1 #include <linux/kernel.h>
2 #include <linux/init.h>
3 #include <linux/module.h>
4 #include <linux/proc_fs.h>
5 #include <linux/skbuff.h>
6 #include <linux/netfilter.h>
7 #include <linux/seq_file.h>
8 #include <net/protocol.h>
9 #include <net/netfilter/nf_log.h>
11 #include "nf_internals.h"
13 /* Internal logging interface, which relies on the real
16 #define NFLOGGER_NAME_LEN 64
18 static struct nf_logger __rcu
*loggers
[NFPROTO_NUMPROTO
][NF_LOG_TYPE_MAX
] __read_mostly
;
19 static DEFINE_MUTEX(nf_log_mutex
);
21 #define nft_log_dereference(logger) \
22 rcu_dereference_protected(logger, lockdep_is_held(&nf_log_mutex))
24 static struct nf_logger
*__find_logger(int pf
, const char *str_logger
)
26 struct nf_logger
*log
;
29 for (i
= 0; i
< NF_LOG_TYPE_MAX
; i
++) {
30 if (loggers
[pf
][i
] == NULL
)
33 log
= nft_log_dereference(loggers
[pf
][i
]);
34 if (!strncasecmp(str_logger
, log
->name
, strlen(log
->name
)))
41 int nf_log_set(struct net
*net
, u_int8_t pf
, const struct nf_logger
*logger
)
43 const struct nf_logger
*log
;
45 if (pf
== NFPROTO_UNSPEC
|| pf
>= ARRAY_SIZE(net
->nf
.nf_loggers
))
48 mutex_lock(&nf_log_mutex
);
49 log
= nft_log_dereference(net
->nf
.nf_loggers
[pf
]);
51 rcu_assign_pointer(net
->nf
.nf_loggers
[pf
], logger
);
53 mutex_unlock(&nf_log_mutex
);
57 EXPORT_SYMBOL(nf_log_set
);
59 void nf_log_unset(struct net
*net
, const struct nf_logger
*logger
)
62 const struct nf_logger
*log
;
64 mutex_lock(&nf_log_mutex
);
65 for (i
= 0; i
< NFPROTO_NUMPROTO
; i
++) {
66 log
= nft_log_dereference(net
->nf
.nf_loggers
[i
]);
68 RCU_INIT_POINTER(net
->nf
.nf_loggers
[i
], NULL
);
70 mutex_unlock(&nf_log_mutex
);
73 EXPORT_SYMBOL(nf_log_unset
);
75 /* return EEXIST if the same logger is registered, 0 on success. */
76 int nf_log_register(u_int8_t pf
, struct nf_logger
*logger
)
81 if (pf
>= ARRAY_SIZE(init_net
.nf
.nf_loggers
))
84 mutex_lock(&nf_log_mutex
);
86 if (pf
== NFPROTO_UNSPEC
) {
87 for (i
= NFPROTO_UNSPEC
; i
< NFPROTO_NUMPROTO
; i
++) {
88 if (rcu_access_pointer(loggers
[i
][logger
->type
])) {
93 for (i
= NFPROTO_UNSPEC
; i
< NFPROTO_NUMPROTO
; i
++)
94 rcu_assign_pointer(loggers
[i
][logger
->type
], logger
);
96 if (rcu_access_pointer(loggers
[pf
][logger
->type
])) {
100 rcu_assign_pointer(loggers
[pf
][logger
->type
], logger
);
104 mutex_unlock(&nf_log_mutex
);
107 EXPORT_SYMBOL(nf_log_register
);
109 void nf_log_unregister(struct nf_logger
*logger
)
111 const struct nf_logger
*log
;
114 mutex_lock(&nf_log_mutex
);
115 for (i
= 0; i
< NFPROTO_NUMPROTO
; i
++) {
116 log
= nft_log_dereference(loggers
[i
][logger
->type
]);
118 RCU_INIT_POINTER(loggers
[i
][logger
->type
], NULL
);
120 mutex_unlock(&nf_log_mutex
);
123 EXPORT_SYMBOL(nf_log_unregister
);
125 int nf_log_bind_pf(struct net
*net
, u_int8_t pf
,
126 const struct nf_logger
*logger
)
128 if (pf
>= ARRAY_SIZE(net
->nf
.nf_loggers
))
130 mutex_lock(&nf_log_mutex
);
131 if (__find_logger(pf
, logger
->name
) == NULL
) {
132 mutex_unlock(&nf_log_mutex
);
135 rcu_assign_pointer(net
->nf
.nf_loggers
[pf
], logger
);
136 mutex_unlock(&nf_log_mutex
);
139 EXPORT_SYMBOL(nf_log_bind_pf
);
141 void nf_log_unbind_pf(struct net
*net
, u_int8_t pf
)
143 if (pf
>= ARRAY_SIZE(net
->nf
.nf_loggers
))
145 mutex_lock(&nf_log_mutex
);
146 RCU_INIT_POINTER(net
->nf
.nf_loggers
[pf
], NULL
);
147 mutex_unlock(&nf_log_mutex
);
149 EXPORT_SYMBOL(nf_log_unbind_pf
);
151 void nf_logger_request_module(int pf
, enum nf_log_type type
)
153 if (loggers
[pf
][type
] == NULL
)
154 request_module("nf-logger-%u-%u", pf
, type
);
156 EXPORT_SYMBOL_GPL(nf_logger_request_module
);
158 int nf_logger_find_get(int pf
, enum nf_log_type type
)
160 struct nf_logger
*logger
;
163 if (pf
== NFPROTO_INET
) {
164 ret
= nf_logger_find_get(NFPROTO_IPV4
, type
);
168 ret
= nf_logger_find_get(NFPROTO_IPV6
, type
);
170 nf_logger_put(NFPROTO_IPV4
, type
);
177 if (rcu_access_pointer(loggers
[pf
][type
]) == NULL
)
178 request_module("nf-logger-%u-%u", pf
, type
);
181 logger
= rcu_dereference(loggers
[pf
][type
]);
185 if (try_module_get(logger
->me
))
191 EXPORT_SYMBOL_GPL(nf_logger_find_get
);
193 void nf_logger_put(int pf
, enum nf_log_type type
)
195 struct nf_logger
*logger
;
197 if (pf
== NFPROTO_INET
) {
198 nf_logger_put(NFPROTO_IPV4
, type
);
199 nf_logger_put(NFPROTO_IPV6
, type
);
203 BUG_ON(loggers
[pf
][type
] == NULL
);
206 logger
= rcu_dereference(loggers
[pf
][type
]);
207 module_put(logger
->me
);
210 EXPORT_SYMBOL_GPL(nf_logger_put
);
212 void nf_log_packet(struct net
*net
,
214 unsigned int hooknum
,
215 const struct sk_buff
*skb
,
216 const struct net_device
*in
,
217 const struct net_device
*out
,
218 const struct nf_loginfo
*loginfo
,
219 const char *fmt
, ...)
222 char prefix
[NF_LOG_PREFIXLEN
];
223 const struct nf_logger
*logger
;
227 logger
= rcu_dereference(loggers
[pf
][loginfo
->type
]);
229 logger
= rcu_dereference(net
->nf
.nf_loggers
[pf
]);
233 vsnprintf(prefix
, sizeof(prefix
), fmt
, args
);
235 logger
->logfn(net
, pf
, hooknum
, skb
, in
, out
, loginfo
, prefix
);
239 EXPORT_SYMBOL(nf_log_packet
);
241 void nf_log_trace(struct net
*net
,
243 unsigned int hooknum
,
244 const struct sk_buff
*skb
,
245 const struct net_device
*in
,
246 const struct net_device
*out
,
247 const struct nf_loginfo
*loginfo
, const char *fmt
, ...)
250 char prefix
[NF_LOG_PREFIXLEN
];
251 const struct nf_logger
*logger
;
254 logger
= rcu_dereference(net
->nf
.nf_loggers
[pf
]);
257 vsnprintf(prefix
, sizeof(prefix
), fmt
, args
);
259 logger
->logfn(net
, pf
, hooknum
, skb
, in
, out
, loginfo
, prefix
);
263 EXPORT_SYMBOL(nf_log_trace
);
265 #define S_SIZE (1024 - (sizeof(unsigned int) + 1))
269 char buf
[S_SIZE
+ 1];
271 static struct nf_log_buf emergency
, *emergency_ptr
= &emergency
;
273 __printf(2, 3) int nf_log_buf_add(struct nf_log_buf
*m
, const char *f
, ...)
278 if (likely(m
->count
< S_SIZE
)) {
280 len
= vsnprintf(m
->buf
+ m
->count
, S_SIZE
- m
->count
, f
, args
);
282 if (likely(m
->count
+ len
< S_SIZE
)) {
288 printk_once(KERN_ERR KBUILD_MODNAME
" please increase S_SIZE\n");
291 EXPORT_SYMBOL_GPL(nf_log_buf_add
);
293 struct nf_log_buf
*nf_log_buf_open(void)
295 struct nf_log_buf
*m
= kmalloc(sizeof(*m
), GFP_ATOMIC
);
300 m
= xchg(&emergency_ptr
, NULL
);
306 EXPORT_SYMBOL_GPL(nf_log_buf_open
);
308 void nf_log_buf_close(struct nf_log_buf
*m
)
310 m
->buf
[m
->count
] = 0;
311 printk("%s\n", m
->buf
);
313 if (likely(m
!= &emergency
))
320 EXPORT_SYMBOL_GPL(nf_log_buf_close
);
322 #ifdef CONFIG_PROC_FS
323 static void *seq_start(struct seq_file
*seq
, loff_t
*pos
)
325 struct net
*net
= seq_file_net(seq
);
327 mutex_lock(&nf_log_mutex
);
329 if (*pos
>= ARRAY_SIZE(net
->nf
.nf_loggers
))
335 static void *seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
337 struct net
*net
= seq_file_net(s
);
341 if (*pos
>= ARRAY_SIZE(net
->nf
.nf_loggers
))
347 static void seq_stop(struct seq_file
*s
, void *v
)
349 mutex_unlock(&nf_log_mutex
);
352 static int seq_show(struct seq_file
*s
, void *v
)
355 const struct nf_logger
*logger
;
357 struct net
*net
= seq_file_net(s
);
359 logger
= nft_log_dereference(net
->nf
.nf_loggers
[*pos
]);
362 seq_printf(s
, "%2lld NONE (", *pos
);
364 seq_printf(s
, "%2lld %s (", *pos
, logger
->name
);
366 if (seq_has_overflowed(s
))
369 for (i
= 0; i
< NF_LOG_TYPE_MAX
; i
++) {
370 if (loggers
[*pos
][i
] == NULL
)
373 logger
= nft_log_dereference(loggers
[*pos
][i
]);
374 seq_printf(s
, "%s", logger
->name
);
375 if (i
== 0 && loggers
[*pos
][i
+ 1] != NULL
)
378 if (seq_has_overflowed(s
))
382 seq_printf(s
, ")\n");
384 if (seq_has_overflowed(s
))
389 static const struct seq_operations nflog_seq_ops
= {
396 static int nflog_open(struct inode
*inode
, struct file
*file
)
398 return seq_open_net(inode
, file
, &nflog_seq_ops
,
399 sizeof(struct seq_net_private
));
402 static const struct file_operations nflog_file_ops
= {
403 .owner
= THIS_MODULE
,
407 .release
= seq_release_net
,
414 static char nf_log_sysctl_fnames
[NFPROTO_NUMPROTO
-NFPROTO_UNSPEC
][3];
415 static struct ctl_table nf_log_sysctl_table
[NFPROTO_NUMPROTO
+1];
417 static int nf_log_proc_dostring(struct ctl_table
*table
, int write
,
418 void __user
*buffer
, size_t *lenp
, loff_t
*ppos
)
420 const struct nf_logger
*logger
;
421 char buf
[NFLOGGER_NAME_LEN
];
423 int tindex
= (unsigned long)table
->extra1
;
424 struct net
*net
= table
->extra2
;
427 struct ctl_table tmp
= *table
;
430 r
= proc_dostring(&tmp
, write
, buffer
, lenp
, ppos
);
434 if (!strcmp(buf
, "NONE")) {
435 nf_log_unbind_pf(net
, tindex
);
438 mutex_lock(&nf_log_mutex
);
439 logger
= __find_logger(tindex
, buf
);
440 if (logger
== NULL
) {
441 mutex_unlock(&nf_log_mutex
);
444 rcu_assign_pointer(net
->nf
.nf_loggers
[tindex
], logger
);
445 mutex_unlock(&nf_log_mutex
);
447 mutex_lock(&nf_log_mutex
);
448 logger
= nft_log_dereference(net
->nf
.nf_loggers
[tindex
]);
450 table
->data
= "NONE";
452 table
->data
= logger
->name
;
453 r
= proc_dostring(table
, write
, buffer
, lenp
, ppos
);
454 mutex_unlock(&nf_log_mutex
);
460 static int netfilter_log_sysctl_init(struct net
*net
)
463 struct ctl_table
*table
;
465 table
= nf_log_sysctl_table
;
466 if (!net_eq(net
, &init_net
)) {
467 table
= kmemdup(nf_log_sysctl_table
,
468 sizeof(nf_log_sysctl_table
),
473 for (i
= NFPROTO_UNSPEC
; i
< NFPROTO_NUMPROTO
; i
++) {
474 snprintf(nf_log_sysctl_fnames
[i
],
476 nf_log_sysctl_table
[i
].procname
=
477 nf_log_sysctl_fnames
[i
];
478 nf_log_sysctl_table
[i
].maxlen
= NFLOGGER_NAME_LEN
;
479 nf_log_sysctl_table
[i
].mode
= 0644;
480 nf_log_sysctl_table
[i
].proc_handler
=
481 nf_log_proc_dostring
;
482 nf_log_sysctl_table
[i
].extra1
=
483 (void *)(unsigned long) i
;
487 for (i
= NFPROTO_UNSPEC
; i
< NFPROTO_NUMPROTO
; i
++)
488 table
[i
].extra2
= net
;
490 net
->nf
.nf_log_dir_header
= register_net_sysctl(net
,
491 "net/netfilter/nf_log",
493 if (!net
->nf
.nf_log_dir_header
)
499 if (!net_eq(net
, &init_net
))
505 static void netfilter_log_sysctl_exit(struct net
*net
)
507 struct ctl_table
*table
;
509 table
= net
->nf
.nf_log_dir_header
->ctl_table_arg
;
510 unregister_net_sysctl_table(net
->nf
.nf_log_dir_header
);
511 if (!net_eq(net
, &init_net
))
515 static int netfilter_log_sysctl_init(struct net
*net
)
520 static void netfilter_log_sysctl_exit(struct net
*net
)
523 #endif /* CONFIG_SYSCTL */
525 static int __net_init
nf_log_net_init(struct net
*net
)
529 #ifdef CONFIG_PROC_FS
530 if (!proc_create("nf_log", S_IRUGO
,
531 net
->nf
.proc_netfilter
, &nflog_file_ops
))
534 ret
= netfilter_log_sysctl_init(net
);
541 #ifdef CONFIG_PROC_FS
542 remove_proc_entry("nf_log", net
->nf
.proc_netfilter
);
547 static void __net_exit
nf_log_net_exit(struct net
*net
)
549 netfilter_log_sysctl_exit(net
);
550 #ifdef CONFIG_PROC_FS
551 remove_proc_entry("nf_log", net
->nf
.proc_netfilter
);
555 static struct pernet_operations nf_log_net_ops
= {
556 .init
= nf_log_net_init
,
557 .exit
= nf_log_net_exit
,
560 int __init
netfilter_log_init(void)
562 return register_pernet_subsys(&nf_log_net_ops
);