/net/netfilter/nf_conntrack_standalone.c

http://github.com/mirrors/linux · C · 1209 lines · 1060 code · 140 blank · 9 comment · 65 complexity · ddb0a36fe6123703da397ffb52c0db84 MD5 · raw file

  1. // SPDX-License-Identifier: GPL-2.0
  2. #include <linux/types.h>
  3. #include <linux/netfilter.h>
  4. #include <linux/slab.h>
  5. #include <linux/module.h>
  6. #include <linux/skbuff.h>
  7. #include <linux/proc_fs.h>
  8. #include <linux/seq_file.h>
  9. #include <linux/percpu.h>
  10. #include <linux/netdevice.h>
  11. #include <linux/security.h>
  12. #include <net/net_namespace.h>
  13. #ifdef CONFIG_SYSCTL
  14. #include <linux/sysctl.h>
  15. #endif
  16. #include <net/netfilter/nf_conntrack.h>
  17. #include <net/netfilter/nf_conntrack_core.h>
  18. #include <net/netfilter/nf_conntrack_l4proto.h>
  19. #include <net/netfilter/nf_conntrack_expect.h>
  20. #include <net/netfilter/nf_conntrack_helper.h>
  21. #include <net/netfilter/nf_conntrack_acct.h>
  22. #include <net/netfilter/nf_conntrack_zones.h>
  23. #include <net/netfilter/nf_conntrack_timestamp.h>
  24. #include <linux/rculist_nulls.h>
  25. static bool enable_hooks __read_mostly;
  26. MODULE_PARM_DESC(enable_hooks, "Always enable conntrack hooks");
  27. module_param(enable_hooks, bool, 0000);
  28. unsigned int nf_conntrack_net_id __read_mostly;
  29. #ifdef CONFIG_NF_CONNTRACK_PROCFS
  30. void
  31. print_tuple(struct seq_file *s, const struct nf_conntrack_tuple *tuple,
  32. const struct nf_conntrack_l4proto *l4proto)
  33. {
  34. switch (tuple->src.l3num) {
  35. case NFPROTO_IPV4:
  36. seq_printf(s, "src=%pI4 dst=%pI4 ",
  37. &tuple->src.u3.ip, &tuple->dst.u3.ip);
  38. break;
  39. case NFPROTO_IPV6:
  40. seq_printf(s, "src=%pI6 dst=%pI6 ",
  41. tuple->src.u3.ip6, tuple->dst.u3.ip6);
  42. break;
  43. default:
  44. break;
  45. }
  46. switch (l4proto->l4proto) {
  47. case IPPROTO_ICMP:
  48. seq_printf(s, "type=%u code=%u id=%u ",
  49. tuple->dst.u.icmp.type,
  50. tuple->dst.u.icmp.code,
  51. ntohs(tuple->src.u.icmp.id));
  52. break;
  53. case IPPROTO_TCP:
  54. seq_printf(s, "sport=%hu dport=%hu ",
  55. ntohs(tuple->src.u.tcp.port),
  56. ntohs(tuple->dst.u.tcp.port));
  57. break;
  58. case IPPROTO_UDPLITE: /* fallthrough */
  59. case IPPROTO_UDP:
  60. seq_printf(s, "sport=%hu dport=%hu ",
  61. ntohs(tuple->src.u.udp.port),
  62. ntohs(tuple->dst.u.udp.port));
  63. break;
  64. case IPPROTO_DCCP:
  65. seq_printf(s, "sport=%hu dport=%hu ",
  66. ntohs(tuple->src.u.dccp.port),
  67. ntohs(tuple->dst.u.dccp.port));
  68. break;
  69. case IPPROTO_SCTP:
  70. seq_printf(s, "sport=%hu dport=%hu ",
  71. ntohs(tuple->src.u.sctp.port),
  72. ntohs(tuple->dst.u.sctp.port));
  73. break;
  74. case IPPROTO_ICMPV6:
  75. seq_printf(s, "type=%u code=%u id=%u ",
  76. tuple->dst.u.icmp.type,
  77. tuple->dst.u.icmp.code,
  78. ntohs(tuple->src.u.icmp.id));
  79. break;
  80. case IPPROTO_GRE:
  81. seq_printf(s, "srckey=0x%x dstkey=0x%x ",
  82. ntohs(tuple->src.u.gre.key),
  83. ntohs(tuple->dst.u.gre.key));
  84. break;
  85. default:
  86. break;
  87. }
  88. }
  89. EXPORT_SYMBOL_GPL(print_tuple);
  90. struct ct_iter_state {
  91. struct seq_net_private p;
  92. struct hlist_nulls_head *hash;
  93. unsigned int htable_size;
  94. unsigned int bucket;
  95. u_int64_t time_now;
  96. };
  97. static struct hlist_nulls_node *ct_get_first(struct seq_file *seq)
  98. {
  99. struct ct_iter_state *st = seq->private;
  100. struct hlist_nulls_node *n;
  101. for (st->bucket = 0;
  102. st->bucket < st->htable_size;
  103. st->bucket++) {
  104. n = rcu_dereference(
  105. hlist_nulls_first_rcu(&st->hash[st->bucket]));
  106. if (!is_a_nulls(n))
  107. return n;
  108. }
  109. return NULL;
  110. }
  111. static struct hlist_nulls_node *ct_get_next(struct seq_file *seq,
  112. struct hlist_nulls_node *head)
  113. {
  114. struct ct_iter_state *st = seq->private;
  115. head = rcu_dereference(hlist_nulls_next_rcu(head));
  116. while (is_a_nulls(head)) {
  117. if (likely(get_nulls_value(head) == st->bucket)) {
  118. if (++st->bucket >= st->htable_size)
  119. return NULL;
  120. }
  121. head = rcu_dereference(
  122. hlist_nulls_first_rcu(&st->hash[st->bucket]));
  123. }
  124. return head;
  125. }
  126. static struct hlist_nulls_node *ct_get_idx(struct seq_file *seq, loff_t pos)
  127. {
  128. struct hlist_nulls_node *head = ct_get_first(seq);
  129. if (head)
  130. while (pos && (head = ct_get_next(seq, head)))
  131. pos--;
  132. return pos ? NULL : head;
  133. }
  134. static void *ct_seq_start(struct seq_file *seq, loff_t *pos)
  135. __acquires(RCU)
  136. {
  137. struct ct_iter_state *st = seq->private;
  138. st->time_now = ktime_get_real_ns();
  139. rcu_read_lock();
  140. nf_conntrack_get_ht(&st->hash, &st->htable_size);
  141. return ct_get_idx(seq, *pos);
  142. }
  143. static void *ct_seq_next(struct seq_file *s, void *v, loff_t *pos)
  144. {
  145. (*pos)++;
  146. return ct_get_next(s, v);
  147. }
  148. static void ct_seq_stop(struct seq_file *s, void *v)
  149. __releases(RCU)
  150. {
  151. rcu_read_unlock();
  152. }
  153. #ifdef CONFIG_NF_CONNTRACK_SECMARK
  154. static void ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
  155. {
  156. int ret;
  157. u32 len;
  158. char *secctx;
  159. ret = security_secid_to_secctx(ct->secmark, &secctx, &len);
  160. if (ret)
  161. return;
  162. seq_printf(s, "secctx=%s ", secctx);
  163. security_release_secctx(secctx, len);
  164. }
  165. #else
  166. static inline void ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
  167. {
  168. }
  169. #endif
  170. #ifdef CONFIG_NF_CONNTRACK_ZONES
  171. static void ct_show_zone(struct seq_file *s, const struct nf_conn *ct,
  172. int dir)
  173. {
  174. const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
  175. if (zone->dir != dir)
  176. return;
  177. switch (zone->dir) {
  178. case NF_CT_DEFAULT_ZONE_DIR:
  179. seq_printf(s, "zone=%u ", zone->id);
  180. break;
  181. case NF_CT_ZONE_DIR_ORIG:
  182. seq_printf(s, "zone-orig=%u ", zone->id);
  183. break;
  184. case NF_CT_ZONE_DIR_REPL:
  185. seq_printf(s, "zone-reply=%u ", zone->id);
  186. break;
  187. default:
  188. break;
  189. }
  190. }
  191. #else
  192. static inline void ct_show_zone(struct seq_file *s, const struct nf_conn *ct,
  193. int dir)
  194. {
  195. }
  196. #endif
  197. #ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
  198. static void ct_show_delta_time(struct seq_file *s, const struct nf_conn *ct)
  199. {
  200. struct ct_iter_state *st = s->private;
  201. struct nf_conn_tstamp *tstamp;
  202. s64 delta_time;
  203. tstamp = nf_conn_tstamp_find(ct);
  204. if (tstamp) {
  205. delta_time = st->time_now - tstamp->start;
  206. if (delta_time > 0)
  207. delta_time = div_s64(delta_time, NSEC_PER_SEC);
  208. else
  209. delta_time = 0;
  210. seq_printf(s, "delta-time=%llu ",
  211. (unsigned long long)delta_time);
  212. }
  213. return;
  214. }
  215. #else
  216. static inline void
  217. ct_show_delta_time(struct seq_file *s, const struct nf_conn *ct)
  218. {
  219. }
  220. #endif
  221. static const char* l3proto_name(u16 proto)
  222. {
  223. switch (proto) {
  224. case AF_INET: return "ipv4";
  225. case AF_INET6: return "ipv6";
  226. }
  227. return "unknown";
  228. }
  229. static const char* l4proto_name(u16 proto)
  230. {
  231. switch (proto) {
  232. case IPPROTO_ICMP: return "icmp";
  233. case IPPROTO_TCP: return "tcp";
  234. case IPPROTO_UDP: return "udp";
  235. case IPPROTO_DCCP: return "dccp";
  236. case IPPROTO_GRE: return "gre";
  237. case IPPROTO_SCTP: return "sctp";
  238. case IPPROTO_UDPLITE: return "udplite";
  239. }
  240. return "unknown";
  241. }
  242. static unsigned int
  243. seq_print_acct(struct seq_file *s, const struct nf_conn *ct, int dir)
  244. {
  245. struct nf_conn_acct *acct;
  246. struct nf_conn_counter *counter;
  247. acct = nf_conn_acct_find(ct);
  248. if (!acct)
  249. return 0;
  250. counter = acct->counter;
  251. seq_printf(s, "packets=%llu bytes=%llu ",
  252. (unsigned long long)atomic64_read(&counter[dir].packets),
  253. (unsigned long long)atomic64_read(&counter[dir].bytes));
  254. return 0;
  255. }
  256. /* return 0 on success, 1 in case of error */
  257. static int ct_seq_show(struct seq_file *s, void *v)
  258. {
  259. struct nf_conntrack_tuple_hash *hash = v;
  260. struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(hash);
  261. const struct nf_conntrack_l4proto *l4proto;
  262. struct net *net = seq_file_net(s);
  263. int ret = 0;
  264. WARN_ON(!ct);
  265. if (unlikely(!atomic_inc_not_zero(&ct->ct_general.use)))
  266. return 0;
  267. if (nf_ct_should_gc(ct)) {
  268. nf_ct_kill(ct);
  269. goto release;
  270. }
  271. /* we only want to print DIR_ORIGINAL */
  272. if (NF_CT_DIRECTION(hash))
  273. goto release;
  274. if (!net_eq(nf_ct_net(ct), net))
  275. goto release;
  276. l4proto = nf_ct_l4proto_find(nf_ct_protonum(ct));
  277. ret = -ENOSPC;
  278. seq_printf(s, "%-8s %u %-8s %u ",
  279. l3proto_name(nf_ct_l3num(ct)), nf_ct_l3num(ct),
  280. l4proto_name(l4proto->l4proto), nf_ct_protonum(ct));
  281. if (!test_bit(IPS_OFFLOAD_BIT, &ct->status))
  282. seq_printf(s, "%ld ", nf_ct_expires(ct) / HZ);
  283. if (l4proto->print_conntrack)
  284. l4proto->print_conntrack(s, ct);
  285. print_tuple(s, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
  286. l4proto);
  287. ct_show_zone(s, ct, NF_CT_ZONE_DIR_ORIG);
  288. if (seq_has_overflowed(s))
  289. goto release;
  290. if (seq_print_acct(s, ct, IP_CT_DIR_ORIGINAL))
  291. goto release;
  292. if (!(test_bit(IPS_SEEN_REPLY_BIT, &ct->status)))
  293. seq_puts(s, "[UNREPLIED] ");
  294. print_tuple(s, &ct->tuplehash[IP_CT_DIR_REPLY].tuple, l4proto);
  295. ct_show_zone(s, ct, NF_CT_ZONE_DIR_REPL);
  296. if (seq_print_acct(s, ct, IP_CT_DIR_REPLY))
  297. goto release;
  298. if (test_bit(IPS_OFFLOAD_BIT, &ct->status))
  299. seq_puts(s, "[OFFLOAD] ");
  300. else if (test_bit(IPS_ASSURED_BIT, &ct->status))
  301. seq_puts(s, "[ASSURED] ");
  302. if (seq_has_overflowed(s))
  303. goto release;
  304. #if defined(CONFIG_NF_CONNTRACK_MARK)
  305. seq_printf(s, "mark=%u ", ct->mark);
  306. #endif
  307. ct_show_secctx(s, ct);
  308. ct_show_zone(s, ct, NF_CT_DEFAULT_ZONE_DIR);
  309. ct_show_delta_time(s, ct);
  310. seq_printf(s, "use=%u\n", atomic_read(&ct->ct_general.use));
  311. if (seq_has_overflowed(s))
  312. goto release;
  313. ret = 0;
  314. release:
  315. nf_ct_put(ct);
  316. return ret;
  317. }
  318. static const struct seq_operations ct_seq_ops = {
  319. .start = ct_seq_start,
  320. .next = ct_seq_next,
  321. .stop = ct_seq_stop,
  322. .show = ct_seq_show
  323. };
  324. static void *ct_cpu_seq_start(struct seq_file *seq, loff_t *pos)
  325. {
  326. struct net *net = seq_file_net(seq);
  327. int cpu;
  328. if (*pos == 0)
  329. return SEQ_START_TOKEN;
  330. for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
  331. if (!cpu_possible(cpu))
  332. continue;
  333. *pos = cpu + 1;
  334. return per_cpu_ptr(net->ct.stat, cpu);
  335. }
  336. return NULL;
  337. }
  338. static void *ct_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
  339. {
  340. struct net *net = seq_file_net(seq);
  341. int cpu;
  342. for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
  343. if (!cpu_possible(cpu))
  344. continue;
  345. *pos = cpu + 1;
  346. return per_cpu_ptr(net->ct.stat, cpu);
  347. }
  348. (*pos)++;
  349. return NULL;
  350. }
  351. static void ct_cpu_seq_stop(struct seq_file *seq, void *v)
  352. {
  353. }
  354. static int ct_cpu_seq_show(struct seq_file *seq, void *v)
  355. {
  356. struct net *net = seq_file_net(seq);
  357. unsigned int nr_conntracks = atomic_read(&net->ct.count);
  358. const struct ip_conntrack_stat *st = v;
  359. if (v == SEQ_START_TOKEN) {
  360. seq_puts(seq, "entries searched found new invalid ignore delete delete_list insert insert_failed drop early_drop icmp_error expect_new expect_create expect_delete search_restart\n");
  361. return 0;
  362. }
  363. seq_printf(seq, "%08x %08x %08x %08x %08x %08x %08x %08x "
  364. "%08x %08x %08x %08x %08x %08x %08x %08x %08x\n",
  365. nr_conntracks,
  366. 0,
  367. st->found,
  368. 0,
  369. st->invalid,
  370. st->ignore,
  371. 0,
  372. 0,
  373. st->insert,
  374. st->insert_failed,
  375. st->drop,
  376. st->early_drop,
  377. st->error,
  378. st->expect_new,
  379. st->expect_create,
  380. st->expect_delete,
  381. st->search_restart
  382. );
  383. return 0;
  384. }
  385. static const struct seq_operations ct_cpu_seq_ops = {
  386. .start = ct_cpu_seq_start,
  387. .next = ct_cpu_seq_next,
  388. .stop = ct_cpu_seq_stop,
  389. .show = ct_cpu_seq_show,
  390. };
  391. static int nf_conntrack_standalone_init_proc(struct net *net)
  392. {
  393. struct proc_dir_entry *pde;
  394. kuid_t root_uid;
  395. kgid_t root_gid;
  396. pde = proc_create_net("nf_conntrack", 0440, net->proc_net, &ct_seq_ops,
  397. sizeof(struct ct_iter_state));
  398. if (!pde)
  399. goto out_nf_conntrack;
  400. root_uid = make_kuid(net->user_ns, 0);
  401. root_gid = make_kgid(net->user_ns, 0);
  402. if (uid_valid(root_uid) && gid_valid(root_gid))
  403. proc_set_user(pde, root_uid, root_gid);
  404. pde = proc_create_net("nf_conntrack", 0444, net->proc_net_stat,
  405. &ct_cpu_seq_ops, sizeof(struct seq_net_private));
  406. if (!pde)
  407. goto out_stat_nf_conntrack;
  408. return 0;
  409. out_stat_nf_conntrack:
  410. remove_proc_entry("nf_conntrack", net->proc_net);
  411. out_nf_conntrack:
  412. return -ENOMEM;
  413. }
  414. static void nf_conntrack_standalone_fini_proc(struct net *net)
  415. {
  416. remove_proc_entry("nf_conntrack", net->proc_net_stat);
  417. remove_proc_entry("nf_conntrack", net->proc_net);
  418. }
  419. #else
  420. static int nf_conntrack_standalone_init_proc(struct net *net)
  421. {
  422. return 0;
  423. }
  424. static void nf_conntrack_standalone_fini_proc(struct net *net)
  425. {
  426. }
  427. #endif /* CONFIG_NF_CONNTRACK_PROCFS */
  428. /* Sysctl support */
  429. #ifdef CONFIG_SYSCTL
  430. /* Log invalid packets of a given protocol */
  431. static int log_invalid_proto_min __read_mostly;
  432. static int log_invalid_proto_max __read_mostly = 255;
  433. /* size the user *wants to set */
  434. static unsigned int nf_conntrack_htable_size_user __read_mostly;
  435. static int
  436. nf_conntrack_hash_sysctl(struct ctl_table *table, int write,
  437. void __user *buffer, size_t *lenp, loff_t *ppos)
  438. {
  439. int ret;
  440. ret = proc_dointvec(table, write, buffer, lenp, ppos);
  441. if (ret < 0 || !write)
  442. return ret;
  443. /* update ret, we might not be able to satisfy request */
  444. ret = nf_conntrack_hash_resize(nf_conntrack_htable_size_user);
  445. /* update it to the actual value used by conntrack */
  446. nf_conntrack_htable_size_user = nf_conntrack_htable_size;
  447. return ret;
  448. }
  449. static struct ctl_table_header *nf_ct_netfilter_header;
  450. enum nf_ct_sysctl_index {
  451. NF_SYSCTL_CT_MAX,
  452. NF_SYSCTL_CT_COUNT,
  453. NF_SYSCTL_CT_BUCKETS,
  454. NF_SYSCTL_CT_CHECKSUM,
  455. NF_SYSCTL_CT_LOG_INVALID,
  456. NF_SYSCTL_CT_EXPECT_MAX,
  457. NF_SYSCTL_CT_ACCT,
  458. NF_SYSCTL_CT_HELPER,
  459. #ifdef CONFIG_NF_CONNTRACK_EVENTS
  460. NF_SYSCTL_CT_EVENTS,
  461. #endif
  462. #ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
  463. NF_SYSCTL_CT_TIMESTAMP,
  464. #endif
  465. NF_SYSCTL_CT_PROTO_TIMEOUT_GENERIC,
  466. NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_SYN_SENT,
  467. NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_SYN_RECV,
  468. NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_ESTABLISHED,
  469. NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_FIN_WAIT,
  470. NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_CLOSE_WAIT,
  471. NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_LAST_ACK,
  472. NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_TIME_WAIT,
  473. NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_CLOSE,
  474. NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_RETRANS,
  475. NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_UNACK,
  476. NF_SYSCTL_CT_PROTO_TCP_LOOSE,
  477. NF_SYSCTL_CT_PROTO_TCP_LIBERAL,
  478. NF_SYSCTL_CT_PROTO_TCP_MAX_RETRANS,
  479. NF_SYSCTL_CT_PROTO_TIMEOUT_UDP,
  480. NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_STREAM,
  481. NF_SYSCTL_CT_PROTO_TIMEOUT_ICMP,
  482. NF_SYSCTL_CT_PROTO_TIMEOUT_ICMPV6,
  483. #ifdef CONFIG_NF_CT_PROTO_SCTP
  484. NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_CLOSED,
  485. NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_COOKIE_WAIT,
  486. NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_COOKIE_ECHOED,
  487. NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_ESTABLISHED,
  488. NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_SHUTDOWN_SENT,
  489. NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_SHUTDOWN_RECD,
  490. NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_SHUTDOWN_ACK_SENT,
  491. NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_HEARTBEAT_SENT,
  492. NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_HEARTBEAT_ACKED,
  493. #endif
  494. #ifdef CONFIG_NF_CT_PROTO_DCCP
  495. NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_REQUEST,
  496. NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_RESPOND,
  497. NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_PARTOPEN,
  498. NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_OPEN,
  499. NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_CLOSEREQ,
  500. NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_CLOSING,
  501. NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_TIMEWAIT,
  502. NF_SYSCTL_CT_PROTO_DCCP_LOOSE,
  503. #endif
  504. #ifdef CONFIG_NF_CT_PROTO_GRE
  505. NF_SYSCTL_CT_PROTO_TIMEOUT_GRE,
  506. NF_SYSCTL_CT_PROTO_TIMEOUT_GRE_STREAM,
  507. #endif
  508. __NF_SYSCTL_CT_LAST_SYSCTL,
  509. };
  510. #define NF_SYSCTL_CT_LAST_SYSCTL (__NF_SYSCTL_CT_LAST_SYSCTL + 1)
  511. static struct ctl_table nf_ct_sysctl_table[] = {
  512. [NF_SYSCTL_CT_MAX] = {
  513. .procname = "nf_conntrack_max",
  514. .data = &nf_conntrack_max,
  515. .maxlen = sizeof(int),
  516. .mode = 0644,
  517. .proc_handler = proc_dointvec,
  518. },
  519. [NF_SYSCTL_CT_COUNT] = {
  520. .procname = "nf_conntrack_count",
  521. .data = &init_net.ct.count,
  522. .maxlen = sizeof(int),
  523. .mode = 0444,
  524. .proc_handler = proc_dointvec,
  525. },
  526. [NF_SYSCTL_CT_BUCKETS] = {
  527. .procname = "nf_conntrack_buckets",
  528. .data = &nf_conntrack_htable_size_user,
  529. .maxlen = sizeof(unsigned int),
  530. .mode = 0644,
  531. .proc_handler = nf_conntrack_hash_sysctl,
  532. },
  533. [NF_SYSCTL_CT_CHECKSUM] = {
  534. .procname = "nf_conntrack_checksum",
  535. .data = &init_net.ct.sysctl_checksum,
  536. .maxlen = sizeof(int),
  537. .mode = 0644,
  538. .proc_handler = proc_dointvec_minmax,
  539. .extra1 = SYSCTL_ZERO,
  540. .extra2 = SYSCTL_ONE,
  541. },
  542. [NF_SYSCTL_CT_LOG_INVALID] = {
  543. .procname = "nf_conntrack_log_invalid",
  544. .data = &init_net.ct.sysctl_log_invalid,
  545. .maxlen = sizeof(unsigned int),
  546. .mode = 0644,
  547. .proc_handler = proc_dointvec_minmax,
  548. .extra1 = &log_invalid_proto_min,
  549. .extra2 = &log_invalid_proto_max,
  550. },
  551. [NF_SYSCTL_CT_EXPECT_MAX] = {
  552. .procname = "nf_conntrack_expect_max",
  553. .data = &nf_ct_expect_max,
  554. .maxlen = sizeof(int),
  555. .mode = 0644,
  556. .proc_handler = proc_dointvec,
  557. },
  558. [NF_SYSCTL_CT_ACCT] = {
  559. .procname = "nf_conntrack_acct",
  560. .data = &init_net.ct.sysctl_acct,
  561. .maxlen = sizeof(int),
  562. .mode = 0644,
  563. .proc_handler = proc_dointvec_minmax,
  564. .extra1 = SYSCTL_ZERO,
  565. .extra2 = SYSCTL_ONE,
  566. },
  567. [NF_SYSCTL_CT_HELPER] = {
  568. .procname = "nf_conntrack_helper",
  569. .data = &init_net.ct.sysctl_auto_assign_helper,
  570. .maxlen = sizeof(int),
  571. .mode = 0644,
  572. .proc_handler = proc_dointvec_minmax,
  573. .extra1 = SYSCTL_ZERO,
  574. .extra2 = SYSCTL_ONE,
  575. },
  576. #ifdef CONFIG_NF_CONNTRACK_EVENTS
  577. [NF_SYSCTL_CT_EVENTS] = {
  578. .procname = "nf_conntrack_events",
  579. .data = &init_net.ct.sysctl_events,
  580. .maxlen = sizeof(int),
  581. .mode = 0644,
  582. .proc_handler = proc_dointvec_minmax,
  583. .extra1 = SYSCTL_ZERO,
  584. .extra2 = SYSCTL_ONE,
  585. },
  586. #endif
  587. #ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
  588. [NF_SYSCTL_CT_TIMESTAMP] = {
  589. .procname = "nf_conntrack_timestamp",
  590. .data = &init_net.ct.sysctl_tstamp,
  591. .maxlen = sizeof(int),
  592. .mode = 0644,
  593. .proc_handler = proc_dointvec_minmax,
  594. .extra1 = SYSCTL_ZERO,
  595. .extra2 = SYSCTL_ONE,
  596. },
  597. #endif
  598. [NF_SYSCTL_CT_PROTO_TIMEOUT_GENERIC] = {
  599. .procname = "nf_conntrack_generic_timeout",
  600. .maxlen = sizeof(unsigned int),
  601. .mode = 0644,
  602. .proc_handler = proc_dointvec_jiffies,
  603. },
  604. [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_SYN_SENT] = {
  605. .procname = "nf_conntrack_tcp_timeout_syn_sent",
  606. .maxlen = sizeof(unsigned int),
  607. .mode = 0644,
  608. .proc_handler = proc_dointvec_jiffies,
  609. },
  610. [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_SYN_RECV] = {
  611. .procname = "nf_conntrack_tcp_timeout_syn_recv",
  612. .maxlen = sizeof(unsigned int),
  613. .mode = 0644,
  614. .proc_handler = proc_dointvec_jiffies,
  615. },
  616. [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_ESTABLISHED] = {
  617. .procname = "nf_conntrack_tcp_timeout_established",
  618. .maxlen = sizeof(unsigned int),
  619. .mode = 0644,
  620. .proc_handler = proc_dointvec_jiffies,
  621. },
  622. [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_FIN_WAIT] = {
  623. .procname = "nf_conntrack_tcp_timeout_fin_wait",
  624. .maxlen = sizeof(unsigned int),
  625. .mode = 0644,
  626. .proc_handler = proc_dointvec_jiffies,
  627. },
  628. [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_CLOSE_WAIT] = {
  629. .procname = "nf_conntrack_tcp_timeout_close_wait",
  630. .maxlen = sizeof(unsigned int),
  631. .mode = 0644,
  632. .proc_handler = proc_dointvec_jiffies,
  633. },
  634. [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_LAST_ACK] = {
  635. .procname = "nf_conntrack_tcp_timeout_last_ack",
  636. .maxlen = sizeof(unsigned int),
  637. .mode = 0644,
  638. .proc_handler = proc_dointvec_jiffies,
  639. },
  640. [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_TIME_WAIT] = {
  641. .procname = "nf_conntrack_tcp_timeout_time_wait",
  642. .maxlen = sizeof(unsigned int),
  643. .mode = 0644,
  644. .proc_handler = proc_dointvec_jiffies,
  645. },
  646. [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_CLOSE] = {
  647. .procname = "nf_conntrack_tcp_timeout_close",
  648. .maxlen = sizeof(unsigned int),
  649. .mode = 0644,
  650. .proc_handler = proc_dointvec_jiffies,
  651. },
  652. [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_RETRANS] = {
  653. .procname = "nf_conntrack_tcp_timeout_max_retrans",
  654. .maxlen = sizeof(unsigned int),
  655. .mode = 0644,
  656. .proc_handler = proc_dointvec_jiffies,
  657. },
  658. [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_UNACK] = {
  659. .procname = "nf_conntrack_tcp_timeout_unacknowledged",
  660. .maxlen = sizeof(unsigned int),
  661. .mode = 0644,
  662. .proc_handler = proc_dointvec_jiffies,
  663. },
  664. [NF_SYSCTL_CT_PROTO_TCP_LOOSE] = {
  665. .procname = "nf_conntrack_tcp_loose",
  666. .maxlen = sizeof(int),
  667. .mode = 0644,
  668. .proc_handler = proc_dointvec_minmax,
  669. .extra1 = SYSCTL_ZERO,
  670. .extra2 = SYSCTL_ONE,
  671. },
  672. [NF_SYSCTL_CT_PROTO_TCP_LIBERAL] = {
  673. .procname = "nf_conntrack_tcp_be_liberal",
  674. .maxlen = sizeof(int),
  675. .mode = 0644,
  676. .proc_handler = proc_dointvec_minmax,
  677. .extra1 = SYSCTL_ZERO,
  678. .extra2 = SYSCTL_ONE,
  679. },
  680. [NF_SYSCTL_CT_PROTO_TCP_MAX_RETRANS] = {
  681. .procname = "nf_conntrack_tcp_max_retrans",
  682. .maxlen = sizeof(unsigned int),
  683. .mode = 0644,
  684. .proc_handler = proc_dointvec,
  685. },
  686. [NF_SYSCTL_CT_PROTO_TIMEOUT_UDP] = {
  687. .procname = "nf_conntrack_udp_timeout",
  688. .maxlen = sizeof(unsigned int),
  689. .mode = 0644,
  690. .proc_handler = proc_dointvec_jiffies,
  691. },
  692. [NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_STREAM] = {
  693. .procname = "nf_conntrack_udp_timeout_stream",
  694. .maxlen = sizeof(unsigned int),
  695. .mode = 0644,
  696. .proc_handler = proc_dointvec_jiffies,
  697. },
  698. [NF_SYSCTL_CT_PROTO_TIMEOUT_ICMP] = {
  699. .procname = "nf_conntrack_icmp_timeout",
  700. .maxlen = sizeof(unsigned int),
  701. .mode = 0644,
  702. .proc_handler = proc_dointvec_jiffies,
  703. },
  704. [NF_SYSCTL_CT_PROTO_TIMEOUT_ICMPV6] = {
  705. .procname = "nf_conntrack_icmpv6_timeout",
  706. .maxlen = sizeof(unsigned int),
  707. .mode = 0644,
  708. .proc_handler = proc_dointvec_jiffies,
  709. },
  710. #ifdef CONFIG_NF_CT_PROTO_SCTP
  711. [NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_CLOSED] = {
  712. .procname = "nf_conntrack_sctp_timeout_closed",
  713. .maxlen = sizeof(unsigned int),
  714. .mode = 0644,
  715. .proc_handler = proc_dointvec_jiffies,
  716. },
  717. [NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_COOKIE_WAIT] = {
  718. .procname = "nf_conntrack_sctp_timeout_cookie_wait",
  719. .maxlen = sizeof(unsigned int),
  720. .mode = 0644,
  721. .proc_handler = proc_dointvec_jiffies,
  722. },
  723. [NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_COOKIE_ECHOED] = {
  724. .procname = "nf_conntrack_sctp_timeout_cookie_echoed",
  725. .maxlen = sizeof(unsigned int),
  726. .mode = 0644,
  727. .proc_handler = proc_dointvec_jiffies,
  728. },
  729. [NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_ESTABLISHED] = {
  730. .procname = "nf_conntrack_sctp_timeout_established",
  731. .maxlen = sizeof(unsigned int),
  732. .mode = 0644,
  733. .proc_handler = proc_dointvec_jiffies,
  734. },
  735. [NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_SHUTDOWN_SENT] = {
  736. .procname = "nf_conntrack_sctp_timeout_shutdown_sent",
  737. .maxlen = sizeof(unsigned int),
  738. .mode = 0644,
  739. .proc_handler = proc_dointvec_jiffies,
  740. },
  741. [NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_SHUTDOWN_RECD] = {
  742. .procname = "nf_conntrack_sctp_timeout_shutdown_recd",
  743. .maxlen = sizeof(unsigned int),
  744. .mode = 0644,
  745. .proc_handler = proc_dointvec_jiffies,
  746. },
  747. [NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_SHUTDOWN_ACK_SENT] = {
  748. .procname = "nf_conntrack_sctp_timeout_shutdown_ack_sent",
  749. .maxlen = sizeof(unsigned int),
  750. .mode = 0644,
  751. .proc_handler = proc_dointvec_jiffies,
  752. },
  753. [NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_HEARTBEAT_SENT] = {
  754. .procname = "nf_conntrack_sctp_timeout_heartbeat_sent",
  755. .maxlen = sizeof(unsigned int),
  756. .mode = 0644,
  757. .proc_handler = proc_dointvec_jiffies,
  758. },
  759. [NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_HEARTBEAT_ACKED] = {
  760. .procname = "nf_conntrack_sctp_timeout_heartbeat_acked",
  761. .maxlen = sizeof(unsigned int),
  762. .mode = 0644,
  763. .proc_handler = proc_dointvec_jiffies,
  764. },
  765. #endif
  766. #ifdef CONFIG_NF_CT_PROTO_DCCP
  767. [NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_REQUEST] = {
  768. .procname = "nf_conntrack_dccp_timeout_request",
  769. .maxlen = sizeof(unsigned int),
  770. .mode = 0644,
  771. .proc_handler = proc_dointvec_jiffies,
  772. },
  773. [NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_RESPOND] = {
  774. .procname = "nf_conntrack_dccp_timeout_respond",
  775. .maxlen = sizeof(unsigned int),
  776. .mode = 0644,
  777. .proc_handler = proc_dointvec_jiffies,
  778. },
  779. [NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_PARTOPEN] = {
  780. .procname = "nf_conntrack_dccp_timeout_partopen",
  781. .maxlen = sizeof(unsigned int),
  782. .mode = 0644,
  783. .proc_handler = proc_dointvec_jiffies,
  784. },
  785. [NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_OPEN] = {
  786. .procname = "nf_conntrack_dccp_timeout_open",
  787. .maxlen = sizeof(unsigned int),
  788. .mode = 0644,
  789. .proc_handler = proc_dointvec_jiffies,
  790. },
  791. [NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_CLOSEREQ] = {
  792. .procname = "nf_conntrack_dccp_timeout_closereq",
  793. .maxlen = sizeof(unsigned int),
  794. .mode = 0644,
  795. .proc_handler = proc_dointvec_jiffies,
  796. },
  797. [NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_CLOSING] = {
  798. .procname = "nf_conntrack_dccp_timeout_closing",
  799. .maxlen = sizeof(unsigned int),
  800. .mode = 0644,
  801. .proc_handler = proc_dointvec_jiffies,
  802. },
  803. [NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_TIMEWAIT] = {
  804. .procname = "nf_conntrack_dccp_timeout_timewait",
  805. .maxlen = sizeof(unsigned int),
  806. .mode = 0644,
  807. .proc_handler = proc_dointvec_jiffies,
  808. },
  809. [NF_SYSCTL_CT_PROTO_DCCP_LOOSE] = {
  810. .procname = "nf_conntrack_dccp_loose",
  811. .maxlen = sizeof(int),
  812. .mode = 0644,
  813. .proc_handler = proc_dointvec_minmax,
  814. .extra1 = SYSCTL_ZERO,
  815. .extra2 = SYSCTL_ONE,
  816. },
  817. #endif
  818. #ifdef CONFIG_NF_CT_PROTO_GRE
  819. [NF_SYSCTL_CT_PROTO_TIMEOUT_GRE] = {
  820. .procname = "nf_conntrack_gre_timeout",
  821. .maxlen = sizeof(unsigned int),
  822. .mode = 0644,
  823. .proc_handler = proc_dointvec_jiffies,
  824. },
  825. [NF_SYSCTL_CT_PROTO_TIMEOUT_GRE_STREAM] = {
  826. .procname = "nf_conntrack_gre_timeout_stream",
  827. .maxlen = sizeof(unsigned int),
  828. .mode = 0644,
  829. .proc_handler = proc_dointvec_jiffies,
  830. },
  831. #endif
  832. {}
  833. };
  834. static struct ctl_table nf_ct_netfilter_table[] = {
  835. {
  836. .procname = "nf_conntrack_max",
  837. .data = &nf_conntrack_max,
  838. .maxlen = sizeof(int),
  839. .mode = 0644,
  840. .proc_handler = proc_dointvec,
  841. },
  842. { }
  843. };
  844. static void nf_conntrack_standalone_init_tcp_sysctl(struct net *net,
  845. struct ctl_table *table)
  846. {
  847. struct nf_tcp_net *tn = nf_tcp_pernet(net);
  848. #define XASSIGN(XNAME, tn) \
  849. table[NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_ ## XNAME].data = \
  850. &(tn)->timeouts[TCP_CONNTRACK_ ## XNAME]
  851. XASSIGN(SYN_SENT, tn);
  852. XASSIGN(SYN_RECV, tn);
  853. XASSIGN(ESTABLISHED, tn);
  854. XASSIGN(FIN_WAIT, tn);
  855. XASSIGN(CLOSE_WAIT, tn);
  856. XASSIGN(LAST_ACK, tn);
  857. XASSIGN(TIME_WAIT, tn);
  858. XASSIGN(CLOSE, tn);
  859. XASSIGN(RETRANS, tn);
  860. XASSIGN(UNACK, tn);
  861. #undef XASSIGN
  862. #define XASSIGN(XNAME, rval) \
  863. table[NF_SYSCTL_CT_PROTO_TCP_ ## XNAME].data = (rval)
  864. XASSIGN(LOOSE, &tn->tcp_loose);
  865. XASSIGN(LIBERAL, &tn->tcp_be_liberal);
  866. XASSIGN(MAX_RETRANS, &tn->tcp_max_retrans);
  867. #undef XASSIGN
  868. }
  869. static void nf_conntrack_standalone_init_sctp_sysctl(struct net *net,
  870. struct ctl_table *table)
  871. {
  872. #ifdef CONFIG_NF_CT_PROTO_SCTP
  873. struct nf_sctp_net *sn = nf_sctp_pernet(net);
  874. #define XASSIGN(XNAME, sn) \
  875. table[NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_ ## XNAME].data = \
  876. &(sn)->timeouts[SCTP_CONNTRACK_ ## XNAME]
  877. XASSIGN(CLOSED, sn);
  878. XASSIGN(COOKIE_WAIT, sn);
  879. XASSIGN(COOKIE_ECHOED, sn);
  880. XASSIGN(ESTABLISHED, sn);
  881. XASSIGN(SHUTDOWN_SENT, sn);
  882. XASSIGN(SHUTDOWN_RECD, sn);
  883. XASSIGN(SHUTDOWN_ACK_SENT, sn);
  884. XASSIGN(HEARTBEAT_SENT, sn);
  885. XASSIGN(HEARTBEAT_ACKED, sn);
  886. #undef XASSIGN
  887. #endif
  888. }
  889. static void nf_conntrack_standalone_init_dccp_sysctl(struct net *net,
  890. struct ctl_table *table)
  891. {
  892. #ifdef CONFIG_NF_CT_PROTO_DCCP
  893. struct nf_dccp_net *dn = nf_dccp_pernet(net);
  894. #define XASSIGN(XNAME, dn) \
  895. table[NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_ ## XNAME].data = \
  896. &(dn)->dccp_timeout[CT_DCCP_ ## XNAME]
  897. XASSIGN(REQUEST, dn);
  898. XASSIGN(RESPOND, dn);
  899. XASSIGN(PARTOPEN, dn);
  900. XASSIGN(OPEN, dn);
  901. XASSIGN(CLOSEREQ, dn);
  902. XASSIGN(CLOSING, dn);
  903. XASSIGN(TIMEWAIT, dn);
  904. #undef XASSIGN
  905. table[NF_SYSCTL_CT_PROTO_DCCP_LOOSE].data = &dn->dccp_loose;
  906. #endif
  907. }
  908. static void nf_conntrack_standalone_init_gre_sysctl(struct net *net,
  909. struct ctl_table *table)
  910. {
  911. #ifdef CONFIG_NF_CT_PROTO_GRE
  912. struct nf_gre_net *gn = nf_gre_pernet(net);
  913. table[NF_SYSCTL_CT_PROTO_TIMEOUT_GRE].data = &gn->timeouts[GRE_CT_UNREPLIED];
  914. table[NF_SYSCTL_CT_PROTO_TIMEOUT_GRE_STREAM].data = &gn->timeouts[GRE_CT_REPLIED];
  915. #endif
  916. }
  917. static int nf_conntrack_standalone_init_sysctl(struct net *net)
  918. {
  919. struct nf_udp_net *un = nf_udp_pernet(net);
  920. struct ctl_table *table;
  921. BUILD_BUG_ON(ARRAY_SIZE(nf_ct_sysctl_table) != NF_SYSCTL_CT_LAST_SYSCTL);
  922. table = kmemdup(nf_ct_sysctl_table, sizeof(nf_ct_sysctl_table),
  923. GFP_KERNEL);
  924. if (!table)
  925. return -ENOMEM;
  926. table[NF_SYSCTL_CT_COUNT].data = &net->ct.count;
  927. table[NF_SYSCTL_CT_CHECKSUM].data = &net->ct.sysctl_checksum;
  928. table[NF_SYSCTL_CT_LOG_INVALID].data = &net->ct.sysctl_log_invalid;
  929. table[NF_SYSCTL_CT_ACCT].data = &net->ct.sysctl_acct;
  930. table[NF_SYSCTL_CT_HELPER].data = &net->ct.sysctl_auto_assign_helper;
  931. #ifdef CONFIG_NF_CONNTRACK_EVENTS
  932. table[NF_SYSCTL_CT_EVENTS].data = &net->ct.sysctl_events;
  933. #endif
  934. #ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
  935. table[NF_SYSCTL_CT_TIMESTAMP].data = &net->ct.sysctl_tstamp;
  936. #endif
  937. table[NF_SYSCTL_CT_PROTO_TIMEOUT_GENERIC].data = &nf_generic_pernet(net)->timeout;
  938. table[NF_SYSCTL_CT_PROTO_TIMEOUT_ICMP].data = &nf_icmp_pernet(net)->timeout;
  939. table[NF_SYSCTL_CT_PROTO_TIMEOUT_ICMPV6].data = &nf_icmpv6_pernet(net)->timeout;
  940. table[NF_SYSCTL_CT_PROTO_TIMEOUT_UDP].data = &un->timeouts[UDP_CT_UNREPLIED];
  941. table[NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_STREAM].data = &un->timeouts[UDP_CT_REPLIED];
  942. nf_conntrack_standalone_init_tcp_sysctl(net, table);
  943. nf_conntrack_standalone_init_sctp_sysctl(net, table);
  944. nf_conntrack_standalone_init_dccp_sysctl(net, table);
  945. nf_conntrack_standalone_init_gre_sysctl(net, table);
  946. /* Don't allow unprivileged users to alter certain sysctls */
  947. if (net->user_ns != &init_user_ns) {
  948. table[NF_SYSCTL_CT_MAX].mode = 0444;
  949. table[NF_SYSCTL_CT_EXPECT_MAX].mode = 0444;
  950. table[NF_SYSCTL_CT_HELPER].mode = 0444;
  951. #ifdef CONFIG_NF_CONNTRACK_EVENTS
  952. table[NF_SYSCTL_CT_EVENTS].mode = 0444;
  953. #endif
  954. table[NF_SYSCTL_CT_BUCKETS].mode = 0444;
  955. } else if (!net_eq(&init_net, net)) {
  956. table[NF_SYSCTL_CT_BUCKETS].mode = 0444;
  957. }
  958. net->ct.sysctl_header = register_net_sysctl(net, "net/netfilter", table);
  959. if (!net->ct.sysctl_header)
  960. goto out_unregister_netfilter;
  961. return 0;
  962. out_unregister_netfilter:
  963. kfree(table);
  964. return -ENOMEM;
  965. }
  966. static void nf_conntrack_standalone_fini_sysctl(struct net *net)
  967. {
  968. struct ctl_table *table;
  969. table = net->ct.sysctl_header->ctl_table_arg;
  970. unregister_net_sysctl_table(net->ct.sysctl_header);
  971. kfree(table);
  972. }
  973. #else
  974. static int nf_conntrack_standalone_init_sysctl(struct net *net)
  975. {
  976. return 0;
  977. }
  978. static void nf_conntrack_standalone_fini_sysctl(struct net *net)
  979. {
  980. }
  981. #endif /* CONFIG_SYSCTL */
  982. static void nf_conntrack_fini_net(struct net *net)
  983. {
  984. if (enable_hooks)
  985. nf_ct_netns_put(net, NFPROTO_INET);
  986. nf_conntrack_standalone_fini_proc(net);
  987. nf_conntrack_standalone_fini_sysctl(net);
  988. }
  989. static int nf_conntrack_pernet_init(struct net *net)
  990. {
  991. int ret;
  992. net->ct.sysctl_checksum = 1;
  993. ret = nf_conntrack_standalone_init_sysctl(net);
  994. if (ret < 0)
  995. return ret;
  996. ret = nf_conntrack_standalone_init_proc(net);
  997. if (ret < 0)
  998. goto out_proc;
  999. ret = nf_conntrack_init_net(net);
  1000. if (ret < 0)
  1001. goto out_init_net;
  1002. if (enable_hooks) {
  1003. ret = nf_ct_netns_get(net, NFPROTO_INET);
  1004. if (ret < 0)
  1005. goto out_hooks;
  1006. }
  1007. return 0;
  1008. out_hooks:
  1009. nf_conntrack_cleanup_net(net);
  1010. out_init_net:
  1011. nf_conntrack_standalone_fini_proc(net);
  1012. out_proc:
  1013. nf_conntrack_standalone_fini_sysctl(net);
  1014. return ret;
  1015. }
  1016. static void nf_conntrack_pernet_exit(struct list_head *net_exit_list)
  1017. {
  1018. struct net *net;
  1019. list_for_each_entry(net, net_exit_list, exit_list)
  1020. nf_conntrack_fini_net(net);
  1021. nf_conntrack_cleanup_net_list(net_exit_list);
  1022. }
  1023. static struct pernet_operations nf_conntrack_net_ops = {
  1024. .init = nf_conntrack_pernet_init,
  1025. .exit_batch = nf_conntrack_pernet_exit,
  1026. .id = &nf_conntrack_net_id,
  1027. .size = sizeof(struct nf_conntrack_net),
  1028. };
  1029. static int __init nf_conntrack_standalone_init(void)
  1030. {
  1031. int ret = nf_conntrack_init_start();
  1032. if (ret < 0)
  1033. goto out_start;
  1034. BUILD_BUG_ON(NFCT_INFOMASK <= IP_CT_NUMBER);
  1035. #ifdef CONFIG_SYSCTL
  1036. nf_ct_netfilter_header =
  1037. register_net_sysctl(&init_net, "net", nf_ct_netfilter_table);
  1038. if (!nf_ct_netfilter_header) {
  1039. pr_err("nf_conntrack: can't register to sysctl.\n");
  1040. ret = -ENOMEM;
  1041. goto out_sysctl;
  1042. }
  1043. nf_conntrack_htable_size_user = nf_conntrack_htable_size;
  1044. #endif
  1045. ret = register_pernet_subsys(&nf_conntrack_net_ops);
  1046. if (ret < 0)
  1047. goto out_pernet;
  1048. nf_conntrack_init_end();
  1049. return 0;
  1050. out_pernet:
  1051. #ifdef CONFIG_SYSCTL
  1052. unregister_net_sysctl_table(nf_ct_netfilter_header);
  1053. out_sysctl:
  1054. #endif
  1055. nf_conntrack_cleanup_end();
  1056. out_start:
  1057. return ret;
  1058. }
  1059. static void __exit nf_conntrack_standalone_fini(void)
  1060. {
  1061. nf_conntrack_cleanup_start();
  1062. unregister_pernet_subsys(&nf_conntrack_net_ops);
  1063. #ifdef CONFIG_SYSCTL
  1064. unregister_net_sysctl_table(nf_ct_netfilter_header);
  1065. #endif
  1066. nf_conntrack_cleanup_end();
  1067. }
  1068. module_init(nf_conntrack_standalone_init);
  1069. module_exit(nf_conntrack_standalone_fini);