1 /* Netfilter messages via netlink socket. Allows for user space
2 * protocol helpers and general trouble making from userspace.
4 * (C) 2001 by Jay Schulist <jschlst@samba.org>,
5 * (C) 2002-2005 by Harald Welte <laforge@gnumonks.org>
6 * (C) 2005,2007 by Pablo Neira Ayuso <pablo@netfilter.org>
8 * Initial netfilter messages via netlink development funded and
9 * generally made possible by Network Robots, Inc. (www.networkrobots.com)
11 * Further development of this code funded by Astaro AG (http://www.astaro.com)
13 * This software may be used and distributed according to the terms
14 * of the GNU General Public License, incorporated herein by reference.
17 #include <linux/module.h>
18 #include <linux/types.h>
19 #include <linux/socket.h>
20 #include <linux/kernel.h>
21 #include <linux/string.h>
22 #include <linux/sockios.h>
23 #include <linux/net.h>
24 #include <linux/skbuff.h>
25 #include <asm/uaccess.h>
27 #include <linux/init.h>
29 #include <net/netlink.h>
30 #include <linux/netfilter/nfnetlink.h>
32 MODULE_LICENSE("GPL");
33 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
34 MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK
, NETLINK_NETFILTER
);
36 static char __initdata nfversion
[] = "0.30";
40 const struct nfnetlink_subsystem __rcu
*subsys
;
41 } table
[NFNL_SUBSYS_COUNT
];
43 static const int nfnl_group2type
[NFNLGRP_MAX
+1] = {
44 [NFNLGRP_CONNTRACK_NEW
] = NFNL_SUBSYS_CTNETLINK
,
45 [NFNLGRP_CONNTRACK_UPDATE
] = NFNL_SUBSYS_CTNETLINK
,
46 [NFNLGRP_CONNTRACK_DESTROY
] = NFNL_SUBSYS_CTNETLINK
,
47 [NFNLGRP_CONNTRACK_EXP_NEW
] = NFNL_SUBSYS_CTNETLINK_EXP
,
48 [NFNLGRP_CONNTRACK_EXP_UPDATE
] = NFNL_SUBSYS_CTNETLINK_EXP
,
49 [NFNLGRP_CONNTRACK_EXP_DESTROY
] = NFNL_SUBSYS_CTNETLINK_EXP
,
50 [NFNLGRP_NFTABLES
] = NFNL_SUBSYS_NFTABLES
,
51 [NFNLGRP_ACCT_QUOTA
] = NFNL_SUBSYS_ACCT
,
54 void nfnl_lock(__u8 subsys_id
)
56 mutex_lock(&table
[subsys_id
].mutex
);
58 EXPORT_SYMBOL_GPL(nfnl_lock
);
60 void nfnl_unlock(__u8 subsys_id
)
62 mutex_unlock(&table
[subsys_id
].mutex
);
64 EXPORT_SYMBOL_GPL(nfnl_unlock
);
66 #ifdef CONFIG_PROVE_LOCKING
67 int lockdep_nfnl_is_held(u8 subsys_id
)
69 return lockdep_is_held(&table
[subsys_id
].mutex
);
71 EXPORT_SYMBOL_GPL(lockdep_nfnl_is_held
);
74 int nfnetlink_subsys_register(const struct nfnetlink_subsystem
*n
)
76 nfnl_lock(n
->subsys_id
);
77 if (table
[n
->subsys_id
].subsys
) {
78 nfnl_unlock(n
->subsys_id
);
81 rcu_assign_pointer(table
[n
->subsys_id
].subsys
, n
);
82 nfnl_unlock(n
->subsys_id
);
86 EXPORT_SYMBOL_GPL(nfnetlink_subsys_register
);
88 int nfnetlink_subsys_unregister(const struct nfnetlink_subsystem
*n
)
90 nfnl_lock(n
->subsys_id
);
91 table
[n
->subsys_id
].subsys
= NULL
;
92 nfnl_unlock(n
->subsys_id
);
96 EXPORT_SYMBOL_GPL(nfnetlink_subsys_unregister
);
98 static inline const struct nfnetlink_subsystem
*nfnetlink_get_subsys(u_int16_t type
)
100 u_int8_t subsys_id
= NFNL_SUBSYS_ID(type
);
102 if (subsys_id
>= NFNL_SUBSYS_COUNT
)
105 return rcu_dereference(table
[subsys_id
].subsys
);
108 static inline const struct nfnl_callback
*
109 nfnetlink_find_client(u_int16_t type
, const struct nfnetlink_subsystem
*ss
)
111 u_int8_t cb_id
= NFNL_MSG_TYPE(type
);
113 if (cb_id
>= ss
->cb_count
)
116 return &ss
->cb
[cb_id
];
119 int nfnetlink_has_listeners(struct net
*net
, unsigned int group
)
121 return netlink_has_listeners(net
->nfnl
, group
);
123 EXPORT_SYMBOL_GPL(nfnetlink_has_listeners
);
125 struct sk_buff
*nfnetlink_alloc_skb(struct net
*net
, unsigned int size
,
126 u32 dst_portid
, gfp_t gfp_mask
)
128 return netlink_alloc_skb(net
->nfnl
, size
, dst_portid
, gfp_mask
);
130 EXPORT_SYMBOL_GPL(nfnetlink_alloc_skb
);
132 int nfnetlink_send(struct sk_buff
*skb
, struct net
*net
, u32 portid
,
133 unsigned int group
, int echo
, gfp_t flags
)
135 return nlmsg_notify(net
->nfnl
, skb
, portid
, group
, echo
, flags
);
137 EXPORT_SYMBOL_GPL(nfnetlink_send
);
139 int nfnetlink_set_err(struct net
*net
, u32 portid
, u32 group
, int error
)
141 return netlink_set_err(net
->nfnl
, portid
, group
, error
);
143 EXPORT_SYMBOL_GPL(nfnetlink_set_err
);
145 int nfnetlink_unicast(struct sk_buff
*skb
, struct net
*net
, u32 portid
,
148 return netlink_unicast(net
->nfnl
, skb
, portid
, flags
);
150 EXPORT_SYMBOL_GPL(nfnetlink_unicast
);
152 /* Process one complete nfnetlink message. */
153 static int nfnetlink_rcv_msg(struct sk_buff
*skb
, struct nlmsghdr
*nlh
)
155 struct net
*net
= sock_net(skb
->sk
);
156 const struct nfnl_callback
*nc
;
157 const struct nfnetlink_subsystem
*ss
;
160 /* All the messages must at least contain nfgenmsg */
161 if (nlmsg_len(nlh
) < sizeof(struct nfgenmsg
))
164 type
= nlh
->nlmsg_type
;
167 ss
= nfnetlink_get_subsys(type
);
169 #ifdef CONFIG_MODULES
171 request_module("nfnetlink-subsys-%d", NFNL_SUBSYS_ID(type
));
173 ss
= nfnetlink_get_subsys(type
);
182 nc
= nfnetlink_find_client(type
, ss
);
189 int min_len
= nlmsg_total_size(sizeof(struct nfgenmsg
));
190 u_int8_t cb_id
= NFNL_MSG_TYPE(nlh
->nlmsg_type
);
191 struct nlattr
*cda
[ss
->cb
[cb_id
].attr_count
+ 1];
192 struct nlattr
*attr
= (void *)nlh
+ min_len
;
193 int attrlen
= nlh
->nlmsg_len
- min_len
;
194 __u8 subsys_id
= NFNL_SUBSYS_ID(type
);
196 err
= nla_parse(cda
, ss
->cb
[cb_id
].attr_count
,
197 attr
, attrlen
, ss
->cb
[cb_id
].policy
);
204 err
= nc
->call_rcu(net
->nfnl
, skb
, nlh
,
205 (const struct nlattr
**)cda
);
209 nfnl_lock(subsys_id
);
210 if (rcu_dereference_protected(table
[subsys_id
].subsys
,
211 lockdep_is_held(&table
[subsys_id
].mutex
)) != ss
||
212 nfnetlink_find_client(type
, ss
) != nc
)
215 err
= nc
->call(net
->nfnl
, skb
, nlh
,
216 (const struct nlattr
**)cda
);
219 nfnl_unlock(subsys_id
);
228 struct list_head head
;
229 struct nlmsghdr
*nlh
;
233 static int nfnl_err_add(struct list_head
*list
, struct nlmsghdr
*nlh
, int err
)
235 struct nfnl_err
*nfnl_err
;
237 nfnl_err
= kmalloc(sizeof(struct nfnl_err
), GFP_KERNEL
);
238 if (nfnl_err
== NULL
)
243 list_add_tail(&nfnl_err
->head
, list
);
248 static void nfnl_err_del(struct nfnl_err
*nfnl_err
)
250 list_del(&nfnl_err
->head
);
254 static void nfnl_err_reset(struct list_head
*err_list
)
256 struct nfnl_err
*nfnl_err
, *next
;
258 list_for_each_entry_safe(nfnl_err
, next
, err_list
, head
)
259 nfnl_err_del(nfnl_err
);
262 static void nfnl_err_deliver(struct list_head
*err_list
, struct sk_buff
*skb
)
264 struct nfnl_err
*nfnl_err
, *next
;
266 list_for_each_entry_safe(nfnl_err
, next
, err_list
, head
) {
267 netlink_ack(skb
, nfnl_err
->nlh
, nfnl_err
->err
);
268 nfnl_err_del(nfnl_err
);
272 static void nfnetlink_rcv_batch(struct sk_buff
*skb
, struct nlmsghdr
*nlh
,
275 struct sk_buff
*oskb
= skb
;
276 struct net
*net
= sock_net(skb
->sk
);
277 const struct nfnetlink_subsystem
*ss
;
278 const struct nfnl_callback
*nc
;
279 bool success
= true, done
= false;
280 static LIST_HEAD(err_list
);
283 if (subsys_id
>= NFNL_SUBSYS_COUNT
)
284 return netlink_ack(skb
, nlh
, -EINVAL
);
286 skb
= netlink_skb_clone(oskb
, GFP_KERNEL
);
288 return netlink_ack(oskb
, nlh
, -ENOMEM
);
292 nfnl_lock(subsys_id
);
293 ss
= rcu_dereference_protected(table
[subsys_id
].subsys
,
294 lockdep_is_held(&table
[subsys_id
].mutex
));
296 #ifdef CONFIG_MODULES
297 nfnl_unlock(subsys_id
);
298 request_module("nfnetlink-subsys-%d", subsys_id
);
299 nfnl_lock(subsys_id
);
300 ss
= rcu_dereference_protected(table
[subsys_id
].subsys
,
301 lockdep_is_held(&table
[subsys_id
].mutex
));
305 nfnl_unlock(subsys_id
);
306 netlink_ack(skb
, nlh
, -EOPNOTSUPP
);
307 return kfree_skb(skb
);
311 if (!ss
->commit
|| !ss
->abort
) {
312 nfnl_unlock(subsys_id
);
313 netlink_ack(skb
, nlh
, -EOPNOTSUPP
);
314 return kfree_skb(skb
);
317 while (skb
->len
>= nlmsg_total_size(0)) {
320 nlh
= nlmsg_hdr(skb
);
323 if (nlmsg_len(nlh
) < sizeof(struct nfgenmsg
) ||
324 skb
->len
< nlh
->nlmsg_len
) {
329 /* Only requests are handled by the kernel */
330 if (!(nlh
->nlmsg_flags
& NLM_F_REQUEST
)) {
335 type
= nlh
->nlmsg_type
;
336 if (type
== NFNL_MSG_BATCH_BEGIN
) {
337 /* Malformed: Batch begin twice */
338 nfnl_err_reset(&err_list
);
341 } else if (type
== NFNL_MSG_BATCH_END
) {
344 } else if (type
< NLMSG_MIN_TYPE
) {
349 /* We only accept a batch with messages for the same
352 if (NFNL_SUBSYS_ID(type
) != subsys_id
) {
357 nc
= nfnetlink_find_client(type
, ss
);
364 int min_len
= nlmsg_total_size(sizeof(struct nfgenmsg
));
365 u_int8_t cb_id
= NFNL_MSG_TYPE(nlh
->nlmsg_type
);
366 struct nlattr
*cda
[ss
->cb
[cb_id
].attr_count
+ 1];
367 struct nlattr
*attr
= (void *)nlh
+ min_len
;
368 int attrlen
= nlh
->nlmsg_len
- min_len
;
370 err
= nla_parse(cda
, ss
->cb
[cb_id
].attr_count
,
371 attr
, attrlen
, ss
->cb
[cb_id
].policy
);
375 if (nc
->call_batch
) {
376 err
= nc
->call_batch(net
->nfnl
, skb
, nlh
,
377 (const struct nlattr
**)cda
);
380 /* The lock was released to autoload some module, we
381 * have to abort and start from scratch using the
384 if (err
== -EAGAIN
) {
385 nfnl_err_reset(&err_list
);
387 nfnl_unlock(subsys_id
);
393 if (nlh
->nlmsg_flags
& NLM_F_ACK
|| err
) {
394 /* Errors are delivered once the full batch has been
395 * processed, this avoids that the same error is
396 * reported several times when replaying the batch.
398 if (nfnl_err_add(&err_list
, nlh
, err
) < 0) {
399 /* We failed to enqueue an error, reset the
400 * list of errors and send OOM to userspace
401 * pointing to the batch header.
403 nfnl_err_reset(&err_list
);
404 netlink_ack(skb
, nlmsg_hdr(oskb
), -ENOMEM
);
408 /* We don't stop processing the batch on errors, thus,
409 * userspace gets all the errors that the batch
416 msglen
= NLMSG_ALIGN(nlh
->nlmsg_len
);
417 if (msglen
> skb
->len
)
419 skb_pull(skb
, msglen
);
427 nfnl_err_deliver(&err_list
, oskb
);
428 nfnl_unlock(subsys_id
);
432 static void nfnetlink_rcv(struct sk_buff
*skb
)
434 struct nlmsghdr
*nlh
= nlmsg_hdr(skb
);
437 if (nlh
->nlmsg_len
< NLMSG_HDRLEN
||
438 skb
->len
< nlh
->nlmsg_len
)
441 if (!netlink_net_capable(skb
, CAP_NET_ADMIN
)) {
442 netlink_ack(skb
, nlh
, -EPERM
);
446 if (nlh
->nlmsg_type
== NFNL_MSG_BATCH_BEGIN
) {
447 struct nfgenmsg
*nfgenmsg
;
449 msglen
= NLMSG_ALIGN(nlh
->nlmsg_len
);
450 if (msglen
> skb
->len
)
453 if (nlh
->nlmsg_len
< NLMSG_HDRLEN
||
454 skb
->len
< NLMSG_HDRLEN
+ sizeof(struct nfgenmsg
))
457 nfgenmsg
= nlmsg_data(nlh
);
458 skb_pull(skb
, msglen
);
459 nfnetlink_rcv_batch(skb
, nlh
, nfgenmsg
->res_id
);
461 netlink_rcv_skb(skb
, &nfnetlink_rcv_msg
);
465 #ifdef CONFIG_MODULES
466 static int nfnetlink_bind(struct net
*net
, int group
)
468 const struct nfnetlink_subsystem
*ss
;
471 if (group
<= NFNLGRP_NONE
|| group
> NFNLGRP_MAX
)
474 type
= nfnl_group2type
[group
];
477 ss
= nfnetlink_get_subsys(type
);
480 request_module("nfnetlink-subsys-%d", type
);
485 static int __net_init
nfnetlink_net_init(struct net
*net
)
488 struct netlink_kernel_cfg cfg
= {
489 .groups
= NFNLGRP_MAX
,
490 .input
= nfnetlink_rcv
,
491 #ifdef CONFIG_MODULES
492 .bind
= nfnetlink_bind
,
496 nfnl
= netlink_kernel_create(net
, NETLINK_NETFILTER
, &cfg
);
499 net
->nfnl_stash
= nfnl
;
500 rcu_assign_pointer(net
->nfnl
, nfnl
);
504 static void __net_exit
nfnetlink_net_exit_batch(struct list_head
*net_exit_list
)
508 list_for_each_entry(net
, net_exit_list
, exit_list
)
509 RCU_INIT_POINTER(net
->nfnl
, NULL
);
511 list_for_each_entry(net
, net_exit_list
, exit_list
)
512 netlink_kernel_release(net
->nfnl_stash
);
515 static struct pernet_operations nfnetlink_net_ops
= {
516 .init
= nfnetlink_net_init
,
517 .exit_batch
= nfnetlink_net_exit_batch
,
520 static int __init
nfnetlink_init(void)
524 for (i
= NFNLGRP_NONE
+ 1; i
<= NFNLGRP_MAX
; i
++)
525 BUG_ON(nfnl_group2type
[i
] == NFNL_SUBSYS_NONE
);
527 for (i
=0; i
<NFNL_SUBSYS_COUNT
; i
++)
528 mutex_init(&table
[i
].mutex
);
530 pr_info("Netfilter messages via NETLINK v%s.\n", nfversion
);
531 return register_pernet_subsys(&nfnetlink_net_ops
);
534 static void __exit
nfnetlink_exit(void)
536 pr_info("Removing netfilter NETLINK layer.\n");
537 unregister_pernet_subsys(&nfnetlink_net_ops
);
539 module_init(nfnetlink_init
);
540 module_exit(nfnetlink_exit
);