1 #include <linux/kernel.h>
2 #include <linux/init.h>
3 #include <linux/module.h>
4 #include <linux/proc_fs.h>
5 #include <linux/skbuff.h>
6 #include <linux/netfilter.h>
7 #include <linux/seq_file.h>
8 #include <net/protocol.h>
9 #include <net/netfilter/nf_log.h>
11 #include "nf_internals.h"
13 /* Internal logging interface, which relies on the real
16 #define NF_LOG_PREFIXLEN 128
17 #define NFLOGGER_NAME_LEN 64
19 static struct nf_logger __rcu
*loggers
[NFPROTO_NUMPROTO
][NF_LOG_TYPE_MAX
] __read_mostly
;
20 static DEFINE_MUTEX(nf_log_mutex
);
22 #define nft_log_dereference(logger) \
23 rcu_dereference_protected(logger, lockdep_is_held(&nf_log_mutex))
25 static struct nf_logger
*__find_logger(int pf
, const char *str_logger
)
27 struct nf_logger
*log
;
30 for (i
= 0; i
< NF_LOG_TYPE_MAX
; i
++) {
31 if (loggers
[pf
][i
] == NULL
)
34 log
= nft_log_dereference(loggers
[pf
][i
]);
35 if (!strncasecmp(str_logger
, log
->name
, strlen(log
->name
)))
42 void nf_log_set(struct net
*net
, u_int8_t pf
, const struct nf_logger
*logger
)
44 const struct nf_logger
*log
;
46 if (pf
== NFPROTO_UNSPEC
)
49 mutex_lock(&nf_log_mutex
);
50 log
= nft_log_dereference(net
->nf
.nf_loggers
[pf
]);
52 rcu_assign_pointer(net
->nf
.nf_loggers
[pf
], logger
);
54 mutex_unlock(&nf_log_mutex
);
56 EXPORT_SYMBOL(nf_log_set
);
58 void nf_log_unset(struct net
*net
, const struct nf_logger
*logger
)
61 const struct nf_logger
*log
;
63 mutex_lock(&nf_log_mutex
);
64 for (i
= 0; i
< NFPROTO_NUMPROTO
; i
++) {
65 log
= nft_log_dereference(net
->nf
.nf_loggers
[i
]);
67 RCU_INIT_POINTER(net
->nf
.nf_loggers
[i
], NULL
);
69 mutex_unlock(&nf_log_mutex
);
72 EXPORT_SYMBOL(nf_log_unset
);
74 /* return EEXIST if the same logger is registered, 0 on success. */
75 int nf_log_register(u_int8_t pf
, struct nf_logger
*logger
)
80 if (pf
>= ARRAY_SIZE(init_net
.nf
.nf_loggers
))
83 mutex_lock(&nf_log_mutex
);
85 if (pf
== NFPROTO_UNSPEC
) {
86 for (i
= NFPROTO_UNSPEC
; i
< NFPROTO_NUMPROTO
; i
++) {
87 if (rcu_access_pointer(loggers
[i
][logger
->type
])) {
92 for (i
= NFPROTO_UNSPEC
; i
< NFPROTO_NUMPROTO
; i
++)
93 rcu_assign_pointer(loggers
[i
][logger
->type
], logger
);
95 if (rcu_access_pointer(loggers
[pf
][logger
->type
])) {
99 rcu_assign_pointer(loggers
[pf
][logger
->type
], logger
);
103 mutex_unlock(&nf_log_mutex
);
106 EXPORT_SYMBOL(nf_log_register
);
108 void nf_log_unregister(struct nf_logger
*logger
)
110 const struct nf_logger
*log
;
113 mutex_lock(&nf_log_mutex
);
114 for (i
= 0; i
< NFPROTO_NUMPROTO
; i
++) {
115 log
= nft_log_dereference(loggers
[i
][logger
->type
]);
117 RCU_INIT_POINTER(loggers
[i
][logger
->type
], NULL
);
119 mutex_unlock(&nf_log_mutex
);
122 EXPORT_SYMBOL(nf_log_unregister
);
124 int nf_log_bind_pf(struct net
*net
, u_int8_t pf
,
125 const struct nf_logger
*logger
)
127 if (pf
>= ARRAY_SIZE(net
->nf
.nf_loggers
))
129 mutex_lock(&nf_log_mutex
);
130 if (__find_logger(pf
, logger
->name
) == NULL
) {
131 mutex_unlock(&nf_log_mutex
);
134 rcu_assign_pointer(net
->nf
.nf_loggers
[pf
], logger
);
135 mutex_unlock(&nf_log_mutex
);
138 EXPORT_SYMBOL(nf_log_bind_pf
);
140 void nf_log_unbind_pf(struct net
*net
, u_int8_t pf
)
142 if (pf
>= ARRAY_SIZE(net
->nf
.nf_loggers
))
144 mutex_lock(&nf_log_mutex
);
145 RCU_INIT_POINTER(net
->nf
.nf_loggers
[pf
], NULL
);
146 mutex_unlock(&nf_log_mutex
);
148 EXPORT_SYMBOL(nf_log_unbind_pf
);
150 void nf_logger_request_module(int pf
, enum nf_log_type type
)
152 if (loggers
[pf
][type
] == NULL
)
153 request_module("nf-logger-%u-%u", pf
, type
);
155 EXPORT_SYMBOL_GPL(nf_logger_request_module
);
157 int nf_logger_find_get(int pf
, enum nf_log_type type
)
159 struct nf_logger
*logger
;
162 if (pf
== NFPROTO_INET
) {
163 ret
= nf_logger_find_get(NFPROTO_IPV4
, type
);
167 ret
= nf_logger_find_get(NFPROTO_IPV6
, type
);
169 nf_logger_put(NFPROTO_IPV4
, type
);
176 if (rcu_access_pointer(loggers
[pf
][type
]) == NULL
)
177 request_module("nf-logger-%u-%u", pf
, type
);
180 logger
= rcu_dereference(loggers
[pf
][type
]);
184 if (try_module_get(logger
->me
))
190 EXPORT_SYMBOL_GPL(nf_logger_find_get
);
192 void nf_logger_put(int pf
, enum nf_log_type type
)
194 struct nf_logger
*logger
;
196 if (pf
== NFPROTO_INET
) {
197 nf_logger_put(NFPROTO_IPV4
, type
);
198 nf_logger_put(NFPROTO_IPV6
, type
);
202 BUG_ON(loggers
[pf
][type
] == NULL
);
205 logger
= rcu_dereference(loggers
[pf
][type
]);
206 module_put(logger
->me
);
209 EXPORT_SYMBOL_GPL(nf_logger_put
);
211 void nf_log_packet(struct net
*net
,
213 unsigned int hooknum
,
214 const struct sk_buff
*skb
,
215 const struct net_device
*in
,
216 const struct net_device
*out
,
217 const struct nf_loginfo
*loginfo
,
218 const char *fmt
, ...)
221 char prefix
[NF_LOG_PREFIXLEN
];
222 const struct nf_logger
*logger
;
226 logger
= rcu_dereference(loggers
[pf
][loginfo
->type
]);
228 logger
= rcu_dereference(net
->nf
.nf_loggers
[pf
]);
232 vsnprintf(prefix
, sizeof(prefix
), fmt
, args
);
234 logger
->logfn(net
, pf
, hooknum
, skb
, in
, out
, loginfo
, prefix
);
238 EXPORT_SYMBOL(nf_log_packet
);
240 void nf_log_trace(struct net
*net
,
242 unsigned int hooknum
,
243 const struct sk_buff
*skb
,
244 const struct net_device
*in
,
245 const struct net_device
*out
,
246 const struct nf_loginfo
*loginfo
, const char *fmt
, ...)
249 char prefix
[NF_LOG_PREFIXLEN
];
250 const struct nf_logger
*logger
;
253 logger
= rcu_dereference(net
->nf
.nf_loggers
[pf
]);
256 vsnprintf(prefix
, sizeof(prefix
), fmt
, args
);
258 logger
->logfn(net
, pf
, hooknum
, skb
, in
, out
, loginfo
, prefix
);
262 EXPORT_SYMBOL(nf_log_trace
);
264 #define S_SIZE (1024 - (sizeof(unsigned int) + 1))
268 char buf
[S_SIZE
+ 1];
270 static struct nf_log_buf emergency
, *emergency_ptr
= &emergency
;
272 __printf(2, 3) int nf_log_buf_add(struct nf_log_buf
*m
, const char *f
, ...)
277 if (likely(m
->count
< S_SIZE
)) {
279 len
= vsnprintf(m
->buf
+ m
->count
, S_SIZE
- m
->count
, f
, args
);
281 if (likely(m
->count
+ len
< S_SIZE
)) {
287 printk_once(KERN_ERR KBUILD_MODNAME
" please increase S_SIZE\n");
290 EXPORT_SYMBOL_GPL(nf_log_buf_add
);
292 struct nf_log_buf
*nf_log_buf_open(void)
294 struct nf_log_buf
*m
= kmalloc(sizeof(*m
), GFP_ATOMIC
);
299 m
= xchg(&emergency_ptr
, NULL
);
305 EXPORT_SYMBOL_GPL(nf_log_buf_open
);
307 void nf_log_buf_close(struct nf_log_buf
*m
)
309 m
->buf
[m
->count
] = 0;
310 printk("%s\n", m
->buf
);
312 if (likely(m
!= &emergency
))
319 EXPORT_SYMBOL_GPL(nf_log_buf_close
);
321 #ifdef CONFIG_PROC_FS
322 static void *seq_start(struct seq_file
*seq
, loff_t
*pos
)
324 struct net
*net
= seq_file_net(seq
);
326 mutex_lock(&nf_log_mutex
);
328 if (*pos
>= ARRAY_SIZE(net
->nf
.nf_loggers
))
334 static void *seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
336 struct net
*net
= seq_file_net(s
);
340 if (*pos
>= ARRAY_SIZE(net
->nf
.nf_loggers
))
346 static void seq_stop(struct seq_file
*s
, void *v
)
348 mutex_unlock(&nf_log_mutex
);
351 static int seq_show(struct seq_file
*s
, void *v
)
354 const struct nf_logger
*logger
;
356 struct net
*net
= seq_file_net(s
);
358 logger
= nft_log_dereference(net
->nf
.nf_loggers
[*pos
]);
361 seq_printf(s
, "%2lld NONE (", *pos
);
363 seq_printf(s
, "%2lld %s (", *pos
, logger
->name
);
365 if (seq_has_overflowed(s
))
368 for (i
= 0; i
< NF_LOG_TYPE_MAX
; i
++) {
369 if (loggers
[*pos
][i
] == NULL
)
372 logger
= nft_log_dereference(loggers
[*pos
][i
]);
373 seq_printf(s
, "%s", logger
->name
);
374 if (i
== 0 && loggers
[*pos
][i
+ 1] != NULL
)
377 if (seq_has_overflowed(s
))
381 seq_printf(s
, ")\n");
383 if (seq_has_overflowed(s
))
388 static const struct seq_operations nflog_seq_ops
= {
395 static int nflog_open(struct inode
*inode
, struct file
*file
)
397 return seq_open_net(inode
, file
, &nflog_seq_ops
,
398 sizeof(struct seq_net_private
));
401 static const struct file_operations nflog_file_ops
= {
402 .owner
= THIS_MODULE
,
406 .release
= seq_release_net
,
413 static char nf_log_sysctl_fnames
[NFPROTO_NUMPROTO
-NFPROTO_UNSPEC
][3];
414 static struct ctl_table nf_log_sysctl_table
[NFPROTO_NUMPROTO
+1];
416 static int nf_log_proc_dostring(struct ctl_table
*table
, int write
,
417 void __user
*buffer
, size_t *lenp
, loff_t
*ppos
)
419 const struct nf_logger
*logger
;
420 char buf
[NFLOGGER_NAME_LEN
];
422 int tindex
= (unsigned long)table
->extra1
;
423 struct net
*net
= current
->nsproxy
->net_ns
;
426 struct ctl_table tmp
= *table
;
429 r
= proc_dostring(&tmp
, write
, buffer
, lenp
, ppos
);
433 if (!strcmp(buf
, "NONE")) {
434 nf_log_unbind_pf(net
, tindex
);
437 mutex_lock(&nf_log_mutex
);
438 logger
= __find_logger(tindex
, buf
);
439 if (logger
== NULL
) {
440 mutex_unlock(&nf_log_mutex
);
443 rcu_assign_pointer(net
->nf
.nf_loggers
[tindex
], logger
);
444 mutex_unlock(&nf_log_mutex
);
446 mutex_lock(&nf_log_mutex
);
447 logger
= nft_log_dereference(net
->nf
.nf_loggers
[tindex
]);
449 table
->data
= "NONE";
451 table
->data
= logger
->name
;
452 r
= proc_dostring(table
, write
, buffer
, lenp
, ppos
);
453 mutex_unlock(&nf_log_mutex
);
459 static int netfilter_log_sysctl_init(struct net
*net
)
462 struct ctl_table
*table
;
464 table
= nf_log_sysctl_table
;
465 if (!net_eq(net
, &init_net
)) {
466 table
= kmemdup(nf_log_sysctl_table
,
467 sizeof(nf_log_sysctl_table
),
472 for (i
= NFPROTO_UNSPEC
; i
< NFPROTO_NUMPROTO
; i
++) {
473 snprintf(nf_log_sysctl_fnames
[i
],
475 nf_log_sysctl_table
[i
].procname
=
476 nf_log_sysctl_fnames
[i
];
477 nf_log_sysctl_table
[i
].data
= NULL
;
478 nf_log_sysctl_table
[i
].maxlen
= NFLOGGER_NAME_LEN
;
479 nf_log_sysctl_table
[i
].mode
= 0644;
480 nf_log_sysctl_table
[i
].proc_handler
=
481 nf_log_proc_dostring
;
482 nf_log_sysctl_table
[i
].extra1
=
483 (void *)(unsigned long) i
;
487 net
->nf
.nf_log_dir_header
= register_net_sysctl(net
,
488 "net/netfilter/nf_log",
490 if (!net
->nf
.nf_log_dir_header
)
496 if (!net_eq(net
, &init_net
))
502 static void netfilter_log_sysctl_exit(struct net
*net
)
504 struct ctl_table
*table
;
506 table
= net
->nf
.nf_log_dir_header
->ctl_table_arg
;
507 unregister_net_sysctl_table(net
->nf
.nf_log_dir_header
);
508 if (!net_eq(net
, &init_net
))
512 static int netfilter_log_sysctl_init(struct net
*net
)
517 static void netfilter_log_sysctl_exit(struct net
*net
)
520 #endif /* CONFIG_SYSCTL */
522 static int __net_init
nf_log_net_init(struct net
*net
)
526 #ifdef CONFIG_PROC_FS
527 if (!proc_create("nf_log", S_IRUGO
,
528 net
->nf
.proc_netfilter
, &nflog_file_ops
))
531 ret
= netfilter_log_sysctl_init(net
);
538 #ifdef CONFIG_PROC_FS
539 remove_proc_entry("nf_log", net
->nf
.proc_netfilter
);
544 static void __net_exit
nf_log_net_exit(struct net
*net
)
546 netfilter_log_sysctl_exit(net
);
547 #ifdef CONFIG_PROC_FS
548 remove_proc_entry("nf_log", net
->nf
.proc_netfilter
);
552 static struct pernet_operations nf_log_net_ops
= {
553 .init
= nf_log_net_init
,
554 .exit
= nf_log_net_exit
,
557 int __init
netfilter_log_init(void)
559 return register_pernet_subsys(&nf_log_net_ops
);