2 * Rusty Russell (C)2000 -- This code is GPL.
3 * Patrick McHardy (c) 2006-2012
6 #include <linux/kernel.h>
7 #include <linux/slab.h>
8 #include <linux/init.h>
9 #include <linux/module.h>
10 #include <linux/proc_fs.h>
11 #include <linux/skbuff.h>
12 #include <linux/netfilter.h>
13 #include <linux/netfilter_bridge.h>
14 #include <linux/seq_file.h>
15 #include <linux/rcupdate.h>
16 #include <net/protocol.h>
17 #include <net/netfilter/nf_queue.h>
20 #include "nf_internals.h"
23 * Hook for nfnetlink_queue to register its queue handler.
24 * We do this so that most of the NFQUEUE code can be modular.
26 * Once the queue is registered it must reinject all packets it
27 * receives, no matter what.
29 static const struct nf_queue_handler __rcu
*queue_handler __read_mostly
;
31 /* return EBUSY when somebody else is registered, return EEXIST if the
32 * same handler is registered, return 0 in case of success. */
33 void nf_register_queue_handler(const struct nf_queue_handler
*qh
)
35 /* should never happen, we only have one queueing backend in kernel */
36 WARN_ON(rcu_access_pointer(queue_handler
));
37 rcu_assign_pointer(queue_handler
, qh
);
39 EXPORT_SYMBOL(nf_register_queue_handler
);
41 /* The caller must flush their queue before this */
42 void nf_unregister_queue_handler(void)
44 RCU_INIT_POINTER(queue_handler
, NULL
);
47 EXPORT_SYMBOL(nf_unregister_queue_handler
);
49 void nf_queue_entry_release_refs(struct nf_queue_entry
*entry
)
51 struct nf_hook_state
*state
= &entry
->state
;
53 /* Release those devices we held, or Alexey will kill me. */
60 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
61 if (entry
->skb
->nf_bridge
) {
62 struct net_device
*physdev
;
64 physdev
= nf_bridge_get_physindev(entry
->skb
);
67 physdev
= nf_bridge_get_physoutdev(entry
->skb
);
72 /* Drop reference to owner of hook which queued us. */
73 module_put(entry
->elem
->owner
);
75 EXPORT_SYMBOL_GPL(nf_queue_entry_release_refs
);
77 /* Bump dev refs so they don't vanish while packet is out */
78 bool nf_queue_entry_get_refs(struct nf_queue_entry
*entry
)
80 struct nf_hook_state
*state
= &entry
->state
;
82 if (!try_module_get(entry
->elem
->owner
))
91 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
92 if (entry
->skb
->nf_bridge
) {
93 struct net_device
*physdev
;
95 physdev
= nf_bridge_get_physindev(entry
->skb
);
98 physdev
= nf_bridge_get_physoutdev(entry
->skb
);
106 EXPORT_SYMBOL_GPL(nf_queue_entry_get_refs
);
108 void nf_queue_nf_hook_drop(struct nf_hook_ops
*ops
)
110 const struct nf_queue_handler
*qh
;
115 qh
= rcu_dereference(queue_handler
);
118 qh
->nf_hook_drop(net
, ops
);
126 * Any packet that leaves via this function must come back
127 * through nf_reinject().
129 int nf_queue(struct sk_buff
*skb
,
130 struct nf_hook_ops
*elem
,
131 struct nf_hook_state
*state
,
132 unsigned int queuenum
)
134 int status
= -ENOENT
;
135 struct nf_queue_entry
*entry
= NULL
;
136 const struct nf_afinfo
*afinfo
;
137 const struct nf_queue_handler
*qh
;
139 /* QUEUE == DROP if no one is waiting, to be safe. */
142 qh
= rcu_dereference(queue_handler
);
148 afinfo
= nf_get_afinfo(state
->pf
);
152 entry
= kmalloc(sizeof(*entry
) + afinfo
->route_key_size
, GFP_ATOMIC
);
158 *entry
= (struct nf_queue_entry
) {
162 .size
= sizeof(*entry
) + afinfo
->route_key_size
,
165 if (!nf_queue_entry_get_refs(entry
)) {
170 afinfo
->saveroute(skb
, entry
);
171 status
= qh
->outfn(entry
, queuenum
);
176 nf_queue_entry_release_refs(entry
);
189 void nf_reinject(struct nf_queue_entry
*entry
, unsigned int verdict
)
191 struct sk_buff
*skb
= entry
->skb
;
192 struct nf_hook_ops
*elem
= entry
->elem
;
193 const struct nf_afinfo
*afinfo
;
198 nf_queue_entry_release_refs(entry
);
200 /* Continue traversal iff userspace said ok... */
201 if (verdict
== NF_REPEAT
) {
202 elem
= list_entry(elem
->list
.prev
, struct nf_hook_ops
, list
);
206 if (verdict
== NF_ACCEPT
) {
207 afinfo
= nf_get_afinfo(entry
->state
.pf
);
208 if (!afinfo
|| afinfo
->reroute(skb
, entry
) < 0)
212 entry
->state
.thresh
= INT_MIN
;
214 if (verdict
== NF_ACCEPT
) {
216 verdict
= nf_iterate(&nf_hooks
[entry
->state
.pf
][entry
->state
.hook
],
217 skb
, &entry
->state
, &elem
);
220 switch (verdict
& NF_VERDICT_MASK
) {
224 entry
->state
.okfn(entry
->state
.sk
, skb
);
228 err
= nf_queue(skb
, elem
, &entry
->state
,
229 verdict
>> NF_VERDICT_QBITS
);
231 if (err
== -ECANCELED
)
234 (verdict
& NF_VERDICT_FLAG_QUEUE_BYPASS
))
247 EXPORT_SYMBOL(nf_reinject
);