blob: 02eaf87227780e1dda279cdcff7c8551ea05caf1 [file] [log] [blame]
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001/* (C) 1999-2001 Paul `Rusty' Russell
2 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08007 */
8
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08009#include <linux/types.h>
10#include <linux/netfilter.h>
11#include <linux/module.h>
12#include <linux/skbuff.h>
13#include <linux/proc_fs.h>
14#include <linux/seq_file.h>
15#include <linux/percpu.h>
16#include <linux/netdevice.h>
Eric W. Biederman457c4cb2007-09-12 12:01:34 +020017#include <net/net_namespace.h>
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080018#ifdef CONFIG_SYSCTL
19#include <linux/sysctl.h>
20#endif
21
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080022#include <net/netfilter/nf_conntrack.h>
Martin Josefssonf6180122006-11-29 02:35:01 +010023#include <net/netfilter/nf_conntrack_core.h>
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080024#include <net/netfilter/nf_conntrack_l3proto.h>
Martin Josefsson605dcad2006-11-29 02:35:06 +010025#include <net/netfilter/nf_conntrack_l4proto.h>
Martin Josefsson77ab9cf2006-11-29 02:34:58 +010026#include <net/netfilter/nf_conntrack_expect.h>
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080027#include <net/netfilter/nf_conntrack_helper.h>
Krzysztof Piotr Oledzki58401572008-07-21 10:01:34 -070028#include <net/netfilter/nf_conntrack_acct.h>
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080029
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080030MODULE_LICENSE("GPL");
31
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080032#ifdef CONFIG_PROC_FS
Martin Josefsson77ab9cf2006-11-29 02:34:58 +010033int
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080034print_tuple(struct seq_file *s, const struct nf_conntrack_tuple *tuple,
Jan Engelhardt32948582008-01-31 04:53:24 -080035 const struct nf_conntrack_l3proto *l3proto,
36 const struct nf_conntrack_l4proto *l4proto)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080037{
Martin Josefsson605dcad2006-11-29 02:35:06 +010038 return l3proto->print_tuple(s, tuple) || l4proto->print_tuple(s, tuple);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080039}
Patrick McHardye4bd8bc2006-11-29 02:35:22 +010040EXPORT_SYMBOL_GPL(print_tuple);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080041
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080042struct ct_iter_state {
Alexey Dobriyanb2ce2c72008-10-08 11:35:05 +020043 struct seq_net_private p;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080044 unsigned int bucket;
45};
46
Patrick McHardyf205c5e2007-07-07 22:28:14 -070047static struct hlist_node *ct_get_first(struct seq_file *seq)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080048{
Alexey Dobriyanb2ce2c72008-10-08 11:35:05 +020049 struct net *net = seq_file_net(seq);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080050 struct ct_iter_state *st = seq->private;
Patrick McHardy76507f62008-01-31 04:38:38 -080051 struct hlist_node *n;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080052
53 for (st->bucket = 0;
54 st->bucket < nf_conntrack_htable_size;
55 st->bucket++) {
Alexey Dobriyanb2ce2c72008-10-08 11:35:05 +020056 n = rcu_dereference(net->ct.hash[st->bucket].first);
Patrick McHardy76507f62008-01-31 04:38:38 -080057 if (n)
58 return n;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080059 }
60 return NULL;
61}
62
Patrick McHardyf205c5e2007-07-07 22:28:14 -070063static struct hlist_node *ct_get_next(struct seq_file *seq,
64 struct hlist_node *head)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080065{
Alexey Dobriyanb2ce2c72008-10-08 11:35:05 +020066 struct net *net = seq_file_net(seq);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080067 struct ct_iter_state *st = seq->private;
68
Patrick McHardy76507f62008-01-31 04:38:38 -080069 head = rcu_dereference(head->next);
Patrick McHardyf205c5e2007-07-07 22:28:14 -070070 while (head == NULL) {
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080071 if (++st->bucket >= nf_conntrack_htable_size)
72 return NULL;
Alexey Dobriyanb2ce2c72008-10-08 11:35:05 +020073 head = rcu_dereference(net->ct.hash[st->bucket].first);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080074 }
75 return head;
76}
77
Patrick McHardyf205c5e2007-07-07 22:28:14 -070078static struct hlist_node *ct_get_idx(struct seq_file *seq, loff_t pos)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080079{
Patrick McHardyf205c5e2007-07-07 22:28:14 -070080 struct hlist_node *head = ct_get_first(seq);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080081
82 if (head)
83 while (pos && (head = ct_get_next(seq, head)))
84 pos--;
85 return pos ? NULL : head;
86}
87
88static void *ct_seq_start(struct seq_file *seq, loff_t *pos)
Patrick McHardy76507f62008-01-31 04:38:38 -080089 __acquires(RCU)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080090{
Patrick McHardy76507f62008-01-31 04:38:38 -080091 rcu_read_lock();
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080092 return ct_get_idx(seq, *pos);
93}
94
95static void *ct_seq_next(struct seq_file *s, void *v, loff_t *pos)
96{
97 (*pos)++;
98 return ct_get_next(s, v);
99}
100
101static void ct_seq_stop(struct seq_file *s, void *v)
Patrick McHardy76507f62008-01-31 04:38:38 -0800102 __releases(RCU)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800103{
Patrick McHardy76507f62008-01-31 04:38:38 -0800104 rcu_read_unlock();
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800105}
106
107/* return 0 on success, 1 in case of error */
108static int ct_seq_show(struct seq_file *s, void *v)
109{
110 const struct nf_conntrack_tuple_hash *hash = v;
Patrick McHardyc88130b2008-01-31 04:42:11 -0800111 const struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(hash);
Jan Engelhardt32948582008-01-31 04:53:24 -0800112 const struct nf_conntrack_l3proto *l3proto;
113 const struct nf_conntrack_l4proto *l4proto;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800114
Patrick McHardyc88130b2008-01-31 04:42:11 -0800115 NF_CT_ASSERT(ct);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800116
117 /* we only want to print DIR_ORIGINAL */
118 if (NF_CT_DIRECTION(hash))
119 return 0;
120
Patrick McHardy5e8fbe22008-04-14 11:15:52 +0200121 l3proto = __nf_ct_l3proto_find(nf_ct_l3num(ct));
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800122 NF_CT_ASSERT(l3proto);
Patrick McHardy5e8fbe22008-04-14 11:15:52 +0200123 l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
Martin Josefsson605dcad2006-11-29 02:35:06 +0100124 NF_CT_ASSERT(l4proto);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800125
126 if (seq_printf(s, "%-8s %u %-8s %u %ld ",
Patrick McHardy5e8fbe22008-04-14 11:15:52 +0200127 l3proto->name, nf_ct_l3num(ct),
128 l4proto->name, nf_ct_protonum(ct),
Patrick McHardyc88130b2008-01-31 04:42:11 -0800129 timer_pending(&ct->timeout)
130 ? (long)(ct->timeout.expires - jiffies)/HZ : 0) != 0)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800131 return -ENOSPC;
132
Patrick McHardyc88130b2008-01-31 04:42:11 -0800133 if (l4proto->print_conntrack && l4proto->print_conntrack(s, ct))
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800134 return -ENOSPC;
135
Patrick McHardyc88130b2008-01-31 04:42:11 -0800136 if (print_tuple(s, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
Martin Josefsson605dcad2006-11-29 02:35:06 +0100137 l3proto, l4proto))
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800138 return -ENOSPC;
139
Krzysztof Piotr Oledzki58401572008-07-21 10:01:34 -0700140 if (seq_print_acct(s, ct, IP_CT_DIR_ORIGINAL))
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800141 return -ENOSPC;
142
Patrick McHardyc88130b2008-01-31 04:42:11 -0800143 if (!(test_bit(IPS_SEEN_REPLY_BIT, &ct->status)))
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800144 if (seq_printf(s, "[UNREPLIED] "))
145 return -ENOSPC;
146
Patrick McHardyc88130b2008-01-31 04:42:11 -0800147 if (print_tuple(s, &ct->tuplehash[IP_CT_DIR_REPLY].tuple,
Martin Josefsson605dcad2006-11-29 02:35:06 +0100148 l3proto, l4proto))
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800149 return -ENOSPC;
150
Krzysztof Piotr Oledzki58401572008-07-21 10:01:34 -0700151 if (seq_print_acct(s, ct, IP_CT_DIR_REPLY))
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800152 return -ENOSPC;
153
Patrick McHardyc88130b2008-01-31 04:42:11 -0800154 if (test_bit(IPS_ASSURED_BIT, &ct->status))
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800155 if (seq_printf(s, "[ASSURED] "))
156 return -ENOSPC;
157
158#if defined(CONFIG_NF_CONNTRACK_MARK)
Patrick McHardyc88130b2008-01-31 04:42:11 -0800159 if (seq_printf(s, "mark=%u ", ct->mark))
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800160 return -ENOSPC;
161#endif
162
James Morris7c9728c2006-06-09 00:31:46 -0700163#ifdef CONFIG_NF_CONNTRACK_SECMARK
Patrick McHardyc88130b2008-01-31 04:42:11 -0800164 if (seq_printf(s, "secmark=%u ", ct->secmark))
James Morris7c9728c2006-06-09 00:31:46 -0700165 return -ENOSPC;
166#endif
167
Patrick McHardyc88130b2008-01-31 04:42:11 -0800168 if (seq_printf(s, "use=%u\n", atomic_read(&ct->ct_general.use)))
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800169 return -ENOSPC;
YOSHIFUJI Hideakia5d29262007-07-19 10:44:21 +0900170
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800171 return 0;
172}
173
Philippe De Muyter56b3d972007-07-10 23:07:31 -0700174static const struct seq_operations ct_seq_ops = {
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800175 .start = ct_seq_start,
176 .next = ct_seq_next,
177 .stop = ct_seq_stop,
178 .show = ct_seq_show
179};
180
181static int ct_open(struct inode *inode, struct file *file)
182{
Alexey Dobriyanb2ce2c72008-10-08 11:35:05 +0200183 return seq_open_net(inode, file, &ct_seq_ops,
Pavel Emelyanove2da5912007-10-10 02:29:58 -0700184 sizeof(struct ct_iter_state));
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800185}
186
Arjan van de Venda7071d2007-02-12 00:55:36 -0800187static const struct file_operations ct_file_ops = {
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800188 .owner = THIS_MODULE,
189 .open = ct_open,
190 .read = seq_read,
191 .llseek = seq_lseek,
Alexey Dobriyanb2ce2c72008-10-08 11:35:05 +0200192 .release = seq_release_net,
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800193};
194
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800195static void *ct_cpu_seq_start(struct seq_file *seq, loff_t *pos)
196{
197 int cpu;
198
199 if (*pos == 0)
200 return SEQ_START_TOKEN;
201
202 for (cpu = *pos-1; cpu < NR_CPUS; ++cpu) {
203 if (!cpu_possible(cpu))
204 continue;
205 *pos = cpu + 1;
206 return &per_cpu(nf_conntrack_stat, cpu);
207 }
208
209 return NULL;
210}
211
212static void *ct_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
213{
214 int cpu;
215
216 for (cpu = *pos; cpu < NR_CPUS; ++cpu) {
217 if (!cpu_possible(cpu))
218 continue;
219 *pos = cpu + 1;
220 return &per_cpu(nf_conntrack_stat, cpu);
221 }
222
223 return NULL;
224}
225
226static void ct_cpu_seq_stop(struct seq_file *seq, void *v)
227{
228}
229
230static int ct_cpu_seq_show(struct seq_file *seq, void *v)
231{
Alexey Dobriyan49ac8712008-10-08 11:35:03 +0200232 unsigned int nr_conntracks = atomic_read(&init_net.ct.count);
Jan Engelhardt32948582008-01-31 04:53:24 -0800233 const struct ip_conntrack_stat *st = v;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800234
235 if (v == SEQ_START_TOKEN) {
236 seq_printf(seq, "entries searched found new invalid ignore delete delete_list insert insert_failed drop early_drop icmp_error expect_new expect_create expect_delete\n");
237 return 0;
238 }
239
240 seq_printf(seq, "%08x %08x %08x %08x %08x %08x %08x %08x "
241 "%08x %08x %08x %08x %08x %08x %08x %08x \n",
242 nr_conntracks,
243 st->searched,
244 st->found,
245 st->new,
246 st->invalid,
247 st->ignore,
248 st->delete,
249 st->delete_list,
250 st->insert,
251 st->insert_failed,
252 st->drop,
253 st->early_drop,
254 st->error,
255
256 st->expect_new,
257 st->expect_create,
258 st->expect_delete
259 );
260 return 0;
261}
262
Philippe De Muyter56b3d972007-07-10 23:07:31 -0700263static const struct seq_operations ct_cpu_seq_ops = {
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800264 .start = ct_cpu_seq_start,
265 .next = ct_cpu_seq_next,
266 .stop = ct_cpu_seq_stop,
267 .show = ct_cpu_seq_show,
268};
269
270static int ct_cpu_seq_open(struct inode *inode, struct file *file)
271{
272 return seq_open(file, &ct_cpu_seq_ops);
273}
274
Arjan van de Venda7071d2007-02-12 00:55:36 -0800275static const struct file_operations ct_cpu_seq_fops = {
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800276 .owner = THIS_MODULE,
277 .open = ct_cpu_seq_open,
278 .read = seq_read,
279 .llseek = seq_lseek,
Pavel Emelyanov665bba12008-02-29 11:39:17 -0800280 .release = seq_release,
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800281};
Alexey Dobriyanb916f7d2008-03-20 15:15:43 +0100282
Alexey Dobriyanb2ce2c72008-10-08 11:35:05 +0200283static int nf_conntrack_standalone_init_proc(struct net *net)
Alexey Dobriyanb916f7d2008-03-20 15:15:43 +0100284{
285 struct proc_dir_entry *pde;
286
Alexey Dobriyanb2ce2c72008-10-08 11:35:05 +0200287 pde = proc_net_fops_create(net, "nf_conntrack", 0440, &ct_file_ops);
Alexey Dobriyanb916f7d2008-03-20 15:15:43 +0100288 if (!pde)
289 goto out_nf_conntrack;
Denis V. Lunev52c0e112008-05-02 04:10:57 -0700290
Alexey Dobriyanb2ce2c72008-10-08 11:35:05 +0200291 pde = proc_create("nf_conntrack", S_IRUGO, net->proc_net_stat,
Denis V. Lunev52c0e112008-05-02 04:10:57 -0700292 &ct_cpu_seq_fops);
Alexey Dobriyanb916f7d2008-03-20 15:15:43 +0100293 if (!pde)
294 goto out_stat_nf_conntrack;
Alexey Dobriyanb916f7d2008-03-20 15:15:43 +0100295 return 0;
296
297out_stat_nf_conntrack:
Alexey Dobriyanb2ce2c72008-10-08 11:35:05 +0200298 proc_net_remove(net, "nf_conntrack");
Alexey Dobriyanb916f7d2008-03-20 15:15:43 +0100299out_nf_conntrack:
300 return -ENOMEM;
301}
302
Alexey Dobriyanb2ce2c72008-10-08 11:35:05 +0200303static void nf_conntrack_standalone_fini_proc(struct net *net)
Alexey Dobriyanb916f7d2008-03-20 15:15:43 +0100304{
Alexey Dobriyanb2ce2c72008-10-08 11:35:05 +0200305 remove_proc_entry("nf_conntrack", net->proc_net_stat);
306 proc_net_remove(net, "nf_conntrack");
Alexey Dobriyanb916f7d2008-03-20 15:15:43 +0100307}
308#else
Alexey Dobriyanb2ce2c72008-10-08 11:35:05 +0200309static int nf_conntrack_standalone_init_proc(struct net *net)
Alexey Dobriyanb916f7d2008-03-20 15:15:43 +0100310{
311 return 0;
312}
313
Alexey Dobriyanb2ce2c72008-10-08 11:35:05 +0200314static void nf_conntrack_standalone_fini_proc(struct net *net)
Alexey Dobriyanb916f7d2008-03-20 15:15:43 +0100315{
316}
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800317#endif /* CONFIG_PROC_FS */
318
319/* Sysctl support */
320
Brian Haley94aec082006-09-18 00:05:22 -0700321int nf_conntrack_checksum __read_mostly = 1;
Patrick McHardy13b18332006-12-02 22:11:25 -0800322EXPORT_SYMBOL_GPL(nf_conntrack_checksum);
Adrian Bunk72b55822006-07-24 22:53:12 -0700323
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800324#ifdef CONFIG_SYSCTL
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800325/* Log invalid packets of a given protocol */
326static int log_invalid_proto_min = 0;
327static int log_invalid_proto_max = 255;
328
329static struct ctl_table_header *nf_ct_sysctl_header;
Krzysztof Piotr Oledzki9714be72008-08-06 02:35:44 -0700330static struct ctl_table_header *nf_ct_netfilter_header;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800331
332static ctl_table nf_ct_sysctl_table[] = {
333 {
334 .ctl_name = NET_NF_CONNTRACK_MAX,
335 .procname = "nf_conntrack_max",
336 .data = &nf_conntrack_max,
337 .maxlen = sizeof(int),
338 .mode = 0644,
339 .proc_handler = &proc_dointvec,
340 },
341 {
342 .ctl_name = NET_NF_CONNTRACK_COUNT,
343 .procname = "nf_conntrack_count",
Alexey Dobriyan49ac8712008-10-08 11:35:03 +0200344 .data = &init_net.ct.count,
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800345 .maxlen = sizeof(int),
346 .mode = 0444,
347 .proc_handler = &proc_dointvec,
348 },
349 {
350 .ctl_name = NET_NF_CONNTRACK_BUCKETS,
351 .procname = "nf_conntrack_buckets",
352 .data = &nf_conntrack_htable_size,
353 .maxlen = sizeof(unsigned int),
354 .mode = 0444,
355 .proc_handler = &proc_dointvec,
356 },
357 {
Patrick McHardy39a27a32006-05-29 18:23:54 -0700358 .ctl_name = NET_NF_CONNTRACK_CHECKSUM,
359 .procname = "nf_conntrack_checksum",
360 .data = &nf_conntrack_checksum,
361 .maxlen = sizeof(unsigned int),
362 .mode = 0644,
363 .proc_handler = &proc_dointvec,
364 },
365 {
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800366 .ctl_name = NET_NF_CONNTRACK_LOG_INVALID,
367 .procname = "nf_conntrack_log_invalid",
368 .data = &nf_ct_log_invalid,
369 .maxlen = sizeof(unsigned int),
370 .mode = 0644,
371 .proc_handler = &proc_dointvec_minmax,
372 .strategy = &sysctl_intvec,
373 .extra1 = &log_invalid_proto_min,
374 .extra2 = &log_invalid_proto_max,
375 },
Patrick McHardyf264a7d2007-07-07 22:36:24 -0700376 {
377 .ctl_name = CTL_UNNUMBERED,
378 .procname = "nf_conntrack_expect_max",
379 .data = &nf_ct_expect_max,
380 .maxlen = sizeof(int),
381 .mode = 0644,
382 .proc_handler = &proc_dointvec,
383 },
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800384 { .ctl_name = 0 }
385};
386
387#define NET_NF_CONNTRACK_MAX 2089
388
389static ctl_table nf_ct_netfilter_table[] = {
390 {
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800391 .ctl_name = NET_NF_CONNTRACK_MAX,
392 .procname = "nf_conntrack_max",
393 .data = &nf_conntrack_max,
394 .maxlen = sizeof(int),
395 .mode = 0644,
396 .proc_handler = &proc_dointvec,
397 },
398 { .ctl_name = 0 }
399};
400
Patrick McHardy9e232492008-01-31 04:54:45 -0800401static struct ctl_path nf_ct_path[] = {
Pavel Emelyanov3d7cc2b2008-01-09 00:33:11 -0800402 { .procname = "net", .ctl_name = CTL_NET, },
403 { }
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800404};
Pavel Emelyanov3d7cc2b2008-01-09 00:33:11 -0800405
Patrick McHardy13b18332006-12-02 22:11:25 -0800406EXPORT_SYMBOL_GPL(nf_ct_log_invalid);
Alexey Dobriyanb916f7d2008-03-20 15:15:43 +0100407
408static int nf_conntrack_standalone_init_sysctl(void)
409{
Krzysztof Piotr Oledzki9714be72008-08-06 02:35:44 -0700410 nf_ct_netfilter_header =
Alexey Dobriyanb916f7d2008-03-20 15:15:43 +0100411 register_sysctl_paths(nf_ct_path, nf_ct_netfilter_table);
Krzysztof Piotr Oledzki9714be72008-08-06 02:35:44 -0700412 if (!nf_ct_netfilter_header)
413 goto out;
414
415 nf_ct_sysctl_header =
416 register_sysctl_paths(nf_net_netfilter_sysctl_path,
417 nf_ct_sysctl_table);
418 if (!nf_ct_sysctl_header)
419 goto out_unregister_netfilter;
420
Alexey Dobriyanb916f7d2008-03-20 15:15:43 +0100421 return 0;
422
Krzysztof Piotr Oledzki9714be72008-08-06 02:35:44 -0700423out_unregister_netfilter:
424 unregister_sysctl_table(nf_ct_netfilter_header);
425out:
426 printk("nf_conntrack: can't register to sysctl.\n");
427 return -ENOMEM;
Alexey Dobriyanb916f7d2008-03-20 15:15:43 +0100428}
429
430static void nf_conntrack_standalone_fini_sysctl(void)
431{
Krzysztof Piotr Oledzki9714be72008-08-06 02:35:44 -0700432 unregister_sysctl_table(nf_ct_netfilter_header);
Alexey Dobriyanb916f7d2008-03-20 15:15:43 +0100433 unregister_sysctl_table(nf_ct_sysctl_header);
434}
435#else
436static int nf_conntrack_standalone_init_sysctl(void)
437{
438 return 0;
439}
440
441static void nf_conntrack_standalone_fini_sysctl(void)
442{
443}
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800444#endif /* CONFIG_SYSCTL */
445
Alexey Dobriyandfdb8d72008-10-08 11:35:02 +0200446static int nf_conntrack_net_init(struct net *net)
447{
Alexey Dobriyanb2ce2c72008-10-08 11:35:05 +0200448 int ret;
449
450 ret = nf_conntrack_init(net);
451 if (ret < 0)
452 goto out_init;
453 ret = nf_conntrack_standalone_init_proc(net);
454 if (ret < 0)
455 goto out_proc;
456 return 0;
457
458out_proc:
459 nf_conntrack_cleanup(net);
460out_init:
461 return ret;
Alexey Dobriyandfdb8d72008-10-08 11:35:02 +0200462}
463
464static void nf_conntrack_net_exit(struct net *net)
465{
Alexey Dobriyanb2ce2c72008-10-08 11:35:05 +0200466 nf_conntrack_standalone_fini_proc(net);
Alexey Dobriyandfdb8d72008-10-08 11:35:02 +0200467 nf_conntrack_cleanup(net);
468}
469
470static struct pernet_operations nf_conntrack_net_ops = {
471 .init = nf_conntrack_net_init,
472 .exit = nf_conntrack_net_exit,
473};
474
Andrew Morton65b4b4e2006-03-28 16:37:06 -0800475static int __init nf_conntrack_standalone_init(void)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800476{
Alexey Dobriyanb916f7d2008-03-20 15:15:43 +0100477 int ret;
Patrick McHardy32292a72006-04-06 14:11:30 -0700478
Alexey Dobriyandfdb8d72008-10-08 11:35:02 +0200479 ret = register_pernet_subsys(&nf_conntrack_net_ops);
Patrick McHardy32292a72006-04-06 14:11:30 -0700480 if (ret < 0)
Alexey Dobriyanb916f7d2008-03-20 15:15:43 +0100481 goto out;
Alexey Dobriyanb916f7d2008-03-20 15:15:43 +0100482 ret = nf_conntrack_standalone_init_sysctl();
483 if (ret < 0)
484 goto out_sysctl;
485 return 0;
Patrick McHardy32292a72006-04-06 14:11:30 -0700486
Alexey Dobriyanb916f7d2008-03-20 15:15:43 +0100487out_sysctl:
Alexey Dobriyandfdb8d72008-10-08 11:35:02 +0200488 unregister_pernet_subsys(&nf_conntrack_net_ops);
Alexey Dobriyanb916f7d2008-03-20 15:15:43 +0100489out:
Patrick McHardy32292a72006-04-06 14:11:30 -0700490 return ret;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800491}
492
Andrew Morton65b4b4e2006-03-28 16:37:06 -0800493static void __exit nf_conntrack_standalone_fini(void)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800494{
Alexey Dobriyanb916f7d2008-03-20 15:15:43 +0100495 nf_conntrack_standalone_fini_sysctl();
Alexey Dobriyandfdb8d72008-10-08 11:35:02 +0200496 unregister_pernet_subsys(&nf_conntrack_net_ops);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800497}
498
Andrew Morton65b4b4e2006-03-28 16:37:06 -0800499module_init(nf_conntrack_standalone_init);
500module_exit(nf_conntrack_standalone_fini);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800501
502/* Some modules need us, but don't depend directly on any symbol.
503 They should call this. */
Harald Welte2e4e6a12006-01-12 13:30:04 -0800504void need_conntrack(void)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800505{
506}
Patrick McHardy13b18332006-12-02 22:11:25 -0800507EXPORT_SYMBOL_GPL(need_conntrack);