SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/netfilter/nf_queue.c

   1 #include <linux/kernel.h>
   2 #include <linux/init.h>
   3 #include <linux/module.h>
   4 #include <linux/proc_fs.h>
   5 #include <linux/skbuff.h>
   6 #include <linux/netfilter.h>
   7 #include <linux/seq_file.h>
   8 #include <linux/rcupdate.h>
   9 #include <net/protocol.h>
  10
  11 #include "nf_internals.h"
  12
  13 /*
  14  * A queue handler may be registered for each protocol.  Each is protected by
  15  * long term mutex.  The handler must provide an an outfn() to accept packets
  16  * for queueing and must reinject all packets it receives, no matter what.
  17  */
  18 static struct nf_queue_handler *queue_handler[NPROTO];
  19
  20 static DEFINE_MUTEX(queue_handler_mutex);
  21
  22 /* return EBUSY when somebody else is registered, return EEXIST if the
  23  * same handler is registered, return 0 in case of success. */
  24 int nf_register_queue_handler(int pf, struct nf_queue_handler *qh)
  25 {
  26         int ret;
  27
  28         if (pf >= NPROTO)
  29                 return -EINVAL;
  30
  31         mutex_lock(&queue_handler_mutex);
  32         if (queue_handler[pf] == qh)
  33                 ret = -EEXIST;
  34         else if (queue_handler[pf])
  35                 ret = -EBUSY;
  36         else {
  37                 rcu_assign_pointer(queue_handler[pf], qh);
  38                 ret = 0;
  39         }
  40         mutex_unlock(&queue_handler_mutex);
  41
  42         return ret;
  43 }
  44 EXPORT_SYMBOL(nf_register_queue_handler);
  45
  46 /* The caller must flush their queue before this */
  47 int nf_unregister_queue_handler(int pf, struct nf_queue_handler *qh)
  48 {
  49         if (pf >= NPROTO)
  50                 return -EINVAL;
  51
  52         mutex_lock(&queue_handler_mutex);
  53         if (queue_handler[pf] != qh) {
  54                 mutex_unlock(&queue_handler_mutex);
  55                 return -EINVAL;
  56         }
  57
  58         rcu_assign_pointer(queue_handler[pf], NULL);
  59         mutex_unlock(&queue_handler_mutex);
  60
  61         synchronize_rcu();
  62
  63         return 0;
  64 }
  65 EXPORT_SYMBOL(nf_unregister_queue_handler);
  66
  67 void nf_unregister_queue_handlers(struct nf_queue_handler *qh)
  68 {
  69         int pf;
  70
  71         mutex_lock(&queue_handler_mutex);
  72         for (pf = 0; pf < NPROTO; pf++)  {
  73                 if (queue_handler[pf] == qh)
  74                         rcu_assign_pointer(queue_handler[pf], NULL);
  75         }
  76         mutex_unlock(&queue_handler_mutex);
  77
  78         synchronize_rcu();
  79 }
  80 EXPORT_SYMBOL_GPL(nf_unregister_queue_handlers);
  81
  82 /*
  83  * Any packet that leaves via this function must come back
  84  * through nf_reinject().
  85  */
  86 static int __nf_queue(struct sk_buff *skb,
  87                       struct list_head *elem,
  88                       int pf, unsigned int hook,
  89                       struct net_device *indev,
  90                       struct net_device *outdev,
  91                       int (*okfn)(struct sk_buff *),
  92                       unsigned int queuenum)
  93 {
  94         int status;
  95         struct nf_info *info;
  96 #ifdef CONFIG_BRIDGE_NETFILTER
  97         struct net_device *physindev = NULL;
  98         struct net_device *physoutdev = NULL;
  99 #endif
 100         struct nf_afinfo *afinfo;
 101         struct nf_queue_handler *qh;
 102
 103         /* QUEUE == DROP if noone is waiting, to be safe. */
 104         rcu_read_lock();
 105
 106         qh = rcu_dereference(queue_handler[pf]);
 107         if (!qh) {
 108                 rcu_read_unlock();
 109                 kfree_skb(skb);
 110                 return 1;
 111         }
 112
 113         afinfo = nf_get_afinfo(pf);
 114         if (!afinfo) {
 115                 rcu_read_unlock();
 116                 kfree_skb(skb);
 117                 return 1;
 118         }
 119
 120         info = kmalloc(sizeof(*info) + afinfo->route_key_size, GFP_ATOMIC);
 121         if (!info) {
 122                 if (net_ratelimit())
 123                         printk(KERN_ERR "OOM queueing packet %p\n",
 124                                skb);
 125                 rcu_read_unlock();
 126                 kfree_skb(skb);
 127                 return 1;
 128         }
 129
 130         *info = (struct nf_info) {
 131                 (struct nf_hook_ops *)elem, pf, hook, indev, outdev, okfn };
 132
 133         /* If it's going away, ignore hook. */
 134         if (!try_module_get(info->elem->owner)) {
 135                 rcu_read_unlock();
 136                 kfree(info);
 137                 return 0;
 138         }
 139
 140         /* Bump dev refs so they don't vanish while packet is out */
 141         if (indev)
 142                 dev_hold(indev);
 143         if (outdev)
 144                 dev_hold(outdev);
 145 #ifdef CONFIG_BRIDGE_NETFILTER
 146         if (skb->nf_bridge) {
 147                 physindev = skb->nf_bridge->physindev;
 148                 if (physindev)
 149                         dev_hold(physindev);
 150                 physoutdev = skb->nf_bridge->physoutdev;
 151                 if (physoutdev)
 152                         dev_hold(physoutdev);
 153         }
 154 #endif
 155         afinfo->saveroute(skb, info);
 156         status = qh->outfn(skb, info, queuenum, qh->data);
 157
 158         rcu_read_unlock();
 159
 160         if (status < 0) {
 161                 /* James M doesn't say fuck enough. */
 162                 if (indev)
 163                         dev_put(indev);
 164                 if (outdev)
 165                         dev_put(outdev);
 166 #ifdef CONFIG_BRIDGE_NETFILTER
 167                 if (physindev)
 168                         dev_put(physindev);
 169                 if (physoutdev)
 170                         dev_put(physoutdev);
 171 #endif
 172                 module_put(info->elem->owner);
 173                 kfree(info);
 174                 kfree_skb(skb);
 175
 176                 return 1;
 177         }
 178
 179         return 1;
 180 }
 181
 182 int nf_queue(struct sk_buff *skb,
 183              struct list_head *elem,
 184              int pf, unsigned int hook,
 185              struct net_device *indev,
 186              struct net_device *outdev,
 187              int (*okfn)(struct sk_buff *),
 188              unsigned int queuenum)
 189 {
 190         struct sk_buff *segs;
 191
 192         if (!skb_is_gso(skb))
 193                 return __nf_queue(skb, elem, pf, hook, indev, outdev, okfn,
 194                                   queuenum);
 195
 196         switch (pf) {
 197         case AF_INET:
 198                 skb->protocol = htons(ETH_P_IP);
 199                 break;
 200         case AF_INET6:
 201                 skb->protocol = htons(ETH_P_IPV6);
 202                 break;
 203         }
 204
 205         segs = skb_gso_segment(skb, 0);
 206         kfree_skb(skb);
 207         if (unlikely(IS_ERR(segs)))
 208                 return 1;
 209
 210         do {
 211                 struct sk_buff *nskb = segs->next;
 212
 213                 segs->next = NULL;
 214                 if (!__nf_queue(segs, elem, pf, hook, indev, outdev, okfn,
 215                                 queuenum))
 216                         kfree_skb(segs);
 217                 segs = nskb;
 218         } while (segs);
 219         return 1;
 220 }
 221
 222 void nf_reinject(struct sk_buff *skb, struct nf_info *info,
 223                  unsigned int verdict)
 224 {
 225         struct list_head *elem = &info->elem->list;
 226         struct list_head *i;
 227         struct nf_afinfo *afinfo;
 228
 229         rcu_read_lock();
 230
 231         /* Release those devices we held, or Alexey will kill me. */
 232         if (info->indev)
 233                 dev_put(info->indev);
 234         if (info->outdev)
 235                 dev_put(info->outdev);
 236 #ifdef CONFIG_BRIDGE_NETFILTER
 237         if (skb->nf_bridge) {
 238                 if (skb->nf_bridge->physindev)
 239                         dev_put(skb->nf_bridge->physindev);
 240                 if (skb->nf_bridge->physoutdev)
 241                         dev_put(skb->nf_bridge->physoutdev);
 242         }
 243 #endif
 244
 245         /* Drop reference to owner of hook which queued us. */
 246         module_put(info->elem->owner);
 247
 248         list_for_each_rcu(i, &nf_hooks[info->pf][info->hook]) {
 249                 if (i == elem)
 250                         break;
 251         }
 252
 253         if (i == &nf_hooks[info->pf][info->hook]) {
 254                 /* The module which sent it to userspace is gone. */
 255                 NFDEBUG("%s: module disappeared, dropping packet.\n",
 256                         __FUNCTION__);
 257                 verdict = NF_DROP;
 258         }
 259
 260         /* Continue traversal iff userspace said ok... */
 261         if (verdict == NF_REPEAT) {
 262                 elem = elem->prev;
 263                 verdict = NF_ACCEPT;
 264         }
 265
 266         if (verdict == NF_ACCEPT) {
 267                 afinfo = nf_get_afinfo(info->pf);
 268                 if (!afinfo || afinfo->reroute(skb, info) < 0)
 269                         verdict = NF_DROP;
 270         }
 271
 272         if (verdict == NF_ACCEPT) {
 273         next_hook:
 274                 verdict = nf_iterate(&nf_hooks[info->pf][info->hook],
 275                                      skb, info->hook,
 276                                      info->indev, info->outdev, &elem,
 277                                      info->okfn, INT_MIN);
 278         }
 279
 280         switch (verdict & NF_VERDICT_MASK) {
 281         case NF_ACCEPT:
 282         case NF_STOP:
 283                 info->okfn(skb);
 284         case NF_STOLEN:
 285                 break;
 286         case NF_QUEUE:
 287                 if (!__nf_queue(skb, elem, info->pf, info->hook,
 288                                 info->indev, info->outdev, info->okfn,
 289                                 verdict >> NF_VERDICT_BITS))
 290                         goto next_hook;
 291                 break;
 292         default:
 293                 kfree_skb(skb);
 294         }
 295         rcu_read_unlock();
 296         kfree(info);
 297         return;
 298 }
 299 EXPORT_SYMBOL(nf_reinject);
 300
 301 #ifdef CONFIG_PROC_FS
 302 static void *seq_start(struct seq_file *seq, loff_t *pos)
 303 {
 304         if (*pos >= NPROTO)
 305                 return NULL;
 306
 307         return pos;
 308 }
 309
 310 static void *seq_next(struct seq_file *s, void *v, loff_t *pos)
 311 {
 312         (*pos)++;
 313
 314         if (*pos >= NPROTO)
 315                 return NULL;
 316
 317         return pos;
 318 }
 319
 320 static void seq_stop(struct seq_file *s, void *v)
 321 {
 322
 323 }
 324
 325 static int seq_show(struct seq_file *s, void *v)
 326 {
 327         int ret;
 328         loff_t *pos = v;
 329         struct nf_queue_handler *qh;
 330
 331         rcu_read_lock();
 332         qh = rcu_dereference(queue_handler[*pos]);
 333         if (!qh)
 334                 ret = seq_printf(s, "%2lld NONE\n", *pos);
 335         else
 336                 ret = seq_printf(s, "%2lld %s\n", *pos, qh->name);
 337         rcu_read_unlock();
 338
 339         return ret;
 340 }
 341
 342 static const struct seq_operations nfqueue_seq_ops = {
 343         .start  = seq_start,
 344         .next   = seq_next,
 345         .stop   = seq_stop,
 346         .show   = seq_show,
 347 };
 348
 349 static int nfqueue_open(struct inode *inode, struct file *file)
 350 {
 351         return seq_open(file, &nfqueue_seq_ops);
 352 }
 353
 354 static const struct file_operations nfqueue_file_ops = {
 355         .owner   = THIS_MODULE,
 356         .open    = nfqueue_open,
 357         .read    = seq_read,
 358         .llseek  = seq_lseek,
 359         .release = seq_release,
 360 };
 361 #endif /* PROC_FS */
 362
 363
 364 int __init netfilter_queue_init(void)
 365 {
 366 #ifdef CONFIG_PROC_FS
 367         struct proc_dir_entry *pde;
 368
 369         pde = create_proc_entry("nf_queue", S_IRUGO, proc_net_netfilter);
 370         if (!pde)
 371                 return -1;
 372         pde->proc_fops = &nfqueue_file_ops;
 373 #endif
 374         return 0;
 375 }
 376