1 /* netfilter.c: look after the filters for various protocols. 2 * Heavily influenced by the old firewall.c by David Bonn and Alan Cox. 3 * 4 * Thanks to Rob `CmdrTaco' Malda for not influencing this code in any 5 * way. 6 * 7 * Rusty Russell (C)2000 -- This code is GPL. 8 * Patrick McHardy (c) 2006-2012 9 */ 10 #include <linux/kernel.h> 11 #include <linux/netfilter.h> 12 #include <net/protocol.h> 13 #include <linux/init.h> 14 #include <linux/skbuff.h> 15 #include <linux/wait.h> 16 #include <linux/module.h> 17 #include <linux/interrupt.h> 18 #include <linux/if.h> 19 #include <linux/netdevice.h> 20 #include <linux/netfilter_ipv6.h> 21 #include <linux/inetdevice.h> 22 #include <linux/proc_fs.h> 23 #include <linux/mutex.h> 24 #include <linux/slab.h> 25 #include <linux/rcupdate.h> 26 #include <net/net_namespace.h> 27 #include <net/sock.h> 28 29 #include "nf_internals.h" 30 31 static DEFINE_MUTEX(afinfo_mutex); 32 33 const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO] __read_mostly; 34 EXPORT_SYMBOL(nf_afinfo); 35 const struct nf_ipv6_ops __rcu *nf_ipv6_ops __read_mostly; 36 EXPORT_SYMBOL_GPL(nf_ipv6_ops); 37 38 DEFINE_PER_CPU(bool, nf_skb_duplicated); 39 EXPORT_SYMBOL_GPL(nf_skb_duplicated); 40 41 int nf_register_afinfo(const struct nf_afinfo *afinfo) 42 { 43 mutex_lock(&afinfo_mutex); 44 RCU_INIT_POINTER(nf_afinfo[afinfo->family], afinfo); 45 mutex_unlock(&afinfo_mutex); 46 return 0; 47 } 48 EXPORT_SYMBOL_GPL(nf_register_afinfo); 49 50 void nf_unregister_afinfo(const struct nf_afinfo *afinfo) 51 { 52 mutex_lock(&afinfo_mutex); 53 RCU_INIT_POINTER(nf_afinfo[afinfo->family], NULL); 54 mutex_unlock(&afinfo_mutex); 55 synchronize_rcu(); 56 } 57 EXPORT_SYMBOL_GPL(nf_unregister_afinfo); 58 59 #ifdef HAVE_JUMP_LABEL 60 struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS]; 61 EXPORT_SYMBOL(nf_hooks_needed); 62 #endif 63 64 static DEFINE_MUTEX(nf_hook_mutex); 65 #define nf_entry_dereference(e) \ 66 rcu_dereference_protected(e, lockdep_is_held(&nf_hook_mutex)) 67 68 static struct nf_hook_entry __rcu **nf_hook_entry_head(struct net *net, const struct nf_hook_ops *reg) 69 { 70 if (reg->pf != NFPROTO_NETDEV) 71 return net->nf.hooks[reg->pf]+reg->hooknum; 72 73 #ifdef CONFIG_NETFILTER_INGRESS 74 if (reg->hooknum == NF_NETDEV_INGRESS) { 75 if (reg->dev && dev_net(reg->dev) == net) 76 return ®->dev->nf_hooks_ingress; 77 } 78 #endif 79 return NULL; 80 } 81 82 int nf_register_net_hook(struct net *net, const struct nf_hook_ops *reg) 83 { 84 struct nf_hook_entry __rcu **pp; 85 struct nf_hook_entry *entry, *p; 86 87 if (reg->pf == NFPROTO_NETDEV) { 88 #ifndef CONFIG_NETFILTER_INGRESS 89 if (reg->hooknum == NF_NETDEV_INGRESS) 90 return -EOPNOTSUPP; 91 #endif 92 if (reg->hooknum != NF_NETDEV_INGRESS || 93 !reg->dev || dev_net(reg->dev) != net) 94 return -EINVAL; 95 } 96 97 pp = nf_hook_entry_head(net, reg); 98 if (!pp) 99 return -EINVAL; 100 101 entry = kmalloc(sizeof(*entry), GFP_KERNEL); 102 if (!entry) 103 return -ENOMEM; 104 105 entry->orig_ops = reg; 106 entry->ops = *reg; 107 entry->next = NULL; 108 109 mutex_lock(&nf_hook_mutex); 110 111 /* Find the spot in the list */ 112 while ((p = nf_entry_dereference(*pp)) != NULL) { 113 if (reg->priority < p->orig_ops->priority) 114 break; 115 pp = &p->next; 116 } 117 rcu_assign_pointer(entry->next, p); 118 rcu_assign_pointer(*pp, entry); 119 120 mutex_unlock(&nf_hook_mutex); 121 #ifdef CONFIG_NETFILTER_INGRESS 122 if (reg->pf == NFPROTO_NETDEV && reg->hooknum == NF_NETDEV_INGRESS) 123 net_inc_ingress_queue(); 124 #endif 125 #ifdef HAVE_JUMP_LABEL 126 static_key_slow_inc(&nf_hooks_needed[reg->pf][reg->hooknum]); 127 #endif 128 return 0; 129 } 130 EXPORT_SYMBOL(nf_register_net_hook); 131 132 void nf_unregister_net_hook(struct net *net, const struct nf_hook_ops *reg) 133 { 134 struct nf_hook_entry __rcu **pp; 135 struct nf_hook_entry *p; 136 137 pp = nf_hook_entry_head(net, reg); 138 if (WARN_ON_ONCE(!pp)) 139 return; 140 141 mutex_lock(&nf_hook_mutex); 142 while ((p = nf_entry_dereference(*pp)) != NULL) { 143 if (p->orig_ops == reg) { 144 rcu_assign_pointer(*pp, p->next); 145 break; 146 } 147 pp = &p->next; 148 } 149 mutex_unlock(&nf_hook_mutex); 150 if (!p) { 151 WARN(1, "nf_unregister_net_hook: hook not found!\n"); 152 return; 153 } 154 #ifdef CONFIG_NETFILTER_INGRESS 155 if (reg->pf == NFPROTO_NETDEV && reg->hooknum == NF_NETDEV_INGRESS) 156 net_dec_ingress_queue(); 157 #endif 158 #ifdef HAVE_JUMP_LABEL 159 static_key_slow_dec(&nf_hooks_needed[reg->pf][reg->hooknum]); 160 #endif 161 synchronize_net(); 162 nf_queue_nf_hook_drop(net, p); 163 /* other cpu might still process nfqueue verdict that used reg */ 164 synchronize_net(); 165 kfree(p); 166 } 167 EXPORT_SYMBOL(nf_unregister_net_hook); 168 169 int nf_register_net_hooks(struct net *net, const struct nf_hook_ops *reg, 170 unsigned int n) 171 { 172 unsigned int i; 173 int err = 0; 174 175 for (i = 0; i < n; i++) { 176 err = nf_register_net_hook(net, ®[i]); 177 if (err) 178 goto err; 179 } 180 return err; 181 182 err: 183 if (i > 0) 184 nf_unregister_net_hooks(net, reg, i); 185 return err; 186 } 187 EXPORT_SYMBOL(nf_register_net_hooks); 188 189 void nf_unregister_net_hooks(struct net *net, const struct nf_hook_ops *reg, 190 unsigned int n) 191 { 192 while (n-- > 0) 193 nf_unregister_net_hook(net, ®[n]); 194 } 195 EXPORT_SYMBOL(nf_unregister_net_hooks); 196 197 static LIST_HEAD(nf_hook_list); 198 199 static int _nf_register_hook(struct nf_hook_ops *reg) 200 { 201 struct net *net, *last; 202 int ret; 203 204 for_each_net(net) { 205 ret = nf_register_net_hook(net, reg); 206 if (ret && ret != -ENOENT) 207 goto rollback; 208 } 209 list_add_tail(®->list, &nf_hook_list); 210 211 return 0; 212 rollback: 213 last = net; 214 for_each_net(net) { 215 if (net == last) 216 break; 217 nf_unregister_net_hook(net, reg); 218 } 219 return ret; 220 } 221 222 int nf_register_hook(struct nf_hook_ops *reg) 223 { 224 int ret; 225 226 rtnl_lock(); 227 ret = _nf_register_hook(reg); 228 rtnl_unlock(); 229 230 return ret; 231 } 232 EXPORT_SYMBOL(nf_register_hook); 233 234 static void _nf_unregister_hook(struct nf_hook_ops *reg) 235 { 236 struct net *net; 237 238 list_del(®->list); 239 for_each_net(net) 240 nf_unregister_net_hook(net, reg); 241 } 242 243 void nf_unregister_hook(struct nf_hook_ops *reg) 244 { 245 rtnl_lock(); 246 _nf_unregister_hook(reg); 247 rtnl_unlock(); 248 } 249 EXPORT_SYMBOL(nf_unregister_hook); 250 251 int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n) 252 { 253 unsigned int i; 254 int err = 0; 255 256 for (i = 0; i < n; i++) { 257 err = nf_register_hook(®[i]); 258 if (err) 259 goto err; 260 } 261 return err; 262 263 err: 264 if (i > 0) 265 nf_unregister_hooks(reg, i); 266 return err; 267 } 268 EXPORT_SYMBOL(nf_register_hooks); 269 270 /* Caller MUST take rtnl_lock() */ 271 int _nf_register_hooks(struct nf_hook_ops *reg, unsigned int n) 272 { 273 unsigned int i; 274 int err = 0; 275 276 for (i = 0; i < n; i++) { 277 err = _nf_register_hook(®[i]); 278 if (err) 279 goto err; 280 } 281 return err; 282 283 err: 284 if (i > 0) 285 _nf_unregister_hooks(reg, i); 286 return err; 287 } 288 EXPORT_SYMBOL(_nf_register_hooks); 289 290 void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n) 291 { 292 while (n-- > 0) 293 nf_unregister_hook(®[n]); 294 } 295 EXPORT_SYMBOL(nf_unregister_hooks); 296 297 /* Caller MUST take rtnl_lock */ 298 void _nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n) 299 { 300 while (n-- > 0) 301 _nf_unregister_hook(®[n]); 302 } 303 EXPORT_SYMBOL(_nf_unregister_hooks); 304 305 unsigned int nf_iterate(struct sk_buff *skb, 306 struct nf_hook_state *state, 307 struct nf_hook_entry **entryp) 308 { 309 unsigned int verdict; 310 311 /* 312 * The caller must not block between calls to this 313 * function because of risk of continuing from deleted element. 314 */ 315 while (*entryp) { 316 if (state->thresh > (*entryp)->ops.priority) { 317 *entryp = rcu_dereference((*entryp)->next); 318 continue; 319 } 320 321 /* Optimization: we don't need to hold module 322 reference here, since function can't sleep. --RR */ 323 repeat: 324 verdict = (*entryp)->ops.hook((*entryp)->ops.priv, skb, state); 325 if (verdict != NF_ACCEPT) { 326 #ifdef CONFIG_NETFILTER_DEBUG 327 if (unlikely((verdict & NF_VERDICT_MASK) 328 > NF_MAX_VERDICT)) { 329 NFDEBUG("Evil return from %p(%u).\n", 330 (*entryp)->ops.hook, state->hook); 331 *entryp = rcu_dereference((*entryp)->next); 332 continue; 333 } 334 #endif 335 if (verdict != NF_REPEAT) 336 return verdict; 337 goto repeat; 338 } 339 *entryp = rcu_dereference((*entryp)->next); 340 } 341 return NF_ACCEPT; 342 } 343 344 345 /* Returns 1 if okfn() needs to be executed by the caller, 346 * -EPERM for NF_DROP, 0 otherwise. Caller must hold rcu_read_lock. */ 347 int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state) 348 { 349 struct nf_hook_entry *entry; 350 unsigned int verdict; 351 int ret = 0; 352 353 entry = rcu_dereference(state->hook_entries); 354 next_hook: 355 verdict = nf_iterate(skb, state, &entry); 356 if (verdict == NF_ACCEPT || verdict == NF_STOP) { 357 ret = 1; 358 } else if ((verdict & NF_VERDICT_MASK) == NF_DROP) { 359 kfree_skb(skb); 360 ret = NF_DROP_GETERR(verdict); 361 if (ret == 0) 362 ret = -EPERM; 363 } else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) { 364 int err; 365 366 RCU_INIT_POINTER(state->hook_entries, entry); 367 err = nf_queue(skb, state, verdict >> NF_VERDICT_QBITS); 368 if (err < 0) { 369 if (err == -ESRCH && 370 (verdict & NF_VERDICT_FLAG_QUEUE_BYPASS)) 371 goto next_hook; 372 kfree_skb(skb); 373 } 374 } 375 return ret; 376 } 377 EXPORT_SYMBOL(nf_hook_slow); 378 379 380 int skb_make_writable(struct sk_buff *skb, unsigned int writable_len) 381 { 382 if (writable_len > skb->len) 383 return 0; 384 385 /* Not exclusive use of packet? Must copy. */ 386 if (!skb_cloned(skb)) { 387 if (writable_len <= skb_headlen(skb)) 388 return 1; 389 } else if (skb_clone_writable(skb, writable_len)) 390 return 1; 391 392 if (writable_len <= skb_headlen(skb)) 393 writable_len = 0; 394 else 395 writable_len -= skb_headlen(skb); 396 397 return !!__pskb_pull_tail(skb, writable_len); 398 } 399 EXPORT_SYMBOL(skb_make_writable); 400 401 /* This needs to be compiled in any case to avoid dependencies between the 402 * nfnetlink_queue code and nf_conntrack. 403 */ 404 struct nfnl_ct_hook __rcu *nfnl_ct_hook __read_mostly; 405 EXPORT_SYMBOL_GPL(nfnl_ct_hook); 406 407 #if IS_ENABLED(CONFIG_NF_CONNTRACK) 408 /* This does not belong here, but locally generated errors need it if connection 409 tracking in use: without this, connection may not be in hash table, and hence 410 manufactured ICMP or RST packets will not be associated with it. */ 411 void (*ip_ct_attach)(struct sk_buff *, const struct sk_buff *) 412 __rcu __read_mostly; 413 EXPORT_SYMBOL(ip_ct_attach); 414 415 void nf_ct_attach(struct sk_buff *new, const struct sk_buff *skb) 416 { 417 void (*attach)(struct sk_buff *, const struct sk_buff *); 418 419 if (skb->nfct) { 420 rcu_read_lock(); 421 attach = rcu_dereference(ip_ct_attach); 422 if (attach) 423 attach(new, skb); 424 rcu_read_unlock(); 425 } 426 } 427 EXPORT_SYMBOL(nf_ct_attach); 428 429 void (*nf_ct_destroy)(struct nf_conntrack *) __rcu __read_mostly; 430 EXPORT_SYMBOL(nf_ct_destroy); 431 432 void nf_conntrack_destroy(struct nf_conntrack *nfct) 433 { 434 void (*destroy)(struct nf_conntrack *); 435 436 rcu_read_lock(); 437 destroy = rcu_dereference(nf_ct_destroy); 438 BUG_ON(destroy == NULL); 439 destroy(nfct); 440 rcu_read_unlock(); 441 } 442 EXPORT_SYMBOL(nf_conntrack_destroy); 443 444 /* Built-in default zone used e.g. by modules. */ 445 const struct nf_conntrack_zone nf_ct_zone_dflt = { 446 .id = NF_CT_DEFAULT_ZONE_ID, 447 .dir = NF_CT_DEFAULT_ZONE_DIR, 448 }; 449 EXPORT_SYMBOL_GPL(nf_ct_zone_dflt); 450 #endif /* CONFIG_NF_CONNTRACK */ 451 452 #ifdef CONFIG_NF_NAT_NEEDED 453 void (*nf_nat_decode_session_hook)(struct sk_buff *, struct flowi *); 454 EXPORT_SYMBOL(nf_nat_decode_session_hook); 455 #endif 456 457 static int nf_register_hook_list(struct net *net) 458 { 459 struct nf_hook_ops *elem; 460 int ret; 461 462 rtnl_lock(); 463 list_for_each_entry(elem, &nf_hook_list, list) { 464 ret = nf_register_net_hook(net, elem); 465 if (ret && ret != -ENOENT) 466 goto out_undo; 467 } 468 rtnl_unlock(); 469 return 0; 470 471 out_undo: 472 list_for_each_entry_continue_reverse(elem, &nf_hook_list, list) 473 nf_unregister_net_hook(net, elem); 474 rtnl_unlock(); 475 return ret; 476 } 477 478 static void nf_unregister_hook_list(struct net *net) 479 { 480 struct nf_hook_ops *elem; 481 482 rtnl_lock(); 483 list_for_each_entry(elem, &nf_hook_list, list) 484 nf_unregister_net_hook(net, elem); 485 rtnl_unlock(); 486 } 487 488 static int __net_init netfilter_net_init(struct net *net) 489 { 490 int i, h, ret; 491 492 for (i = 0; i < ARRAY_SIZE(net->nf.hooks); i++) { 493 for (h = 0; h < NF_MAX_HOOKS; h++) 494 RCU_INIT_POINTER(net->nf.hooks[i][h], NULL); 495 } 496 497 #ifdef CONFIG_PROC_FS 498 net->nf.proc_netfilter = proc_net_mkdir(net, "netfilter", 499 net->proc_net); 500 if (!net->nf.proc_netfilter) { 501 if (!net_eq(net, &init_net)) 502 pr_err("cannot create netfilter proc entry"); 503 504 return -ENOMEM; 505 } 506 #endif 507 ret = nf_register_hook_list(net); 508 if (ret) 509 remove_proc_entry("netfilter", net->proc_net); 510 511 return ret; 512 } 513 514 static void __net_exit netfilter_net_exit(struct net *net) 515 { 516 nf_unregister_hook_list(net); 517 remove_proc_entry("netfilter", net->proc_net); 518 } 519 520 static struct pernet_operations netfilter_net_ops = { 521 .init = netfilter_net_init, 522 .exit = netfilter_net_exit, 523 }; 524 525 int __init netfilter_init(void) 526 { 527 int ret; 528 529 ret = register_pernet_subsys(&netfilter_net_ops); 530 if (ret < 0) 531 goto err; 532 533 ret = netfilter_log_init(); 534 if (ret < 0) 535 goto err_pernet; 536 537 return 0; 538 err_pernet: 539 unregister_pernet_subsys(&netfilter_net_ops); 540 err: 541 return ret; 542 } 543