]>
Commit | Line | Data |
---|---|---|
f6ebe77f | 1 | #include <linux/kernel.h> |
5a0e3ad6 | 2 | #include <linux/slab.h> |
f6ebe77f HW |
3 | #include <linux/init.h> |
4 | #include <linux/module.h> | |
5 | #include <linux/proc_fs.h> | |
6 | #include <linux/skbuff.h> | |
7 | #include <linux/netfilter.h> | |
bbd86b9f | 8 | #include <linux/seq_file.h> |
7a11b984 | 9 | #include <linux/rcupdate.h> |
f6ebe77f | 10 | #include <net/protocol.h> |
c01cd429 | 11 | #include <net/netfilter/nf_queue.h> |
7fee226a | 12 | #include <net/dst.h> |
f6ebe77f HW |
13 | |
14 | #include "nf_internals.h" | |
15 | ||
601e68e1 | 16 | /* |
f6ebe77f HW |
17 | * A queue handler may be registered for each protocol. Each is protected by |
18 | * long term mutex. The handler must provide an an outfn() to accept packets | |
19 | * for queueing and must reinject all packets it receives, no matter what. | |
20 | */ | |
7e9c6eeb | 21 | static const struct nf_queue_handler *queue_handler[NFPROTO_NUMPROTO] __read_mostly; |
f6ebe77f | 22 | |
585426fd | 23 | static DEFINE_MUTEX(queue_handler_mutex); |
f6ebe77f | 24 | |
d72367b6 HW |
25 | /* return EBUSY when somebody else is registered, return EEXIST if the |
26 | * same handler is registered, return 0 in case of success. */ | |
76108cea | 27 | int nf_register_queue_handler(u_int8_t pf, const struct nf_queue_handler *qh) |
601e68e1 | 28 | { |
f6ebe77f HW |
29 | int ret; |
30 | ||
7e9c6eeb | 31 | if (pf >= ARRAY_SIZE(queue_handler)) |
f6ebe77f HW |
32 | return -EINVAL; |
33 | ||
585426fd | 34 | mutex_lock(&queue_handler_mutex); |
d72367b6 HW |
35 | if (queue_handler[pf] == qh) |
36 | ret = -EEXIST; | |
37 | else if (queue_handler[pf]) | |
f6ebe77f HW |
38 | ret = -EBUSY; |
39 | else { | |
585426fd | 40 | rcu_assign_pointer(queue_handler[pf], qh); |
f6ebe77f HW |
41 | ret = 0; |
42 | } | |
585426fd | 43 | mutex_unlock(&queue_handler_mutex); |
f6ebe77f HW |
44 | |
45 | return ret; | |
46 | } | |
47 | EXPORT_SYMBOL(nf_register_queue_handler); | |
48 | ||
49 | /* The caller must flush their queue before this */ | |
76108cea | 50 | int nf_unregister_queue_handler(u_int8_t pf, const struct nf_queue_handler *qh) |
f6ebe77f | 51 | { |
7e9c6eeb | 52 | if (pf >= ARRAY_SIZE(queue_handler)) |
f6ebe77f HW |
53 | return -EINVAL; |
54 | ||
585426fd | 55 | mutex_lock(&queue_handler_mutex); |
94be1a3f | 56 | if (queue_handler[pf] && queue_handler[pf] != qh) { |
585426fd | 57 | mutex_unlock(&queue_handler_mutex); |
ce7663d8 YK |
58 | return -EINVAL; |
59 | } | |
60 | ||
585426fd YK |
61 | rcu_assign_pointer(queue_handler[pf], NULL); |
62 | mutex_unlock(&queue_handler_mutex); | |
63 | ||
64 | synchronize_rcu(); | |
601e68e1 | 65 | |
f6ebe77f HW |
66 | return 0; |
67 | } | |
68 | EXPORT_SYMBOL(nf_unregister_queue_handler); | |
69 | ||
e3ac5298 | 70 | void nf_unregister_queue_handlers(const struct nf_queue_handler *qh) |
f6ebe77f | 71 | { |
76108cea | 72 | u_int8_t pf; |
f6ebe77f | 73 | |
585426fd | 74 | mutex_lock(&queue_handler_mutex); |
7e9c6eeb | 75 | for (pf = 0; pf < ARRAY_SIZE(queue_handler); pf++) { |
bbd86b9f | 76 | if (queue_handler[pf] == qh) |
585426fd | 77 | rcu_assign_pointer(queue_handler[pf], NULL); |
f6ebe77f | 78 | } |
585426fd YK |
79 | mutex_unlock(&queue_handler_mutex); |
80 | ||
81 | synchronize_rcu(); | |
f6ebe77f HW |
82 | } |
83 | EXPORT_SYMBOL_GPL(nf_unregister_queue_handlers); | |
84 | ||
daaa8be2 PM |
85 | static void nf_queue_entry_release_refs(struct nf_queue_entry *entry) |
86 | { | |
87 | /* Release those devices we held, or Alexey will kill me. */ | |
88 | if (entry->indev) | |
89 | dev_put(entry->indev); | |
90 | if (entry->outdev) | |
91 | dev_put(entry->outdev); | |
92 | #ifdef CONFIG_BRIDGE_NETFILTER | |
93 | if (entry->skb->nf_bridge) { | |
94 | struct nf_bridge_info *nf_bridge = entry->skb->nf_bridge; | |
95 | ||
96 | if (nf_bridge->physindev) | |
97 | dev_put(nf_bridge->physindev); | |
98 | if (nf_bridge->physoutdev) | |
99 | dev_put(nf_bridge->physoutdev); | |
100 | } | |
101 | #endif | |
102 | /* Drop reference to owner of hook which queued us. */ | |
103 | module_put(entry->elem->owner); | |
104 | } | |
105 | ||
601e68e1 YH |
106 | /* |
107 | * Any packet that leaves via this function must come back | |
f6ebe77f HW |
108 | * through nf_reinject(). |
109 | */ | |
394f545d PM |
110 | static int __nf_queue(struct sk_buff *skb, |
111 | struct list_head *elem, | |
76108cea | 112 | u_int8_t pf, unsigned int hook, |
394f545d PM |
113 | struct net_device *indev, |
114 | struct net_device *outdev, | |
115 | int (*okfn)(struct sk_buff *), | |
116 | unsigned int queuenum) | |
f6ebe77f HW |
117 | { |
118 | int status; | |
daaa8be2 | 119 | struct nf_queue_entry *entry = NULL; |
f6ebe77f | 120 | #ifdef CONFIG_BRIDGE_NETFILTER |
daaa8be2 PM |
121 | struct net_device *physindev; |
122 | struct net_device *physoutdev; | |
f6ebe77f | 123 | #endif |
1e796fda | 124 | const struct nf_afinfo *afinfo; |
e3ac5298 | 125 | const struct nf_queue_handler *qh; |
f6ebe77f HW |
126 | |
127 | /* QUEUE == DROP if noone is waiting, to be safe. */ | |
585426fd YK |
128 | rcu_read_lock(); |
129 | ||
130 | qh = rcu_dereference(queue_handler[pf]); | |
daaa8be2 PM |
131 | if (!qh) |
132 | goto err_unlock; | |
f6ebe77f | 133 | |
bce8032e | 134 | afinfo = nf_get_afinfo(pf); |
daaa8be2 PM |
135 | if (!afinfo) |
136 | goto err_unlock; | |
bce8032e | 137 | |
02f014d8 | 138 | entry = kmalloc(sizeof(*entry) + afinfo->route_key_size, GFP_ATOMIC); |
daaa8be2 PM |
139 | if (!entry) |
140 | goto err_unlock; | |
f6ebe77f | 141 | |
02f014d8 PM |
142 | *entry = (struct nf_queue_entry) { |
143 | .skb = skb, | |
144 | .elem = list_entry(elem, struct nf_hook_ops, list), | |
145 | .pf = pf, | |
146 | .hook = hook, | |
147 | .indev = indev, | |
148 | .outdev = outdev, | |
149 | .okfn = okfn, | |
150 | }; | |
f6ebe77f HW |
151 | |
152 | /* If it's going away, ignore hook. */ | |
02f014d8 | 153 | if (!try_module_get(entry->elem->owner)) { |
585426fd | 154 | rcu_read_unlock(); |
02f014d8 | 155 | kfree(entry); |
f6ebe77f HW |
156 | return 0; |
157 | } | |
158 | ||
159 | /* Bump dev refs so they don't vanish while packet is out */ | |
8b1cf0db PM |
160 | if (indev) |
161 | dev_hold(indev); | |
162 | if (outdev) | |
163 | dev_hold(outdev); | |
f6ebe77f | 164 | #ifdef CONFIG_BRIDGE_NETFILTER |
394f545d PM |
165 | if (skb->nf_bridge) { |
166 | physindev = skb->nf_bridge->physindev; | |
8b1cf0db PM |
167 | if (physindev) |
168 | dev_hold(physindev); | |
394f545d | 169 | physoutdev = skb->nf_bridge->physoutdev; |
8b1cf0db PM |
170 | if (physoutdev) |
171 | dev_hold(physoutdev); | |
f6ebe77f HW |
172 | } |
173 | #endif | |
7fee226a | 174 | skb_dst_force(skb); |
02f014d8 PM |
175 | afinfo->saveroute(skb, entry); |
176 | status = qh->outfn(entry, queuenum); | |
f6ebe77f | 177 | |
585426fd | 178 | rcu_read_unlock(); |
f6ebe77f HW |
179 | |
180 | if (status < 0) { | |
daaa8be2 PM |
181 | nf_queue_entry_release_refs(entry); |
182 | goto err; | |
f6ebe77f HW |
183 | } |
184 | ||
185 | return 1; | |
daaa8be2 PM |
186 | |
187 | err_unlock: | |
188 | rcu_read_unlock(); | |
189 | err: | |
190 | kfree_skb(skb); | |
191 | kfree(entry); | |
192 | return 1; | |
f6ebe77f HW |
193 | } |
194 | ||
394f545d PM |
195 | int nf_queue(struct sk_buff *skb, |
196 | struct list_head *elem, | |
76108cea | 197 | u_int8_t pf, unsigned int hook, |
394f545d PM |
198 | struct net_device *indev, |
199 | struct net_device *outdev, | |
200 | int (*okfn)(struct sk_buff *), | |
201 | unsigned int queuenum) | |
202 | { | |
203 | struct sk_buff *segs; | |
204 | ||
205 | if (!skb_is_gso(skb)) | |
206 | return __nf_queue(skb, elem, pf, hook, indev, outdev, okfn, | |
207 | queuenum); | |
208 | ||
209 | switch (pf) { | |
4b1e27e9 | 210 | case NFPROTO_IPV4: |
394f545d PM |
211 | skb->protocol = htons(ETH_P_IP); |
212 | break; | |
4b1e27e9 | 213 | case NFPROTO_IPV6: |
394f545d PM |
214 | skb->protocol = htons(ETH_P_IPV6); |
215 | break; | |
216 | } | |
217 | ||
218 | segs = skb_gso_segment(skb, 0); | |
219 | kfree_skb(skb); | |
801678c5 | 220 | if (IS_ERR(segs)) |
394f545d PM |
221 | return 1; |
222 | ||
223 | do { | |
224 | struct sk_buff *nskb = segs->next; | |
225 | ||
226 | segs->next = NULL; | |
227 | if (!__nf_queue(segs, elem, pf, hook, indev, outdev, okfn, | |
228 | queuenum)) | |
229 | kfree_skb(segs); | |
230 | segs = nskb; | |
231 | } while (segs); | |
232 | return 1; | |
233 | } | |
234 | ||
02f014d8 | 235 | void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict) |
f6ebe77f | 236 | { |
02f014d8 PM |
237 | struct sk_buff *skb = entry->skb; |
238 | struct list_head *elem = &entry->elem->list; | |
1e796fda | 239 | const struct nf_afinfo *afinfo; |
f6ebe77f HW |
240 | |
241 | rcu_read_lock(); | |
242 | ||
daaa8be2 | 243 | nf_queue_entry_release_refs(entry); |
f6ebe77f | 244 | |
f6ebe77f HW |
245 | /* Continue traversal iff userspace said ok... */ |
246 | if (verdict == NF_REPEAT) { | |
247 | elem = elem->prev; | |
248 | verdict = NF_ACCEPT; | |
249 | } | |
250 | ||
7a11b984 | 251 | if (verdict == NF_ACCEPT) { |
02f014d8 PM |
252 | afinfo = nf_get_afinfo(entry->pf); |
253 | if (!afinfo || afinfo->reroute(skb, entry) < 0) | |
7a11b984 PM |
254 | verdict = NF_DROP; |
255 | } | |
256 | ||
f6ebe77f HW |
257 | if (verdict == NF_ACCEPT) { |
258 | next_hook: | |
02f014d8 PM |
259 | verdict = nf_iterate(&nf_hooks[entry->pf][entry->hook], |
260 | skb, entry->hook, | |
261 | entry->indev, entry->outdev, &elem, | |
262 | entry->okfn, INT_MIN); | |
f6ebe77f HW |
263 | } |
264 | ||
265 | switch (verdict & NF_VERDICT_MASK) { | |
266 | case NF_ACCEPT: | |
3bc38712 | 267 | case NF_STOP: |
4b3d15ef | 268 | local_bh_disable(); |
02f014d8 | 269 | entry->okfn(skb); |
4b3d15ef | 270 | local_bh_enable(); |
f6ebe77f | 271 | break; |
f6ebe77f | 272 | case NF_QUEUE: |
02f014d8 PM |
273 | if (!__nf_queue(skb, elem, entry->pf, entry->hook, |
274 | entry->indev, entry->outdev, entry->okfn, | |
394f545d | 275 | verdict >> NF_VERDICT_BITS)) |
f6ebe77f HW |
276 | goto next_hook; |
277 | break; | |
64507fdb | 278 | case NF_STOLEN: |
3bc38712 PM |
279 | default: |
280 | kfree_skb(skb); | |
f6ebe77f HW |
281 | } |
282 | rcu_read_unlock(); | |
02f014d8 | 283 | kfree(entry); |
f6ebe77f HW |
284 | } |
285 | EXPORT_SYMBOL(nf_reinject); | |
286 | ||
bbd86b9f HW |
287 | #ifdef CONFIG_PROC_FS |
288 | static void *seq_start(struct seq_file *seq, loff_t *pos) | |
289 | { | |
7e9c6eeb | 290 | if (*pos >= ARRAY_SIZE(queue_handler)) |
bbd86b9f HW |
291 | return NULL; |
292 | ||
293 | return pos; | |
294 | } | |
295 | ||
296 | static void *seq_next(struct seq_file *s, void *v, loff_t *pos) | |
297 | { | |
298 | (*pos)++; | |
299 | ||
7e9c6eeb | 300 | if (*pos >= ARRAY_SIZE(queue_handler)) |
bbd86b9f HW |
301 | return NULL; |
302 | ||
303 | return pos; | |
304 | } | |
305 | ||
306 | static void seq_stop(struct seq_file *s, void *v) | |
307 | { | |
308 | ||
309 | } | |
310 | ||
311 | static int seq_show(struct seq_file *s, void *v) | |
312 | { | |
313 | int ret; | |
314 | loff_t *pos = v; | |
e3ac5298 | 315 | const struct nf_queue_handler *qh; |
bbd86b9f | 316 | |
585426fd YK |
317 | rcu_read_lock(); |
318 | qh = rcu_dereference(queue_handler[*pos]); | |
bbd86b9f HW |
319 | if (!qh) |
320 | ret = seq_printf(s, "%2lld NONE\n", *pos); | |
321 | else | |
322 | ret = seq_printf(s, "%2lld %s\n", *pos, qh->name); | |
585426fd | 323 | rcu_read_unlock(); |
bbd86b9f HW |
324 | |
325 | return ret; | |
326 | } | |
327 | ||
56b3d975 | 328 | static const struct seq_operations nfqueue_seq_ops = { |
bbd86b9f HW |
329 | .start = seq_start, |
330 | .next = seq_next, | |
331 | .stop = seq_stop, | |
332 | .show = seq_show, | |
333 | }; | |
334 | ||
335 | static int nfqueue_open(struct inode *inode, struct file *file) | |
336 | { | |
337 | return seq_open(file, &nfqueue_seq_ops); | |
338 | } | |
339 | ||
da7071d7 | 340 | static const struct file_operations nfqueue_file_ops = { |
bbd86b9f HW |
341 | .owner = THIS_MODULE, |
342 | .open = nfqueue_open, | |
343 | .read = seq_read, | |
344 | .llseek = seq_lseek, | |
345 | .release = seq_release, | |
346 | }; | |
347 | #endif /* PROC_FS */ | |
348 | ||
349 | ||
f6ebe77f HW |
350 | int __init netfilter_queue_init(void) |
351 | { | |
bbd86b9f | 352 | #ifdef CONFIG_PROC_FS |
8eeee8b1 DL |
353 | if (!proc_create("nf_queue", S_IRUGO, |
354 | proc_net_netfilter, &nfqueue_file_ops)) | |
bbd86b9f | 355 | return -1; |
bbd86b9f | 356 | #endif |
f6ebe77f HW |
357 | return 0; |
358 | } | |
359 |