~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/nf_log.c

Version: ~ [ linux-5.4-rc7 ] ~ [ linux-5.3.11 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.84 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.154 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.201 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.201 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.77 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 #include <linux/kernel.h>
  2 #include <linux/init.h>
  3 #include <linux/module.h>
  4 #include <linux/proc_fs.h>
  5 #include <linux/skbuff.h>
  6 #include <linux/netfilter.h>
  7 #include <linux/seq_file.h>
  8 #include <net/protocol.h>
  9 #include <net/netfilter/nf_log.h>
 10 
 11 #include "nf_internals.h"
 12 
 13 /* Internal logging interface, which relies on the real
 14    LOG target modules */
 15 
 16 #define NF_LOG_PREFIXLEN                128
 17 #define NFLOGGER_NAME_LEN               64
 18 
 19 static struct list_head nf_loggers_l[NFPROTO_NUMPROTO] __read_mostly;
 20 static DEFINE_MUTEX(nf_log_mutex);
 21 
 22 static struct nf_logger *__find_logger(int pf, const char *str_logger)
 23 {
 24         struct nf_logger *t;
 25 
 26         list_for_each_entry(t, &nf_loggers_l[pf], list[pf]) {
 27                 if (!strnicmp(str_logger, t->name, strlen(t->name)))
 28                         return t;
 29         }
 30 
 31         return NULL;
 32 }
 33 
 34 void nf_log_set(struct net *net, u_int8_t pf, const struct nf_logger *logger)
 35 {
 36         const struct nf_logger *log;
 37 
 38         if (pf == NFPROTO_UNSPEC)
 39                 return;
 40 
 41         mutex_lock(&nf_log_mutex);
 42         log = rcu_dereference_protected(net->nf.nf_loggers[pf],
 43                                         lockdep_is_held(&nf_log_mutex));
 44         if (log == NULL)
 45                 rcu_assign_pointer(net->nf.nf_loggers[pf], logger);
 46 
 47         mutex_unlock(&nf_log_mutex);
 48 }
 49 EXPORT_SYMBOL(nf_log_set);
 50 
 51 void nf_log_unset(struct net *net, const struct nf_logger *logger)
 52 {
 53         int i;
 54         const struct nf_logger *log;
 55 
 56         mutex_lock(&nf_log_mutex);
 57         for (i = 0; i < NFPROTO_NUMPROTO; i++) {
 58                 log = rcu_dereference_protected(net->nf.nf_loggers[i],
 59                                 lockdep_is_held(&nf_log_mutex));
 60                 if (log == logger)
 61                         RCU_INIT_POINTER(net->nf.nf_loggers[i], NULL);
 62         }
 63         mutex_unlock(&nf_log_mutex);
 64         synchronize_rcu();
 65 }
 66 EXPORT_SYMBOL(nf_log_unset);
 67 
 68 /* return EEXIST if the same logger is registered, 0 on success. */
 69 int nf_log_register(u_int8_t pf, struct nf_logger *logger)
 70 {
 71         int i;
 72 
 73         if (pf >= ARRAY_SIZE(init_net.nf.nf_loggers))
 74                 return -EINVAL;
 75 
 76         for (i = 0; i < ARRAY_SIZE(logger->list); i++)
 77                 INIT_LIST_HEAD(&logger->list[i]);
 78 
 79         mutex_lock(&nf_log_mutex);
 80 
 81         if (pf == NFPROTO_UNSPEC) {
 82                 for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++)
 83                         list_add_tail(&(logger->list[i]), &(nf_loggers_l[i]));
 84         } else {
 85                 /* register at end of list to honor first register win */
 86                 list_add_tail(&logger->list[pf], &nf_loggers_l[pf]);
 87         }
 88 
 89         mutex_unlock(&nf_log_mutex);
 90 
 91         return 0;
 92 }
 93 EXPORT_SYMBOL(nf_log_register);
 94 
 95 void nf_log_unregister(struct nf_logger *logger)
 96 {
 97         int i;
 98 
 99         mutex_lock(&nf_log_mutex);
100         for (i = 0; i < NFPROTO_NUMPROTO; i++)
101                 list_del(&logger->list[i]);
102         mutex_unlock(&nf_log_mutex);
103 }
104 EXPORT_SYMBOL(nf_log_unregister);
105 
106 int nf_log_bind_pf(struct net *net, u_int8_t pf,
107                    const struct nf_logger *logger)
108 {
109         if (pf >= ARRAY_SIZE(net->nf.nf_loggers))
110                 return -EINVAL;
111         mutex_lock(&nf_log_mutex);
112         if (__find_logger(pf, logger->name) == NULL) {
113                 mutex_unlock(&nf_log_mutex);
114                 return -ENOENT;
115         }
116         rcu_assign_pointer(net->nf.nf_loggers[pf], logger);
117         mutex_unlock(&nf_log_mutex);
118         return 0;
119 }
120 EXPORT_SYMBOL(nf_log_bind_pf);
121 
122 void nf_log_unbind_pf(struct net *net, u_int8_t pf)
123 {
124         if (pf >= ARRAY_SIZE(net->nf.nf_loggers))
125                 return;
126         mutex_lock(&nf_log_mutex);
127         RCU_INIT_POINTER(net->nf.nf_loggers[pf], NULL);
128         mutex_unlock(&nf_log_mutex);
129 }
130 EXPORT_SYMBOL(nf_log_unbind_pf);
131 
132 void nf_log_packet(struct net *net,
133                    u_int8_t pf,
134                    unsigned int hooknum,
135                    const struct sk_buff *skb,
136                    const struct net_device *in,
137                    const struct net_device *out,
138                    const struct nf_loginfo *loginfo,
139                    const char *fmt, ...)
140 {
141         va_list args;
142         char prefix[NF_LOG_PREFIXLEN];
143         const struct nf_logger *logger;
144 
145         rcu_read_lock();
146         logger = rcu_dereference(net->nf.nf_loggers[pf]);
147         if (logger) {
148                 va_start(args, fmt);
149                 vsnprintf(prefix, sizeof(prefix), fmt, args);
150                 va_end(args);
151                 logger->logfn(net, pf, hooknum, skb, in, out, loginfo, prefix);
152         }
153         rcu_read_unlock();
154 }
155 EXPORT_SYMBOL(nf_log_packet);
156 
157 #ifdef CONFIG_PROC_FS
158 static void *seq_start(struct seq_file *seq, loff_t *pos)
159 {
160         struct net *net = seq_file_net(seq);
161 
162         mutex_lock(&nf_log_mutex);
163 
164         if (*pos >= ARRAY_SIZE(net->nf.nf_loggers))
165                 return NULL;
166 
167         return pos;
168 }
169 
170 static void *seq_next(struct seq_file *s, void *v, loff_t *pos)
171 {
172         struct net *net = seq_file_net(s);
173 
174         (*pos)++;
175 
176         if (*pos >= ARRAY_SIZE(net->nf.nf_loggers))
177                 return NULL;
178 
179         return pos;
180 }
181 
182 static void seq_stop(struct seq_file *s, void *v)
183 {
184         mutex_unlock(&nf_log_mutex);
185 }
186 
187 static int seq_show(struct seq_file *s, void *v)
188 {
189         loff_t *pos = v;
190         const struct nf_logger *logger;
191         struct nf_logger *t;
192         int ret;
193         struct net *net = seq_file_net(s);
194 
195         logger = rcu_dereference_protected(net->nf.nf_loggers[*pos],
196                                            lockdep_is_held(&nf_log_mutex));
197 
198         if (!logger)
199                 ret = seq_printf(s, "%2lld NONE (", *pos);
200         else
201                 ret = seq_printf(s, "%2lld %s (", *pos, logger->name);
202 
203         if (ret < 0)
204                 return ret;
205 
206         list_for_each_entry(t, &nf_loggers_l[*pos], list[*pos]) {
207                 ret = seq_printf(s, "%s", t->name);
208                 if (ret < 0)
209                         return ret;
210                 if (&t->list[*pos] != nf_loggers_l[*pos].prev) {
211                         ret = seq_printf(s, ",");
212                         if (ret < 0)
213                                 return ret;
214                 }
215         }
216 
217         return seq_printf(s, ")\n");
218 }
219 
220 static const struct seq_operations nflog_seq_ops = {
221         .start  = seq_start,
222         .next   = seq_next,
223         .stop   = seq_stop,
224         .show   = seq_show,
225 };
226 
227 static int nflog_open(struct inode *inode, struct file *file)
228 {
229         return seq_open_net(inode, file, &nflog_seq_ops,
230                             sizeof(struct seq_net_private));
231 }
232 
233 static const struct file_operations nflog_file_ops = {
234         .owner   = THIS_MODULE,
235         .open    = nflog_open,
236         .read    = seq_read,
237         .llseek  = seq_lseek,
238         .release = seq_release_net,
239 };
240 
241 
242 #endif /* PROC_FS */
243 
244 #ifdef CONFIG_SYSCTL
245 static char nf_log_sysctl_fnames[NFPROTO_NUMPROTO-NFPROTO_UNSPEC][3];
246 static struct ctl_table nf_log_sysctl_table[NFPROTO_NUMPROTO+1];
247 
248 static int nf_log_proc_dostring(ctl_table *table, int write,
249                          void __user *buffer, size_t *lenp, loff_t *ppos)
250 {
251         const struct nf_logger *logger;
252         char buf[NFLOGGER_NAME_LEN];
253         size_t size = *lenp;
254         int r = 0;
255         int tindex = (unsigned long)table->extra1;
256         struct net *net = table->extra2;
257 
258         if (write) {
259                 if (size > sizeof(buf))
260                         size = sizeof(buf);
261                 if (copy_from_user(buf, buffer, size))
262                         return -EFAULT;
263 
264                 if (!strcmp(buf, "NONE")) {
265                         nf_log_unbind_pf(net, tindex);
266                         return 0;
267                 }
268                 mutex_lock(&nf_log_mutex);
269                 logger = __find_logger(tindex, buf);
270                 if (logger == NULL) {
271                         mutex_unlock(&nf_log_mutex);
272                         return -ENOENT;
273                 }
274                 rcu_assign_pointer(net->nf.nf_loggers[tindex], logger);
275                 mutex_unlock(&nf_log_mutex);
276         } else {
277                 mutex_lock(&nf_log_mutex);
278                 logger = rcu_dereference_protected(net->nf.nf_loggers[tindex],
279                                                    lockdep_is_held(&nf_log_mutex));
280                 if (!logger)
281                         table->data = "NONE";
282                 else
283                         table->data = logger->name;
284                 r = proc_dostring(table, write, buffer, lenp, ppos);
285                 mutex_unlock(&nf_log_mutex);
286         }
287 
288         return r;
289 }
290 
291 static int netfilter_log_sysctl_init(struct net *net)
292 {
293         int i;
294         struct ctl_table *table;
295 
296         table = nf_log_sysctl_table;
297         if (!net_eq(net, &init_net)) {
298                 table = kmemdup(nf_log_sysctl_table,
299                                  sizeof(nf_log_sysctl_table),
300                                  GFP_KERNEL);
301                 if (!table)
302                         goto err_alloc;
303         } else {
304                 for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++) {
305                         snprintf(nf_log_sysctl_fnames[i],
306                                  3, "%d", i);
307                         nf_log_sysctl_table[i].procname =
308                                 nf_log_sysctl_fnames[i];
309                         nf_log_sysctl_table[i].maxlen =
310                                 NFLOGGER_NAME_LEN * sizeof(char);
311                         nf_log_sysctl_table[i].mode = 0644;
312                         nf_log_sysctl_table[i].proc_handler =
313                                 nf_log_proc_dostring;
314                         nf_log_sysctl_table[i].extra1 =
315                                 (void *)(unsigned long) i;
316                 }
317         }
318 
319         for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++)
320                 table[i].extra2 = net;
321 
322         net->nf.nf_log_dir_header = register_net_sysctl(net,
323                                                 "net/netfilter/nf_log",
324                                                 table);
325         if (!net->nf.nf_log_dir_header)
326                 goto err_reg;
327 
328         return 0;
329 
330 err_reg:
331         if (!net_eq(net, &init_net))
332                 kfree(table);
333 err_alloc:
334         return -ENOMEM;
335 }
336 
337 static void netfilter_log_sysctl_exit(struct net *net)
338 {
339         struct ctl_table *table;
340 
341         table = net->nf.nf_log_dir_header->ctl_table_arg;
342         unregister_net_sysctl_table(net->nf.nf_log_dir_header);
343         if (!net_eq(net, &init_net))
344                 kfree(table);
345 }
346 #else
347 static int netfilter_log_sysctl_init(struct net *net)
348 {
349         return 0;
350 }
351 
352 static void netfilter_log_sysctl_exit(struct net *net)
353 {
354 }
355 #endif /* CONFIG_SYSCTL */
356 
357 static int __net_init nf_log_net_init(struct net *net)
358 {
359         int ret = -ENOMEM;
360 
361 #ifdef CONFIG_PROC_FS
362         if (!proc_create("nf_log", S_IRUGO,
363                          net->nf.proc_netfilter, &nflog_file_ops))
364                 return ret;
365 #endif
366         ret = netfilter_log_sysctl_init(net);
367         if (ret < 0)
368                 goto out_sysctl;
369 
370         return 0;
371 
372 out_sysctl:
373 #ifdef CONFIG_PROC_FS
374         /* For init_net: errors will trigger panic, don't unroll on error. */
375         if (!net_eq(net, &init_net))
376                 remove_proc_entry("nf_log", net->nf.proc_netfilter);
377 #endif
378         return ret;
379 }
380 
381 static void __net_exit nf_log_net_exit(struct net *net)
382 {
383         netfilter_log_sysctl_exit(net);
384 #ifdef CONFIG_PROC_FS
385         remove_proc_entry("nf_log", net->nf.proc_netfilter);
386 #endif
387 }
388 
389 static struct pernet_operations nf_log_net_ops = {
390         .init = nf_log_net_init,
391         .exit = nf_log_net_exit,
392 };
393 
394 int __init netfilter_log_init(void)
395 {
396         int i, ret;
397 
398         ret = register_pernet_subsys(&nf_log_net_ops);
399         if (ret < 0)
400                 return ret;
401 
402         for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++)
403                 INIT_LIST_HEAD(&(nf_loggers_l[i]));
404 
405         return 0;
406 }
407 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp