net/ipv4/netfilter/ip_conntrack_standalone.c

   1 /* This file contains all the functions required for the standalone
   2    ip_conntrack module.
   3
   4    These are not required by the compatibility layer.
   5 */
   6
   7 /* (C) 1999-2001 Paul `Rusty' Russell
   8  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
   9  *
  10  * This program is free software; you can redistribute it and/or modify
  11  * it under the terms of the GNU General Public License version 2 as
  12  * published by the Free Software Foundation.
  13  */
  14
  15 #include <linux/config.h>
  16 #include <linux/types.h>
  17 #include <linux/ip.h>
  18 #include <linux/netfilter.h>
  19 #include <linux/netfilter_ipv4.h>
  20 #include <linux/module.h>
  21 #include <linux/skbuff.h>
  22 #include <linux/proc_fs.h>
  23 #ifdef CONFIG_SYSCTL
  24 #include <linux/sysctl.h>
  25 #endif
  26 #include <net/checksum.h>
  27
  28 #define ASSERT_READ_LOCK(x) MUST_BE_READ_LOCKED(&ip_conntrack_lock)
  29 #define ASSERT_WRITE_LOCK(x) MUST_BE_WRITE_LOCKED(&ip_conntrack_lock)
  30
  31 #include <linux/netfilter_ipv4/ip_conntrack.h>
  32 #include <linux/netfilter_ipv4/ip_conntrack_protocol.h>
  33 #include <linux/netfilter_ipv4/ip_conntrack_core.h>
  34 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
  35 #include <linux/netfilter_ipv4/listhelp.h>
  36
  37 #if 0
  38 #define DEBUGP printk
  39 #else
  40 #define DEBUGP(format, args...)
  41 #endif
  42
  43 MODULE_LICENSE("GPL");
  44
  45 static int kill_proto(const struct ip_conntrack *i, void *data)
  46 {
  47         return (i->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum ==
  48                         *((u_int8_t *) data));
  49 }
  50
  51 static unsigned int
  52 print_tuple(char *buffer, const struct ip_conntrack_tuple *tuple,
  53             struct ip_conntrack_protocol *proto)
  54 {
  55         int len;
  56
  57         len = sprintf(buffer, "src=%u.%u.%u.%u dst=%u.%u.%u.%u ",
  58                       NIPQUAD(tuple->src.ip), NIPQUAD(tuple->dst.ip));
  59
  60         len += proto->print_tuple(buffer + len, tuple);
  61
  62         return len;
  63 }
  64
  65 /* FIXME: Don't print source proto part. --RR */
  66 static unsigned int
  67 print_expect(char *buffer, const struct ip_conntrack_expect *expect)
  68 {
  69         unsigned int len;
  70
  71         if (expect->expectant->helper->timeout)
  72                 len = sprintf(buffer, "EXPECTING: %lu ",
  73                               timer_pending(&expect->timeout)
  74                               ? (expect->timeout.expires - jiffies)/HZ : 0);
  75         else
  76                 len = sprintf(buffer, "EXPECTING: - ");
  77         len += sprintf(buffer + len, "use=%u proto=%u ",
  78                       atomic_read(&expect->use), expect->tuple.dst.protonum);
  79         len += print_tuple(buffer + len, &expect->tuple,
  80                            __ip_ct_find_proto(expect->tuple.dst.protonum));
  81         len += sprintf(buffer + len, "\n");
  82         return len;
  83 }
  84
  85 static unsigned int
  86 print_conntrack(char *buffer, struct ip_conntrack *conntrack)
  87 {
  88         unsigned int len;
  89         struct ip_conntrack_protocol *proto
  90                 = __ip_ct_find_proto(conntrack->tuplehash[IP_CT_DIR_ORIGINAL]
  91                                .tuple.dst.protonum);
  92
  93         len = sprintf(buffer, "%-8s %u %lu ",
  94                       proto->name,
  95                       conntrack->tuplehash[IP_CT_DIR_ORIGINAL]
  96                       .tuple.dst.protonum,
  97                       timer_pending(&conntrack->timeout)
  98                       ? (conntrack->timeout.expires - jiffies)/HZ : 0);
  99
 100         len += proto->print_conntrack(buffer + len, conntrack);
 101         len += print_tuple(buffer + len,
 102                            &conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
 103                            proto);
 104         if (!(test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)))
 105                 len += sprintf(buffer + len, "[UNREPLIED] ");
 106         len += print_tuple(buffer + len,
 107                            &conntrack->tuplehash[IP_CT_DIR_REPLY].tuple,
 108                            proto);
 109         if (test_bit(IPS_ASSURED_BIT, &conntrack->status))
 110                 len += sprintf(buffer + len, "[ASSURED] ");
 111         len += sprintf(buffer + len, "use=%u ",
 112                        atomic_read(&conntrack->ct_general.use));
 113         len += sprintf(buffer + len, "\n");
 114
 115         return len;
 116 }
 117
 118 /* Returns true when finished. */
 119 static inline int
 120 conntrack_iterate(const struct ip_conntrack_tuple_hash *hash,
 121                   char *buffer, off_t offset, off_t *upto,
 122                   unsigned int *len, unsigned int maxlen)
 123 {
 124         unsigned int newlen;
 125         IP_NF_ASSERT(hash->ctrack);
 126
 127         MUST_BE_READ_LOCKED(&ip_conntrack_lock);
 128
 129         /* Only count originals */
 130         if (DIRECTION(hash))
 131                 return 0;
 132
 133         if ((*upto)++ < offset)
 134                 return 0;
 135
 136         newlen = print_conntrack(buffer + *len, hash->ctrack);
 137         if (*len + newlen > maxlen)
 138                 return 1;
 139         else *len += newlen;
 140
 141         return 0;
 142 }
 143
 144 static int
 145 list_conntracks(char *buffer, char **start, off_t offset, int length)
 146 {
 147         unsigned int i;
 148         unsigned int len = 0;
 149         off_t upto = 0;
 150         struct list_head *e;
 151
 152         READ_LOCK(&ip_conntrack_lock);
 153         /* Traverse hash; print originals then reply. */
 154         for (i = 0; i < ip_conntrack_htable_size; i++) {
 155                 if (LIST_FIND(&ip_conntrack_hash[i], conntrack_iterate,
 156                               struct ip_conntrack_tuple_hash *,
 157                               buffer, offset, &upto, &len, length))
 158                         goto finished;
 159         }
 160
 161         /* Now iterate through expecteds. */
 162         READ_LOCK(&ip_conntrack_expect_tuple_lock);
 163         list_for_each(e, &ip_conntrack_expect_list) {
 164                 unsigned int last_len;
 165                 struct ip_conntrack_expect *expect
 166                         = (struct ip_conntrack_expect *)e;
 167                 if (upto++ < offset) continue;
 168
 169                 last_len = len;
 170                 len += print_expect(buffer + len, expect);
 171                 if (len > length) {
 172                         len = last_len;
 173                         goto finished_expects;
 174                 }
 175         }
 176
 177  finished_expects:
 178         READ_UNLOCK(&ip_conntrack_expect_tuple_lock);
 179  finished:
 180         READ_UNLOCK(&ip_conntrack_lock);
 181
 182         /* `start' hack - see fs/proc/generic.c line ~165 */
 183         *start = (char *)((unsigned int)upto - offset);
 184         return len;
 185 }
 186
 187 static unsigned int ip_confirm(unsigned int hooknum,
 188                                struct sk_buff **pskb,
 189                                const struct net_device *in,
 190                                const struct net_device *out,
 191                                int (*okfn)(struct sk_buff *))
 192 {
 193         /* We've seen it coming out the other side: confirm it */
 194         return ip_conntrack_confirm(*pskb);
 195 }
 196
 197 static unsigned int ip_conntrack_defrag(unsigned int hooknum,
 198                                         struct sk_buff **pskb,
 199                                         const struct net_device *in,
 200                                         const struct net_device *out,
 201                                         int (*okfn)(struct sk_buff *))
 202 {
 203         /* Previously seen (loopback)?  Ignore.  Do this before
 204            fragment check. */
 205         if ((*pskb)->nfct)
 206                 return NF_ACCEPT;
 207
 208         /* Gather fragments. */
 209         if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
 210                 *pskb = ip_ct_gather_frags(*pskb);
 211                 if (!*pskb)
 212                         return NF_STOLEN;
 213         }
 214         return NF_ACCEPT;
 215 }
 216
 217 static unsigned int ip_refrag(unsigned int hooknum,
 218                               struct sk_buff **pskb,
 219                               const struct net_device *in,
 220                               const struct net_device *out,
 221                               int (*okfn)(struct sk_buff *))
 222 {
 223         struct rtable *rt = (struct rtable *)(*pskb)->dst;
 224
 225         /* We've seen it coming out the other side: confirm */
 226         if (ip_confirm(hooknum, pskb, in, out, okfn) != NF_ACCEPT)
 227                 return NF_DROP;
 228
 229         /* Local packets are never produced too large for their
 230            interface.  We degfragment them at LOCAL_OUT, however,
 231            so we have to refragment them here. */
 232         if ((*pskb)->len > dst_pmtu(&rt->u.dst) &&
 233             !skb_shinfo(*pskb)->tso_size) {
 234                 /* No hook can be after us, so this should be OK. */
 235                 ip_fragment(*pskb, okfn);
 236                 return NF_STOLEN;
 237         }
 238         return NF_ACCEPT;
 239 }
 240
 241 static unsigned int ip_conntrack_local(unsigned int hooknum,
 242                                        struct sk_buff **pskb,
 243                                        const struct net_device *in,
 244                                        const struct net_device *out,
 245                                        int (*okfn)(struct sk_buff *))
 246 {
 247         /* root is playing with raw sockets. */
 248         if ((*pskb)->len < sizeof(struct iphdr)
 249             || (*pskb)->nh.iph->ihl * 4 < sizeof(struct iphdr)) {
 250                 if (net_ratelimit())
 251                         printk("ipt_hook: happy cracking.\n");
 252                 return NF_ACCEPT;
 253         }
 254         return ip_conntrack_in(hooknum, pskb, in, out, okfn);
 255 }
 256
 257 /* Connection tracking may drop packets, but never alters them, so
 258    make it the first hook. */
 259 static struct nf_hook_ops ip_conntrack_defrag_ops = {
 260         .hook           = ip_conntrack_defrag,
 261         .owner          = THIS_MODULE,
 262         .pf             = PF_INET,
 263         .hooknum        = NF_IP_PRE_ROUTING,
 264         .priority       = NF_IP_PRI_CONNTRACK_DEFRAG,
 265 };
 266
 267 static struct nf_hook_ops ip_conntrack_in_ops = {
 268         .hook           = ip_conntrack_in,
 269         .owner          = THIS_MODULE,
 270         .pf             = PF_INET,
 271         .hooknum        = NF_IP_PRE_ROUTING,
 272         .priority       = NF_IP_PRI_CONNTRACK,
 273 };
 274
 275 static struct nf_hook_ops ip_conntrack_defrag_local_out_ops = {
 276         .hook           = ip_conntrack_defrag,
 277         .owner          = THIS_MODULE,
 278         .pf             = PF_INET,
 279         .hooknum        = NF_IP_LOCAL_OUT,
 280         .priority       = NF_IP_PRI_CONNTRACK_DEFRAG,
 281 };
 282
 283 static struct nf_hook_ops ip_conntrack_local_out_ops = {
 284         .hook           = ip_conntrack_local,
 285         .owner          = THIS_MODULE,
 286         .pf             = PF_INET,
 287         .hooknum        = NF_IP_LOCAL_OUT,
 288         .priority       = NF_IP_PRI_CONNTRACK,
 289 };
 290
 291 /* Refragmenter; last chance. */
 292 static struct nf_hook_ops ip_conntrack_out_ops = {
 293         .hook           = ip_refrag,
 294         .owner          = THIS_MODULE,
 295         .pf             = PF_INET,
 296         .hooknum        = NF_IP_POST_ROUTING,
 297         .priority       = NF_IP_PRI_LAST,
 298 };
 299
 300 static struct nf_hook_ops ip_conntrack_local_in_ops = {
 301         .hook           = ip_confirm,
 302         .owner          = THIS_MODULE,
 303         .pf             = PF_INET,
 304         .hooknum        = NF_IP_LOCAL_IN,
 305         .priority       = NF_IP_PRI_LAST-1,
 306 };
 307
 308 /* Sysctl support */
 309
 310 #ifdef CONFIG_SYSCTL
 311
 312 /* From ip_conntrack_core.c */
 313 extern int ip_conntrack_max;
 314 extern unsigned int ip_conntrack_htable_size;
 315
 316 /* From ip_conntrack_proto_tcp.c */
 317 extern unsigned long ip_ct_tcp_timeout_syn_sent;
 318 extern unsigned long ip_ct_tcp_timeout_syn_recv;
 319 extern unsigned long ip_ct_tcp_timeout_established;
 320 extern unsigned long ip_ct_tcp_timeout_fin_wait;
 321 extern unsigned long ip_ct_tcp_timeout_close_wait;
 322 extern unsigned long ip_ct_tcp_timeout_last_ack;
 323 extern unsigned long ip_ct_tcp_timeout_time_wait;
 324 extern unsigned long ip_ct_tcp_timeout_close;
 325
 326 /* From ip_conntrack_proto_udp.c */
 327 extern unsigned long ip_ct_udp_timeout;
 328 extern unsigned long ip_ct_udp_timeout_stream;
 329
 330 /* From ip_conntrack_proto_icmp.c */
 331 extern unsigned long ip_ct_icmp_timeout;
 332
 333 /* From ip_conntrack_proto_icmp.c */
 334 extern unsigned long ip_ct_generic_timeout;
 335
 336 static struct ctl_table_header *ip_ct_sysctl_header;
 337
 338 static ctl_table ip_ct_sysctl_table[] = {
 339         {
 340                 .ctl_name       = NET_IPV4_NF_CONNTRACK_MAX,
 341                 .procname       = "ip_conntrack_max",
 342                 .data           = &ip_conntrack_max,
 343                 .maxlen         = sizeof(int),
 344                 .mode           = 0644,
 345                 .proc_handler   = &proc_dointvec,
 346         },
 347         {
 348                 .ctl_name       = NET_IPV4_NF_CONNTRACK_BUCKETS,
 349                 .procname       = "ip_conntrack_buckets",
 350                 .data           = &ip_conntrack_htable_size,
 351                 .maxlen         = sizeof(unsigned int),
 352                 .mode           = 0444,
 353                 .proc_handler   = &proc_dointvec,
 354         },
 355         {
 356                 .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_SYN_SENT,
 357                 .procname       = "ip_conntrack_tcp_timeout_syn_sent",
 358                 .data           = &ip_ct_tcp_timeout_syn_sent,
 359                 .maxlen         = sizeof(unsigned int),
 360                 .mode           = 0644,
 361                 .proc_handler   = &proc_dointvec_jiffies,
 362         },
 363         {
 364                 .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_SYN_RECV,
 365                 .procname       = "ip_conntrack_tcp_timeout_syn_recv",
 366                 .data           = &ip_ct_tcp_timeout_syn_recv,
 367                 .maxlen         = sizeof(unsigned int),
 368                 .mode           = 0644,
 369                 .proc_handler   = &proc_dointvec_jiffies,
 370         },
 371         {
 372                 .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_ESTABLISHED,
 373                 .procname       = "ip_conntrack_tcp_timeout_established",
 374                 .data           = &ip_ct_tcp_timeout_established,
 375                 .maxlen         = sizeof(unsigned int),
 376                 .mode           = 0644,
 377                 .proc_handler   = &proc_dointvec_jiffies,
 378         },
 379         {
 380                 .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_FIN_WAIT,
 381                 .procname       = "ip_conntrack_tcp_timeout_fin_wait",
 382                 .data           = &ip_ct_tcp_timeout_fin_wait,
 383                 .maxlen         = sizeof(unsigned int),
 384                 .mode           = 0644,
 385                 .proc_handler   = &proc_dointvec_jiffies,
 386         },
 387         {
 388                 .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_CLOSE_WAIT,
 389                 .procname       = "ip_conntrack_tcp_timeout_close_wait",
 390                 .data           = &ip_ct_tcp_timeout_close_wait,
 391                 .maxlen         = sizeof(unsigned int),
 392                 .mode           = 0644,
 393                 .proc_handler   = &proc_dointvec_jiffies,
 394         },
 395         {
 396                 .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_LAST_ACK,
 397                 .procname       = "ip_conntrack_tcp_timeout_last_ack",
 398                 .data           = &ip_ct_tcp_timeout_last_ack,
 399                 .maxlen         = sizeof(unsigned int),
 400                 .mode           = 0644,
 401                 .proc_handler   = &proc_dointvec_jiffies,
 402         },
 403         {
 404                 .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_TIME_WAIT,
 405                 .procname       = "ip_conntrack_tcp_timeout_time_wait",
 406                 .data           = &ip_ct_tcp_timeout_time_wait,
 407                 .maxlen         = sizeof(unsigned int),
 408                 .mode           = 0644,
 409                 .proc_handler   = &proc_dointvec_jiffies,
 410         },
 411         {
 412                 .ctl_name       = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_CLOSE,
 413                 .procname       = "ip_conntrack_tcp_timeout_close",
 414                 .data           = &ip_ct_tcp_timeout_close,
 415                 .maxlen         = sizeof(unsigned int),
 416                 .mode           = 0644,
 417                 .proc_handler   = &proc_dointvec_jiffies,
 418         },
 419         {
 420                 .ctl_name       = NET_IPV4_NF_CONNTRACK_UDP_TIMEOUT,
 421                 .procname       = "ip_conntrack_udp_timeout",
 422                 .data           = &ip_ct_udp_timeout,
 423                 .maxlen         = sizeof(unsigned int),
 424                 .mode           = 0644,
 425                 .proc_handler   = &proc_dointvec_jiffies,
 426         },
 427         {
 428                 .ctl_name       = NET_IPV4_NF_CONNTRACK_UDP_TIMEOUT_STREAM,
 429                 .procname       = "ip_conntrack_udp_timeout_stream",
 430                 .data           = &ip_ct_udp_timeout_stream,
 431                 .maxlen         = sizeof(unsigned int),
 432                 .mode           = 0644,
 433                 .proc_handler   = &proc_dointvec_jiffies,
 434         },
 435         {
 436                 .ctl_name       = NET_IPV4_NF_CONNTRACK_ICMP_TIMEOUT,
 437                 .procname       = "ip_conntrack_icmp_timeout",
 438                 .data           = &ip_ct_icmp_timeout,
 439                 .maxlen         = sizeof(unsigned int),
 440                 .mode           = 0644,
 441                 .proc_handler   = &proc_dointvec_jiffies,
 442         },
 443         {
 444                 .ctl_name       = NET_IPV4_NF_CONNTRACK_GENERIC_TIMEOUT,
 445                 .procname       = "ip_conntrack_generic_timeout",
 446                 .data           = &ip_ct_generic_timeout,
 447                 .maxlen         = sizeof(unsigned int),
 448                 .mode           = 0644,
 449                 .proc_handler   = &proc_dointvec_jiffies,
 450         },
 451         { .ctl_name = 0 }
 452 };
 453
 454 #define NET_IP_CONNTRACK_MAX 2089
 455
 456 static ctl_table ip_ct_netfilter_table[] = {
 457         {
 458                 .ctl_name       = NET_IPV4_NETFILTER,
 459                 .procname       = "netfilter",
 460                 .mode           = 0555,
 461                 .child          = ip_ct_sysctl_table,
 462         },
 463         {
 464                 .ctl_name       = NET_IP_CONNTRACK_MAX,
 465                 .procname       = "ip_conntrack_max",
 466                 .data           = &ip_conntrack_max,
 467                 .maxlen         = sizeof(int),
 468                 .mode           = 0644,
 469                 .proc_handler   = &proc_dointvec
 470         },
 471         { .ctl_name = 0 }
 472 };
 473
 474 static ctl_table ip_ct_ipv4_table[] = {
 475         {
 476                 .ctl_name       = NET_IPV4,
 477                 .procname       = "ipv4",
 478                 .mode           = 0555,
 479                 .child          = ip_ct_netfilter_table,
 480         },
 481         { .ctl_name = 0 }
 482 };
 483
 484 static ctl_table ip_ct_net_table[] = {
 485         {
 486                 .ctl_name       = CTL_NET,
 487                 .procname       = "net",
 488                 .mode           = 0555,
 489                 .child          = ip_ct_ipv4_table,
 490         },
 491         { .ctl_name = 0 }
 492 };
 493 #endif
 494 static int init_or_cleanup(int init)
 495 {
 496         struct proc_dir_entry *proc;
 497         int ret = 0;
 498
 499         if (!init) goto cleanup;
 500
 501         ret = ip_conntrack_init();
 502         if (ret < 0)
 503                 goto cleanup_nothing;
 504
 505         proc = proc_net_create("ip_conntrack",0,list_conntracks);
 506         if (!proc) goto cleanup_init;
 507         proc->owner = THIS_MODULE;
 508
 509         ret = nf_register_hook(&ip_conntrack_defrag_ops);
 510         if (ret < 0) {
 511                 printk("ip_conntrack: can't register pre-routing defrag hook.\n");
 512                 goto cleanup_proc;
 513         }
 514         ret = nf_register_hook(&ip_conntrack_defrag_local_out_ops);
 515         if (ret < 0) {
 516                 printk("ip_conntrack: can't register local_out defrag hook.\n");
 517                 goto cleanup_defragops;
 518         }
 519         ret = nf_register_hook(&ip_conntrack_in_ops);
 520         if (ret < 0) {
 521                 printk("ip_conntrack: can't register pre-routing hook.\n");
 522                 goto cleanup_defraglocalops;
 523         }
 524         ret = nf_register_hook(&ip_conntrack_local_out_ops);
 525         if (ret < 0) {
 526                 printk("ip_conntrack: can't register local out hook.\n");
 527                 goto cleanup_inops;
 528         }
 529         ret = nf_register_hook(&ip_conntrack_out_ops);
 530         if (ret < 0) {
 531                 printk("ip_conntrack: can't register post-routing hook.\n");
 532                 goto cleanup_inandlocalops;
 533         }
 534         ret = nf_register_hook(&ip_conntrack_local_in_ops);
 535         if (ret < 0) {
 536                 printk("ip_conntrack: can't register local in hook.\n");
 537                 goto cleanup_inoutandlocalops;
 538         }
 539 #ifdef CONFIG_SYSCTL
 540         ip_ct_sysctl_header = register_sysctl_table(ip_ct_net_table, 0);
 541         if (ip_ct_sysctl_header == NULL) {
 542                 printk("ip_conntrack: can't register to sysctl.\n");
 543                 goto cleanup;
 544         }
 545 #endif
 546
 547         return ret;
 548
 549  cleanup:
 550 #ifdef CONFIG_SYSCTL
 551         unregister_sysctl_table(ip_ct_sysctl_header);
 552 #endif
 553         nf_unregister_hook(&ip_conntrack_local_in_ops);
 554  cleanup_inoutandlocalops:
 555         nf_unregister_hook(&ip_conntrack_out_ops);
 556  cleanup_inandlocalops:
 557         nf_unregister_hook(&ip_conntrack_local_out_ops);
 558  cleanup_inops:
 559         nf_unregister_hook(&ip_conntrack_in_ops);
 560  cleanup_defraglocalops:
 561         nf_unregister_hook(&ip_conntrack_defrag_local_out_ops);
 562  cleanup_defragops:
 563         nf_unregister_hook(&ip_conntrack_defrag_ops);
 564  cleanup_proc:
 565         proc_net_remove("ip_conntrack");
 566  cleanup_init:
 567         ip_conntrack_cleanup();
 568  cleanup_nothing:
 569         return ret;
 570 }
 571
 572 /* FIXME: Allow NULL functions and sub in pointers to generic for
 573    them. --RR */
 574 int ip_conntrack_protocol_register(struct ip_conntrack_protocol *proto)
 575 {
 576         int ret = 0;
 577         struct list_head *i;
 578
 579         WRITE_LOCK(&ip_conntrack_lock);
 580         list_for_each(i, &protocol_list) {
 581                 if (((struct ip_conntrack_protocol *)i)->proto
 582                     == proto->proto) {
 583                         ret = -EBUSY;
 584                         goto out;
 585                 }
 586         }
 587
 588         list_prepend(&protocol_list, proto);
 589
 590  out:
 591         WRITE_UNLOCK(&ip_conntrack_lock);
 592         return ret;
 593 }
 594
 595 void ip_conntrack_protocol_unregister(struct ip_conntrack_protocol *proto)
 596 {
 597         WRITE_LOCK(&ip_conntrack_lock);
 598
 599         /* ip_ct_find_proto() returns proto_generic in case there is no protocol
 600          * helper. So this should be enough - HW */
 601         LIST_DELETE(&protocol_list, proto);
 602         WRITE_UNLOCK(&ip_conntrack_lock);
 603
 604         /* Somebody could be still looking at the proto in bh. */
 605         synchronize_net();
 606
 607         /* Remove all contrack entries for this protocol */
 608         ip_ct_selective_cleanup(kill_proto, &proto->proto);
 609 }
 610
 611 static int __init init(void)
 612 {
 613         return init_or_cleanup(1);
 614 }
 615
 616 static void __exit fini(void)
 617 {
 618         init_or_cleanup(0);
 619 }
 620
 621 module_init(init);
 622 module_exit(fini);
 623
 624 /* Some modules need us, but don't depend directly on any symbol.
 625    They should call this. */
 626 void need_ip_conntrack(void)
 627 {
 628 }
 629
 630 EXPORT_SYMBOL(ip_conntrack_protocol_register);
 631 EXPORT_SYMBOL(ip_conntrack_protocol_unregister);
 632 EXPORT_SYMBOL(invert_tuplepr);
 633 EXPORT_SYMBOL(ip_conntrack_alter_reply);
 634 EXPORT_SYMBOL(ip_conntrack_destroyed);
 635 EXPORT_SYMBOL(ip_conntrack_get);
 636 EXPORT_SYMBOL(need_ip_conntrack);
 637 EXPORT_SYMBOL(ip_conntrack_helper_register);
 638 EXPORT_SYMBOL(ip_conntrack_helper_unregister);
 639 EXPORT_SYMBOL(ip_ct_selective_cleanup);
 640 EXPORT_SYMBOL(ip_ct_refresh);
 641 EXPORT_SYMBOL(ip_ct_find_proto);
 642 EXPORT_SYMBOL(__ip_ct_find_proto);
 643 EXPORT_SYMBOL(ip_ct_find_helper);
 644 EXPORT_SYMBOL(ip_conntrack_expect_alloc);
 645 EXPORT_SYMBOL(ip_conntrack_expect_related);
 646 EXPORT_SYMBOL(ip_conntrack_change_expect);
 647 EXPORT_SYMBOL(ip_conntrack_unexpect_related);
 648 EXPORT_SYMBOL_GPL(ip_conntrack_expect_find_get);
 649 EXPORT_SYMBOL_GPL(ip_conntrack_expect_put);
 650 EXPORT_SYMBOL(ip_conntrack_tuple_taken);
 651 EXPORT_SYMBOL(ip_ct_gather_frags);
 652 EXPORT_SYMBOL(ip_conntrack_htable_size);
 653 EXPORT_SYMBOL(ip_conntrack_expect_list);
 654 EXPORT_SYMBOL(ip_conntrack_lock);
 655 EXPORT_SYMBOL(ip_conntrack_hash);
 656 EXPORT_SYMBOL(ip_conntrack_untracked);
 657 EXPORT_SYMBOL_GPL(ip_conntrack_find_get);
 658 EXPORT_SYMBOL_GPL(ip_conntrack_put);