SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/netfilter/nf_queue.c

   1 #include <linux/kernel.h>
   2 #include <linux/init.h>
   3 #include <linux/module.h>
   4 #include <linux/proc_fs.h>
   5 #include <linux/skbuff.h>
   6 #include <linux/netfilter.h>
   7 #include <linux/seq_file.h>
   8 #include <linux/rcupdate.h>
   9 #include <net/protocol.h>
  10
  11 #include "nf_internals.h"
  12
  13 /*
  14  * A queue handler may be registered for each protocol.  Each is protected by
  15  * long term mutex.  The handler must provide an an outfn() to accept packets
  16  * for queueing and must reinject all packets it receives, no matter what.
  17  */
  18 static struct nf_queue_handler *queue_handler[NPROTO];
  19
  20 static DEFINE_RWLOCK(queue_handler_lock);
  21
  22 /* return EBUSY when somebody else is registered, return EEXIST if the
  23  * same handler is registered, return 0 in case of success. */
  24 int nf_register_queue_handler(int pf, struct nf_queue_handler *qh)
  25 {
  26         int ret;
  27
  28         if (pf >= NPROTO)
  29                 return -EINVAL;
  30
  31         write_lock_bh(&queue_handler_lock);
  32         if (queue_handler[pf] == qh)
  33                 ret = -EEXIST;
  34         else if (queue_handler[pf])
  35                 ret = -EBUSY;
  36         else {
  37                 queue_handler[pf] = qh;
  38                 ret = 0;
  39         }
  40         write_unlock_bh(&queue_handler_lock);
  41
  42         return ret;
  43 }
  44 EXPORT_SYMBOL(nf_register_queue_handler);
  45
  46 /* The caller must flush their queue before this */
  47 int nf_unregister_queue_handler(int pf, struct nf_queue_handler *qh)
  48 {
  49         if (pf >= NPROTO)
  50                 return -EINVAL;
  51
  52         write_lock_bh(&queue_handler_lock);
  53         if (queue_handler[pf] != qh) {
  54                 write_unlock_bh(&queue_handler_lock);
  55                 return -EINVAL;
  56         }
  57
  58         queue_handler[pf] = NULL;
  59         write_unlock_bh(&queue_handler_lock);
  60
  61         return 0;
  62 }
  63 EXPORT_SYMBOL(nf_unregister_queue_handler);
  64
  65 void nf_unregister_queue_handlers(struct nf_queue_handler *qh)
  66 {
  67         int pf;
  68
  69         write_lock_bh(&queue_handler_lock);
  70         for (pf = 0; pf < NPROTO; pf++)  {
  71                 if (queue_handler[pf] == qh)
  72                         queue_handler[pf] = NULL;
  73         }
  74         write_unlock_bh(&queue_handler_lock);
  75 }
  76 EXPORT_SYMBOL_GPL(nf_unregister_queue_handlers);
  77
  78 /*
  79  * Any packet that leaves via this function must come back
  80  * through nf_reinject().
  81  */
  82 static int __nf_queue(struct sk_buff *skb,
  83                       struct list_head *elem,
  84                       int pf, unsigned int hook,
  85                       struct net_device *indev,
  86                       struct net_device *outdev,
  87                       int (*okfn)(struct sk_buff *),
  88                       unsigned int queuenum)
  89 {
  90         int status;
  91         struct nf_info *info;
  92 #ifdef CONFIG_BRIDGE_NETFILTER
  93         struct net_device *physindev = NULL;
  94         struct net_device *physoutdev = NULL;
  95 #endif
  96         struct nf_afinfo *afinfo;
  97
  98         /* QUEUE == DROP if noone is waiting, to be safe. */
  99         read_lock(&queue_handler_lock);
 100         if (!queue_handler[pf]) {
 101                 read_unlock(&queue_handler_lock);
 102                 kfree_skb(skb);
 103                 return 1;
 104         }
 105
 106         afinfo = nf_get_afinfo(pf);
 107         if (!afinfo) {
 108                 read_unlock(&queue_handler_lock);
 109                 kfree_skb(skb);
 110                 return 1;
 111         }
 112
 113         info = kmalloc(sizeof(*info) + afinfo->route_key_size, GFP_ATOMIC);
 114         if (!info) {
 115                 if (net_ratelimit())
 116                         printk(KERN_ERR "OOM queueing packet %p\n",
 117                                skb);
 118                 read_unlock(&queue_handler_lock);
 119                 kfree_skb(skb);
 120                 return 1;
 121         }
 122
 123         *info = (struct nf_info) {
 124                 (struct nf_hook_ops *)elem, pf, hook, indev, outdev, okfn };
 125
 126         /* If it's going away, ignore hook. */
 127         if (!try_module_get(info->elem->owner)) {
 128                 read_unlock(&queue_handler_lock);
 129                 kfree(info);
 130                 return 0;
 131         }
 132
 133         /* Bump dev refs so they don't vanish while packet is out */
 134         if (indev) dev_hold(indev);
 135         if (outdev) dev_hold(outdev);
 136
 137 #ifdef CONFIG_BRIDGE_NETFILTER
 138         if (skb->nf_bridge) {
 139                 physindev = skb->nf_bridge->physindev;
 140                 if (physindev) dev_hold(physindev);
 141                 physoutdev = skb->nf_bridge->physoutdev;
 142                 if (physoutdev) dev_hold(physoutdev);
 143         }
 144 #endif
 145         afinfo->saveroute(skb, info);
 146         status = queue_handler[pf]->outfn(skb, info, queuenum,
 147                                           queue_handler[pf]->data);
 148
 149         read_unlock(&queue_handler_lock);
 150
 151         if (status < 0) {
 152                 /* James M doesn't say fuck enough. */
 153                 if (indev) dev_put(indev);
 154                 if (outdev) dev_put(outdev);
 155 #ifdef CONFIG_BRIDGE_NETFILTER
 156                 if (physindev) dev_put(physindev);
 157                 if (physoutdev) dev_put(physoutdev);
 158 #endif
 159                 module_put(info->elem->owner);
 160                 kfree(info);
 161                 kfree_skb(skb);
 162
 163                 return 1;
 164         }
 165
 166         return 1;
 167 }
 168
 169 int nf_queue(struct sk_buff *skb,
 170              struct list_head *elem,
 171              int pf, unsigned int hook,
 172              struct net_device *indev,
 173              struct net_device *outdev,
 174              int (*okfn)(struct sk_buff *),
 175              unsigned int queuenum)
 176 {
 177         struct sk_buff *segs;
 178
 179         if (!skb_is_gso(skb))
 180                 return __nf_queue(skb, elem, pf, hook, indev, outdev, okfn,
 181                                   queuenum);
 182
 183         switch (pf) {
 184         case AF_INET:
 185                 skb->protocol = htons(ETH_P_IP);
 186                 break;
 187         case AF_INET6:
 188                 skb->protocol = htons(ETH_P_IPV6);
 189                 break;
 190         }
 191
 192         segs = skb_gso_segment(skb, 0);
 193         kfree_skb(skb);
 194         if (unlikely(IS_ERR(segs)))
 195                 return 1;
 196
 197         do {
 198                 struct sk_buff *nskb = segs->next;
 199
 200                 segs->next = NULL;
 201                 if (!__nf_queue(segs, elem, pf, hook, indev, outdev, okfn,
 202                                 queuenum))
 203                         kfree_skb(segs);
 204                 segs = nskb;
 205         } while (segs);
 206         return 1;
 207 }
 208
 209 void nf_reinject(struct sk_buff *skb, struct nf_info *info,
 210                  unsigned int verdict)
 211 {
 212         struct list_head *elem = &info->elem->list;
 213         struct list_head *i;
 214         struct nf_afinfo *afinfo;
 215
 216         rcu_read_lock();
 217
 218         /* Release those devices we held, or Alexey will kill me. */
 219         if (info->indev) dev_put(info->indev);
 220         if (info->outdev) dev_put(info->outdev);
 221 #ifdef CONFIG_BRIDGE_NETFILTER
 222         if (skb->nf_bridge) {
 223                 if (skb->nf_bridge->physindev)
 224                         dev_put(skb->nf_bridge->physindev);
 225                 if (skb->nf_bridge->physoutdev)
 226                         dev_put(skb->nf_bridge->physoutdev);
 227         }
 228 #endif
 229
 230         /* Drop reference to owner of hook which queued us. */
 231         module_put(info->elem->owner);
 232
 233         list_for_each_rcu(i, &nf_hooks[info->pf][info->hook]) {
 234                 if (i == elem)
 235                         break;
 236         }
 237
 238         if (i == &nf_hooks[info->pf][info->hook]) {
 239                 /* The module which sent it to userspace is gone. */
 240                 NFDEBUG("%s: module disappeared, dropping packet.\n",
 241                         __FUNCTION__);
 242                 verdict = NF_DROP;
 243         }
 244
 245         /* Continue traversal iff userspace said ok... */
 246         if (verdict == NF_REPEAT) {
 247                 elem = elem->prev;
 248                 verdict = NF_ACCEPT;
 249         }
 250
 251         if (verdict == NF_ACCEPT) {
 252                 afinfo = nf_get_afinfo(info->pf);
 253                 if (!afinfo || afinfo->reroute(&skb, info) < 0)
 254                         verdict = NF_DROP;
 255         }
 256
 257         if (verdict == NF_ACCEPT) {
 258         next_hook:
 259                 verdict = nf_iterate(&nf_hooks[info->pf][info->hook],
 260                                      &skb, info->hook,
 261                                      info->indev, info->outdev, &elem,
 262                                      info->okfn, INT_MIN);
 263         }
 264
 265         switch (verdict & NF_VERDICT_MASK) {
 266         case NF_ACCEPT:
 267         case NF_STOP:
 268                 info->okfn(skb);
 269         case NF_STOLEN:
 270                 break;
 271         case NF_QUEUE:
 272                 if (!__nf_queue(skb, elem, info->pf, info->hook,
 273                                 info->indev, info->outdev, info->okfn,
 274                                 verdict >> NF_VERDICT_BITS))
 275                         goto next_hook;
 276                 break;
 277         default:
 278                 kfree_skb(skb);
 279         }
 280         rcu_read_unlock();
 281         kfree(info);
 282         return;
 283 }
 284 EXPORT_SYMBOL(nf_reinject);
 285
 286 #ifdef CONFIG_PROC_FS
 287 static void *seq_start(struct seq_file *seq, loff_t *pos)
 288 {
 289         if (*pos >= NPROTO)
 290                 return NULL;
 291
 292         return pos;
 293 }
 294
 295 static void *seq_next(struct seq_file *s, void *v, loff_t *pos)
 296 {
 297         (*pos)++;
 298
 299         if (*pos >= NPROTO)
 300                 return NULL;
 301
 302         return pos;
 303 }
 304
 305 static void seq_stop(struct seq_file *s, void *v)
 306 {
 307
 308 }
 309
 310 static int seq_show(struct seq_file *s, void *v)
 311 {
 312         int ret;
 313         loff_t *pos = v;
 314         struct nf_queue_handler *qh;
 315
 316         read_lock_bh(&queue_handler_lock);
 317         qh = queue_handler[*pos];
 318         if (!qh)
 319                 ret = seq_printf(s, "%2lld NONE\n", *pos);
 320         else
 321                 ret = seq_printf(s, "%2lld %s\n", *pos, qh->name);
 322         read_unlock_bh(&queue_handler_lock);
 323
 324         return ret;
 325 }
 326
 327 static struct seq_operations nfqueue_seq_ops = {
 328         .start  = seq_start,
 329         .next   = seq_next,
 330         .stop   = seq_stop,
 331         .show   = seq_show,
 332 };
 333
 334 static int nfqueue_open(struct inode *inode, struct file *file)
 335 {
 336         return seq_open(file, &nfqueue_seq_ops);
 337 }
 338
 339 static const struct file_operations nfqueue_file_ops = {
 340         .owner   = THIS_MODULE,
 341         .open    = nfqueue_open,
 342         .read    = seq_read,
 343         .llseek  = seq_lseek,
 344         .release = seq_release,
 345 };
 346 #endif /* PROC_FS */
 347
 348
 349 int __init netfilter_queue_init(void)
 350 {
 351 #ifdef CONFIG_PROC_FS
 352         struct proc_dir_entry *pde;
 353
 354         pde = create_proc_entry("nf_queue", S_IRUGO, proc_net_netfilter);
 355         if (!pde)
 356                 return -1;
 357         pde->proc_fops = &nfqueue_file_ops;
 358 #endif
 359         return 0;
 360 }
 361