projects/linux·blob master · refs

2219 lines · 54.1 KiB

1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * This is a module which is used for queueing packets and communicating with
4 * userspace via nfnetlink.
5 *
6 * (C) 2005 by Harald Welte <[email protected]>
7 * (C) 2007 by Patrick McHardy <[email protected]>
8 *
9 * Based on the old ipv4-only ip_queue.c:
10 * (C) 2000-2002 James Morris <[email protected]>
11 * (C) 2003-2005 Netfilter Core Team <[email protected]>
12 */
13
14#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
15
16#include <linux/module.h>
17#include <linux/skbuff.h>
18#include <linux/init.h>
19#include <linux/spinlock.h>
20#include <linux/slab.h>
21#include <linux/notifier.h>
22#include <linux/netdevice.h>
23#include <linux/netfilter.h>
24#include <linux/proc_fs.h>
25#include <linux/netfilter_ipv4.h>
26#include <linux/netfilter_ipv6.h>
27#include <linux/netfilter_bridge.h>
28#include <linux/netfilter/nfnetlink.h>
29#include <linux/netfilter/nfnetlink_queue.h>
30#include <linux/netfilter/nf_conntrack_common.h>
31#include <linux/icmp.h>
32#include <linux/icmpv6.h>
33#include <linux/ip.h>
34#include <linux/list.h>
35#include <linux/sctp.h>
36#include <linux/cgroup-defs.h>
37#include <linux/rhashtable.h>
38#include <linux/jhash.h>
39#include <linux/tcp.h>
40#include <linux/udp.h>
41#include <net/gre.h>
42#include <net/gso.h>
43#include <net/ip.h>
44#include <net/sock.h>
45#include <net/tcp_states.h>
46#include <net/netfilter/nf_queue.h>
47#include <net/netns/generic.h>
48
49#include <linux/atomic.h>
50
51#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
52#include "../bridge/br_private.h"
53#endif
54
55#if IS_ENABLED(CONFIG_NF_CONNTRACK)
56#include <net/netfilter/nf_conntrack.h>
57#endif
58
59#define NFQNL_QMAX_DEFAULT 1024
60#define NFQNL_HASH_MIN 8
61#define NFQNL_HASH_MAX 32768
62
63/* We're using struct nlattr which has 16bit nla_len. Note that nla_len
64 * includes the header length. Thus, the maximum packet length that we
65 * support is 65531 bytes. We send truncated packets if the specified length
66 * is larger than that. Userspace can check for presence of NFQA_CAP_LEN
67 * attribute to detect truncation.
68 */
69#define NFQNL_MAX_COPY_RANGE (0xffff - NLA_HDRLEN)
70
71struct nfqnl_instance {
72 struct hlist_node hlist; /* global list of queues */
73 struct rhashtable nfqnl_packet_map;
74 struct rcu_work rwork;
75
76 u32 peer_portid;
77 unsigned int queue_maxlen;
78 unsigned int copy_range;
79 unsigned int queue_dropped;
80 unsigned int queue_user_dropped;
81
82
83 u_int16_t queue_num; /* number of this queue */
84 u_int8_t copy_mode;
85 u_int32_t flags; /* Set using NFQA_CFG_FLAGS */
86/*
87 * Following fields are dirtied for each queued packet,
88 * keep them in same cache line if possible.
89 */
90 spinlock_t lock ____cacheline_aligned_in_smp;
91 unsigned int queue_total;
92 unsigned int id_sequence; /* 'sequence' of pkt ids */
93 struct list_head queue_list; /* packets in queue */
94};
95
96typedef int (*nfqnl_cmpfn)(struct nf_queue_entry *, unsigned long);
97
98static struct workqueue_struct *nfq_cleanup_wq __read_mostly;
99static unsigned int nfnl_queue_net_id __read_mostly;
100
101#define INSTANCE_BUCKETS 16
102struct nfnl_queue_net {
103 spinlock_t instances_lock;
104 struct hlist_head instance_table[INSTANCE_BUCKETS];
105};
106
107static struct nfnl_queue_net *nfnl_queue_pernet(struct net *net)
108{
109 return net_generic(net, nfnl_queue_net_id);
110}
111
112static inline u_int8_t instance_hashfn(u_int16_t queue_num)
113{
114 return ((queue_num >> 8) ^ queue_num) % INSTANCE_BUCKETS;
115}
116
117static const struct rhashtable_params nfqnl_rhashtable_params = {
118 .head_offset = offsetof(struct nf_queue_entry, hash_node),
119 .key_offset = offsetof(struct nf_queue_entry, id),
120 .key_len = sizeof(u32),
121 .automatic_shrinking = true,
122 .min_size = NFQNL_HASH_MIN,
123 .max_size = NFQNL_HASH_MAX,
124};
125
126static struct nfqnl_instance *
127instance_lookup(struct nfnl_queue_net *q, u_int16_t queue_num)
128{
129 struct hlist_head *head;
130 struct nfqnl_instance *inst;
131
132 head = &q->instance_table[instance_hashfn(queue_num)];
133 hlist_for_each_entry_rcu(inst, head, hlist) {
134 if (inst->queue_num == queue_num)
135 return inst;
136 }
137 return NULL;
138}
139
140static struct nfqnl_instance *
141instance_create(struct nfnl_queue_net *q, u_int16_t queue_num, u32 portid)
142{
143 struct nfqnl_instance *inst;
144 unsigned int h;
145 int err;
146
147 inst = kzalloc_obj(*inst, GFP_KERNEL_ACCOUNT);
148 if (!inst)
149 return ERR_PTR(-ENOMEM);
150
151 inst->queue_num = queue_num;
152 inst->peer_portid = portid;
153 inst->queue_maxlen = NFQNL_QMAX_DEFAULT;
154 inst->copy_range = NFQNL_MAX_COPY_RANGE;
155 inst->copy_mode = NFQNL_COPY_NONE;
156 spin_lock_init(&inst->lock);
157 INIT_LIST_HEAD(&inst->queue_list);
158
159 err = rhashtable_init(&inst->nfqnl_packet_map, &nfqnl_rhashtable_params);
160 if (err < 0)
161 goto out_free;
162
163 spin_lock(&q->instances_lock);
164 if (instance_lookup(q, queue_num)) {
165 err = -EEXIST;
166 goto out_unlock;
167 }
168
169 if (!try_module_get(THIS_MODULE)) {
170 err = -EAGAIN;
171 goto out_unlock;
172 }
173
174 h = instance_hashfn(queue_num);
175 hlist_add_head_rcu(&inst->hlist, &q->instance_table[h]);
176
177 spin_unlock(&q->instances_lock);
178
179 return inst;
180
181out_unlock:
182 spin_unlock(&q->instances_lock);
183 rhashtable_destroy(&inst->nfqnl_packet_map);
184out_free:
185 kfree(inst);
186 return ERR_PTR(err);
187}
188
189static void nfqnl_flush(struct nfqnl_instance *queue, nfqnl_cmpfn cmpfn,
190 unsigned long data);
191
192static void instance_destroy_work(struct work_struct *work)
193{
194 struct nfqnl_instance *inst;
195
196 inst = container_of(to_rcu_work(work), struct nfqnl_instance,
197 rwork);
198 rcu_read_lock();
199 nfqnl_flush(inst, NULL, 0);
200 rcu_read_unlock();
201
202 rhashtable_destroy(&inst->nfqnl_packet_map);
203
204 kfree(inst);
205 module_put(THIS_MODULE);
206}
207
208static void
209__instance_destroy(struct nfqnl_instance *inst)
210{
211 hlist_del_rcu(&inst->hlist);
212
213 INIT_RCU_WORK(&inst->rwork, instance_destroy_work);
214 queue_rcu_work(nfq_cleanup_wq, &inst->rwork);
215}
216
217static void
218instance_destroy(struct nfnl_queue_net *q, struct nfqnl_instance *inst)
219{
220 spin_lock(&q->instances_lock);
221 __instance_destroy(inst);
222 spin_unlock(&q->instances_lock);
223}
224
225static int
226__enqueue_entry(struct nfqnl_instance *queue, struct nf_queue_entry *entry)
227{
228 int err;
229
230 err = rhashtable_insert_fast(&queue->nfqnl_packet_map, &entry->hash_node,
231 nfqnl_rhashtable_params);
232 if (unlikely(err))
233 return err;
234
235 list_add_tail(&entry->list, &queue->queue_list);
236 queue->queue_total++;
237
238 return 0;
239}
240
241static void
242__dequeue_entry(struct nfqnl_instance *queue, struct nf_queue_entry *entry)
243{
244 rhashtable_remove_fast(&queue->nfqnl_packet_map, &entry->hash_node,
245 nfqnl_rhashtable_params);
246 list_del(&entry->list);
247 queue->queue_total--;
248}
249
250static struct nf_queue_entry *
251find_dequeue_entry(struct nfqnl_instance *queue, unsigned int id)
252{
253 struct nf_queue_entry *entry;
254
255 spin_lock_bh(&queue->lock);
256 entry = rhashtable_lookup_fast(&queue->nfqnl_packet_map, &id,
257 nfqnl_rhashtable_params);
258
259 if (entry)
260 __dequeue_entry(queue, entry);
261
262 spin_unlock_bh(&queue->lock);
263
264 return entry;
265}
266
267static unsigned int nf_iterate(struct sk_buff *skb,
268 struct nf_hook_state *state,
269 const struct nf_hook_entries *hooks,
270 unsigned int *index)
271{
272 const struct nf_hook_entry *hook;
273 unsigned int verdict, i = *index;
274
275 while (i < hooks->num_hook_entries) {
276 hook = &hooks->hooks[i];
277repeat:
278 verdict = nf_hook_entry_hookfn(hook, skb, state);
279 if (verdict != NF_ACCEPT) {
280 *index = i;
281 if (verdict != NF_REPEAT)
282 return verdict;
283 goto repeat;
284 }
285 i++;
286 }
287
288 *index = i;
289 return NF_ACCEPT;
290}
291
292static struct nf_hook_entries *nf_hook_entries_head(const struct net *net, u8 pf, u8 hooknum)
293{
294 switch (pf) {
295#ifdef CONFIG_NETFILTER_FAMILY_BRIDGE
296 case NFPROTO_BRIDGE:
297 return rcu_dereference(net->nf.hooks_bridge[hooknum]);
298#endif
299 case NFPROTO_IPV4:
300 return rcu_dereference(net->nf.hooks_ipv4[hooknum]);
301 case NFPROTO_IPV6:
302 return rcu_dereference(net->nf.hooks_ipv6[hooknum]);
303 default:
304 WARN_ON_ONCE(1);
305 return NULL;
306 }
307
308 return NULL;
309}
310
311static int nf_ip_reroute(struct sk_buff *skb, const struct nf_queue_entry *entry)
312{
313#ifdef CONFIG_INET
314 const struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);
315
316 if (entry->state.hook == NF_INET_LOCAL_OUT) {
317 const struct iphdr *iph = ip_hdr(skb);
318
319 if (!(iph->tos == rt_info->tos &&
320 skb->mark == rt_info->mark &&
321 iph->daddr == rt_info->daddr &&
322 iph->saddr == rt_info->saddr))
323 return ip_route_me_harder(entry->state.net, entry->state.sk,
324 skb, RTN_UNSPEC);
325 }
326#endif
327 return 0;
328}
329
330static int nf_ip6_reroute(struct sk_buff *skb,
331 const struct nf_queue_entry *entry)
332{
333 struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);
334
335 if (entry->state.hook == NF_INET_LOCAL_OUT) {
336 const struct ipv6hdr *iph = ipv6_hdr(skb);
337
338 if (!ipv6_addr_equal(&iph->daddr, &rt_info->daddr) ||
339 !ipv6_addr_equal(&iph->saddr, &rt_info->saddr) ||
340 skb->mark != rt_info->mark)
341 return nf_ip6_route_me_harder(entry->state.net,
342 entry->state.sk, skb);
343 }
344 return 0;
345}
346
347static int nf_reroute(struct sk_buff *skb, struct nf_queue_entry *entry)
348{
349 int ret = 0;
350
351 switch (entry->state.pf) {
352 case AF_INET:
353 ret = nf_ip_reroute(skb, entry);
354 break;
355 case AF_INET6:
356 ret = nf_ip6_reroute(skb, entry);
357 break;
358 }
359 return ret;
360}
361
362/* caller must hold rcu read-side lock */
363static void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
364{
365 const struct nf_hook_entry *hook_entry;
366 const struct nf_hook_entries *hooks;
367 struct sk_buff *skb = entry->skb;
368 const struct net *net;
369 unsigned int i;
370 int err;
371 u8 pf;
372
373 net = entry->state.net;
374 pf = entry->state.pf;
375
376 hooks = nf_hook_entries_head(net, pf, entry->state.hook);
377
378 i = entry->hook_index;
379 if (!hooks || i >= hooks->num_hook_entries) {
380 kfree_skb_reason(skb, SKB_DROP_REASON_NETFILTER_DROP);
381 nf_queue_entry_free(entry);
382 return;
383 }
384
385 hook_entry = &hooks->hooks[i];
386
387 /* Continue traversal iff userspace said ok... */
388 if (verdict == NF_REPEAT)
389 verdict = nf_hook_entry_hookfn(hook_entry, skb, &entry->state);
390
391 if (verdict == NF_ACCEPT) {
392 if (nf_reroute(skb, entry) < 0)
393 verdict = NF_DROP;
394 }
395
396 if (verdict == NF_ACCEPT) {
397next_hook:
398 ++i;
399 verdict = nf_iterate(skb, &entry->state, hooks, &i);
400 }
401
402 switch (verdict & NF_VERDICT_MASK) {
403 case NF_ACCEPT:
404 case NF_STOP:
405 local_bh_disable();
406 entry->state.okfn(entry->state.net, entry->state.sk, skb);
407 local_bh_enable();
408 break;
409 case NF_QUEUE:
410 err = nf_queue(skb, &entry->state, i, verdict);
411 if (err == 1)
412 goto next_hook;
413 break;
414 case NF_STOLEN:
415 break;
416 default:
417 kfree_skb(skb);
418 }
419
420 nf_queue_entry_free(entry);
421}
422
423/* return true if the entry has an unconfirmed conntrack attached that isn't owned by us
424 * exclusively.
425 */
426static bool nf_ct_drop_unconfirmed(const struct nf_queue_entry *entry, bool *is_unconfirmed)
427{
428#if IS_ENABLED(CONFIG_NF_CONNTRACK)
429 struct nf_conn *ct = (void *)skb_nfct(entry->skb);
430
431 if (!ct || nf_ct_is_confirmed(ct))
432 return false;
433
434 if (is_unconfirmed)
435 *is_unconfirmed = true;
436
437 /* in some cases skb_clone() can occur after initial conntrack
438 * pickup, but conntrack assumes exclusive skb->_nfct ownership for
439 * unconfirmed entries.
440 *
441 * This happens for br_netfilter and with ip multicast routing.
442 * This can't be solved with serialization here because one clone
443 * could have been queued for local delivery or could be transmitted
444 * in parallel on another CPU.
445 */
446 return refcount_read(&ct->ct_general.use) > 1;
447#endif
448 return false;
449}
450
451static bool nf_bridge_port_valid(const struct net_device *dev)
452{
453 if (!dev)
454 return true;
455
456 return netif_is_bridge_port(dev);
457}
458
459/* queued skbs leave rcu protection. We bump device refcount so that
460 * the device cannot go away. However, while packet was out the port
461 * could have been removed from the bridge.
462 *
463 * Ensure in+outdev are still part of a bridge at reinject time.
464 *
465 * The device rx_handler_data could even be pointing at data that is
466 * not a net_bridge_port structure.
467 */
468static bool nf_bridge_ports_valid(const struct nf_queue_entry *entry)
469{
470#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
471 if (!nf_bridge_port_valid(entry->physin) ||
472 !nf_bridge_port_valid(entry->physout))
473 return false;
474#endif
475 if (entry->state.pf != PF_BRIDGE)
476 return true;
477
478 if (!nf_bridge_port_valid(entry->state.in) ||
479 !nf_bridge_port_valid(entry->state.out))
480 return false;
481
482 return true;
483}
484
485static void nfqnl_reinject(struct nf_queue_entry *entry, unsigned int verdict)
486{
487 const struct nf_ct_hook *ct_hook;
488
489 if (!nf_bridge_ports_valid(entry))
490 verdict = NF_DROP;
491
492 if (verdict == NF_ACCEPT ||
493 verdict == NF_REPEAT ||
494 verdict == NF_STOP) {
495 unsigned int ct_verdict = verdict;
496
497 rcu_read_lock();
498 ct_hook = rcu_dereference(nf_ct_hook);
499 if (ct_hook)
500 ct_verdict = ct_hook->update(entry->state.net, entry->skb);
501 rcu_read_unlock();
502
503 switch (ct_verdict & NF_VERDICT_MASK) {
504 case NF_ACCEPT:
505 /* follow userspace verdict, could be REPEAT */
506 break;
507 case NF_STOLEN:
508 nf_queue_entry_free(entry);
509 return;
510 default:
511 verdict = ct_verdict & NF_VERDICT_MASK;
512 break;
513 }
514 }
515
516 if (verdict != NF_DROP && entry->nf_ct_is_unconfirmed) {
517 /* If first queued segment was already reinjected then
518 * there is a good chance the ct entry is now confirmed.
519 *
520 * Handle the rare cases:
521 * - out-of-order verdict
522 * - threaded userspace reinjecting in parallel
523 * - first segment was dropped
524 *
525 * In all of those cases we can't handle this packet
526 * because we can't be sure that another CPU won't modify
527 * nf_conn->ext in parallel which isn't allowed.
528 */
529 if (nf_ct_drop_unconfirmed(entry, NULL))
530 verdict = NF_DROP;
531 }
532
533 nf_reinject(entry, verdict);
534}
535
536static void
537nfqnl_flush(struct nfqnl_instance *queue, nfqnl_cmpfn cmpfn, unsigned long data)
538{
539 struct nf_queue_entry *entry, *next;
540
541 spin_lock_bh(&queue->lock);
542 list_for_each_entry_safe(entry, next, &queue->queue_list, list) {
543 if (!cmpfn || cmpfn(entry, data)) {
544 __dequeue_entry(queue, entry);
545 nfqnl_reinject(entry, NF_DROP);
546 }
547 }
548 spin_unlock_bh(&queue->lock);
549}
550
551static int
552nfqnl_put_packet_info(struct sk_buff *nlskb, struct sk_buff *packet,
553 bool csum_verify)
554{
555 __u32 flags = 0;
556
557 if (packet->ip_summed == CHECKSUM_PARTIAL)
558 flags = NFQA_SKB_CSUMNOTREADY;
559 else if (csum_verify)
560 flags = NFQA_SKB_CSUM_NOTVERIFIED;
561
562 if (skb_is_gso(packet))
563 flags |= NFQA_SKB_GSO;
564
565 return flags ? nla_put_be32(nlskb, NFQA_SKB_INFO, htonl(flags)) : 0;
566}
567
568static int nfqnl_put_sk_uidgid(struct sk_buff *skb, struct sock *sk)
569{
570 const struct socket *sock;
571 const struct file *file;
572 const struct cred *cred;
573
574 if (!sk_fullsock(sk))
575 return 0;
576
577 /* The sk pointer remains valid as long as the skb is.
578 * The sk_socket and file pointer may become NULL
579 * if the socket is closed.
580 * Both structures (including file->cred) are RCU freed
581 * which means they can be accessed within a RCU read section.
582 */
583 sock = READ_ONCE(sk->sk_socket);
584 file = sock ? READ_ONCE(sock->file) : NULL;
585 if (file) {
586 cred = file->f_cred;
587 if (nla_put_be32(skb, NFQA_UID,
588 htonl(from_kuid_munged(&init_user_ns, cred->fsuid))))
589 goto nla_put_failure;
590 if (nla_put_be32(skb, NFQA_GID,
591 htonl(from_kgid_munged(&init_user_ns, cred->fsgid))))
592 goto nla_put_failure;
593 }
594 return 0;
595
596nla_put_failure:
597 return -1;
598}
599
600static int nfqnl_put_sk_classid(struct sk_buff *skb, struct sock *sk)
601{
602#if IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)
603 if (sk && sk_fullsock(sk)) {
604 u32 classid = sock_cgroup_classid(&sk->sk_cgrp_data);
605
606 if (classid && nla_put_be32(skb, NFQA_CGROUP_CLASSID, htonl(classid)))
607 return -1;
608 }
609#endif
610 return 0;
611}
612
613static int nfqnl_get_sk_secctx(struct sk_buff *skb, struct lsm_context *ctx)
614{
615 int seclen = 0;
616#if IS_ENABLED(CONFIG_NETWORK_SECMARK)
617 if (skb->secmark)
618 seclen = security_secid_to_secctx(skb->secmark, ctx);
619#endif
620 return seclen;
621}
622
623static u32 nfqnl_get_bridge_size(struct nf_queue_entry *entry)
624{
625 struct sk_buff *entskb = entry->skb;
626 u32 nlalen = 0;
627 u32 mac_len;
628
629 if (entry->state.pf != PF_BRIDGE || !skb_mac_header_was_set(entskb))
630 return 0;
631
632 if (skb_vlan_tag_present(entskb))
633 nlalen += nla_total_size(nla_total_size(sizeof(__be16)) +
634 nla_total_size(sizeof(__be16)));
635
636 mac_len = skb_mac_header_len(entskb);
637 if (mac_len > 0)
638 nlalen += nla_total_size(mac_len);
639
640 return nlalen;
641}
642
643static int nfqnl_put_bridge(struct nf_queue_entry *entry, struct sk_buff *skb)
644{
645 struct sk_buff *entskb = entry->skb;
646 u32 mac_len;
647
648 if (entry->state.pf != PF_BRIDGE || !skb_mac_header_was_set(entskb))
649 return 0;
650
651 if (skb_vlan_tag_present(entskb)) {
652 struct nlattr *nest;
653
654 nest = nla_nest_start(skb, NFQA_VLAN);
655 if (!nest)
656 goto nla_put_failure;
657
658 if (nla_put_be16(skb, NFQA_VLAN_TCI, htons(entskb->vlan_tci)) ||
659 nla_put_be16(skb, NFQA_VLAN_PROTO, entskb->vlan_proto))
660 goto nla_put_failure;
661
662 nla_nest_end(skb, nest);
663 }
664
665 mac_len = skb_mac_header_len(entskb);
666 if (mac_len > 0 &&
667 nla_put(skb, NFQA_L2HDR, mac_len, skb_mac_header(entskb)))
668 goto nla_put_failure;
669
670 return 0;
671
672nla_put_failure:
673 return -1;
674}
675
676static int nf_queue_checksum_help(struct sk_buff *entskb)
677{
678 if (entskb->protocol == htons(ETH_P_IP)) {
679 if (!pskb_network_may_pull(entskb, sizeof(struct iphdr)) ||
680 ip_check_csum_start(entskb))
681 return -EINVAL;
682 }
683
684 if (skb_csum_is_sctp(entskb))
685 return skb_crc32c_csum_help(entskb);
686
687 return skb_checksum_help(entskb);
688}
689
690#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
691static int nfqnl_put_master_ifindex(struct sk_buff *nlskb, int attr,
692 const struct net_device *dev)
693{
694 const struct net_device *upper;
695
696 if (dev && !netif_is_bridge_port(dev))
697 return 0;
698
699 upper = netdev_master_upper_dev_get_rcu((struct net_device *)dev);
700 if (upper && nla_put_be32(nlskb, attr, htonl(upper->ifindex)))
701 return -EMSGSIZE;
702
703 return 0;
704}
705#endif
706
707static unsigned int nfqnl_get_data_len(const struct sk_buff *entskb,
708 unsigned int copy_range)
709{
710 unsigned int data_len = entskb->len;
711
712 if (!skb_frags_readable(entskb))
713 data_len = skb_headlen(entskb);
714
715 return min(data_len, copy_range);
716}
717
718static struct sk_buff *
719nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
720 struct nf_queue_entry *entry,
721 __be32 **packet_id_ptr)
722{
723 size_t size;
724 size_t data_len = 0, cap_len = 0;
725 unsigned int hlen = 0;
726 struct sk_buff *skb;
727 struct nlattr *nla;
728 struct nfqnl_msg_packet_hdr *pmsg;
729 struct nlmsghdr *nlh;
730 struct sk_buff *entskb = entry->skb;
731 struct net_device *indev;
732 struct net_device *outdev;
733 struct nf_conn *ct = NULL;
734 enum ip_conntrack_info ctinfo = 0;
735 const struct nfnl_ct_hook *nfnl_ct;
736 bool csum_verify;
737 struct lsm_context ctx = { NULL, 0, 0 };
738 int seclen = 0;
739 ktime_t tstamp;
740
741 size = nlmsg_total_size(sizeof(struct nfgenmsg))
742 + nla_total_size(sizeof(struct nfqnl_msg_packet_hdr))
743 + nla_total_size(sizeof(u_int32_t)) /* ifindex */
744 + nla_total_size(sizeof(u_int32_t)) /* ifindex */
745#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
746 + nla_total_size(sizeof(u_int32_t)) /* ifindex */
747 + nla_total_size(sizeof(u_int32_t)) /* ifindex */
748#endif
749 + nla_total_size(sizeof(u_int32_t)) /* mark */
750 + nla_total_size(sizeof(u_int32_t)) /* priority */
751 + nla_total_size(sizeof(struct nfqnl_msg_packet_hw))
752 + nla_total_size(sizeof(u_int32_t)) /* skbinfo */
753#if IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)
754 + nla_total_size(sizeof(u_int32_t)) /* classid */
755#endif
756 + nla_total_size(sizeof(u_int32_t)); /* cap_len */
757
758 tstamp = skb_tstamp_cond(entskb, false);
759 if (tstamp)
760 size += nla_total_size(sizeof(struct nfqnl_msg_packet_timestamp));
761
762 size += nfqnl_get_bridge_size(entry);
763
764 if (entry->state.hook <= NF_INET_FORWARD ||
765 (entry->state.hook == NF_INET_POST_ROUTING && entskb->sk == NULL))
766 csum_verify = !skb_csum_unnecessary(entskb);
767 else
768 csum_verify = false;
769
770 outdev = entry->state.out;
771
772 switch ((enum nfqnl_config_mode)READ_ONCE(queue->copy_mode)) {
773 case NFQNL_COPY_META:
774 case NFQNL_COPY_NONE:
775 break;
776
777 case NFQNL_COPY_PACKET:
778 if (!(queue->flags & NFQA_CFG_F_GSO) &&
779 entskb->ip_summed == CHECKSUM_PARTIAL &&
780 nf_queue_checksum_help(entskb))
781 return NULL;
782
783 data_len = nfqnl_get_data_len(entskb, READ_ONCE(queue->copy_range));
784 hlen = skb_zerocopy_headlen(entskb);
785 hlen = min_t(unsigned int, hlen, data_len);
786 size += sizeof(struct nlattr) + hlen;
787 cap_len = entskb->len;
788 break;
789 }
790
791 nfnl_ct = rcu_dereference(nfnl_ct_hook);
792
793#if IS_ENABLED(CONFIG_NF_CONNTRACK)
794 if (queue->flags & NFQA_CFG_F_CONNTRACK) {
795 if (nfnl_ct != NULL) {
796 ct = nf_ct_get(entskb, &ctinfo);
797 if (ct != NULL)
798 size += nfnl_ct->build_size(ct);
799 }
800 }
801#endif
802
803 if (queue->flags & NFQA_CFG_F_UID_GID) {
804 size += (nla_total_size(sizeof(u_int32_t)) /* uid */
805 + nla_total_size(sizeof(u_int32_t))); /* gid */
806 }
807
808 if ((queue->flags & NFQA_CFG_F_SECCTX) && entskb->sk) {
809 seclen = nfqnl_get_sk_secctx(entskb, &ctx);
810 if (seclen < 0)
811 return NULL;
812 if (seclen)
813 size += nla_total_size(seclen);
814 }
815
816 skb = alloc_skb(size, GFP_ATOMIC);
817 if (!skb) {
818 skb_tx_error(entskb);
819 goto nlmsg_failure;
820 }
821
822 nlh = nfnl_msg_put(skb, 0, 0,
823 nfnl_msg_type(NFNL_SUBSYS_QUEUE, NFQNL_MSG_PACKET),
824 0, entry->state.pf, NFNETLINK_V0,
825 htons(queue->queue_num));
826 if (!nlh) {
827 skb_tx_error(entskb);
828 kfree_skb(skb);
829 goto nlmsg_failure;
830 }
831
832 nla = __nla_reserve(skb, NFQA_PACKET_HDR, sizeof(*pmsg));
833 pmsg = nla_data(nla);
834 pmsg->hw_protocol = entskb->protocol;
835 pmsg->hook = entry->state.hook;
836 *packet_id_ptr = &pmsg->packet_id;
837
838 indev = entry->state.in;
839 if (indev) {
840#if !IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
841 if (nla_put_be32(skb, NFQA_IFINDEX_INDEV, htonl(indev->ifindex)))
842 goto nla_put_failure;
843#else
844 if (entry->state.pf == PF_BRIDGE) {
845 /* Case 1: indev is physical input device, we need to
846 * look for bridge group (when called from
847 * netfilter_bridge) */
848 if (nla_put_be32(skb, NFQA_IFINDEX_PHYSINDEV,
849 htonl(indev->ifindex)) ||
850 nfqnl_put_master_ifindex(skb, NFQA_IFINDEX_INDEV, indev))
851 goto nla_put_failure;
852 } else {
853 int physinif;
854
855 /* Case 2: indev is bridge group, we need to look for
856 * physical device (when called from ipv4) */
857 if (nla_put_be32(skb, NFQA_IFINDEX_INDEV,
858 htonl(indev->ifindex)))
859 goto nla_put_failure;
860
861 physinif = nf_bridge_get_physinif(entskb);
862 if (physinif &&
863 nla_put_be32(skb, NFQA_IFINDEX_PHYSINDEV,
864 htonl(physinif)))
865 goto nla_put_failure;
866 }
867#endif
868 }
869
870 if (outdev) {
871#if !IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
872 if (nla_put_be32(skb, NFQA_IFINDEX_OUTDEV, htonl(outdev->ifindex)))
873 goto nla_put_failure;
874#else
875 if (entry->state.pf == PF_BRIDGE) {
876 /* Case 1: outdev is physical output device, we need to
877 * look for bridge group (when called from
878 * netfilter_bridge) */
879 if (nla_put_be32(skb, NFQA_IFINDEX_PHYSOUTDEV,
880 htonl(outdev->ifindex)) ||
881 nfqnl_put_master_ifindex(skb, NFQA_IFINDEX_OUTDEV, outdev))
882 goto nla_put_failure;
883 } else {
884 int physoutif;
885
886 /* Case 2: outdev is bridge group, we need to look for
887 * physical output device (when called from ipv4) */
888 if (nla_put_be32(skb, NFQA_IFINDEX_OUTDEV,
889 htonl(outdev->ifindex)))
890 goto nla_put_failure;
891
892 physoutif = nf_bridge_get_physoutif(entskb);
893 if (physoutif &&
894 nla_put_be32(skb, NFQA_IFINDEX_PHYSOUTDEV,
895 htonl(physoutif)))
896 goto nla_put_failure;
897 }
898#endif
899 }
900
901 if (entskb->mark &&
902 nla_put_be32(skb, NFQA_MARK, htonl(entskb->mark)))
903 goto nla_put_failure;
904
905 if (entskb->priority &&
906 nla_put_be32(skb, NFQA_PRIORITY, htonl(entskb->priority)))
907 goto nla_put_failure;
908
909 if (indev && entskb->dev &&
910 skb_mac_header_was_set(entskb) &&
911 skb_mac_header_len(entskb) != 0) {
912 struct nfqnl_msg_packet_hw phw;
913 int len;
914
915 memset(&phw, 0, sizeof(phw));
916 len = dev_parse_header(entskb, phw.hw_addr);
917 if (len) {
918 phw.hw_addrlen = htons(len);
919 if (nla_put(skb, NFQA_HWADDR, sizeof(phw), &phw))
920 goto nla_put_failure;
921 }
922 }
923
924 if (nfqnl_put_bridge(entry, skb) < 0)
925 goto nla_put_failure;
926
927 if (entry->state.hook <= NF_INET_FORWARD && tstamp) {
928 struct nfqnl_msg_packet_timestamp ts;
929 struct timespec64 kts = ktime_to_timespec64(tstamp);
930
931 ts.sec = cpu_to_be64(kts.tv_sec);
932 ts.usec = cpu_to_be64(kts.tv_nsec / NSEC_PER_USEC);
933
934 if (nla_put(skb, NFQA_TIMESTAMP, sizeof(ts), &ts))
935 goto nla_put_failure;
936 }
937
938 if ((queue->flags & NFQA_CFG_F_UID_GID) && entskb->sk &&
939 nfqnl_put_sk_uidgid(skb, entskb->sk) < 0)
940 goto nla_put_failure;
941
942 if (nfqnl_put_sk_classid(skb, entskb->sk) < 0)
943 goto nla_put_failure;
944
945 if (seclen > 0 && nla_put(skb, NFQA_SECCTX, ctx.len, ctx.context))
946 goto nla_put_failure;
947
948 if (ct && nfnl_ct->build(skb, ct, ctinfo, NFQA_CT, NFQA_CT_INFO) < 0)
949 goto nla_put_failure;
950
951 if (cap_len > data_len &&
952 nla_put_be32(skb, NFQA_CAP_LEN, htonl(cap_len)))
953 goto nla_put_failure;
954
955 if (nfqnl_put_packet_info(skb, entskb, csum_verify))
956 goto nla_put_failure;
957
958 if (data_len) {
959 struct nlattr *nla;
960
961 if (skb_tailroom(skb) < sizeof(*nla) + hlen)
962 goto nla_put_failure;
963
964 nla = skb_put(skb, sizeof(*nla));
965 nla->nla_type = NFQA_PAYLOAD;
966 nla->nla_len = nla_attr_size(data_len);
967
968 if (skb_zerocopy(skb, entskb, data_len, hlen))
969 goto nla_put_failure;
970 }
971
972 nlh->nlmsg_len = skb->len;
973 if (seclen >= 0)
974 security_release_secctx(&ctx);
975 return skb;
976
977nla_put_failure:
978 skb_tx_error(entskb);
979 kfree_skb(skb);
980 net_err_ratelimited("nf_queue: error creating packet message\n");
981nlmsg_failure:
982 if (seclen >= 0)
983 security_release_secctx(&ctx);
984 return NULL;
985}
986
987static int
988__nfqnl_enqueue_packet(struct net *net, struct nfqnl_instance *queue,
989 struct nf_queue_entry *entry)
990{
991 struct sk_buff *nskb;
992 int err = -ENOBUFS;
993 __be32 *packet_id_ptr;
994 int failopen = 0;
995
996 nskb = nfqnl_build_packet_message(net, queue, entry, &packet_id_ptr);
997 if (nskb == NULL) {
998 err = -ENOMEM;
999 goto err_out;
1000 }
1001 spin_lock_bh(&queue->lock);
1002
1003 if (queue->queue_total >= queue->queue_maxlen)
1004 goto err_out_queue_drop;
1005
1006 entry->id = ++queue->id_sequence;
1007 *packet_id_ptr = htonl(entry->id);
1008
1009 /* Insert into hash BEFORE unicast. If failure don't send to userspace. */
1010 err = __enqueue_entry(queue, entry);
1011 if (unlikely(err))
1012 goto err_out_queue_drop;
1013
1014 /* nfnetlink_unicast will either free the nskb or add it to a socket */
1015 err = nfnetlink_unicast(nskb, net, queue->peer_portid);
1016 if (err < 0) {
1017 /* Unicast failed - remove entry we just inserted */
1018 __dequeue_entry(queue, entry);
1019
1020 if (queue->flags & NFQA_CFG_F_FAIL_OPEN) {
1021 failopen = 1;
1022 err = 0;
1023 } else {
1024 queue->queue_user_dropped++;
1025 }
1026 goto err_out_unlock;
1027 }
1028
1029 spin_unlock_bh(&queue->lock);
1030 return 0;
1031
1032err_out_queue_drop:
1033 if (queue->flags & NFQA_CFG_F_FAIL_OPEN) {
1034 failopen = 1;
1035 err = 0;
1036 } else {
1037 queue->queue_dropped++;
1038
1039 if (queue->queue_total >= queue->queue_maxlen)
1040 net_warn_ratelimited("nf_queue: full at %d entries, dropping packets(s)\n",
1041 queue->queue_total);
1042 else
1043 net_warn_ratelimited("nf_queue: hash insert failed: %d\n", err);
1044 }
1045 kfree_skb(nskb);
1046err_out_unlock:
1047 spin_unlock_bh(&queue->lock);
1048 if (failopen)
1049 nfqnl_reinject(entry, NF_ACCEPT);
1050err_out:
1051 return err;
1052}
1053
1054static struct nf_queue_entry *
1055nf_queue_entry_dup(struct nf_queue_entry *e)
1056{
1057 struct nf_queue_entry *entry = kmemdup(e, e->size, GFP_ATOMIC);
1058
1059 if (!entry)
1060 return NULL;
1061
1062 if (nf_queue_entry_get_refs(entry))
1063 return entry;
1064
1065 kfree(entry);
1066 return NULL;
1067}
1068
1069#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
1070/* When called from bridge netfilter, skb->data must point to MAC header
1071 * before calling skb_gso_segment(). Else, original MAC header is lost
1072 * and segmented skbs will be sent to wrong destination.
1073 */
1074static void nf_bridge_adjust_skb_data(struct sk_buff *skb)
1075{
1076 if (nf_bridge_info_get(skb))
1077 __skb_push(skb, skb_mac_header_len(skb));
1078}
1079
1080static void nf_bridge_adjust_segmented_data(struct sk_buff *skb)
1081{
1082 if (nf_bridge_info_get(skb))
1083 __skb_pull(skb, skb_mac_header_len(skb));
1084}
1085#else
1086#define nf_bridge_adjust_skb_data(s) do {} while (0)
1087#define nf_bridge_adjust_segmented_data(s) do {} while (0)
1088#endif
1089
1090static int
1091__nfqnl_enqueue_packet_gso(struct net *net, struct nfqnl_instance *queue,
1092 struct sk_buff *skb, struct nf_queue_entry *entry)
1093{
1094 int ret = -ENOMEM;
1095 struct nf_queue_entry *entry_seg;
1096
1097 nf_bridge_adjust_segmented_data(skb);
1098
1099 if (skb->next == NULL) { /* last packet, no need to copy entry */
1100 struct sk_buff *gso_skb = entry->skb;
1101 entry->skb = skb;
1102 ret = __nfqnl_enqueue_packet(net, queue, entry);
1103 if (ret)
1104 entry->skb = gso_skb;
1105 return ret;
1106 }
1107
1108 skb_mark_not_on_list(skb);
1109
1110 entry_seg = nf_queue_entry_dup(entry);
1111 if (entry_seg) {
1112 entry_seg->skb = skb;
1113 ret = __nfqnl_enqueue_packet(net, queue, entry_seg);
1114 if (ret)
1115 nf_queue_entry_free(entry_seg);
1116 }
1117 return ret;
1118}
1119
1120static int
1121nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
1122{
1123 struct sk_buff *skb, *segs, *nskb;
1124 bool ct_is_unconfirmed = false;
1125 struct nfqnl_instance *queue;
1126 unsigned int queued;
1127 int err = -ENOBUFS;
1128 struct net *net = entry->state.net;
1129 struct nfnl_queue_net *q = nfnl_queue_pernet(net);
1130
1131 /* rcu_read_lock()ed by nf_hook_thresh */
1132 queue = instance_lookup(q, queuenum);
1133 if (!queue)
1134 return -ESRCH;
1135
1136 if (queue->copy_mode == NFQNL_COPY_NONE)
1137 return -EINVAL;
1138
1139 skb = entry->skb;
1140
1141 switch (entry->state.pf) {
1142 case NFPROTO_IPV4:
1143 skb->protocol = htons(ETH_P_IP);
1144 break;
1145 case NFPROTO_IPV6:
1146 skb->protocol = htons(ETH_P_IPV6);
1147 break;
1148 }
1149
1150 /* Check if someone already holds another reference to
1151 * unconfirmed ct. If so, we cannot queue the skb:
1152 * concurrent modifications of nf_conn->ext are not
1153 * allowed and we can't know if another CPU isn't
1154 * processing the same nf_conn entry in parallel.
1155 */
1156 if (nf_ct_drop_unconfirmed(entry, &ct_is_unconfirmed))
1157 return -EINVAL;
1158
1159 if (!skb_is_gso(skb) || ((queue->flags & NFQA_CFG_F_GSO) && !skb_is_gso_sctp(skb)))
1160 return __nfqnl_enqueue_packet(net, queue, entry);
1161
1162 nf_bridge_adjust_skb_data(skb);
1163 segs = skb_gso_segment(skb, 0);
1164 /* Does not use PTR_ERR to limit the number of error codes that can be
1165 * returned by nf_queue. For instance, callers rely on -ESRCH to
1166 * mean 'ignore this hook'.
1167 */
1168 if (IS_ERR_OR_NULL(segs))
1169 goto out_err;
1170 queued = 0;
1171 err = 0;
1172
1173 skb_list_walk_safe(segs, segs, nskb) {
1174 if (ct_is_unconfirmed && queued > 0) {
1175 /* skb_gso_segment() increments the ct refcount.
1176 * This is a problem for unconfirmed (not in hash)
1177 * entries, those can race when reinjections happen
1178 * in parallel.
1179 *
1180 * Annotate this for all queued entries except the
1181 * first one.
1182 *
1183 * As long as the first one is reinjected first it
1184 * will do the confirmation for us.
1185 */
1186 entry->nf_ct_is_unconfirmed = ct_is_unconfirmed;
1187 }
1188
1189 if (err == 0)
1190 err = __nfqnl_enqueue_packet_gso(net, queue,
1191 segs, entry);
1192 if (err == 0)
1193 queued++;
1194 else
1195 kfree_skb(segs);
1196 }
1197
1198 if (queued) {
1199 if (err) /* some segments are already queued */
1200 nf_queue_entry_free(entry);
1201 kfree_skb(skb);
1202 return 0;
1203 }
1204 out_err:
1205 nf_bridge_adjust_segmented_data(skb);
1206 return err;
1207}
1208
1209static bool nfqnl_validate_ipopts(const struct iphdr *iph_new,
1210 const struct nf_queue_entry *e)
1211{
1212 const struct iphdr *iph_orig = ip_hdr(e->skb);
1213 unsigned int ihl = iph_new->ihl * 4;
1214
1215 if (iph_new->ihl != iph_orig->ihl)
1216 return false;
1217 if (ihl == sizeof(*iph_orig))
1218 return true;
1219
1220 return memcmp(iph_new + 1, ip_hdr(e->skb) + 1, ihl - sizeof(*iph_orig)) == 0;
1221}
1222
1223static bool nfqnl_validate_l4(const u8 *data, unsigned int data_len,
1224 const struct nf_queue_entry *e, u8 proto,
1225 bool fragment)
1226{
1227#if IS_ENABLED(CONFIG_NF_CONNTRACK)
1228 enum ip_conntrack_info ctinfo;
1229 const struct nf_conn *ct;
1230
1231 ct = nf_ct_get(e->skb, &ctinfo);
1232 if (ct && !nf_ct_is_template(ct)) {
1233 if (fragment || nf_ct_protonum(ct) != proto)
1234 return false;
1235 }
1236#endif
1237
1238 if (fragment)
1239 return true;
1240
1241 switch (proto) {
1242 case IPPROTO_TCP: {
1243 const struct tcphdr *th = (const struct tcphdr *)data;
1244 unsigned int thlen;
1245
1246 if (data_len < sizeof(*th))
1247 return false;
1248
1249 thlen = __tcp_hdrlen(th);
1250 if (thlen < sizeof(*th) || data_len < thlen)
1251 return false;
1252
1253 return true;
1254 }
1255 case IPPROTO_UDP:
1256 return data_len >= sizeof(struct udphdr);
1257 case IPPROTO_ICMP:
1258 return data_len >= sizeof(struct icmphdr);
1259 case IPPROTO_ICMPV6:
1260 return data_len >= sizeof(struct icmp6hdr);
1261 case IPPROTO_SCTP:
1262 return data_len >= sizeof(struct sctphdr);
1263 case IPPROTO_GRE:
1264 return data_len >= sizeof(struct gre_base_hdr);
1265 case IPPROTO_AH:
1266 return data_len >= sizeof(struct ip_auth_hdr);
1267 case IPPROTO_ESP:
1268 return data_len >= sizeof(struct ip_esp_hdr);
1269 }
1270
1271 return true;
1272}
1273
1274static bool nfqnl_validate_ip4(const struct iphdr *iph, unsigned int data_len,
1275 const struct nf_queue_entry *e)
1276{
1277 unsigned int ihl;
1278 bool fragment;
1279
1280 if (data_len < sizeof(*iph))
1281 return false;
1282
1283 ihl = iph->ihl * 4u;
1284 if (ihl < sizeof(*iph) || data_len < ihl)
1285 return false;
1286
1287 if (iph->version != 4 ||
1288 ((iph->frag_off ^ ip_hdr(e->skb)->frag_off) & ~htons(IP_DF)) != 0)
1289 return false;
1290
1291 /* BIG TCP won't work; netlink attr len is u16 */
1292 if (ntohs(iph->tot_len) != data_len)
1293 return false;
1294
1295 fragment = iph->frag_off & htons(IP_MF | IP_OFFSET);
1296
1297 /* support for ipopts mangling would require
1298 * recompile + skb transport header update.
1299 */
1300 return nfqnl_validate_ipopts(iph, e) &&
1301 nfqnl_validate_l4((const u8 *)iph + ihl, data_len - ihl, e,
1302 iph->protocol, fragment);
1303}
1304
1305static bool nfqnl_validate_one_exthdr(const u8 *data,
1306 unsigned int data_len,
1307 const struct nf_queue_entry *e,
1308 int start, int hdrlen)
1309{
1310 u16 octets;
1311
1312 if (data_len < hdrlen || hdrlen < 2)
1313 return false;
1314
1315 while (hdrlen > 0) {
1316 if (data_len < sizeof(octets))
1317 return false;
1318 data_len -= sizeof(octets);
1319
1320 if (skb_copy_bits(e->skb, start, &octets, sizeof(octets)))
1321 return false;
1322
1323 if (hdrlen < sizeof(octets))
1324 return false;
1325
1326 hdrlen -= sizeof(octets);
1327 if (memcmp(data, &octets, sizeof(octets)))
1328 return false;
1329
1330 start += sizeof(octets);
1331 data += sizeof(octets);
1332 }
1333
1334 return true;
1335}
1336
1337static bool nfqnl_validate_exthdr(const struct ipv6hdr *ip6_new,
1338 unsigned int data_len,
1339 const struct nf_queue_entry *e)
1340{
1341 const struct ipv6hdr *ip6_orig = ipv6_hdr(e->skb);
1342 int exthdr_cnt = 0, start = sizeof(*ip6_orig);
1343 const u8 *data = (const u8 *)ip6_new;
1344 u8 orig_nexthdr = ip6_orig->nexthdr;
1345 u8 new_nexthdr = ip6_new->nexthdr;
1346 bool fragment = false;
1347
1348 if (new_nexthdr != orig_nexthdr)
1349 return false;
1350
1351 data += sizeof(*ip6_new);
1352 data_len -= sizeof(*ip6_new);
1353
1354 while (ipv6_ext_hdr(orig_nexthdr)) {
1355 const struct ipv6_opt_hdr *hp;
1356 struct ipv6_opt_hdr _hdr;
1357 int hdrlen;
1358
1359 if (orig_nexthdr == NEXTHDR_NONE)
1360 return nfqnl_validate_l4(data, data_len, e,
1361 new_nexthdr, fragment);
1362
1363 if (unlikely(exthdr_cnt++ >= IP6_MAX_EXT_HDRS_CNT))
1364 return false;
1365
1366 hp = skb_header_pointer(e->skb, start, sizeof(_hdr), &_hdr);
1367 if (!hp)
1368 return false;
1369
1370 switch (orig_nexthdr) {
1371 case NEXTHDR_FRAGMENT:
1372 fragment = true;
1373 hdrlen = sizeof(struct frag_hdr);
1374 break;
1375 case NEXTHDR_AUTH:
1376 hdrlen = ipv6_authlen(hp);
1377 break;
1378 default:
1379 hdrlen = ipv6_optlen(hp);
1380 break;
1381 }
1382
1383 if (!nfqnl_validate_one_exthdr(data, data_len, e,
1384 start, hdrlen))
1385 return false;
1386
1387 orig_nexthdr = hp->nexthdr;
1388 hp = (const void *)data;
1389 new_nexthdr = hp->nexthdr;
1390
1391 if (new_nexthdr != orig_nexthdr)
1392 return false;
1393
1394 data_len -= hdrlen;
1395 start += hdrlen;
1396 data += hdrlen;
1397 }
1398
1399 return nfqnl_validate_l4(data, data_len, e, new_nexthdr, fragment);
1400}
1401
1402static bool nfqnl_validate_ip6(const struct ipv6hdr *ip6, unsigned int data_len,
1403 const struct nf_queue_entry *e)
1404{
1405 if (data_len < sizeof(*ip6))
1406 return false;
1407
1408 /* BIG TCP/jumbograms won't work; netlink attr len is u16 */
1409 if (ntohs(ip6->payload_len) != data_len - sizeof(*ip6))
1410 return false;
1411
1412 if (ip6->version != 6)
1413 return false;
1414
1415 return nfqnl_validate_exthdr(ip6, data_len, e);
1416}
1417
1418static bool nfqnl_validate_write(const void *data, unsigned int data_len,
1419 const struct nf_queue_entry *e)
1420{
1421 switch (e->state.pf) {
1422 case NFPROTO_IPV4:
1423 return nfqnl_validate_ip4(data, data_len, e);
1424 case NFPROTO_IPV6:
1425 return nfqnl_validate_ip6(data, data_len, e) &&
1426 !(IP6CB(e->skb)->flags & IP6SKB_JUMBOGRAM);
1427 case NFPROTO_BRIDGE:
1428 /* No write support. Bridge is dubious: userspace doesn't even see L2 header */
1429 return false;
1430 }
1431
1432 return false;
1433}
1434
1435static int
1436nfqnl_mangle(void *data, unsigned int data_len, struct nf_queue_entry *e, int diff)
1437{
1438 struct sk_buff *nskb;
1439
1440 if (e->state.net->user_ns != &init_user_ns)
1441 return -EPERM;
1442
1443 if (!nfqnl_validate_write(data, data_len, e))
1444 return -EINVAL;
1445
1446 if (diff < 0) {
1447 unsigned int min_len = skb_transport_offset(e->skb);
1448
1449 if (data_len < min_len)
1450 return -EINVAL;
1451
1452 if (pskb_trim(e->skb, data_len))
1453 return -ENOMEM;
1454 } else if (diff > 0) {
1455 if (data_len > 0xFFFF)
1456 return -EINVAL;
1457 if (diff > skb_tailroom(e->skb)) {
1458 nskb = skb_copy_expand(e->skb, skb_headroom(e->skb),
1459 diff, GFP_ATOMIC);
1460 if (!nskb)
1461 return -ENOMEM;
1462 kfree_skb(e->skb);
1463 e->skb = nskb;
1464 }
1465 skb_put(e->skb, diff);
1466 }
1467 if (skb_ensure_writable(e->skb, data_len))
1468 return -ENOMEM;
1469 skb_copy_to_linear_data(e->skb, data, data_len);
1470 e->skb->ip_summed = CHECKSUM_NONE;
1471 return 0;
1472}
1473
1474static int
1475nfqnl_set_mode(struct nfqnl_instance *queue,
1476 unsigned char mode, unsigned int range)
1477{
1478 int status = 0;
1479
1480 spin_lock_bh(&queue->lock);
1481 switch (mode) {
1482 case NFQNL_COPY_NONE:
1483 case NFQNL_COPY_META:
1484 queue->copy_mode = mode;
1485 queue->copy_range = 0;
1486 break;
1487
1488 case NFQNL_COPY_PACKET:
1489 queue->copy_mode = mode;
1490 if (range == 0 || range > NFQNL_MAX_COPY_RANGE)
1491 queue->copy_range = NFQNL_MAX_COPY_RANGE;
1492 else
1493 queue->copy_range = range;
1494 break;
1495
1496 default:
1497 status = -EINVAL;
1498
1499 }
1500 spin_unlock_bh(&queue->lock);
1501
1502 return status;
1503}
1504
1505static int
1506dev_cmp(struct nf_queue_entry *entry, unsigned long ifindex)
1507{
1508#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
1509 int physinif, physoutif;
1510
1511 physinif = nf_bridge_get_physinif(entry->skb);
1512 physoutif = nf_bridge_get_physoutif(entry->skb);
1513
1514 if (physinif == ifindex || physoutif == ifindex)
1515 return 1;
1516
1517 if (entry->bridge_dev && entry->bridge_dev->ifindex == ifindex)
1518 return 1;
1519#endif
1520 if (entry->skb_dev && entry->skb_dev->ifindex == ifindex)
1521 return 1;
1522 if (entry->state.in)
1523 if (entry->state.in->ifindex == ifindex)
1524 return 1;
1525 if (entry->state.out)
1526 if (entry->state.out->ifindex == ifindex)
1527 return 1;
1528
1529 return 0;
1530}
1531
1532/* drop all packets with either indev or outdev == ifindex from all queue
1533 * instances */
1534static void
1535nfqnl_dev_drop(struct net *net, int ifindex)
1536{
1537 int i;
1538 struct nfnl_queue_net *q = nfnl_queue_pernet(net);
1539
1540 rcu_read_lock();
1541
1542 for (i = 0; i < INSTANCE_BUCKETS; i++) {
1543 struct nfqnl_instance *inst;
1544 struct hlist_head *head = &q->instance_table[i];
1545
1546 hlist_for_each_entry_rcu(inst, head, hlist)
1547 nfqnl_flush(inst, dev_cmp, ifindex);
1548 }
1549
1550 rcu_read_unlock();
1551}
1552
1553static int
1554nfqnl_rcv_dev_event(struct notifier_block *this,
1555 unsigned long event, void *ptr)
1556{
1557 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1558
1559 /* Drop any packets associated with the downed device */
1560 if (event == NETDEV_DOWN)
1561 nfqnl_dev_drop(dev_net(dev), dev->ifindex);
1562 return NOTIFY_DONE;
1563}
1564
1565static struct notifier_block nfqnl_dev_notifier = {
1566 .notifier_call = nfqnl_rcv_dev_event,
1567};
1568
1569static void nfqnl_nf_hook_drop(struct net *net)
1570{
1571 struct nfnl_queue_net *q = nfnl_queue_pernet(net);
1572 int i;
1573
1574 /* This function is also called on net namespace error unwind,
1575 * when pernet_ops->init() failed and ->exit() functions of the
1576 * previous pernet_ops gets called.
1577 *
1578 * This may result in a call to nfqnl_nf_hook_drop() before
1579 * struct nfnl_queue_net was allocated.
1580 */
1581 if (!q)
1582 return;
1583
1584 for (i = 0; i < INSTANCE_BUCKETS; i++) {
1585 struct nfqnl_instance *inst;
1586 struct hlist_head *head = &q->instance_table[i];
1587
1588 hlist_for_each_entry_rcu(inst, head, hlist)
1589 nfqnl_flush(inst, NULL, 0);
1590 }
1591}
1592
1593static int
1594nfqnl_rcv_nl_event(struct notifier_block *this,
1595 unsigned long event, void *ptr)
1596{
1597 struct netlink_notify *n = ptr;
1598 struct nfnl_queue_net *q = nfnl_queue_pernet(n->net);
1599
1600 if (event == NETLINK_URELEASE && n->protocol == NETLINK_NETFILTER) {
1601 int i;
1602
1603 nfnl_lock(NFNL_SUBSYS_QUEUE);
1604 /* destroy all instances for this portid */
1605 spin_lock(&q->instances_lock);
1606 for (i = 0; i < INSTANCE_BUCKETS; i++) {
1607 struct hlist_node *t2;
1608 struct nfqnl_instance *inst;
1609 struct hlist_head *head = &q->instance_table[i];
1610
1611 hlist_for_each_entry_safe(inst, t2, head, hlist) {
1612 if (n->portid == inst->peer_portid)
1613 __instance_destroy(inst);
1614 }
1615 }
1616 spin_unlock(&q->instances_lock);
1617 nfnl_unlock(NFNL_SUBSYS_QUEUE);
1618 }
1619 return NOTIFY_DONE;
1620}
1621
1622static struct notifier_block nfqnl_rtnl_notifier = {
1623 .notifier_call = nfqnl_rcv_nl_event,
1624};
1625
1626static const struct nla_policy nfqa_vlan_policy[NFQA_VLAN_MAX + 1] = {
1627 [NFQA_VLAN_TCI] = { .type = NLA_U16},
1628 [NFQA_VLAN_PROTO] = { .type = NLA_U16},
1629};
1630
1631static const struct nla_policy nfqa_verdict_policy[NFQA_MAX+1] = {
1632 [NFQA_VERDICT_HDR] = { .len = sizeof(struct nfqnl_msg_verdict_hdr) },
1633 [NFQA_MARK] = { .type = NLA_U32 },
1634 [NFQA_PAYLOAD] = { .type = NLA_UNSPEC },
1635 [NFQA_CT] = { .type = NLA_UNSPEC },
1636 [NFQA_EXP] = { .type = NLA_UNSPEC },
1637 [NFQA_VLAN] = { .type = NLA_NESTED },
1638 [NFQA_PRIORITY] = { .type = NLA_U32 },
1639};
1640
1641static const struct nla_policy nfqa_verdict_batch_policy[NFQA_MAX+1] = {
1642 [NFQA_VERDICT_HDR] = { .len = sizeof(struct nfqnl_msg_verdict_hdr) },
1643 [NFQA_MARK] = { .type = NLA_U32 },
1644 [NFQA_PRIORITY] = { .type = NLA_U32 },
1645};
1646
1647static struct nfqnl_instance *
1648verdict_instance_lookup(struct nfnl_queue_net *q, u16 queue_num, u32 nlportid)
1649{
1650 struct nfqnl_instance *queue;
1651
1652 queue = instance_lookup(q, queue_num);
1653 if (!queue)
1654 return ERR_PTR(-ENODEV);
1655
1656 if (queue->peer_portid != nlportid)
1657 return ERR_PTR(-EPERM);
1658
1659 return queue;
1660}
1661
1662static struct nfqnl_msg_verdict_hdr*
1663verdicthdr_get(const struct nlattr * const nfqa[])
1664{
1665 struct nfqnl_msg_verdict_hdr *vhdr;
1666 unsigned int verdict;
1667
1668 if (!nfqa[NFQA_VERDICT_HDR])
1669 return NULL;
1670
1671 vhdr = nla_data(nfqa[NFQA_VERDICT_HDR]);
1672 verdict = ntohl(vhdr->verdict) & NF_VERDICT_MASK;
1673 if (verdict > NF_MAX_VERDICT || verdict == NF_STOLEN)
1674 return NULL;
1675 return vhdr;
1676}
1677
1678static int nfq_id_after(unsigned int id, unsigned int max)
1679{
1680 return (int)(id - max) > 0;
1681}
1682
1683static int nfqnl_recv_verdict_batch(struct sk_buff *skb,
1684 const struct nfnl_info *info,
1685 const struct nlattr * const nfqa[])
1686{
1687 struct nfnl_queue_net *q = nfnl_queue_pernet(info->net);
1688 u16 queue_num = ntohs(info->nfmsg->res_id);
1689 struct nf_queue_entry *entry, *tmp;
1690 struct nfqnl_msg_verdict_hdr *vhdr;
1691 struct nfqnl_instance *queue;
1692 unsigned int verdict, maxid;
1693 LIST_HEAD(batch_list);
1694
1695 queue = verdict_instance_lookup(q, queue_num,
1696 NETLINK_CB(skb).portid);
1697 if (IS_ERR(queue))
1698 return PTR_ERR(queue);
1699
1700 vhdr = verdicthdr_get(nfqa);
1701 if (!vhdr)
1702 return -EINVAL;
1703
1704 verdict = ntohl(vhdr->verdict);
1705 maxid = ntohl(vhdr->id);
1706
1707 spin_lock_bh(&queue->lock);
1708
1709 list_for_each_entry_safe(entry, tmp, &queue->queue_list, list) {
1710 if (nfq_id_after(entry->id, maxid))
1711 break;
1712 __dequeue_entry(queue, entry);
1713 list_add_tail(&entry->list, &batch_list);
1714 }
1715
1716 spin_unlock_bh(&queue->lock);
1717
1718 if (list_empty(&batch_list))
1719 return -ENOENT;
1720
1721 list_for_each_entry_safe(entry, tmp, &batch_list, list) {
1722 if (nfqa[NFQA_MARK])
1723 entry->skb->mark = ntohl(nla_get_be32(nfqa[NFQA_MARK]));
1724
1725 if (nfqa[NFQA_PRIORITY])
1726 entry->skb->priority = ntohl(nla_get_be32(nfqa[NFQA_PRIORITY]));
1727
1728 nfqnl_reinject(entry, verdict);
1729 }
1730 return 0;
1731}
1732
1733static struct nf_conn *nfqnl_ct_parse(const struct nfnl_ct_hook *nfnl_ct,
1734 const struct nlmsghdr *nlh,
1735 const struct nlattr * const nfqa[],
1736 struct nf_queue_entry *entry,
1737 enum ip_conntrack_info *ctinfo)
1738{
1739#if IS_ENABLED(CONFIG_NF_CONNTRACK)
1740 struct nf_conn *ct;
1741
1742 ct = nf_ct_get(entry->skb, ctinfo);
1743 if (ct == NULL)
1744 return NULL;
1745
1746 if (nfnl_ct->parse(nfqa[NFQA_CT], ct) < 0)
1747 return NULL;
1748
1749 if (nfqa[NFQA_EXP])
1750 nfnl_ct->attach_expect(nfqa[NFQA_EXP], ct,
1751 NETLINK_CB(entry->skb).portid,
1752 nlmsg_report(nlh));
1753 return ct;
1754#else
1755 return NULL;
1756#endif
1757}
1758
1759static int nfqa_parse_bridge(struct nf_queue_entry *entry,
1760 const struct nlattr * const nfqa[])
1761{
1762 if (nfqa[NFQA_VLAN]) {
1763 struct nlattr *tb[NFQA_VLAN_MAX + 1];
1764 int err;
1765
1766 err = nla_parse_nested_deprecated(tb, NFQA_VLAN_MAX,
1767 nfqa[NFQA_VLAN],
1768 nfqa_vlan_policy, NULL);
1769 if (err < 0)
1770 return err;
1771
1772 if (!tb[NFQA_VLAN_TCI] || !tb[NFQA_VLAN_PROTO])
1773 return -EINVAL;
1774
1775 __vlan_hwaccel_put_tag(entry->skb,
1776 nla_get_be16(tb[NFQA_VLAN_PROTO]),
1777 ntohs(nla_get_be16(tb[NFQA_VLAN_TCI])));
1778 }
1779
1780 if (nfqa[NFQA_L2HDR]) {
1781 u32 mac_header_len = skb_mac_header_len(entry->skb);
1782
1783 if (mac_header_len != nla_len(nfqa[NFQA_L2HDR]))
1784 return -EINVAL;
1785 else if (mac_header_len > 0)
1786 memcpy(skb_mac_header(entry->skb),
1787 nla_data(nfqa[NFQA_L2HDR]),
1788 mac_header_len);
1789 }
1790
1791 return 0;
1792}
1793
1794static int nfqnl_recv_verdict(struct sk_buff *skb, const struct nfnl_info *info,
1795 const struct nlattr * const nfqa[])
1796{
1797 struct nfnl_queue_net *q = nfnl_queue_pernet(info->net);
1798 u_int16_t queue_num = ntohs(info->nfmsg->res_id);
1799 const struct nfnl_ct_hook *nfnl_ct;
1800 struct nfqnl_msg_verdict_hdr *vhdr;
1801 enum ip_conntrack_info ctinfo;
1802 struct nfqnl_instance *queue;
1803 struct nf_queue_entry *entry;
1804 struct nf_conn *ct = NULL;
1805 unsigned int verdict;
1806 int err;
1807
1808 queue = verdict_instance_lookup(q, queue_num,
1809 NETLINK_CB(skb).portid);
1810 if (IS_ERR(queue))
1811 return PTR_ERR(queue);
1812
1813 vhdr = verdicthdr_get(nfqa);
1814 if (!vhdr)
1815 return -EINVAL;
1816
1817 verdict = ntohl(vhdr->verdict);
1818
1819 entry = find_dequeue_entry(queue, ntohl(vhdr->id));
1820 if (entry == NULL)
1821 return -ENOENT;
1822
1823 /* rcu lock already held from nfnl->call_rcu. */
1824 nfnl_ct = rcu_dereference(nfnl_ct_hook);
1825
1826 if (nfqa[NFQA_CT]) {
1827 if (nfnl_ct != NULL)
1828 ct = nfqnl_ct_parse(nfnl_ct, info->nlh, nfqa, entry,
1829 &ctinfo);
1830 }
1831
1832 if (entry->state.pf == PF_BRIDGE) {
1833 err = nfqa_parse_bridge(entry, nfqa);
1834 if (err < 0) {
1835 nfqnl_reinject(entry, NF_DROP);
1836 return err;
1837 }
1838 }
1839
1840 if (nfqa[NFQA_PAYLOAD]) {
1841 u16 payload_len = nla_len(nfqa[NFQA_PAYLOAD]);
1842 int diff = payload_len - entry->skb->len;
1843
1844 if (nfqnl_mangle(nla_data(nfqa[NFQA_PAYLOAD]),
1845 payload_len, entry, diff) < 0)
1846 verdict = NF_DROP;
1847 else if (ct && diff)
1848 nfnl_ct->seq_adjust(entry->skb, ct, ctinfo, diff);
1849 }
1850
1851 if (nfqa[NFQA_MARK])
1852 entry->skb->mark = ntohl(nla_get_be32(nfqa[NFQA_MARK]));
1853
1854 if (nfqa[NFQA_PRIORITY])
1855 entry->skb->priority = ntohl(nla_get_be32(nfqa[NFQA_PRIORITY]));
1856
1857 nfqnl_reinject(entry, verdict);
1858 return 0;
1859}
1860
1861static int nfqnl_recv_unsupp(struct sk_buff *skb, const struct nfnl_info *info,
1862 const struct nlattr * const cda[])
1863{
1864 return -ENOTSUPP;
1865}
1866
1867static const struct nla_policy nfqa_cfg_policy[NFQA_CFG_MAX+1] = {
1868 [NFQA_CFG_CMD] = { .len = sizeof(struct nfqnl_msg_config_cmd) },
1869 [NFQA_CFG_PARAMS] = { .len = sizeof(struct nfqnl_msg_config_params) },
1870 [NFQA_CFG_QUEUE_MAXLEN] = { .type = NLA_U32 },
1871 [NFQA_CFG_MASK] = { .type = NLA_U32 },
1872 [NFQA_CFG_FLAGS] = NLA_POLICY_MASK(NLA_BE32, NFQA_CFG_F_MAX - 1),
1873};
1874
1875static const struct nf_queue_handler nfqh = {
1876 .outfn = nfqnl_enqueue_packet,
1877 .nf_hook_drop = nfqnl_nf_hook_drop,
1878};
1879
1880static int nfqnl_recv_config(struct sk_buff *skb, const struct nfnl_info *info,
1881 const struct nlattr * const nfqa[])
1882{
1883 struct nfnl_queue_net *q = nfnl_queue_pernet(info->net);
1884 u_int16_t queue_num = ntohs(info->nfmsg->res_id);
1885 struct nfqnl_msg_config_cmd *cmd = NULL;
1886 struct nfqnl_instance *queue;
1887 __u32 flags = 0, mask = 0;
1888
1889 WARN_ON_ONCE(!lockdep_nfnl_is_held(NFNL_SUBSYS_QUEUE));
1890
1891 if (nfqa[NFQA_CFG_CMD]) {
1892 cmd = nla_data(nfqa[NFQA_CFG_CMD]);
1893
1894 /* Obsolete commands without queue context */
1895 switch (cmd->command) {
1896 case NFQNL_CFG_CMD_PF_BIND: return 0;
1897 case NFQNL_CFG_CMD_PF_UNBIND: return 0;
1898 }
1899 }
1900
1901 /* Check if we support these flags in first place, dependencies should
1902 * be there too not to break atomicity.
1903 */
1904 if (nfqa[NFQA_CFG_FLAGS]) {
1905 if (!nfqa[NFQA_CFG_MASK]) {
1906 /* A mask is needed to specify which flags are being
1907 * changed.
1908 */
1909 return -EINVAL;
1910 }
1911
1912 flags = ntohl(nla_get_be32(nfqa[NFQA_CFG_FLAGS]));
1913 mask = ntohl(nla_get_be32(nfqa[NFQA_CFG_MASK]));
1914
1915 if (flags >= NFQA_CFG_F_MAX)
1916 return -EOPNOTSUPP;
1917
1918#if !IS_ENABLED(CONFIG_NETWORK_SECMARK)
1919 if (flags & mask & NFQA_CFG_F_SECCTX)
1920 return -EOPNOTSUPP;
1921#endif
1922 if ((flags & mask & NFQA_CFG_F_CONNTRACK) &&
1923 !rcu_access_pointer(nfnl_ct_hook)) {
1924#ifdef CONFIG_MODULES
1925 nfnl_unlock(NFNL_SUBSYS_QUEUE);
1926 request_module("ip_conntrack_netlink");
1927 nfnl_lock(NFNL_SUBSYS_QUEUE);
1928 if (rcu_access_pointer(nfnl_ct_hook))
1929 return -EAGAIN;
1930#endif
1931 return -EOPNOTSUPP;
1932 }
1933 }
1934
1935 /* Lookup queue under RCU. After peer_portid check (or for new queue
1936 * in BIND case), the queue is owned by the socket sending this message.
1937 * nfqnl_rcv_nl_event() will block on the nfnl subsys mutex that is
1938 * held by the caller, so the queue cannot be destroyed in parallel,
1939 * even after we drop the RCU read lock.
1940 */
1941 rcu_read_lock();
1942 queue = instance_lookup(q, queue_num);
1943 if (queue && queue->peer_portid != NETLINK_CB(skb).portid) {
1944 rcu_read_unlock();
1945 return -EPERM;
1946 }
1947 rcu_read_unlock();
1948
1949 if (cmd != NULL) {
1950 switch (cmd->command) {
1951 case NFQNL_CFG_CMD_BIND:
1952 if (queue)
1953 return -EBUSY;
1954 queue = instance_create(q, queue_num, NETLINK_CB(skb).portid);
1955 if (IS_ERR(queue))
1956 return PTR_ERR(queue);
1957 break;
1958 case NFQNL_CFG_CMD_UNBIND:
1959 if (!queue)
1960 return -ENODEV;
1961 instance_destroy(q, queue);
1962 return 0;
1963 case NFQNL_CFG_CMD_PF_BIND:
1964 case NFQNL_CFG_CMD_PF_UNBIND:
1965 break;
1966 default:
1967 return -EOPNOTSUPP;
1968 }
1969 }
1970
1971 if (!queue)
1972 return -ENODEV;
1973
1974 if (nfqa[NFQA_CFG_PARAMS]) {
1975 struct nfqnl_msg_config_params *params =
1976 nla_data(nfqa[NFQA_CFG_PARAMS]);
1977
1978 nfqnl_set_mode(queue, params->copy_mode,
1979 ntohl(params->copy_range));
1980 }
1981
1982 if (nfqa[NFQA_CFG_QUEUE_MAXLEN]) {
1983 __be32 *queue_maxlen = nla_data(nfqa[NFQA_CFG_QUEUE_MAXLEN]);
1984
1985 spin_lock_bh(&queue->lock);
1986 queue->queue_maxlen = ntohl(*queue_maxlen);
1987 spin_unlock_bh(&queue->lock);
1988 }
1989
1990 if (nfqa[NFQA_CFG_FLAGS]) {
1991 spin_lock_bh(&queue->lock);
1992 queue->flags &= ~mask;
1993 queue->flags |= flags & mask;
1994 spin_unlock_bh(&queue->lock);
1995 }
1996
1997 return 0;
1998}
1999
2000static const struct nfnl_callback nfqnl_cb[NFQNL_MSG_MAX] = {
2001 [NFQNL_MSG_PACKET] = {
2002 .call = nfqnl_recv_unsupp,
2003 .type = NFNL_CB_RCU,
2004 .attr_count = NFQA_MAX,
2005 },
2006 [NFQNL_MSG_VERDICT] = {
2007 .call = nfqnl_recv_verdict,
2008 .type = NFNL_CB_RCU,
2009 .attr_count = NFQA_MAX,
2010 .policy = nfqa_verdict_policy
2011 },
2012 [NFQNL_MSG_CONFIG] = {
2013 .call = nfqnl_recv_config,
2014 .type = NFNL_CB_MUTEX,
2015 .attr_count = NFQA_CFG_MAX,
2016 .policy = nfqa_cfg_policy
2017 },
2018 [NFQNL_MSG_VERDICT_BATCH] = {
2019 .call = nfqnl_recv_verdict_batch,
2020 .type = NFNL_CB_RCU,
2021 .attr_count = NFQA_MAX,
2022 .policy = nfqa_verdict_batch_policy
2023 },
2024};
2025
2026static const struct nfnetlink_subsystem nfqnl_subsys = {
2027 .name = "nf_queue",
2028 .subsys_id = NFNL_SUBSYS_QUEUE,
2029 .cb_count = NFQNL_MSG_MAX,
2030 .cb = nfqnl_cb,
2031};
2032
2033#ifdef CONFIG_PROC_FS
2034struct iter_state {
2035 struct seq_net_private p;
2036 unsigned int bucket;
2037};
2038
2039static struct hlist_node *get_first(struct seq_file *seq)
2040{
2041 struct iter_state *st = seq->private;
2042 struct net *net;
2043 struct nfnl_queue_net *q;
2044
2045 if (!st)
2046 return NULL;
2047
2048 net = seq_file_net(seq);
2049 q = nfnl_queue_pernet(net);
2050 for (st->bucket = 0; st->bucket < INSTANCE_BUCKETS; st->bucket++) {
2051 if (!hlist_empty(&q->instance_table[st->bucket]))
2052 return q->instance_table[st->bucket].first;
2053 }
2054 return NULL;
2055}
2056
2057static struct hlist_node *get_next(struct seq_file *seq, struct hlist_node *h)
2058{
2059 struct iter_state *st = seq->private;
2060 struct net *net = seq_file_net(seq);
2061
2062 h = h->next;
2063 while (!h) {
2064 struct nfnl_queue_net *q;
2065
2066 if (++st->bucket >= INSTANCE_BUCKETS)
2067 return NULL;
2068
2069 q = nfnl_queue_pernet(net);
2070 h = q->instance_table[st->bucket].first;
2071 }
2072 return h;
2073}
2074
2075static struct hlist_node *get_idx(struct seq_file *seq, loff_t pos)
2076{
2077 struct hlist_node *head;
2078 head = get_first(seq);
2079
2080 if (head)
2081 while (pos && (head = get_next(seq, head)))
2082 pos--;
2083 return pos ? NULL : head;
2084}
2085
2086static void *seq_start(struct seq_file *s, loff_t *pos)
2087 __acquires(nfnl_queue_pernet(seq_file_net(s))->instances_lock)
2088{
2089 spin_lock(&nfnl_queue_pernet(seq_file_net(s))->instances_lock);
2090 return get_idx(s, *pos);
2091}
2092
2093static void *seq_next(struct seq_file *s, void *v, loff_t *pos)
2094{
2095 (*pos)++;
2096 return get_next(s, v);
2097}
2098
2099static void seq_stop(struct seq_file *s, void *v)
2100 __releases(nfnl_queue_pernet(seq_file_net(s))->instances_lock)
2101{
2102 spin_unlock(&nfnl_queue_pernet(seq_file_net(s))->instances_lock);
2103}
2104
2105static int seq_show(struct seq_file *s, void *v)
2106{
2107 const struct nfqnl_instance *inst = v;
2108
2109 seq_printf(s, "%5u %6u %5u %1u %5u %5u %5u %8u %2d\n",
2110 inst->queue_num,
2111 inst->peer_portid, inst->queue_total,
2112 inst->copy_mode, inst->copy_range,
2113 inst->queue_dropped, inst->queue_user_dropped,
2114 inst->id_sequence, 1);
2115 return 0;
2116}
2117
2118static const struct seq_operations nfqnl_seq_ops = {
2119 .start = seq_start,
2120 .next = seq_next,
2121 .stop = seq_stop,
2122 .show = seq_show,
2123};
2124#endif /* PROC_FS */
2125
2126static int __net_init nfnl_queue_net_init(struct net *net)
2127{
2128 unsigned int i;
2129 struct nfnl_queue_net *q = nfnl_queue_pernet(net);
2130
2131 for (i = 0; i < INSTANCE_BUCKETS; i++)
2132 INIT_HLIST_HEAD(&q->instance_table[i]);
2133
2134 spin_lock_init(&q->instances_lock);
2135
2136#ifdef CONFIG_PROC_FS
2137 if (!proc_create_net("nfnetlink_queue", 0440, net->nf.proc_netfilter,
2138 &nfqnl_seq_ops, sizeof(struct iter_state)))
2139 return -ENOMEM;
2140#endif
2141 return 0;
2142}
2143
2144static void __net_exit nfnl_queue_net_exit(struct net *net)
2145{
2146 struct nfnl_queue_net *q = nfnl_queue_pernet(net);
2147 unsigned int i;
2148
2149#ifdef CONFIG_PROC_FS
2150 remove_proc_entry("nfnetlink_queue", net->nf.proc_netfilter);
2151#endif
2152 for (i = 0; i < INSTANCE_BUCKETS; i++)
2153 WARN_ON_ONCE(!hlist_empty(&q->instance_table[i]));
2154}
2155
2156static struct pernet_operations nfnl_queue_net_ops = {
2157 .init = nfnl_queue_net_init,
2158 .exit = nfnl_queue_net_exit,
2159 .id = &nfnl_queue_net_id,
2160 .size = sizeof(struct nfnl_queue_net),
2161};
2162
2163static int __init nfnetlink_queue_init(void)
2164{
2165 int status;
2166
2167 nfq_cleanup_wq = alloc_ordered_workqueue("nfq_workqueue", 0);
2168 if (!nfq_cleanup_wq)
2169 return -ENOMEM;
2170
2171 status = register_pernet_subsys(&nfnl_queue_net_ops);
2172 if (status < 0)
2173 goto cleanup_pernet_subsys;
2174
2175 status = netlink_register_notifier(&nfqnl_rtnl_notifier);
2176 if (status < 0)
2177 goto cleanup_rtnl_notifier;
2178
2179 status = register_netdevice_notifier(&nfqnl_dev_notifier);
2180 if (status < 0)
2181 goto cleanup_dev_notifier;
2182
2183 status = nfnetlink_subsys_register(&nfqnl_subsys);
2184 if (status < 0)
2185 goto cleanup_nfqnl_subsys;
2186
2187 nf_register_queue_handler(&nfqh);
2188
2189 return status;
2190
2191cleanup_nfqnl_subsys:
2192 unregister_netdevice_notifier(&nfqnl_dev_notifier);
2193cleanup_dev_notifier:
2194 netlink_unregister_notifier(&nfqnl_rtnl_notifier);
2195cleanup_rtnl_notifier:
2196 unregister_pernet_subsys(&nfnl_queue_net_ops);
2197cleanup_pernet_subsys:
2198 destroy_workqueue(nfq_cleanup_wq);
2199 return status;
2200}
2201
2202static void __exit nfnetlink_queue_fini(void)
2203{
2204 nf_unregister_queue_handler();
2205 unregister_netdevice_notifier(&nfqnl_dev_notifier);
2206 nfnetlink_subsys_unregister(&nfqnl_subsys);
2207 netlink_unregister_notifier(&nfqnl_rtnl_notifier);
2208 unregister_pernet_subsys(&nfnl_queue_net_ops);
2209 destroy_workqueue(nfq_cleanup_wq);
2210 rcu_barrier(); /* Wait for completion of call_rcu()'s */
2211}
2212
2213MODULE_DESCRIPTION("netfilter packet queue handler");
2214MODULE_AUTHOR("Harald Welte <[email protected]>");
2215MODULE_LICENSE("GPL");
2216MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_QUEUE);
2217
2218module_init(nfnetlink_queue_init);
2219module_exit(nfnetlink_queue_fini);