1 /* Netfilter messages via netlink socket. Allows for user space
2 * protocol helpers and general trouble making from userspace.
4 * (C) 2001 by Jay Schulist <jschlst@samba.org>,
5 * (C) 2002-2005 by Harald Welte <laforge@gnumonks.org>
6 * (C) 2005,2007 by Pablo Neira Ayuso <pablo@netfilter.org>
8 * Initial netfilter messages via netlink development funded and
9 * generally made possible by Network Robots, Inc. (www.networkrobots.com)
11 * Further development of this code funded by Astaro AG (http://www.astaro.com)
13 * This software may be used and distributed according to the terms
14 * of the GNU General Public License, incorporated herein by reference.
17 #include <linux/module.h>
18 #include <linux/types.h>
19 #include <linux/socket.h>
20 #include <linux/kernel.h>
21 #include <linux/string.h>
22 #include <linux/sockios.h>
23 #include <linux/net.h>
24 #include <linux/skbuff.h>
25 #include <asm/uaccess.h>
27 #include <net/netlink.h>
28 #include <linux/init.h>
30 #include <linux/netlink.h>
31 #include <linux/netfilter/nfnetlink.h>
33 MODULE_LICENSE("GPL");
34 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
35 MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK
, NETLINK_NETFILTER
);
37 static char __initdata nfversion
[] = "0.30";
39 static const struct nfnetlink_subsystem __rcu
*subsys_table
[NFNL_SUBSYS_COUNT
];
40 static DEFINE_MUTEX(nfnl_mutex
);
44 mutex_lock(&nfnl_mutex
);
46 EXPORT_SYMBOL_GPL(nfnl_lock
);
48 void nfnl_unlock(void)
50 mutex_unlock(&nfnl_mutex
);
52 EXPORT_SYMBOL_GPL(nfnl_unlock
);
54 int nfnetlink_subsys_register(const struct nfnetlink_subsystem
*n
)
57 if (subsys_table
[n
->subsys_id
]) {
61 rcu_assign_pointer(subsys_table
[n
->subsys_id
], n
);
66 EXPORT_SYMBOL_GPL(nfnetlink_subsys_register
);
68 int nfnetlink_subsys_unregister(const struct nfnetlink_subsystem
*n
)
71 subsys_table
[n
->subsys_id
] = NULL
;
76 EXPORT_SYMBOL_GPL(nfnetlink_subsys_unregister
);
78 static inline const struct nfnetlink_subsystem
*nfnetlink_get_subsys(u_int16_t type
)
80 u_int8_t subsys_id
= NFNL_SUBSYS_ID(type
);
82 if (subsys_id
>= NFNL_SUBSYS_COUNT
)
85 return rcu_dereference(subsys_table
[subsys_id
]);
88 static inline const struct nfnl_callback
*
89 nfnetlink_find_client(u_int16_t type
, const struct nfnetlink_subsystem
*ss
)
91 u_int8_t cb_id
= NFNL_MSG_TYPE(type
);
93 if (cb_id
>= ss
->cb_count
)
96 return &ss
->cb
[cb_id
];
99 int nfnetlink_has_listeners(struct net
*net
, unsigned int group
)
101 return netlink_has_listeners(net
->nfnl
, group
);
103 EXPORT_SYMBOL_GPL(nfnetlink_has_listeners
);
105 int nfnetlink_send(struct sk_buff
*skb
, struct net
*net
, u32 pid
,
106 unsigned int group
, int echo
, gfp_t flags
)
108 return nlmsg_notify(net
->nfnl
, skb
, pid
, group
, echo
, flags
);
110 EXPORT_SYMBOL_GPL(nfnetlink_send
);
112 int nfnetlink_set_err(struct net
*net
, u32 pid
, u32 group
, int error
)
114 return netlink_set_err(net
->nfnl
, pid
, group
, error
);
116 EXPORT_SYMBOL_GPL(nfnetlink_set_err
);
118 int nfnetlink_unicast(struct sk_buff
*skb
, struct net
*net
, u_int32_t pid
, int flags
)
120 return netlink_unicast(net
->nfnl
, skb
, pid
, flags
);
122 EXPORT_SYMBOL_GPL(nfnetlink_unicast
);
124 /* Process one complete nfnetlink message. */
125 static int nfnetlink_rcv_msg(struct sk_buff
*skb
, struct nlmsghdr
*nlh
)
127 struct net
*net
= sock_net(skb
->sk
);
128 const struct nfnl_callback
*nc
;
129 const struct nfnetlink_subsystem
*ss
;
132 if (!capable(CAP_NET_ADMIN
))
135 /* All the messages must at least contain nfgenmsg */
136 if (nlh
->nlmsg_len
< NLMSG_LENGTH(sizeof(struct nfgenmsg
)))
139 type
= nlh
->nlmsg_type
;
142 ss
= nfnetlink_get_subsys(type
);
144 #ifdef CONFIG_MODULES
146 request_module("nfnetlink-subsys-%d", NFNL_SUBSYS_ID(type
));
148 ss
= nfnetlink_get_subsys(type
);
157 nc
= nfnetlink_find_client(type
, ss
);
164 int min_len
= NLMSG_SPACE(sizeof(struct nfgenmsg
));
165 u_int8_t cb_id
= NFNL_MSG_TYPE(nlh
->nlmsg_type
);
166 struct nlattr
*cda
[ss
->cb
[cb_id
].attr_count
+ 1];
167 struct nlattr
*attr
= (void *)nlh
+ min_len
;
168 int attrlen
= nlh
->nlmsg_len
- min_len
;
170 err
= nla_parse(cda
, ss
->cb
[cb_id
].attr_count
,
171 attr
, attrlen
, ss
->cb
[cb_id
].policy
);
178 err
= nc
->call_rcu(net
->nfnl
, skb
, nlh
,
179 (const struct nlattr
**)cda
);
184 if (rcu_dereference_protected(
185 subsys_table
[NFNL_SUBSYS_ID(type
)],
186 lockdep_is_held(&nfnl_mutex
)) != ss
||
187 nfnetlink_find_client(type
, ss
) != nc
)
190 err
= nc
->call(net
->nfnl
, skb
, nlh
,
191 (const struct nlattr
**)cda
);
200 static void nfnetlink_rcv(struct sk_buff
*skb
)
202 netlink_rcv_skb(skb
, &nfnetlink_rcv_msg
);
205 static int __net_init
nfnetlink_net_init(struct net
*net
)
209 nfnl
= netlink_kernel_create(net
, NETLINK_NETFILTER
, NFNLGRP_MAX
,
210 nfnetlink_rcv
, NULL
, THIS_MODULE
);
213 net
->nfnl_stash
= nfnl
;
214 rcu_assign_pointer(net
->nfnl
, nfnl
);
218 static void __net_exit
nfnetlink_net_exit_batch(struct list_head
*net_exit_list
)
222 list_for_each_entry(net
, net_exit_list
, exit_list
)
223 RCU_INIT_POINTER(net
->nfnl
, NULL
);
225 list_for_each_entry(net
, net_exit_list
, exit_list
)
226 netlink_kernel_release(net
->nfnl_stash
);
229 static struct pernet_operations nfnetlink_net_ops
= {
230 .init
= nfnetlink_net_init
,
231 .exit_batch
= nfnetlink_net_exit_batch
,
234 static int __init
nfnetlink_init(void)
236 pr_info("Netfilter messages via NETLINK v%s.\n", nfversion
);
237 return register_pernet_subsys(&nfnetlink_net_ops
);
240 static void __exit
nfnetlink_exit(void)
242 pr_info("Removing netfilter NETLINK layer.\n");
243 unregister_pernet_subsys(&nfnetlink_net_ops
);
245 module_init(nfnetlink_init
);
246 module_exit(nfnetlink_exit
);