net/netfilter/nf_conntrack_standalone.c

   1 /* (C) 1999-2001 Paul `Rusty' Russell
   2  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 as
   6  * published by the Free Software Foundation.
   7  */
   8
   9 #include <linux/types.h>
  10 #include <linux/netfilter.h>
  11 #include <linux/module.h>
  12 #include <linux/skbuff.h>
  13 #include <linux/proc_fs.h>
  14 #include <linux/seq_file.h>
  15 #include <linux/percpu.h>
  16 #include <linux/netdevice.h>
  17 #include <net/net_namespace.h>
  18 #ifdef CONFIG_SYSCTL
  19 #include <linux/sysctl.h>
  20 #endif
  21
  22 #include <net/netfilter/nf_conntrack.h>
  23 #include <net/netfilter/nf_conntrack_core.h>
  24 #include <net/netfilter/nf_conntrack_l3proto.h>
  25 #include <net/netfilter/nf_conntrack_l4proto.h>
  26 #include <net/netfilter/nf_conntrack_expect.h>
  27 #include <net/netfilter/nf_conntrack_helper.h>
  28 #include <net/netfilter/nf_conntrack_acct.h>
  29
  30 MODULE_LICENSE("GPL");
  31
  32 #ifdef CONFIG_PROC_FS
  33 int
  34 print_tuple(struct seq_file *s, const struct nf_conntrack_tuple *tuple,
  35             const struct nf_conntrack_l3proto *l3proto,
  36             const struct nf_conntrack_l4proto *l4proto)
  37 {
  38         return l3proto->print_tuple(s, tuple) || l4proto->print_tuple(s, tuple);
  39 }
  40 EXPORT_SYMBOL_GPL(print_tuple);
  41
  42 struct ct_iter_state {
  43         unsigned int bucket;
  44 };
  45
  46 static struct hlist_node *ct_get_first(struct seq_file *seq)
  47 {
  48         struct ct_iter_state *st = seq->private;
  49         struct hlist_node *n;
  50
  51         for (st->bucket = 0;
  52              st->bucket < nf_conntrack_htable_size;
  53              st->bucket++) {
  54                 n = rcu_dereference(nf_conntrack_hash[st->bucket].first);
  55                 if (n)
  56                         return n;
  57         }
  58         return NULL;
  59 }
  60
  61 static struct hlist_node *ct_get_next(struct seq_file *seq,
  62                                       struct hlist_node *head)
  63 {
  64         struct ct_iter_state *st = seq->private;
  65
  66         head = rcu_dereference(head->next);
  67         while (head == NULL) {
  68                 if (++st->bucket >= nf_conntrack_htable_size)
  69                         return NULL;
  70                 head = rcu_dereference(nf_conntrack_hash[st->bucket].first);
  71         }
  72         return head;
  73 }
  74
  75 static struct hlist_node *ct_get_idx(struct seq_file *seq, loff_t pos)
  76 {
  77         struct hlist_node *head = ct_get_first(seq);
  78
  79         if (head)
  80                 while (pos && (head = ct_get_next(seq, head)))
  81                         pos--;
  82         return pos ? NULL : head;
  83 }
  84
  85 static void *ct_seq_start(struct seq_file *seq, loff_t *pos)
  86         __acquires(RCU)
  87 {
  88         rcu_read_lock();
  89         return ct_get_idx(seq, *pos);
  90 }
  91
  92 static void *ct_seq_next(struct seq_file *s, void *v, loff_t *pos)
  93 {
  94         (*pos)++;
  95         return ct_get_next(s, v);
  96 }
  97
  98 static void ct_seq_stop(struct seq_file *s, void *v)
  99         __releases(RCU)
 100 {
 101         rcu_read_unlock();
 102 }
 103
 104 /* return 0 on success, 1 in case of error */
 105 static int ct_seq_show(struct seq_file *s, void *v)
 106 {
 107         const struct nf_conntrack_tuple_hash *hash = v;
 108         const struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(hash);
 109         const struct nf_conntrack_l3proto *l3proto;
 110         const struct nf_conntrack_l4proto *l4proto;
 111
 112         NF_CT_ASSERT(ct);
 113
 114         /* we only want to print DIR_ORIGINAL */
 115         if (NF_CT_DIRECTION(hash))
 116                 return 0;
 117
 118         l3proto = __nf_ct_l3proto_find(nf_ct_l3num(ct));
 119         NF_CT_ASSERT(l3proto);
 120         l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
 121         NF_CT_ASSERT(l4proto);
 122
 123         if (seq_printf(s, "%-8s %u %-8s %u %ld ",
 124                        l3proto->name, nf_ct_l3num(ct),
 125                        l4proto->name, nf_ct_protonum(ct),
 126                        timer_pending(&ct->timeout)
 127                        ? (long)(ct->timeout.expires - jiffies)/HZ : 0) != 0)
 128                 return -ENOSPC;
 129
 130         if (l4proto->print_conntrack && l4proto->print_conntrack(s, ct))
 131                 return -ENOSPC;
 132
 133         if (print_tuple(s, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
 134                         l3proto, l4proto))
 135                 return -ENOSPC;
 136
 137         if (seq_print_acct(s, ct, IP_CT_DIR_ORIGINAL))
 138                 return -ENOSPC;
 139
 140         if (!(test_bit(IPS_SEEN_REPLY_BIT, &ct->status)))
 141                 if (seq_printf(s, "[UNREPLIED] "))
 142                         return -ENOSPC;
 143
 144         if (print_tuple(s, &ct->tuplehash[IP_CT_DIR_REPLY].tuple,
 145                         l3proto, l4proto))
 146                 return -ENOSPC;
 147
 148         if (seq_print_acct(s, ct, IP_CT_DIR_REPLY))
 149                 return -ENOSPC;
 150
 151         if (test_bit(IPS_ASSURED_BIT, &ct->status))
 152                 if (seq_printf(s, "[ASSURED] "))
 153                         return -ENOSPC;
 154
 155 #if defined(CONFIG_NF_CONNTRACK_MARK)
 156         if (seq_printf(s, "mark=%u ", ct->mark))
 157                 return -ENOSPC;
 158 #endif
 159
 160 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 161         if (seq_printf(s, "secmark=%u ", ct->secmark))
 162                 return -ENOSPC;
 163 #endif
 164
 165         if (seq_printf(s, "use=%u\n", atomic_read(&ct->ct_general.use)))
 166                 return -ENOSPC;
 167
 168         return 0;
 169 }
 170
 171 static const struct seq_operations ct_seq_ops = {
 172         .start = ct_seq_start,
 173         .next  = ct_seq_next,
 174         .stop  = ct_seq_stop,
 175         .show  = ct_seq_show
 176 };
 177
 178 static int ct_open(struct inode *inode, struct file *file)
 179 {
 180         return seq_open_private(file, &ct_seq_ops,
 181                         sizeof(struct ct_iter_state));
 182 }
 183
 184 static const struct file_operations ct_file_ops = {
 185         .owner   = THIS_MODULE,
 186         .open    = ct_open,
 187         .read    = seq_read,
 188         .llseek  = seq_lseek,
 189         .release = seq_release_private,
 190 };
 191
 192 static void *ct_cpu_seq_start(struct seq_file *seq, loff_t *pos)
 193 {
 194         int cpu;
 195
 196         if (*pos == 0)
 197                 return SEQ_START_TOKEN;
 198
 199         for (cpu = *pos-1; cpu < NR_CPUS; ++cpu) {
 200                 if (!cpu_possible(cpu))
 201                         continue;
 202                 *pos = cpu + 1;
 203                 return &per_cpu(nf_conntrack_stat, cpu);
 204         }
 205
 206         return NULL;
 207 }
 208
 209 static void *ct_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 210 {
 211         int cpu;
 212
 213         for (cpu = *pos; cpu < NR_CPUS; ++cpu) {
 214                 if (!cpu_possible(cpu))
 215                         continue;
 216                 *pos = cpu + 1;
 217                 return &per_cpu(nf_conntrack_stat, cpu);
 218         }
 219
 220         return NULL;
 221 }
 222
 223 static void ct_cpu_seq_stop(struct seq_file *seq, void *v)
 224 {
 225 }
 226
 227 static int ct_cpu_seq_show(struct seq_file *seq, void *v)
 228 {
 229         unsigned int nr_conntracks = atomic_read(&nf_conntrack_count);
 230         const struct ip_conntrack_stat *st = v;
 231
 232         if (v == SEQ_START_TOKEN) {
 233                 seq_printf(seq, "entries  searched found new invalid ignore delete delete_list insert insert_failed drop early_drop icmp_error  expect_new expect_create expect_delete\n");
 234                 return 0;
 235         }
 236
 237         seq_printf(seq, "%08x  %08x %08x %08x %08x %08x %08x %08x "
 238                         "%08x %08x %08x %08x %08x  %08x %08x %08x \n",
 239                    nr_conntracks,
 240                    st->searched,
 241                    st->found,
 242                    st->new,
 243                    st->invalid,
 244                    st->ignore,
 245                    st->delete,
 246                    st->delete_list,
 247                    st->insert,
 248                    st->insert_failed,
 249                    st->drop,
 250                    st->early_drop,
 251                    st->error,
 252
 253                    st->expect_new,
 254                    st->expect_create,
 255                    st->expect_delete
 256                 );
 257         return 0;
 258 }
 259
 260 static const struct seq_operations ct_cpu_seq_ops = {
 261         .start  = ct_cpu_seq_start,
 262         .next   = ct_cpu_seq_next,
 263         .stop   = ct_cpu_seq_stop,
 264         .show   = ct_cpu_seq_show,
 265 };
 266
 267 static int ct_cpu_seq_open(struct inode *inode, struct file *file)
 268 {
 269         return seq_open(file, &ct_cpu_seq_ops);
 270 }
 271
 272 static const struct file_operations ct_cpu_seq_fops = {
 273         .owner   = THIS_MODULE,
 274         .open    = ct_cpu_seq_open,
 275         .read    = seq_read,
 276         .llseek  = seq_lseek,
 277         .release = seq_release,
 278 };
 279
 280 static int nf_conntrack_standalone_init_proc(void)
 281 {
 282         struct proc_dir_entry *pde;
 283
 284         pde = proc_net_fops_create(&init_net, "nf_conntrack", 0440, &ct_file_ops);
 285         if (!pde)
 286                 goto out_nf_conntrack;
 287
 288         pde = proc_create("nf_conntrack", S_IRUGO, init_net.proc_net_stat,
 289                           &ct_cpu_seq_fops);
 290         if (!pde)
 291                 goto out_stat_nf_conntrack;
 292         return 0;
 293
 294 out_stat_nf_conntrack:
 295         proc_net_remove(&init_net, "nf_conntrack");
 296 out_nf_conntrack:
 297         return -ENOMEM;
 298 }
 299
 300 static void nf_conntrack_standalone_fini_proc(void)
 301 {
 302         remove_proc_entry("nf_conntrack", init_net.proc_net_stat);
 303         proc_net_remove(&init_net, "nf_conntrack");
 304 }
 305 #else
 306 static int nf_conntrack_standalone_init_proc(void)
 307 {
 308         return 0;
 309 }
 310
 311 static void nf_conntrack_standalone_fini_proc(void)
 312 {
 313 }
 314 #endif /* CONFIG_PROC_FS */
 315
 316 /* Sysctl support */
 317
 318 int nf_conntrack_checksum __read_mostly = 1;
 319 EXPORT_SYMBOL_GPL(nf_conntrack_checksum);
 320
 321 #ifdef CONFIG_SYSCTL
 322 /* Log invalid packets of a given protocol */
 323 static int log_invalid_proto_min = 0;
 324 static int log_invalid_proto_max = 255;
 325
 326 static struct ctl_table_header *nf_ct_sysctl_header;
 327 static struct ctl_table_header *nf_ct_netfilter_header;
 328
 329 static ctl_table nf_ct_sysctl_table[] = {
 330         {
 331                 .ctl_name       = NET_NF_CONNTRACK_MAX,
 332                 .procname       = "nf_conntrack_max",
 333                 .data           = &nf_conntrack_max,
 334                 .maxlen         = sizeof(int),
 335                 .mode           = 0644,
 336                 .proc_handler   = &proc_dointvec,
 337         },
 338         {
 339                 .ctl_name       = NET_NF_CONNTRACK_COUNT,
 340                 .procname       = "nf_conntrack_count",
 341                 .data           = &nf_conntrack_count,
 342                 .maxlen         = sizeof(int),
 343                 .mode           = 0444,
 344                 .proc_handler   = &proc_dointvec,
 345         },
 346         {
 347                 .ctl_name       = NET_NF_CONNTRACK_BUCKETS,
 348                 .procname       = "nf_conntrack_buckets",
 349                 .data           = &nf_conntrack_htable_size,
 350                 .maxlen         = sizeof(unsigned int),
 351                 .mode           = 0444,
 352                 .proc_handler   = &proc_dointvec,
 353         },
 354         {
 355                 .ctl_name       = NET_NF_CONNTRACK_CHECKSUM,
 356                 .procname       = "nf_conntrack_checksum",
 357                 .data           = &nf_conntrack_checksum,
 358                 .maxlen         = sizeof(unsigned int),
 359                 .mode           = 0644,
 360                 .proc_handler   = &proc_dointvec,
 361         },
 362         {
 363                 .ctl_name       = NET_NF_CONNTRACK_LOG_INVALID,
 364                 .procname       = "nf_conntrack_log_invalid",
 365                 .data           = &nf_ct_log_invalid,
 366                 .maxlen         = sizeof(unsigned int),
 367                 .mode           = 0644,
 368                 .proc_handler   = &proc_dointvec_minmax,
 369                 .strategy       = &sysctl_intvec,
 370                 .extra1         = &log_invalid_proto_min,
 371                 .extra2         = &log_invalid_proto_max,
 372         },
 373         {
 374                 .ctl_name       = CTL_UNNUMBERED,
 375                 .procname       = "nf_conntrack_expect_max",
 376                 .data           = &nf_ct_expect_max,
 377                 .maxlen         = sizeof(int),
 378                 .mode           = 0644,
 379                 .proc_handler   = &proc_dointvec,
 380         },
 381         { .ctl_name = 0 }
 382 };
 383
 384 #define NET_NF_CONNTRACK_MAX 2089
 385
 386 static ctl_table nf_ct_netfilter_table[] = {
 387         {
 388                 .ctl_name       = NET_NF_CONNTRACK_MAX,
 389                 .procname       = "nf_conntrack_max",
 390                 .data           = &nf_conntrack_max,
 391                 .maxlen         = sizeof(int),
 392                 .mode           = 0644,
 393                 .proc_handler   = &proc_dointvec,
 394         },
 395         { .ctl_name = 0 }
 396 };
 397
 398 static struct ctl_path nf_ct_path[] = {
 399         { .procname = "net", .ctl_name = CTL_NET, },
 400         { }
 401 };
 402
 403 EXPORT_SYMBOL_GPL(nf_ct_log_invalid);
 404
 405 static int nf_conntrack_standalone_init_sysctl(void)
 406 {
 407         nf_ct_netfilter_header =
 408                 register_sysctl_paths(nf_ct_path, nf_ct_netfilter_table);
 409         if (!nf_ct_netfilter_header)
 410                 goto out;
 411
 412         nf_ct_sysctl_header =
 413                  register_sysctl_paths(nf_net_netfilter_sysctl_path,
 414                                         nf_ct_sysctl_table);
 415         if (!nf_ct_sysctl_header)
 416                 goto out_unregister_netfilter;
 417
 418         return 0;
 419
 420 out_unregister_netfilter:
 421         unregister_sysctl_table(nf_ct_netfilter_header);
 422 out:
 423         printk("nf_conntrack: can't register to sysctl.\n");
 424         return -ENOMEM;
 425 }
 426
 427 static void nf_conntrack_standalone_fini_sysctl(void)
 428 {
 429         unregister_sysctl_table(nf_ct_netfilter_header);
 430         unregister_sysctl_table(nf_ct_sysctl_header);
 431 }
 432 #else
 433 static int nf_conntrack_standalone_init_sysctl(void)
 434 {
 435         return 0;
 436 }
 437
 438 static void nf_conntrack_standalone_fini_sysctl(void)
 439 {
 440 }
 441 #endif /* CONFIG_SYSCTL */
 442
 443 static int __init nf_conntrack_standalone_init(void)
 444 {
 445         int ret;
 446
 447         ret = nf_conntrack_init();
 448         if (ret < 0)
 449                 goto out;
 450         ret = nf_conntrack_standalone_init_proc();
 451         if (ret < 0)
 452                 goto out_proc;
 453         ret = nf_conntrack_standalone_init_sysctl();
 454         if (ret < 0)
 455                 goto out_sysctl;
 456         return 0;
 457
 458 out_sysctl:
 459         nf_conntrack_standalone_fini_proc();
 460 out_proc:
 461         nf_conntrack_cleanup();
 462 out:
 463         return ret;
 464 }
 465
 466 static void __exit nf_conntrack_standalone_fini(void)
 467 {
 468         nf_conntrack_standalone_fini_sysctl();
 469         nf_conntrack_standalone_fini_proc();
 470         nf_conntrack_cleanup();
 471 }
 472
 473 module_init(nf_conntrack_standalone_init);
 474 module_exit(nf_conntrack_standalone_fini);
 475
 476 /* Some modules need us, but don't depend directly on any symbol.
 477    They should call this. */
 478 void need_conntrack(void)
 479 {
 480 }
 481 EXPORT_SYMBOL_GPL(need_conntrack);