1 /* netfilter.c: look after the filters for various protocols. 2 * Heavily influenced by the old firewall.c by David Bonn and Alan Cox. 3 * 4 * Thanks to Rob `CmdrTaco' Malda for not influencing this code in any 5 * way. 6 * 7 * Rusty Russell (C)2000 -- This code is GPL. 8 * Patrick McHardy (c) 2006-2012 9 */ 10 #include <linux/kernel.h> 11 #include <linux/netfilter.h> 12 #include <net/protocol.h> 13 #include <linux/init.h> 14 #include <linux/skbuff.h> 15 #include <linux/wait.h> 16 #include <linux/module.h> 17 #include <linux/interrupt.h> 18 #include <linux/if.h> 19 #include <linux/netdevice.h> 20 #include <linux/inetdevice.h> 21 #include <linux/proc_fs.h> 22 #include <linux/mutex.h> 23 #include <linux/slab.h> 24 #include <net/net_namespace.h> 25 #include <net/sock.h> 26 27 #include "nf_internals.h" 28 29 static DEFINE_MUTEX(afinfo_mutex); 30 31 const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO] __read_mostly; 32 EXPORT_SYMBOL(nf_afinfo); 33 const struct nf_ipv6_ops __rcu *nf_ipv6_ops __read_mostly; 34 EXPORT_SYMBOL_GPL(nf_ipv6_ops); 35 36 int nf_register_afinfo(const struct nf_afinfo *afinfo) 37 { 38 mutex_lock(&afinfo_mutex); 39 RCU_INIT_POINTER(nf_afinfo[afinfo->family], afinfo); 40 mutex_unlock(&afinfo_mutex); 41 return 0; 42 } 43 EXPORT_SYMBOL_GPL(nf_register_afinfo); 44 45 void nf_unregister_afinfo(const struct nf_afinfo *afinfo) 46 { 47 mutex_lock(&afinfo_mutex); 48 RCU_INIT_POINTER(nf_afinfo[afinfo->family], NULL); 49 mutex_unlock(&afinfo_mutex); 50 synchronize_rcu(); 51 } 52 EXPORT_SYMBOL_GPL(nf_unregister_afinfo); 53 54 struct list_head nf_hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS] __read_mostly; 55 EXPORT_SYMBOL(nf_hooks); 56 57 #ifdef HAVE_JUMP_LABEL 58 struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS]; 59 EXPORT_SYMBOL(nf_hooks_needed); 60 #endif 61 62 static DEFINE_MUTEX(nf_hook_mutex); 63 64 int nf_register_hook(struct nf_hook_ops *reg) 65 { 66 struct nf_hook_ops *elem; 67 68 mutex_lock(&nf_hook_mutex); 69 list_for_each_entry(elem, &nf_hooks[reg->pf][reg->hooknum], list) { 70 if (reg->priority < elem->priority) 71 break; 72 } 73 list_add_rcu(®->list, elem->list.prev); 74 mutex_unlock(&nf_hook_mutex); 75 #ifdef HAVE_JUMP_LABEL 76 static_key_slow_inc(&nf_hooks_needed[reg->pf][reg->hooknum]); 77 #endif 78 return 0; 79 } 80 EXPORT_SYMBOL(nf_register_hook); 81 82 void nf_unregister_hook(struct nf_hook_ops *reg) 83 { 84 mutex_lock(&nf_hook_mutex); 85 list_del_rcu(®->list); 86 mutex_unlock(&nf_hook_mutex); 87 #ifdef HAVE_JUMP_LABEL 88 static_key_slow_dec(&nf_hooks_needed[reg->pf][reg->hooknum]); 89 #endif 90 synchronize_net(); 91 } 92 EXPORT_SYMBOL(nf_unregister_hook); 93 94 int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n) 95 { 96 unsigned int i; 97 int err = 0; 98 99 for (i = 0; i < n; i++) { 100 err = nf_register_hook(®[i]); 101 if (err) 102 goto err; 103 } 104 return err; 105 106 err: 107 if (i > 0) 108 nf_unregister_hooks(reg, i); 109 return err; 110 } 111 EXPORT_SYMBOL(nf_register_hooks); 112 113 void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n) 114 { 115 while (n-- > 0) 116 nf_unregister_hook(®[n]); 117 } 118 EXPORT_SYMBOL(nf_unregister_hooks); 119 120 unsigned int nf_iterate(struct list_head *head, 121 struct sk_buff *skb, 122 unsigned int hook, 123 const struct net_device *indev, 124 const struct net_device *outdev, 125 struct nf_hook_ops **elemp, 126 int (*okfn)(struct sk_buff *), 127 int hook_thresh) 128 { 129 unsigned int verdict; 130 131 /* 132 * The caller must not block between calls to this 133 * function because of risk of continuing from deleted element. 134 */ 135 list_for_each_entry_continue_rcu((*elemp), head, list) { 136 if (hook_thresh > (*elemp)->priority) 137 continue; 138 139 /* Optimization: we don't need to hold module 140 reference here, since function can't sleep. --RR */ 141 repeat: 142 verdict = (*elemp)->hook(*elemp, skb, indev, outdev, okfn); 143 if (verdict != NF_ACCEPT) { 144 #ifdef CONFIG_NETFILTER_DEBUG 145 if (unlikely((verdict & NF_VERDICT_MASK) 146 > NF_MAX_VERDICT)) { 147 NFDEBUG("Evil return from %p(%u).\n", 148 (*elemp)->hook, hook); 149 continue; 150 } 151 #endif 152 if (verdict != NF_REPEAT) 153 return verdict; 154 goto repeat; 155 } 156 } 157 return NF_ACCEPT; 158 } 159 160 161 /* Returns 1 if okfn() needs to be executed by the caller, 162 * -EPERM for NF_DROP, 0 otherwise. */ 163 int nf_hook_slow(u_int8_t pf, unsigned int hook, struct sk_buff *skb, 164 struct net_device *indev, 165 struct net_device *outdev, 166 int (*okfn)(struct sk_buff *), 167 int hook_thresh) 168 { 169 struct nf_hook_ops *elem; 170 unsigned int verdict; 171 int ret = 0; 172 173 /* We may already have this, but read-locks nest anyway */ 174 rcu_read_lock(); 175 176 elem = list_entry_rcu(&nf_hooks[pf][hook], struct nf_hook_ops, list); 177 next_hook: 178 verdict = nf_iterate(&nf_hooks[pf][hook], skb, hook, indev, 179 outdev, &elem, okfn, hook_thresh); 180 if (verdict == NF_ACCEPT || verdict == NF_STOP) { 181 ret = 1; 182 } else if ((verdict & NF_VERDICT_MASK) == NF_DROP) { 183 kfree_skb(skb); 184 ret = NF_DROP_GETERR(verdict); 185 if (ret == 0) 186 ret = -EPERM; 187 } else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) { 188 int err = nf_queue(skb, elem, pf, hook, indev, outdev, okfn, 189 verdict >> NF_VERDICT_QBITS); 190 if (err < 0) { 191 if (err == -ECANCELED) 192 goto next_hook; 193 if (err == -ESRCH && 194 (verdict & NF_VERDICT_FLAG_QUEUE_BYPASS)) 195 goto next_hook; 196 kfree_skb(skb); 197 } 198 } 199 rcu_read_unlock(); 200 return ret; 201 } 202 EXPORT_SYMBOL(nf_hook_slow); 203 204 205 int skb_make_writable(struct sk_buff *skb, unsigned int writable_len) 206 { 207 if (writable_len > skb->len) 208 return 0; 209 210 /* Not exclusive use of packet? Must copy. */ 211 if (!skb_cloned(skb)) { 212 if (writable_len <= skb_headlen(skb)) 213 return 1; 214 } else if (skb_clone_writable(skb, writable_len)) 215 return 1; 216 217 if (writable_len <= skb_headlen(skb)) 218 writable_len = 0; 219 else 220 writable_len -= skb_headlen(skb); 221 222 return !!__pskb_pull_tail(skb, writable_len); 223 } 224 EXPORT_SYMBOL(skb_make_writable); 225 226 #if IS_ENABLED(CONFIG_NF_CONNTRACK) 227 /* This does not belong here, but locally generated errors need it if connection 228 tracking in use: without this, connection may not be in hash table, and hence 229 manufactured ICMP or RST packets will not be associated with it. */ 230 void (*ip_ct_attach)(struct sk_buff *, const struct sk_buff *) 231 __rcu __read_mostly; 232 EXPORT_SYMBOL(ip_ct_attach); 233 234 void nf_ct_attach(struct sk_buff *new, const struct sk_buff *skb) 235 { 236 void (*attach)(struct sk_buff *, const struct sk_buff *); 237 238 if (skb->nfct) { 239 rcu_read_lock(); 240 attach = rcu_dereference(ip_ct_attach); 241 if (attach) 242 attach(new, skb); 243 rcu_read_unlock(); 244 } 245 } 246 EXPORT_SYMBOL(nf_ct_attach); 247 248 void (*nf_ct_destroy)(struct nf_conntrack *) __rcu __read_mostly; 249 EXPORT_SYMBOL(nf_ct_destroy); 250 251 void nf_conntrack_destroy(struct nf_conntrack *nfct) 252 { 253 void (*destroy)(struct nf_conntrack *); 254 255 rcu_read_lock(); 256 destroy = rcu_dereference(nf_ct_destroy); 257 BUG_ON(destroy == NULL); 258 destroy(nfct); 259 rcu_read_unlock(); 260 } 261 EXPORT_SYMBOL(nf_conntrack_destroy); 262 263 struct nfq_ct_hook __rcu *nfq_ct_hook __read_mostly; 264 EXPORT_SYMBOL_GPL(nfq_ct_hook); 265 266 struct nfq_ct_nat_hook __rcu *nfq_ct_nat_hook __read_mostly; 267 EXPORT_SYMBOL_GPL(nfq_ct_nat_hook); 268 269 #endif /* CONFIG_NF_CONNTRACK */ 270 271 #ifdef CONFIG_NF_NAT_NEEDED 272 void (*nf_nat_decode_session_hook)(struct sk_buff *, struct flowi *); 273 EXPORT_SYMBOL(nf_nat_decode_session_hook); 274 #endif 275 276 static int __net_init netfilter_net_init(struct net *net) 277 { 278 #ifdef CONFIG_PROC_FS 279 net->nf.proc_netfilter = proc_net_mkdir(net, "netfilter", 280 net->proc_net); 281 if (!net->nf.proc_netfilter) { 282 if (!net_eq(net, &init_net)) 283 pr_err("cannot create netfilter proc entry"); 284 285 return -ENOMEM; 286 } 287 #endif 288 return 0; 289 } 290 291 static void __net_exit netfilter_net_exit(struct net *net) 292 { 293 remove_proc_entry("netfilter", net->proc_net); 294 } 295 296 static struct pernet_operations netfilter_net_ops = { 297 .init = netfilter_net_init, 298 .exit = netfilter_net_exit, 299 }; 300 301 int __init netfilter_init(void) 302 { 303 int i, h, ret; 304 305 for (i = 0; i < ARRAY_SIZE(nf_hooks); i++) { 306 for (h = 0; h < NF_MAX_HOOKS; h++) 307 INIT_LIST_HEAD(&nf_hooks[i][h]); 308 } 309 310 ret = register_pernet_subsys(&netfilter_net_ops); 311 if (ret < 0) 312 goto err; 313 314 ret = netfilter_log_init(); 315 if (ret < 0) 316 goto err_pernet; 317 318 return 0; 319 err_pernet: 320 unregister_pernet_subsys(&netfilter_net_ops); 321 err: 322 return ret; 323 } 324