1 /* netfilter.c: look after the filters for various protocols. 2 * Heavily influenced by the old firewall.c by David Bonn and Alan Cox. 3 * 4 * Thanks to Rob `CmdrTaco' Malda for not influencing this code in any 5 * way. 6 * 7 * Rusty Russell (C)2000 -- This code is GPL. 8 * Patrick McHardy (c) 2006-2012 9 */ 10 #include <linux/kernel.h> 11 #include <linux/netfilter.h> 12 #include <net/protocol.h> 13 #include <linux/init.h> 14 #include <linux/skbuff.h> 15 #include <linux/wait.h> 16 #include <linux/module.h> 17 #include <linux/interrupt.h> 18 #include <linux/if.h> 19 #include <linux/netdevice.h> 20 #include <linux/netfilter_ipv6.h> 21 #include <linux/inetdevice.h> 22 #include <linux/proc_fs.h> 23 #include <linux/mutex.h> 24 #include <linux/slab.h> 25 #include <linux/rcupdate.h> 26 #include <net/net_namespace.h> 27 #include <net/sock.h> 28 29 #include "nf_internals.h" 30 31 static DEFINE_MUTEX(afinfo_mutex); 32 33 const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO] __read_mostly; 34 EXPORT_SYMBOL(nf_afinfo); 35 const struct nf_ipv6_ops __rcu *nf_ipv6_ops __read_mostly; 36 EXPORT_SYMBOL_GPL(nf_ipv6_ops); 37 38 DEFINE_PER_CPU(bool, nf_skb_duplicated); 39 EXPORT_SYMBOL_GPL(nf_skb_duplicated); 40 41 int nf_register_afinfo(const struct nf_afinfo *afinfo) 42 { 43 mutex_lock(&afinfo_mutex); 44 RCU_INIT_POINTER(nf_afinfo[afinfo->family], afinfo); 45 mutex_unlock(&afinfo_mutex); 46 return 0; 47 } 48 EXPORT_SYMBOL_GPL(nf_register_afinfo); 49 50 void nf_unregister_afinfo(const struct nf_afinfo *afinfo) 51 { 52 mutex_lock(&afinfo_mutex); 53 RCU_INIT_POINTER(nf_afinfo[afinfo->family], NULL); 54 mutex_unlock(&afinfo_mutex); 55 synchronize_rcu(); 56 } 57 EXPORT_SYMBOL_GPL(nf_unregister_afinfo); 58 59 #ifdef HAVE_JUMP_LABEL 60 struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS]; 61 EXPORT_SYMBOL(nf_hooks_needed); 62 #endif 63 64 static DEFINE_MUTEX(nf_hook_mutex); 65 #define nf_entry_dereference(e) \ 66 rcu_dereference_protected(e, lockdep_is_held(&nf_hook_mutex)) 67 68 static struct nf_hook_entry __rcu **nf_hook_entry_head(struct net *net, const struct nf_hook_ops *reg) 69 { 70 if (reg->pf != NFPROTO_NETDEV) 71 return net->nf.hooks[reg->pf]+reg->hooknum; 72 73 #ifdef CONFIG_NETFILTER_INGRESS 74 if (reg->hooknum == NF_NETDEV_INGRESS) { 75 if (reg->dev && dev_net(reg->dev) == net) 76 return ®->dev->nf_hooks_ingress; 77 } 78 #endif 79 return NULL; 80 } 81 82 int nf_register_net_hook(struct net *net, const struct nf_hook_ops *reg) 83 { 84 struct nf_hook_entry __rcu **pp; 85 struct nf_hook_entry *entry, *p; 86 87 if (reg->pf == NFPROTO_NETDEV) { 88 #ifndef CONFIG_NETFILTER_INGRESS 89 if (reg->hooknum == NF_NETDEV_INGRESS) 90 return -EOPNOTSUPP; 91 #endif 92 if (reg->hooknum != NF_NETDEV_INGRESS || 93 !reg->dev || dev_net(reg->dev) != net) 94 return -EINVAL; 95 } 96 97 pp = nf_hook_entry_head(net, reg); 98 if (!pp) 99 return -EINVAL; 100 101 entry = kmalloc(sizeof(*entry), GFP_KERNEL); 102 if (!entry) 103 return -ENOMEM; 104 105 nf_hook_entry_init(entry, reg); 106 107 mutex_lock(&nf_hook_mutex); 108 109 /* Find the spot in the list */ 110 for (; (p = nf_entry_dereference(*pp)) != NULL; pp = &p->next) { 111 if (reg->priority < nf_hook_entry_priority(p)) 112 break; 113 } 114 rcu_assign_pointer(entry->next, p); 115 rcu_assign_pointer(*pp, entry); 116 117 mutex_unlock(&nf_hook_mutex); 118 #ifdef CONFIG_NETFILTER_INGRESS 119 if (reg->pf == NFPROTO_NETDEV && reg->hooknum == NF_NETDEV_INGRESS) 120 net_inc_ingress_queue(); 121 #endif 122 #ifdef HAVE_JUMP_LABEL 123 static_key_slow_inc(&nf_hooks_needed[reg->pf][reg->hooknum]); 124 #endif 125 return 0; 126 } 127 EXPORT_SYMBOL(nf_register_net_hook); 128 129 void nf_unregister_net_hook(struct net *net, const struct nf_hook_ops *reg) 130 { 131 struct nf_hook_entry __rcu **pp; 132 struct nf_hook_entry *p; 133 134 pp = nf_hook_entry_head(net, reg); 135 if (WARN_ON_ONCE(!pp)) 136 return; 137 138 mutex_lock(&nf_hook_mutex); 139 for (; (p = nf_entry_dereference(*pp)) != NULL; pp = &p->next) { 140 if (nf_hook_entry_ops(p) == reg) { 141 rcu_assign_pointer(*pp, p->next); 142 break; 143 } 144 } 145 mutex_unlock(&nf_hook_mutex); 146 if (!p) { 147 WARN(1, "nf_unregister_net_hook: hook not found!\n"); 148 return; 149 } 150 #ifdef CONFIG_NETFILTER_INGRESS 151 if (reg->pf == NFPROTO_NETDEV && reg->hooknum == NF_NETDEV_INGRESS) 152 net_dec_ingress_queue(); 153 #endif 154 #ifdef HAVE_JUMP_LABEL 155 static_key_slow_dec(&nf_hooks_needed[reg->pf][reg->hooknum]); 156 #endif 157 synchronize_net(); 158 nf_queue_nf_hook_drop(net, p); 159 /* other cpu might still process nfqueue verdict that used reg */ 160 synchronize_net(); 161 kfree(p); 162 } 163 EXPORT_SYMBOL(nf_unregister_net_hook); 164 165 int nf_register_net_hooks(struct net *net, const struct nf_hook_ops *reg, 166 unsigned int n) 167 { 168 unsigned int i; 169 int err = 0; 170 171 for (i = 0; i < n; i++) { 172 err = nf_register_net_hook(net, ®[i]); 173 if (err) 174 goto err; 175 } 176 return err; 177 178 err: 179 if (i > 0) 180 nf_unregister_net_hooks(net, reg, i); 181 return err; 182 } 183 EXPORT_SYMBOL(nf_register_net_hooks); 184 185 void nf_unregister_net_hooks(struct net *net, const struct nf_hook_ops *reg, 186 unsigned int n) 187 { 188 while (n-- > 0) 189 nf_unregister_net_hook(net, ®[n]); 190 } 191 EXPORT_SYMBOL(nf_unregister_net_hooks); 192 193 static LIST_HEAD(nf_hook_list); 194 195 static int _nf_register_hook(struct nf_hook_ops *reg) 196 { 197 struct net *net, *last; 198 int ret; 199 200 for_each_net(net) { 201 ret = nf_register_net_hook(net, reg); 202 if (ret && ret != -ENOENT) 203 goto rollback; 204 } 205 list_add_tail(®->list, &nf_hook_list); 206 207 return 0; 208 rollback: 209 last = net; 210 for_each_net(net) { 211 if (net == last) 212 break; 213 nf_unregister_net_hook(net, reg); 214 } 215 return ret; 216 } 217 218 int nf_register_hook(struct nf_hook_ops *reg) 219 { 220 int ret; 221 222 rtnl_lock(); 223 ret = _nf_register_hook(reg); 224 rtnl_unlock(); 225 226 return ret; 227 } 228 EXPORT_SYMBOL(nf_register_hook); 229 230 static void _nf_unregister_hook(struct nf_hook_ops *reg) 231 { 232 struct net *net; 233 234 list_del(®->list); 235 for_each_net(net) 236 nf_unregister_net_hook(net, reg); 237 } 238 239 void nf_unregister_hook(struct nf_hook_ops *reg) 240 { 241 rtnl_lock(); 242 _nf_unregister_hook(reg); 243 rtnl_unlock(); 244 } 245 EXPORT_SYMBOL(nf_unregister_hook); 246 247 int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n) 248 { 249 unsigned int i; 250 int err = 0; 251 252 for (i = 0; i < n; i++) { 253 err = nf_register_hook(®[i]); 254 if (err) 255 goto err; 256 } 257 return err; 258 259 err: 260 if (i > 0) 261 nf_unregister_hooks(reg, i); 262 return err; 263 } 264 EXPORT_SYMBOL(nf_register_hooks); 265 266 /* Caller MUST take rtnl_lock() */ 267 int _nf_register_hooks(struct nf_hook_ops *reg, unsigned int n) 268 { 269 unsigned int i; 270 int err = 0; 271 272 for (i = 0; i < n; i++) { 273 err = _nf_register_hook(®[i]); 274 if (err) 275 goto err; 276 } 277 return err; 278 279 err: 280 if (i > 0) 281 _nf_unregister_hooks(reg, i); 282 return err; 283 } 284 EXPORT_SYMBOL(_nf_register_hooks); 285 286 void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n) 287 { 288 while (n-- > 0) 289 nf_unregister_hook(®[n]); 290 } 291 EXPORT_SYMBOL(nf_unregister_hooks); 292 293 /* Caller MUST take rtnl_lock */ 294 void _nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n) 295 { 296 while (n-- > 0) 297 _nf_unregister_hook(®[n]); 298 } 299 EXPORT_SYMBOL(_nf_unregister_hooks); 300 301 /* Returns 1 if okfn() needs to be executed by the caller, 302 * -EPERM for NF_DROP, 0 otherwise. Caller must hold rcu_read_lock. */ 303 int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state, 304 struct nf_hook_entry *entry) 305 { 306 unsigned int verdict; 307 int ret; 308 309 do { 310 verdict = nf_hook_entry_hookfn(entry, skb, state); 311 switch (verdict & NF_VERDICT_MASK) { 312 case NF_ACCEPT: 313 entry = rcu_dereference(entry->next); 314 break; 315 case NF_DROP: 316 kfree_skb(skb); 317 ret = NF_DROP_GETERR(verdict); 318 if (ret == 0) 319 ret = -EPERM; 320 return ret; 321 case NF_QUEUE: 322 ret = nf_queue(skb, state, &entry, verdict); 323 if (ret == 1 && entry) 324 continue; 325 return ret; 326 default: 327 /* Implicit handling for NF_STOLEN, as well as any other 328 * non conventional verdicts. 329 */ 330 return 0; 331 } 332 } while (entry); 333 334 return 1; 335 } 336 EXPORT_SYMBOL(nf_hook_slow); 337 338 339 int skb_make_writable(struct sk_buff *skb, unsigned int writable_len) 340 { 341 if (writable_len > skb->len) 342 return 0; 343 344 /* Not exclusive use of packet? Must copy. */ 345 if (!skb_cloned(skb)) { 346 if (writable_len <= skb_headlen(skb)) 347 return 1; 348 } else if (skb_clone_writable(skb, writable_len)) 349 return 1; 350 351 if (writable_len <= skb_headlen(skb)) 352 writable_len = 0; 353 else 354 writable_len -= skb_headlen(skb); 355 356 return !!__pskb_pull_tail(skb, writable_len); 357 } 358 EXPORT_SYMBOL(skb_make_writable); 359 360 /* This needs to be compiled in any case to avoid dependencies between the 361 * nfnetlink_queue code and nf_conntrack. 362 */ 363 struct nfnl_ct_hook __rcu *nfnl_ct_hook __read_mostly; 364 EXPORT_SYMBOL_GPL(nfnl_ct_hook); 365 366 #if IS_ENABLED(CONFIG_NF_CONNTRACK) 367 /* This does not belong here, but locally generated errors need it if connection 368 tracking in use: without this, connection may not be in hash table, and hence 369 manufactured ICMP or RST packets will not be associated with it. */ 370 void (*ip_ct_attach)(struct sk_buff *, const struct sk_buff *) 371 __rcu __read_mostly; 372 EXPORT_SYMBOL(ip_ct_attach); 373 374 void nf_ct_attach(struct sk_buff *new, const struct sk_buff *skb) 375 { 376 void (*attach)(struct sk_buff *, const struct sk_buff *); 377 378 if (skb->_nfct) { 379 rcu_read_lock(); 380 attach = rcu_dereference(ip_ct_attach); 381 if (attach) 382 attach(new, skb); 383 rcu_read_unlock(); 384 } 385 } 386 EXPORT_SYMBOL(nf_ct_attach); 387 388 void (*nf_ct_destroy)(struct nf_conntrack *) __rcu __read_mostly; 389 EXPORT_SYMBOL(nf_ct_destroy); 390 391 void nf_conntrack_destroy(struct nf_conntrack *nfct) 392 { 393 void (*destroy)(struct nf_conntrack *); 394 395 rcu_read_lock(); 396 destroy = rcu_dereference(nf_ct_destroy); 397 BUG_ON(destroy == NULL); 398 destroy(nfct); 399 rcu_read_unlock(); 400 } 401 EXPORT_SYMBOL(nf_conntrack_destroy); 402 403 /* Built-in default zone used e.g. by modules. */ 404 const struct nf_conntrack_zone nf_ct_zone_dflt = { 405 .id = NF_CT_DEFAULT_ZONE_ID, 406 .dir = NF_CT_DEFAULT_ZONE_DIR, 407 }; 408 EXPORT_SYMBOL_GPL(nf_ct_zone_dflt); 409 #endif /* CONFIG_NF_CONNTRACK */ 410 411 #ifdef CONFIG_NF_NAT_NEEDED 412 void (*nf_nat_decode_session_hook)(struct sk_buff *, struct flowi *); 413 EXPORT_SYMBOL(nf_nat_decode_session_hook); 414 #endif 415 416 static int nf_register_hook_list(struct net *net) 417 { 418 struct nf_hook_ops *elem; 419 int ret; 420 421 rtnl_lock(); 422 list_for_each_entry(elem, &nf_hook_list, list) { 423 ret = nf_register_net_hook(net, elem); 424 if (ret && ret != -ENOENT) 425 goto out_undo; 426 } 427 rtnl_unlock(); 428 return 0; 429 430 out_undo: 431 list_for_each_entry_continue_reverse(elem, &nf_hook_list, list) 432 nf_unregister_net_hook(net, elem); 433 rtnl_unlock(); 434 return ret; 435 } 436 437 static void nf_unregister_hook_list(struct net *net) 438 { 439 struct nf_hook_ops *elem; 440 441 rtnl_lock(); 442 list_for_each_entry(elem, &nf_hook_list, list) 443 nf_unregister_net_hook(net, elem); 444 rtnl_unlock(); 445 } 446 447 static int __net_init netfilter_net_init(struct net *net) 448 { 449 int i, h, ret; 450 451 for (i = 0; i < ARRAY_SIZE(net->nf.hooks); i++) { 452 for (h = 0; h < NF_MAX_HOOKS; h++) 453 RCU_INIT_POINTER(net->nf.hooks[i][h], NULL); 454 } 455 456 #ifdef CONFIG_PROC_FS 457 net->nf.proc_netfilter = proc_net_mkdir(net, "netfilter", 458 net->proc_net); 459 if (!net->nf.proc_netfilter) { 460 if (!net_eq(net, &init_net)) 461 pr_err("cannot create netfilter proc entry"); 462 463 return -ENOMEM; 464 } 465 #endif 466 ret = nf_register_hook_list(net); 467 if (ret) 468 remove_proc_entry("netfilter", net->proc_net); 469 470 return ret; 471 } 472 473 static void __net_exit netfilter_net_exit(struct net *net) 474 { 475 nf_unregister_hook_list(net); 476 remove_proc_entry("netfilter", net->proc_net); 477 } 478 479 static struct pernet_operations netfilter_net_ops = { 480 .init = netfilter_net_init, 481 .exit = netfilter_net_exit, 482 }; 483 484 int __init netfilter_init(void) 485 { 486 int ret; 487 488 ret = register_pernet_subsys(&netfilter_net_ops); 489 if (ret < 0) 490 goto err; 491 492 ret = netfilter_log_init(); 493 if (ret < 0) 494 goto err_pernet; 495 496 return 0; 497 err_pernet: 498 unregister_pernet_subsys(&netfilter_net_ops); 499 err: 500 return ret; 501 } 502