1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * This is a module which is used for queueing packets and communicating with 4 * userspace via nfnetlink. 5 * 6 * (C) 2005 by Harald Welte <laforge@netfilter.org> 7 * (C) 2007 by Patrick McHardy <kaber@trash.net> 8 * 9 * Based on the old ipv4-only ip_queue.c: 10 * (C) 2000-2002 James Morris <jmorris@intercode.com.au> 11 * (C) 2003-2005 Netfilter Core Team <coreteam@netfilter.org> 12 */ 13 14 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 15 16 #include <linux/module.h> 17 #include <linux/skbuff.h> 18 #include <linux/init.h> 19 #include <linux/spinlock.h> 20 #include <linux/slab.h> 21 #include <linux/notifier.h> 22 #include <linux/netdevice.h> 23 #include <linux/netfilter.h> 24 #include <linux/proc_fs.h> 25 #include <linux/netfilter_ipv4.h> 26 #include <linux/netfilter_ipv6.h> 27 #include <linux/netfilter_bridge.h> 28 #include <linux/netfilter/nfnetlink.h> 29 #include <linux/netfilter/nfnetlink_queue.h> 30 #include <linux/netfilter/nf_conntrack_common.h> 31 #include <linux/list.h> 32 #include <linux/cgroup-defs.h> 33 #include <linux/rhashtable.h> 34 #include <linux/jhash.h> 35 #include <net/gso.h> 36 #include <net/sock.h> 37 #include <net/tcp_states.h> 38 #include <net/netfilter/nf_queue.h> 39 #include <net/netns/generic.h> 40 41 #include <linux/atomic.h> 42 43 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) 44 #include "../bridge/br_private.h" 45 #endif 46 47 #if IS_ENABLED(CONFIG_NF_CONNTRACK) 48 #include <net/netfilter/nf_conntrack.h> 49 #endif 50 51 #define NFQNL_QMAX_DEFAULT 1024 52 #define NFQNL_HASH_MIN 8 53 #define NFQNL_HASH_MAX 32768 54 55 /* We're using struct nlattr which has 16bit nla_len. Note that nla_len 56 * includes the header length. Thus, the maximum packet length that we 57 * support is 65531 bytes. We send truncated packets if the specified length 58 * is larger than that. Userspace can check for presence of NFQA_CAP_LEN 59 * attribute to detect truncation. 60 */ 61 #define NFQNL_MAX_COPY_RANGE (0xffff - NLA_HDRLEN) 62 63 struct nfqnl_instance { 64 struct hlist_node hlist; /* global list of queues */ 65 struct rhashtable nfqnl_packet_map; 66 struct rcu_work rwork; 67 68 u32 peer_portid; 69 unsigned int queue_maxlen; 70 unsigned int copy_range; 71 unsigned int queue_dropped; 72 unsigned int queue_user_dropped; 73 74 75 u_int16_t queue_num; /* number of this queue */ 76 u_int8_t copy_mode; 77 u_int32_t flags; /* Set using NFQA_CFG_FLAGS */ 78 /* 79 * Following fields are dirtied for each queued packet, 80 * keep them in same cache line if possible. 81 */ 82 spinlock_t lock ____cacheline_aligned_in_smp; 83 unsigned int queue_total; 84 unsigned int id_sequence; /* 'sequence' of pkt ids */ 85 struct list_head queue_list; /* packets in queue */ 86 }; 87 88 typedef int (*nfqnl_cmpfn)(struct nf_queue_entry *, unsigned long); 89 90 static struct workqueue_struct *nfq_cleanup_wq __read_mostly; 91 static unsigned int nfnl_queue_net_id __read_mostly; 92 93 #define INSTANCE_BUCKETS 16 94 struct nfnl_queue_net { 95 spinlock_t instances_lock; 96 struct hlist_head instance_table[INSTANCE_BUCKETS]; 97 }; 98 99 static struct nfnl_queue_net *nfnl_queue_pernet(struct net *net) 100 { 101 return net_generic(net, nfnl_queue_net_id); 102 } 103 104 static inline u_int8_t instance_hashfn(u_int16_t queue_num) 105 { 106 return ((queue_num >> 8) ^ queue_num) % INSTANCE_BUCKETS; 107 } 108 109 static const struct rhashtable_params nfqnl_rhashtable_params = { 110 .head_offset = offsetof(struct nf_queue_entry, hash_node), 111 .key_offset = offsetof(struct nf_queue_entry, id), 112 .key_len = sizeof(u32), 113 .automatic_shrinking = true, 114 .min_size = NFQNL_HASH_MIN, 115 .max_size = NFQNL_HASH_MAX, 116 }; 117 118 static struct nfqnl_instance * 119 instance_lookup(struct nfnl_queue_net *q, u_int16_t queue_num) 120 { 121 struct hlist_head *head; 122 struct nfqnl_instance *inst; 123 124 head = &q->instance_table[instance_hashfn(queue_num)]; 125 hlist_for_each_entry_rcu(inst, head, hlist) { 126 if (inst->queue_num == queue_num) 127 return inst; 128 } 129 return NULL; 130 } 131 132 static struct nfqnl_instance * 133 instance_create(struct nfnl_queue_net *q, u_int16_t queue_num, u32 portid) 134 { 135 struct nfqnl_instance *inst; 136 unsigned int h; 137 int err; 138 139 inst = kzalloc_obj(*inst, GFP_KERNEL_ACCOUNT); 140 if (!inst) 141 return ERR_PTR(-ENOMEM); 142 143 inst->queue_num = queue_num; 144 inst->peer_portid = portid; 145 inst->queue_maxlen = NFQNL_QMAX_DEFAULT; 146 inst->copy_range = NFQNL_MAX_COPY_RANGE; 147 inst->copy_mode = NFQNL_COPY_NONE; 148 spin_lock_init(&inst->lock); 149 INIT_LIST_HEAD(&inst->queue_list); 150 151 err = rhashtable_init(&inst->nfqnl_packet_map, &nfqnl_rhashtable_params); 152 if (err < 0) 153 goto out_free; 154 155 spin_lock(&q->instances_lock); 156 if (instance_lookup(q, queue_num)) { 157 err = -EEXIST; 158 goto out_unlock; 159 } 160 161 if (!try_module_get(THIS_MODULE)) { 162 err = -EAGAIN; 163 goto out_unlock; 164 } 165 166 h = instance_hashfn(queue_num); 167 hlist_add_head_rcu(&inst->hlist, &q->instance_table[h]); 168 169 spin_unlock(&q->instances_lock); 170 171 return inst; 172 173 out_unlock: 174 spin_unlock(&q->instances_lock); 175 rhashtable_destroy(&inst->nfqnl_packet_map); 176 out_free: 177 kfree(inst); 178 return ERR_PTR(err); 179 } 180 181 static void nfqnl_flush(struct nfqnl_instance *queue, nfqnl_cmpfn cmpfn, 182 unsigned long data); 183 184 static void instance_destroy_work(struct work_struct *work) 185 { 186 struct nfqnl_instance *inst; 187 188 inst = container_of(to_rcu_work(work), struct nfqnl_instance, 189 rwork); 190 rcu_read_lock(); 191 nfqnl_flush(inst, NULL, 0); 192 rcu_read_unlock(); 193 194 rhashtable_destroy(&inst->nfqnl_packet_map); 195 196 kfree(inst); 197 module_put(THIS_MODULE); 198 } 199 200 static void 201 __instance_destroy(struct nfqnl_instance *inst) 202 { 203 hlist_del_rcu(&inst->hlist); 204 205 INIT_RCU_WORK(&inst->rwork, instance_destroy_work); 206 queue_rcu_work(nfq_cleanup_wq, &inst->rwork); 207 } 208 209 static void 210 instance_destroy(struct nfnl_queue_net *q, struct nfqnl_instance *inst) 211 { 212 spin_lock(&q->instances_lock); 213 __instance_destroy(inst); 214 spin_unlock(&q->instances_lock); 215 } 216 217 static int 218 __enqueue_entry(struct nfqnl_instance *queue, struct nf_queue_entry *entry) 219 { 220 int err; 221 222 err = rhashtable_insert_fast(&queue->nfqnl_packet_map, &entry->hash_node, 223 nfqnl_rhashtable_params); 224 if (unlikely(err)) 225 return err; 226 227 list_add_tail(&entry->list, &queue->queue_list); 228 queue->queue_total++; 229 230 return 0; 231 } 232 233 static void 234 __dequeue_entry(struct nfqnl_instance *queue, struct nf_queue_entry *entry) 235 { 236 rhashtable_remove_fast(&queue->nfqnl_packet_map, &entry->hash_node, 237 nfqnl_rhashtable_params); 238 list_del(&entry->list); 239 queue->queue_total--; 240 } 241 242 static struct nf_queue_entry * 243 find_dequeue_entry(struct nfqnl_instance *queue, unsigned int id) 244 { 245 struct nf_queue_entry *entry; 246 247 spin_lock_bh(&queue->lock); 248 entry = rhashtable_lookup_fast(&queue->nfqnl_packet_map, &id, 249 nfqnl_rhashtable_params); 250 251 if (entry) 252 __dequeue_entry(queue, entry); 253 254 spin_unlock_bh(&queue->lock); 255 256 return entry; 257 } 258 259 static unsigned int nf_iterate(struct sk_buff *skb, 260 struct nf_hook_state *state, 261 const struct nf_hook_entries *hooks, 262 unsigned int *index) 263 { 264 const struct nf_hook_entry *hook; 265 unsigned int verdict, i = *index; 266 267 while (i < hooks->num_hook_entries) { 268 hook = &hooks->hooks[i]; 269 repeat: 270 verdict = nf_hook_entry_hookfn(hook, skb, state); 271 if (verdict != NF_ACCEPT) { 272 *index = i; 273 if (verdict != NF_REPEAT) 274 return verdict; 275 goto repeat; 276 } 277 i++; 278 } 279 280 *index = i; 281 return NF_ACCEPT; 282 } 283 284 static struct nf_hook_entries *nf_hook_entries_head(const struct net *net, u8 pf, u8 hooknum) 285 { 286 switch (pf) { 287 #ifdef CONFIG_NETFILTER_FAMILY_BRIDGE 288 case NFPROTO_BRIDGE: 289 return rcu_dereference(net->nf.hooks_bridge[hooknum]); 290 #endif 291 case NFPROTO_IPV4: 292 return rcu_dereference(net->nf.hooks_ipv4[hooknum]); 293 case NFPROTO_IPV6: 294 return rcu_dereference(net->nf.hooks_ipv6[hooknum]); 295 default: 296 WARN_ON_ONCE(1); 297 return NULL; 298 } 299 300 return NULL; 301 } 302 303 static int nf_ip_reroute(struct sk_buff *skb, const struct nf_queue_entry *entry) 304 { 305 #ifdef CONFIG_INET 306 const struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry); 307 308 if (entry->state.hook == NF_INET_LOCAL_OUT) { 309 const struct iphdr *iph = ip_hdr(skb); 310 311 if (!(iph->tos == rt_info->tos && 312 skb->mark == rt_info->mark && 313 iph->daddr == rt_info->daddr && 314 iph->saddr == rt_info->saddr)) 315 return ip_route_me_harder(entry->state.net, entry->state.sk, 316 skb, RTN_UNSPEC); 317 } 318 #endif 319 return 0; 320 } 321 322 static int nf_ip6_reroute(struct sk_buff *skb, 323 const struct nf_queue_entry *entry) 324 { 325 struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry); 326 327 if (entry->state.hook == NF_INET_LOCAL_OUT) { 328 const struct ipv6hdr *iph = ipv6_hdr(skb); 329 330 if (!ipv6_addr_equal(&iph->daddr, &rt_info->daddr) || 331 !ipv6_addr_equal(&iph->saddr, &rt_info->saddr) || 332 skb->mark != rt_info->mark) 333 return nf_ip6_route_me_harder(entry->state.net, 334 entry->state.sk, skb); 335 } 336 return 0; 337 } 338 339 static int nf_reroute(struct sk_buff *skb, struct nf_queue_entry *entry) 340 { 341 int ret = 0; 342 343 switch (entry->state.pf) { 344 case AF_INET: 345 ret = nf_ip_reroute(skb, entry); 346 break; 347 case AF_INET6: 348 ret = nf_ip6_reroute(skb, entry); 349 break; 350 } 351 return ret; 352 } 353 354 /* caller must hold rcu read-side lock */ 355 static void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict) 356 { 357 const struct nf_hook_entry *hook_entry; 358 const struct nf_hook_entries *hooks; 359 struct sk_buff *skb = entry->skb; 360 const struct net *net; 361 unsigned int i; 362 int err; 363 u8 pf; 364 365 net = entry->state.net; 366 pf = entry->state.pf; 367 368 hooks = nf_hook_entries_head(net, pf, entry->state.hook); 369 370 i = entry->hook_index; 371 if (!hooks || i >= hooks->num_hook_entries) { 372 kfree_skb_reason(skb, SKB_DROP_REASON_NETFILTER_DROP); 373 nf_queue_entry_free(entry); 374 return; 375 } 376 377 hook_entry = &hooks->hooks[i]; 378 379 /* Continue traversal iff userspace said ok... */ 380 if (verdict == NF_REPEAT) 381 verdict = nf_hook_entry_hookfn(hook_entry, skb, &entry->state); 382 383 if (verdict == NF_ACCEPT) { 384 if (nf_reroute(skb, entry) < 0) 385 verdict = NF_DROP; 386 } 387 388 if (verdict == NF_ACCEPT) { 389 next_hook: 390 ++i; 391 verdict = nf_iterate(skb, &entry->state, hooks, &i); 392 } 393 394 switch (verdict & NF_VERDICT_MASK) { 395 case NF_ACCEPT: 396 case NF_STOP: 397 local_bh_disable(); 398 entry->state.okfn(entry->state.net, entry->state.sk, skb); 399 local_bh_enable(); 400 break; 401 case NF_QUEUE: 402 err = nf_queue(skb, &entry->state, i, verdict); 403 if (err == 1) 404 goto next_hook; 405 break; 406 case NF_STOLEN: 407 break; 408 default: 409 kfree_skb(skb); 410 } 411 412 nf_queue_entry_free(entry); 413 } 414 415 /* return true if the entry has an unconfirmed conntrack attached that isn't owned by us 416 * exclusively. 417 */ 418 static bool nf_ct_drop_unconfirmed(const struct nf_queue_entry *entry, bool *is_unconfirmed) 419 { 420 #if IS_ENABLED(CONFIG_NF_CONNTRACK) 421 struct nf_conn *ct = (void *)skb_nfct(entry->skb); 422 423 if (!ct || nf_ct_is_confirmed(ct)) 424 return false; 425 426 if (is_unconfirmed) 427 *is_unconfirmed = true; 428 429 /* in some cases skb_clone() can occur after initial conntrack 430 * pickup, but conntrack assumes exclusive skb->_nfct ownership for 431 * unconfirmed entries. 432 * 433 * This happens for br_netfilter and with ip multicast routing. 434 * This can't be solved with serialization here because one clone 435 * could have been queued for local delivery or could be transmitted 436 * in parallel on another CPU. 437 */ 438 return refcount_read(&ct->ct_general.use) > 1; 439 #endif 440 return false; 441 } 442 443 static bool nf_bridge_port_valid(const struct net_device *dev) 444 { 445 if (!dev) 446 return true; 447 448 return netif_is_bridge_port(dev); 449 } 450 451 /* queued skbs leave rcu protection. We bump device refcount so that 452 * the device cannot go away. However, while packet was out the port 453 * could have been removed from the bridge. 454 * 455 * Ensure in+outdev are still part of a bridge at reinject time. 456 * 457 * The device rx_handler_data could even be pointing at data that is 458 * not a net_bridge_port structure. 459 */ 460 static bool nf_bridge_ports_valid(const struct nf_queue_entry *entry) 461 { 462 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) 463 if (!nf_bridge_port_valid(entry->physin) || 464 !nf_bridge_port_valid(entry->physout)) 465 return false; 466 #endif 467 if (entry->state.pf != PF_BRIDGE) 468 return true; 469 470 if (!nf_bridge_port_valid(entry->state.in) || 471 !nf_bridge_port_valid(entry->state.out)) 472 return false; 473 474 return true; 475 } 476 477 static void nfqnl_reinject(struct nf_queue_entry *entry, unsigned int verdict) 478 { 479 const struct nf_ct_hook *ct_hook; 480 481 if (!nf_bridge_ports_valid(entry)) 482 verdict = NF_DROP; 483 484 if (verdict == NF_ACCEPT || 485 verdict == NF_REPEAT || 486 verdict == NF_STOP) { 487 unsigned int ct_verdict = verdict; 488 489 rcu_read_lock(); 490 ct_hook = rcu_dereference(nf_ct_hook); 491 if (ct_hook) 492 ct_verdict = ct_hook->update(entry->state.net, entry->skb); 493 rcu_read_unlock(); 494 495 switch (ct_verdict & NF_VERDICT_MASK) { 496 case NF_ACCEPT: 497 /* follow userspace verdict, could be REPEAT */ 498 break; 499 case NF_STOLEN: 500 nf_queue_entry_free(entry); 501 return; 502 default: 503 verdict = ct_verdict & NF_VERDICT_MASK; 504 break; 505 } 506 } 507 508 if (verdict != NF_DROP && entry->nf_ct_is_unconfirmed) { 509 /* If first queued segment was already reinjected then 510 * there is a good chance the ct entry is now confirmed. 511 * 512 * Handle the rare cases: 513 * - out-of-order verdict 514 * - threaded userspace reinjecting in parallel 515 * - first segment was dropped 516 * 517 * In all of those cases we can't handle this packet 518 * because we can't be sure that another CPU won't modify 519 * nf_conn->ext in parallel which isn't allowed. 520 */ 521 if (nf_ct_drop_unconfirmed(entry, NULL)) 522 verdict = NF_DROP; 523 } 524 525 nf_reinject(entry, verdict); 526 } 527 528 static void 529 nfqnl_flush(struct nfqnl_instance *queue, nfqnl_cmpfn cmpfn, unsigned long data) 530 { 531 struct nf_queue_entry *entry, *next; 532 533 spin_lock_bh(&queue->lock); 534 list_for_each_entry_safe(entry, next, &queue->queue_list, list) { 535 if (!cmpfn || cmpfn(entry, data)) { 536 __dequeue_entry(queue, entry); 537 nfqnl_reinject(entry, NF_DROP); 538 } 539 } 540 spin_unlock_bh(&queue->lock); 541 } 542 543 static int 544 nfqnl_put_packet_info(struct sk_buff *nlskb, struct sk_buff *packet, 545 bool csum_verify) 546 { 547 __u32 flags = 0; 548 549 if (packet->ip_summed == CHECKSUM_PARTIAL) 550 flags = NFQA_SKB_CSUMNOTREADY; 551 else if (csum_verify) 552 flags = NFQA_SKB_CSUM_NOTVERIFIED; 553 554 if (skb_is_gso(packet)) 555 flags |= NFQA_SKB_GSO; 556 557 return flags ? nla_put_be32(nlskb, NFQA_SKB_INFO, htonl(flags)) : 0; 558 } 559 560 static int nfqnl_put_sk_uidgid(struct sk_buff *skb, struct sock *sk) 561 { 562 const struct socket *sock; 563 const struct file *file; 564 const struct cred *cred; 565 566 if (!sk_fullsock(sk)) 567 return 0; 568 569 /* The sk pointer remains valid as long as the skb is. 570 * The sk_socket and file pointer may become NULL 571 * if the socket is closed. 572 * Both structures (including file->cred) are RCU freed 573 * which means they can be accessed within a RCU read section. 574 */ 575 sock = READ_ONCE(sk->sk_socket); 576 file = sock ? READ_ONCE(sock->file) : NULL; 577 if (file) { 578 cred = file->f_cred; 579 if (nla_put_be32(skb, NFQA_UID, 580 htonl(from_kuid_munged(&init_user_ns, cred->fsuid)))) 581 goto nla_put_failure; 582 if (nla_put_be32(skb, NFQA_GID, 583 htonl(from_kgid_munged(&init_user_ns, cred->fsgid)))) 584 goto nla_put_failure; 585 } 586 return 0; 587 588 nla_put_failure: 589 return -1; 590 } 591 592 static int nfqnl_put_sk_classid(struct sk_buff *skb, struct sock *sk) 593 { 594 #if IS_ENABLED(CONFIG_CGROUP_NET_CLASSID) 595 if (sk && sk_fullsock(sk)) { 596 u32 classid = sock_cgroup_classid(&sk->sk_cgrp_data); 597 598 if (classid && nla_put_be32(skb, NFQA_CGROUP_CLASSID, htonl(classid))) 599 return -1; 600 } 601 #endif 602 return 0; 603 } 604 605 static int nfqnl_get_sk_secctx(struct sk_buff *skb, struct lsm_context *ctx) 606 { 607 int seclen = 0; 608 #if IS_ENABLED(CONFIG_NETWORK_SECMARK) 609 if (skb->secmark) 610 seclen = security_secid_to_secctx(skb->secmark, ctx); 611 #endif 612 return seclen; 613 } 614 615 static u32 nfqnl_get_bridge_size(struct nf_queue_entry *entry) 616 { 617 struct sk_buff *entskb = entry->skb; 618 u32 nlalen = 0; 619 u32 mac_len; 620 621 if (entry->state.pf != PF_BRIDGE || !skb_mac_header_was_set(entskb)) 622 return 0; 623 624 if (skb_vlan_tag_present(entskb)) 625 nlalen += nla_total_size(nla_total_size(sizeof(__be16)) + 626 nla_total_size(sizeof(__be16))); 627 628 mac_len = skb_mac_header_len(entskb); 629 if (mac_len > 0) 630 nlalen += nla_total_size(mac_len); 631 632 return nlalen; 633 } 634 635 static int nfqnl_put_bridge(struct nf_queue_entry *entry, struct sk_buff *skb) 636 { 637 struct sk_buff *entskb = entry->skb; 638 u32 mac_len; 639 640 if (entry->state.pf != PF_BRIDGE || !skb_mac_header_was_set(entskb)) 641 return 0; 642 643 if (skb_vlan_tag_present(entskb)) { 644 struct nlattr *nest; 645 646 nest = nla_nest_start(skb, NFQA_VLAN); 647 if (!nest) 648 goto nla_put_failure; 649 650 if (nla_put_be16(skb, NFQA_VLAN_TCI, htons(entskb->vlan_tci)) || 651 nla_put_be16(skb, NFQA_VLAN_PROTO, entskb->vlan_proto)) 652 goto nla_put_failure; 653 654 nla_nest_end(skb, nest); 655 } 656 657 mac_len = skb_mac_header_len(entskb); 658 if (mac_len > 0 && 659 nla_put(skb, NFQA_L2HDR, mac_len, skb_mac_header(entskb))) 660 goto nla_put_failure; 661 662 return 0; 663 664 nla_put_failure: 665 return -1; 666 } 667 668 static int nf_queue_checksum_help(struct sk_buff *entskb) 669 { 670 if (skb_csum_is_sctp(entskb)) 671 return skb_crc32c_csum_help(entskb); 672 673 return skb_checksum_help(entskb); 674 } 675 676 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) 677 static int nfqnl_put_master_ifindex(struct sk_buff *nlskb, int attr, 678 const struct net_device *dev) 679 { 680 const struct net_device *upper; 681 682 if (dev && !netif_is_bridge_port(dev)) 683 return 0; 684 685 upper = netdev_master_upper_dev_get_rcu((struct net_device *)dev); 686 if (upper && nla_put_be32(nlskb, attr, htonl(upper->ifindex))) 687 return -EMSGSIZE; 688 689 return 0; 690 } 691 #endif 692 693 static struct sk_buff * 694 nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, 695 struct nf_queue_entry *entry, 696 __be32 **packet_id_ptr) 697 { 698 size_t size; 699 size_t data_len = 0, cap_len = 0; 700 unsigned int hlen = 0; 701 struct sk_buff *skb; 702 struct nlattr *nla; 703 struct nfqnl_msg_packet_hdr *pmsg; 704 struct nlmsghdr *nlh; 705 struct sk_buff *entskb = entry->skb; 706 struct net_device *indev; 707 struct net_device *outdev; 708 struct nf_conn *ct = NULL; 709 enum ip_conntrack_info ctinfo = 0; 710 const struct nfnl_ct_hook *nfnl_ct; 711 bool csum_verify; 712 struct lsm_context ctx = { NULL, 0, 0 }; 713 int seclen = 0; 714 ktime_t tstamp; 715 716 size = nlmsg_total_size(sizeof(struct nfgenmsg)) 717 + nla_total_size(sizeof(struct nfqnl_msg_packet_hdr)) 718 + nla_total_size(sizeof(u_int32_t)) /* ifindex */ 719 + nla_total_size(sizeof(u_int32_t)) /* ifindex */ 720 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) 721 + nla_total_size(sizeof(u_int32_t)) /* ifindex */ 722 + nla_total_size(sizeof(u_int32_t)) /* ifindex */ 723 #endif 724 + nla_total_size(sizeof(u_int32_t)) /* mark */ 725 + nla_total_size(sizeof(u_int32_t)) /* priority */ 726 + nla_total_size(sizeof(struct nfqnl_msg_packet_hw)) 727 + nla_total_size(sizeof(u_int32_t)) /* skbinfo */ 728 #if IS_ENABLED(CONFIG_CGROUP_NET_CLASSID) 729 + nla_total_size(sizeof(u_int32_t)) /* classid */ 730 #endif 731 + nla_total_size(sizeof(u_int32_t)); /* cap_len */ 732 733 tstamp = skb_tstamp_cond(entskb, false); 734 if (tstamp) 735 size += nla_total_size(sizeof(struct nfqnl_msg_packet_timestamp)); 736 737 size += nfqnl_get_bridge_size(entry); 738 739 if (entry->state.hook <= NF_INET_FORWARD || 740 (entry->state.hook == NF_INET_POST_ROUTING && entskb->sk == NULL)) 741 csum_verify = !skb_csum_unnecessary(entskb); 742 else 743 csum_verify = false; 744 745 outdev = entry->state.out; 746 747 switch ((enum nfqnl_config_mode)READ_ONCE(queue->copy_mode)) { 748 case NFQNL_COPY_META: 749 case NFQNL_COPY_NONE: 750 break; 751 752 case NFQNL_COPY_PACKET: 753 if (!(queue->flags & NFQA_CFG_F_GSO) && 754 entskb->ip_summed == CHECKSUM_PARTIAL && 755 nf_queue_checksum_help(entskb)) 756 return NULL; 757 758 data_len = READ_ONCE(queue->copy_range); 759 if (data_len > entskb->len) 760 data_len = entskb->len; 761 762 hlen = skb_zerocopy_headlen(entskb); 763 hlen = min_t(unsigned int, hlen, data_len); 764 size += sizeof(struct nlattr) + hlen; 765 cap_len = entskb->len; 766 break; 767 } 768 769 nfnl_ct = rcu_dereference(nfnl_ct_hook); 770 771 #if IS_ENABLED(CONFIG_NF_CONNTRACK) 772 if (queue->flags & NFQA_CFG_F_CONNTRACK) { 773 if (nfnl_ct != NULL) { 774 ct = nf_ct_get(entskb, &ctinfo); 775 if (ct != NULL) 776 size += nfnl_ct->build_size(ct); 777 } 778 } 779 #endif 780 781 if (queue->flags & NFQA_CFG_F_UID_GID) { 782 size += (nla_total_size(sizeof(u_int32_t)) /* uid */ 783 + nla_total_size(sizeof(u_int32_t))); /* gid */ 784 } 785 786 if ((queue->flags & NFQA_CFG_F_SECCTX) && entskb->sk) { 787 seclen = nfqnl_get_sk_secctx(entskb, &ctx); 788 if (seclen < 0) 789 return NULL; 790 if (seclen) 791 size += nla_total_size(seclen); 792 } 793 794 skb = alloc_skb(size, GFP_ATOMIC); 795 if (!skb) { 796 skb_tx_error(entskb); 797 goto nlmsg_failure; 798 } 799 800 nlh = nfnl_msg_put(skb, 0, 0, 801 nfnl_msg_type(NFNL_SUBSYS_QUEUE, NFQNL_MSG_PACKET), 802 0, entry->state.pf, NFNETLINK_V0, 803 htons(queue->queue_num)); 804 if (!nlh) { 805 skb_tx_error(entskb); 806 kfree_skb(skb); 807 goto nlmsg_failure; 808 } 809 810 nla = __nla_reserve(skb, NFQA_PACKET_HDR, sizeof(*pmsg)); 811 pmsg = nla_data(nla); 812 pmsg->hw_protocol = entskb->protocol; 813 pmsg->hook = entry->state.hook; 814 *packet_id_ptr = &pmsg->packet_id; 815 816 indev = entry->state.in; 817 if (indev) { 818 #if !IS_ENABLED(CONFIG_BRIDGE_NETFILTER) 819 if (nla_put_be32(skb, NFQA_IFINDEX_INDEV, htonl(indev->ifindex))) 820 goto nla_put_failure; 821 #else 822 if (entry->state.pf == PF_BRIDGE) { 823 /* Case 1: indev is physical input device, we need to 824 * look for bridge group (when called from 825 * netfilter_bridge) */ 826 if (nla_put_be32(skb, NFQA_IFINDEX_PHYSINDEV, 827 htonl(indev->ifindex)) || 828 nfqnl_put_master_ifindex(skb, NFQA_IFINDEX_INDEV, indev)) 829 goto nla_put_failure; 830 } else { 831 int physinif; 832 833 /* Case 2: indev is bridge group, we need to look for 834 * physical device (when called from ipv4) */ 835 if (nla_put_be32(skb, NFQA_IFINDEX_INDEV, 836 htonl(indev->ifindex))) 837 goto nla_put_failure; 838 839 physinif = nf_bridge_get_physinif(entskb); 840 if (physinif && 841 nla_put_be32(skb, NFQA_IFINDEX_PHYSINDEV, 842 htonl(physinif))) 843 goto nla_put_failure; 844 } 845 #endif 846 } 847 848 if (outdev) { 849 #if !IS_ENABLED(CONFIG_BRIDGE_NETFILTER) 850 if (nla_put_be32(skb, NFQA_IFINDEX_OUTDEV, htonl(outdev->ifindex))) 851 goto nla_put_failure; 852 #else 853 if (entry->state.pf == PF_BRIDGE) { 854 /* Case 1: outdev is physical output device, we need to 855 * look for bridge group (when called from 856 * netfilter_bridge) */ 857 if (nla_put_be32(skb, NFQA_IFINDEX_PHYSOUTDEV, 858 htonl(outdev->ifindex)) || 859 nfqnl_put_master_ifindex(skb, NFQA_IFINDEX_OUTDEV, outdev)) 860 goto nla_put_failure; 861 } else { 862 int physoutif; 863 864 /* Case 2: outdev is bridge group, we need to look for 865 * physical output device (when called from ipv4) */ 866 if (nla_put_be32(skb, NFQA_IFINDEX_OUTDEV, 867 htonl(outdev->ifindex))) 868 goto nla_put_failure; 869 870 physoutif = nf_bridge_get_physoutif(entskb); 871 if (physoutif && 872 nla_put_be32(skb, NFQA_IFINDEX_PHYSOUTDEV, 873 htonl(physoutif))) 874 goto nla_put_failure; 875 } 876 #endif 877 } 878 879 if (entskb->mark && 880 nla_put_be32(skb, NFQA_MARK, htonl(entskb->mark))) 881 goto nla_put_failure; 882 883 if (entskb->priority && 884 nla_put_be32(skb, NFQA_PRIORITY, htonl(entskb->priority))) 885 goto nla_put_failure; 886 887 if (indev && entskb->dev && 888 skb_mac_header_was_set(entskb) && 889 skb_mac_header_len(entskb) != 0) { 890 struct nfqnl_msg_packet_hw phw; 891 int len; 892 893 memset(&phw, 0, sizeof(phw)); 894 len = dev_parse_header(entskb, phw.hw_addr); 895 if (len) { 896 phw.hw_addrlen = htons(len); 897 if (nla_put(skb, NFQA_HWADDR, sizeof(phw), &phw)) 898 goto nla_put_failure; 899 } 900 } 901 902 if (nfqnl_put_bridge(entry, skb) < 0) 903 goto nla_put_failure; 904 905 if (entry->state.hook <= NF_INET_FORWARD && tstamp) { 906 struct nfqnl_msg_packet_timestamp ts; 907 struct timespec64 kts = ktime_to_timespec64(tstamp); 908 909 ts.sec = cpu_to_be64(kts.tv_sec); 910 ts.usec = cpu_to_be64(kts.tv_nsec / NSEC_PER_USEC); 911 912 if (nla_put(skb, NFQA_TIMESTAMP, sizeof(ts), &ts)) 913 goto nla_put_failure; 914 } 915 916 if ((queue->flags & NFQA_CFG_F_UID_GID) && entskb->sk && 917 nfqnl_put_sk_uidgid(skb, entskb->sk) < 0) 918 goto nla_put_failure; 919 920 if (nfqnl_put_sk_classid(skb, entskb->sk) < 0) 921 goto nla_put_failure; 922 923 if (seclen > 0 && nla_put(skb, NFQA_SECCTX, ctx.len, ctx.context)) 924 goto nla_put_failure; 925 926 if (ct && nfnl_ct->build(skb, ct, ctinfo, NFQA_CT, NFQA_CT_INFO) < 0) 927 goto nla_put_failure; 928 929 if (cap_len > data_len && 930 nla_put_be32(skb, NFQA_CAP_LEN, htonl(cap_len))) 931 goto nla_put_failure; 932 933 if (nfqnl_put_packet_info(skb, entskb, csum_verify)) 934 goto nla_put_failure; 935 936 if (data_len) { 937 struct nlattr *nla; 938 939 if (skb_tailroom(skb) < sizeof(*nla) + hlen) 940 goto nla_put_failure; 941 942 nla = skb_put(skb, sizeof(*nla)); 943 nla->nla_type = NFQA_PAYLOAD; 944 nla->nla_len = nla_attr_size(data_len); 945 946 if (skb_zerocopy(skb, entskb, data_len, hlen)) 947 goto nla_put_failure; 948 } 949 950 nlh->nlmsg_len = skb->len; 951 if (seclen >= 0) 952 security_release_secctx(&ctx); 953 return skb; 954 955 nla_put_failure: 956 skb_tx_error(entskb); 957 kfree_skb(skb); 958 net_err_ratelimited("nf_queue: error creating packet message\n"); 959 nlmsg_failure: 960 if (seclen >= 0) 961 security_release_secctx(&ctx); 962 return NULL; 963 } 964 965 static int 966 __nfqnl_enqueue_packet(struct net *net, struct nfqnl_instance *queue, 967 struct nf_queue_entry *entry) 968 { 969 struct sk_buff *nskb; 970 int err = -ENOBUFS; 971 __be32 *packet_id_ptr; 972 int failopen = 0; 973 974 nskb = nfqnl_build_packet_message(net, queue, entry, &packet_id_ptr); 975 if (nskb == NULL) { 976 err = -ENOMEM; 977 goto err_out; 978 } 979 spin_lock_bh(&queue->lock); 980 981 if (queue->queue_total >= queue->queue_maxlen) 982 goto err_out_queue_drop; 983 984 entry->id = ++queue->id_sequence; 985 *packet_id_ptr = htonl(entry->id); 986 987 /* Insert into hash BEFORE unicast. If failure don't send to userspace. */ 988 err = __enqueue_entry(queue, entry); 989 if (unlikely(err)) 990 goto err_out_queue_drop; 991 992 /* nfnetlink_unicast will either free the nskb or add it to a socket */ 993 err = nfnetlink_unicast(nskb, net, queue->peer_portid); 994 if (err < 0) { 995 /* Unicast failed - remove entry we just inserted */ 996 __dequeue_entry(queue, entry); 997 998 if (queue->flags & NFQA_CFG_F_FAIL_OPEN) { 999 failopen = 1; 1000 err = 0; 1001 } else { 1002 queue->queue_user_dropped++; 1003 } 1004 goto err_out_unlock; 1005 } 1006 1007 spin_unlock_bh(&queue->lock); 1008 return 0; 1009 1010 err_out_queue_drop: 1011 if (queue->flags & NFQA_CFG_F_FAIL_OPEN) { 1012 failopen = 1; 1013 err = 0; 1014 } else { 1015 queue->queue_dropped++; 1016 1017 if (queue->queue_total >= queue->queue_maxlen) 1018 net_warn_ratelimited("nf_queue: full at %d entries, dropping packets(s)\n", 1019 queue->queue_total); 1020 else 1021 net_warn_ratelimited("nf_queue: hash insert failed: %d\n", err); 1022 } 1023 kfree_skb(nskb); 1024 err_out_unlock: 1025 spin_unlock_bh(&queue->lock); 1026 if (failopen) 1027 nfqnl_reinject(entry, NF_ACCEPT); 1028 err_out: 1029 return err; 1030 } 1031 1032 static struct nf_queue_entry * 1033 nf_queue_entry_dup(struct nf_queue_entry *e) 1034 { 1035 struct nf_queue_entry *entry = kmemdup(e, e->size, GFP_ATOMIC); 1036 1037 if (!entry) 1038 return NULL; 1039 1040 if (nf_queue_entry_get_refs(entry)) 1041 return entry; 1042 1043 kfree(entry); 1044 return NULL; 1045 } 1046 1047 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) 1048 /* When called from bridge netfilter, skb->data must point to MAC header 1049 * before calling skb_gso_segment(). Else, original MAC header is lost 1050 * and segmented skbs will be sent to wrong destination. 1051 */ 1052 static void nf_bridge_adjust_skb_data(struct sk_buff *skb) 1053 { 1054 if (nf_bridge_info_get(skb)) 1055 __skb_push(skb, skb_mac_header_len(skb)); 1056 } 1057 1058 static void nf_bridge_adjust_segmented_data(struct sk_buff *skb) 1059 { 1060 if (nf_bridge_info_get(skb)) 1061 __skb_pull(skb, skb_mac_header_len(skb)); 1062 } 1063 #else 1064 #define nf_bridge_adjust_skb_data(s) do {} while (0) 1065 #define nf_bridge_adjust_segmented_data(s) do {} while (0) 1066 #endif 1067 1068 static int 1069 __nfqnl_enqueue_packet_gso(struct net *net, struct nfqnl_instance *queue, 1070 struct sk_buff *skb, struct nf_queue_entry *entry) 1071 { 1072 int ret = -ENOMEM; 1073 struct nf_queue_entry *entry_seg; 1074 1075 nf_bridge_adjust_segmented_data(skb); 1076 1077 if (skb->next == NULL) { /* last packet, no need to copy entry */ 1078 struct sk_buff *gso_skb = entry->skb; 1079 entry->skb = skb; 1080 ret = __nfqnl_enqueue_packet(net, queue, entry); 1081 if (ret) 1082 entry->skb = gso_skb; 1083 return ret; 1084 } 1085 1086 skb_mark_not_on_list(skb); 1087 1088 entry_seg = nf_queue_entry_dup(entry); 1089 if (entry_seg) { 1090 entry_seg->skb = skb; 1091 ret = __nfqnl_enqueue_packet(net, queue, entry_seg); 1092 if (ret) 1093 nf_queue_entry_free(entry_seg); 1094 } 1095 return ret; 1096 } 1097 1098 static int 1099 nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum) 1100 { 1101 struct sk_buff *skb, *segs, *nskb; 1102 bool ct_is_unconfirmed = false; 1103 struct nfqnl_instance *queue; 1104 unsigned int queued; 1105 int err = -ENOBUFS; 1106 struct net *net = entry->state.net; 1107 struct nfnl_queue_net *q = nfnl_queue_pernet(net); 1108 1109 /* rcu_read_lock()ed by nf_hook_thresh */ 1110 queue = instance_lookup(q, queuenum); 1111 if (!queue) 1112 return -ESRCH; 1113 1114 if (queue->copy_mode == NFQNL_COPY_NONE) 1115 return -EINVAL; 1116 1117 skb = entry->skb; 1118 1119 switch (entry->state.pf) { 1120 case NFPROTO_IPV4: 1121 skb->protocol = htons(ETH_P_IP); 1122 break; 1123 case NFPROTO_IPV6: 1124 skb->protocol = htons(ETH_P_IPV6); 1125 break; 1126 } 1127 1128 /* Check if someone already holds another reference to 1129 * unconfirmed ct. If so, we cannot queue the skb: 1130 * concurrent modifications of nf_conn->ext are not 1131 * allowed and we can't know if another CPU isn't 1132 * processing the same nf_conn entry in parallel. 1133 */ 1134 if (nf_ct_drop_unconfirmed(entry, &ct_is_unconfirmed)) 1135 return -EINVAL; 1136 1137 if (!skb_is_gso(skb) || ((queue->flags & NFQA_CFG_F_GSO) && !skb_is_gso_sctp(skb))) 1138 return __nfqnl_enqueue_packet(net, queue, entry); 1139 1140 nf_bridge_adjust_skb_data(skb); 1141 segs = skb_gso_segment(skb, 0); 1142 /* Does not use PTR_ERR to limit the number of error codes that can be 1143 * returned by nf_queue. For instance, callers rely on -ESRCH to 1144 * mean 'ignore this hook'. 1145 */ 1146 if (IS_ERR_OR_NULL(segs)) 1147 goto out_err; 1148 queued = 0; 1149 err = 0; 1150 1151 skb_list_walk_safe(segs, segs, nskb) { 1152 if (ct_is_unconfirmed && queued > 0) { 1153 /* skb_gso_segment() increments the ct refcount. 1154 * This is a problem for unconfirmed (not in hash) 1155 * entries, those can race when reinjections happen 1156 * in parallel. 1157 * 1158 * Annotate this for all queued entries except the 1159 * first one. 1160 * 1161 * As long as the first one is reinjected first it 1162 * will do the confirmation for us. 1163 */ 1164 entry->nf_ct_is_unconfirmed = ct_is_unconfirmed; 1165 } 1166 1167 if (err == 0) 1168 err = __nfqnl_enqueue_packet_gso(net, queue, 1169 segs, entry); 1170 if (err == 0) 1171 queued++; 1172 else 1173 kfree_skb(segs); 1174 } 1175 1176 if (queued) { 1177 if (err) /* some segments are already queued */ 1178 nf_queue_entry_free(entry); 1179 kfree_skb(skb); 1180 return 0; 1181 } 1182 out_err: 1183 nf_bridge_adjust_segmented_data(skb); 1184 return err; 1185 } 1186 1187 static bool nfqnl_validate_ipopts(const struct iphdr *iph_new, 1188 const struct nf_queue_entry *e) 1189 { 1190 const struct iphdr *iph_orig = ip_hdr(e->skb); 1191 unsigned int ihl = iph_new->ihl * 4; 1192 1193 if (iph_new->ihl != iph_orig->ihl) 1194 return false; 1195 if (ihl == sizeof(*iph_orig)) 1196 return true; 1197 1198 return memcmp(iph_new + 1, ip_hdr(e->skb) + 1, ihl - sizeof(*iph_orig)) == 0; 1199 } 1200 1201 static bool nfqnl_validate_ip4(const struct iphdr *iph, unsigned int data_len, 1202 const struct nf_queue_entry *e) 1203 { 1204 unsigned int ihl; 1205 1206 if (data_len < sizeof(*iph)) 1207 return false; 1208 1209 ihl = iph->ihl * 4u; 1210 if (ihl < sizeof(*iph) || data_len < ihl) 1211 return false; 1212 1213 if (iph->version != 4 || 1214 ((iph->frag_off ^ ip_hdr(e->skb)->frag_off) & ~htons(IP_DF)) != 0) 1215 return false; 1216 1217 /* BIG TCP won't work; netlink attr len is u16 */ 1218 if (ntohs(iph->tot_len) != data_len) 1219 return false; 1220 1221 /* support for ipopts mangling would require 1222 * recompile + skb transport header update. 1223 */ 1224 return nfqnl_validate_ipopts(iph, e); 1225 } 1226 1227 static bool nfqnl_validate_one_exthdr(const u8 *data, 1228 unsigned int data_len, 1229 const struct nf_queue_entry *e, 1230 int start, int hdrlen) 1231 { 1232 u16 octets; 1233 1234 if (data_len < hdrlen || hdrlen < 2) 1235 return false; 1236 1237 while (hdrlen > 0) { 1238 if (data_len < sizeof(octets)) 1239 return false; 1240 data_len -= sizeof(octets); 1241 1242 if (skb_copy_bits(e->skb, start, &octets, sizeof(octets))) 1243 return false; 1244 1245 if (hdrlen < sizeof(octets)) 1246 return false; 1247 1248 hdrlen -= sizeof(octets); 1249 if (memcmp(data, &octets, sizeof(octets))) 1250 return false; 1251 1252 start += sizeof(octets); 1253 data += sizeof(octets); 1254 } 1255 1256 return true; 1257 } 1258 1259 static bool nfqnl_validate_exthdr(const struct ipv6hdr *ip6_new, 1260 unsigned int data_len, 1261 const struct nf_queue_entry *e) 1262 { 1263 const struct ipv6hdr *ip6_orig = ipv6_hdr(e->skb); 1264 int exthdr_cnt = 0, start = sizeof(*ip6_orig); 1265 const u8 *data = (const u8 *)ip6_new; 1266 u8 orig_nexthdr = ip6_orig->nexthdr; 1267 u8 new_nexthdr = ip6_new->nexthdr; 1268 1269 if (new_nexthdr != orig_nexthdr) 1270 return false; 1271 1272 data += sizeof(*ip6_new); 1273 data_len -= sizeof(*ip6_new); 1274 1275 while (ipv6_ext_hdr(orig_nexthdr)) { 1276 const struct ipv6_opt_hdr *hp; 1277 struct ipv6_opt_hdr _hdr; 1278 int hdrlen; 1279 1280 if (orig_nexthdr == NEXTHDR_NONE) 1281 return true; 1282 1283 if (unlikely(exthdr_cnt++ >= IP6_MAX_EXT_HDRS_CNT)) 1284 return false; 1285 1286 hp = skb_header_pointer(e->skb, start, sizeof(_hdr), &_hdr); 1287 if (!hp) 1288 return false; 1289 1290 switch (orig_nexthdr) { 1291 case NEXTHDR_FRAGMENT: 1292 hdrlen = sizeof(struct frag_hdr); 1293 break; 1294 case NEXTHDR_AUTH: 1295 hdrlen = ipv6_authlen(hp); 1296 break; 1297 default: 1298 hdrlen = ipv6_optlen(hp); 1299 break; 1300 } 1301 1302 if (!nfqnl_validate_one_exthdr(data, data_len, e, 1303 start, hdrlen)) 1304 return false; 1305 1306 orig_nexthdr = hp->nexthdr; 1307 hp = (const void *)data; 1308 new_nexthdr = hp->nexthdr; 1309 1310 if (new_nexthdr != orig_nexthdr) 1311 return false; 1312 1313 data_len -= hdrlen; 1314 start += hdrlen; 1315 data += hdrlen; 1316 } 1317 1318 return true; 1319 } 1320 1321 static bool nfqnl_validate_ip6(const struct ipv6hdr *ip6, unsigned int data_len, 1322 const struct nf_queue_entry *e) 1323 { 1324 if (data_len < sizeof(*ip6)) 1325 return false; 1326 1327 /* BIG TCP/jumbograms won't work; netlink attr len is u16 */ 1328 if (ntohs(ip6->payload_len) != data_len - sizeof(*ip6)) 1329 return false; 1330 1331 if (ip6->version != 6) 1332 return false; 1333 1334 return nfqnl_validate_exthdr(ip6, data_len, e); 1335 } 1336 1337 static bool nfqnl_validate_write(const void *data, unsigned int data_len, 1338 const struct nf_queue_entry *e) 1339 { 1340 switch (e->state.pf) { 1341 case NFPROTO_IPV4: 1342 return nfqnl_validate_ip4(data, data_len, e); 1343 case NFPROTO_IPV6: 1344 return nfqnl_validate_ip6(data, data_len, e) && 1345 !(IP6CB(e->skb)->flags & IP6SKB_JUMBOGRAM); 1346 case NFPROTO_BRIDGE: 1347 /* No write support. Bridge is dubious: userspace doesn't even see L2 header */ 1348 return false; 1349 } 1350 1351 return false; 1352 } 1353 1354 static int 1355 nfqnl_mangle(void *data, unsigned int data_len, struct nf_queue_entry *e, int diff) 1356 { 1357 struct sk_buff *nskb; 1358 1359 if (e->state.net->user_ns != &init_user_ns) 1360 return -EPERM; 1361 1362 if (!nfqnl_validate_write(data, data_len, e)) 1363 return -EINVAL; 1364 1365 if (diff < 0) { 1366 unsigned int min_len = skb_transport_offset(e->skb); 1367 1368 if (data_len < min_len) 1369 return -EINVAL; 1370 1371 if (pskb_trim(e->skb, data_len)) 1372 return -ENOMEM; 1373 } else if (diff > 0) { 1374 if (data_len > 0xFFFF) 1375 return -EINVAL; 1376 if (diff > skb_tailroom(e->skb)) { 1377 nskb = skb_copy_expand(e->skb, skb_headroom(e->skb), 1378 diff, GFP_ATOMIC); 1379 if (!nskb) 1380 return -ENOMEM; 1381 kfree_skb(e->skb); 1382 e->skb = nskb; 1383 } 1384 skb_put(e->skb, diff); 1385 } 1386 if (skb_ensure_writable(e->skb, data_len)) 1387 return -ENOMEM; 1388 skb_copy_to_linear_data(e->skb, data, data_len); 1389 e->skb->ip_summed = CHECKSUM_NONE; 1390 return 0; 1391 } 1392 1393 static int 1394 nfqnl_set_mode(struct nfqnl_instance *queue, 1395 unsigned char mode, unsigned int range) 1396 { 1397 int status = 0; 1398 1399 spin_lock_bh(&queue->lock); 1400 switch (mode) { 1401 case NFQNL_COPY_NONE: 1402 case NFQNL_COPY_META: 1403 queue->copy_mode = mode; 1404 queue->copy_range = 0; 1405 break; 1406 1407 case NFQNL_COPY_PACKET: 1408 queue->copy_mode = mode; 1409 if (range == 0 || range > NFQNL_MAX_COPY_RANGE) 1410 queue->copy_range = NFQNL_MAX_COPY_RANGE; 1411 else 1412 queue->copy_range = range; 1413 break; 1414 1415 default: 1416 status = -EINVAL; 1417 1418 } 1419 spin_unlock_bh(&queue->lock); 1420 1421 return status; 1422 } 1423 1424 static int 1425 dev_cmp(struct nf_queue_entry *entry, unsigned long ifindex) 1426 { 1427 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) 1428 int physinif, physoutif; 1429 1430 physinif = nf_bridge_get_physinif(entry->skb); 1431 physoutif = nf_bridge_get_physoutif(entry->skb); 1432 1433 if (physinif == ifindex || physoutif == ifindex) 1434 return 1; 1435 1436 if (entry->bridge_dev && entry->bridge_dev->ifindex == ifindex) 1437 return 1; 1438 #endif 1439 if (entry->skb_dev && entry->skb_dev->ifindex == ifindex) 1440 return 1; 1441 if (entry->state.in) 1442 if (entry->state.in->ifindex == ifindex) 1443 return 1; 1444 if (entry->state.out) 1445 if (entry->state.out->ifindex == ifindex) 1446 return 1; 1447 1448 return 0; 1449 } 1450 1451 /* drop all packets with either indev or outdev == ifindex from all queue 1452 * instances */ 1453 static void 1454 nfqnl_dev_drop(struct net *net, int ifindex) 1455 { 1456 int i; 1457 struct nfnl_queue_net *q = nfnl_queue_pernet(net); 1458 1459 rcu_read_lock(); 1460 1461 for (i = 0; i < INSTANCE_BUCKETS; i++) { 1462 struct nfqnl_instance *inst; 1463 struct hlist_head *head = &q->instance_table[i]; 1464 1465 hlist_for_each_entry_rcu(inst, head, hlist) 1466 nfqnl_flush(inst, dev_cmp, ifindex); 1467 } 1468 1469 rcu_read_unlock(); 1470 } 1471 1472 static int 1473 nfqnl_rcv_dev_event(struct notifier_block *this, 1474 unsigned long event, void *ptr) 1475 { 1476 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 1477 1478 /* Drop any packets associated with the downed device */ 1479 if (event == NETDEV_DOWN) 1480 nfqnl_dev_drop(dev_net(dev), dev->ifindex); 1481 return NOTIFY_DONE; 1482 } 1483 1484 static struct notifier_block nfqnl_dev_notifier = { 1485 .notifier_call = nfqnl_rcv_dev_event, 1486 }; 1487 1488 static void nfqnl_nf_hook_drop(struct net *net) 1489 { 1490 struct nfnl_queue_net *q = nfnl_queue_pernet(net); 1491 int i; 1492 1493 /* This function is also called on net namespace error unwind, 1494 * when pernet_ops->init() failed and ->exit() functions of the 1495 * previous pernet_ops gets called. 1496 * 1497 * This may result in a call to nfqnl_nf_hook_drop() before 1498 * struct nfnl_queue_net was allocated. 1499 */ 1500 if (!q) 1501 return; 1502 1503 for (i = 0; i < INSTANCE_BUCKETS; i++) { 1504 struct nfqnl_instance *inst; 1505 struct hlist_head *head = &q->instance_table[i]; 1506 1507 hlist_for_each_entry_rcu(inst, head, hlist) 1508 nfqnl_flush(inst, NULL, 0); 1509 } 1510 } 1511 1512 static int 1513 nfqnl_rcv_nl_event(struct notifier_block *this, 1514 unsigned long event, void *ptr) 1515 { 1516 struct netlink_notify *n = ptr; 1517 struct nfnl_queue_net *q = nfnl_queue_pernet(n->net); 1518 1519 if (event == NETLINK_URELEASE && n->protocol == NETLINK_NETFILTER) { 1520 int i; 1521 1522 /* destroy all instances for this portid */ 1523 spin_lock(&q->instances_lock); 1524 for (i = 0; i < INSTANCE_BUCKETS; i++) { 1525 struct hlist_node *t2; 1526 struct nfqnl_instance *inst; 1527 struct hlist_head *head = &q->instance_table[i]; 1528 1529 hlist_for_each_entry_safe(inst, t2, head, hlist) { 1530 if (n->portid == inst->peer_portid) 1531 __instance_destroy(inst); 1532 } 1533 } 1534 spin_unlock(&q->instances_lock); 1535 } 1536 return NOTIFY_DONE; 1537 } 1538 1539 static struct notifier_block nfqnl_rtnl_notifier = { 1540 .notifier_call = nfqnl_rcv_nl_event, 1541 }; 1542 1543 static const struct nla_policy nfqa_vlan_policy[NFQA_VLAN_MAX + 1] = { 1544 [NFQA_VLAN_TCI] = { .type = NLA_U16}, 1545 [NFQA_VLAN_PROTO] = { .type = NLA_U16}, 1546 }; 1547 1548 static const struct nla_policy nfqa_verdict_policy[NFQA_MAX+1] = { 1549 [NFQA_VERDICT_HDR] = { .len = sizeof(struct nfqnl_msg_verdict_hdr) }, 1550 [NFQA_MARK] = { .type = NLA_U32 }, 1551 [NFQA_PAYLOAD] = { .type = NLA_UNSPEC }, 1552 [NFQA_CT] = { .type = NLA_UNSPEC }, 1553 [NFQA_EXP] = { .type = NLA_UNSPEC }, 1554 [NFQA_VLAN] = { .type = NLA_NESTED }, 1555 [NFQA_PRIORITY] = { .type = NLA_U32 }, 1556 }; 1557 1558 static const struct nla_policy nfqa_verdict_batch_policy[NFQA_MAX+1] = { 1559 [NFQA_VERDICT_HDR] = { .len = sizeof(struct nfqnl_msg_verdict_hdr) }, 1560 [NFQA_MARK] = { .type = NLA_U32 }, 1561 [NFQA_PRIORITY] = { .type = NLA_U32 }, 1562 }; 1563 1564 static struct nfqnl_instance * 1565 verdict_instance_lookup(struct nfnl_queue_net *q, u16 queue_num, u32 nlportid) 1566 { 1567 struct nfqnl_instance *queue; 1568 1569 queue = instance_lookup(q, queue_num); 1570 if (!queue) 1571 return ERR_PTR(-ENODEV); 1572 1573 if (queue->peer_portid != nlportid) 1574 return ERR_PTR(-EPERM); 1575 1576 return queue; 1577 } 1578 1579 static struct nfqnl_msg_verdict_hdr* 1580 verdicthdr_get(const struct nlattr * const nfqa[]) 1581 { 1582 struct nfqnl_msg_verdict_hdr *vhdr; 1583 unsigned int verdict; 1584 1585 if (!nfqa[NFQA_VERDICT_HDR]) 1586 return NULL; 1587 1588 vhdr = nla_data(nfqa[NFQA_VERDICT_HDR]); 1589 verdict = ntohl(vhdr->verdict) & NF_VERDICT_MASK; 1590 if (verdict > NF_MAX_VERDICT || verdict == NF_STOLEN) 1591 return NULL; 1592 return vhdr; 1593 } 1594 1595 static int nfq_id_after(unsigned int id, unsigned int max) 1596 { 1597 return (int)(id - max) > 0; 1598 } 1599 1600 static int nfqnl_recv_verdict_batch(struct sk_buff *skb, 1601 const struct nfnl_info *info, 1602 const struct nlattr * const nfqa[]) 1603 { 1604 struct nfnl_queue_net *q = nfnl_queue_pernet(info->net); 1605 u16 queue_num = ntohs(info->nfmsg->res_id); 1606 struct nf_queue_entry *entry, *tmp; 1607 struct nfqnl_msg_verdict_hdr *vhdr; 1608 struct nfqnl_instance *queue; 1609 unsigned int verdict, maxid; 1610 LIST_HEAD(batch_list); 1611 1612 queue = verdict_instance_lookup(q, queue_num, 1613 NETLINK_CB(skb).portid); 1614 if (IS_ERR(queue)) 1615 return PTR_ERR(queue); 1616 1617 vhdr = verdicthdr_get(nfqa); 1618 if (!vhdr) 1619 return -EINVAL; 1620 1621 verdict = ntohl(vhdr->verdict); 1622 maxid = ntohl(vhdr->id); 1623 1624 spin_lock_bh(&queue->lock); 1625 1626 list_for_each_entry_safe(entry, tmp, &queue->queue_list, list) { 1627 if (nfq_id_after(entry->id, maxid)) 1628 break; 1629 __dequeue_entry(queue, entry); 1630 list_add_tail(&entry->list, &batch_list); 1631 } 1632 1633 spin_unlock_bh(&queue->lock); 1634 1635 if (list_empty(&batch_list)) 1636 return -ENOENT; 1637 1638 list_for_each_entry_safe(entry, tmp, &batch_list, list) { 1639 if (nfqa[NFQA_MARK]) 1640 entry->skb->mark = ntohl(nla_get_be32(nfqa[NFQA_MARK])); 1641 1642 if (nfqa[NFQA_PRIORITY]) 1643 entry->skb->priority = ntohl(nla_get_be32(nfqa[NFQA_PRIORITY])); 1644 1645 nfqnl_reinject(entry, verdict); 1646 } 1647 return 0; 1648 } 1649 1650 static struct nf_conn *nfqnl_ct_parse(const struct nfnl_ct_hook *nfnl_ct, 1651 const struct nlmsghdr *nlh, 1652 const struct nlattr * const nfqa[], 1653 struct nf_queue_entry *entry, 1654 enum ip_conntrack_info *ctinfo) 1655 { 1656 #if IS_ENABLED(CONFIG_NF_CONNTRACK) 1657 struct nf_conn *ct; 1658 1659 ct = nf_ct_get(entry->skb, ctinfo); 1660 if (ct == NULL) 1661 return NULL; 1662 1663 if (nfnl_ct->parse(nfqa[NFQA_CT], ct) < 0) 1664 return NULL; 1665 1666 if (nfqa[NFQA_EXP]) 1667 nfnl_ct->attach_expect(nfqa[NFQA_EXP], ct, 1668 NETLINK_CB(entry->skb).portid, 1669 nlmsg_report(nlh)); 1670 return ct; 1671 #else 1672 return NULL; 1673 #endif 1674 } 1675 1676 static int nfqa_parse_bridge(struct nf_queue_entry *entry, 1677 const struct nlattr * const nfqa[]) 1678 { 1679 if (nfqa[NFQA_VLAN]) { 1680 struct nlattr *tb[NFQA_VLAN_MAX + 1]; 1681 int err; 1682 1683 err = nla_parse_nested_deprecated(tb, NFQA_VLAN_MAX, 1684 nfqa[NFQA_VLAN], 1685 nfqa_vlan_policy, NULL); 1686 if (err < 0) 1687 return err; 1688 1689 if (!tb[NFQA_VLAN_TCI] || !tb[NFQA_VLAN_PROTO]) 1690 return -EINVAL; 1691 1692 __vlan_hwaccel_put_tag(entry->skb, 1693 nla_get_be16(tb[NFQA_VLAN_PROTO]), 1694 ntohs(nla_get_be16(tb[NFQA_VLAN_TCI]))); 1695 } 1696 1697 if (nfqa[NFQA_L2HDR]) { 1698 u32 mac_header_len = skb_mac_header_len(entry->skb); 1699 1700 if (mac_header_len != nla_len(nfqa[NFQA_L2HDR])) 1701 return -EINVAL; 1702 else if (mac_header_len > 0) 1703 memcpy(skb_mac_header(entry->skb), 1704 nla_data(nfqa[NFQA_L2HDR]), 1705 mac_header_len); 1706 } 1707 1708 return 0; 1709 } 1710 1711 static int nfqnl_recv_verdict(struct sk_buff *skb, const struct nfnl_info *info, 1712 const struct nlattr * const nfqa[]) 1713 { 1714 struct nfnl_queue_net *q = nfnl_queue_pernet(info->net); 1715 u_int16_t queue_num = ntohs(info->nfmsg->res_id); 1716 const struct nfnl_ct_hook *nfnl_ct; 1717 struct nfqnl_msg_verdict_hdr *vhdr; 1718 enum ip_conntrack_info ctinfo; 1719 struct nfqnl_instance *queue; 1720 struct nf_queue_entry *entry; 1721 struct nf_conn *ct = NULL; 1722 unsigned int verdict; 1723 int err; 1724 1725 queue = verdict_instance_lookup(q, queue_num, 1726 NETLINK_CB(skb).portid); 1727 if (IS_ERR(queue)) 1728 return PTR_ERR(queue); 1729 1730 vhdr = verdicthdr_get(nfqa); 1731 if (!vhdr) 1732 return -EINVAL; 1733 1734 verdict = ntohl(vhdr->verdict); 1735 1736 entry = find_dequeue_entry(queue, ntohl(vhdr->id)); 1737 if (entry == NULL) 1738 return -ENOENT; 1739 1740 /* rcu lock already held from nfnl->call_rcu. */ 1741 nfnl_ct = rcu_dereference(nfnl_ct_hook); 1742 1743 if (nfqa[NFQA_CT]) { 1744 if (nfnl_ct != NULL) 1745 ct = nfqnl_ct_parse(nfnl_ct, info->nlh, nfqa, entry, 1746 &ctinfo); 1747 } 1748 1749 if (entry->state.pf == PF_BRIDGE) { 1750 err = nfqa_parse_bridge(entry, nfqa); 1751 if (err < 0) { 1752 nfqnl_reinject(entry, NF_DROP); 1753 return err; 1754 } 1755 } 1756 1757 if (nfqa[NFQA_PAYLOAD]) { 1758 u16 payload_len = nla_len(nfqa[NFQA_PAYLOAD]); 1759 int diff = payload_len - entry->skb->len; 1760 1761 if (nfqnl_mangle(nla_data(nfqa[NFQA_PAYLOAD]), 1762 payload_len, entry, diff) < 0) 1763 verdict = NF_DROP; 1764 else if (ct && diff) 1765 nfnl_ct->seq_adjust(entry->skb, ct, ctinfo, diff); 1766 } 1767 1768 if (nfqa[NFQA_MARK]) 1769 entry->skb->mark = ntohl(nla_get_be32(nfqa[NFQA_MARK])); 1770 1771 if (nfqa[NFQA_PRIORITY]) 1772 entry->skb->priority = ntohl(nla_get_be32(nfqa[NFQA_PRIORITY])); 1773 1774 nfqnl_reinject(entry, verdict); 1775 return 0; 1776 } 1777 1778 static int nfqnl_recv_unsupp(struct sk_buff *skb, const struct nfnl_info *info, 1779 const struct nlattr * const cda[]) 1780 { 1781 return -ENOTSUPP; 1782 } 1783 1784 static const struct nla_policy nfqa_cfg_policy[NFQA_CFG_MAX+1] = { 1785 [NFQA_CFG_CMD] = { .len = sizeof(struct nfqnl_msg_config_cmd) }, 1786 [NFQA_CFG_PARAMS] = { .len = sizeof(struct nfqnl_msg_config_params) }, 1787 [NFQA_CFG_QUEUE_MAXLEN] = { .type = NLA_U32 }, 1788 [NFQA_CFG_MASK] = { .type = NLA_U32 }, 1789 [NFQA_CFG_FLAGS] = NLA_POLICY_MASK(NLA_BE32, NFQA_CFG_F_MAX - 1), 1790 }; 1791 1792 static const struct nf_queue_handler nfqh = { 1793 .outfn = nfqnl_enqueue_packet, 1794 .nf_hook_drop = nfqnl_nf_hook_drop, 1795 }; 1796 1797 static int nfqnl_recv_config(struct sk_buff *skb, const struct nfnl_info *info, 1798 const struct nlattr * const nfqa[]) 1799 { 1800 struct nfnl_queue_net *q = nfnl_queue_pernet(info->net); 1801 u_int16_t queue_num = ntohs(info->nfmsg->res_id); 1802 struct nfqnl_msg_config_cmd *cmd = NULL; 1803 struct nfqnl_instance *queue; 1804 __u32 flags = 0, mask = 0; 1805 1806 WARN_ON_ONCE(!lockdep_nfnl_is_held(NFNL_SUBSYS_QUEUE)); 1807 1808 if (nfqa[NFQA_CFG_CMD]) { 1809 cmd = nla_data(nfqa[NFQA_CFG_CMD]); 1810 1811 /* Obsolete commands without queue context */ 1812 switch (cmd->command) { 1813 case NFQNL_CFG_CMD_PF_BIND: return 0; 1814 case NFQNL_CFG_CMD_PF_UNBIND: return 0; 1815 } 1816 } 1817 1818 /* Check if we support these flags in first place, dependencies should 1819 * be there too not to break atomicity. 1820 */ 1821 if (nfqa[NFQA_CFG_FLAGS]) { 1822 if (!nfqa[NFQA_CFG_MASK]) { 1823 /* A mask is needed to specify which flags are being 1824 * changed. 1825 */ 1826 return -EINVAL; 1827 } 1828 1829 flags = ntohl(nla_get_be32(nfqa[NFQA_CFG_FLAGS])); 1830 mask = ntohl(nla_get_be32(nfqa[NFQA_CFG_MASK])); 1831 1832 if (flags >= NFQA_CFG_F_MAX) 1833 return -EOPNOTSUPP; 1834 1835 #if !IS_ENABLED(CONFIG_NETWORK_SECMARK) 1836 if (flags & mask & NFQA_CFG_F_SECCTX) 1837 return -EOPNOTSUPP; 1838 #endif 1839 if ((flags & mask & NFQA_CFG_F_CONNTRACK) && 1840 !rcu_access_pointer(nfnl_ct_hook)) { 1841 #ifdef CONFIG_MODULES 1842 nfnl_unlock(NFNL_SUBSYS_QUEUE); 1843 request_module("ip_conntrack_netlink"); 1844 nfnl_lock(NFNL_SUBSYS_QUEUE); 1845 if (rcu_access_pointer(nfnl_ct_hook)) 1846 return -EAGAIN; 1847 #endif 1848 return -EOPNOTSUPP; 1849 } 1850 } 1851 1852 /* Lookup queue under RCU. After peer_portid check (or for new queue 1853 * in BIND case), the queue is owned by the socket sending this message. 1854 * A socket cannot simultaneously send a message and close, so while 1855 * processing this CONFIG message, nfqnl_rcv_nl_event() (triggered by 1856 * socket close) cannot destroy this queue. Safe to use without RCU. 1857 */ 1858 rcu_read_lock(); 1859 queue = instance_lookup(q, queue_num); 1860 if (queue && queue->peer_portid != NETLINK_CB(skb).portid) { 1861 rcu_read_unlock(); 1862 return -EPERM; 1863 } 1864 rcu_read_unlock(); 1865 1866 if (cmd != NULL) { 1867 switch (cmd->command) { 1868 case NFQNL_CFG_CMD_BIND: 1869 if (queue) 1870 return -EBUSY; 1871 queue = instance_create(q, queue_num, NETLINK_CB(skb).portid); 1872 if (IS_ERR(queue)) 1873 return PTR_ERR(queue); 1874 break; 1875 case NFQNL_CFG_CMD_UNBIND: 1876 if (!queue) 1877 return -ENODEV; 1878 instance_destroy(q, queue); 1879 return 0; 1880 case NFQNL_CFG_CMD_PF_BIND: 1881 case NFQNL_CFG_CMD_PF_UNBIND: 1882 break; 1883 default: 1884 return -EOPNOTSUPP; 1885 } 1886 } 1887 1888 if (!queue) 1889 return -ENODEV; 1890 1891 if (nfqa[NFQA_CFG_PARAMS]) { 1892 struct nfqnl_msg_config_params *params = 1893 nla_data(nfqa[NFQA_CFG_PARAMS]); 1894 1895 nfqnl_set_mode(queue, params->copy_mode, 1896 ntohl(params->copy_range)); 1897 } 1898 1899 if (nfqa[NFQA_CFG_QUEUE_MAXLEN]) { 1900 __be32 *queue_maxlen = nla_data(nfqa[NFQA_CFG_QUEUE_MAXLEN]); 1901 1902 spin_lock_bh(&queue->lock); 1903 queue->queue_maxlen = ntohl(*queue_maxlen); 1904 spin_unlock_bh(&queue->lock); 1905 } 1906 1907 if (nfqa[NFQA_CFG_FLAGS]) { 1908 spin_lock_bh(&queue->lock); 1909 queue->flags &= ~mask; 1910 queue->flags |= flags & mask; 1911 spin_unlock_bh(&queue->lock); 1912 } 1913 1914 return 0; 1915 } 1916 1917 static const struct nfnl_callback nfqnl_cb[NFQNL_MSG_MAX] = { 1918 [NFQNL_MSG_PACKET] = { 1919 .call = nfqnl_recv_unsupp, 1920 .type = NFNL_CB_RCU, 1921 .attr_count = NFQA_MAX, 1922 }, 1923 [NFQNL_MSG_VERDICT] = { 1924 .call = nfqnl_recv_verdict, 1925 .type = NFNL_CB_RCU, 1926 .attr_count = NFQA_MAX, 1927 .policy = nfqa_verdict_policy 1928 }, 1929 [NFQNL_MSG_CONFIG] = { 1930 .call = nfqnl_recv_config, 1931 .type = NFNL_CB_MUTEX, 1932 .attr_count = NFQA_CFG_MAX, 1933 .policy = nfqa_cfg_policy 1934 }, 1935 [NFQNL_MSG_VERDICT_BATCH] = { 1936 .call = nfqnl_recv_verdict_batch, 1937 .type = NFNL_CB_RCU, 1938 .attr_count = NFQA_MAX, 1939 .policy = nfqa_verdict_batch_policy 1940 }, 1941 }; 1942 1943 static const struct nfnetlink_subsystem nfqnl_subsys = { 1944 .name = "nf_queue", 1945 .subsys_id = NFNL_SUBSYS_QUEUE, 1946 .cb_count = NFQNL_MSG_MAX, 1947 .cb = nfqnl_cb, 1948 }; 1949 1950 #ifdef CONFIG_PROC_FS 1951 struct iter_state { 1952 struct seq_net_private p; 1953 unsigned int bucket; 1954 }; 1955 1956 static struct hlist_node *get_first(struct seq_file *seq) 1957 { 1958 struct iter_state *st = seq->private; 1959 struct net *net; 1960 struct nfnl_queue_net *q; 1961 1962 if (!st) 1963 return NULL; 1964 1965 net = seq_file_net(seq); 1966 q = nfnl_queue_pernet(net); 1967 for (st->bucket = 0; st->bucket < INSTANCE_BUCKETS; st->bucket++) { 1968 if (!hlist_empty(&q->instance_table[st->bucket])) 1969 return q->instance_table[st->bucket].first; 1970 } 1971 return NULL; 1972 } 1973 1974 static struct hlist_node *get_next(struct seq_file *seq, struct hlist_node *h) 1975 { 1976 struct iter_state *st = seq->private; 1977 struct net *net = seq_file_net(seq); 1978 1979 h = h->next; 1980 while (!h) { 1981 struct nfnl_queue_net *q; 1982 1983 if (++st->bucket >= INSTANCE_BUCKETS) 1984 return NULL; 1985 1986 q = nfnl_queue_pernet(net); 1987 h = q->instance_table[st->bucket].first; 1988 } 1989 return h; 1990 } 1991 1992 static struct hlist_node *get_idx(struct seq_file *seq, loff_t pos) 1993 { 1994 struct hlist_node *head; 1995 head = get_first(seq); 1996 1997 if (head) 1998 while (pos && (head = get_next(seq, head))) 1999 pos--; 2000 return pos ? NULL : head; 2001 } 2002 2003 static void *seq_start(struct seq_file *s, loff_t *pos) 2004 __acquires(nfnl_queue_pernet(seq_file_net(s))->instances_lock) 2005 { 2006 spin_lock(&nfnl_queue_pernet(seq_file_net(s))->instances_lock); 2007 return get_idx(s, *pos); 2008 } 2009 2010 static void *seq_next(struct seq_file *s, void *v, loff_t *pos) 2011 { 2012 (*pos)++; 2013 return get_next(s, v); 2014 } 2015 2016 static void seq_stop(struct seq_file *s, void *v) 2017 __releases(nfnl_queue_pernet(seq_file_net(s))->instances_lock) 2018 { 2019 spin_unlock(&nfnl_queue_pernet(seq_file_net(s))->instances_lock); 2020 } 2021 2022 static int seq_show(struct seq_file *s, void *v) 2023 { 2024 const struct nfqnl_instance *inst = v; 2025 2026 seq_printf(s, "%5u %6u %5u %1u %5u %5u %5u %8u %2d\n", 2027 inst->queue_num, 2028 inst->peer_portid, inst->queue_total, 2029 inst->copy_mode, inst->copy_range, 2030 inst->queue_dropped, inst->queue_user_dropped, 2031 inst->id_sequence, 1); 2032 return 0; 2033 } 2034 2035 static const struct seq_operations nfqnl_seq_ops = { 2036 .start = seq_start, 2037 .next = seq_next, 2038 .stop = seq_stop, 2039 .show = seq_show, 2040 }; 2041 #endif /* PROC_FS */ 2042 2043 static int __net_init nfnl_queue_net_init(struct net *net) 2044 { 2045 unsigned int i; 2046 struct nfnl_queue_net *q = nfnl_queue_pernet(net); 2047 2048 for (i = 0; i < INSTANCE_BUCKETS; i++) 2049 INIT_HLIST_HEAD(&q->instance_table[i]); 2050 2051 spin_lock_init(&q->instances_lock); 2052 2053 #ifdef CONFIG_PROC_FS 2054 if (!proc_create_net("nfnetlink_queue", 0440, net->nf.proc_netfilter, 2055 &nfqnl_seq_ops, sizeof(struct iter_state))) 2056 return -ENOMEM; 2057 #endif 2058 return 0; 2059 } 2060 2061 static void __net_exit nfnl_queue_net_exit(struct net *net) 2062 { 2063 struct nfnl_queue_net *q = nfnl_queue_pernet(net); 2064 unsigned int i; 2065 2066 #ifdef CONFIG_PROC_FS 2067 remove_proc_entry("nfnetlink_queue", net->nf.proc_netfilter); 2068 #endif 2069 for (i = 0; i < INSTANCE_BUCKETS; i++) 2070 WARN_ON_ONCE(!hlist_empty(&q->instance_table[i])); 2071 } 2072 2073 static struct pernet_operations nfnl_queue_net_ops = { 2074 .init = nfnl_queue_net_init, 2075 .exit = nfnl_queue_net_exit, 2076 .id = &nfnl_queue_net_id, 2077 .size = sizeof(struct nfnl_queue_net), 2078 }; 2079 2080 static int __init nfnetlink_queue_init(void) 2081 { 2082 int status; 2083 2084 nfq_cleanup_wq = alloc_ordered_workqueue("nfq_workqueue", 0); 2085 if (!nfq_cleanup_wq) 2086 return -ENOMEM; 2087 2088 status = register_pernet_subsys(&nfnl_queue_net_ops); 2089 if (status < 0) 2090 goto cleanup_pernet_subsys; 2091 2092 status = netlink_register_notifier(&nfqnl_rtnl_notifier); 2093 if (status < 0) 2094 goto cleanup_rtnl_notifier; 2095 2096 status = register_netdevice_notifier(&nfqnl_dev_notifier); 2097 if (status < 0) 2098 goto cleanup_dev_notifier; 2099 2100 status = nfnetlink_subsys_register(&nfqnl_subsys); 2101 if (status < 0) 2102 goto cleanup_nfqnl_subsys; 2103 2104 nf_register_queue_handler(&nfqh); 2105 2106 return status; 2107 2108 cleanup_nfqnl_subsys: 2109 unregister_netdevice_notifier(&nfqnl_dev_notifier); 2110 cleanup_dev_notifier: 2111 netlink_unregister_notifier(&nfqnl_rtnl_notifier); 2112 cleanup_rtnl_notifier: 2113 unregister_pernet_subsys(&nfnl_queue_net_ops); 2114 cleanup_pernet_subsys: 2115 destroy_workqueue(nfq_cleanup_wq); 2116 return status; 2117 } 2118 2119 static void __exit nfnetlink_queue_fini(void) 2120 { 2121 nf_unregister_queue_handler(); 2122 unregister_netdevice_notifier(&nfqnl_dev_notifier); 2123 nfnetlink_subsys_unregister(&nfqnl_subsys); 2124 netlink_unregister_notifier(&nfqnl_rtnl_notifier); 2125 unregister_pernet_subsys(&nfnl_queue_net_ops); 2126 destroy_workqueue(nfq_cleanup_wq); 2127 rcu_barrier(); /* Wait for completion of call_rcu()'s */ 2128 } 2129 2130 MODULE_DESCRIPTION("netfilter packet queue handler"); 2131 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>"); 2132 MODULE_LICENSE("GPL"); 2133 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_QUEUE); 2134 2135 module_init(nfnetlink_queue_init); 2136 module_exit(nfnetlink_queue_fini); 2137