1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * This is a module which is used for queueing packets and communicating with 4 * userspace via nfnetlink. 5 * 6 * (C) 2005 by Harald Welte <laforge@netfilter.org> 7 * (C) 2007 by Patrick McHardy <kaber@trash.net> 8 * 9 * Based on the old ipv4-only ip_queue.c: 10 * (C) 2000-2002 James Morris <jmorris@intercode.com.au> 11 * (C) 2003-2005 Netfilter Core Team <coreteam@netfilter.org> 12 */ 13 14 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 15 16 #include <linux/module.h> 17 #include <linux/skbuff.h> 18 #include <linux/init.h> 19 #include <linux/spinlock.h> 20 #include <linux/slab.h> 21 #include <linux/notifier.h> 22 #include <linux/netdevice.h> 23 #include <linux/netfilter.h> 24 #include <linux/proc_fs.h> 25 #include <linux/netfilter_ipv4.h> 26 #include <linux/netfilter_ipv6.h> 27 #include <linux/netfilter_bridge.h> 28 #include <linux/netfilter/nfnetlink.h> 29 #include <linux/netfilter/nfnetlink_queue.h> 30 #include <linux/netfilter/nf_conntrack_common.h> 31 #include <linux/icmp.h> 32 #include <linux/icmpv6.h> 33 #include <linux/ip.h> 34 #include <linux/list.h> 35 #include <linux/sctp.h> 36 #include <linux/cgroup-defs.h> 37 #include <linux/rhashtable.h> 38 #include <linux/jhash.h> 39 #include <linux/tcp.h> 40 #include <linux/udp.h> 41 #include <net/gre.h> 42 #include <net/gso.h> 43 #include <net/ip.h> 44 #include <net/sock.h> 45 #include <net/tcp_states.h> 46 #include <net/netfilter/nf_queue.h> 47 #include <net/netns/generic.h> 48 49 #include <linux/atomic.h> 50 51 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) 52 #include "../bridge/br_private.h" 53 #endif 54 55 #if IS_ENABLED(CONFIG_NF_CONNTRACK) 56 #include <net/netfilter/nf_conntrack.h> 57 #endif 58 59 #define NFQNL_QMAX_DEFAULT 1024 60 #define NFQNL_HASH_MIN 8 61 #define NFQNL_HASH_MAX 32768 62 63 /* We're using struct nlattr which has 16bit nla_len. Note that nla_len 64 * includes the header length. Thus, the maximum packet length that we 65 * support is 65531 bytes. We send truncated packets if the specified length 66 * is larger than that. Userspace can check for presence of NFQA_CAP_LEN 67 * attribute to detect truncation. 68 */ 69 #define NFQNL_MAX_COPY_RANGE (0xffff - NLA_HDRLEN) 70 71 struct nfqnl_instance { 72 struct hlist_node hlist; /* global list of queues */ 73 struct rhashtable nfqnl_packet_map; 74 struct rcu_work rwork; 75 76 u32 peer_portid; 77 unsigned int queue_maxlen; 78 unsigned int copy_range; 79 unsigned int queue_dropped; 80 unsigned int queue_user_dropped; 81 82 83 u_int16_t queue_num; /* number of this queue */ 84 u_int8_t copy_mode; 85 u_int32_t flags; /* Set using NFQA_CFG_FLAGS */ 86 /* 87 * Following fields are dirtied for each queued packet, 88 * keep them in same cache line if possible. 89 */ 90 spinlock_t lock ____cacheline_aligned_in_smp; 91 unsigned int queue_total; 92 unsigned int id_sequence; /* 'sequence' of pkt ids */ 93 struct list_head queue_list; /* packets in queue */ 94 }; 95 96 typedef int (*nfqnl_cmpfn)(struct nf_queue_entry *, unsigned long); 97 98 static struct workqueue_struct *nfq_cleanup_wq __read_mostly; 99 static unsigned int nfnl_queue_net_id __read_mostly; 100 101 #define INSTANCE_BUCKETS 16 102 struct nfnl_queue_net { 103 spinlock_t instances_lock; 104 struct hlist_head instance_table[INSTANCE_BUCKETS]; 105 }; 106 107 static struct nfnl_queue_net *nfnl_queue_pernet(struct net *net) 108 { 109 return net_generic(net, nfnl_queue_net_id); 110 } 111 112 static inline u_int8_t instance_hashfn(u_int16_t queue_num) 113 { 114 return ((queue_num >> 8) ^ queue_num) % INSTANCE_BUCKETS; 115 } 116 117 static const struct rhashtable_params nfqnl_rhashtable_params = { 118 .head_offset = offsetof(struct nf_queue_entry, hash_node), 119 .key_offset = offsetof(struct nf_queue_entry, id), 120 .key_len = sizeof(u32), 121 .automatic_shrinking = true, 122 .min_size = NFQNL_HASH_MIN, 123 .max_size = NFQNL_HASH_MAX, 124 }; 125 126 static struct nfqnl_instance * 127 instance_lookup(struct nfnl_queue_net *q, u_int16_t queue_num) 128 { 129 struct hlist_head *head; 130 struct nfqnl_instance *inst; 131 132 head = &q->instance_table[instance_hashfn(queue_num)]; 133 hlist_for_each_entry_rcu(inst, head, hlist) { 134 if (inst->queue_num == queue_num) 135 return inst; 136 } 137 return NULL; 138 } 139 140 static struct nfqnl_instance * 141 instance_create(struct nfnl_queue_net *q, u_int16_t queue_num, u32 portid) 142 { 143 struct nfqnl_instance *inst; 144 unsigned int h; 145 int err; 146 147 inst = kzalloc_obj(*inst, GFP_KERNEL_ACCOUNT); 148 if (!inst) 149 return ERR_PTR(-ENOMEM); 150 151 inst->queue_num = queue_num; 152 inst->peer_portid = portid; 153 inst->queue_maxlen = NFQNL_QMAX_DEFAULT; 154 inst->copy_range = NFQNL_MAX_COPY_RANGE; 155 inst->copy_mode = NFQNL_COPY_NONE; 156 spin_lock_init(&inst->lock); 157 INIT_LIST_HEAD(&inst->queue_list); 158 159 err = rhashtable_init(&inst->nfqnl_packet_map, &nfqnl_rhashtable_params); 160 if (err < 0) 161 goto out_free; 162 163 spin_lock(&q->instances_lock); 164 if (instance_lookup(q, queue_num)) { 165 err = -EEXIST; 166 goto out_unlock; 167 } 168 169 if (!try_module_get(THIS_MODULE)) { 170 err = -EAGAIN; 171 goto out_unlock; 172 } 173 174 h = instance_hashfn(queue_num); 175 hlist_add_head_rcu(&inst->hlist, &q->instance_table[h]); 176 177 spin_unlock(&q->instances_lock); 178 179 return inst; 180 181 out_unlock: 182 spin_unlock(&q->instances_lock); 183 rhashtable_destroy(&inst->nfqnl_packet_map); 184 out_free: 185 kfree(inst); 186 return ERR_PTR(err); 187 } 188 189 static void nfqnl_flush(struct nfqnl_instance *queue, nfqnl_cmpfn cmpfn, 190 unsigned long data); 191 192 static void instance_destroy_work(struct work_struct *work) 193 { 194 struct nfqnl_instance *inst; 195 196 inst = container_of(to_rcu_work(work), struct nfqnl_instance, 197 rwork); 198 rcu_read_lock(); 199 nfqnl_flush(inst, NULL, 0); 200 rcu_read_unlock(); 201 202 rhashtable_destroy(&inst->nfqnl_packet_map); 203 204 kfree(inst); 205 module_put(THIS_MODULE); 206 } 207 208 static void 209 __instance_destroy(struct nfqnl_instance *inst) 210 { 211 hlist_del_rcu(&inst->hlist); 212 213 INIT_RCU_WORK(&inst->rwork, instance_destroy_work); 214 queue_rcu_work(nfq_cleanup_wq, &inst->rwork); 215 } 216 217 static void 218 instance_destroy(struct nfnl_queue_net *q, struct nfqnl_instance *inst) 219 { 220 spin_lock(&q->instances_lock); 221 __instance_destroy(inst); 222 spin_unlock(&q->instances_lock); 223 } 224 225 static int 226 __enqueue_entry(struct nfqnl_instance *queue, struct nf_queue_entry *entry) 227 { 228 int err; 229 230 err = rhashtable_insert_fast(&queue->nfqnl_packet_map, &entry->hash_node, 231 nfqnl_rhashtable_params); 232 if (unlikely(err)) 233 return err; 234 235 list_add_tail(&entry->list, &queue->queue_list); 236 queue->queue_total++; 237 238 return 0; 239 } 240 241 static void 242 __dequeue_entry(struct nfqnl_instance *queue, struct nf_queue_entry *entry) 243 { 244 rhashtable_remove_fast(&queue->nfqnl_packet_map, &entry->hash_node, 245 nfqnl_rhashtable_params); 246 list_del(&entry->list); 247 queue->queue_total--; 248 } 249 250 static struct nf_queue_entry * 251 find_dequeue_entry(struct nfqnl_instance *queue, unsigned int id) 252 { 253 struct nf_queue_entry *entry; 254 255 spin_lock_bh(&queue->lock); 256 entry = rhashtable_lookup_fast(&queue->nfqnl_packet_map, &id, 257 nfqnl_rhashtable_params); 258 259 if (entry) 260 __dequeue_entry(queue, entry); 261 262 spin_unlock_bh(&queue->lock); 263 264 return entry; 265 } 266 267 static unsigned int nf_iterate(struct sk_buff *skb, 268 struct nf_hook_state *state, 269 const struct nf_hook_entries *hooks, 270 unsigned int *index) 271 { 272 const struct nf_hook_entry *hook; 273 unsigned int verdict, i = *index; 274 275 while (i < hooks->num_hook_entries) { 276 hook = &hooks->hooks[i]; 277 repeat: 278 verdict = nf_hook_entry_hookfn(hook, skb, state); 279 if (verdict != NF_ACCEPT) { 280 *index = i; 281 if (verdict != NF_REPEAT) 282 return verdict; 283 goto repeat; 284 } 285 i++; 286 } 287 288 *index = i; 289 return NF_ACCEPT; 290 } 291 292 static struct nf_hook_entries *nf_hook_entries_head(const struct net *net, u8 pf, u8 hooknum) 293 { 294 switch (pf) { 295 #ifdef CONFIG_NETFILTER_FAMILY_BRIDGE 296 case NFPROTO_BRIDGE: 297 return rcu_dereference(net->nf.hooks_bridge[hooknum]); 298 #endif 299 case NFPROTO_IPV4: 300 return rcu_dereference(net->nf.hooks_ipv4[hooknum]); 301 case NFPROTO_IPV6: 302 return rcu_dereference(net->nf.hooks_ipv6[hooknum]); 303 default: 304 WARN_ON_ONCE(1); 305 return NULL; 306 } 307 308 return NULL; 309 } 310 311 static int nf_ip_reroute(struct sk_buff *skb, const struct nf_queue_entry *entry) 312 { 313 #ifdef CONFIG_INET 314 const struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry); 315 316 if (entry->state.hook == NF_INET_LOCAL_OUT) { 317 const struct iphdr *iph = ip_hdr(skb); 318 319 if (!(iph->tos == rt_info->tos && 320 skb->mark == rt_info->mark && 321 iph->daddr == rt_info->daddr && 322 iph->saddr == rt_info->saddr)) 323 return ip_route_me_harder(entry->state.net, entry->state.sk, 324 skb, RTN_UNSPEC); 325 } 326 #endif 327 return 0; 328 } 329 330 static int nf_ip6_reroute(struct sk_buff *skb, 331 const struct nf_queue_entry *entry) 332 { 333 struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry); 334 335 if (entry->state.hook == NF_INET_LOCAL_OUT) { 336 const struct ipv6hdr *iph = ipv6_hdr(skb); 337 338 if (!ipv6_addr_equal(&iph->daddr, &rt_info->daddr) || 339 !ipv6_addr_equal(&iph->saddr, &rt_info->saddr) || 340 skb->mark != rt_info->mark) 341 return nf_ip6_route_me_harder(entry->state.net, 342 entry->state.sk, skb); 343 } 344 return 0; 345 } 346 347 static int nf_reroute(struct sk_buff *skb, struct nf_queue_entry *entry) 348 { 349 int ret = 0; 350 351 switch (entry->state.pf) { 352 case AF_INET: 353 ret = nf_ip_reroute(skb, entry); 354 break; 355 case AF_INET6: 356 ret = nf_ip6_reroute(skb, entry); 357 break; 358 } 359 return ret; 360 } 361 362 /* caller must hold rcu read-side lock */ 363 static void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict) 364 { 365 const struct nf_hook_entry *hook_entry; 366 const struct nf_hook_entries *hooks; 367 struct sk_buff *skb = entry->skb; 368 const struct net *net; 369 unsigned int i; 370 int err; 371 u8 pf; 372 373 net = entry->state.net; 374 pf = entry->state.pf; 375 376 hooks = nf_hook_entries_head(net, pf, entry->state.hook); 377 378 i = entry->hook_index; 379 if (!hooks || i >= hooks->num_hook_entries) { 380 kfree_skb_reason(skb, SKB_DROP_REASON_NETFILTER_DROP); 381 nf_queue_entry_free(entry); 382 return; 383 } 384 385 hook_entry = &hooks->hooks[i]; 386 387 /* Continue traversal iff userspace said ok... */ 388 if (verdict == NF_REPEAT) 389 verdict = nf_hook_entry_hookfn(hook_entry, skb, &entry->state); 390 391 if (verdict == NF_ACCEPT) { 392 if (nf_reroute(skb, entry) < 0) 393 verdict = NF_DROP; 394 } 395 396 if (verdict == NF_ACCEPT) { 397 next_hook: 398 ++i; 399 verdict = nf_iterate(skb, &entry->state, hooks, &i); 400 } 401 402 switch (verdict & NF_VERDICT_MASK) { 403 case NF_ACCEPT: 404 case NF_STOP: 405 local_bh_disable(); 406 entry->state.okfn(entry->state.net, entry->state.sk, skb); 407 local_bh_enable(); 408 break; 409 case NF_QUEUE: 410 err = nf_queue(skb, &entry->state, i, verdict); 411 if (err == 1) 412 goto next_hook; 413 break; 414 case NF_STOLEN: 415 break; 416 default: 417 kfree_skb(skb); 418 } 419 420 nf_queue_entry_free(entry); 421 } 422 423 /* return true if the entry has an unconfirmed conntrack attached that isn't owned by us 424 * exclusively. 425 */ 426 static bool nf_ct_drop_unconfirmed(const struct nf_queue_entry *entry, bool *is_unconfirmed) 427 { 428 #if IS_ENABLED(CONFIG_NF_CONNTRACK) 429 struct nf_conn *ct = (void *)skb_nfct(entry->skb); 430 431 if (!ct || nf_ct_is_confirmed(ct)) 432 return false; 433 434 if (is_unconfirmed) 435 *is_unconfirmed = true; 436 437 /* in some cases skb_clone() can occur after initial conntrack 438 * pickup, but conntrack assumes exclusive skb->_nfct ownership for 439 * unconfirmed entries. 440 * 441 * This happens for br_netfilter and with ip multicast routing. 442 * This can't be solved with serialization here because one clone 443 * could have been queued for local delivery or could be transmitted 444 * in parallel on another CPU. 445 */ 446 return refcount_read(&ct->ct_general.use) > 1; 447 #endif 448 return false; 449 } 450 451 static bool nf_bridge_port_valid(const struct net_device *dev) 452 { 453 if (!dev) 454 return true; 455 456 return netif_is_bridge_port(dev); 457 } 458 459 /* queued skbs leave rcu protection. We bump device refcount so that 460 * the device cannot go away. However, while packet was out the port 461 * could have been removed from the bridge. 462 * 463 * Ensure in+outdev are still part of a bridge at reinject time. 464 * 465 * The device rx_handler_data could even be pointing at data that is 466 * not a net_bridge_port structure. 467 */ 468 static bool nf_bridge_ports_valid(const struct nf_queue_entry *entry) 469 { 470 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) 471 if (!nf_bridge_port_valid(entry->physin) || 472 !nf_bridge_port_valid(entry->physout)) 473 return false; 474 #endif 475 if (entry->state.pf != PF_BRIDGE) 476 return true; 477 478 if (!nf_bridge_port_valid(entry->state.in) || 479 !nf_bridge_port_valid(entry->state.out)) 480 return false; 481 482 return true; 483 } 484 485 static void nfqnl_reinject(struct nf_queue_entry *entry, unsigned int verdict) 486 { 487 const struct nf_ct_hook *ct_hook; 488 489 if (!nf_bridge_ports_valid(entry)) 490 verdict = NF_DROP; 491 492 if (verdict == NF_ACCEPT || 493 verdict == NF_REPEAT || 494 verdict == NF_STOP) { 495 unsigned int ct_verdict = verdict; 496 497 rcu_read_lock(); 498 ct_hook = rcu_dereference(nf_ct_hook); 499 if (ct_hook) 500 ct_verdict = ct_hook->update(entry->state.net, entry->skb); 501 rcu_read_unlock(); 502 503 switch (ct_verdict & NF_VERDICT_MASK) { 504 case NF_ACCEPT: 505 /* follow userspace verdict, could be REPEAT */ 506 break; 507 case NF_STOLEN: 508 nf_queue_entry_free(entry); 509 return; 510 default: 511 verdict = ct_verdict & NF_VERDICT_MASK; 512 break; 513 } 514 } 515 516 if (verdict != NF_DROP && entry->nf_ct_is_unconfirmed) { 517 /* If first queued segment was already reinjected then 518 * there is a good chance the ct entry is now confirmed. 519 * 520 * Handle the rare cases: 521 * - out-of-order verdict 522 * - threaded userspace reinjecting in parallel 523 * - first segment was dropped 524 * 525 * In all of those cases we can't handle this packet 526 * because we can't be sure that another CPU won't modify 527 * nf_conn->ext in parallel which isn't allowed. 528 */ 529 if (nf_ct_drop_unconfirmed(entry, NULL)) 530 verdict = NF_DROP; 531 } 532 533 nf_reinject(entry, verdict); 534 } 535 536 static void 537 nfqnl_flush(struct nfqnl_instance *queue, nfqnl_cmpfn cmpfn, unsigned long data) 538 { 539 struct nf_queue_entry *entry, *next; 540 541 spin_lock_bh(&queue->lock); 542 list_for_each_entry_safe(entry, next, &queue->queue_list, list) { 543 if (!cmpfn || cmpfn(entry, data)) { 544 __dequeue_entry(queue, entry); 545 nfqnl_reinject(entry, NF_DROP); 546 } 547 } 548 spin_unlock_bh(&queue->lock); 549 } 550 551 static int 552 nfqnl_put_packet_info(struct sk_buff *nlskb, struct sk_buff *packet, 553 bool csum_verify) 554 { 555 __u32 flags = 0; 556 557 if (packet->ip_summed == CHECKSUM_PARTIAL) 558 flags = NFQA_SKB_CSUMNOTREADY; 559 else if (csum_verify) 560 flags = NFQA_SKB_CSUM_NOTVERIFIED; 561 562 if (skb_is_gso(packet)) 563 flags |= NFQA_SKB_GSO; 564 565 return flags ? nla_put_be32(nlskb, NFQA_SKB_INFO, htonl(flags)) : 0; 566 } 567 568 static int nfqnl_put_sk_uidgid(struct sk_buff *skb, struct sock *sk) 569 { 570 const struct socket *sock; 571 const struct file *file; 572 const struct cred *cred; 573 574 if (!sk_fullsock(sk)) 575 return 0; 576 577 /* The sk pointer remains valid as long as the skb is. 578 * The sk_socket and file pointer may become NULL 579 * if the socket is closed. 580 * Both structures (including file->cred) are RCU freed 581 * which means they can be accessed within a RCU read section. 582 */ 583 sock = READ_ONCE(sk->sk_socket); 584 file = sock ? READ_ONCE(sock->file) : NULL; 585 if (file) { 586 cred = file->f_cred; 587 if (nla_put_be32(skb, NFQA_UID, 588 htonl(from_kuid_munged(&init_user_ns, cred->fsuid)))) 589 goto nla_put_failure; 590 if (nla_put_be32(skb, NFQA_GID, 591 htonl(from_kgid_munged(&init_user_ns, cred->fsgid)))) 592 goto nla_put_failure; 593 } 594 return 0; 595 596 nla_put_failure: 597 return -1; 598 } 599 600 static int nfqnl_put_sk_classid(struct sk_buff *skb, struct sock *sk) 601 { 602 #if IS_ENABLED(CONFIG_CGROUP_NET_CLASSID) 603 if (sk && sk_fullsock(sk)) { 604 u32 classid = sock_cgroup_classid(&sk->sk_cgrp_data); 605 606 if (classid && nla_put_be32(skb, NFQA_CGROUP_CLASSID, htonl(classid))) 607 return -1; 608 } 609 #endif 610 return 0; 611 } 612 613 static int nfqnl_get_sk_secctx(struct sk_buff *skb, struct lsm_context *ctx) 614 { 615 int seclen = 0; 616 #if IS_ENABLED(CONFIG_NETWORK_SECMARK) 617 if (skb->secmark) 618 seclen = security_secid_to_secctx(skb->secmark, ctx); 619 #endif 620 return seclen; 621 } 622 623 static u32 nfqnl_get_bridge_size(struct nf_queue_entry *entry) 624 { 625 struct sk_buff *entskb = entry->skb; 626 u32 nlalen = 0; 627 u32 mac_len; 628 629 if (entry->state.pf != PF_BRIDGE || !skb_mac_header_was_set(entskb)) 630 return 0; 631 632 if (skb_vlan_tag_present(entskb)) 633 nlalen += nla_total_size(nla_total_size(sizeof(__be16)) + 634 nla_total_size(sizeof(__be16))); 635 636 mac_len = skb_mac_header_len(entskb); 637 if (mac_len > 0) 638 nlalen += nla_total_size(mac_len); 639 640 return nlalen; 641 } 642 643 static int nfqnl_put_bridge(struct nf_queue_entry *entry, struct sk_buff *skb) 644 { 645 struct sk_buff *entskb = entry->skb; 646 u32 mac_len; 647 648 if (entry->state.pf != PF_BRIDGE || !skb_mac_header_was_set(entskb)) 649 return 0; 650 651 if (skb_vlan_tag_present(entskb)) { 652 struct nlattr *nest; 653 654 nest = nla_nest_start(skb, NFQA_VLAN); 655 if (!nest) 656 goto nla_put_failure; 657 658 if (nla_put_be16(skb, NFQA_VLAN_TCI, htons(entskb->vlan_tci)) || 659 nla_put_be16(skb, NFQA_VLAN_PROTO, entskb->vlan_proto)) 660 goto nla_put_failure; 661 662 nla_nest_end(skb, nest); 663 } 664 665 mac_len = skb_mac_header_len(entskb); 666 if (mac_len > 0 && 667 nla_put(skb, NFQA_L2HDR, mac_len, skb_mac_header(entskb))) 668 goto nla_put_failure; 669 670 return 0; 671 672 nla_put_failure: 673 return -1; 674 } 675 676 static int nf_queue_checksum_help(struct sk_buff *entskb) 677 { 678 if (entskb->protocol == htons(ETH_P_IP)) { 679 if (!pskb_network_may_pull(entskb, sizeof(struct iphdr)) || 680 ip_check_csum_start(entskb)) 681 return -EINVAL; 682 } 683 684 if (skb_csum_is_sctp(entskb)) 685 return skb_crc32c_csum_help(entskb); 686 687 return skb_checksum_help(entskb); 688 } 689 690 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) 691 static int nfqnl_put_master_ifindex(struct sk_buff *nlskb, int attr, 692 const struct net_device *dev) 693 { 694 const struct net_device *upper; 695 696 if (dev && !netif_is_bridge_port(dev)) 697 return 0; 698 699 upper = netdev_master_upper_dev_get_rcu((struct net_device *)dev); 700 if (upper && nla_put_be32(nlskb, attr, htonl(upper->ifindex))) 701 return -EMSGSIZE; 702 703 return 0; 704 } 705 #endif 706 707 static unsigned int nfqnl_get_data_len(const struct sk_buff *entskb, 708 unsigned int copy_range) 709 { 710 unsigned int data_len = entskb->len; 711 712 if (!skb_frags_readable(entskb)) 713 data_len = skb_headlen(entskb); 714 715 return min(data_len, copy_range); 716 } 717 718 static struct sk_buff * 719 nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, 720 struct nf_queue_entry *entry, 721 __be32 **packet_id_ptr) 722 { 723 size_t size; 724 size_t data_len = 0, cap_len = 0; 725 unsigned int hlen = 0; 726 struct sk_buff *skb; 727 struct nlattr *nla; 728 struct nfqnl_msg_packet_hdr *pmsg; 729 struct nlmsghdr *nlh; 730 struct sk_buff *entskb = entry->skb; 731 struct net_device *indev; 732 struct net_device *outdev; 733 struct nf_conn *ct = NULL; 734 enum ip_conntrack_info ctinfo = 0; 735 const struct nfnl_ct_hook *nfnl_ct; 736 bool csum_verify; 737 struct lsm_context ctx = { NULL, 0, 0 }; 738 int seclen = 0; 739 ktime_t tstamp; 740 741 size = nlmsg_total_size(sizeof(struct nfgenmsg)) 742 + nla_total_size(sizeof(struct nfqnl_msg_packet_hdr)) 743 + nla_total_size(sizeof(u_int32_t)) /* ifindex */ 744 + nla_total_size(sizeof(u_int32_t)) /* ifindex */ 745 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) 746 + nla_total_size(sizeof(u_int32_t)) /* ifindex */ 747 + nla_total_size(sizeof(u_int32_t)) /* ifindex */ 748 #endif 749 + nla_total_size(sizeof(u_int32_t)) /* mark */ 750 + nla_total_size(sizeof(u_int32_t)) /* priority */ 751 + nla_total_size(sizeof(struct nfqnl_msg_packet_hw)) 752 + nla_total_size(sizeof(u_int32_t)) /* skbinfo */ 753 #if IS_ENABLED(CONFIG_CGROUP_NET_CLASSID) 754 + nla_total_size(sizeof(u_int32_t)) /* classid */ 755 #endif 756 + nla_total_size(sizeof(u_int32_t)); /* cap_len */ 757 758 tstamp = skb_tstamp_cond(entskb, false); 759 if (tstamp) 760 size += nla_total_size(sizeof(struct nfqnl_msg_packet_timestamp)); 761 762 size += nfqnl_get_bridge_size(entry); 763 764 if (entry->state.hook <= NF_INET_FORWARD || 765 (entry->state.hook == NF_INET_POST_ROUTING && entskb->sk == NULL)) 766 csum_verify = !skb_csum_unnecessary(entskb); 767 else 768 csum_verify = false; 769 770 outdev = entry->state.out; 771 772 switch ((enum nfqnl_config_mode)READ_ONCE(queue->copy_mode)) { 773 case NFQNL_COPY_META: 774 case NFQNL_COPY_NONE: 775 break; 776 777 case NFQNL_COPY_PACKET: 778 if (!(queue->flags & NFQA_CFG_F_GSO) && 779 entskb->ip_summed == CHECKSUM_PARTIAL && 780 nf_queue_checksum_help(entskb)) 781 return NULL; 782 783 data_len = nfqnl_get_data_len(entskb, READ_ONCE(queue->copy_range)); 784 hlen = skb_zerocopy_headlen(entskb); 785 hlen = min_t(unsigned int, hlen, data_len); 786 size += sizeof(struct nlattr) + hlen; 787 cap_len = entskb->len; 788 break; 789 } 790 791 nfnl_ct = rcu_dereference(nfnl_ct_hook); 792 793 #if IS_ENABLED(CONFIG_NF_CONNTRACK) 794 if (queue->flags & NFQA_CFG_F_CONNTRACK) { 795 if (nfnl_ct != NULL) { 796 ct = nf_ct_get(entskb, &ctinfo); 797 if (ct != NULL) 798 size += nfnl_ct->build_size(ct); 799 } 800 } 801 #endif 802 803 if (queue->flags & NFQA_CFG_F_UID_GID) { 804 size += (nla_total_size(sizeof(u_int32_t)) /* uid */ 805 + nla_total_size(sizeof(u_int32_t))); /* gid */ 806 } 807 808 if ((queue->flags & NFQA_CFG_F_SECCTX) && entskb->sk) { 809 seclen = nfqnl_get_sk_secctx(entskb, &ctx); 810 if (seclen < 0) 811 return NULL; 812 if (seclen) 813 size += nla_total_size(seclen); 814 } 815 816 skb = alloc_skb(size, GFP_ATOMIC); 817 if (!skb) { 818 skb_tx_error(entskb); 819 goto nlmsg_failure; 820 } 821 822 nlh = nfnl_msg_put(skb, 0, 0, 823 nfnl_msg_type(NFNL_SUBSYS_QUEUE, NFQNL_MSG_PACKET), 824 0, entry->state.pf, NFNETLINK_V0, 825 htons(queue->queue_num)); 826 if (!nlh) { 827 skb_tx_error(entskb); 828 kfree_skb(skb); 829 goto nlmsg_failure; 830 } 831 832 nla = __nla_reserve(skb, NFQA_PACKET_HDR, sizeof(*pmsg)); 833 pmsg = nla_data(nla); 834 pmsg->hw_protocol = entskb->protocol; 835 pmsg->hook = entry->state.hook; 836 *packet_id_ptr = &pmsg->packet_id; 837 838 indev = entry->state.in; 839 if (indev) { 840 #if !IS_ENABLED(CONFIG_BRIDGE_NETFILTER) 841 if (nla_put_be32(skb, NFQA_IFINDEX_INDEV, htonl(indev->ifindex))) 842 goto nla_put_failure; 843 #else 844 if (entry->state.pf == PF_BRIDGE) { 845 /* Case 1: indev is physical input device, we need to 846 * look for bridge group (when called from 847 * netfilter_bridge) */ 848 if (nla_put_be32(skb, NFQA_IFINDEX_PHYSINDEV, 849 htonl(indev->ifindex)) || 850 nfqnl_put_master_ifindex(skb, NFQA_IFINDEX_INDEV, indev)) 851 goto nla_put_failure; 852 } else { 853 int physinif; 854 855 /* Case 2: indev is bridge group, we need to look for 856 * physical device (when called from ipv4) */ 857 if (nla_put_be32(skb, NFQA_IFINDEX_INDEV, 858 htonl(indev->ifindex))) 859 goto nla_put_failure; 860 861 physinif = nf_bridge_get_physinif(entskb); 862 if (physinif && 863 nla_put_be32(skb, NFQA_IFINDEX_PHYSINDEV, 864 htonl(physinif))) 865 goto nla_put_failure; 866 } 867 #endif 868 } 869 870 if (outdev) { 871 #if !IS_ENABLED(CONFIG_BRIDGE_NETFILTER) 872 if (nla_put_be32(skb, NFQA_IFINDEX_OUTDEV, htonl(outdev->ifindex))) 873 goto nla_put_failure; 874 #else 875 if (entry->state.pf == PF_BRIDGE) { 876 /* Case 1: outdev is physical output device, we need to 877 * look for bridge group (when called from 878 * netfilter_bridge) */ 879 if (nla_put_be32(skb, NFQA_IFINDEX_PHYSOUTDEV, 880 htonl(outdev->ifindex)) || 881 nfqnl_put_master_ifindex(skb, NFQA_IFINDEX_OUTDEV, outdev)) 882 goto nla_put_failure; 883 } else { 884 int physoutif; 885 886 /* Case 2: outdev is bridge group, we need to look for 887 * physical output device (when called from ipv4) */ 888 if (nla_put_be32(skb, NFQA_IFINDEX_OUTDEV, 889 htonl(outdev->ifindex))) 890 goto nla_put_failure; 891 892 physoutif = nf_bridge_get_physoutif(entskb); 893 if (physoutif && 894 nla_put_be32(skb, NFQA_IFINDEX_PHYSOUTDEV, 895 htonl(physoutif))) 896 goto nla_put_failure; 897 } 898 #endif 899 } 900 901 if (entskb->mark && 902 nla_put_be32(skb, NFQA_MARK, htonl(entskb->mark))) 903 goto nla_put_failure; 904 905 if (entskb->priority && 906 nla_put_be32(skb, NFQA_PRIORITY, htonl(entskb->priority))) 907 goto nla_put_failure; 908 909 if (indev && entskb->dev && 910 skb_mac_header_was_set(entskb) && 911 skb_mac_header_len(entskb) != 0) { 912 struct nfqnl_msg_packet_hw phw; 913 int len; 914 915 memset(&phw, 0, sizeof(phw)); 916 len = dev_parse_header(entskb, phw.hw_addr); 917 if (len) { 918 phw.hw_addrlen = htons(len); 919 if (nla_put(skb, NFQA_HWADDR, sizeof(phw), &phw)) 920 goto nla_put_failure; 921 } 922 } 923 924 if (nfqnl_put_bridge(entry, skb) < 0) 925 goto nla_put_failure; 926 927 if (entry->state.hook <= NF_INET_FORWARD && tstamp) { 928 struct nfqnl_msg_packet_timestamp ts; 929 struct timespec64 kts = ktime_to_timespec64(tstamp); 930 931 ts.sec = cpu_to_be64(kts.tv_sec); 932 ts.usec = cpu_to_be64(kts.tv_nsec / NSEC_PER_USEC); 933 934 if (nla_put(skb, NFQA_TIMESTAMP, sizeof(ts), &ts)) 935 goto nla_put_failure; 936 } 937 938 if ((queue->flags & NFQA_CFG_F_UID_GID) && entskb->sk && 939 nfqnl_put_sk_uidgid(skb, entskb->sk) < 0) 940 goto nla_put_failure; 941 942 if (nfqnl_put_sk_classid(skb, entskb->sk) < 0) 943 goto nla_put_failure; 944 945 if (seclen > 0 && nla_put(skb, NFQA_SECCTX, ctx.len, ctx.context)) 946 goto nla_put_failure; 947 948 if (ct && nfnl_ct->build(skb, ct, ctinfo, NFQA_CT, NFQA_CT_INFO) < 0) 949 goto nla_put_failure; 950 951 if (cap_len > data_len && 952 nla_put_be32(skb, NFQA_CAP_LEN, htonl(cap_len))) 953 goto nla_put_failure; 954 955 if (nfqnl_put_packet_info(skb, entskb, csum_verify)) 956 goto nla_put_failure; 957 958 if (data_len) { 959 struct nlattr *nla; 960 961 if (skb_tailroom(skb) < sizeof(*nla) + hlen) 962 goto nla_put_failure; 963 964 nla = skb_put(skb, sizeof(*nla)); 965 nla->nla_type = NFQA_PAYLOAD; 966 nla->nla_len = nla_attr_size(data_len); 967 968 if (skb_zerocopy(skb, entskb, data_len, hlen)) 969 goto nla_put_failure; 970 } 971 972 nlh->nlmsg_len = skb->len; 973 if (seclen >= 0) 974 security_release_secctx(&ctx); 975 return skb; 976 977 nla_put_failure: 978 skb_tx_error(entskb); 979 kfree_skb(skb); 980 net_err_ratelimited("nf_queue: error creating packet message\n"); 981 nlmsg_failure: 982 if (seclen >= 0) 983 security_release_secctx(&ctx); 984 return NULL; 985 } 986 987 static int 988 __nfqnl_enqueue_packet(struct net *net, struct nfqnl_instance *queue, 989 struct nf_queue_entry *entry) 990 { 991 struct sk_buff *nskb; 992 int err = -ENOBUFS; 993 __be32 *packet_id_ptr; 994 int failopen = 0; 995 996 nskb = nfqnl_build_packet_message(net, queue, entry, &packet_id_ptr); 997 if (nskb == NULL) { 998 err = -ENOMEM; 999 goto err_out; 1000 } 1001 spin_lock_bh(&queue->lock); 1002 1003 if (queue->queue_total >= queue->queue_maxlen) 1004 goto err_out_queue_drop; 1005 1006 entry->id = ++queue->id_sequence; 1007 *packet_id_ptr = htonl(entry->id); 1008 1009 /* Insert into hash BEFORE unicast. If failure don't send to userspace. */ 1010 err = __enqueue_entry(queue, entry); 1011 if (unlikely(err)) 1012 goto err_out_queue_drop; 1013 1014 /* nfnetlink_unicast will either free the nskb or add it to a socket */ 1015 err = nfnetlink_unicast(nskb, net, queue->peer_portid); 1016 if (err < 0) { 1017 /* Unicast failed - remove entry we just inserted */ 1018 __dequeue_entry(queue, entry); 1019 1020 if (queue->flags & NFQA_CFG_F_FAIL_OPEN) { 1021 failopen = 1; 1022 err = 0; 1023 } else { 1024 queue->queue_user_dropped++; 1025 } 1026 goto err_out_unlock; 1027 } 1028 1029 spin_unlock_bh(&queue->lock); 1030 return 0; 1031 1032 err_out_queue_drop: 1033 if (queue->flags & NFQA_CFG_F_FAIL_OPEN) { 1034 failopen = 1; 1035 err = 0; 1036 } else { 1037 queue->queue_dropped++; 1038 1039 if (queue->queue_total >= queue->queue_maxlen) 1040 net_warn_ratelimited("nf_queue: full at %d entries, dropping packets(s)\n", 1041 queue->queue_total); 1042 else 1043 net_warn_ratelimited("nf_queue: hash insert failed: %d\n", err); 1044 } 1045 kfree_skb(nskb); 1046 err_out_unlock: 1047 spin_unlock_bh(&queue->lock); 1048 if (failopen) 1049 nfqnl_reinject(entry, NF_ACCEPT); 1050 err_out: 1051 return err; 1052 } 1053 1054 static struct nf_queue_entry * 1055 nf_queue_entry_dup(struct nf_queue_entry *e) 1056 { 1057 struct nf_queue_entry *entry = kmemdup(e, e->size, GFP_ATOMIC); 1058 1059 if (!entry) 1060 return NULL; 1061 1062 if (nf_queue_entry_get_refs(entry)) 1063 return entry; 1064 1065 kfree(entry); 1066 return NULL; 1067 } 1068 1069 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) 1070 /* When called from bridge netfilter, skb->data must point to MAC header 1071 * before calling skb_gso_segment(). Else, original MAC header is lost 1072 * and segmented skbs will be sent to wrong destination. 1073 */ 1074 static void nf_bridge_adjust_skb_data(struct sk_buff *skb) 1075 { 1076 if (nf_bridge_info_get(skb)) 1077 __skb_push(skb, skb_mac_header_len(skb)); 1078 } 1079 1080 static void nf_bridge_adjust_segmented_data(struct sk_buff *skb) 1081 { 1082 if (nf_bridge_info_get(skb)) 1083 __skb_pull(skb, skb_mac_header_len(skb)); 1084 } 1085 #else 1086 #define nf_bridge_adjust_skb_data(s) do {} while (0) 1087 #define nf_bridge_adjust_segmented_data(s) do {} while (0) 1088 #endif 1089 1090 static int 1091 __nfqnl_enqueue_packet_gso(struct net *net, struct nfqnl_instance *queue, 1092 struct sk_buff *skb, struct nf_queue_entry *entry) 1093 { 1094 int ret = -ENOMEM; 1095 struct nf_queue_entry *entry_seg; 1096 1097 nf_bridge_adjust_segmented_data(skb); 1098 1099 if (skb->next == NULL) { /* last packet, no need to copy entry */ 1100 struct sk_buff *gso_skb = entry->skb; 1101 entry->skb = skb; 1102 ret = __nfqnl_enqueue_packet(net, queue, entry); 1103 if (ret) 1104 entry->skb = gso_skb; 1105 return ret; 1106 } 1107 1108 skb_mark_not_on_list(skb); 1109 1110 entry_seg = nf_queue_entry_dup(entry); 1111 if (entry_seg) { 1112 entry_seg->skb = skb; 1113 ret = __nfqnl_enqueue_packet(net, queue, entry_seg); 1114 if (ret) 1115 nf_queue_entry_free(entry_seg); 1116 } 1117 return ret; 1118 } 1119 1120 static int 1121 nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum) 1122 { 1123 struct sk_buff *skb, *segs, *nskb; 1124 bool ct_is_unconfirmed = false; 1125 struct nfqnl_instance *queue; 1126 unsigned int queued; 1127 int err = -ENOBUFS; 1128 struct net *net = entry->state.net; 1129 struct nfnl_queue_net *q = nfnl_queue_pernet(net); 1130 1131 /* rcu_read_lock()ed by nf_hook_thresh */ 1132 queue = instance_lookup(q, queuenum); 1133 if (!queue) 1134 return -ESRCH; 1135 1136 if (queue->copy_mode == NFQNL_COPY_NONE) 1137 return -EINVAL; 1138 1139 skb = entry->skb; 1140 1141 switch (entry->state.pf) { 1142 case NFPROTO_IPV4: 1143 skb->protocol = htons(ETH_P_IP); 1144 break; 1145 case NFPROTO_IPV6: 1146 skb->protocol = htons(ETH_P_IPV6); 1147 break; 1148 } 1149 1150 /* Check if someone already holds another reference to 1151 * unconfirmed ct. If so, we cannot queue the skb: 1152 * concurrent modifications of nf_conn->ext are not 1153 * allowed and we can't know if another CPU isn't 1154 * processing the same nf_conn entry in parallel. 1155 */ 1156 if (nf_ct_drop_unconfirmed(entry, &ct_is_unconfirmed)) 1157 return -EINVAL; 1158 1159 if (!skb_is_gso(skb) || ((queue->flags & NFQA_CFG_F_GSO) && !skb_is_gso_sctp(skb))) 1160 return __nfqnl_enqueue_packet(net, queue, entry); 1161 1162 nf_bridge_adjust_skb_data(skb); 1163 segs = skb_gso_segment(skb, 0); 1164 /* Does not use PTR_ERR to limit the number of error codes that can be 1165 * returned by nf_queue. For instance, callers rely on -ESRCH to 1166 * mean 'ignore this hook'. 1167 */ 1168 if (IS_ERR_OR_NULL(segs)) 1169 goto out_err; 1170 queued = 0; 1171 err = 0; 1172 1173 skb_list_walk_safe(segs, segs, nskb) { 1174 if (ct_is_unconfirmed && queued > 0) { 1175 /* skb_gso_segment() increments the ct refcount. 1176 * This is a problem for unconfirmed (not in hash) 1177 * entries, those can race when reinjections happen 1178 * in parallel. 1179 * 1180 * Annotate this for all queued entries except the 1181 * first one. 1182 * 1183 * As long as the first one is reinjected first it 1184 * will do the confirmation for us. 1185 */ 1186 entry->nf_ct_is_unconfirmed = ct_is_unconfirmed; 1187 } 1188 1189 if (err == 0) 1190 err = __nfqnl_enqueue_packet_gso(net, queue, 1191 segs, entry); 1192 if (err == 0) 1193 queued++; 1194 else 1195 kfree_skb(segs); 1196 } 1197 1198 if (queued) { 1199 if (err) /* some segments are already queued */ 1200 nf_queue_entry_free(entry); 1201 kfree_skb(skb); 1202 return 0; 1203 } 1204 out_err: 1205 nf_bridge_adjust_segmented_data(skb); 1206 return err; 1207 } 1208 1209 static bool nfqnl_validate_ipopts(const struct iphdr *iph_new, 1210 const struct nf_queue_entry *e) 1211 { 1212 const struct iphdr *iph_orig = ip_hdr(e->skb); 1213 unsigned int ihl = iph_new->ihl * 4; 1214 1215 if (iph_new->ihl != iph_orig->ihl) 1216 return false; 1217 if (ihl == sizeof(*iph_orig)) 1218 return true; 1219 1220 return memcmp(iph_new + 1, ip_hdr(e->skb) + 1, ihl - sizeof(*iph_orig)) == 0; 1221 } 1222 1223 static bool nfqnl_validate_l4(const u8 *data, unsigned int data_len, 1224 const struct nf_queue_entry *e, u8 proto, 1225 bool fragment) 1226 { 1227 #if IS_ENABLED(CONFIG_NF_CONNTRACK) 1228 enum ip_conntrack_info ctinfo; 1229 const struct nf_conn *ct; 1230 1231 ct = nf_ct_get(e->skb, &ctinfo); 1232 if (ct && !nf_ct_is_template(ct)) { 1233 if (fragment || nf_ct_protonum(ct) != proto) 1234 return false; 1235 } 1236 #endif 1237 1238 if (fragment) 1239 return true; 1240 1241 switch (proto) { 1242 case IPPROTO_TCP: { 1243 const struct tcphdr *th = (const struct tcphdr *)data; 1244 unsigned int thlen; 1245 1246 if (data_len < sizeof(*th)) 1247 return false; 1248 1249 thlen = __tcp_hdrlen(th); 1250 if (thlen < sizeof(*th) || data_len < thlen) 1251 return false; 1252 1253 return true; 1254 } 1255 case IPPROTO_UDP: 1256 return data_len >= sizeof(struct udphdr); 1257 case IPPROTO_ICMP: 1258 return data_len >= sizeof(struct icmphdr); 1259 case IPPROTO_ICMPV6: 1260 return data_len >= sizeof(struct icmp6hdr); 1261 case IPPROTO_SCTP: 1262 return data_len >= sizeof(struct sctphdr); 1263 case IPPROTO_GRE: 1264 return data_len >= sizeof(struct gre_base_hdr); 1265 case IPPROTO_AH: 1266 return data_len >= sizeof(struct ip_auth_hdr); 1267 case IPPROTO_ESP: 1268 return data_len >= sizeof(struct ip_esp_hdr); 1269 } 1270 1271 return true; 1272 } 1273 1274 static bool nfqnl_validate_ip4(const struct iphdr *iph, unsigned int data_len, 1275 const struct nf_queue_entry *e) 1276 { 1277 unsigned int ihl; 1278 bool fragment; 1279 1280 if (data_len < sizeof(*iph)) 1281 return false; 1282 1283 ihl = iph->ihl * 4u; 1284 if (ihl < sizeof(*iph) || data_len < ihl) 1285 return false; 1286 1287 if (iph->version != 4 || 1288 ((iph->frag_off ^ ip_hdr(e->skb)->frag_off) & ~htons(IP_DF)) != 0) 1289 return false; 1290 1291 /* BIG TCP won't work; netlink attr len is u16 */ 1292 if (ntohs(iph->tot_len) != data_len) 1293 return false; 1294 1295 fragment = iph->frag_off & htons(IP_MF | IP_OFFSET); 1296 1297 /* support for ipopts mangling would require 1298 * recompile + skb transport header update. 1299 */ 1300 return nfqnl_validate_ipopts(iph, e) && 1301 nfqnl_validate_l4((const u8 *)iph + ihl, data_len - ihl, e, 1302 iph->protocol, fragment); 1303 } 1304 1305 static bool nfqnl_validate_one_exthdr(const u8 *data, 1306 unsigned int data_len, 1307 const struct nf_queue_entry *e, 1308 int start, int hdrlen) 1309 { 1310 u16 octets; 1311 1312 if (data_len < hdrlen || hdrlen < 2) 1313 return false; 1314 1315 while (hdrlen > 0) { 1316 if (data_len < sizeof(octets)) 1317 return false; 1318 data_len -= sizeof(octets); 1319 1320 if (skb_copy_bits(e->skb, start, &octets, sizeof(octets))) 1321 return false; 1322 1323 if (hdrlen < sizeof(octets)) 1324 return false; 1325 1326 hdrlen -= sizeof(octets); 1327 if (memcmp(data, &octets, sizeof(octets))) 1328 return false; 1329 1330 start += sizeof(octets); 1331 data += sizeof(octets); 1332 } 1333 1334 return true; 1335 } 1336 1337 static bool nfqnl_validate_exthdr(const struct ipv6hdr *ip6_new, 1338 unsigned int data_len, 1339 const struct nf_queue_entry *e) 1340 { 1341 const struct ipv6hdr *ip6_orig = ipv6_hdr(e->skb); 1342 int exthdr_cnt = 0, start = sizeof(*ip6_orig); 1343 const u8 *data = (const u8 *)ip6_new; 1344 u8 orig_nexthdr = ip6_orig->nexthdr; 1345 u8 new_nexthdr = ip6_new->nexthdr; 1346 bool fragment = false; 1347 1348 if (new_nexthdr != orig_nexthdr) 1349 return false; 1350 1351 data += sizeof(*ip6_new); 1352 data_len -= sizeof(*ip6_new); 1353 1354 while (ipv6_ext_hdr(orig_nexthdr)) { 1355 const struct ipv6_opt_hdr *hp; 1356 struct ipv6_opt_hdr _hdr; 1357 int hdrlen; 1358 1359 if (orig_nexthdr == NEXTHDR_NONE) 1360 return nfqnl_validate_l4(data, data_len, e, 1361 new_nexthdr, fragment); 1362 1363 if (unlikely(exthdr_cnt++ >= IP6_MAX_EXT_HDRS_CNT)) 1364 return false; 1365 1366 hp = skb_header_pointer(e->skb, start, sizeof(_hdr), &_hdr); 1367 if (!hp) 1368 return false; 1369 1370 switch (orig_nexthdr) { 1371 case NEXTHDR_FRAGMENT: 1372 fragment = true; 1373 hdrlen = sizeof(struct frag_hdr); 1374 break; 1375 case NEXTHDR_AUTH: 1376 hdrlen = ipv6_authlen(hp); 1377 break; 1378 default: 1379 hdrlen = ipv6_optlen(hp); 1380 break; 1381 } 1382 1383 if (!nfqnl_validate_one_exthdr(data, data_len, e, 1384 start, hdrlen)) 1385 return false; 1386 1387 orig_nexthdr = hp->nexthdr; 1388 hp = (const void *)data; 1389 new_nexthdr = hp->nexthdr; 1390 1391 if (new_nexthdr != orig_nexthdr) 1392 return false; 1393 1394 data_len -= hdrlen; 1395 start += hdrlen; 1396 data += hdrlen; 1397 } 1398 1399 return nfqnl_validate_l4(data, data_len, e, new_nexthdr, fragment); 1400 } 1401 1402 static bool nfqnl_validate_ip6(const struct ipv6hdr *ip6, unsigned int data_len, 1403 const struct nf_queue_entry *e) 1404 { 1405 if (data_len < sizeof(*ip6)) 1406 return false; 1407 1408 /* BIG TCP/jumbograms won't work; netlink attr len is u16 */ 1409 if (ntohs(ip6->payload_len) != data_len - sizeof(*ip6)) 1410 return false; 1411 1412 if (ip6->version != 6) 1413 return false; 1414 1415 return nfqnl_validate_exthdr(ip6, data_len, e); 1416 } 1417 1418 static bool nfqnl_validate_write(const void *data, unsigned int data_len, 1419 const struct nf_queue_entry *e) 1420 { 1421 switch (e->state.pf) { 1422 case NFPROTO_IPV4: 1423 return nfqnl_validate_ip4(data, data_len, e); 1424 case NFPROTO_IPV6: 1425 return nfqnl_validate_ip6(data, data_len, e) && 1426 !(IP6CB(e->skb)->flags & IP6SKB_JUMBOGRAM); 1427 case NFPROTO_BRIDGE: 1428 /* No write support. Bridge is dubious: userspace doesn't even see L2 header */ 1429 return false; 1430 } 1431 1432 return false; 1433 } 1434 1435 static int 1436 nfqnl_mangle(void *data, unsigned int data_len, struct nf_queue_entry *e, int diff) 1437 { 1438 struct sk_buff *nskb; 1439 1440 if (e->state.net->user_ns != &init_user_ns) 1441 return -EPERM; 1442 1443 if (!nfqnl_validate_write(data, data_len, e)) 1444 return -EINVAL; 1445 1446 if (diff < 0) { 1447 unsigned int min_len = skb_transport_offset(e->skb); 1448 1449 if (data_len < min_len) 1450 return -EINVAL; 1451 1452 if (pskb_trim(e->skb, data_len)) 1453 return -ENOMEM; 1454 } else if (diff > 0) { 1455 if (data_len > 0xFFFF) 1456 return -EINVAL; 1457 if (diff > skb_tailroom(e->skb)) { 1458 nskb = skb_copy_expand(e->skb, skb_headroom(e->skb), 1459 diff, GFP_ATOMIC); 1460 if (!nskb) 1461 return -ENOMEM; 1462 kfree_skb(e->skb); 1463 e->skb = nskb; 1464 } 1465 skb_put(e->skb, diff); 1466 } 1467 if (skb_ensure_writable(e->skb, data_len)) 1468 return -ENOMEM; 1469 skb_copy_to_linear_data(e->skb, data, data_len); 1470 e->skb->ip_summed = CHECKSUM_NONE; 1471 return 0; 1472 } 1473 1474 static int 1475 nfqnl_set_mode(struct nfqnl_instance *queue, 1476 unsigned char mode, unsigned int range) 1477 { 1478 int status = 0; 1479 1480 spin_lock_bh(&queue->lock); 1481 switch (mode) { 1482 case NFQNL_COPY_NONE: 1483 case NFQNL_COPY_META: 1484 queue->copy_mode = mode; 1485 queue->copy_range = 0; 1486 break; 1487 1488 case NFQNL_COPY_PACKET: 1489 queue->copy_mode = mode; 1490 if (range == 0 || range > NFQNL_MAX_COPY_RANGE) 1491 queue->copy_range = NFQNL_MAX_COPY_RANGE; 1492 else 1493 queue->copy_range = range; 1494 break; 1495 1496 default: 1497 status = -EINVAL; 1498 1499 } 1500 spin_unlock_bh(&queue->lock); 1501 1502 return status; 1503 } 1504 1505 static int 1506 dev_cmp(struct nf_queue_entry *entry, unsigned long ifindex) 1507 { 1508 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) 1509 int physinif, physoutif; 1510 1511 physinif = nf_bridge_get_physinif(entry->skb); 1512 physoutif = nf_bridge_get_physoutif(entry->skb); 1513 1514 if (physinif == ifindex || physoutif == ifindex) 1515 return 1; 1516 1517 if (entry->bridge_dev && entry->bridge_dev->ifindex == ifindex) 1518 return 1; 1519 #endif 1520 if (entry->skb_dev && entry->skb_dev->ifindex == ifindex) 1521 return 1; 1522 if (entry->state.in) 1523 if (entry->state.in->ifindex == ifindex) 1524 return 1; 1525 if (entry->state.out) 1526 if (entry->state.out->ifindex == ifindex) 1527 return 1; 1528 1529 return 0; 1530 } 1531 1532 /* drop all packets with either indev or outdev == ifindex from all queue 1533 * instances */ 1534 static void 1535 nfqnl_dev_drop(struct net *net, int ifindex) 1536 { 1537 int i; 1538 struct nfnl_queue_net *q = nfnl_queue_pernet(net); 1539 1540 rcu_read_lock(); 1541 1542 for (i = 0; i < INSTANCE_BUCKETS; i++) { 1543 struct nfqnl_instance *inst; 1544 struct hlist_head *head = &q->instance_table[i]; 1545 1546 hlist_for_each_entry_rcu(inst, head, hlist) 1547 nfqnl_flush(inst, dev_cmp, ifindex); 1548 } 1549 1550 rcu_read_unlock(); 1551 } 1552 1553 static int 1554 nfqnl_rcv_dev_event(struct notifier_block *this, 1555 unsigned long event, void *ptr) 1556 { 1557 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 1558 1559 /* Drop any packets associated with the downed device */ 1560 if (event == NETDEV_DOWN) 1561 nfqnl_dev_drop(dev_net(dev), dev->ifindex); 1562 return NOTIFY_DONE; 1563 } 1564 1565 static struct notifier_block nfqnl_dev_notifier = { 1566 .notifier_call = nfqnl_rcv_dev_event, 1567 }; 1568 1569 static void nfqnl_nf_hook_drop(struct net *net) 1570 { 1571 struct nfnl_queue_net *q = nfnl_queue_pernet(net); 1572 int i; 1573 1574 /* This function is also called on net namespace error unwind, 1575 * when pernet_ops->init() failed and ->exit() functions of the 1576 * previous pernet_ops gets called. 1577 * 1578 * This may result in a call to nfqnl_nf_hook_drop() before 1579 * struct nfnl_queue_net was allocated. 1580 */ 1581 if (!q) 1582 return; 1583 1584 for (i = 0; i < INSTANCE_BUCKETS; i++) { 1585 struct nfqnl_instance *inst; 1586 struct hlist_head *head = &q->instance_table[i]; 1587 1588 hlist_for_each_entry_rcu(inst, head, hlist) 1589 nfqnl_flush(inst, NULL, 0); 1590 } 1591 } 1592 1593 static int 1594 nfqnl_rcv_nl_event(struct notifier_block *this, 1595 unsigned long event, void *ptr) 1596 { 1597 struct netlink_notify *n = ptr; 1598 struct nfnl_queue_net *q = nfnl_queue_pernet(n->net); 1599 1600 if (event == NETLINK_URELEASE && n->protocol == NETLINK_NETFILTER) { 1601 int i; 1602 1603 nfnl_lock(NFNL_SUBSYS_QUEUE); 1604 /* destroy all instances for this portid */ 1605 spin_lock(&q->instances_lock); 1606 for (i = 0; i < INSTANCE_BUCKETS; i++) { 1607 struct hlist_node *t2; 1608 struct nfqnl_instance *inst; 1609 struct hlist_head *head = &q->instance_table[i]; 1610 1611 hlist_for_each_entry_safe(inst, t2, head, hlist) { 1612 if (n->portid == inst->peer_portid) 1613 __instance_destroy(inst); 1614 } 1615 } 1616 spin_unlock(&q->instances_lock); 1617 nfnl_unlock(NFNL_SUBSYS_QUEUE); 1618 } 1619 return NOTIFY_DONE; 1620 } 1621 1622 static struct notifier_block nfqnl_rtnl_notifier = { 1623 .notifier_call = nfqnl_rcv_nl_event, 1624 }; 1625 1626 static const struct nla_policy nfqa_vlan_policy[NFQA_VLAN_MAX + 1] = { 1627 [NFQA_VLAN_TCI] = { .type = NLA_U16}, 1628 [NFQA_VLAN_PROTO] = { .type = NLA_U16}, 1629 }; 1630 1631 static const struct nla_policy nfqa_verdict_policy[NFQA_MAX+1] = { 1632 [NFQA_VERDICT_HDR] = { .len = sizeof(struct nfqnl_msg_verdict_hdr) }, 1633 [NFQA_MARK] = { .type = NLA_U32 }, 1634 [NFQA_PAYLOAD] = { .type = NLA_UNSPEC }, 1635 [NFQA_CT] = { .type = NLA_UNSPEC }, 1636 [NFQA_EXP] = { .type = NLA_UNSPEC }, 1637 [NFQA_VLAN] = { .type = NLA_NESTED }, 1638 [NFQA_PRIORITY] = { .type = NLA_U32 }, 1639 }; 1640 1641 static const struct nla_policy nfqa_verdict_batch_policy[NFQA_MAX+1] = { 1642 [NFQA_VERDICT_HDR] = { .len = sizeof(struct nfqnl_msg_verdict_hdr) }, 1643 [NFQA_MARK] = { .type = NLA_U32 }, 1644 [NFQA_PRIORITY] = { .type = NLA_U32 }, 1645 }; 1646 1647 static struct nfqnl_instance * 1648 verdict_instance_lookup(struct nfnl_queue_net *q, u16 queue_num, u32 nlportid) 1649 { 1650 struct nfqnl_instance *queue; 1651 1652 queue = instance_lookup(q, queue_num); 1653 if (!queue) 1654 return ERR_PTR(-ENODEV); 1655 1656 if (queue->peer_portid != nlportid) 1657 return ERR_PTR(-EPERM); 1658 1659 return queue; 1660 } 1661 1662 static struct nfqnl_msg_verdict_hdr* 1663 verdicthdr_get(const struct nlattr * const nfqa[]) 1664 { 1665 struct nfqnl_msg_verdict_hdr *vhdr; 1666 unsigned int verdict; 1667 1668 if (!nfqa[NFQA_VERDICT_HDR]) 1669 return NULL; 1670 1671 vhdr = nla_data(nfqa[NFQA_VERDICT_HDR]); 1672 verdict = ntohl(vhdr->verdict) & NF_VERDICT_MASK; 1673 if (verdict > NF_MAX_VERDICT || verdict == NF_STOLEN) 1674 return NULL; 1675 return vhdr; 1676 } 1677 1678 static int nfq_id_after(unsigned int id, unsigned int max) 1679 { 1680 return (int)(id - max) > 0; 1681 } 1682 1683 static int nfqnl_recv_verdict_batch(struct sk_buff *skb, 1684 const struct nfnl_info *info, 1685 const struct nlattr * const nfqa[]) 1686 { 1687 struct nfnl_queue_net *q = nfnl_queue_pernet(info->net); 1688 u16 queue_num = ntohs(info->nfmsg->res_id); 1689 struct nf_queue_entry *entry, *tmp; 1690 struct nfqnl_msg_verdict_hdr *vhdr; 1691 struct nfqnl_instance *queue; 1692 unsigned int verdict, maxid; 1693 LIST_HEAD(batch_list); 1694 1695 queue = verdict_instance_lookup(q, queue_num, 1696 NETLINK_CB(skb).portid); 1697 if (IS_ERR(queue)) 1698 return PTR_ERR(queue); 1699 1700 vhdr = verdicthdr_get(nfqa); 1701 if (!vhdr) 1702 return -EINVAL; 1703 1704 verdict = ntohl(vhdr->verdict); 1705 maxid = ntohl(vhdr->id); 1706 1707 spin_lock_bh(&queue->lock); 1708 1709 list_for_each_entry_safe(entry, tmp, &queue->queue_list, list) { 1710 if (nfq_id_after(entry->id, maxid)) 1711 break; 1712 __dequeue_entry(queue, entry); 1713 list_add_tail(&entry->list, &batch_list); 1714 } 1715 1716 spin_unlock_bh(&queue->lock); 1717 1718 if (list_empty(&batch_list)) 1719 return -ENOENT; 1720 1721 list_for_each_entry_safe(entry, tmp, &batch_list, list) { 1722 if (nfqa[NFQA_MARK]) 1723 entry->skb->mark = ntohl(nla_get_be32(nfqa[NFQA_MARK])); 1724 1725 if (nfqa[NFQA_PRIORITY]) 1726 entry->skb->priority = ntohl(nla_get_be32(nfqa[NFQA_PRIORITY])); 1727 1728 nfqnl_reinject(entry, verdict); 1729 } 1730 return 0; 1731 } 1732 1733 static struct nf_conn *nfqnl_ct_parse(const struct nfnl_ct_hook *nfnl_ct, 1734 const struct nlmsghdr *nlh, 1735 const struct nlattr * const nfqa[], 1736 struct nf_queue_entry *entry, 1737 enum ip_conntrack_info *ctinfo) 1738 { 1739 #if IS_ENABLED(CONFIG_NF_CONNTRACK) 1740 struct nf_conn *ct; 1741 1742 ct = nf_ct_get(entry->skb, ctinfo); 1743 if (ct == NULL) 1744 return NULL; 1745 1746 if (nfnl_ct->parse(nfqa[NFQA_CT], ct) < 0) 1747 return NULL; 1748 1749 if (nfqa[NFQA_EXP]) 1750 nfnl_ct->attach_expect(nfqa[NFQA_EXP], ct, 1751 NETLINK_CB(entry->skb).portid, 1752 nlmsg_report(nlh)); 1753 return ct; 1754 #else 1755 return NULL; 1756 #endif 1757 } 1758 1759 static int nfqa_parse_bridge(struct nf_queue_entry *entry, 1760 const struct nlattr * const nfqa[]) 1761 { 1762 if (nfqa[NFQA_VLAN]) { 1763 struct nlattr *tb[NFQA_VLAN_MAX + 1]; 1764 int err; 1765 1766 err = nla_parse_nested_deprecated(tb, NFQA_VLAN_MAX, 1767 nfqa[NFQA_VLAN], 1768 nfqa_vlan_policy, NULL); 1769 if (err < 0) 1770 return err; 1771 1772 if (!tb[NFQA_VLAN_TCI] || !tb[NFQA_VLAN_PROTO]) 1773 return -EINVAL; 1774 1775 __vlan_hwaccel_put_tag(entry->skb, 1776 nla_get_be16(tb[NFQA_VLAN_PROTO]), 1777 ntohs(nla_get_be16(tb[NFQA_VLAN_TCI]))); 1778 } 1779 1780 if (nfqa[NFQA_L2HDR]) { 1781 u32 mac_header_len = skb_mac_header_len(entry->skb); 1782 1783 if (mac_header_len != nla_len(nfqa[NFQA_L2HDR])) 1784 return -EINVAL; 1785 else if (mac_header_len > 0) 1786 memcpy(skb_mac_header(entry->skb), 1787 nla_data(nfqa[NFQA_L2HDR]), 1788 mac_header_len); 1789 } 1790 1791 return 0; 1792 } 1793 1794 static int nfqnl_recv_verdict(struct sk_buff *skb, const struct nfnl_info *info, 1795 const struct nlattr * const nfqa[]) 1796 { 1797 struct nfnl_queue_net *q = nfnl_queue_pernet(info->net); 1798 u_int16_t queue_num = ntohs(info->nfmsg->res_id); 1799 const struct nfnl_ct_hook *nfnl_ct; 1800 struct nfqnl_msg_verdict_hdr *vhdr; 1801 enum ip_conntrack_info ctinfo; 1802 struct nfqnl_instance *queue; 1803 struct nf_queue_entry *entry; 1804 struct nf_conn *ct = NULL; 1805 unsigned int verdict; 1806 int err; 1807 1808 queue = verdict_instance_lookup(q, queue_num, 1809 NETLINK_CB(skb).portid); 1810 if (IS_ERR(queue)) 1811 return PTR_ERR(queue); 1812 1813 vhdr = verdicthdr_get(nfqa); 1814 if (!vhdr) 1815 return -EINVAL; 1816 1817 verdict = ntohl(vhdr->verdict); 1818 1819 entry = find_dequeue_entry(queue, ntohl(vhdr->id)); 1820 if (entry == NULL) 1821 return -ENOENT; 1822 1823 /* rcu lock already held from nfnl->call_rcu. */ 1824 nfnl_ct = rcu_dereference(nfnl_ct_hook); 1825 1826 if (nfqa[NFQA_CT]) { 1827 if (nfnl_ct != NULL) 1828 ct = nfqnl_ct_parse(nfnl_ct, info->nlh, nfqa, entry, 1829 &ctinfo); 1830 } 1831 1832 if (entry->state.pf == PF_BRIDGE) { 1833 err = nfqa_parse_bridge(entry, nfqa); 1834 if (err < 0) { 1835 nfqnl_reinject(entry, NF_DROP); 1836 return err; 1837 } 1838 } 1839 1840 if (nfqa[NFQA_PAYLOAD]) { 1841 u16 payload_len = nla_len(nfqa[NFQA_PAYLOAD]); 1842 int diff = payload_len - entry->skb->len; 1843 1844 if (nfqnl_mangle(nla_data(nfqa[NFQA_PAYLOAD]), 1845 payload_len, entry, diff) < 0) 1846 verdict = NF_DROP; 1847 else if (ct && diff) 1848 nfnl_ct->seq_adjust(entry->skb, ct, ctinfo, diff); 1849 } 1850 1851 if (nfqa[NFQA_MARK]) 1852 entry->skb->mark = ntohl(nla_get_be32(nfqa[NFQA_MARK])); 1853 1854 if (nfqa[NFQA_PRIORITY]) 1855 entry->skb->priority = ntohl(nla_get_be32(nfqa[NFQA_PRIORITY])); 1856 1857 nfqnl_reinject(entry, verdict); 1858 return 0; 1859 } 1860 1861 static int nfqnl_recv_unsupp(struct sk_buff *skb, const struct nfnl_info *info, 1862 const struct nlattr * const cda[]) 1863 { 1864 return -ENOTSUPP; 1865 } 1866 1867 static const struct nla_policy nfqa_cfg_policy[NFQA_CFG_MAX+1] = { 1868 [NFQA_CFG_CMD] = { .len = sizeof(struct nfqnl_msg_config_cmd) }, 1869 [NFQA_CFG_PARAMS] = { .len = sizeof(struct nfqnl_msg_config_params) }, 1870 [NFQA_CFG_QUEUE_MAXLEN] = { .type = NLA_U32 }, 1871 [NFQA_CFG_MASK] = { .type = NLA_U32 }, 1872 [NFQA_CFG_FLAGS] = NLA_POLICY_MASK(NLA_BE32, NFQA_CFG_F_MAX - 1), 1873 }; 1874 1875 static const struct nf_queue_handler nfqh = { 1876 .outfn = nfqnl_enqueue_packet, 1877 .nf_hook_drop = nfqnl_nf_hook_drop, 1878 }; 1879 1880 static int nfqnl_recv_config(struct sk_buff *skb, const struct nfnl_info *info, 1881 const struct nlattr * const nfqa[]) 1882 { 1883 struct nfnl_queue_net *q = nfnl_queue_pernet(info->net); 1884 u_int16_t queue_num = ntohs(info->nfmsg->res_id); 1885 struct nfqnl_msg_config_cmd *cmd = NULL; 1886 struct nfqnl_instance *queue; 1887 __u32 flags = 0, mask = 0; 1888 1889 WARN_ON_ONCE(!lockdep_nfnl_is_held(NFNL_SUBSYS_QUEUE)); 1890 1891 if (nfqa[NFQA_CFG_CMD]) { 1892 cmd = nla_data(nfqa[NFQA_CFG_CMD]); 1893 1894 /* Obsolete commands without queue context */ 1895 switch (cmd->command) { 1896 case NFQNL_CFG_CMD_PF_BIND: return 0; 1897 case NFQNL_CFG_CMD_PF_UNBIND: return 0; 1898 } 1899 } 1900 1901 /* Check if we support these flags in first place, dependencies should 1902 * be there too not to break atomicity. 1903 */ 1904 if (nfqa[NFQA_CFG_FLAGS]) { 1905 if (!nfqa[NFQA_CFG_MASK]) { 1906 /* A mask is needed to specify which flags are being 1907 * changed. 1908 */ 1909 return -EINVAL; 1910 } 1911 1912 flags = ntohl(nla_get_be32(nfqa[NFQA_CFG_FLAGS])); 1913 mask = ntohl(nla_get_be32(nfqa[NFQA_CFG_MASK])); 1914 1915 if (flags >= NFQA_CFG_F_MAX) 1916 return -EOPNOTSUPP; 1917 1918 #if !IS_ENABLED(CONFIG_NETWORK_SECMARK) 1919 if (flags & mask & NFQA_CFG_F_SECCTX) 1920 return -EOPNOTSUPP; 1921 #endif 1922 if ((flags & mask & NFQA_CFG_F_CONNTRACK) && 1923 !rcu_access_pointer(nfnl_ct_hook)) { 1924 #ifdef CONFIG_MODULES 1925 nfnl_unlock(NFNL_SUBSYS_QUEUE); 1926 request_module("ip_conntrack_netlink"); 1927 nfnl_lock(NFNL_SUBSYS_QUEUE); 1928 if (rcu_access_pointer(nfnl_ct_hook)) 1929 return -EAGAIN; 1930 #endif 1931 return -EOPNOTSUPP; 1932 } 1933 } 1934 1935 /* Lookup queue under RCU. After peer_portid check (or for new queue 1936 * in BIND case), the queue is owned by the socket sending this message. 1937 * nfqnl_rcv_nl_event() will block on the nfnl subsys mutex that is 1938 * held by the caller, so the queue cannot be destroyed in parallel, 1939 * even after we drop the RCU read lock. 1940 */ 1941 rcu_read_lock(); 1942 queue = instance_lookup(q, queue_num); 1943 if (queue && queue->peer_portid != NETLINK_CB(skb).portid) { 1944 rcu_read_unlock(); 1945 return -EPERM; 1946 } 1947 rcu_read_unlock(); 1948 1949 if (cmd != NULL) { 1950 switch (cmd->command) { 1951 case NFQNL_CFG_CMD_BIND: 1952 if (queue) 1953 return -EBUSY; 1954 queue = instance_create(q, queue_num, NETLINK_CB(skb).portid); 1955 if (IS_ERR(queue)) 1956 return PTR_ERR(queue); 1957 break; 1958 case NFQNL_CFG_CMD_UNBIND: 1959 if (!queue) 1960 return -ENODEV; 1961 instance_destroy(q, queue); 1962 return 0; 1963 case NFQNL_CFG_CMD_PF_BIND: 1964 case NFQNL_CFG_CMD_PF_UNBIND: 1965 break; 1966 default: 1967 return -EOPNOTSUPP; 1968 } 1969 } 1970 1971 if (!queue) 1972 return -ENODEV; 1973 1974 if (nfqa[NFQA_CFG_PARAMS]) { 1975 struct nfqnl_msg_config_params *params = 1976 nla_data(nfqa[NFQA_CFG_PARAMS]); 1977 1978 nfqnl_set_mode(queue, params->copy_mode, 1979 ntohl(params->copy_range)); 1980 } 1981 1982 if (nfqa[NFQA_CFG_QUEUE_MAXLEN]) { 1983 __be32 *queue_maxlen = nla_data(nfqa[NFQA_CFG_QUEUE_MAXLEN]); 1984 1985 spin_lock_bh(&queue->lock); 1986 queue->queue_maxlen = ntohl(*queue_maxlen); 1987 spin_unlock_bh(&queue->lock); 1988 } 1989 1990 if (nfqa[NFQA_CFG_FLAGS]) { 1991 spin_lock_bh(&queue->lock); 1992 queue->flags &= ~mask; 1993 queue->flags |= flags & mask; 1994 spin_unlock_bh(&queue->lock); 1995 } 1996 1997 return 0; 1998 } 1999 2000 static const struct nfnl_callback nfqnl_cb[NFQNL_MSG_MAX] = { 2001 [NFQNL_MSG_PACKET] = { 2002 .call = nfqnl_recv_unsupp, 2003 .type = NFNL_CB_RCU, 2004 .attr_count = NFQA_MAX, 2005 }, 2006 [NFQNL_MSG_VERDICT] = { 2007 .call = nfqnl_recv_verdict, 2008 .type = NFNL_CB_RCU, 2009 .attr_count = NFQA_MAX, 2010 .policy = nfqa_verdict_policy 2011 }, 2012 [NFQNL_MSG_CONFIG] = { 2013 .call = nfqnl_recv_config, 2014 .type = NFNL_CB_MUTEX, 2015 .attr_count = NFQA_CFG_MAX, 2016 .policy = nfqa_cfg_policy 2017 }, 2018 [NFQNL_MSG_VERDICT_BATCH] = { 2019 .call = nfqnl_recv_verdict_batch, 2020 .type = NFNL_CB_RCU, 2021 .attr_count = NFQA_MAX, 2022 .policy = nfqa_verdict_batch_policy 2023 }, 2024 }; 2025 2026 static const struct nfnetlink_subsystem nfqnl_subsys = { 2027 .name = "nf_queue", 2028 .subsys_id = NFNL_SUBSYS_QUEUE, 2029 .cb_count = NFQNL_MSG_MAX, 2030 .cb = nfqnl_cb, 2031 }; 2032 2033 #ifdef CONFIG_PROC_FS 2034 struct iter_state { 2035 struct seq_net_private p; 2036 unsigned int bucket; 2037 }; 2038 2039 static struct hlist_node *get_first(struct seq_file *seq) 2040 { 2041 struct iter_state *st = seq->private; 2042 struct net *net; 2043 struct nfnl_queue_net *q; 2044 2045 if (!st) 2046 return NULL; 2047 2048 net = seq_file_net(seq); 2049 q = nfnl_queue_pernet(net); 2050 for (st->bucket = 0; st->bucket < INSTANCE_BUCKETS; st->bucket++) { 2051 if (!hlist_empty(&q->instance_table[st->bucket])) 2052 return q->instance_table[st->bucket].first; 2053 } 2054 return NULL; 2055 } 2056 2057 static struct hlist_node *get_next(struct seq_file *seq, struct hlist_node *h) 2058 { 2059 struct iter_state *st = seq->private; 2060 struct net *net = seq_file_net(seq); 2061 2062 h = h->next; 2063 while (!h) { 2064 struct nfnl_queue_net *q; 2065 2066 if (++st->bucket >= INSTANCE_BUCKETS) 2067 return NULL; 2068 2069 q = nfnl_queue_pernet(net); 2070 h = q->instance_table[st->bucket].first; 2071 } 2072 return h; 2073 } 2074 2075 static struct hlist_node *get_idx(struct seq_file *seq, loff_t pos) 2076 { 2077 struct hlist_node *head; 2078 head = get_first(seq); 2079 2080 if (head) 2081 while (pos && (head = get_next(seq, head))) 2082 pos--; 2083 return pos ? NULL : head; 2084 } 2085 2086 static void *seq_start(struct seq_file *s, loff_t *pos) 2087 __acquires(nfnl_queue_pernet(seq_file_net(s))->instances_lock) 2088 { 2089 spin_lock(&nfnl_queue_pernet(seq_file_net(s))->instances_lock); 2090 return get_idx(s, *pos); 2091 } 2092 2093 static void *seq_next(struct seq_file *s, void *v, loff_t *pos) 2094 { 2095 (*pos)++; 2096 return get_next(s, v); 2097 } 2098 2099 static void seq_stop(struct seq_file *s, void *v) 2100 __releases(nfnl_queue_pernet(seq_file_net(s))->instances_lock) 2101 { 2102 spin_unlock(&nfnl_queue_pernet(seq_file_net(s))->instances_lock); 2103 } 2104 2105 static int seq_show(struct seq_file *s, void *v) 2106 { 2107 const struct nfqnl_instance *inst = v; 2108 2109 seq_printf(s, "%5u %6u %5u %1u %5u %5u %5u %8u %2d\n", 2110 inst->queue_num, 2111 inst->peer_portid, inst->queue_total, 2112 inst->copy_mode, inst->copy_range, 2113 inst->queue_dropped, inst->queue_user_dropped, 2114 inst->id_sequence, 1); 2115 return 0; 2116 } 2117 2118 static const struct seq_operations nfqnl_seq_ops = { 2119 .start = seq_start, 2120 .next = seq_next, 2121 .stop = seq_stop, 2122 .show = seq_show, 2123 }; 2124 #endif /* PROC_FS */ 2125 2126 static int __net_init nfnl_queue_net_init(struct net *net) 2127 { 2128 unsigned int i; 2129 struct nfnl_queue_net *q = nfnl_queue_pernet(net); 2130 2131 for (i = 0; i < INSTANCE_BUCKETS; i++) 2132 INIT_HLIST_HEAD(&q->instance_table[i]); 2133 2134 spin_lock_init(&q->instances_lock); 2135 2136 #ifdef CONFIG_PROC_FS 2137 if (!proc_create_net("nfnetlink_queue", 0440, net->nf.proc_netfilter, 2138 &nfqnl_seq_ops, sizeof(struct iter_state))) 2139 return -ENOMEM; 2140 #endif 2141 return 0; 2142 } 2143 2144 static void __net_exit nfnl_queue_net_exit(struct net *net) 2145 { 2146 struct nfnl_queue_net *q = nfnl_queue_pernet(net); 2147 unsigned int i; 2148 2149 #ifdef CONFIG_PROC_FS 2150 remove_proc_entry("nfnetlink_queue", net->nf.proc_netfilter); 2151 #endif 2152 for (i = 0; i < INSTANCE_BUCKETS; i++) 2153 WARN_ON_ONCE(!hlist_empty(&q->instance_table[i])); 2154 } 2155 2156 static struct pernet_operations nfnl_queue_net_ops = { 2157 .init = nfnl_queue_net_init, 2158 .exit = nfnl_queue_net_exit, 2159 .id = &nfnl_queue_net_id, 2160 .size = sizeof(struct nfnl_queue_net), 2161 }; 2162 2163 static int __init nfnetlink_queue_init(void) 2164 { 2165 int status; 2166 2167 nfq_cleanup_wq = alloc_ordered_workqueue("nfq_workqueue", 0); 2168 if (!nfq_cleanup_wq) 2169 return -ENOMEM; 2170 2171 status = register_pernet_subsys(&nfnl_queue_net_ops); 2172 if (status < 0) 2173 goto cleanup_pernet_subsys; 2174 2175 status = netlink_register_notifier(&nfqnl_rtnl_notifier); 2176 if (status < 0) 2177 goto cleanup_rtnl_notifier; 2178 2179 status = register_netdevice_notifier(&nfqnl_dev_notifier); 2180 if (status < 0) 2181 goto cleanup_dev_notifier; 2182 2183 status = nfnetlink_subsys_register(&nfqnl_subsys); 2184 if (status < 0) 2185 goto cleanup_nfqnl_subsys; 2186 2187 nf_register_queue_handler(&nfqh); 2188 2189 return status; 2190 2191 cleanup_nfqnl_subsys: 2192 unregister_netdevice_notifier(&nfqnl_dev_notifier); 2193 cleanup_dev_notifier: 2194 netlink_unregister_notifier(&nfqnl_rtnl_notifier); 2195 cleanup_rtnl_notifier: 2196 unregister_pernet_subsys(&nfnl_queue_net_ops); 2197 cleanup_pernet_subsys: 2198 destroy_workqueue(nfq_cleanup_wq); 2199 return status; 2200 } 2201 2202 static void __exit nfnetlink_queue_fini(void) 2203 { 2204 nf_unregister_queue_handler(); 2205 unregister_netdevice_notifier(&nfqnl_dev_notifier); 2206 nfnetlink_subsys_unregister(&nfqnl_subsys); 2207 netlink_unregister_notifier(&nfqnl_rtnl_notifier); 2208 unregister_pernet_subsys(&nfnl_queue_net_ops); 2209 destroy_workqueue(nfq_cleanup_wq); 2210 rcu_barrier(); /* Wait for completion of call_rcu()'s */ 2211 } 2212 2213 MODULE_DESCRIPTION("netfilter packet queue handler"); 2214 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>"); 2215 MODULE_LICENSE("GPL"); 2216 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_QUEUE); 2217 2218 module_init(nfnetlink_queue_init); 2219 module_exit(nfnetlink_queue_fini); 2220