projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
[TCP] Vegas: Increase default alpha to 2 and beta to 4.
[deliverable/linux.git] / net / netfilter / nf_conntrack_standalone.c
CommitLineData
9fb9cbb1
YK		 1/* This file contains all the functions required for the standalone
2 nf_conntrack module.
3
4 These are not required by the compatibility layer.
5*/
6
7/* (C) 1999-2001 Paul `Rusty' Russell
8 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2 as
12 * published by the Free Software Foundation.
13 *
14 * 16 Dec 2003: Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp>
15 * - generalize L3 protocol dependent part.
16 *
17 * Derived from net/ipv4/netfilter/ip_conntrack_standalone.c
18 */
19
9fb9cbb1
YK		 20#include <linux/types.h>
21#include <linux/netfilter.h>
22#include <linux/module.h>
23#include <linux/skbuff.h>
24#include <linux/proc_fs.h>
25#include <linux/seq_file.h>
26#include <linux/percpu.h>
27#include <linux/netdevice.h>
28#ifdef CONFIG_SYSCTL
29#include <linux/sysctl.h>
30#endif
31
32#define ASSERT_READ_LOCK(x)
33#define ASSERT_WRITE_LOCK(x)
34
35#include <net/netfilter/nf_conntrack.h>
36#include <net/netfilter/nf_conntrack_l3proto.h>
37#include <net/netfilter/nf_conntrack_protocol.h>
38#include <net/netfilter/nf_conntrack_core.h>
39#include <net/netfilter/nf_conntrack_helper.h>
9fb9cbb1
YK		 40
41#if 0
42#define DEBUGP printk
43#else
44#define DEBUGP(format, args...)
45#endif
46
47MODULE_LICENSE("GPL");
48
49extern atomic_t nf_conntrack_count;
50DECLARE_PER_CPU(struct ip_conntrack_stat, nf_conntrack_stat);
51
52static int kill_l3proto(struct nf_conn *i, void *data)
53{
54 return (i->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num ==
55 ((struct nf_conntrack_l3proto *)data)->l3proto);
56}
57
58static int kill_proto(struct nf_conn *i, void *data)
59{
60 struct nf_conntrack_protocol *proto;
61 proto = (struct nf_conntrack_protocol *)data;
62 return (i->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum ==
63 proto->proto) &&
64 (i->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num ==
65 proto->l3proto);
66}
67
68#ifdef CONFIG_PROC_FS
69static int
70print_tuple(struct seq_file *s, const struct nf_conntrack_tuple *tuple,
71 struct nf_conntrack_l3proto *l3proto,
72 struct nf_conntrack_protocol *proto)
73{
74 return l3proto->print_tuple(s, tuple) || proto->print_tuple(s, tuple);
75}
76
77#ifdef CONFIG_NF_CT_ACCT
78static unsigned int
79seq_print_counters(struct seq_file *s,
80 const struct ip_conntrack_counter *counter)
81{
82 return seq_printf(s, "packets=%llu bytes=%llu ",
83 (unsigned long long)counter->packets,
84 (unsigned long long)counter->bytes);
85}
86#else
87#define seq_print_counters(x, y) 0
88#endif
89
90struct ct_iter_state {
91 unsigned int bucket;
92};
93
94static struct list_head *ct_get_first(struct seq_file *seq)
95{
96 struct ct_iter_state *st = seq->private;
97
98 for (st->bucket = 0;
99 st->bucket < nf_conntrack_htable_size;
100 st->bucket++) {
101 if (!list_empty(&nf_conntrack_hash[st->bucket]))
102 return nf_conntrack_hash[st->bucket].next;
103 }
104 return NULL;
105}
106
107static struct list_head *ct_get_next(struct seq_file *seq, struct list_head *head)
108{
109 struct ct_iter_state *st = seq->private;
110
111 head = head->next;
112 while (head == &nf_conntrack_hash[st->bucket]) {
113 if (++st->bucket >= nf_conntrack_htable_size)
114 return NULL;
115 head = nf_conntrack_hash[st->bucket].next;
116 }
117 return head;
118}
119
120static struct list_head *ct_get_idx(struct seq_file *seq, loff_t pos)
121{
122 struct list_head *head = ct_get_first(seq);
123
124 if (head)
125 while (pos && (head = ct_get_next(seq, head)))
126 pos--;
127 return pos ? NULL : head;
128}
129
130static void *ct_seq_start(struct seq_file *seq, loff_t *pos)
131{
132 read_lock_bh(&nf_conntrack_lock);
133 return ct_get_idx(seq, *pos);
134}
135
136static void *ct_seq_next(struct seq_file *s, void *v, loff_t *pos)
137{
138 (*pos)++;
139 return ct_get_next(s, v);
140}
141
142static void ct_seq_stop(struct seq_file *s, void *v)
143{
144 read_unlock_bh(&nf_conntrack_lock);
145}
146
147/* return 0 on success, 1 in case of error */
148static int ct_seq_show(struct seq_file *s, void *v)
149{
150 const struct nf_conntrack_tuple_hash *hash = v;
151 const struct nf_conn *conntrack = nf_ct_tuplehash_to_ctrack(hash);
152 struct nf_conntrack_l3proto *l3proto;
153 struct nf_conntrack_protocol *proto;
154
155 ASSERT_READ_LOCK(&nf_conntrack_lock);
156 NF_CT_ASSERT(conntrack);
157
158 /* we only want to print DIR_ORIGINAL */
159 if (NF_CT_DIRECTION(hash))
160 return 0;
161
c1d10adb
PNA		 162 l3proto = __nf_ct_l3proto_find(conntrack->tuplehash[IP_CT_DIR_ORIGINAL]
163 .tuple.src.l3num);
9fb9cbb1
YK		 164
165 NF_CT_ASSERT(l3proto);
c1d10adb
PNA		 166 proto = __nf_ct_proto_find(conntrack->tuplehash[IP_CT_DIR_ORIGINAL]
167 .tuple.src.l3num,
168 conntrack->tuplehash[IP_CT_DIR_ORIGINAL]
169 .tuple.dst.protonum);
9fb9cbb1
YK		 170 NF_CT_ASSERT(proto);
171
172 if (seq_printf(s, "%-8s %u %-8s %u %ld ",
173 l3proto->name,
174 conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num,
175 proto->name,
176 conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum,
177 timer_pending(&conntrack->timeout)
178 ? (long)(conntrack->timeout.expires - jiffies)/HZ : 0) != 0)
179 return -ENOSPC;
180
181 if (l3proto->print_conntrack(s, conntrack))
182 return -ENOSPC;
183
184 if (proto->print_conntrack(s, conntrack))
185 return -ENOSPC;
186
187 if (print_tuple(s, &conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
188 l3proto, proto))
189 return -ENOSPC;
190
191 if (seq_print_counters(s, &conntrack->counters[IP_CT_DIR_ORIGINAL]))
192 return -ENOSPC;
193
194 if (!(test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)))
195 if (seq_printf(s, "[UNREPLIED] "))
196 return -ENOSPC;
197
198 if (print_tuple(s, &conntrack->tuplehash[IP_CT_DIR_REPLY].tuple,
199 l3proto, proto))
200 return -ENOSPC;
201
202 if (seq_print_counters(s, &conntrack->counters[IP_CT_DIR_REPLY]))
203 return -ENOSPC;
204
205 if (test_bit(IPS_ASSURED_BIT, &conntrack->status))
206 if (seq_printf(s, "[ASSURED] "))
207 return -ENOSPC;
208
209#if defined(CONFIG_NF_CONNTRACK_MARK)
210 if (seq_printf(s, "mark=%u ", conntrack->mark))
211 return -ENOSPC;
212#endif
213
7c9728c3
JM		 214#ifdef CONFIG_NF_CONNTRACK_SECMARK
215 if (seq_printf(s, "secmark=%u ", conntrack->secmark))
216 return -ENOSPC;
217#endif
218
9fb9cbb1
YK		 219 if (seq_printf(s, "use=%u\n", atomic_read(&conntrack->ct_general.use)))
220 return -ENOSPC;
221
222 return 0;
223}
224
225static struct seq_operations ct_seq_ops = {
226 .start = ct_seq_start,
227 .next = ct_seq_next,
228 .stop = ct_seq_stop,
229 .show = ct_seq_show
230};
231
232static int ct_open(struct inode *inode, struct file *file)
233{
234 struct seq_file *seq;
235 struct ct_iter_state *st;
236 int ret;
237
238 st = kmalloc(sizeof(struct ct_iter_state), GFP_KERNEL);
239 if (st == NULL)
240 return -ENOMEM;
241 ret = seq_open(file, &ct_seq_ops);
242 if (ret)
243 goto out_free;
244 seq = file->private_data;
245 seq->private = st;
246 memset(st, 0, sizeof(struct ct_iter_state));
247 return ret;
248out_free:
249 kfree(st);
250 return ret;
251}
252
253static struct file_operations ct_file_ops = {
254 .owner = THIS_MODULE,
255 .open = ct_open,
256 .read = seq_read,
257 .llseek = seq_lseek,
258 .release = seq_release_private,
259};
260
261/* expects */
262static void *exp_seq_start(struct seq_file *s, loff_t *pos)
263{
264 struct list_head *e = &nf_conntrack_expect_list;
265 loff_t i;
266
267 /* strange seq_file api calls stop even if we fail,
268 * thus we need to grab lock since stop unlocks */
269 read_lock_bh(&nf_conntrack_lock);
270
271 if (list_empty(e))
272 return NULL;
273
274 for (i = 0; i <= *pos; i++) {
275 e = e->next;
276 if (e == &nf_conntrack_expect_list)
277 return NULL;
278 }
279 return e;
280}
281
282static void *exp_seq_next(struct seq_file *s, void *v, loff_t *pos)
283{
284 struct list_head *e = v;
285
286 ++*pos;
287 e = e->next;
288
289 if (e == &nf_conntrack_expect_list)
290 return NULL;
291
292 return e;
293}
294
295static void exp_seq_stop(struct seq_file *s, void *v)
296{
297 read_unlock_bh(&nf_conntrack_lock);
298}
299
300static int exp_seq_show(struct seq_file *s, void *v)
301{
302 struct nf_conntrack_expect *expect = v;
303
304 if (expect->timeout.function)
305 seq_printf(s, "%ld ", timer_pending(&expect->timeout)
306 ? (long)(expect->timeout.expires - jiffies)/HZ : 0);
307 else
308 seq_printf(s, "- ");
309 seq_printf(s, "l3proto = %u proto=%u ",
310 expect->tuple.src.l3num,
311 expect->tuple.dst.protonum);
312 print_tuple(s, &expect->tuple,
c1d10adb
PNA		 313 __nf_ct_l3proto_find(expect->tuple.src.l3num),
314 __nf_ct_proto_find(expect->tuple.src.l3num,
315 expect->tuple.dst.protonum));
9fb9cbb1
YK		 316 return seq_putc(s, '\n');
317}
318
319static struct seq_operations exp_seq_ops = {
320 .start = exp_seq_start,
321 .next = exp_seq_next,
322 .stop = exp_seq_stop,
323 .show = exp_seq_show
324};
325
326static int exp_open(struct inode *inode, struct file *file)
327{
328 return seq_open(file, &exp_seq_ops);
329}
330
331static struct file_operations exp_file_ops = {
332 .owner = THIS_MODULE,
333 .open = exp_open,
334 .read = seq_read,
335 .llseek = seq_lseek,
336 .release = seq_release
337};
338
339static void *ct_cpu_seq_start(struct seq_file *seq, loff_t *pos)
340{
341 int cpu;
342
343 if (*pos == 0)
344 return SEQ_START_TOKEN;
345
346 for (cpu = *pos-1; cpu < NR_CPUS; ++cpu) {
347 if (!cpu_possible(cpu))
348 continue;
349 *pos = cpu + 1;
350 return &per_cpu(nf_conntrack_stat, cpu);
351 }
352
353 return NULL;
354}
355
356static void *ct_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
357{
358 int cpu;
359
360 for (cpu = *pos; cpu < NR_CPUS; ++cpu) {
361 if (!cpu_possible(cpu))
362 continue;
363 *pos = cpu + 1;
364 return &per_cpu(nf_conntrack_stat, cpu);
365 }
366
367 return NULL;
368}
369
370static void ct_cpu_seq_stop(struct seq_file *seq, void *v)
371{
372}
373
374static int ct_cpu_seq_show(struct seq_file *seq, void *v)
375{
376 unsigned int nr_conntracks = atomic_read(&nf_conntrack_count);
377 struct ip_conntrack_stat *st = v;
378
379 if (v == SEQ_START_TOKEN) {
380 seq_printf(seq, "entries searched found new invalid ignore delete delete_list insert insert_failed drop early_drop icmp_error expect_new expect_create expect_delete\n");
381 return 0;
382 }
383
384 seq_printf(seq, "%08x %08x %08x %08x %08x %08x %08x %08x "
385 "%08x %08x %08x %08x %08x %08x %08x %08x \n",
386 nr_conntracks,
387 st->searched,
388 st->found,
389 st->new,
390 st->invalid,
391 st->ignore,
392 st->delete,
393 st->delete_list,
394 st->insert,
395 st->insert_failed,
396 st->drop,
397 st->early_drop,
398 st->error,
399
400 st->expect_new,
401 st->expect_create,
402 st->expect_delete
403 );
404 return 0;
405}
406
407static struct seq_operations ct_cpu_seq_ops = {
408 .start = ct_cpu_seq_start,
409 .next = ct_cpu_seq_next,
410 .stop = ct_cpu_seq_stop,
411 .show = ct_cpu_seq_show,
412};
413
414static int ct_cpu_seq_open(struct inode *inode, struct file *file)
415{
416 return seq_open(file, &ct_cpu_seq_ops);
417}
418
419static struct file_operations ct_cpu_seq_fops = {
420 .owner = THIS_MODULE,
421 .open = ct_cpu_seq_open,
422 .read = seq_read,
423 .llseek = seq_lseek,
424 .release = seq_release_private,
425};
426#endif /* CONFIG_PROC_FS */
427
428/* Sysctl support */
429
94aec08e 430int nf_conntrack_checksum __read_mostly = 1;
72b55823 431
9fb9cbb1
YK		 432#ifdef CONFIG_SYSCTL
433
434/* From nf_conntrack_core.c */
435extern int nf_conntrack_max;
436extern unsigned int nf_conntrack_htable_size;
437
438/* From nf_conntrack_proto_tcp.c */
babbdb1a
PM		 439extern unsigned int nf_ct_tcp_timeout_syn_sent;
440extern unsigned int nf_ct_tcp_timeout_syn_recv;
441extern unsigned int nf_ct_tcp_timeout_established;
442extern unsigned int nf_ct_tcp_timeout_fin_wait;
443extern unsigned int nf_ct_tcp_timeout_close_wait;
444extern unsigned int nf_ct_tcp_timeout_last_ack;
445extern unsigned int nf_ct_tcp_timeout_time_wait;
446extern unsigned int nf_ct_tcp_timeout_close;
447extern unsigned int nf_ct_tcp_timeout_max_retrans;
9fb9cbb1
YK		 448extern int nf_ct_tcp_loose;
449extern int nf_ct_tcp_be_liberal;
450extern int nf_ct_tcp_max_retrans;
451
452/* From nf_conntrack_proto_udp.c */
babbdb1a
PM		 453extern unsigned int nf_ct_udp_timeout;
454extern unsigned int nf_ct_udp_timeout_stream;
9fb9cbb1
YK		 455
456/* From nf_conntrack_proto_generic.c */
babbdb1a 457extern unsigned int nf_ct_generic_timeout;
9fb9cbb1
YK		 458
459/* Log invalid packets of a given protocol */
460static int log_invalid_proto_min = 0;
461static int log_invalid_proto_max = 255;
462
463static struct ctl_table_header *nf_ct_sysctl_header;
464
465static ctl_table nf_ct_sysctl_table[] = {
466 {
467 .ctl_name = NET_NF_CONNTRACK_MAX,
468 .procname = "nf_conntrack_max",
469 .data = &nf_conntrack_max,
470 .maxlen = sizeof(int),
471 .mode = 0644,
472 .proc_handler = &proc_dointvec,
473 },
474 {
475 .ctl_name = NET_NF_CONNTRACK_COUNT,
476 .procname = "nf_conntrack_count",
477 .data = &nf_conntrack_count,
478 .maxlen = sizeof(int),
479 .mode = 0444,
480 .proc_handler = &proc_dointvec,
481 },
482 {
483 .ctl_name = NET_NF_CONNTRACK_BUCKETS,
484 .procname = "nf_conntrack_buckets",
485 .data = &nf_conntrack_htable_size,
486 .maxlen = sizeof(unsigned int),
487 .mode = 0444,
488 .proc_handler = &proc_dointvec,
489 },
39a27a35
PM		 490 {
491 .ctl_name = NET_NF_CONNTRACK_CHECKSUM,
492 .procname = "nf_conntrack_checksum",
493 .data = &nf_conntrack_checksum,
494 .maxlen = sizeof(unsigned int),
495 .mode = 0644,
496 .proc_handler = &proc_dointvec,
497 },
9fb9cbb1
YK		 498 {
499 .ctl_name = NET_NF_CONNTRACK_TCP_TIMEOUT_SYN_SENT,
500 .procname = "nf_conntrack_tcp_timeout_syn_sent",
501 .data = &nf_ct_tcp_timeout_syn_sent,
502 .maxlen = sizeof(unsigned int),
503 .mode = 0644,
504 .proc_handler = &proc_dointvec_jiffies,
505 },
506 {
507 .ctl_name = NET_NF_CONNTRACK_TCP_TIMEOUT_SYN_RECV,
508 .procname = "nf_conntrack_tcp_timeout_syn_recv",
509 .data = &nf_ct_tcp_timeout_syn_recv,
510 .maxlen = sizeof(unsigned int),
511 .mode = 0644,
512 .proc_handler = &proc_dointvec_jiffies,
513 },
514 {
515 .ctl_name = NET_NF_CONNTRACK_TCP_TIMEOUT_ESTABLISHED,
516 .procname = "nf_conntrack_tcp_timeout_established",
517 .data = &nf_ct_tcp_timeout_established,
518 .maxlen = sizeof(unsigned int),
519 .mode = 0644,
520 .proc_handler = &proc_dointvec_jiffies,
521 },
522 {
523 .ctl_name = NET_NF_CONNTRACK_TCP_TIMEOUT_FIN_WAIT,
524 .procname = "nf_conntrack_tcp_timeout_fin_wait",
525 .data = &nf_ct_tcp_timeout_fin_wait,
526 .maxlen = sizeof(unsigned int),
527 .mode = 0644,
528 .proc_handler = &proc_dointvec_jiffies,
529 },
530 {
531 .ctl_name = NET_NF_CONNTRACK_TCP_TIMEOUT_CLOSE_WAIT,
532 .procname = "nf_conntrack_tcp_timeout_close_wait",
533 .data = &nf_ct_tcp_timeout_close_wait,
534 .maxlen = sizeof(unsigned int),
535 .mode = 0644,
536 .proc_handler = &proc_dointvec_jiffies,
537 },
538 {
539 .ctl_name = NET_NF_CONNTRACK_TCP_TIMEOUT_LAST_ACK,
540 .procname = "nf_conntrack_tcp_timeout_last_ack",
541 .data = &nf_ct_tcp_timeout_last_ack,
542 .maxlen = sizeof(unsigned int),
543 .mode = 0644,
544 .proc_handler = &proc_dointvec_jiffies,
545 },
546 {
547 .ctl_name = NET_NF_CONNTRACK_TCP_TIMEOUT_TIME_WAIT,
548 .procname = "nf_conntrack_tcp_timeout_time_wait",
549 .data = &nf_ct_tcp_timeout_time_wait,
550 .maxlen = sizeof(unsigned int),
551 .mode = 0644,
552 .proc_handler = &proc_dointvec_jiffies,
553 },
554 {
555 .ctl_name = NET_NF_CONNTRACK_TCP_TIMEOUT_CLOSE,
556 .procname = "nf_conntrack_tcp_timeout_close",
557 .data = &nf_ct_tcp_timeout_close,
558 .maxlen = sizeof(unsigned int),
559 .mode = 0644,
560 .proc_handler = &proc_dointvec_jiffies,
561 },
562 {
563 .ctl_name = NET_NF_CONNTRACK_UDP_TIMEOUT,
564 .procname = "nf_conntrack_udp_timeout",
565 .data = &nf_ct_udp_timeout,
566 .maxlen = sizeof(unsigned int),
567 .mode = 0644,
568 .proc_handler = &proc_dointvec_jiffies,
569 },
570 {
571 .ctl_name = NET_NF_CONNTRACK_UDP_TIMEOUT_STREAM,
572 .procname = "nf_conntrack_udp_timeout_stream",
573 .data = &nf_ct_udp_timeout_stream,
574 .maxlen = sizeof(unsigned int),
575 .mode = 0644,
576 .proc_handler = &proc_dointvec_jiffies,
577 },
578 {
579 .ctl_name = NET_NF_CONNTRACK_GENERIC_TIMEOUT,
580 .procname = "nf_conntrack_generic_timeout",
581 .data = &nf_ct_generic_timeout,
582 .maxlen = sizeof(unsigned int),
583 .mode = 0644,
584 .proc_handler = &proc_dointvec_jiffies,
585 },
586 {
587 .ctl_name = NET_NF_CONNTRACK_LOG_INVALID,
588 .procname = "nf_conntrack_log_invalid",
589 .data = &nf_ct_log_invalid,
590 .maxlen = sizeof(unsigned int),
591 .mode = 0644,
592 .proc_handler = &proc_dointvec_minmax,
593 .strategy = &sysctl_intvec,
594 .extra1 = &log_invalid_proto_min,
595 .extra2 = &log_invalid_proto_max,
596 },
597 {
598 .ctl_name = NET_NF_CONNTRACK_TCP_TIMEOUT_MAX_RETRANS,
599 .procname = "nf_conntrack_tcp_timeout_max_retrans",
600 .data = &nf_ct_tcp_timeout_max_retrans,
601 .maxlen = sizeof(unsigned int),
602 .mode = 0644,
603 .proc_handler = &proc_dointvec_jiffies,
604 },
605 {
606 .ctl_name = NET_NF_CONNTRACK_TCP_LOOSE,
607 .procname = "nf_conntrack_tcp_loose",
608 .data = &nf_ct_tcp_loose,
609 .maxlen = sizeof(unsigned int),
610 .mode = 0644,
611 .proc_handler = &proc_dointvec,
612 },
613 {
614 .ctl_name = NET_NF_CONNTRACK_TCP_BE_LIBERAL,
615 .procname = "nf_conntrack_tcp_be_liberal",
616 .data = &nf_ct_tcp_be_liberal,
617 .maxlen = sizeof(unsigned int),
618 .mode = 0644,
619 .proc_handler = &proc_dointvec,
620 },
621 {
622 .ctl_name = NET_NF_CONNTRACK_TCP_MAX_RETRANS,
623 .procname = "nf_conntrack_tcp_max_retrans",
624 .data = &nf_ct_tcp_max_retrans,
625 .maxlen = sizeof(unsigned int),
626 .mode = 0644,
627 .proc_handler = &proc_dointvec,
628 },
629
630 { .ctl_name = 0 }
631};
632
633#define NET_NF_CONNTRACK_MAX 2089
634
635static ctl_table nf_ct_netfilter_table[] = {
636 {
637 .ctl_name = NET_NETFILTER,
638 .procname = "netfilter",
639 .mode = 0555,
640 .child = nf_ct_sysctl_table,
641 },
642 {
643 .ctl_name = NET_NF_CONNTRACK_MAX,
644 .procname = "nf_conntrack_max",
645 .data = &nf_conntrack_max,
646 .maxlen = sizeof(int),
647 .mode = 0644,
648 .proc_handler = &proc_dointvec,
649 },
650 { .ctl_name = 0 }
651};
652
653static ctl_table nf_ct_net_table[] = {
654 {
655 .ctl_name = CTL_NET,
656 .procname = "net",
657 .mode = 0555,
658 .child = nf_ct_netfilter_table,
659 },
660 { .ctl_name = 0 }
661};
662EXPORT_SYMBOL(nf_ct_log_invalid);
663#endif /* CONFIG_SYSCTL */
664
9fb9cbb1
YK		 665int nf_conntrack_l3proto_register(struct nf_conntrack_l3proto *proto)
666{
667 int ret = 0;
668
669 write_lock_bh(&nf_conntrack_lock);
670 if (nf_ct_l3protos[proto->l3proto] != &nf_conntrack_generic_l3proto) {
671 ret = -EBUSY;
672 goto out;
673 }
674 nf_ct_l3protos[proto->l3proto] = proto;
675out:
676 write_unlock_bh(&nf_conntrack_lock);
677
678 return ret;
679}
680
681void nf_conntrack_l3proto_unregister(struct nf_conntrack_l3proto *proto)
682{
683 write_lock_bh(&nf_conntrack_lock);
684 nf_ct_l3protos[proto->l3proto] = &nf_conntrack_generic_l3proto;
685 write_unlock_bh(&nf_conntrack_lock);
686
687 /* Somebody could be still looking at the proto in bh. */
688 synchronize_net();
689
690 /* Remove all contrack entries for this protocol */
691 nf_ct_iterate_cleanup(kill_l3proto, proto);
692}
693
694/* FIXME: Allow NULL functions and sub in pointers to generic for
695 them. --RR */
696int nf_conntrack_protocol_register(struct nf_conntrack_protocol *proto)
697{
698 int ret = 0;
699
700retry:
701 write_lock_bh(&nf_conntrack_lock);
702 if (nf_ct_protos[proto->l3proto]) {
703 if (nf_ct_protos[proto->l3proto][proto->proto]
704 != &nf_conntrack_generic_protocol) {
705 ret = -EBUSY;
706 goto out_unlock;
707 }
708 } else {
709 /* l3proto may be loaded latter. */
710 struct nf_conntrack_protocol **proto_array;
711 int i;
712
713 write_unlock_bh(&nf_conntrack_lock);
714
715 proto_array = (struct nf_conntrack_protocol **)
716 kmalloc(MAX_NF_CT_PROTO *
717 sizeof(struct nf_conntrack_protocol *),
718 GFP_KERNEL);
719 if (proto_array == NULL) {
720 ret = -ENOMEM;
721 goto out;
722 }
723 for (i = 0; i < MAX_NF_CT_PROTO; i++)
724 proto_array[i] = &nf_conntrack_generic_protocol;
725
726 write_lock_bh(&nf_conntrack_lock);
727 if (nf_ct_protos[proto->l3proto]) {
728 /* bad timing, but no problem */
729 write_unlock_bh(&nf_conntrack_lock);
730 kfree(proto_array);
731 } else {
732 nf_ct_protos[proto->l3proto] = proto_array;
733 write_unlock_bh(&nf_conntrack_lock);
734 }
735
736 /*
737 * Just once because array is never freed until unloading
738 * nf_conntrack.ko
739 */
740 goto retry;
741 }
742
743 nf_ct_protos[proto->l3proto][proto->proto] = proto;
744
745out_unlock:
746 write_unlock_bh(&nf_conntrack_lock);
747out:
748 return ret;
749}
750
751void nf_conntrack_protocol_unregister(struct nf_conntrack_protocol *proto)
752{
753 write_lock_bh(&nf_conntrack_lock);
754 nf_ct_protos[proto->l3proto][proto->proto]
755 = &nf_conntrack_generic_protocol;
756 write_unlock_bh(&nf_conntrack_lock);
757
758 /* Somebody could be still looking at the proto in bh. */
759 synchronize_net();
760
761 /* Remove all contrack entries for this protocol */
762 nf_ct_iterate_cleanup(kill_proto, proto);
763}
764
65b4b4e8 765static int __init nf_conntrack_standalone_init(void)
9fb9cbb1 766{
32292a7f
PM		 767#ifdef CONFIG_PROC_FS
768 struct proc_dir_entry *proc, *proc_exp, *proc_stat;
769#endif
770 int ret = 0;
771
772 ret = nf_conntrack_init();
773 if (ret < 0)
774 return ret;
775
776#ifdef CONFIG_PROC_FS
777 proc = proc_net_fops_create("nf_conntrack", 0440, &ct_file_ops);
778 if (!proc) goto cleanup_init;
779
780 proc_exp = proc_net_fops_create("nf_conntrack_expect", 0440,
781 &exp_file_ops);
782 if (!proc_exp) goto cleanup_proc;
783
784 proc_stat = create_proc_entry("nf_conntrack", S_IRUGO, proc_net_stat);
785 if (!proc_stat)
786 goto cleanup_proc_exp;
787
788 proc_stat->proc_fops = &ct_cpu_seq_fops;
789 proc_stat->owner = THIS_MODULE;
790#endif
791#ifdef CONFIG_SYSCTL
792 nf_ct_sysctl_header = register_sysctl_table(nf_ct_net_table, 0);
793 if (nf_ct_sysctl_header == NULL) {
794 printk("nf_conntrack: can't register to sysctl.\n");
795 ret = -ENOMEM;
796 goto cleanup_proc_stat;
797 }
798#endif
799 return ret;
800
801#ifdef CONFIG_SYSCTL
802 cleanup_proc_stat:
803#endif
804#ifdef CONFIG_PROC_FS
805 remove_proc_entry("nf_conntrack", proc_net_stat);
806 cleanup_proc_exp:
807 proc_net_remove("nf_conntrack_expect");
808 cleanup_proc:
809 proc_net_remove("nf_conntrack");
810 cleanup_init:
811#endif /* CNFIG_PROC_FS */
812 nf_conntrack_cleanup();
813 return ret;
9fb9cbb1
YK		 814}
815
65b4b4e8 816static void __exit nf_conntrack_standalone_fini(void)
9fb9cbb1 817{
32292a7f
PM		 818#ifdef CONFIG_SYSCTL
819 unregister_sysctl_table(nf_ct_sysctl_header);
820#endif
821#ifdef CONFIG_PROC_FS
822 remove_proc_entry("nf_conntrack", proc_net_stat);
823 proc_net_remove("nf_conntrack_expect");
824 proc_net_remove("nf_conntrack");
825#endif /* CNFIG_PROC_FS */
826 nf_conntrack_cleanup();
9fb9cbb1
YK		 827}
828
65b4b4e8
AM		 829module_init(nf_conntrack_standalone_init);
830module_exit(nf_conntrack_standalone_fini);
9fb9cbb1
YK		 831
832/* Some modules need us, but don't depend directly on any symbol.
833 They should call this. */
2e4e6a17 834void need_conntrack(void)
9fb9cbb1
YK		 835{
836}
837
838#ifdef CONFIG_NF_CONNTRACK_EVENTS
839EXPORT_SYMBOL_GPL(nf_conntrack_chain);
840EXPORT_SYMBOL_GPL(nf_conntrack_expect_chain);
841EXPORT_SYMBOL_GPL(nf_conntrack_register_notifier);
842EXPORT_SYMBOL_GPL(nf_conntrack_unregister_notifier);
843EXPORT_SYMBOL_GPL(__nf_ct_event_cache_init);
844EXPORT_PER_CPU_SYMBOL_GPL(nf_conntrack_ecache);
845EXPORT_SYMBOL_GPL(nf_ct_deliver_cached_events);
846#endif
b9f78f9f
PNA		 847EXPORT_SYMBOL(nf_ct_l3proto_try_module_get);
848EXPORT_SYMBOL(nf_ct_l3proto_module_put);
9fb9cbb1
YK		 849EXPORT_SYMBOL(nf_conntrack_l3proto_register);
850EXPORT_SYMBOL(nf_conntrack_l3proto_unregister);
851EXPORT_SYMBOL(nf_conntrack_protocol_register);
852EXPORT_SYMBOL(nf_conntrack_protocol_unregister);
853EXPORT_SYMBOL(nf_ct_invert_tuplepr);
9fb9cbb1 854EXPORT_SYMBOL(nf_conntrack_destroyed);
2e4e6a17 855EXPORT_SYMBOL(need_conntrack);
9fb9cbb1
YK		 856EXPORT_SYMBOL(nf_conntrack_helper_register);
857EXPORT_SYMBOL(nf_conntrack_helper_unregister);
858EXPORT_SYMBOL(nf_ct_iterate_cleanup);
859EXPORT_SYMBOL(__nf_ct_refresh_acct);
860EXPORT_SYMBOL(nf_ct_protos);
c1d10adb
PNA		 861EXPORT_SYMBOL(__nf_ct_proto_find);
862EXPORT_SYMBOL(nf_ct_proto_find_get);
863EXPORT_SYMBOL(nf_ct_proto_put);
864EXPORT_SYMBOL(nf_ct_l3proto_find_get);
865EXPORT_SYMBOL(nf_ct_l3proto_put);
9fb9cbb1 866EXPORT_SYMBOL(nf_ct_l3protos);
39a27a35 867EXPORT_SYMBOL_GPL(nf_conntrack_checksum);
9fb9cbb1
YK		 868EXPORT_SYMBOL(nf_conntrack_expect_alloc);
869EXPORT_SYMBOL(nf_conntrack_expect_put);
870EXPORT_SYMBOL(nf_conntrack_expect_related);
871EXPORT_SYMBOL(nf_conntrack_unexpect_related);
872EXPORT_SYMBOL(nf_conntrack_tuple_taken);
873EXPORT_SYMBOL(nf_conntrack_htable_size);
874EXPORT_SYMBOL(nf_conntrack_lock);
875EXPORT_SYMBOL(nf_conntrack_hash);
876EXPORT_SYMBOL(nf_conntrack_untracked);
877EXPORT_SYMBOL_GPL(nf_conntrack_find_get);
878#ifdef CONFIG_IP_NF_NAT_NEEDED
879EXPORT_SYMBOL(nf_conntrack_tcp_update);
880#endif
881EXPORT_SYMBOL(__nf_conntrack_confirm);
882EXPORT_SYMBOL(nf_ct_get_tuple);
883EXPORT_SYMBOL(nf_ct_invert_tuple);
884EXPORT_SYMBOL(nf_conntrack_in);
885EXPORT_SYMBOL(__nf_conntrack_attach);
c1d10adb
PNA		 886EXPORT_SYMBOL(nf_conntrack_alloc);
887EXPORT_SYMBOL(nf_conntrack_free);
888EXPORT_SYMBOL(nf_conntrack_flush);
889EXPORT_SYMBOL(nf_ct_remove_expectations);
890EXPORT_SYMBOL(nf_ct_helper_find_get);
891EXPORT_SYMBOL(nf_ct_helper_put);
892EXPORT_SYMBOL(__nf_conntrack_helper_find_byname);
893EXPORT_SYMBOL(__nf_conntrack_find);
894EXPORT_SYMBOL(nf_ct_unlink_expect);
895EXPORT_SYMBOL(nf_conntrack_hash_insert);
896EXPORT_SYMBOL(__nf_conntrack_expect_find);
897EXPORT_SYMBOL(nf_conntrack_expect_find);
898EXPORT_SYMBOL(nf_conntrack_expect_list);
899#if defined(CONFIG_NF_CT_NETLINK) || \
900 defined(CONFIG_NF_CT_NETLINK_MODULE)
901EXPORT_SYMBOL(nf_ct_port_tuple_to_nfattr);
902EXPORT_SYMBOL(nf_ct_port_nfattr_to_tuple);
903#endif
Linux kernel - Deliverables
This page took 0.204268 seconds and 5 git commands to generate.