nfnetlink_log.c 29 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * This is a module which is used for logging packets to userspace via
  4. * nfetlink.
  5. *
  6. * (C) 2005 by Harald Welte <laforge@netfilter.org>
  7. * (C) 2006-2012 Patrick McHardy <kaber@trash.net>
  8. *
  9. * Based on the old ipv4-only ipt_ULOG.c:
  10. * (C) 2000-2004 by Harald Welte <laforge@netfilter.org>
  11. */
  12. #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  13. #include <linux/module.h>
  14. #include <linux/skbuff.h>
  15. #include <linux/if_arp.h>
  16. #include <linux/init.h>
  17. #include <linux/ip.h>
  18. #include <linux/ipv6.h>
  19. #include <linux/netdevice.h>
  20. #include <linux/netfilter.h>
  21. #include <linux/netfilter_bridge.h>
  22. #include <net/netlink.h>
  23. #include <linux/netfilter/nfnetlink.h>
  24. #include <linux/netfilter/nfnetlink_log.h>
  25. #include <linux/netfilter/nf_conntrack_common.h>
  26. #include <linux/spinlock.h>
  27. #include <linux/sysctl.h>
  28. #include <linux/proc_fs.h>
  29. #include <linux/security.h>
  30. #include <linux/list.h>
  31. #include <linux/slab.h>
  32. #include <net/sock.h>
  33. #include <net/netfilter/nf_log.h>
  34. #include <net/netns/generic.h>
  35. #include <linux/atomic.h>
  36. #include <linux/refcount.h>
  37. #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
  38. #include "../bridge/br_private.h"
  39. #endif
  40. #define NFULNL_COPY_DISABLED 0xff
  41. #define NFULNL_NLBUFSIZ_DEFAULT NLMSG_GOODSIZE
  42. #define NFULNL_TIMEOUT_DEFAULT 100 /* every second */
  43. #define NFULNL_QTHRESH_DEFAULT 100 /* 100 packets */
  44. /* max packet size is limited by 16-bit struct nfattr nfa_len field */
  45. #define NFULNL_COPY_RANGE_MAX (0xFFFF - NLA_HDRLEN)
  46. #define PRINTR(x, args...) do { if (net_ratelimit()) \
  47. printk(x, ## args); } while (0);
  48. struct nfulnl_instance {
  49. struct hlist_node hlist; /* global list of instances */
  50. spinlock_t lock;
  51. refcount_t use; /* use count */
  52. unsigned int qlen; /* number of nlmsgs in skb */
  53. struct sk_buff *skb; /* pre-allocatd skb */
  54. struct timer_list timer;
  55. struct net *net;
  56. struct user_namespace *peer_user_ns; /* User namespace of the peer process */
  57. u32 peer_portid; /* PORTID of the peer process */
  58. /* configurable parameters */
  59. unsigned int flushtimeout; /* timeout until queue flush */
  60. unsigned int nlbufsiz; /* netlink buffer allocation size */
  61. unsigned int qthreshold; /* threshold of the queue */
  62. u_int32_t copy_range;
  63. u_int32_t seq; /* instance-local sequential counter */
  64. u_int16_t group_num; /* number of this queue */
  65. u_int16_t flags;
  66. u_int8_t copy_mode;
  67. struct rcu_head rcu;
  68. };
  69. #define INSTANCE_BUCKETS 16
  70. static unsigned int nfnl_log_net_id __read_mostly;
  71. struct nfnl_log_net {
  72. spinlock_t instances_lock;
  73. struct hlist_head instance_table[INSTANCE_BUCKETS];
  74. atomic_t global_seq;
  75. };
  76. static struct nfnl_log_net *nfnl_log_pernet(struct net *net)
  77. {
  78. return net_generic(net, nfnl_log_net_id);
  79. }
  80. static inline u_int8_t instance_hashfn(u_int16_t group_num)
  81. {
  82. return ((group_num & 0xff) % INSTANCE_BUCKETS);
  83. }
  84. static struct nfulnl_instance *
  85. __instance_lookup(struct nfnl_log_net *log, u_int16_t group_num)
  86. {
  87. struct hlist_head *head;
  88. struct nfulnl_instance *inst;
  89. head = &log->instance_table[instance_hashfn(group_num)];
  90. hlist_for_each_entry_rcu(inst, head, hlist) {
  91. if (inst->group_num == group_num)
  92. return inst;
  93. }
  94. return NULL;
  95. }
  96. static inline void
  97. instance_get(struct nfulnl_instance *inst)
  98. {
  99. refcount_inc(&inst->use);
  100. }
  101. static struct nfulnl_instance *
  102. instance_lookup_get(struct nfnl_log_net *log, u_int16_t group_num)
  103. {
  104. struct nfulnl_instance *inst;
  105. rcu_read_lock_bh();
  106. inst = __instance_lookup(log, group_num);
  107. if (inst && !refcount_inc_not_zero(&inst->use))
  108. inst = NULL;
  109. rcu_read_unlock_bh();
  110. return inst;
  111. }
  112. static void nfulnl_instance_free_rcu(struct rcu_head *head)
  113. {
  114. struct nfulnl_instance *inst =
  115. container_of(head, struct nfulnl_instance, rcu);
  116. put_net(inst->net);
  117. kfree(inst);
  118. module_put(THIS_MODULE);
  119. }
  120. static void
  121. instance_put(struct nfulnl_instance *inst)
  122. {
  123. if (inst && refcount_dec_and_test(&inst->use))
  124. call_rcu(&inst->rcu, nfulnl_instance_free_rcu);
  125. }
  126. static void nfulnl_timer(struct timer_list *t);
  127. static struct nfulnl_instance *
  128. instance_create(struct net *net, u_int16_t group_num,
  129. u32 portid, struct user_namespace *user_ns)
  130. {
  131. struct nfulnl_instance *inst;
  132. struct nfnl_log_net *log = nfnl_log_pernet(net);
  133. int err;
  134. spin_lock_bh(&log->instances_lock);
  135. if (__instance_lookup(log, group_num)) {
  136. err = -EEXIST;
  137. goto out_unlock;
  138. }
  139. inst = kzalloc(sizeof(*inst), GFP_ATOMIC);
  140. if (!inst) {
  141. err = -ENOMEM;
  142. goto out_unlock;
  143. }
  144. if (!try_module_get(THIS_MODULE)) {
  145. kfree(inst);
  146. err = -EAGAIN;
  147. goto out_unlock;
  148. }
  149. INIT_HLIST_NODE(&inst->hlist);
  150. spin_lock_init(&inst->lock);
  151. /* needs to be two, since we _put() after creation */
  152. refcount_set(&inst->use, 2);
  153. timer_setup(&inst->timer, nfulnl_timer, 0);
  154. inst->net = get_net(net);
  155. inst->peer_user_ns = user_ns;
  156. inst->peer_portid = portid;
  157. inst->group_num = group_num;
  158. inst->qthreshold = NFULNL_QTHRESH_DEFAULT;
  159. inst->flushtimeout = NFULNL_TIMEOUT_DEFAULT;
  160. inst->nlbufsiz = NFULNL_NLBUFSIZ_DEFAULT;
  161. inst->copy_mode = NFULNL_COPY_PACKET;
  162. inst->copy_range = NFULNL_COPY_RANGE_MAX;
  163. hlist_add_head_rcu(&inst->hlist,
  164. &log->instance_table[instance_hashfn(group_num)]);
  165. spin_unlock_bh(&log->instances_lock);
  166. return inst;
  167. out_unlock:
  168. spin_unlock_bh(&log->instances_lock);
  169. return ERR_PTR(err);
  170. }
  171. static void __nfulnl_flush(struct nfulnl_instance *inst);
  172. /* called with BH disabled */
  173. static void
  174. __instance_destroy(struct nfulnl_instance *inst)
  175. {
  176. /* first pull it out of the global list */
  177. hlist_del_rcu(&inst->hlist);
  178. /* then flush all pending packets from skb */
  179. spin_lock(&inst->lock);
  180. /* lockless readers wont be able to use us */
  181. inst->copy_mode = NFULNL_COPY_DISABLED;
  182. if (inst->skb)
  183. __nfulnl_flush(inst);
  184. spin_unlock(&inst->lock);
  185. /* and finally put the refcount */
  186. instance_put(inst);
  187. }
  188. static inline void
  189. instance_destroy(struct nfnl_log_net *log,
  190. struct nfulnl_instance *inst)
  191. {
  192. spin_lock_bh(&log->instances_lock);
  193. __instance_destroy(inst);
  194. spin_unlock_bh(&log->instances_lock);
  195. }
  196. static int
  197. nfulnl_set_mode(struct nfulnl_instance *inst, u_int8_t mode,
  198. unsigned int range)
  199. {
  200. int status = 0;
  201. spin_lock_bh(&inst->lock);
  202. switch (mode) {
  203. case NFULNL_COPY_NONE:
  204. case NFULNL_COPY_META:
  205. inst->copy_mode = mode;
  206. inst->copy_range = 0;
  207. break;
  208. case NFULNL_COPY_PACKET:
  209. inst->copy_mode = mode;
  210. if (range == 0)
  211. range = NFULNL_COPY_RANGE_MAX;
  212. inst->copy_range = min_t(unsigned int,
  213. range, NFULNL_COPY_RANGE_MAX);
  214. break;
  215. default:
  216. status = -EINVAL;
  217. break;
  218. }
  219. spin_unlock_bh(&inst->lock);
  220. return status;
  221. }
  222. static int
  223. nfulnl_set_nlbufsiz(struct nfulnl_instance *inst, u_int32_t nlbufsiz)
  224. {
  225. int status;
  226. spin_lock_bh(&inst->lock);
  227. if (nlbufsiz < NFULNL_NLBUFSIZ_DEFAULT)
  228. status = -ERANGE;
  229. else if (nlbufsiz > 131072)
  230. status = -ERANGE;
  231. else {
  232. inst->nlbufsiz = nlbufsiz;
  233. status = 0;
  234. }
  235. spin_unlock_bh(&inst->lock);
  236. return status;
  237. }
  238. static void
  239. nfulnl_set_timeout(struct nfulnl_instance *inst, u_int32_t timeout)
  240. {
  241. spin_lock_bh(&inst->lock);
  242. inst->flushtimeout = timeout;
  243. spin_unlock_bh(&inst->lock);
  244. }
  245. static void
  246. nfulnl_set_qthresh(struct nfulnl_instance *inst, u_int32_t qthresh)
  247. {
  248. spin_lock_bh(&inst->lock);
  249. inst->qthreshold = qthresh;
  250. spin_unlock_bh(&inst->lock);
  251. }
  252. static int
  253. nfulnl_set_flags(struct nfulnl_instance *inst, u_int16_t flags)
  254. {
  255. spin_lock_bh(&inst->lock);
  256. inst->flags = flags;
  257. spin_unlock_bh(&inst->lock);
  258. return 0;
  259. }
  260. static struct sk_buff *
  261. nfulnl_alloc_skb(struct net *net, u32 peer_portid, unsigned int inst_size,
  262. unsigned int pkt_size)
  263. {
  264. struct sk_buff *skb;
  265. unsigned int n;
  266. /* alloc skb which should be big enough for a whole multipart
  267. * message. WARNING: has to be <= 128k due to slab restrictions */
  268. n = max(inst_size, pkt_size);
  269. skb = alloc_skb(n, GFP_ATOMIC | __GFP_NOWARN);
  270. if (!skb) {
  271. if (n > pkt_size) {
  272. /* try to allocate only as much as we need for current
  273. * packet */
  274. skb = alloc_skb(pkt_size, GFP_ATOMIC);
  275. }
  276. }
  277. return skb;
  278. }
  279. static void
  280. __nfulnl_send(struct nfulnl_instance *inst)
  281. {
  282. if (inst->qlen > 1) {
  283. struct nlmsghdr *nlh = nlmsg_put(inst->skb, 0, 0,
  284. NLMSG_DONE,
  285. sizeof(struct nfgenmsg),
  286. 0);
  287. if (WARN_ONCE(!nlh, "bad nlskb size: %u, tailroom %d\n",
  288. inst->skb->len, skb_tailroom(inst->skb))) {
  289. kfree_skb(inst->skb);
  290. goto out;
  291. }
  292. }
  293. nfnetlink_unicast(inst->skb, inst->net, inst->peer_portid);
  294. out:
  295. inst->qlen = 0;
  296. inst->skb = NULL;
  297. }
  298. static void
  299. __nfulnl_flush(struct nfulnl_instance *inst)
  300. {
  301. /* timer holds a reference */
  302. if (del_timer(&inst->timer))
  303. instance_put(inst);
  304. if (inst->skb)
  305. __nfulnl_send(inst);
  306. }
  307. static void
  308. nfulnl_timer(struct timer_list *t)
  309. {
  310. struct nfulnl_instance *inst = from_timer(inst, t, timer);
  311. spin_lock_bh(&inst->lock);
  312. if (inst->skb)
  313. __nfulnl_send(inst);
  314. spin_unlock_bh(&inst->lock);
  315. instance_put(inst);
  316. }
  317. static u32 nfulnl_get_bridge_size(const struct sk_buff *skb)
  318. {
  319. u32 size = 0;
  320. if (!skb_mac_header_was_set(skb))
  321. return 0;
  322. if (skb_vlan_tag_present(skb)) {
  323. size += nla_total_size(0); /* nested */
  324. size += nla_total_size(sizeof(u16)); /* id */
  325. size += nla_total_size(sizeof(u16)); /* tag */
  326. }
  327. if (skb->network_header > skb->mac_header)
  328. size += nla_total_size(skb->network_header - skb->mac_header);
  329. return size;
  330. }
  331. static int nfulnl_put_bridge(struct nfulnl_instance *inst, const struct sk_buff *skb)
  332. {
  333. if (!skb_mac_header_was_set(skb))
  334. return 0;
  335. if (skb_vlan_tag_present(skb)) {
  336. struct nlattr *nest;
  337. nest = nla_nest_start(inst->skb, NFULA_VLAN);
  338. if (!nest)
  339. goto nla_put_failure;
  340. if (nla_put_be16(inst->skb, NFULA_VLAN_TCI, htons(skb->vlan_tci)) ||
  341. nla_put_be16(inst->skb, NFULA_VLAN_PROTO, skb->vlan_proto))
  342. goto nla_put_failure;
  343. nla_nest_end(inst->skb, nest);
  344. }
  345. if (skb->mac_header < skb->network_header) {
  346. int len = (int)(skb->network_header - skb->mac_header);
  347. if (nla_put(inst->skb, NFULA_L2HDR, len, skb_mac_header(skb)))
  348. goto nla_put_failure;
  349. }
  350. return 0;
  351. nla_put_failure:
  352. return -1;
  353. }
  354. /* This is an inline function, we don't really care about a long
  355. * list of arguments */
  356. static inline int
  357. __build_packet_message(struct nfnl_log_net *log,
  358. struct nfulnl_instance *inst,
  359. const struct sk_buff *skb,
  360. unsigned int data_len,
  361. u_int8_t pf,
  362. unsigned int hooknum,
  363. const struct net_device *indev,
  364. const struct net_device *outdev,
  365. const char *prefix, unsigned int plen,
  366. const struct nfnl_ct_hook *nfnl_ct,
  367. struct nf_conn *ct, enum ip_conntrack_info ctinfo)
  368. {
  369. struct nfulnl_msg_packet_hdr pmsg;
  370. struct nlmsghdr *nlh;
  371. struct nfgenmsg *nfmsg;
  372. sk_buff_data_t old_tail = inst->skb->tail;
  373. struct sock *sk;
  374. const unsigned char *hwhdrp;
  375. nlh = nlmsg_put(inst->skb, 0, 0,
  376. nfnl_msg_type(NFNL_SUBSYS_ULOG, NFULNL_MSG_PACKET),
  377. sizeof(struct nfgenmsg), 0);
  378. if (!nlh)
  379. return -1;
  380. nfmsg = nlmsg_data(nlh);
  381. nfmsg->nfgen_family = pf;
  382. nfmsg->version = NFNETLINK_V0;
  383. nfmsg->res_id = htons(inst->group_num);
  384. memset(&pmsg, 0, sizeof(pmsg));
  385. pmsg.hw_protocol = skb->protocol;
  386. pmsg.hook = hooknum;
  387. if (nla_put(inst->skb, NFULA_PACKET_HDR, sizeof(pmsg), &pmsg))
  388. goto nla_put_failure;
  389. if (prefix &&
  390. nla_put(inst->skb, NFULA_PREFIX, plen, prefix))
  391. goto nla_put_failure;
  392. if (indev) {
  393. #if !IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
  394. if (nla_put_be32(inst->skb, NFULA_IFINDEX_INDEV,
  395. htonl(indev->ifindex)))
  396. goto nla_put_failure;
  397. #else
  398. if (pf == PF_BRIDGE) {
  399. /* Case 1: outdev is physical input device, we need to
  400. * look for bridge group (when called from
  401. * netfilter_bridge) */
  402. if (nla_put_be32(inst->skb, NFULA_IFINDEX_PHYSINDEV,
  403. htonl(indev->ifindex)) ||
  404. /* this is the bridge group "brX" */
  405. /* rcu_read_lock()ed by nf_hook_thresh or
  406. * nf_log_packet.
  407. */
  408. nla_put_be32(inst->skb, NFULA_IFINDEX_INDEV,
  409. htonl(br_port_get_rcu(indev)->br->dev->ifindex)))
  410. goto nla_put_failure;
  411. } else {
  412. struct net_device *physindev;
  413. /* Case 2: indev is bridge group, we need to look for
  414. * physical device (when called from ipv4) */
  415. if (nla_put_be32(inst->skb, NFULA_IFINDEX_INDEV,
  416. htonl(indev->ifindex)))
  417. goto nla_put_failure;
  418. physindev = nf_bridge_get_physindev(skb);
  419. if (physindev &&
  420. nla_put_be32(inst->skb, NFULA_IFINDEX_PHYSINDEV,
  421. htonl(physindev->ifindex)))
  422. goto nla_put_failure;
  423. }
  424. #endif
  425. }
  426. if (outdev) {
  427. #if !IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
  428. if (nla_put_be32(inst->skb, NFULA_IFINDEX_OUTDEV,
  429. htonl(outdev->ifindex)))
  430. goto nla_put_failure;
  431. #else
  432. if (pf == PF_BRIDGE) {
  433. /* Case 1: outdev is physical output device, we need to
  434. * look for bridge group (when called from
  435. * netfilter_bridge) */
  436. if (nla_put_be32(inst->skb, NFULA_IFINDEX_PHYSOUTDEV,
  437. htonl(outdev->ifindex)) ||
  438. /* this is the bridge group "brX" */
  439. /* rcu_read_lock()ed by nf_hook_thresh or
  440. * nf_log_packet.
  441. */
  442. nla_put_be32(inst->skb, NFULA_IFINDEX_OUTDEV,
  443. htonl(br_port_get_rcu(outdev)->br->dev->ifindex)))
  444. goto nla_put_failure;
  445. } else {
  446. struct net_device *physoutdev;
  447. /* Case 2: indev is a bridge group, we need to look
  448. * for physical device (when called from ipv4) */
  449. if (nla_put_be32(inst->skb, NFULA_IFINDEX_OUTDEV,
  450. htonl(outdev->ifindex)))
  451. goto nla_put_failure;
  452. physoutdev = nf_bridge_get_physoutdev(skb);
  453. if (physoutdev &&
  454. nla_put_be32(inst->skb, NFULA_IFINDEX_PHYSOUTDEV,
  455. htonl(physoutdev->ifindex)))
  456. goto nla_put_failure;
  457. }
  458. #endif
  459. }
  460. if (skb->mark &&
  461. nla_put_be32(inst->skb, NFULA_MARK, htonl(skb->mark)))
  462. goto nla_put_failure;
  463. if (indev && skb->dev &&
  464. skb_mac_header_was_set(skb) &&
  465. skb_mac_header_len(skb) != 0) {
  466. struct nfulnl_msg_packet_hw phw;
  467. int len;
  468. memset(&phw, 0, sizeof(phw));
  469. len = dev_parse_header(skb, phw.hw_addr);
  470. if (len > 0) {
  471. phw.hw_addrlen = htons(len);
  472. if (nla_put(inst->skb, NFULA_HWADDR, sizeof(phw), &phw))
  473. goto nla_put_failure;
  474. }
  475. }
  476. if (indev && skb_mac_header_was_set(skb)) {
  477. if (nla_put_be16(inst->skb, NFULA_HWTYPE, htons(skb->dev->type)) ||
  478. nla_put_be16(inst->skb, NFULA_HWLEN,
  479. htons(skb->dev->hard_header_len)))
  480. goto nla_put_failure;
  481. hwhdrp = skb_mac_header(skb);
  482. if (skb->dev->type == ARPHRD_SIT)
  483. hwhdrp -= ETH_HLEN;
  484. if (hwhdrp >= skb->head &&
  485. nla_put(inst->skb, NFULA_HWHEADER,
  486. skb->dev->hard_header_len, hwhdrp))
  487. goto nla_put_failure;
  488. }
  489. if (hooknum <= NF_INET_FORWARD && skb->tstamp) {
  490. struct nfulnl_msg_packet_timestamp ts;
  491. struct timespec64 kts = ktime_to_timespec64(skb->tstamp);
  492. ts.sec = cpu_to_be64(kts.tv_sec);
  493. ts.usec = cpu_to_be64(kts.tv_nsec / NSEC_PER_USEC);
  494. if (nla_put(inst->skb, NFULA_TIMESTAMP, sizeof(ts), &ts))
  495. goto nla_put_failure;
  496. }
  497. /* UID */
  498. sk = skb->sk;
  499. if (sk && sk_fullsock(sk)) {
  500. read_lock_bh(&sk->sk_callback_lock);
  501. if (sk->sk_socket && sk->sk_socket->file) {
  502. struct file *file = sk->sk_socket->file;
  503. const struct cred *cred = file->f_cred;
  504. struct user_namespace *user_ns = inst->peer_user_ns;
  505. __be32 uid = htonl(from_kuid_munged(user_ns, cred->fsuid));
  506. __be32 gid = htonl(from_kgid_munged(user_ns, cred->fsgid));
  507. read_unlock_bh(&sk->sk_callback_lock);
  508. if (nla_put_be32(inst->skb, NFULA_UID, uid) ||
  509. nla_put_be32(inst->skb, NFULA_GID, gid))
  510. goto nla_put_failure;
  511. } else
  512. read_unlock_bh(&sk->sk_callback_lock);
  513. }
  514. /* local sequence number */
  515. if ((inst->flags & NFULNL_CFG_F_SEQ) &&
  516. nla_put_be32(inst->skb, NFULA_SEQ, htonl(inst->seq++)))
  517. goto nla_put_failure;
  518. /* global sequence number */
  519. if ((inst->flags & NFULNL_CFG_F_SEQ_GLOBAL) &&
  520. nla_put_be32(inst->skb, NFULA_SEQ_GLOBAL,
  521. htonl(atomic_inc_return(&log->global_seq))))
  522. goto nla_put_failure;
  523. if (ct && nfnl_ct->build(inst->skb, ct, ctinfo,
  524. NFULA_CT, NFULA_CT_INFO) < 0)
  525. goto nla_put_failure;
  526. if ((pf == NFPROTO_NETDEV || pf == NFPROTO_BRIDGE) &&
  527. nfulnl_put_bridge(inst, skb) < 0)
  528. goto nla_put_failure;
  529. if (data_len) {
  530. struct nlattr *nla;
  531. int size = nla_attr_size(data_len);
  532. if (skb_tailroom(inst->skb) < nla_total_size(data_len))
  533. goto nla_put_failure;
  534. nla = skb_put(inst->skb, nla_total_size(data_len));
  535. nla->nla_type = NFULA_PAYLOAD;
  536. nla->nla_len = size;
  537. if (skb_copy_bits(skb, 0, nla_data(nla), data_len))
  538. BUG();
  539. }
  540. nlh->nlmsg_len = inst->skb->tail - old_tail;
  541. return 0;
  542. nla_put_failure:
  543. PRINTR(KERN_ERR "nfnetlink_log: error creating log nlmsg\n");
  544. return -1;
  545. }
  546. static const struct nf_loginfo default_loginfo = {
  547. .type = NF_LOG_TYPE_ULOG,
  548. .u = {
  549. .ulog = {
  550. .copy_len = 0xffff,
  551. .group = 0,
  552. .qthreshold = 1,
  553. },
  554. },
  555. };
  556. /* log handler for internal netfilter logging api */
  557. static void
  558. nfulnl_log_packet(struct net *net,
  559. u_int8_t pf,
  560. unsigned int hooknum,
  561. const struct sk_buff *skb,
  562. const struct net_device *in,
  563. const struct net_device *out,
  564. const struct nf_loginfo *li_user,
  565. const char *prefix)
  566. {
  567. size_t size;
  568. unsigned int data_len;
  569. struct nfulnl_instance *inst;
  570. const struct nf_loginfo *li;
  571. unsigned int qthreshold;
  572. unsigned int plen = 0;
  573. struct nfnl_log_net *log = nfnl_log_pernet(net);
  574. const struct nfnl_ct_hook *nfnl_ct = NULL;
  575. struct nf_conn *ct = NULL;
  576. enum ip_conntrack_info ctinfo;
  577. if (li_user && li_user->type == NF_LOG_TYPE_ULOG)
  578. li = li_user;
  579. else
  580. li = &default_loginfo;
  581. inst = instance_lookup_get(log, li->u.ulog.group);
  582. if (!inst)
  583. return;
  584. if (prefix)
  585. plen = strlen(prefix) + 1;
  586. /* FIXME: do we want to make the size calculation conditional based on
  587. * what is actually present? way more branches and checks, but more
  588. * memory efficient... */
  589. size = nlmsg_total_size(sizeof(struct nfgenmsg))
  590. + nla_total_size(sizeof(struct nfulnl_msg_packet_hdr))
  591. + nla_total_size(sizeof(u_int32_t)) /* ifindex */
  592. + nla_total_size(sizeof(u_int32_t)) /* ifindex */
  593. #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
  594. + nla_total_size(sizeof(u_int32_t)) /* ifindex */
  595. + nla_total_size(sizeof(u_int32_t)) /* ifindex */
  596. #endif
  597. + nla_total_size(sizeof(u_int32_t)) /* mark */
  598. + nla_total_size(sizeof(u_int32_t)) /* uid */
  599. + nla_total_size(sizeof(u_int32_t)) /* gid */
  600. + nla_total_size(plen) /* prefix */
  601. + nla_total_size(sizeof(struct nfulnl_msg_packet_hw))
  602. + nla_total_size(sizeof(struct nfulnl_msg_packet_timestamp))
  603. + nla_total_size(sizeof(struct nfgenmsg)); /* NLMSG_DONE */
  604. if (in && skb_mac_header_was_set(skb)) {
  605. size += nla_total_size(skb->dev->hard_header_len)
  606. + nla_total_size(sizeof(u_int16_t)) /* hwtype */
  607. + nla_total_size(sizeof(u_int16_t)); /* hwlen */
  608. }
  609. spin_lock_bh(&inst->lock);
  610. if (inst->flags & NFULNL_CFG_F_SEQ)
  611. size += nla_total_size(sizeof(u_int32_t));
  612. if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL)
  613. size += nla_total_size(sizeof(u_int32_t));
  614. if (inst->flags & NFULNL_CFG_F_CONNTRACK) {
  615. nfnl_ct = rcu_dereference(nfnl_ct_hook);
  616. if (nfnl_ct != NULL) {
  617. ct = nfnl_ct->get_ct(skb, &ctinfo);
  618. if (ct != NULL)
  619. size += nfnl_ct->build_size(ct);
  620. }
  621. }
  622. if (pf == NFPROTO_NETDEV || pf == NFPROTO_BRIDGE)
  623. size += nfulnl_get_bridge_size(skb);
  624. qthreshold = inst->qthreshold;
  625. /* per-rule qthreshold overrides per-instance */
  626. if (li->u.ulog.qthreshold)
  627. if (qthreshold > li->u.ulog.qthreshold)
  628. qthreshold = li->u.ulog.qthreshold;
  629. switch (inst->copy_mode) {
  630. case NFULNL_COPY_META:
  631. case NFULNL_COPY_NONE:
  632. data_len = 0;
  633. break;
  634. case NFULNL_COPY_PACKET:
  635. data_len = inst->copy_range;
  636. if ((li->u.ulog.flags & NF_LOG_F_COPY_LEN) &&
  637. (li->u.ulog.copy_len < data_len))
  638. data_len = li->u.ulog.copy_len;
  639. if (data_len > skb->len)
  640. data_len = skb->len;
  641. size += nla_total_size(data_len);
  642. break;
  643. case NFULNL_COPY_DISABLED:
  644. default:
  645. goto unlock_and_release;
  646. }
  647. if (inst->skb && size > skb_tailroom(inst->skb)) {
  648. /* either the queue len is too high or we don't have
  649. * enough room in the skb left. flush to userspace. */
  650. __nfulnl_flush(inst);
  651. }
  652. if (!inst->skb) {
  653. inst->skb = nfulnl_alloc_skb(net, inst->peer_portid,
  654. inst->nlbufsiz, size);
  655. if (!inst->skb)
  656. goto alloc_failure;
  657. }
  658. inst->qlen++;
  659. __build_packet_message(log, inst, skb, data_len, pf,
  660. hooknum, in, out, prefix, plen,
  661. nfnl_ct, ct, ctinfo);
  662. if (inst->qlen >= qthreshold)
  663. __nfulnl_flush(inst);
  664. /* timer_pending always called within inst->lock, so there
  665. * is no chance of a race here */
  666. else if (!timer_pending(&inst->timer)) {
  667. instance_get(inst);
  668. inst->timer.expires = jiffies + (inst->flushtimeout*HZ/100);
  669. add_timer(&inst->timer);
  670. }
  671. unlock_and_release:
  672. spin_unlock_bh(&inst->lock);
  673. instance_put(inst);
  674. return;
  675. alloc_failure:
  676. /* FIXME: statistics */
  677. goto unlock_and_release;
  678. }
  679. static int
  680. nfulnl_rcv_nl_event(struct notifier_block *this,
  681. unsigned long event, void *ptr)
  682. {
  683. struct netlink_notify *n = ptr;
  684. struct nfnl_log_net *log = nfnl_log_pernet(n->net);
  685. if (event == NETLINK_URELEASE && n->protocol == NETLINK_NETFILTER) {
  686. int i;
  687. /* destroy all instances for this portid */
  688. spin_lock_bh(&log->instances_lock);
  689. for (i = 0; i < INSTANCE_BUCKETS; i++) {
  690. struct hlist_node *t2;
  691. struct nfulnl_instance *inst;
  692. struct hlist_head *head = &log->instance_table[i];
  693. hlist_for_each_entry_safe(inst, t2, head, hlist) {
  694. if (n->portid == inst->peer_portid)
  695. __instance_destroy(inst);
  696. }
  697. }
  698. spin_unlock_bh(&log->instances_lock);
  699. }
  700. return NOTIFY_DONE;
  701. }
  702. static struct notifier_block nfulnl_rtnl_notifier = {
  703. .notifier_call = nfulnl_rcv_nl_event,
  704. };
  705. static int nfulnl_recv_unsupp(struct net *net, struct sock *ctnl,
  706. struct sk_buff *skb, const struct nlmsghdr *nlh,
  707. const struct nlattr * const nfqa[],
  708. struct netlink_ext_ack *extack)
  709. {
  710. return -ENOTSUPP;
  711. }
  712. static struct nf_logger nfulnl_logger __read_mostly = {
  713. .name = "nfnetlink_log",
  714. .type = NF_LOG_TYPE_ULOG,
  715. .logfn = nfulnl_log_packet,
  716. .me = THIS_MODULE,
  717. };
  718. static const struct nla_policy nfula_cfg_policy[NFULA_CFG_MAX+1] = {
  719. [NFULA_CFG_CMD] = { .len = sizeof(struct nfulnl_msg_config_cmd) },
  720. [NFULA_CFG_MODE] = { .len = sizeof(struct nfulnl_msg_config_mode) },
  721. [NFULA_CFG_TIMEOUT] = { .type = NLA_U32 },
  722. [NFULA_CFG_QTHRESH] = { .type = NLA_U32 },
  723. [NFULA_CFG_NLBUFSIZ] = { .type = NLA_U32 },
  724. [NFULA_CFG_FLAGS] = { .type = NLA_U16 },
  725. };
  726. static int nfulnl_recv_config(struct net *net, struct sock *ctnl,
  727. struct sk_buff *skb, const struct nlmsghdr *nlh,
  728. const struct nlattr * const nfula[],
  729. struct netlink_ext_ack *extack)
  730. {
  731. struct nfgenmsg *nfmsg = nlmsg_data(nlh);
  732. u_int16_t group_num = ntohs(nfmsg->res_id);
  733. struct nfulnl_instance *inst;
  734. struct nfulnl_msg_config_cmd *cmd = NULL;
  735. struct nfnl_log_net *log = nfnl_log_pernet(net);
  736. int ret = 0;
  737. u16 flags = 0;
  738. if (nfula[NFULA_CFG_CMD]) {
  739. u_int8_t pf = nfmsg->nfgen_family;
  740. cmd = nla_data(nfula[NFULA_CFG_CMD]);
  741. /* Commands without queue context */
  742. switch (cmd->command) {
  743. case NFULNL_CFG_CMD_PF_BIND:
  744. return nf_log_bind_pf(net, pf, &nfulnl_logger);
  745. case NFULNL_CFG_CMD_PF_UNBIND:
  746. nf_log_unbind_pf(net, pf);
  747. return 0;
  748. }
  749. }
  750. inst = instance_lookup_get(log, group_num);
  751. if (inst && inst->peer_portid != NETLINK_CB(skb).portid) {
  752. ret = -EPERM;
  753. goto out_put;
  754. }
  755. /* Check if we support these flags in first place, dependencies should
  756. * be there too not to break atomicity.
  757. */
  758. if (nfula[NFULA_CFG_FLAGS]) {
  759. flags = ntohs(nla_get_be16(nfula[NFULA_CFG_FLAGS]));
  760. if ((flags & NFULNL_CFG_F_CONNTRACK) &&
  761. !rcu_access_pointer(nfnl_ct_hook)) {
  762. #ifdef CONFIG_MODULES
  763. nfnl_unlock(NFNL_SUBSYS_ULOG);
  764. request_module("ip_conntrack_netlink");
  765. nfnl_lock(NFNL_SUBSYS_ULOG);
  766. if (rcu_access_pointer(nfnl_ct_hook)) {
  767. ret = -EAGAIN;
  768. goto out_put;
  769. }
  770. #endif
  771. ret = -EOPNOTSUPP;
  772. goto out_put;
  773. }
  774. }
  775. if (cmd != NULL) {
  776. switch (cmd->command) {
  777. case NFULNL_CFG_CMD_BIND:
  778. if (inst) {
  779. ret = -EBUSY;
  780. goto out_put;
  781. }
  782. inst = instance_create(net, group_num,
  783. NETLINK_CB(skb).portid,
  784. sk_user_ns(NETLINK_CB(skb).sk));
  785. if (IS_ERR(inst)) {
  786. ret = PTR_ERR(inst);
  787. goto out;
  788. }
  789. break;
  790. case NFULNL_CFG_CMD_UNBIND:
  791. if (!inst) {
  792. ret = -ENODEV;
  793. goto out;
  794. }
  795. instance_destroy(log, inst);
  796. goto out_put;
  797. default:
  798. ret = -ENOTSUPP;
  799. goto out_put;
  800. }
  801. } else if (!inst) {
  802. ret = -ENODEV;
  803. goto out;
  804. }
  805. if (nfula[NFULA_CFG_MODE]) {
  806. struct nfulnl_msg_config_mode *params =
  807. nla_data(nfula[NFULA_CFG_MODE]);
  808. nfulnl_set_mode(inst, params->copy_mode,
  809. ntohl(params->copy_range));
  810. }
  811. if (nfula[NFULA_CFG_TIMEOUT]) {
  812. __be32 timeout = nla_get_be32(nfula[NFULA_CFG_TIMEOUT]);
  813. nfulnl_set_timeout(inst, ntohl(timeout));
  814. }
  815. if (nfula[NFULA_CFG_NLBUFSIZ]) {
  816. __be32 nlbufsiz = nla_get_be32(nfula[NFULA_CFG_NLBUFSIZ]);
  817. nfulnl_set_nlbufsiz(inst, ntohl(nlbufsiz));
  818. }
  819. if (nfula[NFULA_CFG_QTHRESH]) {
  820. __be32 qthresh = nla_get_be32(nfula[NFULA_CFG_QTHRESH]);
  821. nfulnl_set_qthresh(inst, ntohl(qthresh));
  822. }
  823. if (nfula[NFULA_CFG_FLAGS])
  824. nfulnl_set_flags(inst, flags);
  825. out_put:
  826. instance_put(inst);
  827. out:
  828. return ret;
  829. }
  830. static const struct nfnl_callback nfulnl_cb[NFULNL_MSG_MAX] = {
  831. [NFULNL_MSG_PACKET] = { .call = nfulnl_recv_unsupp,
  832. .attr_count = NFULA_MAX, },
  833. [NFULNL_MSG_CONFIG] = { .call = nfulnl_recv_config,
  834. .attr_count = NFULA_CFG_MAX,
  835. .policy = nfula_cfg_policy },
  836. };
  837. static const struct nfnetlink_subsystem nfulnl_subsys = {
  838. .name = "log",
  839. .subsys_id = NFNL_SUBSYS_ULOG,
  840. .cb_count = NFULNL_MSG_MAX,
  841. .cb = nfulnl_cb,
  842. };
  843. #ifdef CONFIG_PROC_FS
  844. struct iter_state {
  845. struct seq_net_private p;
  846. unsigned int bucket;
  847. };
  848. static struct hlist_node *get_first(struct net *net, struct iter_state *st)
  849. {
  850. struct nfnl_log_net *log;
  851. if (!st)
  852. return NULL;
  853. log = nfnl_log_pernet(net);
  854. for (st->bucket = 0; st->bucket < INSTANCE_BUCKETS; st->bucket++) {
  855. struct hlist_head *head = &log->instance_table[st->bucket];
  856. if (!hlist_empty(head))
  857. return rcu_dereference_bh(hlist_first_rcu(head));
  858. }
  859. return NULL;
  860. }
  861. static struct hlist_node *get_next(struct net *net, struct iter_state *st,
  862. struct hlist_node *h)
  863. {
  864. h = rcu_dereference_bh(hlist_next_rcu(h));
  865. while (!h) {
  866. struct nfnl_log_net *log;
  867. struct hlist_head *head;
  868. if (++st->bucket >= INSTANCE_BUCKETS)
  869. return NULL;
  870. log = nfnl_log_pernet(net);
  871. head = &log->instance_table[st->bucket];
  872. h = rcu_dereference_bh(hlist_first_rcu(head));
  873. }
  874. return h;
  875. }
  876. static struct hlist_node *get_idx(struct net *net, struct iter_state *st,
  877. loff_t pos)
  878. {
  879. struct hlist_node *head;
  880. head = get_first(net, st);
  881. if (head)
  882. while (pos && (head = get_next(net, st, head)))
  883. pos--;
  884. return pos ? NULL : head;
  885. }
  886. static void *seq_start(struct seq_file *s, loff_t *pos)
  887. __acquires(rcu_bh)
  888. {
  889. rcu_read_lock_bh();
  890. return get_idx(seq_file_net(s), s->private, *pos);
  891. }
  892. static void *seq_next(struct seq_file *s, void *v, loff_t *pos)
  893. {
  894. (*pos)++;
  895. return get_next(seq_file_net(s), s->private, v);
  896. }
  897. static void seq_stop(struct seq_file *s, void *v)
  898. __releases(rcu_bh)
  899. {
  900. rcu_read_unlock_bh();
  901. }
  902. static int seq_show(struct seq_file *s, void *v)
  903. {
  904. const struct nfulnl_instance *inst = v;
  905. seq_printf(s, "%5u %6u %5u %1u %5u %6u %2u\n",
  906. inst->group_num,
  907. inst->peer_portid, inst->qlen,
  908. inst->copy_mode, inst->copy_range,
  909. inst->flushtimeout, refcount_read(&inst->use));
  910. return 0;
  911. }
  912. static const struct seq_operations nful_seq_ops = {
  913. .start = seq_start,
  914. .next = seq_next,
  915. .stop = seq_stop,
  916. .show = seq_show,
  917. };
  918. #endif /* PROC_FS */
  919. static int __net_init nfnl_log_net_init(struct net *net)
  920. {
  921. unsigned int i;
  922. struct nfnl_log_net *log = nfnl_log_pernet(net);
  923. #ifdef CONFIG_PROC_FS
  924. struct proc_dir_entry *proc;
  925. kuid_t root_uid;
  926. kgid_t root_gid;
  927. #endif
  928. for (i = 0; i < INSTANCE_BUCKETS; i++)
  929. INIT_HLIST_HEAD(&log->instance_table[i]);
  930. spin_lock_init(&log->instances_lock);
  931. #ifdef CONFIG_PROC_FS
  932. proc = proc_create_net("nfnetlink_log", 0440, net->nf.proc_netfilter,
  933. &nful_seq_ops, sizeof(struct iter_state));
  934. if (!proc)
  935. return -ENOMEM;
  936. root_uid = make_kuid(net->user_ns, 0);
  937. root_gid = make_kgid(net->user_ns, 0);
  938. if (uid_valid(root_uid) && gid_valid(root_gid))
  939. proc_set_user(proc, root_uid, root_gid);
  940. #endif
  941. return 0;
  942. }
  943. static void __net_exit nfnl_log_net_exit(struct net *net)
  944. {
  945. struct nfnl_log_net *log = nfnl_log_pernet(net);
  946. unsigned int i;
  947. #ifdef CONFIG_PROC_FS
  948. remove_proc_entry("nfnetlink_log", net->nf.proc_netfilter);
  949. #endif
  950. nf_log_unset(net, &nfulnl_logger);
  951. for (i = 0; i < INSTANCE_BUCKETS; i++)
  952. WARN_ON_ONCE(!hlist_empty(&log->instance_table[i]));
  953. }
  954. static struct pernet_operations nfnl_log_net_ops = {
  955. .init = nfnl_log_net_init,
  956. .exit = nfnl_log_net_exit,
  957. .id = &nfnl_log_net_id,
  958. .size = sizeof(struct nfnl_log_net),
  959. };
  960. static int __init nfnetlink_log_init(void)
  961. {
  962. int status;
  963. status = register_pernet_subsys(&nfnl_log_net_ops);
  964. if (status < 0) {
  965. pr_err("failed to register pernet ops\n");
  966. goto out;
  967. }
  968. netlink_register_notifier(&nfulnl_rtnl_notifier);
  969. status = nfnetlink_subsys_register(&nfulnl_subsys);
  970. if (status < 0) {
  971. pr_err("failed to create netlink socket\n");
  972. goto cleanup_netlink_notifier;
  973. }
  974. status = nf_log_register(NFPROTO_UNSPEC, &nfulnl_logger);
  975. if (status < 0) {
  976. pr_err("failed to register logger\n");
  977. goto cleanup_subsys;
  978. }
  979. return status;
  980. cleanup_subsys:
  981. nfnetlink_subsys_unregister(&nfulnl_subsys);
  982. cleanup_netlink_notifier:
  983. netlink_unregister_notifier(&nfulnl_rtnl_notifier);
  984. unregister_pernet_subsys(&nfnl_log_net_ops);
  985. out:
  986. return status;
  987. }
  988. static void __exit nfnetlink_log_fini(void)
  989. {
  990. nfnetlink_subsys_unregister(&nfulnl_subsys);
  991. netlink_unregister_notifier(&nfulnl_rtnl_notifier);
  992. unregister_pernet_subsys(&nfnl_log_net_ops);
  993. nf_log_unregister(&nfulnl_logger);
  994. }
  995. MODULE_DESCRIPTION("netfilter userspace logging");
  996. MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
  997. MODULE_LICENSE("GPL");
  998. MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_ULOG);
  999. MODULE_ALIAS_NF_LOGGER(AF_INET, 1);
  1000. MODULE_ALIAS_NF_LOGGER(AF_INET6, 1);
  1001. MODULE_ALIAS_NF_LOGGER(AF_BRIDGE, 1);
  1002. MODULE_ALIAS_NF_LOGGER(3, 1); /* NFPROTO_ARP */
  1003. MODULE_ALIAS_NF_LOGGER(5, 1); /* NFPROTO_NETDEV */
  1004. module_init(nfnetlink_log_init);
  1005. module_exit(nfnetlink_log_fini);