUNTERS_ORIG\|REPL */	434	+ 2 * nla_total_size(0) /* CTA_COUNTERS_ORIG\|REPL */
435	+ 2 * nla_total_size(sizeof(uint64_t)) /* CTA_COUNTERS_PACKETS */	435	+ 2 * nla_total_size(sizeof(uint64_t)) /* CTA_COUNTERS_PACKETS */
436	+ 2 * nla_total_size(sizeof(uint64_t)) /* CTA_COUNTERS_BYTES */	436	+ 2 * nla_total_size(sizeof(uint64_t)) /* CTA_COUNTERS_BYTES */
437	#endif	437	#endif
438	+ nla_total_size(sizeof(u_int32_t)) /* CTA_TIMEOUT */	438	+ nla_total_size(sizeof(u_int32_t)) /* CTA_TIMEOUT */
439	+ nla_total_size(0) /* CTA_PROTOINFO */	439	+ nla_total_size(0) /* CTA_PROTOINFO */
440	+ nla_total_size(0) /* CTA_HELP */	440	+ nla_total_size(0) /* CTA_HELP */
441	+ nla_total_size(NF_CT_HELPER_NAME_LEN) /* CTA_HELP_NAME */	441	+ nla_total_size(NF_CT_HELPER_NAME_LEN) /* CTA_HELP_NAME */
442	#ifdef CONFIG_NF_CONNTRACK_SECMARK	442	#ifdef CONFIG_NF_CONNTRACK_SECMARK
443	+ nla_total_size(sizeof(u_int32_t)) /* CTA_SECMARK */	443	+ nla_total_size(sizeof(u_int32_t)) /* CTA_SECMARK */
444	#endif	444	#endif
445	#ifdef CONFIG_NF_NAT_NEEDED	445	#ifdef CONFIG_NF_NAT_NEEDED
446	+ 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG\|REPL */	446	+ 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG\|REPL */
447	+ 6 * nla_total_size(sizeof(u_int32_t)) /* CTA_NAT_SEQ_OFFSET */	447	+ 6 * nla_total_size(sizeof(u_int32_t)) /* CTA_NAT_SEQ_OFFSET */
448	#endif	448	#endif
449	#ifdef CONFIG_NF_CONNTRACK_MARK	449	#ifdef CONFIG_NF_CONNTRACK_MARK
450	+ nla_total_size(sizeof(u_int32_t)) /* CTA_MARK */	450	+ nla_total_size(sizeof(u_int32_t)) /* CTA_MARK */
451	#endif	451	#endif
452	+ ctnetlink_proto_size(ct)	452	+ ctnetlink_proto_size(ct)
453	;	453	;
454	}	454	}
455		455
456	static int	456	static int
457	ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item)	457	ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item)
458	{	458	{
459	struct nlmsghdr *nlh;	459	struct nlmsghdr *nlh;
460	struct nfgenmsg *nfmsg;	460	struct nfgenmsg *nfmsg;
461	struct nlattr *nest_parms;	461	struct nlattr *nest_parms;
462	struct nf_conn *ct = item->ct;	462	struct nf_conn *ct = item->ct;
463	struct sk_buff *skb;	463	struct sk_buff *skb;
464	unsigned int type;	464	unsigned int type;
465	unsigned int flags = 0, group;	465	unsigned int flags = 0, group;
466		466
467	/* ignore our fake conntrack entry */	467	/* ignore our fake conntrack entry */
468	if (ct == &nf_conntrack_untracked)	468	if (ct == &nf_conntrack_untracked)
469	return 0;	469	return 0;
470		470
471	if (events & IPCT_DESTROY) {	471	if (events & IPCT_DESTROY) {
472	type = IPCTNL_MSG_CT_DELETE;	472	type = IPCTNL_MSG_CT_DELETE;
473	group = NFNLGRP_CONNTRACK_DESTROY;	473	group = NFNLGRP_CONNTRACK_DESTROY;
474	} else if (events & (IPCT_NEW \| IPCT_RELATED)) {	474	} else if (events & (IPCT_NEW \| IPCT_RELATED)) {
475	type = IPCTNL_MSG_CT_NEW;	475	type = IPCTNL_MSG_CT_NEW;
476	flags = NLM_F_CREATE\|NLM_F_EXCL;	476	flags = NLM_F_CREATE\|NLM_F_EXCL;
477	group = NFNLGRP_CONNTRACK_NEW;	477	group = NFNLGRP_CONNTRACK_NEW;
478	} else if (events) {	478	} else if (events) {
479	type = IPCTNL_MSG_CT_NEW;	479	type = IPCTNL_MSG_CT_NEW;
480	group = NFNLGRP_CONNTRACK_UPDATE;	480	group = NFNLGRP_CONNTRACK_UPDATE;
481	} else	481	} else
482	return 0;	482	return 0;
483		483
484	if (!item->report && !nfnetlink_has_listeners(group))	484	if (!item->report && !nfnetlink_has_listeners(group))
485	return 0;	485	return 0;
486		486
487	skb = nlmsg_new(ctnetlink_nlmsg_size(ct), GFP_ATOMIC);	487	skb = nlmsg_new(ctnetlink_nlmsg_size(ct), GFP_ATOMIC);
488	if (skb == NULL)	488	if (skb == NULL)
489	goto errout;	489	goto errout;
490		490
491	type \|= NFNL_SUBSYS_CTNETLINK << 8;	491	type \|= NFNL_SUBSYS_CTNETLINK << 8;
492	nlh = nlmsg_put(skb, item->pid, 0, type, sizeof(*nfmsg), flags);	492	nlh = nlmsg_put(skb, item->pid, 0, type, sizeof(*nfmsg), flags);
493	if (nlh == NULL)	493	if (nlh == NULL)
494	goto nlmsg_failure;	494	goto nlmsg_failure;
495		495
496	nfmsg = nlmsg_data(nlh);	496	nfmsg = nlmsg_data(nlh);
497	nfmsg->nfgen_family = nf_ct_l3num(ct);	497	nfmsg->nfgen_family = nf_ct_l3num(ct);
498	nfmsg->version = NFNETLINK_V0;	498	nfmsg->version = NFNETLINK_V0;
499	nfmsg->res_id = 0;	499	nfmsg->res_id = 0;
500		500
501	rcu_read_lock();	501	rcu_read_lock();
502	nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG \| NLA_F_NESTED);	502	nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG \| NLA_F_NESTED);
503	if (!nest_parms)	503	if (!nest_parms)
504	goto nla_put_failure;	504	goto nla_put_failure;
505	if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)	505	if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)
506	goto nla_put_failure;	506	goto nla_put_failure;
507	nla_nest_end(skb, nest_parms);	507	nla_nest_end(skb, nest_parms);
508		508
509	nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY \| NLA_F_NESTED);	509	nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY \| NLA_F_NESTED);
510	if (!nest_parms)	510	if (!nest_parms)
511	goto nla_put_failure;	511	goto nla_put_failure;
512	if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_REPLY)) < 0)	512	if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_REPLY)) < 0)
513	goto nla_put_failure;	513	goto nla_put_failure;
514	nla_nest_end(skb, nest_parms);	514	nla_nest_end(skb, nest_parms);
515		515
516	if (ctnetlink_dump_id(skb, ct) < 0)	516	if (ctnetlink_dump_id(skb, ct) < 0)
517	goto nla_put_failure;	517	goto nla_put_failure;
518		518
519	if (ctnetlink_dump_status(skb, ct) < 0)	519	if (ctnetlink_dump_status(skb, ct) < 0)
520	goto nla_put_failure;	520	goto nla_put_failure;
521		521
522	if (events & IPCT_DESTROY) {	522	if (events & IPCT_DESTROY) {
523	if (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 \|\|	523	if (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 \|\|
524	ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0)	524	ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0)
525	goto nla_put_failure;	525	goto nla_put_failure;
526	} else {	526	} else {
527	if (ctnetlink_dump_timeout(skb, ct) < 0)	527	if (ctnetlink_dump_timeout(skb, ct) < 0)
528	goto nla_put_failure;	528	goto nla_put_failure;
529		529
530	if (events & IPCT_PROTOINFO	530	if (events & IPCT_PROTOINFO
531	&& ctnetlink_dump_protoinfo(skb, ct) < 0)	531	&& ctnetlink_dump_protoinfo(skb, ct) < 0)
532	goto nla_put_failure;	532	goto nla_put_failure;
533		533
534	if ((events & IPCT_HELPER \|\| nfct_help(ct))	534	if ((events & IPCT_HELPER \|\| nfct_help(ct))
535	&& ctnetlink_dump_helpinfo(skb, ct) < 0)	535	&& ctnetlink_dump_helpinfo(skb, ct) < 0)
536	goto nla_put_failure;	536	goto nla_put_failure;
537		537
538	#ifdef CONFIG_NF_CONNTRACK_SECMARK	538	#ifdef CONFIG_NF_CONNTRACK_SECMARK
539	if ((events & IPCT_SECMARK \|\| ct->secmark)	539	if ((events & IPCT_SECMARK \|\| ct->secmark)
540	&& ctnetlink_dump_secmark(skb, ct) < 0)	540	&& ctnetlink_dump_secmark(skb, ct) < 0)
541	goto nla_put_failure;	541	goto nla_put_failure;
542	#endif	542	#endif
543		543
544	if (events & IPCT_RELATED &&	544	if (events & IPCT_RELATED &&
545	ctnetlink_dump_master(skb, ct) < 0)	545	ctnetlink_dump_master(skb, ct) < 0)
546	goto nla_put_failure;	546	goto nla_put_failure;
547		547
548	if (events & IPCT_NATSEQADJ &&	548	if (events & IPCT_NATSEQADJ &&
549	ctnetlink_dump_nat_seq_adj(skb, ct) < 0)	549	ctnetlink_dump_nat_seq_adj(skb, ct) < 0)
550	goto nla_put_failure;	550	goto nla_put_failure;
551	}	551	}
552		552
553	#ifdef CONFIG_NF_CONNTRACK_MARK	553	#ifdef CONFIG_NF_CONNTRACK_MARK
554	if ((events & IPCT_MARK \|\| ct->mark)	554	if ((events & IPCT_MARK \|\| ct->mark)
555	&& ctnetlink_dump_mark(skb, ct) < 0)	555	&& ctnetlink_dump_mark(skb, ct) < 0)
556	goto nla_put_failure;	556	goto nla_put_failure;
557	#endif	557	#endif
558	rcu_read_unlock();	558	rcu_read_unlock();
559		559
560	nlmsg_end(skb, nlh);	560	nlmsg_end(skb, nlh);
561	nfnetlink_send(skb, item->pid, group, item->report, GFP_ATOMIC);	561	nfnetlink_send(skb, item->pid, group, item->report, GFP_ATOMIC);
562	return 0;	562	return 0;
563		563
564	nla_put_failure:	564	nla_put_failure:
565	rcu_read_unlock();	565	rcu_read_unlock();
566	nlmsg_cancel(skb, nlh);	566	nlmsg_cancel(skb, nlh);
567	nlmsg_failure:	567	nlmsg_failure:
568	kfree_skb(skb);	568	kfree_skb(skb);
569	errout:	569	errout:
570	nfnetlink_set_err(0, group, -ENOBUFS);	570	nfnetlink_set_err(0, group, -ENOBUFS);
571	return 0;	571	return 0;
572	}	572	}
573	#endif /* CONFIG_NF_CONNTRACK_EVENTS */	573	#endif /* CONFIG_NF_CONNTRACK_EVENTS */
574		574
575	static int ctnetlink_done(struct netlink_callback *cb)	575	static int ctnetlink_done(struct netlink_callback *cb)
576	{	576	{
577	if (cb->args[1])	577	if (cb->args[1])
578	nf_ct_put((struct nf_conn *)cb->args[1]);	578	nf_ct_put((struct nf_conn *)cb->args[1]);
579	return 0;	579	return 0;
580	}	580	}
581		581
582	static int	582	static int
583	ctnetlink_dump_table(struct sk_buff skb, struct netlink_callback cb)	583	ctnetlink_dump_table(struct sk_buff skb, struct netlink_callback cb)
584	{	584	{
585	struct nf_conn ct, last;	585	struct nf_conn ct, last;
586	struct nf_conntrack_tuple_hash *h;	586	struct nf_conntrack_tuple_hash *h;
587	struct hlist_nulls_node *n;	587	struct hlist_nulls_node *n;
588	struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);	588	struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
589	u_int8_t l3proto = nfmsg->nfgen_family;	589	u_int8_t l3proto = nfmsg->nfgen_family;
590		590
591	rcu_read_lock();	591	rcu_read_lock();
592	last = (struct nf_conn *)cb->args[1];	592	last = (struct nf_conn *)cb->args[1];
593	for (; cb->args[0] < nf_conntrack_htable_size; cb->args[0]++) {	593	for (; cb->args[0] < nf_conntrack_htable_size; cb->args[0]++) {
594	restart:	594	restart:
595	hlist_nulls_for_each_entry_rcu(h, n, &init_net.ct.hash[cb->args[0]],	595	hlist_nulls_for_each_entry_rcu(h, n, &init_net.ct.hash[cb->args[0]],
596	hnnode) {	596	hnnode) {
597	if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)	597	if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)
598	continue;	598	continue;
599	ct = nf_ct_tuplehash_to_ctrack(h);	599	ct = nf_ct_tuplehash_to_ctrack(h);
600	if (!atomic_inc_not_zero(&ct->ct_general.use))	600	if (!atomic_inc_not_zero(&ct->ct_general.use))
601	continue;	601	continue;
602	/* Dump entries of a given L3 protocol number.	602	/* Dump entries of a given L3 protocol number.
603	* If it is not specified, ie. l3proto == 0,	603	* If it is not specified, ie. l3proto == 0,
604	* then dump everything. */	604	* then dump everything. */
605	if (l3proto && nf_ct_l3num(ct) != l3proto)	605	if (l3proto && nf_ct_l3num(ct) != l3proto)
606	goto releasect;	606	goto releasect;
607	if (cb->args[1]) {	607	if (cb->args[1]) {
608	if (ct != last)	608	if (ct != last)
609	goto releasect;	609	goto releasect;
610	cb->args[1] = 0;	610	cb->args[1] = 0;
611	}	611	}
612	if (ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).pid,	612	if (ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).pid,
613	cb->nlh->nlmsg_seq,	613	cb->nlh->nlmsg_seq,
614	IPCTNL_MSG_CT_NEW, ct) < 0) {	614	IPCTNL_MSG_CT_NEW, ct) < 0) {
615	cb->args[1] = (unsigned long)ct;	615	cb->args[1] = (unsigned long)ct;
616	goto out;	616	goto out;
617	}	617	}
618		618
619	if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) ==	619	if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) ==
620	IPCTNL_MSG_CT_GET_CTRZERO) {	620	IPCTNL_MSG_CT_GET_CTRZERO) {
621	struct nf_conn_counter *acct;	621	struct nf_conn_counter *acct;
622		622
623	acct = nf_conn_acct_find(ct);	623	acct = nf_conn_acct_find(ct);
624	if (acct)	624	if (acct)
625	memset(acct, 0, sizeof(struct nf_conn_counter[IP_CT_DIR_MAX]));	625	memset(acct, 0, sizeof(struct nf_conn_counter[IP_CT_DIR_MAX]));
626	}	626	}
627	releasect:	627	releasect:
628	nf_ct_put(ct);	628	nf_ct_put(ct);
629	}	629	}
630	if (cb->args[1]) {	630	if (cb->args[1]) {
631	cb->args[1] = 0;	631	cb->args[1] = 0;
632	goto restart;	632	goto restart;
633	}	633	}
634	}	634	}
635	out:	635	out:
636	rcu_read_unlock();	636	rcu_read_unlock();
637	if (last)	637	if (last)
638	nf_ct_put(last);	638	nf_ct_put(last);
639		639
640	return skb->len;	640	return skb->len;
641	}	641	}
642		642
643	static inline int	643	static inline int
644	ctnetlink_parse_tuple_ip(struct nlattr attr, struct nf_conntrack_tuple tuple)	644	ctnetlink_parse_tuple_ip(struct nlattr attr, struct nf_conntrack_tuple tuple)
645	{	645	{
646	struct nlattr *tb[CTA_IP_MAX+1];	646	struct nlattr *tb[CTA_IP_MAX+1];
647	struct nf_conntrack_l3proto *l3proto;	647	struct nf_conntrack_l3proto *l3proto;
648	int ret = 0;	648	int ret = 0;
649		649
650	nla_parse_nested(tb, CTA_IP_MAX, attr, NULL);	650	nla_parse_nested(tb, CTA_IP_MAX, attr, NULL);
651		651
652	rcu_read_lock();	652	rcu_read_lock();
653	l3proto = __nf_ct_l3proto_find(tuple->src.l3num);	653	l3proto = __nf_ct_l3proto_find(tuple->src.l3num);
654		654
655	if (likely(l3proto->nlattr_to_tuple)) {	655	if (likely(l3proto->nlattr_to_tuple)) {
656	ret = nla_validate_nested(attr, CTA_IP_MAX,	656	ret = nla_validate_nested(attr, CTA_IP_MAX,
657	l3proto->nla_policy);	657	l3proto->nla_policy);
658	if (ret == 0)	658	if (ret == 0)
659	ret = l3proto->nlattr_to_tuple(tb, tuple);	659	ret = l3proto->nlattr_to_tuple(tb, tuple);
660	}	660	}
661		661
662	rcu_read_unlock();	662	rcu_read_unlock();
663		663
664	return ret;	664	return ret;
665	}	665	}
666		666
667	static const struct nla_policy proto_nla_policy[CTA_PROTO_MAX+1] = {	667	static const struct nla_policy proto_nla_policy[CTA_PROTO_MAX+1] = {
668	[CTA_PROTO_NUM] = { .type = NLA_U8 },	668	[CTA_PROTO_NUM] = { .type = NLA_U8 },
669	};	669	};
670		670
671	static inline int	671	static inline int
672	ctnetlink_parse_tuple_proto(struct nlattr *attr,	672	ctnetlink_parse_tuple_proto(struct nlattr *attr,
673	struct nf_conntrack_tuple *tuple)	673	struct nf_conntrack_tuple *tuple)
674	{	674	{
675	struct nlattr *tb[CTA_PROTO_MAX+1];	675	struct nlattr *tb[CTA_PROTO_MAX+1];
676	struct nf_conntrack_l4proto *l4proto;	676	struct nf_conntrack_l4proto *l4proto;
677	int ret = 0;	677	int ret = 0;
678		678
679	ret = nla_parse_nested(tb, CTA_PROTO_MAX, attr, proto_nla_policy);	679	ret = nla_parse_nested(tb, CTA_PROTO_MAX, attr, proto_nla_policy);
680	if (ret < 0)	680	if (ret < 0)
681	return ret;	681	return ret;
682		682
683	if (!tb[CTA_PROTO_NUM])	683	if (!tb[CTA_PROTO_NUM])
684	return -EINVAL;	684	return -EINVAL;
685	tuple->dst.protonum = nla_get_u8(tb[CTA_PROTO_NUM]);	685	tuple->dst.protonum = nla_get_u8(tb[CTA_PROTO_NUM]);
686		686
687	rcu_read_lock();	687	rcu_read_lock();
688	l4proto = __nf_ct_l4proto_find(tuple->src.l3num, tuple->dst.protonum);	688	l4proto = __nf_ct_l4proto_find(tuple->src.l3num, tuple->dst.protonum);
689		689
690	if (likely(l4proto->nlattr_to_tuple)) {	690	if (likely(l4proto->nlattr_to_tuple)) {
691	ret = nla_validate_nested(attr, CTA_PROTO_MAX,	691	ret = nla_validate_nested(attr, CTA_PROTO_MAX,
692	l4proto->nla_policy);	692	l4proto->nla_policy);
693	if (ret == 0)	693	if (ret == 0)
694	ret = l4proto->nlattr_to_tuple(tb, tuple);	694	ret = l4proto->nlattr_to_tuple(tb, tuple);
695	}	695	}
696		696
697	rcu_read_unlock();	697	rcu_read_unlock();
698		698
699	return ret;	699	return ret;
700	}	700	}
701		701
702	static int	702	static int
703	ctnetlink_parse_tuple(struct nlattr cda[], struct nf_conntrack_tuple tuple,	703	ctnetlink_parse_tuple(struct nlattr cda[], struct nf_conntrack_tuple tuple,
704	enum ctattr_tuple type, u_int8_t l3num)	704	enum ctattr_tuple type, u_int8_t l3num)
705	{	705	{
706	struct nlattr *tb[CTA_TUPLE_MAX+1];	706	struct nlattr *tb[CTA_TUPLE_MAX+1];
707	int err;	707	int err;
708		708
709	memset(tuple, 0, sizeof(*tuple));	709	memset(tuple, 0, sizeof(*tuple));
710		710
711	nla_parse_nested(tb, CTA_TUPLE_MAX, cda[type], NULL);	711	nla_parse_nested(tb, CTA_TUPLE_MAX, cda[type], NULL);
712		712
713	if (!tb[CTA_TUPLE_IP])	713	if (!tb[CTA_TUPLE_IP])
714	return -EINVAL;	714	return -EINVAL;
715		715
716	tuple->src.l3num = l3num;	716	tuple->src.l3num = l3num;
717		717
718	err = ctnetlink_parse_tuple_ip(tb[CTA_TUPLE_IP], tuple);	718	err = ctnetlink_parse_tuple_ip(tb[CTA_TUPLE_IP], tuple);
719	if (err < 0)	719	if (err < 0)
720	return err;	720	return err;
721		721
722	if (!tb[CTA_TUPLE_PROTO])	722	if (!tb[CTA_TUPLE_PROTO])
723	return -EINVAL;	723	return -EINVAL;
724		724
725	err = ctnetlink_parse_tuple_proto(tb[CTA_TUPLE_PROTO], tuple);	725	err = ctnetlink_parse_tuple_proto(tb[CTA_TUPLE_PROTO], tuple);
726	if (err < 0)	726	if (err < 0)
727	return err;	727	return err;
728		728
729	/* orig and expect tuples get DIR_ORIGINAL */	729	/* orig and expect tuples get DIR_ORIGINAL */
730	if (type == CTA_TUPLE_REPLY)	730	if (type == CTA_TUPLE_REPLY)
731	tuple->dst.dir = IP_CT_DIR_REPLY;	731	tuple->dst.dir = IP_CT_DIR_REPLY;
732	else	732	else
733	tuple->dst.dir = IP_CT_DIR_ORIGINAL;	733	tuple->dst.dir = IP_CT_DIR_ORIGINAL;
734		734
735	return 0;	735	return 0;
736	}	736	}
737		737
738	static inline int	738	static inline int
739	ctnetlink_parse_help(struct nlattr attr, char *helper_name)	739	ctnetlink_parse_help(struct nlattr attr, char *helper_name)
740	{	740	{
741	struct nlattr *tb[CTA_HELP_MAX+1];	741	struct nlattr *tb[CTA_HELP_MAX+1];
742		742
743	nla_parse_nested(tb, CTA_HELP_MAX, attr, NULL);	743	nla_parse_nested(tb, CTA_HELP_MAX, attr, NULL);
744		744
745	if (!tb[CTA_HELP_NAME])	745	if (!tb[CTA_HELP_NAME])
746	return -EINVAL;	746	return -EINVAL;
747		747
748	*helper_name = nla_data(tb[CTA_HELP_NAME]);	748	*helper_name = nla_data(tb[CTA_HELP_NAME]);
749		749
750	return 0;	750	return 0;
751	}	751	}
752		752
753	static const struct nla_policy ct_nla_policy[CTA_MAX+1] = {	753	static const struct nla_policy ct_nla_policy[CTA_MAX+1] = {
754	[CTA_STATUS] = { .type = NLA_U32 },	754	[CTA_STATUS] = { .type = NLA_U32 },
755	[CTA_TIMEOUT] = { .type = NLA_U32 },	755	[CTA_TIMEOUT] = { .type = NLA_U32 },
756	[CTA_MARK] = { .type = NLA_U32 },	756	[CTA_MARK] = { .type = NLA_U32 },
757	[CTA_USE] = { .type = NLA_U32 },	757	[CTA_USE] = { .type = NLA_U32 },
758	[CTA_ID] = { .type = NLA_U32 },	758	[CTA_ID] = { .type = NLA_U32 },
759	};	759	};
760		760
761	static int	761	static int
762	ctnetlink_del_conntrack(struct sock ctnl, struct sk_buff skb,	762	ctnetlink_del_conntrack(struct sock ctnl, struct sk_buff skb,
763	struct nlmsghdr nlh, struct nlattr cda[])	763	struct nlmsghdr nlh, struct nlattr cda[])
764	{	764	{
765	struct nf_conntrack_tuple_hash *h;	765	struct nf_conntrack_tuple_hash *h;
766	struct nf_conntrack_tuple tuple;	766	struct nf_conntrack_tuple tuple;
767	struct nf_conn *ct;	767	struct nf_conn *ct;
768	struct nfgenmsg *nfmsg = nlmsg_data(nlh);	768	struct nfgenmsg *nfmsg = nlmsg_data(nlh);
769	u_int8_t u3 = nfmsg->nfgen_family;	769	u_int8_t u3 = nfmsg->nfgen_family;
770	int err = 0;	770	int err = 0;
771		771
772	if (cda[CTA_TUPLE_ORIG])	772	if (cda[CTA_TUPLE_ORIG])
773	err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, u3);	773	err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, u3);
774	else if (cda[CTA_TUPLE_REPLY])	774	else if (cda[CTA_TUPLE_REPLY])
775	err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, u3);	775	err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, u3);
776	else {	776	else {
777	/* Flush the whole table */	777	/* Flush the whole table */
778	nf_conntrack_flush_report(&init_net,	778	nf_conntrack_flush_report(&init_net,
779	NETLINK_CB(skb).pid,	779	NETLINK_CB(skb).pid,
780	nlmsg_report(nlh));	780	nlmsg_report(nlh));
781	return 0;	781	return 0;
782	}	782	}
783		783
784	if (err < 0)	784	if (err < 0)
785	return err;	785	return err;
786		786
787	h = nf_conntrack_find_get(&init_net, &tuple);	787	h = nf_conntrack_find_get(&init_net, &tuple);
788	if (!h)	788	if (!h)
789	return -ENOENT;	789	return -ENOENT;
790		790
791	ct = nf_ct_tuplehash_to_ctrack(h);	791	ct = nf_ct_tuplehash_to_ctrack(h);
792		792
793	if (cda[CTA_ID]) {	793	if (cda[CTA_ID]) {
794	u_int32_t id = ntohl(nla_get_be32(cda[CTA_ID]));	794	u_int32_t id = ntohl(nla_get_be32(cda[CTA_ID]));
795	if (id != (u32)(unsigned long)ct) {	795	if (id != (u32)(unsigned long)ct) {
796	nf_ct_put(ct);	796	nf_ct_put(ct);
797	return -ENOENT;	797	return -ENOENT;
798	}	798	}
799	}	799	}
800		800
801	nf_conntrack_event_report(IPCT_DESTROY,	801	nf_conntrack_event_report(IPCT_DESTROY,
802	ct,	802	ct,
803	NETLINK_CB(skb).pid,	803	NETLINK_CB(skb).pid,
804	nlmsg_report(nlh));	804	nlmsg_report(nlh));
805		805
806	/* death_by_timeout would report the event again */	806	/* death_by_timeout would report the event again */
807	set_bit(IPS_DYING_BIT, &ct->status);	807	set_bit(IPS_DYING_BIT, &ct->status);
808		808
809	nf_ct_kill(ct);	809	nf_ct_kill(ct);
810	nf_ct_put(ct);	810	nf_ct_put(ct);
811		811
812	return 0;	812	return 0;
813	}	813	}
814		814
815	static int	815	static int
816	ctnetlink_get_conntrack(struct sock ctnl, struct sk_buff skb,	816	ctnetlink_get_conntrack(struct sock ctnl, struct sk_buff skb,
817	struct nlmsghdr nlh, struct nlattr cda[])	817	struct nlmsghdr nlh, struct nlattr cda[])
818	{	818	{
819	struct nf_conntrack_tuple_hash *h;	819	struct nf_conntrack_tuple_hash *h;
820	struct nf_conntrack_tuple tuple;	820	struct nf_conntrack_tuple tuple;
821	struct nf_conn *ct;	821	struct nf_conn *ct;
822	struct sk_buff *skb2 = NULL;	822	struct sk_buff *skb2 = NULL;
823	struct nfgenmsg *nfmsg = nlmsg_data(nlh);	823	struct nfgenmsg *nfmsg = nlmsg_data(nlh);
824	u_int8_t u3 = nfmsg->nfgen_family;	824	u_int8_t u3 = nfmsg->nfgen_family;
825	int err = 0;	825	int err = 0;
826		826
827	if (nlh->nlmsg_flags & NLM_F_DUMP)	827	if (nlh->nlmsg_flags & NLM_F_DUMP)
828	return netlink_dump_start(ctnl, skb, nlh, ctnetlink_dump_table,	828	return netlink_dump_start(ctnl, skb, nlh, ctnetlink_dump_table,
829	ctnetlink_done);	829	ctnetlink_done);
830		830
831	if (cda[CTA_TUPLE_ORIG])	831	if (cda[CTA_TUPLE_ORIG])
832	err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, u3);	832	err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, u3);
833	else if (cda[CTA_TUPLE_REPLY])	833	else if (cda[CTA_TUPLE_REPLY])
834	err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, u3);	834	err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, u3);
835	else	835	else
836	return -EINVAL;	836	return -EINVAL;
837		837
838	if (err < 0)	838	if (err < 0)
839	return err;	839	return err;
840		840
841	h = nf_conntrack_find_get(&init_net, &tuple);	841	h = nf_conntrack_find_get(&init_net, &tuple);
842	if (!h)	842	if (!h)
843	return -ENOENT;	843	return -ENOENT;
844		844
845	ct = nf_ct_tuplehash_to_ctrack(h);	845	ct = nf_ct_tuplehash_to_ctrack(h);
846		846
847	err = -ENOMEM;	847	err = -ENOMEM;
848	skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);	848	skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
849	if (skb2 == NULL) {	849	if (skb2 == NULL) {
850	nf_ct_put(ct);	850	nf_ct_put(ct);
851	return -ENOMEM;	851	return -ENOMEM;
852	}	852	}
853		853
854	rcu_read_lock();	854	rcu_read_lock();
855	err = ctnetlink_fill_info(skb2, NETLINK_CB(skb).pid, nlh->nlmsg_seq,	855	err = ctnetlink_fill_info(skb2, NETLINK_CB(skb).pid, nlh->nlmsg_seq,
856	IPCTNL_MSG_CT_NEW, ct);	856	IPCTNL_MSG_CT_NEW, ct);
857	rcu_read_unlock();	857	rcu_read_unlock();
858	nf_ct_put(ct);	858	nf_ct_put(ct);
859	if (err <= 0)	859	if (err <= 0)
860	goto free;	860	goto free;
861		861
862	err = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);	862	err = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
863	if (err < 0)	863	if (err < 0)
864	goto out;	864	goto out;
865		865
866	return 0;	866	return 0;
867		867
868	free:	868	free:
869	kfree_skb(skb2);	869	kfree_skb(skb2);
870	out:	870	out:
871	return err;	871	return err;
872	}	872	}
873		873
874	#ifdef CONFIG_NF_NAT_NEEDED	874	#ifdef CONFIG_NF_NAT_NEEDED
875	static int	875	static int
876	ctnetlink_parse_nat_setup(struct nf_conn *ct,	876	ctnetlink_parse_nat_setup(struct nf_conn *ct,
877	enum nf_nat_manip_type manip,	877	enum nf_nat_manip_type manip,
878	struct nlattr *attr)	878	struct nlattr *attr)
879	{	879	{
880	typeof(nfnetlink_parse_nat_setup_hook) parse_nat_setup;	880	typeof(nfnetlink_parse_nat_setup_hook) parse_nat_setup;
881		881
882	parse_nat_setup = rcu_dereference(nfnetlink_parse_nat_setup_hook);	882	parse_nat_setup = rcu_dereference(nfnetlink_parse_nat_setup_hook);
883	if (!parse_nat_setup) {	883	if (!parse_nat_setup) {
884	#ifdef CONFIG_MODULES	884	#ifdef CONFIG_MODULES
885	rcu_read_unlock();	885	rcu_read_unlock();
886	spin_unlock_bh(&nf_conntrack_lock);	886	spin_unlock_bh(&nf_conntrack_lock);
887	nfnl_unlock();	887	nfnl_unlock();
888	if (request_module("nf-nat-ipv4") < 0) {	888	if (request_module("nf-nat-ipv4") < 0) {
889	nfnl_lock();	889	nfnl_lock();
890	spin_lock_bh(&nf_conntrack_lock);	890	spin_lock_bh(&nf_conntrack_lock);
891	rcu_read_lock();	891	rcu_read_lock();
892	return -EOPNOTSUPP;	892	return -EOPNOTSUPP;
893	}	893	}
894	nfnl_lock();	894	nfnl_lock();
895	spin_lock_bh(&nf_conntrack_lock);	895	spin_lock_bh(&nf_conntrack_lock);
896	rcu_read_lock();	896	rcu_read_lock();
897	if (nfnetlink_parse_nat_setup_hook)	897	if (nfnetlink_parse_nat_setup_hook)
898	return -EAGAIN;	898	return -EAGAIN;
899	#endif	899	#endif
900	return -EOPNOTSUPP;	900	return -EOPNOTSUPP;
901	}	901	}
902		902
903	return parse_nat_setup(ct, manip, attr);	903	return parse_nat_setup(ct, manip, attr);
904	}	904	}
905	#endif	905	#endif
906		906
907	static int	907	static int
908	ctnetlink_change_status(struct nf_conn ct, struct nlattr cda[])	908	ctnetlink_change_status(struct nf_conn ct, struct nlattr cda[])
909	{	909	{
910	unsigned long d;	910	unsigned long d;
911	unsigned int status = ntohl(nla_get_be32(cda[CTA_STATUS]));	911	unsigned int status = ntohl(nla_get_be32(cda[CTA_STATUS]));
912	d = ct->status ^ status;	912	d = ct->status ^ status;
913		913
914	if (d & (IPS_EXPECTED\|IPS_CONFIRMED\|IPS_DYING))	914	if (d & (IPS_EXPECTED\|IPS_CONFIRMED\|IPS_DYING))
915	/* unchangeable */	915	/* unchangeable */
916	return -EBUSY;	916	return -EBUSY;
917		917
918	if (d & IPS_SEEN_REPLY && !(status & IPS_SEEN_REPLY))	918	if (d & IPS_SEEN_REPLY && !(status & IPS_SEEN_REPLY))
919	/* SEEN_REPLY bit can only be set */	919	/* SEEN_REPLY bit can only be set */
920	return -EBUSY;	920	return -EBUSY;
921		921
922	if (d & IPS_ASSURED && !(status & IPS_ASSURED))	922	if (d & IPS_ASSURED && !(status & IPS_ASSURED))
923	/* ASSURED bit can only be set */	923	/* ASSURED bit can only be set */
924	return -EBUSY;	924	return -EBUSY;
925		925
926	/* Be careful here, modifying NAT bits can screw up things,	926	/* Be careful here, modifying NAT bits can screw up things,
927	* so don't let users modify them directly if they don't pass	927	* so don't let users modify them directly if they don't pass
928	* nf_nat_range. */	928	* nf_nat_range. */
929	ct->status \|= status & ~(IPS_NAT_DONE_MASK \| IPS_NAT_MASK);	929	ct->status \|= status & ~(IPS_NAT_DONE_MASK \| IPS_NAT_MASK);
930	return 0;	930	return 0;
931	}	931	}
932		932
933	static int	933	static int
934	ctnetlink_change_nat(struct nf_conn ct, struct nlattr cda[])	934	ctnetlink_change_nat(struct nf_conn ct, struct nlattr cda[])
935	{	935	{
936	#ifdef CONFIG_NF_NAT_NEEDED	936	#ifdef CONFIG_NF_NAT_NEEDED
937	int ret;	937	int ret;
938		938
939	if (cda[CTA_NAT_DST]) {	939	if (cda[CTA_NAT_DST]) {
940	ret = ctnetlink_parse_nat_setup(ct,	940	ret = ctnetlink_parse_nat_setup(ct,
941	IP_NAT_MANIP_DST,	941	IP_NAT_MANIP_DST,
942	cda[CTA_NAT_DST]);	942	cda[CTA_NAT_DST]);
943	if (ret < 0)	943	if (ret < 0)
944	return ret;	944	return ret;
945	}	945	}
946	if (cda[CTA_NAT_SRC]) {	946	if (cda[CTA_NAT_SRC]) {
947	ret = ctnetlink_parse_nat_setup(ct,	947	ret = ctnetlink_parse_nat_setup(ct,
948	IP_NAT_MANIP_SRC,	948	IP_NAT_MANIP_SRC,
949	cda[CTA_NAT_SRC]);	949	cda[CTA_NAT_SRC]);
950	if (ret < 0)	950	if (ret < 0)
951	return ret;	951	return ret;
952	}	952	}
953	return 0;	953	return 0;
954	#else	954	#else
955	return -EOPNOTSUPP;	955	return -EOPNOTSUPP;
956	#endif	956	#endif
957	}	957	}
958		958
959	static inline int	959	static inline int
960	ctnetlink_change_helper(struct nf_conn ct, struct nlattr cda[])	960	ctnetlink_change_helper(struct nf_conn ct, struct nlattr cda[])
961	{	961	{
962	struct nf_conntrack_helper *helper;	962	struct nf_conntrack_helper *helper;
963	struct nf_conn_help *help = nfct_help(ct);	963	struct nf_conn_help *help = nfct_help(ct);
964	char *helpname = NULL;	964	char *helpname = NULL;
965	int err;	965	int err;
966		966
967	/* don't change helper of sibling connections */	967	/* don't change helper of sibling connections */
968	if (ct->master)	968	if (ct->master)
969	return -EBUSY;	969	return -EBUSY;
970		970
971	err = ctnetlink_parse_help(cda[CTA_HELP], &helpname);	971	err = ctnetlink_parse_help(cda[CTA_HELP], &helpname);
972	if (err < 0)	972	if (err < 0)
973	return err;	973	return err;
974		974
975	if (!strcmp(helpname, "")) {	975	if (!strcmp(helpname, "")) {
976	if (help && help->helper) {	976	if (help && help->helper) {
977	/* we had a helper before ... */	977	/* we had a helper before ... */
978	nf_ct_remove_expectations(ct);	978	nf_ct_remove_expectations(ct);
979	rcu_assign_pointer(help->helper, NULL);	979	rcu_assign_pointer(help->helper, NULL);
980	}	980	}
981		981
982	return 0;	982	return 0;
983	}	983	}
984		984
985	helper = __nf_conntrack_helper_find_byname(helpname);	985	helper = __nf_conntrack_helper_find_byname(helpname);
986	if (helper == NULL) {	986	if (helper == NULL) {
987	#ifdef CONFIG_MODULES	987	#ifdef CONFIG_MODULES
988	spin_unlock_bh(&nf_conntrack_lock);	988	spin_unlock_bh(&nf_conntrack_lock);
989		989
990	if (request_module("nfct-helper-%s", helpname) < 0) {	990	if (request_module("nfct-helper-%s", helpname) < 0) {
991	spin_lock_bh(&nf_conntrack_lock);	991	spin_lock_bh(&nf_conntrack_lock);
992	return -EOPNOTSUPP;	992	return -EOPNOTSUPP;
993	}	993	}
994		994
995	spin_lock_bh(&nf_conntrack_lock);	995	spin_lock_bh(&nf_conntrack_lock);
996	helper = __nf_conntrack_helper_find_byname(helpname);	996	helper = __nf_conntrack_helper_find_byname(helpname);
997	if (helper)	997	if (helper)
998	return -EAGAIN;	998	return -EAGAIN;
999	#endif	999	#endif
1000	return -EOPNOTSUPP;	1000	return -EOPNOTSUPP;
1001	}	1001	}
1002		1002
1003	if (help) {	1003	if (help) {
1004	if (help->helper == helper)	1004	if (help->helper == helper)
1005	return 0;	1005	return 0;
1006	if (help->helper)	1006	if (help->helper)
1007	return -EBUSY;	1007	return -EBUSY;
1008	/* need to zero data of old helper */	1008	/* need to zero data of old helper */
1009	memset(&help->help, 0, sizeof(help->help));	1009	memset(&help->help, 0, sizeof(help->help));
1010	} else {	1010	} else {
1011	help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);	1011	help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1012	if (help == NULL)	1012	if (help == NULL)
1013	return -ENOMEM;	1013	return -ENOMEM;
1014	}	1014	}
1015		1015
1016	rcu_assign_pointer(help->helper, helper);	1016	rcu_assign_pointer(help->helper, helper);
1017		1017
1018	return 0;	1018	return 0;
1019	}	1019	}
1020		1020
1021	static inline int	1021	static inline int
1022	ctnetlink_change_timeout(struct nf_conn ct, struct nlattr cda[])	1022	ctnetlink_change_timeout(struct nf_conn ct, struct nlattr cda[])
1023	{	1023	{
1024	u_int32_t timeout = ntohl(nla_get_be32(cda[CTA_TIMEOUT]));	1024	u_int32_t timeout = ntohl(nla_get_be32(cda[CTA_TIMEOUT]));
1025		1025
1026	if (!del_timer(&ct->timeout))	1026	if (!del_timer(&ct->timeout))
1027	return -ETIME;	1027	return -ETIME;
1028		1028
1029	ct->timeout.expires = jiffies + timeout * HZ;	1029	ct->timeout.expires = jiffies + timeout * HZ;
1030	add_timer(&ct->timeout);	1030	add_timer(&ct->timeout);
1031		1031
1032	return 0;	1032	return 0;
1033	}	1033	}
1034		1034
1035	static inline int	1035	static inline int
1036	ctnetlink_change_protoinfo(struct nf_conn ct, struct nlattr cda[])	1036	ctnetlink_change_protoinfo(struct nf_conn ct, struct nlattr cda[])
1037	{	1037	{
1038	struct nlattr tb[CTA_PROTOINFO_MAX+1], attr = cda[CTA_PROTOINFO];	1038	struct nlattr tb[CTA_PROTOINFO_MAX+1], attr = cda[CTA_PROTOINFO];
1039	struct nf_conntrack_l4proto *l4proto;	1039	struct nf_conntrack_l4proto *l4proto;
1040	int err = 0;	1040	int err = 0;
1041		1041
1042	nla_parse_nested(tb, CTA_PROTOINFO_MAX, attr, NULL);	1042	nla_parse_nested(tb, CTA_PROTOINFO_MAX, attr, NULL);
1043		1043
1044	rcu_read_lock();	1044	rcu_read_lock();
1045	l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));	1045	l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
1046	if (l4proto->from_nlattr)	1046	if (l4proto->from_nlattr)
1047	err = l4proto->from_nlattr(tb, ct);	1047	err = l4proto->from_nlattr(tb, ct);
1048	rcu_read_unlock();	1048	rcu_read_unlock();
1049		1049
1050	return err;	1050	return err;
1051	}	1051	}
1052		1052
1053	#ifdef CONFIG_NF_NAT_NEEDED	1053	#ifdef CONFIG_NF_NAT_NEEDED
1054	static inline int	1054	static inline int
1055	change_nat_seq_adj(struct nf_nat_seq natseq, struct nlattr attr)	1055	change_nat_seq_adj(struct nf_nat_seq natseq, struct nlattr attr)
1056	{	1056	{
1057	struct nlattr *cda[CTA_NAT_SEQ_MAX+1];	1057	struct nlattr *cda[CTA_NAT_SEQ_MAX+1];
1058		1058
1059	nla_parse_nested(cda, CTA_NAT_SEQ_MAX, attr, NULL);	1059	nla_parse_nested(cda, CTA_NAT_SEQ_MAX, attr, NULL);
1060		1060
1061	if (!cda[CTA_NAT_SEQ_CORRECTION_POS])	1061	if (!cda[CTA_NAT_SEQ_CORRECTION_POS])
1062	return -EINVAL;	1062	return -EINVAL;
1063		1063
1064	natseq->correction_pos =	1064	natseq->correction_pos =
1065	ntohl(nla_get_be32(cda[CTA_NAT_SEQ_CORRECTION_POS]));	1065	ntohl(nla_get_be32(cda[CTA_NAT_SEQ_CORRECTION_POS]));
1066		1066
1067	if (!cda[CTA_NAT_SEQ_OFFSET_BEFORE])	1067	if (!cda[CTA_NAT_SEQ_OFFSET_BEFORE])
1068	return -EINVAL;	1068	return -EINVAL;
1069		1069
1070	natseq->offset_before =	1070	natseq->offset_before =
1071	ntohl(nla_get_be32(cda[CTA_NAT_SEQ_OFFSET_BEFORE]));	1071	ntohl(nla_get_be32(cda[CTA_NAT_SEQ_OFFSET_BEFORE]));
1072		1072
1073	if (!cda[CTA_NAT_SEQ_OFFSET_AFTER])	1073	if (!cda[CTA_NAT_SEQ_OFFSET_AFTER])
1074	return -EINVAL;	1074	return -EINVAL;
1075		1075
1076	natseq->offset_after =	1076	natseq->offset_after =
1077	ntohl(nla_get_be32(cda[CTA_NAT_SEQ_OFFSET_AFTER]));	1077	ntohl(nla_get_be32(cda[CTA_NAT_SEQ_OFFSET_AFTER]));
1078		1078
1079	return 0;	1079	return 0;
1080	}	1080	}
1081		1081
1082	static int	1082	static int
1083	ctnetlink_change_nat_seq_adj(struct nf_conn ct, struct nlattr cda[])	1083	ctnetlink_change_nat_seq_adj(struct nf_conn ct, struct nlattr cda[])
1084	{	1084	{
1085	int ret = 0;	1085	int ret = 0;
1086	struct nf_conn_nat *nat = nfct_nat(ct);	1086	struct nf_conn_nat *nat = nfct_nat(ct);
1087		1087
1088	if (!nat)	1088	if (!nat)
1089	return 0;	1089	return 0;
1090		1090
1091	if (cda[CTA_NAT_SEQ_ADJ_ORIG]) {	1091	if (cda[CTA_NAT_SEQ_ADJ_ORIG]) {
1092	ret = change_nat_seq_adj(&nat->seq[IP_CT_DIR_ORIGINAL],	1092	ret = change_nat_seq_adj(&nat->seq[IP_CT_DIR_ORIGINAL],
1093	cda[CTA_NAT_SEQ_ADJ_ORIG]);	1093	cda[CTA_NAT_SEQ_ADJ_ORIG]);
1094	if (ret < 0)	1094	if (ret < 0)
1095	return ret;	1095	return ret;
1096		1096
1097	ct->status \|= IPS_SEQ_ADJUST;	1097	ct->status \|= IPS_SEQ_ADJUST;
1098	}	1098	}
1099		1099
1100	if (cda[CTA_NAT_SEQ_ADJ_REPLY]) {	1100	if (cda[CTA_NAT_SEQ_ADJ_REPLY]) {
1101	ret = change_nat_seq_adj(&nat->seq[IP_CT_DIR_REPLY],	1101	ret = change_nat_seq_adj(&nat->seq[IP_CT_DIR_REPLY],
1102	cda[CTA_NAT_SEQ_ADJ_REPLY]);	1102	cda[CTA_NAT_SEQ_ADJ_REPLY]);
1103	if (ret < 0)	1103	if (ret < 0)
1104	return ret;	1104	return ret;
1105		1105
1106	ct->status \|= IPS_SEQ_ADJUST;	1106	ct->status \|= IPS_SEQ_ADJUST;
1107	}	1107	}
1108		1108
1109	return 0;	1109	return 0;
1110	}	1110	}
1111	#endif	1111	#endif
1112		1112
1113	static int	1113	static int
1114	ctnetlink_change_conntrack(struct nf_conn ct, struct nlattr cda[])	1114	ctnetlink_change_conntrack(struct nf_conn ct, struct nlattr cda[])
1115	{	1115	{
1116	int err;	1116	int err;
1117		1117
1118	/* only allow NAT changes and master assignation for new conntracks */	1118	/* only allow NAT changes and master assignation for new conntracks */
1119	if (cda[CTA_NAT_SRC] \|\| cda[CTA_NAT_DST] \|\| cda[CTA_TUPLE_MASTER])	1119	if (cda[CTA_NAT_SRC] \|\| cda[CTA_NAT_DST] \|\| cda[CTA_TUPLE_MASTER])
1120	return -EOPNOTSUPP;	1120	return -EOPNOTSUPP;
1121		1121
1122	if (cda[CTA_HELP]) {	1122	if (cda[CTA_HELP]) {
1123	err = ctnetlink_change_helper(ct, cda);	1123	err = ctnetlink_change_helper(ct, cda);
1124	if (err < 0)	1124	if (err < 0)
1125	return err;	1125	return err;
1126	}	1126	}
1127		1127
1128	if (cda[CTA_TIMEOUT]) {	1128	if (cda[CTA_TIMEOUT]) {
1129	err = ctnetlink_change_timeout(ct, cda);	1129	err = ctnetlink_change_timeout(ct, cda);
1130	if (err < 0)	1130	if (err < 0)
1131	return err;	1131	return err;
1132	}	1132	}
1133		1133
1134	if (cda[CTA_STATUS]) {	1134	if (cda[CTA_STATUS]) {
1135	err = ctnetlink_change_status(ct, cda);	1135	err = ctnetlink_change_status(ct, cda);
1136	if (err < 0)	1136	if (err < 0)
1137	return err;	1137	return err;
1138	}	1138	}
1139		1139
1140	if (cda[CTA_PROTOINFO]) {	1140	if (cda[CTA_PROTOINFO]) {
1141	err = ctnetlink_change_protoinfo(ct, cda);	1141	err = ctnetlink_change_protoinfo(ct, cda);
1142	if (err < 0)	1142	if (err < 0)
1143	return err;	1143	return err;
1144	}	1144	}
1145		1145
1146	#if defined(CONFIG_NF_CONNTRACK_MARK)	1146	#if defined(CONFIG_NF_CONNTRACK_MARK)
1147	if (cda[CTA_MARK])	1147	if (cda[CTA_MARK])
1148	ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));	1148	ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));
1149	#endif	1149	#endif
1150		1150
1151	#ifdef CONFIG_NF_NAT_NEEDED	1151	#ifdef CONFIG_NF_NAT_NEEDED
1152	if (cda[CTA_NAT_SEQ_ADJ_ORIG] \|\| cda[CTA_NAT_SEQ_ADJ_REPLY]) {	1152	if (cda[CTA_NAT_SEQ_ADJ_ORIG] \|\| cda[CTA_NAT_SEQ_ADJ_REPLY]) {
1153	err = ctnetlink_change_nat_seq_adj(ct, cda);	1153	err = ctnetlink_change_nat_seq_adj(ct, cda);
1154	if (err < 0)	1154	if (err < 0)
1155	return err;	1155	return err;
1156	}	1156	}
1157	#endif	1157	#endif
1158		1158
1159	return 0;	1159	return 0;
1160	}	1160	}
1161		1161
1162	static struct nf_conn *	1162	static struct nf_conn *
1163	ctnetlink_create_conntrack(struct nlattr *cda[],	1163	ctnetlink_create_conntrack(struct nlattr *cda[],
1164	struct nf_conntrack_tuple *otuple,	1164	struct nf_conntrack_tuple *otuple,
1165	struct nf_conntrack_tuple *rtuple,	1165	struct nf_conntrack_tuple *rtuple,
1166	u8 u3)	1166	u8 u3)
1167	{	1167	{
1168	struct nf_conn *ct;	1168	struct nf_conn *ct;
1169	int err = -EINVAL;	1169	int err = -EINVAL;
1170	struct nf_conntrack_helper *helper;	1170	struct nf_conntrack_helper *helper;
1171		1171
1172	ct = nf_conntrack_alloc(&init_net, otuple, rtuple, GFP_ATOMIC);	1172	ct = nf_conntrack_alloc(&init_net, otuple, rtuple, GFP_ATOMIC);
1173	if (IS_ERR(ct))	1173	if (IS_ERR(ct))
1174	return ERR_PTR(-ENOMEM);	1174	return ERR_PTR(-ENOMEM);
1175		1175
1176	if (!cda[CTA_TIMEOUT])	1176	if (!cda[CTA_TIMEOUT])
1177	goto err1;	1177	goto err1;
1178	ct->timeout.expires = ntohl(nla_get_be32(cda[CTA_TIMEOUT]));	1178	ct->timeout.expires = ntohl(nla_get_be32(cda[CTA_TIMEOUT]));
1179		1179
1180	ct->timeout.expires = jiffies + ct->timeout.expires * HZ;	1180	ct->timeout.expires = jiffies + ct->timeout.expires * HZ;
1181	ct->status \|= IPS_CONFIRMED;	1181	ct->status \|= IPS_CONFIRMED;
1182		1182
1183	rcu_read_lock();	1183	rcu_read_lock();
1184	if (cda[CTA_HELP]) {	1184	if (cda[CTA_HELP]) {
1185	char *helpname = NULL;	1185	char *helpname = NULL;
1186		1186
1187	err = ctnetlink_parse_help(cda[CTA_HELP], &helpname);	1187	err = ctnetlink_parse_help(cda[CTA_HELP], &helpname);
1188	if (err < 0)	1188	if (err < 0)
1189	goto err2;	1189	goto err2;
1190		1190
1191	helper = __nf_conntrack_helper_find_byname(helpname);	1191	helper = __nf_conntrack_helper_find_byname(helpname);
1192	if (helper == NULL) {	1192	if (helper == NULL) {
1193	rcu_read_unlock();	1193	rcu_read_unlock();
1194	#ifdef CONFIG_MODULES	1194	#ifdef CONFIG_MODULES
1195	if (request_module("nfct-helper-%s", helpname) < 0) {	1195	if (request_module("nfct-helper-%s", helpname) < 0) {
1196	err = -EOPNOTSUPP;	1196	err = -EOPNOTSUPP;
1197	goto err1;	1197	goto err1;
1198	}	1198	}
1199		1199
1200	rcu_read_lock();	1200	rcu_read_lock();
1201	helper = __nf_conntrack_helper_find_byname(helpname);	1201	helper = __nf_conntrack_helper_find_byname(helpname);
1202	if (helper) {	1202	if (helper) {
1203	err = -EAGAIN;	1203	err = -EAGAIN;
1204	goto err2;	1204	goto err2;
1205	}	1205	}
1206	rcu_read_unlock();	1206	rcu_read_unlock();
1207	#endif	1207	#endif
1208	err = -EOPNOTSUPP;	1208	err = -EOPNOTSUPP;
1209	goto err1;	1209	goto err1;
1210	} else {	1210	} else {
1211	struct nf_conn_help *help;	1211	struct nf_conn_help *help;
1212		1212
1213	help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);	1213	help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1214	if (help == NULL) {	1214	if (help == NULL) {
1215	err = -ENOMEM;	1215	err = -ENOMEM;
1216	goto err2;	1216	goto err2;
1217	}	1217	}
1218		1218
1219	/* not in hash table yet so not strictly necessary */	1219	/* not in hash table yet so not strictly necessary */
1220	rcu_assign_pointer(help->helper, helper);	1220	rcu_assign_pointer(help->helper, helper);
1221	}	1221	}
1222	} else {	1222	} else {
1223	/* try an implicit helper assignation */	1223	/* try an implicit helper assignation */
1224	err = __nf_ct_try_assign_helper(ct, GFP_ATOMIC);	1224	err = __nf_ct_try_assign_helper(ct, GFP_ATOMIC);
1225	if (err < 0)	1225	if (err < 0)
1226	goto err2;	1226	goto err2;
1227	}	1227	}
1228		1228
1229	if (cda[CTA_STATUS]) {	1229	if (cda[CTA_STATUS]) {
1230	err = ctnetlink_change_status(ct, cda);	1230	err = ctnetlink_change_status(ct, cda);
1231	if (err < 0)	1231	if (err < 0)
1232	goto err2;	1232	goto err2;
1233	}	1233	}
1234		1234
1235	if (cda[CTA_NAT_SRC] \|\| cda[CTA_NAT_DST]) {	1235	if (cda[CTA_NAT_SRC] \|\| cda[CTA_NAT_DST]) {
1236	err = ctnetlink_change_nat(ct, cda);	1236	err = ctnetlink_change_nat(ct, cda);
1237	if (err < 0)	1237	if (err < 0)
1238	goto err2;	1238	goto err2;
1239	}	1239	}
1240		1240
1241	#ifdef CONFIG_NF_NAT_NEEDED	1241	#ifdef CONFIG_NF_NAT_NEEDED
1242	if (cda[CTA_NAT_SEQ_ADJ_ORIG] \|\| cda[CTA_NAT_SEQ_ADJ_REPLY]) {	1242	if (cda[CTA_NAT_SEQ_ADJ_ORIG] \|\| cda[CTA_NAT_SEQ_ADJ_REPLY]) {
1243	err = ctnetlink_change_nat_seq_adj(ct, cda);	1243	err = ctnetlink_change_nat_seq_adj(ct, cda);
1244	if (err < 0)	1244	if (err < 0)
1245	goto err2;	1245	goto err2;
1246	}	1246	}
1247	#endif	1247	#endif
1248		1248
1249	if (cda[CTA_PROTOINFO]) {	1249	if (cda[CTA_PROTOINFO]) {
1250	err = ctnetlink_change_protoinfo(ct, cda);	1250	err = ctnetlink_change_protoinfo(ct, cda);
1251	if (err < 0)	1251	if (err < 0)
1252	goto err2;	1252	goto err2;
1253	}	1253	}
1254		1254
1255	nf_ct_acct_ext_add(ct, GFP_ATOMIC);	1255	nf_ct_acct_ext_add(ct, GFP_ATOMIC);
1256		1256
1257	#if defined(CONFIG_NF_CONNTRACK_MARK)	1257	#if defined(CONFIG_NF_CONNTRACK_MARK)
1258	if (cda[CTA_MARK])	1258	if (cda[CTA_MARK])
1259	ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));	1259	ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));
1260	#endif	1260	#endif
1261		1261
1262	/* setup master conntrack: this is a confirmed expectation */	1262	/* setup master conntrack: this is a confirmed expectation */
1263	if (cda[CTA_TUPLE_MASTER]) {	1263	if (cda[CTA_TUPLE_MASTER]) {
1264	struct nf_conntrack_tuple master;	1264	struct nf_conntrack_tuple master;
1265	struct nf_conntrack_tuple_hash *master_h;	1265	struct nf_conntrack_tuple_hash *master_h;
1266	struct nf_conn *master_ct;	1266	struct nf_conn *master_ct;
1267		1267
1268	err = ctnetlink_parse_tuple(cda, &master, CTA_TUPLE_MASTER, u3);	1268	err = ctnetlink_parse_tuple(cda, &master, CTA_TUPLE_MASTER, u3);
1269	if (err < 0)	1269	if (err < 0)
1270	goto err2;	1270	goto err2;
1271		1271
1272	master_h = nf_conntrack_find_get(&init_net, &master);	1272	master_h = nf_conntrack_find_get(&init_net, &master);
1273	if (master_h == NULL) {	1273	if (master_h == NULL) {
1274	err = -ENOENT;	1274	err = -ENOENT;
1275	goto err2;	1275	goto err2;
1276	}	1276	}
1277	master_ct = nf_ct_tuplehash_to_ctrack(master_h);	1277	master_ct = nf_ct_tuplehash_to_ctrack(master_h);
1278	__set_bit(IPS_EXPECTED_BIT, &ct->status);	1278	__set_bit(IPS_EXPECTED_BIT, &ct->status);
1279	ct->master = master_ct;	1279	ct->master = master_ct;
1280	}	1280	}
1281		1281
1282	add_timer(&ct->timeout);	1282	add_timer(&ct->timeout);
1283	nf_conntrack_hash_insert(ct);	1283	nf_conntrack_hash_insert(ct);
1284	rcu_read_unlock();	1284	rcu_read_unlock();
1285		1285
1286	return ct;	1286	return ct;
1287		1287
1288	err2:	1288	err2:
1289	rcu_read_unlock();	1289	rcu_read_unlock();
1290	err1:	1290	err1:
1291	nf_conntrack_free(ct);	1291	nf_conntrack_free(ct);
1292	return ERR_PTR(err);	1292	return ERR_PTR(err);
1293	}	1293	}
1294		1294
1295	static int	1295	static int
1296	ctnetlink_new_conntrack(struct sock ctnl, struct sk_buff skb,	1296	ctnetlink_new_conntrack(struct sock ctnl, struct sk_buff skb,
1297	struct nlmsghdr nlh, struct nlattr cda[])	1297	struct nlmsghdr nlh, struct nlattr cda[])
1298	{	1298	{
1299	struct nf_conntrack_tuple otuple, rtuple;	1299	struct nf_conntrack_tuple otuple, rtuple;
1300	struct nf_conntrack_tuple_hash *h = NULL;	1300	struct nf_conntrack_tuple_hash *h = NULL;
1301	struct nfgenmsg *nfmsg = nlmsg_data(nlh);	1301	struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1302	u_int8_t u3 = nfmsg->nfgen_family;	1302	u_int8_t u3 = nfmsg->nfgen_family;
1303	int err = 0;	1303	int err = 0;
1304		1304
1305	if (cda[CTA_TUPLE_ORIG]) {	1305	if (cda[CTA_TUPLE_ORIG]) {
1306	err = ctnetlink_parse_tuple(cda, &otuple, CTA_TUPLE_ORIG, u3);	1306	err = ctnetlink_parse_tuple(cda, &otuple, CTA_TUPLE_ORIG, u3);
1307	if (err < 0)	1307	if (err < 0)
1308	return err;	1308	return err;
1309	}	1309	}
1310		1310
1311	if (cda[CTA_TUPLE_REPLY]) {	1311	if (cda[CTA_TUPLE_REPLY]) {
1312	err = ctnetlink_parse_tuple(cda, &rtuple, CTA_TUPLE_REPLY, u3);	1312	err = ctnetlink_parse_tuple(cda, &rtuple, CTA_TUPLE_REPLY, u3);
1313	if (err < 0)	1313	if (err < 0)
1314	return err;	1314	return err;
1315	}	1315	}
1316		1316
1317	spin_lock_bh(&nf_conntrack_lock);	1317	spin_lock_bh(&nf_conntrack_lock);
1318	if (cda[CTA_TUPLE_ORIG])	1318	if (cda[CTA_TUPLE_ORIG])
1319	h = __nf_conntrack_find(&init_net, &otuple);	1319	h = __nf_conntrack_find(&init_net, &otuple);
1320	else if (cda[CTA_TUPLE_REPLY])	1320	else if (cda[CTA_TUPLE_REPLY])
1321	h = __nf_conntrack_find(&init_net, &rtuple);	1321	h = __nf_conntrack_find(&init_net, &rtuple);
1322		1322
1323	if (h == NULL) {	1323	if (h == NULL) {
1324	err = -ENOENT;	1324	err = -ENOENT;
1325	if (nlh->nlmsg_flags & NLM_F_CREATE) {	1325	if (nlh->nlmsg_flags & NLM_F_CREATE) {
1326	struct nf_conn *ct;	1326	struct nf_conn *ct;
1327	enum ip_conntrack_events events;	1327	enum ip_conntrack_events events;
1328		1328
1329	ct = ctnetlink_create_conntrack(cda, &otuple,	1329	ct = ctnetlink_create_conntrack(cda, &otuple,
1330	&rtuple, u3);	1330	&rtuple, u3);
1331	if (IS_ERR(ct)) {	1331	if (IS_ERR(ct)) {
1332	err = PTR_ERR(ct);	1332	err = PTR_ERR(ct);
1333	goto out_unlock;	1333	goto out_unlock;
1334	}	1334	}
1335	err = 0;	1335	err = 0;
1336	nf_conntrack_get(&ct->ct_general);	1336	nf_conntrack_get(&ct->ct_general);
1337	spin_unlock_bh(&nf_conntrack_lock);	1337	spin_unlock_bh(&nf_conntrack_lock);
1338	if (test_bit(IPS_EXPECTED_BIT, &ct->status))	1338	if (test_bit(IPS_EXPECTED_BIT, &ct->status))
1339	events = IPCT_RELATED;	1339	events = IPCT_RELATED;
1340	else	1340	else
1341	events = IPCT_NEW;	1341	events = IPCT_NEW;
1342		1342
1343	nf_conntrack_event_report(IPCT_STATUS \|	1343	nf_conntrack_event_report(IPCT_STATUS \|
1344	IPCT_HELPER \|	1344	IPCT_HELPER \|
1345	IPCT_PROTOINFO \|	1345	IPCT_PROTOINFO \|
1346	IPCT_NATSEQADJ \|	1346	IPCT_NATSEQADJ \|
1347	IPCT_MARK \| events,	1347	IPCT_MARK \| events,
1348	ct, NETLINK_CB(skb).pid,	1348	ct, NETLINK_CB(skb).pid,
1349	nlmsg_report(nlh));	1349	nlmsg_report(nlh));
1350	nf_ct_put(ct);	1350	nf_ct_put(ct);
1351	} else	1351	} else
1352	spin_unlock_bh(&nf_conntrack_lock);	1352	spin_unlock_bh(&nf_conntrack_lock);
1353		1353
1354	return err;	1354	return err;
1355	}	1355	}
1356	/* implicit 'else' */	1356	/* implicit 'else' */
1357		1357
1358	/* We manipulate the conntrack inside the global conntrack table lock,	1358	/* We manipulate the conntrack inside the global conntrack table lock,
1359	* so there's no need to increase the refcount */	1359	* so there's no need to increase the refcount */
1360	err = -EEXIST;	1360	err = -EEXIST;
1361	if (!(nlh->nlmsg_flags & NLM_F_EXCL)) {	1361	if (!(nlh->nlmsg_flags & NLM_F_EXCL)) {
1362	struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);	1362	struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
1363		1363
1364	err = ctnetlink_change_conntrack(ct, cda);	1364	err = ctnetlink_change_conntrack(ct, cda);
1365	if (err == 0) {	1365	if (err == 0) {
1366	nf_conntrack_get(&ct->ct_general);	1366	nf_conntrack_get(&ct->ct_general);
1367	spin_unlock_bh(&nf_conntrack_lock);	1367	spin_unlock_bh(&nf_conntrack_lock);
1368	nf_conntrack_event_report(IPCT_STATUS \|	1368	nf_conntrack_event_report(IPCT_STATUS \|
1369	IPCT_HELPER \|	1369	IPCT_HELPER \|
1370	IPCT_PROTOINFO \|	1370	IPCT_PROTOINFO \|
1371	IPCT_NATSEQADJ \|	1371	IPCT_NATSEQADJ \|
1372	IPCT_MARK,	1372	IPCT_MARK,
1373	ct, NETLINK_CB(skb).pid,	1373	ct, NETLINK_CB(skb).pid,
1374	nlmsg_report(nlh));	1374	nlmsg_report(nlh));
1375	nf_ct_put(ct);	1375	nf_ct_put(ct);
1376	} else	1376	} else
1377	spin_unlock_bh(&nf_conntrack_lock);	1377	spin_unlock_bh(&nf_conntrack_lock);
1378		1378
1379	return err;	1379	return err;
1380	}	1380	}
1381		1381
1382	out_unlock:	1382	out_unlock:
1383	spin_unlock_bh(&nf_conntrack_lock);	1383	spin_unlock_bh(&nf_conntrack_lock);
1384	return err;	1384	return err;
1385	}	1385	}
1386		1386
1387	/***********************************************************************	1387	/***********************************************************************
1388	* EXPECT	1388	* EXPECT
1389	***********************************************************************/	1389	***********************************************************************/
1390		1390
1391	static inline int	1391	static inline int
1392	ctnetlink_exp_dump_tuple(struct sk_buff *skb,	1392	ctnetlink_exp_dump_tuple(struct sk_buff *skb,
1393	const struct nf_conntrack_tuple *tuple,	1393	const struct nf_conntrack_tuple *tuple,
1394	enum ctattr_expect type)	1394	enum ctattr_expect type)
1395	{	1395	{
1396	struct nlattr *nest_parms;	1396	struct nlattr *nest_parms;
1397		1397
1398	nest_parms = nla_nest_start(skb, type \| NLA_F_NESTED);	1398	nest_parms = nla_nest_start(skb, type \| NLA_F_NESTED);
1399	if (!nest_parms)	1399	if (!nest_parms)
1400	goto nla_put_failure;	1400	goto nla_put_failure;
1401	if (ctnetlink_dump_tuples(skb, tuple) < 0)	1401	if (ctnetlink_dump_tuples(skb, tuple) < 0)
1402	goto nla_put_failure;	1402	goto nla_put_failure;
1403	nla_nest_end(skb, nest_parms);	1403	nla_nest_end(skb, nest_parms);
1404		1404
1405	return 0;	1405	return 0;
1406		1406
1407	nla_put_failure:	1407	nla_put_failure:
1408	return -1;	1408	return -1;
1409	}	1409	}
1410		1410
1411	static inline int	1411	static inline int
1412	ctnetlink_exp_dump_mask(struct sk_buff *skb,	1412	ctnetlink_exp_dump_mask(struct sk_buff *skb,
1413	const struct nf_conntrack_tuple *tuple,	1413	const struct nf_conntrack_tuple *tuple,
1414	const struct nf_conntrack_tuple_mask *mask)	1414	const struct nf_conntrack_tuple_mask *mask)
1415	{	1415	{
1416	int ret;	1416	int ret;
1417	struct nf_conntrack_l3proto *l3proto;	1417	struct nf_conntrack_l3proto *l3proto;
1418	struct nf_conntrack_l4proto *l4proto;	1418	struct nf_conntrack_l4proto *l4proto;
1419	struct nf_conntrack_tuple m;	1419	struct nf_conntrack_tuple m;
1420	struct nlattr *nest_parms;	1420	struct nlattr *nest_parms;
1421		1421
1422	memset(&m, 0xFF, sizeof(m));	1422	memset(&m, 0xFF, sizeof(m));
1423	m.src.u.all = mask->src.u.all;	1423	m.src.u.all = mask->src.u.all;
1424	memcpy(&m.src.u3, &mask->src.u3, sizeof(m.src.u3));	1424	memcpy(&m.src.u3, &mask->src.u3, sizeof(m.src.u3));
1425		1425
1426	nest_parms = nla_nest_start(skb, CTA_EXPECT_MASK \| NLA_F_NESTED);	1426	nest_parms = nla_nest_start(skb, CTA_EXPECT_MASK \| NLA_F_NESTED);
1427	if (!nest_parms)	1427	if (!nest_parms)
1428	goto nla_put_failure;	1428	goto nla_put_failure;
1429		1429
1430	l3proto = __nf_ct_l3proto_find(tuple->src.l3num);	1430	l3proto = __nf_ct_l3proto_find(tuple->src.l3num);
1431	ret = ctnetlink_dump_tuples_ip(skb, &m, l3proto);	1431	ret = ctnetlink_dump_tuples_ip(skb, &m, l3proto);
1432		1432
1433	if (unlikely(ret < 0))	1433	if (unlikely(ret < 0))
1434	goto nla_put_failure;	1434	goto nla_put_failure;
1435		1435
1436	l4proto = __nf_ct_l4proto_find(tuple->src.l3num, tuple->dst.protonum);	1436	l4proto = __nf_ct_l4proto_find(tuple->src.l3num, tuple->dst.protonum);
1437	ret = ctnetlink_dump_tuples_proto(skb, &m, l4proto);	1437	ret = ctnetlink_dump_tuples_proto(skb, &m, l4proto);
1438	if (unlikely(ret < 0))	1438	if (unlikely(ret < 0))
1439	goto nla_put_failure;	1439	goto nla_put_failure;
1440		1440
1441	nla_nest_end(skb, nest_parms);	1441	nla_nest_end(skb, nest_parms);
1442		1442
1443	return 0;	1443	return 0;
1444		1444
1445	nla_put_failure:	1445	nla_put_failure:
1446	return -1;	1446	return -1;
1447	}	1447	}
1448		1448
1449	static int	1449	static int
1450	ctnetlink_exp_dump_expect(struct sk_buff *skb,	1450	ctnetlink_exp_dump_expect(struct sk_buff *skb,
1451	const struct nf_conntrack_expect *exp)	1451	const struct nf_conntrack_expect *exp)
1452	{	1452	{
1453	struct nf_conn *master = exp->master;	1453	struct nf_conn *master = exp->master;
1454	long timeout = (exp->timeout.expires - jiffies) / HZ;	1454	long timeout = (exp->timeout.expires - jiffies) / HZ;
1455		1455
1456	if (timeout < 0)	1456	if (timeout < 0)
1457	timeout = 0;	1457	timeout = 0;
1458		1458
1459	if (ctnetlink_exp_dump_tuple(skb, &exp->tuple, CTA_EXPECT_TUPLE) < 0)	1459	if (ctnetlink_exp_dump_tuple(skb, &exp->tuple, CTA_EXPECT_TUPLE) < 0)
1460	goto nla_put_failure;	1460	goto nla_put_failure;
1461	if (ctnetlink_exp_dump_mask(skb, &exp->tuple, &exp->mask) < 0)	1461	if (ctnetlink_exp_dump_mask(skb, &exp->tuple, &exp->mask) < 0)
1462	goto nla_put_failure;	1462	goto nla_put_failure;
1463	if (ctnetlink_exp_dump_tuple(skb,	1463	if (ctnetlink_exp_dump_tuple(skb,
1464	&master->tuplehash[IP_CT_DIR_ORIGINAL].tuple,	1464	&master->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
1465	CTA_EXPECT_MASTER) < 0)	1465	CTA_EXPECT_MASTER) < 0)
1466	goto nla_put_failure;	1466	goto nla_put_failure;
1467		1467
1468	NLA_PUT_BE32(skb, CTA_EXPECT_TIMEOUT, htonl(timeout));	1468	NLA_PUT_BE32(skb, CTA_EXPECT_TIMEOUT, htonl(timeout));
1469	NLA_PUT_BE32(skb, CTA_EXPECT_ID, htonl((unsigned long)exp));	1469	NLA_PUT_BE32(skb, CTA_EXPECT_ID, htonl((unsigned long)exp));
1470		1470
1471	return 0;	1471	return 0;
1472		1472
1473	nla_put_failure:	1473	nla_put_failure:
1474	return -1;	1474	return -1;
1475	}	1475	}
1476		1476
1477	static int	1477	static int
1478	ctnetlink_exp_fill_info(struct sk_buff *skb, u32 pid, u32 seq,	1478	ctnetlink_exp_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
1479	int event, const struct nf_conntrack_expect *exp)	1479	int event, const struct nf_conntrack_expect *exp)
1480	{	1480	{
1481	struct nlmsghdr *nlh;	1481	struct nlmsghdr *nlh;
1482	struct nfgenmsg *nfmsg;	1482	struct nfgenmsg *nfmsg;
1483	unsigned int flags = pid ? NLM_F_MULTI : 0;	1483	unsigned int flags = pid ? NLM_F_MULTI : 0;
1484		1484
1485	event \|= NFNL_SUBSYS_CTNETLINK_EXP << 8;	1485	event \|= NFNL_SUBSYS_CTNETLINK_EXP << 8;
1486	nlh = nlmsg_put(skb, pid, seq, event, sizeof(*nfmsg), flags);	1486	nlh = nlmsg_put(skb, pid, seq, event, sizeof(*nfmsg), flags);
1487	if (nlh == NULL)	1487	if (nlh == NULL)
1488	goto nlmsg_failure;	1488	goto nlmsg_failure;
1489		1489
1490	nfmsg = nlmsg_data(nlh);	1490	nfmsg = nlmsg_data(nlh);
1491	nfmsg->nfgen_family = exp->tuple.src.l3num;	1491	nfmsg->nfgen_family = exp->tuple.src.l3num;
1492	nfmsg->version = NFNETLINK_V0;	1492	nfmsg->version = NFNETLINK_V0;
1493	nfmsg->res_id = 0;	1493	nfmsg->res_id = 0;
1494		1494
1495	if (ctnetlink_exp_dump_expect(skb, exp) < 0)	1495	if (ctnetlink_exp_dump_expect(skb, exp) < 0)
1496	goto nla_put_failure;	1496	goto nla_put_failure;
1497		1497
1498	nlmsg_end(skb, nlh);	1498	nlmsg_end(skb, nlh);
1499	return skb->len;	1499	return skb->len;
1500		1500
1501	nlmsg_failure:	1501	nlmsg_failure:
1502	nla_put_failure:	1502	nla_put_failure:
1503	nlmsg_cancel(skb, nlh);	1503	nlmsg_cancel(skb, nlh);
1504	return -1;	1504	return -1;
1505	}	1505	}
1506		1506
1507	#ifdef CONFIG_NF_CONNTRACK_EVENTS	1507	#ifdef CONFIG_NF_CONNTRACK_EVENTS
1508	static int	1508	static int
1509	ctnetlink_expect_event(unsigned int events, struct nf_exp_event *item)	1509	ctnetlink_expect_event(unsigned int events, struct nf_exp_event *item)
1510	{	1510	{
1511	struct nlmsghdr *nlh;	1511	struct nlmsghdr *nlh;
1512	struct nfgenmsg *nfmsg;	1512	struct nfgenmsg *nfmsg;
1513	struct nf_conntrack_expect *exp = item->exp;	1513	struct nf_conntrack_expect *exp = item->exp;
1514	struct sk_buff *skb;	1514	struct sk_buff *skb;
1515	unsigned int type;	1515	unsigned int type;
1516	int flags = 0;	1516	int flags = 0;
1517		1517
1518	if (events & IPEXP_NEW) {	1518	if (events & IPEXP_NEW) {
1519	type = IPCTNL_MSG_EXP_NEW;	1519	type = IPCTNL_MSG_EXP_NEW;
1520	flags = NLM_F_CREATE\|NLM_F_EXCL;	1520	flags = NLM_F_CREATE\|NLM_F_EXCL;
1521	} else	1521	} else
1522	return 0;	1522	return 0;
1523		1523
1524	if (!item->report &&	1524	if (!item->report &&
1525	!nfnetlink_has_listeners(NFNLGRP_CONNTRACK_EXP_NEW))	1525	!nfnetlink_has_listeners(NFNLGRP_CONNTRACK_EXP_NEW))
1526	return 0;	1526	return 0;
1527		1527
1528	skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);	1528	skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
1529	if (skb == NULL)	1529	if (skb == NULL)
1530	goto errout;	1530	goto errout;
1531		1531
1532	type \|= NFNL_SUBSYS_CTNETLINK_EXP << 8;	1532	type \|= NFNL_SUBSYS_CTNETLINK_EXP << 8;
1533	nlh = nlmsg_put(skb, item->pid, 0, type, sizeof(*nfmsg), flags);	1533	nlh = nlmsg_put(skb, item->pid, 0, type, sizeof(*nfmsg), flags);
1534	if (nlh == NULL)	1534	if (nlh == NULL)
1535	goto nlmsg_failure;	1535	goto nlmsg_failure;
1536		1536
1537	nfmsg = nlmsg_data(nlh);	1537	nfmsg = nlmsg_data(nlh);
1538	nfmsg->nfgen_family = exp->tuple.src.l3num;	1538	nfmsg->nfgen_family = exp->tuple.src.l3num;
1539	nfmsg->version = NFNETLINK_V0;	1539	nfmsg->version = NFNETLINK_V0;
1540	nfmsg->res_id = 0;	1540	nfmsg->res_id = 0;
1541		1541
1542	rcu_read_lock();	1542	rcu_read_lock();
1543	if (ctnetlink_exp_dump_expect(skb, exp) < 0)	1543	if (ctnetlink_exp_dump_expect(skb, exp) < 0)
1544	goto nla_put_failure;	1544	goto nla_put_failure;
1545	rcu_read_unlock();	1545	rcu_read_unlock();
1546		1546
1547	nlmsg_end(skb, nlh);	1547	nlmsg_end(skb, nlh);
1548	nfnetlink_send(skb, item->pid, NFNLGRP_CONNTRACK_EXP_NEW,	1548	nfnetlink_send(skb, item->pid, NFNLGRP_CONNTRACK_EXP_NEW,
1549	item->report, GFP_ATOMIC);	1549	item->report, GFP_ATOMIC);
1550	return 0;	1550	return 0;
1551		1551
1552	nla_put_failure:	1552	nla_put_failure:
1553	rcu_read_unlock();	1553	rcu_read_unlock();
1554	nlmsg_cancel(skb, nlh);	1554	nlmsg_cancel(skb, nlh);
1555	nlmsg_failure:	1555	nlmsg_failure:
1556	kfree_skb(skb);	1556	kfree_skb(skb);
1557	errout:	1557	errout:
1558	nfnetlink_set_err(0, 0, -ENOBUFS);	1558	nfnetlink_set_err(0, 0, -ENOBUFS);
1559	return 0;	1559	return 0;
1560	}	1560	}
1561	#endif	1561	#endif
1562	static int ctnetlink_exp_done(struct netlink_callback *cb)	1562	static int ctnetlink_exp_done(struct netlink_callback *cb)
1563	{	1563	{
1564	if (cb->args[1])	1564	if (cb->args[1])
1565	nf_ct_expect_put((struct nf_conntrack_expect *)cb->args[1]);	1565	nf_ct_expect_put((struct nf_conntrack_expect *)cb->args[1]);
1566	return 0;	1566	return 0;
1567	}	1567	}
1568		1568
1569	static int	1569	static int
1570	ctnetlink_exp_dump_table(struct sk_buff skb, struct netlink_callback cb)	1570	ctnetlink_exp_dump_table(struct sk_buff skb, struct netlink_callback cb)
1571	{	1571	{
1572	struct net *net = &init_net;	1572	struct net *net = &init_net;
1573	struct nf_conntrack_expect exp, last;	1573	struct nf_conntrack_expect exp, last;
1574	struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);	1574	struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
1575	struct hlist_node *n;	1575	struct hlist_node *n;
1576	u_int8_t l3proto = nfmsg->nfgen_family;	1576	u_int8_t l3proto = nfmsg->nfgen_family;
1577		1577
1578	rcu_read_lock();	1578	rcu_read_lock();
1579	last = (struct nf_conntrack_expect *)cb->args[1];	1579	last = (struct nf_conntrack_expect *)cb->args[1];
1580	for (; cb->args[0] < nf_ct_expect_hsize; cb->args[0]++) {	1580	for (; cb->args[0] < nf_ct_expect_hsize; cb->args[0]++) {
1581	restart:	1581	restart:
1582	hlist_for_each_entry(exp, n, &net->ct.expect_hash[cb->args[0]],	1582	hlist_for_each_entry(exp, n, &net->ct.expect_hash[cb->args[0]],
1583	hnode) {	1583	hnode) {
1584	if (l3proto && exp->tuple.src.l3num != l3proto)	1584	if (l3proto && exp->tuple.src.l3num != l3proto)
1585	continue;	1585	continue;
1586	if (cb->args[1]) {	1586	if (cb->args[1]) {
1587	if (exp != last)	1587	if (exp != last)
1588	continue;	1588	continue;
1589	cb->args[1] = 0;	1589	cb->args[1] = 0;
1590	}	1590	}
1591	if (ctnetlink_exp_fill_info(skb,	1591	if (ctnetlink_exp_fill_info(skb,
1592	NETLINK_CB(cb->skb).pid,	1592	NETLINK_CB(cb->skb).pid,
1593	cb->nlh->nlmsg_seq,	1593	cb->nlh->nlmsg_seq,
1594	IPCTNL_MSG_EXP_NEW,	1594	IPCTNL_MSG_EXP_NEW,
1595	exp) < 0) {	1595	exp) < 0) {
1596	if (!atomic_inc_not_zero(&exp->use))	1596	if (!atomic_inc_not_zero(&exp->use))
1597	continue;	1597	continue;
1598	cb->args[1] = (unsigned long)exp;	1598	cb->args[1] = (unsigned long)exp;
1599	goto out;	1599	goto out;
1600	}	1600	}
1601	}	1601	}
1602	if (cb->args[1]) {	1602	if (cb->args[1]) {
1603	cb->args[1] = 0;	1603	cb->args[1] = 0;
1604	goto restart;	1604	goto restart;
1605	}	1605	}
1606	}	1606	}
1607	out:	1607	out:
1608	rcu_read_unlock();	1608	rcu_read_unlock();
1609	if (last)	1609	if (last)
1610	nf_ct_expect_put(last);	1610	nf_ct_expect_put(last);
1611		1611
1612	return skb->len;	1612	return skb->len;
1613	}	1613	}
1614		1614
1615	static const struct nla_policy exp_nla_policy[CTA_EXPECT_MAX+1] = {	1615	static const struct nla_policy exp_nla_policy[CTA_EXPECT_MAX+1] = {
1616	[CTA_EXPECT_TIMEOUT] = { .type = NLA_U32 },	1616	[CTA_EXPECT_TIMEOUT] = { .type = NLA_U32 },
1617	[CTA_EXPECT_ID] = { .type = NLA_U32 },	1617	[CTA_EXPECT_ID] = { .type = NLA_U32 },
1618	};	1618	};
1619		1619
1620	static int	1620	static int
1621	ctnetlink_get_expect(struct sock ctnl, struct sk_buff skb,	1621	ctnetlink_get_expect(struct sock ctnl, struct sk_buff skb,
1622	struct nlmsghdr nlh, struct nlattr cda[])	1622	struct nlmsghdr nlh, struct nlattr cda[])
1623	{	1623	{
1624	struct nf_conntrack_tuple tuple;	1624	struct nf_conntrack_tuple tuple;
1625	struct nf_conntrack_expect *exp;	1625	struct nf_conntrack_expect *exp;
1626	struct sk_buff *skb2;	1626	struct sk_buff *skb2;
1627	struct nfgenmsg *nfmsg = nlmsg_data(nlh);	1627	struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1628	u_int8_t u3 = nfmsg->nfgen_family;	1628	u_int8_t u3 = nfmsg->nfgen_family;
1629	int err = 0;	1629	int err = 0;
1630		1630
1631	if (nlh->nlmsg_flags & NLM_F_DUMP) {	1631	if (nlh->nlmsg_flags & NLM_F_DUMP) {
1632	return netlink_dump_start(ctnl, skb, nlh,	1632	return netlink_dump_start(ctnl, skb, nlh,
1633	ctnetlink_exp_dump_table,	1633	ctnetlink_exp_dump_table,
1634	ctnetlink_exp_done);	1634	ctnetlink_exp_done);
1635	}	1635	}
1636		1636
1637	if (cda[CTA_EXPECT_MASTER])	1637	if (cda[CTA_EXPECT_MASTER])
1638	err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER, u3);	1638	err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER, u3);
1639	else	1639	else
1640	return -EINVAL;	1640	return -EINVAL;
1641		1641
1642	if (err < 0)	1642	if (err < 0)
1643	return err;	1643	return err;
1644		1644
1645	exp = nf_ct_expect_find_get(&init_net, &tuple);	1645	exp = nf_ct_expect_find_get(&init_net, &tuple);
1646	if (!exp)	1646	if (!exp)
1647	return -ENOENT;	1647	return -ENOENT;
1648		1648
1649	if (cda[CTA_EXPECT_ID]) {	1649	if (cda[CTA_EXPECT_ID]) {
1650	__be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);	1650	__be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);
1651	if (ntohl(id) != (u32)(unsigned long)exp) {	1651	if (ntohl(id) != (u32)(unsigned long)exp) {
1652	nf_ct_expect_put(exp);	1652	nf_ct_expect_put(exp);
1653	return -ENOENT;	1653	return -ENOENT;
1654	}	1654	}
1655	}	1655	}
1656		1656
1657	err = -ENOMEM;	1657	err = -ENOMEM;
1658	skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);	1658	skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1659	if (skb2 == NULL)	1659	if (skb2 == NULL)
1660	goto out;	1660	goto out;
1661		1661
1662	rcu_read_lock();	1662	rcu_read_lock();
1663	err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).pid,	1663	err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).pid,
1664	nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW, exp);	1664	nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW, exp);
1665	rcu_read_unlock();	1665	rcu_read_unlock();
1666	if (err <= 0)	1666	if (err <= 0)
1667	goto free;	1667	goto free;
1668		1668
1669	nf_ct_expect_put(exp);	1669	nf_ct_expect_put(exp);
1670		1670
1671	return netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);	1671	return netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
1672		1672
1673	free:	1673	free:
1674	kfree_skb(skb2);	1674	kfree_skb(skb2);
1675	out:	1675	out:
1676	nf_ct_expect_put(exp);	1676	nf_ct_expect_put(exp);
1677	return err;	1677	return err;
1678	}	1678	}
1679		1679
1680	static int	1680	static int
1681	ctnetlink_del_expect(struct sock ctnl, struct sk_buff skb,	1681	ctnetlink_del_expect(struct sock ctnl, struct sk_buff skb,
1682	struct nlmsghdr nlh, struct nlattr cda[])	1682	struct nlmsghdr nlh, struct nlattr cda[])
1683	{	1683	{
1684	struct nf_conntrack_expect *exp;	1684	struct nf_conntrack_expect *exp;
1685	struct nf_conntrack_tuple tuple;	1685	struct nf_conntrack_tuple tuple;
1686	struct nf_conntrack_helper *h;	1686	struct nf_conntrack_helper *h;
1687	struct nfgenmsg *nfmsg = nlmsg_data(nlh);	1687	struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1688	struct hlist_node n, next;	1688	struct hlist_node n, next;
1689	u_int8_t u3 = nfmsg->nfgen_family;	1689	u_int8_t u3 = nfmsg->nfgen_family;
1690	unsigned int i;	1690	unsigned int i;
1691	int err;	1691	int err;
1692		1692
1693	if (cda[CTA_EXPECT_TUPLE]) {	1693	if (cda[CTA_EXPECT_TUPLE]) {
1694	/* delete a single expect by tuple */	1694	/* delete a single expect by tuple */
1695	err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);	1695	err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
1696	if (err < 0)	1696	if (err < 0)
1697	return err;	1697	return err;
1698		1698
1699	/* bump usage count to 2 */	1699	/* bump usage count to 2 */
1700	exp = nf_ct_expect_find_get(&init_net, &tuple);	1700	exp = nf_ct_expect_find_get(&init_net, &tuple);
1701	if (!exp)	1701	if (!exp)
1702	return -ENOENT;	1702	return -ENOENT;
1703		1703
1704	if (cda[CTA_EXPECT_ID]) {	1704	if (cda[CTA_EXPECT_ID]) {
1705	__be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);	1705	__be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);
1706	if (ntohl(id) != (u32)(unsigned long)exp) {	1706	if (ntohl(id) != (u32)(unsigned long)exp) {
1707	nf_ct_expect_put(exp);	1707	nf_ct_expect_put(exp);
1708	return -ENOENT;	1708	return -ENOENT;
1709	}	1709	}
1710	}	1710	}
1711		1711
1712	/* after list removal, usage count == 1 */	1712	/* after list removal, usage count == 1 */
1713	nf_ct_unexpect_related(exp);	1713	nf_ct_unexpect_related(exp);
1714	/* have to put what we 'get' above.	1714	/* have to put what we 'get' above.
1715	* after this line usage count == 0 */	1715	* after this line usage count == 0 */
1716	nf_ct_expect_put(exp);	1716	nf_ct_expect_put(exp);
1717	} else if (cda[CTA_EXPECT_HELP_NAME]) {	1717	} else if (cda[CTA_EXPECT_HELP_NAME]) {
1718	char *name = nla_data(cda[CTA_EXPECT_HELP_NAME]);	1718	char *name = nla_data(cda[CTA_EXPECT_HELP_NAME]);
1719	struct nf_conn_help *m_help;	1719	struct nf_conn_help *m_help;
1720		1720
1721	/* delete all expectations for this helper */	1721	/* delete all expectations for this helper */
1722	spin_lock_bh(&nf_conntrack_lock);	1722	spin_lock_bh(&nf_conntrack_lock);
1723	h = __nf_conntrack_helper_find_byname(name);	1723	h = __nf_conntrack_helper_find_byname(name);
1724	if (!h) {	1724	if (!h) {
1725	spin_unlock_bh(&nf_conntrack_lock);	1725	spin_unlock_bh(&nf_conntrack_lock);
1726	return -EOPNOTSUPP;	1726	return -EOPNOTSUPP;
1727	}	1727	}
1728	for (i = 0; i < nf_ct_expect_hsize; i++) {	1728	for (i = 0; i < nf_ct_expect_hsize; i++) {
1729	hlist_for_each_entry_safe(exp, n, next,	1729	hlist_for_each_entry_safe(exp, n, next,
1730	&init_net.ct.expect_hash[i],	1730	&init_net.ct.expect_hash[i],
1731	hnode) {	1731	hnode) {
1732	m_help = nfct_help(exp->master);	1732	m_help = nfct_help(exp->master);
1733	if (m_help->helper == h	1733	if (m_help->helper == h
1734	&& del_timer(&exp->timeout)) {	1734	&& del_timer(&exp->timeout)) {
1735	nf_ct_unlink_expect(exp);	1735	nf_ct_unlink_expect(exp);
1736	nf_ct_expect_put(exp);	1736	nf_ct_expect_put(exp);
1737	}	1737	}
1738	}	1738	}
1739	}	1739	}
1740	spin_unlock_bh(&nf_conntrack_lock);	1740	spin_unlock_bh(&nf_conntrack_lock);
1741	} else {	1741	} else {
1742	/* This basically means we have to flush everything*/	1742	/* This basically means we have to flush everything*/
1743	spin_lock_bh(&nf_conntrack_lock);	1743	spin_lock_bh(&nf_conntrack_lock);
1744	for (i = 0; i < nf_ct_expect_hsize; i++) {	1744	for (i = 0; i < nf_ct_expect_hsize; i++) {
1745	hlist_for_each_entry_safe(exp, n, next,	1745	hlist_for_each_entry_safe(exp, n, next,
1746	&init_net.ct.expect_hash[i],	1746	&init_net.ct.expect_hash[i],
1747	hnode) {	1747	hnode) {
1748	if (del_timer(&exp->timeout)) {	1748	if (del_timer(&exp->timeout)) {
1749	nf_ct_unlink_expect(exp);	1749	nf_ct_unlink_expect(exp);
1750	nf_ct_expect_put(exp);	1750	nf_ct_expect_put(exp);
1751	}	1751	}
1752	}	1752	}
1753	}	1753	}
1754	spin_unlock_bh(&nf_conntrack_lock);	1754	spin_unlock_bh(&nf_conntrack_lock);
1755	}	1755	}
1756		1756
1757	return 0;	1757	return 0;
1758	}	1758	}
1759	static int	1759	static int
1760	ctnetlink_change_expect(struct nf_conntrack_expect x, struct nlattr cda[])	1760	ctnetlink_change_expect(struct nf_conntrack_expect x, struct nlattr cda[])
1761	{	1761	{
1762	return -EOPNOTSUPP;	1762	return -EOPNOTSUPP;
1763	}	1763	}
1764		1764
1765	static int	1765	static int
1766	ctnetlink_create_expect(struct nlattr *cda[], u_int8_t u3, u32 pid, int report)	1766	ctnetlink_create_expect(struct nlattr *cda[], u_int8_t u3, u32 pid, int report)
1767	{	1767	{
1768	struct nf_conntrack_tuple tuple, mask, master_tuple;	1768	struct nf_conntrack_tuple tuple, mask, master_tuple;
1769	struct nf_conntrack_tuple_hash *h = NULL;	1769	struct nf_conntrack_tuple_hash *h = NULL;
1770	struct nf_conntrack_expect *exp;	1770	struct nf_conntrack_expect *exp;
1771	struct nf_conn *ct;	1771	struct nf_conn *ct;
1772	struct nf_conn_help *help;	1772	struct nf_conn_help *help;
1773	int err = 0;	1773	int err = 0;
1774		1774
1775	/* caller guarantees that those three CTA_EXPECT_* exist */	1775	/* caller guarantees that those three CTA_EXPECT_* exist */
1776	err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);	1776	err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
1777	if (err < 0)	1777	if (err < 0)
1778	return err;	1778	return err;
1779	err = ctnetlink_parse_tuple(cda, &mask, CTA_EXPECT_MASK, u3);	1779	err = ctnetlink_parse_tuple(cda, &mask, CTA_EXPECT_MASK, u3);
1780	if (err < 0)	1780	if (err < 0)
1781	return err;	1781	return err;
1782	err = ctnetlink_parse_tuple(cda, &master_tuple, CTA_EXPECT_MASTER, u3);	1782	err = ctnetlink_parse_tuple(cda, &master_tuple, CTA_EXPECT_MASTER, u3);
1783	if (err < 0)	1783	if (err < 0)
1784	return err;	1784	return err;
1785		1785
1786	/* Look for master conntrack of this expectation */	1786	/* Look for master conntrack of this expectation */
1787	h = nf_conntrack_find_get(&init_net, &master_tuple);	1787	h = nf_conntrack_find_get(&init_net, &master_tuple);
1788	if (!h)	1788	if (!h)
1789	return -ENOENT;	1789	return -ENOENT;
1790	ct = nf_ct_tuplehash_to_ctrack(h);	1790	ct = nf_ct_tuplehash_to_ctrack(h);
1791	help = nfct_help(ct);	1791	help = nfct_help(ct);
1792		1792
1793	if (!help \|\| !help->helper) {	1793	if (!help \|\| !help->helper) {
1794	/* such conntrack hasn't got any helper, abort */	1794	/* such conntrack hasn't got any helper, abort */
1795	err = -EOPNOTSUPP;	1795	err = -EOPNOTSUPP;
1796	goto out;	1796	goto out;
1797	}	1797	}
1798		1798
1799	exp = nf_ct_expect_alloc(ct);	1799	exp = nf_ct_expect_alloc(ct);
1800	if (!exp) {	1800	if (!exp) {
1801	err = -ENOMEM;	1801	err = -ENOMEM;
1802	goto out;	1802	goto out;
1803	}	1803	}
1804		1804
1805	exp->class = 0;	1805	exp->class = 0;
1806	exp->expectfn = NULL;	1806	exp->expectfn = NULL;
1807	exp->flags = 0;	1807	exp->flags = 0;
1808	exp->master = ct;	1808	exp->master = ct;
1809	exp->helper = NULL;	1809	exp->helper = NULL;
1810	memcpy(&exp->tuple, &tuple, sizeof(struct nf_conntrack_tuple));	1810	memcpy(&exp->tuple, &tuple, sizeof(struct nf_conntrack_tuple));
1811	memcpy(&exp->mask.src.u3, &mask.src.u3, sizeof(exp->mask.src.u3));	1811	memcpy(&exp->mask.src.u3, &mask.src.u3, sizeof(exp->mask.src.u3));
1812	exp->mask.src.u.all = mask.src.u.all;	1812	exp->mask.src.u.all = mask.src.u.all;
1813		1813
1814	err = nf_ct_expect_related_report(exp, pid, report);	1814	err = nf_ct_expect_related_report(exp, pid, report);
1815	nf_ct_expect_put(exp);	1815	nf_ct_expect_put(exp);
1816		1816
1817	out:	1817	out:
1818	nf_ct_put(nf_ct_tuplehash_to_ctrack(h));	1818	nf_ct_put(nf_ct_tuplehash_to_ctrack(h));
1819	return err;	1819	return err;
1820	}	1820	}
1821		1821
1822	static int	1822	static int
1823	ctnetlink_new_expect(struct sock ctnl, struct sk_buff skb,	1823	ctnetlink_new_expect(struct sock ctnl, struct sk_buff skb,
1824	struct nlmsghdr nlh, struct nlattr cda[])	1824	struct nlmsghdr nlh, struct nlattr cda[])
1825	{	1825	{
1826	struct nf_conntrack_tuple tuple;	1826	struct nf_conntrack_tuple tuple;
1827	struct nf_conntrack_expect *exp;	1827	struct nf_conntrack_expect *exp;
1828	struct nfgenmsg *nfmsg = nlmsg_data(nlh);	1828	struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1829	u_int8_t u3 = nfmsg->nfgen_family;	1829	u_int8_t u3 = nfmsg->nfgen_family;
1830	int err = 0;	1830	int err = 0;
1831		1831
1832	if (!cda[CTA_EXPECT_TUPLE]	1832	if (!cda[CTA_EXPECT_TUPLE]
1833	\|\| !cda[CTA_EXPECT_MASK]	1833	\|\| !cda[CTA_EXPECT_MASK]
1834	\|\| !cda[CTA_EXPECT_MASTER])	1834	\|\| !cda[CTA_EXPECT_MASTER])
1835	return -EINVAL;	1835	return -EINVAL;
1836		1836
1837	err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);	1837	err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
1838	if (err < 0)	1838	if (err < 0)
1839	return err;	1839	return err;
1840		1840
1841	spin_lock_bh(&nf_conntrack_lock);	1841	spin_lock_bh(&nf_conntrack_lock);
1842	exp = __nf_ct_expect_find(&init_net, &tuple);	1842	exp = __nf_ct_expect_find(&init_net, &tuple);
1843		1843
1844	if (!exp) {	1844	if (!exp) {
1845	spin_unlock_bh(&nf_conntrack_lock);	1845	spin_unlock_bh(&nf_conntrack_lock);
1846	err = -ENOENT;	1846	err = -ENOENT;
1847	if (nlh->nlmsg_flags & NLM_F_CREATE) {	1847	if (nlh->nlmsg_flags & NLM_F_CREATE) {
1848	err = ctnetlink_create_expect(cda,	1848	err = ctnetlink_create_expect(cda,
1849	u3,	1849	u3,
1850	NETLINK_CB(skb).pid,	1850	NETLINK_CB(skb).pid,
1851	nlmsg_report(nlh));	1851	nlmsg_report(nlh));
1852	}	1852	}
1853	return err;	1853	return err;
1854	}	1854	}
1855		1855
1856	err = -EEXIST;	1856	err = -EEXIST;
1857	if (!(nlh->nlmsg_flags & NLM_F_EXCL))	1857	if (!(nlh->nlmsg_flags & NLM_F_EXCL))
1858	err = ctnetlink_change_expect(exp, cda);	1858	err = ctnetlink_change_expect(exp, cda);
1859	spin_unlock_bh(&nf_conntrack_lock);	1859	spin_unlock_bh(&nf_conntrack_lock);
1860		1860
1861	return err;	1861	return err;
1862	}	1862	}
1863		1863
1864	#ifdef CONFIG_NF_CONNTRACK_EVENTS	1864	#ifdef CONFIG_NF_CONNTRACK_EVENTS
1865	static struct nf_ct_event_notifier ctnl_notifier = {	1865	static struct nf_ct_event_notifier ctnl_notifier = {
1866	.fcn = ctnetlink_conntrack_event,	1866	.fcn = ctnetlink_conntrack_event,
1867	};	1867	};
1868		1868
1869	static struct nf_exp_event_notifier ctnl_notifier_exp = {	1869	static struct nf_exp_event_notifier ctnl_notifier_exp = {
1870	.fcn = ctnetlink_expect_event,	1870	.fcn = ctnetlink_expect_event,
1871	};	1871	};
1872	#endif	1872	#endif
1873		1873
1874	static const struct nfnl_callback ctnl_cb[IPCTNL_MSG_MAX] = {	1874	static const struct nfnl_callback ctnl_cb[IPCTNL_MSG_MAX] = {
1875	[IPCTNL_MSG_CT_NEW] = { .call = ctnetlink_new_conntrack,	1875	[IPCTNL_MSG_CT_NEW] = { .call = ctnetlink_new_conntrack,
1876	.attr_count = CTA_MAX,	1876	.attr_count = CTA_MAX,
1877	.policy = ct_nla_policy },	1877	.policy = ct_nla_policy },
1878	[IPCTNL_MSG_CT_GET] = { .call = ctnetlink_get_conntrack,	1878	[IPCTNL_MSG_CT_GET] = { .call = ctnetlink_get_conntrack,
1879	.attr_count = CTA_MAX,	1879	.attr_count = CTA_MAX,
1880	.policy = ct_nla_policy },	1880	.policy = ct_nla_policy },
1881	[IPCTNL_MSG_CT_DELETE] = { .call = ctnetlink_del_conntrack,	1881	[IPCTNL_MSG_CT_DELETE] = { .call = ctnetlink_del_conntrack,
1882	.attr_count = CTA_MAX,	1882	.attr_count = CTA_MAX,
1883	.policy = ct_nla_policy },	1883	.policy = ct_nla_policy },
1884	[IPCTNL_MSG_CT_GET_CTRZERO] = { .call = ctnetlink_get_conntrack,	1884	[IPCTNL_MSG_CT_GET_CTRZERO] = { .call = ctnetlink_get_conntrack,
1885	.attr_count = CTA_MAX,	1885	.attr_count = CTA_MAX,
1886	.policy = ct_nla_policy },	1886	.policy = ct_nla_policy },
1887	};	1887	};
1888		1888
1889	static const struct nfnl_callback ctnl_exp_cb[IPCTNL_MSG_EXP_MAX] = {	1889	static const struct nfnl_callback ctnl_exp_cb[IPCTNL_MSG_EXP_MAX] = {
1890	[IPCTNL_MSG_EXP_GET] = { .call = ctnetlink_get_expect,	1890	[IPCTNL_MSG_EXP_GET] = { .call = ctnetlink_get_expect,
1891	.attr_count = CTA_EXPECT_MAX,	1891	.attr_count = CTA_EXPECT_MAX,
1892	.policy = exp_nla_policy },	1892	.policy = exp_nla_policy },
1893	[IPCTNL_MSG_EXP_NEW] = { .call = ctnetlink_new_expect,	1893	[IPCTNL_MSG_EXP_NEW] = { .call = ctnetlink_new_expect,
1894	.attr_count = CTA_EXPECT_MAX,	1894	.attr_count = CTA_EXPECT_MAX,
1895	.policy = exp_nla_policy },	1895	.policy = exp_nla_policy },
1896	[IPCTNL_MSG_EXP_DELETE] = { .call = ctnetlink_del_expect,	1896	[IPCTNL_MSG_EXP_DELETE] = { .call = ctnetlink_del_expect,
1897	.attr_count = CTA_EXPECT_MAX,	1897	.attr_count = CTA_EXPECT_MAX,
1898	.policy = exp_nla_policy },	1898	.policy = exp_nla_policy },
1899	};	1899	};
1900		1900
1901	static const struct nfnetlink_subsystem ctnl_subsys = {	1901	static const struct nfnetlink_subsystem ctnl_subsys = {
1902	.name = "conntrack",	1902	.name = "conntrack",
1903	.subsys_id = NFNL_SUBSYS_CTNETLINK,	1903	.subsys_id = NFNL_SUBSYS_CTNETLINK,
1904	.cb_count = IPCTNL_MSG_MAX,	1904	.cb_count = IPCTNL_MSG_MAX,
1905	.cb = ctnl_cb,	1905	.cb = ctnl_cb,
1906	};	1906	};
1907		1907
1908	static const struct nfnetlink_subsystem ctnl_exp_subsys = {	1908	static const struct nfnetlink_subsystem ctnl_exp_subsys = {
1909	.name = "conntrack_expect",	1909	.name = "conntrack_expect",
1910	.subsys_id = NFNL_SUBSYS_CTNETLINK_EXP,	1910	.subsys_id = NFNL_SUBSYS_CTNETLINK_EXP,
1911	.cb_count = IPCTNL_MSG_EXP_MAX,	1911	.cb_count = IPCTNL_MSG_EXP_MAX,
1912	.cb = ctnl_exp_cb,	1912	.cb = ctnl_exp_cb,
1913	};	1913	};
1914		1914
1915	MODULE_ALIAS("ip_conntrack_netlink");	1915	MODULE_ALIAS("ip_conntrack_netlink");
1916	MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK);	1916	MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK);
1917	MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_EXP);	1917	MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_EXP);
1918		1918
1919	static int __init ctnetlink_init(void)	1919	static int __init ctnetlink_init(void)
1920	{	1920	{
1921	int ret;	1921	int ret;
1922		1922
1923	printk("ctnetlink v%s: registering with nfnetlink.\n", version);	1923	printk("ctnetlink v%s: registering with nfnetlink.\n", version);
1924	ret = nfnetlink_subsys_register(&ctnl_subsys);	1924	ret = nfnetlink_subsys_register(&ctnl_subsys);
1925	if (ret < 0) {	1925	if (ret < 0) {
1926	printk("ctnetlink_init: cannot register with nfnetlink.\n");	1926	printk("ctnetlink_init: cannot register with nfnetlink.\n");
1927	goto err_out;	1927	goto err_out;
1928	}	1928	}
1929		1929
1930	ret = nfnetlink_subsys_register(&ctnl_exp_subsys);	1930	ret = nfnetlink_subsys_register(&ctnl_exp_subsys);
1931	if (ret < 0) {	1931	if (ret < 0) {
1932	printk("ctnetlink_init: cannot register exp with nfnetlink.\n");	1932	printk("ctnetlink_init: cannot register exp with nfnetlink.\n");
1933	goto err_unreg_subsys;	1933	goto err_unreg_subsys;
1934	}	1934	}
1935		1935
1936	#ifdef CONFIG_NF_CONNTRACK_EVENTS	1936	#ifdef CONFIG_NF_CONNTRACK_EVENTS
1937	ret = nf_conntrack_register_notifier(&ctnl_notifier);	1937	ret = nf_conntrack_register_notifier(&ctnl_notifier);
1938	if (ret < 0) {	1938	if (ret < 0) {
1939	printk("ctnetlink_init: cannot register notifier.\n");	1939	printk("ctnetlink_init: cannot register notifier.\n");
1940	goto err_unreg_exp_subsys;	1940	goto err_unreg_exp_subsys;
1941	}	1941	}
1942		1942
1943	ret = nf_ct_expect_register_notifier(&ctnl_notifier_exp);	1943	ret = nf_ct_expect_register_notifier(&ctnl_notifier_exp);
1944	if (ret < 0) {	1944	if (ret < 0) {
1945	printk("ctnetlink_init: cannot expect register notifier.\n");	1945	printk("ctnetlink_init: cannot expect register notifier.\n");
1946	goto err_unreg_notifier;	1946	goto err_unreg_notifier;
1947	}	1947	}
1948	#endif	1948	#endif
1949		1949
1950	return 0;	1950	return 0;
1951		1951
1952	#ifdef CONFIG_NF_CONNTRACK_EVENTS	1952	#ifdef CONFIG_NF_CONNTRACK_EVENTS
1953	err_unreg_notifier:	1953	err_unreg_notifier:
1954	nf_conntrack_unregister_notifier(&ctnl_notifier);	1954	nf_conntrack_unregister_notifier(&ctnl_notifier);
1955	err_unreg_exp_subsys:	1955	err_unreg_exp_subsys:
1956	nfnetlink_subsys_unregister(&ctnl_exp_subsys);	1956	nfnetlink_subsys_unregister(&ctnl_exp_subsys);
1957	#endif	1957	#endif
1958	err_unreg_subsys:	1958	err_unreg_subsys:
1959	nfnetlink_subsys_unregister(&ctnl_subsys);	1959	nfnetlink_subsys_unregister(&ctnl_subsys);
1960	err_out:	1960	err_out:
1961	return ret;	1961	return ret;
1962	}	1962	}
1963		1963
1964	static void __exit ctnetlink_exit(void)	1964	static void __exit ctnetlink_exit(void)
1965	{	1965	{
1966	printk("ctnetlink: unregistering from nfnetlink.\n");	1966	printk("ctnetlink: unregistering from nfnetlink.\n");
1967		1967
1968	#ifdef CONFIG_NF_CONNTRACK_EVENTS	1968	#ifdef CONFIG_NF_CONNTRACK_EVENTS
1969	nf_ct_expect_unregister_notifier(&ctnl_notifier_exp);	1969	nf_ct_expect_unregister_notifier(&ctnl_notifier_exp);
1970	nf_conntrack_unregister_notifier(&ctnl_notifier);	1970	nf_conntrack_unregister_notifier(&ctnl_notifier);
1971	#endif	1971	#endif
1972		1972
1973	nfnetlink_subsys_unregister(&ctnl_exp_subsys);	1973	nfnetlink_subsys_unregister(&ctnl_exp_subsys);
1974	nfnetlink_subsys_unregister(&ctnl_subsys);	1974	nfnetlink_subsys_unregister(&ctnl_subsys);
1975	return;	1975	return;
1976	}	1976	}
1977		1977
1978	module_init(ctnetlink_init);	1978	module_init(ctnetlink_init);
1979	module_exit(ctnetlink_exit);	1979	module_exit(ctnetlink_exit);
1980		1980

net/netfilter/nf_conntrack_proto_dccp.c

Diff comments View file @ 440f0d5

 /*
  * DCCP connection tracking protocol helper
  *
  * Copyright (c) 2005, 2006, 2008 Patrick McHardy <kaber@trash.net>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  *
  */
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/sysctl.h>
 #include <linux/spinlock.h>
 #include <linux/skbuff.h>
 #include <linux/dccp.h>
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
 #include <linux/netfilter/nfnetlink_conntrack.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_log.h>
-static DEFINE_RWLOCK(dccp_lock);
 /* Timeouts are based on values from RFC4340:
  *
  * - REQUEST:
  *
  *   8.1.2. Client Request
  *
  *   A client MAY give up on its DCCP-Requests after some time
  *   (3 minutes, for example).
  *
  * - RESPOND:
  *
  *   8.1.3. Server Response
  *
  *   It MAY also leave the RESPOND state for CLOSED after a timeout of
  *   not less than 4MSL (8 minutes);
  *
  * - PARTOPEN:
  *
  *   8.1.5. Handshake Completion
  *
  *   If the client remains in PARTOPEN for more than 4MSL (8 minutes),
  *   it SHOULD reset the connection with Reset Code 2, "Aborted".
  *
  * - OPEN:
  *
  *   The DCCP timestamp overflows after 11.9 hours. If the connection
  *   stays idle this long the sequence number won't be recognized
  *   as valid anymore.
  *
  * - CLOSEREQ/CLOSING:
  *
  *   8.3. Termination
  *
  *   The retransmission timer should initially be set to go off in two
  *   round-trip times and should back off to not less than once every
  *   64 seconds ...
  *
  * - TIMEWAIT:
  *
  *   4.3. States
  *
  *   A server or client socket remains in this state for 2MSL (4 minutes)
  *   after the connection has been town down, ...
  */
 #define DCCP_MSL (2 * 60 * HZ)
 static const char * const dccp_state_names[] = {
 	[CT_DCCP_NONE]		= "NONE",
 	[CT_DCCP_REQUEST]	= "REQUEST",
 	[CT_DCCP_RESPOND]	= "RESPOND",
 	[CT_DCCP_PARTOPEN]	= "PARTOPEN",
 	[CT_DCCP_OPEN]		= "OPEN",
 	[CT_DCCP_CLOSEREQ]	= "CLOSEREQ",
 	[CT_DCCP_CLOSING]	= "CLOSING",
 	[CT_DCCP_TIMEWAIT]	= "TIMEWAIT",
 	[CT_DCCP_IGNORE]	= "IGNORE",
 	[CT_DCCP_INVALID]	= "INVALID",
 };
 #define sNO	CT_DCCP_NONE
 #define sRQ	CT_DCCP_REQUEST
 #define sRS	CT_DCCP_RESPOND
 #define sPO	CT_DCCP_PARTOPEN
 #define sOP	CT_DCCP_OPEN
 #define sCR	CT_DCCP_CLOSEREQ
 #define sCG	CT_DCCP_CLOSING
 #define sTW	CT_DCCP_TIMEWAIT
 #define sIG	CT_DCCP_IGNORE
 #define sIV	CT_DCCP_INVALID
 /*
  * DCCP state transistion table
  *
  * The assumption is the same as for TCP tracking:
  *
  * We are the man in the middle. All the packets go through us but might
  * get lost in transit to the destination. It is assumed that the destination
  * can't receive segments we haven't seen.
  *
  * The following states exist:
  *
  * NONE:	Initial state, expecting Request
  * REQUEST:	Request seen, waiting for Response from server
  * RESPOND:	Response from server seen, waiting for Ack from client
  * PARTOPEN:	Ack after Response seen, waiting for packet other than Response,
  * 		Reset or Sync from server
  * OPEN:	Packet other than Response, Reset or Sync seen
  * CLOSEREQ:	CloseReq from server seen, expecting Close from client
  * CLOSING:	Close seen, expecting Reset
  * TIMEWAIT:	Reset seen
  * IGNORE:	Not determinable whether packet is valid
  *
  * Some states exist only on one side of the connection: REQUEST, RESPOND,
  * PARTOPEN, CLOSEREQ. For the other side these states are equivalent to
  * the one it was in before.
  *
  * Packets are marked as ignored (sIG) if we don't know if they're valid
  * (for example a reincarnation of a connection we didn't notice is dead
  * already) and the server may send back a connection closing Reset or a
  * Response. They're also used for Sync/SyncAck packets, which we don't
  * care about.
  */
 static const u_int8_t
 dccp_state_table[CT_DCCP_ROLE_MAX + 1][DCCP_PKT_SYNCACK + 1][CT_DCCP_MAX + 1] = {
 	[CT_DCCP_ROLE_CLIENT] = {
 		[DCCP_PKT_REQUEST] = {
 		/*
 		 * sNO -> sRQ		Regular Request
 		 * sRQ -> sRQ		Retransmitted Request or reincarnation
 		 * sRS -> sRS		Retransmitted Request (apparently Response
 		 * 			got lost after we saw it) or reincarnation
 		 * sPO -> sIG		Ignore, conntrack might be out of sync
 		 * sOP -> sIG		Ignore, conntrack might be out of sync
 		 * sCR -> sIG		Ignore, conntrack might be out of sync
 		 * sCG -> sIG		Ignore, conntrack might be out of sync
 		 * sTW -> sRQ		Reincarnation
 		 *
 		 *	sNO, sRQ, sRS, sPO. sOP, sCR, sCG, sTW, */
 			sRQ, sRQ, sRS, sIG, sIG, sIG, sIG, sRQ,
 		},
 		[DCCP_PKT_RESPONSE] = {
 		/*
 		 * sNO -> sIV		Invalid
 		 * sRQ -> sIG		Ignore, might be response to ignored Request
 		 * sRS -> sIG		Ignore, might be response to ignored Request
 		 * sPO -> sIG		Ignore, might be response to ignored Request
 		 * sOP -> sIG		Ignore, might be response to ignored Request
 		 * sCR -> sIG		Ignore, might be response to ignored Request
 		 * sCG -> sIG		Ignore, might be response to ignored Request
 		 * sTW -> sIV		Invalid, reincarnation in reverse direction
 		 *			goes through sRQ
 		 *
 		 *	sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
 			sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIV,
 		},
 		[DCCP_PKT_ACK] = {
 		/*
 		 * sNO -> sIV		No connection
 		 * sRQ -> sIV		No connection
 		 * sRS -> sPO		Ack for Response, move to PARTOPEN (8.1.5.)
 		 * sPO -> sPO		Retransmitted Ack for Response, remain in PARTOPEN
 		 * sOP -> sOP		Regular ACK, remain in OPEN
 		 * sCR -> sCR		Ack in CLOSEREQ MAY be processed (8.3.)
 		 * sCG -> sCG		Ack in CLOSING MAY be processed (8.3.)
 		 * sTW -> sIV
 		 *
 		 *	sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
 			sIV, sIV, sPO, sPO, sOP, sCR, sCG, sIV
 		},
 		[DCCP_PKT_DATA] = {
 		/*
 		 * sNO -> sIV		No connection
 		 * sRQ -> sIV		No connection
 		 * sRS -> sIV		No connection
 		 * sPO -> sIV		MUST use DataAck in PARTOPEN state (8.1.5.)
 		 * sOP -> sOP		Regular Data packet
 		 * sCR -> sCR		Data in CLOSEREQ MAY be processed (8.3.)
 		 * sCG -> sCG		Data in CLOSING MAY be processed (8.3.)
 		 * sTW -> sIV
 		 *
 		 *	sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
 			sIV, sIV, sIV, sIV, sOP, sCR, sCG, sIV,
 		},
 		[DCCP_PKT_DATAACK] = {
 		/*
 		 * sNO -> sIV		No connection
 		 * sRQ -> sIV		No connection
 		 * sRS -> sPO		Ack for Response, move to PARTOPEN (8.1.5.)
 		 * sPO -> sPO		Remain in PARTOPEN state
 		 * sOP -> sOP		Regular DataAck packet in OPEN state
 		 * sCR -> sCR		DataAck in CLOSEREQ MAY be processed (8.3.)
 		 * sCG -> sCG		DataAck in CLOSING MAY be processed (8.3.)
 		 * sTW -> sIV
 		 *
 		 *	sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
 			sIV, sIV, sPO, sPO, sOP, sCR, sCG, sIV
 		},
 		[DCCP_PKT_CLOSEREQ] = {
 		/*
 		 * CLOSEREQ may only be sent by the server.
 		 *
 		 *	sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
 			sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV
 		},
 		[DCCP_PKT_CLOSE] = {
 		/*
 		 * sNO -> sIV		No connection
 		 * sRQ -> sIV		No connection
 		 * sRS -> sIV		No connection
 		 * sPO -> sCG		Client-initiated close
 		 * sOP -> sCG		Client-initiated close
 		 * sCR -> sCG		Close in response to CloseReq (8.3.)
 		 * sCG -> sCG		Retransmit
 		 * sTW -> sIV		Late retransmit, already in TIME_WAIT
 		 *
 		 *	sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
 			sIV, sIV, sIV, sCG, sCG, sCG, sIV, sIV
 		},
 		[DCCP_PKT_RESET] = {
 		/*
 		 * sNO -> sIV		No connection
 		 * sRQ -> sTW		Sync received or timeout, SHOULD send Reset (8.1.1.)
 		 * sRS -> sTW		Response received without Request
 		 * sPO -> sTW		Timeout, SHOULD send Reset (8.1.5.)
 		 * sOP -> sTW		Connection reset
 		 * sCR -> sTW		Connection reset
 		 * sCG -> sTW		Connection reset
 		 * sTW -> sIG		Ignore (don't refresh timer)
 		 *
 		 *	sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
 			sIV, sTW, sTW, sTW, sTW, sTW, sTW, sIG
 		},
 		[DCCP_PKT_SYNC] = {
 		/*
 		 * We currently ignore Sync packets
 		 *
 		 *	sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
 			sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
 		},
 		[DCCP_PKT_SYNCACK] = {
 		/*
 		 * We currently ignore SyncAck packets
 		 *
 		 *	sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
 			sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
 		},
 	},
 	[CT_DCCP_ROLE_SERVER] = {
 		[DCCP_PKT_REQUEST] = {
 		/*
 		 * sNO -> sIV		Invalid
 		 * sRQ -> sIG		Ignore, conntrack might be out of sync
 		 * sRS -> sIG		Ignore, conntrack might be out of sync
 		 * sPO -> sIG		Ignore, conntrack might be out of sync
 		 * sOP -> sIG		Ignore, conntrack might be out of sync
 		 * sCR -> sIG		Ignore, conntrack might be out of sync
 		 * sCG -> sIG		Ignore, conntrack might be out of sync
 		 * sTW -> sRQ		Reincarnation, must reverse roles
 		 *
 		 *	sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
 			sIV, sIG, sIG, sIG, sIG, sIG, sIG, sRQ
 		},
 		[DCCP_PKT_RESPONSE] = {
 		/*
 		 * sNO -> sIV		Response without Request
 		 * sRQ -> sRS		Response to clients Request
 		 * sRS -> sRS		Retransmitted Response (8.1.3. SHOULD NOT)
 		 * sPO -> sIG		Response to an ignored Request or late retransmit
 		 * sOP -> sIG		Ignore, might be response to ignored Request
 		 * sCR -> sIG		Ignore, might be response to ignored Request
 		 * sCG -> sIG		Ignore, might be response to ignored Request
 		 * sTW -> sIV		Invalid, Request from client in sTW moves to sRQ
 		 *
 		 *	sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
 			sIV, sRS, sRS, sIG, sIG, sIG, sIG, sIV
 		},
 		[DCCP_PKT_ACK] = {
 		/*
 		 * sNO -> sIV		No connection
 		 * sRQ -> sIV		No connection
 		 * sRS -> sIV		No connection
 		 * sPO -> sOP		Enter OPEN state (8.1.5.)
 		 * sOP -> sOP		Regular Ack in OPEN state
 		 * sCR -> sIV		Waiting for Close from client
 		 * sCG -> sCG		Ack in CLOSING MAY be processed (8.3.)
 		 * sTW -> sIV
 		 *
 		 *	sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
 			sIV, sIV, sIV, sOP, sOP, sIV, sCG, sIV
 		},
 		[DCCP_PKT_DATA] = {
 		/*
 		 * sNO -> sIV		No connection
 		 * sRQ -> sIV		No connection
 		 * sRS -> sIV		No connection
 		 * sPO -> sOP		Enter OPEN state (8.1.5.)
 		 * sOP -> sOP		Regular Data packet in OPEN state
 		 * sCR -> sIV		Waiting for Close from client
 		 * sCG -> sCG		Data in CLOSING MAY be processed (8.3.)
 		 * sTW -> sIV
 		 *
 		 *	sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
 			sIV, sIV, sIV, sOP, sOP, sIV, sCG, sIV
 		},
 		[DCCP_PKT_DATAACK] = {
 		/*
 		 * sNO -> sIV		No connection
 		 * sRQ -> sIV		No connection
 		 * sRS -> sIV		No connection
 		 * sPO -> sOP		Enter OPEN state (8.1.5.)
 		 * sOP -> sOP		Regular DataAck in OPEN state
 		 * sCR -> sIV		Waiting for Close from client
 		 * sCG -> sCG		Data in CLOSING MAY be processed (8.3.)
 		 * sTW -> sIV
 		 *
 		 *	sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
 			sIV, sIV, sIV, sOP, sOP, sIV, sCG, sIV
 		},
 		[DCCP_PKT_CLOSEREQ] = {
 		/*
 		 * sNO -> sIV		No connection
 		 * sRQ -> sIV		No connection
 		 * sRS -> sIV		No connection
 		 * sPO -> sOP -> sCR	Move directly to CLOSEREQ (8.1.5.)
 		 * sOP -> sCR		CloseReq in OPEN state
 		 * sCR -> sCR		Retransmit
 		 * sCG -> sCR		Simultaneous close, client sends another Close
 		 * sTW -> sIV		Already closed
 		 *
 		 *	sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
 			sIV, sIV, sIV, sCR, sCR, sCR, sCR, sIV
 		},
 		[DCCP_PKT_CLOSE] = {
 		/*
 		 * sNO -> sIV		No connection
 		 * sRQ -> sIV		No connection
 		 * sRS -> sIV		No connection
 		 * sPO -> sOP -> sCG	Move direcly to CLOSING
 		 * sOP -> sCG		Move to CLOSING
 		 * sCR -> sIV		Close after CloseReq is invalid
 		 * sCG -> sCG		Retransmit
 		 * sTW -> sIV		Already closed
 		 *
 		 *	sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
 			sIV, sIV, sIV, sCG, sCG, sIV, sCG, sIV
 		},
 		[DCCP_PKT_RESET] = {
 		/*
 		 * sNO -> sIV		No connection
 		 * sRQ -> sTW		Reset in response to Request
 		 * sRS -> sTW		Timeout, SHOULD send Reset (8.1.3.)
 		 * sPO -> sTW		Timeout, SHOULD send Reset (8.1.3.)
 		 * sOP -> sTW
 		 * sCR -> sTW
 		 * sCG -> sTW
 		 * sTW -> sIG		Ignore (don't refresh timer)
 		 *
 		 *	sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW, sTW */
 			sIV, sTW, sTW, sTW, sTW, sTW, sTW, sTW, sIG
 		},
 		[DCCP_PKT_SYNC] = {
 		/*
 		 * We currently ignore Sync packets
 		 *
 		 *	sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
 			sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
 		},
 		[DCCP_PKT_SYNCACK] = {
 		/*
 		 * We currently ignore SyncAck packets
 		 *
 		 *	sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
 			sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
 		},
 	},
 };
 /* this module per-net specifics */
 static int dccp_net_id;
 struct dccp_net {
 	int dccp_loose;
 	unsigned int dccp_timeout[CT_DCCP_MAX + 1];
 #ifdef CONFIG_SYSCTL
 	struct ctl_table_header *sysctl_header;
 	struct ctl_table *sysctl_table;
 #endif
 };
 static inline struct dccp_net *dccp_pernet(struct net *net)
 {
 	return net_generic(net, dccp_net_id);
 }
 static bool dccp_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
 			      struct nf_conntrack_tuple *tuple)
 {
 	struct dccp_hdr _hdr, *dh;
 	dh = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr);
 	if (dh == NULL)
 		return false;
 	tuple->src.u.dccp.port = dh->dccph_sport;
 	tuple->dst.u.dccp.port = dh->dccph_dport;
 	return true;
 }
 static bool dccp_invert_tuple(struct nf_conntrack_tuple *inv,
 			      const struct nf_conntrack_tuple *tuple)
 {
 	inv->src.u.dccp.port = tuple->dst.u.dccp.port;
 	inv->dst.u.dccp.port = tuple->src.u.dccp.port;
 	return true;
 }
 static bool dccp_new(struct nf_conn *ct, const struct sk_buff *skb,
 		     unsigned int dataoff)
 {
 	struct net *net = nf_ct_net(ct);
 	struct dccp_net *dn;
 	struct dccp_hdr _dh, *dh;
 	const char *msg;
 	u_int8_t state;
 	dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &dh);
 	BUG_ON(dh == NULL);
 	state = dccp_state_table[CT_DCCP_ROLE_CLIENT][dh->dccph_type][CT_DCCP_NONE];
 	switch (state) {
 	default:
 		dn = dccp_pernet(net);
 		if (dn->dccp_loose == 0) {
 			msg = "nf_ct_dccp: not picking up existing connection ";
 			goto out_invalid;
 		}
 	case CT_DCCP_REQUEST:
 		break;
 	case CT_DCCP_INVALID:
 		msg = "nf_ct_dccp: invalid state transition ";
 		goto out_invalid;
 	}
 	ct->proto.dccp.role[IP_CT_DIR_ORIGINAL] = CT_DCCP_ROLE_CLIENT;
 	ct->proto.dccp.role[IP_CT_DIR_REPLY] = CT_DCCP_ROLE_SERVER;
 	ct->proto.dccp.state = CT_DCCP_NONE;
 	return true;
 out_invalid:
 	if (LOG_INVALID(net, IPPROTO_DCCP))
 		nf_log_packet(nf_ct_l3num(ct), 0, skb, NULL, NULL, NULL, msg);
 	return false;
 }
 static u64 dccp_ack_seq(const struct dccp_hdr *dh)
 {
 	const struct dccp_hdr_ack_bits *dhack;
 	dhack = (void *)dh + __dccp_basic_hdr_len(dh);
 	return ((u64)ntohs(dhack->dccph_ack_nr_high) << 32) +
 		     ntohl(dhack->dccph_ack_nr_low);
 }
 static int dccp_packet(struct nf_conn *ct, const struct sk_buff *skb,
 		       unsigned int dataoff, enum ip_conntrack_info ctinfo,
 		       u_int8_t pf, unsigned int hooknum)
 {
 	struct net *net = nf_ct_net(ct);
 	struct dccp_net *dn;
 	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 	struct dccp_hdr _dh, *dh;
 	u_int8_t type, old_state, new_state;
 	enum ct_dccp_roles role;
 	dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &dh);
 	BUG_ON(dh == NULL);
 	type = dh->dccph_type;
 	if (type == DCCP_PKT_RESET &&
 	    !test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
 		/* Tear down connection immediately if only reply is a RESET */
 		nf_ct_kill_acct(ct, ctinfo, skb);
 		return NF_ACCEPT;
 	}
-	write_lock_bh(&dccp_lock);
+	spin_lock_bh(&ct->lock);
 	role = ct->proto.dccp.role[dir];
 	old_state = ct->proto.dccp.state;
 	new_state = dccp_state_table[role][type][old_state];
 	switch (new_state) {
 	case CT_DCCP_REQUEST:
 		if (old_state == CT_DCCP_TIMEWAIT &&
 		    role == CT_DCCP_ROLE_SERVER) {
 			/* Reincarnation in the reverse direction: reopen and
 			 * reverse client/server roles. */
 			ct->proto.dccp.role[dir] = CT_DCCP_ROLE_CLIENT;
 			ct->proto.dccp.role[!dir] = CT_DCCP_ROLE_SERVER;
 		}
 		break;
 	case CT_DCCP_RESPOND:
 		if (old_state == CT_DCCP_REQUEST)
 			ct->proto.dccp.handshake_seq = dccp_hdr_seq(dh);
 		break;
 	case CT_DCCP_PARTOPEN:
 		if (old_state == CT_DCCP_RESPOND &&
 		    type == DCCP_PKT_ACK &&
 		    dccp_ack_seq(dh) == ct->proto.dccp.handshake_seq)
 			set_bit(IPS_ASSURED_BIT, &ct->status);
 		break;
 	case CT_DCCP_IGNORE:
 		/*
 		 * Connection tracking might be out of sync, so we ignore
 		 * packets that might establish a new connection and resync
 		 * if the server responds with a valid Response.
 		 */
 		if (ct->proto.dccp.last_dir == !dir &&
 		    ct->proto.dccp.last_pkt == DCCP_PKT_REQUEST &&
 		    type == DCCP_PKT_RESPONSE) {
 			ct->proto.dccp.role[!dir] = CT_DCCP_ROLE_CLIENT;
 			ct->proto.dccp.role[dir] = CT_DCCP_ROLE_SERVER;
 			ct->proto.dccp.handshake_seq = dccp_hdr_seq(dh);
 			new_state = CT_DCCP_RESPOND;
 			break;
 		}
 		ct->proto.dccp.last_dir = dir;
 		ct->proto.dccp.last_pkt = type;
-		write_unlock_bh(&dccp_lock);
+		spin_unlock_bh(&ct->lock);
 		if (LOG_INVALID(net, IPPROTO_DCCP))
 			nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 				      "nf_ct_dccp: invalid packet ignored ");
 		return NF_ACCEPT;
 	case CT_DCCP_INVALID:
-		write_unlock_bh(&dccp_lock);
+		spin_unlock_bh(&ct->lock);
 		if (LOG_INVALID(net, IPPROTO_DCCP))
 			nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 				      "nf_ct_dccp: invalid state transition ");
 		return -NF_ACCEPT;
 	}
 	ct->proto.dccp.last_dir = dir;
 	ct->proto.dccp.last_pkt = type;
 	ct->proto.dccp.state = new_state;
-	write_unlock_bh(&dccp_lock);
+	spin_unlock_bh(&ct->lock);
 	dn = dccp_pernet(net);
 	nf_ct_refresh_acct(ct, ctinfo, skb, dn->dccp_timeout[new_state]);
 	return NF_ACCEPT;
 }
 static int dccp_error(struct net *net, struct sk_buff *skb,
 		      unsigned int dataoff, enum ip_conntrack_info *ctinfo,
 		      u_int8_t pf, unsigned int hooknum)
 {
 	struct dccp_hdr _dh, *dh;
 	unsigned int dccp_len = skb->len - dataoff;
 	unsigned int cscov;
 	const char *msg;
 	dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &dh);
 	if (dh == NULL) {
 		msg = "nf_ct_dccp: short packet ";
 		goto out_invalid;
 	}
 	if (dh->dccph_doff * 4 < sizeof(struct dccp_hdr) ||
 	    dh->dccph_doff * 4 > dccp_len) {
 		msg = "nf_ct_dccp: truncated/malformed packet ";
 		goto out_invalid;
 	}
 	cscov = dccp_len;
 	if (dh->dccph_cscov) {
 		cscov = (dh->dccph_cscov - 1) * 4;
 		if (cscov > dccp_len) {
 			msg = "nf_ct_dccp: bad checksum coverage ";
 			goto out_invalid;
 		}
 	}
 	if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
 	    nf_checksum_partial(skb, hooknum, dataoff, cscov, IPPROTO_DCCP,
 				pf)) {
 		msg = "nf_ct_dccp: bad checksum ";
 		goto out_invalid;
 	}
 	if (dh->dccph_type >= DCCP_PKT_INVALID) {
 		msg = "nf_ct_dccp: reserved packet type ";
 		goto out_invalid;
 	}
 	return NF_ACCEPT;
 out_invalid:
 	if (LOG_INVALID(net, IPPROTO_DCCP))
 		nf_log_packet(pf, 0, skb, NULL, NULL, NULL, msg);
 	return -NF_ACCEPT;
 }
 static int dccp_print_tuple(struct seq_file *s,
 			    const struct nf_conntrack_tuple *tuple)
 {
 	return seq_printf(s, "sport=%hu dport=%hu ",
 			  ntohs(tuple->src.u.dccp.port),
 			  ntohs(tuple->dst.u.dccp.port));
 }
-static int dccp_print_conntrack(struct seq_file *s, const struct nf_conn *ct)
+static int dccp_print_conntrack(struct seq_file *s, struct nf_conn *ct)
 {
 	return seq_printf(s, "%s ", dccp_state_names[ct->proto.dccp.state]);
 }
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 static int dccp_to_nlattr(struct sk_buff *skb, struct nlattr *nla,
-			  const struct nf_conn *ct)
+			  struct nf_conn *ct)
 {
 	struct nlattr *nest_parms;
-	read_lock_bh(&dccp_lock);
+	spin_lock_bh(&ct->lock);
 	nest_parms = nla_nest_start(skb, CTA_PROTOINFO_DCCP | NLA_F_NESTED);
 	if (!nest_parms)
 		goto nla_put_failure;
 	NLA_PUT_U8(skb, CTA_PROTOINFO_DCCP_STATE, ct->proto.dccp.state);
 	NLA_PUT_U8(skb, CTA_PROTOINFO_DCCP_ROLE,
 		   ct->proto.dccp.role[IP_CT_DIR_ORIGINAL]);
 	NLA_PUT_BE64(skb, CTA_PROTOINFO_DCCP_HANDSHAKE_SEQ,
 		     cpu_to_be64(ct->proto.dccp.handshake_seq));
 	nla_nest_end(skb, nest_parms);
-	read_unlock_bh(&dccp_lock);
+	spin_unlock_bh(&ct->lock);
 	return 0;
 nla_put_failure:
-	read_unlock_bh(&dccp_lock);
+	spin_unlock_bh(&ct->lock);
 	return -1;
 }
 static const struct nla_policy dccp_nla_policy[CTA_PROTOINFO_DCCP_MAX + 1] = {
 	[CTA_PROTOINFO_DCCP_STATE]	= { .type = NLA_U8 },
 	[CTA_PROTOINFO_DCCP_ROLE]	= { .type = NLA_U8 },
 	[CTA_PROTOINFO_DCCP_HANDSHAKE_SEQ] = { .type = NLA_U64 },
 };
 static int nlattr_to_dccp(struct nlattr *cda[], struct nf_conn *ct)
 {
 	struct nlattr *attr = cda[CTA_PROTOINFO_DCCP];
 	struct nlattr *tb[CTA_PROTOINFO_DCCP_MAX + 1];
 	int err;
 	if (!attr)
 		return 0;
 	err = nla_parse_nested(tb, CTA_PROTOINFO_DCCP_MAX, attr,
 			       dccp_nla_policy);
 	if (err < 0)
 		return err;
 	if (!tb[CTA_PROTOINFO_DCCP_STATE] ||
 	    !tb[CTA_PROTOINFO_DCCP_ROLE] ||
 	    nla_get_u8(tb[CTA_PROTOINFO_DCCP_ROLE]) > CT_DCCP_ROLE_MAX ||
 	    nla_get_u8(tb[CTA_PROTOINFO_DCCP_STATE]) >= CT_DCCP_IGNORE) {
 		return -EINVAL;
 	}
-	write_lock_bh(&dccp_lock);
+	spin_lock_bh(&ct->lock);
 	ct->proto.dccp.state = nla_get_u8(tb[CTA_PROTOINFO_DCCP_STATE]);
 	if (nla_get_u8(tb[CTA_PROTOINFO_DCCP_ROLE]) == CT_DCCP_ROLE_CLIENT) {
 		ct->proto.dccp.role[IP_CT_DIR_ORIGINAL] = CT_DCCP_ROLE_CLIENT;
 		ct->proto.dccp.role[IP_CT_DIR_REPLY] = CT_DCCP_ROLE_SERVER;
 	} else {
 		ct->proto.dccp.role[IP_CT_DIR_ORIGINAL] = CT_DCCP_ROLE_SERVER;
 		ct->proto.dccp.role[IP_CT_DIR_REPLY] = CT_DCCP_ROLE_CLIENT;
 	}
 	if (tb[CTA_PROTOINFO_DCCP_HANDSHAKE_SEQ]) {
 		ct->proto.dccp.handshake_seq =
 		be64_to_cpu(nla_get_be64(tb[CTA_PROTOINFO_DCCP_HANDSHAKE_SEQ]));
 	}
-	write_unlock_bh(&dccp_lock);
+	spin_unlock_bh(&ct->lock);
 	return 0;
 }
 static int dccp_nlattr_size(void)
 {
 	return nla_total_size(0)	/* CTA_PROTOINFO_DCCP */
 		+ nla_policy_len(dccp_nla_policy, CTA_PROTOINFO_DCCP_MAX + 1);
 }
 #endif
 #ifdef CONFIG_SYSCTL
 /* template, data assigned later */
 static struct ctl_table dccp_sysctl_table[] = {
 	{
 		.ctl_name	= CTL_UNNUMBERED,
 		.procname	= "nf_conntrack_dccp_timeout_request",
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.ctl_name	= CTL_UNNUMBERED,
 		.procname	= "nf_conntrack_dccp_timeout_respond",
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.ctl_name	= CTL_UNNUMBERED,
 		.procname	= "nf_conntrack_dccp_timeout_partopen",
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.ctl_name	= CTL_UNNUMBERED,
 		.procname	= "nf_conntrack_dccp_timeout_open",
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.ctl_name	= CTL_UNNUMBERED,
 		.procname	= "nf_conntrack_dccp_timeout_closereq",
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.ctl_name	= CTL_UNNUMBERED,
 		.procname	= "nf_conntrack_dccp_timeout_closing",
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.ctl_name	= CTL_UNNUMBERED,
 		.procname	= "nf_conntrack_dccp_timeout_timewait",
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.ctl_name	= CTL_UNNUMBERED,
 		.procname	= "nf_conntrack_dccp_loose",
 		.maxlen		= sizeof(int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec,
 	},
 	{
 		.ctl_name	= 0,
 	}
 };
 #endif /* CONFIG_SYSCTL */
 static struct nf_conntrack_l4proto dccp_proto4 __read_mostly = {
 	.l3proto		= AF_INET,
 	.l4proto		= IPPROTO_DCCP,
 	.name			= "dccp",
 	.pkt_to_tuple		= dccp_pkt_to_tuple,
 	.invert_tuple		= dccp_invert_tuple,
 	.new			= dccp_new,
 	.packet			= dccp_packet,
 	.error			= dccp_error,
 	.print_tuple		= dccp_print_tuple,
 	.print_conntrack	= dccp_print_conntrack,
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 	.to_nlattr		= dccp_to_nlattr,
 	.nlattr_size		= dccp_nlattr_size,
 	.from_nlattr		= nlattr_to_dccp,
 	.tuple_to_nlattr	= nf_ct_port_tuple_to_nlattr,
 	.nlattr_tuple_size	= nf_ct_port_nlattr_tuple_size,
 	.nlattr_to_tuple	= nf_ct_port_nlattr_to_tuple,
 	.nla_policy		= nf_ct_port_nla_policy,
 #endif
 };
 static struct nf_conntrack_l4proto dccp_proto6 __read_mostly = {
 	.l3proto		= AF_INET6,
 	.l4proto		= IPPROTO_DCCP,
 	.name			= "dccp",
 	.pkt_to_tuple		= dccp_pkt_to_tuple,
 	.invert_tuple		= dccp_invert_tuple,
 	.new			= dccp_new,
 	.packet			= dccp_packet,
 	.error			= dccp_error,
 	.print_tuple		= dccp_print_tuple,
 	.print_conntrack	= dccp_print_conntrack,
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 	.to_nlattr		= dccp_to_nlattr,
 	.nlattr_size		= dccp_nlattr_size,
 	.from_nlattr		= nlattr_to_dccp,
 	.tuple_to_nlattr	= nf_ct_port_tuple_to_nlattr,
 	.nlattr_tuple_size	= nf_ct_port_nlattr_tuple_size,
 	.nlattr_to_tuple	= nf_ct_port_nlattr_to_tuple,
 	.nla_policy		= nf_ct_port_nla_policy,
 #endif
 };
 static __net_init int dccp_net_init(struct net *net)
 {
 	struct dccp_net *dn;
 	int err;
 	dn = kmalloc(sizeof(*dn), GFP_KERNEL);
 	if (!dn)
 		return -ENOMEM;
 	/* default values */
 	dn->dccp_loose = 1;
 	dn->dccp_timeout[CT_DCCP_REQUEST]	= 2 * DCCP_MSL;
 	dn->dccp_timeout[CT_DCCP_RESPOND]	= 4 * DCCP_MSL;
 	dn->dccp_timeout[CT_DCCP_PARTOPEN]	= 4 * DCCP_MSL;
 	dn->dccp_timeout[CT_DCCP_OPEN]		= 12 * 3600 * HZ;
 	dn->dccp_timeout[CT_DCCP_CLOSEREQ]	= 64 * HZ;
 	dn->dccp_timeout[CT_DCCP_CLOSING]	= 64 * HZ;
 	dn->dccp_timeout[CT_DCCP_TIMEWAIT]	= 2 * DCCP_MSL;
 	err = net_assign_generic(net, dccp_net_id, dn);
 	if (err)
 		goto out;
 #ifdef CONFIG_SYSCTL
 	err = -ENOMEM;
 	dn->sysctl_table = kmemdup(dccp_sysctl_table,
 			sizeof(dccp_sysctl_table), GFP_KERNEL);
 	if (!dn->sysctl_table)
 		goto out;
 	dn->sysctl_table[0].data = &dn->dccp_timeout[CT_DCCP_REQUEST];
 	dn->sysctl_table[1].data = &dn->dccp_timeout[CT_DCCP_RESPOND];
 	dn->sysctl_table[2].data = &dn->dccp_timeout[CT_DCCP_PARTOPEN];
 	dn->sysctl_table[3].data = &dn->dccp_timeout[CT_DCCP_OPEN];
 	dn->sysctl_table[4].data = &dn->dccp_timeout[CT_DCCP_CLOSEREQ];
 	dn->sysctl_table[5].data = &dn->dccp_timeout[CT_DCCP_CLOSING];
 	dn->sysctl_table[6].data = &dn->dccp_timeout[CT_DCCP_TIMEWAIT];
 	dn->sysctl_table[7].data = &dn->dccp_loose;
 	dn->sysctl_header = register_net_sysctl_table(net,
 			nf_net_netfilter_sysctl_path, dn->sysctl_table);
 	if (!dn->sysctl_header) {
 		kfree(dn->sysctl_table);
 		goto out;
 	}
 #endif
 	return 0;
 out:
 	kfree(dn);
 	return err;
 }
 static __net_exit void dccp_net_exit(struct net *net)
 {
 	struct dccp_net *dn = dccp_pernet(net);
 #ifdef CONFIG_SYSCTL
 	unregister_net_sysctl_table(dn->sysctl_header);
 	kfree(dn->sysctl_table);
 #endif
 	kfree(dn);
 	net_assign_generic(net, dccp_net_id, NULL);
 }
 static struct pernet_operations dccp_net_ops = {
 	.init = dccp_net_init,
 	.exit = dccp_net_exit,
 };
 static int __init nf_conntrack_proto_dccp_init(void)
 {
 	int err;
 	err = register_pernet_gen_subsys(&dccp_net_id, &dccp_net_ops);
 	if (err < 0)
 		goto err1;
 	err = nf_conntrack_l4proto_register(&dccp_proto4);
 	if (err < 0)
 		goto err2;
 	err = nf_conntrack_l4proto_register(&dccp_proto6);
 	if (err < 0)
 		goto err3;
 	return 0;
 err3:
 	nf_conntrack_l4proto_unregister(&dccp_proto4);
 err2:
 	unregister_pernet_gen_subsys(dccp_net_id, &dccp_net_ops);
 err1:
 	return err;
 }
 static void __exit nf_conntrack_proto_dccp_fini(void)
 {
 	unregister_pernet_gen_subsys(dccp_net_id, &dccp_net_ops);
 	nf_conntrack_l4proto_unregister(&dccp_proto6);
 	nf_conntrack_l4proto_unregister(&dccp_proto4);
 }
 module_init(nf_conntrack_proto_dccp_init);
 module_exit(nf_conntrack_proto_dccp_fini);
 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
 MODULE_DESCRIPTION("DCCP connection tracking protocol helper");
 MODULE_LICENSE("GPL");

net/netfilter/nf_conntrack_proto_gre.c

Diff comments View file @ 440f0d5

 /*
  * ip_conntrack_proto_gre.c - Version 3.0
  *
  * Connection tracking protocol helper module for GRE.
  *
  * GRE is a generic encapsulation protocol, which is generally not very
  * suited for NAT, as it has no protocol-specific part as port numbers.
  *
  * It has an optional key field, which may help us distinguishing two
  * connections between the same two hosts.
  *
  * GRE is defined in RFC 1701 and RFC 1702, as well as RFC 2784
  *
  * PPTP is built on top of a modified version of GRE, and has a mandatory
  * field called "CallID", which serves us for the same purpose as the key
  * field in plain GRE.
  *
  * Documentation about PPTP can be found in RFC 2637
  *
  * (C) 2000-2005 by Harald Welte <laforge@gnumonks.org>
  *
  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  *
  */
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/timer.h>
 #include <linux/list.h>
 #include <linux/seq_file.h>
 #include <linux/in.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
 #include <net/dst.h>
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
 #include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_core.h>
 #include <linux/netfilter/nf_conntrack_proto_gre.h>
 #include <linux/netfilter/nf_conntrack_pptp.h>
 #define GRE_TIMEOUT		(30 * HZ)
 #define GRE_STREAM_TIMEOUT	(180 * HZ)
 static int proto_gre_net_id;
 struct netns_proto_gre {
 	rwlock_t		keymap_lock;
 	struct list_head	keymap_list;
 };
 void nf_ct_gre_keymap_flush(struct net *net)
 {
 	struct netns_proto_gre *net_gre = net_generic(net, proto_gre_net_id);
 	struct nf_ct_gre_keymap *km, *tmp;
 	write_lock_bh(&net_gre->keymap_lock);
 	list_for_each_entry_safe(km, tmp, &net_gre->keymap_list, list) {
 		list_del(&km->list);
 		kfree(km);
 	}
 	write_unlock_bh(&net_gre->keymap_lock);
 }
 EXPORT_SYMBOL(nf_ct_gre_keymap_flush);
 static inline int gre_key_cmpfn(const struct nf_ct_gre_keymap *km,
 				const struct nf_conntrack_tuple *t)
 {
 	return km->tuple.src.l3num == t->src.l3num &&
 	       !memcmp(&km->tuple.src.u3, &t->src.u3, sizeof(t->src.u3)) &&
 	       !memcmp(&km->tuple.dst.u3, &t->dst.u3, sizeof(t->dst.u3)) &&
 	       km->tuple.dst.protonum == t->dst.protonum &&
 	       km->tuple.dst.u.all == t->dst.u.all;
 }
 /* look up the source key for a given tuple */
 static __be16 gre_keymap_lookup(struct net *net, struct nf_conntrack_tuple *t)
 {
 	struct netns_proto_gre *net_gre = net_generic(net, proto_gre_net_id);
 	struct nf_ct_gre_keymap *km;
 	__be16 key = 0;
 	read_lock_bh(&net_gre->keymap_lock);
 	list_for_each_entry(km, &net_gre->keymap_list, list) {
 		if (gre_key_cmpfn(km, t)) {
 			key = km->tuple.src.u.gre.key;
 			break;
 		}
 	}
 	read_unlock_bh(&net_gre->keymap_lock);
 	pr_debug("lookup src key 0x%x for ", key);
 	nf_ct_dump_tuple(t);
 	return key;
 }
 /* add a single keymap entry, associate with specified master ct */
 int nf_ct_gre_keymap_add(struct nf_conn *ct, enum ip_conntrack_dir dir,
 			 struct nf_conntrack_tuple *t)
 {
 	struct net *net = nf_ct_net(ct);
 	struct netns_proto_gre *net_gre = net_generic(net, proto_gre_net_id);
 	struct nf_conn_help *help = nfct_help(ct);
 	struct nf_ct_gre_keymap **kmp, *km;
 	kmp = &help->help.ct_pptp_info.keymap[dir];
 	if (*kmp) {
 		/* check whether it's a retransmission */
 		read_lock_bh(&net_gre->keymap_lock);
 		list_for_each_entry(km, &net_gre->keymap_list, list) {
 			if (gre_key_cmpfn(km, t) && km == *kmp) {
 				read_unlock_bh(&net_gre->keymap_lock);
 				return 0;
 			}
 		}
 		read_unlock_bh(&net_gre->keymap_lock);
 		pr_debug("trying to override keymap_%s for ct %p\n",
 			 dir == IP_CT_DIR_REPLY ? "reply" : "orig", ct);
 		return -EEXIST;
 	}
 	km = kmalloc(sizeof(*km), GFP_ATOMIC);
 	if (!km)
 		return -ENOMEM;
 	memcpy(&km->tuple, t, sizeof(*t));
 	*kmp = km;
 	pr_debug("adding new entry %p: ", km);
 	nf_ct_dump_tuple(&km->tuple);
 	write_lock_bh(&net_gre->keymap_lock);
 	list_add_tail(&km->list, &net_gre->keymap_list);
 	write_unlock_bh(&net_gre->keymap_lock);
 	return 0;
 }
 EXPORT_SYMBOL_GPL(nf_ct_gre_keymap_add);
 /* destroy the keymap entries associated with specified master ct */
 void nf_ct_gre_keymap_destroy(struct nf_conn *ct)
 {
 	struct net *net = nf_ct_net(ct);
 	struct netns_proto_gre *net_gre = net_generic(net, proto_gre_net_id);
 	struct nf_conn_help *help = nfct_help(ct);
 	enum ip_conntrack_dir dir;
 	pr_debug("entering for ct %p\n", ct);
 	write_lock_bh(&net_gre->keymap_lock);
 	for (dir = IP_CT_DIR_ORIGINAL; dir < IP_CT_DIR_MAX; dir++) {
 		if (help->help.ct_pptp_info.keymap[dir]) {
 			pr_debug("removing %p from list\n",
 				 help->help.ct_pptp_info.keymap[dir]);
 			list_del(&help->help.ct_pptp_info.keymap[dir]->list);
 			kfree(help->help.ct_pptp_info.keymap[dir]);
 			help->help.ct_pptp_info.keymap[dir] = NULL;
 		}
 	}
 	write_unlock_bh(&net_gre->keymap_lock);
 }
 EXPORT_SYMBOL_GPL(nf_ct_gre_keymap_destroy);
 /* PUBLIC CONNTRACK PROTO HELPER FUNCTIONS */
 /* invert gre part of tuple */
 static bool gre_invert_tuple(struct nf_conntrack_tuple *tuple,
 			     const struct nf_conntrack_tuple *orig)
 {
 	tuple->dst.u.gre.key = orig->src.u.gre.key;
 	tuple->src.u.gre.key = orig->dst.u.gre.key;
 	return true;
 }
 /* gre hdr info to tuple */
 static bool gre_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
 			     struct nf_conntrack_tuple *tuple)
 {
 	struct net *net = dev_net(skb->dev ? skb->dev : skb->dst->dev);
 	const struct gre_hdr_pptp *pgrehdr;
 	struct gre_hdr_pptp _pgrehdr;
 	__be16 srckey;
 	const struct gre_hdr *grehdr;
 	struct gre_hdr _grehdr;
 	/* first only delinearize old RFC1701 GRE header */
 	grehdr = skb_header_pointer(skb, dataoff, sizeof(_grehdr), &_grehdr);
 	if (!grehdr || grehdr->version != GRE_VERSION_PPTP) {
 		/* try to behave like "nf_conntrack_proto_generic" */
 		tuple->src.u.all = 0;
 		tuple->dst.u.all = 0;
 		return true;
 	}
 	/* PPTP header is variable length, only need up to the call_id field */
 	pgrehdr = skb_header_pointer(skb, dataoff, 8, &_pgrehdr);
 	if (!pgrehdr)
 		return true;
 	if (ntohs(grehdr->protocol) != GRE_PROTOCOL_PPTP) {
 		pr_debug("GRE_VERSION_PPTP but unknown proto\n");
 		return false;
 	}
 	tuple->dst.u.gre.key = pgrehdr->call_id;
 	srckey = gre_keymap_lookup(net, tuple);
 	tuple->src.u.gre.key = srckey;
 	return true;
 }
 /* print gre part of tuple */
 static int gre_print_tuple(struct seq_file *s,
 			   const struct nf_conntrack_tuple *tuple)
 {
 	return seq_printf(s, "srckey=0x%x dstkey=0x%x ",
 			  ntohs(tuple->src.u.gre.key),
 			  ntohs(tuple->dst.u.gre.key));
 }
 /* print private data for conntrack */
-static int gre_print_conntrack(struct seq_file *s,
+static int gre_print_conntrack(struct seq_file *s, struct nf_conn *ct)
-			       const struct nf_conn *ct)
 {
 	return seq_printf(s, "timeout=%u, stream_timeout=%u ",
 			  (ct->proto.gre.timeout / HZ),
 			  (ct->proto.gre.stream_timeout / HZ));
 }
 /* Returns verdict for packet, and may modify conntrack */
 static int gre_packet(struct nf_conn *ct,
 		      const struct sk_buff *skb,
 		      unsigned int dataoff,
 		      enum ip_conntrack_info ctinfo,
 		      u_int8_t pf,
 		      unsigned int hooknum)
 {
 	/* If we've seen traffic both ways, this is a GRE connection.
 	 * Extend timeout. */
 	if (ct->status & IPS_SEEN_REPLY) {
 		nf_ct_refresh_acct(ct, ctinfo, skb,
 				   ct->proto.gre.stream_timeout);
 		/* Also, more likely to be important, and not a probe. */
 		set_bit(IPS_ASSURED_BIT, &ct->status);
 		nf_conntrack_event_cache(IPCT_STATUS, ct);
 	} else
 		nf_ct_refresh_acct(ct, ctinfo, skb,
 				   ct->proto.gre.timeout);
 	return NF_ACCEPT;
 }
 /* Called when a new connection for this protocol found. */
 static bool gre_new(struct nf_conn *ct, const struct sk_buff *skb,
 		    unsigned int dataoff)
 {
 	pr_debug(": ");
 	nf_ct_dump_tuple(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
 	/* initialize to sane value.  Ideally a conntrack helper
 	 * (e.g. in case of pptp) is increasing them */
 	ct->proto.gre.stream_timeout = GRE_STREAM_TIMEOUT;
 	ct->proto.gre.timeout = GRE_TIMEOUT;
 	return true;
 }
 /* Called when a conntrack entry has already been removed from the hashes
  * and is about to be deleted from memory */
 static void gre_destroy(struct nf_conn *ct)
 {
 	struct nf_conn *master = ct->master;
 	pr_debug(" entering\n");
 	if (!master)
 		pr_debug("no master !?!\n");
 	else
 		nf_ct_gre_keymap_destroy(master);
 }
 /* protocol helper struct */
 static struct nf_conntrack_l4proto nf_conntrack_l4proto_gre4 __read_mostly = {
 	.l3proto	 = AF_INET,
 	.l4proto	 = IPPROTO_GRE,
 	.name		 = "gre",
 	.pkt_to_tuple	 = gre_pkt_to_tuple,
 	.invert_tuple	 = gre_invert_tuple,
 	.print_tuple	 = gre_print_tuple,
 	.print_conntrack = gre_print_conntrack,
 	.packet		 = gre_packet,
 	.new		 = gre_new,
 	.destroy	 = gre_destroy,
 	.me 		 = THIS_MODULE,
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 	.tuple_to_nlattr = nf_ct_port_tuple_to_nlattr,
 	.nlattr_tuple_size = nf_ct_port_nlattr_tuple_size,
 	.nlattr_to_tuple = nf_ct_port_nlattr_to_tuple,
 	.nla_policy	 = nf_ct_port_nla_policy,
 #endif
 };
 static int proto_gre_net_init(struct net *net)
 {
 	struct netns_proto_gre *net_gre;
 	int rv;
 	net_gre = kmalloc(sizeof(struct netns_proto_gre), GFP_KERNEL);
 	if (!net_gre)
 		return -ENOMEM;
 	rwlock_init(&net_gre->keymap_lock);
 	INIT_LIST_HEAD(&net_gre->keymap_list);
 	rv = net_assign_generic(net, proto_gre_net_id, net_gre);
 	if (rv < 0)
 		kfree(net_gre);
 	return rv;
 }
 static void proto_gre_net_exit(struct net *net)
 {
 	struct netns_proto_gre *net_gre = net_generic(net, proto_gre_net_id);
 	nf_ct_gre_keymap_flush(net);
 	kfree(net_gre);
 }
 static struct pernet_operations proto_gre_net_ops = {
 	.init = proto_gre_net_init,
 	.exit = proto_gre_net_exit,
 };
 static int __init nf_ct_proto_gre_init(void)
 {
 	int rv;
 	rv = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_gre4);
 	if (rv < 0)
 		return rv;
 	rv = register_pernet_gen_subsys(&proto_gre_net_id, &proto_gre_net_ops);
 	if (rv < 0)
 		nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_gre4);
 	return rv;
 }
 static void __exit nf_ct_proto_gre_fini(void)
 {
 	nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_gre4);
 	unregister_pernet_gen_subsys(proto_gre_net_id, &proto_gre_net_ops);
 }
 module_init(nf_ct_proto_gre_init);
 module_exit(nf_ct_proto_gre_fini);
 MODULE_LICENSE("GPL");

net/netfilter/nf_conntrack_proto_sctp.c

Diff comments View file @ 440f0d5

 /*
  * Connection tracking protocol helper module for SCTP.
  *
  * SCTP is defined in RFC 2960. References to various sections in this code
  * are to this RFC.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
 #include <linux/types.h>
 #include <linux/timer.h>
 #include <linux/netfilter.h>
 #include <linux/module.h>
 #include <linux/in.h>
 #include <linux/ip.h>
 #include <linux/sctp.h>
 #include <linux/string.h>
 #include <linux/seq_file.h>
 #include <linux/spinlock.h>
 #include <linux/interrupt.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_ecache.h>
-/* Protects ct->proto.sctp */
-static DEFINE_RWLOCK(sctp_lock);
 /* FIXME: Examine ipfilter's timeouts and conntrack transitions more
    closely.  They're more complex. --RR
    And so for me for SCTP :D -Kiran */
 static const char *const sctp_conntrack_names[] = {
 	"NONE",
 	"CLOSED",
 	"COOKIE_WAIT",
 	"COOKIE_ECHOED",
 	"ESTABLISHED",
 	"SHUTDOWN_SENT",
 	"SHUTDOWN_RECD",
 	"SHUTDOWN_ACK_SENT",
 };
 #define SECS  * HZ
 #define MINS  * 60 SECS
 #define HOURS * 60 MINS
 #define DAYS  * 24 HOURS
 static unsigned int sctp_timeouts[SCTP_CONNTRACK_MAX] __read_mostly = {
 	[SCTP_CONNTRACK_CLOSED]			= 10 SECS,
 	[SCTP_CONNTRACK_COOKIE_WAIT]		= 3 SECS,
 	[SCTP_CONNTRACK_COOKIE_ECHOED]		= 3 SECS,
 	[SCTP_CONNTRACK_ESTABLISHED]		= 5 DAYS,
 	[SCTP_CONNTRACK_SHUTDOWN_SENT]		= 300 SECS / 1000,
 	[SCTP_CONNTRACK_SHUTDOWN_RECD]		= 300 SECS / 1000,
 	[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT]	= 3 SECS,
 };
 #define sNO SCTP_CONNTRACK_NONE
 #define	sCL SCTP_CONNTRACK_CLOSED
 #define	sCW SCTP_CONNTRACK_COOKIE_WAIT
 #define	sCE SCTP_CONNTRACK_COOKIE_ECHOED
 #define	sES SCTP_CONNTRACK_ESTABLISHED
 #define	sSS SCTP_CONNTRACK_SHUTDOWN_SENT
 #define	sSR SCTP_CONNTRACK_SHUTDOWN_RECD
 #define	sSA SCTP_CONNTRACK_SHUTDOWN_ACK_SENT
 #define	sIV SCTP_CONNTRACK_MAX
 /*
 	These are the descriptions of the states:
 NOTE: These state names are tantalizingly similar to the states of an
 SCTP endpoint. But the interpretation of the states is a little different,
 considering that these are the states of the connection and not of an end
 point. Please note the subtleties. -Kiran
 NONE              - Nothing so far.
 COOKIE WAIT       - We have seen an INIT chunk in the original direction, or also
 		    an INIT_ACK chunk in the reply direction.
 COOKIE ECHOED     - We have seen a COOKIE_ECHO chunk in the original direction.
 ESTABLISHED       - We have seen a COOKIE_ACK in the reply direction.
 SHUTDOWN_SENT     - We have seen a SHUTDOWN chunk in the original direction.
 SHUTDOWN_RECD     - We have seen a SHUTDOWN chunk in the reply directoin.
 SHUTDOWN_ACK_SENT - We have seen a SHUTDOWN_ACK chunk in the direction opposite
 		    to that of the SHUTDOWN chunk.
 CLOSED            - We have seen a SHUTDOWN_COMPLETE chunk in the direction of
 		    the SHUTDOWN chunk. Connection is closed.
 */
 /* TODO
  - I have assumed that the first INIT is in the original direction.
  This messes things when an INIT comes in the reply direction in CLOSED
  state.
  - Check the error type in the reply dir before transitioning from
 cookie echoed to closed.
  - Sec 5.2.4 of RFC 2960
  - Multi Homing support.
 */
 /* SCTP conntrack state transitions */
 static const u8 sctp_conntracks[2][9][SCTP_CONNTRACK_MAX] = {
 	{
 /*	ORIGINAL	*/
 /*                  sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA */
 /* init         */ {sCW, sCW, sCW, sCE, sES, sSS, sSR, sSA},
 /* init_ack     */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA},
 /* abort        */ {sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL},
 /* shutdown     */ {sCL, sCL, sCW, sCE, sSS, sSS, sSR, sSA},
 /* shutdown_ack */ {sSA, sCL, sCW, sCE, sES, sSA, sSA, sSA},
 /* error        */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* Cant have Stale cookie*/
 /* cookie_echo  */ {sCL, sCL, sCE, sCE, sES, sSS, sSR, sSA},/* 5.2.4 - Big TODO */
 /* cookie_ack   */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* Cant come in orig dir */
 /* shutdown_comp*/ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sCL}
 	},
 	{
 /*	REPLY	*/
 /*                  sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA */
 /* init         */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* INIT in sCL Big TODO */
 /* init_ack     */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA},
 /* abort        */ {sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL},
 /* shutdown     */ {sIV, sCL, sCW, sCE, sSR, sSS, sSR, sSA},
 /* shutdown_ack */ {sIV, sCL, sCW, sCE, sES, sSA, sSA, sSA},
 /* error        */ {sIV, sCL, sCW, sCL, sES, sSS, sSR, sSA},
 /* cookie_echo  */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA},/* Cant come in reply dir */
 /* cookie_ack   */ {sIV, sCL, sCW, sES, sES, sSS, sSR, sSA},
 /* shutdown_comp*/ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sCL}
 	}
 };
 static bool sctp_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
 			      struct nf_conntrack_tuple *tuple)
 {
 	const struct sctphdr *hp;
 	struct sctphdr _hdr;
 	/* Actually only need first 8 bytes. */
 	hp = skb_header_pointer(skb, dataoff, 8, &_hdr);
 	if (hp == NULL)
 		return false;
 	tuple->src.u.sctp.port = hp->source;
 	tuple->dst.u.sctp.port = hp->dest;
 	return true;
 }
 static bool sctp_invert_tuple(struct nf_conntrack_tuple *tuple,
 			      const struct nf_conntrack_tuple *orig)
 {
 	tuple->src.u.sctp.port = orig->dst.u.sctp.port;
 	tuple->dst.u.sctp.port = orig->src.u.sctp.port;
 	return true;
 }
 /* Print out the per-protocol part of the tuple. */
 static int sctp_print_tuple(struct seq_file *s,
 			    const struct nf_conntrack_tuple *tuple)
 {
 	return seq_printf(s, "sport=%hu dport=%hu ",
 			  ntohs(tuple->src.u.sctp.port),
 			  ntohs(tuple->dst.u.sctp.port));
 }
 /* Print out the private part of the conntrack. */
-static int sctp_print_conntrack(struct seq_file *s, const struct nf_conn *ct)
+static int sctp_print_conntrack(struct seq_file *s, struct nf_conn *ct)
 {
 	enum sctp_conntrack state;
-	read_lock_bh(&sctp_lock);
+	spin_lock_bh(&ct->lock);
 	state = ct->proto.sctp.state;
-	read_unlock_bh(&sctp_lock);
+	spin_unlock_bh(&ct->lock);
 	return seq_printf(s, "%s ", sctp_conntrack_names[state]);
 }
 #define for_each_sctp_chunk(skb, sch, _sch, offset, dataoff, count)	\
 for ((offset) = (dataoff) + sizeof(sctp_sctphdr_t), (count) = 0;	\
 	(offset) < (skb)->len &&					\
 	((sch) = skb_header_pointer((skb), (offset), sizeof(_sch), &(_sch)));	\
 	(offset) += (ntohs((sch)->length) + 3) & ~3, (count)++)
 /* Some validity checks to make sure the chunks are fine */
 static int do_basic_checks(struct nf_conn *ct,
 			   const struct sk_buff *skb,
 			   unsigned int dataoff,
 			   unsigned long *map)
 {
 	u_int32_t offset, count;
 	sctp_chunkhdr_t _sch, *sch;
 	int flag;
 	flag = 0;
 	for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) {
 		pr_debug("Chunk Num: %d  Type: %d\n", count, sch->type);
 		if (sch->type == SCTP_CID_INIT ||
 		    sch->type == SCTP_CID_INIT_ACK ||
 		    sch->type == SCTP_CID_SHUTDOWN_COMPLETE)
 			flag = 1;
 		/*
 		 * Cookie Ack/Echo chunks not the first OR
 		 * Init / Init Ack / Shutdown compl chunks not the only chunks
 		 * OR zero-length.
 		 */
 		if (((sch->type == SCTP_CID_COOKIE_ACK ||
 		      sch->type == SCTP_CID_COOKIE_ECHO ||
 		      flag) &&
 		     count != 0) || !sch->length) {
 			pr_debug("Basic checks failed\n");
 			return 1;
 		}
 		if (map)
 			set_bit(sch->type, map);
 	}
 	pr_debug("Basic checks passed\n");
 	return count == 0;
 }
 static int sctp_new_state(enum ip_conntrack_dir dir,
 			  enum sctp_conntrack cur_state,
 			  int chunk_type)
 {
 	int i;
 	pr_debug("Chunk type: %d\n", chunk_type);
 	switch (chunk_type) {
 	case SCTP_CID_INIT:
 		pr_debug("SCTP_CID_INIT\n");
 		i = 0;
 		break;
 	case SCTP_CID_INIT_ACK:
 		pr_debug("SCTP_CID_INIT_ACK\n");
 		i = 1;
 		break;
 	case SCTP_CID_ABORT:
 		pr_debug("SCTP_CID_ABORT\n");
 		i = 2;
 		break;
 	case SCTP_CID_SHUTDOWN:
 		pr_debug("SCTP_CID_SHUTDOWN\n");
 		i = 3;
 		break;
 	case SCTP_CID_SHUTDOWN_ACK:
 		pr_debug("SCTP_CID_SHUTDOWN_ACK\n");
 		i = 4;
 		break;
 	case SCTP_CID_ERROR:
 		pr_debug("SCTP_CID_ERROR\n");
 		i = 5;
 		break;
 	case SCTP_CID_COOKIE_ECHO:
 		pr_debug("SCTP_CID_COOKIE_ECHO\n");
 		i = 6;
 		break;
 	case SCTP_CID_COOKIE_ACK:
 		pr_debug("SCTP_CID_COOKIE_ACK\n");
 		i = 7;
 		break;
 	case SCTP_CID_SHUTDOWN_COMPLETE:
 		pr_debug("SCTP_CID_SHUTDOWN_COMPLETE\n");
 		i = 8;
 		break;
 	default:
 		/* Other chunks like DATA, SACK, HEARTBEAT and
 		its ACK do not cause a change in state */
 		pr_debug("Unknown chunk type, Will stay in %s\n",
 			 sctp_conntrack_names[cur_state]);
 		return cur_state;
 	}
 	pr_debug("dir: %d   cur_state: %s  chunk_type: %d  new_state: %s\n",
 		 dir, sctp_conntrack_names[cur_state], chunk_type,
 		 sctp_conntrack_names[sctp_conntracks[dir][i][cur_state]]);
 	return sctp_conntracks[dir][i][cur_state];
 }
 /* Returns verdict for packet, or -NF_ACCEPT for invalid. */
 static int sctp_packet(struct nf_conn *ct,
 		       const struct sk_buff *skb,
 		       unsigned int dataoff,
 		       enum ip_conntrack_info ctinfo,
 		       u_int8_t pf,
 		       unsigned int hooknum)
 {
 	enum sctp_conntrack new_state, old_state;
 	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 	const struct sctphdr *sh;
 	struct sctphdr _sctph;
 	const struct sctp_chunkhdr *sch;
 	struct sctp_chunkhdr _sch;
 	u_int32_t offset, count;
 	unsigned long map[256 / sizeof(unsigned long)] = { 0 };
 	sh = skb_header_pointer(skb, dataoff, sizeof(_sctph), &_sctph);
 	if (sh == NULL)
 		goto out;
 	if (do_basic_checks(ct, skb, dataoff, map) != 0)
 		goto out;
 	/* Check the verification tag (Sec 8.5) */
 	if (!test_bit(SCTP_CID_INIT, map) &&
 	    !test_bit(SCTP_CID_SHUTDOWN_COMPLETE, map) &&
 	    !test_bit(SCTP_CID_COOKIE_ECHO, map) &&
 	    !test_bit(SCTP_CID_ABORT, map) &&
 	    !test_bit(SCTP_CID_SHUTDOWN_ACK, map) &&
 	    sh->vtag != ct->proto.sctp.vtag[dir]) {
 		pr_debug("Verification tag check failed\n");
 		goto out;
 	}
 	old_state = new_state = SCTP_CONNTRACK_NONE;
-	write_lock_bh(&sctp_lock);
+	spin_lock_bh(&ct->lock);
 	for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) {
 		/* Special cases of Verification tag check (Sec 8.5.1) */
 		if (sch->type == SCTP_CID_INIT) {
 			/* Sec 8.5.1 (A) */
 			if (sh->vtag != 0)
 				goto out_unlock;
 		} else if (sch->type == SCTP_CID_ABORT) {
 			/* Sec 8.5.1 (B) */
 			if (sh->vtag != ct->proto.sctp.vtag[dir] &&
 			    sh->vtag != ct->proto.sctp.vtag[!dir])
 				goto out_unlock;
 		} else if (sch->type == SCTP_CID_SHUTDOWN_COMPLETE) {
 			/* Sec 8.5.1 (C) */
 			if (sh->vtag != ct->proto.sctp.vtag[dir] &&
 			    sh->vtag != ct->proto.sctp.vtag[!dir] &&
 			    sch->flags & SCTP_CHUNK_FLAG_T)
 				goto out_unlock;
 		} else if (sch->type == SCTP_CID_COOKIE_ECHO) {
 			/* Sec 8.5.1 (D) */
 			if (sh->vtag != ct->proto.sctp.vtag[dir])
 				goto out_unlock;
 		}
 		old_state = ct->proto.sctp.state;
 		new_state = sctp_new_state(dir, old_state, sch->type);
 		/* Invalid */
 		if (new_state == SCTP_CONNTRACK_MAX) {
 			pr_debug("nf_conntrack_sctp: Invalid dir=%i ctype=%u "
 				 "conntrack=%u\n",
 				 dir, sch->type, old_state);
 			goto out_unlock;
 		}
 		/* If it is an INIT or an INIT ACK note down the vtag */
 		if (sch->type == SCTP_CID_INIT ||
 		    sch->type == SCTP_CID_INIT_ACK) {
 			sctp_inithdr_t _inithdr, *ih;
 			ih = skb_header_pointer(skb, offset + sizeof(sctp_chunkhdr_t),
 						sizeof(_inithdr), &_inithdr);
 			if (ih == NULL)
 				goto out_unlock;
 			pr_debug("Setting vtag %x for dir %d\n",
 				 ih->init_tag, !dir);
 			ct->proto.sctp.vtag[!dir] = ih->init_tag;
 		}
 		ct->proto.sctp.state = new_state;
 		if (old_state != new_state)
 			nf_conntrack_event_cache(IPCT_PROTOINFO, ct);
 	}
-	write_unlock_bh(&sctp_lock);
+	spin_unlock_bh(&ct->lock);
 	nf_ct_refresh_acct(ct, ctinfo, skb, sctp_timeouts[new_state]);
 	if (old_state == SCTP_CONNTRACK_COOKIE_ECHOED &&
 	    dir == IP_CT_DIR_REPLY &&
 	    new_state == SCTP_CONNTRACK_ESTABLISHED) {
 		pr_debug("Setting assured bit\n");
 		set_bit(IPS_ASSURED_BIT, &ct->status);
 		nf_conntrack_event_cache(IPCT_STATUS, ct);
 	}
 	return NF_ACCEPT;
 out_unlock:
-	write_unlock_bh(&sctp_lock);
+	spin_unlock_bh(&ct->lock);
 out:
 	return -NF_ACCEPT;
 }
 /* Called when a new connection for this protocol found. */
 static bool sctp_new(struct nf_conn *ct, const struct sk_buff *skb,
 		     unsigned int dataoff)
 {
 	enum sctp_conntrack new_state;
 	const struct sctphdr *sh;
 	struct sctphdr _sctph;
 	const struct sctp_chunkhdr *sch;
 	struct sctp_chunkhdr _sch;
 	u_int32_t offset, count;
 	unsigned long map[256 / sizeof(unsigned long)] = { 0 };
 	sh = skb_header_pointer(skb, dataoff, sizeof(_sctph), &_sctph);
 	if (sh == NULL)
 		return false;
 	if (do_basic_checks(ct, skb, dataoff, map) != 0)
 		return false;
 	/* If an OOTB packet has any of these chunks discard (Sec 8.4) */
 	if (test_bit(SCTP_CID_ABORT, map) ||
 	    test_bit(SCTP_CID_SHUTDOWN_COMPLETE, map) ||
 	    test_bit(SCTP_CID_COOKIE_ACK, map))
 		return false;
 	new_state = SCTP_CONNTRACK_MAX;
 	for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) {
 		/* Don't need lock here: this conntrack not in circulation yet */
 		new_state = sctp_new_state(IP_CT_DIR_ORIGINAL,
 					   SCTP_CONNTRACK_NONE, sch->type);
 		/* Invalid: delete conntrack */
 		if (new_state == SCTP_CONNTRACK_NONE ||
 		    new_state == SCTP_CONNTRACK_MAX) {
 			pr_debug("nf_conntrack_sctp: invalid new deleting.\n");
 			return false;
 		}
 		/* Copy the vtag into the state info */
 		if (sch->type == SCTP_CID_INIT) {
 			if (sh->vtag == 0) {
 				sctp_inithdr_t _inithdr, *ih;
 				ih = skb_header_pointer(skb, offset + sizeof(sctp_chunkhdr_t),
 							sizeof(_inithdr), &_inithdr);
 				if (ih == NULL)
 					return false;
 				pr_debug("Setting vtag %x for new conn\n",
 					 ih->init_tag);
 				ct->proto.sctp.vtag[IP_CT_DIR_REPLY] =
 								ih->init_tag;
 			} else {
 				/* Sec 8.5.1 (A) */
 				return false;
 			}
 		}
 		/* If it is a shutdown ack OOTB packet, we expect a return
 		   shutdown complete, otherwise an ABORT Sec 8.4 (5) and (8) */
 		else {
 			pr_debug("Setting vtag %x for new conn OOTB\n",
 				 sh->vtag);
 			ct->proto.sctp.vtag[IP_CT_DIR_REPLY] = sh->vtag;
 		}
 		ct->proto.sctp.state = new_state;
 	}
 	return true;
 }
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_conntrack.h>
 static int sctp_to_nlattr(struct sk_buff *skb, struct nlattr *nla,
-			  const struct nf_conn *ct)
+			  struct nf_conn *ct)
 {
 	struct nlattr *nest_parms;
-	read_lock_bh(&sctp_lock);
+	spin_lock_bh(&ct->lock);
 	nest_parms = nla_nest_start(skb, CTA_PROTOINFO_SCTP | NLA_F_NESTED);
 	if (!nest_parms)
 		goto nla_put_failure;
 	NLA_PUT_U8(skb, CTA_PROTOINFO_SCTP_STATE, ct->proto.sctp.state);
 	NLA_PUT_BE32(skb,
 		     CTA_PROTOINFO_SCTP_VTAG_ORIGINAL,
 		     ct->proto.sctp.vtag[IP_CT_DIR_ORIGINAL]);
 	NLA_PUT_BE32(skb,
 		     CTA_PROTOINFO_SCTP_VTAG_REPLY,
 		     ct->proto.sctp.vtag[IP_CT_DIR_REPLY]);
-	read_unlock_bh(&sctp_lock);
+	spin_unlock_bh(&ct->lock);
 	nla_nest_end(skb, nest_parms);
 	return 0;
 nla_put_failure:
-	read_unlock_bh(&sctp_lock);
+	spin_unlock_bh(&ct->lock);
 	return -1;
 }
 static const struct nla_policy sctp_nla_policy[CTA_PROTOINFO_SCTP_MAX+1] = {
 	[CTA_PROTOINFO_SCTP_STATE]	    = { .type = NLA_U8 },
 	[CTA_PROTOINFO_SCTP_VTAG_ORIGINAL]  = { .type = NLA_U32 },
 	[CTA_PROTOINFO_SCTP_VTAG_REPLY]     = { .type = NLA_U32 },
 };
 static int nlattr_to_sctp(struct nlattr *cda[], struct nf_conn *ct)
 {
 	struct nlattr *attr = cda[CTA_PROTOINFO_SCTP];
 	struct nlattr *tb[CTA_PROTOINFO_SCTP_MAX+1];
 	int err;
 	/* updates may not contain the internal protocol info, skip parsing */
 	if (!attr)
 		return 0;
 	err = nla_parse_nested(tb,
 			       CTA_PROTOINFO_SCTP_MAX,
 			       attr,
 			       sctp_nla_policy);
 	if (err < 0)
 		return err;
 	if (!tb[CTA_PROTOINFO_SCTP_STATE] ||
 	    !tb[CTA_PROTOINFO_SCTP_VTAG_ORIGINAL] ||
 	    !tb[CTA_PROTOINFO_SCTP_VTAG_REPLY])
 		return -EINVAL;
-	write_lock_bh(&sctp_lock);
+	spin_lock_bh(&ct->lock);
 	ct->proto.sctp.state = nla_get_u8(tb[CTA_PROTOINFO_SCTP_STATE]);
 	ct->proto.sctp.vtag[IP_CT_DIR_ORIGINAL] =
 		nla_get_be32(tb[CTA_PROTOINFO_SCTP_VTAG_ORIGINAL]);
 	ct->proto.sctp.vtag[IP_CT_DIR_REPLY] =
 		nla_get_be32(tb[CTA_PROTOINFO_SCTP_VTAG_REPLY]);
-	write_unlock_bh(&sctp_lock);
+	spin_unlock_bh(&ct->lock);
 	return 0;
 }
 static int sctp_nlattr_size(void)
 {
 	return nla_total_size(0)	/* CTA_PROTOINFO_SCTP */
 		+ nla_policy_len(sctp_nla_policy, CTA_PROTOINFO_SCTP_MAX + 1);
 }
 #endif
 #ifdef CONFIG_SYSCTL
 static unsigned int sctp_sysctl_table_users;
 static struct ctl_table_header *sctp_sysctl_header;
 static struct ctl_table sctp_sysctl_table[] = {
 	{
 		.procname	= "nf_conntrack_sctp_timeout_closed",
 		.data		= &sctp_timeouts[SCTP_CONNTRACK_CLOSED],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.procname	= "nf_conntrack_sctp_timeout_cookie_wait",
 		.data		= &sctp_timeouts[SCTP_CONNTRACK_COOKIE_WAIT],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.procname	= "nf_conntrack_sctp_timeout_cookie_echoed",
 		.data		= &sctp_timeouts[SCTP_CONNTRACK_COOKIE_ECHOED],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.procname	= "nf_conntrack_sctp_timeout_established",
 		.data		= &sctp_timeouts[SCTP_CONNTRACK_ESTABLISHED],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.procname	= "nf_conntrack_sctp_timeout_shutdown_sent",
 		.data		= &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_SENT],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.procname	= "nf_conntrack_sctp_timeout_shutdown_recd",
 		.data		= &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_RECD],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.procname	= "nf_conntrack_sctp_timeout_shutdown_ack_sent",
 		.data		= &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.ctl_name = 0
 	}
 };
 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
 static struct ctl_table sctp_compat_sysctl_table[] = {
 	{
 		.procname	= "ip_conntrack_sctp_timeout_closed",
 		.data		= &sctp_timeouts[SCTP_CONNTRACK_CLOSED],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.procname	= "ip_conntrack_sctp_timeout_cookie_wait",
 		.data		= &sctp_timeouts[SCTP_CONNTRACK_COOKIE_WAIT],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.procname	= "ip_conntrack_sctp_timeout_cookie_echoed",
 		.data		= &sctp_timeouts[SCTP_CONNTRACK_COOKIE_ECHOED],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.procname	= "ip_conntrack_sctp_timeout_established",
 		.data		= &sctp_timeouts[SCTP_CONNTRACK_ESTABLISHED],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.procname	= "ip_conntrack_sctp_timeout_shutdown_sent",
 		.data		= &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_SENT],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.procname	= "ip_conntrack_sctp_timeout_shutdown_recd",
 		.data		= &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_RECD],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.procname	= "ip_conntrack_sctp_timeout_shutdown_ack_sent",
 		.data		= &sctp_timeouts[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.ctl_name = 0
 	}
 };
 #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
 #endif
 static struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp4 __read_mostly = {
 	.l3proto		= PF_INET,
 	.l4proto 		= IPPROTO_SCTP,
 	.name 			= "sctp",
 	.pkt_to_tuple 		= sctp_pkt_to_tuple,
 	.invert_tuple 		= sctp_invert_tuple,
 	.print_tuple 		= sctp_print_tuple,
 	.print_conntrack	= sctp_print_conntrack,
 	.packet 		= sctp_packet,
 	.new 			= sctp_new,
 	.me 			= THIS_MODULE,
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 	.to_nlattr		= sctp_to_nlattr,
 	.nlattr_size		= sctp_nlattr_size,
 	.from_nlattr		= nlattr_to_sctp,
 	.tuple_to_nlattr	= nf_ct_port_tuple_to_nlattr,
 	.nlattr_tuple_size	= nf_ct_port_nlattr_tuple_size,
 	.nlattr_to_tuple	= nf_ct_port_nlattr_to_tuple,
 	.nla_policy		= nf_ct_port_nla_policy,
 #endif
 #ifdef CONFIG_SYSCTL
 	.ctl_table_users	= &sctp_sysctl_table_users,
 	.ctl_table_header	= &sctp_sysctl_header,
 	.ctl_table		= sctp_sysctl_table,
 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
 	.ctl_compat_table	= sctp_compat_sysctl_table,
 #endif
 #endif
 };
 static struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp6 __read_mostly = {
 	.l3proto		= PF_INET6,
 	.l4proto 		= IPPROTO_SCTP,
 	.name 			= "sctp",
 	.pkt_to_tuple 		= sctp_pkt_to_tuple,
 	.invert_tuple 		= sctp_invert_tuple,
 	.print_tuple 		= sctp_print_tuple,
 	.print_conntrack	= sctp_print_conntrack,
 	.packet 		= sctp_packet,
 	.new 			= sctp_new,
 	.me 			= THIS_MODULE,
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 	.to_nlattr		= sctp_to_nlattr,
 	.nlattr_size		= sctp_nlattr_size,
 	.from_nlattr		= nlattr_to_sctp,
 	.tuple_to_nlattr	= nf_ct_port_tuple_to_nlattr,
 	.nlattr_tuple_size	= nf_ct_port_nlattr_tuple_size,
 	.nlattr_to_tuple	= nf_ct_port_nlattr_to_tuple,
 	.nla_policy		= nf_ct_port_nla_policy,
 #endif
 #ifdef CONFIG_SYSCTL
 	.ctl_table_users	= &sctp_sysctl_table_users,
 	.ctl_table_header	= &sctp_sysctl_header,
 	.ctl_table		= sctp_sysctl_table,
 #endif
 };
 static int __init nf_conntrack_proto_sctp_init(void)
 {
 	int ret;
 	ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_sctp4);
 	if (ret) {
 		printk("nf_conntrack_l4proto_sctp4: protocol register failed\n");
 		goto out;
 	}
 	ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_sctp6);
 	if (ret) {
 		printk("nf_conntrack_l4proto_sctp6: protocol register failed\n");
 		goto cleanup_sctp4;
 	}
 	return ret;
  cleanup_sctp4:
 	nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp4);
  out:
 	return ret;
 }
 static void __exit nf_conntrack_proto_sctp_fini(void)
 {
 	nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp6);
 	nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp4);
 }
 module_init(nf_conntrack_proto_sctp_init);
 module_exit(nf_conntrack_proto_sctp_fini);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Kiran Kumar Immidi");
 MODULE_DESCRIPTION("Netfilter connection tracking protocol helper for SCTP");
 MODULE_ALIAS("ip_conntrack_proto_sctp");

net/netfilter/nf_conntrack_proto_tcp.c

Diff comments View file @ 440f0d5

 /* (C) 1999-2001 Paul `Rusty' Russell
  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
 #include <linux/types.h>
 #include <linux/timer.h>
 #include <linux/module.h>
 #include <linux/in.h>
 #include <linux/tcp.h>
 #include <linux/spinlock.h>
 #include <linux/skbuff.h>
 #include <linux/ipv6.h>
 #include <net/ip6_checksum.h>
 #include <asm/unaligned.h>
 #include <net/tcp.h>
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv4.h>
 #include <linux/netfilter_ipv6.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_ecache.h>
 #include <net/netfilter/nf_log.h>
 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
-/* Protects ct->proto.tcp */
-static DEFINE_RWLOCK(tcp_lock);
 /* "Be conservative in what you do,
     be liberal in what you accept from others."
     If it's non-zero, we mark only out of window RST segments as INVALID. */
 static int nf_ct_tcp_be_liberal __read_mostly = 0;
 /* If it is set to zero, we disable picking up already established
    connections. */
 static int nf_ct_tcp_loose __read_mostly = 1;
 /* Max number of the retransmitted packets without receiving an (acceptable)
    ACK from the destination. If this number is reached, a shorter timer
    will be started. */
 static int nf_ct_tcp_max_retrans __read_mostly = 3;
   /* FIXME: Examine ipfilter's timeouts and conntrack transitions more
      closely.  They're more complex. --RR */
 static const char *const tcp_conntrack_names[] = {
 	"NONE",
 	"SYN_SENT",
 	"SYN_RECV",
 	"ESTABLISHED",
 	"FIN_WAIT",
 	"CLOSE_WAIT",
 	"LAST_ACK",
 	"TIME_WAIT",
 	"CLOSE",
 	"SYN_SENT2",
 };
 #define SECS * HZ
 #define MINS * 60 SECS
 #define HOURS * 60 MINS
 #define DAYS * 24 HOURS
 /* RFC1122 says the R2 limit should be at least 100 seconds.
    Linux uses 15 packets as limit, which corresponds
    to ~13-30min depending on RTO. */
 static unsigned int nf_ct_tcp_timeout_max_retrans __read_mostly    =   5 MINS;
 static unsigned int nf_ct_tcp_timeout_unacknowledged __read_mostly =   5 MINS;
 static unsigned int tcp_timeouts[TCP_CONNTRACK_MAX] __read_mostly = {
 	[TCP_CONNTRACK_SYN_SENT]	= 2 MINS,
 	[TCP_CONNTRACK_SYN_RECV]	= 60 SECS,
 	[TCP_CONNTRACK_ESTABLISHED]	= 5 DAYS,
 	[TCP_CONNTRACK_FIN_WAIT]	= 2 MINS,
 	[TCP_CONNTRACK_CLOSE_WAIT]	= 60 SECS,
 	[TCP_CONNTRACK_LAST_ACK]	= 30 SECS,
 	[TCP_CONNTRACK_TIME_WAIT]	= 2 MINS,
 	[TCP_CONNTRACK_CLOSE]		= 10 SECS,
 	[TCP_CONNTRACK_SYN_SENT2]	= 2 MINS,
 };
 #define sNO TCP_CONNTRACK_NONE
 #define sSS TCP_CONNTRACK_SYN_SENT
 #define sSR TCP_CONNTRACK_SYN_RECV
 #define sES TCP_CONNTRACK_ESTABLISHED
 #define sFW TCP_CONNTRACK_FIN_WAIT
 #define sCW TCP_CONNTRACK_CLOSE_WAIT
 #define sLA TCP_CONNTRACK_LAST_ACK
 #define sTW TCP_CONNTRACK_TIME_WAIT
 #define sCL TCP_CONNTRACK_CLOSE
 #define sS2 TCP_CONNTRACK_SYN_SENT2
 #define sIV TCP_CONNTRACK_MAX
 #define sIG TCP_CONNTRACK_IGNORE
 /* What TCP flags are set from RST/SYN/FIN/ACK. */
 enum tcp_bit_set {
 	TCP_SYN_SET,
 	TCP_SYNACK_SET,
 	TCP_FIN_SET,
 	TCP_ACK_SET,
 	TCP_RST_SET,
 	TCP_NONE_SET,
 };
 /*
  * The TCP state transition table needs a few words...
  *
  * We are the man in the middle. All the packets go through us
  * but might get lost in transit to the destination.
  * It is assumed that the destinations can't receive segments
  * we haven't seen.
  *
  * The checked segment is in window, but our windows are *not*
  * equivalent with the ones of the sender/receiver. We always
  * try to guess the state of the current sender.
  *
  * The meaning of the states are:
  *
  * NONE:	initial state
  * SYN_SENT:	SYN-only packet seen
  * SYN_SENT2:	SYN-only packet seen from reply dir, simultaneous open
  * SYN_RECV:	SYN-ACK packet seen
  * ESTABLISHED:	ACK packet seen
  * FIN_WAIT:	FIN packet seen
  * CLOSE_WAIT:	ACK seen (after FIN)
  * LAST_ACK:	FIN seen (after FIN)
  * TIME_WAIT:	last ACK seen
  * CLOSE:	closed connection (RST)
  *
  * Packets marked as IGNORED (sIG):
  *	if they may be either invalid or valid
  *	and the receiver may send back a connection
  *	closing RST or a SYN/ACK.
  *
  * Packets marked as INVALID (sIV):
  *	if we regard them as truly invalid packets
  */
 static const u8 tcp_conntracks[2][6][TCP_CONNTRACK_MAX] = {
 	{
 /* ORIGINAL */
 /* 	     sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2	*/
 /*syn*/	   { sSS, sSS, sIG, sIG, sIG, sIG, sIG, sSS, sSS, sS2 },
 /*
  *	sNO -> sSS	Initialize a new connection
  *	sSS -> sSS	Retransmitted SYN
  *	sS2 -> sS2	Late retransmitted SYN
  *	sSR -> sIG
  *	sES -> sIG	Error: SYNs in window outside the SYN_SENT state
  *			are errors. Receiver will reply with RST
  *			and close the connection.
  *			Or we are not in sync and hold a dead connection.
  *	sFW -> sIG
  *	sCW -> sIG
  *	sLA -> sIG
  *	sTW -> sSS	Reopened connection (RFC 1122).
  *	sCL -> sSS
  */
 /* 	     sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2	*/
 /*synack*/ { sIV, sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG, sSR },
 /*
  *	sNO -> sIV	Too late and no reason to do anything
  *	sSS -> sIV	Client can't send SYN and then SYN/ACK
  *	sS2 -> sSR	SYN/ACK sent to SYN2 in simultaneous open
  *	sSR -> sIG
  *	sES -> sIG	Error: SYNs in window outside the SYN_SENT state
  *			are errors. Receiver will reply with RST
  *			and close the connection.
  *			Or we are not in sync and hold a dead connection.
  *	sFW -> sIG
  *	sCW -> sIG
  *	sLA -> sIG
  *	sTW -> sIG
  *	sCL -> sIG
  */
 /* 	     sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2	*/
 /*fin*/    { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
 /*
  *	sNO -> sIV	Too late and no reason to do anything...
  *	sSS -> sIV	Client migth not send FIN in this state:
  *			we enforce waiting for a SYN/ACK reply first.
  *	sS2 -> sIV
  *	sSR -> sFW	Close started.
  *	sES -> sFW
  *	sFW -> sLA	FIN seen in both directions, waiting for
  *			the last ACK.
  *			Migth be a retransmitted FIN as well...
  *	sCW -> sLA
  *	sLA -> sLA	Retransmitted FIN. Remain in the same state.
  *	sTW -> sTW
  *	sCL -> sCL
  */
 /* 	     sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2	*/
 /*ack*/	   { sES, sIV, sES, sES, sCW, sCW, sTW, sTW, sCL, sIV },
 /*
  *	sNO -> sES	Assumed.
  *	sSS -> sIV	ACK is invalid: we haven't seen a SYN/ACK yet.
  *	sS2 -> sIV
  *	sSR -> sES	Established state is reached.
  *	sES -> sES	:-)
  *	sFW -> sCW	Normal close request answered by ACK.
  *	sCW -> sCW
  *	sLA -> sTW	Last ACK detected.
  *	sTW -> sTW	Retransmitted last ACK. Remain in the same state.
  *	sCL -> sCL
  */
 /* 	     sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2	*/
 /*rst*/    { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL },
 /*none*/   { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
 	},
 	{
 /* REPLY */
 /* 	     sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2	*/
 /*syn*/	   { sIV, sS2, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sS2 },
 /*
  *	sNO -> sIV	Never reached.
  *	sSS -> sS2	Simultaneous open
  *	sS2 -> sS2	Retransmitted simultaneous SYN
  *	sSR -> sIV	Invalid SYN packets sent by the server
  *	sES -> sIV
  *	sFW -> sIV
  *	sCW -> sIV
  *	sLA -> sIV
  *	sTW -> sIV	Reopened connection, but server may not do it.
  *	sCL -> sIV
  */
 /* 	     sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2	*/
 /*synack*/ { sIV, sSR, sSR, sIG, sIG, sIG, sIG, sIG, sIG, sSR },
 /*
  *	sSS -> sSR	Standard open.
  *	sS2 -> sSR	Simultaneous open
  *	sSR -> sSR	Retransmitted SYN/ACK.
  *	sES -> sIG	Late retransmitted SYN/ACK?
  *	sFW -> sIG	Might be SYN/ACK answering ignored SYN
  *	sCW -> sIG
  *	sLA -> sIG
  *	sTW -> sIG
  *	sCL -> sIG
  */
 /* 	     sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2	*/
 /*fin*/    { sIV, sIV, sFW, sFW, sLA, sLA, sLA, sTW, sCL, sIV },
 /*
  *	sSS -> sIV	Server might not send FIN in this state.
  *	sS2 -> sIV
  *	sSR -> sFW	Close started.
  *	sES -> sFW
  *	sFW -> sLA	FIN seen in both directions.
  *	sCW -> sLA
  *	sLA -> sLA	Retransmitted FIN.
  *	sTW -> sTW
  *	sCL -> sCL
  */
 /* 	     sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2	*/
 /*ack*/	   { sIV, sIG, sSR, sES, sCW, sCW, sTW, sTW, sCL, sIG },
 /*
  *	sSS -> sIG	Might be a half-open connection.
  *	sS2 -> sIG
  *	sSR -> sSR	Might answer late resent SYN.
  *	sES -> sES	:-)
  *	sFW -> sCW	Normal close request answered by ACK.
  *	sCW -> sCW
  *	sLA -> sTW	Last ACK detected.
  *	sTW -> sTW	Retransmitted last ACK.
  *	sCL -> sCL
  */
 /* 	     sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2	*/
 /*rst*/    { sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL },
 /*none*/   { sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
 	}
 };
 static bool tcp_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
 			     struct nf_conntrack_tuple *tuple)
 {
 	const struct tcphdr *hp;
 	struct tcphdr _hdr;
 	/* Actually only need first 8 bytes. */
 	hp = skb_header_pointer(skb, dataoff, 8, &_hdr);
 	if (hp == NULL)
 		return false;
 	tuple->src.u.tcp.port = hp->source;
 	tuple->dst.u.tcp.port = hp->dest;
 	return true;
 }
 static bool tcp_invert_tuple(struct nf_conntrack_tuple *tuple,
 			     const struct nf_conntrack_tuple *orig)
 {
 	tuple->src.u.tcp.port = orig->dst.u.tcp.port;
 	tuple->dst.u.tcp.port = orig->src.u.tcp.port;
 	return true;
 }
 /* Print out the per-protocol part of the tuple. */
 static int tcp_print_tuple(struct seq_file *s,
 			   const struct nf_conntrack_tuple *tuple)
 {
 	return seq_printf(s, "sport=%hu dport=%hu ",
 			  ntohs(tuple->src.u.tcp.port),
 			  ntohs(tuple->dst.u.tcp.port));
 }
 /* Print out the private part of the conntrack. */
-static int tcp_print_conntrack(struct seq_file *s, const struct nf_conn *ct)
+static int tcp_print_conntrack(struct seq_file *s, struct nf_conn *ct)
 {
 	enum tcp_conntrack state;
-	read_lock_bh(&tcp_lock);
+	spin_lock_bh(&ct->lock);
 	state = ct->proto.tcp.state;
-	read_unlock_bh(&tcp_lock);
+	spin_unlock_bh(&ct->lock);
 	return seq_printf(s, "%s ", tcp_conntrack_names[state]);
 }
 static unsigned int get_conntrack_index(const struct tcphdr *tcph)
 {
 	if (tcph->rst) return TCP_RST_SET;
 	else if (tcph->syn) return (tcph->ack ? TCP_SYNACK_SET : TCP_SYN_SET);
 	else if (tcph->fin) return TCP_FIN_SET;
 	else if (tcph->ack) return TCP_ACK_SET;
 	else return TCP_NONE_SET;
 }
 /* TCP connection tracking based on 'Real Stateful TCP Packet Filtering
    in IP Filter' by Guido van Rooij.
    http://www.nluug.nl/events/sane2000/papers.html
    http://www.iae.nl/users/guido/papers/tcp_filtering.ps.gz
    The boundaries and the conditions are changed according to RFC793:
    the packet must intersect the window (i.e. segments may be
    after the right or before the left edge) and thus receivers may ACK
    segments after the right edge of the window.
 	td_maxend = max(sack + max(win,1)) seen in reply packets
 	td_maxwin = max(max(win, 1)) + (sack - ack) seen in sent packets
 	td_maxwin += seq + len - sender.td_maxend
 			if seq + len > sender.td_maxend
 	td_end    = max(seq + len) seen in sent packets
    I.   Upper bound for valid data:	seq <= sender.td_maxend
    II.  Lower bound for valid data:	seq + len >= sender.td_end - receiver.td_maxwin
    III.	Upper bound for valid (s)ack:   sack <= receiver.td_end
    IV.	Lower bound for valid (s)ack:	sack >= receiver.td_end - MAXACKWINDOW
    where sack is the highest right edge of sack block found in the packet
    or ack in the case of packet without SACK option.
    The upper bound limit for a valid (s)ack is not ignored -
    we doesn't have to deal with fragments.
 */
 static inline __u32 segment_seq_plus_len(__u32 seq,
 					 size_t len,
 					 unsigned int dataoff,
 					 const struct tcphdr *tcph)
 {
 	/* XXX Should I use payload length field in IP/IPv6 header ?
 	 * - YK */
 	return (seq + len - dataoff - tcph->doff*4
 		+ (tcph->syn ? 1 : 0) + (tcph->fin ? 1 : 0));
 }
 /* Fixme: what about big packets? */
 #define MAXACKWINCONST			66000
 #define MAXACKWINDOW(sender)						\
 	((sender)->td_maxwin > MAXACKWINCONST ? (sender)->td_maxwin	\
 					      : MAXACKWINCONST)
 /*
  * Simplified tcp_parse_options routine from tcp_input.c
  */
 static void tcp_options(const struct sk_buff *skb,
 			unsigned int dataoff,
 			const struct tcphdr *tcph,
 			struct ip_ct_tcp_state *state)
 {
 	unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
 	const unsigned char *ptr;
 	int length = (tcph->doff*4) - sizeof(struct tcphdr);
 	if (!length)
 		return;
 	ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr),
 				 length, buff);
 	BUG_ON(ptr == NULL);
 	state->td_scale =
 	state->flags = 0;
 	while (length > 0) {
 		int opcode=*ptr++;
 		int opsize;
 		switch (opcode) {
 		case TCPOPT_EOL:
 			return;
 		case TCPOPT_NOP:	/* Ref: RFC 793 section 3.1 */
 			length--;
 			continue;
 		default:
 			opsize=*ptr++;
 			if (opsize < 2) /* "silly options" */
 				return;
 			if (opsize > length)
 				break;	/* don't parse partial options */
 			if (opcode == TCPOPT_SACK_PERM
 			    && opsize == TCPOLEN_SACK_PERM)
 				state->flags |= IP_CT_TCP_FLAG_SACK_PERM;
 			else if (opcode == TCPOPT_WINDOW
 				 && opsize == TCPOLEN_WINDOW) {
 				state->td_scale = *(u_int8_t *)ptr;
 				if (state->td_scale > 14) {
 					/* See RFC1323 */
 					state->td_scale = 14;
 				}
 				state->flags |=
 					IP_CT_TCP_FLAG_WINDOW_SCALE;
 			}
 			ptr += opsize - 2;
 			length -= opsize;
 		}
 	}
 }
 static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
                      const struct tcphdr *tcph, __u32 *sack)
 {
 	unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
 	const unsigned char *ptr;
 	int length = (tcph->doff*4) - sizeof(struct tcphdr);
 	__u32 tmp;
 	if (!length)
 		return;
 	ptr = skb_header_pointer(skb, dataoff + sizeof(struct tcphdr),
 				 length, buff);
 	BUG_ON(ptr == NULL);
 	/* Fast path for timestamp-only option */
 	if (length == TCPOLEN_TSTAMP_ALIGNED*4
 	    && *(__be32 *)ptr == htonl((TCPOPT_NOP << 24)
 				       | (TCPOPT_NOP << 16)
 				       | (TCPOPT_TIMESTAMP << 8)
 				       | TCPOLEN_TIMESTAMP))
 		return;
 	while (length > 0) {
 		int opcode = *ptr++;
 		int opsize, i;
 		switch (opcode) {
 		case TCPOPT_EOL:
 			return;
 		case TCPOPT_NOP:	/* Ref: RFC 793 section 3.1 */
 			length--;
 			continue;
 		default:
 			opsize = *ptr++;
 			if (opsize < 2) /* "silly options" */
 				return;
 			if (opsize > length)
 				break;	/* don't parse partial options */
 			if (opcode == TCPOPT_SACK
 			    && opsize >= (TCPOLEN_SACK_BASE
 					  + TCPOLEN_SACK_PERBLOCK)
 			    && !((opsize - TCPOLEN_SACK_BASE)
 				 % TCPOLEN_SACK_PERBLOCK)) {
 				for (i = 0;
 				     i < (opsize - TCPOLEN_SACK_BASE);
 				     i += TCPOLEN_SACK_PERBLOCK) {
 					tmp = get_unaligned_be32((__be32 *)(ptr+i)+1);
 					if (after(tmp, *sack))
 						*sack = tmp;
 				}
 				return;
 			}
 			ptr += opsize - 2;
 			length -= opsize;
 		}
 	}
 }
 static bool tcp_in_window(const struct nf_conn *ct,
 			  struct ip_ct_tcp *state,
 			  enum ip_conntrack_dir dir,
 			  unsigned int index,
 			  const struct sk_buff *skb,
 			  unsigned int dataoff,
 			  const struct tcphdr *tcph,
 			  u_int8_t pf)
 {
 	struct net *net = nf_ct_net(ct);
 	struct ip_ct_tcp_state *sender = &state->seen[dir];
 	struct ip_ct_tcp_state *receiver = &state->seen[!dir];
 	const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
 	__u32 seq, ack, sack, end, win, swin;
 	bool res;
 	/*
 	 * Get the required data from the packet.
 	 */
 	seq = ntohl(tcph->seq);
 	ack = sack = ntohl(tcph->ack_seq);
 	win = ntohs(tcph->window);
 	end = segment_seq_plus_len(seq, skb->len, dataoff, tcph);
 	if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM)
 		tcp_sack(skb, dataoff, tcph, &sack);
 	pr_debug("tcp_in_window: START\n");
 	pr_debug("tcp_in_window: ");
 	nf_ct_dump_tuple(tuple);
 	pr_debug("seq=%u ack=%u sack=%u win=%u end=%u\n",
 		 seq, ack, sack, win, end);
 	pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
 		 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
 		 sender->td_end, sender->td_maxend, sender->td_maxwin,
 		 sender->td_scale,
 		 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
 		 receiver->td_scale);
 	if (sender->td_maxwin == 0) {
 		/*
 		 * Initialize sender data.
 		 */
 		if (tcph->syn) {
 			/*
 			 * SYN-ACK in reply to a SYN
 			 * or SYN from reply direction in simultaneous open.
 			 */
 			sender->td_end =
 			sender->td_maxend = end;
 			sender->td_maxwin = (win == 0 ? 1 : win);
 			tcp_options(skb, dataoff, tcph, sender);
 			/*
 			 * RFC 1323:
 			 * Both sides must send the Window Scale option
 			 * to enable window scaling in either direction.
 			 */
 			if (!(sender->flags & IP_CT_TCP_FLAG_WINDOW_SCALE
 			      && receiver->flags & IP_CT_TCP_FLAG_WINDOW_SCALE))
 				sender->td_scale =
 				receiver->td_scale = 0;
 			if (!tcph->ack)
 				/* Simultaneous open */
 				return true;
 		} else {
 			/*
 			 * We are in the middle of a connection,
 			 * its history is lost for us.
 			 * Let's try to use the data from the packet.
 			 */
 			sender->td_end = end;
 			sender->td_maxwin = (win == 0 ? 1 : win);
 			sender->td_maxend = end + sender->td_maxwin;
 		}
 	} else if (((state->state == TCP_CONNTRACK_SYN_SENT
 		     && dir == IP_CT_DIR_ORIGINAL)
 		   || (state->state == TCP_CONNTRACK_SYN_RECV
 		     && dir == IP_CT_DIR_REPLY))
 		   && after(end, sender->td_end)) {
 		/*
 		 * RFC 793: "if a TCP is reinitialized ... then it need
 		 * not wait at all; it must only be sure to use sequence
 		 * numbers larger than those recently used."
 		 */
 		sender->td_end =
 		sender->td_maxend = end;
 		sender->td_maxwin = (win == 0 ? 1 : win);
 		tcp_options(skb, dataoff, tcph, sender);
 	}
 	if (!(tcph->ack)) {
 		/*
 		 * If there is no ACK, just pretend it was set and OK.
 		 */
 		ack = sack = receiver->td_end;
 	} else if (((tcp_flag_word(tcph) & (TCP_FLAG_ACK|TCP_FLAG_RST)) ==
 		    (TCP_FLAG_ACK|TCP_FLAG_RST))
 		   && (ack == 0)) {
 		/*
 		 * Broken TCP stacks, that set ACK in RST packets as well
 		 * with zero ack value.
 		 */
 		ack = sack = receiver->td_end;
 	}
 	if (seq == end
 	    && (!tcph->rst
 		|| (seq == 0 && state->state == TCP_CONNTRACK_SYN_SENT)))
 		/*
 		 * Packets contains no data: we assume it is valid
 		 * and check the ack value only.
 		 * However RST segments are always validated by their
 		 * SEQ number, except when seq == 0 (reset sent answering
 		 * SYN.
 		 */
 		seq = end = sender->td_end;
 	pr_debug("tcp_in_window: ");
 	nf_ct_dump_tuple(tuple);
 	pr_debug("seq=%u ack=%u sack =%u win=%u end=%u\n",
 		 seq, ack, sack, win, end);
 	pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
 		 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
 		 sender->td_end, sender->td_maxend, sender->td_maxwin,
 		 sender->td_scale,
 		 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
 		 receiver->td_scale);
 	pr_debug("tcp_in_window: I=%i II=%i III=%i IV=%i\n",
 		 before(seq, sender->td_maxend + 1),
 		 after(end, sender->td_end - receiver->td_maxwin - 1),
 		 before(sack, receiver->td_end + 1),
 		 after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1));
 	if (before(seq, sender->td_maxend + 1) &&
 	    after(end, sender->td_end - receiver->td_maxwin - 1) &&
 	    before(sack, receiver->td_end + 1) &&
 	    after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1)) {
 		/*
 		 * Take into account window scaling (RFC 1323).
 		 */
 		if (!tcph->syn)
 			win <<= sender->td_scale;
 		/*
 		 * Update sender data.
 		 */
 		swin = win + (sack - ack);
 		if (sender->td_maxwin < swin)
 			sender->td_maxwin = swin;
 		if (after(end, sender->td_end)) {
 			sender->td_end = end;
 			sender->flags |= IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
 		}
 		/*
 		 * Update receiver data.
 		 */
 		if (after(end, sender->td_maxend))
 			receiver->td_maxwin += end - sender->td_maxend;
 		if (after(sack + win, receiver->td_maxend - 1)) {
 			receiver->td_maxend = sack + win;
 			if (win == 0)
 				receiver->td_maxend++;
 		}
 		if (ack == receiver->td_end)
 			receiver->flags &= ~IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
 		/*
 		 * Check retransmissions.
 		 */
 		if (index == TCP_ACK_SET) {
 			if (state->last_dir == dir
 			    && state->last_seq == seq
 			    && state->last_ack == ack
 			    && state->last_end == end
 			    && state->last_win == win)
 				state->retrans++;
 			else {
 				state->last_dir = dir;
 				state->last_seq = seq;
 				state->last_ack = ack;
 				state->last_end = end;
 				state->last_win = win;
 				state->retrans = 0;
 			}
 		}
 		res = true;
 	} else {
 		res = false;
 		if (sender->flags & IP_CT_TCP_FLAG_BE_LIBERAL ||
 		    nf_ct_tcp_be_liberal)
 			res = true;
 		if (!res && LOG_INVALID(net, IPPROTO_TCP))
 			nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 			"nf_ct_tcp: %s ",
 			before(seq, sender->td_maxend + 1) ?
 			after(end, sender->td_end - receiver->td_maxwin - 1) ?
 			before(sack, receiver->td_end + 1) ?
 			after(ack, receiver->td_end - MAXACKWINDOW(sender)) ? "BUG"
 			: "ACK is under the lower bound (possible overly delayed ACK)"
 			: "ACK is over the upper bound (ACKed data not seen yet)"
 			: "SEQ is under the lower bound (already ACKed data retransmitted)"
 			: "SEQ is over the upper bound (over the window of the receiver)");
 	}
 	pr_debug("tcp_in_window: res=%u sender end=%u maxend=%u maxwin=%u "
 		 "receiver end=%u maxend=%u maxwin=%u\n",
 		 res, sender->td_end, sender->td_maxend, sender->td_maxwin,
 		 receiver->td_end, receiver->td_maxend, receiver->td_maxwin);
 	return res;
 }
 #ifdef CONFIG_NF_NAT_NEEDED
 /* Update sender->td_end after NAT successfully mangled the packet */
 /* Caller must linearize skb at tcp header. */
 void nf_conntrack_tcp_update(const struct sk_buff *skb,
 			     unsigned int dataoff,
 			     struct nf_conn *ct,
 			     int dir)
 {
 	const struct tcphdr *tcph = (const void *)skb->data + dataoff;
 	const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[dir];
 	const struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[!dir];
 	__u32 end;
 	end = segment_seq_plus_len(ntohl(tcph->seq), skb->len, dataoff, tcph);
-	write_lock_bh(&tcp_lock);
+	spin_lock_bh(&ct->lock);
 	/*
 	 * We have to worry for the ack in the reply packet only...
 	 */
 	if (after(end, ct->proto.tcp.seen[dir].td_end))
 		ct->proto.tcp.seen[dir].td_end = end;
 	ct->proto.tcp.last_end = end;
-	write_unlock_bh(&tcp_lock);
+	spin_unlock_bh(&ct->lock);
 	pr_debug("tcp_update: sender end=%u maxend=%u maxwin=%u scale=%i "
 		 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
 		 sender->td_end, sender->td_maxend, sender->td_maxwin,
 		 sender->td_scale,
 		 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
 		 receiver->td_scale);
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_tcp_update);
 #endif
 #define	TH_FIN	0x01
 #define	TH_SYN	0x02
 #define	TH_RST	0x04
 #define	TH_PUSH	0x08
 #define	TH_ACK	0x10
 #define	TH_URG	0x20
 #define	TH_ECE	0x40
 #define	TH_CWR	0x80
 /* table of valid flag combinations - PUSH, ECE and CWR are always valid */
 static const u8 tcp_valid_flags[(TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG) + 1] =
 {
 	[TH_SYN]			= 1,
 	[TH_SYN|TH_URG]			= 1,
 	[TH_SYN|TH_ACK]			= 1,
 	[TH_RST]			= 1,
 	[TH_RST|TH_ACK]			= 1,
 	[TH_FIN|TH_ACK]			= 1,
 	[TH_FIN|TH_ACK|TH_URG]		= 1,
 	[TH_ACK]			= 1,
 	[TH_ACK|TH_URG]			= 1,
 };
 /* Protect conntrack agaist broken packets. Code taken from ipt_unclean.c.  */
 static int tcp_error(struct net *net,
 		     struct sk_buff *skb,
 		     unsigned int dataoff,
 		     enum ip_conntrack_info *ctinfo,
 		     u_int8_t pf,
 		     unsigned int hooknum)
 {
 	const struct tcphdr *th;
 	struct tcphdr _tcph;
 	unsigned int tcplen = skb->len - dataoff;
 	u_int8_t tcpflags;
 	/* Smaller that minimal TCP header? */
 	th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
 	if (th == NULL) {
 		if (LOG_INVALID(net, IPPROTO_TCP))
 			nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 				"nf_ct_tcp: short packet ");
 		return -NF_ACCEPT;
 	}
 	/* Not whole TCP header or malformed packet */
 	if (th->doff*4 < sizeof(struct tcphdr) || tcplen < th->doff*4) {
 		if (LOG_INVALID(net, IPPROTO_TCP))
 			nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 				"nf_ct_tcp: truncated/malformed packet ");
 		return -NF_ACCEPT;
 	}
 	/* Checksum invalid? Ignore.
 	 * We skip checking packets on the outgoing path
 	 * because the checksum is assumed to be correct.
 	 */
 	/* FIXME: Source route IP option packets --RR */
 	if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
 	    nf_checksum(skb, hooknum, dataoff, IPPROTO_TCP, pf)) {
 		if (LOG_INVALID(net, IPPROTO_TCP))
 			nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 				  "nf_ct_tcp: bad TCP checksum ");
 		return -NF_ACCEPT;
 	}
 	/* Check TCP flags. */
 	tcpflags = (((u_int8_t *)th)[13] & ~(TH_ECE|TH_CWR|TH_PUSH));
 	if (!tcp_valid_flags[tcpflags]) {
 		if (LOG_INVALID(net, IPPROTO_TCP))
 			nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 				  "nf_ct_tcp: invalid TCP flag combination ");
 		return -NF_ACCEPT;
 	}
 	return NF_ACCEPT;
 }
 /* Returns verdict for packet, or -1 for invalid. */
 static int tcp_packet(struct nf_conn *ct,
 		      const struct sk_buff *skb,
 		      unsigned int dataoff,
 		      enum ip_conntrack_info ctinfo,
 		      u_int8_t pf,
 		      unsigned int hooknum)
 {
 	struct net *net = nf_ct_net(ct);
 	struct nf_conntrack_tuple *tuple;
 	enum tcp_conntrack new_state, old_state;
 	enum ip_conntrack_dir dir;
 	const struct tcphdr *th;
 	struct tcphdr _tcph;
 	unsigned long timeout;
 	unsigned int index;
 	th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
 	BUG_ON(th == NULL);
-	write_lock_bh(&tcp_lock);
+	spin_lock_bh(&ct->lock);
 	old_state = ct->proto.tcp.state;
 	dir = CTINFO2DIR(ctinfo);
 	index = get_conntrack_index(th);
 	new_state = tcp_conntracks[dir][index][old_state];
 	tuple = &ct->tuplehash[dir].tuple;
 	switch (new_state) {
 	case TCP_CONNTRACK_SYN_SENT:
 		if (old_state < TCP_CONNTRACK_TIME_WAIT)
 			break;
 		/* RFC 1122: "When a connection is closed actively,
 		 * it MUST linger in TIME-WAIT state for a time 2xMSL
 		 * (Maximum Segment Lifetime). However, it MAY accept
 		 * a new SYN from the remote TCP to reopen the connection
 		 * directly from TIME-WAIT state, if..."
 		 * We ignore the conditions because we are in the
 		 * TIME-WAIT state anyway.
 		 *
 		 * Handle aborted connections: we and the server
 		 * think there is an existing connection but the client
 		 * aborts it and starts a new one.
 		 */
 		if (((ct->proto.tcp.seen[dir].flags
 		      | ct->proto.tcp.seen[!dir].flags)
 		     & IP_CT_TCP_FLAG_CLOSE_INIT)
 		    || (ct->proto.tcp.last_dir == dir
 		        && ct->proto.tcp.last_index == TCP_RST_SET)) {
 			/* Attempt to reopen a closed/aborted connection.
 			 * Delete this connection and look up again. */
-			write_unlock_bh(&tcp_lock);
+			spin_unlock_bh(&ct->lock);
 			/* Only repeat if we can actually remove the timer.
 			 * Destruction may already be in progress in process
 			 * context and we must give it a chance to terminate.
 			 */
 			if (nf_ct_kill(ct))
 				return -NF_REPEAT;
 			return NF_DROP;
 		}
 		/* Fall through */
 	case TCP_CONNTRACK_IGNORE:
 		/* Ignored packets:
 		 *
 		 * Our connection entry may be out of sync, so ignore
 		 * packets which may signal the real connection between
 		 * the client and the server.
 		 *
 		 * a) SYN in ORIGINAL
 		 * b) SYN/ACK in REPLY
 		 * c) ACK in reply direction after initial SYN in original.
 		 *
 		 * If the ignored packet is invalid, the receiver will send
 		 * a RST we'll catch below.
 		 */
 		if (index == TCP_SYNACK_SET
 		    && ct->proto.tcp.last_index == TCP_SYN_SET
 		    && ct->proto.tcp.last_dir != dir
 		    && ntohl(th->ack_seq) == ct->proto.tcp.last_end) {
 			/* b) This SYN/ACK acknowledges a SYN that we earlier
 			 * ignored as invalid. This means that the client and
 			 * the server are both in sync, while the firewall is
 			 * not. We kill this session and block the SYN/ACK so
 			 * that the client cannot but retransmit its SYN and
 			 * thus initiate a clean new session.
 			 */
-			write_unlock_bh(&tcp_lock);
+			spin_unlock_bh(&ct->lock);
 			if (LOG_INVALID(net, IPPROTO_TCP))
 				nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 					  "nf_ct_tcp: killing out of sync session ");
 			nf_ct_kill(ct);
 			return NF_DROP;
 		}
 		ct->proto.tcp.last_index = index;
 		ct->proto.tcp.last_dir = dir;
 		ct->proto.tcp.last_seq = ntohl(th->seq);
 		ct->proto.tcp.last_end =
 		    segment_seq_plus_len(ntohl(th->seq), skb->len, dataoff, th);
-		write_unlock_bh(&tcp_lock);
+		spin_unlock_bh(&ct->lock);
 		if (LOG_INVALID(net, IPPROTO_TCP))
 			nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 				  "nf_ct_tcp: invalid packet ignored ");
 		return NF_ACCEPT;
 	case TCP_CONNTRACK_MAX:
 		/* Invalid packet */
 		pr_debug("nf_ct_tcp: Invalid dir=%i index=%u ostate=%u\n",
 			 dir, get_conntrack_index(th), old_state);
-		write_unlock_bh(&tcp_lock);
+		spin_unlock_bh(&ct->lock);
 		if (LOG_INVALID(net, IPPROTO_TCP))
 			nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
 				  "nf_ct_tcp: invalid state ");
 		return -NF_ACCEPT;
 	case TCP_CONNTRACK_CLOSE:
 		if (index == TCP_RST_SET
 		    && ((test_bit(IPS_SEEN_REPLY_BIT, &ct->status)
 			 && ct->proto.tcp.last_index == TCP_SYN_SET)
 			|| (!test_bit(IPS_ASSURED_BIT, &ct->status)
 			    && ct->proto.tcp.last_index == TCP_ACK_SET))
 		    && ntohl(th->ack_seq) == ct->proto.tcp.last_end) {
 			/* RST sent to invalid SYN or ACK we had let through
 			 * at a) and c) above:
 			 *
 			 * a) SYN was in window then
 			 * c) we hold a half-open connection.
 			 *
 			 * Delete our connection entry.
 			 * We skip window checking, because packet might ACK
 			 * segments we ignored. */
 			goto in_window;
 		}
 		/* Just fall through */
 	default:
 		/* Keep compilers happy. */
 		break;
 	}
 	if (!tcp_in_window(ct, &ct->proto.tcp, dir, index,
 			   skb, dataoff, th, pf)) {
-		write_unlock_bh(&tcp_lock);
+		spin_unlock_bh(&ct->lock);
 		return -NF_ACCEPT;
 	}
      in_window:
 	/* From now on we have got in-window packets */
 	ct->proto.tcp.last_index = index;
 	ct->proto.tcp.last_dir = dir;
 	pr_debug("tcp_conntracks: ");
 	nf_ct_dump_tuple(tuple);
 	pr_debug("syn=%i ack=%i fin=%i rst=%i old=%i new=%i\n",
 		 (th->syn ? 1 : 0), (th->ack ? 1 : 0),
 		 (th->fin ? 1 : 0), (th->rst ? 1 : 0),
 		 old_state, new_state);
 	ct->proto.tcp.state = new_state;
 	if (old_state != new_state
 	    && new_state == TCP_CONNTRACK_FIN_WAIT)
 		ct->proto.tcp.seen[dir].flags |= IP_CT_TCP_FLAG_CLOSE_INIT;
 	if (ct->proto.tcp.retrans >= nf_ct_tcp_max_retrans &&
 	    tcp_timeouts[new_state] > nf_ct_tcp_timeout_max_retrans)
 		timeout = nf_ct_tcp_timeout_max_retrans;
 	else if ((ct->proto.tcp.seen[0].flags | ct->proto.tcp.seen[1].flags) &
 		 IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED &&
 		 tcp_timeouts[new_state] > nf_ct_tcp_timeout_unacknowledged)
 		timeout = nf_ct_tcp_timeout_unacknowledged;
 	else
 		timeout = tcp_timeouts[new_state];
-	write_unlock_bh(&tcp_lock);
+	spin_unlock_bh(&ct->lock);
 	if (new_state != old_state)
 		nf_conntrack_event_cache(IPCT_PROTOINFO, ct);
 	if (!test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
 		/* If only reply is a RST, we can consider ourselves not to
 		   have an established connection: this is a fairly common
 		   problem case, so we can delete the conntrack
 		   immediately.  --RR */
 		if (th->rst) {
 			nf_ct_kill_acct(ct, ctinfo, skb);
 			return NF_ACCEPT;
 		}
 	} else if (!test_bit(IPS_ASSURED_BIT, &ct->status)
 		   && (old_state == TCP_CONNTRACK_SYN_RECV
 		       || old_state == TCP_CONNTRACK_ESTABLISHED)
 		   && new_state == TCP_CONNTRACK_ESTABLISHED) {
 		/* Set ASSURED if we see see valid ack in ESTABLISHED
 		   after SYN_RECV or a valid answer for a picked up
 		   connection. */
 		set_bit(IPS_ASSURED_BIT, &ct->status);
 		nf_conntrack_event_cache(IPCT_STATUS, ct);
 	}
 	nf_ct_refresh_acct(ct, ctinfo, skb, timeout);
 	return NF_ACCEPT;
 }
 /* Called when a new connection for this protocol found. */
 static bool tcp_new(struct nf_conn *ct, const struct sk_buff *skb,
 		    unsigned int dataoff)
 {
 	enum tcp_conntrack new_state;
 	const struct tcphdr *th;
 	struct tcphdr _tcph;
 	const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[0];
 	const struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[1];
 	th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
 	BUG_ON(th == NULL);
 	/* Don't need lock here: this conntrack not in circulation yet */
 	new_state
 		= tcp_conntracks[0][get_conntrack_index(th)]
 		[TCP_CONNTRACK_NONE];
 	/* Invalid: delete conntrack */
 	if (new_state >= TCP_CONNTRACK_MAX) {
 		pr_debug("nf_ct_tcp: invalid new deleting.\n");
 		return false;
 	}
 	if (new_state == TCP_CONNTRACK_SYN_SENT) {
 		/* SYN packet */
 		ct->proto.tcp.seen[0].td_end =
 			segment_seq_plus_len(ntohl(th->seq), skb->len,
 					     dataoff, th);
 		ct->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
 		if (ct->proto.tcp.seen[0].td_maxwin == 0)
 			ct->proto.tcp.seen[0].td_maxwin = 1;
 		ct->proto.tcp.seen[0].td_maxend =
 			ct->proto.tcp.seen[0].td_end;
 		tcp_options(skb, dataoff, th, &ct->proto.tcp.seen[0]);
 		ct->proto.tcp.seen[1].flags = 0;
 	} else if (nf_ct_tcp_loose == 0) {
 		/* Don't try to pick up connections. */
 		return false;
 	} else {
 		/*
 		 * We are in the middle of a connection,
 		 * its history is lost for us.
 		 * Let's try to use the data from the packet.
 		 */
 		ct->proto.tcp.seen[0].td_end =
 			segment_seq_plus_len(ntohl(th->seq), skb->len,
 					     dataoff, th);
 		ct->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
 		if (ct->proto.tcp.seen[0].td_maxwin == 0)
 			ct->proto.tcp.seen[0].td_maxwin = 1;
 		ct->proto.tcp.seen[0].td_maxend =
 			ct->proto.tcp.seen[0].td_end +
 			ct->proto.tcp.seen[0].td_maxwin;
 		ct->proto.tcp.seen[0].td_scale = 0;
 		/* We assume SACK and liberal window checking to handle
 		 * window scaling */
 		ct->proto.tcp.seen[0].flags =
 		ct->proto.tcp.seen[1].flags = IP_CT_TCP_FLAG_SACK_PERM |
 					      IP_CT_TCP_FLAG_BE_LIBERAL;
 	}
 	ct->proto.tcp.seen[1].td_end = 0;
 	ct->proto.tcp.seen[1].td_maxend = 0;
 	ct->proto.tcp.seen[1].td_maxwin = 0;
 	ct->proto.tcp.seen[1].td_scale = 0;
 	/* tcp_packet will set them */
 	ct->proto.tcp.state = TCP_CONNTRACK_NONE;
 	ct->proto.tcp.last_index = TCP_NONE_SET;
 	pr_debug("tcp_new: sender end=%u maxend=%u maxwin=%u scale=%i "
 		 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
 		 sender->td_end, sender->td_maxend, sender->td_maxwin,
 		 sender->td_scale,
 		 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
 		 receiver->td_scale);
 	return true;
 }
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_conntrack.h>
 static int tcp_to_nlattr(struct sk_buff *skb, struct nlattr *nla,
-			 const struct nf_conn *ct)
+			 struct nf_conn *ct)
 {
 	struct nlattr *nest_parms;
 	struct nf_ct_tcp_flags tmp = {};
-	read_lock_bh(&tcp_lock);
+	spin_lock_bh(&ct->lock);
 	nest_parms = nla_nest_start(skb, CTA_PROTOINFO_TCP | NLA_F_NESTED);
 	if (!nest_parms)
 		goto nla_put_failure;
 	NLA_PUT_U8(skb, CTA_PROTOINFO_TCP_STATE, ct->proto.tcp.state);
 	NLA_PUT_U8(skb, CTA_PROTOINFO_TCP_WSCALE_ORIGINAL,
 		   ct->proto.tcp.seen[0].td_scale);
 	NLA_PUT_U8(skb, CTA_PROTOINFO_TCP_WSCALE_REPLY,
 		   ct->proto.tcp.seen[1].td_scale);
 	tmp.flags = ct->proto.tcp.seen[0].flags;
 	NLA_PUT(skb, CTA_PROTOINFO_TCP_FLAGS_ORIGINAL,
 		sizeof(struct nf_ct_tcp_flags), &tmp);
 	tmp.flags = ct->proto.tcp.seen[1].flags;
 	NLA_PUT(skb, CTA_PROTOINFO_TCP_FLAGS_REPLY,
 		sizeof(struct nf_ct_tcp_flags), &tmp);
-	read_unlock_bh(&tcp_lock);
+	spin_unlock_bh(&ct->lock);
 	nla_nest_end(skb, nest_parms);
 	return 0;
 nla_put_failure:
-	read_unlock_bh(&tcp_lock);
+	spin_unlock_bh(&ct->lock);
 	return -1;
 }
 static const struct nla_policy tcp_nla_policy[CTA_PROTOINFO_TCP_MAX+1] = {
 	[CTA_PROTOINFO_TCP_STATE]	    = { .type = NLA_U8 },
 	[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL] = { .type = NLA_U8 },
 	[CTA_PROTOINFO_TCP_WSCALE_REPLY]    = { .type = NLA_U8 },
 	[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]  = { .len = sizeof(struct nf_ct_tcp_flags) },
 	[CTA_PROTOINFO_TCP_FLAGS_REPLY]	    = { .len =  sizeof(struct nf_ct_tcp_flags) },
 };
 static int nlattr_to_tcp(struct nlattr *cda[], struct nf_conn *ct)
 {
 	struct nlattr *pattr = cda[CTA_PROTOINFO_TCP];
 	struct nlattr *tb[CTA_PROTOINFO_TCP_MAX+1];
 	int err;
 	/* updates could not contain anything about the private
 	 * protocol info, in that case skip the parsing */
 	if (!pattr)
 		return 0;
 	err = nla_parse_nested(tb, CTA_PROTOINFO_TCP_MAX, pattr, tcp_nla_policy);
 	if (err < 0)
 		return err;
 	if (tb[CTA_PROTOINFO_TCP_STATE] &&
 	    nla_get_u8(tb[CTA_PROTOINFO_TCP_STATE]) >= TCP_CONNTRACK_MAX)
 		return -EINVAL;
-	write_lock_bh(&tcp_lock);
+	spin_lock_bh(&ct->lock);
 	if (tb[CTA_PROTOINFO_TCP_STATE])
 		ct->proto.tcp.state = nla_get_u8(tb[CTA_PROTOINFO_TCP_STATE]);
 	if (tb[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]) {
 		struct nf_ct_tcp_flags *attr =
 			nla_data(tb[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]);
 		ct->proto.tcp.seen[0].flags &= ~attr->mask;
 		ct->proto.tcp.seen[0].flags |= attr->flags & attr->mask;
 	}
 	if (tb[CTA_PROTOINFO_TCP_FLAGS_REPLY]) {
 		struct nf_ct_tcp_flags *attr =
 			nla_data(tb[CTA_PROTOINFO_TCP_FLAGS_REPLY]);
 		ct->proto.tcp.seen[1].flags &= ~attr->mask;
 		ct->proto.tcp.seen[1].flags |= attr->flags & attr->mask;
 	}
 	if (tb[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL] &&
 	    tb[CTA_PROTOINFO_TCP_WSCALE_REPLY] &&
 	    ct->proto.tcp.seen[0].flags & IP_CT_TCP_FLAG_WINDOW_SCALE &&
 	    ct->proto.tcp.seen[1].flags & IP_CT_TCP_FLAG_WINDOW_SCALE) {
 		ct->proto.tcp.seen[0].td_scale =
 			nla_get_u8(tb[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL]);
 		ct->proto.tcp.seen[1].td_scale =
 			nla_get_u8(tb[CTA_PROTOINFO_TCP_WSCALE_REPLY]);
 	}
-	write_unlock_bh(&tcp_lock);
+	spin_unlock_bh(&ct->lock);
 	return 0;
 }
 static int tcp_nlattr_size(void)
 {
 	return nla_total_size(0)	   /* CTA_PROTOINFO_TCP */
 		+ nla_policy_len(tcp_nla_policy, CTA_PROTOINFO_TCP_MAX + 1);
 }
 static int tcp_nlattr_tuple_size(void)
 {
 	return nla_policy_len(nf_ct_port_nla_policy, CTA_PROTO_MAX + 1);
 }
 #endif
 #ifdef CONFIG_SYSCTL
 static unsigned int tcp_sysctl_table_users;
 static struct ctl_table_header *tcp_sysctl_header;
 static struct ctl_table tcp_sysctl_table[] = {
 	{
 		.procname	= "nf_conntrack_tcp_timeout_syn_sent",
 		.data		= &tcp_timeouts[TCP_CONNTRACK_SYN_SENT],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.procname	= "nf_conntrack_tcp_timeout_syn_recv",
 		.data		= &tcp_timeouts[TCP_CONNTRACK_SYN_RECV],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.procname	= "nf_conntrack_tcp_timeout_established",
 		.data		= &tcp_timeouts[TCP_CONNTRACK_ESTABLISHED],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.procname	= "nf_conntrack_tcp_timeout_fin_wait",
 		.data		= &tcp_timeouts[TCP_CONNTRACK_FIN_WAIT],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.procname	= "nf_conntrack_tcp_timeout_close_wait",
 		.data		= &tcp_timeouts[TCP_CONNTRACK_CLOSE_WAIT],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.procname	= "nf_conntrack_tcp_timeout_last_ack",
 		.data		= &tcp_timeouts[TCP_CONNTRACK_LAST_ACK],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.procname	= "nf_conntrack_tcp_timeout_time_wait",
 		.data		= &tcp_timeouts[TCP_CONNTRACK_TIME_WAIT],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.procname	= "nf_conntrack_tcp_timeout_close",
 		.data		= &tcp_timeouts[TCP_CONNTRACK_CLOSE],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.procname	= "nf_conntrack_tcp_timeout_max_retrans",
 		.data		= &nf_ct_tcp_timeout_max_retrans,
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.procname	= "nf_conntrack_tcp_timeout_unacknowledged",
 		.data		= &nf_ct_tcp_timeout_unacknowledged,
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.ctl_name	= NET_NF_CONNTRACK_TCP_LOOSE,
 		.procname	= "nf_conntrack_tcp_loose",
 		.data		= &nf_ct_tcp_loose,
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec,
 	},
 	{
 		.ctl_name	= NET_NF_CONNTRACK_TCP_BE_LIBERAL,
 		.procname       = "nf_conntrack_tcp_be_liberal",
 		.data           = &nf_ct_tcp_be_liberal,
 		.maxlen         = sizeof(unsigned int),
 		.mode           = 0644,
 		.proc_handler   = proc_dointvec,
 	},
 	{
 		.ctl_name	= NET_NF_CONNTRACK_TCP_MAX_RETRANS,
 		.procname	= "nf_conntrack_tcp_max_retrans",
 		.data		= &nf_ct_tcp_max_retrans,
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec,
 	},
 	{
 		.ctl_name	= 0
 	}
 };
 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
 static struct ctl_table tcp_compat_sysctl_table[] = {
 	{
 		.procname	= "ip_conntrack_tcp_timeout_syn_sent",
 		.data		= &tcp_timeouts[TCP_CONNTRACK_SYN_SENT],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.procname	= "ip_conntrack_tcp_timeout_syn_sent2",
 		.data		= &tcp_timeouts[TCP_CONNTRACK_SYN_SENT2],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.procname	= "ip_conntrack_tcp_timeout_syn_recv",
 		.data		= &tcp_timeouts[TCP_CONNTRACK_SYN_RECV],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.procname	= "ip_conntrack_tcp_timeout_established",
 		.data		= &tcp_timeouts[TCP_CONNTRACK_ESTABLISHED],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.procname	= "ip_conntrack_tcp_timeout_fin_wait",
 		.data		= &tcp_timeouts[TCP_CONNTRACK_FIN_WAIT],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.procname	= "ip_conntrack_tcp_timeout_close_wait",
 		.data		= &tcp_timeouts[TCP_CONNTRACK_CLOSE_WAIT],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.procname	= "ip_conntrack_tcp_timeout_last_ack",
 		.data		= &tcp_timeouts[TCP_CONNTRACK_LAST_ACK],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.procname	= "ip_conntrack_tcp_timeout_time_wait",
 		.data		= &tcp_timeouts[TCP_CONNTRACK_TIME_WAIT],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.procname	= "ip_conntrack_tcp_timeout_close",
 		.data		= &tcp_timeouts[TCP_CONNTRACK_CLOSE],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.procname	= "ip_conntrack_tcp_timeout_max_retrans",
 		.data		= &nf_ct_tcp_timeout_max_retrans,
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.ctl_name	= NET_IPV4_NF_CONNTRACK_TCP_LOOSE,
 		.procname	= "ip_conntrack_tcp_loose",
 		.data		= &nf_ct_tcp_loose,
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec,
 	},
 	{
 		.ctl_name	= NET_IPV4_NF_CONNTRACK_TCP_BE_LIBERAL,
 		.procname	= "ip_conntrack_tcp_be_liberal",
 		.data		= &nf_ct_tcp_be_liberal,
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec,
 	},
 	{
 		.ctl_name	= NET_IPV4_NF_CONNTRACK_TCP_MAX_RETRANS,
 		.procname	= "ip_conntrack_tcp_max_retrans",
 		.data		= &nf_ct_tcp_max_retrans,
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec,
 	},
 	{
 		.ctl_name	= 0
 	}
 };
 #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
 #endif /* CONFIG_SYSCTL */
 struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp4 __read_mostly =
 {
 	.l3proto		= PF_INET,
 	.l4proto 		= IPPROTO_TCP,
 	.name 			= "tcp",
 	.pkt_to_tuple 		= tcp_pkt_to_tuple,
 	.invert_tuple 		= tcp_invert_tuple,
 	.print_tuple 		= tcp_print_tuple,
 	.print_conntrack 	= tcp_print_conntrack,
 	.packet 		= tcp_packet,
 	.new 			= tcp_new,
 	.error			= tcp_error,
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 	.to_nlattr		= tcp_to_nlattr,
 	.nlattr_size		= tcp_nlattr_size,
 	.from_nlattr		= nlattr_to_tcp,
 	.tuple_to_nlattr	= nf_ct_port_tuple_to_nlattr,
 	.nlattr_to_tuple	= nf_ct_port_nlattr_to_tuple,
 	.nlattr_tuple_size	= tcp_nlattr_tuple_size,
 	.nla_policy		= nf_ct_port_nla_policy,
 #endif
 #ifdef CONFIG_SYSCTL
 	.ctl_table_users	= &tcp_sysctl_table_users,
 	.ctl_table_header	= &tcp_sysctl_header,
 	.ctl_table		= tcp_sysctl_table,
 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
 	.ctl_compat_table	= tcp_compat_sysctl_table,
 #endif
 #endif
 };
 EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_tcp4);
 struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp6 __read_mostly =
 {
 	.l3proto		= PF_INET6,
 	.l4proto 		= IPPROTO_TCP,
 	.name 			= "tcp",
 	.pkt_to_tuple 		= tcp_pkt_to_tuple,
 	.invert_tuple 		= tcp_invert_tuple,
 	.print_tuple 		= tcp_print_tuple,
 	.print_conntrack 	= tcp_print_conntrack,
 	.packet 		= tcp_packet,
 	.new 			= tcp_new,
 	.error			= tcp_error,
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 	.to_nlattr		= tcp_to_nlattr,
 	.nlattr_size		= tcp_nlattr_size,
 	.from_nlattr		= nlattr_to_tcp,
 	.tuple_to_nlattr	= nf_ct_port_tuple_to_nlattr,
 	.nlattr_to_tuple	= nf_ct_port_nlattr_to_tuple,
 	.nlattr_tuple_size	= tcp_nlattr_tuple_size,
 	.nla_policy		= nf_ct_port_nla_policy,
 #endif
 #ifdef CONFIG_SYSCTL
 	.ctl_table_users	= &tcp_sysctl_table_users,
 	.ctl_table_header	= &tcp_sysctl_header,
 	.ctl_table		= tcp_sysctl_table,
 #endif
 };
 EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_tcp6);

1	/*	1	/*
2	* Header for use in defining a given L4 protocol for connection tracking.	2	* Header for use in defining a given L4 protocol for connection tracking.
3	*	3	*
4	* 16 Dec 2003: Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp>	4	* 16 Dec 2003: Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp>
5	* - generalized L3 protocol dependent part.	5	* - generalized L3 protocol dependent part.
6	*	6	*
7	* Derived from include/linux/netfiter_ipv4/ip_conntrack_protcol.h	7	* Derived from include/linux/netfiter_ipv4/ip_conntrack_protcol.h
8	*/	8	*/
9		9
10	#ifndef _NF_CONNTRACK_L4PROTO_H	10	#ifndef _NF_CONNTRACK_L4PROTO_H
11	#define _NF_CONNTRACK_L4PROTO_H	11	#define _NF_CONNTRACK_L4PROTO_H
12	#include <linux/netlink.h>	12	#include <linux/netlink.h>
13	#include <net/netlink.h>	13	#include <net/netlink.h>
14	#include <net/netfilter/nf_conntrack.h>	14	#include <net/netfilter/nf_conntrack.h>
15		15
16	struct seq_file;	16	struct seq_file;
17		17
18	struct nf_conntrack_l4proto	18	struct nf_conntrack_l4proto
19	{	19	{
20	/* L3 Protocol number. */	20	/* L3 Protocol number. */
21	u_int16_t l3proto;	21	u_int16_t l3proto;
22		22
23	/* L4 Protocol number. */	23	/* L4 Protocol number. */
24	u_int8_t l4proto;	24	u_int8_t l4proto;
25		25
26	/* Try to fill in the third arg: dataoff is offset past network protocol	26	/* Try to fill in the third arg: dataoff is offset past network protocol
27	hdr. Return true if possible. */	27	hdr. Return true if possible. */
28	bool (pkt_to_tuple)(const struct sk_buff skb, unsigned int dataoff,	28	bool (pkt_to_tuple)(const struct sk_buff skb, unsigned int dataoff,
29	struct nf_conntrack_tuple *tuple);	29	struct nf_conntrack_tuple *tuple);
30		30
31	/* Invert the per-proto part of the tuple: ie. turn xmit into reply.	31	/* Invert the per-proto part of the tuple: ie. turn xmit into reply.
32	* Some packets can't be inverted: return 0 in that case.	32	* Some packets can't be inverted: return 0 in that case.
33	*/	33	*/
34	bool (invert_tuple)(struct nf_conntrack_tuple inverse,	34	bool (invert_tuple)(struct nf_conntrack_tuple inverse,
35	const struct nf_conntrack_tuple *orig);	35	const struct nf_conntrack_tuple *orig);
36		36
37	/* Returns verdict for packet, or -1 for invalid. */	37	/* Returns verdict for packet, or -1 for invalid. */
38	int (packet)(struct nf_conn ct,	38	int (packet)(struct nf_conn ct,
39	const struct sk_buff *skb,	39	const struct sk_buff *skb,
40	unsigned int dataoff,	40	unsigned int dataoff,
41	enum ip_conntrack_info ctinfo,	41	enum ip_conntrack_info ctinfo,
42	u_int8_t pf,	42	u_int8_t pf,
43	unsigned int hooknum);	43	unsigned int hooknum);
44		44
45	/* Called when a new connection for this protocol found;	45	/* Called when a new connection for this protocol found;
46	* returns TRUE if it's OK. If so, packet() called next. */	46	* returns TRUE if it's OK. If so, packet() called next. */
47	bool (new)(struct nf_conn ct, const struct sk_buff *skb,	47	bool (new)(struct nf_conn ct, const struct sk_buff *skb,
48	unsigned int dataoff);	48	unsigned int dataoff);
49		49
50	/* Called when a conntrack entry is destroyed */	50	/* Called when a conntrack entry is destroyed */
51	void (destroy)(struct nf_conn ct);	51	void (destroy)(struct nf_conn ct);
52		52
53	int (error)(struct net net, struct sk_buff *skb, unsigned int dataoff,	53	int (error)(struct net net, struct sk_buff *skb, unsigned int dataoff,
54	enum ip_conntrack_info *ctinfo,	54	enum ip_conntrack_info *ctinfo,
55	u_int8_t pf, unsigned int hooknum);	55	u_int8_t pf, unsigned int hooknum);
56		56
57	/* Print out the per-protocol part of the tuple. Return like seq_* */	57	/* Print out the per-protocol part of the tuple. Return like seq_* */
58	int (print_tuple)(struct seq_file s,	58	int (print_tuple)(struct seq_file s,
59	const struct nf_conntrack_tuple *);	59	const struct nf_conntrack_tuple *);
60		60
61	/* Print out the private part of the conntrack. */	61	/* Print out the private part of the conntrack. */
62	int (print_conntrack)(struct seq_file s, const struct nf_conn *);	62	int (print_conntrack)(struct seq_file s, struct nf_conn *);
63		63
64	/* convert protoinfo to nfnetink attributes */	64	/* convert protoinfo to nfnetink attributes */
65	int (to_nlattr)(struct sk_buff skb, struct nlattr *nla,	65	int (to_nlattr)(struct sk_buff skb, struct nlattr *nla,
66	const struct nf_conn *ct);	66	struct nf_conn *ct);
67	/* Calculate protoinfo nlattr size */	67	/* Calculate protoinfo nlattr size */
68	int (*nlattr_size)(void);	68	int (*nlattr_size)(void);
69		69
70	/* convert nfnetlink attributes to protoinfo */	70	/* convert nfnetlink attributes to protoinfo */
71	int (from_nlattr)(struct nlattr tb[], struct nf_conn *ct);	71	int (from_nlattr)(struct nlattr tb[], struct nf_conn *ct);
72		72
73	int (tuple_to_nlattr)(struct sk_buff skb,	73	int (tuple_to_nlattr)(struct sk_buff skb,
74	const struct nf_conntrack_tuple *t);	74	const struct nf_conntrack_tuple *t);
75	/* Calculate tuple nlattr size */	75	/* Calculate tuple nlattr size */
76	int (*nlattr_tuple_size)(void);	76	int (*nlattr_tuple_size)(void);
77	int (nlattr_to_tuple)(struct nlattr tb[],	77	int (nlattr_to_tuple)(struct nlattr tb[],
78	struct nf_conntrack_tuple *t);	78	struct nf_conntrack_tuple *t);
79	const struct nla_policy *nla_policy;	79	const struct nla_policy *nla_policy;
80		80
81	size_t nla_size;	81	size_t nla_size;
82		82
83	#ifdef CONFIG_SYSCTL	83	#ifdef CONFIG_SYSCTL
84	struct ctl_table_header **ctl_table_header;	84	struct ctl_table_header **ctl_table_header;
85	struct ctl_table *ctl_table;	85	struct ctl_table *ctl_table;
86	unsigned int *ctl_table_users;	86	unsigned int *ctl_table_users;
87	#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT	87	#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
88	struct ctl_table_header *ctl_compat_table_header;	88	struct ctl_table_header *ctl_compat_table_header;
89	struct ctl_table *ctl_compat_table;	89	struct ctl_table *ctl_compat_table;
90	#endif	90	#endif
91	#endif	91	#endif
92	/* Protocol name */	92	/* Protocol name */
93	const char *name;	93	const char *name;
94		94
95	/* Module (if any) which this is connected to. */	95	/* Module (if any) which this is connected to. */
96	struct module *me;	96	struct module *me;
97	};	97	};
98		98
99	/* Existing built-in generic protocol */	99	/* Existing built-in generic protocol */
100	extern struct nf_conntrack_l4proto nf_conntrack_l4proto_generic;	100	extern struct nf_conntrack_l4proto nf_conntrack_l4proto_generic;
101		101
102	#define MAX_NF_CT_PROTO 256	102	#define MAX_NF_CT_PROTO 256
103		103
104	extern struct nf_conntrack_l4proto *	104	extern struct nf_conntrack_l4proto *
105	__nf_ct_l4proto_find(u_int16_t l3proto, u_int8_t l4proto);	105	__nf_ct_l4proto_find(u_int16_t l3proto, u_int8_t l4proto);
106		106
107	/* Protocol registration. */	107	/* Protocol registration. */
108	extern int nf_conntrack_l4proto_register(struct nf_conntrack_l4proto *proto);	108	extern int nf_conntrack_l4proto_register(struct nf_conntrack_l4proto *proto);
109	extern void nf_conntrack_l4proto_unregister(struct nf_conntrack_l4proto *proto);	109	extern void nf_conntrack_l4proto_unregister(struct nf_conntrack_l4proto *proto);
110		110
111	/* Generic netlink helpers */	111	/* Generic netlink helpers */
112	extern int nf_ct_port_tuple_to_nlattr(struct sk_buff *skb,	112	extern int nf_ct_port_tuple_to_nlattr(struct sk_buff *skb,
113	const struct nf_conntrack_tuple *tuple);	113	const struct nf_conntrack_tuple *tuple);
114	extern int nf_ct_port_nlattr_to_tuple(struct nlattr *tb[],	114	extern int nf_ct_port_nlattr_to_tuple(struct nlattr *tb[],
115	struct nf_conntrack_tuple *t);	115	struct nf_conntrack_tuple *t);
116	extern int nf_ct_port_nlattr_tuple_size(void);	116	extern int nf_ct_port_nlattr_tuple_size(void);
117	extern const struct nla_policy nf_ct_port_nla_policy[];	117	extern const struct nla_policy nf_ct_port_nla_policy[];
118		118
119	#ifdef CONFIG_SYSCTL	119	#ifdef CONFIG_SYSCTL
120	#ifdef DEBUG_INVALID_PACKETS	120	#ifdef DEBUG_INVALID_PACKETS
121	#define LOG_INVALID(net, proto) \	121	#define LOG_INVALID(net, proto) \
122	((net)->ct.sysctl_log_invalid == (proto) \|\| \	122	((net)->ct.sysctl_log_invalid == (proto) \|\| \
123	(net)->ct.sysctl_log_invalid == IPPROTO_RAW)	123	(net)->ct.sysctl_log_invalid == IPPROTO_RAW)
124	#else	124	#else
125	#define LOG_INVALID(net, proto) \	125	#define LOG_INVALID(net, proto) \
126	(((net)->ct.sysctl_log_invalid == (proto) \|\| \	126	(((net)->ct.sysctl_log_invalid == (proto) \|\| \
127	(net)->ct.sysctl_log_invalid == IPPROTO_RAW) \	127	(net)->ct.sysctl_log_invalid == IPPROTO_RAW) \
128	&& net_ratelimit())	128	&& net_ratelimit())
129	#endif	129	#endif
130	#else	130	#else
131	static inline int LOG_INVALID(struct net *net, int proto) { return 0; }	131	static inline int LOG_INVALID(struct net *net, int proto) { return 0; }
132	#endif /* CONFIG_SYSCTL */	132	#endif /* CONFIG_SYSCTL */
133		133
134	#endif /_NF_CONNTRACK_PROTOCOL_H/	134	#endif /_NF_CONNTRACK_PROTOCOL_H/
135		135