v2.4.9.9 -> v2.4.9.10
[opensuse:kernel.git] / net / ipv4 / netfilter / ip_conntrack_standalone.c
1 /* This file contains all the functions required for the standalone
2    ip_conntrack module.
3
4    These are not required by the compatibility layer.
5 */
6
7 /* (c) 1999 Paul `Rusty' Russell.  Licenced under the GNU General
8    Public Licence. */
9
10 #include <linux/types.h>
11 #include <linux/ip.h>
12 #include <linux/netfilter.h>
13 #include <linux/netfilter_ipv4.h>
14 #include <linux/module.h>
15 #include <linux/skbuff.h>
16 #include <linux/proc_fs.h>
17 #include <linux/version.h>
18 #include <net/checksum.h>
19
20 #define ASSERT_READ_LOCK(x) MUST_BE_READ_LOCKED(&ip_conntrack_lock)
21 #define ASSERT_WRITE_LOCK(x) MUST_BE_WRITE_LOCKED(&ip_conntrack_lock)
22
23 #include <linux/netfilter_ipv4/ip_conntrack.h>
24 #include <linux/netfilter_ipv4/ip_conntrack_protocol.h>
25 #include <linux/netfilter_ipv4/ip_conntrack_core.h>
26 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
27 #include <linux/netfilter_ipv4/listhelp.h>
28
29 #if 0
30 #define DEBUGP printk
31 #else
32 #define DEBUGP(format, args...)
33 #endif
34
35 struct module *ip_conntrack_module = THIS_MODULE;
36
37 static unsigned int
38 print_tuple(char *buffer, const struct ip_conntrack_tuple *tuple,
39             struct ip_conntrack_protocol *proto)
40 {
41         int len;
42
43         len = sprintf(buffer, "src=%u.%u.%u.%u dst=%u.%u.%u.%u ",
44                       NIPQUAD(tuple->src.ip), NIPQUAD(tuple->dst.ip));
45
46         len += proto->print_tuple(buffer + len, tuple);
47
48         return len;
49 }
50
51 /* FIXME: Don't print source proto part. --RR */
52 static unsigned int
53 print_expect(char *buffer, const struct ip_conntrack_expect *expect)
54 {
55         unsigned int len;
56
57         len = sprintf(buffer, "EXPECTING: proto=%u ",
58                       expect->tuple.dst.protonum);
59         len += print_tuple(buffer + len, &expect->tuple,
60                            __find_proto(expect->tuple.dst.protonum));
61         len += sprintf(buffer + len, "\n");
62         return len;
63 }
64
65 static unsigned int
66 print_conntrack(char *buffer, const struct ip_conntrack *conntrack)
67 {
68         unsigned int len;
69         struct ip_conntrack_protocol *proto
70                 = __find_proto(conntrack->tuplehash[IP_CT_DIR_ORIGINAL]
71                                .tuple.dst.protonum);
72
73         len = sprintf(buffer, "%-8s %u %lu ",
74                       proto->name,
75                       conntrack->tuplehash[IP_CT_DIR_ORIGINAL]
76                       .tuple.dst.protonum,
77                       timer_pending(&conntrack->timeout)
78                       ? (conntrack->timeout.expires - jiffies)/HZ : 0);
79
80         len += proto->print_conntrack(buffer + len, conntrack);
81         len += print_tuple(buffer + len,
82                            &conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
83                            proto);
84         if (!(conntrack->status & IPS_SEEN_REPLY))
85                 len += sprintf(buffer + len, "[UNREPLIED] ");
86         len += print_tuple(buffer + len,
87                            &conntrack->tuplehash[IP_CT_DIR_REPLY].tuple,
88                            proto);
89         if (conntrack->status & IPS_ASSURED)
90                 len += sprintf(buffer + len, "[ASSURED] ");
91         len += sprintf(buffer + len, "use=%u ",
92                        atomic_read(&conntrack->ct_general.use));
93         len += sprintf(buffer + len, "\n");
94
95         return len;
96 }
97
98 /* Returns true when finished. */
99 static inline int
100 conntrack_iterate(const struct ip_conntrack_tuple_hash *hash,
101                   char *buffer, off_t offset, off_t *upto,
102                   unsigned int *len, unsigned int maxlen)
103 {
104         unsigned int newlen;
105         IP_NF_ASSERT(hash->ctrack);
106
107         MUST_BE_READ_LOCKED(&ip_conntrack_lock);
108
109         /* Only count originals */
110         if (DIRECTION(hash))
111                 return 0;
112
113         if ((*upto)++ < offset)
114                 return 0;
115
116         newlen = print_conntrack(buffer + *len, hash->ctrack);
117         if (*len + newlen > maxlen)
118                 return 1;
119         else *len += newlen;
120
121         return 0;
122 }
123
124 static int
125 list_conntracks(char *buffer, char **start, off_t offset, int length)
126 {
127         unsigned int i;
128         unsigned int len = 0;
129         off_t upto = 0;
130         struct list_head *e;
131
132         READ_LOCK(&ip_conntrack_lock);
133         /* Traverse hash; print originals then reply. */
134         for (i = 0; i < ip_conntrack_htable_size; i++) {
135                 if (LIST_FIND(&ip_conntrack_hash[i], conntrack_iterate,
136                               struct ip_conntrack_tuple_hash *,
137                               buffer, offset, &upto, &len, length))
138                         goto finished;
139         }
140
141         /* Now iterate through expecteds. */
142         for (e = expect_list.next; e != &expect_list; e = e->next) {
143                 unsigned int last_len;
144                 struct ip_conntrack_expect *expect
145                         = (struct ip_conntrack_expect *)e;
146                 if (upto++ < offset) continue;
147
148                 last_len = len;
149                 len += print_expect(buffer + len, expect);
150                 if (len > length) {
151                         len = last_len;
152                         goto finished;
153                 }
154         }
155
156  finished:
157         READ_UNLOCK(&ip_conntrack_lock);
158
159         /* `start' hack - see fs/proc/generic.c line ~165 */
160         *start = (char *)((unsigned int)upto - offset);
161         return len;
162 }
163
164 static unsigned int ip_confirm(unsigned int hooknum,
165                                struct sk_buff **pskb,
166                                const struct net_device *in,
167                                const struct net_device *out,
168                                int (*okfn)(struct sk_buff *))
169 {
170         /* We've seen it coming out the other side: confirm it */
171         return ip_conntrack_confirm(*pskb);
172 }
173
174 static unsigned int ip_refrag(unsigned int hooknum,
175                               struct sk_buff **pskb,
176                               const struct net_device *in,
177                               const struct net_device *out,
178                               int (*okfn)(struct sk_buff *))
179 {
180         struct rtable *rt = (struct rtable *)(*pskb)->dst;
181
182         /* We've seen it coming out the other side: confirm */
183         if (ip_confirm(hooknum, pskb, in, out, okfn) != NF_ACCEPT)
184                 return NF_DROP;
185
186         /* Local packets are never produced too large for their
187            interface.  We degfragment them at LOCAL_OUT, however,
188            so we have to refragment them here. */
189         if ((*pskb)->len > rt->u.dst.pmtu) {
190                 /* No hook can be after us, so this should be OK. */
191                 ip_fragment(*pskb, okfn);
192                 return NF_STOLEN;
193         }
194         return NF_ACCEPT;
195 }
196
197 static unsigned int ip_conntrack_local(unsigned int hooknum,
198                                        struct sk_buff **pskb,
199                                        const struct net_device *in,
200                                        const struct net_device *out,
201                                        int (*okfn)(struct sk_buff *))
202 {
203         /* root is playing with raw sockets. */
204         if ((*pskb)->len < sizeof(struct iphdr)
205             || (*pskb)->nh.iph->ihl * 4 < sizeof(struct iphdr)) {
206                 if (net_ratelimit())
207                         printk("ipt_hook: happy cracking.\n");
208                 return NF_ACCEPT;
209         }
210         return ip_conntrack_in(hooknum, pskb, in, out, okfn);
211 }
212
213 /* Connection tracking may drop packets, but never alters them, so
214    make it the first hook. */
215 static struct nf_hook_ops ip_conntrack_in_ops
216 = { { NULL, NULL }, ip_conntrack_in, PF_INET, NF_IP_PRE_ROUTING,
217         NF_IP_PRI_CONNTRACK };
218 static struct nf_hook_ops ip_conntrack_local_out_ops
219 = { { NULL, NULL }, ip_conntrack_local, PF_INET, NF_IP_LOCAL_OUT,
220         NF_IP_PRI_CONNTRACK };
221 /* Refragmenter; last chance. */
222 static struct nf_hook_ops ip_conntrack_out_ops
223 = { { NULL, NULL }, ip_refrag, PF_INET, NF_IP_POST_ROUTING, NF_IP_PRI_LAST };
224 static struct nf_hook_ops ip_conntrack_local_in_ops
225 = { { NULL, NULL }, ip_confirm, PF_INET, NF_IP_LOCAL_IN, NF_IP_PRI_LAST-1 };
226
227 static int init_or_cleanup(int init)
228 {
229         struct proc_dir_entry *proc;
230         int ret = 0;
231
232         if (!init) goto cleanup;
233
234         ret = ip_conntrack_init();
235         if (ret < 0)
236                 goto cleanup_nothing;
237
238         proc = proc_net_create("ip_conntrack",0,list_conntracks);
239         if (!proc) goto cleanup_init;
240         proc->owner = THIS_MODULE;
241
242         ret = nf_register_hook(&ip_conntrack_in_ops);
243         if (ret < 0) {
244                 printk("ip_conntrack: can't register in hook.\n");
245                 goto cleanup_proc;
246         }
247         ret = nf_register_hook(&ip_conntrack_local_out_ops);
248         if (ret < 0) {
249                 printk("ip_conntrack: can't register local out hook.\n");
250                 goto cleanup_inops;
251         }
252         ret = nf_register_hook(&ip_conntrack_out_ops);
253         if (ret < 0) {
254                 printk("ip_conntrack: can't register post-routing hook.\n");
255                 goto cleanup_inandlocalops;
256         }
257         ret = nf_register_hook(&ip_conntrack_local_in_ops);
258         if (ret < 0) {
259                 printk("ip_conntrack: can't register local in hook.\n");
260                 goto cleanup_inoutandlocalops;
261         }
262
263         return ret;
264
265  cleanup:
266         nf_unregister_hook(&ip_conntrack_local_in_ops);
267  cleanup_inoutandlocalops:
268         nf_unregister_hook(&ip_conntrack_out_ops);
269  cleanup_inandlocalops:
270         nf_unregister_hook(&ip_conntrack_local_out_ops);
271  cleanup_inops:
272         nf_unregister_hook(&ip_conntrack_in_ops);
273  cleanup_proc:
274         proc_net_remove("ip_conntrack");
275  cleanup_init:
276         ip_conntrack_cleanup();
277  cleanup_nothing:
278         return ret;
279 }
280
281 /* FIXME: Allow NULL functions and sub in pointers to generic for
282    them. --RR */
283 int ip_conntrack_protocol_register(struct ip_conntrack_protocol *proto)
284 {
285         int ret = 0;
286         struct list_head *i;
287
288         WRITE_LOCK(&ip_conntrack_lock);
289         for (i = protocol_list.next; i != &protocol_list; i = i->next) {
290                 if (((struct ip_conntrack_protocol *)i)->proto
291                     == proto->proto) {
292                         ret = -EBUSY;
293                         goto out;
294                 }
295         }
296
297         list_prepend(&protocol_list, proto);
298         MOD_INC_USE_COUNT;
299
300  out:
301         WRITE_UNLOCK(&ip_conntrack_lock);
302         return ret;
303 }
304
305 /* FIXME: Implement this --RR */
306 #if 0
307 void ip_conntrack_protocol_unregister(struct ip_conntrack_protocol *proto)
308 {
309 }
310 #endif
311
312 static int __init init(void)
313 {
314         return init_or_cleanup(1);
315 }
316
317 static void __exit fini(void)
318 {
319         init_or_cleanup(0);
320 }
321
322 module_init(init);
323 module_exit(fini);
324
325 EXPORT_SYMBOL(ip_conntrack_protocol_register);
326 EXPORT_SYMBOL(invert_tuplepr);
327 EXPORT_SYMBOL(ip_conntrack_alter_reply);
328 EXPORT_SYMBOL(ip_conntrack_destroyed);
329 EXPORT_SYMBOL(ip_conntrack_get);
330 EXPORT_SYMBOL(ip_conntrack_module);
331 EXPORT_SYMBOL(ip_conntrack_helper_register);
332 EXPORT_SYMBOL(ip_conntrack_helper_unregister);
333 EXPORT_SYMBOL(ip_ct_selective_cleanup);
334 EXPORT_SYMBOL(ip_ct_refresh);
335 EXPORT_SYMBOL(ip_conntrack_expect_related);
336 EXPORT_SYMBOL(ip_conntrack_tuple_taken);
337 EXPORT_SYMBOL(ip_ct_gather_frags);
338 EXPORT_SYMBOL(ip_conntrack_htable_size);