blob: a364f8e5e698f8b2b2dd450faa727eaa2faddeee [file] [log] [blame]
Thomas Gleixnerd2912cb2019-06-04 10:11:33 +02001// SPDX-License-Identifier: GPL-2.0-only
Harald Welte7af4cc32005-08-09 19:44:15 -07002/*
3 * This is a module which is used for queueing packets and communicating with
Jesper Dangaard Brouer67137f32009-06-08 03:11:33 +00004 * userspace via nfnetlink.
Harald Welte7af4cc32005-08-09 19:44:15 -07005 *
6 * (C) 2005 by Harald Welte <laforge@netfilter.org>
Patrick McHardy4ad9d4f2007-12-05 01:31:17 -08007 * (C) 2007 by Patrick McHardy <kaber@trash.net>
Harald Welte7af4cc32005-08-09 19:44:15 -07008 *
9 * Based on the old ipv4-only ip_queue.c:
10 * (C) 2000-2002 James Morris <jmorris@intercode.com.au>
11 * (C) 2003-2005 Netfilter Core Team <coreteam@netfilter.org>
Harald Welte7af4cc32005-08-09 19:44:15 -070012 */
Arushi Singhal5191d702018-03-12 18:36:29 +053013
14#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
15
Harald Welte7af4cc32005-08-09 19:44:15 -070016#include <linux/module.h>
17#include <linux/skbuff.h>
18#include <linux/init.h>
19#include <linux/spinlock.h>
Tejun Heo5a0e3ad2010-03-24 17:04:11 +090020#include <linux/slab.h>
Harald Welte7af4cc32005-08-09 19:44:15 -070021#include <linux/notifier.h>
22#include <linux/netdevice.h>
23#include <linux/netfilter.h>
Harald Welte838ab632005-08-09 19:50:45 -070024#include <linux/proc_fs.h>
Harald Welte7af4cc32005-08-09 19:44:15 -070025#include <linux/netfilter_ipv4.h>
26#include <linux/netfilter_ipv6.h>
Florian Westphalc737b7c2015-04-02 14:31:41 +020027#include <linux/netfilter_bridge.h>
Harald Welte7af4cc32005-08-09 19:44:15 -070028#include <linux/netfilter/nfnetlink.h>
29#include <linux/netfilter/nfnetlink_queue.h>
Pablo Neira Ayusob7bd1802015-09-30 22:53:44 +010030#include <linux/netfilter/nf_conntrack_common.h>
Harald Welte7af4cc32005-08-09 19:44:15 -070031#include <linux/list.h>
32#include <net/sock.h>
David S. Miller83111e72014-01-06 13:36:06 -050033#include <net/tcp_states.h>
Patrick McHardyc01cd422007-12-05 01:24:48 -080034#include <net/netfilter/nf_queue.h>
Gao fenge8179612013-03-24 23:50:47 +000035#include <net/netns/generic.h>
Harald Welte7af4cc32005-08-09 19:44:15 -070036
Arun Sharma600634972011-07-26 16:09:06 -070037#include <linux/atomic.h>
Harald Welte7af4cc32005-08-09 19:44:15 -070038
Pablo Neira Ayuso1109a902014-10-01 11:19:17 +020039#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
Harald Weltefbcd9232005-08-09 20:22:10 -070040#include "../bridge/br_private.h"
41#endif
42
Florian Westphal5da773a2017-07-26 00:02:34 +020043#if IS_ENABLED(CONFIG_NF_CONNTRACK)
44#include <net/netfilter/nf_conntrack.h>
45#endif
46
Harald Welte7af4cc32005-08-09 19:44:15 -070047#define NFQNL_QMAX_DEFAULT 1024
48
Florian Westphal9cefbbc2013-06-04 22:22:15 +000049/* We're using struct nlattr which has 16bit nla_len. Note that nla_len
50 * includes the header length. Thus, the maximum packet length that we
51 * support is 65531 bytes. We send truncated packets if the specified length
52 * is larger than that. Userspace can check for presence of NFQA_CAP_LEN
53 * attribute to detect truncation.
54 */
55#define NFQNL_MAX_COPY_RANGE (0xffff - NLA_HDRLEN)
56
Harald Welte7af4cc32005-08-09 19:44:15 -070057struct nfqnl_instance {
58 struct hlist_node hlist; /* global list of queues */
Patrick McHardy9872bec2007-12-05 01:28:50 -080059 struct rcu_head rcu;
Harald Welte7af4cc32005-08-09 19:44:15 -070060
Richard Weinbergercc6bc442015-04-13 00:52:37 +020061 u32 peer_portid;
Harald Welte7af4cc32005-08-09 19:44:15 -070062 unsigned int queue_maxlen;
63 unsigned int copy_range;
Harald Welte7af4cc32005-08-09 19:44:15 -070064 unsigned int queue_dropped;
65 unsigned int queue_user_dropped;
66
Harald Welte7af4cc32005-08-09 19:44:15 -070067
68 u_int16_t queue_num; /* number of this queue */
69 u_int8_t copy_mode;
Krishna Kumarfdb694a02012-05-24 03:56:44 +000070 u_int32_t flags; /* Set using NFQA_CFG_FLAGS */
Eric Dumazetc463ac92010-06-09 18:07:06 +020071/*
72 * Following fields are dirtied for each queued packet,
73 * keep them in same cache line if possible.
74 */
Florian Westphal886bc502016-10-31 00:35:07 +010075 spinlock_t lock ____cacheline_aligned_in_smp;
Eric Dumazetc463ac92010-06-09 18:07:06 +020076 unsigned int queue_total;
Eric Dumazet5863702a2011-07-19 11:44:17 +020077 unsigned int id_sequence; /* 'sequence' of pkt ids */
Harald Welte7af4cc32005-08-09 19:44:15 -070078 struct list_head queue_list; /* packets in queue */
79};
80
Patrick McHardy02f014d2007-12-05 01:26:33 -080081typedef int (*nfqnl_cmpfn)(struct nf_queue_entry *, unsigned long);
Harald Welte7af4cc32005-08-09 19:44:15 -070082
Alexey Dobriyanc7d03a02016-11-17 04:58:21 +030083static unsigned int nfnl_queue_net_id __read_mostly;
Harald Welte7af4cc32005-08-09 19:44:15 -070084
Harald Welte7af4cc32005-08-09 19:44:15 -070085#define INSTANCE_BUCKETS 16
Gao fenge8179612013-03-24 23:50:47 +000086struct nfnl_queue_net {
87 spinlock_t instances_lock;
88 struct hlist_head instance_table[INSTANCE_BUCKETS];
89};
90
91static struct nfnl_queue_net *nfnl_queue_pernet(struct net *net)
92{
93 return net_generic(net, nfnl_queue_net_id);
94}
Harald Welte7af4cc32005-08-09 19:44:15 -070095
96static inline u_int8_t instance_hashfn(u_int16_t queue_num)
97{
Pablo Neira Ayuso1cdb0902013-03-14 06:03:17 +000098 return ((queue_num >> 8) ^ queue_num) % INSTANCE_BUCKETS;
Harald Welte7af4cc32005-08-09 19:44:15 -070099}
100
101static struct nfqnl_instance *
Gao fenge8179612013-03-24 23:50:47 +0000102instance_lookup(struct nfnl_queue_net *q, u_int16_t queue_num)
Harald Welte7af4cc32005-08-09 19:44:15 -0700103{
104 struct hlist_head *head;
Harald Welte7af4cc32005-08-09 19:44:15 -0700105 struct nfqnl_instance *inst;
106
Gao fenge8179612013-03-24 23:50:47 +0000107 head = &q->instance_table[instance_hashfn(queue_num)];
Sasha Levinb67bfe02013-02-27 17:06:00 -0800108 hlist_for_each_entry_rcu(inst, head, hlist) {
Harald Welte7af4cc32005-08-09 19:44:15 -0700109 if (inst->queue_num == queue_num)
110 return inst;
111 }
112 return NULL;
113}
114
115static struct nfqnl_instance *
Richard Weinbergercc6bc442015-04-13 00:52:37 +0200116instance_create(struct nfnl_queue_net *q, u_int16_t queue_num, u32 portid)
Harald Welte7af4cc32005-08-09 19:44:15 -0700117{
Patrick McHardybaab2ce2007-12-17 22:41:21 -0800118 struct nfqnl_instance *inst;
Patrick McHardy9872bec2007-12-05 01:28:50 -0800119 unsigned int h;
Patrick McHardybaab2ce2007-12-17 22:41:21 -0800120 int err;
Harald Welte7af4cc32005-08-09 19:44:15 -0700121
Gao fenge8179612013-03-24 23:50:47 +0000122 spin_lock(&q->instances_lock);
123 if (instance_lookup(q, queue_num)) {
Patrick McHardybaab2ce2007-12-17 22:41:21 -0800124 err = -EEXIST;
Harald Welte7af4cc32005-08-09 19:44:15 -0700125 goto out_unlock;
Patrick McHardybaab2ce2007-12-17 22:41:21 -0800126 }
Harald Welte7af4cc32005-08-09 19:44:15 -0700127
Harald Welte10dfdc62005-11-03 19:20:07 +0100128 inst = kzalloc(sizeof(*inst), GFP_ATOMIC);
Patrick McHardybaab2ce2007-12-17 22:41:21 -0800129 if (!inst) {
130 err = -ENOMEM;
Harald Welte7af4cc32005-08-09 19:44:15 -0700131 goto out_unlock;
Patrick McHardybaab2ce2007-12-17 22:41:21 -0800132 }
Harald Welte7af4cc32005-08-09 19:44:15 -0700133
Harald Welte7af4cc32005-08-09 19:44:15 -0700134 inst->queue_num = queue_num;
Eric W. Biederman15e47302012-09-07 20:12:54 +0000135 inst->peer_portid = portid;
Harald Welte7af4cc32005-08-09 19:44:15 -0700136 inst->queue_maxlen = NFQNL_QMAX_DEFAULT;
Florian Westphal9cefbbc2013-06-04 22:22:15 +0000137 inst->copy_range = NFQNL_MAX_COPY_RANGE;
Harald Welte7af4cc32005-08-09 19:44:15 -0700138 inst->copy_mode = NFQNL_COPY_NONE;
YOSHIFUJI Hideaki181a46a2006-01-04 13:56:54 -0800139 spin_lock_init(&inst->lock);
Harald Welte7af4cc32005-08-09 19:44:15 -0700140 INIT_LIST_HEAD(&inst->queue_list);
141
Patrick McHardybaab2ce2007-12-17 22:41:21 -0800142 if (!try_module_get(THIS_MODULE)) {
143 err = -EAGAIN;
Harald Welte7af4cc32005-08-09 19:44:15 -0700144 goto out_free;
Patrick McHardybaab2ce2007-12-17 22:41:21 -0800145 }
Harald Welte7af4cc32005-08-09 19:44:15 -0700146
Patrick McHardy9872bec2007-12-05 01:28:50 -0800147 h = instance_hashfn(queue_num);
Gao fenge8179612013-03-24 23:50:47 +0000148 hlist_add_head_rcu(&inst->hlist, &q->instance_table[h]);
Harald Welte7af4cc32005-08-09 19:44:15 -0700149
Gao fenge8179612013-03-24 23:50:47 +0000150 spin_unlock(&q->instances_lock);
Harald Welte7af4cc32005-08-09 19:44:15 -0700151
Harald Welte7af4cc32005-08-09 19:44:15 -0700152 return inst;
153
154out_free:
155 kfree(inst);
156out_unlock:
Gao fenge8179612013-03-24 23:50:47 +0000157 spin_unlock(&q->instances_lock);
Patrick McHardybaab2ce2007-12-17 22:41:21 -0800158 return ERR_PTR(err);
Harald Welte7af4cc32005-08-09 19:44:15 -0700159}
160
Patrick McHardyb43d8d82007-12-05 01:25:30 -0800161static void nfqnl_flush(struct nfqnl_instance *queue, nfqnl_cmpfn cmpfn,
162 unsigned long data);
Harald Welte7af4cc32005-08-09 19:44:15 -0700163
164static void
Patrick McHardy9872bec2007-12-05 01:28:50 -0800165instance_destroy_rcu(struct rcu_head *head)
Harald Welte7af4cc32005-08-09 19:44:15 -0700166{
Patrick McHardy9872bec2007-12-05 01:28:50 -0800167 struct nfqnl_instance *inst = container_of(head, struct nfqnl_instance,
168 rcu);
Harald Welte7af4cc32005-08-09 19:44:15 -0700169
Patrick McHardyb43d8d82007-12-05 01:25:30 -0800170 nfqnl_flush(inst, NULL, 0);
Patrick McHardy9872bec2007-12-05 01:28:50 -0800171 kfree(inst);
Harald Welte7af4cc32005-08-09 19:44:15 -0700172 module_put(THIS_MODULE);
173}
174
Patrick McHardy9872bec2007-12-05 01:28:50 -0800175static void
Harald Welte7af4cc32005-08-09 19:44:15 -0700176__instance_destroy(struct nfqnl_instance *inst)
177{
Patrick McHardy9872bec2007-12-05 01:28:50 -0800178 hlist_del_rcu(&inst->hlist);
179 call_rcu(&inst->rcu, instance_destroy_rcu);
Harald Welte7af4cc32005-08-09 19:44:15 -0700180}
181
Patrick McHardy9872bec2007-12-05 01:28:50 -0800182static void
Gao fenge8179612013-03-24 23:50:47 +0000183instance_destroy(struct nfnl_queue_net *q, struct nfqnl_instance *inst)
Harald Welte7af4cc32005-08-09 19:44:15 -0700184{
Gao fenge8179612013-03-24 23:50:47 +0000185 spin_lock(&q->instances_lock);
Patrick McHardy9872bec2007-12-05 01:28:50 -0800186 __instance_destroy(inst);
Gao fenge8179612013-03-24 23:50:47 +0000187 spin_unlock(&q->instances_lock);
Harald Welte7af4cc32005-08-09 19:44:15 -0700188}
189
Harald Welte7af4cc32005-08-09 19:44:15 -0700190static inline void
Patrick McHardy02f014d2007-12-05 01:26:33 -0800191__enqueue_entry(struct nfqnl_instance *queue, struct nf_queue_entry *entry)
Harald Welte7af4cc32005-08-09 19:44:15 -0700192{
Patrick McHardy0ac41e82007-12-05 01:25:03 -0800193 list_add_tail(&entry->list, &queue->queue_list);
Harald Welte7af4cc32005-08-09 19:44:15 -0700194 queue->queue_total++;
195}
196
Florian Westphal97d32cf2011-07-19 11:46:33 +0200197static void
198__dequeue_entry(struct nfqnl_instance *queue, struct nf_queue_entry *entry)
199{
200 list_del(&entry->list);
201 queue->queue_total--;
202}
203
Patrick McHardy02f014d2007-12-05 01:26:33 -0800204static struct nf_queue_entry *
Patrick McHardyb43d8d82007-12-05 01:25:30 -0800205find_dequeue_entry(struct nfqnl_instance *queue, unsigned int id)
Harald Welte7af4cc32005-08-09 19:44:15 -0700206{
Patrick McHardy02f014d2007-12-05 01:26:33 -0800207 struct nf_queue_entry *entry = NULL, *i;
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800208
Harald Welte7af4cc32005-08-09 19:44:15 -0700209 spin_lock_bh(&queue->lock);
Patrick McHardyb43d8d82007-12-05 01:25:30 -0800210
211 list_for_each_entry(i, &queue->queue_list, list) {
212 if (i->id == id) {
213 entry = i;
214 break;
215 }
216 }
217
Florian Westphal97d32cf2011-07-19 11:46:33 +0200218 if (entry)
219 __dequeue_entry(queue, entry);
Patrick McHardyb43d8d82007-12-05 01:25:30 -0800220
Harald Welte7af4cc32005-08-09 19:44:15 -0700221 spin_unlock_bh(&queue->lock);
222
223 return entry;
224}
225
Pablo Neira Ayuso368982c2018-05-23 09:17:24 +0200226static void nfqnl_reinject(struct nf_queue_entry *entry, unsigned int verdict)
227{
Florian Westphal285c8a72022-01-07 05:03:24 +0100228 const struct nf_ct_hook *ct_hook;
Pablo Neira Ayuso368982c2018-05-23 09:17:24 +0200229 int err;
230
231 if (verdict == NF_ACCEPT ||
Michal 'vorner' Vanerad18d7b2018-09-04 13:25:44 +0200232 verdict == NF_REPEAT ||
Pablo Neira Ayuso368982c2018-05-23 09:17:24 +0200233 verdict == NF_STOP) {
234 rcu_read_lock();
235 ct_hook = rcu_dereference(nf_ct_hook);
236 if (ct_hook) {
237 err = ct_hook->update(entry->state.net, entry->skb);
238 if (err < 0)
239 verdict = NF_DROP;
240 }
241 rcu_read_unlock();
242 }
243 nf_reinject(entry, verdict);
244}
245
Harald Welte7af4cc32005-08-09 19:44:15 -0700246static void
Patrick McHardyb43d8d82007-12-05 01:25:30 -0800247nfqnl_flush(struct nfqnl_instance *queue, nfqnl_cmpfn cmpfn, unsigned long data)
Harald Welte7af4cc32005-08-09 19:44:15 -0700248{
Patrick McHardy02f014d2007-12-05 01:26:33 -0800249 struct nf_queue_entry *entry, *next;
Patrick McHardyb43d8d82007-12-05 01:25:30 -0800250
Harald Welte7af4cc32005-08-09 19:44:15 -0700251 spin_lock_bh(&queue->lock);
Patrick McHardyb43d8d82007-12-05 01:25:30 -0800252 list_for_each_entry_safe(entry, next, &queue->queue_list, list) {
253 if (!cmpfn || cmpfn(entry, data)) {
254 list_del(&entry->list);
255 queue->queue_total--;
Pablo Neira Ayuso368982c2018-05-23 09:17:24 +0200256 nfqnl_reinject(entry, NF_DROP);
Patrick McHardyb43d8d82007-12-05 01:25:30 -0800257 }
258 }
Harald Welte7af4cc32005-08-09 19:44:15 -0700259 spin_unlock_bh(&queue->lock);
260}
261
Florian Westphal496e4ae2013-06-29 14:15:47 +0200262static int
263nfqnl_put_packet_info(struct sk_buff *nlskb, struct sk_buff *packet,
264 bool csum_verify)
Florian Westphal72371902013-04-19 04:58:26 +0000265{
266 __u32 flags = 0;
267
268 if (packet->ip_summed == CHECKSUM_PARTIAL)
269 flags = NFQA_SKB_CSUMNOTREADY;
Florian Westphal496e4ae2013-06-29 14:15:47 +0200270 else if (csum_verify)
271 flags = NFQA_SKB_CSUM_NOTVERIFIED;
272
Florian Westphal72371902013-04-19 04:58:26 +0000273 if (skb_is_gso(packet))
274 flags |= NFQA_SKB_GSO;
275
276 return flags ? nla_put_be32(nlskb, NFQA_SKB_INFO, htonl(flags)) : 0;
277}
278
Valentina Giusti08c0cad2013-12-20 17:28:53 +0100279static int nfqnl_put_sk_uidgid(struct sk_buff *skb, struct sock *sk)
280{
281 const struct cred *cred;
282
Eric Dumazeta8399232015-03-16 21:06:15 -0700283 if (!sk_fullsock(sk))
Valentina Giusti08c0cad2013-12-20 17:28:53 +0100284 return 0;
285
286 read_lock_bh(&sk->sk_callback_lock);
287 if (sk->sk_socket && sk->sk_socket->file) {
288 cred = sk->sk_socket->file->f_cred;
289 if (nla_put_be32(skb, NFQA_UID,
290 htonl(from_kuid_munged(&init_user_ns, cred->fsuid))))
291 goto nla_put_failure;
292 if (nla_put_be32(skb, NFQA_GID,
293 htonl(from_kgid_munged(&init_user_ns, cred->fsgid))))
294 goto nla_put_failure;
295 }
296 read_unlock_bh(&sk->sk_callback_lock);
297 return 0;
298
299nla_put_failure:
300 read_unlock_bh(&sk->sk_callback_lock);
301 return -1;
302}
303
Roman Kubiakef493bd2015-06-12 12:32:57 +0200304static u32 nfqnl_get_sk_secctx(struct sk_buff *skb, char **secdata)
305{
306 u32 seclen = 0;
307#if IS_ENABLED(CONFIG_NETWORK_SECMARK)
308 if (!skb || !sk_fullsock(skb->sk))
309 return 0;
310
311 read_lock_bh(&skb->sk->sk_callback_lock);
312
313 if (skb->secmark)
314 security_secid_to_secctx(skb->secmark, secdata, &seclen);
315
316 read_unlock_bh(&skb->sk->sk_callback_lock);
317#endif
318 return seclen;
319}
320
Stephane Bryant15824ab2016-03-26 08:42:11 +0100321static u32 nfqnl_get_bridge_size(struct nf_queue_entry *entry)
322{
323 struct sk_buff *entskb = entry->skb;
324 u32 nlalen = 0;
325
326 if (entry->state.pf != PF_BRIDGE || !skb_mac_header_was_set(entskb))
327 return 0;
328
329 if (skb_vlan_tag_present(entskb))
330 nlalen += nla_total_size(nla_total_size(sizeof(__be16)) +
331 nla_total_size(sizeof(__be16)));
332
333 if (entskb->network_header > entskb->mac_header)
334 nlalen += nla_total_size((entskb->network_header -
335 entskb->mac_header));
336
337 return nlalen;
338}
339
340static int nfqnl_put_bridge(struct nf_queue_entry *entry, struct sk_buff *skb)
341{
342 struct sk_buff *entskb = entry->skb;
343
344 if (entry->state.pf != PF_BRIDGE || !skb_mac_header_was_set(entskb))
345 return 0;
346
347 if (skb_vlan_tag_present(entskb)) {
348 struct nlattr *nest;
349
Michal Kubecekae0be8d2019-04-26 11:13:06 +0200350 nest = nla_nest_start(skb, NFQA_VLAN);
Stephane Bryant15824ab2016-03-26 08:42:11 +0100351 if (!nest)
352 goto nla_put_failure;
353
354 if (nla_put_be16(skb, NFQA_VLAN_TCI, htons(entskb->vlan_tci)) ||
355 nla_put_be16(skb, NFQA_VLAN_PROTO, entskb->vlan_proto))
356 goto nla_put_failure;
357
358 nla_nest_end(skb, nest);
359 }
360
361 if (entskb->mac_header < entskb->network_header) {
362 int len = (int)(entskb->network_header - entskb->mac_header);
363
364 if (nla_put(skb, NFQA_L2HDR, len, skb_mac_header(entskb)))
365 goto nla_put_failure;
366 }
367
368 return 0;
369
370nla_put_failure:
371 return -1;
372}
373
Harald Welte7af4cc32005-08-09 19:44:15 -0700374static struct sk_buff *
Gao feng74332682013-09-23 19:20:55 +0800375nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
Eric Dumazet5863702a2011-07-19 11:44:17 +0200376 struct nf_queue_entry *entry,
377 __be32 **packet_id_ptr)
Harald Welte7af4cc32005-08-09 19:44:15 -0700378{
Harald Welte7af4cc32005-08-09 19:44:15 -0700379 size_t size;
Florian Westphalc5b0db32016-02-18 15:03:28 +0100380 size_t data_len = 0, cap_len = 0;
Thomas Grafaf2806f2013-12-13 15:22:17 +0100381 unsigned int hlen = 0;
Harald Welte7af4cc32005-08-09 19:44:15 -0700382 struct sk_buff *skb;
Eric Dumazet5863702a2011-07-19 11:44:17 +0200383 struct nlattr *nla;
384 struct nfqnl_msg_packet_hdr *pmsg;
Harald Welte7af4cc32005-08-09 19:44:15 -0700385 struct nlmsghdr *nlh;
Jesper Juhl3e4ead42006-01-05 12:15:58 -0800386 struct sk_buff *entskb = entry->skb;
387 struct net_device *indev;
388 struct net_device *outdev;
Pablo Neira Ayuso9cb01762012-06-07 12:13:39 +0200389 struct nf_conn *ct = NULL;
Florian Westphalb43c2792021-11-26 13:04:03 +0100390 enum ip_conntrack_info ctinfo = 0;
Florian Westphal285c8a72022-01-07 05:03:24 +0100391 const struct nfnl_ct_hook *nfnl_ct;
Florian Westphal496e4ae2013-06-29 14:15:47 +0200392 bool csum_verify;
Roman Kubiakef493bd2015-06-12 12:32:57 +0200393 char *secdata = NULL;
394 u32 seclen = 0;
Martin KaFai Lau80fcec62022-03-02 11:56:15 -0800395 ktime_t tstamp;
Harald Welte7af4cc32005-08-09 19:44:15 -0700396
yangxingwu7e59b3fe2019-07-16 10:13:01 +0800397 size = nlmsg_total_size(sizeof(struct nfgenmsg))
Patrick McHardydf6fb862007-09-28 14:37:03 -0700398 + nla_total_size(sizeof(struct nfqnl_msg_packet_hdr))
399 + nla_total_size(sizeof(u_int32_t)) /* ifindex */
400 + nla_total_size(sizeof(u_int32_t)) /* ifindex */
Pablo Neira Ayuso1109a902014-10-01 11:19:17 +0200401#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
Patrick McHardydf6fb862007-09-28 14:37:03 -0700402 + nla_total_size(sizeof(u_int32_t)) /* ifindex */
403 + nla_total_size(sizeof(u_int32_t)) /* ifindex */
Harald Weltefbcd9232005-08-09 20:22:10 -0700404#endif
Patrick McHardydf6fb862007-09-28 14:37:03 -0700405 + nla_total_size(sizeof(u_int32_t)) /* mark */
Nicolas Dichtel8b541362022-01-17 21:56:13 +0100406 + nla_total_size(sizeof(u_int32_t)) /* priority */
Patrick McHardydf6fb862007-09-28 14:37:03 -0700407 + nla_total_size(sizeof(struct nfqnl_msg_packet_hw))
Florian Westphal72371902013-04-19 04:58:26 +0000408 + nla_total_size(sizeof(u_int32_t)) /* skbinfo */
Eric Dumazetae08ce02013-03-17 17:15:55 +0000409 + nla_total_size(sizeof(u_int32_t)); /* cap_len */
410
Martin KaFai Lau80fcec62022-03-02 11:56:15 -0800411 tstamp = skb_tstamp_cond(entskb, false);
412 if (tstamp)
Eric Dumazetae08ce02013-03-17 17:15:55 +0000413 size += nla_total_size(sizeof(struct nfqnl_msg_packet_timestamp));
Harald Welte7af4cc32005-08-09 19:44:15 -0700414
Stephane Bryant15824ab2016-03-26 08:42:11 +0100415 size += nfqnl_get_bridge_size(entry);
416
David S. Miller1d1de892015-04-03 16:31:01 -0400417 if (entry->state.hook <= NF_INET_FORWARD ||
418 (entry->state.hook == NF_INET_POST_ROUTING && entskb->sk == NULL))
Florian Westphal496e4ae2013-06-29 14:15:47 +0200419 csum_verify = !skb_csum_unnecessary(entskb);
420 else
421 csum_verify = false;
422
David S. Miller1d1de892015-04-03 16:31:01 -0400423 outdev = entry->state.out;
Jesper Juhl3e4ead42006-01-05 12:15:58 -0800424
Mark Rutland14cd5d42017-10-23 14:07:17 -0700425 switch ((enum nfqnl_config_mode)READ_ONCE(queue->copy_mode)) {
Harald Welte7af4cc32005-08-09 19:44:15 -0700426 case NFQNL_COPY_META:
427 case NFQNL_COPY_NONE:
Harald Welte7af4cc32005-08-09 19:44:15 -0700428 break;
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800429
Harald Welte7af4cc32005-08-09 19:44:15 -0700430 case NFQNL_COPY_PACKET:
Florian Westphal00bd1cc2013-04-19 04:58:27 +0000431 if (!(queue->flags & NFQA_CFG_F_GSO) &&
432 entskb->ip_summed == CHECKSUM_PARTIAL &&
Eric Dumazetc463ac92010-06-09 18:07:06 +0200433 skb_checksum_help(entskb))
Patrick McHardye7dfb092005-09-06 15:10:00 -0700434 return NULL;
Eric Dumazetc463ac92010-06-09 18:07:06 +0200435
Mark Rutland14cd5d42017-10-23 14:07:17 -0700436 data_len = READ_ONCE(queue->copy_range);
Florian Westphal9cefbbc2013-06-04 22:22:15 +0000437 if (data_len > entskb->len)
Jesper Juhl3e4ead42006-01-05 12:15:58 -0800438 data_len = entskb->len;
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800439
Thomas Grafaf2806f2013-12-13 15:22:17 +0100440 hlen = skb_zerocopy_headlen(entskb);
441 hlen = min_t(unsigned int, hlen, data_len);
Eric Dumazetae08ce02013-03-17 17:15:55 +0000442 size += sizeof(struct nlattr) + hlen;
Pablo Neira Ayuso6ee584b2012-09-24 14:52:12 +0200443 cap_len = entskb->len;
Harald Welte7af4cc32005-08-09 19:44:15 -0700444 break;
Harald Welte7af4cc32005-08-09 19:44:15 -0700445 }
446
Arnd Bergmann8e662162015-11-19 13:49:59 +0100447 nfnl_ct = rcu_dereference(nfnl_ct_hook);
448
Florian Westphal83ace772021-01-20 16:30:03 +0100449#if IS_ENABLED(CONFIG_NF_CONNTRACK)
Pablo Neira Ayusob7bd1802015-09-30 22:53:44 +0100450 if (queue->flags & NFQA_CFG_F_CONNTRACK) {
Ken-ichirou MATSUZAWAa4b47662015-10-05 11:47:13 +0900451 if (nfnl_ct != NULL) {
Florian Westphal83ace772021-01-20 16:30:03 +0100452 ct = nf_ct_get(entskb, &ctinfo);
Pablo Neira Ayusob7bd1802015-09-30 22:53:44 +0100453 if (ct != NULL)
Ken-ichirou MATSUZAWAa4b47662015-10-05 11:47:13 +0900454 size += nfnl_ct->build_size(ct);
Pablo Neira Ayusob7bd1802015-09-30 22:53:44 +0100455 }
456 }
Florian Westphal83ace772021-01-20 16:30:03 +0100457#endif
Harald Welte7af4cc32005-08-09 19:44:15 -0700458
Valentina Giusti08c0cad2013-12-20 17:28:53 +0100459 if (queue->flags & NFQA_CFG_F_UID_GID) {
yangxingwu7e59b3fe2019-07-16 10:13:01 +0800460 size += (nla_total_size(sizeof(u_int32_t)) /* uid */
Valentina Giusti08c0cad2013-12-20 17:28:53 +0100461 + nla_total_size(sizeof(u_int32_t))); /* gid */
462 }
463
Roman Kubiakef493bd2015-06-12 12:32:57 +0200464 if ((queue->flags & NFQA_CFG_F_SECCTX) && entskb->sk) {
465 seclen = nfqnl_get_sk_secctx(entskb, &secdata);
466 if (seclen)
467 size += nla_total_size(seclen);
468 }
469
Florian Westphalc5b0db32016-02-18 15:03:28 +0100470 skb = alloc_skb(size, GFP_ATOMIC);
Zoltan Kiss36d5fe62014-03-26 22:37:45 +0000471 if (!skb) {
472 skb_tx_error(entskb);
Liping Zhang77c1c032017-03-28 22:59:25 +0800473 goto nlmsg_failure;
Zoltan Kiss36d5fe62014-03-26 22:37:45 +0000474 }
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800475
Pablo Neira Ayuso19c28b12021-03-30 16:58:37 +0200476 nlh = nfnl_msg_put(skb, 0, 0,
477 nfnl_msg_type(NFNL_SUBSYS_QUEUE, NFQNL_MSG_PACKET),
478 0, entry->state.pf, NFNETLINK_V0,
479 htons(queue->queue_num));
David S. Miller3da07c02012-06-26 21:35:27 -0700480 if (!nlh) {
Zoltan Kiss36d5fe62014-03-26 22:37:45 +0000481 skb_tx_error(entskb);
David S. Miller3da07c02012-06-26 21:35:27 -0700482 kfree_skb(skb);
Liping Zhang77c1c032017-03-28 22:59:25 +0800483 goto nlmsg_failure;
David S. Miller3da07c02012-06-26 21:35:27 -0700484 }
Harald Welte7af4cc32005-08-09 19:44:15 -0700485
Eric Dumazet5863702a2011-07-19 11:44:17 +0200486 nla = __nla_reserve(skb, NFQA_PACKET_HDR, sizeof(*pmsg));
487 pmsg = nla_data(nla);
488 pmsg->hw_protocol = entskb->protocol;
David S. Miller1d1de892015-04-03 16:31:01 -0400489 pmsg->hook = entry->state.hook;
Eric Dumazet5863702a2011-07-19 11:44:17 +0200490 *packet_id_ptr = &pmsg->packet_id;
Harald Welte7af4cc32005-08-09 19:44:15 -0700491
David S. Miller1d1de892015-04-03 16:31:01 -0400492 indev = entry->state.in;
Jesper Juhl3e4ead42006-01-05 12:15:58 -0800493 if (indev) {
Pablo Neira Ayuso1109a902014-10-01 11:19:17 +0200494#if !IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
David S. Millera4471892012-03-29 23:27:38 -0400495 if (nla_put_be32(skb, NFQA_IFINDEX_INDEV, htonl(indev->ifindex)))
496 goto nla_put_failure;
Harald Weltefbcd9232005-08-09 20:22:10 -0700497#else
David S. Miller1d1de892015-04-03 16:31:01 -0400498 if (entry->state.pf == PF_BRIDGE) {
Harald Weltefbcd9232005-08-09 20:22:10 -0700499 /* Case 1: indev is physical input device, we need to
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800500 * look for bridge group (when called from
Harald Weltefbcd9232005-08-09 20:22:10 -0700501 * netfilter_bridge) */
David S. Millera4471892012-03-29 23:27:38 -0400502 if (nla_put_be32(skb, NFQA_IFINDEX_PHYSINDEV,
503 htonl(indev->ifindex)) ||
Harald Weltefbcd9232005-08-09 20:22:10 -0700504 /* this is the bridge group "brX" */
Jiri Pirkof350a0a82010-06-15 06:50:45 +0000505 /* rcu_read_lock()ed by __nf_queue */
David S. Millera4471892012-03-29 23:27:38 -0400506 nla_put_be32(skb, NFQA_IFINDEX_INDEV,
507 htonl(br_port_get_rcu(indev)->br->dev->ifindex)))
508 goto nla_put_failure;
Harald Weltefbcd9232005-08-09 20:22:10 -0700509 } else {
Florian Westphalc737b7c2015-04-02 14:31:41 +0200510 int physinif;
511
Harald Weltefbcd9232005-08-09 20:22:10 -0700512 /* Case 2: indev is bridge group, we need to look for
513 * physical device (when called from ipv4) */
David S. Millera4471892012-03-29 23:27:38 -0400514 if (nla_put_be32(skb, NFQA_IFINDEX_INDEV,
515 htonl(indev->ifindex)))
516 goto nla_put_failure;
Florian Westphalc737b7c2015-04-02 14:31:41 +0200517
518 physinif = nf_bridge_get_physinif(entskb);
519 if (physinif &&
David S. Millera4471892012-03-29 23:27:38 -0400520 nla_put_be32(skb, NFQA_IFINDEX_PHYSINDEV,
Florian Westphalc737b7c2015-04-02 14:31:41 +0200521 htonl(physinif)))
David S. Millera4471892012-03-29 23:27:38 -0400522 goto nla_put_failure;
Harald Weltefbcd9232005-08-09 20:22:10 -0700523 }
524#endif
Harald Welte7af4cc32005-08-09 19:44:15 -0700525 }
526
Jesper Juhl3e4ead42006-01-05 12:15:58 -0800527 if (outdev) {
Pablo Neira Ayuso1109a902014-10-01 11:19:17 +0200528#if !IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
David S. Millera4471892012-03-29 23:27:38 -0400529 if (nla_put_be32(skb, NFQA_IFINDEX_OUTDEV, htonl(outdev->ifindex)))
530 goto nla_put_failure;
Harald Weltefbcd9232005-08-09 20:22:10 -0700531#else
David S. Miller1d1de892015-04-03 16:31:01 -0400532 if (entry->state.pf == PF_BRIDGE) {
Harald Weltefbcd9232005-08-09 20:22:10 -0700533 /* Case 1: outdev is physical output device, we need to
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800534 * look for bridge group (when called from
Harald Weltefbcd9232005-08-09 20:22:10 -0700535 * netfilter_bridge) */
David S. Millera4471892012-03-29 23:27:38 -0400536 if (nla_put_be32(skb, NFQA_IFINDEX_PHYSOUTDEV,
537 htonl(outdev->ifindex)) ||
Harald Weltefbcd9232005-08-09 20:22:10 -0700538 /* this is the bridge group "brX" */
Jiri Pirkof350a0a82010-06-15 06:50:45 +0000539 /* rcu_read_lock()ed by __nf_queue */
David S. Millera4471892012-03-29 23:27:38 -0400540 nla_put_be32(skb, NFQA_IFINDEX_OUTDEV,
541 htonl(br_port_get_rcu(outdev)->br->dev->ifindex)))
542 goto nla_put_failure;
Harald Weltefbcd9232005-08-09 20:22:10 -0700543 } else {
Florian Westphalc737b7c2015-04-02 14:31:41 +0200544 int physoutif;
545
Harald Weltefbcd9232005-08-09 20:22:10 -0700546 /* Case 2: outdev is bridge group, we need to look for
547 * physical output device (when called from ipv4) */
David S. Millera4471892012-03-29 23:27:38 -0400548 if (nla_put_be32(skb, NFQA_IFINDEX_OUTDEV,
549 htonl(outdev->ifindex)))
550 goto nla_put_failure;
Florian Westphalc737b7c2015-04-02 14:31:41 +0200551
552 physoutif = nf_bridge_get_physoutif(entskb);
553 if (physoutif &&
David S. Millera4471892012-03-29 23:27:38 -0400554 nla_put_be32(skb, NFQA_IFINDEX_PHYSOUTDEV,
Florian Westphalc737b7c2015-04-02 14:31:41 +0200555 htonl(physoutif)))
David S. Millera4471892012-03-29 23:27:38 -0400556 goto nla_put_failure;
Harald Weltefbcd9232005-08-09 20:22:10 -0700557 }
558#endif
Harald Welte7af4cc32005-08-09 19:44:15 -0700559 }
560
David S. Millera4471892012-03-29 23:27:38 -0400561 if (entskb->mark &&
562 nla_put_be32(skb, NFQA_MARK, htonl(entskb->mark)))
563 goto nla_put_failure;
Harald Welte7af4cc32005-08-09 19:44:15 -0700564
Nicolas Dichtel8b541362022-01-17 21:56:13 +0100565 if (entskb->priority &&
566 nla_put_be32(skb, NFQA_PRIORITY, htonl(entskb->priority)))
567 goto nla_put_failure;
568
Nicolas Cavallari2c38de42011-06-16 17:27:04 +0200569 if (indev && entskb->dev &&
Ignacy Gawędzkiebb966d2021-12-10 16:31:27 +0100570 skb_mac_header_was_set(entskb) &&
571 skb_mac_header_len(entskb) != 0) {
Harald Welte7af4cc32005-08-09 19:44:15 -0700572 struct nfqnl_msg_packet_hw phw;
Dan Carpentere4d091d2013-08-01 12:36:57 +0300573 int len;
574
575 memset(&phw, 0, sizeof(phw));
576 len = dev_parse_header(entskb, phw.hw_addr);
Stephen Hemmingerb95cce32007-09-26 22:13:38 -0700577 if (len) {
578 phw.hw_addrlen = htons(len);
David S. Millera4471892012-03-29 23:27:38 -0400579 if (nla_put(skb, NFQA_HWADDR, sizeof(phw), &phw))
580 goto nla_put_failure;
Stephen Hemmingerb95cce32007-09-26 22:13:38 -0700581 }
Harald Welte7af4cc32005-08-09 19:44:15 -0700582 }
583
Stephane Bryant15824ab2016-03-26 08:42:11 +0100584 if (nfqnl_put_bridge(entry, skb) < 0)
585 goto nla_put_failure;
586
Martin KaFai Lau80fcec62022-03-02 11:56:15 -0800587 if (entry->state.hook <= NF_INET_FORWARD && tstamp) {
Harald Welte7af4cc32005-08-09 19:44:15 -0700588 struct nfqnl_msg_packet_timestamp ts;
Martin KaFai Lau80fcec62022-03-02 11:56:15 -0800589 struct timespec64 kts = ktime_to_timespec64(tstamp);
Pablo Neira Ayusob28b1e82015-10-04 19:38:14 +0200590
591 ts.sec = cpu_to_be64(kts.tv_sec);
592 ts.usec = cpu_to_be64(kts.tv_nsec / NSEC_PER_USEC);
Harald Welte7af4cc32005-08-09 19:44:15 -0700593
David S. Millera4471892012-03-29 23:27:38 -0400594 if (nla_put(skb, NFQA_TIMESTAMP, sizeof(ts), &ts))
595 goto nla_put_failure;
Harald Welte7af4cc32005-08-09 19:44:15 -0700596 }
597
Valentina Giusti08c0cad2013-12-20 17:28:53 +0100598 if ((queue->flags & NFQA_CFG_F_UID_GID) && entskb->sk &&
599 nfqnl_put_sk_uidgid(skb, entskb->sk) < 0)
600 goto nla_put_failure;
601
Roman Kubiakef493bd2015-06-12 12:32:57 +0200602 if (seclen && nla_put(skb, NFQA_SECCTX, seclen, secdata))
603 goto nla_put_failure;
604
Ken-ichirou MATSUZAWAa4b47662015-10-05 11:47:13 +0900605 if (ct && nfnl_ct->build(skb, ct, ctinfo, NFQA_CT, NFQA_CT_INFO) < 0)
Pablo Neira Ayuso7c622342012-06-19 02:10:57 +0200606 goto nla_put_failure;
Pablo Neira Ayuso9cb01762012-06-07 12:13:39 +0200607
Florian Westphal7f877122013-06-04 22:22:16 +0000608 if (cap_len > data_len &&
609 nla_put_be32(skb, NFQA_CAP_LEN, htonl(cap_len)))
Pablo Neira Ayuso6ee584b2012-09-24 14:52:12 +0200610 goto nla_put_failure;
611
Florian Westphal496e4ae2013-06-29 14:15:47 +0200612 if (nfqnl_put_packet_info(skb, entskb, csum_verify))
Florian Westphal72371902013-04-19 04:58:26 +0000613 goto nla_put_failure;
614
Eric Dumazetae08ce02013-03-17 17:15:55 +0000615 if (data_len) {
616 struct nlattr *nla;
617
618 if (skb_tailroom(skb) < sizeof(*nla) + hlen)
619 goto nla_put_failure;
620
Johannes Berg4df864c2017-06-16 14:29:21 +0200621 nla = skb_put(skb, sizeof(*nla));
Eric Dumazetae08ce02013-03-17 17:15:55 +0000622 nla->nla_type = NFQA_PAYLOAD;
623 nla->nla_len = nla_attr_size(data_len);
624
Zoltan Kiss36d5fe62014-03-26 22:37:45 +0000625 if (skb_zerocopy(skb, entskb, data_len, hlen))
626 goto nla_put_failure;
Eric Dumazetae08ce02013-03-17 17:15:55 +0000627 }
628
629 nlh->nlmsg_len = skb->len;
Liping Zhang77c1c032017-03-28 22:59:25 +0800630 if (seclen)
631 security_release_secctx(secdata, seclen);
Harald Welte7af4cc32005-08-09 19:44:15 -0700632 return skb;
633
Patrick McHardydf6fb862007-09-28 14:37:03 -0700634nla_put_failure:
Zoltan Kiss36d5fe62014-03-26 22:37:45 +0000635 skb_tx_error(entskb);
Wei Yongjuna6729952012-08-28 03:14:15 +0000636 kfree_skb(skb);
Joe Perchese87cc472012-05-13 21:56:26 +0000637 net_err_ratelimited("nf_queue: error creating packet message\n");
Liping Zhang77c1c032017-03-28 22:59:25 +0800638nlmsg_failure:
639 if (seclen)
640 security_release_secctx(secdata, seclen);
Harald Welte7af4cc32005-08-09 19:44:15 -0700641 return NULL;
642}
643
Florian Westphal5da773a2017-07-26 00:02:34 +0200644static bool nf_ct_drop_unconfirmed(const struct nf_queue_entry *entry)
645{
646#if IS_ENABLED(CONFIG_NF_CONNTRACK)
647 static const unsigned long flags = IPS_CONFIRMED | IPS_DYING;
648 const struct nf_conn *ct = (void *)skb_nfct(entry->skb);
649
650 if (ct && ((ct->status & flags) == IPS_DYING))
651 return true;
652#endif
653 return false;
654}
655
Harald Welte7af4cc32005-08-09 19:44:15 -0700656static int
Florian Westphala5fedd432013-04-19 04:58:25 +0000657__nfqnl_enqueue_packet(struct net *net, struct nfqnl_instance *queue,
658 struct nf_queue_entry *entry)
Harald Welte7af4cc32005-08-09 19:44:15 -0700659{
Harald Welte7af4cc32005-08-09 19:44:15 -0700660 struct sk_buff *nskb;
Florian Westphalf1585082011-01-18 15:27:28 +0100661 int err = -ENOBUFS;
Eric Dumazet5863702a2011-07-19 11:44:17 +0200662 __be32 *packet_id_ptr;
Krishna Kumarfdb694a02012-05-24 03:56:44 +0000663 int failopen = 0;
Harald Welte7af4cc32005-08-09 19:44:15 -0700664
Gao feng74332682013-09-23 19:20:55 +0800665 nskb = nfqnl_build_packet_message(net, queue, entry, &packet_id_ptr);
Florian Westphalf1585082011-01-18 15:27:28 +0100666 if (nskb == NULL) {
667 err = -ENOMEM;
Patrick McHardy0ef0f462007-12-05 01:31:01 -0800668 goto err_out;
Florian Westphalf1585082011-01-18 15:27:28 +0100669 }
Harald Welte7af4cc32005-08-09 19:44:15 -0700670 spin_lock_bh(&queue->lock);
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800671
Florian Westphal5da773a2017-07-26 00:02:34 +0200672 if (nf_ct_drop_unconfirmed(entry))
673 goto err_out_free_nskb;
674
Harald Welte7af4cc32005-08-09 19:44:15 -0700675 if (queue->queue_total >= queue->queue_maxlen) {
Krishna Kumarfdb694a02012-05-24 03:56:44 +0000676 if (queue->flags & NFQA_CFG_F_FAIL_OPEN) {
677 failopen = 1;
678 err = 0;
679 } else {
680 queue->queue_dropped++;
681 net_warn_ratelimited("nf_queue: full at %d entries, dropping packets(s)\n",
682 queue->queue_total);
683 }
Harald Welte7af4cc32005-08-09 19:44:15 -0700684 goto err_out_free_nskb;
685 }
Eric Dumazet5863702a2011-07-19 11:44:17 +0200686 entry->id = ++queue->id_sequence;
687 *packet_id_ptr = htonl(entry->id);
Harald Welte7af4cc32005-08-09 19:44:15 -0700688
689 /* nfnetlink_unicast will either free the nskb or add it to a socket */
Pablo Neira Ayusoee921182020-08-23 13:55:36 +0200690 err = nfnetlink_unicast(nskb, net, queue->peer_portid);
Patrick McHardy0ef0f462007-12-05 01:31:01 -0800691 if (err < 0) {
Pablo Neira Ayuso93140112016-03-23 12:58:01 +0100692 if (queue->flags & NFQA_CFG_F_FAIL_OPEN) {
693 failopen = 1;
694 err = 0;
695 } else {
696 queue->queue_user_dropped++;
697 }
Harald Welte7af4cc32005-08-09 19:44:15 -0700698 goto err_out_unlock;
699 }
700
701 __enqueue_entry(queue, entry);
702
703 spin_unlock_bh(&queue->lock);
Patrick McHardy0ef0f462007-12-05 01:31:01 -0800704 return 0;
Harald Welte7af4cc32005-08-09 19:44:15 -0700705
706err_out_free_nskb:
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800707 kfree_skb(nskb);
Harald Welte7af4cc32005-08-09 19:44:15 -0700708err_out_unlock:
709 spin_unlock_bh(&queue->lock);
Krishna Kumarfdb694a02012-05-24 03:56:44 +0000710 if (failopen)
Pablo Neira Ayuso368982c2018-05-23 09:17:24 +0200711 nfqnl_reinject(entry, NF_ACCEPT);
Patrick McHardy0ef0f462007-12-05 01:31:01 -0800712err_out:
Florian Westphalf1585082011-01-18 15:27:28 +0100713 return err;
Harald Welte7af4cc32005-08-09 19:44:15 -0700714}
715
Florian Westphala5fedd432013-04-19 04:58:25 +0000716static struct nf_queue_entry *
717nf_queue_entry_dup(struct nf_queue_entry *e)
718{
719 struct nf_queue_entry *entry = kmemdup(e, e->size, GFP_ATOMIC);
Florian Westphalc3873072022-02-28 06:22:22 +0100720
721 if (!entry)
722 return NULL;
723
724 if (nf_queue_entry_get_refs(entry))
725 return entry;
726
727 kfree(entry);
728 return NULL;
Florian Westphala5fedd432013-04-19 04:58:25 +0000729}
730
Pablo Neira Ayuso1109a902014-10-01 11:19:17 +0200731#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
Florian Westphala5fedd432013-04-19 04:58:25 +0000732/* When called from bridge netfilter, skb->data must point to MAC header
733 * before calling skb_gso_segment(). Else, original MAC header is lost
734 * and segmented skbs will be sent to wrong destination.
735 */
736static void nf_bridge_adjust_skb_data(struct sk_buff *skb)
737{
Florian Westphalc4b0e772018-12-18 17:15:15 +0100738 if (nf_bridge_info_get(skb))
Florian Westphala5fedd432013-04-19 04:58:25 +0000739 __skb_push(skb, skb->network_header - skb->mac_header);
740}
741
742static void nf_bridge_adjust_segmented_data(struct sk_buff *skb)
743{
Florian Westphalc4b0e772018-12-18 17:15:15 +0100744 if (nf_bridge_info_get(skb))
Florian Westphala5fedd432013-04-19 04:58:25 +0000745 __skb_pull(skb, skb->network_header - skb->mac_header);
746}
747#else
748#define nf_bridge_adjust_skb_data(s) do {} while (0)
749#define nf_bridge_adjust_segmented_data(s) do {} while (0)
750#endif
751
Florian Westphala5fedd432013-04-19 04:58:25 +0000752static int
753__nfqnl_enqueue_packet_gso(struct net *net, struct nfqnl_instance *queue,
754 struct sk_buff *skb, struct nf_queue_entry *entry)
755{
756 int ret = -ENOMEM;
757 struct nf_queue_entry *entry_seg;
758
759 nf_bridge_adjust_segmented_data(skb);
760
761 if (skb->next == NULL) { /* last packet, no need to copy entry */
762 struct sk_buff *gso_skb = entry->skb;
763 entry->skb = skb;
764 ret = __nfqnl_enqueue_packet(net, queue, entry);
765 if (ret)
766 entry->skb = gso_skb;
767 return ret;
768 }
769
David S. Millera8305bf2018-07-29 20:42:53 -0700770 skb_mark_not_on_list(skb);
Florian Westphala5fedd432013-04-19 04:58:25 +0000771
772 entry_seg = nf_queue_entry_dup(entry);
773 if (entry_seg) {
774 entry_seg->skb = skb;
775 ret = __nfqnl_enqueue_packet(net, queue, entry_seg);
776 if (ret)
Florian Westphaldd3cc112020-03-27 03:24:46 +0100777 nf_queue_entry_free(entry_seg);
Florian Westphala5fedd432013-04-19 04:58:25 +0000778 }
779 return ret;
780}
781
782static int
783nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
784{
785 unsigned int queued;
786 struct nfqnl_instance *queue;
Jason A. Donenfeld2670ee72020-01-13 18:42:32 -0500787 struct sk_buff *skb, *segs, *nskb;
Florian Westphala5fedd432013-04-19 04:58:25 +0000788 int err = -ENOBUFS;
Eric W. Biederman9dff2c92015-09-15 20:04:17 -0500789 struct net *net = entry->state.net;
Florian Westphala5fedd432013-04-19 04:58:25 +0000790 struct nfnl_queue_net *q = nfnl_queue_pernet(net);
791
Aaron Conolee2361cb2016-09-21 11:35:04 -0400792 /* rcu_read_lock()ed by nf_hook_thresh */
Florian Westphala5fedd432013-04-19 04:58:25 +0000793 queue = instance_lookup(q, queuenum);
794 if (!queue)
795 return -ESRCH;
796
797 if (queue->copy_mode == NFQNL_COPY_NONE)
798 return -EINVAL;
799
Florian Westphala5fedd432013-04-19 04:58:25 +0000800 skb = entry->skb;
801
David S. Miller1d1de892015-04-03 16:31:01 -0400802 switch (entry->state.pf) {
Florian Westphala5fedd432013-04-19 04:58:25 +0000803 case NFPROTO_IPV4:
804 skb->protocol = htons(ETH_P_IP);
805 break;
806 case NFPROTO_IPV6:
807 skb->protocol = htons(ETH_P_IPV6);
808 break;
809 }
810
Pablo Neira Ayuso7b8dfe22013-06-07 18:42:00 +0200811 if ((queue->flags & NFQA_CFG_F_GSO) || !skb_is_gso(skb))
812 return __nfqnl_enqueue_packet(net, queue, entry);
813
Florian Westphala5fedd432013-04-19 04:58:25 +0000814 nf_bridge_adjust_skb_data(skb);
815 segs = skb_gso_segment(skb, 0);
816 /* Does not use PTR_ERR to limit the number of error codes that can be
Florian Westphaled78d092015-10-13 14:33:27 +0200817 * returned by nf_queue. For instance, callers rely on -ESRCH to
Florian Westphala5fedd432013-04-19 04:58:25 +0000818 * mean 'ignore this hook'.
819 */
Florian Westphal330966e2014-10-20 13:49:17 +0200820 if (IS_ERR_OR_NULL(segs))
Florian Westphala5fedd432013-04-19 04:58:25 +0000821 goto out_err;
822 queued = 0;
823 err = 0;
Jason A. Donenfeld2670ee72020-01-13 18:42:32 -0500824 skb_list_walk_safe(segs, segs, nskb) {
Florian Westphala5fedd432013-04-19 04:58:25 +0000825 if (err == 0)
826 err = __nfqnl_enqueue_packet_gso(net, queue,
827 segs, entry);
828 if (err == 0)
829 queued++;
830 else
831 kfree_skb(segs);
Jason A. Donenfeld2670ee72020-01-13 18:42:32 -0500832 }
Florian Westphala5fedd432013-04-19 04:58:25 +0000833
834 if (queued) {
835 if (err) /* some segments are already queued */
Florian Westphaldd3cc112020-03-27 03:24:46 +0100836 nf_queue_entry_free(entry);
Florian Westphala5fedd432013-04-19 04:58:25 +0000837 kfree_skb(skb);
838 return 0;
839 }
840 out_err:
841 nf_bridge_adjust_segmented_data(skb);
842 return err;
843}
844
Harald Welte7af4cc32005-08-09 19:44:15 -0700845static int
Pablo Neira Ayuso8c88f872012-06-07 13:31:25 +0200846nfqnl_mangle(void *data, int data_len, struct nf_queue_entry *e, int diff)
Harald Welte7af4cc32005-08-09 19:44:15 -0700847{
Patrick McHardye2b58a62008-02-19 17:17:52 -0800848 struct sk_buff *nskb;
Harald Welte7af4cc32005-08-09 19:44:15 -0700849
Patrick McHardyd8a585d2006-11-14 19:48:09 -0800850 if (diff < 0) {
851 if (pskb_trim(e->skb, data_len))
852 return -ENOMEM;
853 } else if (diff > 0) {
Harald Welte7af4cc32005-08-09 19:44:15 -0700854 if (data_len > 0xFFFF)
855 return -EINVAL;
856 if (diff > skb_tailroom(e->skb)) {
Arnaud Ebalard9a732ed2008-04-29 03:16:34 -0700857 nskb = skb_copy_expand(e->skb, skb_headroom(e->skb),
858 diff, GFP_ATOMIC);
Arushi Singhal5191d702018-03-12 18:36:29 +0530859 if (!nskb)
Patrick McHardye2b58a62008-02-19 17:17:52 -0800860 return -ENOMEM;
Patrick McHardye2b58a62008-02-19 17:17:52 -0800861 kfree_skb(e->skb);
862 e->skb = nskb;
Harald Welte7af4cc32005-08-09 19:44:15 -0700863 }
864 skb_put(e->skb, diff);
865 }
Florian Westphal2cf6bff2019-05-23 15:44:12 +0200866 if (skb_ensure_writable(e->skb, data_len))
Harald Welte7af4cc32005-08-09 19:44:15 -0700867 return -ENOMEM;
Arnaldo Carvalho de Melo27d7ff42007-03-31 11:55:19 -0300868 skb_copy_to_linear_data(e->skb, data, data_len);
Patrick McHardye7dfb092005-09-06 15:10:00 -0700869 e->skb->ip_summed = CHECKSUM_NONE;
Harald Welte7af4cc32005-08-09 19:44:15 -0700870 return 0;
871}
872
Harald Welte7af4cc32005-08-09 19:44:15 -0700873static int
874nfqnl_set_mode(struct nfqnl_instance *queue,
875 unsigned char mode, unsigned int range)
876{
Patrick McHardyc5de0df2007-12-05 01:29:05 -0800877 int status = 0;
Harald Welte7af4cc32005-08-09 19:44:15 -0700878
879 spin_lock_bh(&queue->lock);
Patrick McHardyc5de0df2007-12-05 01:29:05 -0800880 switch (mode) {
881 case NFQNL_COPY_NONE:
882 case NFQNL_COPY_META:
883 queue->copy_mode = mode;
884 queue->copy_range = 0;
885 break;
886
887 case NFQNL_COPY_PACKET:
888 queue->copy_mode = mode;
Florian Westphal9cefbbc2013-06-04 22:22:15 +0000889 if (range == 0 || range > NFQNL_MAX_COPY_RANGE)
890 queue->copy_range = NFQNL_MAX_COPY_RANGE;
Patrick McHardyc5de0df2007-12-05 01:29:05 -0800891 else
892 queue->copy_range = range;
893 break;
894
895 default:
896 status = -EINVAL;
897
898 }
Harald Welte7af4cc32005-08-09 19:44:15 -0700899 spin_unlock_bh(&queue->lock);
900
901 return status;
902}
903
904static int
Patrick McHardy02f014d2007-12-05 01:26:33 -0800905dev_cmp(struct nf_queue_entry *entry, unsigned long ifindex)
Harald Welte7af4cc32005-08-09 19:44:15 -0700906{
Florian Westphalc4b0e772018-12-18 17:15:15 +0100907#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
908 int physinif, physoutif;
909
910 physinif = nf_bridge_get_physinif(entry->skb);
911 physoutif = nf_bridge_get_physoutif(entry->skb);
912
913 if (physinif == ifindex || physoutif == ifindex)
914 return 1;
915#endif
David S. Miller1d1de892015-04-03 16:31:01 -0400916 if (entry->state.in)
917 if (entry->state.in->ifindex == ifindex)
Harald Welte7af4cc32005-08-09 19:44:15 -0700918 return 1;
David S. Miller1d1de892015-04-03 16:31:01 -0400919 if (entry->state.out)
920 if (entry->state.out->ifindex == ifindex)
Harald Welte7af4cc32005-08-09 19:44:15 -0700921 return 1;
Florian Westphalc737b7c2015-04-02 14:31:41 +0200922
Harald Welte7af4cc32005-08-09 19:44:15 -0700923 return 0;
924}
925
926/* drop all packets with either indev or outdev == ifindex from all queue
927 * instances */
928static void
Gao fenge8179612013-03-24 23:50:47 +0000929nfqnl_dev_drop(struct net *net, int ifindex)
Harald Welte7af4cc32005-08-09 19:44:15 -0700930{
931 int i;
Gao fenge8179612013-03-24 23:50:47 +0000932 struct nfnl_queue_net *q = nfnl_queue_pernet(net);
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800933
Patrick McHardy9872bec2007-12-05 01:28:50 -0800934 rcu_read_lock();
Harald Welte7af4cc32005-08-09 19:44:15 -0700935
Patrick McHardy9872bec2007-12-05 01:28:50 -0800936 for (i = 0; i < INSTANCE_BUCKETS; i++) {
Harald Welte7af4cc32005-08-09 19:44:15 -0700937 struct nfqnl_instance *inst;
Gao fenge8179612013-03-24 23:50:47 +0000938 struct hlist_head *head = &q->instance_table[i];
Harald Welte7af4cc32005-08-09 19:44:15 -0700939
Sasha Levinb67bfe02013-02-27 17:06:00 -0800940 hlist_for_each_entry_rcu(inst, head, hlist)
Patrick McHardyb43d8d82007-12-05 01:25:30 -0800941 nfqnl_flush(inst, dev_cmp, ifindex);
Harald Welte7af4cc32005-08-09 19:44:15 -0700942 }
943
Patrick McHardy9872bec2007-12-05 01:28:50 -0800944 rcu_read_unlock();
Harald Welte7af4cc32005-08-09 19:44:15 -0700945}
946
Harald Welte7af4cc32005-08-09 19:44:15 -0700947static int
948nfqnl_rcv_dev_event(struct notifier_block *this,
949 unsigned long event, void *ptr)
950{
Jiri Pirko351638e2013-05-28 01:30:21 +0000951 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
Harald Welte7af4cc32005-08-09 19:44:15 -0700952
953 /* Drop any packets associated with the downed device */
954 if (event == NETDEV_DOWN)
Gao fenge8179612013-03-24 23:50:47 +0000955 nfqnl_dev_drop(dev_net(dev), dev->ifindex);
Harald Welte7af4cc32005-08-09 19:44:15 -0700956 return NOTIFY_DONE;
957}
958
959static struct notifier_block nfqnl_dev_notifier = {
960 .notifier_call = nfqnl_rcv_dev_event,
961};
962
Florian Westphal26888df2017-12-01 00:21:03 +0100963static void nfqnl_nf_hook_drop(struct net *net)
Eric W. Biederman8405a8f2015-06-19 14:03:39 -0500964{
965 struct nfnl_queue_net *q = nfnl_queue_pernet(net);
966 int i;
967
Florian Westphal87029972021-08-05 12:02:43 +0200968 /* This function is also called on net namespace error unwind,
969 * when pernet_ops->init() failed and ->exit() functions of the
970 * previous pernet_ops gets called.
971 *
972 * This may result in a call to nfqnl_nf_hook_drop() before
973 * struct nfnl_queue_net was allocated.
974 */
975 if (!q)
976 return;
977
Eric W. Biederman8405a8f2015-06-19 14:03:39 -0500978 for (i = 0; i < INSTANCE_BUCKETS; i++) {
979 struct nfqnl_instance *inst;
980 struct hlist_head *head = &q->instance_table[i];
981
Florian Westphal26888df2017-12-01 00:21:03 +0100982 hlist_for_each_entry_rcu(inst, head, hlist)
Florian Westphal039b40e2017-04-24 15:37:41 +0200983 nfqnl_flush(inst, NULL, 0);
Eric W. Biederman8405a8f2015-06-19 14:03:39 -0500984 }
Eric W. Biederman8405a8f2015-06-19 14:03:39 -0500985}
986
Harald Welte7af4cc32005-08-09 19:44:15 -0700987static int
988nfqnl_rcv_nl_event(struct notifier_block *this,
989 unsigned long event, void *ptr)
990{
991 struct netlink_notify *n = ptr;
Gao fenge8179612013-03-24 23:50:47 +0000992 struct nfnl_queue_net *q = nfnl_queue_pernet(n->net);
Harald Welte7af4cc32005-08-09 19:44:15 -0700993
Patrick McHardydee58172009-11-06 17:04:00 +0100994 if (event == NETLINK_URELEASE && n->protocol == NETLINK_NETFILTER) {
Harald Welte7af4cc32005-08-09 19:44:15 -0700995 int i;
996
Eric W. Biederman15e47302012-09-07 20:12:54 +0000997 /* destroy all instances for this portid */
Gao fenge8179612013-03-24 23:50:47 +0000998 spin_lock(&q->instances_lock);
Patrick McHardy9872bec2007-12-05 01:28:50 -0800999 for (i = 0; i < INSTANCE_BUCKETS; i++) {
Sasha Levinb67bfe02013-02-27 17:06:00 -08001000 struct hlist_node *t2;
Harald Welte7af4cc32005-08-09 19:44:15 -07001001 struct nfqnl_instance *inst;
Gao fenge8179612013-03-24 23:50:47 +00001002 struct hlist_head *head = &q->instance_table[i];
Harald Welte7af4cc32005-08-09 19:44:15 -07001003
Sasha Levinb67bfe02013-02-27 17:06:00 -08001004 hlist_for_each_entry_safe(inst, t2, head, hlist) {
Gao fenge8179612013-03-24 23:50:47 +00001005 if (n->portid == inst->peer_portid)
Harald Welte7af4cc32005-08-09 19:44:15 -07001006 __instance_destroy(inst);
1007 }
1008 }
Gao fenge8179612013-03-24 23:50:47 +00001009 spin_unlock(&q->instances_lock);
Harald Welte7af4cc32005-08-09 19:44:15 -07001010 }
1011 return NOTIFY_DONE;
1012}
1013
1014static struct notifier_block nfqnl_rtnl_notifier = {
1015 .notifier_call = nfqnl_rcv_nl_event,
1016};
1017
Stephane Bryant8d45ff22016-03-26 08:42:12 +01001018static const struct nla_policy nfqa_vlan_policy[NFQA_VLAN_MAX + 1] = {
1019 [NFQA_VLAN_TCI] = { .type = NLA_U16},
1020 [NFQA_VLAN_PROTO] = { .type = NLA_U16},
1021};
1022
Patrick McHardy5bf75852007-09-28 14:39:26 -07001023static const struct nla_policy nfqa_verdict_policy[NFQA_MAX+1] = {
1024 [NFQA_VERDICT_HDR] = { .len = sizeof(struct nfqnl_msg_verdict_hdr) },
1025 [NFQA_MARK] = { .type = NLA_U32 },
1026 [NFQA_PAYLOAD] = { .type = NLA_UNSPEC },
Pablo Neira Ayuso9cb01762012-06-07 12:13:39 +02001027 [NFQA_CT] = { .type = NLA_UNSPEC },
Pablo Neira Ayusobd077932013-08-07 18:13:20 +02001028 [NFQA_EXP] = { .type = NLA_UNSPEC },
Stephane Bryant8d45ff22016-03-26 08:42:12 +01001029 [NFQA_VLAN] = { .type = NLA_NESTED },
Nicolas Dichtel98eee882022-02-04 11:21:43 +01001030 [NFQA_PRIORITY] = { .type = NLA_U32 },
Harald Welte838ab632005-08-09 19:50:45 -07001031};
1032
Florian Westphal97d32cf2011-07-19 11:46:33 +02001033static const struct nla_policy nfqa_verdict_batch_policy[NFQA_MAX+1] = {
1034 [NFQA_VERDICT_HDR] = { .len = sizeof(struct nfqnl_msg_verdict_hdr) },
1035 [NFQA_MARK] = { .type = NLA_U32 },
Nicolas Dichtel98eee882022-02-04 11:21:43 +01001036 [NFQA_PRIORITY] = { .type = NLA_U32 },
Florian Westphal97d32cf2011-07-19 11:46:33 +02001037};
1038
Gao fenge8179612013-03-24 23:50:47 +00001039static struct nfqnl_instance *
Richard Weinbergercc6bc442015-04-13 00:52:37 +02001040verdict_instance_lookup(struct nfnl_queue_net *q, u16 queue_num, u32 nlportid)
Florian Westphal97d32cf2011-07-19 11:46:33 +02001041{
1042 struct nfqnl_instance *queue;
1043
Gao fenge8179612013-03-24 23:50:47 +00001044 queue = instance_lookup(q, queue_num);
Florian Westphal97d32cf2011-07-19 11:46:33 +02001045 if (!queue)
1046 return ERR_PTR(-ENODEV);
1047
Eric W. Biederman15e47302012-09-07 20:12:54 +00001048 if (queue->peer_portid != nlportid)
Florian Westphal97d32cf2011-07-19 11:46:33 +02001049 return ERR_PTR(-EPERM);
1050
1051 return queue;
1052}
1053
1054static struct nfqnl_msg_verdict_hdr*
1055verdicthdr_get(const struct nlattr * const nfqa[])
1056{
1057 struct nfqnl_msg_verdict_hdr *vhdr;
1058 unsigned int verdict;
1059
1060 if (!nfqa[NFQA_VERDICT_HDR])
1061 return NULL;
1062
1063 vhdr = nla_data(nfqa[NFQA_VERDICT_HDR]);
Florian Westphalc6675232011-08-30 15:01:20 +02001064 verdict = ntohl(vhdr->verdict) & NF_VERDICT_MASK;
1065 if (verdict > NF_MAX_VERDICT || verdict == NF_STOLEN)
Florian Westphal97d32cf2011-07-19 11:46:33 +02001066 return NULL;
1067 return vhdr;
1068}
1069
1070static int nfq_id_after(unsigned int id, unsigned int max)
1071{
1072 return (int)(id - max) > 0;
1073}
1074
Pablo Neira Ayuso797d4982021-04-23 00:17:10 +02001075static int nfqnl_recv_verdict_batch(struct sk_buff *skb,
1076 const struct nfnl_info *info,
1077 const struct nlattr * const nfqa[])
Florian Westphal97d32cf2011-07-19 11:46:33 +02001078{
Pablo Neira Ayuso797d4982021-04-23 00:17:10 +02001079 struct nfnl_queue_net *q = nfnl_queue_pernet(info->net);
Pablo Neira Ayusoef4b65e2021-05-31 00:08:09 +02001080 u16 queue_num = ntohs(info->nfmsg->res_id);
Florian Westphal97d32cf2011-07-19 11:46:33 +02001081 struct nf_queue_entry *entry, *tmp;
Florian Westphal97d32cf2011-07-19 11:46:33 +02001082 struct nfqnl_msg_verdict_hdr *vhdr;
1083 struct nfqnl_instance *queue;
Pablo Neira Ayuso797d4982021-04-23 00:17:10 +02001084 unsigned int verdict, maxid;
Florian Westphal97d32cf2011-07-19 11:46:33 +02001085 LIST_HEAD(batch_list);
Gao fenge8179612013-03-24 23:50:47 +00001086
1087 queue = verdict_instance_lookup(q, queue_num,
1088 NETLINK_CB(skb).portid);
Florian Westphal97d32cf2011-07-19 11:46:33 +02001089 if (IS_ERR(queue))
1090 return PTR_ERR(queue);
1091
1092 vhdr = verdicthdr_get(nfqa);
1093 if (!vhdr)
1094 return -EINVAL;
1095
1096 verdict = ntohl(vhdr->verdict);
1097 maxid = ntohl(vhdr->id);
1098
1099 spin_lock_bh(&queue->lock);
1100
1101 list_for_each_entry_safe(entry, tmp, &queue->queue_list, list) {
1102 if (nfq_id_after(entry->id, maxid))
1103 break;
1104 __dequeue_entry(queue, entry);
1105 list_add_tail(&entry->list, &batch_list);
1106 }
1107
1108 spin_unlock_bh(&queue->lock);
1109
1110 if (list_empty(&batch_list))
1111 return -ENOENT;
1112
1113 list_for_each_entry_safe(entry, tmp, &batch_list, list) {
1114 if (nfqa[NFQA_MARK])
1115 entry->skb->mark = ntohl(nla_get_be32(nfqa[NFQA_MARK]));
Pablo Neira Ayuso368982c2018-05-23 09:17:24 +02001116
Nicolas Dichtel98eee882022-02-04 11:21:43 +01001117 if (nfqa[NFQA_PRIORITY])
1118 entry->skb->priority = ntohl(nla_get_be32(nfqa[NFQA_PRIORITY]));
1119
Pablo Neira Ayuso368982c2018-05-23 09:17:24 +02001120 nfqnl_reinject(entry, verdict);
Florian Westphal97d32cf2011-07-19 11:46:33 +02001121 }
1122 return 0;
1123}
1124
Florian Westphal285c8a72022-01-07 05:03:24 +01001125static struct nf_conn *nfqnl_ct_parse(const struct nfnl_ct_hook *nfnl_ct,
Pablo Neira Ayusob7bd1802015-09-30 22:53:44 +01001126 const struct nlmsghdr *nlh,
1127 const struct nlattr * const nfqa[],
1128 struct nf_queue_entry *entry,
1129 enum ip_conntrack_info *ctinfo)
1130{
Florian Westphal83ace772021-01-20 16:30:03 +01001131#if IS_ENABLED(CONFIG_NF_CONNTRACK)
Pablo Neira Ayusob7bd1802015-09-30 22:53:44 +01001132 struct nf_conn *ct;
1133
Florian Westphal83ace772021-01-20 16:30:03 +01001134 ct = nf_ct_get(entry->skb, ctinfo);
Pablo Neira Ayusob7bd1802015-09-30 22:53:44 +01001135 if (ct == NULL)
1136 return NULL;
1137
Ken-ichirou MATSUZAWAa4b47662015-10-05 11:47:13 +09001138 if (nfnl_ct->parse(nfqa[NFQA_CT], ct) < 0)
Pablo Neira Ayusob7bd1802015-09-30 22:53:44 +01001139 return NULL;
1140
1141 if (nfqa[NFQA_EXP])
Ken-ichirou MATSUZAWAa4b47662015-10-05 11:47:13 +09001142 nfnl_ct->attach_expect(nfqa[NFQA_EXP], ct,
Pablo Neira Ayusob7bd1802015-09-30 22:53:44 +01001143 NETLINK_CB(entry->skb).portid,
1144 nlmsg_report(nlh));
1145 return ct;
Florian Westphal83ace772021-01-20 16:30:03 +01001146#else
1147 return NULL;
1148#endif
Pablo Neira Ayusob7bd1802015-09-30 22:53:44 +01001149}
1150
Stephane Bryant8d45ff22016-03-26 08:42:12 +01001151static int nfqa_parse_bridge(struct nf_queue_entry *entry,
1152 const struct nlattr * const nfqa[])
1153{
1154 if (nfqa[NFQA_VLAN]) {
1155 struct nlattr *tb[NFQA_VLAN_MAX + 1];
1156 int err;
1157
Johannes Berg8cb08172019-04-26 14:07:28 +02001158 err = nla_parse_nested_deprecated(tb, NFQA_VLAN_MAX,
1159 nfqa[NFQA_VLAN],
1160 nfqa_vlan_policy, NULL);
Stephane Bryant8d45ff22016-03-26 08:42:12 +01001161 if (err < 0)
1162 return err;
1163
1164 if (!tb[NFQA_VLAN_TCI] || !tb[NFQA_VLAN_PROTO])
1165 return -EINVAL;
1166
Michał Mirosław82eea4c2018-11-09 00:18:02 +01001167 __vlan_hwaccel_put_tag(entry->skb,
1168 nla_get_be16(tb[NFQA_VLAN_PROTO]),
1169 ntohs(nla_get_be16(tb[NFQA_VLAN_TCI])));
Stephane Bryant8d45ff22016-03-26 08:42:12 +01001170 }
1171
1172 if (nfqa[NFQA_L2HDR]) {
1173 int mac_header_len = entry->skb->network_header -
1174 entry->skb->mac_header;
1175
1176 if (mac_header_len != nla_len(nfqa[NFQA_L2HDR]))
1177 return -EINVAL;
1178 else if (mac_header_len > 0)
1179 memcpy(skb_mac_header(entry->skb),
1180 nla_data(nfqa[NFQA_L2HDR]),
1181 mac_header_len);
1182 }
1183
1184 return 0;
1185}
1186
Pablo Neira Ayuso797d4982021-04-23 00:17:10 +02001187static int nfqnl_recv_verdict(struct sk_buff *skb, const struct nfnl_info *info,
1188 const struct nlattr * const nfqa[])
Harald Welte7af4cc32005-08-09 19:44:15 -07001189{
Pablo Neira Ayuso797d4982021-04-23 00:17:10 +02001190 struct nfnl_queue_net *q = nfnl_queue_pernet(info->net);
Pablo Neira Ayusoef4b65e2021-05-31 00:08:09 +02001191 u_int16_t queue_num = ntohs(info->nfmsg->res_id);
Florian Westphal285c8a72022-01-07 05:03:24 +01001192 const struct nfnl_ct_hook *nfnl_ct;
Harald Welte7af4cc32005-08-09 19:44:15 -07001193 struct nfqnl_msg_verdict_hdr *vhdr;
Kees Cook3f649ab2020-06-03 13:09:38 -07001194 enum ip_conntrack_info ctinfo;
Pablo Neira Ayuso797d4982021-04-23 00:17:10 +02001195 struct nfqnl_instance *queue;
1196 struct nf_queue_entry *entry;
Pablo Neira Ayuso8c88f872012-06-07 13:31:25 +02001197 struct nf_conn *ct = NULL;
Pablo Neira Ayuso797d4982021-04-23 00:17:10 +02001198 unsigned int verdict;
Stephane Bryant8d45ff22016-03-26 08:42:12 +01001199 int err;
Harald Welte7af4cc32005-08-09 19:44:15 -07001200
Liping Zhang00a31012016-08-08 22:07:27 +08001201 queue = verdict_instance_lookup(q, queue_num,
1202 NETLINK_CB(skb).portid);
Florian Westphal97d32cf2011-07-19 11:46:33 +02001203 if (IS_ERR(queue))
1204 return PTR_ERR(queue);
Harald Welte7af4cc32005-08-09 19:44:15 -07001205
Florian Westphal97d32cf2011-07-19 11:46:33 +02001206 vhdr = verdicthdr_get(nfqa);
1207 if (!vhdr)
Eric Dumazet84a797d2011-07-18 16:08:27 +02001208 return -EINVAL;
Harald Welte7af4cc32005-08-09 19:44:15 -07001209
Harald Welte7af4cc32005-08-09 19:44:15 -07001210 verdict = ntohl(vhdr->verdict);
1211
Patrick McHardyb43d8d82007-12-05 01:25:30 -08001212 entry = find_dequeue_entry(queue, ntohl(vhdr->id));
Eric Dumazet84a797d2011-07-18 16:08:27 +02001213 if (entry == NULL)
1214 return -ENOENT;
Harald Welte7af4cc32005-08-09 19:44:15 -07001215
Arnd Bergmann8e662162015-11-19 13:49:59 +01001216 /* rcu lock already held from nfnl->call_rcu. */
1217 nfnl_ct = rcu_dereference(nfnl_ct_hook);
1218
Pablo Neira Ayusobd077932013-08-07 18:13:20 +02001219 if (nfqa[NFQA_CT]) {
Ken-ichirou MATSUZAWAa4b47662015-10-05 11:47:13 +09001220 if (nfnl_ct != NULL)
Pablo Neira Ayuso797d4982021-04-23 00:17:10 +02001221 ct = nfqnl_ct_parse(nfnl_ct, info->nlh, nfqa, entry,
1222 &ctinfo);
Pablo Neira Ayusobd077932013-08-07 18:13:20 +02001223 }
Pablo Neira Ayuso9cb01762012-06-07 12:13:39 +02001224
Stephane Bryant8d45ff22016-03-26 08:42:12 +01001225 if (entry->state.pf == PF_BRIDGE) {
1226 err = nfqa_parse_bridge(entry, nfqa);
1227 if (err < 0)
1228 return err;
1229 }
1230
Patrick McHardydf6fb862007-09-28 14:37:03 -07001231 if (nfqa[NFQA_PAYLOAD]) {
Pablo Neira Ayuso8c88f872012-06-07 13:31:25 +02001232 u16 payload_len = nla_len(nfqa[NFQA_PAYLOAD]);
1233 int diff = payload_len - entry->skb->len;
1234
Patrick McHardydf6fb862007-09-28 14:37:03 -07001235 if (nfqnl_mangle(nla_data(nfqa[NFQA_PAYLOAD]),
Pablo Neira Ayuso8c88f872012-06-07 13:31:25 +02001236 payload_len, entry, diff) < 0)
Harald Welte7af4cc32005-08-09 19:44:15 -07001237 verdict = NF_DROP;
Pablo Neira Ayuso8c88f872012-06-07 13:31:25 +02001238
Pablo Neira Ayusob7bd1802015-09-30 22:53:44 +01001239 if (ct && diff)
Ken-ichirou MATSUZAWAa4b47662015-10-05 11:47:13 +09001240 nfnl_ct->seq_adjust(entry->skb, ct, ctinfo, diff);
Harald Welte7af4cc32005-08-09 19:44:15 -07001241 }
1242
Patrick McHardydf6fb862007-09-28 14:37:03 -07001243 if (nfqa[NFQA_MARK])
Patrick McHardyea3a66f2007-12-05 01:30:02 -08001244 entry->skb->mark = ntohl(nla_get_be32(nfqa[NFQA_MARK]));
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001245
Nicolas Dichtel98eee882022-02-04 11:21:43 +01001246 if (nfqa[NFQA_PRIORITY])
1247 entry->skb->priority = ntohl(nla_get_be32(nfqa[NFQA_PRIORITY]));
1248
Pablo Neira Ayuso368982c2018-05-23 09:17:24 +02001249 nfqnl_reinject(entry, verdict);
Harald Welte7af4cc32005-08-09 19:44:15 -07001250 return 0;
1251}
1252
Pablo Neira Ayuso797d4982021-04-23 00:17:10 +02001253static int nfqnl_recv_unsupp(struct sk_buff *skb, const struct nfnl_info *info,
1254 const struct nlattr * const cda[])
Harald Welte7af4cc32005-08-09 19:44:15 -07001255{
1256 return -ENOTSUPP;
1257}
1258
Patrick McHardy5bf75852007-09-28 14:39:26 -07001259static const struct nla_policy nfqa_cfg_policy[NFQA_CFG_MAX+1] = {
1260 [NFQA_CFG_CMD] = { .len = sizeof(struct nfqnl_msg_config_cmd) },
1261 [NFQA_CFG_PARAMS] = { .len = sizeof(struct nfqnl_msg_config_params) },
Eric Dumazetba062eb2018-06-13 09:13:39 -07001262 [NFQA_CFG_QUEUE_MAXLEN] = { .type = NLA_U32 },
1263 [NFQA_CFG_MASK] = { .type = NLA_U32 },
1264 [NFQA_CFG_FLAGS] = { .type = NLA_U32 },
Harald Welte838ab632005-08-09 19:50:45 -07001265};
1266
Patrick McHardye3ac5292007-12-05 01:23:57 -08001267static const struct nf_queue_handler nfqh = {
Arushi Singhald4ef3832017-04-02 14:52:12 +05301268 .outfn = nfqnl_enqueue_packet,
1269 .nf_hook_drop = nfqnl_nf_hook_drop,
Harald Weltebbd86b9f2005-08-09 20:23:11 -07001270};
1271
Pablo Neira Ayusoa6555362021-04-23 00:17:09 +02001272static int nfqnl_recv_config(struct sk_buff *skb, const struct nfnl_info *info,
1273 const struct nlattr * const nfqa[])
Harald Welte7af4cc32005-08-09 19:44:15 -07001274{
Pablo Neira Ayusoa6555362021-04-23 00:17:09 +02001275 struct nfnl_queue_net *q = nfnl_queue_pernet(info->net);
Pablo Neira Ayusoef4b65e2021-05-31 00:08:09 +02001276 u_int16_t queue_num = ntohs(info->nfmsg->res_id);
Patrick McHardy9872bec2007-12-05 01:28:50 -08001277 struct nfqnl_msg_config_cmd *cmd = NULL;
Pablo Neira Ayusoa6555362021-04-23 00:17:09 +02001278 struct nfqnl_instance *queue;
Ken-ichirou MATSUZAWA60d2c7f2016-01-05 09:28:05 +09001279 __u32 flags = 0, mask = 0;
Harald Welte838ab632005-08-09 19:50:45 -07001280 int ret = 0;
Harald Welte7af4cc32005-08-09 19:44:15 -07001281
Patrick McHardy9872bec2007-12-05 01:28:50 -08001282 if (nfqa[NFQA_CFG_CMD]) {
1283 cmd = nla_data(nfqa[NFQA_CFG_CMD]);
1284
Florian Westphal0360ae42012-11-23 06:22:21 +00001285 /* Obsolete commands without queue context */
Patrick McHardy9872bec2007-12-05 01:28:50 -08001286 switch (cmd->command) {
Florian Westphal0360ae42012-11-23 06:22:21 +00001287 case NFQNL_CFG_CMD_PF_BIND: return 0;
1288 case NFQNL_CFG_CMD_PF_UNBIND: return 0;
Patrick McHardy9872bec2007-12-05 01:28:50 -08001289 }
Patrick McHardya3c8e7f2007-12-05 01:28:30 -08001290 }
1291
Ken-ichirou MATSUZAWA60d2c7f2016-01-05 09:28:05 +09001292 /* Check if we support these flags in first place, dependencies should
1293 * be there too not to break atomicity.
1294 */
1295 if (nfqa[NFQA_CFG_FLAGS]) {
1296 if (!nfqa[NFQA_CFG_MASK]) {
1297 /* A mask is needed to specify which flags are being
1298 * changed.
1299 */
1300 return -EINVAL;
1301 }
1302
1303 flags = ntohl(nla_get_be32(nfqa[NFQA_CFG_FLAGS]));
1304 mask = ntohl(nla_get_be32(nfqa[NFQA_CFG_MASK]));
1305
1306 if (flags >= NFQA_CFG_F_MAX)
1307 return -EOPNOTSUPP;
1308
1309#if !IS_ENABLED(CONFIG_NETWORK_SECMARK)
1310 if (flags & mask & NFQA_CFG_F_SECCTX)
1311 return -EOPNOTSUPP;
1312#endif
Ken-ichirou MATSUZAWA71b2e5f2016-01-05 09:32:59 +09001313 if ((flags & mask & NFQA_CFG_F_CONNTRACK) &&
1314 !rcu_access_pointer(nfnl_ct_hook)) {
1315#ifdef CONFIG_MODULES
1316 nfnl_unlock(NFNL_SUBSYS_QUEUE);
1317 request_module("ip_conntrack_netlink");
1318 nfnl_lock(NFNL_SUBSYS_QUEUE);
1319 if (rcu_access_pointer(nfnl_ct_hook))
1320 return -EAGAIN;
1321#endif
1322 return -EOPNOTSUPP;
1323 }
Ken-ichirou MATSUZAWA60d2c7f2016-01-05 09:28:05 +09001324 }
1325
Patrick McHardy9872bec2007-12-05 01:28:50 -08001326 rcu_read_lock();
Gao fenge8179612013-03-24 23:50:47 +00001327 queue = instance_lookup(q, queue_num);
Eric W. Biederman15e47302012-09-07 20:12:54 +00001328 if (queue && queue->peer_portid != NETLINK_CB(skb).portid) {
Patrick McHardy9872bec2007-12-05 01:28:50 -08001329 ret = -EPERM;
1330 goto err_out_unlock;
1331 }
Patrick McHardya3c8e7f2007-12-05 01:28:30 -08001332
Patrick McHardy9872bec2007-12-05 01:28:50 -08001333 if (cmd != NULL) {
Harald Welte7af4cc32005-08-09 19:44:15 -07001334 switch (cmd->command) {
1335 case NFQNL_CFG_CMD_BIND:
Patrick McHardy9872bec2007-12-05 01:28:50 -08001336 if (queue) {
1337 ret = -EBUSY;
1338 goto err_out_unlock;
1339 }
Gao fenge8179612013-03-24 23:50:47 +00001340 queue = instance_create(q, queue_num,
1341 NETLINK_CB(skb).portid);
Patrick McHardybaab2ce2007-12-17 22:41:21 -08001342 if (IS_ERR(queue)) {
1343 ret = PTR_ERR(queue);
Patrick McHardy9872bec2007-12-05 01:28:50 -08001344 goto err_out_unlock;
1345 }
Harald Welte7af4cc32005-08-09 19:44:15 -07001346 break;
1347 case NFQNL_CFG_CMD_UNBIND:
Patrick McHardy9872bec2007-12-05 01:28:50 -08001348 if (!queue) {
1349 ret = -ENODEV;
1350 goto err_out_unlock;
1351 }
Gao fenge8179612013-03-24 23:50:47 +00001352 instance_destroy(q, queue);
Ken-ichirou MATSUZAWA17bc6b42016-01-05 09:29:54 +09001353 goto err_out_unlock;
Harald Welte7af4cc32005-08-09 19:44:15 -07001354 case NFQNL_CFG_CMD_PF_BIND:
Harald Welte7af4cc32005-08-09 19:44:15 -07001355 case NFQNL_CFG_CMD_PF_UNBIND:
Harald Welte7af4cc32005-08-09 19:44:15 -07001356 break;
1357 default:
Patrick McHardycd21f0a2007-12-17 22:40:19 -08001358 ret = -ENOTSUPP;
Ken-ichirou MATSUZAWA21c3c972016-01-05 09:31:40 +09001359 goto err_out_unlock;
Harald Welte7af4cc32005-08-09 19:44:15 -07001360 }
Harald Welte7af4cc32005-08-09 19:44:15 -07001361 }
1362
Ken-ichirou MATSUZAWA60d2c7f2016-01-05 09:28:05 +09001363 if (!queue) {
1364 ret = -ENODEV;
1365 goto err_out_unlock;
1366 }
Harald Welte7af4cc32005-08-09 19:44:15 -07001367
Ken-ichirou MATSUZAWA60d2c7f2016-01-05 09:28:05 +09001368 if (nfqa[NFQA_CFG_PARAMS]) {
1369 struct nfqnl_msg_config_params *params =
1370 nla_data(nfqa[NFQA_CFG_PARAMS]);
1371
Harald Welte7af4cc32005-08-09 19:44:15 -07001372 nfqnl_set_mode(queue, params->copy_mode,
1373 ntohl(params->copy_range));
1374 }
1375
Patrick McHardydf6fb862007-09-28 14:37:03 -07001376 if (nfqa[NFQA_CFG_QUEUE_MAXLEN]) {
Ken-ichirou MATSUZAWA60d2c7f2016-01-05 09:28:05 +09001377 __be32 *queue_maxlen = nla_data(nfqa[NFQA_CFG_QUEUE_MAXLEN]);
Patrick McHardya3c8e7f2007-12-05 01:28:30 -08001378
Eric Leblond829e17a2006-11-29 02:35:33 +01001379 spin_lock_bh(&queue->lock);
1380 queue->queue_maxlen = ntohl(*queue_maxlen);
1381 spin_unlock_bh(&queue->lock);
1382 }
1383
Krishna Kumarfdb694a02012-05-24 03:56:44 +00001384 if (nfqa[NFQA_CFG_FLAGS]) {
Krishna Kumarfdb694a02012-05-24 03:56:44 +00001385 spin_lock_bh(&queue->lock);
1386 queue->flags &= ~mask;
1387 queue->flags |= flags & mask;
1388 spin_unlock_bh(&queue->lock);
1389 }
1390
Patrick McHardy9872bec2007-12-05 01:28:50 -08001391err_out_unlock:
1392 rcu_read_unlock();
Harald Welte838ab632005-08-09 19:50:45 -07001393 return ret;
Harald Welte7af4cc32005-08-09 19:44:15 -07001394}
1395
Patrick McHardy7c8d4cb2007-09-28 14:15:45 -07001396static const struct nfnl_callback nfqnl_cb[NFQNL_MSG_MAX] = {
Pablo Neira Ayuso50f2db92021-04-23 00:17:12 +02001397 [NFQNL_MSG_PACKET] = {
1398 .call = nfqnl_recv_unsupp,
1399 .type = NFNL_CB_RCU,
1400 .attr_count = NFQA_MAX,
1401 },
1402 [NFQNL_MSG_VERDICT] = {
1403 .call = nfqnl_recv_verdict,
1404 .type = NFNL_CB_RCU,
1405 .attr_count = NFQA_MAX,
1406 .policy = nfqa_verdict_policy
1407 },
1408 [NFQNL_MSG_CONFIG] = {
1409 .call = nfqnl_recv_config,
1410 .type = NFNL_CB_MUTEX,
1411 .attr_count = NFQA_CFG_MAX,
1412 .policy = nfqa_cfg_policy
1413 },
1414 [NFQNL_MSG_VERDICT_BATCH] = {
1415 .call = nfqnl_recv_verdict_batch,
1416 .type = NFNL_CB_RCU,
1417 .attr_count = NFQA_MAX,
1418 .policy = nfqa_verdict_batch_policy
1419 },
Harald Welte7af4cc32005-08-09 19:44:15 -07001420};
1421
Patrick McHardy7c8d4cb2007-09-28 14:15:45 -07001422static const struct nfnetlink_subsystem nfqnl_subsys = {
Harald Welte7af4cc32005-08-09 19:44:15 -07001423 .name = "nf_queue",
1424 .subsys_id = NFNL_SUBSYS_QUEUE,
1425 .cb_count = NFQNL_MSG_MAX,
Harald Welte7af4cc32005-08-09 19:44:15 -07001426 .cb = nfqnl_cb,
1427};
1428
Harald Welte838ab632005-08-09 19:50:45 -07001429#ifdef CONFIG_PROC_FS
1430struct iter_state {
Gao fenge8179612013-03-24 23:50:47 +00001431 struct seq_net_private p;
Harald Welte838ab632005-08-09 19:50:45 -07001432 unsigned int bucket;
1433};
1434
1435static struct hlist_node *get_first(struct seq_file *seq)
1436{
1437 struct iter_state *st = seq->private;
Gao fenge8179612013-03-24 23:50:47 +00001438 struct net *net;
1439 struct nfnl_queue_net *q;
Harald Welte838ab632005-08-09 19:50:45 -07001440
1441 if (!st)
1442 return NULL;
1443
Gao fenge8179612013-03-24 23:50:47 +00001444 net = seq_file_net(seq);
1445 q = nfnl_queue_pernet(net);
Harald Welte838ab632005-08-09 19:50:45 -07001446 for (st->bucket = 0; st->bucket < INSTANCE_BUCKETS; st->bucket++) {
Gao fenge8179612013-03-24 23:50:47 +00001447 if (!hlist_empty(&q->instance_table[st->bucket]))
1448 return q->instance_table[st->bucket].first;
Harald Welte838ab632005-08-09 19:50:45 -07001449 }
1450 return NULL;
1451}
1452
1453static struct hlist_node *get_next(struct seq_file *seq, struct hlist_node *h)
1454{
1455 struct iter_state *st = seq->private;
Gao fenge8179612013-03-24 23:50:47 +00001456 struct net *net = seq_file_net(seq);
Harald Welte838ab632005-08-09 19:50:45 -07001457
1458 h = h->next;
1459 while (!h) {
Gao fenge8179612013-03-24 23:50:47 +00001460 struct nfnl_queue_net *q;
1461
Harald Welte838ab632005-08-09 19:50:45 -07001462 if (++st->bucket >= INSTANCE_BUCKETS)
1463 return NULL;
1464
Gao fenge8179612013-03-24 23:50:47 +00001465 q = nfnl_queue_pernet(net);
1466 h = q->instance_table[st->bucket].first;
Harald Welte838ab632005-08-09 19:50:45 -07001467 }
1468 return h;
1469}
1470
1471static struct hlist_node *get_idx(struct seq_file *seq, loff_t pos)
1472{
1473 struct hlist_node *head;
1474 head = get_first(seq);
1475
1476 if (head)
1477 while (pos && (head = get_next(seq, head)))
1478 pos--;
1479 return pos ? NULL : head;
1480}
1481
Gao fenge8179612013-03-24 23:50:47 +00001482static void *seq_start(struct seq_file *s, loff_t *pos)
1483 __acquires(nfnl_queue_pernet(seq_file_net(s))->instances_lock)
Harald Welte838ab632005-08-09 19:50:45 -07001484{
Gao fenge8179612013-03-24 23:50:47 +00001485 spin_lock(&nfnl_queue_pernet(seq_file_net(s))->instances_lock);
1486 return get_idx(s, *pos);
Harald Welte838ab632005-08-09 19:50:45 -07001487}
1488
1489static void *seq_next(struct seq_file *s, void *v, loff_t *pos)
1490{
1491 (*pos)++;
1492 return get_next(s, v);
1493}
1494
1495static void seq_stop(struct seq_file *s, void *v)
Gao fenge8179612013-03-24 23:50:47 +00001496 __releases(nfnl_queue_pernet(seq_file_net(s))->instances_lock)
Harald Welte838ab632005-08-09 19:50:45 -07001497{
Gao fenge8179612013-03-24 23:50:47 +00001498 spin_unlock(&nfnl_queue_pernet(seq_file_net(s))->instances_lock);
Harald Welte838ab632005-08-09 19:50:45 -07001499}
1500
1501static int seq_show(struct seq_file *s, void *v)
1502{
1503 const struct nfqnl_instance *inst = v;
1504
Richard Weinberger6b46f7b2015-04-13 00:52:38 +02001505 seq_printf(s, "%5u %6u %5u %1u %5u %5u %5u %8u %2d\n",
Steven Rostedt (Red Hat)e71456ae2014-10-27 17:43:45 -04001506 inst->queue_num,
1507 inst->peer_portid, inst->queue_total,
1508 inst->copy_mode, inst->copy_range,
1509 inst->queue_dropped, inst->queue_user_dropped,
1510 inst->id_sequence, 1);
Joe Perches861fb102015-05-12 18:28:23 -07001511 return 0;
Harald Welte838ab632005-08-09 19:50:45 -07001512}
1513
Philippe De Muyter56b3d972007-07-10 23:07:31 -07001514static const struct seq_operations nfqnl_seq_ops = {
Harald Welte838ab632005-08-09 19:50:45 -07001515 .start = seq_start,
1516 .next = seq_next,
1517 .stop = seq_stop,
1518 .show = seq_show,
1519};
Harald Welte838ab632005-08-09 19:50:45 -07001520#endif /* PROC_FS */
1521
Gao fenge8179612013-03-24 23:50:47 +00001522static int __net_init nfnl_queue_net_init(struct net *net)
Harald Welte7af4cc32005-08-09 19:44:15 -07001523{
Gao fenge8179612013-03-24 23:50:47 +00001524 unsigned int i;
1525 struct nfnl_queue_net *q = nfnl_queue_pernet(net);
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001526
Harald Welte838ab632005-08-09 19:50:45 -07001527 for (i = 0; i < INSTANCE_BUCKETS; i++)
Gao fenge8179612013-03-24 23:50:47 +00001528 INIT_HLIST_HEAD(&q->instance_table[i]);
1529
1530 spin_lock_init(&q->instances_lock);
1531
1532#ifdef CONFIG_PROC_FS
Christoph Hellwigc3506372018-04-10 19:42:55 +02001533 if (!proc_create_net("nfnetlink_queue", 0440, net->nf.proc_netfilter,
1534 &nfqnl_seq_ops, sizeof(struct iter_state)))
Gao fenge8179612013-03-24 23:50:47 +00001535 return -ENOMEM;
1536#endif
1537 return 0;
1538}
1539
1540static void __net_exit nfnl_queue_net_exit(struct net *net)
1541{
Vasily Averin613d0772017-11-12 14:32:37 +03001542 struct nfnl_queue_net *q = nfnl_queue_pernet(net);
1543 unsigned int i;
1544
Pablo Neira Ayusoe778f562013-04-30 08:01:18 +00001545#ifdef CONFIG_PROC_FS
Gao fenge8179612013-03-24 23:50:47 +00001546 remove_proc_entry("nfnetlink_queue", net->nf.proc_netfilter);
Pablo Neira Ayusoe778f562013-04-30 08:01:18 +00001547#endif
Vasily Averin613d0772017-11-12 14:32:37 +03001548 for (i = 0; i < INSTANCE_BUCKETS; i++)
1549 WARN_ON_ONCE(!hlist_empty(&q->instance_table[i]));
Gao fenge8179612013-03-24 23:50:47 +00001550}
1551
1552static struct pernet_operations nfnl_queue_net_ops = {
Eric W. Biedermandc3ee322016-05-13 21:18:52 -05001553 .init = nfnl_queue_net_init,
1554 .exit = nfnl_queue_net_exit,
Eric W. Biedermandc3ee322016-05-13 21:18:52 -05001555 .id = &nfnl_queue_net_id,
1556 .size = sizeof(struct nfnl_queue_net),
Gao fenge8179612013-03-24 23:50:47 +00001557};
1558
1559static int __init nfnetlink_queue_init(void)
1560{
Francesco Ruggeri3bfe0492015-05-17 14:30:31 -07001561 int status;
1562
1563 status = register_pernet_subsys(&nfnl_queue_net_ops);
1564 if (status < 0) {
Arushi Singhal5191d702018-03-12 18:36:29 +05301565 pr_err("failed to register pernet ops\n");
Francesco Ruggeri3bfe0492015-05-17 14:30:31 -07001566 goto out;
1567 }
Harald Welte838ab632005-08-09 19:50:45 -07001568
Harald Welte7af4cc32005-08-09 19:44:15 -07001569 netlink_register_notifier(&nfqnl_rtnl_notifier);
1570 status = nfnetlink_subsys_register(&nfqnl_subsys);
1571 if (status < 0) {
Arushi Singhal5191d702018-03-12 18:36:29 +05301572 pr_err("failed to create netlink socket\n");
Harald Welte7af4cc32005-08-09 19:44:15 -07001573 goto cleanup_netlink_notifier;
1574 }
1575
Gao Feng4e6577d2016-09-09 23:25:09 +08001576 status = register_netdevice_notifier(&nfqnl_dev_notifier);
1577 if (status < 0) {
Arushi Singhal5191d702018-03-12 18:36:29 +05301578 pr_err("failed to register netdevice notifier\n");
Gao Feng4e6577d2016-09-09 23:25:09 +08001579 goto cleanup_netlink_subsys;
1580 }
1581
Florian Westphal87029972021-08-05 12:02:43 +02001582 nf_register_queue_handler(&nfqh);
1583
Harald Welte7af4cc32005-08-09 19:44:15 -07001584 return status;
1585
Gao Feng4e6577d2016-09-09 23:25:09 +08001586cleanup_netlink_subsys:
1587 nfnetlink_subsys_unregister(&nfqnl_subsys);
Harald Welte7af4cc32005-08-09 19:44:15 -07001588cleanup_netlink_notifier:
1589 netlink_unregister_notifier(&nfqnl_rtnl_notifier);
Nikolay Borisov639e0772015-12-07 12:13:26 +02001590 unregister_pernet_subsys(&nfnl_queue_net_ops);
Francesco Ruggeri3bfe0492015-05-17 14:30:31 -07001591out:
Harald Welte7af4cc32005-08-09 19:44:15 -07001592 return status;
1593}
1594
Andrew Morton65b4b4e2006-03-28 16:37:06 -08001595static void __exit nfnetlink_queue_fini(void)
Harald Welte7af4cc32005-08-09 19:44:15 -07001596{
Florian Westphal87029972021-08-05 12:02:43 +02001597 nf_unregister_queue_handler();
Patrick McHardy32292a72006-04-06 14:11:30 -07001598 unregister_netdevice_notifier(&nfqnl_dev_notifier);
Patrick McHardy32292a72006-04-06 14:11:30 -07001599 nfnetlink_subsys_unregister(&nfqnl_subsys);
1600 netlink_unregister_notifier(&nfqnl_rtnl_notifier);
Francesco Ruggeri3bfe0492015-05-17 14:30:31 -07001601 unregister_pernet_subsys(&nfnl_queue_net_ops);
Jesper Dangaard Brouer67137f32009-06-08 03:11:33 +00001602
1603 rcu_barrier(); /* Wait for completion of call_rcu()'s */
Harald Welte7af4cc32005-08-09 19:44:15 -07001604}
1605
1606MODULE_DESCRIPTION("netfilter packet queue handler");
1607MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
1608MODULE_LICENSE("GPL");
1609MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_QUEUE);
1610
Andrew Morton65b4b4e2006-03-28 16:37:06 -08001611module_init(nfnetlink_queue_init);
1612module_exit(nfnetlink_queue_fini);