Merge with /pub/scm/linux/kernel/git/torvalds/linux-2.6.git
[linux-2.6] / net / netfilter / nf_conntrack_standalone.c
1 /* This file contains all the functions required for the standalone
2    nf_conntrack module.
3
4    These are not required by the compatibility layer.
5 */
6
7 /* (C) 1999-2001 Paul `Rusty' Russell
8  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
9  *
10  * This program is free software; you can redistribute it and/or modify
11  * it under the terms of the GNU General Public License version 2 as
12  * published by the Free Software Foundation.
13  *
14  * 16 Dec 2003: Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp>
15  *      - generalize L3 protocol dependent part.
16  *
17  * Derived from net/ipv4/netfilter/ip_conntrack_standalone.c
18  */
19
20 #include <linux/config.h>
21 #include <linux/types.h>
22 #include <linux/netfilter.h>
23 #include <linux/module.h>
24 #include <linux/skbuff.h>
25 #include <linux/proc_fs.h>
26 #include <linux/seq_file.h>
27 #include <linux/percpu.h>
28 #include <linux/netdevice.h>
29 #ifdef CONFIG_SYSCTL
30 #include <linux/sysctl.h>
31 #endif
32
33 #define ASSERT_READ_LOCK(x)
34 #define ASSERT_WRITE_LOCK(x)
35
36 #include <net/netfilter/nf_conntrack.h>
37 #include <net/netfilter/nf_conntrack_l3proto.h>
38 #include <net/netfilter/nf_conntrack_protocol.h>
39 #include <net/netfilter/nf_conntrack_core.h>
40 #include <net/netfilter/nf_conntrack_helper.h>
41 #include <linux/netfilter_ipv4/listhelp.h>
42
43 #if 0
44 #define DEBUGP printk
45 #else
46 #define DEBUGP(format, args...)
47 #endif
48
49 MODULE_LICENSE("GPL");
50
51 extern atomic_t nf_conntrack_count;
52 DECLARE_PER_CPU(struct ip_conntrack_stat, nf_conntrack_stat);
53
54 static int kill_l3proto(struct nf_conn *i, void *data)
55 {
56         return (i->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num == 
57                         ((struct nf_conntrack_l3proto *)data)->l3proto);
58 }
59
60 static int kill_proto(struct nf_conn *i, void *data)
61 {
62         struct nf_conntrack_protocol *proto;
63         proto = (struct nf_conntrack_protocol *)data;
64         return (i->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum == 
65                         proto->proto) &&
66                (i->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num ==
67                         proto->l3proto);
68 }
69
70 #ifdef CONFIG_PROC_FS
71 static int
72 print_tuple(struct seq_file *s, const struct nf_conntrack_tuple *tuple,
73             struct nf_conntrack_l3proto *l3proto,
74             struct nf_conntrack_protocol *proto)
75 {
76         return l3proto->print_tuple(s, tuple) || proto->print_tuple(s, tuple);
77 }
78
79 #ifdef CONFIG_NF_CT_ACCT
80 static unsigned int
81 seq_print_counters(struct seq_file *s,
82                    const struct ip_conntrack_counter *counter)
83 {
84         return seq_printf(s, "packets=%llu bytes=%llu ",
85                           (unsigned long long)counter->packets,
86                           (unsigned long long)counter->bytes);
87 }
88 #else
89 #define seq_print_counters(x, y)        0
90 #endif
91
92 struct ct_iter_state {
93         unsigned int bucket;
94 };
95
96 static struct list_head *ct_get_first(struct seq_file *seq)
97 {
98         struct ct_iter_state *st = seq->private;
99
100         for (st->bucket = 0;
101              st->bucket < nf_conntrack_htable_size;
102              st->bucket++) {
103                 if (!list_empty(&nf_conntrack_hash[st->bucket]))
104                         return nf_conntrack_hash[st->bucket].next;
105         }
106         return NULL;
107 }
108
109 static struct list_head *ct_get_next(struct seq_file *seq, struct list_head *head)
110 {
111         struct ct_iter_state *st = seq->private;
112
113         head = head->next;
114         while (head == &nf_conntrack_hash[st->bucket]) {
115                 if (++st->bucket >= nf_conntrack_htable_size)
116                         return NULL;
117                 head = nf_conntrack_hash[st->bucket].next;
118         }
119         return head;
120 }
121
122 static struct list_head *ct_get_idx(struct seq_file *seq, loff_t pos)
123 {
124         struct list_head *head = ct_get_first(seq);
125
126         if (head)
127                 while (pos && (head = ct_get_next(seq, head)))
128                         pos--;
129         return pos ? NULL : head;
130 }
131
132 static void *ct_seq_start(struct seq_file *seq, loff_t *pos)
133 {
134         read_lock_bh(&nf_conntrack_lock);
135         return ct_get_idx(seq, *pos);
136 }
137
138 static void *ct_seq_next(struct seq_file *s, void *v, loff_t *pos)
139 {
140         (*pos)++;
141         return ct_get_next(s, v);
142 }
143
144 static void ct_seq_stop(struct seq_file *s, void *v)
145 {
146         read_unlock_bh(&nf_conntrack_lock);
147 }
148
149 /* return 0 on success, 1 in case of error */
150 static int ct_seq_show(struct seq_file *s, void *v)
151 {
152         const struct nf_conntrack_tuple_hash *hash = v;
153         const struct nf_conn *conntrack = nf_ct_tuplehash_to_ctrack(hash);
154         struct nf_conntrack_l3proto *l3proto;
155         struct nf_conntrack_protocol *proto;
156
157         ASSERT_READ_LOCK(&nf_conntrack_lock);
158         NF_CT_ASSERT(conntrack);
159
160         /* we only want to print DIR_ORIGINAL */
161         if (NF_CT_DIRECTION(hash))
162                 return 0;
163
164         l3proto = __nf_ct_l3proto_find(conntrack->tuplehash[IP_CT_DIR_ORIGINAL]
165                                        .tuple.src.l3num);
166
167         NF_CT_ASSERT(l3proto);
168         proto = __nf_ct_proto_find(conntrack->tuplehash[IP_CT_DIR_ORIGINAL]
169                                    .tuple.src.l3num,
170                                    conntrack->tuplehash[IP_CT_DIR_ORIGINAL]
171                                    .tuple.dst.protonum);
172         NF_CT_ASSERT(proto);
173
174         if (seq_printf(s, "%-8s %u %-8s %u %ld ",
175                        l3proto->name,
176                        conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num,
177                        proto->name,
178                        conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum,
179                        timer_pending(&conntrack->timeout)
180                        ? (long)(conntrack->timeout.expires - jiffies)/HZ : 0) != 0)
181                 return -ENOSPC;
182
183         if (l3proto->print_conntrack(s, conntrack))
184                 return -ENOSPC;
185
186         if (proto->print_conntrack(s, conntrack))
187                 return -ENOSPC;
188
189         if (print_tuple(s, &conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
190                         l3proto, proto))
191                 return -ENOSPC;
192
193         if (seq_print_counters(s, &conntrack->counters[IP_CT_DIR_ORIGINAL]))
194                 return -ENOSPC;
195
196         if (!(test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)))
197                 if (seq_printf(s, "[UNREPLIED] "))
198                         return -ENOSPC;
199
200         if (print_tuple(s, &conntrack->tuplehash[IP_CT_DIR_REPLY].tuple,
201                         l3proto, proto))
202                 return -ENOSPC;
203
204         if (seq_print_counters(s, &conntrack->counters[IP_CT_DIR_REPLY]))
205                 return -ENOSPC;
206
207         if (test_bit(IPS_ASSURED_BIT, &conntrack->status))
208                 if (seq_printf(s, "[ASSURED] "))
209                         return -ENOSPC;
210
211 #if defined(CONFIG_NF_CONNTRACK_MARK)
212         if (seq_printf(s, "mark=%u ", conntrack->mark))
213                 return -ENOSPC;
214 #endif
215
216         if (seq_printf(s, "use=%u\n", atomic_read(&conntrack->ct_general.use)))
217                 return -ENOSPC;
218         
219         return 0;
220 }
221
222 static struct seq_operations ct_seq_ops = {
223         .start = ct_seq_start,
224         .next  = ct_seq_next,
225         .stop  = ct_seq_stop,
226         .show  = ct_seq_show
227 };
228
229 static int ct_open(struct inode *inode, struct file *file)
230 {
231         struct seq_file *seq;
232         struct ct_iter_state *st;
233         int ret;
234
235         st = kmalloc(sizeof(struct ct_iter_state), GFP_KERNEL);
236         if (st == NULL)
237                 return -ENOMEM;
238         ret = seq_open(file, &ct_seq_ops);
239         if (ret)
240                 goto out_free;
241         seq          = file->private_data;
242         seq->private = st;
243         memset(st, 0, sizeof(struct ct_iter_state));
244         return ret;
245 out_free:
246         kfree(st);
247         return ret;
248 }
249
250 static struct file_operations ct_file_ops = {
251         .owner   = THIS_MODULE,
252         .open    = ct_open,
253         .read    = seq_read,
254         .llseek  = seq_lseek,
255         .release = seq_release_private,
256 };
257
258 /* expects */
259 static void *exp_seq_start(struct seq_file *s, loff_t *pos)
260 {
261         struct list_head *e = &nf_conntrack_expect_list;
262         loff_t i;
263
264         /* strange seq_file api calls stop even if we fail,
265          * thus we need to grab lock since stop unlocks */
266         read_lock_bh(&nf_conntrack_lock);
267
268         if (list_empty(e))
269                 return NULL;
270
271         for (i = 0; i <= *pos; i++) {
272                 e = e->next;
273                 if (e == &nf_conntrack_expect_list)
274                         return NULL;
275         }
276         return e;
277 }
278
279 static void *exp_seq_next(struct seq_file *s, void *v, loff_t *pos)
280 {
281         struct list_head *e = v;
282
283         ++*pos;
284         e = e->next;
285
286         if (e == &nf_conntrack_expect_list)
287                 return NULL;
288
289         return e;
290 }
291
292 static void exp_seq_stop(struct seq_file *s, void *v)
293 {
294         read_unlock_bh(&nf_conntrack_lock);
295 }
296
297 static int exp_seq_show(struct seq_file *s, void *v)
298 {
299         struct nf_conntrack_expect *expect = v;
300
301         if (expect->timeout.function)
302                 seq_printf(s, "%ld ", timer_pending(&expect->timeout)
303                            ? (long)(expect->timeout.expires - jiffies)/HZ : 0);
304         else
305                 seq_printf(s, "- ");
306         seq_printf(s, "l3proto = %u proto=%u ",
307                    expect->tuple.src.l3num,
308                    expect->tuple.dst.protonum);
309         print_tuple(s, &expect->tuple,
310                     __nf_ct_l3proto_find(expect->tuple.src.l3num),
311                     __nf_ct_proto_find(expect->tuple.src.l3num,
312                                        expect->tuple.dst.protonum));
313         return seq_putc(s, '\n');
314 }
315
316 static struct seq_operations exp_seq_ops = {
317         .start = exp_seq_start,
318         .next = exp_seq_next,
319         .stop = exp_seq_stop,
320         .show = exp_seq_show
321 };
322
323 static int exp_open(struct inode *inode, struct file *file)
324 {
325         return seq_open(file, &exp_seq_ops);
326 }
327
328 static struct file_operations exp_file_ops = {
329         .owner   = THIS_MODULE,
330         .open    = exp_open,
331         .read    = seq_read,
332         .llseek  = seq_lseek,
333         .release = seq_release
334 };
335
336 static void *ct_cpu_seq_start(struct seq_file *seq, loff_t *pos)
337 {
338         int cpu;
339
340         if (*pos == 0)
341                 return SEQ_START_TOKEN;
342
343         for (cpu = *pos-1; cpu < NR_CPUS; ++cpu) {
344                 if (!cpu_possible(cpu))
345                         continue;
346                 *pos = cpu + 1;
347                 return &per_cpu(nf_conntrack_stat, cpu);
348         }
349
350         return NULL;
351 }
352
353 static void *ct_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
354 {
355         int cpu;
356
357         for (cpu = *pos; cpu < NR_CPUS; ++cpu) {
358                 if (!cpu_possible(cpu))
359                         continue;
360                 *pos = cpu + 1;
361                 return &per_cpu(nf_conntrack_stat, cpu);
362         }
363
364         return NULL;
365 }
366
367 static void ct_cpu_seq_stop(struct seq_file *seq, void *v)
368 {
369 }
370
371 static int ct_cpu_seq_show(struct seq_file *seq, void *v)
372 {
373         unsigned int nr_conntracks = atomic_read(&nf_conntrack_count);
374         struct ip_conntrack_stat *st = v;
375
376         if (v == SEQ_START_TOKEN) {
377                 seq_printf(seq, "entries  searched found new invalid ignore delete delete_list insert insert_failed drop early_drop icmp_error  expect_new expect_create expect_delete\n");
378                 return 0;
379         }
380
381         seq_printf(seq, "%08x  %08x %08x %08x %08x %08x %08x %08x "
382                         "%08x %08x %08x %08x %08x  %08x %08x %08x \n",
383                    nr_conntracks,
384                    st->searched,
385                    st->found,
386                    st->new,
387                    st->invalid,
388                    st->ignore,
389                    st->delete,
390                    st->delete_list,
391                    st->insert,
392                    st->insert_failed,
393                    st->drop,
394                    st->early_drop,
395                    st->error,
396
397                    st->expect_new,
398                    st->expect_create,
399                    st->expect_delete
400                 );
401         return 0;
402 }
403
404 static struct seq_operations ct_cpu_seq_ops = {
405         .start  = ct_cpu_seq_start,
406         .next   = ct_cpu_seq_next,
407         .stop   = ct_cpu_seq_stop,
408         .show   = ct_cpu_seq_show,
409 };
410
411 static int ct_cpu_seq_open(struct inode *inode, struct file *file)
412 {
413         return seq_open(file, &ct_cpu_seq_ops);
414 }
415
416 static struct file_operations ct_cpu_seq_fops = {
417         .owner   = THIS_MODULE,
418         .open    = ct_cpu_seq_open,
419         .read    = seq_read,
420         .llseek  = seq_lseek,
421         .release = seq_release_private,
422 };
423 #endif /* CONFIG_PROC_FS */
424
425 /* Sysctl support */
426
427 #ifdef CONFIG_SYSCTL
428
429 /* From nf_conntrack_core.c */
430 extern int nf_conntrack_max;
431 extern unsigned int nf_conntrack_htable_size;
432
433 /* From nf_conntrack_proto_tcp.c */
434 extern unsigned int nf_ct_tcp_timeout_syn_sent;
435 extern unsigned int nf_ct_tcp_timeout_syn_recv;
436 extern unsigned int nf_ct_tcp_timeout_established;
437 extern unsigned int nf_ct_tcp_timeout_fin_wait;
438 extern unsigned int nf_ct_tcp_timeout_close_wait;
439 extern unsigned int nf_ct_tcp_timeout_last_ack;
440 extern unsigned int nf_ct_tcp_timeout_time_wait;
441 extern unsigned int nf_ct_tcp_timeout_close;
442 extern unsigned int nf_ct_tcp_timeout_max_retrans;
443 extern int nf_ct_tcp_loose;
444 extern int nf_ct_tcp_be_liberal;
445 extern int nf_ct_tcp_max_retrans;
446
447 /* From nf_conntrack_proto_udp.c */
448 extern unsigned int nf_ct_udp_timeout;
449 extern unsigned int nf_ct_udp_timeout_stream;
450
451 /* From nf_conntrack_proto_generic.c */
452 extern unsigned int nf_ct_generic_timeout;
453
454 /* Log invalid packets of a given protocol */
455 static int log_invalid_proto_min = 0;
456 static int log_invalid_proto_max = 255;
457
458 static struct ctl_table_header *nf_ct_sysctl_header;
459
460 static ctl_table nf_ct_sysctl_table[] = {
461         {
462                 .ctl_name       = NET_NF_CONNTRACK_MAX,
463                 .procname       = "nf_conntrack_max",
464                 .data           = &nf_conntrack_max,
465                 .maxlen         = sizeof(int),
466                 .mode           = 0644,
467                 .proc_handler   = &proc_dointvec,
468         },
469         {
470                 .ctl_name       = NET_NF_CONNTRACK_COUNT,
471                 .procname       = "nf_conntrack_count",
472                 .data           = &nf_conntrack_count,
473                 .maxlen         = sizeof(int),
474                 .mode           = 0444,
475                 .proc_handler   = &proc_dointvec,
476         },
477         {
478                 .ctl_name       = NET_NF_CONNTRACK_BUCKETS,
479                 .procname       = "nf_conntrack_buckets",
480                 .data           = &nf_conntrack_htable_size,
481                 .maxlen         = sizeof(unsigned int),
482                 .mode           = 0444,
483                 .proc_handler   = &proc_dointvec,
484         },
485         {
486                 .ctl_name       = NET_NF_CONNTRACK_TCP_TIMEOUT_SYN_SENT,
487                 .procname       = "nf_conntrack_tcp_timeout_syn_sent",
488                 .data           = &nf_ct_tcp_timeout_syn_sent,
489                 .maxlen         = sizeof(unsigned int),
490                 .mode           = 0644,
491                 .proc_handler   = &proc_dointvec_jiffies,
492         },
493         {
494                 .ctl_name       = NET_NF_CONNTRACK_TCP_TIMEOUT_SYN_RECV,
495                 .procname       = "nf_conntrack_tcp_timeout_syn_recv",
496                 .data           = &nf_ct_tcp_timeout_syn_recv,
497                 .maxlen         = sizeof(unsigned int),
498                 .mode           = 0644,
499                 .proc_handler   = &proc_dointvec_jiffies,
500         },
501         {
502                 .ctl_name       = NET_NF_CONNTRACK_TCP_TIMEOUT_ESTABLISHED,
503                 .procname       = "nf_conntrack_tcp_timeout_established",
504                 .data           = &nf_ct_tcp_timeout_established,
505                 .maxlen         = sizeof(unsigned int),
506                 .mode           = 0644,
507                 .proc_handler   = &proc_dointvec_jiffies,
508         },
509         {
510                 .ctl_name       = NET_NF_CONNTRACK_TCP_TIMEOUT_FIN_WAIT,
511                 .procname       = "nf_conntrack_tcp_timeout_fin_wait",
512                 .data           = &nf_ct_tcp_timeout_fin_wait,
513                 .maxlen         = sizeof(unsigned int),
514                 .mode           = 0644,
515                 .proc_handler   = &proc_dointvec_jiffies,
516         },
517         {
518                 .ctl_name       = NET_NF_CONNTRACK_TCP_TIMEOUT_CLOSE_WAIT,
519                 .procname       = "nf_conntrack_tcp_timeout_close_wait",
520                 .data           = &nf_ct_tcp_timeout_close_wait,
521                 .maxlen         = sizeof(unsigned int),
522                 .mode           = 0644,
523                 .proc_handler   = &proc_dointvec_jiffies,
524         },
525         {
526                 .ctl_name       = NET_NF_CONNTRACK_TCP_TIMEOUT_LAST_ACK,
527                 .procname       = "nf_conntrack_tcp_timeout_last_ack",
528                 .data           = &nf_ct_tcp_timeout_last_ack,
529                 .maxlen         = sizeof(unsigned int),
530                 .mode           = 0644,
531                 .proc_handler   = &proc_dointvec_jiffies,
532         },
533         {
534                 .ctl_name       = NET_NF_CONNTRACK_TCP_TIMEOUT_TIME_WAIT,
535                 .procname       = "nf_conntrack_tcp_timeout_time_wait",
536                 .data           = &nf_ct_tcp_timeout_time_wait,
537                 .maxlen         = sizeof(unsigned int),
538                 .mode           = 0644,
539                 .proc_handler   = &proc_dointvec_jiffies,
540         },
541         {
542                 .ctl_name       = NET_NF_CONNTRACK_TCP_TIMEOUT_CLOSE,
543                 .procname       = "nf_conntrack_tcp_timeout_close",
544                 .data           = &nf_ct_tcp_timeout_close,
545                 .maxlen         = sizeof(unsigned int),
546                 .mode           = 0644,
547                 .proc_handler   = &proc_dointvec_jiffies,
548         },
549         {
550                 .ctl_name       = NET_NF_CONNTRACK_UDP_TIMEOUT,
551                 .procname       = "nf_conntrack_udp_timeout",
552                 .data           = &nf_ct_udp_timeout,
553                 .maxlen         = sizeof(unsigned int),
554                 .mode           = 0644,
555                 .proc_handler   = &proc_dointvec_jiffies,
556         },
557         {
558                 .ctl_name       = NET_NF_CONNTRACK_UDP_TIMEOUT_STREAM,
559                 .procname       = "nf_conntrack_udp_timeout_stream",
560                 .data           = &nf_ct_udp_timeout_stream,
561                 .maxlen         = sizeof(unsigned int),
562                 .mode           = 0644,
563                 .proc_handler   = &proc_dointvec_jiffies,
564         },
565         {
566                 .ctl_name       = NET_NF_CONNTRACK_GENERIC_TIMEOUT,
567                 .procname       = "nf_conntrack_generic_timeout",
568                 .data           = &nf_ct_generic_timeout,
569                 .maxlen         = sizeof(unsigned int),
570                 .mode           = 0644,
571                 .proc_handler   = &proc_dointvec_jiffies,
572         },
573         {
574                 .ctl_name       = NET_NF_CONNTRACK_LOG_INVALID,
575                 .procname       = "nf_conntrack_log_invalid",
576                 .data           = &nf_ct_log_invalid,
577                 .maxlen         = sizeof(unsigned int),
578                 .mode           = 0644,
579                 .proc_handler   = &proc_dointvec_minmax,
580                 .strategy       = &sysctl_intvec,
581                 .extra1         = &log_invalid_proto_min,
582                 .extra2         = &log_invalid_proto_max,
583         },
584         {
585                 .ctl_name       = NET_NF_CONNTRACK_TCP_TIMEOUT_MAX_RETRANS,
586                 .procname       = "nf_conntrack_tcp_timeout_max_retrans",
587                 .data           = &nf_ct_tcp_timeout_max_retrans,
588                 .maxlen         = sizeof(unsigned int),
589                 .mode           = 0644,
590                 .proc_handler   = &proc_dointvec_jiffies,
591         },
592         {
593                 .ctl_name       = NET_NF_CONNTRACK_TCP_LOOSE,
594                 .procname       = "nf_conntrack_tcp_loose",
595                 .data           = &nf_ct_tcp_loose,
596                 .maxlen         = sizeof(unsigned int),
597                 .mode           = 0644,
598                 .proc_handler   = &proc_dointvec,
599         },
600         {
601                 .ctl_name       = NET_NF_CONNTRACK_TCP_BE_LIBERAL,
602                 .procname       = "nf_conntrack_tcp_be_liberal",
603                 .data           = &nf_ct_tcp_be_liberal,
604                 .maxlen         = sizeof(unsigned int),
605                 .mode           = 0644,
606                 .proc_handler   = &proc_dointvec,
607         },
608         {
609                 .ctl_name       = NET_NF_CONNTRACK_TCP_MAX_RETRANS,
610                 .procname       = "nf_conntrack_tcp_max_retrans",
611                 .data           = &nf_ct_tcp_max_retrans,
612                 .maxlen         = sizeof(unsigned int),
613                 .mode           = 0644,
614                 .proc_handler   = &proc_dointvec,
615         },
616
617         { .ctl_name = 0 }
618 };
619
620 #define NET_NF_CONNTRACK_MAX 2089
621
622 static ctl_table nf_ct_netfilter_table[] = {
623         {
624                 .ctl_name       = NET_NETFILTER,
625                 .procname       = "netfilter",
626                 .mode           = 0555,
627                 .child          = nf_ct_sysctl_table,
628         },
629         {
630                 .ctl_name       = NET_NF_CONNTRACK_MAX,
631                 .procname       = "nf_conntrack_max",
632                 .data           = &nf_conntrack_max,
633                 .maxlen         = sizeof(int),
634                 .mode           = 0644,
635                 .proc_handler   = &proc_dointvec,
636         },
637         { .ctl_name = 0 }
638 };
639
640 static ctl_table nf_ct_net_table[] = {
641         {
642                 .ctl_name       = CTL_NET,
643                 .procname       = "net",
644                 .mode           = 0555,
645                 .child          = nf_ct_netfilter_table,
646         },
647         { .ctl_name = 0 }
648 };
649 EXPORT_SYMBOL(nf_ct_log_invalid);
650 #endif /* CONFIG_SYSCTL */
651
652 static int init_or_cleanup(int init)
653 {
654 #ifdef CONFIG_PROC_FS
655         struct proc_dir_entry *proc, *proc_exp, *proc_stat;
656 #endif
657         int ret = 0;
658
659         if (!init) goto cleanup;
660
661         ret = nf_conntrack_init();
662         if (ret < 0)
663                 goto cleanup_nothing;
664
665 #ifdef CONFIG_PROC_FS
666         proc = proc_net_fops_create("nf_conntrack", 0440, &ct_file_ops);
667         if (!proc) goto cleanup_init;
668
669         proc_exp = proc_net_fops_create("nf_conntrack_expect", 0440,
670                                         &exp_file_ops);
671         if (!proc_exp) goto cleanup_proc;
672
673         proc_stat = create_proc_entry("nf_conntrack", S_IRUGO, proc_net_stat);
674         if (!proc_stat)
675                 goto cleanup_proc_exp;
676
677         proc_stat->proc_fops = &ct_cpu_seq_fops;
678         proc_stat->owner = THIS_MODULE;
679 #endif
680 #ifdef CONFIG_SYSCTL
681         nf_ct_sysctl_header = register_sysctl_table(nf_ct_net_table, 0);
682         if (nf_ct_sysctl_header == NULL) {
683                 printk("nf_conntrack: can't register to sysctl.\n");
684                 ret = -ENOMEM;
685                 goto cleanup_proc_stat;
686         }
687 #endif
688
689         return ret;
690
691  cleanup:
692 #ifdef CONFIG_SYSCTL
693         unregister_sysctl_table(nf_ct_sysctl_header);
694  cleanup_proc_stat:
695 #endif
696 #ifdef CONFIG_PROC_FS
697         remove_proc_entry("nf_conntrack", proc_net_stat);
698  cleanup_proc_exp:
699         proc_net_remove("nf_conntrack_expect");
700  cleanup_proc:
701         proc_net_remove("nf_conntrack");
702  cleanup_init:
703 #endif /* CNFIG_PROC_FS */
704         nf_conntrack_cleanup();
705  cleanup_nothing:
706         return ret;
707 }
708
709 int nf_conntrack_l3proto_register(struct nf_conntrack_l3proto *proto)
710 {
711         int ret = 0;
712
713         write_lock_bh(&nf_conntrack_lock);
714         if (nf_ct_l3protos[proto->l3proto] != &nf_conntrack_generic_l3proto) {
715                 ret = -EBUSY;
716                 goto out;
717         }
718         nf_ct_l3protos[proto->l3proto] = proto;
719 out:
720         write_unlock_bh(&nf_conntrack_lock);
721
722         return ret;
723 }
724
725 void nf_conntrack_l3proto_unregister(struct nf_conntrack_l3proto *proto)
726 {
727         write_lock_bh(&nf_conntrack_lock);
728         nf_ct_l3protos[proto->l3proto] = &nf_conntrack_generic_l3proto;
729         write_unlock_bh(&nf_conntrack_lock);
730         
731         /* Somebody could be still looking at the proto in bh. */
732         synchronize_net();
733
734         /* Remove all contrack entries for this protocol */
735         nf_ct_iterate_cleanup(kill_l3proto, proto);
736 }
737
738 /* FIXME: Allow NULL functions and sub in pointers to generic for
739    them. --RR */
740 int nf_conntrack_protocol_register(struct nf_conntrack_protocol *proto)
741 {
742         int ret = 0;
743
744 retry:
745         write_lock_bh(&nf_conntrack_lock);
746         if (nf_ct_protos[proto->l3proto]) {
747                 if (nf_ct_protos[proto->l3proto][proto->proto]
748                                 != &nf_conntrack_generic_protocol) {
749                         ret = -EBUSY;
750                         goto out_unlock;
751                 }
752         } else {
753                 /* l3proto may be loaded latter. */
754                 struct nf_conntrack_protocol **proto_array;
755                 int i;
756
757                 write_unlock_bh(&nf_conntrack_lock);
758
759                 proto_array = (struct nf_conntrack_protocol **)
760                                 kmalloc(MAX_NF_CT_PROTO *
761                                          sizeof(struct nf_conntrack_protocol *),
762                                         GFP_KERNEL);
763                 if (proto_array == NULL) {
764                         ret = -ENOMEM;
765                         goto out;
766                 }
767                 for (i = 0; i < MAX_NF_CT_PROTO; i++)
768                         proto_array[i] = &nf_conntrack_generic_protocol;
769
770                 write_lock_bh(&nf_conntrack_lock);
771                 if (nf_ct_protos[proto->l3proto]) {
772                         /* bad timing, but no problem */
773                         write_unlock_bh(&nf_conntrack_lock);
774                         kfree(proto_array);
775                 } else {
776                         nf_ct_protos[proto->l3proto] = proto_array;
777                         write_unlock_bh(&nf_conntrack_lock);
778                 }
779
780                 /*
781                  * Just once because array is never freed until unloading
782                  * nf_conntrack.ko
783                  */
784                 goto retry;
785         }
786
787         nf_ct_protos[proto->l3proto][proto->proto] = proto;
788
789 out_unlock:
790         write_unlock_bh(&nf_conntrack_lock);
791 out:
792         return ret;
793 }
794
795 void nf_conntrack_protocol_unregister(struct nf_conntrack_protocol *proto)
796 {
797         write_lock_bh(&nf_conntrack_lock);
798         nf_ct_protos[proto->l3proto][proto->proto]
799                 = &nf_conntrack_generic_protocol;
800         write_unlock_bh(&nf_conntrack_lock);
801         
802         /* Somebody could be still looking at the proto in bh. */
803         synchronize_net();
804
805         /* Remove all contrack entries for this protocol */
806         nf_ct_iterate_cleanup(kill_proto, proto);
807 }
808
809 static int __init nf_conntrack_standalone_init(void)
810 {
811         return init_or_cleanup(1);
812 }
813
814 static void __exit nf_conntrack_standalone_fini(void)
815 {
816         init_or_cleanup(0);
817 }
818
819 module_init(nf_conntrack_standalone_init);
820 module_exit(nf_conntrack_standalone_fini);
821
822 /* Some modules need us, but don't depend directly on any symbol.
823    They should call this. */
824 void need_conntrack(void)
825 {
826 }
827
828 #ifdef CONFIG_NF_CONNTRACK_EVENTS
829 EXPORT_SYMBOL_GPL(nf_conntrack_chain);
830 EXPORT_SYMBOL_GPL(nf_conntrack_expect_chain);
831 EXPORT_SYMBOL_GPL(nf_conntrack_register_notifier);
832 EXPORT_SYMBOL_GPL(nf_conntrack_unregister_notifier);
833 EXPORT_SYMBOL_GPL(__nf_ct_event_cache_init);
834 EXPORT_PER_CPU_SYMBOL_GPL(nf_conntrack_ecache);
835 EXPORT_SYMBOL_GPL(nf_ct_deliver_cached_events);
836 #endif
837 EXPORT_SYMBOL(nf_ct_l3proto_try_module_get);
838 EXPORT_SYMBOL(nf_ct_l3proto_module_put);
839 EXPORT_SYMBOL(nf_conntrack_l3proto_register);
840 EXPORT_SYMBOL(nf_conntrack_l3proto_unregister);
841 EXPORT_SYMBOL(nf_conntrack_protocol_register);
842 EXPORT_SYMBOL(nf_conntrack_protocol_unregister);
843 EXPORT_SYMBOL(nf_ct_invert_tuplepr);
844 EXPORT_SYMBOL(nf_conntrack_destroyed);
845 EXPORT_SYMBOL(need_conntrack);
846 EXPORT_SYMBOL(nf_conntrack_helper_register);
847 EXPORT_SYMBOL(nf_conntrack_helper_unregister);
848 EXPORT_SYMBOL(nf_ct_iterate_cleanup);
849 EXPORT_SYMBOL(__nf_ct_refresh_acct);
850 EXPORT_SYMBOL(nf_ct_protos);
851 EXPORT_SYMBOL(__nf_ct_proto_find);
852 EXPORT_SYMBOL(nf_ct_proto_find_get);
853 EXPORT_SYMBOL(nf_ct_proto_put);
854 EXPORT_SYMBOL(nf_ct_l3proto_find_get);
855 EXPORT_SYMBOL(nf_ct_l3proto_put);
856 EXPORT_SYMBOL(nf_ct_l3protos);
857 EXPORT_SYMBOL(nf_conntrack_expect_alloc);
858 EXPORT_SYMBOL(nf_conntrack_expect_put);
859 EXPORT_SYMBOL(nf_conntrack_expect_related);
860 EXPORT_SYMBOL(nf_conntrack_unexpect_related);
861 EXPORT_SYMBOL(nf_conntrack_tuple_taken);
862 EXPORT_SYMBOL(nf_conntrack_htable_size);
863 EXPORT_SYMBOL(nf_conntrack_lock);
864 EXPORT_SYMBOL(nf_conntrack_hash);
865 EXPORT_SYMBOL(nf_conntrack_untracked);
866 EXPORT_SYMBOL_GPL(nf_conntrack_find_get);
867 #ifdef CONFIG_IP_NF_NAT_NEEDED
868 EXPORT_SYMBOL(nf_conntrack_tcp_update);
869 #endif
870 EXPORT_SYMBOL(__nf_conntrack_confirm);
871 EXPORT_SYMBOL(nf_ct_get_tuple);
872 EXPORT_SYMBOL(nf_ct_invert_tuple);
873 EXPORT_SYMBOL(nf_conntrack_in);
874 EXPORT_SYMBOL(__nf_conntrack_attach);
875 EXPORT_SYMBOL(nf_conntrack_alloc);
876 EXPORT_SYMBOL(nf_conntrack_free);
877 EXPORT_SYMBOL(nf_conntrack_flush);
878 EXPORT_SYMBOL(nf_ct_remove_expectations);
879 EXPORT_SYMBOL(nf_ct_helper_find_get);
880 EXPORT_SYMBOL(nf_ct_helper_put);
881 EXPORT_SYMBOL(__nf_conntrack_helper_find_byname);
882 EXPORT_SYMBOL(__nf_conntrack_find);
883 EXPORT_SYMBOL(nf_ct_unlink_expect);
884 EXPORT_SYMBOL(nf_conntrack_hash_insert);
885 EXPORT_SYMBOL(__nf_conntrack_expect_find);
886 EXPORT_SYMBOL(nf_conntrack_expect_find);
887 EXPORT_SYMBOL(nf_conntrack_expect_list);
888 #if defined(CONFIG_NF_CT_NETLINK) || \
889     defined(CONFIG_NF_CT_NETLINK_MODULE)
890 EXPORT_SYMBOL(nf_ct_port_tuple_to_nfattr);
891 EXPORT_SYMBOL(nf_ct_port_nfattr_to_tuple);
892 #endif