net/netfilter/nf_sockopt.c

0001 // SPDX-License-Identifier: GPL-2.0
0002 #include <linux/kernel.h>
0003 #include <linux/init.h>
0004 #include <linux/module.h>
0005 #include <linux/skbuff.h>
0006 #include <linux/netfilter.h>
0007 #include <linux/mutex.h>
0008 #include <net/sock.h>
0009
0010 #include "nf_internals.h"
0011
0012 /* Sockopts only registered and called from user context, so
0013    net locking would be overkill.  Also, [gs]etsockopt calls may
0014    sleep. */
0015 static DEFINE_MUTEX(nf_sockopt_mutex);
0016 static LIST_HEAD(nf_sockopts);
0017
0018 /* Do exclusive ranges overlap? */
0019 static inline int overlap(int min1, int max1, int min2, int max2)
0020 {
0021     return max1 > min2 && min1 < max2;
0022 }
0023
0024 /* Functions to register sockopt ranges (exclusive). */
0025 int nf_register_sockopt(struct nf_sockopt_ops *reg)
0026 {
0027     struct nf_sockopt_ops *ops;
0028     int ret = 0;
0029
0030     mutex_lock(&nf_sockopt_mutex);
0031     list_for_each_entry(ops, &nf_sockopts, list) {
0032         if (ops->pf == reg->pf
0033             && (overlap(ops->set_optmin, ops->set_optmax,
0034                 reg->set_optmin, reg->set_optmax)
0035             || overlap(ops->get_optmin, ops->get_optmax,
0036                    reg->get_optmin, reg->get_optmax))) {
0037             pr_debug("nf_sock overlap: %u-%u/%u-%u v %u-%u/%u-%u\n",
0038                 ops->set_optmin, ops->set_optmax,
0039                 ops->get_optmin, ops->get_optmax,
0040                 reg->set_optmin, reg->set_optmax,
0041                 reg->get_optmin, reg->get_optmax);
0042             ret = -EBUSY;
0043             goto out;
0044         }
0045     }
0046
0047     list_add(&reg->list, &nf_sockopts);
0048 out:
0049     mutex_unlock(&nf_sockopt_mutex);
0050     return ret;
0051 }
0052 EXPORT_SYMBOL(nf_register_sockopt);
0053
0054 void nf_unregister_sockopt(struct nf_sockopt_ops *reg)
0055 {
0056     mutex_lock(&nf_sockopt_mutex);
0057     list_del(&reg->list);
0058     mutex_unlock(&nf_sockopt_mutex);
0059 }
0060 EXPORT_SYMBOL(nf_unregister_sockopt);
0061
0062 static struct nf_sockopt_ops *nf_sockopt_find(struct sock *sk, u_int8_t pf,
0063         int val, int get)
0064 {
0065     struct nf_sockopt_ops *ops;
0066
0067     mutex_lock(&nf_sockopt_mutex);
0068     list_for_each_entry(ops, &nf_sockopts, list) {
0069         if (ops->pf == pf) {
0070             if (!try_module_get(ops->owner))
0071                 goto out_nosup;
0072
0073             if (get) {
0074                 if (val >= ops->get_optmin &&
0075                         val < ops->get_optmax)
0076                     goto out;
0077             } else {
0078                 if (val >= ops->set_optmin &&
0079                         val < ops->set_optmax)
0080                     goto out;
0081             }
0082             module_put(ops->owner);
0083         }
0084     }
0085 out_nosup:
0086     ops = ERR_PTR(-ENOPROTOOPT);
0087 out:
0088     mutex_unlock(&nf_sockopt_mutex);
0089     return ops;
0090 }
0091
0092 int nf_setsockopt(struct sock *sk, u_int8_t pf, int val, sockptr_t opt,
0093           unsigned int len)
0094 {
0095     struct nf_sockopt_ops *ops;
0096     int ret;
0097
0098     ops = nf_sockopt_find(sk, pf, val, 0);
0099     if (IS_ERR(ops))
0100         return PTR_ERR(ops);
0101     ret = ops->set(sk, val, opt, len);
0102     module_put(ops->owner);
0103     return ret;
0104 }
0105 EXPORT_SYMBOL(nf_setsockopt);
0106
0107 int nf_getsockopt(struct sock *sk, u_int8_t pf, int val, char __user *opt,
0108           int *len)
0109 {
0110     struct nf_sockopt_ops *ops;
0111     int ret;
0112
0113     ops = nf_sockopt_find(sk, pf, val, 1);
0114     if (IS_ERR(ops))
0115         return PTR_ERR(ops);
0116     ret = ops->get(sk, val, opt, len);
0117     module_put(ops->owner);
0118     return ret;
0119 }
0120 EXPORT_SYMBOL(nf_getsockopt);