1 #include <linux/kernel.h> 2 #include <linux/slab.h> 3 #include <linux/init.h> 4 #include <linux/module.h> 5 #include <linux/proc_fs.h> 6 #include <linux/skbuff.h> 7 #include <linux/netfilter.h> 8 #include <linux/seq_file.h> 9 #include <linux/rcupdate.h> 10 #include <net/protocol.h> 11 #include <net/netfilter/nf_queue.h> 12 #include <net/dst.h> 13 14 #include "nf_internals.h" 15 16 /* 17 * A queue handler may be registered for each protocol. Each is protected by 18 * long term mutex. The handler must provide an an outfn() to accept packets 19 * for queueing and must reinject all packets it receives, no matter what. 20 */ 21 static const struct nf_queue_handler __rcu *queue_handler[NFPROTO_NUMPROTO] __read_mostly; 22 23 static DEFINE_MUTEX(queue_handler_mutex); 24 25 /* return EBUSY when somebody else is registered, return EEXIST if the 26 * same handler is registered, return 0 in case of success. */ 27 int nf_register_queue_handler(u_int8_t pf, const struct nf_queue_handler *qh) 28 { 29 int ret; 30 31 if (pf >= ARRAY_SIZE(queue_handler)) 32 return -EINVAL; 33 34 mutex_lock(&queue_handler_mutex); 35 if (queue_handler[pf] == qh) 36 ret = -EEXIST; 37 else if (queue_handler[pf]) 38 ret = -EBUSY; 39 else { 40 rcu_assign_pointer(queue_handler[pf], qh); 41 ret = 0; 42 } 43 mutex_unlock(&queue_handler_mutex); 44 45 return ret; 46 } 47 EXPORT_SYMBOL(nf_register_queue_handler); 48 49 /* The caller must flush their queue before this */ 50 int nf_unregister_queue_handler(u_int8_t pf, const struct nf_queue_handler *qh) 51 { 52 if (pf >= ARRAY_SIZE(queue_handler)) 53 return -EINVAL; 54 55 mutex_lock(&queue_handler_mutex); 56 if (queue_handler[pf] && queue_handler[pf] != qh) { 57 mutex_unlock(&queue_handler_mutex); 58 return -EINVAL; 59 } 60 61 rcu_assign_pointer(queue_handler[pf], NULL); 62 mutex_unlock(&queue_handler_mutex); 63 64 synchronize_rcu(); 65 66 return 0; 67 } 68 EXPORT_SYMBOL(nf_unregister_queue_handler); 69 70 void nf_unregister_queue_handlers(const struct nf_queue_handler *qh) 71 { 72 u_int8_t pf; 73 74 mutex_lock(&queue_handler_mutex); 75 for (pf = 0; pf < ARRAY_SIZE(queue_handler); pf++) { 76 if (queue_handler[pf] == qh) 77 rcu_assign_pointer(queue_handler[pf], NULL); 78 } 79 mutex_unlock(&queue_handler_mutex); 80 81 synchronize_rcu(); 82 } 83 EXPORT_SYMBOL_GPL(nf_unregister_queue_handlers); 84 85 static void nf_queue_entry_release_refs(struct nf_queue_entry *entry) 86 { 87 /* Release those devices we held, or Alexey will kill me. */ 88 if (entry->indev) 89 dev_put(entry->indev); 90 if (entry->outdev) 91 dev_put(entry->outdev); 92 #ifdef CONFIG_BRIDGE_NETFILTER 93 if (entry->skb->nf_bridge) { 94 struct nf_bridge_info *nf_bridge = entry->skb->nf_bridge; 95 96 if (nf_bridge->physindev) 97 dev_put(nf_bridge->physindev); 98 if (nf_bridge->physoutdev) 99 dev_put(nf_bridge->physoutdev); 100 } 101 #endif 102 /* Drop reference to owner of hook which queued us. */ 103 module_put(entry->elem->owner); 104 } 105 106 /* 107 * Any packet that leaves via this function must come back 108 * through nf_reinject(). 109 */ 110 static int __nf_queue(struct sk_buff *skb, 111 struct list_head *elem, 112 u_int8_t pf, unsigned int hook, 113 struct net_device *indev, 114 struct net_device *outdev, 115 int (*okfn)(struct sk_buff *), 116 unsigned int queuenum) 117 { 118 int status; 119 struct nf_queue_entry *entry = NULL; 120 #ifdef CONFIG_BRIDGE_NETFILTER 121 struct net_device *physindev; 122 struct net_device *physoutdev; 123 #endif 124 const struct nf_afinfo *afinfo; 125 const struct nf_queue_handler *qh; 126 127 /* QUEUE == DROP if noone is waiting, to be safe. */ 128 rcu_read_lock(); 129 130 qh = rcu_dereference(queue_handler[pf]); 131 if (!qh) 132 goto err_unlock; 133 134 afinfo = nf_get_afinfo(pf); 135 if (!afinfo) 136 goto err_unlock; 137 138 entry = kmalloc(sizeof(*entry) + afinfo->route_key_size, GFP_ATOMIC); 139 if (!entry) 140 goto err_unlock; 141 142 *entry = (struct nf_queue_entry) { 143 .skb = skb, 144 .elem = list_entry(elem, struct nf_hook_ops, list), 145 .pf = pf, 146 .hook = hook, 147 .indev = indev, 148 .outdev = outdev, 149 .okfn = okfn, 150 }; 151 152 /* If it's going away, ignore hook. */ 153 if (!try_module_get(entry->elem->owner)) { 154 rcu_read_unlock(); 155 kfree(entry); 156 return 0; 157 } 158 159 /* Bump dev refs so they don't vanish while packet is out */ 160 if (indev) 161 dev_hold(indev); 162 if (outdev) 163 dev_hold(outdev); 164 #ifdef CONFIG_BRIDGE_NETFILTER 165 if (skb->nf_bridge) { 166 physindev = skb->nf_bridge->physindev; 167 if (physindev) 168 dev_hold(physindev); 169 physoutdev = skb->nf_bridge->physoutdev; 170 if (physoutdev) 171 dev_hold(physoutdev); 172 } 173 #endif 174 skb_dst_force(skb); 175 afinfo->saveroute(skb, entry); 176 status = qh->outfn(entry, queuenum); 177 178 rcu_read_unlock(); 179 180 if (status < 0) { 181 nf_queue_entry_release_refs(entry); 182 goto err; 183 } 184 185 return 1; 186 187 err_unlock: 188 rcu_read_unlock(); 189 err: 190 kfree_skb(skb); 191 kfree(entry); 192 return 1; 193 } 194 195 int nf_queue(struct sk_buff *skb, 196 struct list_head *elem, 197 u_int8_t pf, unsigned int hook, 198 struct net_device *indev, 199 struct net_device *outdev, 200 int (*okfn)(struct sk_buff *), 201 unsigned int queuenum) 202 { 203 struct sk_buff *segs; 204 205 if (!skb_is_gso(skb)) 206 return __nf_queue(skb, elem, pf, hook, indev, outdev, okfn, 207 queuenum); 208 209 switch (pf) { 210 case NFPROTO_IPV4: 211 skb->protocol = htons(ETH_P_IP); 212 break; 213 case NFPROTO_IPV6: 214 skb->protocol = htons(ETH_P_IPV6); 215 break; 216 } 217 218 segs = skb_gso_segment(skb, 0); 219 kfree_skb(skb); 220 if (IS_ERR(segs)) 221 return 1; 222 223 do { 224 struct sk_buff *nskb = segs->next; 225 226 segs->next = NULL; 227 if (!__nf_queue(segs, elem, pf, hook, indev, outdev, okfn, 228 queuenum)) 229 kfree_skb(segs); 230 segs = nskb; 231 } while (segs); 232 return 1; 233 } 234 235 void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict) 236 { 237 struct sk_buff *skb = entry->skb; 238 struct list_head *elem = &entry->elem->list; 239 const struct nf_afinfo *afinfo; 240 241 rcu_read_lock(); 242 243 nf_queue_entry_release_refs(entry); 244 245 /* Continue traversal iff userspace said ok... */ 246 if (verdict == NF_REPEAT) { 247 elem = elem->prev; 248 verdict = NF_ACCEPT; 249 } 250 251 if (verdict == NF_ACCEPT) { 252 afinfo = nf_get_afinfo(entry->pf); 253 if (!afinfo || afinfo->reroute(skb, entry) < 0) 254 verdict = NF_DROP; 255 } 256 257 if (verdict == NF_ACCEPT) { 258 next_hook: 259 verdict = nf_iterate(&nf_hooks[entry->pf][entry->hook], 260 skb, entry->hook, 261 entry->indev, entry->outdev, &elem, 262 entry->okfn, INT_MIN); 263 } 264 265 switch (verdict & NF_VERDICT_MASK) { 266 case NF_ACCEPT: 267 case NF_STOP: 268 local_bh_disable(); 269 entry->okfn(skb); 270 local_bh_enable(); 271 break; 272 case NF_QUEUE: 273 if (!__nf_queue(skb, elem, entry->pf, entry->hook, 274 entry->indev, entry->outdev, entry->okfn, 275 verdict >> NF_VERDICT_BITS)) 276 goto next_hook; 277 break; 278 case NF_STOLEN: 279 default: 280 kfree_skb(skb); 281 } 282 rcu_read_unlock(); 283 kfree(entry); 284 } 285 EXPORT_SYMBOL(nf_reinject); 286 287 #ifdef CONFIG_PROC_FS 288 static void *seq_start(struct seq_file *seq, loff_t *pos) 289 { 290 if (*pos >= ARRAY_SIZE(queue_handler)) 291 return NULL; 292 293 return pos; 294 } 295 296 static void *seq_next(struct seq_file *s, void *v, loff_t *pos) 297 { 298 (*pos)++; 299 300 if (*pos >= ARRAY_SIZE(queue_handler)) 301 return NULL; 302 303 return pos; 304 } 305 306 static void seq_stop(struct seq_file *s, void *v) 307 { 308 309 } 310 311 static int seq_show(struct seq_file *s, void *v) 312 { 313 int ret; 314 loff_t *pos = v; 315 const struct nf_queue_handler *qh; 316 317 rcu_read_lock(); 318 qh = rcu_dereference(queue_handler[*pos]); 319 if (!qh) 320 ret = seq_printf(s, "%2lld NONE\n", *pos); 321 else 322 ret = seq_printf(s, "%2lld %s\n", *pos, qh->name); 323 rcu_read_unlock(); 324 325 return ret; 326 } 327 328 static const struct seq_operations nfqueue_seq_ops = { 329 .start = seq_start, 330 .next = seq_next, 331 .stop = seq_stop, 332 .show = seq_show, 333 }; 334 335 static int nfqueue_open(struct inode *inode, struct file *file) 336 { 337 return seq_open(file, &nfqueue_seq_ops); 338 } 339 340 static const struct file_operations nfqueue_file_ops = { 341 .owner = THIS_MODULE, 342 .open = nfqueue_open, 343 .read = seq_read, 344 .llseek = seq_lseek, 345 .release = seq_release, 346 }; 347 #endif /* PROC_FS */ 348 349 350 int __init netfilter_queue_init(void) 351 { 352 #ifdef CONFIG_PROC_FS 353 if (!proc_create("nf_queue", S_IRUGO, 354 proc_net_netfilter, &nfqueue_file_ops)) 355 return -1; 356 #endif 357 return 0; 358 } 359 360