nfnetlink.c 8.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375
  1. /* Netfilter messages via netlink socket. Allows for user space
  2. * protocol helpers and general trouble making from userspace.
  3. *
  4. * (C) 2001 by Jay Schulist <jschlst@samba.org>,
  5. * (C) 2002-2005 by Harald Welte <laforge@gnumonks.org>
  6. * (C) 2005 by Pablo Neira Ayuso <pablo@eurodev.net>
  7. *
  8. * Initial netfilter messages via netlink development funded and
  9. * generally made possible by Network Robots, Inc. (www.networkrobots.com)
  10. *
  11. * Further development of this code funded by Astaro AG (http://www.astaro.com)
  12. *
  13. * This software may be used and distributed according to the terms
  14. * of the GNU General Public License, incorporated herein by reference.
  15. */
  16. #include <linux/module.h>
  17. #include <linux/types.h>
  18. #include <linux/socket.h>
  19. #include <linux/kernel.h>
  20. #include <linux/major.h>
  21. #include <linux/timer.h>
  22. #include <linux/string.h>
  23. #include <linux/sockios.h>
  24. #include <linux/net.h>
  25. #include <linux/fcntl.h>
  26. #include <linux/skbuff.h>
  27. #include <asm/uaccess.h>
  28. #include <asm/system.h>
  29. #include <net/sock.h>
  30. #include <linux/init.h>
  31. #include <linux/spinlock.h>
  32. #include <linux/netfilter.h>
  33. #include <linux/netlink.h>
  34. #include <linux/netfilter/nfnetlink.h>
  35. MODULE_LICENSE("GPL");
  36. MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
  37. MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_NETFILTER);
  38. static char __initdata nfversion[] = "0.30";
  39. #if 0
  40. #define DEBUGP(format, args...) \
  41. printk(KERN_DEBUG "%s(%d):%s(): " format, __FILE__, \
  42. __LINE__, __FUNCTION__, ## args)
  43. #else
  44. #define DEBUGP(format, args...)
  45. #endif
  46. static struct sock *nfnl = NULL;
  47. static struct nfnetlink_subsystem *subsys_table[NFNL_SUBSYS_COUNT];
  48. DECLARE_MUTEX(nfnl_sem);
  49. void nfnl_lock(void)
  50. {
  51. nfnl_shlock();
  52. }
  53. void nfnl_unlock(void)
  54. {
  55. nfnl_shunlock();
  56. }
  57. int nfnetlink_subsys_register(struct nfnetlink_subsystem *n)
  58. {
  59. DEBUGP("registering subsystem ID %u\n", n->subsys_id);
  60. nfnl_lock();
  61. if (subsys_table[n->subsys_id]) {
  62. nfnl_unlock();
  63. return -EBUSY;
  64. }
  65. subsys_table[n->subsys_id] = n;
  66. nfnl_unlock();
  67. return 0;
  68. }
  69. int nfnetlink_subsys_unregister(struct nfnetlink_subsystem *n)
  70. {
  71. DEBUGP("unregistering subsystem ID %u\n", n->subsys_id);
  72. nfnl_lock();
  73. subsys_table[n->subsys_id] = NULL;
  74. nfnl_unlock();
  75. return 0;
  76. }
  77. static inline struct nfnetlink_subsystem *nfnetlink_get_subsys(u_int16_t type)
  78. {
  79. u_int8_t subsys_id = NFNL_SUBSYS_ID(type);
  80. if (subsys_id >= NFNL_SUBSYS_COUNT
  81. || subsys_table[subsys_id] == NULL)
  82. return NULL;
  83. return subsys_table[subsys_id];
  84. }
  85. static inline struct nfnl_callback *
  86. nfnetlink_find_client(u_int16_t type, struct nfnetlink_subsystem *ss)
  87. {
  88. u_int8_t cb_id = NFNL_MSG_TYPE(type);
  89. if (cb_id >= ss->cb_count) {
  90. DEBUGP("msgtype %u >= %u, returning\n", type, ss->cb_count);
  91. return NULL;
  92. }
  93. return &ss->cb[cb_id];
  94. }
  95. void __nfa_fill(struct sk_buff *skb, int attrtype, int attrlen,
  96. const void *data)
  97. {
  98. struct nfattr *nfa;
  99. int size = NFA_LENGTH(attrlen);
  100. nfa = (struct nfattr *)skb_put(skb, NFA_ALIGN(size));
  101. nfa->nfa_type = attrtype;
  102. nfa->nfa_len = size;
  103. memcpy(NFA_DATA(nfa), data, attrlen);
  104. memset(NFA_DATA(nfa) + attrlen, 0, NFA_ALIGN(size) - size);
  105. }
  106. void nfattr_parse(struct nfattr *tb[], int maxattr, struct nfattr *nfa, int len)
  107. {
  108. memset(tb, 0, sizeof(struct nfattr *) * maxattr);
  109. while (NFA_OK(nfa, len)) {
  110. unsigned flavor = NFA_TYPE(nfa);
  111. if (flavor && flavor <= maxattr)
  112. tb[flavor-1] = nfa;
  113. nfa = NFA_NEXT(nfa, len);
  114. }
  115. }
  116. /**
  117. * nfnetlink_check_attributes - check and parse nfnetlink attributes
  118. *
  119. * subsys: nfnl subsystem for which this message is to be parsed
  120. * nlmsghdr: netlink message to be checked/parsed
  121. * cda: array of pointers, needs to be at least subsys->attr_count big
  122. *
  123. */
  124. static int
  125. nfnetlink_check_attributes(struct nfnetlink_subsystem *subsys,
  126. struct nlmsghdr *nlh, struct nfattr *cda[])
  127. {
  128. int min_len;
  129. u_int16_t attr_count;
  130. u_int8_t cb_id = NFNL_MSG_TYPE(nlh->nlmsg_type);
  131. if (unlikely(cb_id >= subsys->cb_count)) {
  132. DEBUGP("msgtype %u >= %u, returning\n",
  133. cb_id, subsys->cb_count);
  134. return -EINVAL;
  135. }
  136. min_len = NLMSG_SPACE(sizeof(struct nfgenmsg));
  137. if (unlikely(nlh->nlmsg_len < min_len))
  138. return -EINVAL;
  139. attr_count = subsys->cb[cb_id].attr_count;
  140. memset(cda, 0, sizeof(struct nfattr *) * attr_count);
  141. /* check attribute lengths. */
  142. if (likely(nlh->nlmsg_len > min_len)) {
  143. struct nfattr *attr = NFM_NFA(NLMSG_DATA(nlh));
  144. int attrlen = nlh->nlmsg_len - NLMSG_ALIGN(min_len);
  145. while (NFA_OK(attr, attrlen)) {
  146. unsigned flavor = NFA_TYPE(attr);
  147. if (flavor) {
  148. if (flavor > attr_count)
  149. return -EINVAL;
  150. cda[flavor - 1] = attr;
  151. }
  152. attr = NFA_NEXT(attr, attrlen);
  153. }
  154. }
  155. /* implicit: if nlmsg_len == min_len, we return 0, and an empty
  156. * (zeroed) cda[] array. The message is valid, but empty. */
  157. return 0;
  158. }
  159. int nfnetlink_has_listeners(unsigned int group)
  160. {
  161. return netlink_has_listeners(nfnl, group);
  162. }
  163. EXPORT_SYMBOL_GPL(nfnetlink_has_listeners);
  164. int nfnetlink_send(struct sk_buff *skb, u32 pid, unsigned group, int echo)
  165. {
  166. int err = 0;
  167. NETLINK_CB(skb).dst_group = group;
  168. if (echo)
  169. atomic_inc(&skb->users);
  170. netlink_broadcast(nfnl, skb, pid, group, gfp_any());
  171. if (echo)
  172. err = netlink_unicast(nfnl, skb, pid, MSG_DONTWAIT);
  173. return err;
  174. }
  175. int nfnetlink_unicast(struct sk_buff *skb, u_int32_t pid, int flags)
  176. {
  177. return netlink_unicast(nfnl, skb, pid, flags);
  178. }
  179. /* Process one complete nfnetlink message. */
  180. static int nfnetlink_rcv_msg(struct sk_buff *skb,
  181. struct nlmsghdr *nlh, int *errp)
  182. {
  183. struct nfnl_callback *nc;
  184. struct nfnetlink_subsystem *ss;
  185. int type, err = 0;
  186. DEBUGP("entered; subsys=%u, msgtype=%u\n",
  187. NFNL_SUBSYS_ID(nlh->nlmsg_type),
  188. NFNL_MSG_TYPE(nlh->nlmsg_type));
  189. if (security_netlink_recv(skb, CAP_NET_ADMIN)) {
  190. DEBUGP("missing CAP_NET_ADMIN\n");
  191. *errp = -EPERM;
  192. return -1;
  193. }
  194. /* Only requests are handled by kernel now. */
  195. if (!(nlh->nlmsg_flags & NLM_F_REQUEST)) {
  196. DEBUGP("received non-request message\n");
  197. return 0;
  198. }
  199. /* All the messages must at least contain nfgenmsg */
  200. if (nlh->nlmsg_len < NLMSG_SPACE(sizeof(struct nfgenmsg))) {
  201. DEBUGP("received message was too short\n");
  202. return 0;
  203. }
  204. type = nlh->nlmsg_type;
  205. ss = nfnetlink_get_subsys(type);
  206. if (!ss) {
  207. #ifdef CONFIG_KMOD
  208. /* don't call nfnl_shunlock, since it would reenter
  209. * with further packet processing */
  210. up(&nfnl_sem);
  211. request_module("nfnetlink-subsys-%d", NFNL_SUBSYS_ID(type));
  212. nfnl_shlock();
  213. ss = nfnetlink_get_subsys(type);
  214. if (!ss)
  215. #endif
  216. goto err_inval;
  217. }
  218. nc = nfnetlink_find_client(type, ss);
  219. if (!nc) {
  220. DEBUGP("unable to find client for type %d\n", type);
  221. goto err_inval;
  222. }
  223. {
  224. u_int16_t attr_count =
  225. ss->cb[NFNL_MSG_TYPE(nlh->nlmsg_type)].attr_count;
  226. struct nfattr *cda[attr_count];
  227. memset(cda, 0, sizeof(struct nfattr *) * attr_count);
  228. err = nfnetlink_check_attributes(ss, nlh, cda);
  229. if (err < 0)
  230. goto err_inval;
  231. DEBUGP("calling handler\n");
  232. err = nc->call(nfnl, skb, nlh, cda, errp);
  233. *errp = err;
  234. return err;
  235. }
  236. err_inval:
  237. DEBUGP("returning -EINVAL\n");
  238. *errp = -EINVAL;
  239. return -1;
  240. }
  241. /* Process one packet of messages. */
  242. static inline int nfnetlink_rcv_skb(struct sk_buff *skb)
  243. {
  244. int err;
  245. struct nlmsghdr *nlh;
  246. while (skb->len >= NLMSG_SPACE(0)) {
  247. u32 rlen;
  248. nlh = (struct nlmsghdr *)skb->data;
  249. if (nlh->nlmsg_len < sizeof(struct nlmsghdr)
  250. || skb->len < nlh->nlmsg_len)
  251. return 0;
  252. rlen = NLMSG_ALIGN(nlh->nlmsg_len);
  253. if (rlen > skb->len)
  254. rlen = skb->len;
  255. if (nfnetlink_rcv_msg(skb, nlh, &err)) {
  256. if (!err)
  257. return -1;
  258. netlink_ack(skb, nlh, err);
  259. } else
  260. if (nlh->nlmsg_flags & NLM_F_ACK)
  261. netlink_ack(skb, nlh, 0);
  262. skb_pull(skb, rlen);
  263. }
  264. return 0;
  265. }
  266. static void nfnetlink_rcv(struct sock *sk, int len)
  267. {
  268. do {
  269. struct sk_buff *skb;
  270. if (nfnl_shlock_nowait())
  271. return;
  272. while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
  273. if (nfnetlink_rcv_skb(skb)) {
  274. if (skb->len)
  275. skb_queue_head(&sk->sk_receive_queue,
  276. skb);
  277. else
  278. kfree_skb(skb);
  279. break;
  280. }
  281. kfree_skb(skb);
  282. }
  283. /* don't call nfnl_shunlock, since it would reenter
  284. * with further packet processing */
  285. up(&nfnl_sem);
  286. } while(nfnl && nfnl->sk_receive_queue.qlen);
  287. }
  288. static void __exit nfnetlink_exit(void)
  289. {
  290. printk("Removing netfilter NETLINK layer.\n");
  291. sock_release(nfnl->sk_socket);
  292. return;
  293. }
  294. static int __init nfnetlink_init(void)
  295. {
  296. printk("Netfilter messages via NETLINK v%s.\n", nfversion);
  297. nfnl = netlink_kernel_create(NETLINK_NETFILTER, NFNLGRP_MAX,
  298. nfnetlink_rcv, THIS_MODULE);
  299. if (!nfnl) {
  300. printk(KERN_ERR "cannot initialize nfnetlink!\n");
  301. return -1;
  302. }
  303. return 0;
  304. }
  305. module_init(nfnetlink_init);
  306. module_exit(nfnetlink_exit);
  307. EXPORT_SYMBOL_GPL(nfnetlink_subsys_register);
  308. EXPORT_SYMBOL_GPL(nfnetlink_subsys_unregister);
  309. EXPORT_SYMBOL_GPL(nfnetlink_send);
  310. EXPORT_SYMBOL_GPL(nfnetlink_unicast);
  311. EXPORT_SYMBOL_GPL(nfattr_parse);
  312. EXPORT_SYMBOL_GPL(__nfa_fill);