Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

[firefly-linux-kernel-4.4.55.git] / net / netfilter / nf_conntrack_core.c

diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 76613f5a55c0c557920c1f52f2d67a20c0934eda..7b48035826eeed8b1ae2ad3cefb97024dec84dab 100644 (file)
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -44,6 +44,7 @@
 #include <net/netfilter/nf_conntrack_ecache.h>
 #include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/nf_conntrack_timestamp.h>
+#include <net/netfilter/nf_conntrack_timeout.h>
 #include <net/netfilter/nf_nat.h>
 #include <net/netfilter/nf_nat_core.h>
 
@@ -404,19 +405,49 @@ static void __nf_conntrack_hash_insert(struct nf_conn *ct,
                           &net->ct.hash[repl_hash]);
 }
 
-void nf_conntrack_hash_insert(struct nf_conn *ct)
+int
+nf_conntrack_hash_check_insert(struct nf_conn *ct)
 {
        struct net *net = nf_ct_net(ct);
        unsigned int hash, repl_hash;
+       struct nf_conntrack_tuple_hash *h;
+       struct hlist_nulls_node *n;
        u16 zone;
 
        zone = nf_ct_zone(ct);
-       hash = hash_conntrack(net, zone, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
-       repl_hash = hash_conntrack(net, zone, &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+       hash = hash_conntrack(net, zone,
+                             &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
+       repl_hash = hash_conntrack(net, zone,
+                                  &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+
+       spin_lock_bh(&nf_conntrack_lock);
+
+       /* See if there's one in the list already, including reverse */
+       hlist_nulls_for_each_entry(h, n, &net->ct.hash[hash], hnnode)
+               if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
+                                     &h->tuple) &&
+                   zone == nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)))
+                       goto out;
+       hlist_nulls_for_each_entry(h, n, &net->ct.hash[repl_hash], hnnode)
+               if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_REPLY].tuple,
+                                     &h->tuple) &&
+                   zone == nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)))
+                       goto out;
 
+       add_timer(&ct->timeout);
+       nf_conntrack_get(&ct->ct_general);
        __nf_conntrack_hash_insert(ct, hash, repl_hash);
+       NF_CT_STAT_INC(net, insert);
+       spin_unlock_bh(&nf_conntrack_lock);
+
+       return 0;
+
+out:
+       NF_CT_STAT_INC(net, insert_failed);
+       spin_unlock_bh(&nf_conntrack_lock);
+       return -EEXIST;
 }
-EXPORT_SYMBOL_GPL(nf_conntrack_hash_insert);
+EXPORT_SYMBOL_GPL(nf_conntrack_hash_check_insert);
 
 /* Confirm a connection given skb; places it in hash table */
 int
@@ -605,8 +636,12 @@ static noinline int early_drop(struct net *net, unsigned int hash)
 
        if (del_timer(&ct->timeout)) {
                death_by_timeout((unsigned long)ct);
-               dropped = 1;
-               NF_CT_STAT_INC_ATOMIC(net, early_drop);
+               /* Check if we indeed killed this entry. Reliable event
+                  delivery may have inserted it into the dying list. */
+               if (test_bit(IPS_DYING_BIT, &ct->status)) {
+                       dropped = 1;
+                       NF_CT_STAT_INC_ATOMIC(net, early_drop);
+               }
        }
        nf_ct_put(ct);
        return dropped;
@@ -733,7 +768,8 @@ init_conntrack(struct net *net, struct nf_conn *tmpl,
               struct nf_conntrack_l3proto *l3proto,
               struct nf_conntrack_l4proto *l4proto,
               struct sk_buff *skb,
-              unsigned int dataoff, u32 hash)
+              unsigned int dataoff, u32 hash,
+              unsigned int *timeouts)
 {
        struct nf_conn *ct;
        struct nf_conn_help *help;
@@ -752,7 +788,7 @@ init_conntrack(struct net *net, struct nf_conn *tmpl,
        if (IS_ERR(ct))
                return (struct nf_conntrack_tuple_hash *)ct;
 
-       if (!l4proto->new(ct, skb, dataoff)) {
+       if (!l4proto->new(ct, skb, dataoff, timeouts)) {
                nf_conntrack_free(ct);
                pr_debug("init conntrack: can't track with proto module\n");
                return NULL;
@@ -818,7 +854,8 @@ resolve_normal_ct(struct net *net, struct nf_conn *tmpl,
                  struct nf_conntrack_l3proto *l3proto,
                  struct nf_conntrack_l4proto *l4proto,
                  int *set_reply,
-                 enum ip_conntrack_info *ctinfo)
+                 enum ip_conntrack_info *ctinfo,
+                 unsigned int *timeouts)
 {
        struct nf_conntrack_tuple tuple;
        struct nf_conntrack_tuple_hash *h;
@@ -838,7 +875,7 @@ resolve_normal_ct(struct net *net, struct nf_conn *tmpl,
        h = __nf_conntrack_find_get(net, zone, &tuple, hash);
        if (!h) {
                h = init_conntrack(net, tmpl, &tuple, l3proto, l4proto,
-                                  skb, dataoff, hash);
+                                  skb, dataoff, hash, timeouts);
                if (!h)
                        return NULL;
                if (IS_ERR(h))
@@ -879,6 +916,8 @@ nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum,
        enum ip_conntrack_info ctinfo;
        struct nf_conntrack_l3proto *l3proto;
        struct nf_conntrack_l4proto *l4proto;
+       struct nf_conn_timeout *timeout_ext;
+       unsigned int *timeouts;
        unsigned int dataoff;
        u_int8_t protonum;
        int set_reply = 0;
@@ -925,8 +964,19 @@ nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum,
                        goto out;
        }
 
+       /* Decide what timeout policy we want to apply to this flow. */
+       if (tmpl) {
+               timeout_ext = nf_ct_timeout_find(tmpl);
+               if (timeout_ext)
+                       timeouts = NF_CT_TIMEOUT_EXT_DATA(timeout_ext);
+               else
+                       timeouts = l4proto->get_timeouts(net);
+       } else
+               timeouts = l4proto->get_timeouts(net);
+
        ct = resolve_normal_ct(net, tmpl, skb, dataoff, pf, protonum,
-                              l3proto, l4proto, &set_reply, &ctinfo);
+                              l3proto, l4proto, &set_reply, &ctinfo,
+                              timeouts);
        if (!ct) {
                /* Not valid part of a connection */
                NF_CT_STAT_INC_ATOMIC(net, invalid);
@@ -943,7 +993,7 @@ nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum,
 
        NF_CT_ASSERT(skb->nfct);
 
-       ret = l4proto->packet(ct, skb, dataoff, ctinfo, pf, hooknum);
+       ret = l4proto->packet(ct, skb, dataoff, ctinfo, pf, hooknum, timeouts);
        if (ret <= 0) {
                /* Invalid: inverse of the return code tells
                 * the netfilter core what to do */
@@ -1297,6 +1347,7 @@ static void nf_conntrack_cleanup_net(struct net *net)
        }
 
        nf_ct_free_hashtable(net->ct.hash, net->ct.htable_size);
+       nf_conntrack_timeout_fini(net);
        nf_conntrack_ecache_fini(net);
        nf_conntrack_tstamp_fini(net);
        nf_conntrack_acct_fini(net);
@@ -1528,9 +1579,14 @@ static int nf_conntrack_init_net(struct net *net)
        ret = nf_conntrack_ecache_init(net);
        if (ret < 0)
                goto err_ecache;
+       ret = nf_conntrack_timeout_init(net);
+       if (ret < 0)
+               goto err_timeout;
 
        return 0;
 
+err_timeout:
+       nf_conntrack_timeout_fini(net);
 err_ecache:
        nf_conntrack_tstamp_fini(net);
 err_tstamp: