1 /* (C) 1999-2001 Paul `Rusty' Russell
2 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
3 * (C) 2005-2012 Patrick McHardy <kaber@trash.net>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
10 #include <linux/types.h>
11 #include <linux/netfilter.h>
12 #include <linux/slab.h>
13 #include <linux/module.h>
14 #include <linux/skbuff.h>
15 #include <linux/proc_fs.h>
16 #include <linux/seq_file.h>
17 #include <linux/percpu.h>
18 #include <linux/netdevice.h>
19 #include <linux/security.h>
20 #include <net/net_namespace.h>
22 #include <linux/sysctl.h>
25 #include <net/netfilter/nf_conntrack.h>
26 #include <net/netfilter/nf_conntrack_core.h>
27 #include <net/netfilter/nf_conntrack_l3proto.h>
28 #include <net/netfilter/nf_conntrack_l4proto.h>
29 #include <net/netfilter/nf_conntrack_expect.h>
30 #include <net/netfilter/nf_conntrack_helper.h>
31 #include <net/netfilter/nf_conntrack_acct.h>
32 #include <net/netfilter/nf_conntrack_zones.h>
33 #include <net/netfilter/nf_conntrack_timestamp.h>
34 #include <linux/rculist_nulls.h>
36 MODULE_LICENSE("GPL");
38 #ifdef CONFIG_NF_CONNTRACK_PROCFS
40 print_tuple(struct seq_file *s, const struct nf_conntrack_tuple *tuple,
41 const struct nf_conntrack_l3proto *l3proto,
42 const struct nf_conntrack_l4proto *l4proto)
44 l3proto->print_tuple(s, tuple);
45 l4proto->print_tuple(s, tuple);
47 EXPORT_SYMBOL_GPL(print_tuple);
49 struct ct_iter_state {
50 struct seq_net_private p;
55 static struct hlist_nulls_node *ct_get_first(struct seq_file *seq)
57 struct net *net = seq_file_net(seq);
58 struct ct_iter_state *st = seq->private;
59 struct hlist_nulls_node *n;
62 st->bucket < net->ct.htable_size;
64 n = rcu_dereference(hlist_nulls_first_rcu(&net->ct.hash[st->bucket]));
71 static struct hlist_nulls_node *ct_get_next(struct seq_file *seq,
72 struct hlist_nulls_node *head)
74 struct net *net = seq_file_net(seq);
75 struct ct_iter_state *st = seq->private;
77 head = rcu_dereference(hlist_nulls_next_rcu(head));
78 while (is_a_nulls(head)) {
79 if (likely(get_nulls_value(head) == st->bucket)) {
80 if (++st->bucket >= net->ct.htable_size)
83 head = rcu_dereference(
84 hlist_nulls_first_rcu(
85 &net->ct.hash[st->bucket]));
90 static struct hlist_nulls_node *ct_get_idx(struct seq_file *seq, loff_t pos)
92 struct hlist_nulls_node *head = ct_get_first(seq);
95 while (pos && (head = ct_get_next(seq, head)))
97 return pos ? NULL : head;
100 static void *ct_seq_start(struct seq_file *seq, loff_t *pos)
103 struct ct_iter_state *st = seq->private;
105 st->time_now = ktime_get_real_ns();
107 return ct_get_idx(seq, *pos);
110 static void *ct_seq_next(struct seq_file *s, void *v, loff_t *pos)
113 return ct_get_next(s, v);
116 static void ct_seq_stop(struct seq_file *s, void *v)
122 #ifdef CONFIG_NF_CONNTRACK_SECMARK
123 static void ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
129 ret = security_secid_to_secctx(ct->secmark, &secctx, &len);
133 seq_printf(s, "secctx=%s ", secctx);
135 security_release_secctx(secctx, len);
138 static inline void ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
143 #ifdef CONFIG_NF_CONNTRACK_ZONES
144 static void ct_show_zone(struct seq_file *s, const struct nf_conn *ct,
147 const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
149 if (zone->dir != dir)
152 case NF_CT_DEFAULT_ZONE_DIR:
153 seq_printf(s, "zone=%u ", zone->id);
155 case NF_CT_ZONE_DIR_ORIG:
156 seq_printf(s, "zone-orig=%u ", zone->id);
158 case NF_CT_ZONE_DIR_REPL:
159 seq_printf(s, "zone-reply=%u ", zone->id);
166 static inline void ct_show_zone(struct seq_file *s, const struct nf_conn *ct,
172 #ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
173 static void ct_show_delta_time(struct seq_file *s, const struct nf_conn *ct)
175 struct ct_iter_state *st = s->private;
176 struct nf_conn_tstamp *tstamp;
179 tstamp = nf_conn_tstamp_find(ct);
181 delta_time = st->time_now - tstamp->start;
183 delta_time = div_s64(delta_time, NSEC_PER_SEC);
187 seq_printf(s, "delta-time=%llu ",
188 (unsigned long long)delta_time);
194 ct_show_delta_time(struct seq_file *s, const struct nf_conn *ct)
199 /* return 0 on success, 1 in case of error */
200 static int ct_seq_show(struct seq_file *s, void *v)
202 struct nf_conntrack_tuple_hash *hash = v;
203 struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(hash);
204 const struct nf_conntrack_l3proto *l3proto;
205 const struct nf_conntrack_l4proto *l4proto;
209 if (unlikely(!atomic_inc_not_zero(&ct->ct_general.use)))
212 /* we only want to print DIR_ORIGINAL */
213 if (NF_CT_DIRECTION(hash))
216 l3proto = __nf_ct_l3proto_find(nf_ct_l3num(ct));
217 NF_CT_ASSERT(l3proto);
218 l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
219 NF_CT_ASSERT(l4proto);
222 seq_printf(s, "%-8s %u %-8s %u %ld ",
223 l3proto->name, nf_ct_l3num(ct),
224 l4proto->name, nf_ct_protonum(ct),
225 timer_pending(&ct->timeout)
226 ? (long)(ct->timeout.expires - jiffies)/HZ : 0);
228 if (l4proto->print_conntrack)
229 l4proto->print_conntrack(s, ct);
231 print_tuple(s, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
234 ct_show_zone(s, ct, NF_CT_ZONE_DIR_ORIG);
236 if (seq_has_overflowed(s))
239 if (seq_print_acct(s, ct, IP_CT_DIR_ORIGINAL))
242 if (!(test_bit(IPS_SEEN_REPLY_BIT, &ct->status)))
243 seq_printf(s, "[UNREPLIED] ");
245 print_tuple(s, &ct->tuplehash[IP_CT_DIR_REPLY].tuple,
248 ct_show_zone(s, ct, NF_CT_ZONE_DIR_REPL);
250 if (seq_print_acct(s, ct, IP_CT_DIR_REPLY))
253 if (test_bit(IPS_ASSURED_BIT, &ct->status))
254 seq_printf(s, "[ASSURED] ");
256 if (seq_has_overflowed(s))
259 #if defined(CONFIG_NF_CONNTRACK_MARK)
260 seq_printf(s, "mark=%u ", ct->mark);
263 ct_show_secctx(s, ct);
264 ct_show_zone(s, ct, NF_CT_DEFAULT_ZONE_DIR);
265 ct_show_delta_time(s, ct);
267 seq_printf(s, "use=%u\n", atomic_read(&ct->ct_general.use));
269 if (seq_has_overflowed(s))
278 static const struct seq_operations ct_seq_ops = {
279 .start = ct_seq_start,
285 static int ct_open(struct inode *inode, struct file *file)
287 return seq_open_net(inode, file, &ct_seq_ops,
288 sizeof(struct ct_iter_state));
291 static const struct file_operations ct_file_ops = {
292 .owner = THIS_MODULE,
296 .release = seq_release_net,
299 static void *ct_cpu_seq_start(struct seq_file *seq, loff_t *pos)
301 struct net *net = seq_file_net(seq);
305 return SEQ_START_TOKEN;
307 for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
308 if (!cpu_possible(cpu))
311 return per_cpu_ptr(net->ct.stat, cpu);
317 static void *ct_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
319 struct net *net = seq_file_net(seq);
322 for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
323 if (!cpu_possible(cpu))
326 return per_cpu_ptr(net->ct.stat, cpu);
332 static void ct_cpu_seq_stop(struct seq_file *seq, void *v)
336 static int ct_cpu_seq_show(struct seq_file *seq, void *v)
338 struct net *net = seq_file_net(seq);
339 unsigned int nr_conntracks = atomic_read(&net->ct.count);
340 const struct ip_conntrack_stat *st = v;
342 if (v == SEQ_START_TOKEN) {
343 seq_printf(seq, "entries searched found new invalid ignore delete delete_list insert insert_failed drop early_drop icmp_error expect_new expect_create expect_delete search_restart\n");
347 seq_printf(seq, "%08x %08x %08x %08x %08x %08x %08x %08x "
348 "%08x %08x %08x %08x %08x %08x %08x %08x %08x\n",
371 static const struct seq_operations ct_cpu_seq_ops = {
372 .start = ct_cpu_seq_start,
373 .next = ct_cpu_seq_next,
374 .stop = ct_cpu_seq_stop,
375 .show = ct_cpu_seq_show,
378 static int ct_cpu_seq_open(struct inode *inode, struct file *file)
380 return seq_open_net(inode, file, &ct_cpu_seq_ops,
381 sizeof(struct seq_net_private));
384 static const struct file_operations ct_cpu_seq_fops = {
385 .owner = THIS_MODULE,
386 .open = ct_cpu_seq_open,
389 .release = seq_release_net,
392 static int nf_conntrack_standalone_init_proc(struct net *net)
394 struct proc_dir_entry *pde;
396 pde = proc_create("nf_conntrack", 0440, net->proc_net, &ct_file_ops);
398 goto out_nf_conntrack;
400 pde = proc_create("nf_conntrack", S_IRUGO, net->proc_net_stat,
403 goto out_stat_nf_conntrack;
406 out_stat_nf_conntrack:
407 remove_proc_entry("nf_conntrack", net->proc_net);
412 static void nf_conntrack_standalone_fini_proc(struct net *net)
414 remove_proc_entry("nf_conntrack", net->proc_net_stat);
415 remove_proc_entry("nf_conntrack", net->proc_net);
418 static int nf_conntrack_standalone_init_proc(struct net *net)
423 static void nf_conntrack_standalone_fini_proc(struct net *net)
426 #endif /* CONFIG_NF_CONNTRACK_PROCFS */
431 /* Log invalid packets of a given protocol */
432 static int log_invalid_proto_min = 0;
433 static int log_invalid_proto_max = 255;
435 static struct ctl_table_header *nf_ct_netfilter_header;
437 static struct ctl_table nf_ct_sysctl_table[] = {
439 .procname = "nf_conntrack_max",
440 .data = &nf_conntrack_max,
441 .maxlen = sizeof(int),
443 .proc_handler = proc_dointvec,
446 .procname = "nf_conntrack_count",
447 .data = &init_net.ct.count,
448 .maxlen = sizeof(int),
450 .proc_handler = proc_dointvec,
453 .procname = "nf_conntrack_buckets",
454 .data = &init_net.ct.htable_size,
455 .maxlen = sizeof(unsigned int),
457 .proc_handler = proc_dointvec,
460 .procname = "nf_conntrack_checksum",
461 .data = &init_net.ct.sysctl_checksum,
462 .maxlen = sizeof(unsigned int),
464 .proc_handler = proc_dointvec,
467 .procname = "nf_conntrack_log_invalid",
468 .data = &init_net.ct.sysctl_log_invalid,
469 .maxlen = sizeof(unsigned int),
471 .proc_handler = proc_dointvec_minmax,
472 .extra1 = &log_invalid_proto_min,
473 .extra2 = &log_invalid_proto_max,
476 .procname = "nf_conntrack_expect_max",
477 .data = &nf_ct_expect_max,
478 .maxlen = sizeof(int),
480 .proc_handler = proc_dointvec,
485 #define NET_NF_CONNTRACK_MAX 2089
487 static struct ctl_table nf_ct_netfilter_table[] = {
489 .procname = "nf_conntrack_max",
490 .data = &nf_conntrack_max,
491 .maxlen = sizeof(int),
493 .proc_handler = proc_dointvec,
498 static int nf_conntrack_standalone_init_sysctl(struct net *net)
500 struct ctl_table *table;
502 table = kmemdup(nf_ct_sysctl_table, sizeof(nf_ct_sysctl_table),
507 table[1].data = &net->ct.count;
508 table[2].data = &net->ct.htable_size;
509 table[3].data = &net->ct.sysctl_checksum;
510 table[4].data = &net->ct.sysctl_log_invalid;
512 /* Don't export sysctls to unprivileged users */
513 if (net->user_ns != &init_user_ns)
514 table[0].procname = NULL;
516 net->ct.sysctl_header = register_net_sysctl(net, "net/netfilter", table);
517 if (!net->ct.sysctl_header)
518 goto out_unregister_netfilter;
522 out_unregister_netfilter:
528 static void nf_conntrack_standalone_fini_sysctl(struct net *net)
530 struct ctl_table *table;
532 table = net->ct.sysctl_header->ctl_table_arg;
533 unregister_net_sysctl_table(net->ct.sysctl_header);
537 static int nf_conntrack_standalone_init_sysctl(struct net *net)
542 static void nf_conntrack_standalone_fini_sysctl(struct net *net)
545 #endif /* CONFIG_SYSCTL */
547 static int nf_conntrack_pernet_init(struct net *net)
551 ret = nf_conntrack_init_net(net);
555 ret = nf_conntrack_standalone_init_proc(net);
559 net->ct.sysctl_checksum = 1;
560 net->ct.sysctl_log_invalid = 0;
561 ret = nf_conntrack_standalone_init_sysctl(net);
568 nf_conntrack_standalone_fini_proc(net);
570 nf_conntrack_cleanup_net(net);
575 static void nf_conntrack_pernet_exit(struct list_head *net_exit_list)
579 list_for_each_entry(net, net_exit_list, exit_list) {
580 nf_conntrack_standalone_fini_sysctl(net);
581 nf_conntrack_standalone_fini_proc(net);
583 nf_conntrack_cleanup_net_list(net_exit_list);
586 static struct pernet_operations nf_conntrack_net_ops = {
587 .init = nf_conntrack_pernet_init,
588 .exit_batch = nf_conntrack_pernet_exit,
591 static int __init nf_conntrack_standalone_init(void)
593 int ret = nf_conntrack_init_start();
598 nf_ct_netfilter_header =
599 register_net_sysctl(&init_net, "net", nf_ct_netfilter_table);
600 if (!nf_ct_netfilter_header) {
601 pr_err("nf_conntrack: can't register to sysctl.\n");
607 ret = register_pernet_subsys(&nf_conntrack_net_ops);
611 nf_conntrack_init_end();
616 unregister_net_sysctl_table(nf_ct_netfilter_header);
619 nf_conntrack_cleanup_end();
624 static void __exit nf_conntrack_standalone_fini(void)
626 nf_conntrack_cleanup_start();
627 unregister_pernet_subsys(&nf_conntrack_net_ops);
629 unregister_net_sysctl_table(nf_ct_netfilter_header);
631 nf_conntrack_cleanup_end();
634 module_init(nf_conntrack_standalone_init);
635 module_exit(nf_conntrack_standalone_fini);
637 /* Some modules need us, but don't depend directly on any symbol.
638 They should call this. */
639 void need_conntrack(void)
642 EXPORT_SYMBOL_GPL(need_conntrack);