[deliverable/linux.git] / net / netfilter / nf_synproxy_core.c

/*
 * Copyright (c) 2013 Patrick McHardy <kaber@trash.net>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/module.h>
#include <linux/skbuff.h>
#include <asm/unaligned.h>
#include <net/tcp.h>
#include <net/netns/generic.h>

#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_tcpudp.h>
#include <linux/netfilter/xt_SYNPROXY.h>
#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_extend.h>
#include <net/netfilter/nf_conntrack_seqadj.h>
#include <net/netfilter/nf_conntrack_synproxy.h>

int synproxy_net_id;
EXPORT_SYMBOL_GPL(synproxy_net_id);

bool
synproxy_parse_options(const struct sk_buff *skb, unsigned int doff,
		       const struct tcphdr *th, struct synproxy_options *opts)
{
	int length = (th->doff * 4) - sizeof(*th);
	u8 buf[40], *ptr;

	ptr = skb_header_pointer(skb, doff + sizeof(*th), length, buf);
	if (ptr == NULL)
		return false;

	opts->options = 0;
	while (length > 0) {
		int opcode = *ptr++;
		int opsize;

		switch (opcode) {
		case TCPOPT_EOL:
			return true;
		case TCPOPT_NOP:
			length--;
			continue;
		default:
			opsize = *ptr++;
			if (opsize < 2)
				return true;
			if (opsize > length)
				return true;

			switch (opcode) {
			case TCPOPT_MSS:
				if (opsize == TCPOLEN_MSS) {
					opts->mss = get_unaligned_be16(ptr);
					opts->options |= XT_SYNPROXY_OPT_MSS;
				}
				break;
			case TCPOPT_WINDOW:
				if (opsize == TCPOLEN_WINDOW) {
					opts->wscale = *ptr;
					if (opts->wscale > 14)
						opts->wscale = 14;
					opts->options |= XT_SYNPROXY_OPT_WSCALE;
				}
				break;
			case TCPOPT_TIMESTAMP:
				if (opsize == TCPOLEN_TIMESTAMP) {
					opts->tsval = get_unaligned_be32(ptr);
					opts->tsecr = get_unaligned_be32(ptr + 4);
					opts->options |= XT_SYNPROXY_OPT_TIMESTAMP;
				}
				break;
			case TCPOPT_SACK_PERM:
				if (opsize == TCPOLEN_SACK_PERM)
					opts->options |= XT_SYNPROXY_OPT_SACK_PERM;
				break;
			}

			ptr += opsize - 2;
			length -= opsize;
		}
	}
	return true;
}
EXPORT_SYMBOL_GPL(synproxy_parse_options);

unsigned int synproxy_options_size(const struct synproxy_options *opts)
{
	unsigned int size = 0;

	if (opts->options & XT_SYNPROXY_OPT_MSS)
		size += TCPOLEN_MSS_ALIGNED;
	if (opts->options & XT_SYNPROXY_OPT_TIMESTAMP)
		size += TCPOLEN_TSTAMP_ALIGNED;
	else if (opts->options & XT_SYNPROXY_OPT_SACK_PERM)
		size += TCPOLEN_SACKPERM_ALIGNED;
	if (opts->options & XT_SYNPROXY_OPT_WSCALE)
		size += TCPOLEN_WSCALE_ALIGNED;

	return size;
}
EXPORT_SYMBOL_GPL(synproxy_options_size);

void
synproxy_build_options(struct tcphdr *th, const struct synproxy_options *opts)
{
	__be32 *ptr = (__be32 *)(th + 1);
	u8 options = opts->options;

	if (options & XT_SYNPROXY_OPT_MSS)
		*ptr++ = htonl((TCPOPT_MSS << 24) |
			       (TCPOLEN_MSS << 16) |
			       opts->mss);

	if (options & XT_SYNPROXY_OPT_TIMESTAMP) {
		if (options & XT_SYNPROXY_OPT_SACK_PERM)
			*ptr++ = htonl((TCPOPT_SACK_PERM << 24) |
				       (TCPOLEN_SACK_PERM << 16) |
				       (TCPOPT_TIMESTAMP << 8) |
				       TCPOLEN_TIMESTAMP);
		else
			*ptr++ = htonl((TCPOPT_NOP << 24) |
				       (TCPOPT_NOP << 16) |
				       (TCPOPT_TIMESTAMP << 8) |
				       TCPOLEN_TIMESTAMP);

		*ptr++ = htonl(opts->tsval);
		*ptr++ = htonl(opts->tsecr);
	} else if (options & XT_SYNPROXY_OPT_SACK_PERM)
		*ptr++ = htonl((TCPOPT_NOP << 24) |
			       (TCPOPT_NOP << 16) |
			       (TCPOPT_SACK_PERM << 8) |
			       TCPOLEN_SACK_PERM);

	if (options & XT_SYNPROXY_OPT_WSCALE)
		*ptr++ = htonl((TCPOPT_NOP << 24) |
			       (TCPOPT_WINDOW << 16) |
			       (TCPOLEN_WINDOW << 8) |
			       opts->wscale);
}
EXPORT_SYMBOL_GPL(synproxy_build_options);

void synproxy_init_timestamp_cookie(const struct xt_synproxy_info *info,
				    struct synproxy_options *opts)
{
	opts->tsecr = opts->tsval;
	opts->tsval = tcp_time_stamp & ~0x3f;

	if (opts->options & XT_SYNPROXY_OPT_WSCALE) {
		opts->tsval |= opts->wscale;
		opts->wscale = info->wscale;
	} else
		opts->tsval |= 0xf;

	if (opts->options & XT_SYNPROXY_OPT_SACK_PERM)
		opts->tsval |= 1 << 4;

	if (opts->options & XT_SYNPROXY_OPT_ECN)
		opts->tsval |= 1 << 5;
}
EXPORT_SYMBOL_GPL(synproxy_init_timestamp_cookie);

void synproxy_check_timestamp_cookie(struct synproxy_options *opts)
{
	opts->wscale = opts->tsecr & 0xf;
	if (opts->wscale != 0xf)
		opts->options |= XT_SYNPROXY_OPT_WSCALE;

	opts->options |= opts->tsecr & (1 << 4) ? XT_SYNPROXY_OPT_SACK_PERM : 0;

	opts->options |= opts->tsecr & (1 << 5) ? XT_SYNPROXY_OPT_ECN : 0;
}
EXPORT_SYMBOL_GPL(synproxy_check_timestamp_cookie);

unsigned int synproxy_tstamp_adjust(struct sk_buff *skb,
				    unsigned int protoff,
				    struct tcphdr *th,
				    struct nf_conn *ct,
				    enum ip_conntrack_info ctinfo,
				    const struct nf_conn_synproxy *synproxy)
{
	unsigned int optoff, optend;
	u32 *ptr, old;

	if (synproxy->tsoff == 0)
		return 1;

	optoff = protoff + sizeof(struct tcphdr);
	optend = protoff + th->doff * 4;

	if (!skb_make_writable(skb, optend))
		return 0;

	while (optoff < optend) {
		unsigned char *op = skb->data + optoff;

		switch (op[0]) {
		case TCPOPT_EOL:
			return 1;
		case TCPOPT_NOP:
			optoff++;
			continue;
		default:
			if (optoff + 1 == optend ||
			    optoff + op[1] > optend ||
			    op[1] < 2)
				return 0;
			if (op[0] == TCPOPT_TIMESTAMP &&
			    op[1] == TCPOLEN_TIMESTAMP) {
				if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY) {
					ptr = (u32 *)&op[2];
					old = *ptr;
					*ptr = htonl(ntohl(*ptr) -
						     synproxy->tsoff);
				} else {
					ptr = (u32 *)&op[6];
					old = *ptr;
					*ptr = htonl(ntohl(*ptr) +
						     synproxy->tsoff);
				}
				inet_proto_csum_replace4(&th->check, skb,
							 old, *ptr, 0);
				return 1;
			}
			optoff += op[1];
		}
	}
	return 1;
}
EXPORT_SYMBOL_GPL(synproxy_tstamp_adjust);

static struct nf_ct_ext_type nf_ct_synproxy_extend __read_mostly = {
	.len		= sizeof(struct nf_conn_synproxy),
	.align		= __alignof__(struct nf_conn_synproxy),
	.id		= NF_CT_EXT_SYNPROXY,
};

#ifdef CONFIG_PROC_FS
static void *synproxy_cpu_seq_start(struct seq_file *seq, loff_t *pos)
{
	struct synproxy_net *snet = synproxy_pernet(seq_file_net(seq));
	int cpu;

	if (*pos == 0)
		return SEQ_START_TOKEN;

	for (cpu = *pos - 1; cpu < nr_cpu_ids; cpu++) {
		if (!cpu_possible(cpu))
			continue;
		*pos = cpu + 1;
		return per_cpu_ptr(snet->stats, cpu);
	}

	return NULL;
}

static void *synproxy_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
{
	struct synproxy_net *snet = synproxy_pernet(seq_file_net(seq));
	int cpu;

	for (cpu = *pos; cpu < nr_cpu_ids; cpu++) {
		if (!cpu_possible(cpu))
			continue;
		*pos = cpu + 1;
		return per_cpu_ptr(snet->stats, cpu);
	}

	return NULL;
}

static void synproxy_cpu_seq_stop(struct seq_file *seq, void *v)
{
	return;
}

static int synproxy_cpu_seq_show(struct seq_file *seq, void *v)
{
	struct synproxy_stats *stats = v;

	if (v == SEQ_START_TOKEN) {
		seq_printf(seq, "entries\t\tsyn_received\t"
				"cookie_invalid\tcookie_valid\t"
				"cookie_retrans\tconn_reopened\n");
		return 0;
	}

	seq_printf(seq, "%08x\t%08x\t%08x\t%08x\t%08x\t%08x\n", 0,
		   stats->syn_received,
		   stats->cookie_invalid,
		   stats->cookie_valid,
		   stats->cookie_retrans,
		   stats->conn_reopened);

	return 0;
}

static const struct seq_operations synproxy_cpu_seq_ops = {
	.start		= synproxy_cpu_seq_start,
	.next		= synproxy_cpu_seq_next,
	.stop		= synproxy_cpu_seq_stop,
	.show		= synproxy_cpu_seq_show,
};

static int synproxy_cpu_seq_open(struct inode *inode, struct file *file)
{
	return seq_open_net(inode, file, &synproxy_cpu_seq_ops,
			    sizeof(struct seq_net_private));
}

static const struct file_operations synproxy_cpu_seq_fops = {
	.owner		= THIS_MODULE,
	.open		= synproxy_cpu_seq_open,
	.read		= seq_read,
	.llseek		= seq_lseek,
	.release	= seq_release_net,
};

static int __net_init synproxy_proc_init(struct net *net)
{
	if (!proc_create("synproxy", S_IRUGO, net->proc_net_stat,
			 &synproxy_cpu_seq_fops))
		return -ENOMEM;
	return 0;
}

static void __net_exit synproxy_proc_exit(struct net *net)
{
	remove_proc_entry("synproxy", net->proc_net_stat);
}
#else
static int __net_init synproxy_proc_init(struct net *net)
{
	return 0;
}

static void __net_exit synproxy_proc_exit(struct net *net)
{
	return;
}
#endif /* CONFIG_PROC_FS */

static int __net_init synproxy_net_init(struct net *net)
{
	struct synproxy_net *snet = synproxy_pernet(net);
	struct nf_conntrack_tuple t;
	struct nf_conn *ct;
	int err = -ENOMEM;

	memset(&t, 0, sizeof(t));
	ct = nf_conntrack_alloc(net, 0, &t, &t, GFP_KERNEL);
	if (IS_ERR(ct)) {
		err = PTR_ERR(ct);
		goto err1;
	}

	if (!nfct_seqadj_ext_add(ct))
		goto err2;
	if (!nfct_synproxy_ext_add(ct))
		goto err2;
	__set_bit(IPS_TEMPLATE_BIT, &ct->status);
	__set_bit(IPS_CONFIRMED_BIT, &ct->status);

	snet->tmpl = ct;

	snet->stats = alloc_percpu(struct synproxy_stats);
	if (snet->stats == NULL)
		goto err2;

	err = synproxy_proc_init(net);
	if (err < 0)
		goto err3;

	return 0;

err3:
	free_percpu(snet->stats);
err2:
	nf_conntrack_free(ct);
err1:
	return err;
}

static void __net_exit synproxy_net_exit(struct net *net)
{
	struct synproxy_net *snet = synproxy_pernet(net);

	nf_conntrack_free(snet->tmpl);
	synproxy_proc_exit(net);
	free_percpu(snet->stats);
}

static struct pernet_operations synproxy_net_ops = {
	.init		= synproxy_net_init,
	.exit		= synproxy_net_exit,
	.id		= &synproxy_net_id,
	.size		= sizeof(struct synproxy_net),
};

static int __init synproxy_core_init(void)
{
	int err;

	err = nf_ct_extend_register(&nf_ct_synproxy_extend);
	if (err < 0)
		goto err1;

	err = register_pernet_subsys(&synproxy_net_ops);
	if (err < 0)
		goto err2;

	return 0;

err2:
	nf_ct_extend_unregister(&nf_ct_synproxy_extend);
err1:
	return err;
}

static void __exit synproxy_core_exit(void)
{
	unregister_pernet_subsys(&synproxy_net_ops);
	nf_ct_extend_unregister(&nf_ct_synproxy_extend);
}

module_init(synproxy_core_init);
module_exit(synproxy_core_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
Commit	Line	Data
48b1de4c PM	1	/*
	2	* Copyright (c) 2013 Patrick McHardy <kaber@trash.net>
	3	*
	4	* This program is free software; you can redistribute it and/or modify
	5	* it under the terms of the GNU General Public License version 2 as
	6	* published by the Free Software Foundation.
	7	*/
	8
	9	#include <linux/module.h>
	10	#include <linux/skbuff.h>
	11	#include <asm/unaligned.h>
	12	#include <net/tcp.h>
	13	#include <net/netns/generic.h>
	14
	15	#include <linux/netfilter_ipv4/ip_tables.h>
	16	#include <linux/netfilter/x_tables.h>
	17	#include <linux/netfilter/xt_tcpudp.h>
	18	#include <linux/netfilter/xt_SYNPROXY.h>
	19	#include <net/netfilter/nf_conntrack.h>
	20	#include <net/netfilter/nf_conntrack_extend.h>
	21	#include <net/netfilter/nf_conntrack_seqadj.h>
	22	#include <net/netfilter/nf_conntrack_synproxy.h>
	23
	24	int synproxy_net_id;
	25	EXPORT_SYMBOL_GPL(synproxy_net_id);
	26
f4a87e7b	27	bool
48b1de4c PM	28	synproxy_parse_options(const struct sk_buff *skb, unsigned int doff,
	29	const struct tcphdr th, struct synproxy_options opts)
	30	{
	31	int length = (th->doff * 4) - sizeof(*th);
	32	u8 buf[40], *ptr;
	33
	34	ptr = skb_header_pointer(skb, doff + sizeof(*th), length, buf);
f4a87e7b PM	35	if (ptr == NULL)
f4a87e7b PM	36	return false;
48b1de4c PM	37
	38	opts->options = 0;
	39	while (length > 0) {
	40	int opcode = *ptr++;
	41	int opsize;
	42
	43	switch (opcode) {
	44	case TCPOPT_EOL:
f4a87e7b	45	return true;
48b1de4c PM	46	case TCPOPT_NOP:
	47	length--;
	48	continue;
	49	default:
	50	opsize = *ptr++;
	51	if (opsize < 2)
f4a87e7b	52	return true;
48b1de4c	53	if (opsize > length)
f4a87e7b	54	return true;
48b1de4c PM	55
	56	switch (opcode) {
	57	case TCPOPT_MSS:
	58	if (opsize == TCPOLEN_MSS) {
	59	opts->mss = get_unaligned_be16(ptr);
	60	opts->options \|= XT_SYNPROXY_OPT_MSS;
	61	}
	62	break;
	63	case TCPOPT_WINDOW:
	64	if (opsize == TCPOLEN_WINDOW) {
	65	opts->wscale = *ptr;
	66	if (opts->wscale > 14)
	67	opts->wscale = 14;
	68	opts->options \|= XT_SYNPROXY_OPT_WSCALE;
	69	}
	70	break;
	71	case TCPOPT_TIMESTAMP:
	72	if (opsize == TCPOLEN_TIMESTAMP) {
	73	opts->tsval = get_unaligned_be32(ptr);
	74	opts->tsecr = get_unaligned_be32(ptr + 4);
	75	opts->options \|= XT_SYNPROXY_OPT_TIMESTAMP;
	76	}
	77	break;
	78	case TCPOPT_SACK_PERM:
	79	if (opsize == TCPOLEN_SACK_PERM)
	80	opts->options \|= XT_SYNPROXY_OPT_SACK_PERM;
	81	break;
	82	}
	83
	84	ptr += opsize - 2;
	85	length -= opsize;
	86	}
	87	}
f4a87e7b	88	return true;
48b1de4c PM	89	}
	90	EXPORT_SYMBOL_GPL(synproxy_parse_options);
	91
	92	unsigned int synproxy_options_size(const struct synproxy_options *opts)
	93	{
	94	unsigned int size = 0;
	95
	96	if (opts->options & XT_SYNPROXY_OPT_MSS)
	97	size += TCPOLEN_MSS_ALIGNED;
	98	if (opts->options & XT_SYNPROXY_OPT_TIMESTAMP)
	99	size += TCPOLEN_TSTAMP_ALIGNED;
	100	else if (opts->options & XT_SYNPROXY_OPT_SACK_PERM)
	101	size += TCPOLEN_SACKPERM_ALIGNED;
	102	if (opts->options & XT_SYNPROXY_OPT_WSCALE)
	103	size += TCPOLEN_WSCALE_ALIGNED;
	104
	105	return size;
	106	}
	107	EXPORT_SYMBOL_GPL(synproxy_options_size);
	108
	109	void
	110	synproxy_build_options(struct tcphdr th, const struct synproxy_options opts)
	111	{
	112	__be32 ptr = (__be32 )(th + 1);
	113	u8 options = opts->options;
	114
	115	if (options & XT_SYNPROXY_OPT_MSS)
	116	*ptr++ = htonl((TCPOPT_MSS << 24) \|
	117	(TCPOLEN_MSS << 16) \|
	118	opts->mss);
	119
	120	if (options & XT_SYNPROXY_OPT_TIMESTAMP) {
	121	if (options & XT_SYNPROXY_OPT_SACK_PERM)
	122	*ptr++ = htonl((TCPOPT_SACK_PERM << 24) \|
	123	(TCPOLEN_SACK_PERM << 16) \|
	124	(TCPOPT_TIMESTAMP << 8) \|
	125	TCPOLEN_TIMESTAMP);
	126	else
	127	*ptr++ = htonl((TCPOPT_NOP << 24) \|
	128	(TCPOPT_NOP << 16) \|
	129	(TCPOPT_TIMESTAMP << 8) \|
	130	TCPOLEN_TIMESTAMP);
	131
	132	*ptr++ = htonl(opts->tsval);
	133	*ptr++ = htonl(opts->tsecr);
	134	} else if (options & XT_SYNPROXY_OPT_SACK_PERM)
	135	*ptr++ = htonl((TCPOPT_NOP << 24) \|
	136	(TCPOPT_NOP << 16) \|
	137	(TCPOPT_SACK_PERM << 8) \|
	138	TCPOLEN_SACK_PERM);
	139
	140	if (options & XT_SYNPROXY_OPT_WSCALE)
	141	*ptr++ = htonl((TCPOPT_NOP << 24) \|
	142	(TCPOPT_WINDOW << 16) \|
	143	(TCPOLEN_WINDOW << 8) \|
	144	opts->wscale);
	145	}
	146	EXPORT_SYMBOL_GPL(synproxy_build_options);
	147
	148	void synproxy_init_timestamp_cookie(const struct xt_synproxy_info *info,
	149	struct synproxy_options *opts)
	150	{
	151	opts->tsecr = opts->tsval;
	152	opts->tsval = tcp_time_stamp & ~0x3f;
153
c1898c4c MT	154	if (opts->options & XT_SYNPROXY_OPT_WSCALE) {
	155	opts->tsval \|= opts->wscale;
	156	opts->wscale = info->wscale;
	157	} else
48b1de4c PM	158	opts->tsval \|= 0xf;
	159
	160	if (opts->options & XT_SYNPROXY_OPT_SACK_PERM)
	161	opts->tsval \|= 1 << 4;
	162
	163	if (opts->options & XT_SYNPROXY_OPT_ECN)
	164	opts->tsval \|= 1 << 5;
	165	}
	166	EXPORT_SYMBOL_GPL(synproxy_init_timestamp_cookie);
	167
	168	void synproxy_check_timestamp_cookie(struct synproxy_options *opts)
	169	{
	170	opts->wscale = opts->tsecr & 0xf;
	171	if (opts->wscale != 0xf)
	172	opts->options \|= XT_SYNPROXY_OPT_WSCALE;
	173
	174	opts->options \|= opts->tsecr & (1 << 4) ? XT_SYNPROXY_OPT_SACK_PERM : 0;
	175
	176	opts->options \|= opts->tsecr & (1 << 5) ? XT_SYNPROXY_OPT_ECN : 0;
	177	}
	178	EXPORT_SYMBOL_GPL(synproxy_check_timestamp_cookie);
	179
	180	unsigned int synproxy_tstamp_adjust(struct sk_buff *skb,
	181	unsigned int protoff,
	182	struct tcphdr *th,
	183	struct nf_conn *ct,
	184	enum ip_conntrack_info ctinfo,
	185	const struct nf_conn_synproxy *synproxy)
	186	{
	187	unsigned int optoff, optend;
	188	u32 *ptr, old;
	189
	190	if (synproxy->tsoff == 0)
	191	return 1;
	192
	193	optoff = protoff + sizeof(struct tcphdr);
	194	optend = protoff + th->doff * 4;
	195
	196	if (!skb_make_writable(skb, optend))
	197	return 0;
	198
	199	while (optoff < optend) {
	200	unsigned char *op = skb->data + optoff;
	201
	202	switch (op[0]) {
	203	case TCPOPT_EOL:
	204	return 1;
	205	case TCPOPT_NOP:
	206	optoff++;
	207	continue;
	208	default:
	209	if (optoff + 1 == optend \|\|
	210	optoff + op[1] > optend \|\|
	211	op[1] < 2)
	212	return 0;
	213	if (op[0] == TCPOPT_TIMESTAMP &&
	214	op[1] == TCPOLEN_TIMESTAMP) {
	215	if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY) {
	216	ptr = (u32 *)&op[2];
	217	old = *ptr;
	218	ptr = htonl(ntohl(ptr) -
	219	synproxy->tsoff);
	220	} else {
	221	ptr = (u32 *)&op[6];
222	old = *ptr;
223	ptr = htonl(ntohl(ptr) +
224	synproxy->tsoff);
225	}
226	inet_proto_csum_replace4(&th->check, skb,
227	old, *ptr, 0);
228	return 1;
229	}
230	optoff += op[1];
231	}
232	}
233	return 1;
234	}
235	EXPORT_SYMBOL_GPL(synproxy_tstamp_adjust);
236
237	static struct nf_ct_ext_type nf_ct_synproxy_extend __read_mostly = {
238	.len = sizeof(struct nf_conn_synproxy),
239	.align = __alignof__(struct nf_conn_synproxy),
240	.id = NF_CT_EXT_SYNPROXY,
241	};
242
243	#ifdef CONFIG_PROC_FS
244	static void synproxy_cpu_seq_start(struct seq_file seq, loff_t *pos)
245	{
246	struct synproxy_net *snet = synproxy_pernet(seq_file_net(seq));
247	int cpu;
248
249	if (*pos == 0)
250	return SEQ_START_TOKEN;
251
252	for (cpu = *pos - 1; cpu < nr_cpu_ids; cpu++) {
253	if (!cpu_possible(cpu))
254	continue;
255	*pos = cpu + 1;
256	return per_cpu_ptr(snet->stats, cpu);
257	}
258
259	return NULL;
260	}
261
262	static void synproxy_cpu_seq_next(struct seq_file seq, void v, loff_t pos)
263	{
264	struct synproxy_net *snet = synproxy_pernet(seq_file_net(seq));
265	int cpu;
266
267	for (cpu = *pos; cpu < nr_cpu_ids; cpu++) {
268	if (!cpu_possible(cpu))
269	continue;
270	*pos = cpu + 1;
271	return per_cpu_ptr(snet->stats, cpu);
272	}
273
274	return NULL;
275	}
276
277	static void synproxy_cpu_seq_stop(struct seq_file seq, void v)
278	{
279	return;
280	}
281
282	static int synproxy_cpu_seq_show(struct seq_file seq, void v)
283	{
284	struct synproxy_stats *stats = v;
285
286	if (v == SEQ_START_TOKEN) {
287	seq_printf(seq, "entries\t\tsyn_received\t"
288	"cookie_invalid\tcookie_valid\t"
289	"cookie_retrans\tconn_reopened\n");
290	return 0;
291	}
292
293	seq_printf(seq, "%08x\t%08x\t%08x\t%08x\t%08x\t%08x\n", 0,
294	stats->syn_received,
295	stats->cookie_invalid,
296	stats->cookie_valid,
297	stats->cookie_retrans,
298	stats->conn_reopened);
299
300	return 0;
301	}
302
303	static const struct seq_operations synproxy_cpu_seq_ops = {
304	.start = synproxy_cpu_seq_start,
305	.next = synproxy_cpu_seq_next,
306	.stop = synproxy_cpu_seq_stop,
307	.show = synproxy_cpu_seq_show,
308	};
309
310	static int synproxy_cpu_seq_open(struct inode inode, struct file file)
311	{
312	return seq_open_net(inode, file, &synproxy_cpu_seq_ops,
313	sizeof(struct seq_net_private));
314	}
315
316	static const struct file_operations synproxy_cpu_seq_fops = {
317	.owner = THIS_MODULE,
318	.open = synproxy_cpu_seq_open,
319	.read = seq_read,
320	.llseek = seq_lseek,
321	.release = seq_release_net,
322	};
323
324	static int __net_init synproxy_proc_init(struct net *net)
325	{
326	if (!proc_create("synproxy", S_IRUGO, net->proc_net_stat,
327	&synproxy_cpu_seq_fops))
328	return -ENOMEM;
329	return 0;
330	}
331
332	static void __net_exit synproxy_proc_exit(struct net *net)
333	{
334	remove_proc_entry("synproxy", net->proc_net_stat);
335	}
336	#else
337	static int __net_init synproxy_proc_init(struct net *net)
338	{
339	return 0;
340	}
341
342	static void __net_exit synproxy_proc_exit(struct net *net)
343	{
344	return;
345	}
346	#endif /* CONFIG_PROC_FS */
347
348	static int __net_init synproxy_net_init(struct net *net)
349	{
350	struct synproxy_net *snet = synproxy_pernet(net);
351	struct nf_conntrack_tuple t;
352	struct nf_conn *ct;
353	int err = -ENOMEM;
354
355	memset(&t, 0, sizeof(t));
356	ct = nf_conntrack_alloc(net, 0, &t, &t, GFP_KERNEL);
357	if (IS_ERR(ct)) {
358	err = PTR_ERR(ct);
359	goto err1;
360	}
361
48b1de4c PM	362	if (!nfct_seqadj_ext_add(ct))
	363	goto err2;
	364	if (!nfct_synproxy_ext_add(ct))
	365	goto err2;
f4de4c89 PM	366	__set_bit(IPS_TEMPLATE_BIT, &ct->status);
f4de4c89 PM	367	__set_bit(IPS_CONFIRMED_BIT, &ct->status);
48b1de4c PM	368
	369	snet->tmpl = ct;
	370
	371	snet->stats = alloc_percpu(struct synproxy_stats);
	372	if (snet->stats == NULL)
	373	goto err2;
	374
	375	err = synproxy_proc_init(net);
	376	if (err < 0)
	377	goto err3;
	378
	379	return 0;
	380
	381	err3:
	382	free_percpu(snet->stats);
	383	err2:
	384	nf_conntrack_free(ct);
	385	err1:
	386	return err;
	387	}
	388
	389	static void __net_exit synproxy_net_exit(struct net *net)
	390	{
	391	struct synproxy_net *snet = synproxy_pernet(net);
	392
	393	nf_conntrack_free(snet->tmpl);
	394	synproxy_proc_exit(net);
	395	free_percpu(snet->stats);
	396	}
	397
	398	static struct pernet_operations synproxy_net_ops = {
	399	.init = synproxy_net_init,
	400	.exit = synproxy_net_exit,
	401	.id = &synproxy_net_id,
	402	.size = sizeof(struct synproxy_net),
	403	};
	404
	405	static int __init synproxy_core_init(void)
	406	{
	407	int err;
	408
	409	err = nf_ct_extend_register(&nf_ct_synproxy_extend);
	410	if (err < 0)
	411	goto err1;
	412
	413	err = register_pernet_subsys(&synproxy_net_ops);
	414	if (err < 0)
	415	goto err2;
	416
	417	return 0;
	418
	419	err2:
	420	nf_ct_extend_unregister(&nf_ct_synproxy_extend);
	421	err1:
	422	return err;
	423	}
	424
	425	static void __exit synproxy_core_exit(void)
	426	{
	427	unregister_pernet_subsys(&synproxy_net_ops);
	428	nf_ct_extend_unregister(&nf_ct_synproxy_extend);
	429	}
	430
	431	module_init(synproxy_core_init);
432	module_exit(synproxy_core_exit);
433
434	MODULE_LICENSE("GPL");
435	MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");