~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/nf_conntrack_standalone.c

Version: ~ [ linux-5.12-rc1 ] ~ [ linux-5.11.2 ] ~ [ linux-5.10.19 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.101 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.177 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.222 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.258 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.258 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /* (C) 1999-2001 Paul `Rusty' Russell
  2  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
  3  * (C) 2005-2012 Patrick McHardy <kaber@trash.net>
  4  *
  5  * This program is free software; you can redistribute it and/or modify
  6  * it under the terms of the GNU General Public License version 2 as
  7  * published by the Free Software Foundation.
  8  */
  9 
 10 #include <linux/types.h>
 11 #include <linux/netfilter.h>
 12 #include <linux/slab.h>
 13 #include <linux/module.h>
 14 #include <linux/skbuff.h>
 15 #include <linux/proc_fs.h>
 16 #include <linux/seq_file.h>
 17 #include <linux/percpu.h>
 18 #include <linux/netdevice.h>
 19 #include <linux/security.h>
 20 #include <net/net_namespace.h>
 21 #ifdef CONFIG_SYSCTL
 22 #include <linux/sysctl.h>
 23 #endif
 24 
 25 #include <net/netfilter/nf_conntrack.h>
 26 #include <net/netfilter/nf_conntrack_core.h>
 27 #include <net/netfilter/nf_conntrack_l3proto.h>
 28 #include <net/netfilter/nf_conntrack_l4proto.h>
 29 #include <net/netfilter/nf_conntrack_expect.h>
 30 #include <net/netfilter/nf_conntrack_helper.h>
 31 #include <net/netfilter/nf_conntrack_acct.h>
 32 #include <net/netfilter/nf_conntrack_zones.h>
 33 #include <net/netfilter/nf_conntrack_timestamp.h>
 34 #include <linux/rculist_nulls.h>
 35 
 36 MODULE_LICENSE("GPL");
 37 
 38 #ifdef CONFIG_NF_CONNTRACK_PROCFS
 39 void
 40 print_tuple(struct seq_file *s, const struct nf_conntrack_tuple *tuple,
 41             const struct nf_conntrack_l3proto *l3proto,
 42             const struct nf_conntrack_l4proto *l4proto)
 43 {
 44         l3proto->print_tuple(s, tuple);
 45         l4proto->print_tuple(s, tuple);
 46 }
 47 EXPORT_SYMBOL_GPL(print_tuple);
 48 
 49 struct ct_iter_state {
 50         struct seq_net_private p;
 51         struct hlist_nulls_head *hash;
 52         unsigned int htable_size;
 53         unsigned int bucket;
 54         u_int64_t time_now;
 55 };
 56 
 57 static struct hlist_nulls_node *ct_get_first(struct seq_file *seq)
 58 {
 59         struct ct_iter_state *st = seq->private;
 60         struct hlist_nulls_node *n;
 61 
 62         for (st->bucket = 0;
 63              st->bucket < st->htable_size;
 64              st->bucket++) {
 65                 n = rcu_dereference(
 66                         hlist_nulls_first_rcu(&st->hash[st->bucket]));
 67                 if (!is_a_nulls(n))
 68                         return n;
 69         }
 70         return NULL;
 71 }
 72 
 73 static struct hlist_nulls_node *ct_get_next(struct seq_file *seq,
 74                                       struct hlist_nulls_node *head)
 75 {
 76         struct ct_iter_state *st = seq->private;
 77 
 78         head = rcu_dereference(hlist_nulls_next_rcu(head));
 79         while (is_a_nulls(head)) {
 80                 if (likely(get_nulls_value(head) == st->bucket)) {
 81                         if (++st->bucket >= st->htable_size)
 82                                 return NULL;
 83                 }
 84                 head = rcu_dereference(
 85                         hlist_nulls_first_rcu(&st->hash[st->bucket]));
 86         }
 87         return head;
 88 }
 89 
 90 static struct hlist_nulls_node *ct_get_idx(struct seq_file *seq, loff_t pos)
 91 {
 92         struct hlist_nulls_node *head = ct_get_first(seq);
 93 
 94         if (head)
 95                 while (pos && (head = ct_get_next(seq, head)))
 96                         pos--;
 97         return pos ? NULL : head;
 98 }
 99 
100 static void *ct_seq_start(struct seq_file *seq, loff_t *pos)
101         __acquires(RCU)
102 {
103         struct ct_iter_state *st = seq->private;
104 
105         st->time_now = ktime_get_real_ns();
106         rcu_read_lock();
107 
108         nf_conntrack_get_ht(&st->hash, &st->htable_size);
109         return ct_get_idx(seq, *pos);
110 }
111 
112 static void *ct_seq_next(struct seq_file *s, void *v, loff_t *pos)
113 {
114         (*pos)++;
115         return ct_get_next(s, v);
116 }
117 
118 static void ct_seq_stop(struct seq_file *s, void *v)
119         __releases(RCU)
120 {
121         rcu_read_unlock();
122 }
123 
124 #ifdef CONFIG_NF_CONNTRACK_SECMARK
125 static void ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
126 {
127         int ret;
128         u32 len;
129         char *secctx;
130 
131         ret = security_secid_to_secctx(ct->secmark, &secctx, &len);
132         if (ret)
133                 return;
134 
135         seq_printf(s, "secctx=%s ", secctx);
136 
137         security_release_secctx(secctx, len);
138 }
139 #else
140 static inline void ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
141 {
142 }
143 #endif
144 
145 #ifdef CONFIG_NF_CONNTRACK_ZONES
146 static void ct_show_zone(struct seq_file *s, const struct nf_conn *ct,
147                          int dir)
148 {
149         const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
150 
151         if (zone->dir != dir)
152                 return;
153         switch (zone->dir) {
154         case NF_CT_DEFAULT_ZONE_DIR:
155                 seq_printf(s, "zone=%u ", zone->id);
156                 break;
157         case NF_CT_ZONE_DIR_ORIG:
158                 seq_printf(s, "zone-orig=%u ", zone->id);
159                 break;
160         case NF_CT_ZONE_DIR_REPL:
161                 seq_printf(s, "zone-reply=%u ", zone->id);
162                 break;
163         default:
164                 break;
165         }
166 }
167 #else
168 static inline void ct_show_zone(struct seq_file *s, const struct nf_conn *ct,
169                                 int dir)
170 {
171 }
172 #endif
173 
174 #ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
175 static void ct_show_delta_time(struct seq_file *s, const struct nf_conn *ct)
176 {
177         struct ct_iter_state *st = s->private;
178         struct nf_conn_tstamp *tstamp;
179         s64 delta_time;
180 
181         tstamp = nf_conn_tstamp_find(ct);
182         if (tstamp) {
183                 delta_time = st->time_now - tstamp->start;
184                 if (delta_time > 0)
185                         delta_time = div_s64(delta_time, NSEC_PER_SEC);
186                 else
187                         delta_time = 0;
188 
189                 seq_printf(s, "delta-time=%llu ",
190                            (unsigned long long)delta_time);
191         }
192         return;
193 }
194 #else
195 static inline void
196 ct_show_delta_time(struct seq_file *s, const struct nf_conn *ct)
197 {
198 }
199 #endif
200 
201 /* return 0 on success, 1 in case of error */
202 static int ct_seq_show(struct seq_file *s, void *v)
203 {
204         struct nf_conntrack_tuple_hash *hash = v;
205         struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(hash);
206         const struct nf_conntrack_l3proto *l3proto;
207         const struct nf_conntrack_l4proto *l4proto;
208         struct net *net = seq_file_net(s);
209         int ret = 0;
210 
211         NF_CT_ASSERT(ct);
212         if (unlikely(!atomic_inc_not_zero(&ct->ct_general.use)))
213                 return 0;
214 
215         /* we only want to print DIR_ORIGINAL */
216         if (NF_CT_DIRECTION(hash))
217                 goto release;
218 
219         if (!net_eq(nf_ct_net(ct), net))
220                 goto release;
221 
222         l3proto = __nf_ct_l3proto_find(nf_ct_l3num(ct));
223         NF_CT_ASSERT(l3proto);
224         l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
225         NF_CT_ASSERT(l4proto);
226 
227         ret = -ENOSPC;
228         seq_printf(s, "%-8s %u %-8s %u %ld ",
229                    l3proto->name, nf_ct_l3num(ct),
230                    l4proto->name, nf_ct_protonum(ct),
231                    timer_pending(&ct->timeout)
232                    ? (long)(ct->timeout.expires - jiffies)/HZ : 0);
233 
234         if (l4proto->print_conntrack)
235                 l4proto->print_conntrack(s, ct);
236 
237         print_tuple(s, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
238                     l3proto, l4proto);
239 
240         ct_show_zone(s, ct, NF_CT_ZONE_DIR_ORIG);
241 
242         if (seq_has_overflowed(s))
243                 goto release;
244 
245         if (seq_print_acct(s, ct, IP_CT_DIR_ORIGINAL))
246                 goto release;
247 
248         if (!(test_bit(IPS_SEEN_REPLY_BIT, &ct->status)))
249                 seq_printf(s, "[UNREPLIED] ");
250 
251         print_tuple(s, &ct->tuplehash[IP_CT_DIR_REPLY].tuple,
252                     l3proto, l4proto);
253 
254         ct_show_zone(s, ct, NF_CT_ZONE_DIR_REPL);
255 
256         if (seq_print_acct(s, ct, IP_CT_DIR_REPLY))
257                 goto release;
258 
259         if (test_bit(IPS_ASSURED_BIT, &ct->status))
260                 seq_printf(s, "[ASSURED] ");
261 
262         if (seq_has_overflowed(s))
263                 goto release;
264 
265 #if defined(CONFIG_NF_CONNTRACK_MARK)
266         seq_printf(s, "mark=%u ", ct->mark);
267 #endif
268 
269         ct_show_secctx(s, ct);
270         ct_show_zone(s, ct, NF_CT_DEFAULT_ZONE_DIR);
271         ct_show_delta_time(s, ct);
272 
273         seq_printf(s, "use=%u\n", atomic_read(&ct->ct_general.use));
274 
275         if (seq_has_overflowed(s))
276                 goto release;
277 
278         ret = 0;
279 release:
280         nf_ct_put(ct);
281         return ret;
282 }
283 
284 static const struct seq_operations ct_seq_ops = {
285         .start = ct_seq_start,
286         .next  = ct_seq_next,
287         .stop  = ct_seq_stop,
288         .show  = ct_seq_show
289 };
290 
291 static int ct_open(struct inode *inode, struct file *file)
292 {
293         return seq_open_net(inode, file, &ct_seq_ops,
294                         sizeof(struct ct_iter_state));
295 }
296 
297 static const struct file_operations ct_file_ops = {
298         .owner   = THIS_MODULE,
299         .open    = ct_open,
300         .read    = seq_read,
301         .llseek  = seq_lseek,
302         .release = seq_release_net,
303 };
304 
305 static void *ct_cpu_seq_start(struct seq_file *seq, loff_t *pos)
306 {
307         struct net *net = seq_file_net(seq);
308         int cpu;
309 
310         if (*pos == 0)
311                 return SEQ_START_TOKEN;
312 
313         for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
314                 if (!cpu_possible(cpu))
315                         continue;
316                 *pos = cpu + 1;
317                 return per_cpu_ptr(net->ct.stat, cpu);
318         }
319 
320         return NULL;
321 }
322 
323 static void *ct_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
324 {
325         struct net *net = seq_file_net(seq);
326         int cpu;
327 
328         for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
329                 if (!cpu_possible(cpu))
330                         continue;
331                 *pos = cpu + 1;
332                 return per_cpu_ptr(net->ct.stat, cpu);
333         }
334 
335         return NULL;
336 }
337 
338 static void ct_cpu_seq_stop(struct seq_file *seq, void *v)
339 {
340 }
341 
342 static int ct_cpu_seq_show(struct seq_file *seq, void *v)
343 {
344         struct net *net = seq_file_net(seq);
345         unsigned int nr_conntracks = atomic_read(&net->ct.count);
346         const struct ip_conntrack_stat *st = v;
347 
348         if (v == SEQ_START_TOKEN) {
349                 seq_printf(seq, "entries  searched found new invalid ignore delete delete_list insert insert_failed drop early_drop icmp_error  expect_new expect_create expect_delete search_restart\n");
350                 return 0;
351         }
352 
353         seq_printf(seq, "%08x  %08x %08x %08x %08x %08x %08x %08x "
354                         "%08x %08x %08x %08x %08x  %08x %08x %08x %08x\n",
355                    nr_conntracks,
356                    st->searched,
357                    st->found,
358                    st->new,
359                    st->invalid,
360                    st->ignore,
361                    st->delete,
362                    st->delete_list,
363                    st->insert,
364                    st->insert_failed,
365                    st->drop,
366                    st->early_drop,
367                    st->error,
368 
369                    st->expect_new,
370                    st->expect_create,
371                    st->expect_delete,
372                    st->search_restart
373                 );
374         return 0;
375 }
376 
377 static const struct seq_operations ct_cpu_seq_ops = {
378         .start  = ct_cpu_seq_start,
379         .next   = ct_cpu_seq_next,
380         .stop   = ct_cpu_seq_stop,
381         .show   = ct_cpu_seq_show,
382 };
383 
384 static int ct_cpu_seq_open(struct inode *inode, struct file *file)
385 {
386         return seq_open_net(inode, file, &ct_cpu_seq_ops,
387                             sizeof(struct seq_net_private));
388 }
389 
390 static const struct file_operations ct_cpu_seq_fops = {
391         .owner   = THIS_MODULE,
392         .open    = ct_cpu_seq_open,
393         .read    = seq_read,
394         .llseek  = seq_lseek,
395         .release = seq_release_net,
396 };
397 
398 static int nf_conntrack_standalone_init_proc(struct net *net)
399 {
400         struct proc_dir_entry *pde;
401         kuid_t root_uid;
402         kgid_t root_gid;
403 
404         pde = proc_create("nf_conntrack", 0440, net->proc_net, &ct_file_ops);
405         if (!pde)
406                 goto out_nf_conntrack;
407 
408         root_uid = make_kuid(net->user_ns, 0);
409         root_gid = make_kgid(net->user_ns, 0);
410         if (uid_valid(root_uid) && gid_valid(root_gid))
411                 proc_set_user(pde, root_uid, root_gid);
412 
413         pde = proc_create("nf_conntrack", S_IRUGO, net->proc_net_stat,
414                           &ct_cpu_seq_fops);
415         if (!pde)
416                 goto out_stat_nf_conntrack;
417         return 0;
418 
419 out_stat_nf_conntrack:
420         remove_proc_entry("nf_conntrack", net->proc_net);
421 out_nf_conntrack:
422         return -ENOMEM;
423 }
424 
425 static void nf_conntrack_standalone_fini_proc(struct net *net)
426 {
427         remove_proc_entry("nf_conntrack", net->proc_net_stat);
428         remove_proc_entry("nf_conntrack", net->proc_net);
429 }
430 #else
431 static int nf_conntrack_standalone_init_proc(struct net *net)
432 {
433         return 0;
434 }
435 
436 static void nf_conntrack_standalone_fini_proc(struct net *net)
437 {
438 }
439 #endif /* CONFIG_NF_CONNTRACK_PROCFS */
440 
441 /* Sysctl support */
442 
443 #ifdef CONFIG_SYSCTL
444 /* Log invalid packets of a given protocol */
445 static int log_invalid_proto_min __read_mostly;
446 static int log_invalid_proto_max __read_mostly = 255;
447 
448 /* size the user *wants to set */
449 static unsigned int nf_conntrack_htable_size_user __read_mostly;
450 
451 static int
452 nf_conntrack_hash_sysctl(struct ctl_table *table, int write,
453                          void __user *buffer, size_t *lenp, loff_t *ppos)
454 {
455         int ret;
456 
457         ret = proc_dointvec(table, write, buffer, lenp, ppos);
458         if (ret < 0 || !write)
459                 return ret;
460 
461         /* update ret, we might not be able to satisfy request */
462         ret = nf_conntrack_hash_resize(nf_conntrack_htable_size_user);
463 
464         /* update it to the actual value used by conntrack */
465         nf_conntrack_htable_size_user = nf_conntrack_htable_size;
466         return ret;
467 }
468 
469 static struct ctl_table_header *nf_ct_netfilter_header;
470 
471 static struct ctl_table nf_ct_sysctl_table[] = {
472         {
473                 .procname       = "nf_conntrack_max",
474                 .data           = &nf_conntrack_max,
475                 .maxlen         = sizeof(int),
476                 .mode           = 0644,
477                 .proc_handler   = proc_dointvec,
478         },
479         {
480                 .procname       = "nf_conntrack_count",
481                 .data           = &init_net.ct.count,
482                 .maxlen         = sizeof(int),
483                 .mode           = 0444,
484                 .proc_handler   = proc_dointvec,
485         },
486         {
487                 .procname       = "nf_conntrack_buckets",
488                 .data           = &nf_conntrack_htable_size_user,
489                 .maxlen         = sizeof(unsigned int),
490                 .mode           = 0644,
491                 .proc_handler   = nf_conntrack_hash_sysctl,
492         },
493         {
494                 .procname       = "nf_conntrack_checksum",
495                 .data           = &init_net.ct.sysctl_checksum,
496                 .maxlen         = sizeof(unsigned int),
497                 .mode           = 0644,
498                 .proc_handler   = proc_dointvec,
499         },
500         {
501                 .procname       = "nf_conntrack_log_invalid",
502                 .data           = &init_net.ct.sysctl_log_invalid,
503                 .maxlen         = sizeof(unsigned int),
504                 .mode           = 0644,
505                 .proc_handler   = proc_dointvec_minmax,
506                 .extra1         = &log_invalid_proto_min,
507                 .extra2         = &log_invalid_proto_max,
508         },
509         {
510                 .procname       = "nf_conntrack_expect_max",
511                 .data           = &nf_ct_expect_max,
512                 .maxlen         = sizeof(int),
513                 .mode           = 0644,
514                 .proc_handler   = proc_dointvec,
515         },
516         { }
517 };
518 
519 static struct ctl_table nf_ct_netfilter_table[] = {
520         {
521                 .procname       = "nf_conntrack_max",
522                 .data           = &nf_conntrack_max,
523                 .maxlen         = sizeof(int),
524                 .mode           = 0644,
525                 .proc_handler   = proc_dointvec,
526         },
527         { }
528 };
529 
530 static int nf_conntrack_standalone_init_sysctl(struct net *net)
531 {
532         struct ctl_table *table;
533 
534         table = kmemdup(nf_ct_sysctl_table, sizeof(nf_ct_sysctl_table),
535                         GFP_KERNEL);
536         if (!table)
537                 goto out_kmemdup;
538 
539         table[1].data = &net->ct.count;
540         table[3].data = &net->ct.sysctl_checksum;
541         table[4].data = &net->ct.sysctl_log_invalid;
542 
543         /* Don't export sysctls to unprivileged users */
544         if (net->user_ns != &init_user_ns)
545                 table[0].procname = NULL;
546 
547         if (!net_eq(&init_net, net))
548                 table[2].mode = 0444;
549 
550         net->ct.sysctl_header = register_net_sysctl(net, "net/netfilter", table);
551         if (!net->ct.sysctl_header)
552                 goto out_unregister_netfilter;
553 
554         return 0;
555 
556 out_unregister_netfilter:
557         kfree(table);
558 out_kmemdup:
559         return -ENOMEM;
560 }
561 
562 static void nf_conntrack_standalone_fini_sysctl(struct net *net)
563 {
564         struct ctl_table *table;
565 
566         table = net->ct.sysctl_header->ctl_table_arg;
567         unregister_net_sysctl_table(net->ct.sysctl_header);
568         kfree(table);
569 }
570 #else
571 static int nf_conntrack_standalone_init_sysctl(struct net *net)
572 {
573         return 0;
574 }
575 
576 static void nf_conntrack_standalone_fini_sysctl(struct net *net)
577 {
578 }
579 #endif /* CONFIG_SYSCTL */
580 
581 static int nf_conntrack_pernet_init(struct net *net)
582 {
583         int ret;
584 
585         ret = nf_conntrack_init_net(net);
586         if (ret < 0)
587                 goto out_init;
588 
589         ret = nf_conntrack_standalone_init_proc(net);
590         if (ret < 0)
591                 goto out_proc;
592 
593         net->ct.sysctl_checksum = 1;
594         net->ct.sysctl_log_invalid = 0;
595         ret = nf_conntrack_standalone_init_sysctl(net);
596         if (ret < 0)
597                 goto out_sysctl;
598 
599         return 0;
600 
601 out_sysctl:
602         nf_conntrack_standalone_fini_proc(net);
603 out_proc:
604         nf_conntrack_cleanup_net(net);
605 out_init:
606         return ret;
607 }
608 
609 static void nf_conntrack_pernet_exit(struct list_head *net_exit_list)
610 {
611         struct net *net;
612 
613         list_for_each_entry(net, net_exit_list, exit_list) {
614                 nf_conntrack_standalone_fini_sysctl(net);
615                 nf_conntrack_standalone_fini_proc(net);
616         }
617         nf_conntrack_cleanup_net_list(net_exit_list);
618 }
619 
620 static struct pernet_operations nf_conntrack_net_ops = {
621         .init           = nf_conntrack_pernet_init,
622         .exit_batch     = nf_conntrack_pernet_exit,
623 };
624 
625 static int __init nf_conntrack_standalone_init(void)
626 {
627         int ret = nf_conntrack_init_start();
628         if (ret < 0)
629                 goto out_start;
630 
631 #ifdef CONFIG_SYSCTL
632         nf_ct_netfilter_header =
633                 register_net_sysctl(&init_net, "net", nf_ct_netfilter_table);
634         if (!nf_ct_netfilter_header) {
635                 pr_err("nf_conntrack: can't register to sysctl.\n");
636                 ret = -ENOMEM;
637                 goto out_sysctl;
638         }
639 
640         nf_conntrack_htable_size_user = nf_conntrack_htable_size;
641 #endif
642 
643         ret = register_pernet_subsys(&nf_conntrack_net_ops);
644         if (ret < 0)
645                 goto out_pernet;
646 
647         nf_conntrack_init_end();
648         return 0;
649 
650 out_pernet:
651 #ifdef CONFIG_SYSCTL
652         unregister_net_sysctl_table(nf_ct_netfilter_header);
653 out_sysctl:
654 #endif
655         nf_conntrack_cleanup_end();
656 out_start:
657         return ret;
658 }
659 
660 static void __exit nf_conntrack_standalone_fini(void)
661 {
662         nf_conntrack_cleanup_start();
663         unregister_pernet_subsys(&nf_conntrack_net_ops);
664 #ifdef CONFIG_SYSCTL
665         unregister_net_sysctl_table(nf_ct_netfilter_header);
666 #endif
667         nf_conntrack_cleanup_end();
668 }
669 
670 module_init(nf_conntrack_standalone_init);
671 module_exit(nf_conntrack_standalone_fini);
672 
673 /* Some modules need us, but don't depend directly on any symbol.
674    They should call this. */
675 void need_conntrack(void)
676 {
677 }
678 EXPORT_SYMBOL_GPL(need_conntrack);
679 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp