projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
[SECMARK]: Add secmark support to conntrack
[deliverable/linux.git] / net / ipv4 / netfilter / ip_conntrack_standalone.c
CommitLineData
1da177e4
LT		 1/* This file contains all the functions required for the standalone
2 ip_conntrack module.
3
4 These are not required by the compatibility layer.
5*/
6
7/* (C) 1999-2001 Paul `Rusty' Russell
080774a2 8 * (C) 2002-2005 Netfilter Core Team <coreteam@netfilter.org>
1da177e4
LT		 9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2 as
12 * published by the Free Software Foundation.
13 */
14
15#include <linux/config.h>
16#include <linux/types.h>
17#include <linux/ip.h>
18#include <linux/netfilter.h>
19#include <linux/netfilter_ipv4.h>
20#include <linux/module.h>
21#include <linux/skbuff.h>
22#include <linux/proc_fs.h>
23#include <linux/seq_file.h>
24#include <linux/percpu.h>
25#ifdef CONFIG_SYSCTL
26#include <linux/sysctl.h>
27#endif
28#include <net/checksum.h>
29#include <net/ip.h>
14c85021 30#include <net/route.h>
1da177e4 31
e45b1be8
PM		 32#define ASSERT_READ_LOCK(x)
33#define ASSERT_WRITE_LOCK(x)
1da177e4
LT		 34
35#include <linux/netfilter_ipv4/ip_conntrack.h>
36#include <linux/netfilter_ipv4/ip_conntrack_protocol.h>
37#include <linux/netfilter_ipv4/ip_conntrack_core.h>
38#include <linux/netfilter_ipv4/ip_conntrack_helper.h>
39#include <linux/netfilter_ipv4/listhelp.h>
40
41#if 0
42#define DEBUGP printk
43#else
44#define DEBUGP(format, args...)
45#endif
46
47MODULE_LICENSE("GPL");
48
49extern atomic_t ip_conntrack_count;
50DECLARE_PER_CPU(struct ip_conntrack_stat, ip_conntrack_stat);
51
52static int kill_proto(struct ip_conntrack *i, void *data)
53{
54 return (i->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum ==
55 *((u_int8_t *) data));
56}
57
58#ifdef CONFIG_PROC_FS
59static int
60print_tuple(struct seq_file *s, const struct ip_conntrack_tuple *tuple,
61 struct ip_conntrack_protocol *proto)
62{
63 seq_printf(s, "src=%u.%u.%u.%u dst=%u.%u.%u.%u ",
64 NIPQUAD(tuple->src.ip), NIPQUAD(tuple->dst.ip));
65 return proto->print_tuple(s, tuple);
66}
67
68#ifdef CONFIG_IP_NF_CT_ACCT
69static unsigned int
70seq_print_counters(struct seq_file *s,
71 const struct ip_conntrack_counter *counter)
72{
73 return seq_printf(s, "packets=%llu bytes=%llu ",
74 (unsigned long long)counter->packets,
75 (unsigned long long)counter->bytes);
76}
77#else
78#define seq_print_counters(x, y) 0
79#endif
80
81struct ct_iter_state {
82 unsigned int bucket;
83};
84
85static struct list_head *ct_get_first(struct seq_file *seq)
86{
87 struct ct_iter_state *st = seq->private;
88
89 for (st->bucket = 0;
90 st->bucket < ip_conntrack_htable_size;
91 st->bucket++) {
92 if (!list_empty(&ip_conntrack_hash[st->bucket]))
93 return ip_conntrack_hash[st->bucket].next;
94 }
95 return NULL;
96}
97
98static struct list_head *ct_get_next(struct seq_file *seq, struct list_head *head)
99{
100 struct ct_iter_state *st = seq->private;
101
102 head = head->next;
103 while (head == &ip_conntrack_hash[st->bucket]) {
104 if (++st->bucket >= ip_conntrack_htable_size)
105 return NULL;
106 head = ip_conntrack_hash[st->bucket].next;
107 }
108 return head;
109}
110
111static struct list_head *ct_get_idx(struct seq_file *seq, loff_t pos)
112{
113 struct list_head *head = ct_get_first(seq);
114
115 if (head)
116 while (pos && (head = ct_get_next(seq, head)))
117 pos--;
118 return pos ? NULL : head;
119}
120
121static void *ct_seq_start(struct seq_file *seq, loff_t *pos)
122{
e45b1be8 123 read_lock_bh(&ip_conntrack_lock);
1da177e4
LT		 124 return ct_get_idx(seq, *pos);
125}
126
127static void *ct_seq_next(struct seq_file *s, void *v, loff_t *pos)
128{
129 (*pos)++;
130 return ct_get_next(s, v);
131}
132
133static void ct_seq_stop(struct seq_file *s, void *v)
134{
e45b1be8 135 read_unlock_bh(&ip_conntrack_lock);
1da177e4
LT		 136}
137
138static int ct_seq_show(struct seq_file *s, void *v)
139{
140 const struct ip_conntrack_tuple_hash *hash = v;
141 const struct ip_conntrack *conntrack = tuplehash_to_ctrack(hash);
142 struct ip_conntrack_protocol *proto;
143
e45b1be8 144 ASSERT_READ_LOCK(&ip_conntrack_lock);
1da177e4
LT		 145 IP_NF_ASSERT(conntrack);
146
147 /* we only want to print DIR_ORIGINAL */
148 if (DIRECTION(hash))
149 return 0;
150
080774a2 151 proto = __ip_conntrack_proto_find(conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum);
1da177e4
LT		 152 IP_NF_ASSERT(proto);
153
154 if (seq_printf(s, "%-8s %u %ld ",
155 proto->name,
156 conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum,
157 timer_pending(&conntrack->timeout)
158 ? (long)(conntrack->timeout.expires - jiffies)/HZ
159 : 0) != 0)
160 return -ENOSPC;
161
162 if (proto->print_conntrack(s, conntrack))
163 return -ENOSPC;
164
165 if (print_tuple(s, &conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
166 proto))
167 return -ENOSPC;
168
169 if (seq_print_counters(s, &conntrack->counters[IP_CT_DIR_ORIGINAL]))
170 return -ENOSPC;
171
172 if (!(test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)))
173 if (seq_printf(s, "[UNREPLIED] "))
174 return -ENOSPC;
175
176 if (print_tuple(s, &conntrack->tuplehash[IP_CT_DIR_REPLY].tuple,
177 proto))
178 return -ENOSPC;
179
180 if (seq_print_counters(s, &conntrack->counters[IP_CT_DIR_REPLY]))
181 return -ENOSPC;
182
183 if (test_bit(IPS_ASSURED_BIT, &conntrack->status))
184 if (seq_printf(s, "[ASSURED] "))
185 return -ENOSPC;
186
187#if defined(CONFIG_IP_NF_CONNTRACK_MARK)
bf3a46aa 188 if (seq_printf(s, "mark=%u ", conntrack->mark))
1da177e4
LT		 189 return -ENOSPC;
190#endif
191
7c9728c3
JM		 192#ifdef CONFIG_IP_NF_CONNTRACK_SECMARK
193 if (seq_printf(s, "secmark=%u ", conntrack->secmark))
194 return -ENOSPC;
195#endif
196
1da177e4
LT		 197 if (seq_printf(s, "use=%u\n", atomic_read(&conntrack->ct_general.use)))
198 return -ENOSPC;
199
200 return 0;
201}
202
203static struct seq_operations ct_seq_ops = {
204 .start = ct_seq_start,
205 .next = ct_seq_next,
206 .stop = ct_seq_stop,
207 .show = ct_seq_show
208};
209
210static int ct_open(struct inode *inode, struct file *file)
211{
212 struct seq_file *seq;
213 struct ct_iter_state *st;
214 int ret;
215
216 st = kmalloc(sizeof(struct ct_iter_state), GFP_KERNEL);
217 if (st == NULL)
218 return -ENOMEM;
219 ret = seq_open(file, &ct_seq_ops);
220 if (ret)
221 goto out_free;
222 seq = file->private_data;
223 seq->private = st;
224 memset(st, 0, sizeof(struct ct_iter_state));
225 return ret;
226out_free:
227 kfree(st);
228 return ret;
229}
230
231static struct file_operations ct_file_ops = {
232 .owner = THIS_MODULE,
233 .open = ct_open,
234 .read = seq_read,
235 .llseek = seq_lseek,
236 .release = seq_release_private,
237};
238
239/* expects */
240static void *exp_seq_start(struct seq_file *s, loff_t *pos)
241{
242 struct list_head *e = &ip_conntrack_expect_list;
243 loff_t i;
244
245 /* strange seq_file api calls stop even if we fail,
246 * thus we need to grab lock since stop unlocks */
e45b1be8 247 read_lock_bh(&ip_conntrack_lock);
1da177e4
LT		 248
249 if (list_empty(e))
250 return NULL;
251
252 for (i = 0; i <= *pos; i++) {
253 e = e->next;
254 if (e == &ip_conntrack_expect_list)
255 return NULL;
256 }
257 return e;
258}
259
260static void *exp_seq_next(struct seq_file *s, void *v, loff_t *pos)
261{
262 struct list_head *e = v;
263
a96aca88 264 ++*pos;
1da177e4
LT		 265 e = e->next;
266
267 if (e == &ip_conntrack_expect_list)
268 return NULL;
269
270 return e;
271}
272
273static void exp_seq_stop(struct seq_file *s, void *v)
274{
e45b1be8 275 read_unlock_bh(&ip_conntrack_lock);
1da177e4
LT		 276}
277
278static int exp_seq_show(struct seq_file *s, void *v)
279{
280 struct ip_conntrack_expect *expect = v;
281
282 if (expect->timeout.function)
283 seq_printf(s, "%ld ", timer_pending(&expect->timeout)
284 ? (long)(expect->timeout.expires - jiffies)/HZ : 0);
285 else
286 seq_printf(s, "- ");
287
288 seq_printf(s, "proto=%u ", expect->tuple.dst.protonum);
289
290 print_tuple(s, &expect->tuple,
080774a2 291 __ip_conntrack_proto_find(expect->tuple.dst.protonum));
1da177e4
LT		 292 return seq_putc(s, '\n');
293}
294
295static struct seq_operations exp_seq_ops = {
296 .start = exp_seq_start,
297 .next = exp_seq_next,
298 .stop = exp_seq_stop,
299 .show = exp_seq_show
300};
301
302static int exp_open(struct inode *inode, struct file *file)
303{
304 return seq_open(file, &exp_seq_ops);
305}
306
307static struct file_operations exp_file_ops = {
308 .owner = THIS_MODULE,
309 .open = exp_open,
310 .read = seq_read,
311 .llseek = seq_lseek,
312 .release = seq_release
313};
314
315static void *ct_cpu_seq_start(struct seq_file *seq, loff_t *pos)
316{
317 int cpu;
318
319 if (*pos == 0)
320 return SEQ_START_TOKEN;
321
322 for (cpu = *pos-1; cpu < NR_CPUS; ++cpu) {
323 if (!cpu_possible(cpu))
324 continue;
325 *pos = cpu+1;
326 return &per_cpu(ip_conntrack_stat, cpu);
327 }
328
329 return NULL;
330}
331
332static void *ct_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
333{
334 int cpu;
335
336 for (cpu = *pos; cpu < NR_CPUS; ++cpu) {
337 if (!cpu_possible(cpu))
338 continue;
339 *pos = cpu+1;
340 return &per_cpu(ip_conntrack_stat, cpu);
341 }
342
343 return NULL;
344}
345
346static void ct_cpu_seq_stop(struct seq_file *seq, void *v)
347{
348}
349
350static int ct_cpu_seq_show(struct seq_file *seq, void *v)
351{
352 unsigned int nr_conntracks = atomic_read(&ip_conntrack_count);
353 struct ip_conntrack_stat *st = v;
354
355 if (v == SEQ_START_TOKEN) {
356 seq_printf(seq, "entries searched found new invalid ignore delete delete_list insert insert_failed drop early_drop icmp_error expect_new expect_create expect_delete\n");
357 return 0;
358 }
359
360 seq_printf(seq, "%08x %08x %08x %08x %08x %08x %08x %08x "
361 "%08x %08x %08x %08x %08x %08x %08x %08x \n",
362 nr_conntracks,
363 st->searched,
364 st->found,
365 st->new,
366 st->invalid,
367 st->ignore,
368 st->delete,
369 st->delete_list,
370 st->insert,
371 st->insert_failed,
372 st->drop,
373 st->early_drop,
374 st->error,
375
376 st->expect_new,
377 st->expect_create,
378 st->expect_delete
379 );
380 return 0;
381}
382
383static struct seq_operations ct_cpu_seq_ops = {
384 .start = ct_cpu_seq_start,
385 .next = ct_cpu_seq_next,
386 .stop = ct_cpu_seq_stop,
387 .show = ct_cpu_seq_show,
388};
389
390static int ct_cpu_seq_open(struct inode *inode, struct file *file)
391{
392 return seq_open(file, &ct_cpu_seq_ops);
393}
394
395static struct file_operations ct_cpu_seq_fops = {
396 .owner = THIS_MODULE,
397 .open = ct_cpu_seq_open,
398 .read = seq_read,
399 .llseek = seq_lseek,
400 .release = seq_release_private,
401};
402#endif
403
404static unsigned int ip_confirm(unsigned int hooknum,
405 struct sk_buff **pskb,
406 const struct net_device *in,
407 const struct net_device *out,
408 int (*okfn)(struct sk_buff *))
e281e3ac
PM		 409{
410 /* We've seen it coming out the other side: confirm it */
411 return ip_conntrack_confirm(pskb);
412}
413
414static unsigned int ip_conntrack_help(unsigned int hooknum,
415 struct sk_buff **pskb,
416 const struct net_device *in,
417 const struct net_device *out,
418 int (*okfn)(struct sk_buff *))
1da177e4
LT		 419{
420 struct ip_conntrack *ct;
421 enum ip_conntrack_info ctinfo;
422
423 /* This is where we call the helper: as the packet goes out. */
424 ct = ip_conntrack_get(*pskb, &ctinfo);
6442f1cf 425 if (ct && ct->helper && ctinfo != IP_CT_RELATED + IP_CT_IS_REPLY) {
1da177e4
LT		 426 unsigned int ret;
427 ret = ct->helper->help(pskb, ct, ctinfo);
428 if (ret != NF_ACCEPT)
429 return ret;
430 }
e281e3ac 431 return NF_ACCEPT;
1da177e4
LT		 432}
433
434static unsigned int ip_conntrack_defrag(unsigned int hooknum,
435 struct sk_buff **pskb,
436 const struct net_device *in,
437 const struct net_device *out,
438 int (*okfn)(struct sk_buff *))
439{
84531c24
PO		 440#if !defined(CONFIG_IP_NF_NAT) && !defined(CONFIG_IP_NF_NAT_MODULE)
441 /* Previously seen (loopback)? Ignore. Do this before
442 fragment check. */
443 if ((*pskb)->nfct)
444 return NF_ACCEPT;
445#endif
446
1da177e4
LT		 447 /* Gather fragments. */
448 if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
449 *pskb = ip_ct_gather_frags(*pskb,
450 hooknum == NF_IP_PRE_ROUTING ?
451 IP_DEFRAG_CONNTRACK_IN :
452 IP_DEFRAG_CONNTRACK_OUT);
453 if (!*pskb)
454 return NF_STOLEN;
455 }
456 return NF_ACCEPT;
457}
458
1da177e4
LT		 459static unsigned int ip_conntrack_local(unsigned int hooknum,
460 struct sk_buff **pskb,
461 const struct net_device *in,
462 const struct net_device *out,
463 int (*okfn)(struct sk_buff *))
464{
465 /* root is playing with raw sockets. */
466 if ((*pskb)->len < sizeof(struct iphdr)
467 || (*pskb)->nh.iph->ihl * 4 < sizeof(struct iphdr)) {
468 if (net_ratelimit())
469 printk("ipt_hook: happy cracking.\n");
470 return NF_ACCEPT;
471 }
472 return ip_conntrack_in(hooknum, pskb, in, out, okfn);
473}
474
475/* Connection tracking may drop packets, but never alters them, so
476 make it the first hook. */
964ddaa1
PM		 477static struct nf_hook_ops ip_conntrack_ops[] = {
478 {
479 .hook = ip_conntrack_defrag,
480 .owner = THIS_MODULE,
481 .pf = PF_INET,
482 .hooknum = NF_IP_PRE_ROUTING,
483 .priority = NF_IP_PRI_CONNTRACK_DEFRAG,
484 },
485 {
486 .hook = ip_conntrack_in,
487 .owner = THIS_MODULE,
488 .pf = PF_INET,
489 .hooknum = NF_IP_PRE_ROUTING,
490 .priority = NF_IP_PRI_CONNTRACK,
491 },
492 {
493 .hook = ip_conntrack_defrag,
494 .owner = THIS_MODULE,
495 .pf = PF_INET,
496 .hooknum = NF_IP_LOCAL_OUT,
497 .priority = NF_IP_PRI_CONNTRACK_DEFRAG,
498 },
499 {
500 .hook = ip_conntrack_local,
501 .owner = THIS_MODULE,
502 .pf = PF_INET,
503 .hooknum = NF_IP_LOCAL_OUT,
504 .priority = NF_IP_PRI_CONNTRACK,
505 },
506 {
507 .hook = ip_conntrack_help,
508 .owner = THIS_MODULE,
509 .pf = PF_INET,
510 .hooknum = NF_IP_POST_ROUTING,
511 .priority = NF_IP_PRI_CONNTRACK_HELPER,
512 },
513 {
514 .hook = ip_conntrack_help,
515 .owner = THIS_MODULE,
516 .pf = PF_INET,
517 .hooknum = NF_IP_LOCAL_IN,
518 .priority = NF_IP_PRI_CONNTRACK_HELPER,
519 },
520 {
521 .hook = ip_confirm,
522 .owner = THIS_MODULE,
523 .pf = PF_INET,
524 .hooknum = NF_IP_POST_ROUTING,
525 .priority = NF_IP_PRI_CONNTRACK_CONFIRM,
526 },
527 {
528 .hook = ip_confirm,
529 .owner = THIS_MODULE,
530 .pf = PF_INET,
531 .hooknum = NF_IP_LOCAL_IN,
532 .priority = NF_IP_PRI_CONNTRACK_CONFIRM,
533 },
1da177e4
LT		 534};
535
536/* Sysctl support */
537
538#ifdef CONFIG_SYSCTL
539
540/* From ip_conntrack_core.c */
541extern int ip_conntrack_max;
542extern unsigned int ip_conntrack_htable_size;
543
544/* From ip_conntrack_proto_tcp.c */
babbdb1a
PM		 545extern unsigned int ip_ct_tcp_timeout_syn_sent;
546extern unsigned int ip_ct_tcp_timeout_syn_recv;
547extern unsigned int ip_ct_tcp_timeout_established;
548extern unsigned int ip_ct_tcp_timeout_fin_wait;
549extern unsigned int ip_ct_tcp_timeout_close_wait;
550extern unsigned int ip_ct_tcp_timeout_last_ack;
551extern unsigned int ip_ct_tcp_timeout_time_wait;
552extern unsigned int ip_ct_tcp_timeout_close;
553extern unsigned int ip_ct_tcp_timeout_max_retrans;
1da177e4
LT		 554extern int ip_ct_tcp_loose;
555extern int ip_ct_tcp_be_liberal;
556extern int ip_ct_tcp_max_retrans;
557
558/* From ip_conntrack_proto_udp.c */
babbdb1a
PM		 559extern unsigned int ip_ct_udp_timeout;
560extern unsigned int ip_ct_udp_timeout_stream;
1da177e4
LT		 561
562/* From ip_conntrack_proto_icmp.c */
babbdb1a 563extern unsigned int ip_ct_icmp_timeout;
1da177e4
LT		 564
565/* From ip_conntrack_proto_icmp.c */
babbdb1a 566extern unsigned int ip_ct_generic_timeout;
1da177e4
LT		 567
568/* Log invalid packets of a given protocol */
569static int log_invalid_proto_min = 0;
570static int log_invalid_proto_max = 255;
571
39a27a35
PM		 572int ip_conntrack_checksum = 1;
573
1da177e4
LT		 574static struct ctl_table_header *ip_ct_sysctl_header;
575
576static ctl_table ip_ct_sysctl_table[] = {
577 {
578 .ctl_name = NET_IPV4_NF_CONNTRACK_MAX,
579 .procname = "ip_conntrack_max",
580 .data = &ip_conntrack_max,
581 .maxlen = sizeof(int),
582 .mode = 0644,
583 .proc_handler = &proc_dointvec,
584 },
585 {
586 .ctl_name = NET_IPV4_NF_CONNTRACK_COUNT,
587 .procname = "ip_conntrack_count",
588 .data = &ip_conntrack_count,
589 .maxlen = sizeof(int),
590 .mode = 0444,
591 .proc_handler = &proc_dointvec,
592 },
593 {
594 .ctl_name = NET_IPV4_NF_CONNTRACK_BUCKETS,
595 .procname = "ip_conntrack_buckets",
596 .data = &ip_conntrack_htable_size,
597 .maxlen = sizeof(unsigned int),
598 .mode = 0444,
599 .proc_handler = &proc_dointvec,
600 },
39a27a35
PM		 601 {
602 .ctl_name = NET_IPV4_NF_CONNTRACK_CHECKSUM,
603 .procname = "ip_conntrack_checksum",
604 .data = &ip_conntrack_checksum,
605 .maxlen = sizeof(int),
606 .mode = 0644,
607 .proc_handler = &proc_dointvec,
608 },
1da177e4
LT		 609 {
610 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_SYN_SENT,
611 .procname = "ip_conntrack_tcp_timeout_syn_sent",
612 .data = &ip_ct_tcp_timeout_syn_sent,
613 .maxlen = sizeof(unsigned int),
614 .mode = 0644,
615 .proc_handler = &proc_dointvec_jiffies,
616 },
617 {
618 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_SYN_RECV,
619 .procname = "ip_conntrack_tcp_timeout_syn_recv",
620 .data = &ip_ct_tcp_timeout_syn_recv,
621 .maxlen = sizeof(unsigned int),
622 .mode = 0644,
623 .proc_handler = &proc_dointvec_jiffies,
624 },
625 {
626 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_ESTABLISHED,
627 .procname = "ip_conntrack_tcp_timeout_established",
628 .data = &ip_ct_tcp_timeout_established,
629 .maxlen = sizeof(unsigned int),
630 .mode = 0644,
631 .proc_handler = &proc_dointvec_jiffies,
632 },
633 {
634 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_FIN_WAIT,
635 .procname = "ip_conntrack_tcp_timeout_fin_wait",
636 .data = &ip_ct_tcp_timeout_fin_wait,
637 .maxlen = sizeof(unsigned int),
638 .mode = 0644,
639 .proc_handler = &proc_dointvec_jiffies,
640 },
641 {
642 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_CLOSE_WAIT,
643 .procname = "ip_conntrack_tcp_timeout_close_wait",
644 .data = &ip_ct_tcp_timeout_close_wait,
645 .maxlen = sizeof(unsigned int),
646 .mode = 0644,
647 .proc_handler = &proc_dointvec_jiffies,
648 },
649 {
650 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_LAST_ACK,
651 .procname = "ip_conntrack_tcp_timeout_last_ack",
652 .data = &ip_ct_tcp_timeout_last_ack,
653 .maxlen = sizeof(unsigned int),
654 .mode = 0644,
655 .proc_handler = &proc_dointvec_jiffies,
656 },
657 {
658 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_TIME_WAIT,
659 .procname = "ip_conntrack_tcp_timeout_time_wait",
660 .data = &ip_ct_tcp_timeout_time_wait,
661 .maxlen = sizeof(unsigned int),
662 .mode = 0644,
663 .proc_handler = &proc_dointvec_jiffies,
664 },
665 {
666 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_CLOSE,
667 .procname = "ip_conntrack_tcp_timeout_close",
668 .data = &ip_ct_tcp_timeout_close,
669 .maxlen = sizeof(unsigned int),
670 .mode = 0644,
671 .proc_handler = &proc_dointvec_jiffies,
672 },
673 {
674 .ctl_name = NET_IPV4_NF_CONNTRACK_UDP_TIMEOUT,
675 .procname = "ip_conntrack_udp_timeout",
676 .data = &ip_ct_udp_timeout,
677 .maxlen = sizeof(unsigned int),
678 .mode = 0644,
679 .proc_handler = &proc_dointvec_jiffies,
680 },
681 {
682 .ctl_name = NET_IPV4_NF_CONNTRACK_UDP_TIMEOUT_STREAM,
683 .procname = "ip_conntrack_udp_timeout_stream",
684 .data = &ip_ct_udp_timeout_stream,
685 .maxlen = sizeof(unsigned int),
686 .mode = 0644,
687 .proc_handler = &proc_dointvec_jiffies,
688 },
689 {
690 .ctl_name = NET_IPV4_NF_CONNTRACK_ICMP_TIMEOUT,
691 .procname = "ip_conntrack_icmp_timeout",
692 .data = &ip_ct_icmp_timeout,
693 .maxlen = sizeof(unsigned int),
694 .mode = 0644,
695 .proc_handler = &proc_dointvec_jiffies,
696 },
697 {
698 .ctl_name = NET_IPV4_NF_CONNTRACK_GENERIC_TIMEOUT,
699 .procname = "ip_conntrack_generic_timeout",
700 .data = &ip_ct_generic_timeout,
701 .maxlen = sizeof(unsigned int),
702 .mode = 0644,
703 .proc_handler = &proc_dointvec_jiffies,
704 },
705 {
706 .ctl_name = NET_IPV4_NF_CONNTRACK_LOG_INVALID,
707 .procname = "ip_conntrack_log_invalid",
708 .data = &ip_ct_log_invalid,
709 .maxlen = sizeof(unsigned int),
710 .mode = 0644,
711 .proc_handler = &proc_dointvec_minmax,
712 .strategy = &sysctl_intvec,
713 .extra1 = &log_invalid_proto_min,
714 .extra2 = &log_invalid_proto_max,
715 },
716 {
717 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_MAX_RETRANS,
718 .procname = "ip_conntrack_tcp_timeout_max_retrans",
719 .data = &ip_ct_tcp_timeout_max_retrans,
720 .maxlen = sizeof(unsigned int),
721 .mode = 0644,
722 .proc_handler = &proc_dointvec_jiffies,
723 },
724 {
725 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_LOOSE,
726 .procname = "ip_conntrack_tcp_loose",
727 .data = &ip_ct_tcp_loose,
728 .maxlen = sizeof(unsigned int),
729 .mode = 0644,
730 .proc_handler = &proc_dointvec,
731 },
732 {
733 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_BE_LIBERAL,
734 .procname = "ip_conntrack_tcp_be_liberal",
735 .data = &ip_ct_tcp_be_liberal,
736 .maxlen = sizeof(unsigned int),
737 .mode = 0644,
738 .proc_handler = &proc_dointvec,
739 },
740 {
741 .ctl_name = NET_IPV4_NF_CONNTRACK_TCP_MAX_RETRANS,
742 .procname = "ip_conntrack_tcp_max_retrans",
743 .data = &ip_ct_tcp_max_retrans,
744 .maxlen = sizeof(unsigned int),
745 .mode = 0644,
746 .proc_handler = &proc_dointvec,
747 },
748 { .ctl_name = 0 }
749};
750
751#define NET_IP_CONNTRACK_MAX 2089
752
753static ctl_table ip_ct_netfilter_table[] = {
754 {
755 .ctl_name = NET_IPV4_NETFILTER,
756 .procname = "netfilter",
757 .mode = 0555,
758 .child = ip_ct_sysctl_table,
759 },
760 {
761 .ctl_name = NET_IP_CONNTRACK_MAX,
762 .procname = "ip_conntrack_max",
763 .data = &ip_conntrack_max,
764 .maxlen = sizeof(int),
765 .mode = 0644,
766 .proc_handler = &proc_dointvec
767 },
768 { .ctl_name = 0 }
769};
770
771static ctl_table ip_ct_ipv4_table[] = {
772 {
773 .ctl_name = NET_IPV4,
774 .procname = "ipv4",
775 .mode = 0555,
776 .child = ip_ct_netfilter_table,
777 },
778 { .ctl_name = 0 }
779};
780
781static ctl_table ip_ct_net_table[] = {
782 {
783 .ctl_name = CTL_NET,
784 .procname = "net",
785 .mode = 0555,
786 .child = ip_ct_ipv4_table,
787 },
788 { .ctl_name = 0 }
789};
790
791EXPORT_SYMBOL(ip_ct_log_invalid);
792#endif /* CONFIG_SYSCTL */
793
32292a7f
PM		 794/* FIXME: Allow NULL functions and sub in pointers to generic for
795 them. --RR */
796int ip_conntrack_protocol_register(struct ip_conntrack_protocol *proto)
797{
798 int ret = 0;
799
800 write_lock_bh(&ip_conntrack_lock);
801 if (ip_ct_protos[proto->proto] != &ip_conntrack_generic_protocol) {
802 ret = -EBUSY;
803 goto out;
804 }
805 ip_ct_protos[proto->proto] = proto;
806 out:
807 write_unlock_bh(&ip_conntrack_lock);
808 return ret;
809}
810
811void ip_conntrack_protocol_unregister(struct ip_conntrack_protocol *proto)
812{
813 write_lock_bh(&ip_conntrack_lock);
814 ip_ct_protos[proto->proto] = &ip_conntrack_generic_protocol;
815 write_unlock_bh(&ip_conntrack_lock);
816
817 /* Somebody could be still looking at the proto in bh. */
818 synchronize_net();
819
820 /* Remove all contrack entries for this protocol */
821 ip_ct_iterate_cleanup(kill_proto, &proto->proto);
822}
823
824static int __init ip_conntrack_standalone_init(void)
1da177e4
LT		 825{
826#ifdef CONFIG_PROC_FS
827 struct proc_dir_entry *proc, *proc_exp, *proc_stat;
828#endif
829 int ret = 0;
830
1da177e4
LT		 831 ret = ip_conntrack_init();
832 if (ret < 0)
32292a7f 833 return ret;
1da177e4
LT		 834
835#ifdef CONFIG_PROC_FS
836 ret = -ENOMEM;
837 proc = proc_net_fops_create("ip_conntrack", 0440, &ct_file_ops);
838 if (!proc) goto cleanup_init;
839
840 proc_exp = proc_net_fops_create("ip_conntrack_expect", 0440,
841 &exp_file_ops);
842 if (!proc_exp) goto cleanup_proc;
843
844 proc_stat = create_proc_entry("ip_conntrack", S_IRUGO, proc_net_stat);
845 if (!proc_stat)
846 goto cleanup_proc_exp;
847
848 proc_stat->proc_fops = &ct_cpu_seq_fops;
849 proc_stat->owner = THIS_MODULE;
850#endif
851
964ddaa1 852 ret = nf_register_hooks(ip_conntrack_ops, ARRAY_SIZE(ip_conntrack_ops));
1da177e4 853 if (ret < 0) {
964ddaa1 854 printk("ip_conntrack: can't register hooks.\n");
1da177e4
LT		 855 goto cleanup_proc_stat;
856 }
1da177e4
LT		 857#ifdef CONFIG_SYSCTL
858 ip_ct_sysctl_header = register_sysctl_table(ip_ct_net_table, 0);
859 if (ip_ct_sysctl_header == NULL) {
860 printk("ip_conntrack: can't register to sysctl.\n");
861 ret = -ENOMEM;
964ddaa1 862 goto cleanup_hooks;
1da177e4
LT		 863 }
864#endif
1da177e4
LT		 865 return ret;
866
1da177e4 867#ifdef CONFIG_SYSCTL
964ddaa1 868 cleanup_hooks:
964ddaa1 869 nf_unregister_hooks(ip_conntrack_ops, ARRAY_SIZE(ip_conntrack_ops));
32292a7f 870#endif
1da177e4
LT		 871 cleanup_proc_stat:
872#ifdef CONFIG_PROC_FS
873 remove_proc_entry("ip_conntrack", proc_net_stat);
874 cleanup_proc_exp:
875 proc_net_remove("ip_conntrack_expect");
876 cleanup_proc:
877 proc_net_remove("ip_conntrack");
878 cleanup_init:
879#endif /* CONFIG_PROC_FS */
880 ip_conntrack_cleanup();
1da177e4
LT		 881 return ret;
882}
883
65b4b4e8 884static void __exit ip_conntrack_standalone_fini(void)
1da177e4 885{
32292a7f
PM		 886 synchronize_net();
887#ifdef CONFIG_SYSCTL
888 unregister_sysctl_table(ip_ct_sysctl_header);
889#endif
890 nf_unregister_hooks(ip_conntrack_ops, ARRAY_SIZE(ip_conntrack_ops));
891#ifdef CONFIG_PROC_FS
892 remove_proc_entry("ip_conntrack", proc_net_stat);
893 proc_net_remove("ip_conntrack_expect");
894 proc_net_remove("ip_conntrack");
895#endif /* CONFIG_PROC_FS */
896 ip_conntrack_cleanup();
1da177e4
LT		 897}
898
65b4b4e8
AM		 899module_init(ip_conntrack_standalone_init);
900module_exit(ip_conntrack_standalone_fini);
1da177e4
LT		 901
902/* Some modules need us, but don't depend directly on any symbol.
903 They should call this. */
2e4e6a17 904void need_conntrack(void)
1da177e4
LT		 905{
906}
907
ac3247ba
HW		 908#ifdef CONFIG_IP_NF_CONNTRACK_EVENTS
909EXPORT_SYMBOL_GPL(ip_conntrack_chain);
910EXPORT_SYMBOL_GPL(ip_conntrack_expect_chain);
911EXPORT_SYMBOL_GPL(ip_conntrack_register_notifier);
912EXPORT_SYMBOL_GPL(ip_conntrack_unregister_notifier);
a86888b9 913EXPORT_SYMBOL_GPL(__ip_ct_event_cache_init);
ac3247ba
HW		 914EXPORT_PER_CPU_SYMBOL_GPL(ip_conntrack_ecache);
915#endif
1da177e4
LT		 916EXPORT_SYMBOL(ip_conntrack_protocol_register);
917EXPORT_SYMBOL(ip_conntrack_protocol_unregister);
918EXPORT_SYMBOL(ip_ct_get_tuple);
919EXPORT_SYMBOL(invert_tuplepr);
920EXPORT_SYMBOL(ip_conntrack_alter_reply);
921EXPORT_SYMBOL(ip_conntrack_destroyed);
2e4e6a17 922EXPORT_SYMBOL(need_conntrack);
1da177e4
LT		 923EXPORT_SYMBOL(ip_conntrack_helper_register);
924EXPORT_SYMBOL(ip_conntrack_helper_unregister);
925EXPORT_SYMBOL(ip_ct_iterate_cleanup);
1dfbab59 926EXPORT_SYMBOL(__ip_ct_refresh_acct);
080774a2 927
1da177e4 928EXPORT_SYMBOL(ip_conntrack_expect_alloc);
4acdbdbe 929EXPORT_SYMBOL(ip_conntrack_expect_put);
a41bc002
PM		 930EXPORT_SYMBOL_GPL(__ip_conntrack_expect_find);
931EXPORT_SYMBOL_GPL(ip_conntrack_expect_find);
1da177e4
LT		 932EXPORT_SYMBOL(ip_conntrack_expect_related);
933EXPORT_SYMBOL(ip_conntrack_unexpect_related);
080774a2 934EXPORT_SYMBOL_GPL(ip_conntrack_expect_list);
49719eb3 935EXPORT_SYMBOL_GPL(ip_ct_unlink_expect);
080774a2 936
1da177e4
LT		 937EXPORT_SYMBOL(ip_conntrack_tuple_taken);
938EXPORT_SYMBOL(ip_ct_gather_frags);
939EXPORT_SYMBOL(ip_conntrack_htable_size);
940EXPORT_SYMBOL(ip_conntrack_lock);
941EXPORT_SYMBOL(ip_conntrack_hash);
942EXPORT_SYMBOL(ip_conntrack_untracked);
943EXPORT_SYMBOL_GPL(ip_conntrack_find_get);
1da177e4
LT		 944#ifdef CONFIG_IP_NF_NAT_NEEDED
945EXPORT_SYMBOL(ip_conntrack_tcp_update);
946#endif
080774a2
HW		 947
948EXPORT_SYMBOL_GPL(ip_conntrack_flush);
949EXPORT_SYMBOL_GPL(__ip_conntrack_find);
950
951EXPORT_SYMBOL_GPL(ip_conntrack_alloc);
952EXPORT_SYMBOL_GPL(ip_conntrack_free);
953EXPORT_SYMBOL_GPL(ip_conntrack_hash_insert);
954
955EXPORT_SYMBOL_GPL(ip_ct_remove_expectations);
956
957EXPORT_SYMBOL_GPL(ip_conntrack_helper_find_get);
958EXPORT_SYMBOL_GPL(ip_conntrack_helper_put);
959EXPORT_SYMBOL_GPL(__ip_conntrack_helper_find_byname);
960
961EXPORT_SYMBOL_GPL(ip_conntrack_proto_find_get);
962EXPORT_SYMBOL_GPL(ip_conntrack_proto_put);
963EXPORT_SYMBOL_GPL(__ip_conntrack_proto_find);
39a27a35 964EXPORT_SYMBOL_GPL(ip_conntrack_checksum);
080774a2
HW		 965#if defined(CONFIG_IP_NF_CONNTRACK_NETLINK) || \
966 defined(CONFIG_IP_NF_CONNTRACK_NETLINK_MODULE)
967EXPORT_SYMBOL_GPL(ip_ct_port_tuple_to_nfattr);
968EXPORT_SYMBOL_GPL(ip_ct_port_nfattr_to_tuple);
969#endif
Linux kernel - Deliverables
This page took 0.176986 seconds and 5 git commands to generate.