Back to home page

OSCL-LXR
 
 

     

0001 // SPDX-License-Identifier: GPL-2.0-only
0002 /*
0003  * This is a module which is used for queueing packets and communicating with
0004  * userspace via nfnetlink.
0005  *
0006  * (C) 2005 by Harald Welte <laforge@netfilter.org>
0007  * (C) 2007 by Patrick McHardy <kaber@trash.net>
0008  *
0009  * Based on the old ipv4-only ip_queue.c:
0010  * (C) 2000-2002 James Morris <jmorris@intercode.com.au>
0011  * (C) 2003-2005 Netfilter Core Team <coreteam@netfilter.org>
0012  */
0013 
0014 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
0015 
0016 #include <linux/module.h>
0017 #include <linux/skbuff.h>
0018 #include <linux/init.h>
0019 #include <linux/spinlock.h>
0020 #include <linux/slab.h>
0021 #include <linux/notifier.h>
0022 #include <linux/netdevice.h>
0023 #include <linux/netfilter.h>
0024 #include <linux/proc_fs.h>
0025 #include <linux/netfilter_ipv4.h>
0026 #include <linux/netfilter_ipv6.h>
0027 #include <linux/netfilter_bridge.h>
0028 #include <linux/netfilter/nfnetlink.h>
0029 #include <linux/netfilter/nfnetlink_queue.h>
0030 #include <linux/netfilter/nf_conntrack_common.h>
0031 #include <linux/list.h>
0032 #include <net/sock.h>
0033 #include <net/tcp_states.h>
0034 #include <net/netfilter/nf_queue.h>
0035 #include <net/netns/generic.h>
0036 
0037 #include <linux/atomic.h>
0038 
0039 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
0040 #include "../bridge/br_private.h"
0041 #endif
0042 
0043 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
0044 #include <net/netfilter/nf_conntrack.h>
0045 #endif
0046 
0047 #define NFQNL_QMAX_DEFAULT 1024
0048 
0049 /* We're using struct nlattr which has 16bit nla_len. Note that nla_len
0050  * includes the header length. Thus, the maximum packet length that we
0051  * support is 65531 bytes. We send truncated packets if the specified length
0052  * is larger than that.  Userspace can check for presence of NFQA_CAP_LEN
0053  * attribute to detect truncation.
0054  */
0055 #define NFQNL_MAX_COPY_RANGE (0xffff - NLA_HDRLEN)
0056 
0057 struct nfqnl_instance {
0058     struct hlist_node hlist;        /* global list of queues */
0059     struct rcu_head rcu;
0060 
0061     u32 peer_portid;
0062     unsigned int queue_maxlen;
0063     unsigned int copy_range;
0064     unsigned int queue_dropped;
0065     unsigned int queue_user_dropped;
0066 
0067 
0068     u_int16_t queue_num;            /* number of this queue */
0069     u_int8_t copy_mode;
0070     u_int32_t flags;            /* Set using NFQA_CFG_FLAGS */
0071 /*
0072  * Following fields are dirtied for each queued packet,
0073  * keep them in same cache line if possible.
0074  */
0075     spinlock_t  lock    ____cacheline_aligned_in_smp;
0076     unsigned int    queue_total;
0077     unsigned int    id_sequence;        /* 'sequence' of pkt ids */
0078     struct list_head queue_list;        /* packets in queue */
0079 };
0080 
0081 typedef int (*nfqnl_cmpfn)(struct nf_queue_entry *, unsigned long);
0082 
0083 static unsigned int nfnl_queue_net_id __read_mostly;
0084 
0085 #define INSTANCE_BUCKETS    16
0086 struct nfnl_queue_net {
0087     spinlock_t instances_lock;
0088     struct hlist_head instance_table[INSTANCE_BUCKETS];
0089 };
0090 
0091 static struct nfnl_queue_net *nfnl_queue_pernet(struct net *net)
0092 {
0093     return net_generic(net, nfnl_queue_net_id);
0094 }
0095 
0096 static inline u_int8_t instance_hashfn(u_int16_t queue_num)
0097 {
0098     return ((queue_num >> 8) ^ queue_num) % INSTANCE_BUCKETS;
0099 }
0100 
0101 static struct nfqnl_instance *
0102 instance_lookup(struct nfnl_queue_net *q, u_int16_t queue_num)
0103 {
0104     struct hlist_head *head;
0105     struct nfqnl_instance *inst;
0106 
0107     head = &q->instance_table[instance_hashfn(queue_num)];
0108     hlist_for_each_entry_rcu(inst, head, hlist) {
0109         if (inst->queue_num == queue_num)
0110             return inst;
0111     }
0112     return NULL;
0113 }
0114 
0115 static struct nfqnl_instance *
0116 instance_create(struct nfnl_queue_net *q, u_int16_t queue_num, u32 portid)
0117 {
0118     struct nfqnl_instance *inst;
0119     unsigned int h;
0120     int err;
0121 
0122     spin_lock(&q->instances_lock);
0123     if (instance_lookup(q, queue_num)) {
0124         err = -EEXIST;
0125         goto out_unlock;
0126     }
0127 
0128     inst = kzalloc(sizeof(*inst), GFP_ATOMIC);
0129     if (!inst) {
0130         err = -ENOMEM;
0131         goto out_unlock;
0132     }
0133 
0134     inst->queue_num = queue_num;
0135     inst->peer_portid = portid;
0136     inst->queue_maxlen = NFQNL_QMAX_DEFAULT;
0137     inst->copy_range = NFQNL_MAX_COPY_RANGE;
0138     inst->copy_mode = NFQNL_COPY_NONE;
0139     spin_lock_init(&inst->lock);
0140     INIT_LIST_HEAD(&inst->queue_list);
0141 
0142     if (!try_module_get(THIS_MODULE)) {
0143         err = -EAGAIN;
0144         goto out_free;
0145     }
0146 
0147     h = instance_hashfn(queue_num);
0148     hlist_add_head_rcu(&inst->hlist, &q->instance_table[h]);
0149 
0150     spin_unlock(&q->instances_lock);
0151 
0152     return inst;
0153 
0154 out_free:
0155     kfree(inst);
0156 out_unlock:
0157     spin_unlock(&q->instances_lock);
0158     return ERR_PTR(err);
0159 }
0160 
0161 static void nfqnl_flush(struct nfqnl_instance *queue, nfqnl_cmpfn cmpfn,
0162             unsigned long data);
0163 
0164 static void
0165 instance_destroy_rcu(struct rcu_head *head)
0166 {
0167     struct nfqnl_instance *inst = container_of(head, struct nfqnl_instance,
0168                            rcu);
0169 
0170     nfqnl_flush(inst, NULL, 0);
0171     kfree(inst);
0172     module_put(THIS_MODULE);
0173 }
0174 
0175 static void
0176 __instance_destroy(struct nfqnl_instance *inst)
0177 {
0178     hlist_del_rcu(&inst->hlist);
0179     call_rcu(&inst->rcu, instance_destroy_rcu);
0180 }
0181 
0182 static void
0183 instance_destroy(struct nfnl_queue_net *q, struct nfqnl_instance *inst)
0184 {
0185     spin_lock(&q->instances_lock);
0186     __instance_destroy(inst);
0187     spin_unlock(&q->instances_lock);
0188 }
0189 
0190 static inline void
0191 __enqueue_entry(struct nfqnl_instance *queue, struct nf_queue_entry *entry)
0192 {
0193        list_add_tail(&entry->list, &queue->queue_list);
0194        queue->queue_total++;
0195 }
0196 
0197 static void
0198 __dequeue_entry(struct nfqnl_instance *queue, struct nf_queue_entry *entry)
0199 {
0200     list_del(&entry->list);
0201     queue->queue_total--;
0202 }
0203 
0204 static struct nf_queue_entry *
0205 find_dequeue_entry(struct nfqnl_instance *queue, unsigned int id)
0206 {
0207     struct nf_queue_entry *entry = NULL, *i;
0208 
0209     spin_lock_bh(&queue->lock);
0210 
0211     list_for_each_entry(i, &queue->queue_list, list) {
0212         if (i->id == id) {
0213             entry = i;
0214             break;
0215         }
0216     }
0217 
0218     if (entry)
0219         __dequeue_entry(queue, entry);
0220 
0221     spin_unlock_bh(&queue->lock);
0222 
0223     return entry;
0224 }
0225 
0226 static void nfqnl_reinject(struct nf_queue_entry *entry, unsigned int verdict)
0227 {
0228     const struct nf_ct_hook *ct_hook;
0229     int err;
0230 
0231     if (verdict == NF_ACCEPT ||
0232         verdict == NF_REPEAT ||
0233         verdict == NF_STOP) {
0234         rcu_read_lock();
0235         ct_hook = rcu_dereference(nf_ct_hook);
0236         if (ct_hook) {
0237             err = ct_hook->update(entry->state.net, entry->skb);
0238             if (err < 0)
0239                 verdict = NF_DROP;
0240         }
0241         rcu_read_unlock();
0242     }
0243     nf_reinject(entry, verdict);
0244 }
0245 
0246 static void
0247 nfqnl_flush(struct nfqnl_instance *queue, nfqnl_cmpfn cmpfn, unsigned long data)
0248 {
0249     struct nf_queue_entry *entry, *next;
0250 
0251     spin_lock_bh(&queue->lock);
0252     list_for_each_entry_safe(entry, next, &queue->queue_list, list) {
0253         if (!cmpfn || cmpfn(entry, data)) {
0254             list_del(&entry->list);
0255             queue->queue_total--;
0256             nfqnl_reinject(entry, NF_DROP);
0257         }
0258     }
0259     spin_unlock_bh(&queue->lock);
0260 }
0261 
0262 static int
0263 nfqnl_put_packet_info(struct sk_buff *nlskb, struct sk_buff *packet,
0264               bool csum_verify)
0265 {
0266     __u32 flags = 0;
0267 
0268     if (packet->ip_summed == CHECKSUM_PARTIAL)
0269         flags = NFQA_SKB_CSUMNOTREADY;
0270     else if (csum_verify)
0271         flags = NFQA_SKB_CSUM_NOTVERIFIED;
0272 
0273     if (skb_is_gso(packet))
0274         flags |= NFQA_SKB_GSO;
0275 
0276     return flags ? nla_put_be32(nlskb, NFQA_SKB_INFO, htonl(flags)) : 0;
0277 }
0278 
0279 static int nfqnl_put_sk_uidgid(struct sk_buff *skb, struct sock *sk)
0280 {
0281     const struct cred *cred;
0282 
0283     if (!sk_fullsock(sk))
0284         return 0;
0285 
0286     read_lock_bh(&sk->sk_callback_lock);
0287     if (sk->sk_socket && sk->sk_socket->file) {
0288         cred = sk->sk_socket->file->f_cred;
0289         if (nla_put_be32(skb, NFQA_UID,
0290             htonl(from_kuid_munged(&init_user_ns, cred->fsuid))))
0291             goto nla_put_failure;
0292         if (nla_put_be32(skb, NFQA_GID,
0293             htonl(from_kgid_munged(&init_user_ns, cred->fsgid))))
0294             goto nla_put_failure;
0295     }
0296     read_unlock_bh(&sk->sk_callback_lock);
0297     return 0;
0298 
0299 nla_put_failure:
0300     read_unlock_bh(&sk->sk_callback_lock);
0301     return -1;
0302 }
0303 
0304 static u32 nfqnl_get_sk_secctx(struct sk_buff *skb, char **secdata)
0305 {
0306     u32 seclen = 0;
0307 #if IS_ENABLED(CONFIG_NETWORK_SECMARK)
0308     if (!skb || !sk_fullsock(skb->sk))
0309         return 0;
0310 
0311     read_lock_bh(&skb->sk->sk_callback_lock);
0312 
0313     if (skb->secmark)
0314         security_secid_to_secctx(skb->secmark, secdata, &seclen);
0315 
0316     read_unlock_bh(&skb->sk->sk_callback_lock);
0317 #endif
0318     return seclen;
0319 }
0320 
0321 static u32 nfqnl_get_bridge_size(struct nf_queue_entry *entry)
0322 {
0323     struct sk_buff *entskb = entry->skb;
0324     u32 nlalen = 0;
0325 
0326     if (entry->state.pf != PF_BRIDGE || !skb_mac_header_was_set(entskb))
0327         return 0;
0328 
0329     if (skb_vlan_tag_present(entskb))
0330         nlalen += nla_total_size(nla_total_size(sizeof(__be16)) +
0331                      nla_total_size(sizeof(__be16)));
0332 
0333     if (entskb->network_header > entskb->mac_header)
0334         nlalen += nla_total_size((entskb->network_header -
0335                       entskb->mac_header));
0336 
0337     return nlalen;
0338 }
0339 
0340 static int nfqnl_put_bridge(struct nf_queue_entry *entry, struct sk_buff *skb)
0341 {
0342     struct sk_buff *entskb = entry->skb;
0343 
0344     if (entry->state.pf != PF_BRIDGE || !skb_mac_header_was_set(entskb))
0345         return 0;
0346 
0347     if (skb_vlan_tag_present(entskb)) {
0348         struct nlattr *nest;
0349 
0350         nest = nla_nest_start(skb, NFQA_VLAN);
0351         if (!nest)
0352             goto nla_put_failure;
0353 
0354         if (nla_put_be16(skb, NFQA_VLAN_TCI, htons(entskb->vlan_tci)) ||
0355             nla_put_be16(skb, NFQA_VLAN_PROTO, entskb->vlan_proto))
0356             goto nla_put_failure;
0357 
0358         nla_nest_end(skb, nest);
0359     }
0360 
0361     if (entskb->mac_header < entskb->network_header) {
0362         int len = (int)(entskb->network_header - entskb->mac_header);
0363 
0364         if (nla_put(skb, NFQA_L2HDR, len, skb_mac_header(entskb)))
0365             goto nla_put_failure;
0366     }
0367 
0368     return 0;
0369 
0370 nla_put_failure:
0371     return -1;
0372 }
0373 
0374 static struct sk_buff *
0375 nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
0376                struct nf_queue_entry *entry,
0377                __be32 **packet_id_ptr)
0378 {
0379     size_t size;
0380     size_t data_len = 0, cap_len = 0;
0381     unsigned int hlen = 0;
0382     struct sk_buff *skb;
0383     struct nlattr *nla;
0384     struct nfqnl_msg_packet_hdr *pmsg;
0385     struct nlmsghdr *nlh;
0386     struct sk_buff *entskb = entry->skb;
0387     struct net_device *indev;
0388     struct net_device *outdev;
0389     struct nf_conn *ct = NULL;
0390     enum ip_conntrack_info ctinfo = 0;
0391     const struct nfnl_ct_hook *nfnl_ct;
0392     bool csum_verify;
0393     char *secdata = NULL;
0394     u32 seclen = 0;
0395     ktime_t tstamp;
0396 
0397     size = nlmsg_total_size(sizeof(struct nfgenmsg))
0398         + nla_total_size(sizeof(struct nfqnl_msg_packet_hdr))
0399         + nla_total_size(sizeof(u_int32_t)) /* ifindex */
0400         + nla_total_size(sizeof(u_int32_t)) /* ifindex */
0401 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
0402         + nla_total_size(sizeof(u_int32_t)) /* ifindex */
0403         + nla_total_size(sizeof(u_int32_t)) /* ifindex */
0404 #endif
0405         + nla_total_size(sizeof(u_int32_t)) /* mark */
0406         + nla_total_size(sizeof(u_int32_t)) /* priority */
0407         + nla_total_size(sizeof(struct nfqnl_msg_packet_hw))
0408         + nla_total_size(sizeof(u_int32_t)) /* skbinfo */
0409         + nla_total_size(sizeof(u_int32_t));    /* cap_len */
0410 
0411     tstamp = skb_tstamp_cond(entskb, false);
0412     if (tstamp)
0413         size += nla_total_size(sizeof(struct nfqnl_msg_packet_timestamp));
0414 
0415     size += nfqnl_get_bridge_size(entry);
0416 
0417     if (entry->state.hook <= NF_INET_FORWARD ||
0418        (entry->state.hook == NF_INET_POST_ROUTING && entskb->sk == NULL))
0419         csum_verify = !skb_csum_unnecessary(entskb);
0420     else
0421         csum_verify = false;
0422 
0423     outdev = entry->state.out;
0424 
0425     switch ((enum nfqnl_config_mode)READ_ONCE(queue->copy_mode)) {
0426     case NFQNL_COPY_META:
0427     case NFQNL_COPY_NONE:
0428         break;
0429 
0430     case NFQNL_COPY_PACKET:
0431         if (!(queue->flags & NFQA_CFG_F_GSO) &&
0432             entskb->ip_summed == CHECKSUM_PARTIAL &&
0433             skb_checksum_help(entskb))
0434             return NULL;
0435 
0436         data_len = READ_ONCE(queue->copy_range);
0437         if (data_len > entskb->len)
0438             data_len = entskb->len;
0439 
0440         hlen = skb_zerocopy_headlen(entskb);
0441         hlen = min_t(unsigned int, hlen, data_len);
0442         size += sizeof(struct nlattr) + hlen;
0443         cap_len = entskb->len;
0444         break;
0445     }
0446 
0447     nfnl_ct = rcu_dereference(nfnl_ct_hook);
0448 
0449 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
0450     if (queue->flags & NFQA_CFG_F_CONNTRACK) {
0451         if (nfnl_ct != NULL) {
0452             ct = nf_ct_get(entskb, &ctinfo);
0453             if (ct != NULL)
0454                 size += nfnl_ct->build_size(ct);
0455         }
0456     }
0457 #endif
0458 
0459     if (queue->flags & NFQA_CFG_F_UID_GID) {
0460         size += (nla_total_size(sizeof(u_int32_t))  /* uid */
0461             + nla_total_size(sizeof(u_int32_t)));   /* gid */
0462     }
0463 
0464     if ((queue->flags & NFQA_CFG_F_SECCTX) && entskb->sk) {
0465         seclen = nfqnl_get_sk_secctx(entskb, &secdata);
0466         if (seclen)
0467             size += nla_total_size(seclen);
0468     }
0469 
0470     skb = alloc_skb(size, GFP_ATOMIC);
0471     if (!skb) {
0472         skb_tx_error(entskb);
0473         goto nlmsg_failure;
0474     }
0475 
0476     nlh = nfnl_msg_put(skb, 0, 0,
0477                nfnl_msg_type(NFNL_SUBSYS_QUEUE, NFQNL_MSG_PACKET),
0478                0, entry->state.pf, NFNETLINK_V0,
0479                htons(queue->queue_num));
0480     if (!nlh) {
0481         skb_tx_error(entskb);
0482         kfree_skb(skb);
0483         goto nlmsg_failure;
0484     }
0485 
0486     nla = __nla_reserve(skb, NFQA_PACKET_HDR, sizeof(*pmsg));
0487     pmsg = nla_data(nla);
0488     pmsg->hw_protocol   = entskb->protocol;
0489     pmsg->hook      = entry->state.hook;
0490     *packet_id_ptr      = &pmsg->packet_id;
0491 
0492     indev = entry->state.in;
0493     if (indev) {
0494 #if !IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
0495         if (nla_put_be32(skb, NFQA_IFINDEX_INDEV, htonl(indev->ifindex)))
0496             goto nla_put_failure;
0497 #else
0498         if (entry->state.pf == PF_BRIDGE) {
0499             /* Case 1: indev is physical input device, we need to
0500              * look for bridge group (when called from
0501              * netfilter_bridge) */
0502             if (nla_put_be32(skb, NFQA_IFINDEX_PHYSINDEV,
0503                      htonl(indev->ifindex)) ||
0504             /* this is the bridge group "brX" */
0505             /* rcu_read_lock()ed by __nf_queue */
0506                 nla_put_be32(skb, NFQA_IFINDEX_INDEV,
0507                      htonl(br_port_get_rcu(indev)->br->dev->ifindex)))
0508                 goto nla_put_failure;
0509         } else {
0510             int physinif;
0511 
0512             /* Case 2: indev is bridge group, we need to look for
0513              * physical device (when called from ipv4) */
0514             if (nla_put_be32(skb, NFQA_IFINDEX_INDEV,
0515                      htonl(indev->ifindex)))
0516                 goto nla_put_failure;
0517 
0518             physinif = nf_bridge_get_physinif(entskb);
0519             if (physinif &&
0520                 nla_put_be32(skb, NFQA_IFINDEX_PHYSINDEV,
0521                      htonl(physinif)))
0522                 goto nla_put_failure;
0523         }
0524 #endif
0525     }
0526 
0527     if (outdev) {
0528 #if !IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
0529         if (nla_put_be32(skb, NFQA_IFINDEX_OUTDEV, htonl(outdev->ifindex)))
0530             goto nla_put_failure;
0531 #else
0532         if (entry->state.pf == PF_BRIDGE) {
0533             /* Case 1: outdev is physical output device, we need to
0534              * look for bridge group (when called from
0535              * netfilter_bridge) */
0536             if (nla_put_be32(skb, NFQA_IFINDEX_PHYSOUTDEV,
0537                      htonl(outdev->ifindex)) ||
0538             /* this is the bridge group "brX" */
0539             /* rcu_read_lock()ed by __nf_queue */
0540                 nla_put_be32(skb, NFQA_IFINDEX_OUTDEV,
0541                      htonl(br_port_get_rcu(outdev)->br->dev->ifindex)))
0542                 goto nla_put_failure;
0543         } else {
0544             int physoutif;
0545 
0546             /* Case 2: outdev is bridge group, we need to look for
0547              * physical output device (when called from ipv4) */
0548             if (nla_put_be32(skb, NFQA_IFINDEX_OUTDEV,
0549                      htonl(outdev->ifindex)))
0550                 goto nla_put_failure;
0551 
0552             physoutif = nf_bridge_get_physoutif(entskb);
0553             if (physoutif &&
0554                 nla_put_be32(skb, NFQA_IFINDEX_PHYSOUTDEV,
0555                      htonl(physoutif)))
0556                 goto nla_put_failure;
0557         }
0558 #endif
0559     }
0560 
0561     if (entskb->mark &&
0562         nla_put_be32(skb, NFQA_MARK, htonl(entskb->mark)))
0563         goto nla_put_failure;
0564 
0565     if (entskb->priority &&
0566         nla_put_be32(skb, NFQA_PRIORITY, htonl(entskb->priority)))
0567         goto nla_put_failure;
0568 
0569     if (indev && entskb->dev &&
0570         skb_mac_header_was_set(entskb) &&
0571         skb_mac_header_len(entskb) != 0) {
0572         struct nfqnl_msg_packet_hw phw;
0573         int len;
0574 
0575         memset(&phw, 0, sizeof(phw));
0576         len = dev_parse_header(entskb, phw.hw_addr);
0577         if (len) {
0578             phw.hw_addrlen = htons(len);
0579             if (nla_put(skb, NFQA_HWADDR, sizeof(phw), &phw))
0580                 goto nla_put_failure;
0581         }
0582     }
0583 
0584     if (nfqnl_put_bridge(entry, skb) < 0)
0585         goto nla_put_failure;
0586 
0587     if (entry->state.hook <= NF_INET_FORWARD && tstamp) {
0588         struct nfqnl_msg_packet_timestamp ts;
0589         struct timespec64 kts = ktime_to_timespec64(tstamp);
0590 
0591         ts.sec = cpu_to_be64(kts.tv_sec);
0592         ts.usec = cpu_to_be64(kts.tv_nsec / NSEC_PER_USEC);
0593 
0594         if (nla_put(skb, NFQA_TIMESTAMP, sizeof(ts), &ts))
0595             goto nla_put_failure;
0596     }
0597 
0598     if ((queue->flags & NFQA_CFG_F_UID_GID) && entskb->sk &&
0599         nfqnl_put_sk_uidgid(skb, entskb->sk) < 0)
0600         goto nla_put_failure;
0601 
0602     if (seclen && nla_put(skb, NFQA_SECCTX, seclen, secdata))
0603         goto nla_put_failure;
0604 
0605     if (ct && nfnl_ct->build(skb, ct, ctinfo, NFQA_CT, NFQA_CT_INFO) < 0)
0606         goto nla_put_failure;
0607 
0608     if (cap_len > data_len &&
0609         nla_put_be32(skb, NFQA_CAP_LEN, htonl(cap_len)))
0610         goto nla_put_failure;
0611 
0612     if (nfqnl_put_packet_info(skb, entskb, csum_verify))
0613         goto nla_put_failure;
0614 
0615     if (data_len) {
0616         struct nlattr *nla;
0617 
0618         if (skb_tailroom(skb) < sizeof(*nla) + hlen)
0619             goto nla_put_failure;
0620 
0621         nla = skb_put(skb, sizeof(*nla));
0622         nla->nla_type = NFQA_PAYLOAD;
0623         nla->nla_len = nla_attr_size(data_len);
0624 
0625         if (skb_zerocopy(skb, entskb, data_len, hlen))
0626             goto nla_put_failure;
0627     }
0628 
0629     nlh->nlmsg_len = skb->len;
0630     if (seclen)
0631         security_release_secctx(secdata, seclen);
0632     return skb;
0633 
0634 nla_put_failure:
0635     skb_tx_error(entskb);
0636     kfree_skb(skb);
0637     net_err_ratelimited("nf_queue: error creating packet message\n");
0638 nlmsg_failure:
0639     if (seclen)
0640         security_release_secctx(secdata, seclen);
0641     return NULL;
0642 }
0643 
0644 static bool nf_ct_drop_unconfirmed(const struct nf_queue_entry *entry)
0645 {
0646 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
0647     static const unsigned long flags = IPS_CONFIRMED | IPS_DYING;
0648     const struct nf_conn *ct = (void *)skb_nfct(entry->skb);
0649 
0650     if (ct && ((ct->status & flags) == IPS_DYING))
0651         return true;
0652 #endif
0653     return false;
0654 }
0655 
0656 static int
0657 __nfqnl_enqueue_packet(struct net *net, struct nfqnl_instance *queue,
0658             struct nf_queue_entry *entry)
0659 {
0660     struct sk_buff *nskb;
0661     int err = -ENOBUFS;
0662     __be32 *packet_id_ptr;
0663     int failopen = 0;
0664 
0665     nskb = nfqnl_build_packet_message(net, queue, entry, &packet_id_ptr);
0666     if (nskb == NULL) {
0667         err = -ENOMEM;
0668         goto err_out;
0669     }
0670     spin_lock_bh(&queue->lock);
0671 
0672     if (nf_ct_drop_unconfirmed(entry))
0673         goto err_out_free_nskb;
0674 
0675     if (queue->queue_total >= queue->queue_maxlen) {
0676         if (queue->flags & NFQA_CFG_F_FAIL_OPEN) {
0677             failopen = 1;
0678             err = 0;
0679         } else {
0680             queue->queue_dropped++;
0681             net_warn_ratelimited("nf_queue: full at %d entries, dropping packets(s)\n",
0682                          queue->queue_total);
0683         }
0684         goto err_out_free_nskb;
0685     }
0686     entry->id = ++queue->id_sequence;
0687     *packet_id_ptr = htonl(entry->id);
0688 
0689     /* nfnetlink_unicast will either free the nskb or add it to a socket */
0690     err = nfnetlink_unicast(nskb, net, queue->peer_portid);
0691     if (err < 0) {
0692         if (queue->flags & NFQA_CFG_F_FAIL_OPEN) {
0693             failopen = 1;
0694             err = 0;
0695         } else {
0696             queue->queue_user_dropped++;
0697         }
0698         goto err_out_unlock;
0699     }
0700 
0701     __enqueue_entry(queue, entry);
0702 
0703     spin_unlock_bh(&queue->lock);
0704     return 0;
0705 
0706 err_out_free_nskb:
0707     kfree_skb(nskb);
0708 err_out_unlock:
0709     spin_unlock_bh(&queue->lock);
0710     if (failopen)
0711         nfqnl_reinject(entry, NF_ACCEPT);
0712 err_out:
0713     return err;
0714 }
0715 
0716 static struct nf_queue_entry *
0717 nf_queue_entry_dup(struct nf_queue_entry *e)
0718 {
0719     struct nf_queue_entry *entry = kmemdup(e, e->size, GFP_ATOMIC);
0720 
0721     if (!entry)
0722         return NULL;
0723 
0724     if (nf_queue_entry_get_refs(entry))
0725         return entry;
0726 
0727     kfree(entry);
0728     return NULL;
0729 }
0730 
0731 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
0732 /* When called from bridge netfilter, skb->data must point to MAC header
0733  * before calling skb_gso_segment(). Else, original MAC header is lost
0734  * and segmented skbs will be sent to wrong destination.
0735  */
0736 static void nf_bridge_adjust_skb_data(struct sk_buff *skb)
0737 {
0738     if (nf_bridge_info_get(skb))
0739         __skb_push(skb, skb->network_header - skb->mac_header);
0740 }
0741 
0742 static void nf_bridge_adjust_segmented_data(struct sk_buff *skb)
0743 {
0744     if (nf_bridge_info_get(skb))
0745         __skb_pull(skb, skb->network_header - skb->mac_header);
0746 }
0747 #else
0748 #define nf_bridge_adjust_skb_data(s) do {} while (0)
0749 #define nf_bridge_adjust_segmented_data(s) do {} while (0)
0750 #endif
0751 
0752 static int
0753 __nfqnl_enqueue_packet_gso(struct net *net, struct nfqnl_instance *queue,
0754                struct sk_buff *skb, struct nf_queue_entry *entry)
0755 {
0756     int ret = -ENOMEM;
0757     struct nf_queue_entry *entry_seg;
0758 
0759     nf_bridge_adjust_segmented_data(skb);
0760 
0761     if (skb->next == NULL) { /* last packet, no need to copy entry */
0762         struct sk_buff *gso_skb = entry->skb;
0763         entry->skb = skb;
0764         ret = __nfqnl_enqueue_packet(net, queue, entry);
0765         if (ret)
0766             entry->skb = gso_skb;
0767         return ret;
0768     }
0769 
0770     skb_mark_not_on_list(skb);
0771 
0772     entry_seg = nf_queue_entry_dup(entry);
0773     if (entry_seg) {
0774         entry_seg->skb = skb;
0775         ret = __nfqnl_enqueue_packet(net, queue, entry_seg);
0776         if (ret)
0777             nf_queue_entry_free(entry_seg);
0778     }
0779     return ret;
0780 }
0781 
0782 static int
0783 nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
0784 {
0785     unsigned int queued;
0786     struct nfqnl_instance *queue;
0787     struct sk_buff *skb, *segs, *nskb;
0788     int err = -ENOBUFS;
0789     struct net *net = entry->state.net;
0790     struct nfnl_queue_net *q = nfnl_queue_pernet(net);
0791 
0792     /* rcu_read_lock()ed by nf_hook_thresh */
0793     queue = instance_lookup(q, queuenum);
0794     if (!queue)
0795         return -ESRCH;
0796 
0797     if (queue->copy_mode == NFQNL_COPY_NONE)
0798         return -EINVAL;
0799 
0800     skb = entry->skb;
0801 
0802     switch (entry->state.pf) {
0803     case NFPROTO_IPV4:
0804         skb->protocol = htons(ETH_P_IP);
0805         break;
0806     case NFPROTO_IPV6:
0807         skb->protocol = htons(ETH_P_IPV6);
0808         break;
0809     }
0810 
0811     if ((queue->flags & NFQA_CFG_F_GSO) || !skb_is_gso(skb))
0812         return __nfqnl_enqueue_packet(net, queue, entry);
0813 
0814     nf_bridge_adjust_skb_data(skb);
0815     segs = skb_gso_segment(skb, 0);
0816     /* Does not use PTR_ERR to limit the number of error codes that can be
0817      * returned by nf_queue.  For instance, callers rely on -ESRCH to
0818      * mean 'ignore this hook'.
0819      */
0820     if (IS_ERR_OR_NULL(segs))
0821         goto out_err;
0822     queued = 0;
0823     err = 0;
0824     skb_list_walk_safe(segs, segs, nskb) {
0825         if (err == 0)
0826             err = __nfqnl_enqueue_packet_gso(net, queue,
0827                             segs, entry);
0828         if (err == 0)
0829             queued++;
0830         else
0831             kfree_skb(segs);
0832     }
0833 
0834     if (queued) {
0835         if (err) /* some segments are already queued */
0836             nf_queue_entry_free(entry);
0837         kfree_skb(skb);
0838         return 0;
0839     }
0840  out_err:
0841     nf_bridge_adjust_segmented_data(skb);
0842     return err;
0843 }
0844 
0845 static int
0846 nfqnl_mangle(void *data, unsigned int data_len, struct nf_queue_entry *e, int diff)
0847 {
0848     struct sk_buff *nskb;
0849 
0850     if (diff < 0) {
0851         unsigned int min_len = skb_transport_offset(e->skb);
0852 
0853         if (data_len < min_len)
0854             return -EINVAL;
0855 
0856         if (pskb_trim(e->skb, data_len))
0857             return -ENOMEM;
0858     } else if (diff > 0) {
0859         if (data_len > 0xFFFF)
0860             return -EINVAL;
0861         if (diff > skb_tailroom(e->skb)) {
0862             nskb = skb_copy_expand(e->skb, skb_headroom(e->skb),
0863                            diff, GFP_ATOMIC);
0864             if (!nskb)
0865                 return -ENOMEM;
0866             kfree_skb(e->skb);
0867             e->skb = nskb;
0868         }
0869         skb_put(e->skb, diff);
0870     }
0871     if (skb_ensure_writable(e->skb, data_len))
0872         return -ENOMEM;
0873     skb_copy_to_linear_data(e->skb, data, data_len);
0874     e->skb->ip_summed = CHECKSUM_NONE;
0875     return 0;
0876 }
0877 
0878 static int
0879 nfqnl_set_mode(struct nfqnl_instance *queue,
0880            unsigned char mode, unsigned int range)
0881 {
0882     int status = 0;
0883 
0884     spin_lock_bh(&queue->lock);
0885     switch (mode) {
0886     case NFQNL_COPY_NONE:
0887     case NFQNL_COPY_META:
0888         queue->copy_mode = mode;
0889         queue->copy_range = 0;
0890         break;
0891 
0892     case NFQNL_COPY_PACKET:
0893         queue->copy_mode = mode;
0894         if (range == 0 || range > NFQNL_MAX_COPY_RANGE)
0895             queue->copy_range = NFQNL_MAX_COPY_RANGE;
0896         else
0897             queue->copy_range = range;
0898         break;
0899 
0900     default:
0901         status = -EINVAL;
0902 
0903     }
0904     spin_unlock_bh(&queue->lock);
0905 
0906     return status;
0907 }
0908 
0909 static int
0910 dev_cmp(struct nf_queue_entry *entry, unsigned long ifindex)
0911 {
0912 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
0913     int physinif, physoutif;
0914 
0915     physinif = nf_bridge_get_physinif(entry->skb);
0916     physoutif = nf_bridge_get_physoutif(entry->skb);
0917 
0918     if (physinif == ifindex || physoutif == ifindex)
0919         return 1;
0920 #endif
0921     if (entry->state.in)
0922         if (entry->state.in->ifindex == ifindex)
0923             return 1;
0924     if (entry->state.out)
0925         if (entry->state.out->ifindex == ifindex)
0926             return 1;
0927 
0928     return 0;
0929 }
0930 
0931 /* drop all packets with either indev or outdev == ifindex from all queue
0932  * instances */
0933 static void
0934 nfqnl_dev_drop(struct net *net, int ifindex)
0935 {
0936     int i;
0937     struct nfnl_queue_net *q = nfnl_queue_pernet(net);
0938 
0939     rcu_read_lock();
0940 
0941     for (i = 0; i < INSTANCE_BUCKETS; i++) {
0942         struct nfqnl_instance *inst;
0943         struct hlist_head *head = &q->instance_table[i];
0944 
0945         hlist_for_each_entry_rcu(inst, head, hlist)
0946             nfqnl_flush(inst, dev_cmp, ifindex);
0947     }
0948 
0949     rcu_read_unlock();
0950 }
0951 
0952 static int
0953 nfqnl_rcv_dev_event(struct notifier_block *this,
0954             unsigned long event, void *ptr)
0955 {
0956     struct net_device *dev = netdev_notifier_info_to_dev(ptr);
0957 
0958     /* Drop any packets associated with the downed device */
0959     if (event == NETDEV_DOWN)
0960         nfqnl_dev_drop(dev_net(dev), dev->ifindex);
0961     return NOTIFY_DONE;
0962 }
0963 
0964 static struct notifier_block nfqnl_dev_notifier = {
0965     .notifier_call  = nfqnl_rcv_dev_event,
0966 };
0967 
0968 static void nfqnl_nf_hook_drop(struct net *net)
0969 {
0970     struct nfnl_queue_net *q = nfnl_queue_pernet(net);
0971     int i;
0972 
0973     /* This function is also called on net namespace error unwind,
0974      * when pernet_ops->init() failed and ->exit() functions of the
0975      * previous pernet_ops gets called.
0976      *
0977      * This may result in a call to nfqnl_nf_hook_drop() before
0978      * struct nfnl_queue_net was allocated.
0979      */
0980     if (!q)
0981         return;
0982 
0983     for (i = 0; i < INSTANCE_BUCKETS; i++) {
0984         struct nfqnl_instance *inst;
0985         struct hlist_head *head = &q->instance_table[i];
0986 
0987         hlist_for_each_entry_rcu(inst, head, hlist)
0988             nfqnl_flush(inst, NULL, 0);
0989     }
0990 }
0991 
0992 static int
0993 nfqnl_rcv_nl_event(struct notifier_block *this,
0994            unsigned long event, void *ptr)
0995 {
0996     struct netlink_notify *n = ptr;
0997     struct nfnl_queue_net *q = nfnl_queue_pernet(n->net);
0998 
0999     if (event == NETLINK_URELEASE && n->protocol == NETLINK_NETFILTER) {
1000         int i;
1001 
1002         /* destroy all instances for this portid */
1003         spin_lock(&q->instances_lock);
1004         for (i = 0; i < INSTANCE_BUCKETS; i++) {
1005             struct hlist_node *t2;
1006             struct nfqnl_instance *inst;
1007             struct hlist_head *head = &q->instance_table[i];
1008 
1009             hlist_for_each_entry_safe(inst, t2, head, hlist) {
1010                 if (n->portid == inst->peer_portid)
1011                     __instance_destroy(inst);
1012             }
1013         }
1014         spin_unlock(&q->instances_lock);
1015     }
1016     return NOTIFY_DONE;
1017 }
1018 
1019 static struct notifier_block nfqnl_rtnl_notifier = {
1020     .notifier_call  = nfqnl_rcv_nl_event,
1021 };
1022 
1023 static const struct nla_policy nfqa_vlan_policy[NFQA_VLAN_MAX + 1] = {
1024     [NFQA_VLAN_TCI]     = { .type = NLA_U16},
1025     [NFQA_VLAN_PROTO]   = { .type = NLA_U16},
1026 };
1027 
1028 static const struct nla_policy nfqa_verdict_policy[NFQA_MAX+1] = {
1029     [NFQA_VERDICT_HDR]  = { .len = sizeof(struct nfqnl_msg_verdict_hdr) },
1030     [NFQA_MARK]     = { .type = NLA_U32 },
1031     [NFQA_PAYLOAD]      = { .type = NLA_UNSPEC },
1032     [NFQA_CT]       = { .type = NLA_UNSPEC },
1033     [NFQA_EXP]      = { .type = NLA_UNSPEC },
1034     [NFQA_VLAN]     = { .type = NLA_NESTED },
1035     [NFQA_PRIORITY]     = { .type = NLA_U32 },
1036 };
1037 
1038 static const struct nla_policy nfqa_verdict_batch_policy[NFQA_MAX+1] = {
1039     [NFQA_VERDICT_HDR]  = { .len = sizeof(struct nfqnl_msg_verdict_hdr) },
1040     [NFQA_MARK]     = { .type = NLA_U32 },
1041     [NFQA_PRIORITY]     = { .type = NLA_U32 },
1042 };
1043 
1044 static struct nfqnl_instance *
1045 verdict_instance_lookup(struct nfnl_queue_net *q, u16 queue_num, u32 nlportid)
1046 {
1047     struct nfqnl_instance *queue;
1048 
1049     queue = instance_lookup(q, queue_num);
1050     if (!queue)
1051         return ERR_PTR(-ENODEV);
1052 
1053     if (queue->peer_portid != nlportid)
1054         return ERR_PTR(-EPERM);
1055 
1056     return queue;
1057 }
1058 
1059 static struct nfqnl_msg_verdict_hdr*
1060 verdicthdr_get(const struct nlattr * const nfqa[])
1061 {
1062     struct nfqnl_msg_verdict_hdr *vhdr;
1063     unsigned int verdict;
1064 
1065     if (!nfqa[NFQA_VERDICT_HDR])
1066         return NULL;
1067 
1068     vhdr = nla_data(nfqa[NFQA_VERDICT_HDR]);
1069     verdict = ntohl(vhdr->verdict) & NF_VERDICT_MASK;
1070     if (verdict > NF_MAX_VERDICT || verdict == NF_STOLEN)
1071         return NULL;
1072     return vhdr;
1073 }
1074 
1075 static int nfq_id_after(unsigned int id, unsigned int max)
1076 {
1077     return (int)(id - max) > 0;
1078 }
1079 
1080 static int nfqnl_recv_verdict_batch(struct sk_buff *skb,
1081                     const struct nfnl_info *info,
1082                     const struct nlattr * const nfqa[])
1083 {
1084     struct nfnl_queue_net *q = nfnl_queue_pernet(info->net);
1085     u16 queue_num = ntohs(info->nfmsg->res_id);
1086     struct nf_queue_entry *entry, *tmp;
1087     struct nfqnl_msg_verdict_hdr *vhdr;
1088     struct nfqnl_instance *queue;
1089     unsigned int verdict, maxid;
1090     LIST_HEAD(batch_list);
1091 
1092     queue = verdict_instance_lookup(q, queue_num,
1093                     NETLINK_CB(skb).portid);
1094     if (IS_ERR(queue))
1095         return PTR_ERR(queue);
1096 
1097     vhdr = verdicthdr_get(nfqa);
1098     if (!vhdr)
1099         return -EINVAL;
1100 
1101     verdict = ntohl(vhdr->verdict);
1102     maxid = ntohl(vhdr->id);
1103 
1104     spin_lock_bh(&queue->lock);
1105 
1106     list_for_each_entry_safe(entry, tmp, &queue->queue_list, list) {
1107         if (nfq_id_after(entry->id, maxid))
1108             break;
1109         __dequeue_entry(queue, entry);
1110         list_add_tail(&entry->list, &batch_list);
1111     }
1112 
1113     spin_unlock_bh(&queue->lock);
1114 
1115     if (list_empty(&batch_list))
1116         return -ENOENT;
1117 
1118     list_for_each_entry_safe(entry, tmp, &batch_list, list) {
1119         if (nfqa[NFQA_MARK])
1120             entry->skb->mark = ntohl(nla_get_be32(nfqa[NFQA_MARK]));
1121 
1122         if (nfqa[NFQA_PRIORITY])
1123             entry->skb->priority = ntohl(nla_get_be32(nfqa[NFQA_PRIORITY]));
1124 
1125         nfqnl_reinject(entry, verdict);
1126     }
1127     return 0;
1128 }
1129 
1130 static struct nf_conn *nfqnl_ct_parse(const struct nfnl_ct_hook *nfnl_ct,
1131                       const struct nlmsghdr *nlh,
1132                       const struct nlattr * const nfqa[],
1133                       struct nf_queue_entry *entry,
1134                       enum ip_conntrack_info *ctinfo)
1135 {
1136 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
1137     struct nf_conn *ct;
1138 
1139     ct = nf_ct_get(entry->skb, ctinfo);
1140     if (ct == NULL)
1141         return NULL;
1142 
1143     if (nfnl_ct->parse(nfqa[NFQA_CT], ct) < 0)
1144         return NULL;
1145 
1146     if (nfqa[NFQA_EXP])
1147         nfnl_ct->attach_expect(nfqa[NFQA_EXP], ct,
1148                       NETLINK_CB(entry->skb).portid,
1149                       nlmsg_report(nlh));
1150     return ct;
1151 #else
1152     return NULL;
1153 #endif
1154 }
1155 
1156 static int nfqa_parse_bridge(struct nf_queue_entry *entry,
1157                  const struct nlattr * const nfqa[])
1158 {
1159     if (nfqa[NFQA_VLAN]) {
1160         struct nlattr *tb[NFQA_VLAN_MAX + 1];
1161         int err;
1162 
1163         err = nla_parse_nested_deprecated(tb, NFQA_VLAN_MAX,
1164                           nfqa[NFQA_VLAN],
1165                           nfqa_vlan_policy, NULL);
1166         if (err < 0)
1167             return err;
1168 
1169         if (!tb[NFQA_VLAN_TCI] || !tb[NFQA_VLAN_PROTO])
1170             return -EINVAL;
1171 
1172         __vlan_hwaccel_put_tag(entry->skb,
1173             nla_get_be16(tb[NFQA_VLAN_PROTO]),
1174             ntohs(nla_get_be16(tb[NFQA_VLAN_TCI])));
1175     }
1176 
1177     if (nfqa[NFQA_L2HDR]) {
1178         int mac_header_len = entry->skb->network_header -
1179             entry->skb->mac_header;
1180 
1181         if (mac_header_len != nla_len(nfqa[NFQA_L2HDR]))
1182             return -EINVAL;
1183         else if (mac_header_len > 0)
1184             memcpy(skb_mac_header(entry->skb),
1185                    nla_data(nfqa[NFQA_L2HDR]),
1186                    mac_header_len);
1187     }
1188 
1189     return 0;
1190 }
1191 
1192 static int nfqnl_recv_verdict(struct sk_buff *skb, const struct nfnl_info *info,
1193                   const struct nlattr * const nfqa[])
1194 {
1195     struct nfnl_queue_net *q = nfnl_queue_pernet(info->net);
1196     u_int16_t queue_num = ntohs(info->nfmsg->res_id);
1197     const struct nfnl_ct_hook *nfnl_ct;
1198     struct nfqnl_msg_verdict_hdr *vhdr;
1199     enum ip_conntrack_info ctinfo;
1200     struct nfqnl_instance *queue;
1201     struct nf_queue_entry *entry;
1202     struct nf_conn *ct = NULL;
1203     unsigned int verdict;
1204     int err;
1205 
1206     queue = verdict_instance_lookup(q, queue_num,
1207                     NETLINK_CB(skb).portid);
1208     if (IS_ERR(queue))
1209         return PTR_ERR(queue);
1210 
1211     vhdr = verdicthdr_get(nfqa);
1212     if (!vhdr)
1213         return -EINVAL;
1214 
1215     verdict = ntohl(vhdr->verdict);
1216 
1217     entry = find_dequeue_entry(queue, ntohl(vhdr->id));
1218     if (entry == NULL)
1219         return -ENOENT;
1220 
1221     /* rcu lock already held from nfnl->call_rcu. */
1222     nfnl_ct = rcu_dereference(nfnl_ct_hook);
1223 
1224     if (nfqa[NFQA_CT]) {
1225         if (nfnl_ct != NULL)
1226             ct = nfqnl_ct_parse(nfnl_ct, info->nlh, nfqa, entry,
1227                         &ctinfo);
1228     }
1229 
1230     if (entry->state.pf == PF_BRIDGE) {
1231         err = nfqa_parse_bridge(entry, nfqa);
1232         if (err < 0)
1233             return err;
1234     }
1235 
1236     if (nfqa[NFQA_PAYLOAD]) {
1237         u16 payload_len = nla_len(nfqa[NFQA_PAYLOAD]);
1238         int diff = payload_len - entry->skb->len;
1239 
1240         if (nfqnl_mangle(nla_data(nfqa[NFQA_PAYLOAD]),
1241                  payload_len, entry, diff) < 0)
1242             verdict = NF_DROP;
1243 
1244         if (ct && diff)
1245             nfnl_ct->seq_adjust(entry->skb, ct, ctinfo, diff);
1246     }
1247 
1248     if (nfqa[NFQA_MARK])
1249         entry->skb->mark = ntohl(nla_get_be32(nfqa[NFQA_MARK]));
1250 
1251     if (nfqa[NFQA_PRIORITY])
1252         entry->skb->priority = ntohl(nla_get_be32(nfqa[NFQA_PRIORITY]));
1253 
1254     nfqnl_reinject(entry, verdict);
1255     return 0;
1256 }
1257 
1258 static int nfqnl_recv_unsupp(struct sk_buff *skb, const struct nfnl_info *info,
1259                  const struct nlattr * const cda[])
1260 {
1261     return -ENOTSUPP;
1262 }
1263 
1264 static const struct nla_policy nfqa_cfg_policy[NFQA_CFG_MAX+1] = {
1265     [NFQA_CFG_CMD]      = { .len = sizeof(struct nfqnl_msg_config_cmd) },
1266     [NFQA_CFG_PARAMS]   = { .len = sizeof(struct nfqnl_msg_config_params) },
1267     [NFQA_CFG_QUEUE_MAXLEN] = { .type = NLA_U32 },
1268     [NFQA_CFG_MASK]     = { .type = NLA_U32 },
1269     [NFQA_CFG_FLAGS]    = { .type = NLA_U32 },
1270 };
1271 
1272 static const struct nf_queue_handler nfqh = {
1273     .outfn      = nfqnl_enqueue_packet,
1274     .nf_hook_drop   = nfqnl_nf_hook_drop,
1275 };
1276 
1277 static int nfqnl_recv_config(struct sk_buff *skb, const struct nfnl_info *info,
1278                  const struct nlattr * const nfqa[])
1279 {
1280     struct nfnl_queue_net *q = nfnl_queue_pernet(info->net);
1281     u_int16_t queue_num = ntohs(info->nfmsg->res_id);
1282     struct nfqnl_msg_config_cmd *cmd = NULL;
1283     struct nfqnl_instance *queue;
1284     __u32 flags = 0, mask = 0;
1285     int ret = 0;
1286 
1287     if (nfqa[NFQA_CFG_CMD]) {
1288         cmd = nla_data(nfqa[NFQA_CFG_CMD]);
1289 
1290         /* Obsolete commands without queue context */
1291         switch (cmd->command) {
1292         case NFQNL_CFG_CMD_PF_BIND: return 0;
1293         case NFQNL_CFG_CMD_PF_UNBIND: return 0;
1294         }
1295     }
1296 
1297     /* Check if we support these flags in first place, dependencies should
1298      * be there too not to break atomicity.
1299      */
1300     if (nfqa[NFQA_CFG_FLAGS]) {
1301         if (!nfqa[NFQA_CFG_MASK]) {
1302             /* A mask is needed to specify which flags are being
1303              * changed.
1304              */
1305             return -EINVAL;
1306         }
1307 
1308         flags = ntohl(nla_get_be32(nfqa[NFQA_CFG_FLAGS]));
1309         mask = ntohl(nla_get_be32(nfqa[NFQA_CFG_MASK]));
1310 
1311         if (flags >= NFQA_CFG_F_MAX)
1312             return -EOPNOTSUPP;
1313 
1314 #if !IS_ENABLED(CONFIG_NETWORK_SECMARK)
1315         if (flags & mask & NFQA_CFG_F_SECCTX)
1316             return -EOPNOTSUPP;
1317 #endif
1318         if ((flags & mask & NFQA_CFG_F_CONNTRACK) &&
1319             !rcu_access_pointer(nfnl_ct_hook)) {
1320 #ifdef CONFIG_MODULES
1321             nfnl_unlock(NFNL_SUBSYS_QUEUE);
1322             request_module("ip_conntrack_netlink");
1323             nfnl_lock(NFNL_SUBSYS_QUEUE);
1324             if (rcu_access_pointer(nfnl_ct_hook))
1325                 return -EAGAIN;
1326 #endif
1327             return -EOPNOTSUPP;
1328         }
1329     }
1330 
1331     rcu_read_lock();
1332     queue = instance_lookup(q, queue_num);
1333     if (queue && queue->peer_portid != NETLINK_CB(skb).portid) {
1334         ret = -EPERM;
1335         goto err_out_unlock;
1336     }
1337 
1338     if (cmd != NULL) {
1339         switch (cmd->command) {
1340         case NFQNL_CFG_CMD_BIND:
1341             if (queue) {
1342                 ret = -EBUSY;
1343                 goto err_out_unlock;
1344             }
1345             queue = instance_create(q, queue_num,
1346                         NETLINK_CB(skb).portid);
1347             if (IS_ERR(queue)) {
1348                 ret = PTR_ERR(queue);
1349                 goto err_out_unlock;
1350             }
1351             break;
1352         case NFQNL_CFG_CMD_UNBIND:
1353             if (!queue) {
1354                 ret = -ENODEV;
1355                 goto err_out_unlock;
1356             }
1357             instance_destroy(q, queue);
1358             goto err_out_unlock;
1359         case NFQNL_CFG_CMD_PF_BIND:
1360         case NFQNL_CFG_CMD_PF_UNBIND:
1361             break;
1362         default:
1363             ret = -ENOTSUPP;
1364             goto err_out_unlock;
1365         }
1366     }
1367 
1368     if (!queue) {
1369         ret = -ENODEV;
1370         goto err_out_unlock;
1371     }
1372 
1373     if (nfqa[NFQA_CFG_PARAMS]) {
1374         struct nfqnl_msg_config_params *params =
1375             nla_data(nfqa[NFQA_CFG_PARAMS]);
1376 
1377         nfqnl_set_mode(queue, params->copy_mode,
1378                 ntohl(params->copy_range));
1379     }
1380 
1381     if (nfqa[NFQA_CFG_QUEUE_MAXLEN]) {
1382         __be32 *queue_maxlen = nla_data(nfqa[NFQA_CFG_QUEUE_MAXLEN]);
1383 
1384         spin_lock_bh(&queue->lock);
1385         queue->queue_maxlen = ntohl(*queue_maxlen);
1386         spin_unlock_bh(&queue->lock);
1387     }
1388 
1389     if (nfqa[NFQA_CFG_FLAGS]) {
1390         spin_lock_bh(&queue->lock);
1391         queue->flags &= ~mask;
1392         queue->flags |= flags & mask;
1393         spin_unlock_bh(&queue->lock);
1394     }
1395 
1396 err_out_unlock:
1397     rcu_read_unlock();
1398     return ret;
1399 }
1400 
1401 static const struct nfnl_callback nfqnl_cb[NFQNL_MSG_MAX] = {
1402     [NFQNL_MSG_PACKET]  = {
1403         .call       = nfqnl_recv_unsupp,
1404         .type       = NFNL_CB_RCU,
1405         .attr_count = NFQA_MAX,
1406     },
1407     [NFQNL_MSG_VERDICT] = {
1408         .call       = nfqnl_recv_verdict,
1409         .type       = NFNL_CB_RCU,
1410         .attr_count = NFQA_MAX,
1411         .policy     = nfqa_verdict_policy
1412     },
1413     [NFQNL_MSG_CONFIG]  = {
1414         .call       = nfqnl_recv_config,
1415         .type       = NFNL_CB_MUTEX,
1416         .attr_count = NFQA_CFG_MAX,
1417         .policy     = nfqa_cfg_policy
1418     },
1419     [NFQNL_MSG_VERDICT_BATCH] = {
1420         .call       = nfqnl_recv_verdict_batch,
1421         .type       = NFNL_CB_RCU,
1422         .attr_count = NFQA_MAX,
1423         .policy     = nfqa_verdict_batch_policy
1424     },
1425 };
1426 
1427 static const struct nfnetlink_subsystem nfqnl_subsys = {
1428     .name       = "nf_queue",
1429     .subsys_id  = NFNL_SUBSYS_QUEUE,
1430     .cb_count   = NFQNL_MSG_MAX,
1431     .cb     = nfqnl_cb,
1432 };
1433 
1434 #ifdef CONFIG_PROC_FS
1435 struct iter_state {
1436     struct seq_net_private p;
1437     unsigned int bucket;
1438 };
1439 
1440 static struct hlist_node *get_first(struct seq_file *seq)
1441 {
1442     struct iter_state *st = seq->private;
1443     struct net *net;
1444     struct nfnl_queue_net *q;
1445 
1446     if (!st)
1447         return NULL;
1448 
1449     net = seq_file_net(seq);
1450     q = nfnl_queue_pernet(net);
1451     for (st->bucket = 0; st->bucket < INSTANCE_BUCKETS; st->bucket++) {
1452         if (!hlist_empty(&q->instance_table[st->bucket]))
1453             return q->instance_table[st->bucket].first;
1454     }
1455     return NULL;
1456 }
1457 
1458 static struct hlist_node *get_next(struct seq_file *seq, struct hlist_node *h)
1459 {
1460     struct iter_state *st = seq->private;
1461     struct net *net = seq_file_net(seq);
1462 
1463     h = h->next;
1464     while (!h) {
1465         struct nfnl_queue_net *q;
1466 
1467         if (++st->bucket >= INSTANCE_BUCKETS)
1468             return NULL;
1469 
1470         q = nfnl_queue_pernet(net);
1471         h = q->instance_table[st->bucket].first;
1472     }
1473     return h;
1474 }
1475 
1476 static struct hlist_node *get_idx(struct seq_file *seq, loff_t pos)
1477 {
1478     struct hlist_node *head;
1479     head = get_first(seq);
1480 
1481     if (head)
1482         while (pos && (head = get_next(seq, head)))
1483             pos--;
1484     return pos ? NULL : head;
1485 }
1486 
1487 static void *seq_start(struct seq_file *s, loff_t *pos)
1488     __acquires(nfnl_queue_pernet(seq_file_net(s))->instances_lock)
1489 {
1490     spin_lock(&nfnl_queue_pernet(seq_file_net(s))->instances_lock);
1491     return get_idx(s, *pos);
1492 }
1493 
1494 static void *seq_next(struct seq_file *s, void *v, loff_t *pos)
1495 {
1496     (*pos)++;
1497     return get_next(s, v);
1498 }
1499 
1500 static void seq_stop(struct seq_file *s, void *v)
1501     __releases(nfnl_queue_pernet(seq_file_net(s))->instances_lock)
1502 {
1503     spin_unlock(&nfnl_queue_pernet(seq_file_net(s))->instances_lock);
1504 }
1505 
1506 static int seq_show(struct seq_file *s, void *v)
1507 {
1508     const struct nfqnl_instance *inst = v;
1509 
1510     seq_printf(s, "%5u %6u %5u %1u %5u %5u %5u %8u %2d\n",
1511            inst->queue_num,
1512            inst->peer_portid, inst->queue_total,
1513            inst->copy_mode, inst->copy_range,
1514            inst->queue_dropped, inst->queue_user_dropped,
1515            inst->id_sequence, 1);
1516     return 0;
1517 }
1518 
1519 static const struct seq_operations nfqnl_seq_ops = {
1520     .start  = seq_start,
1521     .next   = seq_next,
1522     .stop   = seq_stop,
1523     .show   = seq_show,
1524 };
1525 #endif /* PROC_FS */
1526 
1527 static int __net_init nfnl_queue_net_init(struct net *net)
1528 {
1529     unsigned int i;
1530     struct nfnl_queue_net *q = nfnl_queue_pernet(net);
1531 
1532     for (i = 0; i < INSTANCE_BUCKETS; i++)
1533         INIT_HLIST_HEAD(&q->instance_table[i]);
1534 
1535     spin_lock_init(&q->instances_lock);
1536 
1537 #ifdef CONFIG_PROC_FS
1538     if (!proc_create_net("nfnetlink_queue", 0440, net->nf.proc_netfilter,
1539             &nfqnl_seq_ops, sizeof(struct iter_state)))
1540         return -ENOMEM;
1541 #endif
1542     return 0;
1543 }
1544 
1545 static void __net_exit nfnl_queue_net_exit(struct net *net)
1546 {
1547     struct nfnl_queue_net *q = nfnl_queue_pernet(net);
1548     unsigned int i;
1549 
1550 #ifdef CONFIG_PROC_FS
1551     remove_proc_entry("nfnetlink_queue", net->nf.proc_netfilter);
1552 #endif
1553     for (i = 0; i < INSTANCE_BUCKETS; i++)
1554         WARN_ON_ONCE(!hlist_empty(&q->instance_table[i]));
1555 }
1556 
1557 static struct pernet_operations nfnl_queue_net_ops = {
1558     .init       = nfnl_queue_net_init,
1559     .exit       = nfnl_queue_net_exit,
1560     .id     = &nfnl_queue_net_id,
1561     .size       = sizeof(struct nfnl_queue_net),
1562 };
1563 
1564 static int __init nfnetlink_queue_init(void)
1565 {
1566     int status;
1567 
1568     status = register_pernet_subsys(&nfnl_queue_net_ops);
1569     if (status < 0) {
1570         pr_err("failed to register pernet ops\n");
1571         goto out;
1572     }
1573 
1574     netlink_register_notifier(&nfqnl_rtnl_notifier);
1575     status = nfnetlink_subsys_register(&nfqnl_subsys);
1576     if (status < 0) {
1577         pr_err("failed to create netlink socket\n");
1578         goto cleanup_netlink_notifier;
1579     }
1580 
1581     status = register_netdevice_notifier(&nfqnl_dev_notifier);
1582     if (status < 0) {
1583         pr_err("failed to register netdevice notifier\n");
1584         goto cleanup_netlink_subsys;
1585     }
1586 
1587     nf_register_queue_handler(&nfqh);
1588 
1589     return status;
1590 
1591 cleanup_netlink_subsys:
1592     nfnetlink_subsys_unregister(&nfqnl_subsys);
1593 cleanup_netlink_notifier:
1594     netlink_unregister_notifier(&nfqnl_rtnl_notifier);
1595     unregister_pernet_subsys(&nfnl_queue_net_ops);
1596 out:
1597     return status;
1598 }
1599 
1600 static void __exit nfnetlink_queue_fini(void)
1601 {
1602     nf_unregister_queue_handler();
1603     unregister_netdevice_notifier(&nfqnl_dev_notifier);
1604     nfnetlink_subsys_unregister(&nfqnl_subsys);
1605     netlink_unregister_notifier(&nfqnl_rtnl_notifier);
1606     unregister_pernet_subsys(&nfnl_queue_net_ops);
1607 
1608     rcu_barrier(); /* Wait for completion of call_rcu()'s */
1609 }
1610 
1611 MODULE_DESCRIPTION("netfilter packet queue handler");
1612 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
1613 MODULE_LICENSE("GPL");
1614 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_QUEUE);
1615 
1616 module_init(nfnetlink_queue_init);
1617 module_exit(nfnetlink_queue_fini);
[ Source navigation ] [ Diff markup ] [ Identifier search ] [ general search ]

This page was automatically generated by the 2.1.0 LXR engine.

The LXR team
Valid CSS 2.1! Valid HTML 4.01!