1 /* License: GPL */ 2 3 #include <linux/mutex.h> 4 #include <linux/socket.h> 5 #include <linux/skbuff.h> 6 #include <net/netlink.h> 7 #include <net/net_namespace.h> 8 #include <linux/module.h> 9 #include <net/sock.h> 10 #include <linux/kernel.h> 11 #include <linux/tcp.h> 12 #include <linux/workqueue.h> 13 14 #include <linux/inet_diag.h> 15 #include <linux/sock_diag.h> 16 17 static const struct sock_diag_handler *sock_diag_handlers[AF_MAX]; 18 static int (*inet_rcv_compat)(struct sk_buff *skb, struct nlmsghdr *nlh); 19 static DEFINE_MUTEX(sock_diag_table_mutex); 20 static struct workqueue_struct *broadcast_wq; 21 22 u64 sock_gen_cookie(struct sock *sk) 23 { 24 while (1) { 25 u64 res = atomic64_read(&sk->sk_cookie); 26 27 if (res) 28 return res; 29 res = atomic64_inc_return(&sock_net(sk)->cookie_gen); 30 atomic64_cmpxchg(&sk->sk_cookie, 0, res); 31 } 32 } 33 34 int sock_diag_check_cookie(struct sock *sk, const __u32 *cookie) 35 { 36 u64 res; 37 38 if (cookie[0] == INET_DIAG_NOCOOKIE && cookie[1] == INET_DIAG_NOCOOKIE) 39 return 0; 40 41 res = sock_gen_cookie(sk); 42 if ((u32)res != cookie[0] || (u32)(res >> 32) != cookie[1]) 43 return -ESTALE; 44 45 return 0; 46 } 47 EXPORT_SYMBOL_GPL(sock_diag_check_cookie); 48 49 void sock_diag_save_cookie(struct sock *sk, __u32 *cookie) 50 { 51 u64 res = sock_gen_cookie(sk); 52 53 cookie[0] = (u32)res; 54 cookie[1] = (u32)(res >> 32); 55 } 56 EXPORT_SYMBOL_GPL(sock_diag_save_cookie); 57 58 int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attrtype) 59 { 60 u32 mem[SK_MEMINFO_VARS]; 61 62 sk_get_meminfo(sk, mem); 63 64 return nla_put(skb, attrtype, sizeof(mem), &mem); 65 } 66 EXPORT_SYMBOL_GPL(sock_diag_put_meminfo); 67 68 int sock_diag_put_filterinfo(bool may_report_filterinfo, struct sock *sk, 69 struct sk_buff *skb, int attrtype) 70 { 71 struct sock_fprog_kern *fprog; 72 struct sk_filter *filter; 73 struct nlattr *attr; 74 unsigned int flen; 75 int err = 0; 76 77 if (!may_report_filterinfo) { 78 nla_reserve(skb, attrtype, 0); 79 return 0; 80 } 81 82 rcu_read_lock(); 83 filter = rcu_dereference(sk->sk_filter); 84 if (!filter) 85 goto out; 86 87 fprog = filter->prog->orig_prog; 88 if (!fprog) 89 goto out; 90 91 flen = bpf_classic_proglen(fprog); 92 93 attr = nla_reserve(skb, attrtype, flen); 94 if (attr == NULL) { 95 err = -EMSGSIZE; 96 goto out; 97 } 98 99 memcpy(nla_data(attr), fprog->filter, flen); 100 out: 101 rcu_read_unlock(); 102 return err; 103 } 104 EXPORT_SYMBOL(sock_diag_put_filterinfo); 105 106 struct broadcast_sk { 107 struct sock *sk; 108 struct work_struct work; 109 }; 110 111 static size_t sock_diag_nlmsg_size(void) 112 { 113 return NLMSG_ALIGN(sizeof(struct inet_diag_msg) 114 + nla_total_size(sizeof(u8)) /* INET_DIAG_PROTOCOL */ 115 + nla_total_size_64bit(sizeof(struct tcp_info))); /* INET_DIAG_INFO */ 116 } 117 118 static void sock_diag_broadcast_destroy_work(struct work_struct *work) 119 { 120 struct broadcast_sk *bsk = 121 container_of(work, struct broadcast_sk, work); 122 struct sock *sk = bsk->sk; 123 const struct sock_diag_handler *hndl; 124 struct sk_buff *skb; 125 const enum sknetlink_groups group = sock_diag_destroy_group(sk); 126 int err = -1; 127 128 WARN_ON(group == SKNLGRP_NONE); 129 130 skb = nlmsg_new(sock_diag_nlmsg_size(), GFP_KERNEL); 131 if (!skb) 132 goto out; 133 134 mutex_lock(&sock_diag_table_mutex); 135 hndl = sock_diag_handlers[sk->sk_family]; 136 if (hndl && hndl->get_info) 137 err = hndl->get_info(skb, sk); 138 mutex_unlock(&sock_diag_table_mutex); 139 140 if (!err) 141 nlmsg_multicast(sock_net(sk)->diag_nlsk, skb, 0, group, 142 GFP_KERNEL); 143 else 144 kfree_skb(skb); 145 out: 146 sk_destruct(sk); 147 kfree(bsk); 148 } 149 150 void sock_diag_broadcast_destroy(struct sock *sk) 151 { 152 /* Note, this function is often called from an interrupt context. */ 153 struct broadcast_sk *bsk = 154 kmalloc(sizeof(struct broadcast_sk), GFP_ATOMIC); 155 if (!bsk) 156 return sk_destruct(sk); 157 bsk->sk = sk; 158 INIT_WORK(&bsk->work, sock_diag_broadcast_destroy_work); 159 queue_work(broadcast_wq, &bsk->work); 160 } 161 162 void sock_diag_register_inet_compat(int (*fn)(struct sk_buff *skb, struct nlmsghdr *nlh)) 163 { 164 mutex_lock(&sock_diag_table_mutex); 165 inet_rcv_compat = fn; 166 mutex_unlock(&sock_diag_table_mutex); 167 } 168 EXPORT_SYMBOL_GPL(sock_diag_register_inet_compat); 169 170 void sock_diag_unregister_inet_compat(int (*fn)(struct sk_buff *skb, struct nlmsghdr *nlh)) 171 { 172 mutex_lock(&sock_diag_table_mutex); 173 inet_rcv_compat = NULL; 174 mutex_unlock(&sock_diag_table_mutex); 175 } 176 EXPORT_SYMBOL_GPL(sock_diag_unregister_inet_compat); 177 178 int sock_diag_register(const struct sock_diag_handler *hndl) 179 { 180 int err = 0; 181 182 if (hndl->family >= AF_MAX) 183 return -EINVAL; 184 185 mutex_lock(&sock_diag_table_mutex); 186 if (sock_diag_handlers[hndl->family]) 187 err = -EBUSY; 188 else 189 sock_diag_handlers[hndl->family] = hndl; 190 mutex_unlock(&sock_diag_table_mutex); 191 192 return err; 193 } 194 EXPORT_SYMBOL_GPL(sock_diag_register); 195 196 void sock_diag_unregister(const struct sock_diag_handler *hnld) 197 { 198 int family = hnld->family; 199 200 if (family >= AF_MAX) 201 return; 202 203 mutex_lock(&sock_diag_table_mutex); 204 BUG_ON(sock_diag_handlers[family] != hnld); 205 sock_diag_handlers[family] = NULL; 206 mutex_unlock(&sock_diag_table_mutex); 207 } 208 EXPORT_SYMBOL_GPL(sock_diag_unregister); 209 210 static int __sock_diag_cmd(struct sk_buff *skb, struct nlmsghdr *nlh) 211 { 212 int err; 213 struct sock_diag_req *req = nlmsg_data(nlh); 214 const struct sock_diag_handler *hndl; 215 216 if (nlmsg_len(nlh) < sizeof(*req)) 217 return -EINVAL; 218 219 if (req->sdiag_family >= AF_MAX) 220 return -EINVAL; 221 222 if (sock_diag_handlers[req->sdiag_family] == NULL) 223 sock_load_diag_module(req->sdiag_family, 0); 224 225 mutex_lock(&sock_diag_table_mutex); 226 hndl = sock_diag_handlers[req->sdiag_family]; 227 if (hndl == NULL) 228 err = -ENOENT; 229 else if (nlh->nlmsg_type == SOCK_DIAG_BY_FAMILY) 230 err = hndl->dump(skb, nlh); 231 else if (nlh->nlmsg_type == SOCK_DESTROY && hndl->destroy) 232 err = hndl->destroy(skb, nlh); 233 else 234 err = -EOPNOTSUPP; 235 mutex_unlock(&sock_diag_table_mutex); 236 237 return err; 238 } 239 240 static int sock_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, 241 struct netlink_ext_ack *extack) 242 { 243 int ret; 244 245 switch (nlh->nlmsg_type) { 246 case TCPDIAG_GETSOCK: 247 case DCCPDIAG_GETSOCK: 248 if (inet_rcv_compat == NULL) 249 sock_load_diag_module(AF_INET, 0); 250 251 mutex_lock(&sock_diag_table_mutex); 252 if (inet_rcv_compat != NULL) 253 ret = inet_rcv_compat(skb, nlh); 254 else 255 ret = -EOPNOTSUPP; 256 mutex_unlock(&sock_diag_table_mutex); 257 258 return ret; 259 case SOCK_DIAG_BY_FAMILY: 260 case SOCK_DESTROY: 261 return __sock_diag_cmd(skb, nlh); 262 default: 263 return -EINVAL; 264 } 265 } 266 267 static DEFINE_MUTEX(sock_diag_mutex); 268 269 static void sock_diag_rcv(struct sk_buff *skb) 270 { 271 mutex_lock(&sock_diag_mutex); 272 netlink_rcv_skb(skb, &sock_diag_rcv_msg); 273 mutex_unlock(&sock_diag_mutex); 274 } 275 276 static int sock_diag_bind(struct net *net, int group) 277 { 278 switch (group) { 279 case SKNLGRP_INET_TCP_DESTROY: 280 case SKNLGRP_INET_UDP_DESTROY: 281 if (!sock_diag_handlers[AF_INET]) 282 sock_load_diag_module(AF_INET, 0); 283 break; 284 case SKNLGRP_INET6_TCP_DESTROY: 285 case SKNLGRP_INET6_UDP_DESTROY: 286 if (!sock_diag_handlers[AF_INET6]) 287 sock_load_diag_module(AF_INET6, 0); 288 break; 289 } 290 return 0; 291 } 292 293 int sock_diag_destroy(struct sock *sk, int err) 294 { 295 if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) 296 return -EPERM; 297 298 if (!sk->sk_prot->diag_destroy) 299 return -EOPNOTSUPP; 300 301 return sk->sk_prot->diag_destroy(sk, err); 302 } 303 EXPORT_SYMBOL_GPL(sock_diag_destroy); 304 305 static int __net_init diag_net_init(struct net *net) 306 { 307 struct netlink_kernel_cfg cfg = { 308 .groups = SKNLGRP_MAX, 309 .input = sock_diag_rcv, 310 .bind = sock_diag_bind, 311 .flags = NL_CFG_F_NONROOT_RECV, 312 }; 313 314 net->diag_nlsk = netlink_kernel_create(net, NETLINK_SOCK_DIAG, &cfg); 315 return net->diag_nlsk == NULL ? -ENOMEM : 0; 316 } 317 318 static void __net_exit diag_net_exit(struct net *net) 319 { 320 netlink_kernel_release(net->diag_nlsk); 321 net->diag_nlsk = NULL; 322 } 323 324 static struct pernet_operations diag_net_ops = { 325 .init = diag_net_init, 326 .exit = diag_net_exit, 327 }; 328 329 static int __init sock_diag_init(void) 330 { 331 broadcast_wq = alloc_workqueue("sock_diag_events", 0, 0); 332 BUG_ON(!broadcast_wq); 333 return register_pernet_subsys(&diag_net_ops); 334 } 335 device_initcall(sock_diag_init); 336