1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2021 Ng Peng Nam Sean
5 * Copyright (c) 2022 Alexander V. Chernikov <melifaro@FreeBSD.org>
6 * Copyright (c) 2023 Gleb Smirnoff <glebius@FreeBSD.org>
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 */
29
30 /*
31 * This file contains socket and protocol bindings for netlink.
32 */
33
34 #include <sys/param.h>
35 #include <sys/kernel.h>
36 #include <sys/malloc.h>
37 #include <sys/lock.h>
38 #include <sys/rmlock.h>
39 #include <sys/domain.h>
40 #include <sys/jail.h>
41 #include <sys/mbuf.h>
42 #include <sys/osd.h>
43 #include <sys/protosw.h>
44 #include <sys/proc.h>
45 #include <sys/ck.h>
46 #include <sys/socket.h>
47 #include <sys/socketvar.h>
48 #include <sys/sysent.h>
49 #include <sys/syslog.h>
50 #include <sys/priv.h>
51 #include <sys/uio.h>
52
53 #include <netlink/netlink.h>
54 #include <netlink/netlink_ctl.h>
55 #include <netlink/netlink_var.h>
56
57 #define DEBUG_MOD_NAME nl_domain
58 #define DEBUG_MAX_LEVEL LOG_DEBUG3
59 #include <netlink/netlink_debug.h>
60 _DECLARE_DEBUG(LOG_INFO);
61
62 _Static_assert((NLP_MAX_GROUPS % 64) == 0,
63 "NLP_MAX_GROUPS has to be multiple of 64");
64 _Static_assert(NLP_MAX_GROUPS >= 64,
65 "NLP_MAX_GROUPS has to be at least 64");
66
67 #define NLCTL_TRACKER struct rm_priotracker nl_tracker
68 #define NLCTL_RLOCK() rm_rlock(&V_nl_ctl.ctl_lock, &nl_tracker)
69 #define NLCTL_RUNLOCK() rm_runlock(&V_nl_ctl.ctl_lock, &nl_tracker)
70 #define NLCTL_LOCK_ASSERT() rm_assert(&V_nl_ctl.ctl_lock, RA_LOCKED)
71
72 #define NLCTL_WLOCK() rm_wlock(&V_nl_ctl.ctl_lock)
73 #define NLCTL_WUNLOCK() rm_wunlock(&V_nl_ctl.ctl_lock)
74 #define NLCTL_WLOCK_ASSERT() rm_assert(&V_nl_ctl.ctl_lock, RA_WLOCKED)
75
76 static u_long nl_sendspace = NLSNDQ;
77 SYSCTL_ULONG(_net_netlink, OID_AUTO, sendspace, CTLFLAG_RW, &nl_sendspace, 0,
78 "Default netlink socket send space");
79
80 static u_long nl_recvspace = NLSNDQ;
81 SYSCTL_ULONG(_net_netlink, OID_AUTO, recvspace, CTLFLAG_RW, &nl_recvspace, 0,
82 "Default netlink socket receive space");
83
84 extern u_long sb_max_adj;
85 static u_long nl_maxsockbuf = 512 * 1024 * 1024; /* 512M, XXX: init based on physmem */
86 static int sysctl_handle_nl_maxsockbuf(SYSCTL_HANDLER_ARGS);
87 SYSCTL_OID(_net_netlink, OID_AUTO, nl_maxsockbuf,
88 CTLTYPE_ULONG | CTLFLAG_RW | CTLFLAG_MPSAFE, &nl_maxsockbuf, 0,
89 sysctl_handle_nl_maxsockbuf, "LU",
90 "Maximum Netlink socket buffer size");
91
92
93 static unsigned int osd_slot_id = 0;
94
95 void
nl_osd_register(void)96 nl_osd_register(void)
97 {
98 osd_slot_id = osd_register(OSD_THREAD, NULL, NULL);
99 }
100
101 void
nl_osd_unregister(void)102 nl_osd_unregister(void)
103 {
104 osd_deregister(OSD_THREAD, osd_slot_id);
105 }
106
107 struct nlpcb *
_nl_get_thread_nlp(struct thread * td)108 _nl_get_thread_nlp(struct thread *td)
109 {
110 return (osd_get(OSD_THREAD, &td->td_osd, osd_slot_id));
111 }
112
113 void
nl_set_thread_nlp(struct thread * td,struct nlpcb * nlp)114 nl_set_thread_nlp(struct thread *td, struct nlpcb *nlp)
115 {
116 NLP_LOG(LOG_DEBUG2, nlp, "Set thread %p nlp to %p (slot %u)", td, nlp, osd_slot_id);
117 if (osd_set(OSD_THREAD, &td->td_osd, osd_slot_id, nlp) == 0)
118 return;
119 /* Failed, need to realloc */
120 void **rsv = osd_reserve(osd_slot_id);
121 osd_set_reserved(OSD_THREAD, &td->td_osd, osd_slot_id, rsv, nlp);
122 }
123
124 /*
125 * Looks up a nlpcb struct based on the @portid. Need to claim nlsock_mtx.
126 * Returns nlpcb pointer if present else NULL
127 */
128 static struct nlpcb *
nl_port_lookup(uint32_t port_id)129 nl_port_lookup(uint32_t port_id)
130 {
131 struct nlpcb *nlp;
132
133 CK_LIST_FOREACH(nlp, &V_nl_ctl.ctl_port_head, nl_port_next) {
134 if (nlp->nl_port == port_id)
135 return (nlp);
136 }
137 return (NULL);
138 }
139
140 static void
nlp_join_group(struct nlpcb * nlp,unsigned int group_id)141 nlp_join_group(struct nlpcb *nlp, unsigned int group_id)
142 {
143 MPASS(group_id < NLP_MAX_GROUPS);
144 NLCTL_WLOCK_ASSERT();
145
146 /* TODO: add family handler callback */
147 if (!nlp_unconstrained_vnet(nlp))
148 return;
149
150 BIT_SET(NLP_MAX_GROUPS, group_id, &nlp->nl_groups);
151 }
152
153 static void
nlp_leave_group(struct nlpcb * nlp,unsigned int group_id)154 nlp_leave_group(struct nlpcb *nlp, unsigned int group_id)
155 {
156 MPASS(group_id < NLP_MAX_GROUPS);
157 NLCTL_WLOCK_ASSERT();
158
159 BIT_CLR(NLP_MAX_GROUPS, group_id, &nlp->nl_groups);
160 }
161
162 static bool
nlp_memberof_group(struct nlpcb * nlp,unsigned int group_id)163 nlp_memberof_group(struct nlpcb *nlp, unsigned int group_id)
164 {
165 MPASS(group_id < NLP_MAX_GROUPS);
166 NLCTL_LOCK_ASSERT();
167
168 return (BIT_ISSET(NLP_MAX_GROUPS, group_id, &nlp->nl_groups));
169 }
170
171 static uint32_t
nlp_get_groups_compat(struct nlpcb * nlp)172 nlp_get_groups_compat(struct nlpcb *nlp)
173 {
174 uint32_t groups_mask = 0;
175
176 NLCTL_LOCK_ASSERT();
177
178 for (int i = 0; i < 32; i++) {
179 if (nlp_memberof_group(nlp, i + 1))
180 groups_mask |= (1 << i);
181 }
182
183 return (groups_mask);
184 }
185
186 static struct nl_buf *
nl_buf_copy(struct nl_buf * nb)187 nl_buf_copy(struct nl_buf *nb)
188 {
189 struct nl_buf *copy;
190
191 copy = nl_buf_alloc(nb->buflen, M_NOWAIT);
192 if (__predict_false(copy == NULL))
193 return (NULL);
194 memcpy(copy, nb, sizeof(*nb) + nb->buflen);
195
196 return (copy);
197 }
198
199 /*
200 * Broadcasts in the writer's buffer.
201 */
202 bool
nl_send_group(struct nl_writer * nw)203 nl_send_group(struct nl_writer *nw)
204 {
205 struct nl_buf *nb = nw->buf;
206 struct nlpcb *nlp_last = NULL;
207 struct nlpcb *nlp;
208 NLCTL_TRACKER;
209
210 IF_DEBUG_LEVEL(LOG_DEBUG2) {
211 struct nlmsghdr *hdr = (struct nlmsghdr *)nb->data;
212 NL_LOG(LOG_DEBUG2, "MCAST len %u msg type %d len %u to group %d/%d",
213 nb->datalen, hdr->nlmsg_type, hdr->nlmsg_len,
214 nw->group.proto, nw->group.id);
215 }
216
217 nw->buf = NULL;
218
219 NLCTL_RLOCK();
220 CK_LIST_FOREACH(nlp, &V_nl_ctl.ctl_pcb_head, nl_next) {
221 if ((nw->group.priv == 0 || priv_check_cred(
222 nlp->nl_socket->so_cred, nw->group.priv) == 0) &&
223 nlp->nl_proto == nw->group.proto &&
224 nlp_memberof_group(nlp, nw->group.id)) {
225 if (nlp_last != NULL) {
226 struct nl_buf *copy;
227
228 copy = nl_buf_copy(nb);
229 if (copy != NULL) {
230 nw->buf = copy;
231 (void)nl_send(nw, nlp_last);
232 } else {
233 NLP_LOCK(nlp_last);
234 if (nlp_last->nl_socket != NULL)
235 sorwakeup(nlp_last->nl_socket);
236 NLP_UNLOCK(nlp_last);
237 }
238 }
239 nlp_last = nlp;
240 }
241 }
242 if (nlp_last != NULL) {
243 nw->buf = nb;
244 (void)nl_send(nw, nlp_last);
245 } else
246 nl_buf_free(nb);
247
248 NLCTL_RUNLOCK();
249
250 return (true);
251 }
252
253 void
nl_clear_group(u_int group)254 nl_clear_group(u_int group)
255 {
256 struct nlpcb *nlp;
257
258 NLCTL_WLOCK();
259 CK_LIST_FOREACH(nlp, &V_nl_ctl.ctl_pcb_head, nl_next)
260 if (nlp_memberof_group(nlp, group))
261 nlp_leave_group(nlp, group);
262 NLCTL_WUNLOCK();
263 }
264
265 static uint32_t
nl_find_port(void)266 nl_find_port(void)
267 {
268 /*
269 * app can open multiple netlink sockets.
270 * Start with current pid, if already taken,
271 * try random numbers in 65k..256k+65k space,
272 * avoiding clash with pids.
273 */
274 if (nl_port_lookup(curproc->p_pid) == NULL)
275 return (curproc->p_pid);
276 for (int i = 0; i < 16; i++) {
277 uint32_t nl_port = (arc4random() % 65536) + 65536 * 4;
278 if (nl_port_lookup(nl_port) == 0)
279 return (nl_port);
280 NL_LOG(LOG_DEBUG3, "tried %u\n", nl_port);
281 }
282 return (curproc->p_pid);
283 }
284
285 static int
nl_bind_locked(struct nlpcb * nlp,struct sockaddr_nl * snl)286 nl_bind_locked(struct nlpcb *nlp, struct sockaddr_nl *snl)
287 {
288 if (nlp->nl_bound) {
289 if (nlp->nl_port != snl->nl_pid) {
290 NL_LOG(LOG_DEBUG,
291 "bind() failed: program pid %d "
292 "is different from provided pid %d",
293 nlp->nl_port, snl->nl_pid);
294 return (EINVAL); // XXX: better error
295 }
296 } else {
297 if (snl->nl_pid == 0)
298 snl->nl_pid = nl_find_port();
299 if (nl_port_lookup(snl->nl_pid) != NULL)
300 return (EADDRINUSE);
301 nlp->nl_port = snl->nl_pid;
302 nlp->nl_bound = true;
303 CK_LIST_INSERT_HEAD(&V_nl_ctl.ctl_port_head, nlp, nl_port_next);
304 }
305 for (int i = 0; i < 32; i++) {
306 if (snl->nl_groups & ((uint32_t)1 << i))
307 nlp_join_group(nlp, i + 1);
308 else
309 nlp_leave_group(nlp, i + 1);
310 }
311
312 return (0);
313 }
314
315 static int
nl_attach(struct socket * so,int proto,struct thread * td)316 nl_attach(struct socket *so, int proto, struct thread *td)
317 {
318 struct nlpcb *nlp;
319 int error;
320
321 if (__predict_false(netlink_unloading != 0))
322 return (EAFNOSUPPORT);
323
324 error = nl_verify_proto(proto);
325 if (error != 0)
326 return (error);
327
328 bool is_linux = SV_PROC_ABI(td->td_proc) == SV_ABI_LINUX;
329 NL_LOG(LOG_DEBUG2, "socket %p, %sPID %d: attaching socket to %s",
330 so, is_linux ? "(linux) " : "", curproc->p_pid,
331 nl_get_proto_name(proto));
332
333 nlp = malloc(sizeof(struct nlpcb), M_PCB, M_WAITOK | M_ZERO);
334 error = soreserve(so, nl_sendspace, nl_recvspace);
335 if (error != 0) {
336 free(nlp, M_PCB);
337 return (error);
338 }
339 TAILQ_INIT(&so->so_rcv.nl_queue);
340 TAILQ_INIT(&so->so_snd.nl_queue);
341 so->so_pcb = nlp;
342 nlp->nl_socket = so;
343 nlp->nl_proto = proto;
344 nlp->nl_process_id = curproc->p_pid;
345 nlp->nl_linux = is_linux;
346 nlp->nl_unconstrained_vnet = !jailed_without_vnet(so->so_cred);
347 nlp->nl_need_thread_setup = true;
348 NLP_LOCK_INIT(nlp);
349 refcount_init(&nlp->nl_refcount, 1);
350
351 nlp->nl_taskqueue = taskqueue_create("netlink_socket", M_WAITOK,
352 taskqueue_thread_enqueue, &nlp->nl_taskqueue);
353 TASK_INIT(&nlp->nl_task, 0, nl_taskqueue_handler, nlp);
354 taskqueue_start_threads(&nlp->nl_taskqueue, 1, PWAIT,
355 "netlink_socket (PID %u)", nlp->nl_process_id);
356
357 NLCTL_WLOCK();
358 CK_LIST_INSERT_HEAD(&V_nl_ctl.ctl_pcb_head, nlp, nl_next);
359 NLCTL_WUNLOCK();
360
361 soisconnected(so);
362
363 return (0);
364 }
365
366 static int
nl_bind(struct socket * so,struct sockaddr * sa,struct thread * td)367 nl_bind(struct socket *so, struct sockaddr *sa, struct thread *td)
368 {
369 struct nlpcb *nlp = sotonlpcb(so);
370 struct sockaddr_nl *snl = (struct sockaddr_nl *)sa;
371 int error;
372
373 NL_LOG(LOG_DEBUG3, "socket %p, PID %d", so, curproc->p_pid);
374 if (snl->nl_len != sizeof(*snl)) {
375 NL_LOG(LOG_DEBUG, "socket %p, wrong sizeof(), ignoring bind()", so);
376 return (EINVAL);
377 }
378
379
380 NLCTL_WLOCK();
381 NLP_LOCK(nlp);
382 error = nl_bind_locked(nlp, snl);
383 NLP_UNLOCK(nlp);
384 NLCTL_WUNLOCK();
385 NL_LOG(LOG_DEBUG2, "socket %p, bind() to %u, groups %u, error %d", so,
386 snl->nl_pid, snl->nl_groups, error);
387
388 return (error);
389 }
390
391
392 static int
nl_assign_port(struct nlpcb * nlp,uint32_t port_id)393 nl_assign_port(struct nlpcb *nlp, uint32_t port_id)
394 {
395 struct sockaddr_nl snl = {
396 .nl_pid = port_id,
397 };
398 int error;
399
400 NLCTL_WLOCK();
401 NLP_LOCK(nlp);
402 snl.nl_groups = nlp_get_groups_compat(nlp);
403 error = nl_bind_locked(nlp, &snl);
404 NLP_UNLOCK(nlp);
405 NLCTL_WUNLOCK();
406
407 NL_LOG(LOG_DEBUG3, "socket %p, port assign: %d, error: %d", nlp->nl_socket, port_id, error);
408 return (error);
409 }
410
411 /*
412 * nl_autobind_port binds a unused portid to @nlp
413 * @nlp: pcb data for the netlink socket
414 * @candidate_id: first id to consider
415 */
416 static int
nl_autobind_port(struct nlpcb * nlp,uint32_t candidate_id)417 nl_autobind_port(struct nlpcb *nlp, uint32_t candidate_id)
418 {
419 uint32_t port_id = candidate_id;
420 NLCTL_TRACKER;
421 bool exist;
422 int error = EADDRINUSE;
423
424 for (int i = 0; i < 10; i++) {
425 NL_LOG(LOG_DEBUG3, "socket %p, trying to assign port %d", nlp->nl_socket, port_id);
426 NLCTL_RLOCK();
427 exist = nl_port_lookup(port_id) != 0;
428 NLCTL_RUNLOCK();
429 if (!exist) {
430 error = nl_assign_port(nlp, port_id);
431 if (error != EADDRINUSE)
432 break;
433 }
434 port_id++;
435 }
436 NL_LOG(LOG_DEBUG3, "socket %p, autobind to %d, error: %d", nlp->nl_socket, port_id, error);
437 return (error);
438 }
439
440 static int
nl_connect(struct socket * so,struct sockaddr * sa,struct thread * td)441 nl_connect(struct socket *so, struct sockaddr *sa, struct thread *td)
442 {
443 struct sockaddr_nl *snl = (struct sockaddr_nl *)sa;
444 struct nlpcb *nlp;
445
446 NL_LOG(LOG_DEBUG3, "socket %p, PID %d", so, curproc->p_pid);
447 if (snl->nl_len != sizeof(*snl)) {
448 NL_LOG(LOG_DEBUG, "socket %p, wrong sizeof(), ignoring bind()", so);
449 return (EINVAL);
450 }
451
452 nlp = sotonlpcb(so);
453 if (!nlp->nl_bound) {
454 int error = nl_autobind_port(nlp, td->td_proc->p_pid);
455 if (error != 0) {
456 NL_LOG(LOG_DEBUG, "socket %p, nl_autobind() failed: %d", so, error);
457 return (error);
458 }
459 }
460 /* XXX: Handle socket flags & multicast */
461 soisconnected(so);
462
463 NL_LOG(LOG_DEBUG2, "socket %p, connect to %u", so, snl->nl_pid);
464
465 return (0);
466 }
467
468 static void
destroy_nlpcb_epoch(epoch_context_t ctx)469 destroy_nlpcb_epoch(epoch_context_t ctx)
470 {
471 struct nlpcb *nlp;
472
473 nlp = __containerof(ctx, struct nlpcb, nl_epoch_ctx);
474
475 NLP_LOCK_DESTROY(nlp);
476 free(nlp, M_PCB);
477 }
478
479 static void
nl_close(struct socket * so)480 nl_close(struct socket *so)
481 {
482 MPASS(sotonlpcb(so) != NULL);
483 struct nlpcb *nlp;
484 struct nl_buf *nb;
485
486 NL_LOG(LOG_DEBUG2, "detaching socket %p, PID %d", so, curproc->p_pid);
487 nlp = sotonlpcb(so);
488
489 /* Mark as inactive so no new work can be enqueued */
490 NLP_LOCK(nlp);
491 bool was_bound = nlp->nl_bound;
492 NLP_UNLOCK(nlp);
493
494 /* Wait till all scheduled work has been completed */
495 taskqueue_drain_all(nlp->nl_taskqueue);
496 taskqueue_free(nlp->nl_taskqueue);
497
498 NLCTL_WLOCK();
499 NLP_LOCK(nlp);
500 if (was_bound) {
501 CK_LIST_REMOVE(nlp, nl_port_next);
502 NL_LOG(LOG_DEBUG3, "socket %p, unlinking bound pid %u", so, nlp->nl_port);
503 }
504 CK_LIST_REMOVE(nlp, nl_next);
505 nlp->nl_socket = NULL;
506 NLP_UNLOCK(nlp);
507 NLCTL_WUNLOCK();
508
509 so->so_pcb = NULL;
510
511 while ((nb = TAILQ_FIRST(&so->so_snd.nl_queue)) != NULL) {
512 TAILQ_REMOVE(&so->so_snd.nl_queue, nb, tailq);
513 nl_buf_free(nb);
514 }
515 while ((nb = TAILQ_FIRST(&so->so_rcv.nl_queue)) != NULL) {
516 TAILQ_REMOVE(&so->so_rcv.nl_queue, nb, tailq);
517 nl_buf_free(nb);
518 }
519
520 NL_LOG(LOG_DEBUG3, "socket %p, detached", so);
521
522 /* XXX: is delayed free needed? */
523 NET_EPOCH_CALL(destroy_nlpcb_epoch, &nlp->nl_epoch_ctx);
524 }
525
526 static int
nl_disconnect(struct socket * so)527 nl_disconnect(struct socket *so)
528 {
529 NL_LOG(LOG_DEBUG3, "socket %p, PID %d", so, curproc->p_pid);
530 MPASS(sotonlpcb(so) != NULL);
531 return (ENOTCONN);
532 }
533
534 static int
nl_sockaddr(struct socket * so,struct sockaddr * sa)535 nl_sockaddr(struct socket *so, struct sockaddr *sa)
536 {
537
538 *(struct sockaddr_nl *)sa = (struct sockaddr_nl ){
539 /* TODO: set other fields */
540 .nl_len = sizeof(struct sockaddr_nl),
541 .nl_family = AF_NETLINK,
542 .nl_pid = sotonlpcb(so)->nl_port,
543 };
544
545 return (0);
546 }
547
548 static int
nl_sosend(struct socket * so,struct sockaddr * addr,struct uio * uio,struct mbuf * m,struct mbuf * control,int flags,struct thread * td)549 nl_sosend(struct socket *so, struct sockaddr *addr, struct uio *uio,
550 struct mbuf *m, struct mbuf *control, int flags, struct thread *td)
551 {
552 struct nlpcb *nlp = sotonlpcb(so);
553 struct sockbuf *sb = &so->so_snd;
554 struct nl_buf *nb;
555 size_t len;
556 int error;
557
558 MPASS(m == NULL && uio != NULL);
559
560 if (__predict_false(control != NULL)) {
561 m_freem(control);
562 return (EINVAL);
563 }
564
565 if (__predict_false(flags & MSG_OOB)) /* XXXGL: or just ignore? */
566 return (EOPNOTSUPP);
567
568 if (__predict_false(uio->uio_resid < sizeof(struct nlmsghdr)))
569 return (ENOBUFS); /* XXXGL: any better error? */
570
571 if (__predict_false(uio->uio_resid > sb->sb_hiwat))
572 return (EMSGSIZE);
573
574 error = SOCK_IO_SEND_LOCK(so, SBLOCKWAIT(flags));
575 if (error)
576 return (error);
577
578 len = roundup2(uio->uio_resid, 8) + SCRATCH_BUFFER_SIZE;
579 if (nlp->nl_linux)
580 len += roundup2(uio->uio_resid, 8);
581 nb = nl_buf_alloc(len, M_WAITOK);
582 nb->datalen = uio->uio_resid;
583 error = uiomove(&nb->data[0], uio->uio_resid, uio);
584 if (__predict_false(error))
585 goto out;
586
587 NL_LOG(LOG_DEBUG2, "sending message to kernel %u bytes", nb->datalen);
588
589 SOCK_SENDBUF_LOCK(so);
590 restart:
591 if (sb->sb_hiwat - sb->sb_ccc >= nb->datalen) {
592 TAILQ_INSERT_TAIL(&sb->nl_queue, nb, tailq);
593 sb->sb_acc += nb->datalen;
594 sb->sb_ccc += nb->datalen;
595 nb = NULL;
596 } else if ((so->so_state & SS_NBIO) ||
597 (flags & (MSG_NBIO | MSG_DONTWAIT)) != 0) {
598 SOCK_SENDBUF_UNLOCK(so);
599 error = EWOULDBLOCK;
600 goto out;
601 } else {
602 if ((error = sbwait(so, SO_SND)) != 0) {
603 SOCK_SENDBUF_UNLOCK(so);
604 goto out;
605 } else
606 goto restart;
607 }
608 SOCK_SENDBUF_UNLOCK(so);
609
610 if (nb == NULL) {
611 NL_LOG(LOG_DEBUG3, "success");
612 NLP_LOCK(nlp);
613 nl_schedule_taskqueue(nlp);
614 NLP_UNLOCK(nlp);
615 }
616
617 out:
618 SOCK_IO_SEND_UNLOCK(so);
619 if (nb != NULL) {
620 NL_LOG(LOG_DEBUG3, "failure, error %d", error);
621 nl_buf_free(nb);
622 }
623 return (error);
624 }
625
626 /* Create control data for recvmsg(2) on Netlink socket. */
627 static struct mbuf *
nl_createcontrol(struct nlpcb * nlp)628 nl_createcontrol(struct nlpcb *nlp)
629 {
630 struct {
631 struct nlattr nla;
632 uint32_t val;
633 } data[] = {
634 {
635 .nla.nla_len = sizeof(struct nlattr) + sizeof(uint32_t),
636 .nla.nla_type = NLMSGINFO_ATTR_PROCESS_ID,
637 .val = nlp->nl_process_id,
638 },
639 {
640 .nla.nla_len = sizeof(struct nlattr) + sizeof(uint32_t),
641 .nla.nla_type = NLMSGINFO_ATTR_PORT_ID,
642 .val = nlp->nl_port,
643 },
644 };
645
646 return (sbcreatecontrol(data, sizeof(data), NETLINK_MSG_INFO,
647 SOL_NETLINK, M_WAITOK));
648 }
649
650 static int
nl_soreceive(struct socket * so,struct sockaddr ** psa,struct uio * uio,struct mbuf ** mp,struct mbuf ** controlp,int * flagsp)651 nl_soreceive(struct socket *so, struct sockaddr **psa, struct uio *uio,
652 struct mbuf **mp, struct mbuf **controlp, int *flagsp)
653 {
654 static const struct sockaddr_nl nl_empty_src = {
655 .nl_len = sizeof(struct sockaddr_nl),
656 .nl_family = PF_NETLINK,
657 .nl_pid = 0 /* comes from the kernel */
658 };
659 struct sockbuf *sb = &so->so_rcv;
660 struct nlpcb *nlp = sotonlpcb(so);
661 struct nl_buf *first, *last, *nb, *next;
662 struct nlmsghdr *hdr;
663 int flags, error;
664 u_int len, overflow, partoff, partlen, msgrcv, datalen;
665 bool nonblock, trunc, peek;
666
667 MPASS(mp == NULL && uio != NULL);
668
669 NL_LOG(LOG_DEBUG3, "socket %p, PID %d", so, curproc->p_pid);
670
671 if (psa != NULL)
672 *psa = sodupsockaddr((const struct sockaddr *)&nl_empty_src,
673 M_WAITOK);
674
675 if (controlp != NULL && (nlp->nl_flags & NLF_MSG_INFO))
676 *controlp = nl_createcontrol(nlp);
677
678 flags = flagsp != NULL ? *flagsp & ~MSG_TRUNC : 0;
679 trunc = flagsp != NULL ? *flagsp & MSG_TRUNC : false;
680 nonblock = (so->so_state & SS_NBIO) ||
681 (flags & (MSG_DONTWAIT | MSG_NBIO));
682 peek = flags & MSG_PEEK;
683
684 error = SOCK_IO_RECV_LOCK(so, SBLOCKWAIT(flags));
685 if (__predict_false(error))
686 return (error);
687
688 len = 0;
689 overflow = 0;
690 msgrcv = 0;
691 datalen = 0;
692
693 SOCK_RECVBUF_LOCK(so);
694 while ((first = TAILQ_FIRST(&sb->nl_queue)) == NULL) {
695 if (nonblock) {
696 SOCK_RECVBUF_UNLOCK(so);
697 SOCK_IO_RECV_UNLOCK(so);
698 return (EWOULDBLOCK);
699 }
700 error = sbwait(so, SO_RCV);
701 if (error) {
702 SOCK_RECVBUF_UNLOCK(so);
703 SOCK_IO_RECV_UNLOCK(so);
704 return (error);
705 }
706 }
707
708 /*
709 * Netlink socket buffer consists of a queue of nl_bufs, but for the
710 * userland there should be no boundaries. However, there are Netlink
711 * messages, that shouldn't be split. Internal invariant is that a
712 * message never spans two nl_bufs.
713 * If a large userland buffer is provided, we would traverse the queue
714 * until either queue end is reached or the buffer is fulfilled. If
715 * an application provides a buffer that isn't able to fit a single
716 * message, we would truncate it and lose its tail. This is the only
717 * condition where we would lose data. If buffer is able to fit at
718 * least one message, we would return it and won't truncate the next.
719 *
720 * We use same code for normal and MSG_PEEK case. At first queue pass
721 * we scan nl_bufs and count lenght. In case we can read entire buffer
722 * at one write everything is trivial. In case we can not, we save
723 * pointer to the last (or partial) nl_buf and in the !peek case we
724 * split the queue into two pieces. We can safely drop the queue lock,
725 * as kernel would only append nl_bufs to the end of the queue, and
726 * we are the exclusive owner of queue beginning due to sleepable lock.
727 * At the second pass we copy data out and in !peek case free nl_bufs.
728 */
729 TAILQ_FOREACH(nb, &sb->nl_queue, tailq) {
730 u_int offset;
731
732 MPASS(nb->offset < nb->datalen);
733 offset = nb->offset;
734 while (offset < nb->datalen) {
735 hdr = (struct nlmsghdr *)&nb->data[offset];
736 MPASS(nb->offset + hdr->nlmsg_len <= nb->datalen);
737 if (uio->uio_resid < len + hdr->nlmsg_len) {
738 overflow = len + hdr->nlmsg_len -
739 uio->uio_resid;
740 partoff = nb->offset;
741 if (offset > partoff) {
742 partlen = offset - partoff;
743 if (!peek) {
744 nb->offset = offset;
745 datalen += partlen;
746 }
747 } else if (len == 0 && uio->uio_resid > 0) {
748 flags |= MSG_TRUNC;
749 partlen = uio->uio_resid;
750 if (peek)
751 goto nospace;
752 datalen += hdr->nlmsg_len;
753 if (nb->offset + hdr->nlmsg_len ==
754 nb->datalen) {
755 /*
756 * Avoid leaving empty nb.
757 * Process last nb normally.
758 * Trust uiomove() to care
759 * about negative uio_resid.
760 */
761 nb = TAILQ_NEXT(nb, tailq);
762 overflow = 0;
763 partlen = 0;
764 } else
765 nb->offset += hdr->nlmsg_len;
766 msgrcv++;
767 } else
768 partlen = 0;
769 goto nospace;
770 }
771 len += hdr->nlmsg_len;
772 offset += hdr->nlmsg_len;
773 MPASS(offset <= nb->buflen);
774 msgrcv++;
775 }
776 MPASS(offset == nb->datalen);
777 datalen += nb->datalen - nb->offset;
778 }
779 nospace:
780 last = nb;
781 if (!peek) {
782 if (last == NULL)
783 TAILQ_INIT(&sb->nl_queue);
784 else {
785 /* XXXGL: create TAILQ_SPLIT */
786 TAILQ_FIRST(&sb->nl_queue) = last;
787 last->tailq.tqe_prev = &TAILQ_FIRST(&sb->nl_queue);
788 }
789 MPASS(sb->sb_acc >= datalen);
790 sb->sb_acc -= datalen;
791 sb->sb_ccc -= datalen;
792 }
793 SOCK_RECVBUF_UNLOCK(so);
794
795 for (nb = first; nb != last; nb = next) {
796 next = TAILQ_NEXT(nb, tailq);
797 if (__predict_true(error == 0))
798 error = uiomove(&nb->data[nb->offset],
799 (int)(nb->datalen - nb->offset), uio);
800 if (!peek)
801 nl_buf_free(nb);
802 }
803 if (last != NULL && partlen > 0 && __predict_true(error == 0))
804 error = uiomove(&nb->data[partoff], (int)partlen, uio);
805
806 if (trunc && overflow > 0) {
807 uio->uio_resid -= overflow;
808 MPASS(uio->uio_resid < 0);
809 } else
810 MPASS(uio->uio_resid >= 0);
811
812 if (uio->uio_td)
813 uio->uio_td->td_ru.ru_msgrcv += msgrcv;
814
815 if (flagsp != NULL)
816 *flagsp |= flags;
817
818 SOCK_IO_RECV_UNLOCK(so);
819
820 nl_on_transmit(sotonlpcb(so));
821
822 return (error);
823 }
824
825 static int
nl_getoptflag(int sopt_name)826 nl_getoptflag(int sopt_name)
827 {
828 switch (sopt_name) {
829 case NETLINK_CAP_ACK:
830 return (NLF_CAP_ACK);
831 case NETLINK_EXT_ACK:
832 return (NLF_EXT_ACK);
833 case NETLINK_GET_STRICT_CHK:
834 return (NLF_STRICT);
835 case NETLINK_MSG_INFO:
836 return (NLF_MSG_INFO);
837 }
838
839 return (0);
840 }
841
842 static int
nl_ctloutput(struct socket * so,struct sockopt * sopt)843 nl_ctloutput(struct socket *so, struct sockopt *sopt)
844 {
845 struct nlpcb *nlp = sotonlpcb(so);
846 uint32_t flag;
847 int optval, error = 0;
848 NLCTL_TRACKER;
849
850 NL_LOG(LOG_DEBUG2, "%ssockopt(%p, %d)", (sopt->sopt_dir) ? "set" : "get",
851 so, sopt->sopt_name);
852
853 switch (sopt->sopt_dir) {
854 case SOPT_SET:
855 switch (sopt->sopt_name) {
856 case NETLINK_ADD_MEMBERSHIP:
857 case NETLINK_DROP_MEMBERSHIP:
858 error = sooptcopyin(sopt, &optval, sizeof(optval), sizeof(optval));
859 if (error != 0)
860 break;
861 if (optval <= 0 || optval >= NLP_MAX_GROUPS) {
862 error = ERANGE;
863 break;
864 }
865 NL_LOG(LOG_DEBUG2, "ADD/DEL group %d", (uint32_t)optval);
866
867 NLCTL_WLOCK();
868 if (sopt->sopt_name == NETLINK_ADD_MEMBERSHIP)
869 nlp_join_group(nlp, optval);
870 else
871 nlp_leave_group(nlp, optval);
872 NLCTL_WUNLOCK();
873 break;
874 case NETLINK_CAP_ACK:
875 case NETLINK_EXT_ACK:
876 case NETLINK_GET_STRICT_CHK:
877 case NETLINK_MSG_INFO:
878 error = sooptcopyin(sopt, &optval, sizeof(optval), sizeof(optval));
879 if (error != 0)
880 break;
881
882 flag = nl_getoptflag(sopt->sopt_name);
883
884 if ((flag == NLF_MSG_INFO) && nlp->nl_linux) {
885 error = EINVAL;
886 break;
887 }
888
889 NLCTL_WLOCK();
890 if (optval != 0)
891 nlp->nl_flags |= flag;
892 else
893 nlp->nl_flags &= ~flag;
894 NLCTL_WUNLOCK();
895 break;
896 default:
897 error = ENOPROTOOPT;
898 }
899 break;
900 case SOPT_GET:
901 switch (sopt->sopt_name) {
902 case NETLINK_LIST_MEMBERSHIPS:
903 NLCTL_RLOCK();
904 optval = nlp_get_groups_compat(nlp);
905 NLCTL_RUNLOCK();
906 error = sooptcopyout(sopt, &optval, sizeof(optval));
907 break;
908 case NETLINK_CAP_ACK:
909 case NETLINK_EXT_ACK:
910 case NETLINK_GET_STRICT_CHK:
911 case NETLINK_MSG_INFO:
912 NLCTL_RLOCK();
913 optval = (nlp->nl_flags & nl_getoptflag(sopt->sopt_name)) != 0;
914 NLCTL_RUNLOCK();
915 error = sooptcopyout(sopt, &optval, sizeof(optval));
916 break;
917 default:
918 error = ENOPROTOOPT;
919 }
920 break;
921 default:
922 error = ENOPROTOOPT;
923 }
924
925 return (error);
926 }
927
928 static int
sysctl_handle_nl_maxsockbuf(SYSCTL_HANDLER_ARGS)929 sysctl_handle_nl_maxsockbuf(SYSCTL_HANDLER_ARGS)
930 {
931 int error = 0;
932 u_long tmp_maxsockbuf = nl_maxsockbuf;
933
934 error = sysctl_handle_long(oidp, &tmp_maxsockbuf, arg2, req);
935 if (error || !req->newptr)
936 return (error);
937 if (tmp_maxsockbuf < MSIZE + MCLBYTES)
938 return (EINVAL);
939 nl_maxsockbuf = tmp_maxsockbuf;
940
941 return (0);
942 }
943
944 static int
nl_setsbopt(struct socket * so,struct sockopt * sopt)945 nl_setsbopt(struct socket *so, struct sockopt *sopt)
946 {
947 int error, optval;
948 bool result;
949
950 if (sopt->sopt_name != SO_RCVBUF)
951 return (sbsetopt(so, sopt));
952
953 /* Allow to override max buffer size in certain conditions */
954
955 error = sooptcopyin(sopt, &optval, sizeof optval, sizeof optval);
956 if (error != 0)
957 return (error);
958 NL_LOG(LOG_DEBUG2, "socket %p, PID %d, SO_RCVBUF=%d", so, curproc->p_pid, optval);
959 if (optval > sb_max_adj) {
960 if (priv_check(curthread, PRIV_NET_ROUTE) != 0)
961 return (EPERM);
962 }
963
964 SOCK_RECVBUF_LOCK(so);
965 result = sbreserve_locked_limit(so, SO_RCV, optval, nl_maxsockbuf, curthread);
966 SOCK_RECVBUF_UNLOCK(so);
967
968 return (result ? 0 : ENOBUFS);
969 }
970
971 #define NETLINK_PROTOSW \
972 .pr_flags = PR_ATOMIC | PR_ADDR | PR_SOCKBUF, \
973 .pr_ctloutput = nl_ctloutput, \
974 .pr_setsbopt = nl_setsbopt, \
975 .pr_attach = nl_attach, \
976 .pr_bind = nl_bind, \
977 .pr_connect = nl_connect, \
978 .pr_disconnect = nl_disconnect, \
979 .pr_sosend = nl_sosend, \
980 .pr_soreceive = nl_soreceive, \
981 .pr_sockaddr = nl_sockaddr, \
982 .pr_close = nl_close
983
984 static struct protosw netlink_raw_sw = {
985 .pr_type = SOCK_RAW,
986 NETLINK_PROTOSW
987 };
988
989 static struct protosw netlink_dgram_sw = {
990 .pr_type = SOCK_DGRAM,
991 NETLINK_PROTOSW
992 };
993
994 static struct domain netlinkdomain = {
995 .dom_family = PF_NETLINK,
996 .dom_name = "netlink",
997 .dom_flags = DOMF_UNLOADABLE,
998 .dom_nprotosw = 2,
999 .dom_protosw = { &netlink_raw_sw, &netlink_dgram_sw },
1000 };
1001
1002 DOMAIN_SET(netlink);
1003