[deliverable/linux.git] / net / netfilter / nf_synproxy_core.c

/*
 * Copyright (c) 2013 Patrick McHardy <kaber@trash.net>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/module.h>
#include <linux/skbuff.h>
#include <asm/unaligned.h>
#include <net/tcp.h>
#include <net/netns/generic.h>

#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_tcpudp.h>
#include <linux/netfilter/xt_SYNPROXY.h>
#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_extend.h>
#include <net/netfilter/nf_conntrack_seqadj.h>
#include <net/netfilter/nf_conntrack_synproxy.h>

int synproxy_net_id;
EXPORT_SYMBOL_GPL(synproxy_net_id);

bool
synproxy_parse_options(const struct sk_buff *skb, unsigned int doff,
		       const struct tcphdr *th, struct synproxy_options *opts)
{
	int length = (th->doff * 4) - sizeof(*th);
	u8 buf[40], *ptr;

	ptr = skb_header_pointer(skb, doff + sizeof(*th), length, buf);
	if (ptr == NULL)
		return false;

	opts->options = 0;
	while (length > 0) {
		int opcode = *ptr++;
		int opsize;

		switch (opcode) {
		case TCPOPT_EOL:
			return true;
		case TCPOPT_NOP:
			length--;
			continue;
		default:
			opsize = *ptr++;
			if (opsize < 2)
				return true;
			if (opsize > length)
				return true;

			switch (opcode) {
			case TCPOPT_MSS:
				if (opsize == TCPOLEN_MSS) {
					opts->mss = get_unaligned_be16(ptr);
					opts->options |= XT_SYNPROXY_OPT_MSS;
				}
				break;
			case TCPOPT_WINDOW:
				if (opsize == TCPOLEN_WINDOW) {
					opts->wscale = *ptr;
					if (opts->wscale > 14)
						opts->wscale = 14;
					opts->options |= XT_SYNPROXY_OPT_WSCALE;
				}
				break;
			case TCPOPT_TIMESTAMP:
				if (opsize == TCPOLEN_TIMESTAMP) {
					opts->tsval = get_unaligned_be32(ptr);
					opts->tsecr = get_unaligned_be32(ptr + 4);
					opts->options |= XT_SYNPROXY_OPT_TIMESTAMP;
				}
				break;
			case TCPOPT_SACK_PERM:
				if (opsize == TCPOLEN_SACK_PERM)
					opts->options |= XT_SYNPROXY_OPT_SACK_PERM;
				break;
			}

			ptr += opsize - 2;
			length -= opsize;
		}
	}
	return true;
}
EXPORT_SYMBOL_GPL(synproxy_parse_options);

unsigned int synproxy_options_size(const struct synproxy_options *opts)
{
	unsigned int size = 0;

	if (opts->options & XT_SYNPROXY_OPT_MSS)
		size += TCPOLEN_MSS_ALIGNED;
	if (opts->options & XT_SYNPROXY_OPT_TIMESTAMP)
		size += TCPOLEN_TSTAMP_ALIGNED;
	else if (opts->options & XT_SYNPROXY_OPT_SACK_PERM)
		size += TCPOLEN_SACKPERM_ALIGNED;
	if (opts->options & XT_SYNPROXY_OPT_WSCALE)
		size += TCPOLEN_WSCALE_ALIGNED;

	return size;
}
EXPORT_SYMBOL_GPL(synproxy_options_size);

void
synproxy_build_options(struct tcphdr *th, const struct synproxy_options *opts)
{
	__be32 *ptr = (__be32 *)(th + 1);
	u8 options = opts->options;

	if (options & XT_SYNPROXY_OPT_MSS)
		*ptr++ = htonl((TCPOPT_MSS << 24) |
			       (TCPOLEN_MSS << 16) |
			       opts->mss);

	if (options & XT_SYNPROXY_OPT_TIMESTAMP) {
		if (options & XT_SYNPROXY_OPT_SACK_PERM)
			*ptr++ = htonl((TCPOPT_SACK_PERM << 24) |
				       (TCPOLEN_SACK_PERM << 16) |
				       (TCPOPT_TIMESTAMP << 8) |
				       TCPOLEN_TIMESTAMP);
		else
			*ptr++ = htonl((TCPOPT_NOP << 24) |
				       (TCPOPT_NOP << 16) |
				       (TCPOPT_TIMESTAMP << 8) |
				       TCPOLEN_TIMESTAMP);

		*ptr++ = htonl(opts->tsval);
		*ptr++ = htonl(opts->tsecr);
	} else if (options & XT_SYNPROXY_OPT_SACK_PERM)
		*ptr++ = htonl((TCPOPT_NOP << 24) |
			       (TCPOPT_NOP << 16) |
			       (TCPOPT_SACK_PERM << 8) |
			       TCPOLEN_SACK_PERM);

	if (options & XT_SYNPROXY_OPT_WSCALE)
		*ptr++ = htonl((TCPOPT_NOP << 24) |
			       (TCPOPT_WINDOW << 16) |
			       (TCPOLEN_WINDOW << 8) |
			       opts->wscale);
}
EXPORT_SYMBOL_GPL(synproxy_build_options);

void synproxy_init_timestamp_cookie(const struct xt_synproxy_info *info,
				    struct synproxy_options *opts)
{
	opts->tsecr = opts->tsval;
	opts->tsval = tcp_time_stamp & ~0x3f;

	if (opts->options & XT_SYNPROXY_OPT_WSCALE)
		opts->tsval |= info->wscale;
	else
		opts->tsval |= 0xf;

	if (opts->options & XT_SYNPROXY_OPT_SACK_PERM)
		opts->tsval |= 1 << 4;

	if (opts->options & XT_SYNPROXY_OPT_ECN)
		opts->tsval |= 1 << 5;
}
EXPORT_SYMBOL_GPL(synproxy_init_timestamp_cookie);

void synproxy_check_timestamp_cookie(struct synproxy_options *opts)
{
	opts->wscale = opts->tsecr & 0xf;
	if (opts->wscale != 0xf)
		opts->options |= XT_SYNPROXY_OPT_WSCALE;

	opts->options |= opts->tsecr & (1 << 4) ? XT_SYNPROXY_OPT_SACK_PERM : 0;

	opts->options |= opts->tsecr & (1 << 5) ? XT_SYNPROXY_OPT_ECN : 0;
}
EXPORT_SYMBOL_GPL(synproxy_check_timestamp_cookie);

unsigned int synproxy_tstamp_adjust(struct sk_buff *skb,
				    unsigned int protoff,
				    struct tcphdr *th,
				    struct nf_conn *ct,
				    enum ip_conntrack_info ctinfo,
				    const struct nf_conn_synproxy *synproxy)
{
	unsigned int optoff, optend;
	u32 *ptr, old;

	if (synproxy->tsoff == 0)
		return 1;

	optoff = protoff + sizeof(struct tcphdr);
	optend = protoff + th->doff * 4;

	if (!skb_make_writable(skb, optend))
		return 0;

	while (optoff < optend) {
		unsigned char *op = skb->data + optoff;

		switch (op[0]) {
		case TCPOPT_EOL:
			return 1;
		case TCPOPT_NOP:
			optoff++;
			continue;
		default:
			if (optoff + 1 == optend ||
			    optoff + op[1] > optend ||
			    op[1] < 2)
				return 0;
			if (op[0] == TCPOPT_TIMESTAMP &&
			    op[1] == TCPOLEN_TIMESTAMP) {
				if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY) {
					ptr = (u32 *)&op[2];
					old = *ptr;
					*ptr = htonl(ntohl(*ptr) -
						     synproxy->tsoff);
				} else {
					ptr = (u32 *)&op[6];
					old = *ptr;
					*ptr = htonl(ntohl(*ptr) +
						     synproxy->tsoff);
				}
				inet_proto_csum_replace4(&th->check, skb,
							 old, *ptr, 0);
				return 1;
			}
			optoff += op[1];
		}
	}
	return 1;
}
EXPORT_SYMBOL_GPL(synproxy_tstamp_adjust);

static struct nf_ct_ext_type nf_ct_synproxy_extend __read_mostly = {
	.len		= sizeof(struct nf_conn_synproxy),
	.align		= __alignof__(struct nf_conn_synproxy),
	.id		= NF_CT_EXT_SYNPROXY,
};

#ifdef CONFIG_PROC_FS
static void *synproxy_cpu_seq_start(struct seq_file *seq, loff_t *pos)
{
	struct synproxy_net *snet = synproxy_pernet(seq_file_net(seq));
	int cpu;

	if (*pos == 0)
		return SEQ_START_TOKEN;

	for (cpu = *pos - 1; cpu < nr_cpu_ids; cpu++) {
		if (!cpu_possible(cpu))
			continue;
		*pos = cpu + 1;
		return per_cpu_ptr(snet->stats, cpu);
	}

	return NULL;
}

static void *synproxy_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
{
	struct synproxy_net *snet = synproxy_pernet(seq_file_net(seq));
	int cpu;

	for (cpu = *pos; cpu < nr_cpu_ids; cpu++) {
		if (!cpu_possible(cpu))
			continue;
		*pos = cpu + 1;
		return per_cpu_ptr(snet->stats, cpu);
	}

	return NULL;
}

static void synproxy_cpu_seq_stop(struct seq_file *seq, void *v)
{
	return;
}

static int synproxy_cpu_seq_show(struct seq_file *seq, void *v)
{
	struct synproxy_stats *stats = v;

	if (v == SEQ_START_TOKEN) {
		seq_printf(seq, "entries\t\tsyn_received\t"
				"cookie_invalid\tcookie_valid\t"
				"cookie_retrans\tconn_reopened\n");
		return 0;
	}

	seq_printf(seq, "%08x\t%08x\t%08x\t%08x\t%08x\t%08x\n", 0,
		   stats->syn_received,
		   stats->cookie_invalid,
		   stats->cookie_valid,
		   stats->cookie_retrans,
		   stats->conn_reopened);

	return 0;
}

static const struct seq_operations synproxy_cpu_seq_ops = {
	.start		= synproxy_cpu_seq_start,
	.next		= synproxy_cpu_seq_next,
	.stop		= synproxy_cpu_seq_stop,
	.show		= synproxy_cpu_seq_show,
};

static int synproxy_cpu_seq_open(struct inode *inode, struct file *file)
{
	return seq_open_net(inode, file, &synproxy_cpu_seq_ops,
			    sizeof(struct seq_net_private));
}

static const struct file_operations synproxy_cpu_seq_fops = {
	.owner		= THIS_MODULE,
	.open		= synproxy_cpu_seq_open,
	.read		= seq_read,
	.llseek		= seq_lseek,
	.release	= seq_release_net,
};

static int __net_init synproxy_proc_init(struct net *net)
{
	if (!proc_create("synproxy", S_IRUGO, net->proc_net_stat,
			 &synproxy_cpu_seq_fops))
		return -ENOMEM;
	return 0;
}

static void __net_exit synproxy_proc_exit(struct net *net)
{
	remove_proc_entry("synproxy", net->proc_net_stat);
}
#else
static int __net_init synproxy_proc_init(struct net *net)
{
	return 0;
}

static void __net_exit synproxy_proc_exit(struct net *net)
{
	return;
}
#endif /* CONFIG_PROC_FS */

static int __net_init synproxy_net_init(struct net *net)
{
	struct synproxy_net *snet = synproxy_pernet(net);
	struct nf_conntrack_tuple t;
	struct nf_conn *ct;
	int err = -ENOMEM;

	memset(&t, 0, sizeof(t));
	ct = nf_conntrack_alloc(net, 0, &t, &t, GFP_KERNEL);
	if (IS_ERR(ct)) {
		err = PTR_ERR(ct);
		goto err1;
	}

	if (!nfct_seqadj_ext_add(ct))
		goto err2;
	if (!nfct_synproxy_ext_add(ct))
		goto err2;
	__set_bit(IPS_TEMPLATE_BIT, &ct->status);
	__set_bit(IPS_CONFIRMED_BIT, &ct->status);

	snet->tmpl = ct;

	snet->stats = alloc_percpu(struct synproxy_stats);
	if (snet->stats == NULL)
		goto err2;

	err = synproxy_proc_init(net);
	if (err < 0)
		goto err3;

	return 0;

err3:
	free_percpu(snet->stats);
err2:
	nf_conntrack_free(ct);
err1:
	return err;
}

static void __net_exit synproxy_net_exit(struct net *net)
{
	struct synproxy_net *snet = synproxy_pernet(net);

	nf_conntrack_free(snet->tmpl);
	synproxy_proc_exit(net);
	free_percpu(snet->stats);
}

static struct pernet_operations synproxy_net_ops = {
	.init		= synproxy_net_init,
	.exit		= synproxy_net_exit,
	.id		= &synproxy_net_id,
	.size		= sizeof(struct synproxy_net),
};

static int __init synproxy_core_init(void)
{
	int err;

	err = nf_ct_extend_register(&nf_ct_synproxy_extend);
	if (err < 0)
		goto err1;

	err = register_pernet_subsys(&synproxy_net_ops);
	if (err < 0)
		goto err2;

	return 0;

err2:
	nf_ct_extend_unregister(&nf_ct_synproxy_extend);
err1:
	return err;
}

static void __exit synproxy_core_exit(void)
{
	unregister_pernet_subsys(&synproxy_net_ops);
	nf_ct_extend_unregister(&nf_ct_synproxy_extend);
}

module_init(synproxy_core_init);
module_exit(synproxy_core_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
Commit	Line	Data
48b1de4c PM	1	/*
	2	* Copyright (c) 2013 Patrick McHardy <kaber@trash.net>
	3	*
	4	* This program is free software; you can redistribute it and/or modify
	5	* it under the terms of the GNU General Public License version 2 as
	6	* published by the Free Software Foundation.
	7	*/
	8
	9	#include <linux/module.h>
	10	#include <linux/skbuff.h>
	11	#include <asm/unaligned.h>
	12	#include <net/tcp.h>
	13	#include <net/netns/generic.h>
	14
	15	#include <linux/netfilter_ipv4/ip_tables.h>
	16	#include <linux/netfilter/x_tables.h>
	17	#include <linux/netfilter/xt_tcpudp.h>
	18	#include <linux/netfilter/xt_SYNPROXY.h>
	19	#include <net/netfilter/nf_conntrack.h>
	20	#include <net/netfilter/nf_conntrack_extend.h>
	21	#include <net/netfilter/nf_conntrack_seqadj.h>
	22	#include <net/netfilter/nf_conntrack_synproxy.h>
	23
	24	int synproxy_net_id;
	25	EXPORT_SYMBOL_GPL(synproxy_net_id);
	26
f4a87e7b	27	bool
48b1de4c PM	28	synproxy_parse_options(const struct sk_buff *skb, unsigned int doff,
	29	const struct tcphdr th, struct synproxy_options opts)
	30	{
	31	int length = (th->doff * 4) - sizeof(*th);
	32	u8 buf[40], *ptr;
	33
	34	ptr = skb_header_pointer(skb, doff + sizeof(*th), length, buf);
f4a87e7b PM	35	if (ptr == NULL)
f4a87e7b PM	36	return false;
48b1de4c PM	37
	38	opts->options = 0;
	39	while (length > 0) {
	40	int opcode = *ptr++;
	41	int opsize;
	42
	43	switch (opcode) {
	44	case TCPOPT_EOL:
f4a87e7b	45	return true;
48b1de4c PM	46	case TCPOPT_NOP:
	47	length--;
	48	continue;
	49	default:
	50	opsize = *ptr++;
	51	if (opsize < 2)
f4a87e7b	52	return true;
48b1de4c	53	if (opsize > length)
f4a87e7b	54	return true;
48b1de4c PM	55
	56	switch (opcode) {
	57	case TCPOPT_MSS:
	58	if (opsize == TCPOLEN_MSS) {
	59	opts->mss = get_unaligned_be16(ptr);
	60	opts->options \|= XT_SYNPROXY_OPT_MSS;
	61	}
	62	break;
	63	case TCPOPT_WINDOW:
	64	if (opsize == TCPOLEN_WINDOW) {
	65	opts->wscale = *ptr;
	66	if (opts->wscale > 14)
	67	opts->wscale = 14;
	68	opts->options \|= XT_SYNPROXY_OPT_WSCALE;
	69	}
	70	break;
	71	case TCPOPT_TIMESTAMP:
	72	if (opsize == TCPOLEN_TIMESTAMP) {
	73	opts->tsval = get_unaligned_be32(ptr);
	74	opts->tsecr = get_unaligned_be32(ptr + 4);
	75	opts->options \|= XT_SYNPROXY_OPT_TIMESTAMP;
	76	}
	77	break;
	78	case TCPOPT_SACK_PERM:
	79	if (opsize == TCPOLEN_SACK_PERM)
	80	opts->options \|= XT_SYNPROXY_OPT_SACK_PERM;
	81	break;
	82	}
	83
	84	ptr += opsize - 2;
	85	length -= opsize;
	86	}
	87	}
f4a87e7b	88	return true;
48b1de4c PM	89	}
	90	EXPORT_SYMBOL_GPL(synproxy_parse_options);
	91
	92	unsigned int synproxy_options_size(const struct synproxy_options *opts)
	93	{
	94	unsigned int size = 0;
	95
	96	if (opts->options & XT_SYNPROXY_OPT_MSS)
	97	size += TCPOLEN_MSS_ALIGNED;
	98	if (opts->options & XT_SYNPROXY_OPT_TIMESTAMP)
	99	size += TCPOLEN_TSTAMP_ALIGNED;
	100	else if (opts->options & XT_SYNPROXY_OPT_SACK_PERM)
	101	size += TCPOLEN_SACKPERM_ALIGNED;
	102	if (opts->options & XT_SYNPROXY_OPT_WSCALE)
	103	size += TCPOLEN_WSCALE_ALIGNED;
	104
	105	return size;
	106	}
	107	EXPORT_SYMBOL_GPL(synproxy_options_size);
	108
	109	void
	110	synproxy_build_options(struct tcphdr th, const struct synproxy_options opts)
	111	{
	112	__be32 ptr = (__be32 )(th + 1);
	113	u8 options = opts->options;
	114
	115	if (options & XT_SYNPROXY_OPT_MSS)
	116	*ptr++ = htonl((TCPOPT_MSS << 24) \|
	117	(TCPOLEN_MSS << 16) \|
	118	opts->mss);
	119
	120	if (options & XT_SYNPROXY_OPT_TIMESTAMP) {
	121	if (options & XT_SYNPROXY_OPT_SACK_PERM)
	122	*ptr++ = htonl((TCPOPT_SACK_PERM << 24) \|
	123	(TCPOLEN_SACK_PERM << 16) \|
	124	(TCPOPT_TIMESTAMP << 8) \|
	125	TCPOLEN_TIMESTAMP);
	126	else
	127	*ptr++ = htonl((TCPOPT_NOP << 24) \|
	128	(TCPOPT_NOP << 16) \|
	129	(TCPOPT_TIMESTAMP << 8) \|
	130	TCPOLEN_TIMESTAMP);
	131
	132	*ptr++ = htonl(opts->tsval);
	133	*ptr++ = htonl(opts->tsecr);
	134	} else if (options & XT_SYNPROXY_OPT_SACK_PERM)
	135	*ptr++ = htonl((TCPOPT_NOP << 24) \|
	136	(TCPOPT_NOP << 16) \|
	137	(TCPOPT_SACK_PERM << 8) \|
	138	TCPOLEN_SACK_PERM);
	139
	140	if (options & XT_SYNPROXY_OPT_WSCALE)
	141	*ptr++ = htonl((TCPOPT_NOP << 24) \|
	142	(TCPOPT_WINDOW << 16) \|
	143	(TCPOLEN_WINDOW << 8) \|
	144	opts->wscale);
	145	}
	146	EXPORT_SYMBOL_GPL(synproxy_build_options);
	147
	148	void synproxy_init_timestamp_cookie(const struct xt_synproxy_info *info,
	149	struct synproxy_options *opts)
	150	{
	151	opts->tsecr = opts->tsval;
	152	opts->tsval = tcp_time_stamp & ~0x3f;
153
154	if (opts->options & XT_SYNPROXY_OPT_WSCALE)
155	opts->tsval \|= info->wscale;
156	else
157	opts->tsval \|= 0xf;
158
159	if (opts->options & XT_SYNPROXY_OPT_SACK_PERM)
160	opts->tsval \|= 1 << 4;
161
162	if (opts->options & XT_SYNPROXY_OPT_ECN)
163	opts->tsval \|= 1 << 5;
164	}
165	EXPORT_SYMBOL_GPL(synproxy_init_timestamp_cookie);
166
167	void synproxy_check_timestamp_cookie(struct synproxy_options *opts)
168	{
169	opts->wscale = opts->tsecr & 0xf;
170	if (opts->wscale != 0xf)
171	opts->options \|= XT_SYNPROXY_OPT_WSCALE;
172
173	opts->options \|= opts->tsecr & (1 << 4) ? XT_SYNPROXY_OPT_SACK_PERM : 0;
174
175	opts->options \|= opts->tsecr & (1 << 5) ? XT_SYNPROXY_OPT_ECN : 0;
176	}
177	EXPORT_SYMBOL_GPL(synproxy_check_timestamp_cookie);
178
179	unsigned int synproxy_tstamp_adjust(struct sk_buff *skb,
180	unsigned int protoff,
181	struct tcphdr *th,
182	struct nf_conn *ct,
183	enum ip_conntrack_info ctinfo,
184	const struct nf_conn_synproxy *synproxy)
185	{
186	unsigned int optoff, optend;
187	u32 *ptr, old;
188
189	if (synproxy->tsoff == 0)
190	return 1;
191
192	optoff = protoff + sizeof(struct tcphdr);
193	optend = protoff + th->doff * 4;
194
195	if (!skb_make_writable(skb, optend))
196	return 0;
197
198	while (optoff < optend) {
199	unsigned char *op = skb->data + optoff;
200
201	switch (op[0]) {
202	case TCPOPT_EOL:
203	return 1;
204	case TCPOPT_NOP:
205	optoff++;
206	continue;
207	default:
208	if (optoff + 1 == optend \|\|
209	optoff + op[1] > optend \|\|
210	op[1] < 2)
211	return 0;
212	if (op[0] == TCPOPT_TIMESTAMP &&
213	op[1] == TCPOLEN_TIMESTAMP) {
214	if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY) {
215	ptr = (u32 *)&op[2];
216	old = *ptr;
217	ptr = htonl(ntohl(ptr) -
218	synproxy->tsoff);
219	} else {
220	ptr = (u32 *)&op[6];
221	old = *ptr;
222	ptr = htonl(ntohl(ptr) +
223	synproxy->tsoff);
224	}
225	inet_proto_csum_replace4(&th->check, skb,
226	old, *ptr, 0);
227	return 1;
228	}
229	optoff += op[1];
230	}
231	}
232	return 1;
233	}
234	EXPORT_SYMBOL_GPL(synproxy_tstamp_adjust);
235
236	static struct nf_ct_ext_type nf_ct_synproxy_extend __read_mostly = {
237	.len = sizeof(struct nf_conn_synproxy),
238	.align = __alignof__(struct nf_conn_synproxy),
239	.id = NF_CT_EXT_SYNPROXY,
240	};
241
242	#ifdef CONFIG_PROC_FS
243	static void synproxy_cpu_seq_start(struct seq_file seq, loff_t *pos)
244	{
245	struct synproxy_net *snet = synproxy_pernet(seq_file_net(seq));
246	int cpu;
247
248	if (*pos == 0)
249	return SEQ_START_TOKEN;
250
251	for (cpu = *pos - 1; cpu < nr_cpu_ids; cpu++) {
252	if (!cpu_possible(cpu))
253	continue;
254	*pos = cpu + 1;
255	return per_cpu_ptr(snet->stats, cpu);
256	}
257
258	return NULL;
259	}
260
261	static void synproxy_cpu_seq_next(struct seq_file seq, void v, loff_t pos)
262	{
263	struct synproxy_net *snet = synproxy_pernet(seq_file_net(seq));
264	int cpu;
265
266	for (cpu = *pos; cpu < nr_cpu_ids; cpu++) {
267	if (!cpu_possible(cpu))
268	continue;
269	*pos = cpu + 1;
270	return per_cpu_ptr(snet->stats, cpu);
271	}
272
273	return NULL;
274	}
275
276	static void synproxy_cpu_seq_stop(struct seq_file seq, void v)
277	{
278	return;
279	}
280
281	static int synproxy_cpu_seq_show(struct seq_file seq, void v)
282	{
283	struct synproxy_stats *stats = v;
284
285	if (v == SEQ_START_TOKEN) {
286	seq_printf(seq, "entries\t\tsyn_received\t"
287	"cookie_invalid\tcookie_valid\t"
288	"cookie_retrans\tconn_reopened\n");
289	return 0;
290	}
291
292	seq_printf(seq, "%08x\t%08x\t%08x\t%08x\t%08x\t%08x\n", 0,
293	stats->syn_received,
294	stats->cookie_invalid,
295	stats->cookie_valid,
296	stats->cookie_retrans,
297	stats->conn_reopened);
298
299	return 0;
300	}
301
302	static const struct seq_operations synproxy_cpu_seq_ops = {
303	.start = synproxy_cpu_seq_start,
304	.next = synproxy_cpu_seq_next,
305	.stop = synproxy_cpu_seq_stop,
306	.show = synproxy_cpu_seq_show,
307	};
308
309	static int synproxy_cpu_seq_open(struct inode inode, struct file file)
310	{
311	return seq_open_net(inode, file, &synproxy_cpu_seq_ops,
312	sizeof(struct seq_net_private));
313	}
314
315	static const struct file_operations synproxy_cpu_seq_fops = {
316	.owner = THIS_MODULE,
317	.open = synproxy_cpu_seq_open,
318	.read = seq_read,
319	.llseek = seq_lseek,
320	.release = seq_release_net,
321	};
322
323	static int __net_init synproxy_proc_init(struct net *net)
324	{
325	if (!proc_create("synproxy", S_IRUGO, net->proc_net_stat,
326	&synproxy_cpu_seq_fops))
327	return -ENOMEM;
328	return 0;
329	}
330
331	static void __net_exit synproxy_proc_exit(struct net *net)
332	{
333	remove_proc_entry("synproxy", net->proc_net_stat);
334	}
335	#else
336	static int __net_init synproxy_proc_init(struct net *net)
337	{
338	return 0;
339	}
340
341	static void __net_exit synproxy_proc_exit(struct net *net)
342	{
343	return;
344	}
345	#endif /* CONFIG_PROC_FS */
346
347	static int __net_init synproxy_net_init(struct net *net)
348	{
349	struct synproxy_net *snet = synproxy_pernet(net);
350	struct nf_conntrack_tuple t;
351	struct nf_conn *ct;
352	int err = -ENOMEM;
353
354	memset(&t, 0, sizeof(t));
355	ct = nf_conntrack_alloc(net, 0, &t, &t, GFP_KERNEL);
356	if (IS_ERR(ct)) {
357	err = PTR_ERR(ct);
358	goto err1;
359	}
360
48b1de4c PM	361	if (!nfct_seqadj_ext_add(ct))
	362	goto err2;
	363	if (!nfct_synproxy_ext_add(ct))
	364	goto err2;
f4de4c89 PM	365	__set_bit(IPS_TEMPLATE_BIT, &ct->status);
f4de4c89 PM	366	__set_bit(IPS_CONFIRMED_BIT, &ct->status);
48b1de4c PM	367
	368	snet->tmpl = ct;
	369
	370	snet->stats = alloc_percpu(struct synproxy_stats);
	371	if (snet->stats == NULL)
	372	goto err2;
	373
	374	err = synproxy_proc_init(net);
	375	if (err < 0)
	376	goto err3;
	377
	378	return 0;
	379
	380	err3:
	381	free_percpu(snet->stats);
	382	err2:
	383	nf_conntrack_free(ct);
	384	err1:
	385	return err;
	386	}
	387
	388	static void __net_exit synproxy_net_exit(struct net *net)
	389	{
	390	struct synproxy_net *snet = synproxy_pernet(net);
	391
	392	nf_conntrack_free(snet->tmpl);
	393	synproxy_proc_exit(net);
	394	free_percpu(snet->stats);
	395	}
	396
	397	static struct pernet_operations synproxy_net_ops = {
	398	.init = synproxy_net_init,
	399	.exit = synproxy_net_exit,
	400	.id = &synproxy_net_id,
	401	.size = sizeof(struct synproxy_net),
	402	};
	403
	404	static int __init synproxy_core_init(void)
	405	{
	406	int err;
	407
	408	err = nf_ct_extend_register(&nf_ct_synproxy_extend);
	409	if (err < 0)
	410	goto err1;
	411
	412	err = register_pernet_subsys(&synproxy_net_ops);
	413	if (err < 0)
	414	goto err2;
	415
	416	return 0;
	417
	418	err2:
	419	nf_ct_extend_unregister(&nf_ct_synproxy_extend);
	420	err1:
	421	return err;
	422	}
	423
	424	static void __exit synproxy_core_exit(void)
	425	{
	426	unregister_pernet_subsys(&synproxy_net_ops);
	427	nf_ct_extend_unregister(&nf_ct_synproxy_extend);
	428	}
	429
	430	module_init(synproxy_core_init);
431	module_exit(synproxy_core_exit);
432
433	MODULE_LICENSE("GPL");
434	MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");