Commit | Line | Data |
---|---|---|
f6ebe77f HW |
1 | #include <linux/kernel.h> |
2 | #include <linux/init.h> | |
3 | #include <linux/module.h> | |
4 | #include <linux/proc_fs.h> | |
5 | #include <linux/skbuff.h> | |
6 | #include <linux/netfilter.h> | |
bbd86b9f | 7 | #include <linux/seq_file.h> |
f6ebe77f | 8 | #include <net/protocol.h> |
f01ffbd6 | 9 | #include <net/netfilter/nf_log.h> |
f6ebe77f HW |
10 | |
11 | #include "nf_internals.h" | |
12 | ||
a5d29264 | 13 | /* Internal logging interface, which relies on the real |
f6ebe77f HW |
14 | LOG target modules */ |
15 | ||
16 | #define NF_LOG_PREFIXLEN 128 | |
17625274 | 17 | #define NFLOGGER_NAME_LEN 64 |
f6ebe77f | 18 | |
5962815a | 19 | static struct nf_logger __rcu *loggers[NFPROTO_NUMPROTO][NF_LOG_TYPE_MAX] __read_mostly; |
9b73534d | 20 | static DEFINE_MUTEX(nf_log_mutex); |
f6ebe77f | 21 | |
ca735b3a | 22 | static struct nf_logger *__find_logger(int pf, const char *str_logger) |
f6ebe77f | 23 | { |
5962815a PNA |
24 | struct nf_logger *log; |
25 | int i; | |
26 | ||
27 | for (i = 0; i < NF_LOG_TYPE_MAX; i++) { | |
28 | if (loggers[pf][i] == NULL) | |
29 | continue; | |
f6ebe77f | 30 | |
5962815a PNA |
31 | log = rcu_dereference_protected(loggers[pf][i], |
32 | lockdep_is_held(&nf_log_mutex)); | |
33 | if (!strnicmp(str_logger, log->name, strlen(log->name))) | |
34 | return log; | |
ca735b3a | 35 | } |
d72367b6 | 36 | |
ca735b3a | 37 | return NULL; |
601e68e1 | 38 | } |
f6ebe77f | 39 | |
30e0c6a6 G |
40 | void nf_log_set(struct net *net, u_int8_t pf, const struct nf_logger *logger) |
41 | { | |
42 | const struct nf_logger *log; | |
43 | ||
30e0c6a6 G |
44 | if (pf == NFPROTO_UNSPEC) |
45 | return; | |
46 | ||
47 | mutex_lock(&nf_log_mutex); | |
48 | log = rcu_dereference_protected(net->nf.nf_loggers[pf], | |
49 | lockdep_is_held(&nf_log_mutex)); | |
50 | if (log == NULL) | |
51 | rcu_assign_pointer(net->nf.nf_loggers[pf], logger); | |
52 | ||
53 | mutex_unlock(&nf_log_mutex); | |
54 | } | |
55 | EXPORT_SYMBOL(nf_log_set); | |
56 | ||
57 | void nf_log_unset(struct net *net, const struct nf_logger *logger) | |
58 | { | |
59 | int i; | |
60 | const struct nf_logger *log; | |
61 | ||
30e0c6a6 G |
62 | mutex_lock(&nf_log_mutex); |
63 | for (i = 0; i < NFPROTO_NUMPROTO; i++) { | |
64 | log = rcu_dereference_protected(net->nf.nf_loggers[i], | |
65 | lockdep_is_held(&nf_log_mutex)); | |
66 | if (log == logger) | |
67 | RCU_INIT_POINTER(net->nf.nf_loggers[i], NULL); | |
68 | } | |
69 | mutex_unlock(&nf_log_mutex); | |
70 | synchronize_rcu(); | |
71 | } | |
72 | EXPORT_SYMBOL(nf_log_unset); | |
73 | ||
d93cf068 | 74 | /* return EEXIST if the same logger is registered, 0 on success. */ |
ca735b3a | 75 | int nf_log_register(u_int8_t pf, struct nf_logger *logger) |
f6ebe77f | 76 | { |
b6f0a365 | 77 | int i; |
ca735b3a | 78 | |
30e0c6a6 | 79 | if (pf >= ARRAY_SIZE(init_net.nf.nf_loggers)) |
ca735b3a EL |
80 | return -EINVAL; |
81 | ||
9b73534d | 82 | mutex_lock(&nf_log_mutex); |
ca735b3a EL |
83 | |
84 | if (pf == NFPROTO_UNSPEC) { | |
ca735b3a | 85 | for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++) |
5962815a | 86 | rcu_assign_pointer(loggers[i][logger->type], logger); |
ca735b3a EL |
87 | } else { |
88 | /* register at end of list to honor first register win */ | |
5962815a | 89 | rcu_assign_pointer(loggers[pf][logger->type], logger); |
ca735b3a EL |
90 | } |
91 | ||
9b73534d | 92 | mutex_unlock(&nf_log_mutex); |
f6ebe77f | 93 | |
ca735b3a | 94 | return 0; |
f6ebe77f | 95 | } |
ca735b3a | 96 | EXPORT_SYMBOL(nf_log_register); |
f6ebe77f | 97 | |
ca735b3a | 98 | void nf_log_unregister(struct nf_logger *logger) |
f6ebe77f HW |
99 | { |
100 | int i; | |
101 | ||
9b73534d | 102 | mutex_lock(&nf_log_mutex); |
30e0c6a6 | 103 | for (i = 0; i < NFPROTO_NUMPROTO; i++) |
5962815a | 104 | RCU_INIT_POINTER(loggers[i][logger->type], NULL); |
9b73534d | 105 | mutex_unlock(&nf_log_mutex); |
f6ebe77f | 106 | } |
e92ad99c | 107 | EXPORT_SYMBOL(nf_log_unregister); |
f6ebe77f | 108 | |
30e0c6a6 G |
109 | int nf_log_bind_pf(struct net *net, u_int8_t pf, |
110 | const struct nf_logger *logger) | |
ca735b3a | 111 | { |
30e0c6a6 | 112 | if (pf >= ARRAY_SIZE(net->nf.nf_loggers)) |
9ef0298a | 113 | return -EINVAL; |
ca735b3a EL |
114 | mutex_lock(&nf_log_mutex); |
115 | if (__find_logger(pf, logger->name) == NULL) { | |
116 | mutex_unlock(&nf_log_mutex); | |
117 | return -ENOENT; | |
118 | } | |
30e0c6a6 | 119 | rcu_assign_pointer(net->nf.nf_loggers[pf], logger); |
ca735b3a EL |
120 | mutex_unlock(&nf_log_mutex); |
121 | return 0; | |
122 | } | |
123 | EXPORT_SYMBOL(nf_log_bind_pf); | |
124 | ||
30e0c6a6 | 125 | void nf_log_unbind_pf(struct net *net, u_int8_t pf) |
ca735b3a | 126 | { |
30e0c6a6 | 127 | if (pf >= ARRAY_SIZE(net->nf.nf_loggers)) |
9ef0298a | 128 | return; |
ca735b3a | 129 | mutex_lock(&nf_log_mutex); |
30e0c6a6 | 130 | RCU_INIT_POINTER(net->nf.nf_loggers[pf], NULL); |
ca735b3a EL |
131 | mutex_unlock(&nf_log_mutex); |
132 | } | |
133 | EXPORT_SYMBOL(nf_log_unbind_pf); | |
134 | ||
30e0c6a6 G |
135 | void nf_log_packet(struct net *net, |
136 | u_int8_t pf, | |
f6ebe77f HW |
137 | unsigned int hooknum, |
138 | const struct sk_buff *skb, | |
139 | const struct net_device *in, | |
140 | const struct net_device *out, | |
7b2f9631 | 141 | const struct nf_loginfo *loginfo, |
f6ebe77f HW |
142 | const char *fmt, ...) |
143 | { | |
144 | va_list args; | |
145 | char prefix[NF_LOG_PREFIXLEN]; | |
7b2f9631 | 146 | const struct nf_logger *logger; |
601e68e1 | 147 | |
f6ebe77f | 148 | rcu_read_lock(); |
30e0c6a6 | 149 | logger = rcu_dereference(net->nf.nf_loggers[pf]); |
f6ebe77f HW |
150 | if (logger) { |
151 | va_start(args, fmt); | |
152 | vsnprintf(prefix, sizeof(prefix), fmt, args); | |
153 | va_end(args); | |
8cdb46da | 154 | logger->logfn(net, pf, hooknum, skb, in, out, loginfo, prefix); |
f6ebe77f HW |
155 | } |
156 | rcu_read_unlock(); | |
157 | } | |
158 | EXPORT_SYMBOL(nf_log_packet); | |
159 | ||
160 | #ifdef CONFIG_PROC_FS | |
161 | static void *seq_start(struct seq_file *seq, loff_t *pos) | |
162 | { | |
30e0c6a6 G |
163 | struct net *net = seq_file_net(seq); |
164 | ||
6440fe05 | 165 | mutex_lock(&nf_log_mutex); |
f6ebe77f | 166 | |
30e0c6a6 | 167 | if (*pos >= ARRAY_SIZE(net->nf.nf_loggers)) |
f6ebe77f HW |
168 | return NULL; |
169 | ||
170 | return pos; | |
171 | } | |
172 | ||
173 | static void *seq_next(struct seq_file *s, void *v, loff_t *pos) | |
174 | { | |
30e0c6a6 G |
175 | struct net *net = seq_file_net(s); |
176 | ||
f6ebe77f HW |
177 | (*pos)++; |
178 | ||
30e0c6a6 | 179 | if (*pos >= ARRAY_SIZE(net->nf.nf_loggers)) |
f6ebe77f HW |
180 | return NULL; |
181 | ||
182 | return pos; | |
183 | } | |
184 | ||
185 | static void seq_stop(struct seq_file *s, void *v) | |
186 | { | |
6440fe05 | 187 | mutex_unlock(&nf_log_mutex); |
f6ebe77f HW |
188 | } |
189 | ||
190 | static int seq_show(struct seq_file *s, void *v) | |
191 | { | |
192 | loff_t *pos = v; | |
193 | const struct nf_logger *logger; | |
5962815a | 194 | int i, ret; |
30e0c6a6 | 195 | struct net *net = seq_file_net(s); |
f6ebe77f | 196 | |
30e0c6a6 | 197 | logger = rcu_dereference_protected(net->nf.nf_loggers[*pos], |
0e60ebe0 | 198 | lockdep_is_held(&nf_log_mutex)); |
f6ebe77f HW |
199 | |
200 | if (!logger) | |
c7a913cd EL |
201 | ret = seq_printf(s, "%2lld NONE (", *pos); |
202 | else | |
203 | ret = seq_printf(s, "%2lld %s (", *pos, logger->name); | |
204 | ||
205 | if (ret < 0) | |
206 | return ret; | |
207 | ||
5962815a PNA |
208 | for (i = 0; i < NF_LOG_TYPE_MAX; i++) { |
209 | if (loggers[*pos][i] == NULL) | |
210 | continue; | |
211 | ||
212 | logger = rcu_dereference_protected(loggers[*pos][i], | |
213 | lockdep_is_held(&nf_log_mutex)); | |
214 | ret = seq_printf(s, "%s", logger->name); | |
6440fe05 | 215 | if (ret < 0) |
c7a913cd | 216 | return ret; |
5962815a | 217 | if (i == 0 && loggers[*pos][i + 1] != NULL) { |
c7a913cd | 218 | ret = seq_printf(s, ","); |
6440fe05 | 219 | if (ret < 0) |
c7a913cd | 220 | return ret; |
c7a913cd EL |
221 | } |
222 | } | |
601e68e1 | 223 | |
c7a913cd | 224 | return seq_printf(s, ")\n"); |
f6ebe77f HW |
225 | } |
226 | ||
56b3d975 | 227 | static const struct seq_operations nflog_seq_ops = { |
f6ebe77f HW |
228 | .start = seq_start, |
229 | .next = seq_next, | |
230 | .stop = seq_stop, | |
231 | .show = seq_show, | |
232 | }; | |
233 | ||
234 | static int nflog_open(struct inode *inode, struct file *file) | |
235 | { | |
30e0c6a6 G |
236 | return seq_open_net(inode, file, &nflog_seq_ops, |
237 | sizeof(struct seq_net_private)); | |
f6ebe77f HW |
238 | } |
239 | ||
da7071d7 | 240 | static const struct file_operations nflog_file_ops = { |
f6ebe77f HW |
241 | .owner = THIS_MODULE, |
242 | .open = nflog_open, | |
243 | .read = seq_read, | |
244 | .llseek = seq_lseek, | |
30e0c6a6 | 245 | .release = seq_release_net, |
f6ebe77f HW |
246 | }; |
247 | ||
17625274 | 248 | |
f6ebe77f HW |
249 | #endif /* PROC_FS */ |
250 | ||
17625274 | 251 | #ifdef CONFIG_SYSCTL |
17625274 EL |
252 | static char nf_log_sysctl_fnames[NFPROTO_NUMPROTO-NFPROTO_UNSPEC][3]; |
253 | static struct ctl_table nf_log_sysctl_table[NFPROTO_NUMPROTO+1]; | |
f6ebe77f | 254 | |
fe2c6338 | 255 | static int nf_log_proc_dostring(struct ctl_table *table, int write, |
24955619 | 256 | void __user *buffer, size_t *lenp, loff_t *ppos) |
17625274 EL |
257 | { |
258 | const struct nf_logger *logger; | |
24955619 PM |
259 | char buf[NFLOGGER_NAME_LEN]; |
260 | size_t size = *lenp; | |
17625274 EL |
261 | int r = 0; |
262 | int tindex = (unsigned long)table->extra1; | |
30e0c6a6 | 263 | struct net *net = current->nsproxy->net_ns; |
17625274 EL |
264 | |
265 | if (write) { | |
24955619 PM |
266 | if (size > sizeof(buf)) |
267 | size = sizeof(buf); | |
268 | if (copy_from_user(buf, buffer, size)) | |
269 | return -EFAULT; | |
270 | ||
271 | if (!strcmp(buf, "NONE")) { | |
30e0c6a6 | 272 | nf_log_unbind_pf(net, tindex); |
17625274 EL |
273 | return 0; |
274 | } | |
275 | mutex_lock(&nf_log_mutex); | |
24955619 | 276 | logger = __find_logger(tindex, buf); |
17625274 EL |
277 | if (logger == NULL) { |
278 | mutex_unlock(&nf_log_mutex); | |
279 | return -ENOENT; | |
280 | } | |
30e0c6a6 | 281 | rcu_assign_pointer(net->nf.nf_loggers[tindex], logger); |
17625274 EL |
282 | mutex_unlock(&nf_log_mutex); |
283 | } else { | |
266d07cb | 284 | mutex_lock(&nf_log_mutex); |
30e0c6a6 | 285 | logger = rcu_dereference_protected(net->nf.nf_loggers[tindex], |
0e60ebe0 | 286 | lockdep_is_held(&nf_log_mutex)); |
17625274 EL |
287 | if (!logger) |
288 | table->data = "NONE"; | |
289 | else | |
290 | table->data = logger->name; | |
8d65af78 | 291 | r = proc_dostring(table, write, buffer, lenp, ppos); |
266d07cb | 292 | mutex_unlock(&nf_log_mutex); |
17625274 EL |
293 | } |
294 | ||
295 | return r; | |
296 | } | |
297 | ||
30e0c6a6 | 298 | static int netfilter_log_sysctl_init(struct net *net) |
f6ebe77f | 299 | { |
ca735b3a | 300 | int i; |
30e0c6a6 G |
301 | struct ctl_table *table; |
302 | ||
303 | table = nf_log_sysctl_table; | |
304 | if (!net_eq(net, &init_net)) { | |
305 | table = kmemdup(nf_log_sysctl_table, | |
306 | sizeof(nf_log_sysctl_table), | |
307 | GFP_KERNEL); | |
308 | if (!table) | |
309 | goto err_alloc; | |
310 | } else { | |
311 | for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++) { | |
312 | snprintf(nf_log_sysctl_fnames[i], | |
313 | 3, "%d", i); | |
314 | nf_log_sysctl_table[i].procname = | |
315 | nf_log_sysctl_fnames[i]; | |
316 | nf_log_sysctl_table[i].data = NULL; | |
317 | nf_log_sysctl_table[i].maxlen = | |
318 | NFLOGGER_NAME_LEN * sizeof(char); | |
319 | nf_log_sysctl_table[i].mode = 0644; | |
320 | nf_log_sysctl_table[i].proc_handler = | |
321 | nf_log_proc_dostring; | |
322 | nf_log_sysctl_table[i].extra1 = | |
323 | (void *)(unsigned long) i; | |
324 | } | |
17625274 EL |
325 | } |
326 | ||
30e0c6a6 G |
327 | net->nf.nf_log_dir_header = register_net_sysctl(net, |
328 | "net/netfilter/nf_log", | |
329 | table); | |
330 | if (!net->nf.nf_log_dir_header) | |
331 | goto err_reg; | |
17625274 EL |
332 | |
333 | return 0; | |
30e0c6a6 G |
334 | |
335 | err_reg: | |
336 | if (!net_eq(net, &init_net)) | |
337 | kfree(table); | |
338 | err_alloc: | |
339 | return -ENOMEM; | |
340 | } | |
341 | ||
342 | static void netfilter_log_sysctl_exit(struct net *net) | |
343 | { | |
344 | struct ctl_table *table; | |
345 | ||
346 | table = net->nf.nf_log_dir_header->ctl_table_arg; | |
347 | unregister_net_sysctl_table(net->nf.nf_log_dir_header); | |
348 | if (!net_eq(net, &init_net)) | |
349 | kfree(table); | |
17625274 EL |
350 | } |
351 | #else | |
30e0c6a6 | 352 | static int netfilter_log_sysctl_init(struct net *net) |
17625274 EL |
353 | { |
354 | return 0; | |
355 | } | |
30e0c6a6 G |
356 | |
357 | static void netfilter_log_sysctl_exit(struct net *net) | |
358 | { | |
359 | } | |
17625274 EL |
360 | #endif /* CONFIG_SYSCTL */ |
361 | ||
30e0c6a6 | 362 | static int __net_init nf_log_net_init(struct net *net) |
17625274 | 363 | { |
30e0c6a6 G |
364 | int ret = -ENOMEM; |
365 | ||
f6ebe77f | 366 | #ifdef CONFIG_PROC_FS |
8eeee8b1 | 367 | if (!proc_create("nf_log", S_IRUGO, |
30e0c6a6 G |
368 | net->nf.proc_netfilter, &nflog_file_ops)) |
369 | return ret; | |
62243927 | 370 | #endif |
30e0c6a6 G |
371 | ret = netfilter_log_sysctl_init(net); |
372 | if (ret < 0) | |
373 | goto out_sysctl; | |
ca735b3a | 374 | |
30e0c6a6 G |
375 | return 0; |
376 | ||
377 | out_sysctl: | |
e778f56e | 378 | #ifdef CONFIG_PROC_FS |
6d11cfdb | 379 | remove_proc_entry("nf_log", net->nf.proc_netfilter); |
e778f56e | 380 | #endif |
30e0c6a6 G |
381 | return ret; |
382 | } | |
383 | ||
384 | static void __net_exit nf_log_net_exit(struct net *net) | |
385 | { | |
386 | netfilter_log_sysctl_exit(net); | |
e778f56e | 387 | #ifdef CONFIG_PROC_FS |
30e0c6a6 | 388 | remove_proc_entry("nf_log", net->nf.proc_netfilter); |
e778f56e | 389 | #endif |
30e0c6a6 G |
390 | } |
391 | ||
392 | static struct pernet_operations nf_log_net_ops = { | |
393 | .init = nf_log_net_init, | |
394 | .exit = nf_log_net_exit, | |
395 | }; | |
396 | ||
397 | int __init netfilter_log_init(void) | |
398 | { | |
5962815a | 399 | return register_pernet_subsys(&nf_log_net_ops); |
f6ebe77f | 400 | } |