1 /* License: GPL */ 2 3 #include <linux/mutex.h> 4 #include <linux/socket.h> 5 #include <linux/skbuff.h> 6 #include <net/netlink.h> 7 #include <net/net_namespace.h> 8 #include <linux/module.h> 9 #include <net/sock.h> 10 #include <linux/kernel.h> 11 #include <linux/tcp.h> 12 #include <linux/workqueue.h> 13 14 #include <linux/inet_diag.h> 15 #include <linux/sock_diag.h> 16 17 static const struct sock_diag_handler *sock_diag_handlers[AF_MAX]; 18 static int (*inet_rcv_compat)(struct sk_buff *skb, struct nlmsghdr *nlh); 19 static DEFINE_MUTEX(sock_diag_table_mutex); 20 static struct workqueue_struct *broadcast_wq; 21 22 u64 sock_gen_cookie(struct sock *sk) 23 { 24 while (1) { 25 u64 res = atomic64_read(&sk->sk_cookie); 26 27 if (res) 28 return res; 29 res = atomic64_inc_return(&sock_net(sk)->cookie_gen); 30 atomic64_cmpxchg(&sk->sk_cookie, 0, res); 31 } 32 } 33 34 int sock_diag_check_cookie(struct sock *sk, const __u32 *cookie) 35 { 36 u64 res; 37 38 if (cookie[0] == INET_DIAG_NOCOOKIE && cookie[1] == INET_DIAG_NOCOOKIE) 39 return 0; 40 41 res = sock_gen_cookie(sk); 42 if ((u32)res != cookie[0] || (u32)(res >> 32) != cookie[1]) 43 return -ESTALE; 44 45 return 0; 46 } 47 EXPORT_SYMBOL_GPL(sock_diag_check_cookie); 48 49 void sock_diag_save_cookie(struct sock *sk, __u32 *cookie) 50 { 51 u64 res = sock_gen_cookie(sk); 52 53 cookie[0] = (u32)res; 54 cookie[1] = (u32)(res >> 32); 55 } 56 EXPORT_SYMBOL_GPL(sock_diag_save_cookie); 57 58 int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attrtype) 59 { 60 u32 mem[SK_MEMINFO_VARS]; 61 62 sk_get_meminfo(sk, mem); 63 64 return nla_put(skb, attrtype, sizeof(mem), &mem); 65 } 66 EXPORT_SYMBOL_GPL(sock_diag_put_meminfo); 67 68 int sock_diag_put_filterinfo(bool may_report_filterinfo, struct sock *sk, 69 struct sk_buff *skb, int attrtype) 70 { 71 struct sock_fprog_kern *fprog; 72 struct sk_filter *filter; 73 struct nlattr *attr; 74 unsigned int flen; 75 int err = 0; 76 77 if (!may_report_filterinfo) { 78 nla_reserve(skb, attrtype, 0); 79 return 0; 80 } 81 82 rcu_read_lock(); 83 filter = rcu_dereference(sk->sk_filter); 84 if (!filter) 85 goto out; 86 87 fprog = filter->prog->orig_prog; 88 if (!fprog) 89 goto out; 90 91 flen = bpf_classic_proglen(fprog); 92 93 attr = nla_reserve(skb, attrtype, flen); 94 if (attr == NULL) { 95 err = -EMSGSIZE; 96 goto out; 97 } 98 99 memcpy(nla_data(attr), fprog->filter, flen); 100 out: 101 rcu_read_unlock(); 102 return err; 103 } 104 EXPORT_SYMBOL(sock_diag_put_filterinfo); 105 106 struct broadcast_sk { 107 struct sock *sk; 108 struct work_struct work; 109 }; 110 111 static size_t sock_diag_nlmsg_size(void) 112 { 113 return NLMSG_ALIGN(sizeof(struct inet_diag_msg) 114 + nla_total_size(sizeof(u8)) /* INET_DIAG_PROTOCOL */ 115 + nla_total_size_64bit(sizeof(struct tcp_info))); /* INET_DIAG_INFO */ 116 } 117 118 static void sock_diag_broadcast_destroy_work(struct work_struct *work) 119 { 120 struct broadcast_sk *bsk = 121 container_of(work, struct broadcast_sk, work); 122 struct sock *sk = bsk->sk; 123 const struct sock_diag_handler *hndl; 124 struct sk_buff *skb; 125 const enum sknetlink_groups group = sock_diag_destroy_group(sk); 126 int err = -1; 127 128 WARN_ON(group == SKNLGRP_NONE); 129 130 skb = nlmsg_new(sock_diag_nlmsg_size(), GFP_KERNEL); 131 if (!skb) 132 goto out; 133 134 mutex_lock(&sock_diag_table_mutex); 135 hndl = sock_diag_handlers[sk->sk_family]; 136 if (hndl && hndl->get_info) 137 err = hndl->get_info(skb, sk); 138 mutex_unlock(&sock_diag_table_mutex); 139 140 if (!err) 141 nlmsg_multicast(sock_net(sk)->diag_nlsk, skb, 0, group, 142 GFP_KERNEL); 143 else 144 kfree_skb(skb); 145 out: 146 sk_destruct(sk); 147 kfree(bsk); 148 } 149 150 void sock_diag_broadcast_destroy(struct sock *sk) 151 { 152 /* Note, this function is often called from an interrupt context. */ 153 struct broadcast_sk *bsk = 154 kmalloc(sizeof(struct broadcast_sk), GFP_ATOMIC); 155 if (!bsk) 156 return sk_destruct(sk); 157 bsk->sk = sk; 158 INIT_WORK(&bsk->work, sock_diag_broadcast_destroy_work); 159 queue_work(broadcast_wq, &bsk->work); 160 } 161 162 void sock_diag_register_inet_compat(int (*fn)(struct sk_buff *skb, struct nlmsghdr *nlh)) 163 { 164 mutex_lock(&sock_diag_table_mutex); 165 inet_rcv_compat = fn; 166 mutex_unlock(&sock_diag_table_mutex); 167 } 168 EXPORT_SYMBOL_GPL(sock_diag_register_inet_compat); 169 170 void sock_diag_unregister_inet_compat(int (*fn)(struct sk_buff *skb, struct nlmsghdr *nlh)) 171 { 172 mutex_lock(&sock_diag_table_mutex); 173 inet_rcv_compat = NULL; 174 mutex_unlock(&sock_diag_table_mutex); 175 } 176 EXPORT_SYMBOL_GPL(sock_diag_unregister_inet_compat); 177 178 int sock_diag_register(const struct sock_diag_handler *hndl) 179 { 180 int err = 0; 181 182 if (hndl->family >= AF_MAX) 183 return -EINVAL; 184 185 mutex_lock(&sock_diag_table_mutex); 186 if (sock_diag_handlers[hndl->family]) 187 err = -EBUSY; 188 else 189 sock_diag_handlers[hndl->family] = hndl; 190 mutex_unlock(&sock_diag_table_mutex); 191 192 return err; 193 } 194 EXPORT_SYMBOL_GPL(sock_diag_register); 195 196 void sock_diag_unregister(const struct sock_diag_handler *hnld) 197 { 198 int family = hnld->family; 199 200 if (family >= AF_MAX) 201 return; 202 203 mutex_lock(&sock_diag_table_mutex); 204 BUG_ON(sock_diag_handlers[family] != hnld); 205 sock_diag_handlers[family] = NULL; 206 mutex_unlock(&sock_diag_table_mutex); 207 } 208 EXPORT_SYMBOL_GPL(sock_diag_unregister); 209 210 static int __sock_diag_cmd(struct sk_buff *skb, struct nlmsghdr *nlh) 211 { 212 int err; 213 struct sock_diag_req *req = nlmsg_data(nlh); 214 const struct sock_diag_handler *hndl; 215 216 if (nlmsg_len(nlh) < sizeof(*req)) 217 return -EINVAL; 218 219 if (req->sdiag_family >= AF_MAX) 220 return -EINVAL; 221 222 if (sock_diag_handlers[req->sdiag_family] == NULL) 223 request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK, 224 NETLINK_SOCK_DIAG, req->sdiag_family); 225 226 mutex_lock(&sock_diag_table_mutex); 227 hndl = sock_diag_handlers[req->sdiag_family]; 228 if (hndl == NULL) 229 err = -ENOENT; 230 else if (nlh->nlmsg_type == SOCK_DIAG_BY_FAMILY) 231 err = hndl->dump(skb, nlh); 232 else if (nlh->nlmsg_type == SOCK_DESTROY && hndl->destroy) 233 err = hndl->destroy(skb, nlh); 234 else 235 err = -EOPNOTSUPP; 236 mutex_unlock(&sock_diag_table_mutex); 237 238 return err; 239 } 240 241 static int sock_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, 242 struct netlink_ext_ack *extack) 243 { 244 int ret; 245 246 switch (nlh->nlmsg_type) { 247 case TCPDIAG_GETSOCK: 248 case DCCPDIAG_GETSOCK: 249 if (inet_rcv_compat == NULL) 250 request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK, 251 NETLINK_SOCK_DIAG, AF_INET); 252 253 mutex_lock(&sock_diag_table_mutex); 254 if (inet_rcv_compat != NULL) 255 ret = inet_rcv_compat(skb, nlh); 256 else 257 ret = -EOPNOTSUPP; 258 mutex_unlock(&sock_diag_table_mutex); 259 260 return ret; 261 case SOCK_DIAG_BY_FAMILY: 262 case SOCK_DESTROY: 263 return __sock_diag_cmd(skb, nlh); 264 default: 265 return -EINVAL; 266 } 267 } 268 269 static DEFINE_MUTEX(sock_diag_mutex); 270 271 static void sock_diag_rcv(struct sk_buff *skb) 272 { 273 mutex_lock(&sock_diag_mutex); 274 netlink_rcv_skb(skb, &sock_diag_rcv_msg); 275 mutex_unlock(&sock_diag_mutex); 276 } 277 278 static int sock_diag_bind(struct net *net, int group) 279 { 280 switch (group) { 281 case SKNLGRP_INET_TCP_DESTROY: 282 case SKNLGRP_INET_UDP_DESTROY: 283 if (!sock_diag_handlers[AF_INET]) 284 request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK, 285 NETLINK_SOCK_DIAG, AF_INET); 286 break; 287 case SKNLGRP_INET6_TCP_DESTROY: 288 case SKNLGRP_INET6_UDP_DESTROY: 289 if (!sock_diag_handlers[AF_INET6]) 290 request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK, 291 NETLINK_SOCK_DIAG, AF_INET); 292 break; 293 } 294 return 0; 295 } 296 297 int sock_diag_destroy(struct sock *sk, int err) 298 { 299 if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) 300 return -EPERM; 301 302 if (!sk->sk_prot->diag_destroy) 303 return -EOPNOTSUPP; 304 305 return sk->sk_prot->diag_destroy(sk, err); 306 } 307 EXPORT_SYMBOL_GPL(sock_diag_destroy); 308 309 static int __net_init diag_net_init(struct net *net) 310 { 311 struct netlink_kernel_cfg cfg = { 312 .groups = SKNLGRP_MAX, 313 .input = sock_diag_rcv, 314 .bind = sock_diag_bind, 315 .flags = NL_CFG_F_NONROOT_RECV, 316 }; 317 318 net->diag_nlsk = netlink_kernel_create(net, NETLINK_SOCK_DIAG, &cfg); 319 return net->diag_nlsk == NULL ? -ENOMEM : 0; 320 } 321 322 static void __net_exit diag_net_exit(struct net *net) 323 { 324 netlink_kernel_release(net->diag_nlsk); 325 net->diag_nlsk = NULL; 326 } 327 328 static struct pernet_operations diag_net_ops = { 329 .init = diag_net_init, 330 .exit = diag_net_exit, 331 }; 332 333 static int __init sock_diag_init(void) 334 { 335 broadcast_wq = alloc_workqueue("sock_diag_events", 0, 0); 336 BUG_ON(!broadcast_wq); 337 return register_pernet_subsys(&diag_net_ops); 338 } 339 device_initcall(sock_diag_init); 340