net/netfilter/nf_conntrack_standalone.c

   1 /* (C) 1999-2001 Paul `Rusty' Russell
   2  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 as
   6  * published by the Free Software Foundation.
   7  */
   8
   9 #include <linux/types.h>
  10 #include <linux/netfilter.h>
  11 #include <linux/module.h>
  12 #include <linux/skbuff.h>
  13 #include <linux/proc_fs.h>
  14 #include <linux/seq_file.h>
  15 #include <linux/percpu.h>
  16 #include <linux/netdevice.h>
  17 #include <net/net_namespace.h>
  18 #ifdef CONFIG_SYSCTL
  19 #include <linux/sysctl.h>
  20 #endif
  21
  22 #include <net/netfilter/nf_conntrack.h>
  23 #include <net/netfilter/nf_conntrack_core.h>
  24 #include <net/netfilter/nf_conntrack_l3proto.h>
  25 #include <net/netfilter/nf_conntrack_l4proto.h>
  26 #include <net/netfilter/nf_conntrack_expect.h>
  27 #include <net/netfilter/nf_conntrack_helper.h>
  28 #include <net/netfilter/nf_conntrack_acct.h>
  29
  30 MODULE_LICENSE("GPL");
  31
  32 #ifdef CONFIG_PROC_FS
  33 int
  34 print_tuple(struct seq_file *s, const struct nf_conntrack_tuple *tuple,
  35             const struct nf_conntrack_l3proto *l3proto,
  36             const struct nf_conntrack_l4proto *l4proto)
  37 {
  38         return l3proto->print_tuple(s, tuple) || l4proto->print_tuple(s, tuple);
  39 }
  40 EXPORT_SYMBOL_GPL(print_tuple);
  41
  42 struct ct_iter_state {
  43         unsigned int bucket;
  44 };
  45
  46 static struct hlist_node *ct_get_first(struct seq_file *seq)
  47 {
  48         struct ct_iter_state *st = seq->private;
  49         struct hlist_node *n;
  50
  51         for (st->bucket = 0;
  52              st->bucket < nf_conntrack_htable_size;
  53              st->bucket++) {
  54                 n = rcu_dereference(nf_conntrack_hash[st->bucket].first);
  55                 if (n)
  56                         return n;
  57         }
  58         return NULL;
  59 }
  60
  61 static struct hlist_node *ct_get_next(struct seq_file *seq,
  62                                       struct hlist_node *head)
  63 {
  64         struct ct_iter_state *st = seq->private;
  65
  66         head = rcu_dereference(head->next);
  67         while (head == NULL) {
  68                 if (++st->bucket >= nf_conntrack_htable_size)
  69                         return NULL;
  70                 head = rcu_dereference(nf_conntrack_hash[st->bucket].first);
  71         }
  72         return head;
  73 }
  74
  75 static struct hlist_node *ct_get_idx(struct seq_file *seq, loff_t pos)
  76 {
  77         struct hlist_node *head = ct_get_first(seq);
  78
  79         if (head)
  80                 while (pos && (head = ct_get_next(seq, head)))
  81                         pos--;
  82         return pos ? NULL : head;
  83 }
  84
  85 static void *ct_seq_start(struct seq_file *seq, loff_t *pos)
  86         __acquires(RCU)
  87 {
  88         rcu_read_lock();
  89         return ct_get_idx(seq, *pos);
  90 }
  91
  92 static void *ct_seq_next(struct seq_file *s, void *v, loff_t *pos)
  93 {
  94         (*pos)++;
  95         return ct_get_next(s, v);
  96 }
  97
  98 static void ct_seq_stop(struct seq_file *s, void *v)
  99         __releases(RCU)
 100 {
 101         rcu_read_unlock();
 102 }
 103
 104 /* return 0 on success, 1 in case of error */
 105 static int ct_seq_show(struct seq_file *s, void *v)
 106 {
 107         const struct nf_conntrack_tuple_hash *hash = v;
 108         const struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(hash);
 109         const struct nf_conntrack_l3proto *l3proto;
 110         const struct nf_conntrack_l4proto *l4proto;
 111
 112         NF_CT_ASSERT(ct);
 113
 114         /* we only want to print DIR_ORIGINAL */
 115         if (NF_CT_DIRECTION(hash))
 116                 return 0;
 117
 118         l3proto = __nf_ct_l3proto_find(nf_ct_l3num(ct));
 119         NF_CT_ASSERT(l3proto);
 120         l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
 121         NF_CT_ASSERT(l4proto);
 122
 123         if (seq_printf(s, "%-8s %u %-8s %u %ld ",
 124                        l3proto->name, nf_ct_l3num(ct),
 125                        l4proto->name, nf_ct_protonum(ct),
 126                        timer_pending(&ct->timeout)
 127                        ? (long)(ct->timeout.expires - jiffies)/HZ : 0) != 0)
 128                 return -ENOSPC;
 129
 130         if (l4proto->print_conntrack && l4proto->print_conntrack(s, ct))
 131                 return -ENOSPC;
 132
 133         if (print_tuple(s, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
 134                         l3proto, l4proto))
 135                 return -ENOSPC;
 136
 137         if (seq_print_acct(s, ct, IP_CT_DIR_ORIGINAL))
 138                 return -ENOSPC;
 139
 140         if (!(test_bit(IPS_SEEN_REPLY_BIT, &ct->status)))
 141                 if (seq_printf(s, "[UNREPLIED] "))
 142                         return -ENOSPC;
 143
 144         if (print_tuple(s, &ct->tuplehash[IP_CT_DIR_REPLY].tuple,
 145                         l3proto, l4proto))
 146                 return -ENOSPC;
 147
 148         if (seq_print_acct(s, ct, IP_CT_DIR_REPLY))
 149                 return -ENOSPC;
 150
 151         if (test_bit(IPS_ASSURED_BIT, &ct->status))
 152                 if (seq_printf(s, "[ASSURED] "))
 153                         return -ENOSPC;
 154
 155 #if defined(CONFIG_NF_CONNTRACK_MARK)
 156         if (seq_printf(s, "mark=%u ", ct->mark))
 157                 return -ENOSPC;
 158 #endif
 159
 160 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 161         if (seq_printf(s, "secmark=%u ", ct->secmark))
 162                 return -ENOSPC;
 163 #endif
 164
 165         if (seq_printf(s, "use=%u\n", atomic_read(&ct->ct_general.use)))
 166                 return -ENOSPC;
 167
 168         return 0;
 169 }
 170
 171 static const struct seq_operations ct_seq_ops = {
 172         .start = ct_seq_start,
 173         .next  = ct_seq_next,
 174         .stop  = ct_seq_stop,
 175         .show  = ct_seq_show
 176 };
 177
 178 static int ct_open(struct inode *inode, struct file *file)
 179 {
 180         return seq_open_private(file, &ct_seq_ops,
 181                         sizeof(struct ct_iter_state));
 182 }
 183
 184 static const struct file_operations ct_file_ops = {
 185         .owner   = THIS_MODULE,
 186         .open    = ct_open,
 187         .read    = seq_read,
 188         .llseek  = seq_lseek,
 189         .release = seq_release_private,
 190 };
 191
 192 static void *ct_cpu_seq_start(struct seq_file *seq, loff_t *pos)
 193 {
 194         int cpu;
 195
 196         if (*pos == 0)
 197                 return SEQ_START_TOKEN;
 198
 199         for (cpu = *pos-1; cpu < NR_CPUS; ++cpu) {
 200                 if (!cpu_possible(cpu))
 201                         continue;
 202                 *pos = cpu + 1;
 203                 return &per_cpu(nf_conntrack_stat, cpu);
 204         }
 205
 206         return NULL;
 207 }
 208
 209 static void *ct_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 210 {
 211         int cpu;
 212
 213         for (cpu = *pos; cpu < NR_CPUS; ++cpu) {
 214                 if (!cpu_possible(cpu))
 215                         continue;
 216                 *pos = cpu + 1;
 217                 return &per_cpu(nf_conntrack_stat, cpu);
 218         }
 219
 220         return NULL;
 221 }
 222
 223 static void ct_cpu_seq_stop(struct seq_file *seq, void *v)
 224 {
 225 }
 226
 227 static int ct_cpu_seq_show(struct seq_file *seq, void *v)
 228 {
 229         unsigned int nr_conntracks = atomic_read(&nf_conntrack_count);
 230         const struct ip_conntrack_stat *st = v;
 231
 232         if (v == SEQ_START_TOKEN) {
 233                 seq_printf(seq, "entries  searched found new invalid ignore delete delete_list insert insert_failed drop early_drop icmp_error  expect_new expect_create expect_delete\n");
 234                 return 0;
 235         }
 236
 237         seq_printf(seq, "%08x  %08x %08x %08x %08x %08x %08x %08x "
 238                         "%08x %08x %08x %08x %08x  %08x %08x %08x \n",
 239                    nr_conntracks,
 240                    st->searched,
 241                    st->found,
 242                    st->new,
 243                    st->invalid,
 244                    st->ignore,
 245                    st->delete,
 246                    st->delete_list,
 247                    st->insert,
 248                    st->insert_failed,
 249                    st->drop,
 250                    st->early_drop,
 251                    st->error,
 252
 253                    st->expect_new,
 254                    st->expect_create,
 255                    st->expect_delete
 256                 );
 257         return 0;
 258 }
 259
 260 static const struct seq_operations ct_cpu_seq_ops = {
 261         .start  = ct_cpu_seq_start,
 262         .next   = ct_cpu_seq_next,
 263         .stop   = ct_cpu_seq_stop,
 264         .show   = ct_cpu_seq_show,
 265 };
 266
 267 static int ct_cpu_seq_open(struct inode *inode, struct file *file)
 268 {
 269         return seq_open(file, &ct_cpu_seq_ops);
 270 }
 271
 272 static const struct file_operations ct_cpu_seq_fops = {
 273         .owner   = THIS_MODULE,
 274         .open    = ct_cpu_seq_open,
 275         .read    = seq_read,
 276         .llseek  = seq_lseek,
 277         .release = seq_release,
 278 };
 279
 280 static int nf_conntrack_standalone_init_proc(void)
 281 {
 282         struct proc_dir_entry *pde;
 283
 284         pde = proc_net_fops_create(&init_net, "nf_conntrack", 0440, &ct_file_ops);
 285         if (!pde)
 286                 goto out_nf_conntrack;
 287
 288         pde = proc_create("nf_conntrack", S_IRUGO, init_net.proc_net_stat,
 289                           &ct_cpu_seq_fops);
 290         if (!pde)
 291                 goto out_stat_nf_conntrack;
 292         return 0;
 293
 294 out_stat_nf_conntrack:
 295         proc_net_remove(&init_net, "nf_conntrack");
 296 out_nf_conntrack:
 297         return -ENOMEM;
 298 }
 299
 300 static void nf_conntrack_standalone_fini_proc(void)
 301 {
 302         remove_proc_entry("nf_conntrack", init_net.proc_net_stat);
 303         proc_net_remove(&init_net, "nf_conntrack");
 304 }
 305 #else
 306 static int nf_conntrack_standalone_init_proc(void)
 307 {
 308         return 0;
 309 }
 310
 311 static void nf_conntrack_standalone_fini_proc(void)
 312 {
 313 }
 314 #endif /* CONFIG_PROC_FS */
 315
 316 /* Sysctl support */
 317
 318 int nf_conntrack_checksum __read_mostly = 1;
 319 EXPORT_SYMBOL_GPL(nf_conntrack_checksum);
 320
 321 #ifdef CONFIG_SYSCTL
 322 /* Log invalid packets of a given protocol */
 323 static int log_invalid_proto_min = 0;
 324 static int log_invalid_proto_max = 255;
 325
 326 static struct ctl_table_header *nf_ct_sysctl_header;
 327
 328 static ctl_table nf_ct_sysctl_table[] = {
 329         {
 330                 .ctl_name       = NET_NF_CONNTRACK_MAX,
 331                 .procname       = "nf_conntrack_max",
 332                 .data           = &nf_conntrack_max,
 333                 .maxlen         = sizeof(int),
 334                 .mode           = 0644,
 335                 .proc_handler   = &proc_dointvec,
 336         },
 337         {
 338                 .ctl_name       = NET_NF_CONNTRACK_COUNT,
 339                 .procname       = "nf_conntrack_count",
 340                 .data           = &nf_conntrack_count,
 341                 .maxlen         = sizeof(int),
 342                 .mode           = 0444,
 343                 .proc_handler   = &proc_dointvec,
 344         },
 345         {
 346                 .ctl_name       = NET_NF_CONNTRACK_BUCKETS,
 347                 .procname       = "nf_conntrack_buckets",
 348                 .data           = &nf_conntrack_htable_size,
 349                 .maxlen         = sizeof(unsigned int),
 350                 .mode           = 0444,
 351                 .proc_handler   = &proc_dointvec,
 352         },
 353         {
 354                 .ctl_name       = NET_NF_CONNTRACK_CHECKSUM,
 355                 .procname       = "nf_conntrack_checksum",
 356                 .data           = &nf_conntrack_checksum,
 357                 .maxlen         = sizeof(unsigned int),
 358                 .mode           = 0644,
 359                 .proc_handler   = &proc_dointvec,
 360         },
 361         {
 362                 .ctl_name       = NET_NF_CONNTRACK_LOG_INVALID,
 363                 .procname       = "nf_conntrack_log_invalid",
 364                 .data           = &nf_ct_log_invalid,
 365                 .maxlen         = sizeof(unsigned int),
 366                 .mode           = 0644,
 367                 .proc_handler   = &proc_dointvec_minmax,
 368                 .strategy       = &sysctl_intvec,
 369                 .extra1         = &log_invalid_proto_min,
 370                 .extra2         = &log_invalid_proto_max,
 371         },
 372         {
 373                 .ctl_name       = CTL_UNNUMBERED,
 374                 .procname       = "nf_conntrack_expect_max",
 375                 .data           = &nf_ct_expect_max,
 376                 .maxlen         = sizeof(int),
 377                 .mode           = 0644,
 378                 .proc_handler   = &proc_dointvec,
 379         },
 380         { .ctl_name = 0 }
 381 };
 382
 383 #define NET_NF_CONNTRACK_MAX 2089
 384
 385 static ctl_table nf_ct_netfilter_table[] = {
 386         {
 387                 .ctl_name       = NET_NETFILTER,
 388                 .procname       = "netfilter",
 389                 .mode           = 0555,
 390                 .child          = nf_ct_sysctl_table,
 391         },
 392         {
 393                 .ctl_name       = NET_NF_CONNTRACK_MAX,
 394                 .procname       = "nf_conntrack_max",
 395                 .data           = &nf_conntrack_max,
 396                 .maxlen         = sizeof(int),
 397                 .mode           = 0644,
 398                 .proc_handler   = &proc_dointvec,
 399         },
 400         { .ctl_name = 0 }
 401 };
 402
 403 static struct ctl_path nf_ct_path[] = {
 404         { .procname = "net", .ctl_name = CTL_NET, },
 405         { }
 406 };
 407
 408 EXPORT_SYMBOL_GPL(nf_ct_log_invalid);
 409
 410 static int nf_conntrack_standalone_init_sysctl(void)
 411 {
 412         nf_ct_sysctl_header =
 413                 register_sysctl_paths(nf_ct_path, nf_ct_netfilter_table);
 414         if (nf_ct_sysctl_header == NULL) {
 415                 printk("nf_conntrack: can't register to sysctl.\n");
 416                 return -ENOMEM;
 417         }
 418         return 0;
 419
 420 }
 421
 422 static void nf_conntrack_standalone_fini_sysctl(void)
 423 {
 424         unregister_sysctl_table(nf_ct_sysctl_header);
 425 }
 426 #else
 427 static int nf_conntrack_standalone_init_sysctl(void)
 428 {
 429         return 0;
 430 }
 431
 432 static void nf_conntrack_standalone_fini_sysctl(void)
 433 {
 434 }
 435 #endif /* CONFIG_SYSCTL */
 436
 437 static int __init nf_conntrack_standalone_init(void)
 438 {
 439         int ret;
 440
 441         ret = nf_conntrack_init();
 442         if (ret < 0)
 443                 goto out;
 444         ret = nf_conntrack_standalone_init_proc();
 445         if (ret < 0)
 446                 goto out_proc;
 447         ret = nf_conntrack_standalone_init_sysctl();
 448         if (ret < 0)
 449                 goto out_sysctl;
 450         return 0;
 451
 452 out_sysctl:
 453         nf_conntrack_standalone_fini_proc();
 454 out_proc:
 455         nf_conntrack_cleanup();
 456 out:
 457         return ret;
 458 }
 459
 460 static void __exit nf_conntrack_standalone_fini(void)
 461 {
 462         nf_conntrack_standalone_fini_sysctl();
 463         nf_conntrack_standalone_fini_proc();
 464         nf_conntrack_cleanup();
 465 }
 466
 467 module_init(nf_conntrack_standalone_init);
 468 module_exit(nf_conntrack_standalone_fini);
 469
 470 /* Some modules need us, but don't depend directly on any symbol.
 471    They should call this. */
 472 void need_conntrack(void)
 473 {
 474 }
 475 EXPORT_SYMBOL_GPL(need_conntrack);