1 #include <linux/kernel.h> 2 #include <linux/init.h> 3 #include <linux/module.h> 4 #include <linux/proc_fs.h> 5 #include <linux/skbuff.h> 6 #include <linux/netfilter.h> 7 #include <linux/seq_file.h> 8 #include <net/protocol.h> 9 #include <net/netfilter/nf_log.h> 10 11 #include "nf_internals.h" 12 13 /* Internal logging interface, which relies on the real 14 LOG target modules */ 15 16 #define NF_LOG_PREFIXLEN 128 17 #define NFLOGGER_NAME_LEN 64 18 19 static struct nf_logger __rcu *loggers[NFPROTO_NUMPROTO][NF_LOG_TYPE_MAX] __read_mostly; 20 static DEFINE_MUTEX(nf_log_mutex); 21 22 #define nft_log_dereference(logger) \ 23 rcu_dereference_protected(logger, lockdep_is_held(&nf_log_mutex)) 24 25 static struct nf_logger *__find_logger(int pf, const char *str_logger) 26 { 27 struct nf_logger *log; 28 int i; 29 30 for (i = 0; i < NF_LOG_TYPE_MAX; i++) { 31 if (loggers[pf][i] == NULL) 32 continue; 33 34 log = nft_log_dereference(loggers[pf][i]); 35 if (!strncasecmp(str_logger, log->name, strlen(log->name))) 36 return log; 37 } 38 39 return NULL; 40 } 41 42 void nf_log_set(struct net *net, u_int8_t pf, const struct nf_logger *logger) 43 { 44 const struct nf_logger *log; 45 46 if (pf == NFPROTO_UNSPEC) 47 return; 48 49 mutex_lock(&nf_log_mutex); 50 log = nft_log_dereference(net->nf.nf_loggers[pf]); 51 if (log == NULL) 52 rcu_assign_pointer(net->nf.nf_loggers[pf], logger); 53 54 mutex_unlock(&nf_log_mutex); 55 } 56 EXPORT_SYMBOL(nf_log_set); 57 58 void nf_log_unset(struct net *net, const struct nf_logger *logger) 59 { 60 int i; 61 const struct nf_logger *log; 62 63 mutex_lock(&nf_log_mutex); 64 for (i = 0; i < NFPROTO_NUMPROTO; i++) { 65 log = nft_log_dereference(net->nf.nf_loggers[i]); 66 if (log == logger) 67 RCU_INIT_POINTER(net->nf.nf_loggers[i], NULL); 68 } 69 mutex_unlock(&nf_log_mutex); 70 synchronize_rcu(); 71 } 72 EXPORT_SYMBOL(nf_log_unset); 73 74 /* return EEXIST if the same logger is registered, 0 on success. */ 75 int nf_log_register(u_int8_t pf, struct nf_logger *logger) 76 { 77 int i; 78 int ret = 0; 79 80 if (pf >= ARRAY_SIZE(init_net.nf.nf_loggers)) 81 return -EINVAL; 82 83 mutex_lock(&nf_log_mutex); 84 85 if (pf == NFPROTO_UNSPEC) { 86 for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++) { 87 if (rcu_access_pointer(loggers[i][logger->type])) { 88 ret = -EEXIST; 89 goto unlock; 90 } 91 } 92 for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++) 93 rcu_assign_pointer(loggers[i][logger->type], logger); 94 } else { 95 if (rcu_access_pointer(loggers[pf][logger->type])) { 96 ret = -EEXIST; 97 goto unlock; 98 } 99 rcu_assign_pointer(loggers[pf][logger->type], logger); 100 } 101 102 unlock: 103 mutex_unlock(&nf_log_mutex); 104 return ret; 105 } 106 EXPORT_SYMBOL(nf_log_register); 107 108 void nf_log_unregister(struct nf_logger *logger) 109 { 110 int i; 111 112 mutex_lock(&nf_log_mutex); 113 for (i = 0; i < NFPROTO_NUMPROTO; i++) 114 RCU_INIT_POINTER(loggers[i][logger->type], NULL); 115 mutex_unlock(&nf_log_mutex); 116 } 117 EXPORT_SYMBOL(nf_log_unregister); 118 119 int nf_log_bind_pf(struct net *net, u_int8_t pf, 120 const struct nf_logger *logger) 121 { 122 if (pf >= ARRAY_SIZE(net->nf.nf_loggers)) 123 return -EINVAL; 124 mutex_lock(&nf_log_mutex); 125 if (__find_logger(pf, logger->name) == NULL) { 126 mutex_unlock(&nf_log_mutex); 127 return -ENOENT; 128 } 129 rcu_assign_pointer(net->nf.nf_loggers[pf], logger); 130 mutex_unlock(&nf_log_mutex); 131 return 0; 132 } 133 EXPORT_SYMBOL(nf_log_bind_pf); 134 135 void nf_log_unbind_pf(struct net *net, u_int8_t pf) 136 { 137 if (pf >= ARRAY_SIZE(net->nf.nf_loggers)) 138 return; 139 mutex_lock(&nf_log_mutex); 140 RCU_INIT_POINTER(net->nf.nf_loggers[pf], NULL); 141 mutex_unlock(&nf_log_mutex); 142 } 143 EXPORT_SYMBOL(nf_log_unbind_pf); 144 145 void nf_logger_request_module(int pf, enum nf_log_type type) 146 { 147 if (loggers[pf][type] == NULL) 148 request_module("nf-logger-%u-%u", pf, type); 149 } 150 EXPORT_SYMBOL_GPL(nf_logger_request_module); 151 152 int nf_logger_find_get(int pf, enum nf_log_type type) 153 { 154 struct nf_logger *logger; 155 int ret = -ENOENT; 156 157 if (rcu_access_pointer(loggers[pf][type]) == NULL) 158 request_module("nf-logger-%u-%u", pf, type); 159 160 rcu_read_lock(); 161 logger = rcu_dereference(loggers[pf][type]); 162 if (logger == NULL) 163 goto out; 164 165 if (logger && try_module_get(logger->me)) 166 ret = 0; 167 out: 168 rcu_read_unlock(); 169 return ret; 170 } 171 EXPORT_SYMBOL_GPL(nf_logger_find_get); 172 173 void nf_logger_put(int pf, enum nf_log_type type) 174 { 175 struct nf_logger *logger; 176 177 BUG_ON(loggers[pf][type] == NULL); 178 179 rcu_read_lock(); 180 logger = rcu_dereference(loggers[pf][type]); 181 module_put(logger->me); 182 rcu_read_unlock(); 183 } 184 EXPORT_SYMBOL_GPL(nf_logger_put); 185 186 void nf_log_packet(struct net *net, 187 u_int8_t pf, 188 unsigned int hooknum, 189 const struct sk_buff *skb, 190 const struct net_device *in, 191 const struct net_device *out, 192 const struct nf_loginfo *loginfo, 193 const char *fmt, ...) 194 { 195 va_list args; 196 char prefix[NF_LOG_PREFIXLEN]; 197 const struct nf_logger *logger; 198 199 rcu_read_lock(); 200 if (loginfo != NULL) 201 logger = rcu_dereference(loggers[pf][loginfo->type]); 202 else 203 logger = rcu_dereference(net->nf.nf_loggers[pf]); 204 205 if (logger) { 206 va_start(args, fmt); 207 vsnprintf(prefix, sizeof(prefix), fmt, args); 208 va_end(args); 209 logger->logfn(net, pf, hooknum, skb, in, out, loginfo, prefix); 210 } 211 rcu_read_unlock(); 212 } 213 EXPORT_SYMBOL(nf_log_packet); 214 215 #define S_SIZE (1024 - (sizeof(unsigned int) + 1)) 216 217 struct nf_log_buf { 218 unsigned int count; 219 char buf[S_SIZE + 1]; 220 }; 221 static struct nf_log_buf emergency, *emergency_ptr = &emergency; 222 223 __printf(2, 3) int nf_log_buf_add(struct nf_log_buf *m, const char *f, ...) 224 { 225 va_list args; 226 int len; 227 228 if (likely(m->count < S_SIZE)) { 229 va_start(args, f); 230 len = vsnprintf(m->buf + m->count, S_SIZE - m->count, f, args); 231 va_end(args); 232 if (likely(m->count + len < S_SIZE)) { 233 m->count += len; 234 return 0; 235 } 236 } 237 m->count = S_SIZE; 238 printk_once(KERN_ERR KBUILD_MODNAME " please increase S_SIZE\n"); 239 return -1; 240 } 241 EXPORT_SYMBOL_GPL(nf_log_buf_add); 242 243 struct nf_log_buf *nf_log_buf_open(void) 244 { 245 struct nf_log_buf *m = kmalloc(sizeof(*m), GFP_ATOMIC); 246 247 if (unlikely(!m)) { 248 local_bh_disable(); 249 do { 250 m = xchg(&emergency_ptr, NULL); 251 } while (!m); 252 } 253 m->count = 0; 254 return m; 255 } 256 EXPORT_SYMBOL_GPL(nf_log_buf_open); 257 258 void nf_log_buf_close(struct nf_log_buf *m) 259 { 260 m->buf[m->count] = 0; 261 printk("%s\n", m->buf); 262 263 if (likely(m != &emergency)) 264 kfree(m); 265 else { 266 emergency_ptr = m; 267 local_bh_enable(); 268 } 269 } 270 EXPORT_SYMBOL_GPL(nf_log_buf_close); 271 272 #ifdef CONFIG_PROC_FS 273 static void *seq_start(struct seq_file *seq, loff_t *pos) 274 { 275 struct net *net = seq_file_net(seq); 276 277 mutex_lock(&nf_log_mutex); 278 279 if (*pos >= ARRAY_SIZE(net->nf.nf_loggers)) 280 return NULL; 281 282 return pos; 283 } 284 285 static void *seq_next(struct seq_file *s, void *v, loff_t *pos) 286 { 287 struct net *net = seq_file_net(s); 288 289 (*pos)++; 290 291 if (*pos >= ARRAY_SIZE(net->nf.nf_loggers)) 292 return NULL; 293 294 return pos; 295 } 296 297 static void seq_stop(struct seq_file *s, void *v) 298 { 299 mutex_unlock(&nf_log_mutex); 300 } 301 302 static int seq_show(struct seq_file *s, void *v) 303 { 304 loff_t *pos = v; 305 const struct nf_logger *logger; 306 int i; 307 struct net *net = seq_file_net(s); 308 309 logger = nft_log_dereference(net->nf.nf_loggers[*pos]); 310 311 if (!logger) 312 seq_printf(s, "%2lld NONE (", *pos); 313 else 314 seq_printf(s, "%2lld %s (", *pos, logger->name); 315 316 if (seq_has_overflowed(s)) 317 return -ENOSPC; 318 319 for (i = 0; i < NF_LOG_TYPE_MAX; i++) { 320 if (loggers[*pos][i] == NULL) 321 continue; 322 323 logger = nft_log_dereference(loggers[*pos][i]); 324 seq_printf(s, "%s", logger->name); 325 if (i == 0 && loggers[*pos][i + 1] != NULL) 326 seq_printf(s, ","); 327 328 if (seq_has_overflowed(s)) 329 return -ENOSPC; 330 } 331 332 seq_printf(s, ")\n"); 333 334 if (seq_has_overflowed(s)) 335 return -ENOSPC; 336 return 0; 337 } 338 339 static const struct seq_operations nflog_seq_ops = { 340 .start = seq_start, 341 .next = seq_next, 342 .stop = seq_stop, 343 .show = seq_show, 344 }; 345 346 static int nflog_open(struct inode *inode, struct file *file) 347 { 348 return seq_open_net(inode, file, &nflog_seq_ops, 349 sizeof(struct seq_net_private)); 350 } 351 352 static const struct file_operations nflog_file_ops = { 353 .owner = THIS_MODULE, 354 .open = nflog_open, 355 .read = seq_read, 356 .llseek = seq_lseek, 357 .release = seq_release_net, 358 }; 359 360 361 #endif /* PROC_FS */ 362 363 #ifdef CONFIG_SYSCTL 364 static char nf_log_sysctl_fnames[NFPROTO_NUMPROTO-NFPROTO_UNSPEC][3]; 365 static struct ctl_table nf_log_sysctl_table[NFPROTO_NUMPROTO+1]; 366 367 static int nf_log_proc_dostring(struct ctl_table *table, int write, 368 void __user *buffer, size_t *lenp, loff_t *ppos) 369 { 370 const struct nf_logger *logger; 371 char buf[NFLOGGER_NAME_LEN]; 372 size_t size = *lenp; 373 int r = 0; 374 int tindex = (unsigned long)table->extra1; 375 struct net *net = current->nsproxy->net_ns; 376 377 if (write) { 378 if (size > sizeof(buf)) 379 size = sizeof(buf); 380 if (copy_from_user(buf, buffer, size)) 381 return -EFAULT; 382 383 if (!strcmp(buf, "NONE")) { 384 nf_log_unbind_pf(net, tindex); 385 return 0; 386 } 387 mutex_lock(&nf_log_mutex); 388 logger = __find_logger(tindex, buf); 389 if (logger == NULL) { 390 mutex_unlock(&nf_log_mutex); 391 return -ENOENT; 392 } 393 rcu_assign_pointer(net->nf.nf_loggers[tindex], logger); 394 mutex_unlock(&nf_log_mutex); 395 } else { 396 mutex_lock(&nf_log_mutex); 397 logger = nft_log_dereference(net->nf.nf_loggers[tindex]); 398 if (!logger) 399 table->data = "NONE"; 400 else 401 table->data = logger->name; 402 r = proc_dostring(table, write, buffer, lenp, ppos); 403 mutex_unlock(&nf_log_mutex); 404 } 405 406 return r; 407 } 408 409 static int netfilter_log_sysctl_init(struct net *net) 410 { 411 int i; 412 struct ctl_table *table; 413 414 table = nf_log_sysctl_table; 415 if (!net_eq(net, &init_net)) { 416 table = kmemdup(nf_log_sysctl_table, 417 sizeof(nf_log_sysctl_table), 418 GFP_KERNEL); 419 if (!table) 420 goto err_alloc; 421 } else { 422 for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++) { 423 snprintf(nf_log_sysctl_fnames[i], 424 3, "%d", i); 425 nf_log_sysctl_table[i].procname = 426 nf_log_sysctl_fnames[i]; 427 nf_log_sysctl_table[i].data = NULL; 428 nf_log_sysctl_table[i].maxlen = NFLOGGER_NAME_LEN; 429 nf_log_sysctl_table[i].mode = 0644; 430 nf_log_sysctl_table[i].proc_handler = 431 nf_log_proc_dostring; 432 nf_log_sysctl_table[i].extra1 = 433 (void *)(unsigned long) i; 434 } 435 } 436 437 net->nf.nf_log_dir_header = register_net_sysctl(net, 438 "net/netfilter/nf_log", 439 table); 440 if (!net->nf.nf_log_dir_header) 441 goto err_reg; 442 443 return 0; 444 445 err_reg: 446 if (!net_eq(net, &init_net)) 447 kfree(table); 448 err_alloc: 449 return -ENOMEM; 450 } 451 452 static void netfilter_log_sysctl_exit(struct net *net) 453 { 454 struct ctl_table *table; 455 456 table = net->nf.nf_log_dir_header->ctl_table_arg; 457 unregister_net_sysctl_table(net->nf.nf_log_dir_header); 458 if (!net_eq(net, &init_net)) 459 kfree(table); 460 } 461 #else 462 static int netfilter_log_sysctl_init(struct net *net) 463 { 464 return 0; 465 } 466 467 static void netfilter_log_sysctl_exit(struct net *net) 468 { 469 } 470 #endif /* CONFIG_SYSCTL */ 471 472 static int __net_init nf_log_net_init(struct net *net) 473 { 474 int ret = -ENOMEM; 475 476 #ifdef CONFIG_PROC_FS 477 if (!proc_create("nf_log", S_IRUGO, 478 net->nf.proc_netfilter, &nflog_file_ops)) 479 return ret; 480 #endif 481 ret = netfilter_log_sysctl_init(net); 482 if (ret < 0) 483 goto out_sysctl; 484 485 return 0; 486 487 out_sysctl: 488 #ifdef CONFIG_PROC_FS 489 remove_proc_entry("nf_log", net->nf.proc_netfilter); 490 #endif 491 return ret; 492 } 493 494 static void __net_exit nf_log_net_exit(struct net *net) 495 { 496 netfilter_log_sysctl_exit(net); 497 #ifdef CONFIG_PROC_FS 498 remove_proc_entry("nf_log", net->nf.proc_netfilter); 499 #endif 500 } 501 502 static struct pernet_operations nf_log_net_ops = { 503 .init = nf_log_net_init, 504 .exit = nf_log_net_exit, 505 }; 506 507 int __init netfilter_log_init(void) 508 { 509 return register_pernet_subsys(&nf_log_net_ops); 510 } 511