1 /*
2  * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
3  * (C) 2012 by Vyatta Inc. <http://www.vyatta.com>
4  *
5  * This program is free software; you can redistribute it and/or modify
6  * it under the terms of the GNU General Public License version 2 as
7  * published by the Free Software Foundation (or any later at your option).
8  */
9 #include <linux/init.h>
10 #include <linux/module.h>
11 #include <linux/kernel.h>
12 #include <linux/rculist.h>
13 #include <linux/rculist_nulls.h>
14 #include <linux/types.h>
15 #include <linux/timer.h>
16 #include <linux/security.h>
17 #include <linux/skbuff.h>
18 #include <linux/errno.h>
19 #include <linux/netlink.h>
20 #include <linux/spinlock.h>
21 #include <linux/interrupt.h>
22 #include <linux/slab.h>
23 
24 #include <linux/netfilter.h>
25 #include <net/netlink.h>
26 #include <net/sock.h>
27 #include <net/netfilter/nf_conntrack.h>
28 #include <net/netfilter/nf_conntrack_core.h>
29 #include <net/netfilter/nf_conntrack_l3proto.h>
30 #include <net/netfilter/nf_conntrack_l4proto.h>
31 #include <net/netfilter/nf_conntrack_tuple.h>
32 #include <net/netfilter/nf_conntrack_timeout.h>
33 
34 #include <linux/netfilter/nfnetlink.h>
35 #include <linux/netfilter/nfnetlink_cttimeout.h>
36 
37 MODULE_LICENSE("GPL");
38 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
39 MODULE_DESCRIPTION("cttimeout: Extended Netfilter Connection Tracking timeout tuning");
40 
41 static const struct nla_policy cttimeout_nla_policy[CTA_TIMEOUT_MAX+1] = {
42 	[CTA_TIMEOUT_NAME]	= { .type = NLA_NUL_STRING,
43 				    .len  = CTNL_TIMEOUT_NAME_MAX - 1},
44 	[CTA_TIMEOUT_L3PROTO]	= { .type = NLA_U16 },
45 	[CTA_TIMEOUT_L4PROTO]	= { .type = NLA_U8 },
46 	[CTA_TIMEOUT_DATA]	= { .type = NLA_NESTED },
47 };
48 
49 static int
50 ctnl_timeout_parse_policy(void *timeouts, struct nf_conntrack_l4proto *l4proto,
51 			  struct net *net, const struct nlattr *attr)
52 {
53 	int ret = 0;
54 
55 	if (likely(l4proto->ctnl_timeout.nlattr_to_obj)) {
56 		struct nlattr *tb[l4proto->ctnl_timeout.nlattr_max+1];
57 
58 		ret = nla_parse_nested(tb, l4proto->ctnl_timeout.nlattr_max,
59 				       attr, l4proto->ctnl_timeout.nla_policy);
60 		if (ret < 0)
61 			return ret;
62 
63 		ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
64 	}
65 	return ret;
66 }
67 
68 static int cttimeout_new_timeout(struct net *net, struct sock *ctnl,
69 				 struct sk_buff *skb,
70 				 const struct nlmsghdr *nlh,
71 				 const struct nlattr * const cda[])
72 {
73 	__u16 l3num;
74 	__u8 l4num;
75 	struct nf_conntrack_l4proto *l4proto;
76 	struct ctnl_timeout *timeout, *matching = NULL;
77 	char *name;
78 	int ret;
79 
80 	if (!cda[CTA_TIMEOUT_NAME] ||
81 	    !cda[CTA_TIMEOUT_L3PROTO] ||
82 	    !cda[CTA_TIMEOUT_L4PROTO] ||
83 	    !cda[CTA_TIMEOUT_DATA])
84 		return -EINVAL;
85 
86 	name = nla_data(cda[CTA_TIMEOUT_NAME]);
87 	l3num = ntohs(nla_get_be16(cda[CTA_TIMEOUT_L3PROTO]));
88 	l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]);
89 
90 	list_for_each_entry(timeout, &net->nfct_timeout_list, head) {
91 		if (strncmp(timeout->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
92 			continue;
93 
94 		if (nlh->nlmsg_flags & NLM_F_EXCL)
95 			return -EEXIST;
96 
97 		matching = timeout;
98 		break;
99 	}
100 
101 	l4proto = nf_ct_l4proto_find_get(l3num, l4num);
102 
103 	/* This protocol is not supportted, skip. */
104 	if (l4proto->l4proto != l4num) {
105 		ret = -EOPNOTSUPP;
106 		goto err_proto_put;
107 	}
108 
109 	if (matching) {
110 		if (nlh->nlmsg_flags & NLM_F_REPLACE) {
111 			/* You cannot replace one timeout policy by another of
112 			 * different kind, sorry.
113 			 */
114 			if (matching->l3num != l3num ||
115 			    matching->l4proto->l4proto != l4num) {
116 				ret = -EINVAL;
117 				goto err_proto_put;
118 			}
119 
120 			ret = ctnl_timeout_parse_policy(&matching->data,
121 							l4proto, net,
122 							cda[CTA_TIMEOUT_DATA]);
123 			return ret;
124 		}
125 		ret = -EBUSY;
126 		goto err_proto_put;
127 	}
128 
129 	timeout = kzalloc(sizeof(struct ctnl_timeout) +
130 			  l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
131 	if (timeout == NULL) {
132 		ret = -ENOMEM;
133 		goto err_proto_put;
134 	}
135 
136 	ret = ctnl_timeout_parse_policy(&timeout->data, l4proto, net,
137 					cda[CTA_TIMEOUT_DATA]);
138 	if (ret < 0)
139 		goto err;
140 
141 	strcpy(timeout->name, nla_data(cda[CTA_TIMEOUT_NAME]));
142 	timeout->l3num = l3num;
143 	timeout->l4proto = l4proto;
144 	atomic_set(&timeout->refcnt, 1);
145 	list_add_tail_rcu(&timeout->head, &net->nfct_timeout_list);
146 
147 	return 0;
148 err:
149 	kfree(timeout);
150 err_proto_put:
151 	nf_ct_l4proto_put(l4proto);
152 	return ret;
153 }
154 
155 static int
156 ctnl_timeout_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
157 		       int event, struct ctnl_timeout *timeout)
158 {
159 	struct nlmsghdr *nlh;
160 	struct nfgenmsg *nfmsg;
161 	unsigned int flags = portid ? NLM_F_MULTI : 0;
162 	struct nf_conntrack_l4proto *l4proto = timeout->l4proto;
163 
164 	event |= NFNL_SUBSYS_CTNETLINK_TIMEOUT << 8;
165 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
166 	if (nlh == NULL)
167 		goto nlmsg_failure;
168 
169 	nfmsg = nlmsg_data(nlh);
170 	nfmsg->nfgen_family = AF_UNSPEC;
171 	nfmsg->version = NFNETLINK_V0;
172 	nfmsg->res_id = 0;
173 
174 	if (nla_put_string(skb, CTA_TIMEOUT_NAME, timeout->name) ||
175 	    nla_put_be16(skb, CTA_TIMEOUT_L3PROTO, htons(timeout->l3num)) ||
176 	    nla_put_u8(skb, CTA_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) ||
177 	    nla_put_be32(skb, CTA_TIMEOUT_USE,
178 			 htonl(atomic_read(&timeout->refcnt))))
179 		goto nla_put_failure;
180 
181 	if (likely(l4proto->ctnl_timeout.obj_to_nlattr)) {
182 		struct nlattr *nest_parms;
183 		int ret;
184 
185 		nest_parms = nla_nest_start(skb,
186 					    CTA_TIMEOUT_DATA | NLA_F_NESTED);
187 		if (!nest_parms)
188 			goto nla_put_failure;
189 
190 		ret = l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data);
191 		if (ret < 0)
192 			goto nla_put_failure;
193 
194 		nla_nest_end(skb, nest_parms);
195 	}
196 
197 	nlmsg_end(skb, nlh);
198 	return skb->len;
199 
200 nlmsg_failure:
201 nla_put_failure:
202 	nlmsg_cancel(skb, nlh);
203 	return -1;
204 }
205 
206 static int
207 ctnl_timeout_dump(struct sk_buff *skb, struct netlink_callback *cb)
208 {
209 	struct net *net = sock_net(skb->sk);
210 	struct ctnl_timeout *cur, *last;
211 
212 	if (cb->args[2])
213 		return 0;
214 
215 	last = (struct ctnl_timeout *)cb->args[1];
216 	if (cb->args[1])
217 		cb->args[1] = 0;
218 
219 	rcu_read_lock();
220 	list_for_each_entry_rcu(cur, &net->nfct_timeout_list, head) {
221 		if (last) {
222 			if (cur != last)
223 				continue;
224 
225 			last = NULL;
226 		}
227 		if (ctnl_timeout_fill_info(skb, NETLINK_CB(cb->skb).portid,
228 					   cb->nlh->nlmsg_seq,
229 					   NFNL_MSG_TYPE(cb->nlh->nlmsg_type),
230 					   IPCTNL_MSG_TIMEOUT_NEW, cur) < 0) {
231 			cb->args[1] = (unsigned long)cur;
232 			break;
233 		}
234 	}
235 	if (!cb->args[1])
236 		cb->args[2] = 1;
237 	rcu_read_unlock();
238 	return skb->len;
239 }
240 
241 static int cttimeout_get_timeout(struct net *net, struct sock *ctnl,
242 				 struct sk_buff *skb,
243 				 const struct nlmsghdr *nlh,
244 				 const struct nlattr * const cda[])
245 {
246 	int ret = -ENOENT;
247 	char *name;
248 	struct ctnl_timeout *cur;
249 
250 	if (nlh->nlmsg_flags & NLM_F_DUMP) {
251 		struct netlink_dump_control c = {
252 			.dump = ctnl_timeout_dump,
253 		};
254 		return netlink_dump_start(ctnl, skb, nlh, &c);
255 	}
256 
257 	if (!cda[CTA_TIMEOUT_NAME])
258 		return -EINVAL;
259 	name = nla_data(cda[CTA_TIMEOUT_NAME]);
260 
261 	list_for_each_entry(cur, &net->nfct_timeout_list, head) {
262 		struct sk_buff *skb2;
263 
264 		if (strncmp(cur->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
265 			continue;
266 
267 		skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
268 		if (skb2 == NULL) {
269 			ret = -ENOMEM;
270 			break;
271 		}
272 
273 		ret = ctnl_timeout_fill_info(skb2, NETLINK_CB(skb).portid,
274 					     nlh->nlmsg_seq,
275 					     NFNL_MSG_TYPE(nlh->nlmsg_type),
276 					     IPCTNL_MSG_TIMEOUT_NEW, cur);
277 		if (ret <= 0) {
278 			kfree_skb(skb2);
279 			break;
280 		}
281 		ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid,
282 					MSG_DONTWAIT);
283 		if (ret > 0)
284 			ret = 0;
285 
286 		/* this avoids a loop in nfnetlink. */
287 		return ret == -EAGAIN ? -ENOBUFS : ret;
288 	}
289 	return ret;
290 }
291 
292 static void untimeout(struct nf_conntrack_tuple_hash *i,
293 		      struct ctnl_timeout *timeout)
294 {
295 	struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(i);
296 	struct nf_conn_timeout *timeout_ext = nf_ct_timeout_find(ct);
297 
298 	if (timeout_ext && (!timeout || timeout_ext->timeout == timeout))
299 		RCU_INIT_POINTER(timeout_ext->timeout, NULL);
300 }
301 
302 static void ctnl_untimeout(struct net *net, struct ctnl_timeout *timeout)
303 {
304 	struct nf_conntrack_tuple_hash *h;
305 	const struct hlist_nulls_node *nn;
306 	int i;
307 
308 	local_bh_disable();
309 	for (i = 0; i < nf_conntrack_htable_size; i++) {
310 		nf_conntrack_lock(&nf_conntrack_locks[i % CONNTRACK_LOCKS]);
311 		if (i < nf_conntrack_htable_size) {
312 			hlist_nulls_for_each_entry(h, nn, &nf_conntrack_hash[i], hnnode)
313 				untimeout(h, timeout);
314 		}
315 		spin_unlock(&nf_conntrack_locks[i % CONNTRACK_LOCKS]);
316 	}
317 	local_bh_enable();
318 }
319 
320 /* try to delete object, fail if it is still in use. */
321 static int ctnl_timeout_try_del(struct net *net, struct ctnl_timeout *timeout)
322 {
323 	int ret = 0;
324 
325 	/* we want to avoid races with nf_ct_timeout_find_get. */
326 	if (atomic_dec_and_test(&timeout->refcnt)) {
327 		/* We are protected by nfnl mutex. */
328 		list_del_rcu(&timeout->head);
329 		nf_ct_l4proto_put(timeout->l4proto);
330 		ctnl_untimeout(net, timeout);
331 		kfree_rcu(timeout, rcu_head);
332 	} else {
333 		/* still in use, restore reference counter. */
334 		atomic_inc(&timeout->refcnt);
335 		ret = -EBUSY;
336 	}
337 	return ret;
338 }
339 
340 static int cttimeout_del_timeout(struct net *net, struct sock *ctnl,
341 				 struct sk_buff *skb,
342 				 const struct nlmsghdr *nlh,
343 				 const struct nlattr * const cda[])
344 {
345 	struct ctnl_timeout *cur;
346 	int ret = -ENOENT;
347 	char *name;
348 
349 	if (!cda[CTA_TIMEOUT_NAME]) {
350 		list_for_each_entry(cur, &net->nfct_timeout_list, head)
351 			ctnl_timeout_try_del(net, cur);
352 
353 		return 0;
354 	}
355 	name = nla_data(cda[CTA_TIMEOUT_NAME]);
356 
357 	list_for_each_entry(cur, &net->nfct_timeout_list, head) {
358 		if (strncmp(cur->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
359 			continue;
360 
361 		ret = ctnl_timeout_try_del(net, cur);
362 		if (ret < 0)
363 			return ret;
364 
365 		break;
366 	}
367 	return ret;
368 }
369 
370 static int cttimeout_default_set(struct net *net, struct sock *ctnl,
371 				 struct sk_buff *skb,
372 				 const struct nlmsghdr *nlh,
373 				 const struct nlattr * const cda[])
374 {
375 	__u16 l3num;
376 	__u8 l4num;
377 	struct nf_conntrack_l4proto *l4proto;
378 	unsigned int *timeouts;
379 	int ret;
380 
381 	if (!cda[CTA_TIMEOUT_L3PROTO] ||
382 	    !cda[CTA_TIMEOUT_L4PROTO] ||
383 	    !cda[CTA_TIMEOUT_DATA])
384 		return -EINVAL;
385 
386 	l3num = ntohs(nla_get_be16(cda[CTA_TIMEOUT_L3PROTO]));
387 	l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]);
388 	l4proto = nf_ct_l4proto_find_get(l3num, l4num);
389 
390 	/* This protocol is not supported, skip. */
391 	if (l4proto->l4proto != l4num) {
392 		ret = -EOPNOTSUPP;
393 		goto err;
394 	}
395 
396 	timeouts = l4proto->get_timeouts(net);
397 
398 	ret = ctnl_timeout_parse_policy(timeouts, l4proto, net,
399 					cda[CTA_TIMEOUT_DATA]);
400 	if (ret < 0)
401 		goto err;
402 
403 	nf_ct_l4proto_put(l4proto);
404 	return 0;
405 err:
406 	nf_ct_l4proto_put(l4proto);
407 	return ret;
408 }
409 
410 static int
411 cttimeout_default_fill_info(struct net *net, struct sk_buff *skb, u32 portid,
412 			    u32 seq, u32 type, int event,
413 			    struct nf_conntrack_l4proto *l4proto)
414 {
415 	struct nlmsghdr *nlh;
416 	struct nfgenmsg *nfmsg;
417 	unsigned int flags = portid ? NLM_F_MULTI : 0;
418 
419 	event |= NFNL_SUBSYS_CTNETLINK_TIMEOUT << 8;
420 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
421 	if (nlh == NULL)
422 		goto nlmsg_failure;
423 
424 	nfmsg = nlmsg_data(nlh);
425 	nfmsg->nfgen_family = AF_UNSPEC;
426 	nfmsg->version = NFNETLINK_V0;
427 	nfmsg->res_id = 0;
428 
429 	if (nla_put_be16(skb, CTA_TIMEOUT_L3PROTO, htons(l4proto->l3proto)) ||
430 	    nla_put_u8(skb, CTA_TIMEOUT_L4PROTO, l4proto->l4proto))
431 		goto nla_put_failure;
432 
433 	if (likely(l4proto->ctnl_timeout.obj_to_nlattr)) {
434 		struct nlattr *nest_parms;
435 		unsigned int *timeouts = l4proto->get_timeouts(net);
436 		int ret;
437 
438 		nest_parms = nla_nest_start(skb,
439 					    CTA_TIMEOUT_DATA | NLA_F_NESTED);
440 		if (!nest_parms)
441 			goto nla_put_failure;
442 
443 		ret = l4proto->ctnl_timeout.obj_to_nlattr(skb, timeouts);
444 		if (ret < 0)
445 			goto nla_put_failure;
446 
447 		nla_nest_end(skb, nest_parms);
448 	}
449 
450 	nlmsg_end(skb, nlh);
451 	return skb->len;
452 
453 nlmsg_failure:
454 nla_put_failure:
455 	nlmsg_cancel(skb, nlh);
456 	return -1;
457 }
458 
459 static int cttimeout_default_get(struct net *net, struct sock *ctnl,
460 				 struct sk_buff *skb,
461 				 const struct nlmsghdr *nlh,
462 				 const struct nlattr * const cda[])
463 {
464 	__u16 l3num;
465 	__u8 l4num;
466 	struct nf_conntrack_l4proto *l4proto;
467 	struct sk_buff *skb2;
468 	int ret, err;
469 
470 	if (!cda[CTA_TIMEOUT_L3PROTO] || !cda[CTA_TIMEOUT_L4PROTO])
471 		return -EINVAL;
472 
473 	l3num = ntohs(nla_get_be16(cda[CTA_TIMEOUT_L3PROTO]));
474 	l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]);
475 	l4proto = nf_ct_l4proto_find_get(l3num, l4num);
476 
477 	/* This protocol is not supported, skip. */
478 	if (l4proto->l4proto != l4num) {
479 		err = -EOPNOTSUPP;
480 		goto err;
481 	}
482 
483 	skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
484 	if (skb2 == NULL) {
485 		err = -ENOMEM;
486 		goto err;
487 	}
488 
489 	ret = cttimeout_default_fill_info(net, skb2, NETLINK_CB(skb).portid,
490 					  nlh->nlmsg_seq,
491 					  NFNL_MSG_TYPE(nlh->nlmsg_type),
492 					  IPCTNL_MSG_TIMEOUT_DEFAULT_SET,
493 					  l4proto);
494 	if (ret <= 0) {
495 		kfree_skb(skb2);
496 		err = -ENOMEM;
497 		goto err;
498 	}
499 	ret = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid, MSG_DONTWAIT);
500 	if (ret > 0)
501 		ret = 0;
502 
503 	/* this avoids a loop in nfnetlink. */
504 	return ret == -EAGAIN ? -ENOBUFS : ret;
505 err:
506 	nf_ct_l4proto_put(l4proto);
507 	return err;
508 }
509 
510 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
511 static struct ctnl_timeout *
512 ctnl_timeout_find_get(struct net *net, const char *name)
513 {
514 	struct ctnl_timeout *timeout, *matching = NULL;
515 
516 	rcu_read_lock();
517 	list_for_each_entry_rcu(timeout, &net->nfct_timeout_list, head) {
518 		if (strncmp(timeout->name, name, CTNL_TIMEOUT_NAME_MAX) != 0)
519 			continue;
520 
521 		if (!try_module_get(THIS_MODULE))
522 			goto err;
523 
524 		if (!atomic_inc_not_zero(&timeout->refcnt)) {
525 			module_put(THIS_MODULE);
526 			goto err;
527 		}
528 		matching = timeout;
529 		break;
530 	}
531 err:
532 	rcu_read_unlock();
533 	return matching;
534 }
535 
536 static void ctnl_timeout_put(struct ctnl_timeout *timeout)
537 {
538 	atomic_dec(&timeout->refcnt);
539 	module_put(THIS_MODULE);
540 }
541 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
542 
543 static const struct nfnl_callback cttimeout_cb[IPCTNL_MSG_TIMEOUT_MAX] = {
544 	[IPCTNL_MSG_TIMEOUT_NEW]	= { .call = cttimeout_new_timeout,
545 					    .attr_count = CTA_TIMEOUT_MAX,
546 					    .policy = cttimeout_nla_policy },
547 	[IPCTNL_MSG_TIMEOUT_GET]	= { .call = cttimeout_get_timeout,
548 					    .attr_count = CTA_TIMEOUT_MAX,
549 					    .policy = cttimeout_nla_policy },
550 	[IPCTNL_MSG_TIMEOUT_DELETE]	= { .call = cttimeout_del_timeout,
551 					    .attr_count = CTA_TIMEOUT_MAX,
552 					    .policy = cttimeout_nla_policy },
553 	[IPCTNL_MSG_TIMEOUT_DEFAULT_SET]= { .call = cttimeout_default_set,
554 					    .attr_count = CTA_TIMEOUT_MAX,
555 					    .policy = cttimeout_nla_policy },
556 	[IPCTNL_MSG_TIMEOUT_DEFAULT_GET]= { .call = cttimeout_default_get,
557 					    .attr_count = CTA_TIMEOUT_MAX,
558 					    .policy = cttimeout_nla_policy },
559 };
560 
561 static const struct nfnetlink_subsystem cttimeout_subsys = {
562 	.name				= "conntrack_timeout",
563 	.subsys_id			= NFNL_SUBSYS_CTNETLINK_TIMEOUT,
564 	.cb_count			= IPCTNL_MSG_TIMEOUT_MAX,
565 	.cb				= cttimeout_cb,
566 };
567 
568 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_TIMEOUT);
569 
570 static int __net_init cttimeout_net_init(struct net *net)
571 {
572 	INIT_LIST_HEAD(&net->nfct_timeout_list);
573 
574 	return 0;
575 }
576 
577 static void __net_exit cttimeout_net_exit(struct net *net)
578 {
579 	struct ctnl_timeout *cur, *tmp;
580 
581 	ctnl_untimeout(net, NULL);
582 
583 	list_for_each_entry_safe(cur, tmp, &net->nfct_timeout_list, head) {
584 		list_del_rcu(&cur->head);
585 		nf_ct_l4proto_put(cur->l4proto);
586 		kfree_rcu(cur, rcu_head);
587 	}
588 }
589 
590 static struct pernet_operations cttimeout_ops = {
591 	.init	= cttimeout_net_init,
592 	.exit	= cttimeout_net_exit,
593 };
594 
595 static int __init cttimeout_init(void)
596 {
597 	int ret;
598 
599 	ret = register_pernet_subsys(&cttimeout_ops);
600 	if (ret < 0)
601 		return ret;
602 
603 	ret = nfnetlink_subsys_register(&cttimeout_subsys);
604 	if (ret < 0) {
605 		pr_err("cttimeout_init: cannot register cttimeout with "
606 			"nfnetlink.\n");
607 		goto err_out;
608 	}
609 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
610 	RCU_INIT_POINTER(nf_ct_timeout_find_get_hook, ctnl_timeout_find_get);
611 	RCU_INIT_POINTER(nf_ct_timeout_put_hook, ctnl_timeout_put);
612 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
613 	return 0;
614 
615 err_out:
616 	unregister_pernet_subsys(&cttimeout_ops);
617 	return ret;
618 }
619 
620 static void __exit cttimeout_exit(void)
621 {
622 	pr_info("cttimeout: unregistering from nfnetlink.\n");
623 
624 	nfnetlink_subsys_unregister(&cttimeout_subsys);
625 
626 	unregister_pernet_subsys(&cttimeout_ops);
627 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
628 	RCU_INIT_POINTER(nf_ct_timeout_find_get_hook, NULL);
629 	RCU_INIT_POINTER(nf_ct_timeout_put_hook, NULL);
630 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
631 	rcu_barrier();
632 }
633 
634 module_init(cttimeout_init);
635 module_exit(cttimeout_exit);
636