net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c

   1 /* ip_conntrack proc compat - based on ip_conntrack_standalone.c
   2  *
   3  * (C) 1999-2001 Paul `Rusty' Russell
   4  * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
   5  * (C) 2006-2010 Patrick McHardy <kaber@trash.net>
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2 as
   9  * published by the Free Software Foundation.
  10  */
  11 #include <linux/types.h>
  12 #include <linux/proc_fs.h>
  13 #include <linux/seq_file.h>
  14 #include <linux/percpu.h>
  15 #include <linux/security.h>
  16 #include <net/net_namespace.h>
  17
  18 #include <linux/netfilter.h>
  19 #include <net/netfilter/nf_conntrack_core.h>
  20 #include <net/netfilter/nf_conntrack_l3proto.h>
  21 #include <net/netfilter/nf_conntrack_l4proto.h>
  22 #include <net/netfilter/nf_conntrack_expect.h>
  23 #include <net/netfilter/nf_conntrack_acct.h>
  24 #include <linux/rculist_nulls.h>
  25 #include <linux/export.h>
  26
  27 struct ct_iter_state {
  28         struct seq_net_private p;
  29         struct hlist_nulls_head *hash;
  30         unsigned int htable_size;
  31         unsigned int bucket;
  32 };
  33
  34 static struct hlist_nulls_node *ct_get_first(struct seq_file *seq)
  35 {
  36         struct ct_iter_state *st = seq->private;
  37         struct hlist_nulls_node *n;
  38
  39         for (st->bucket = 0;
  40              st->bucket < st->htable_size;
  41              st->bucket++) {
  42                 n = rcu_dereference(
  43                         hlist_nulls_first_rcu(&st->hash[st->bucket]));
  44                 if (!is_a_nulls(n))
  45                         return n;
  46         }
  47         return NULL;
  48 }
  49
  50 static struct hlist_nulls_node *ct_get_next(struct seq_file *seq,
  51                                       struct hlist_nulls_node *head)
  52 {
  53         struct ct_iter_state *st = seq->private;
  54
  55         head = rcu_dereference(hlist_nulls_next_rcu(head));
  56         while (is_a_nulls(head)) {
  57                 if (likely(get_nulls_value(head) == st->bucket)) {
  58                         if (++st->bucket >= st->htable_size)
  59                                 return NULL;
  60                 }
  61                 head = rcu_dereference(
  62                         hlist_nulls_first_rcu(&st->hash[st->bucket]));
  63         }
  64         return head;
  65 }
  66
  67 static struct hlist_nulls_node *ct_get_idx(struct seq_file *seq, loff_t pos)
  68 {
  69         struct hlist_nulls_node *head = ct_get_first(seq);
  70
  71         if (head)
  72                 while (pos && (head = ct_get_next(seq, head)))
  73                         pos--;
  74         return pos ? NULL : head;
  75 }
  76
  77 static void *ct_seq_start(struct seq_file *seq, loff_t *pos)
  78         __acquires(RCU)
  79 {
  80         struct ct_iter_state *st = seq->private;
  81
  82         rcu_read_lock();
  83
  84         nf_conntrack_get_ht(&st->hash, &st->htable_size);
  85         return ct_get_idx(seq, *pos);
  86 }
  87
  88 static void *ct_seq_next(struct seq_file *s, void *v, loff_t *pos)
  89 {
  90         (*pos)++;
  91         return ct_get_next(s, v);
  92 }
  93
  94 static void ct_seq_stop(struct seq_file *s, void *v)
  95         __releases(RCU)
  96 {
  97         rcu_read_unlock();
  98 }
  99
 100 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 101 static void ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
 102 {
 103         int ret;
 104         u32 len;
 105         char *secctx;
 106
 107         ret = security_secid_to_secctx(ct->secmark, &secctx, &len);
 108         if (ret)
 109                 return;
 110
 111         seq_printf(s, "secctx=%s ", secctx);
 112
 113         security_release_secctx(secctx, len);
 114 }
 115 #else
 116 static inline void ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
 117 {
 118 }
 119 #endif
 120
 121 static bool ct_seq_should_skip(const struct nf_conn *ct,
 122                                const struct net *net,
 123                                const struct nf_conntrack_tuple_hash *hash)
 124 {
 125         /* we only want to print DIR_ORIGINAL */
 126         if (NF_CT_DIRECTION(hash))
 127                 return true;
 128
 129         if (nf_ct_l3num(ct) != AF_INET)
 130                 return true;
 131
 132         if (!net_eq(nf_ct_net(ct), net))
 133                 return true;
 134
 135         return false;
 136 }
 137
 138 static int ct_seq_show(struct seq_file *s, void *v)
 139 {
 140         struct nf_conntrack_tuple_hash *hash = v;
 141         struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(hash);
 142         const struct nf_conntrack_l3proto *l3proto;
 143         const struct nf_conntrack_l4proto *l4proto;
 144         int ret = 0;
 145
 146         NF_CT_ASSERT(ct);
 147         if (ct_seq_should_skip(ct, seq_file_net(s), hash))
 148                 return 0;
 149
 150         if (unlikely(!atomic_inc_not_zero(&ct->ct_general.use)))
 151                 return 0;
 152
 153         /* check if we raced w. object reuse */
 154         if (!nf_ct_is_confirmed(ct) ||
 155             ct_seq_should_skip(ct, seq_file_net(s), hash))
 156                 goto release;
 157
 158         l3proto = __nf_ct_l3proto_find(nf_ct_l3num(ct));
 159         NF_CT_ASSERT(l3proto);
 160         l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
 161         NF_CT_ASSERT(l4proto);
 162
 163         ret = -ENOSPC;
 164         seq_printf(s, "%-8s %u %ld ",
 165                    l4proto->name, nf_ct_protonum(ct),
 166                    timer_pending(&ct->timeout)
 167                    ? (long)(ct->timeout.expires - jiffies)/HZ : 0);
 168
 169         if (l4proto->print_conntrack)
 170                 l4proto->print_conntrack(s, ct);
 171
 172         if (seq_has_overflowed(s))
 173                 goto release;
 174
 175         print_tuple(s, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
 176                     l3proto, l4proto);
 177
 178         if (seq_has_overflowed(s))
 179                 goto release;
 180
 181         if (seq_print_acct(s, ct, IP_CT_DIR_ORIGINAL))
 182                 goto release;
 183
 184         if (!(test_bit(IPS_SEEN_REPLY_BIT, &ct->status)))
 185                 seq_printf(s, "[UNREPLIED] ");
 186
 187         print_tuple(s, &ct->tuplehash[IP_CT_DIR_REPLY].tuple,
 188                     l3proto, l4proto);
 189
 190         if (seq_has_overflowed(s))
 191                 goto release;
 192
 193         if (seq_print_acct(s, ct, IP_CT_DIR_REPLY))
 194                 goto release;
 195
 196         if (test_bit(IPS_ASSURED_BIT, &ct->status))
 197                 seq_printf(s, "[ASSURED] ");
 198
 199 #ifdef CONFIG_NF_CONNTRACK_MARK
 200         seq_printf(s, "mark=%u ", ct->mark);
 201 #endif
 202
 203         ct_show_secctx(s, ct);
 204
 205         seq_printf(s, "use=%u\n", atomic_read(&ct->ct_general.use));
 206
 207         if (seq_has_overflowed(s))
 208                 goto release;
 209
 210         ret = 0;
 211 release:
 212         nf_ct_put(ct);
 213         return ret;
 214 }
 215
 216 static const struct seq_operations ct_seq_ops = {
 217         .start = ct_seq_start,
 218         .next  = ct_seq_next,
 219         .stop  = ct_seq_stop,
 220         .show  = ct_seq_show
 221 };
 222
 223 static int ct_open(struct inode *inode, struct file *file)
 224 {
 225         return seq_open_net(inode, file, &ct_seq_ops,
 226                             sizeof(struct ct_iter_state));
 227 }
 228
 229 static const struct file_operations ct_file_ops = {
 230         .owner   = THIS_MODULE,
 231         .open    = ct_open,
 232         .read    = seq_read,
 233         .llseek  = seq_lseek,
 234         .release = seq_release_net,
 235 };
 236
 237 /* expects */
 238 struct ct_expect_iter_state {
 239         struct seq_net_private p;
 240         unsigned int bucket;
 241 };
 242
 243 static struct hlist_node *ct_expect_get_first(struct seq_file *seq)
 244 {
 245         struct ct_expect_iter_state *st = seq->private;
 246         struct hlist_node *n;
 247
 248         for (st->bucket = 0; st->bucket < nf_ct_expect_hsize; st->bucket++) {
 249                 n = rcu_dereference(
 250                         hlist_first_rcu(&nf_ct_expect_hash[st->bucket]));
 251                 if (n)
 252                         return n;
 253         }
 254         return NULL;
 255 }
 256
 257 static struct hlist_node *ct_expect_get_next(struct seq_file *seq,
 258                                              struct hlist_node *head)
 259 {
 260         struct ct_expect_iter_state *st = seq->private;
 261
 262         head = rcu_dereference(hlist_next_rcu(head));
 263         while (head == NULL) {
 264                 if (++st->bucket >= nf_ct_expect_hsize)
 265                         return NULL;
 266                 head = rcu_dereference(
 267                         hlist_first_rcu(&nf_ct_expect_hash[st->bucket]));
 268         }
 269         return head;
 270 }
 271
 272 static struct hlist_node *ct_expect_get_idx(struct seq_file *seq, loff_t pos)
 273 {
 274         struct hlist_node *head = ct_expect_get_first(seq);
 275
 276         if (head)
 277                 while (pos && (head = ct_expect_get_next(seq, head)))
 278                         pos--;
 279         return pos ? NULL : head;
 280 }
 281
 282 static void *exp_seq_start(struct seq_file *seq, loff_t *pos)
 283         __acquires(RCU)
 284 {
 285         rcu_read_lock();
 286         return ct_expect_get_idx(seq, *pos);
 287 }
 288
 289 static void *exp_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 290 {
 291         (*pos)++;
 292         return ct_expect_get_next(seq, v);
 293 }
 294
 295 static void exp_seq_stop(struct seq_file *seq, void *v)
 296         __releases(RCU)
 297 {
 298         rcu_read_unlock();
 299 }
 300
 301 static int exp_seq_show(struct seq_file *s, void *v)
 302 {
 303         struct nf_conntrack_expect *exp;
 304         const struct hlist_node *n = v;
 305
 306         exp = hlist_entry(n, struct nf_conntrack_expect, hnode);
 307
 308         if (!net_eq(nf_ct_net(exp->master), seq_file_net(s)))
 309                 return 0;
 310
 311         if (exp->tuple.src.l3num != AF_INET)
 312                 return 0;
 313
 314         if (exp->timeout.function)
 315                 seq_printf(s, "%ld ", timer_pending(&exp->timeout)
 316                            ? (long)(exp->timeout.expires - jiffies)/HZ : 0);
 317         else
 318                 seq_printf(s, "- ");
 319
 320         seq_printf(s, "proto=%u ", exp->tuple.dst.protonum);
 321
 322         print_tuple(s, &exp->tuple,
 323                     __nf_ct_l3proto_find(exp->tuple.src.l3num),
 324                     __nf_ct_l4proto_find(exp->tuple.src.l3num,
 325                                          exp->tuple.dst.protonum));
 326         seq_putc(s, '\n');
 327
 328         return 0;
 329 }
 330
 331 static const struct seq_operations exp_seq_ops = {
 332         .start = exp_seq_start,
 333         .next = exp_seq_next,
 334         .stop = exp_seq_stop,
 335         .show = exp_seq_show
 336 };
 337
 338 static int exp_open(struct inode *inode, struct file *file)
 339 {
 340         return seq_open_net(inode, file, &exp_seq_ops,
 341                             sizeof(struct ct_expect_iter_state));
 342 }
 343
 344 static const struct file_operations ip_exp_file_ops = {
 345         .owner   = THIS_MODULE,
 346         .open    = exp_open,
 347         .read    = seq_read,
 348         .llseek  = seq_lseek,
 349         .release = seq_release_net,
 350 };
 351
 352 static void *ct_cpu_seq_start(struct seq_file *seq, loff_t *pos)
 353 {
 354         struct net *net = seq_file_net(seq);
 355         int cpu;
 356
 357         if (*pos == 0)
 358                 return SEQ_START_TOKEN;
 359
 360         for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
 361                 if (!cpu_possible(cpu))
 362                         continue;
 363                 *pos = cpu+1;
 364                 return per_cpu_ptr(net->ct.stat, cpu);
 365         }
 366
 367         return NULL;
 368 }
 369
 370 static void *ct_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 371 {
 372         struct net *net = seq_file_net(seq);
 373         int cpu;
 374
 375         for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
 376                 if (!cpu_possible(cpu))
 377                         continue;
 378                 *pos = cpu+1;
 379                 return per_cpu_ptr(net->ct.stat, cpu);
 380         }
 381
 382         return NULL;
 383 }
 384
 385 static void ct_cpu_seq_stop(struct seq_file *seq, void *v)
 386 {
 387 }
 388
 389 static int ct_cpu_seq_show(struct seq_file *seq, void *v)
 390 {
 391         struct net *net = seq_file_net(seq);
 392         unsigned int nr_conntracks = atomic_read(&net->ct.count);
 393         const struct ip_conntrack_stat *st = v;
 394
 395         if (v == SEQ_START_TOKEN) {
 396                 seq_printf(seq, "entries  searched found new invalid ignore delete delete_list insert insert_failed drop early_drop icmp_error  expect_new expect_create expect_delete search_restart\n");
 397                 return 0;
 398         }
 399
 400         seq_printf(seq, "%08x  %08x %08x %08x %08x %08x %08x %08x "
 401                         "%08x %08x %08x %08x %08x  %08x %08x %08x %08x\n",
 402                    nr_conntracks,
 403                    st->searched,
 404                    st->found,
 405                    st->new,
 406                    st->invalid,
 407                    st->ignore,
 408                    st->delete,
 409                    st->delete_list,
 410                    st->insert,
 411                    st->insert_failed,
 412                    st->drop,
 413                    st->early_drop,
 414                    st->error,
 415
 416                    st->expect_new,
 417                    st->expect_create,
 418                    st->expect_delete,
 419                    st->search_restart
 420                 );
 421         return 0;
 422 }
 423
 424 static const struct seq_operations ct_cpu_seq_ops = {
 425         .start  = ct_cpu_seq_start,
 426         .next   = ct_cpu_seq_next,
 427         .stop   = ct_cpu_seq_stop,
 428         .show   = ct_cpu_seq_show,
 429 };
 430
 431 static int ct_cpu_seq_open(struct inode *inode, struct file *file)
 432 {
 433         return seq_open_net(inode, file, &ct_cpu_seq_ops,
 434                             sizeof(struct seq_net_private));
 435 }
 436
 437 static const struct file_operations ct_cpu_seq_fops = {
 438         .owner   = THIS_MODULE,
 439         .open    = ct_cpu_seq_open,
 440         .read    = seq_read,
 441         .llseek  = seq_lseek,
 442         .release = seq_release_net,
 443 };
 444
 445 static int __net_init ip_conntrack_net_init(struct net *net)
 446 {
 447         struct proc_dir_entry *proc, *proc_exp, *proc_stat;
 448
 449         proc = proc_create("ip_conntrack", 0440, net->proc_net, &ct_file_ops);
 450         if (!proc)
 451                 goto err1;
 452
 453         proc_exp = proc_create("ip_conntrack_expect", 0440, net->proc_net,
 454                                &ip_exp_file_ops);
 455         if (!proc_exp)
 456                 goto err2;
 457
 458         proc_stat = proc_create("ip_conntrack", S_IRUGO,
 459                                 net->proc_net_stat, &ct_cpu_seq_fops);
 460         if (!proc_stat)
 461                 goto err3;
 462         return 0;
 463
 464 err3:
 465         remove_proc_entry("ip_conntrack_expect", net->proc_net);
 466 err2:
 467         remove_proc_entry("ip_conntrack", net->proc_net);
 468 err1:
 469         return -ENOMEM;
 470 }
 471
 472 static void __net_exit ip_conntrack_net_exit(struct net *net)
 473 {
 474         remove_proc_entry("ip_conntrack", net->proc_net_stat);
 475         remove_proc_entry("ip_conntrack_expect", net->proc_net);
 476         remove_proc_entry("ip_conntrack", net->proc_net);
 477 }
 478
 479 static struct pernet_operations ip_conntrack_net_ops = {
 480         .init = ip_conntrack_net_init,
 481         .exit = ip_conntrack_net_exit,
 482 };
 483
 484 int __init nf_conntrack_ipv4_compat_init(void)
 485 {
 486         return register_pernet_subsys(&ip_conntrack_net_ops);
 487 }
 488
 489 void __exit nf_conntrack_ipv4_compat_fini(void)
 490 {
 491         unregister_pernet_subsys(&ip_conntrack_net_ops);
 492 }