1 /* This file contains all the functions required for the standalone
4 These are not required by the compatibility layer.
7 /* (C) 1999-2001 Paul `Rusty' Russell
8 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2 as
12 * published by the Free Software Foundation.
14 * 16 Dec 2003: Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp>
15 * - generalize L3 protocol dependent part.
17 * Derived from net/ipv4/netfilter/ip_conntrack_standalone.c
20 #include <linux/types.h>
21 #include <linux/netfilter.h>
22 #include <linux/module.h>
23 #include <linux/skbuff.h>
24 #include <linux/proc_fs.h>
25 #include <linux/seq_file.h>
26 #include <linux/percpu.h>
27 #include <linux/netdevice.h>
29 #include <linux/sysctl.h>
32 #include <net/netfilter/nf_conntrack.h>
33 #include <net/netfilter/nf_conntrack_core.h>
34 #include <net/netfilter/nf_conntrack_l3proto.h>
35 #include <net/netfilter/nf_conntrack_l4proto.h>
36 #include <net/netfilter/nf_conntrack_expect.h>
37 #include <net/netfilter/nf_conntrack_helper.h>
42 #define DEBUGP(format, args...)
45 MODULE_LICENSE("GPL");
49 print_tuple(struct seq_file
*s
, const struct nf_conntrack_tuple
*tuple
,
50 struct nf_conntrack_l3proto
*l3proto
,
51 struct nf_conntrack_l4proto
*l4proto
)
53 return l3proto
->print_tuple(s
, tuple
) || l4proto
->print_tuple(s
, tuple
);
56 #ifdef CONFIG_NF_CT_ACCT
58 seq_print_counters(struct seq_file
*s
,
59 const struct ip_conntrack_counter
*counter
)
61 return seq_printf(s
, "packets=%llu bytes=%llu ",
62 (unsigned long long)counter
->packets
,
63 (unsigned long long)counter
->bytes
);
66 #define seq_print_counters(x, y) 0
69 struct ct_iter_state
{
73 static struct list_head
*ct_get_first(struct seq_file
*seq
)
75 struct ct_iter_state
*st
= seq
->private;
78 st
->bucket
< nf_conntrack_htable_size
;
80 if (!list_empty(&nf_conntrack_hash
[st
->bucket
]))
81 return nf_conntrack_hash
[st
->bucket
].next
;
86 static struct list_head
*ct_get_next(struct seq_file
*seq
, struct list_head
*head
)
88 struct ct_iter_state
*st
= seq
->private;
91 while (head
== &nf_conntrack_hash
[st
->bucket
]) {
92 if (++st
->bucket
>= nf_conntrack_htable_size
)
94 head
= nf_conntrack_hash
[st
->bucket
].next
;
99 static struct list_head
*ct_get_idx(struct seq_file
*seq
, loff_t pos
)
101 struct list_head
*head
= ct_get_first(seq
);
104 while (pos
&& (head
= ct_get_next(seq
, head
)))
106 return pos
? NULL
: head
;
109 static void *ct_seq_start(struct seq_file
*seq
, loff_t
*pos
)
111 read_lock_bh(&nf_conntrack_lock
);
112 return ct_get_idx(seq
, *pos
);
115 static void *ct_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
118 return ct_get_next(s
, v
);
121 static void ct_seq_stop(struct seq_file
*s
, void *v
)
123 read_unlock_bh(&nf_conntrack_lock
);
126 /* return 0 on success, 1 in case of error */
127 static int ct_seq_show(struct seq_file
*s
, void *v
)
129 const struct nf_conntrack_tuple_hash
*hash
= v
;
130 const struct nf_conn
*conntrack
= nf_ct_tuplehash_to_ctrack(hash
);
131 struct nf_conntrack_l3proto
*l3proto
;
132 struct nf_conntrack_l4proto
*l4proto
;
134 NF_CT_ASSERT(conntrack
);
136 /* we only want to print DIR_ORIGINAL */
137 if (NF_CT_DIRECTION(hash
))
140 l3proto
= __nf_ct_l3proto_find(conntrack
->tuplehash
[IP_CT_DIR_ORIGINAL
]
143 NF_CT_ASSERT(l3proto
);
144 l4proto
= __nf_ct_l4proto_find(conntrack
->tuplehash
[IP_CT_DIR_ORIGINAL
]
146 conntrack
->tuplehash
[IP_CT_DIR_ORIGINAL
]
147 .tuple
.dst
.protonum
);
148 NF_CT_ASSERT(l4proto
);
150 if (seq_printf(s
, "%-8s %u %-8s %u %ld ",
152 conntrack
->tuplehash
[IP_CT_DIR_ORIGINAL
].tuple
.src
.l3num
,
154 conntrack
->tuplehash
[IP_CT_DIR_ORIGINAL
].tuple
.dst
.protonum
,
155 timer_pending(&conntrack
->timeout
)
156 ? (long)(conntrack
->timeout
.expires
- jiffies
)/HZ
: 0) != 0)
159 if (l3proto
->print_conntrack(s
, conntrack
))
162 if (l4proto
->print_conntrack(s
, conntrack
))
165 if (print_tuple(s
, &conntrack
->tuplehash
[IP_CT_DIR_ORIGINAL
].tuple
,
169 if (seq_print_counters(s
, &conntrack
->counters
[IP_CT_DIR_ORIGINAL
]))
172 if (!(test_bit(IPS_SEEN_REPLY_BIT
, &conntrack
->status
)))
173 if (seq_printf(s
, "[UNREPLIED] "))
176 if (print_tuple(s
, &conntrack
->tuplehash
[IP_CT_DIR_REPLY
].tuple
,
180 if (seq_print_counters(s
, &conntrack
->counters
[IP_CT_DIR_REPLY
]))
183 if (test_bit(IPS_ASSURED_BIT
, &conntrack
->status
))
184 if (seq_printf(s
, "[ASSURED] "))
187 #if defined(CONFIG_NF_CONNTRACK_MARK)
188 if (seq_printf(s
, "mark=%u ", conntrack
->mark
))
192 #ifdef CONFIG_NF_CONNTRACK_SECMARK
193 if (seq_printf(s
, "secmark=%u ", conntrack
->secmark
))
197 if (seq_printf(s
, "use=%u\n", atomic_read(&conntrack
->ct_general
.use
)))
203 static struct seq_operations ct_seq_ops
= {
204 .start
= ct_seq_start
,
210 static int ct_open(struct inode
*inode
, struct file
*file
)
212 struct seq_file
*seq
;
213 struct ct_iter_state
*st
;
216 st
= kmalloc(sizeof(struct ct_iter_state
), GFP_KERNEL
);
219 ret
= seq_open(file
, &ct_seq_ops
);
222 seq
= file
->private_data
;
224 memset(st
, 0, sizeof(struct ct_iter_state
));
231 static struct file_operations ct_file_ops
= {
232 .owner
= THIS_MODULE
,
236 .release
= seq_release_private
,
239 static void *ct_cpu_seq_start(struct seq_file
*seq
, loff_t
*pos
)
244 return SEQ_START_TOKEN
;
246 for (cpu
= *pos
-1; cpu
< NR_CPUS
; ++cpu
) {
247 if (!cpu_possible(cpu
))
250 return &per_cpu(nf_conntrack_stat
, cpu
);
256 static void *ct_cpu_seq_next(struct seq_file
*seq
, void *v
, loff_t
*pos
)
260 for (cpu
= *pos
; cpu
< NR_CPUS
; ++cpu
) {
261 if (!cpu_possible(cpu
))
264 return &per_cpu(nf_conntrack_stat
, cpu
);
270 static void ct_cpu_seq_stop(struct seq_file
*seq
, void *v
)
274 static int ct_cpu_seq_show(struct seq_file
*seq
, void *v
)
276 unsigned int nr_conntracks
= atomic_read(&nf_conntrack_count
);
277 struct ip_conntrack_stat
*st
= v
;
279 if (v
== SEQ_START_TOKEN
) {
280 seq_printf(seq
, "entries searched found new invalid ignore delete delete_list insert insert_failed drop early_drop icmp_error expect_new expect_create expect_delete\n");
284 seq_printf(seq
, "%08x %08x %08x %08x %08x %08x %08x %08x "
285 "%08x %08x %08x %08x %08x %08x %08x %08x \n",
307 static struct seq_operations ct_cpu_seq_ops
= {
308 .start
= ct_cpu_seq_start
,
309 .next
= ct_cpu_seq_next
,
310 .stop
= ct_cpu_seq_stop
,
311 .show
= ct_cpu_seq_show
,
314 static int ct_cpu_seq_open(struct inode
*inode
, struct file
*file
)
316 return seq_open(file
, &ct_cpu_seq_ops
);
319 static struct file_operations ct_cpu_seq_fops
= {
320 .owner
= THIS_MODULE
,
321 .open
= ct_cpu_seq_open
,
324 .release
= seq_release_private
,
326 #endif /* CONFIG_PROC_FS */
330 int nf_conntrack_checksum __read_mostly
= 1;
333 /* Log invalid packets of a given protocol */
334 static int log_invalid_proto_min
= 0;
335 static int log_invalid_proto_max
= 255;
337 static struct ctl_table_header
*nf_ct_sysctl_header
;
339 static ctl_table nf_ct_sysctl_table
[] = {
341 .ctl_name
= NET_NF_CONNTRACK_MAX
,
342 .procname
= "nf_conntrack_max",
343 .data
= &nf_conntrack_max
,
344 .maxlen
= sizeof(int),
346 .proc_handler
= &proc_dointvec
,
349 .ctl_name
= NET_NF_CONNTRACK_COUNT
,
350 .procname
= "nf_conntrack_count",
351 .data
= &nf_conntrack_count
,
352 .maxlen
= sizeof(int),
354 .proc_handler
= &proc_dointvec
,
357 .ctl_name
= NET_NF_CONNTRACK_BUCKETS
,
358 .procname
= "nf_conntrack_buckets",
359 .data
= &nf_conntrack_htable_size
,
360 .maxlen
= sizeof(unsigned int),
362 .proc_handler
= &proc_dointvec
,
365 .ctl_name
= NET_NF_CONNTRACK_CHECKSUM
,
366 .procname
= "nf_conntrack_checksum",
367 .data
= &nf_conntrack_checksum
,
368 .maxlen
= sizeof(unsigned int),
370 .proc_handler
= &proc_dointvec
,
373 .ctl_name
= NET_NF_CONNTRACK_LOG_INVALID
,
374 .procname
= "nf_conntrack_log_invalid",
375 .data
= &nf_ct_log_invalid
,
376 .maxlen
= sizeof(unsigned int),
378 .proc_handler
= &proc_dointvec_minmax
,
379 .strategy
= &sysctl_intvec
,
380 .extra1
= &log_invalid_proto_min
,
381 .extra2
= &log_invalid_proto_max
,
387 #define NET_NF_CONNTRACK_MAX 2089
389 static ctl_table nf_ct_netfilter_table
[] = {
391 .ctl_name
= NET_NETFILTER
,
392 .procname
= "netfilter",
394 .child
= nf_ct_sysctl_table
,
397 .ctl_name
= NET_NF_CONNTRACK_MAX
,
398 .procname
= "nf_conntrack_max",
399 .data
= &nf_conntrack_max
,
400 .maxlen
= sizeof(int),
402 .proc_handler
= &proc_dointvec
,
407 static ctl_table nf_ct_net_table
[] = {
412 .child
= nf_ct_netfilter_table
,
416 EXPORT_SYMBOL(nf_ct_log_invalid
);
417 #endif /* CONFIG_SYSCTL */
419 static int __init
nf_conntrack_standalone_init(void)
421 #ifdef CONFIG_PROC_FS
422 struct proc_dir_entry
*proc
, *proc_exp
, *proc_stat
;
426 ret
= nf_conntrack_init();
430 #ifdef CONFIG_PROC_FS
431 proc
= proc_net_fops_create("nf_conntrack", 0440, &ct_file_ops
);
432 if (!proc
) goto cleanup_init
;
434 proc_exp
= proc_net_fops_create("nf_conntrack_expect", 0440,
436 if (!proc_exp
) goto cleanup_proc
;
438 proc_stat
= create_proc_entry("nf_conntrack", S_IRUGO
, proc_net_stat
);
440 goto cleanup_proc_exp
;
442 proc_stat
->proc_fops
= &ct_cpu_seq_fops
;
443 proc_stat
->owner
= THIS_MODULE
;
446 nf_ct_sysctl_header
= register_sysctl_table(nf_ct_net_table
, 0);
447 if (nf_ct_sysctl_header
== NULL
) {
448 printk("nf_conntrack: can't register to sysctl.\n");
450 goto cleanup_proc_stat
;
458 #ifdef CONFIG_PROC_FS
459 remove_proc_entry("nf_conntrack", proc_net_stat
);
461 proc_net_remove("nf_conntrack_expect");
463 proc_net_remove("nf_conntrack");
465 #endif /* CNFIG_PROC_FS */
466 nf_conntrack_cleanup();
470 static void __exit
nf_conntrack_standalone_fini(void)
473 unregister_sysctl_table(nf_ct_sysctl_header
);
475 #ifdef CONFIG_PROC_FS
476 remove_proc_entry("nf_conntrack", proc_net_stat
);
477 proc_net_remove("nf_conntrack_expect");
478 proc_net_remove("nf_conntrack");
479 #endif /* CNFIG_PROC_FS */
480 nf_conntrack_cleanup();
483 module_init(nf_conntrack_standalone_init
);
484 module_exit(nf_conntrack_standalone_fini
);
486 /* Some modules need us, but don't depend directly on any symbol.
487 They should call this. */
488 void need_conntrack(void)
492 #ifdef CONFIG_NF_CONNTRACK_EVENTS
493 EXPORT_SYMBOL_GPL(nf_conntrack_chain
);
494 EXPORT_SYMBOL_GPL(nf_conntrack_expect_chain
);
495 EXPORT_SYMBOL_GPL(nf_conntrack_register_notifier
);
496 EXPORT_SYMBOL_GPL(nf_conntrack_unregister_notifier
);
497 EXPORT_SYMBOL_GPL(__nf_ct_event_cache_init
);
498 EXPORT_PER_CPU_SYMBOL_GPL(nf_conntrack_ecache
);
499 EXPORT_SYMBOL_GPL(nf_ct_deliver_cached_events
);
501 EXPORT_SYMBOL(nf_ct_l3proto_try_module_get
);
502 EXPORT_SYMBOL(nf_ct_l3proto_module_put
);
503 EXPORT_SYMBOL(nf_conntrack_l3proto_register
);
504 EXPORT_SYMBOL(nf_conntrack_l3proto_unregister
);
505 EXPORT_SYMBOL(nf_conntrack_l4proto_register
);
506 EXPORT_SYMBOL(nf_conntrack_l4proto_unregister
);
507 EXPORT_SYMBOL(nf_ct_invert_tuplepr
);
508 EXPORT_SYMBOL(nf_conntrack_destroyed
);
509 EXPORT_SYMBOL(need_conntrack
);
510 EXPORT_SYMBOL(nf_conntrack_helper_register
);
511 EXPORT_SYMBOL(nf_conntrack_helper_unregister
);
512 EXPORT_SYMBOL(nf_ct_iterate_cleanup
);
513 EXPORT_SYMBOL(__nf_ct_refresh_acct
);
514 EXPORT_SYMBOL(nf_ct_protos
);
515 EXPORT_SYMBOL(__nf_ct_l4proto_find
);
516 EXPORT_SYMBOL(nf_ct_l4proto_find_get
);
517 EXPORT_SYMBOL(nf_ct_l4proto_put
);
518 EXPORT_SYMBOL(nf_ct_l3proto_find_get
);
519 EXPORT_SYMBOL(nf_ct_l3proto_put
);
520 EXPORT_SYMBOL(nf_ct_l3protos
);
521 EXPORT_SYMBOL_GPL(nf_conntrack_checksum
);
522 EXPORT_SYMBOL(nf_conntrack_expect_alloc
);
523 EXPORT_SYMBOL(nf_conntrack_expect_put
);
524 EXPORT_SYMBOL(nf_conntrack_expect_related
);
525 EXPORT_SYMBOL(nf_conntrack_unexpect_related
);
526 EXPORT_SYMBOL(nf_conntrack_tuple_taken
);
527 EXPORT_SYMBOL(nf_conntrack_htable_size
);
528 EXPORT_SYMBOL(nf_conntrack_lock
);
529 EXPORT_SYMBOL(nf_conntrack_hash
);
530 EXPORT_SYMBOL(nf_conntrack_untracked
);
531 EXPORT_SYMBOL_GPL(nf_conntrack_find_get
);
532 #ifdef CONFIG_IP_NF_NAT_NEEDED
533 EXPORT_SYMBOL(nf_conntrack_tcp_update
);
535 EXPORT_SYMBOL(__nf_conntrack_confirm
);
536 EXPORT_SYMBOL(nf_ct_get_tuple
);
537 EXPORT_SYMBOL(nf_ct_invert_tuple
);
538 EXPORT_SYMBOL(nf_conntrack_in
);
539 EXPORT_SYMBOL(__nf_conntrack_attach
);
540 EXPORT_SYMBOL(nf_conntrack_alloc
);
541 EXPORT_SYMBOL(nf_conntrack_free
);
542 EXPORT_SYMBOL(nf_conntrack_flush
);
543 EXPORT_SYMBOL(nf_ct_remove_expectations
);
544 EXPORT_SYMBOL(nf_ct_helper_find_get
);
545 EXPORT_SYMBOL(nf_ct_helper_put
);
546 EXPORT_SYMBOL(__nf_conntrack_helper_find_byname
);
547 EXPORT_SYMBOL(__nf_conntrack_find
);
548 EXPORT_SYMBOL(nf_ct_unlink_expect
);
549 EXPORT_SYMBOL(nf_conntrack_hash_insert
);
550 EXPORT_SYMBOL(__nf_conntrack_expect_find
);
551 EXPORT_SYMBOL(nf_conntrack_expect_find
);
552 EXPORT_SYMBOL(nf_conntrack_expect_list
);
553 #if defined(CONFIG_NF_CT_NETLINK) || \
554 defined(CONFIG_NF_CT_NETLINK_MODULE)
555 EXPORT_SYMBOL(nf_ct_port_tuple_to_nfattr
);
556 EXPORT_SYMBOL(nf_ct_port_nfattr_to_tuple
);