1 #include <linux/kernel.h> 2 #include <linux/init.h> 3 #include <linux/module.h> 4 #include <linux/proc_fs.h> 5 #include <linux/skbuff.h> 6 #include <linux/netfilter.h> 7 #include <linux/seq_file.h> 8 #include <net/protocol.h> 9 #include <net/netfilter/nf_log.h> 10 11 #include "nf_internals.h" 12 13 /* Internal logging interface, which relies on the real 14 LOG target modules */ 15 16 #define NFLOGGER_NAME_LEN 64 17 18 int sysctl_nf_log_all_netns __read_mostly; 19 EXPORT_SYMBOL(sysctl_nf_log_all_netns); 20 21 static struct nf_logger __rcu *loggers[NFPROTO_NUMPROTO][NF_LOG_TYPE_MAX] __read_mostly; 22 static DEFINE_MUTEX(nf_log_mutex); 23 24 #define nft_log_dereference(logger) \ 25 rcu_dereference_protected(logger, lockdep_is_held(&nf_log_mutex)) 26 27 static struct nf_logger *__find_logger(int pf, const char *str_logger) 28 { 29 struct nf_logger *log; 30 int i; 31 32 for (i = 0; i < NF_LOG_TYPE_MAX; i++) { 33 if (loggers[pf][i] == NULL) 34 continue; 35 36 log = nft_log_dereference(loggers[pf][i]); 37 if (!strncasecmp(str_logger, log->name, strlen(log->name))) 38 return log; 39 } 40 41 return NULL; 42 } 43 44 int nf_log_set(struct net *net, u_int8_t pf, const struct nf_logger *logger) 45 { 46 const struct nf_logger *log; 47 48 if (pf == NFPROTO_UNSPEC || pf >= ARRAY_SIZE(net->nf.nf_loggers)) 49 return -EOPNOTSUPP; 50 51 mutex_lock(&nf_log_mutex); 52 log = nft_log_dereference(net->nf.nf_loggers[pf]); 53 if (log == NULL) 54 rcu_assign_pointer(net->nf.nf_loggers[pf], logger); 55 56 mutex_unlock(&nf_log_mutex); 57 58 return 0; 59 } 60 EXPORT_SYMBOL(nf_log_set); 61 62 void nf_log_unset(struct net *net, const struct nf_logger *logger) 63 { 64 int i; 65 const struct nf_logger *log; 66 67 mutex_lock(&nf_log_mutex); 68 for (i = 0; i < NFPROTO_NUMPROTO; i++) { 69 log = nft_log_dereference(net->nf.nf_loggers[i]); 70 if (log == logger) 71 RCU_INIT_POINTER(net->nf.nf_loggers[i], NULL); 72 } 73 mutex_unlock(&nf_log_mutex); 74 synchronize_rcu(); 75 } 76 EXPORT_SYMBOL(nf_log_unset); 77 78 /* return EEXIST if the same logger is registered, 0 on success. */ 79 int nf_log_register(u_int8_t pf, struct nf_logger *logger) 80 { 81 int i; 82 int ret = 0; 83 84 if (pf >= ARRAY_SIZE(init_net.nf.nf_loggers)) 85 return -EINVAL; 86 87 mutex_lock(&nf_log_mutex); 88 89 if (pf == NFPROTO_UNSPEC) { 90 for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++) { 91 if (rcu_access_pointer(loggers[i][logger->type])) { 92 ret = -EEXIST; 93 goto unlock; 94 } 95 } 96 for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++) 97 rcu_assign_pointer(loggers[i][logger->type], logger); 98 } else { 99 if (rcu_access_pointer(loggers[pf][logger->type])) { 100 ret = -EEXIST; 101 goto unlock; 102 } 103 rcu_assign_pointer(loggers[pf][logger->type], logger); 104 } 105 106 unlock: 107 mutex_unlock(&nf_log_mutex); 108 return ret; 109 } 110 EXPORT_SYMBOL(nf_log_register); 111 112 void nf_log_unregister(struct nf_logger *logger) 113 { 114 const struct nf_logger *log; 115 int i; 116 117 mutex_lock(&nf_log_mutex); 118 for (i = 0; i < NFPROTO_NUMPROTO; i++) { 119 log = nft_log_dereference(loggers[i][logger->type]); 120 if (log == logger) 121 RCU_INIT_POINTER(loggers[i][logger->type], NULL); 122 } 123 mutex_unlock(&nf_log_mutex); 124 synchronize_rcu(); 125 } 126 EXPORT_SYMBOL(nf_log_unregister); 127 128 int nf_log_bind_pf(struct net *net, u_int8_t pf, 129 const struct nf_logger *logger) 130 { 131 if (pf >= ARRAY_SIZE(net->nf.nf_loggers)) 132 return -EINVAL; 133 mutex_lock(&nf_log_mutex); 134 if (__find_logger(pf, logger->name) == NULL) { 135 mutex_unlock(&nf_log_mutex); 136 return -ENOENT; 137 } 138 rcu_assign_pointer(net->nf.nf_loggers[pf], logger); 139 mutex_unlock(&nf_log_mutex); 140 return 0; 141 } 142 EXPORT_SYMBOL(nf_log_bind_pf); 143 144 void nf_log_unbind_pf(struct net *net, u_int8_t pf) 145 { 146 if (pf >= ARRAY_SIZE(net->nf.nf_loggers)) 147 return; 148 mutex_lock(&nf_log_mutex); 149 RCU_INIT_POINTER(net->nf.nf_loggers[pf], NULL); 150 mutex_unlock(&nf_log_mutex); 151 } 152 EXPORT_SYMBOL(nf_log_unbind_pf); 153 154 void nf_logger_request_module(int pf, enum nf_log_type type) 155 { 156 if (loggers[pf][type] == NULL) 157 request_module("nf-logger-%u-%u", pf, type); 158 } 159 EXPORT_SYMBOL_GPL(nf_logger_request_module); 160 161 int nf_logger_find_get(int pf, enum nf_log_type type) 162 { 163 struct nf_logger *logger; 164 int ret = -ENOENT; 165 166 if (pf == NFPROTO_INET) { 167 ret = nf_logger_find_get(NFPROTO_IPV4, type); 168 if (ret < 0) 169 return ret; 170 171 ret = nf_logger_find_get(NFPROTO_IPV6, type); 172 if (ret < 0) { 173 nf_logger_put(NFPROTO_IPV4, type); 174 return ret; 175 } 176 177 return 0; 178 } 179 180 if (rcu_access_pointer(loggers[pf][type]) == NULL) 181 request_module("nf-logger-%u-%u", pf, type); 182 183 rcu_read_lock(); 184 logger = rcu_dereference(loggers[pf][type]); 185 if (logger == NULL) 186 goto out; 187 188 if (try_module_get(logger->me)) 189 ret = 0; 190 out: 191 rcu_read_unlock(); 192 return ret; 193 } 194 EXPORT_SYMBOL_GPL(nf_logger_find_get); 195 196 void nf_logger_put(int pf, enum nf_log_type type) 197 { 198 struct nf_logger *logger; 199 200 if (pf == NFPROTO_INET) { 201 nf_logger_put(NFPROTO_IPV4, type); 202 nf_logger_put(NFPROTO_IPV6, type); 203 return; 204 } 205 206 BUG_ON(loggers[pf][type] == NULL); 207 208 rcu_read_lock(); 209 logger = rcu_dereference(loggers[pf][type]); 210 module_put(logger->me); 211 rcu_read_unlock(); 212 } 213 EXPORT_SYMBOL_GPL(nf_logger_put); 214 215 void nf_log_packet(struct net *net, 216 u_int8_t pf, 217 unsigned int hooknum, 218 const struct sk_buff *skb, 219 const struct net_device *in, 220 const struct net_device *out, 221 const struct nf_loginfo *loginfo, 222 const char *fmt, ...) 223 { 224 va_list args; 225 char prefix[NF_LOG_PREFIXLEN]; 226 const struct nf_logger *logger; 227 228 rcu_read_lock(); 229 if (loginfo != NULL) 230 logger = rcu_dereference(loggers[pf][loginfo->type]); 231 else 232 logger = rcu_dereference(net->nf.nf_loggers[pf]); 233 234 if (logger) { 235 va_start(args, fmt); 236 vsnprintf(prefix, sizeof(prefix), fmt, args); 237 va_end(args); 238 logger->logfn(net, pf, hooknum, skb, in, out, loginfo, prefix); 239 } 240 rcu_read_unlock(); 241 } 242 EXPORT_SYMBOL(nf_log_packet); 243 244 void nf_log_trace(struct net *net, 245 u_int8_t pf, 246 unsigned int hooknum, 247 const struct sk_buff *skb, 248 const struct net_device *in, 249 const struct net_device *out, 250 const struct nf_loginfo *loginfo, const char *fmt, ...) 251 { 252 va_list args; 253 char prefix[NF_LOG_PREFIXLEN]; 254 const struct nf_logger *logger; 255 256 rcu_read_lock(); 257 logger = rcu_dereference(net->nf.nf_loggers[pf]); 258 if (logger) { 259 va_start(args, fmt); 260 vsnprintf(prefix, sizeof(prefix), fmt, args); 261 va_end(args); 262 logger->logfn(net, pf, hooknum, skb, in, out, loginfo, prefix); 263 } 264 rcu_read_unlock(); 265 } 266 EXPORT_SYMBOL(nf_log_trace); 267 268 #define S_SIZE (1024 - (sizeof(unsigned int) + 1)) 269 270 struct nf_log_buf { 271 unsigned int count; 272 char buf[S_SIZE + 1]; 273 }; 274 static struct nf_log_buf emergency, *emergency_ptr = &emergency; 275 276 __printf(2, 3) int nf_log_buf_add(struct nf_log_buf *m, const char *f, ...) 277 { 278 va_list args; 279 int len; 280 281 if (likely(m->count < S_SIZE)) { 282 va_start(args, f); 283 len = vsnprintf(m->buf + m->count, S_SIZE - m->count, f, args); 284 va_end(args); 285 if (likely(m->count + len < S_SIZE)) { 286 m->count += len; 287 return 0; 288 } 289 } 290 m->count = S_SIZE; 291 printk_once(KERN_ERR KBUILD_MODNAME " please increase S_SIZE\n"); 292 return -1; 293 } 294 EXPORT_SYMBOL_GPL(nf_log_buf_add); 295 296 struct nf_log_buf *nf_log_buf_open(void) 297 { 298 struct nf_log_buf *m = kmalloc(sizeof(*m), GFP_ATOMIC); 299 300 if (unlikely(!m)) { 301 local_bh_disable(); 302 do { 303 m = xchg(&emergency_ptr, NULL); 304 } while (!m); 305 } 306 m->count = 0; 307 return m; 308 } 309 EXPORT_SYMBOL_GPL(nf_log_buf_open); 310 311 void nf_log_buf_close(struct nf_log_buf *m) 312 { 313 m->buf[m->count] = 0; 314 printk("%s\n", m->buf); 315 316 if (likely(m != &emergency)) 317 kfree(m); 318 else { 319 emergency_ptr = m; 320 local_bh_enable(); 321 } 322 } 323 EXPORT_SYMBOL_GPL(nf_log_buf_close); 324 325 #ifdef CONFIG_PROC_FS 326 static void *seq_start(struct seq_file *seq, loff_t *pos) 327 { 328 struct net *net = seq_file_net(seq); 329 330 mutex_lock(&nf_log_mutex); 331 332 if (*pos >= ARRAY_SIZE(net->nf.nf_loggers)) 333 return NULL; 334 335 return pos; 336 } 337 338 static void *seq_next(struct seq_file *s, void *v, loff_t *pos) 339 { 340 struct net *net = seq_file_net(s); 341 342 (*pos)++; 343 344 if (*pos >= ARRAY_SIZE(net->nf.nf_loggers)) 345 return NULL; 346 347 return pos; 348 } 349 350 static void seq_stop(struct seq_file *s, void *v) 351 { 352 mutex_unlock(&nf_log_mutex); 353 } 354 355 static int seq_show(struct seq_file *s, void *v) 356 { 357 loff_t *pos = v; 358 const struct nf_logger *logger; 359 int i; 360 struct net *net = seq_file_net(s); 361 362 logger = nft_log_dereference(net->nf.nf_loggers[*pos]); 363 364 if (!logger) 365 seq_printf(s, "%2lld NONE (", *pos); 366 else 367 seq_printf(s, "%2lld %s (", *pos, logger->name); 368 369 if (seq_has_overflowed(s)) 370 return -ENOSPC; 371 372 for (i = 0; i < NF_LOG_TYPE_MAX; i++) { 373 if (loggers[*pos][i] == NULL) 374 continue; 375 376 logger = nft_log_dereference(loggers[*pos][i]); 377 seq_printf(s, "%s", logger->name); 378 if (i == 0 && loggers[*pos][i + 1] != NULL) 379 seq_printf(s, ","); 380 381 if (seq_has_overflowed(s)) 382 return -ENOSPC; 383 } 384 385 seq_printf(s, ")\n"); 386 387 if (seq_has_overflowed(s)) 388 return -ENOSPC; 389 return 0; 390 } 391 392 static const struct seq_operations nflog_seq_ops = { 393 .start = seq_start, 394 .next = seq_next, 395 .stop = seq_stop, 396 .show = seq_show, 397 }; 398 399 static int nflog_open(struct inode *inode, struct file *file) 400 { 401 return seq_open_net(inode, file, &nflog_seq_ops, 402 sizeof(struct seq_net_private)); 403 } 404 405 static const struct file_operations nflog_file_ops = { 406 .owner = THIS_MODULE, 407 .open = nflog_open, 408 .read = seq_read, 409 .llseek = seq_lseek, 410 .release = seq_release_net, 411 }; 412 413 414 #endif /* PROC_FS */ 415 416 #ifdef CONFIG_SYSCTL 417 static char nf_log_sysctl_fnames[NFPROTO_NUMPROTO-NFPROTO_UNSPEC][3]; 418 static struct ctl_table nf_log_sysctl_table[NFPROTO_NUMPROTO+1]; 419 static struct ctl_table_header *nf_log_sysctl_fhdr; 420 421 static struct ctl_table nf_log_sysctl_ftable[] = { 422 { 423 .procname = "nf_log_all_netns", 424 .data = &sysctl_nf_log_all_netns, 425 .maxlen = sizeof(sysctl_nf_log_all_netns), 426 .mode = 0644, 427 .proc_handler = proc_dointvec, 428 }, 429 { } 430 }; 431 432 static int nf_log_proc_dostring(struct ctl_table *table, int write, 433 void __user *buffer, size_t *lenp, loff_t *ppos) 434 { 435 const struct nf_logger *logger; 436 char buf[NFLOGGER_NAME_LEN]; 437 int r = 0; 438 int tindex = (unsigned long)table->extra1; 439 struct net *net = table->extra2; 440 441 if (write) { 442 struct ctl_table tmp = *table; 443 444 tmp.data = buf; 445 r = proc_dostring(&tmp, write, buffer, lenp, ppos); 446 if (r) 447 return r; 448 449 if (!strcmp(buf, "NONE")) { 450 nf_log_unbind_pf(net, tindex); 451 return 0; 452 } 453 mutex_lock(&nf_log_mutex); 454 logger = __find_logger(tindex, buf); 455 if (logger == NULL) { 456 mutex_unlock(&nf_log_mutex); 457 return -ENOENT; 458 } 459 rcu_assign_pointer(net->nf.nf_loggers[tindex], logger); 460 mutex_unlock(&nf_log_mutex); 461 } else { 462 mutex_lock(&nf_log_mutex); 463 logger = nft_log_dereference(net->nf.nf_loggers[tindex]); 464 if (!logger) 465 table->data = "NONE"; 466 else 467 table->data = logger->name; 468 r = proc_dostring(table, write, buffer, lenp, ppos); 469 mutex_unlock(&nf_log_mutex); 470 } 471 472 return r; 473 } 474 475 static int netfilter_log_sysctl_init(struct net *net) 476 { 477 int i; 478 struct ctl_table *table; 479 480 table = nf_log_sysctl_table; 481 if (!net_eq(net, &init_net)) { 482 table = kmemdup(nf_log_sysctl_table, 483 sizeof(nf_log_sysctl_table), 484 GFP_KERNEL); 485 if (!table) 486 goto err_alloc; 487 } else { 488 for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++) { 489 snprintf(nf_log_sysctl_fnames[i], 490 3, "%d", i); 491 nf_log_sysctl_table[i].procname = 492 nf_log_sysctl_fnames[i]; 493 nf_log_sysctl_table[i].maxlen = NFLOGGER_NAME_LEN; 494 nf_log_sysctl_table[i].mode = 0644; 495 nf_log_sysctl_table[i].proc_handler = 496 nf_log_proc_dostring; 497 nf_log_sysctl_table[i].extra1 = 498 (void *)(unsigned long) i; 499 } 500 nf_log_sysctl_fhdr = register_net_sysctl(net, "net/netfilter", 501 nf_log_sysctl_ftable); 502 if (!nf_log_sysctl_fhdr) 503 goto err_freg; 504 } 505 506 for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++) 507 table[i].extra2 = net; 508 509 net->nf.nf_log_dir_header = register_net_sysctl(net, 510 "net/netfilter/nf_log", 511 table); 512 if (!net->nf.nf_log_dir_header) 513 goto err_reg; 514 515 return 0; 516 517 err_reg: 518 if (!net_eq(net, &init_net)) 519 kfree(table); 520 else 521 unregister_net_sysctl_table(nf_log_sysctl_fhdr); 522 err_freg: 523 err_alloc: 524 return -ENOMEM; 525 } 526 527 static void netfilter_log_sysctl_exit(struct net *net) 528 { 529 struct ctl_table *table; 530 531 table = net->nf.nf_log_dir_header->ctl_table_arg; 532 unregister_net_sysctl_table(net->nf.nf_log_dir_header); 533 if (!net_eq(net, &init_net)) 534 kfree(table); 535 else 536 unregister_net_sysctl_table(nf_log_sysctl_fhdr); 537 } 538 #else 539 static int netfilter_log_sysctl_init(struct net *net) 540 { 541 return 0; 542 } 543 544 static void netfilter_log_sysctl_exit(struct net *net) 545 { 546 } 547 #endif /* CONFIG_SYSCTL */ 548 549 static int __net_init nf_log_net_init(struct net *net) 550 { 551 int ret = -ENOMEM; 552 553 #ifdef CONFIG_PROC_FS 554 if (!proc_create("nf_log", S_IRUGO, 555 net->nf.proc_netfilter, &nflog_file_ops)) 556 return ret; 557 #endif 558 ret = netfilter_log_sysctl_init(net); 559 if (ret < 0) 560 goto out_sysctl; 561 562 return 0; 563 564 out_sysctl: 565 #ifdef CONFIG_PROC_FS 566 remove_proc_entry("nf_log", net->nf.proc_netfilter); 567 #endif 568 return ret; 569 } 570 571 static void __net_exit nf_log_net_exit(struct net *net) 572 { 573 netfilter_log_sysctl_exit(net); 574 #ifdef CONFIG_PROC_FS 575 remove_proc_entry("nf_log", net->nf.proc_netfilter); 576 #endif 577 } 578 579 static struct pernet_operations nf_log_net_ops = { 580 .init = nf_log_net_init, 581 .exit = nf_log_net_exit, 582 }; 583 584 int __init netfilter_log_init(void) 585 { 586 return register_pernet_subsys(&nf_log_net_ops); 587 } 588