Blame view
net/netfilter/nf_conntrack_standalone.c
13.4 KB
9fb9cbb10
|
1 2 3 4 5 6 |
/* (C) 1999-2001 Paul `Rusty' Russell * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as * published by the Free Software Foundation. |
9fb9cbb10
|
7 |
*/ |
9fb9cbb10
|
8 9 |
#include <linux/types.h> #include <linux/netfilter.h> |
5a0e3ad6a
|
10 |
#include <linux/slab.h> |
9fb9cbb10
|
11 12 13 14 15 16 |
#include <linux/module.h> #include <linux/skbuff.h> #include <linux/proc_fs.h> #include <linux/seq_file.h> #include <linux/percpu.h> #include <linux/netdevice.h> |
1ae4de0cd
|
17 |
#include <linux/security.h> |
457c4cbc5
|
18 |
#include <net/net_namespace.h> |
9fb9cbb10
|
19 20 21 |
#ifdef CONFIG_SYSCTL #include <linux/sysctl.h> #endif |
9fb9cbb10
|
22 |
#include <net/netfilter/nf_conntrack.h> |
f61801218
|
23 |
#include <net/netfilter/nf_conntrack_core.h> |
9fb9cbb10
|
24 |
#include <net/netfilter/nf_conntrack_l3proto.h> |
605dcad6c
|
25 |
#include <net/netfilter/nf_conntrack_l4proto.h> |
77ab9cff0
|
26 |
#include <net/netfilter/nf_conntrack_expect.h> |
9fb9cbb10
|
27 |
#include <net/netfilter/nf_conntrack_helper.h> |
584015727
|
28 |
#include <net/netfilter/nf_conntrack_acct.h> |
5d0aa2ccd
|
29 |
#include <net/netfilter/nf_conntrack_zones.h> |
a992ca2a0
|
30 |
#include <net/netfilter/nf_conntrack_timestamp.h> |
0e60ebe04
|
31 |
#include <linux/rculist_nulls.h> |
9fb9cbb10
|
32 |
|
9fb9cbb10
|
33 |
MODULE_LICENSE("GPL"); |
54b07dca6
|
34 |
#ifdef CONFIG_NF_CONNTRACK_PROCFS |
77ab9cff0
|
35 |
int |
9fb9cbb10
|
36 |
print_tuple(struct seq_file *s, const struct nf_conntrack_tuple *tuple, |
32948588a
|
37 38 |
const struct nf_conntrack_l3proto *l3proto, const struct nf_conntrack_l4proto *l4proto) |
9fb9cbb10
|
39 |
{ |
605dcad6c
|
40 |
return l3proto->print_tuple(s, tuple) || l4proto->print_tuple(s, tuple); |
9fb9cbb10
|
41 |
} |
e4bd8bce3
|
42 |
EXPORT_SYMBOL_GPL(print_tuple); |
9fb9cbb10
|
43 |
|
9fb9cbb10
|
44 |
struct ct_iter_state { |
b2ce2c747
|
45 |
struct seq_net_private p; |
9fb9cbb10
|
46 |
unsigned int bucket; |
a992ca2a0
|
47 |
u_int64_t time_now; |
9fb9cbb10
|
48 |
}; |
ea781f197
|
49 |
static struct hlist_nulls_node *ct_get_first(struct seq_file *seq) |
9fb9cbb10
|
50 |
{ |
b2ce2c747
|
51 |
struct net *net = seq_file_net(seq); |
9fb9cbb10
|
52 |
struct ct_iter_state *st = seq->private; |
ea781f197
|
53 |
struct hlist_nulls_node *n; |
9fb9cbb10
|
54 55 |
for (st->bucket = 0; |
d696c7bda
|
56 |
st->bucket < net->ct.htable_size; |
9fb9cbb10
|
57 |
st->bucket++) { |
0e60ebe04
|
58 |
n = rcu_dereference(hlist_nulls_first_rcu(&net->ct.hash[st->bucket])); |
ea781f197
|
59 |
if (!is_a_nulls(n)) |
76507f69c
|
60 |
return n; |
9fb9cbb10
|
61 62 63 |
} return NULL; } |
ea781f197
|
64 65 |
static struct hlist_nulls_node *ct_get_next(struct seq_file *seq, struct hlist_nulls_node *head) |
9fb9cbb10
|
66 |
{ |
b2ce2c747
|
67 |
struct net *net = seq_file_net(seq); |
9fb9cbb10
|
68 |
struct ct_iter_state *st = seq->private; |
0e60ebe04
|
69 |
head = rcu_dereference(hlist_nulls_next_rcu(head)); |
ea781f197
|
70 71 |
while (is_a_nulls(head)) { if (likely(get_nulls_value(head) == st->bucket)) { |
d696c7bda
|
72 |
if (++st->bucket >= net->ct.htable_size) |
ea781f197
|
73 74 |
return NULL; } |
0e60ebe04
|
75 76 77 |
head = rcu_dereference( hlist_nulls_first_rcu( &net->ct.hash[st->bucket])); |
9fb9cbb10
|
78 79 80 |
} return head; } |
ea781f197
|
81 |
static struct hlist_nulls_node *ct_get_idx(struct seq_file *seq, loff_t pos) |
9fb9cbb10
|
82 |
{ |
ea781f197
|
83 |
struct hlist_nulls_node *head = ct_get_first(seq); |
9fb9cbb10
|
84 85 86 87 88 89 90 91 |
if (head) while (pos && (head = ct_get_next(seq, head))) pos--; return pos ? NULL : head; } static void *ct_seq_start(struct seq_file *seq, loff_t *pos) |
76507f69c
|
92 |
__acquires(RCU) |
9fb9cbb10
|
93 |
{ |
a992ca2a0
|
94 95 96 |
struct ct_iter_state *st = seq->private; st->time_now = ktime_to_ns(ktime_get_real()); |
76507f69c
|
97 |
rcu_read_lock(); |
9fb9cbb10
|
98 99 100 101 102 103 104 105 106 107 |
return ct_get_idx(seq, *pos); } static void *ct_seq_next(struct seq_file *s, void *v, loff_t *pos) { (*pos)++; return ct_get_next(s, v); } static void ct_seq_stop(struct seq_file *s, void *v) |
76507f69c
|
108 |
__releases(RCU) |
9fb9cbb10
|
109 |
{ |
76507f69c
|
110 |
rcu_read_unlock(); |
9fb9cbb10
|
111 |
} |
1ae4de0cd
|
112 113 114 115 116 117 118 119 120 |
#ifdef CONFIG_NF_CONNTRACK_SECMARK static int ct_show_secctx(struct seq_file *s, const struct nf_conn *ct) { int ret; u32 len; char *secctx; ret = security_secid_to_secctx(ct->secmark, &secctx, &len); if (ret) |
cba85b532
|
121 |
return 0; |
1ae4de0cd
|
122 123 124 125 126 127 128 129 130 131 132 133 |
ret = seq_printf(s, "secctx=%s ", secctx); security_release_secctx(secctx, len); return ret; } #else static inline int ct_show_secctx(struct seq_file *s, const struct nf_conn *ct) { return 0; } #endif |
a992ca2a0
|
134 |
#ifdef CONFIG_NF_CONNTRACK_TIMESTAMP |
f5c88f56b
|
135 |
static int ct_show_delta_time(struct seq_file *s, const struct nf_conn *ct) |
a992ca2a0
|
136 |
{ |
f5c88f56b
|
137 |
struct ct_iter_state *st = s->private; |
a992ca2a0
|
138 |
struct nf_conn_tstamp *tstamp; |
f5c88f56b
|
139 |
s64 delta_time; |
a992ca2a0
|
140 141 142 |
tstamp = nf_conn_tstamp_find(ct); if (tstamp) { |
f5c88f56b
|
143 144 145 146 147 148 149 150 |
delta_time = st->time_now - tstamp->start; if (delta_time > 0) delta_time = div_s64(delta_time, NSEC_PER_SEC); else delta_time = 0; return seq_printf(s, "delta-time=%llu ", (unsigned long long)delta_time); |
a992ca2a0
|
151 |
} |
f5c88f56b
|
152 |
return 0; |
a992ca2a0
|
153 154 155 156 157 158 159 160 |
} #else static inline int ct_show_delta_time(struct seq_file *s, const struct nf_conn *ct) { return 0; } #endif |
9fb9cbb10
|
161 162 163 |
/* return 0 on success, 1 in case of error */ static int ct_seq_show(struct seq_file *s, void *v) { |
ea781f197
|
164 165 |
struct nf_conntrack_tuple_hash *hash = v; struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(hash); |
32948588a
|
166 167 |
const struct nf_conntrack_l3proto *l3proto; const struct nf_conntrack_l4proto *l4proto; |
ea781f197
|
168 |
int ret = 0; |
9fb9cbb10
|
169 |
|
c88130bcd
|
170 |
NF_CT_ASSERT(ct); |
ea781f197
|
171 172 |
if (unlikely(!atomic_inc_not_zero(&ct->ct_general.use))) return 0; |
9fb9cbb10
|
173 174 175 |
/* we only want to print DIR_ORIGINAL */ if (NF_CT_DIRECTION(hash)) |
ea781f197
|
176 |
goto release; |
9fb9cbb10
|
177 |
|
5e8fbe2ac
|
178 |
l3proto = __nf_ct_l3proto_find(nf_ct_l3num(ct)); |
9fb9cbb10
|
179 |
NF_CT_ASSERT(l3proto); |
5e8fbe2ac
|
180 |
l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct)); |
605dcad6c
|
181 |
NF_CT_ASSERT(l4proto); |
9fb9cbb10
|
182 |
|
ea781f197
|
183 |
ret = -ENOSPC; |
9fb9cbb10
|
184 |
if (seq_printf(s, "%-8s %u %-8s %u %ld ", |
5e8fbe2ac
|
185 186 |
l3proto->name, nf_ct_l3num(ct), l4proto->name, nf_ct_protonum(ct), |
c88130bcd
|
187 188 |
timer_pending(&ct->timeout) ? (long)(ct->timeout.expires - jiffies)/HZ : 0) != 0) |
ea781f197
|
189 |
goto release; |
9fb9cbb10
|
190 |
|
c88130bcd
|
191 |
if (l4proto->print_conntrack && l4proto->print_conntrack(s, ct)) |
ea781f197
|
192 |
goto release; |
9fb9cbb10
|
193 |
|
c88130bcd
|
194 |
if (print_tuple(s, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple, |
605dcad6c
|
195 |
l3proto, l4proto)) |
ea781f197
|
196 |
goto release; |
9fb9cbb10
|
197 |
|
584015727
|
198 |
if (seq_print_acct(s, ct, IP_CT_DIR_ORIGINAL)) |
ea781f197
|
199 |
goto release; |
9fb9cbb10
|
200 |
|
c88130bcd
|
201 |
if (!(test_bit(IPS_SEEN_REPLY_BIT, &ct->status))) |
9fb9cbb10
|
202 |
if (seq_printf(s, "[UNREPLIED] ")) |
ea781f197
|
203 |
goto release; |
9fb9cbb10
|
204 |
|
c88130bcd
|
205 |
if (print_tuple(s, &ct->tuplehash[IP_CT_DIR_REPLY].tuple, |
605dcad6c
|
206 |
l3proto, l4proto)) |
ea781f197
|
207 |
goto release; |
9fb9cbb10
|
208 |
|
584015727
|
209 |
if (seq_print_acct(s, ct, IP_CT_DIR_REPLY)) |
ea781f197
|
210 |
goto release; |
9fb9cbb10
|
211 |
|
c88130bcd
|
212 |
if (test_bit(IPS_ASSURED_BIT, &ct->status)) |
9fb9cbb10
|
213 |
if (seq_printf(s, "[ASSURED] ")) |
ea781f197
|
214 |
goto release; |
9fb9cbb10
|
215 216 |
#if defined(CONFIG_NF_CONNTRACK_MARK) |
c88130bcd
|
217 |
if (seq_printf(s, "mark=%u ", ct->mark)) |
ea781f197
|
218 |
goto release; |
9fb9cbb10
|
219 |
#endif |
1ae4de0cd
|
220 |
if (ct_show_secctx(s, ct)) |
ea781f197
|
221 |
goto release; |
7c9728c39
|
222 |
|
5d0aa2ccd
|
223 224 225 226 |
#ifdef CONFIG_NF_CONNTRACK_ZONES if (seq_printf(s, "zone=%u ", nf_ct_zone(ct))) goto release; #endif |
a992ca2a0
|
227 228 |
if (ct_show_delta_time(s, ct)) goto release; |
c88130bcd
|
229 230 |
if (seq_printf(s, "use=%u ", atomic_read(&ct->ct_general.use))) |
ea781f197
|
231 |
goto release; |
a5d292646
|
232 |
|
ea781f197
|
233 234 235 |
ret = 0; release: nf_ct_put(ct); |
d88d7de09
|
236 |
return ret; |
9fb9cbb10
|
237 |
} |
56b3d975b
|
238 |
static const struct seq_operations ct_seq_ops = { |
9fb9cbb10
|
239 240 241 242 243 244 245 246 |
.start = ct_seq_start, .next = ct_seq_next, .stop = ct_seq_stop, .show = ct_seq_show }; static int ct_open(struct inode *inode, struct file *file) { |
b2ce2c747
|
247 |
return seq_open_net(inode, file, &ct_seq_ops, |
e2da59133
|
248 |
sizeof(struct ct_iter_state)); |
9fb9cbb10
|
249 |
} |
da7071d7e
|
250 |
static const struct file_operations ct_file_ops = { |
9fb9cbb10
|
251 252 253 254 |
.owner = THIS_MODULE, .open = ct_open, .read = seq_read, .llseek = seq_lseek, |
b2ce2c747
|
255 |
.release = seq_release_net, |
9fb9cbb10
|
256 |
}; |
9fb9cbb10
|
257 258 |
static void *ct_cpu_seq_start(struct seq_file *seq, loff_t *pos) { |
8e9df8018
|
259 |
struct net *net = seq_file_net(seq); |
9fb9cbb10
|
260 261 262 263 |
int cpu; if (*pos == 0) return SEQ_START_TOKEN; |
0f23174aa
|
264 |
for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) { |
9fb9cbb10
|
265 266 267 |
if (!cpu_possible(cpu)) continue; *pos = cpu + 1; |
8e9df8018
|
268 |
return per_cpu_ptr(net->ct.stat, cpu); |
9fb9cbb10
|
269 270 271 272 273 274 275 |
} return NULL; } static void *ct_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos) { |
8e9df8018
|
276 |
struct net *net = seq_file_net(seq); |
9fb9cbb10
|
277 |
int cpu; |
0f23174aa
|
278 |
for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) { |
9fb9cbb10
|
279 280 281 |
if (!cpu_possible(cpu)) continue; *pos = cpu + 1; |
8e9df8018
|
282 |
return per_cpu_ptr(net->ct.stat, cpu); |
9fb9cbb10
|
283 284 285 286 287 288 289 290 291 292 293 |
} return NULL; } static void ct_cpu_seq_stop(struct seq_file *seq, void *v) { } static int ct_cpu_seq_show(struct seq_file *seq, void *v) { |
8e9df8018
|
294 295 |
struct net *net = seq_file_net(seq); unsigned int nr_conntracks = atomic_read(&net->ct.count); |
32948588a
|
296 |
const struct ip_conntrack_stat *st = v; |
9fb9cbb10
|
297 298 |
if (v == SEQ_START_TOKEN) { |
af740b2c8
|
299 300 |
seq_printf(seq, "entries searched found new invalid ignore delete delete_list insert insert_failed drop early_drop icmp_error expect_new expect_create expect_delete search_restart "); |
9fb9cbb10
|
301 302 303 304 |
return 0; } seq_printf(seq, "%08x %08x %08x %08x %08x %08x %08x %08x " |
af740b2c8
|
305 306 |
"%08x %08x %08x %08x %08x %08x %08x %08x %08x ", |
9fb9cbb10
|
307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 |
nr_conntracks, st->searched, st->found, st->new, st->invalid, st->ignore, st->delete, st->delete_list, st->insert, st->insert_failed, st->drop, st->early_drop, st->error, st->expect_new, st->expect_create, |
af740b2c8
|
323 324 |
st->expect_delete, st->search_restart |
9fb9cbb10
|
325 326 327 |
); return 0; } |
56b3d975b
|
328 |
static const struct seq_operations ct_cpu_seq_ops = { |
9fb9cbb10
|
329 330 331 332 333 334 335 336 |
.start = ct_cpu_seq_start, .next = ct_cpu_seq_next, .stop = ct_cpu_seq_stop, .show = ct_cpu_seq_show, }; static int ct_cpu_seq_open(struct inode *inode, struct file *file) { |
8e9df8018
|
337 338 |
return seq_open_net(inode, file, &ct_cpu_seq_ops, sizeof(struct seq_net_private)); |
9fb9cbb10
|
339 |
} |
da7071d7e
|
340 |
static const struct file_operations ct_cpu_seq_fops = { |
9fb9cbb10
|
341 342 343 344 |
.owner = THIS_MODULE, .open = ct_cpu_seq_open, .read = seq_read, .llseek = seq_lseek, |
8e9df8018
|
345 |
.release = seq_release_net, |
9fb9cbb10
|
346 |
}; |
b916f7d4b
|
347 |
|
b2ce2c747
|
348 |
static int nf_conntrack_standalone_init_proc(struct net *net) |
b916f7d4b
|
349 350 |
{ struct proc_dir_entry *pde; |
b2ce2c747
|
351 |
pde = proc_net_fops_create(net, "nf_conntrack", 0440, &ct_file_ops); |
b916f7d4b
|
352 353 |
if (!pde) goto out_nf_conntrack; |
52c0e111f
|
354 |
|
b2ce2c747
|
355 |
pde = proc_create("nf_conntrack", S_IRUGO, net->proc_net_stat, |
52c0e111f
|
356 |
&ct_cpu_seq_fops); |
b916f7d4b
|
357 358 |
if (!pde) goto out_stat_nf_conntrack; |
b916f7d4b
|
359 360 361 |
return 0; out_stat_nf_conntrack: |
b2ce2c747
|
362 |
proc_net_remove(net, "nf_conntrack"); |
b916f7d4b
|
363 364 365 |
out_nf_conntrack: return -ENOMEM; } |
b2ce2c747
|
366 |
static void nf_conntrack_standalone_fini_proc(struct net *net) |
b916f7d4b
|
367 |
{ |
b2ce2c747
|
368 369 |
remove_proc_entry("nf_conntrack", net->proc_net_stat); proc_net_remove(net, "nf_conntrack"); |
b916f7d4b
|
370 371 |
} #else |
b2ce2c747
|
372 |
static int nf_conntrack_standalone_init_proc(struct net *net) |
b916f7d4b
|
373 374 375 |
{ return 0; } |
b2ce2c747
|
376 |
static void nf_conntrack_standalone_fini_proc(struct net *net) |
b916f7d4b
|
377 378 |
{ } |
54b07dca6
|
379 |
#endif /* CONFIG_NF_CONNTRACK_PROCFS */ |
9fb9cbb10
|
380 381 382 383 |
/* Sysctl support */ #ifdef CONFIG_SYSCTL |
9fb9cbb10
|
384 385 386 |
/* Log invalid packets of a given protocol */ static int log_invalid_proto_min = 0; static int log_invalid_proto_max = 255; |
9714be7da
|
387 |
static struct ctl_table_header *nf_ct_netfilter_header; |
9fb9cbb10
|
388 389 390 |
static ctl_table nf_ct_sysctl_table[] = { { |
9fb9cbb10
|
391 392 393 394 |
.procname = "nf_conntrack_max", .data = &nf_conntrack_max, .maxlen = sizeof(int), .mode = 0644, |
6d9f239a1
|
395 |
.proc_handler = proc_dointvec, |
9fb9cbb10
|
396 397 |
}, { |
9fb9cbb10
|
398 |
.procname = "nf_conntrack_count", |
49ac8713b
|
399 |
.data = &init_net.ct.count, |
9fb9cbb10
|
400 401 |
.maxlen = sizeof(int), .mode = 0444, |
6d9f239a1
|
402 |
.proc_handler = proc_dointvec, |
9fb9cbb10
|
403 404 |
}, { |
9fb9cbb10
|
405 |
.procname = "nf_conntrack_buckets", |
d696c7bda
|
406 |
.data = &init_net.ct.htable_size, |
9fb9cbb10
|
407 408 |
.maxlen = sizeof(unsigned int), .mode = 0444, |
6d9f239a1
|
409 |
.proc_handler = proc_dointvec, |
9fb9cbb10
|
410 411 |
}, { |
39a27a35c
|
412 |
.procname = "nf_conntrack_checksum", |
c04d05529
|
413 |
.data = &init_net.ct.sysctl_checksum, |
39a27a35c
|
414 415 |
.maxlen = sizeof(unsigned int), .mode = 0644, |
6d9f239a1
|
416 |
.proc_handler = proc_dointvec, |
39a27a35c
|
417 418 |
}, { |
9fb9cbb10
|
419 |
.procname = "nf_conntrack_log_invalid", |
c2a2c7e0c
|
420 |
.data = &init_net.ct.sysctl_log_invalid, |
9fb9cbb10
|
421 422 |
.maxlen = sizeof(unsigned int), .mode = 0644, |
6d9f239a1
|
423 |
.proc_handler = proc_dointvec_minmax, |
9fb9cbb10
|
424 425 426 |
.extra1 = &log_invalid_proto_min, .extra2 = &log_invalid_proto_max, }, |
f264a7df0
|
427 |
{ |
f264a7df0
|
428 429 430 431 |
.procname = "nf_conntrack_expect_max", .data = &nf_ct_expect_max, .maxlen = sizeof(int), .mode = 0644, |
6d9f239a1
|
432 |
.proc_handler = proc_dointvec, |
f264a7df0
|
433 |
}, |
f8572d8f2
|
434 |
{ } |
9fb9cbb10
|
435 436 437 438 439 440 |
}; #define NET_NF_CONNTRACK_MAX 2089 static ctl_table nf_ct_netfilter_table[] = { { |
9fb9cbb10
|
441 442 443 444 |
.procname = "nf_conntrack_max", .data = &nf_conntrack_max, .maxlen = sizeof(int), .mode = 0644, |
6d9f239a1
|
445 |
.proc_handler = proc_dointvec, |
9fb9cbb10
|
446 |
}, |
f8572d8f2
|
447 |
{ } |
9fb9cbb10
|
448 |
}; |
9e232495d
|
449 |
static struct ctl_path nf_ct_path[] = { |
f8572d8f2
|
450 |
{ .procname = "net", }, |
3d7cc2ba6
|
451 |
{ } |
9fb9cbb10
|
452 |
}; |
3d7cc2ba6
|
453 |
|
802507071
|
454 |
static int nf_conntrack_standalone_init_sysctl(struct net *net) |
b916f7d4b
|
455 |
{ |
802507071
|
456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 |
struct ctl_table *table; if (net_eq(net, &init_net)) { nf_ct_netfilter_header = register_sysctl_paths(nf_ct_path, nf_ct_netfilter_table); if (!nf_ct_netfilter_header) goto out; } table = kmemdup(nf_ct_sysctl_table, sizeof(nf_ct_sysctl_table), GFP_KERNEL); if (!table) goto out_kmemdup; table[1].data = &net->ct.count; |
d696c7bda
|
471 |
table[2].data = &net->ct.htable_size; |
c04d05529
|
472 |
table[3].data = &net->ct.sysctl_checksum; |
c2a2c7e0c
|
473 |
table[4].data = &net->ct.sysctl_log_invalid; |
802507071
|
474 475 476 477 |
net->ct.sysctl_header = register_net_sysctl_table(net, nf_net_netfilter_sysctl_path, table); if (!net->ct.sysctl_header) |
9714be7da
|
478 |
goto out_unregister_netfilter; |
b916f7d4b
|
479 |
return 0; |
9714be7da
|
480 |
out_unregister_netfilter: |
802507071
|
481 482 483 484 |
kfree(table); out_kmemdup: if (net_eq(net, &init_net)) unregister_sysctl_table(nf_ct_netfilter_header); |
9714be7da
|
485 |
out: |
654d0fbdc
|
486 487 |
printk(KERN_ERR "nf_conntrack: can't register to sysctl. "); |
9714be7da
|
488 |
return -ENOMEM; |
b916f7d4b
|
489 |
} |
802507071
|
490 |
static void nf_conntrack_standalone_fini_sysctl(struct net *net) |
b916f7d4b
|
491 |
{ |
802507071
|
492 493 494 495 496 497 498 |
struct ctl_table *table; if (net_eq(net, &init_net)) unregister_sysctl_table(nf_ct_netfilter_header); table = net->ct.sysctl_header->ctl_table_arg; unregister_net_sysctl_table(net->ct.sysctl_header); kfree(table); |
b916f7d4b
|
499 500 |
} #else |
802507071
|
501 |
static int nf_conntrack_standalone_init_sysctl(struct net *net) |
b916f7d4b
|
502 503 504 |
{ return 0; } |
802507071
|
505 |
static void nf_conntrack_standalone_fini_sysctl(struct net *net) |
b916f7d4b
|
506 507 |
{ } |
9fb9cbb10
|
508 |
#endif /* CONFIG_SYSCTL */ |
dfdb8d791
|
509 510 |
static int nf_conntrack_net_init(struct net *net) { |
b2ce2c747
|
511 512 513 514 515 516 517 518 |
int ret; ret = nf_conntrack_init(net); if (ret < 0) goto out_init; ret = nf_conntrack_standalone_init_proc(net); if (ret < 0) goto out_proc; |
c04d05529
|
519 |
net->ct.sysctl_checksum = 1; |
c2a2c7e0c
|
520 |
net->ct.sysctl_log_invalid = 0; |
802507071
|
521 522 523 |
ret = nf_conntrack_standalone_init_sysctl(net); if (ret < 0) goto out_sysctl; |
b2ce2c747
|
524 |
return 0; |
802507071
|
525 526 |
out_sysctl: nf_conntrack_standalone_fini_proc(net); |
b2ce2c747
|
527 528 529 530 |
out_proc: nf_conntrack_cleanup(net); out_init: return ret; |
dfdb8d791
|
531 532 533 534 |
} static void nf_conntrack_net_exit(struct net *net) { |
802507071
|
535 |
nf_conntrack_standalone_fini_sysctl(net); |
b2ce2c747
|
536 |
nf_conntrack_standalone_fini_proc(net); |
dfdb8d791
|
537 538 539 540 541 542 543 |
nf_conntrack_cleanup(net); } static struct pernet_operations nf_conntrack_net_ops = { .init = nf_conntrack_net_init, .exit = nf_conntrack_net_exit, }; |
65b4b4e81
|
544 |
static int __init nf_conntrack_standalone_init(void) |
9fb9cbb10
|
545 |
{ |
802507071
|
546 |
return register_pernet_subsys(&nf_conntrack_net_ops); |
9fb9cbb10
|
547 |
} |
65b4b4e81
|
548 |
static void __exit nf_conntrack_standalone_fini(void) |
9fb9cbb10
|
549 |
{ |
dfdb8d791
|
550 |
unregister_pernet_subsys(&nf_conntrack_net_ops); |
9fb9cbb10
|
551 |
} |
65b4b4e81
|
552 553 |
module_init(nf_conntrack_standalone_init); module_exit(nf_conntrack_standalone_fini); |
9fb9cbb10
|
554 555 556 |
/* Some modules need us, but don't depend directly on any symbol. They should call this. */ |
2e4e6a17a
|
557 |
void need_conntrack(void) |
9fb9cbb10
|
558 559 |
{ } |
13b183391
|
560 |
EXPORT_SYMBOL_GPL(need_conntrack); |