net/netfilter/nf_conntrack_expect.c

   1 /* Expectation handling for nf_conntrack. */
   2
   3 /* (C) 1999-2001 Paul `Rusty' Russell
   4  * (C) 2002-2006 Netfilter Core Team <[email protected]>
   5  * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
   6  * (c) 2005-2012 Patrick McHardy <[email protected]>
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License version 2 as
  10  * published by the Free Software Foundation.
  11  */
  12
  13 #include <linux/types.h>
  14 #include <linux/netfilter.h>
  15 #include <linux/skbuff.h>
  16 #include <linux/proc_fs.h>
  17 #include <linux/seq_file.h>
  18 #include <linux/stddef.h>
  19 #include <linux/slab.h>
  20 #include <linux/err.h>
  21 #include <linux/percpu.h>
  22 #include <linux/kernel.h>
  23 #include <linux/jhash.h>
  24 #include <linux/moduleparam.h>
  25 #include <linux/export.h>
  26 #include <net/net_namespace.h>
  27
  28 #include <net/netfilter/nf_conntrack.h>
  29 #include <net/netfilter/nf_conntrack_core.h>
  30 #include <net/netfilter/nf_conntrack_expect.h>
  31 #include <net/netfilter/nf_conntrack_helper.h>
  32 #include <net/netfilter/nf_conntrack_tuple.h>
  33 #include <net/netfilter/nf_conntrack_zones.h>
  34
  35 unsigned int nf_ct_expect_hsize __read_mostly;
  36 EXPORT_SYMBOL_GPL(nf_ct_expect_hsize);
  37
  38 unsigned int nf_ct_expect_max __read_mostly;
  39
  40 static struct kmem_cache *nf_ct_expect_cachep __read_mostly;
  41
  42 /* nf_conntrack_expect helper functions */
  43 void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp,
  44                                 u32 portid, int report)
  45 {
  46         struct nf_conn_help *master_help = nfct_help(exp->master);
  47         struct net *net = nf_ct_exp_net(exp);
  48
  49         NF_CT_ASSERT(master_help);
  50         NF_CT_ASSERT(!timer_pending(&exp->timeout));
  51
  52         hlist_del_rcu(&exp->hnode);
  53         net->ct.expect_count--;
  54
  55         hlist_del(&exp->lnode);
  56         master_help->expecting[exp->class]--;
  57
  58         nf_ct_expect_event_report(IPEXP_DESTROY, exp, portid, report);
  59         nf_ct_expect_put(exp);
  60
  61         NF_CT_STAT_INC(net, expect_delete);
  62 }
  63 EXPORT_SYMBOL_GPL(nf_ct_unlink_expect_report);
  64
  65 static void nf_ct_expectation_timed_out(unsigned long ul_expect)
  66 {
  67         struct nf_conntrack_expect *exp = (void *)ul_expect;
  68
  69         spin_lock_bh(&nf_conntrack_expect_lock);
  70         nf_ct_unlink_expect(exp);
  71         spin_unlock_bh(&nf_conntrack_expect_lock);
  72         nf_ct_expect_put(exp);
  73 }
  74
  75 static unsigned int nf_ct_expect_dst_hash(const struct nf_conntrack_tuple *tuple)
  76 {
  77         unsigned int hash;
  78
  79         if (unlikely(!nf_conntrack_hash_rnd)) {
  80                 init_nf_conntrack_hash_rnd();
  81         }
  82
  83         hash = jhash2(tuple->dst.u3.all, ARRAY_SIZE(tuple->dst.u3.all),
  84                       (((tuple->dst.protonum ^ tuple->src.l3num) << 16) |
  85                        (__force __u16)tuple->dst.u.all) ^ nf_conntrack_hash_rnd);
  86
  87         return reciprocal_scale(hash, nf_ct_expect_hsize);
  88 }
  89
  90 struct nf_conntrack_expect *
  91 __nf_ct_expect_find(struct net *net,
  92                     const struct nf_conntrack_zone *zone,
  93                     const struct nf_conntrack_tuple *tuple)
  94 {
  95         struct nf_conntrack_expect *i;
  96         unsigned int h;
  97
  98         if (!net->ct.expect_count)
  99                 return NULL;
 100
 101         h = nf_ct_expect_dst_hash(tuple);
 102         hlist_for_each_entry_rcu(i, &net->ct.expect_hash[h], hnode) {
 103                 if (nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask) &&
 104                     nf_ct_zone_equal_any(i->master, zone))
 105                         return i;
 106         }
 107         return NULL;
 108 }
 109 EXPORT_SYMBOL_GPL(__nf_ct_expect_find);
 110
 111 /* Just find a expectation corresponding to a tuple. */
 112 struct nf_conntrack_expect *
 113 nf_ct_expect_find_get(struct net *net,
 114                       const struct nf_conntrack_zone *zone,
 115                       const struct nf_conntrack_tuple *tuple)
 116 {
 117         struct nf_conntrack_expect *i;
 118
 119         rcu_read_lock();
 120         i = __nf_ct_expect_find(net, zone, tuple);
 121         if (i && !atomic_inc_not_zero(&i->use))
 122                 i = NULL;
 123         rcu_read_unlock();
 124
 125         return i;
 126 }
 127 EXPORT_SYMBOL_GPL(nf_ct_expect_find_get);
 128
 129 /* If an expectation for this connection is found, it gets delete from
 130  * global list then returned. */
 131 struct nf_conntrack_expect *
 132 nf_ct_find_expectation(struct net *net,
 133                        const struct nf_conntrack_zone *zone,
 134                        const struct nf_conntrack_tuple *tuple)
 135 {
 136         struct nf_conntrack_expect *i, *exp = NULL;
 137         unsigned int h;
 138
 139         if (!net->ct.expect_count)
 140                 return NULL;
 141
 142         h = nf_ct_expect_dst_hash(tuple);
 143         hlist_for_each_entry(i, &net->ct.expect_hash[h], hnode) {
 144                 if (!(i->flags & NF_CT_EXPECT_INACTIVE) &&
 145                     nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask) &&
 146                     nf_ct_zone_equal_any(i->master, zone)) {
 147                         exp = i;
 148                         break;
 149                 }
 150         }
 151         if (!exp)
 152                 return NULL;
 153
 154         /* If master is not in hash table yet (ie. packet hasn't left
 155            this machine yet), how can other end know about expected?
 156            Hence these are not the droids you are looking for (if
 157            master ct never got confirmed, we'd hold a reference to it
 158            and weird things would happen to future packets). */
 159         if (!nf_ct_is_confirmed(exp->master))
 160                 return NULL;
 161
 162         /* Avoid race with other CPUs, that for exp->master ct, is
 163          * about to invoke ->destroy(), or nf_ct_delete() via timeout
 164          * or early_drop().
 165          *
 166          * The atomic_inc_not_zero() check tells:  If that fails, we
 167          * know that the ct is being destroyed.  If it succeeds, we
 168          * can be sure the ct cannot disappear underneath.
 169          */
 170         if (unlikely(nf_ct_is_dying(exp->master) ||
 171                      !atomic_inc_not_zero(&exp->master->ct_general.use)))
 172                 return NULL;
 173
 174         if (exp->flags & NF_CT_EXPECT_PERMANENT) {
 175                 atomic_inc(&exp->use);
 176                 return exp;
 177         } else if (del_timer(&exp->timeout)) {
 178                 nf_ct_unlink_expect(exp);
 179                 return exp;
 180         }
 181         /* Undo exp->master refcnt increase, if del_timer() failed */
 182         nf_ct_put(exp->master);
 183
 184         return NULL;
 185 }
 186
 187 /* delete all expectations for this conntrack */
 188 void nf_ct_remove_expectations(struct nf_conn *ct)
 189 {
 190         struct nf_conn_help *help = nfct_help(ct);
 191         struct nf_conntrack_expect *exp;
 192         struct hlist_node *next;
 193
 194         /* Optimization: most connection never expect any others. */
 195         if (!help)
 196                 return;
 197
 198         spin_lock_bh(&nf_conntrack_expect_lock);
 199         hlist_for_each_entry_safe(exp, next, &help->expectations, lnode) {
 200                 if (del_timer(&exp->timeout)) {
 201                         nf_ct_unlink_expect(exp);
 202                         nf_ct_expect_put(exp);
 203                 }
 204         }
 205         spin_unlock_bh(&nf_conntrack_expect_lock);
 206 }
 207 EXPORT_SYMBOL_GPL(nf_ct_remove_expectations);
 208
 209 /* Would two expected things clash? */
 210 static inline int expect_clash(const struct nf_conntrack_expect *a,
 211                                const struct nf_conntrack_expect *b)
 212 {
 213         /* Part covered by intersection of masks must be unequal,
 214            otherwise they clash */
 215         struct nf_conntrack_tuple_mask intersect_mask;
 216         int count;
 217
 218         intersect_mask.src.u.all = a->mask.src.u.all & b->mask.src.u.all;
 219
 220         for (count = 0; count < NF_CT_TUPLE_L3SIZE; count++){
 221                 intersect_mask.src.u3.all[count] =
 222                         a->mask.src.u3.all[count] & b->mask.src.u3.all[count];
 223         }
 224
 225         return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask) &&
 226                nf_ct_zone_equal_any(a->master, nf_ct_zone(b->master));
 227 }
 228
 229 static inline int expect_matches(const struct nf_conntrack_expect *a,
 230                                  const struct nf_conntrack_expect *b)
 231 {
 232         return a->master == b->master && a->class == b->class &&
 233                nf_ct_tuple_equal(&a->tuple, &b->tuple) &&
 234                nf_ct_tuple_mask_equal(&a->mask, &b->mask) &&
 235                nf_ct_zone_equal_any(a->master, nf_ct_zone(b->master));
 236 }
 237
 238 /* Generally a bad idea to call this: could have matched already. */
 239 void nf_ct_unexpect_related(struct nf_conntrack_expect *exp)
 240 {
 241         spin_lock_bh(&nf_conntrack_expect_lock);
 242         if (del_timer(&exp->timeout)) {
 243                 nf_ct_unlink_expect(exp);
 244                 nf_ct_expect_put(exp);
 245         }
 246         spin_unlock_bh(&nf_conntrack_expect_lock);
 247 }
 248 EXPORT_SYMBOL_GPL(nf_ct_unexpect_related);
 249
 250 /* We don't increase the master conntrack refcount for non-fulfilled
 251  * conntracks. During the conntrack destruction, the expectations are
 252  * always killed before the conntrack itself */
 253 struct nf_conntrack_expect *nf_ct_expect_alloc(struct nf_conn *me)
 254 {
 255         struct nf_conntrack_expect *new;
 256
 257         new = kmem_cache_alloc(nf_ct_expect_cachep, GFP_ATOMIC);
 258         if (!new)
 259                 return NULL;
 260
 261         new->master = me;
 262         atomic_set(&new->use, 1);
 263         return new;
 264 }
 265 EXPORT_SYMBOL_GPL(nf_ct_expect_alloc);
 266
 267 void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class,
 268                        u_int8_t family,
 269                        const union nf_inet_addr *saddr,
 270                        const union nf_inet_addr *daddr,
 271                        u_int8_t proto, const __be16 *src, const __be16 *dst)
 272 {
 273         int len;
 274
 275         if (family == AF_INET)
 276                 len = 4;
 277         else
 278                 len = 16;
 279
 280         exp->flags = 0;
 281         exp->class = class;
 282         exp->expectfn = NULL;
 283         exp->helper = NULL;
 284         exp->tuple.src.l3num = family;
 285         exp->tuple.dst.protonum = proto;
 286
 287         if (saddr) {
 288                 memcpy(&exp->tuple.src.u3, saddr, len);
 289                 if (sizeof(exp->tuple.src.u3) > len)
 290                         /* address needs to be cleared for nf_ct_tuple_equal */
 291                         memset((void *)&exp->tuple.src.u3 + len, 0x00,
 292                                sizeof(exp->tuple.src.u3) - len);
 293                 memset(&exp->mask.src.u3, 0xFF, len);
 294                 if (sizeof(exp->mask.src.u3) > len)
 295                         memset((void *)&exp->mask.src.u3 + len, 0x00,
 296                                sizeof(exp->mask.src.u3) - len);
 297         } else {
 298                 memset(&exp->tuple.src.u3, 0x00, sizeof(exp->tuple.src.u3));
 299                 memset(&exp->mask.src.u3, 0x00, sizeof(exp->mask.src.u3));
 300         }
 301
 302         if (src) {
 303                 exp->tuple.src.u.all = *src;
 304                 exp->mask.src.u.all = htons(0xFFFF);
 305         } else {
 306                 exp->tuple.src.u.all = 0;
 307                 exp->mask.src.u.all = 0;
 308         }
 309
 310         memcpy(&exp->tuple.dst.u3, daddr, len);
 311         if (sizeof(exp->tuple.dst.u3) > len)
 312                 /* address needs to be cleared for nf_ct_tuple_equal */
 313                 memset((void *)&exp->tuple.dst.u3 + len, 0x00,
 314                        sizeof(exp->tuple.dst.u3) - len);
 315
 316         exp->tuple.dst.u.all = *dst;
 317
 318 #ifdef CONFIG_NF_NAT_NEEDED
 319         memset(&exp->saved_addr, 0, sizeof(exp->saved_addr));
 320         memset(&exp->saved_proto, 0, sizeof(exp->saved_proto));
 321 #endif
 322 }
 323 EXPORT_SYMBOL_GPL(nf_ct_expect_init);
 324
 325 static void nf_ct_expect_free_rcu(struct rcu_head *head)
 326 {
 327         struct nf_conntrack_expect *exp;
 328
 329         exp = container_of(head, struct nf_conntrack_expect, rcu);
 330         kmem_cache_free(nf_ct_expect_cachep, exp);
 331 }
 332
 333 void nf_ct_expect_put(struct nf_conntrack_expect *exp)
 334 {
 335         if (atomic_dec_and_test(&exp->use))
 336                 call_rcu(&exp->rcu, nf_ct_expect_free_rcu);
 337 }
 338 EXPORT_SYMBOL_GPL(nf_ct_expect_put);
 339
 340 static int nf_ct_expect_insert(struct nf_conntrack_expect *exp)
 341 {
 342         struct nf_conn_help *master_help = nfct_help(exp->master);
 343         struct nf_conntrack_helper *helper;
 344         struct net *net = nf_ct_exp_net(exp);
 345         unsigned int h = nf_ct_expect_dst_hash(&exp->tuple);
 346
 347         /* two references : one for hash insert, one for the timer */
 348         atomic_add(2, &exp->use);
 349
 350         hlist_add_head(&exp->lnode, &master_help->expectations);
 351         master_help->expecting[exp->class]++;
 352
 353         hlist_add_head_rcu(&exp->hnode, &net->ct.expect_hash[h]);
 354         net->ct.expect_count++;
 355
 356         setup_timer(&exp->timeout, nf_ct_expectation_timed_out,
 357                     (unsigned long)exp);
 358         helper = rcu_dereference_protected(master_help->helper,
 359                                            lockdep_is_held(&nf_conntrack_expect_lock));
 360         if (helper) {
 361                 exp->timeout.expires = jiffies +
 362                         helper->expect_policy[exp->class].timeout * HZ;
 363         }
 364         add_timer(&exp->timeout);
 365
 366         NF_CT_STAT_INC(net, expect_create);
 367         return 0;
 368 }
 369
 370 /* Race with expectations being used means we could have none to find; OK. */
 371 static void evict_oldest_expect(struct nf_conn *master,
 372                                 struct nf_conntrack_expect *new)
 373 {
 374         struct nf_conn_help *master_help = nfct_help(master);
 375         struct nf_conntrack_expect *exp, *last = NULL;
 376
 377         hlist_for_each_entry(exp, &master_help->expectations, lnode) {
 378                 if (exp->class == new->class)
 379                         last = exp;
 380         }
 381
 382         if (last && del_timer(&last->timeout)) {
 383                 nf_ct_unlink_expect(last);
 384                 nf_ct_expect_put(last);
 385         }
 386 }
 387
 388 static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect)
 389 {
 390         const struct nf_conntrack_expect_policy *p;
 391         struct nf_conntrack_expect *i;
 392         struct nf_conn *master = expect->master;
 393         struct nf_conn_help *master_help = nfct_help(master);
 394         struct nf_conntrack_helper *helper;
 395         struct net *net = nf_ct_exp_net(expect);
 396         struct hlist_node *next;
 397         unsigned int h;
 398         int ret = 1;
 399
 400         if (!master_help) {
 401                 ret = -ESHUTDOWN;
 402                 goto out;
 403         }
 404         h = nf_ct_expect_dst_hash(&expect->tuple);
 405         hlist_for_each_entry_safe(i, next, &net->ct.expect_hash[h], hnode) {
 406                 if (expect_matches(i, expect)) {
 407                         if (del_timer(&i->timeout)) {
 408                                 nf_ct_unlink_expect(i);
 409                                 nf_ct_expect_put(i);
 410                                 break;
 411                         }
 412                 } else if (expect_clash(i, expect)) {
 413                         ret = -EBUSY;
 414                         goto out;
 415                 }
 416         }
 417         /* Will be over limit? */
 418         helper = rcu_dereference_protected(master_help->helper,
 419                                            lockdep_is_held(&nf_conntrack_expect_lock));
 420         if (helper) {
 421                 p = &helper->expect_policy[expect->class];
 422                 if (p->max_expected &&
 423                     master_help->expecting[expect->class] >= p->max_expected) {
 424                         evict_oldest_expect(master, expect);
 425                         if (master_help->expecting[expect->class]
 426                                                 >= p->max_expected) {
 427                                 ret = -EMFILE;
 428                                 goto out;
 429                         }
 430                 }
 431         }
 432
 433         if (net->ct.expect_count >= nf_ct_expect_max) {
 434                 net_warn_ratelimited("nf_conntrack: expectation table full\n");
 435                 ret = -EMFILE;
 436         }
 437 out:
 438         return ret;
 439 }
 440
 441 int nf_ct_expect_related_report(struct nf_conntrack_expect *expect,
 442                                 u32 portid, int report)
 443 {
 444         int ret;
 445
 446         spin_lock_bh(&nf_conntrack_expect_lock);
 447         ret = __nf_ct_expect_check(expect);
 448         if (ret <= 0)
 449                 goto out;
 450
 451         ret = nf_ct_expect_insert(expect);
 452         if (ret < 0)
 453                 goto out;
 454         spin_unlock_bh(&nf_conntrack_expect_lock);
 455         nf_ct_expect_event_report(IPEXP_NEW, expect, portid, report);
 456         return ret;
 457 out:
 458         spin_unlock_bh(&nf_conntrack_expect_lock);
 459         return ret;
 460 }
 461 EXPORT_SYMBOL_GPL(nf_ct_expect_related_report);
 462
 463 #ifdef CONFIG_NF_CONNTRACK_PROCFS
 464 struct ct_expect_iter_state {
 465         struct seq_net_private p;
 466         unsigned int bucket;
 467 };
 468
 469 static struct hlist_node *ct_expect_get_first(struct seq_file *seq)
 470 {
 471         struct net *net = seq_file_net(seq);
 472         struct ct_expect_iter_state *st = seq->private;
 473         struct hlist_node *n;
 474
 475         for (st->bucket = 0; st->bucket < nf_ct_expect_hsize; st->bucket++) {
 476                 n = rcu_dereference(hlist_first_rcu(&net->ct.expect_hash[st->bucket]));
 477                 if (n)
 478                         return n;
 479         }
 480         return NULL;
 481 }
 482
 483 static struct hlist_node *ct_expect_get_next(struct seq_file *seq,
 484                                              struct hlist_node *head)
 485 {
 486         struct net *net = seq_file_net(seq);
 487         struct ct_expect_iter_state *st = seq->private;
 488
 489         head = rcu_dereference(hlist_next_rcu(head));
 490         while (head == NULL) {
 491                 if (++st->bucket >= nf_ct_expect_hsize)
 492                         return NULL;
 493                 head = rcu_dereference(hlist_first_rcu(&net->ct.expect_hash[st->bucket]));
 494         }
 495         return head;
 496 }
 497
 498 static struct hlist_node *ct_expect_get_idx(struct seq_file *seq, loff_t pos)
 499 {
 500         struct hlist_node *head = ct_expect_get_first(seq);
 501
 502         if (head)
 503                 while (pos && (head = ct_expect_get_next(seq, head)))
 504                         pos--;
 505         return pos ? NULL : head;
 506 }
 507
 508 static void *exp_seq_start(struct seq_file *seq, loff_t *pos)
 509         __acquires(RCU)
 510 {
 511         rcu_read_lock();
 512         return ct_expect_get_idx(seq, *pos);
 513 }
 514
 515 static void *exp_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 516 {
 517         (*pos)++;
 518         return ct_expect_get_next(seq, v);
 519 }
 520
 521 static void exp_seq_stop(struct seq_file *seq, void *v)
 522         __releases(RCU)
 523 {
 524         rcu_read_unlock();
 525 }
 526
 527 static int exp_seq_show(struct seq_file *s, void *v)
 528 {
 529         struct nf_conntrack_expect *expect;
 530         struct nf_conntrack_helper *helper;
 531         struct hlist_node *n = v;
 532         char *delim = "";
 533
 534         expect = hlist_entry(n, struct nf_conntrack_expect, hnode);
 535
 536         if (expect->timeout.function)
 537                 seq_printf(s, "%ld ", timer_pending(&expect->timeout)
 538                            ? (long)(expect->timeout.expires - jiffies)/HZ : 0);
 539         else
 540                 seq_printf(s, "- ");
 541         seq_printf(s, "l3proto = %u proto=%u ",
 542                    expect->tuple.src.l3num,
 543                    expect->tuple.dst.protonum);
 544         print_tuple(s, &expect->tuple,
 545                     __nf_ct_l3proto_find(expect->tuple.src.l3num),
 546                     __nf_ct_l4proto_find(expect->tuple.src.l3num,
 547                                        expect->tuple.dst.protonum));
 548
 549         if (expect->flags & NF_CT_EXPECT_PERMANENT) {
 550                 seq_printf(s, "PERMANENT");
 551                 delim = ",";
 552         }
 553         if (expect->flags & NF_CT_EXPECT_INACTIVE) {
 554                 seq_printf(s, "%sINACTIVE", delim);
 555                 delim = ",";
 556         }
 557         if (expect->flags & NF_CT_EXPECT_USERSPACE)
 558                 seq_printf(s, "%sUSERSPACE", delim);
 559
 560         helper = rcu_dereference(nfct_help(expect->master)->helper);
 561         if (helper) {
 562                 seq_printf(s, "%s%s", expect->flags ? " " : "", helper->name);
 563                 if (helper->expect_policy[expect->class].name)
 564                         seq_printf(s, "/%s",
 565                                    helper->expect_policy[expect->class].name);
 566         }
 567
 568         seq_putc(s, '\n');
 569
 570         return 0;
 571 }
 572
 573 static const struct seq_operations exp_seq_ops = {
 574         .start = exp_seq_start,
 575         .next = exp_seq_next,
 576         .stop = exp_seq_stop,
 577         .show = exp_seq_show
 578 };
 579
 580 static int exp_open(struct inode *inode, struct file *file)
 581 {
 582         return seq_open_net(inode, file, &exp_seq_ops,
 583                         sizeof(struct ct_expect_iter_state));
 584 }
 585
 586 static const struct file_operations exp_file_ops = {
 587         .owner   = THIS_MODULE,
 588         .open    = exp_open,
 589         .read    = seq_read,
 590         .llseek  = seq_lseek,
 591         .release = seq_release_net,
 592 };
 593 #endif /* CONFIG_NF_CONNTRACK_PROCFS */
 594
 595 static int exp_proc_init(struct net *net)
 596 {
 597 #ifdef CONFIG_NF_CONNTRACK_PROCFS
 598         struct proc_dir_entry *proc;
 599         kuid_t root_uid;
 600         kgid_t root_gid;
 601
 602         proc = proc_create("nf_conntrack_expect", 0440, net->proc_net,
 603                            &exp_file_ops);
 604         if (!proc)
 605                 return -ENOMEM;
 606
 607         root_uid = make_kuid(net->user_ns, 0);
 608         root_gid = make_kgid(net->user_ns, 0);
 609         if (uid_valid(root_uid) && gid_valid(root_gid))
 610                 proc_set_user(proc, root_uid, root_gid);
 611 #endif /* CONFIG_NF_CONNTRACK_PROCFS */
 612         return 0;
 613 }
 614
 615 static void exp_proc_remove(struct net *net)
 616 {
 617 #ifdef CONFIG_NF_CONNTRACK_PROCFS
 618         remove_proc_entry("nf_conntrack_expect", net->proc_net);
 619 #endif /* CONFIG_NF_CONNTRACK_PROCFS */
 620 }
 621
 622 module_param_named(expect_hashsize, nf_ct_expect_hsize, uint, 0400);
 623
 624 int nf_conntrack_expect_pernet_init(struct net *net)
 625 {
 626         int err = -ENOMEM;
 627
 628         net->ct.expect_count = 0;
 629         net->ct.expect_hash = nf_ct_alloc_hashtable(&nf_ct_expect_hsize, 0);
 630         if (net->ct.expect_hash == NULL)
 631                 goto err1;
 632
 633         err = exp_proc_init(net);
 634         if (err < 0)
 635                 goto err2;
 636
 637         return 0;
 638 err2:
 639         nf_ct_free_hashtable(net->ct.expect_hash, nf_ct_expect_hsize);
 640 err1:
 641         return err;
 642 }
 643
 644 void nf_conntrack_expect_pernet_fini(struct net *net)
 645 {
 646         exp_proc_remove(net);
 647         nf_ct_free_hashtable(net->ct.expect_hash, nf_ct_expect_hsize);
 648 }
 649
 650 int nf_conntrack_expect_init(void)
 651 {
 652         if (!nf_ct_expect_hsize) {
 653                 nf_ct_expect_hsize = nf_conntrack_htable_size / 256;
 654                 if (!nf_ct_expect_hsize)
 655                         nf_ct_expect_hsize = 1;
 656         }
 657         nf_ct_expect_max = nf_ct_expect_hsize * 4;
 658         nf_ct_expect_cachep = kmem_cache_create("nf_conntrack_expect",
 659                                 sizeof(struct nf_conntrack_expect),
 660                                 0, 0, NULL);
 661         if (!nf_ct_expect_cachep)
 662                 return -ENOMEM;
 663         return 0;
 664 }
 665
 666 void nf_conntrack_expect_fini(void)
 667 {
 668         rcu_barrier(); /* Wait for call_rcu() before destroy */
 669         kmem_cache_destroy(nf_ct_expect_cachep);
 670 }