net/netfilter/nf_queue.c

0001 /*
0002  * Rusty Russell (C)2000 -- This code is GPL.
0003  * Patrick McHardy (c) 2006-2012
0004  */
0005
0006 #include <linux/kernel.h>
0007 #include <linux/slab.h>
0008 #include <linux/init.h>
0009 #include <linux/module.h>
0010 #include <linux/proc_fs.h>
0011 #include <linux/skbuff.h>
0012 #include <linux/netfilter.h>
0013 #include <linux/netfilter_ipv4.h>
0014 #include <linux/netfilter_ipv6.h>
0015 #include <linux/netfilter_bridge.h>
0016 #include <linux/seq_file.h>
0017 #include <linux/rcupdate.h>
0018 #include <net/protocol.h>
0019 #include <net/netfilter/nf_queue.h>
0020 #include <net/dst.h>
0021
0022 #include "nf_internals.h"
0023
0024 static const struct nf_queue_handler __rcu *nf_queue_handler;
0025
0026 /*
0027  * Hook for nfnetlink_queue to register its queue handler.
0028  * We do this so that most of the NFQUEUE code can be modular.
0029  *
0030  * Once the queue is registered it must reinject all packets it
0031  * receives, no matter what.
0032  */
0033
0034 void nf_register_queue_handler(const struct nf_queue_handler *qh)
0035 {
0036     /* should never happen, we only have one queueing backend in kernel */
0037     WARN_ON(rcu_access_pointer(nf_queue_handler));
0038     rcu_assign_pointer(nf_queue_handler, qh);
0039 }
0040 EXPORT_SYMBOL(nf_register_queue_handler);
0041
0042 /* The caller must flush their queue before this */
0043 void nf_unregister_queue_handler(void)
0044 {
0045     RCU_INIT_POINTER(nf_queue_handler, NULL);
0046 }
0047 EXPORT_SYMBOL(nf_unregister_queue_handler);
0048
0049 static void nf_queue_sock_put(struct sock *sk)
0050 {
0051 #ifdef CONFIG_INET
0052     sock_gen_put(sk);
0053 #else
0054     sock_put(sk);
0055 #endif
0056 }
0057
0058 static void nf_queue_entry_release_refs(struct nf_queue_entry *entry)
0059 {
0060     struct nf_hook_state *state = &entry->state;
0061
0062     /* Release those devices we held, or Alexey will kill me. */
0063     dev_put(state->in);
0064     dev_put(state->out);
0065     if (state->sk)
0066         nf_queue_sock_put(state->sk);
0067
0068 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
0069     dev_put(entry->physin);
0070     dev_put(entry->physout);
0071 #endif
0072 }
0073
0074 void nf_queue_entry_free(struct nf_queue_entry *entry)
0075 {
0076     nf_queue_entry_release_refs(entry);
0077     kfree(entry);
0078 }
0079 EXPORT_SYMBOL_GPL(nf_queue_entry_free);
0080
0081 static void __nf_queue_entry_init_physdevs(struct nf_queue_entry *entry)
0082 {
0083 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
0084     const struct sk_buff *skb = entry->skb;
0085     struct nf_bridge_info *nf_bridge;
0086
0087     nf_bridge = nf_bridge_info_get(skb);
0088     if (nf_bridge) {
0089         entry->physin = nf_bridge_get_physindev(skb);
0090         entry->physout = nf_bridge_get_physoutdev(skb);
0091     } else {
0092         entry->physin = NULL;
0093         entry->physout = NULL;
0094     }
0095 #endif
0096 }
0097
0098 /* Bump dev refs so they don't vanish while packet is out */
0099 bool nf_queue_entry_get_refs(struct nf_queue_entry *entry)
0100 {
0101     struct nf_hook_state *state = &entry->state;
0102
0103     if (state->sk && !refcount_inc_not_zero(&state->sk->sk_refcnt))
0104         return false;
0105
0106     dev_hold(state->in);
0107     dev_hold(state->out);
0108
0109 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
0110     dev_hold(entry->physin);
0111     dev_hold(entry->physout);
0112 #endif
0113     return true;
0114 }
0115 EXPORT_SYMBOL_GPL(nf_queue_entry_get_refs);
0116
0117 void nf_queue_nf_hook_drop(struct net *net)
0118 {
0119     const struct nf_queue_handler *qh;
0120
0121     rcu_read_lock();
0122     qh = rcu_dereference(nf_queue_handler);
0123     if (qh)
0124         qh->nf_hook_drop(net);
0125     rcu_read_unlock();
0126 }
0127 EXPORT_SYMBOL_GPL(nf_queue_nf_hook_drop);
0128
0129 static void nf_ip_saveroute(const struct sk_buff *skb,
0130                 struct nf_queue_entry *entry)
0131 {
0132     struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);
0133
0134     if (entry->state.hook == NF_INET_LOCAL_OUT) {
0135         const struct iphdr *iph = ip_hdr(skb);
0136
0137         rt_info->tos = iph->tos;
0138         rt_info->daddr = iph->daddr;
0139         rt_info->saddr = iph->saddr;
0140         rt_info->mark = skb->mark;
0141     }
0142 }
0143
0144 static void nf_ip6_saveroute(const struct sk_buff *skb,
0145                  struct nf_queue_entry *entry)
0146 {
0147     struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);
0148
0149     if (entry->state.hook == NF_INET_LOCAL_OUT) {
0150         const struct ipv6hdr *iph = ipv6_hdr(skb);
0151
0152         rt_info->daddr = iph->daddr;
0153         rt_info->saddr = iph->saddr;
0154         rt_info->mark = skb->mark;
0155     }
0156 }
0157
0158 static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state,
0159               unsigned int index, unsigned int queuenum)
0160 {
0161     struct nf_queue_entry *entry = NULL;
0162     const struct nf_queue_handler *qh;
0163     unsigned int route_key_size;
0164     int status;
0165
0166     /* QUEUE == DROP if no one is waiting, to be safe. */
0167     qh = rcu_dereference(nf_queue_handler);
0168     if (!qh)
0169         return -ESRCH;
0170
0171     switch (state->pf) {
0172     case AF_INET:
0173         route_key_size = sizeof(struct ip_rt_info);
0174         break;
0175     case AF_INET6:
0176         route_key_size = sizeof(struct ip6_rt_info);
0177         break;
0178     default:
0179         route_key_size = 0;
0180         break;
0181     }
0182
0183     if (skb_sk_is_prefetched(skb)) {
0184         struct sock *sk = skb->sk;
0185
0186         if (!sk_is_refcounted(sk)) {
0187             if (!refcount_inc_not_zero(&sk->sk_refcnt))
0188                 return -ENOTCONN;
0189
0190             /* drop refcount on skb_orphan */
0191             skb->destructor = sock_edemux;
0192         }
0193     }
0194
0195     entry = kmalloc(sizeof(*entry) + route_key_size, GFP_ATOMIC);
0196     if (!entry)
0197         return -ENOMEM;
0198
0199     if (skb_dst(skb) && !skb_dst_force(skb)) {
0200         kfree(entry);
0201         return -ENETDOWN;
0202     }
0203
0204     *entry = (struct nf_queue_entry) {
0205         .skb    = skb,
0206         .state  = *state,
0207         .hook_index = index,
0208         .size   = sizeof(*entry) + route_key_size,
0209     };
0210
0211     __nf_queue_entry_init_physdevs(entry);
0212
0213     if (!nf_queue_entry_get_refs(entry)) {
0214         kfree(entry);
0215         return -ENOTCONN;
0216     }
0217
0218     switch (entry->state.pf) {
0219     case AF_INET:
0220         nf_ip_saveroute(skb, entry);
0221         break;
0222     case AF_INET6:
0223         nf_ip6_saveroute(skb, entry);
0224         break;
0225     }
0226
0227     status = qh->outfn(entry, queuenum);
0228     if (status < 0) {
0229         nf_queue_entry_free(entry);
0230         return status;
0231     }
0232
0233     return 0;
0234 }
0235
0236 /* Packets leaving via this function must come back through nf_reinject(). */
0237 int nf_queue(struct sk_buff *skb, struct nf_hook_state *state,
0238          unsigned int index, unsigned int verdict)
0239 {
0240     int ret;
0241
0242     ret = __nf_queue(skb, state, index, verdict >> NF_VERDICT_QBITS);
0243     if (ret < 0) {
0244         if (ret == -ESRCH &&
0245             (verdict & NF_VERDICT_FLAG_QUEUE_BYPASS))
0246             return 1;
0247         kfree_skb(skb);
0248     }
0249
0250     return 0;
0251 }
0252 EXPORT_SYMBOL_GPL(nf_queue);
0253
0254 static unsigned int nf_iterate(struct sk_buff *skb,
0255                    struct nf_hook_state *state,
0256                    const struct nf_hook_entries *hooks,
0257                    unsigned int *index)
0258 {
0259     const struct nf_hook_entry *hook;
0260     unsigned int verdict, i = *index;
0261
0262     while (i < hooks->num_hook_entries) {
0263         hook = &hooks->hooks[i];
0264 repeat:
0265         verdict = nf_hook_entry_hookfn(hook, skb, state);
0266         if (verdict != NF_ACCEPT) {
0267             *index = i;
0268             if (verdict != NF_REPEAT)
0269                 return verdict;
0270             goto repeat;
0271         }
0272         i++;
0273     }
0274
0275     *index = i;
0276     return NF_ACCEPT;
0277 }
0278
0279 static struct nf_hook_entries *nf_hook_entries_head(const struct net *net, u8 pf, u8 hooknum)
0280 {
0281     switch (pf) {
0282 #ifdef CONFIG_NETFILTER_FAMILY_BRIDGE
0283     case NFPROTO_BRIDGE:
0284         return rcu_dereference(net->nf.hooks_bridge[hooknum]);
0285 #endif
0286     case NFPROTO_IPV4:
0287         return rcu_dereference(net->nf.hooks_ipv4[hooknum]);
0288     case NFPROTO_IPV6:
0289         return rcu_dereference(net->nf.hooks_ipv6[hooknum]);
0290     default:
0291         WARN_ON_ONCE(1);
0292         return NULL;
0293     }
0294
0295     return NULL;
0296 }
0297
0298 /* Caller must hold rcu read-side lock */
0299 void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
0300 {
0301     const struct nf_hook_entry *hook_entry;
0302     const struct nf_hook_entries *hooks;
0303     struct sk_buff *skb = entry->skb;
0304     const struct net *net;
0305     unsigned int i;
0306     int err;
0307     u8 pf;
0308
0309     net = entry->state.net;
0310     pf = entry->state.pf;
0311
0312     hooks = nf_hook_entries_head(net, pf, entry->state.hook);
0313
0314     i = entry->hook_index;
0315     if (WARN_ON_ONCE(!hooks || i >= hooks->num_hook_entries)) {
0316         kfree_skb(skb);
0317         nf_queue_entry_free(entry);
0318         return;
0319     }
0320
0321     hook_entry = &hooks->hooks[i];
0322
0323     /* Continue traversal iff userspace said ok... */
0324     if (verdict == NF_REPEAT)
0325         verdict = nf_hook_entry_hookfn(hook_entry, skb, &entry->state);
0326
0327     if (verdict == NF_ACCEPT) {
0328         if (nf_reroute(skb, entry) < 0)
0329             verdict = NF_DROP;
0330     }
0331
0332     if (verdict == NF_ACCEPT) {
0333 next_hook:
0334         ++i;
0335         verdict = nf_iterate(skb, &entry->state, hooks, &i);
0336     }
0337
0338     switch (verdict & NF_VERDICT_MASK) {
0339     case NF_ACCEPT:
0340     case NF_STOP:
0341         local_bh_disable();
0342         entry->state.okfn(entry->state.net, entry->state.sk, skb);
0343         local_bh_enable();
0344         break;
0345     case NF_QUEUE:
0346         err = nf_queue(skb, &entry->state, i, verdict);
0347         if (err == 1)
0348             goto next_hook;
0349         break;
0350     case NF_STOLEN:
0351         break;
0352     default:
0353         kfree_skb(skb);
0354     }
0355
0356     nf_queue_entry_free(entry);
0357 }
0358 EXPORT_SYMBOL(nf_reinject);