nfnetlink.c 7.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315
  1. /* Netfilter messages via netlink socket. Allows for user space
  2. * protocol helpers and general trouble making from userspace.
  3. *
  4. * (C) 2001 by Jay Schulist <jschlst@samba.org>,
  5. * (C) 2002-2005 by Harald Welte <laforge@gnumonks.org>
  6. * (C) 2005,2007 by Pablo Neira Ayuso <pablo@netfilter.org>
  7. *
  8. * Initial netfilter messages via netlink development funded and
  9. * generally made possible by Network Robots, Inc. (www.networkrobots.com)
  10. *
  11. * Further development of this code funded by Astaro AG (http://www.astaro.com)
  12. *
  13. * This software may be used and distributed according to the terms
  14. * of the GNU General Public License, incorporated herein by reference.
  15. */
  16. #include <linux/module.h>
  17. #include <linux/types.h>
  18. #include <linux/socket.h>
  19. #include <linux/kernel.h>
  20. #include <linux/major.h>
  21. #include <linux/timer.h>
  22. #include <linux/string.h>
  23. #include <linux/sockios.h>
  24. #include <linux/net.h>
  25. #include <linux/fcntl.h>
  26. #include <linux/skbuff.h>
  27. #include <asm/uaccess.h>
  28. #include <asm/system.h>
  29. #include <net/sock.h>
  30. #include <net/netlink.h>
  31. #include <linux/init.h>
  32. #include <linux/spinlock.h>
  33. #include <linux/netfilter.h>
  34. #include <linux/netlink.h>
  35. #include <linux/netfilter/nfnetlink.h>
  36. MODULE_LICENSE("GPL");
  37. MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
  38. MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_NETFILTER);
  39. static char __initdata nfversion[] = "0.30";
  40. static struct sock *nfnl = NULL;
  41. static struct nfnetlink_subsystem *subsys_table[NFNL_SUBSYS_COUNT];
  42. static DEFINE_MUTEX(nfnl_mutex);
  43. static void nfnl_lock(void)
  44. {
  45. mutex_lock(&nfnl_mutex);
  46. }
  47. static int nfnl_trylock(void)
  48. {
  49. return !mutex_trylock(&nfnl_mutex);
  50. }
  51. static void __nfnl_unlock(void)
  52. {
  53. mutex_unlock(&nfnl_mutex);
  54. }
  55. static void nfnl_unlock(void)
  56. {
  57. mutex_unlock(&nfnl_mutex);
  58. if (nfnl->sk_receive_queue.qlen)
  59. nfnl->sk_data_ready(nfnl, 0);
  60. }
  61. int nfnetlink_subsys_register(struct nfnetlink_subsystem *n)
  62. {
  63. nfnl_lock();
  64. if (subsys_table[n->subsys_id]) {
  65. nfnl_unlock();
  66. return -EBUSY;
  67. }
  68. subsys_table[n->subsys_id] = n;
  69. nfnl_unlock();
  70. return 0;
  71. }
  72. int nfnetlink_subsys_unregister(struct nfnetlink_subsystem *n)
  73. {
  74. nfnl_lock();
  75. subsys_table[n->subsys_id] = NULL;
  76. nfnl_unlock();
  77. return 0;
  78. }
  79. static inline struct nfnetlink_subsystem *nfnetlink_get_subsys(u_int16_t type)
  80. {
  81. u_int8_t subsys_id = NFNL_SUBSYS_ID(type);
  82. if (subsys_id >= NFNL_SUBSYS_COUNT
  83. || subsys_table[subsys_id] == NULL)
  84. return NULL;
  85. return subsys_table[subsys_id];
  86. }
  87. static inline struct nfnl_callback *
  88. nfnetlink_find_client(u_int16_t type, struct nfnetlink_subsystem *ss)
  89. {
  90. u_int8_t cb_id = NFNL_MSG_TYPE(type);
  91. if (cb_id >= ss->cb_count)
  92. return NULL;
  93. return &ss->cb[cb_id];
  94. }
  95. void __nfa_fill(struct sk_buff *skb, int attrtype, int attrlen,
  96. const void *data)
  97. {
  98. struct nfattr *nfa;
  99. int size = NFA_LENGTH(attrlen);
  100. nfa = (struct nfattr *)skb_put(skb, NFA_ALIGN(size));
  101. nfa->nfa_type = attrtype;
  102. nfa->nfa_len = size;
  103. memcpy(NFA_DATA(nfa), data, attrlen);
  104. memset(NFA_DATA(nfa) + attrlen, 0, NFA_ALIGN(size) - size);
  105. }
  106. void nfattr_parse(struct nfattr *tb[], int maxattr, struct nfattr *nfa, int len)
  107. {
  108. memset(tb, 0, sizeof(struct nfattr *) * maxattr);
  109. while (NFA_OK(nfa, len)) {
  110. unsigned flavor = NFA_TYPE(nfa);
  111. if (flavor && flavor <= maxattr)
  112. tb[flavor-1] = nfa;
  113. nfa = NFA_NEXT(nfa, len);
  114. }
  115. }
  116. /**
  117. * nfnetlink_check_attributes - check and parse nfnetlink attributes
  118. *
  119. * subsys: nfnl subsystem for which this message is to be parsed
  120. * nlmsghdr: netlink message to be checked/parsed
  121. * cda: array of pointers, needs to be at least subsys->attr_count big
  122. *
  123. */
  124. static int
  125. nfnetlink_check_attributes(struct nfnetlink_subsystem *subsys,
  126. struct nlmsghdr *nlh, struct nfattr *cda[])
  127. {
  128. int min_len;
  129. u_int16_t attr_count;
  130. u_int8_t cb_id = NFNL_MSG_TYPE(nlh->nlmsg_type);
  131. if (unlikely(cb_id >= subsys->cb_count))
  132. return -EINVAL;
  133. min_len = NLMSG_SPACE(sizeof(struct nfgenmsg));
  134. if (unlikely(nlh->nlmsg_len < min_len))
  135. return -EINVAL;
  136. attr_count = subsys->cb[cb_id].attr_count;
  137. memset(cda, 0, sizeof(struct nfattr *) * attr_count);
  138. /* check attribute lengths. */
  139. if (likely(nlh->nlmsg_len > min_len)) {
  140. struct nfattr *attr = NFM_NFA(NLMSG_DATA(nlh));
  141. int attrlen = nlh->nlmsg_len - NLMSG_ALIGN(min_len);
  142. while (NFA_OK(attr, attrlen)) {
  143. unsigned flavor = NFA_TYPE(attr);
  144. if (flavor) {
  145. if (flavor > attr_count)
  146. return -EINVAL;
  147. cda[flavor - 1] = attr;
  148. }
  149. attr = NFA_NEXT(attr, attrlen);
  150. }
  151. }
  152. /* implicit: if nlmsg_len == min_len, we return 0, and an empty
  153. * (zeroed) cda[] array. The message is valid, but empty. */
  154. return 0;
  155. }
  156. int nfnetlink_has_listeners(unsigned int group)
  157. {
  158. return netlink_has_listeners(nfnl, group);
  159. }
  160. EXPORT_SYMBOL_GPL(nfnetlink_has_listeners);
  161. int nfnetlink_send(struct sk_buff *skb, u32 pid, unsigned group, int echo)
  162. {
  163. int err = 0;
  164. NETLINK_CB(skb).dst_group = group;
  165. if (echo)
  166. atomic_inc(&skb->users);
  167. netlink_broadcast(nfnl, skb, pid, group, gfp_any());
  168. if (echo)
  169. err = netlink_unicast(nfnl, skb, pid, MSG_DONTWAIT);
  170. return err;
  171. }
  172. int nfnetlink_unicast(struct sk_buff *skb, u_int32_t pid, int flags)
  173. {
  174. return netlink_unicast(nfnl, skb, pid, flags);
  175. }
  176. /* Process one complete nfnetlink message. */
  177. static int nfnetlink_rcv_msg(struct sk_buff *skb,
  178. struct nlmsghdr *nlh, int *errp)
  179. {
  180. struct nfnl_callback *nc;
  181. struct nfnetlink_subsystem *ss;
  182. int type, err = 0;
  183. if (security_netlink_recv(skb, CAP_NET_ADMIN)) {
  184. *errp = -EPERM;
  185. return -1;
  186. }
  187. /* Only requests are handled by kernel now. */
  188. if (!(nlh->nlmsg_flags & NLM_F_REQUEST))
  189. return 0;
  190. /* All the messages must at least contain nfgenmsg */
  191. if (nlh->nlmsg_len < NLMSG_SPACE(sizeof(struct nfgenmsg)))
  192. return 0;
  193. type = nlh->nlmsg_type;
  194. ss = nfnetlink_get_subsys(type);
  195. if (!ss) {
  196. #ifdef CONFIG_KMOD
  197. /* don't call nfnl_unlock, since it would reenter
  198. * with further packet processing */
  199. __nfnl_unlock();
  200. request_module("nfnetlink-subsys-%d", NFNL_SUBSYS_ID(type));
  201. nfnl_lock();
  202. ss = nfnetlink_get_subsys(type);
  203. if (!ss)
  204. #endif
  205. goto err_inval;
  206. }
  207. nc = nfnetlink_find_client(type, ss);
  208. if (!nc)
  209. goto err_inval;
  210. {
  211. u_int16_t attr_count =
  212. ss->cb[NFNL_MSG_TYPE(nlh->nlmsg_type)].attr_count;
  213. struct nfattr *cda[attr_count];
  214. memset(cda, 0, sizeof(struct nfattr *) * attr_count);
  215. err = nfnetlink_check_attributes(ss, nlh, cda);
  216. if (err < 0)
  217. goto err_inval;
  218. err = nc->call(nfnl, skb, nlh, cda, errp);
  219. *errp = err;
  220. return err;
  221. }
  222. err_inval:
  223. *errp = -EINVAL;
  224. return -1;
  225. }
  226. static void nfnetlink_rcv(struct sock *sk, int len)
  227. {
  228. unsigned int qlen = 0;
  229. do {
  230. if (nfnl_trylock())
  231. return;
  232. netlink_run_queue(sk, &qlen, nfnetlink_rcv_msg);
  233. __nfnl_unlock();
  234. } while (qlen);
  235. }
  236. static void __exit nfnetlink_exit(void)
  237. {
  238. printk("Removing netfilter NETLINK layer.\n");
  239. sock_release(nfnl->sk_socket);
  240. return;
  241. }
  242. static int __init nfnetlink_init(void)
  243. {
  244. printk("Netfilter messages via NETLINK v%s.\n", nfversion);
  245. nfnl = netlink_kernel_create(NETLINK_NETFILTER, NFNLGRP_MAX,
  246. nfnetlink_rcv, THIS_MODULE);
  247. if (!nfnl) {
  248. printk(KERN_ERR "cannot initialize nfnetlink!\n");
  249. return -1;
  250. }
  251. return 0;
  252. }
  253. module_init(nfnetlink_init);
  254. module_exit(nfnetlink_exit);
  255. EXPORT_SYMBOL_GPL(nfnetlink_subsys_register);
  256. EXPORT_SYMBOL_GPL(nfnetlink_subsys_unregister);
  257. EXPORT_SYMBOL_GPL(nfnetlink_send);
  258. EXPORT_SYMBOL_GPL(nfnetlink_unicast);
  259. EXPORT_SYMBOL_GPL(nfattr_parse);
  260. EXPORT_SYMBOL_GPL(__nfa_fill);