Commit | Line | Data |
---|---|---|
f6ebe77f HW |
1 | #include <linux/kernel.h> |
2 | #include <linux/init.h> | |
3 | #include <linux/module.h> | |
4 | #include <linux/proc_fs.h> | |
5 | #include <linux/skbuff.h> | |
6 | #include <linux/netfilter.h> | |
bbd86b9f | 7 | #include <linux/seq_file.h> |
f6ebe77f | 8 | #include <net/protocol.h> |
f01ffbd6 | 9 | #include <net/netfilter/nf_log.h> |
f6ebe77f HW |
10 | |
11 | #include "nf_internals.h" | |
12 | ||
a5d29264 | 13 | /* Internal logging interface, which relies on the real |
f6ebe77f HW |
14 | LOG target modules */ |
15 | ||
16 | #define NF_LOG_PREFIXLEN 128 | |
17625274 | 17 | #define NFLOGGER_NAME_LEN 64 |
f6ebe77f | 18 | |
5962815a | 19 | static struct nf_logger __rcu *loggers[NFPROTO_NUMPROTO][NF_LOG_TYPE_MAX] __read_mostly; |
9b73534d | 20 | static DEFINE_MUTEX(nf_log_mutex); |
f6ebe77f | 21 | |
0c26ed1c ML |
22 | #define nft_log_dereference(logger) \ |
23 | rcu_dereference_protected(logger, lockdep_is_held(&nf_log_mutex)) | |
24 | ||
ca735b3a | 25 | static struct nf_logger *__find_logger(int pf, const char *str_logger) |
f6ebe77f | 26 | { |
5962815a PNA |
27 | struct nf_logger *log; |
28 | int i; | |
29 | ||
30 | for (i = 0; i < NF_LOG_TYPE_MAX; i++) { | |
31 | if (loggers[pf][i] == NULL) | |
32 | continue; | |
f6ebe77f | 33 | |
0c26ed1c | 34 | log = nft_log_dereference(loggers[pf][i]); |
18082746 | 35 | if (!strncasecmp(str_logger, log->name, strlen(log->name))) |
5962815a | 36 | return log; |
ca735b3a | 37 | } |
d72367b6 | 38 | |
ca735b3a | 39 | return NULL; |
601e68e1 | 40 | } |
f6ebe77f | 41 | |
30e0c6a6 G |
42 | void nf_log_set(struct net *net, u_int8_t pf, const struct nf_logger *logger) |
43 | { | |
44 | const struct nf_logger *log; | |
45 | ||
30e0c6a6 G |
46 | if (pf == NFPROTO_UNSPEC) |
47 | return; | |
48 | ||
49 | mutex_lock(&nf_log_mutex); | |
0c26ed1c | 50 | log = nft_log_dereference(net->nf.nf_loggers[pf]); |
30e0c6a6 G |
51 | if (log == NULL) |
52 | rcu_assign_pointer(net->nf.nf_loggers[pf], logger); | |
53 | ||
54 | mutex_unlock(&nf_log_mutex); | |
55 | } | |
56 | EXPORT_SYMBOL(nf_log_set); | |
57 | ||
58 | void nf_log_unset(struct net *net, const struct nf_logger *logger) | |
59 | { | |
60 | int i; | |
61 | const struct nf_logger *log; | |
62 | ||
30e0c6a6 G |
63 | mutex_lock(&nf_log_mutex); |
64 | for (i = 0; i < NFPROTO_NUMPROTO; i++) { | |
0c26ed1c | 65 | log = nft_log_dereference(net->nf.nf_loggers[i]); |
30e0c6a6 G |
66 | if (log == logger) |
67 | RCU_INIT_POINTER(net->nf.nf_loggers[i], NULL); | |
68 | } | |
69 | mutex_unlock(&nf_log_mutex); | |
70 | synchronize_rcu(); | |
71 | } | |
72 | EXPORT_SYMBOL(nf_log_unset); | |
73 | ||
d93cf068 | 74 | /* return EEXIST if the same logger is registered, 0 on success. */ |
ca735b3a | 75 | int nf_log_register(u_int8_t pf, struct nf_logger *logger) |
f6ebe77f | 76 | { |
b6f0a365 | 77 | int i; |
8ac2bde2 | 78 | int ret = 0; |
ca735b3a | 79 | |
30e0c6a6 | 80 | if (pf >= ARRAY_SIZE(init_net.nf.nf_loggers)) |
ca735b3a EL |
81 | return -EINVAL; |
82 | ||
9b73534d | 83 | mutex_lock(&nf_log_mutex); |
ca735b3a EL |
84 | |
85 | if (pf == NFPROTO_UNSPEC) { | |
8ac2bde2 ML |
86 | for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++) { |
87 | if (rcu_access_pointer(loggers[i][logger->type])) { | |
88 | ret = -EEXIST; | |
89 | goto unlock; | |
90 | } | |
91 | } | |
ca735b3a | 92 | for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++) |
5962815a | 93 | rcu_assign_pointer(loggers[i][logger->type], logger); |
ca735b3a | 94 | } else { |
8ac2bde2 ML |
95 | if (rcu_access_pointer(loggers[pf][logger->type])) { |
96 | ret = -EEXIST; | |
97 | goto unlock; | |
98 | } | |
5962815a | 99 | rcu_assign_pointer(loggers[pf][logger->type], logger); |
ca735b3a EL |
100 | } |
101 | ||
8ac2bde2 | 102 | unlock: |
9b73534d | 103 | mutex_unlock(&nf_log_mutex); |
8ac2bde2 | 104 | return ret; |
f6ebe77f | 105 | } |
ca735b3a | 106 | EXPORT_SYMBOL(nf_log_register); |
f6ebe77f | 107 | |
ca735b3a | 108 | void nf_log_unregister(struct nf_logger *logger) |
f6ebe77f HW |
109 | { |
110 | int i; | |
111 | ||
9b73534d | 112 | mutex_lock(&nf_log_mutex); |
30e0c6a6 | 113 | for (i = 0; i < NFPROTO_NUMPROTO; i++) |
5962815a | 114 | RCU_INIT_POINTER(loggers[i][logger->type], NULL); |
9b73534d | 115 | mutex_unlock(&nf_log_mutex); |
f6ebe77f | 116 | } |
e92ad99c | 117 | EXPORT_SYMBOL(nf_log_unregister); |
f6ebe77f | 118 | |
30e0c6a6 G |
119 | int nf_log_bind_pf(struct net *net, u_int8_t pf, |
120 | const struct nf_logger *logger) | |
ca735b3a | 121 | { |
30e0c6a6 | 122 | if (pf >= ARRAY_SIZE(net->nf.nf_loggers)) |
9ef0298a | 123 | return -EINVAL; |
ca735b3a EL |
124 | mutex_lock(&nf_log_mutex); |
125 | if (__find_logger(pf, logger->name) == NULL) { | |
126 | mutex_unlock(&nf_log_mutex); | |
127 | return -ENOENT; | |
128 | } | |
30e0c6a6 | 129 | rcu_assign_pointer(net->nf.nf_loggers[pf], logger); |
ca735b3a EL |
130 | mutex_unlock(&nf_log_mutex); |
131 | return 0; | |
132 | } | |
133 | EXPORT_SYMBOL(nf_log_bind_pf); | |
134 | ||
30e0c6a6 | 135 | void nf_log_unbind_pf(struct net *net, u_int8_t pf) |
ca735b3a | 136 | { |
30e0c6a6 | 137 | if (pf >= ARRAY_SIZE(net->nf.nf_loggers)) |
9ef0298a | 138 | return; |
ca735b3a | 139 | mutex_lock(&nf_log_mutex); |
30e0c6a6 | 140 | RCU_INIT_POINTER(net->nf.nf_loggers[pf], NULL); |
ca735b3a EL |
141 | mutex_unlock(&nf_log_mutex); |
142 | } | |
143 | EXPORT_SYMBOL(nf_log_unbind_pf); | |
144 | ||
960649d1 PNA |
145 | void nf_logger_request_module(int pf, enum nf_log_type type) |
146 | { | |
147 | if (loggers[pf][type] == NULL) | |
148 | request_module("nf-logger-%u-%u", pf, type); | |
149 | } | |
150 | EXPORT_SYMBOL_GPL(nf_logger_request_module); | |
151 | ||
fab4085f PNA |
152 | int nf_logger_find_get(int pf, enum nf_log_type type) |
153 | { | |
154 | struct nf_logger *logger; | |
155 | int ret = -ENOENT; | |
156 | ||
157 | logger = loggers[pf][type]; | |
158 | if (logger == NULL) | |
159 | request_module("nf-logger-%u-%u", pf, type); | |
160 | ||
161 | rcu_read_lock(); | |
162 | logger = rcu_dereference(loggers[pf][type]); | |
163 | if (logger == NULL) | |
164 | goto out; | |
165 | ||
166 | if (logger && try_module_get(logger->me)) | |
167 | ret = 0; | |
168 | out: | |
169 | rcu_read_unlock(); | |
170 | return ret; | |
171 | } | |
172 | EXPORT_SYMBOL_GPL(nf_logger_find_get); | |
173 | ||
174 | void nf_logger_put(int pf, enum nf_log_type type) | |
175 | { | |
176 | struct nf_logger *logger; | |
177 | ||
178 | BUG_ON(loggers[pf][type] == NULL); | |
179 | ||
180 | rcu_read_lock(); | |
181 | logger = rcu_dereference(loggers[pf][type]); | |
182 | module_put(logger->me); | |
183 | rcu_read_unlock(); | |
184 | } | |
185 | EXPORT_SYMBOL_GPL(nf_logger_put); | |
186 | ||
30e0c6a6 G |
187 | void nf_log_packet(struct net *net, |
188 | u_int8_t pf, | |
f6ebe77f HW |
189 | unsigned int hooknum, |
190 | const struct sk_buff *skb, | |
191 | const struct net_device *in, | |
192 | const struct net_device *out, | |
7b2f9631 | 193 | const struct nf_loginfo *loginfo, |
f6ebe77f HW |
194 | const char *fmt, ...) |
195 | { | |
196 | va_list args; | |
197 | char prefix[NF_LOG_PREFIXLEN]; | |
7b2f9631 | 198 | const struct nf_logger *logger; |
601e68e1 | 199 | |
f6ebe77f | 200 | rcu_read_lock(); |
fab4085f PNA |
201 | if (loginfo != NULL) |
202 | logger = rcu_dereference(loggers[pf][loginfo->type]); | |
203 | else | |
204 | logger = rcu_dereference(net->nf.nf_loggers[pf]); | |
205 | ||
f6ebe77f HW |
206 | if (logger) { |
207 | va_start(args, fmt); | |
208 | vsnprintf(prefix, sizeof(prefix), fmt, args); | |
209 | va_end(args); | |
8cdb46da | 210 | logger->logfn(net, pf, hooknum, skb, in, out, loginfo, prefix); |
f6ebe77f HW |
211 | } |
212 | rcu_read_unlock(); | |
213 | } | |
214 | EXPORT_SYMBOL(nf_log_packet); | |
215 | ||
27fd8d90 PNA |
216 | #define S_SIZE (1024 - (sizeof(unsigned int) + 1)) |
217 | ||
218 | struct nf_log_buf { | |
219 | unsigned int count; | |
220 | char buf[S_SIZE + 1]; | |
221 | }; | |
222 | static struct nf_log_buf emergency, *emergency_ptr = &emergency; | |
223 | ||
224 | __printf(2, 3) int nf_log_buf_add(struct nf_log_buf *m, const char *f, ...) | |
225 | { | |
226 | va_list args; | |
227 | int len; | |
228 | ||
229 | if (likely(m->count < S_SIZE)) { | |
230 | va_start(args, f); | |
231 | len = vsnprintf(m->buf + m->count, S_SIZE - m->count, f, args); | |
232 | va_end(args); | |
233 | if (likely(m->count + len < S_SIZE)) { | |
234 | m->count += len; | |
235 | return 0; | |
236 | } | |
237 | } | |
238 | m->count = S_SIZE; | |
239 | printk_once(KERN_ERR KBUILD_MODNAME " please increase S_SIZE\n"); | |
240 | return -1; | |
241 | } | |
242 | EXPORT_SYMBOL_GPL(nf_log_buf_add); | |
243 | ||
244 | struct nf_log_buf *nf_log_buf_open(void) | |
245 | { | |
246 | struct nf_log_buf *m = kmalloc(sizeof(*m), GFP_ATOMIC); | |
247 | ||
248 | if (unlikely(!m)) { | |
249 | local_bh_disable(); | |
250 | do { | |
251 | m = xchg(&emergency_ptr, NULL); | |
252 | } while (!m); | |
253 | } | |
254 | m->count = 0; | |
255 | return m; | |
256 | } | |
257 | EXPORT_SYMBOL_GPL(nf_log_buf_open); | |
258 | ||
259 | void nf_log_buf_close(struct nf_log_buf *m) | |
260 | { | |
261 | m->buf[m->count] = 0; | |
262 | printk("%s\n", m->buf); | |
263 | ||
264 | if (likely(m != &emergency)) | |
265 | kfree(m); | |
266 | else { | |
267 | emergency_ptr = m; | |
268 | local_bh_enable(); | |
269 | } | |
270 | } | |
271 | EXPORT_SYMBOL_GPL(nf_log_buf_close); | |
272 | ||
f6ebe77f HW |
273 | #ifdef CONFIG_PROC_FS |
274 | static void *seq_start(struct seq_file *seq, loff_t *pos) | |
275 | { | |
30e0c6a6 G |
276 | struct net *net = seq_file_net(seq); |
277 | ||
6440fe05 | 278 | mutex_lock(&nf_log_mutex); |
f6ebe77f | 279 | |
30e0c6a6 | 280 | if (*pos >= ARRAY_SIZE(net->nf.nf_loggers)) |
f6ebe77f HW |
281 | return NULL; |
282 | ||
283 | return pos; | |
284 | } | |
285 | ||
286 | static void *seq_next(struct seq_file *s, void *v, loff_t *pos) | |
287 | { | |
30e0c6a6 G |
288 | struct net *net = seq_file_net(s); |
289 | ||
f6ebe77f HW |
290 | (*pos)++; |
291 | ||
30e0c6a6 | 292 | if (*pos >= ARRAY_SIZE(net->nf.nf_loggers)) |
f6ebe77f HW |
293 | return NULL; |
294 | ||
295 | return pos; | |
296 | } | |
297 | ||
298 | static void seq_stop(struct seq_file *s, void *v) | |
299 | { | |
6440fe05 | 300 | mutex_unlock(&nf_log_mutex); |
f6ebe77f HW |
301 | } |
302 | ||
303 | static int seq_show(struct seq_file *s, void *v) | |
304 | { | |
305 | loff_t *pos = v; | |
306 | const struct nf_logger *logger; | |
5962815a | 307 | int i, ret; |
30e0c6a6 | 308 | struct net *net = seq_file_net(s); |
f6ebe77f | 309 | |
0c26ed1c | 310 | logger = nft_log_dereference(net->nf.nf_loggers[*pos]); |
f6ebe77f HW |
311 | |
312 | if (!logger) | |
c7a913cd EL |
313 | ret = seq_printf(s, "%2lld NONE (", *pos); |
314 | else | |
315 | ret = seq_printf(s, "%2lld %s (", *pos, logger->name); | |
316 | ||
317 | if (ret < 0) | |
318 | return ret; | |
319 | ||
5962815a PNA |
320 | for (i = 0; i < NF_LOG_TYPE_MAX; i++) { |
321 | if (loggers[*pos][i] == NULL) | |
322 | continue; | |
323 | ||
0c26ed1c | 324 | logger = nft_log_dereference(loggers[*pos][i]); |
5962815a | 325 | ret = seq_printf(s, "%s", logger->name); |
6440fe05 | 326 | if (ret < 0) |
c7a913cd | 327 | return ret; |
5962815a | 328 | if (i == 0 && loggers[*pos][i + 1] != NULL) { |
c7a913cd | 329 | ret = seq_printf(s, ","); |
6440fe05 | 330 | if (ret < 0) |
c7a913cd | 331 | return ret; |
c7a913cd EL |
332 | } |
333 | } | |
601e68e1 | 334 | |
c7a913cd | 335 | return seq_printf(s, ")\n"); |
f6ebe77f HW |
336 | } |
337 | ||
56b3d975 | 338 | static const struct seq_operations nflog_seq_ops = { |
f6ebe77f HW |
339 | .start = seq_start, |
340 | .next = seq_next, | |
341 | .stop = seq_stop, | |
342 | .show = seq_show, | |
343 | }; | |
344 | ||
345 | static int nflog_open(struct inode *inode, struct file *file) | |
346 | { | |
30e0c6a6 G |
347 | return seq_open_net(inode, file, &nflog_seq_ops, |
348 | sizeof(struct seq_net_private)); | |
f6ebe77f HW |
349 | } |
350 | ||
da7071d7 | 351 | static const struct file_operations nflog_file_ops = { |
f6ebe77f HW |
352 | .owner = THIS_MODULE, |
353 | .open = nflog_open, | |
354 | .read = seq_read, | |
355 | .llseek = seq_lseek, | |
30e0c6a6 | 356 | .release = seq_release_net, |
f6ebe77f HW |
357 | }; |
358 | ||
17625274 | 359 | |
f6ebe77f HW |
360 | #endif /* PROC_FS */ |
361 | ||
17625274 | 362 | #ifdef CONFIG_SYSCTL |
17625274 EL |
363 | static char nf_log_sysctl_fnames[NFPROTO_NUMPROTO-NFPROTO_UNSPEC][3]; |
364 | static struct ctl_table nf_log_sysctl_table[NFPROTO_NUMPROTO+1]; | |
f6ebe77f | 365 | |
fe2c6338 | 366 | static int nf_log_proc_dostring(struct ctl_table *table, int write, |
24955619 | 367 | void __user *buffer, size_t *lenp, loff_t *ppos) |
17625274 EL |
368 | { |
369 | const struct nf_logger *logger; | |
24955619 PM |
370 | char buf[NFLOGGER_NAME_LEN]; |
371 | size_t size = *lenp; | |
17625274 EL |
372 | int r = 0; |
373 | int tindex = (unsigned long)table->extra1; | |
30e0c6a6 | 374 | struct net *net = current->nsproxy->net_ns; |
17625274 EL |
375 | |
376 | if (write) { | |
24955619 PM |
377 | if (size > sizeof(buf)) |
378 | size = sizeof(buf); | |
379 | if (copy_from_user(buf, buffer, size)) | |
380 | return -EFAULT; | |
381 | ||
382 | if (!strcmp(buf, "NONE")) { | |
30e0c6a6 | 383 | nf_log_unbind_pf(net, tindex); |
17625274 EL |
384 | return 0; |
385 | } | |
386 | mutex_lock(&nf_log_mutex); | |
24955619 | 387 | logger = __find_logger(tindex, buf); |
17625274 EL |
388 | if (logger == NULL) { |
389 | mutex_unlock(&nf_log_mutex); | |
390 | return -ENOENT; | |
391 | } | |
30e0c6a6 | 392 | rcu_assign_pointer(net->nf.nf_loggers[tindex], logger); |
17625274 EL |
393 | mutex_unlock(&nf_log_mutex); |
394 | } else { | |
266d07cb | 395 | mutex_lock(&nf_log_mutex); |
0c26ed1c | 396 | logger = nft_log_dereference(net->nf.nf_loggers[tindex]); |
17625274 EL |
397 | if (!logger) |
398 | table->data = "NONE"; | |
399 | else | |
400 | table->data = logger->name; | |
8d65af78 | 401 | r = proc_dostring(table, write, buffer, lenp, ppos); |
266d07cb | 402 | mutex_unlock(&nf_log_mutex); |
17625274 EL |
403 | } |
404 | ||
405 | return r; | |
406 | } | |
407 | ||
30e0c6a6 | 408 | static int netfilter_log_sysctl_init(struct net *net) |
f6ebe77f | 409 | { |
ca735b3a | 410 | int i; |
30e0c6a6 G |
411 | struct ctl_table *table; |
412 | ||
413 | table = nf_log_sysctl_table; | |
414 | if (!net_eq(net, &init_net)) { | |
415 | table = kmemdup(nf_log_sysctl_table, | |
416 | sizeof(nf_log_sysctl_table), | |
417 | GFP_KERNEL); | |
418 | if (!table) | |
419 | goto err_alloc; | |
420 | } else { | |
421 | for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++) { | |
422 | snprintf(nf_log_sysctl_fnames[i], | |
423 | 3, "%d", i); | |
424 | nf_log_sysctl_table[i].procname = | |
425 | nf_log_sysctl_fnames[i]; | |
426 | nf_log_sysctl_table[i].data = NULL; | |
427 | nf_log_sysctl_table[i].maxlen = | |
428 | NFLOGGER_NAME_LEN * sizeof(char); | |
429 | nf_log_sysctl_table[i].mode = 0644; | |
430 | nf_log_sysctl_table[i].proc_handler = | |
431 | nf_log_proc_dostring; | |
432 | nf_log_sysctl_table[i].extra1 = | |
433 | (void *)(unsigned long) i; | |
434 | } | |
17625274 EL |
435 | } |
436 | ||
30e0c6a6 G |
437 | net->nf.nf_log_dir_header = register_net_sysctl(net, |
438 | "net/netfilter/nf_log", | |
439 | table); | |
440 | if (!net->nf.nf_log_dir_header) | |
441 | goto err_reg; | |
17625274 EL |
442 | |
443 | return 0; | |
30e0c6a6 G |
444 | |
445 | err_reg: | |
446 | if (!net_eq(net, &init_net)) | |
447 | kfree(table); | |
448 | err_alloc: | |
449 | return -ENOMEM; | |
450 | } | |
451 | ||
452 | static void netfilter_log_sysctl_exit(struct net *net) | |
453 | { | |
454 | struct ctl_table *table; | |
455 | ||
456 | table = net->nf.nf_log_dir_header->ctl_table_arg; | |
457 | unregister_net_sysctl_table(net->nf.nf_log_dir_header); | |
458 | if (!net_eq(net, &init_net)) | |
459 | kfree(table); | |
17625274 EL |
460 | } |
461 | #else | |
30e0c6a6 | 462 | static int netfilter_log_sysctl_init(struct net *net) |
17625274 EL |
463 | { |
464 | return 0; | |
465 | } | |
30e0c6a6 G |
466 | |
467 | static void netfilter_log_sysctl_exit(struct net *net) | |
468 | { | |
469 | } | |
17625274 EL |
470 | #endif /* CONFIG_SYSCTL */ |
471 | ||
30e0c6a6 | 472 | static int __net_init nf_log_net_init(struct net *net) |
17625274 | 473 | { |
30e0c6a6 G |
474 | int ret = -ENOMEM; |
475 | ||
f6ebe77f | 476 | #ifdef CONFIG_PROC_FS |
8eeee8b1 | 477 | if (!proc_create("nf_log", S_IRUGO, |
30e0c6a6 G |
478 | net->nf.proc_netfilter, &nflog_file_ops)) |
479 | return ret; | |
62243927 | 480 | #endif |
30e0c6a6 G |
481 | ret = netfilter_log_sysctl_init(net); |
482 | if (ret < 0) | |
483 | goto out_sysctl; | |
ca735b3a | 484 | |
30e0c6a6 G |
485 | return 0; |
486 | ||
487 | out_sysctl: | |
e778f56e | 488 | #ifdef CONFIG_PROC_FS |
6d11cfdb | 489 | remove_proc_entry("nf_log", net->nf.proc_netfilter); |
e778f56e | 490 | #endif |
30e0c6a6 G |
491 | return ret; |
492 | } | |
493 | ||
494 | static void __net_exit nf_log_net_exit(struct net *net) | |
495 | { | |
496 | netfilter_log_sysctl_exit(net); | |
e778f56e | 497 | #ifdef CONFIG_PROC_FS |
30e0c6a6 | 498 | remove_proc_entry("nf_log", net->nf.proc_netfilter); |
e778f56e | 499 | #endif |
30e0c6a6 G |
500 | } |
501 | ||
502 | static struct pernet_operations nf_log_net_ops = { | |
503 | .init = nf_log_net_init, | |
504 | .exit = nf_log_net_exit, | |
505 | }; | |
506 | ||
507 | int __init netfilter_log_init(void) | |
508 | { | |
5962815a | 509 | return register_pernet_subsys(&nf_log_net_ops); |
f6ebe77f | 510 | } |