1 // SPDX-License-Identifier: GPL-2.0
2 #include <linux/types.h>
3 #include <linux/netfilter.h>
4 #include <linux/slab.h>
5 #include <linux/module.h>
6 #include <linux/skbuff.h>
7 #include <linux/proc_fs.h>
8 #include <linux/seq_file.h>
9 #include <linux/percpu.h>
10 #include <linux/netdevice.h>
11 #include <linux/security.h>
12 #include <net/net_namespace.h>
13 #ifdef CONFIG_SYSCTL
14 #include <linux/sysctl.h>
15 #endif
16
17 #include <net/netfilter/nf_log.h>
18 #include <net/netfilter/nf_conntrack.h>
19 #include <net/netfilter/nf_conntrack_core.h>
20 #include <net/netfilter/nf_conntrack_l4proto.h>
21 #include <net/netfilter/nf_conntrack_expect.h>
22 #include <net/netfilter/nf_conntrack_helper.h>
23 #include <net/netfilter/nf_conntrack_acct.h>
24 #include <net/netfilter/nf_conntrack_zones.h>
25 #include <net/netfilter/nf_conntrack_timestamp.h>
26 #include <linux/rculist_nulls.h>
27
28 static bool enable_hooks __read_mostly;
29 MODULE_PARM_DESC(enable_hooks, "Always enable conntrack hooks");
30 module_param(enable_hooks, bool, 0000);
31
32 unsigned int nf_conntrack_net_id __read_mostly;
33
34 #ifdef CONFIG_NF_CONNTRACK_PROCFS
35 void
print_tuple(struct seq_file * s,const struct nf_conntrack_tuple * tuple,const struct nf_conntrack_l4proto * l4proto)36 print_tuple(struct seq_file *s, const struct nf_conntrack_tuple *tuple,
37 const struct nf_conntrack_l4proto *l4proto)
38 {
39 switch (tuple->src.l3num) {
40 case NFPROTO_IPV4:
41 seq_printf(s, "src=%pI4 dst=%pI4 ",
42 &tuple->src.u3.ip, &tuple->dst.u3.ip);
43 break;
44 case NFPROTO_IPV6:
45 seq_printf(s, "src=%pI6 dst=%pI6 ",
46 tuple->src.u3.ip6, tuple->dst.u3.ip6);
47 break;
48 default:
49 break;
50 }
51
52 switch (l4proto->l4proto) {
53 case IPPROTO_ICMP:
54 seq_printf(s, "type=%u code=%u id=%u ",
55 tuple->dst.u.icmp.type,
56 tuple->dst.u.icmp.code,
57 ntohs(tuple->src.u.icmp.id));
58 break;
59 case IPPROTO_TCP:
60 seq_printf(s, "sport=%hu dport=%hu ",
61 ntohs(tuple->src.u.tcp.port),
62 ntohs(tuple->dst.u.tcp.port));
63 break;
64 case IPPROTO_UDP:
65 seq_printf(s, "sport=%hu dport=%hu ",
66 ntohs(tuple->src.u.udp.port),
67 ntohs(tuple->dst.u.udp.port));
68
69 break;
70 case IPPROTO_SCTP:
71 seq_printf(s, "sport=%hu dport=%hu ",
72 ntohs(tuple->src.u.sctp.port),
73 ntohs(tuple->dst.u.sctp.port));
74 break;
75 case IPPROTO_ICMPV6:
76 seq_printf(s, "type=%u code=%u id=%u ",
77 tuple->dst.u.icmp.type,
78 tuple->dst.u.icmp.code,
79 ntohs(tuple->src.u.icmp.id));
80 break;
81 case IPPROTO_GRE:
82 seq_printf(s, "srckey=0x%x dstkey=0x%x ",
83 ntohs(tuple->src.u.gre.key),
84 ntohs(tuple->dst.u.gre.key));
85 break;
86 default:
87 break;
88 }
89 }
90 EXPORT_SYMBOL_GPL(print_tuple);
91
92 struct ct_iter_state {
93 struct seq_net_private p;
94 struct hlist_nulls_head *hash;
95 unsigned int htable_size;
96 unsigned int skip_elems;
97 unsigned int bucket;
98 u_int64_t time_now;
99 };
100
ct_get_next(const struct net * net,struct ct_iter_state * st)101 static struct nf_conntrack_tuple_hash *ct_get_next(const struct net *net,
102 struct ct_iter_state *st)
103 {
104 struct nf_conntrack_tuple_hash *h;
105 struct hlist_nulls_node *n;
106 unsigned int i;
107
108 for (i = st->bucket; i < st->htable_size; i++) {
109 unsigned int skip = 0;
110
111 restart:
112 hlist_nulls_for_each_entry_rcu(h, n, &st->hash[i], hnnode) {
113 struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
114 struct hlist_nulls_node *tmp = n;
115
116 if (!net_eq(net, nf_ct_net(ct)))
117 continue;
118
119 if (++skip <= st->skip_elems)
120 continue;
121
122 /* h should be returned, skip to nulls marker. */
123 while (!is_a_nulls(tmp))
124 tmp = rcu_dereference(hlist_nulls_next_rcu(tmp));
125
126 /* check if h is still linked to hash[i] */
127 if (get_nulls_value(tmp) != i) {
128 skip = 0;
129 goto restart;
130 }
131
132 st->skip_elems = skip;
133 st->bucket = i;
134 return h;
135 }
136
137 skip = 0;
138 if (get_nulls_value(n) != i)
139 goto restart;
140
141 st->skip_elems = 0;
142 }
143
144 st->bucket = i;
145 return NULL;
146 }
147
ct_seq_start(struct seq_file * seq,loff_t * pos)148 static void *ct_seq_start(struct seq_file *seq, loff_t *pos)
149 __acquires(RCU)
150 {
151 struct ct_iter_state *st = seq->private;
152 struct net *net = seq_file_net(seq);
153
154 st->time_now = ktime_get_real_ns();
155 rcu_read_lock();
156
157 nf_conntrack_get_ht(&st->hash, &st->htable_size);
158
159 if (*pos == 0) {
160 st->skip_elems = 0;
161 st->bucket = 0;
162 } else if (st->skip_elems) {
163 /* resume from last dumped entry */
164 st->skip_elems--;
165 }
166
167 return ct_get_next(net, st);
168 }
169
ct_seq_next(struct seq_file * s,void * v,loff_t * pos)170 static void *ct_seq_next(struct seq_file *s, void *v, loff_t *pos)
171 {
172 struct ct_iter_state *st = s->private;
173 struct net *net = seq_file_net(s);
174
175 (*pos)++;
176 return ct_get_next(net, st);
177 }
178
ct_seq_stop(struct seq_file * s,void * v)179 static void ct_seq_stop(struct seq_file *s, void *v)
180 __releases(RCU)
181 {
182 rcu_read_unlock();
183 }
184
185 #ifdef CONFIG_NF_CONNTRACK_SECMARK
ct_show_secctx(struct seq_file * s,const struct nf_conn * ct)186 static void ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
187 {
188 struct lsm_context ctx;
189 int ret;
190
191 ret = security_secid_to_secctx(ct->secmark, &ctx);
192 if (ret < 0)
193 return;
194
195 seq_printf(s, "secctx=%s ", ctx.context);
196
197 security_release_secctx(&ctx);
198 }
199 #else
ct_show_secctx(struct seq_file * s,const struct nf_conn * ct)200 static inline void ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
201 {
202 }
203 #endif
204
205 #ifdef CONFIG_NF_CONNTRACK_ZONES
ct_show_zone(struct seq_file * s,const struct nf_conn * ct,int dir)206 static void ct_show_zone(struct seq_file *s, const struct nf_conn *ct,
207 int dir)
208 {
209 const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
210
211 if (zone->dir != dir)
212 return;
213 switch (zone->dir) {
214 case NF_CT_DEFAULT_ZONE_DIR:
215 seq_printf(s, "zone=%u ", zone->id);
216 break;
217 case NF_CT_ZONE_DIR_ORIG:
218 seq_printf(s, "zone-orig=%u ", zone->id);
219 break;
220 case NF_CT_ZONE_DIR_REPL:
221 seq_printf(s, "zone-reply=%u ", zone->id);
222 break;
223 default:
224 break;
225 }
226 }
227 #else
ct_show_zone(struct seq_file * s,const struct nf_conn * ct,int dir)228 static inline void ct_show_zone(struct seq_file *s, const struct nf_conn *ct,
229 int dir)
230 {
231 }
232 #endif
233
234 #ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
ct_show_delta_time(struct seq_file * s,const struct nf_conn * ct)235 static void ct_show_delta_time(struct seq_file *s, const struct nf_conn *ct)
236 {
237 struct ct_iter_state *st = s->private;
238 struct nf_conn_tstamp *tstamp;
239 s64 delta_time;
240
241 tstamp = nf_conn_tstamp_find(ct);
242 if (tstamp) {
243 delta_time = st->time_now - tstamp->start;
244 if (delta_time > 0)
245 delta_time = div_s64(delta_time, NSEC_PER_SEC);
246 else
247 delta_time = 0;
248
249 seq_printf(s, "delta-time=%llu ",
250 (unsigned long long)delta_time);
251 }
252 return;
253 }
254 #else
255 static inline void
ct_show_delta_time(struct seq_file * s,const struct nf_conn * ct)256 ct_show_delta_time(struct seq_file *s, const struct nf_conn *ct)
257 {
258 }
259 #endif
260
l3proto_name(u16 proto)261 static const char* l3proto_name(u16 proto)
262 {
263 switch (proto) {
264 case AF_INET: return "ipv4";
265 case AF_INET6: return "ipv6";
266 }
267
268 return "unknown";
269 }
270
l4proto_name(u16 proto)271 static const char* l4proto_name(u16 proto)
272 {
273 switch (proto) {
274 case IPPROTO_ICMP: return "icmp";
275 case IPPROTO_TCP: return "tcp";
276 case IPPROTO_UDP: return "udp";
277 case IPPROTO_GRE: return "gre";
278 case IPPROTO_SCTP: return "sctp";
279 case IPPROTO_ICMPV6: return "icmpv6";
280 }
281
282 return "unknown";
283 }
284
285 static void
seq_print_acct(struct seq_file * s,const struct nf_conn * ct,int dir)286 seq_print_acct(struct seq_file *s, const struct nf_conn *ct, int dir)
287 {
288 struct nf_conn_acct *acct;
289 struct nf_conn_counter *counter;
290
291 acct = nf_conn_acct_find(ct);
292 if (!acct)
293 return;
294
295 counter = acct->counter;
296 seq_printf(s, "packets=%llu bytes=%llu ",
297 (unsigned long long)atomic64_read(&counter[dir].packets),
298 (unsigned long long)atomic64_read(&counter[dir].bytes));
299 }
300
301 /* return 0 on success, 1 in case of error */
ct_seq_show(struct seq_file * s,void * v)302 static int ct_seq_show(struct seq_file *s, void *v)
303 {
304 struct nf_conntrack_tuple_hash *hash = v;
305 struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(hash);
306 const struct nf_conntrack_l4proto *l4proto;
307 struct net *net = seq_file_net(s);
308 int ret = 0;
309
310 WARN_ON(!ct);
311 if (unlikely(!refcount_inc_not_zero(&ct->ct_general.use)))
312 return 0;
313
314 /* load ->status after refcount increase */
315 smp_acquire__after_ctrl_dep();
316
317 if (nf_ct_should_gc(ct)) {
318 struct ct_iter_state *st = s->private;
319
320 st->skip_elems--;
321 nf_ct_kill(ct);
322 goto release;
323 }
324
325 /* we only want to print DIR_ORIGINAL */
326 if (NF_CT_DIRECTION(hash))
327 goto release;
328
329 if (!net_eq(nf_ct_net(ct), net))
330 goto release;
331
332 l4proto = nf_ct_l4proto_find(nf_ct_protonum(ct));
333
334 ret = -ENOSPC;
335 seq_printf(s, "%-8s %u %-8s %u ",
336 l3proto_name(nf_ct_l3num(ct)), nf_ct_l3num(ct),
337 l4proto_name(l4proto->l4proto), nf_ct_protonum(ct));
338
339 if (!test_bit(IPS_OFFLOAD_BIT, &ct->status))
340 seq_printf(s, "%ld ", nf_ct_expires(ct) / HZ);
341
342 if (l4proto->print_conntrack)
343 l4proto->print_conntrack(s, ct);
344
345 print_tuple(s, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
346 l4proto);
347
348 ct_show_zone(s, ct, NF_CT_ZONE_DIR_ORIG);
349
350 if (seq_has_overflowed(s))
351 goto release;
352
353 seq_print_acct(s, ct, IP_CT_DIR_ORIGINAL);
354
355 if (!(test_bit(IPS_SEEN_REPLY_BIT, &ct->status)))
356 seq_puts(s, "[UNREPLIED] ");
357
358 print_tuple(s, &ct->tuplehash[IP_CT_DIR_REPLY].tuple, l4proto);
359
360 ct_show_zone(s, ct, NF_CT_ZONE_DIR_REPL);
361
362 seq_print_acct(s, ct, IP_CT_DIR_REPLY);
363
364 if (test_bit(IPS_HW_OFFLOAD_BIT, &ct->status))
365 seq_puts(s, "[HW_OFFLOAD] ");
366 else if (test_bit(IPS_OFFLOAD_BIT, &ct->status))
367 seq_puts(s, "[OFFLOAD] ");
368 else if (test_bit(IPS_ASSURED_BIT, &ct->status))
369 seq_puts(s, "[ASSURED] ");
370
371 if (seq_has_overflowed(s))
372 goto release;
373
374 #if defined(CONFIG_NF_CONNTRACK_MARK)
375 seq_printf(s, "mark=%u ", READ_ONCE(ct->mark));
376 #endif
377
378 ct_show_secctx(s, ct);
379 ct_show_zone(s, ct, NF_CT_DEFAULT_ZONE_DIR);
380 ct_show_delta_time(s, ct);
381
382 seq_printf(s, "use=%u\n", refcount_read(&ct->ct_general.use));
383
384 if (seq_has_overflowed(s))
385 goto release;
386
387 ret = 0;
388 release:
389 nf_ct_put(ct);
390 return ret;
391 }
392
393 static const struct seq_operations ct_seq_ops = {
394 .start = ct_seq_start,
395 .next = ct_seq_next,
396 .stop = ct_seq_stop,
397 .show = ct_seq_show
398 };
399
ct_cpu_seq_start(struct seq_file * seq,loff_t * pos)400 static void *ct_cpu_seq_start(struct seq_file *seq, loff_t *pos)
401 {
402 struct net *net = seq_file_net(seq);
403 int cpu;
404
405 if (*pos == 0)
406 return SEQ_START_TOKEN;
407
408 for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
409 if (!cpu_possible(cpu))
410 continue;
411 *pos = cpu + 1;
412 return per_cpu_ptr(net->ct.stat, cpu);
413 }
414
415 return NULL;
416 }
417
ct_cpu_seq_next(struct seq_file * seq,void * v,loff_t * pos)418 static void *ct_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
419 {
420 struct net *net = seq_file_net(seq);
421 int cpu;
422
423 for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
424 if (!cpu_possible(cpu))
425 continue;
426 *pos = cpu + 1;
427 return per_cpu_ptr(net->ct.stat, cpu);
428 }
429 (*pos)++;
430 return NULL;
431 }
432
ct_cpu_seq_stop(struct seq_file * seq,void * v)433 static void ct_cpu_seq_stop(struct seq_file *seq, void *v)
434 {
435 }
436
ct_cpu_seq_show(struct seq_file * seq,void * v)437 static int ct_cpu_seq_show(struct seq_file *seq, void *v)
438 {
439 struct net *net = seq_file_net(seq);
440 const struct ip_conntrack_stat *st = v;
441 unsigned int nr_conntracks;
442
443 if (v == SEQ_START_TOKEN) {
444 seq_puts(seq, "entries clashres found new invalid ignore delete chainlength insert insert_failed drop early_drop icmp_error expect_new expect_create expect_delete search_restart\n");
445 return 0;
446 }
447
448 nr_conntracks = nf_conntrack_count(net);
449
450 seq_printf(seq, "%08x %08x %08x %08x %08x %08x %08x %08x "
451 "%08x %08x %08x %08x %08x %08x %08x %08x %08x\n",
452 nr_conntracks,
453 st->clash_resolve,
454 st->found,
455 0,
456 st->invalid,
457 0,
458 0,
459 st->chaintoolong,
460 st->insert,
461 st->insert_failed,
462 st->drop,
463 st->early_drop,
464 st->error,
465
466 st->expect_new,
467 st->expect_create,
468 st->expect_delete,
469 st->search_restart
470 );
471 return 0;
472 }
473
474 static const struct seq_operations ct_cpu_seq_ops = {
475 .start = ct_cpu_seq_start,
476 .next = ct_cpu_seq_next,
477 .stop = ct_cpu_seq_stop,
478 .show = ct_cpu_seq_show,
479 };
480
nf_conntrack_standalone_init_proc(struct net * net)481 static int nf_conntrack_standalone_init_proc(struct net *net)
482 {
483 struct proc_dir_entry *pde;
484 kuid_t root_uid;
485 kgid_t root_gid;
486
487 pde = proc_create_net("nf_conntrack", 0440, net->proc_net, &ct_seq_ops,
488 sizeof(struct ct_iter_state));
489 if (!pde)
490 goto out_nf_conntrack;
491
492 root_uid = make_kuid(net->user_ns, 0);
493 root_gid = make_kgid(net->user_ns, 0);
494 if (uid_valid(root_uid) && gid_valid(root_gid))
495 proc_set_user(pde, root_uid, root_gid);
496
497 pde = proc_create_net("nf_conntrack", 0444, net->proc_net_stat,
498 &ct_cpu_seq_ops, sizeof(struct seq_net_private));
499 if (!pde)
500 goto out_stat_nf_conntrack;
501 return 0;
502
503 out_stat_nf_conntrack:
504 remove_proc_entry("nf_conntrack", net->proc_net);
505 out_nf_conntrack:
506 return -ENOMEM;
507 }
508
nf_conntrack_standalone_fini_proc(struct net * net)509 static void nf_conntrack_standalone_fini_proc(struct net *net)
510 {
511 remove_proc_entry("nf_conntrack", net->proc_net_stat);
512 remove_proc_entry("nf_conntrack", net->proc_net);
513 }
514 #else
nf_conntrack_standalone_init_proc(struct net * net)515 static int nf_conntrack_standalone_init_proc(struct net *net)
516 {
517 return 0;
518 }
519
nf_conntrack_standalone_fini_proc(struct net * net)520 static void nf_conntrack_standalone_fini_proc(struct net *net)
521 {
522 }
523 #endif /* CONFIG_NF_CONNTRACK_PROCFS */
524
nf_conntrack_count(const struct net * net)525 u32 nf_conntrack_count(const struct net *net)
526 {
527 const struct nf_conntrack_net *cnet = nf_ct_pernet(net);
528
529 return atomic_read(&cnet->count);
530 }
531 EXPORT_SYMBOL_GPL(nf_conntrack_count);
532
533 /* Sysctl support */
534
535 #ifdef CONFIG_SYSCTL
536 /* size the user *wants to set */
537 static unsigned int nf_conntrack_htable_size_user __read_mostly;
538
539 static int
nf_conntrack_hash_sysctl(const struct ctl_table * table,int write,void * buffer,size_t * lenp,loff_t * ppos)540 nf_conntrack_hash_sysctl(const struct ctl_table *table, int write,
541 void *buffer, size_t *lenp, loff_t *ppos)
542 {
543 int ret;
544
545 /* module_param hashsize could have changed value */
546 nf_conntrack_htable_size_user = nf_conntrack_htable_size;
547
548 ret = proc_dointvec(table, write, buffer, lenp, ppos);
549 if (ret < 0 || !write)
550 return ret;
551
552 /* update ret, we might not be able to satisfy request */
553 ret = nf_conntrack_hash_resize(nf_conntrack_htable_size_user);
554
555 /* update it to the actual value used by conntrack */
556 nf_conntrack_htable_size_user = nf_conntrack_htable_size;
557 return ret;
558 }
559
560 static int
nf_conntrack_log_invalid_sysctl(const struct ctl_table * table,int write,void * buffer,size_t * lenp,loff_t * ppos)561 nf_conntrack_log_invalid_sysctl(const struct ctl_table *table, int write,
562 void *buffer, size_t *lenp, loff_t *ppos)
563 {
564 int ret, i;
565
566 ret = proc_dou8vec_minmax(table, write, buffer, lenp, ppos);
567 if (ret < 0 || !write)
568 return ret;
569
570 if (*(u8 *)table->data == 0)
571 return 0;
572
573 /* Load nf_log_syslog only if no logger is currently registered */
574 for (i = 0; i < NFPROTO_NUMPROTO; i++) {
575 if (nf_log_is_registered(i))
576 return 0;
577 }
578 request_module("%s", "nf_log_syslog");
579
580 return 0;
581 }
582
583 static struct ctl_table_header *nf_ct_netfilter_header;
584
585 enum nf_ct_sysctl_index {
586 NF_SYSCTL_CT_MAX,
587 NF_SYSCTL_CT_COUNT,
588 NF_SYSCTL_CT_BUCKETS,
589 NF_SYSCTL_CT_CHECKSUM,
590 NF_SYSCTL_CT_LOG_INVALID,
591 NF_SYSCTL_CT_EXPECT_MAX,
592 NF_SYSCTL_CT_ACCT,
593 #ifdef CONFIG_NF_CONNTRACK_EVENTS
594 NF_SYSCTL_CT_EVENTS,
595 #endif
596 #ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
597 NF_SYSCTL_CT_TIMESTAMP,
598 #endif
599 NF_SYSCTL_CT_PROTO_TIMEOUT_GENERIC,
600 NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_SYN_SENT,
601 NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_SYN_RECV,
602 NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_ESTABLISHED,
603 NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_FIN_WAIT,
604 NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_CLOSE_WAIT,
605 NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_LAST_ACK,
606 NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_TIME_WAIT,
607 NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_CLOSE,
608 NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_RETRANS,
609 NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_UNACK,
610 #if IS_ENABLED(CONFIG_NF_FLOW_TABLE)
611 NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_OFFLOAD,
612 #endif
613 NF_SYSCTL_CT_PROTO_TCP_LOOSE,
614 NF_SYSCTL_CT_PROTO_TCP_LIBERAL,
615 NF_SYSCTL_CT_PROTO_TCP_IGNORE_INVALID_RST,
616 NF_SYSCTL_CT_PROTO_TCP_MAX_RETRANS,
617 NF_SYSCTL_CT_PROTO_TIMEOUT_UDP,
618 NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_STREAM,
619 #if IS_ENABLED(CONFIG_NF_FLOW_TABLE)
620 NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_OFFLOAD,
621 #endif
622 NF_SYSCTL_CT_PROTO_TIMEOUT_ICMP,
623 NF_SYSCTL_CT_PROTO_TIMEOUT_ICMPV6,
624 #ifdef CONFIG_NF_CT_PROTO_SCTP
625 NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_CLOSED,
626 NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_COOKIE_WAIT,
627 NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_COOKIE_ECHOED,
628 NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_ESTABLISHED,
629 NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_SHUTDOWN_SENT,
630 NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_SHUTDOWN_RECD,
631 NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_SHUTDOWN_ACK_SENT,
632 NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_HEARTBEAT_SENT,
633 #endif
634 #ifdef CONFIG_NF_CT_PROTO_GRE
635 NF_SYSCTL_CT_PROTO_TIMEOUT_GRE,
636 NF_SYSCTL_CT_PROTO_TIMEOUT_GRE_STREAM,
637 #endif
638
639 NF_SYSCTL_CT_LAST_SYSCTL,
640 };
641
642 static const struct ctl_table nf_ct_sysctl_table[] = {
643 [NF_SYSCTL_CT_MAX] = {
644 .procname = "nf_conntrack_max",
645 .data = &nf_conntrack_max,
646 .maxlen = sizeof(int),
647 .mode = 0644,
648 .proc_handler = proc_dointvec_minmax,
649 .extra1 = SYSCTL_ONE,
650 .extra2 = SYSCTL_INT_MAX,
651 },
652 [NF_SYSCTL_CT_COUNT] = {
653 .procname = "nf_conntrack_count",
654 .maxlen = sizeof(int),
655 .mode = 0444,
656 .proc_handler = proc_dointvec,
657 },
658 [NF_SYSCTL_CT_BUCKETS] = {
659 .procname = "nf_conntrack_buckets",
660 .data = &nf_conntrack_htable_size_user,
661 .maxlen = sizeof(unsigned int),
662 .mode = 0644,
663 .proc_handler = nf_conntrack_hash_sysctl,
664 },
665 [NF_SYSCTL_CT_CHECKSUM] = {
666 .procname = "nf_conntrack_checksum",
667 .data = &init_net.ct.sysctl_checksum,
668 .maxlen = sizeof(u8),
669 .mode = 0644,
670 .proc_handler = proc_dou8vec_minmax,
671 .extra1 = SYSCTL_ZERO,
672 .extra2 = SYSCTL_ONE,
673 },
674 [NF_SYSCTL_CT_LOG_INVALID] = {
675 .procname = "nf_conntrack_log_invalid",
676 .data = &init_net.ct.sysctl_log_invalid,
677 .maxlen = sizeof(u8),
678 .mode = 0644,
679 .proc_handler = nf_conntrack_log_invalid_sysctl,
680 },
681 [NF_SYSCTL_CT_EXPECT_MAX] = {
682 .procname = "nf_conntrack_expect_max",
683 .data = &nf_ct_expect_max,
684 .maxlen = sizeof(int),
685 .mode = 0644,
686 .proc_handler = proc_dointvec_minmax,
687 .extra1 = SYSCTL_ONE,
688 .extra2 = SYSCTL_INT_MAX,
689 },
690 [NF_SYSCTL_CT_ACCT] = {
691 .procname = "nf_conntrack_acct",
692 .data = &init_net.ct.sysctl_acct,
693 .maxlen = sizeof(u8),
694 .mode = 0644,
695 .proc_handler = proc_dou8vec_minmax,
696 .extra1 = SYSCTL_ZERO,
697 .extra2 = SYSCTL_ONE,
698 },
699 #ifdef CONFIG_NF_CONNTRACK_EVENTS
700 [NF_SYSCTL_CT_EVENTS] = {
701 .procname = "nf_conntrack_events",
702 .data = &init_net.ct.sysctl_events,
703 .maxlen = sizeof(u8),
704 .mode = 0644,
705 .proc_handler = proc_dou8vec_minmax,
706 .extra1 = SYSCTL_ZERO,
707 .extra2 = SYSCTL_TWO,
708 },
709 #endif
710 #ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
711 [NF_SYSCTL_CT_TIMESTAMP] = {
712 .procname = "nf_conntrack_timestamp",
713 .data = &init_net.ct.sysctl_tstamp,
714 .maxlen = sizeof(u8),
715 .mode = 0644,
716 .proc_handler = proc_dou8vec_minmax,
717 .extra1 = SYSCTL_ZERO,
718 .extra2 = SYSCTL_ONE,
719 },
720 #endif
721 [NF_SYSCTL_CT_PROTO_TIMEOUT_GENERIC] = {
722 .procname = "nf_conntrack_generic_timeout",
723 .maxlen = sizeof(unsigned int),
724 .mode = 0644,
725 .proc_handler = proc_dointvec_jiffies,
726 },
727 [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_SYN_SENT] = {
728 .procname = "nf_conntrack_tcp_timeout_syn_sent",
729 .maxlen = sizeof(unsigned int),
730 .mode = 0644,
731 .proc_handler = proc_dointvec_jiffies,
732 },
733 [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_SYN_RECV] = {
734 .procname = "nf_conntrack_tcp_timeout_syn_recv",
735 .maxlen = sizeof(unsigned int),
736 .mode = 0644,
737 .proc_handler = proc_dointvec_jiffies,
738 },
739 [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_ESTABLISHED] = {
740 .procname = "nf_conntrack_tcp_timeout_established",
741 .maxlen = sizeof(unsigned int),
742 .mode = 0644,
743 .proc_handler = proc_dointvec_jiffies,
744 },
745 [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_FIN_WAIT] = {
746 .procname = "nf_conntrack_tcp_timeout_fin_wait",
747 .maxlen = sizeof(unsigned int),
748 .mode = 0644,
749 .proc_handler = proc_dointvec_jiffies,
750 },
751 [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_CLOSE_WAIT] = {
752 .procname = "nf_conntrack_tcp_timeout_close_wait",
753 .maxlen = sizeof(unsigned int),
754 .mode = 0644,
755 .proc_handler = proc_dointvec_jiffies,
756 },
757 [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_LAST_ACK] = {
758 .procname = "nf_conntrack_tcp_timeout_last_ack",
759 .maxlen = sizeof(unsigned int),
760 .mode = 0644,
761 .proc_handler = proc_dointvec_jiffies,
762 },
763 [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_TIME_WAIT] = {
764 .procname = "nf_conntrack_tcp_timeout_time_wait",
765 .maxlen = sizeof(unsigned int),
766 .mode = 0644,
767 .proc_handler = proc_dointvec_jiffies,
768 },
769 [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_CLOSE] = {
770 .procname = "nf_conntrack_tcp_timeout_close",
771 .maxlen = sizeof(unsigned int),
772 .mode = 0644,
773 .proc_handler = proc_dointvec_jiffies,
774 },
775 [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_RETRANS] = {
776 .procname = "nf_conntrack_tcp_timeout_max_retrans",
777 .maxlen = sizeof(unsigned int),
778 .mode = 0644,
779 .proc_handler = proc_dointvec_jiffies,
780 },
781 [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_UNACK] = {
782 .procname = "nf_conntrack_tcp_timeout_unacknowledged",
783 .maxlen = sizeof(unsigned int),
784 .mode = 0644,
785 .proc_handler = proc_dointvec_jiffies,
786 },
787 #if IS_ENABLED(CONFIG_NF_FLOW_TABLE)
788 [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_OFFLOAD] = {
789 .procname = "nf_flowtable_tcp_timeout",
790 .maxlen = sizeof(unsigned int),
791 .mode = 0644,
792 .proc_handler = proc_dointvec_jiffies,
793 },
794 #endif
795 [NF_SYSCTL_CT_PROTO_TCP_LOOSE] = {
796 .procname = "nf_conntrack_tcp_loose",
797 .maxlen = sizeof(u8),
798 .mode = 0644,
799 .proc_handler = proc_dou8vec_minmax,
800 .extra1 = SYSCTL_ZERO,
801 .extra2 = SYSCTL_ONE,
802 },
803 [NF_SYSCTL_CT_PROTO_TCP_LIBERAL] = {
804 .procname = "nf_conntrack_tcp_be_liberal",
805 .maxlen = sizeof(u8),
806 .mode = 0644,
807 .proc_handler = proc_dou8vec_minmax,
808 .extra1 = SYSCTL_ZERO,
809 .extra2 = SYSCTL_ONE,
810 },
811 [NF_SYSCTL_CT_PROTO_TCP_IGNORE_INVALID_RST] = {
812 .procname = "nf_conntrack_tcp_ignore_invalid_rst",
813 .maxlen = sizeof(u8),
814 .mode = 0644,
815 .proc_handler = proc_dou8vec_minmax,
816 .extra1 = SYSCTL_ZERO,
817 .extra2 = SYSCTL_ONE,
818 },
819 [NF_SYSCTL_CT_PROTO_TCP_MAX_RETRANS] = {
820 .procname = "nf_conntrack_tcp_max_retrans",
821 .maxlen = sizeof(u8),
822 .mode = 0644,
823 .proc_handler = proc_dou8vec_minmax,
824 },
825 [NF_SYSCTL_CT_PROTO_TIMEOUT_UDP] = {
826 .procname = "nf_conntrack_udp_timeout",
827 .maxlen = sizeof(unsigned int),
828 .mode = 0644,
829 .proc_handler = proc_dointvec_jiffies,
830 },
831 [NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_STREAM] = {
832 .procname = "nf_conntrack_udp_timeout_stream",
833 .maxlen = sizeof(unsigned int),
834 .mode = 0644,
835 .proc_handler = proc_dointvec_jiffies,
836 },
837 #if IS_ENABLED(CONFIG_NF_FLOW_TABLE)
838 [NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_OFFLOAD] = {
839 .procname = "nf_flowtable_udp_timeout",
840 .maxlen = sizeof(unsigned int),
841 .mode = 0644,
842 .proc_handler = proc_dointvec_jiffies,
843 },
844 #endif
845 [NF_SYSCTL_CT_PROTO_TIMEOUT_ICMP] = {
846 .procname = "nf_conntrack_icmp_timeout",
847 .maxlen = sizeof(unsigned int),
848 .mode = 0644,
849 .proc_handler = proc_dointvec_jiffies,
850 },
851 [NF_SYSCTL_CT_PROTO_TIMEOUT_ICMPV6] = {
852 .procname = "nf_conntrack_icmpv6_timeout",
853 .maxlen = sizeof(unsigned int),
854 .mode = 0644,
855 .proc_handler = proc_dointvec_jiffies,
856 },
857 #ifdef CONFIG_NF_CT_PROTO_SCTP
858 [NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_CLOSED] = {
859 .procname = "nf_conntrack_sctp_timeout_closed",
860 .maxlen = sizeof(unsigned int),
861 .mode = 0644,
862 .proc_handler = proc_dointvec_jiffies,
863 },
864 [NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_COOKIE_WAIT] = {
865 .procname = "nf_conntrack_sctp_timeout_cookie_wait",
866 .maxlen = sizeof(unsigned int),
867 .mode = 0644,
868 .proc_handler = proc_dointvec_jiffies,
869 },
870 [NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_COOKIE_ECHOED] = {
871 .procname = "nf_conntrack_sctp_timeout_cookie_echoed",
872 .maxlen = sizeof(unsigned int),
873 .mode = 0644,
874 .proc_handler = proc_dointvec_jiffies,
875 },
876 [NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_ESTABLISHED] = {
877 .procname = "nf_conntrack_sctp_timeout_established",
878 .maxlen = sizeof(unsigned int),
879 .mode = 0644,
880 .proc_handler = proc_dointvec_jiffies,
881 },
882 [NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_SHUTDOWN_SENT] = {
883 .procname = "nf_conntrack_sctp_timeout_shutdown_sent",
884 .maxlen = sizeof(unsigned int),
885 .mode = 0644,
886 .proc_handler = proc_dointvec_jiffies,
887 },
888 [NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_SHUTDOWN_RECD] = {
889 .procname = "nf_conntrack_sctp_timeout_shutdown_recd",
890 .maxlen = sizeof(unsigned int),
891 .mode = 0644,
892 .proc_handler = proc_dointvec_jiffies,
893 },
894 [NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_SHUTDOWN_ACK_SENT] = {
895 .procname = "nf_conntrack_sctp_timeout_shutdown_ack_sent",
896 .maxlen = sizeof(unsigned int),
897 .mode = 0644,
898 .proc_handler = proc_dointvec_jiffies,
899 },
900 [NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_HEARTBEAT_SENT] = {
901 .procname = "nf_conntrack_sctp_timeout_heartbeat_sent",
902 .maxlen = sizeof(unsigned int),
903 .mode = 0644,
904 .proc_handler = proc_dointvec_jiffies,
905 },
906 #endif
907 #ifdef CONFIG_NF_CT_PROTO_GRE
908 [NF_SYSCTL_CT_PROTO_TIMEOUT_GRE] = {
909 .procname = "nf_conntrack_gre_timeout",
910 .maxlen = sizeof(unsigned int),
911 .mode = 0644,
912 .proc_handler = proc_dointvec_jiffies,
913 },
914 [NF_SYSCTL_CT_PROTO_TIMEOUT_GRE_STREAM] = {
915 .procname = "nf_conntrack_gre_timeout_stream",
916 .maxlen = sizeof(unsigned int),
917 .mode = 0644,
918 .proc_handler = proc_dointvec_jiffies,
919 },
920 #endif
921 };
922
923 static struct ctl_table nf_ct_netfilter_table[] = {
924 {
925 .procname = "nf_conntrack_max",
926 .data = &nf_conntrack_max,
927 .maxlen = sizeof(int),
928 .mode = 0644,
929 .proc_handler = proc_dointvec_minmax,
930 .extra1 = SYSCTL_ONE,
931 .extra2 = SYSCTL_INT_MAX,
932 },
933 };
934
nf_conntrack_standalone_init_tcp_sysctl(struct net * net,struct ctl_table * table)935 static void nf_conntrack_standalone_init_tcp_sysctl(struct net *net,
936 struct ctl_table *table)
937 {
938 struct nf_tcp_net *tn = nf_tcp_pernet(net);
939
940 #define XASSIGN(XNAME, tn) \
941 table[NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_ ## XNAME].data = \
942 &(tn)->timeouts[TCP_CONNTRACK_ ## XNAME]
943
944 XASSIGN(SYN_SENT, tn);
945 XASSIGN(SYN_RECV, tn);
946 XASSIGN(ESTABLISHED, tn);
947 XASSIGN(FIN_WAIT, tn);
948 XASSIGN(CLOSE_WAIT, tn);
949 XASSIGN(LAST_ACK, tn);
950 XASSIGN(TIME_WAIT, tn);
951 XASSIGN(CLOSE, tn);
952 XASSIGN(RETRANS, tn);
953 XASSIGN(UNACK, tn);
954 #undef XASSIGN
955 #define XASSIGN(XNAME, rval) \
956 table[NF_SYSCTL_CT_PROTO_TCP_ ## XNAME].data = (rval)
957
958 XASSIGN(LOOSE, &tn->tcp_loose);
959 XASSIGN(LIBERAL, &tn->tcp_be_liberal);
960 XASSIGN(MAX_RETRANS, &tn->tcp_max_retrans);
961 XASSIGN(IGNORE_INVALID_RST, &tn->tcp_ignore_invalid_rst);
962 #undef XASSIGN
963
964 #if IS_ENABLED(CONFIG_NF_FLOW_TABLE)
965 table[NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_OFFLOAD].data = &tn->offload_timeout;
966 #endif
967
968 }
969
nf_conntrack_standalone_init_sctp_sysctl(struct net * net,struct ctl_table * table)970 static void nf_conntrack_standalone_init_sctp_sysctl(struct net *net,
971 struct ctl_table *table)
972 {
973 #ifdef CONFIG_NF_CT_PROTO_SCTP
974 struct nf_sctp_net *sn = nf_sctp_pernet(net);
975
976 #define XASSIGN(XNAME, sn) \
977 table[NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_ ## XNAME].data = \
978 &(sn)->timeouts[SCTP_CONNTRACK_ ## XNAME]
979
980 XASSIGN(CLOSED, sn);
981 XASSIGN(COOKIE_WAIT, sn);
982 XASSIGN(COOKIE_ECHOED, sn);
983 XASSIGN(ESTABLISHED, sn);
984 XASSIGN(SHUTDOWN_SENT, sn);
985 XASSIGN(SHUTDOWN_RECD, sn);
986 XASSIGN(SHUTDOWN_ACK_SENT, sn);
987 XASSIGN(HEARTBEAT_SENT, sn);
988 #undef XASSIGN
989 #endif
990 }
991
nf_conntrack_standalone_init_gre_sysctl(struct net * net,struct ctl_table * table)992 static void nf_conntrack_standalone_init_gre_sysctl(struct net *net,
993 struct ctl_table *table)
994 {
995 #ifdef CONFIG_NF_CT_PROTO_GRE
996 struct nf_gre_net *gn = nf_gre_pernet(net);
997
998 table[NF_SYSCTL_CT_PROTO_TIMEOUT_GRE].data = &gn->timeouts[GRE_CT_UNREPLIED];
999 table[NF_SYSCTL_CT_PROTO_TIMEOUT_GRE_STREAM].data = &gn->timeouts[GRE_CT_REPLIED];
1000 #endif
1001 }
1002
nf_conntrack_standalone_init_sysctl(struct net * net)1003 static int nf_conntrack_standalone_init_sysctl(struct net *net)
1004 {
1005 struct nf_conntrack_net *cnet = nf_ct_pernet(net);
1006 struct nf_udp_net *un = nf_udp_pernet(net);
1007 struct ctl_table *table;
1008
1009 BUILD_BUG_ON(ARRAY_SIZE(nf_ct_sysctl_table) != NF_SYSCTL_CT_LAST_SYSCTL);
1010
1011 table = kmemdup(nf_ct_sysctl_table, sizeof(nf_ct_sysctl_table),
1012 GFP_KERNEL);
1013 if (!table)
1014 return -ENOMEM;
1015
1016 table[NF_SYSCTL_CT_COUNT].data = &cnet->count;
1017 table[NF_SYSCTL_CT_CHECKSUM].data = &net->ct.sysctl_checksum;
1018 table[NF_SYSCTL_CT_LOG_INVALID].data = &net->ct.sysctl_log_invalid;
1019 table[NF_SYSCTL_CT_ACCT].data = &net->ct.sysctl_acct;
1020 #ifdef CONFIG_NF_CONNTRACK_EVENTS
1021 table[NF_SYSCTL_CT_EVENTS].data = &net->ct.sysctl_events;
1022 #endif
1023 #ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
1024 table[NF_SYSCTL_CT_TIMESTAMP].data = &net->ct.sysctl_tstamp;
1025 #endif
1026 table[NF_SYSCTL_CT_PROTO_TIMEOUT_GENERIC].data = &nf_generic_pernet(net)->timeout;
1027 table[NF_SYSCTL_CT_PROTO_TIMEOUT_ICMP].data = &nf_icmp_pernet(net)->timeout;
1028 table[NF_SYSCTL_CT_PROTO_TIMEOUT_ICMPV6].data = &nf_icmpv6_pernet(net)->timeout;
1029 table[NF_SYSCTL_CT_PROTO_TIMEOUT_UDP].data = &un->timeouts[UDP_CT_UNREPLIED];
1030 table[NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_STREAM].data = &un->timeouts[UDP_CT_REPLIED];
1031 #if IS_ENABLED(CONFIG_NF_FLOW_TABLE)
1032 table[NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_OFFLOAD].data = &un->offload_timeout;
1033 #endif
1034
1035 nf_conntrack_standalone_init_tcp_sysctl(net, table);
1036 nf_conntrack_standalone_init_sctp_sysctl(net, table);
1037 nf_conntrack_standalone_init_gre_sysctl(net, table);
1038
1039 /* Don't allow non-init_net ns to alter global sysctls */
1040 if (!net_eq(&init_net, net)) {
1041 table[NF_SYSCTL_CT_MAX].mode = 0444;
1042 table[NF_SYSCTL_CT_EXPECT_MAX].mode = 0444;
1043 table[NF_SYSCTL_CT_BUCKETS].mode = 0444;
1044 }
1045
1046 cnet->sysctl_header = register_net_sysctl_sz(net, "net/netfilter",
1047 table,
1048 ARRAY_SIZE(nf_ct_sysctl_table));
1049 if (!cnet->sysctl_header)
1050 goto out_unregister_netfilter;
1051
1052 return 0;
1053
1054 out_unregister_netfilter:
1055 kfree(table);
1056 return -ENOMEM;
1057 }
1058
nf_conntrack_standalone_fini_sysctl(struct net * net)1059 static void nf_conntrack_standalone_fini_sysctl(struct net *net)
1060 {
1061 struct nf_conntrack_net *cnet = nf_ct_pernet(net);
1062 const struct ctl_table *table;
1063
1064 table = cnet->sysctl_header->ctl_table_arg;
1065 unregister_net_sysctl_table(cnet->sysctl_header);
1066 kfree(table);
1067 }
1068 #else
nf_conntrack_standalone_init_sysctl(struct net * net)1069 static int nf_conntrack_standalone_init_sysctl(struct net *net)
1070 {
1071 return 0;
1072 }
1073
nf_conntrack_standalone_fini_sysctl(struct net * net)1074 static void nf_conntrack_standalone_fini_sysctl(struct net *net)
1075 {
1076 }
1077 #endif /* CONFIG_SYSCTL */
1078
nf_conntrack_fini_net(struct net * net)1079 static void nf_conntrack_fini_net(struct net *net)
1080 {
1081 if (enable_hooks)
1082 nf_ct_netns_put(net, NFPROTO_INET);
1083
1084 nf_conntrack_standalone_fini_proc(net);
1085 nf_conntrack_standalone_fini_sysctl(net);
1086 }
1087
nf_conntrack_pernet_init(struct net * net)1088 static int nf_conntrack_pernet_init(struct net *net)
1089 {
1090 int ret;
1091
1092 net->ct.sysctl_checksum = 1;
1093
1094 ret = nf_conntrack_standalone_init_sysctl(net);
1095 if (ret < 0)
1096 return ret;
1097
1098 ret = nf_conntrack_standalone_init_proc(net);
1099 if (ret < 0)
1100 goto out_proc;
1101
1102 ret = nf_conntrack_init_net(net);
1103 if (ret < 0)
1104 goto out_init_net;
1105
1106 if (enable_hooks) {
1107 ret = nf_ct_netns_get(net, NFPROTO_INET);
1108 if (ret < 0)
1109 goto out_hooks;
1110 }
1111
1112 return 0;
1113
1114 out_hooks:
1115 nf_conntrack_cleanup_net(net);
1116 out_init_net:
1117 nf_conntrack_standalone_fini_proc(net);
1118 out_proc:
1119 nf_conntrack_standalone_fini_sysctl(net);
1120 return ret;
1121 }
1122
nf_conntrack_pernet_exit(struct list_head * net_exit_list)1123 static void nf_conntrack_pernet_exit(struct list_head *net_exit_list)
1124 {
1125 struct net *net;
1126
1127 list_for_each_entry(net, net_exit_list, exit_list)
1128 nf_conntrack_fini_net(net);
1129
1130 nf_conntrack_cleanup_net_list(net_exit_list);
1131 }
1132
1133 static struct pernet_operations nf_conntrack_net_ops = {
1134 .init = nf_conntrack_pernet_init,
1135 .exit_batch = nf_conntrack_pernet_exit,
1136 .id = &nf_conntrack_net_id,
1137 .size = sizeof(struct nf_conntrack_net),
1138 };
1139
nf_conntrack_standalone_init(void)1140 static int __init nf_conntrack_standalone_init(void)
1141 {
1142 int ret = nf_conntrack_init_start();
1143 if (ret < 0)
1144 goto out_start;
1145
1146 BUILD_BUG_ON(NFCT_INFOMASK <= IP_CT_NUMBER);
1147
1148 #ifdef CONFIG_SYSCTL
1149 nf_ct_netfilter_header =
1150 register_net_sysctl(&init_net, "net", nf_ct_netfilter_table);
1151 if (!nf_ct_netfilter_header) {
1152 pr_err("nf_conntrack: can't register to sysctl.\n");
1153 ret = -ENOMEM;
1154 goto out_sysctl;
1155 }
1156
1157 nf_conntrack_htable_size_user = nf_conntrack_htable_size;
1158 #endif
1159
1160 nf_conntrack_init_end();
1161
1162 ret = register_pernet_subsys(&nf_conntrack_net_ops);
1163 if (ret < 0)
1164 goto out_pernet;
1165
1166 return 0;
1167
1168 out_pernet:
1169 #ifdef CONFIG_SYSCTL
1170 unregister_net_sysctl_table(nf_ct_netfilter_header);
1171 out_sysctl:
1172 #endif
1173 nf_conntrack_cleanup_end();
1174 out_start:
1175 return ret;
1176 }
1177
nf_conntrack_standalone_fini(void)1178 static void __exit nf_conntrack_standalone_fini(void)
1179 {
1180 nf_conntrack_cleanup_start();
1181 unregister_pernet_subsys(&nf_conntrack_net_ops);
1182 #ifdef CONFIG_SYSCTL
1183 unregister_net_sysctl_table(nf_ct_netfilter_header);
1184 #endif
1185 nf_conntrack_cleanup_end();
1186 }
1187
1188 module_init(nf_conntrack_standalone_init);
1189 module_exit(nf_conntrack_standalone_fini);
1190