1 #include <linux/kernel.h> 2 #include <linux/slab.h> 3 #include <linux/init.h> 4 #include <linux/module.h> 5 #include <linux/proc_fs.h> 6 #include <linux/skbuff.h> 7 #include <linux/netfilter.h> 8 #include <linux/seq_file.h> 9 #include <linux/rcupdate.h> 10 #include <net/protocol.h> 11 #include <net/netfilter/nf_queue.h> 12 13 #include "nf_internals.h" 14 15 /* 16 * A queue handler may be registered for each protocol. Each is protected by 17 * long term mutex. The handler must provide an an outfn() to accept packets 18 * for queueing and must reinject all packets it receives, no matter what. 19 */ 20 static const struct nf_queue_handler *queue_handler[NFPROTO_NUMPROTO] __read_mostly; 21 22 static DEFINE_MUTEX(queue_handler_mutex); 23 24 /* return EBUSY when somebody else is registered, return EEXIST if the 25 * same handler is registered, return 0 in case of success. */ 26 int nf_register_queue_handler(u_int8_t pf, const struct nf_queue_handler *qh) 27 { 28 int ret; 29 30 if (pf >= ARRAY_SIZE(queue_handler)) 31 return -EINVAL; 32 33 mutex_lock(&queue_handler_mutex); 34 if (queue_handler[pf] == qh) 35 ret = -EEXIST; 36 else if (queue_handler[pf]) 37 ret = -EBUSY; 38 else { 39 rcu_assign_pointer(queue_handler[pf], qh); 40 ret = 0; 41 } 42 mutex_unlock(&queue_handler_mutex); 43 44 return ret; 45 } 46 EXPORT_SYMBOL(nf_register_queue_handler); 47 48 /* The caller must flush their queue before this */ 49 int nf_unregister_queue_handler(u_int8_t pf, const struct nf_queue_handler *qh) 50 { 51 if (pf >= ARRAY_SIZE(queue_handler)) 52 return -EINVAL; 53 54 mutex_lock(&queue_handler_mutex); 55 if (queue_handler[pf] && queue_handler[pf] != qh) { 56 mutex_unlock(&queue_handler_mutex); 57 return -EINVAL; 58 } 59 60 rcu_assign_pointer(queue_handler[pf], NULL); 61 mutex_unlock(&queue_handler_mutex); 62 63 synchronize_rcu(); 64 65 return 0; 66 } 67 EXPORT_SYMBOL(nf_unregister_queue_handler); 68 69 void nf_unregister_queue_handlers(const struct nf_queue_handler *qh) 70 { 71 u_int8_t pf; 72 73 mutex_lock(&queue_handler_mutex); 74 for (pf = 0; pf < ARRAY_SIZE(queue_handler); pf++) { 75 if (queue_handler[pf] == qh) 76 rcu_assign_pointer(queue_handler[pf], NULL); 77 } 78 mutex_unlock(&queue_handler_mutex); 79 80 synchronize_rcu(); 81 } 82 EXPORT_SYMBOL_GPL(nf_unregister_queue_handlers); 83 84 static void nf_queue_entry_release_refs(struct nf_queue_entry *entry) 85 { 86 /* Release those devices we held, or Alexey will kill me. */ 87 if (entry->indev) 88 dev_put(entry->indev); 89 if (entry->outdev) 90 dev_put(entry->outdev); 91 #ifdef CONFIG_BRIDGE_NETFILTER 92 if (entry->skb->nf_bridge) { 93 struct nf_bridge_info *nf_bridge = entry->skb->nf_bridge; 94 95 if (nf_bridge->physindev) 96 dev_put(nf_bridge->physindev); 97 if (nf_bridge->physoutdev) 98 dev_put(nf_bridge->physoutdev); 99 } 100 #endif 101 /* Drop reference to owner of hook which queued us. */ 102 module_put(entry->elem->owner); 103 } 104 105 /* 106 * Any packet that leaves via this function must come back 107 * through nf_reinject(). 108 */ 109 static int __nf_queue(struct sk_buff *skb, 110 struct list_head *elem, 111 u_int8_t pf, unsigned int hook, 112 struct net_device *indev, 113 struct net_device *outdev, 114 int (*okfn)(struct sk_buff *), 115 unsigned int queuenum) 116 { 117 int status; 118 struct nf_queue_entry *entry = NULL; 119 #ifdef CONFIG_BRIDGE_NETFILTER 120 struct net_device *physindev; 121 struct net_device *physoutdev; 122 #endif 123 const struct nf_afinfo *afinfo; 124 const struct nf_queue_handler *qh; 125 126 /* QUEUE == DROP if noone is waiting, to be safe. */ 127 rcu_read_lock(); 128 129 qh = rcu_dereference(queue_handler[pf]); 130 if (!qh) 131 goto err_unlock; 132 133 afinfo = nf_get_afinfo(pf); 134 if (!afinfo) 135 goto err_unlock; 136 137 entry = kmalloc(sizeof(*entry) + afinfo->route_key_size, GFP_ATOMIC); 138 if (!entry) 139 goto err_unlock; 140 141 *entry = (struct nf_queue_entry) { 142 .skb = skb, 143 .elem = list_entry(elem, struct nf_hook_ops, list), 144 .pf = pf, 145 .hook = hook, 146 .indev = indev, 147 .outdev = outdev, 148 .okfn = okfn, 149 }; 150 151 /* If it's going away, ignore hook. */ 152 if (!try_module_get(entry->elem->owner)) { 153 rcu_read_unlock(); 154 kfree(entry); 155 return 0; 156 } 157 158 /* Bump dev refs so they don't vanish while packet is out */ 159 if (indev) 160 dev_hold(indev); 161 if (outdev) 162 dev_hold(outdev); 163 #ifdef CONFIG_BRIDGE_NETFILTER 164 if (skb->nf_bridge) { 165 physindev = skb->nf_bridge->physindev; 166 if (physindev) 167 dev_hold(physindev); 168 physoutdev = skb->nf_bridge->physoutdev; 169 if (physoutdev) 170 dev_hold(physoutdev); 171 } 172 #endif 173 afinfo->saveroute(skb, entry); 174 status = qh->outfn(entry, queuenum); 175 176 rcu_read_unlock(); 177 178 if (status < 0) { 179 nf_queue_entry_release_refs(entry); 180 goto err; 181 } 182 183 return 1; 184 185 err_unlock: 186 rcu_read_unlock(); 187 err: 188 kfree_skb(skb); 189 kfree(entry); 190 return 1; 191 } 192 193 int nf_queue(struct sk_buff *skb, 194 struct list_head *elem, 195 u_int8_t pf, unsigned int hook, 196 struct net_device *indev, 197 struct net_device *outdev, 198 int (*okfn)(struct sk_buff *), 199 unsigned int queuenum) 200 { 201 struct sk_buff *segs; 202 203 if (!skb_is_gso(skb)) 204 return __nf_queue(skb, elem, pf, hook, indev, outdev, okfn, 205 queuenum); 206 207 switch (pf) { 208 case NFPROTO_IPV4: 209 skb->protocol = htons(ETH_P_IP); 210 break; 211 case NFPROTO_IPV6: 212 skb->protocol = htons(ETH_P_IPV6); 213 break; 214 } 215 216 segs = skb_gso_segment(skb, 0); 217 kfree_skb(skb); 218 if (IS_ERR(segs)) 219 return 1; 220 221 do { 222 struct sk_buff *nskb = segs->next; 223 224 segs->next = NULL; 225 if (!__nf_queue(segs, elem, pf, hook, indev, outdev, okfn, 226 queuenum)) 227 kfree_skb(segs); 228 segs = nskb; 229 } while (segs); 230 return 1; 231 } 232 233 void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict) 234 { 235 struct sk_buff *skb = entry->skb; 236 struct list_head *elem = &entry->elem->list; 237 const struct nf_afinfo *afinfo; 238 239 rcu_read_lock(); 240 241 nf_queue_entry_release_refs(entry); 242 243 /* Continue traversal iff userspace said ok... */ 244 if (verdict == NF_REPEAT) { 245 elem = elem->prev; 246 verdict = NF_ACCEPT; 247 } 248 249 if (verdict == NF_ACCEPT) { 250 afinfo = nf_get_afinfo(entry->pf); 251 if (!afinfo || afinfo->reroute(skb, entry) < 0) 252 verdict = NF_DROP; 253 } 254 255 if (verdict == NF_ACCEPT) { 256 next_hook: 257 verdict = nf_iterate(&nf_hooks[entry->pf][entry->hook], 258 skb, entry->hook, 259 entry->indev, entry->outdev, &elem, 260 entry->okfn, INT_MIN); 261 } 262 263 switch (verdict & NF_VERDICT_MASK) { 264 case NF_ACCEPT: 265 case NF_STOP: 266 local_bh_disable(); 267 entry->okfn(skb); 268 local_bh_enable(); 269 break; 270 case NF_QUEUE: 271 if (!__nf_queue(skb, elem, entry->pf, entry->hook, 272 entry->indev, entry->outdev, entry->okfn, 273 verdict >> NF_VERDICT_BITS)) 274 goto next_hook; 275 break; 276 case NF_STOLEN: 277 default: 278 kfree_skb(skb); 279 } 280 rcu_read_unlock(); 281 kfree(entry); 282 return; 283 } 284 EXPORT_SYMBOL(nf_reinject); 285 286 #ifdef CONFIG_PROC_FS 287 static void *seq_start(struct seq_file *seq, loff_t *pos) 288 { 289 if (*pos >= ARRAY_SIZE(queue_handler)) 290 return NULL; 291 292 return pos; 293 } 294 295 static void *seq_next(struct seq_file *s, void *v, loff_t *pos) 296 { 297 (*pos)++; 298 299 if (*pos >= ARRAY_SIZE(queue_handler)) 300 return NULL; 301 302 return pos; 303 } 304 305 static void seq_stop(struct seq_file *s, void *v) 306 { 307 308 } 309 310 static int seq_show(struct seq_file *s, void *v) 311 { 312 int ret; 313 loff_t *pos = v; 314 const struct nf_queue_handler *qh; 315 316 rcu_read_lock(); 317 qh = rcu_dereference(queue_handler[*pos]); 318 if (!qh) 319 ret = seq_printf(s, "%2lld NONE\n", *pos); 320 else 321 ret = seq_printf(s, "%2lld %s\n", *pos, qh->name); 322 rcu_read_unlock(); 323 324 return ret; 325 } 326 327 static const struct seq_operations nfqueue_seq_ops = { 328 .start = seq_start, 329 .next = seq_next, 330 .stop = seq_stop, 331 .show = seq_show, 332 }; 333 334 static int nfqueue_open(struct inode *inode, struct file *file) 335 { 336 return seq_open(file, &nfqueue_seq_ops); 337 } 338 339 static const struct file_operations nfqueue_file_ops = { 340 .owner = THIS_MODULE, 341 .open = nfqueue_open, 342 .read = seq_read, 343 .llseek = seq_lseek, 344 .release = seq_release, 345 }; 346 #endif /* PROC_FS */ 347 348 349 int __init netfilter_queue_init(void) 350 { 351 #ifdef CONFIG_PROC_FS 352 if (!proc_create("nf_queue", S_IRUGO, 353 proc_net_netfilter, &nfqueue_file_ops)) 354 return -1; 355 #endif 356 return 0; 357 } 358 359