1 /* Netfilter messages via netlink socket. Allows for user space 2 * protocol helpers and general trouble making from userspace. 3 * 4 * (C) 2001 by Jay Schulist <jschlst@samba.org>, 5 * (C) 2002-2005 by Harald Welte <laforge@gnumonks.org> 6 * (C) 2005-2017 by Pablo Neira Ayuso <pablo@netfilter.org> 7 * 8 * Initial netfilter messages via netlink development funded and 9 * generally made possible by Network Robots, Inc. (www.networkrobots.com) 10 * 11 * Further development of this code funded by Astaro AG (http://www.astaro.com) 12 * 13 * This software may be used and distributed according to the terms 14 * of the GNU General Public License, incorporated herein by reference. 15 */ 16 17 #include <linux/module.h> 18 #include <linux/types.h> 19 #include <linux/socket.h> 20 #include <linux/kernel.h> 21 #include <linux/string.h> 22 #include <linux/sockios.h> 23 #include <linux/net.h> 24 #include <linux/skbuff.h> 25 #include <linux/uaccess.h> 26 #include <net/sock.h> 27 #include <linux/init.h> 28 #include <linux/sched/signal.h> 29 30 #include <net/netlink.h> 31 #include <net/netns/generic.h> 32 #include <linux/netfilter/nfnetlink.h> 33 34 MODULE_LICENSE("GPL"); 35 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>"); 36 MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_NETFILTER); 37 MODULE_DESCRIPTION("Netfilter messages via netlink socket"); 38 39 #define nfnl_dereference_protected(id) \ 40 rcu_dereference_protected(table[(id)].subsys, \ 41 lockdep_nfnl_is_held((id))) 42 43 #define NFNL_MAX_ATTR_COUNT 32 44 45 static unsigned int nfnetlink_pernet_id __read_mostly; 46 47 struct nfnl_net { 48 unsigned int ctnetlink_listeners; 49 struct sock *nfnl; 50 }; 51 52 static struct { 53 struct mutex mutex; 54 const struct nfnetlink_subsystem __rcu *subsys; 55 } table[NFNL_SUBSYS_COUNT]; 56 57 static struct lock_class_key nfnl_lockdep_keys[NFNL_SUBSYS_COUNT]; 58 59 static const char *const nfnl_lockdep_names[NFNL_SUBSYS_COUNT] = { 60 [NFNL_SUBSYS_NONE] = "nfnl_subsys_none", 61 [NFNL_SUBSYS_CTNETLINK] = "nfnl_subsys_ctnetlink", 62 [NFNL_SUBSYS_CTNETLINK_EXP] = "nfnl_subsys_ctnetlink_exp", 63 [NFNL_SUBSYS_QUEUE] = "nfnl_subsys_queue", 64 [NFNL_SUBSYS_ULOG] = "nfnl_subsys_ulog", 65 [NFNL_SUBSYS_OSF] = "nfnl_subsys_osf", 66 [NFNL_SUBSYS_IPSET] = "nfnl_subsys_ipset", 67 [NFNL_SUBSYS_ACCT] = "nfnl_subsys_acct", 68 [NFNL_SUBSYS_CTNETLINK_TIMEOUT] = "nfnl_subsys_cttimeout", 69 [NFNL_SUBSYS_CTHELPER] = "nfnl_subsys_cthelper", 70 [NFNL_SUBSYS_NFTABLES] = "nfnl_subsys_nftables", 71 [NFNL_SUBSYS_NFT_COMPAT] = "nfnl_subsys_nftcompat", 72 [NFNL_SUBSYS_HOOK] = "nfnl_subsys_hook", 73 }; 74 75 static const int nfnl_group2type[NFNLGRP_MAX+1] = { 76 [NFNLGRP_CONNTRACK_NEW] = NFNL_SUBSYS_CTNETLINK, 77 [NFNLGRP_CONNTRACK_UPDATE] = NFNL_SUBSYS_CTNETLINK, 78 [NFNLGRP_CONNTRACK_DESTROY] = NFNL_SUBSYS_CTNETLINK, 79 [NFNLGRP_CONNTRACK_EXP_NEW] = NFNL_SUBSYS_CTNETLINK_EXP, 80 [NFNLGRP_CONNTRACK_EXP_UPDATE] = NFNL_SUBSYS_CTNETLINK_EXP, 81 [NFNLGRP_CONNTRACK_EXP_DESTROY] = NFNL_SUBSYS_CTNETLINK_EXP, 82 [NFNLGRP_NFTABLES] = NFNL_SUBSYS_NFTABLES, 83 [NFNLGRP_ACCT_QUOTA] = NFNL_SUBSYS_ACCT, 84 [NFNLGRP_NFTRACE] = NFNL_SUBSYS_NFTABLES, 85 }; 86 87 static struct nfnl_net *nfnl_pernet(struct net *net) 88 { 89 return net_generic(net, nfnetlink_pernet_id); 90 } 91 92 void nfnl_lock(__u8 subsys_id) 93 { 94 mutex_lock(&table[subsys_id].mutex); 95 } 96 EXPORT_SYMBOL_GPL(nfnl_lock); 97 98 void nfnl_unlock(__u8 subsys_id) 99 { 100 mutex_unlock(&table[subsys_id].mutex); 101 } 102 EXPORT_SYMBOL_GPL(nfnl_unlock); 103 104 #ifdef CONFIG_PROVE_LOCKING 105 bool lockdep_nfnl_is_held(u8 subsys_id) 106 { 107 return lockdep_is_held(&table[subsys_id].mutex); 108 } 109 EXPORT_SYMBOL_GPL(lockdep_nfnl_is_held); 110 #endif 111 112 int nfnetlink_subsys_register(const struct nfnetlink_subsystem *n) 113 { 114 u8 cb_id; 115 116 /* Sanity-check attr_count size to avoid stack buffer overflow. */ 117 for (cb_id = 0; cb_id < n->cb_count; cb_id++) 118 if (WARN_ON(n->cb[cb_id].attr_count > NFNL_MAX_ATTR_COUNT)) 119 return -EINVAL; 120 121 nfnl_lock(n->subsys_id); 122 if (table[n->subsys_id].subsys) { 123 nfnl_unlock(n->subsys_id); 124 return -EBUSY; 125 } 126 rcu_assign_pointer(table[n->subsys_id].subsys, n); 127 nfnl_unlock(n->subsys_id); 128 129 return 0; 130 } 131 EXPORT_SYMBOL_GPL(nfnetlink_subsys_register); 132 133 int nfnetlink_subsys_unregister(const struct nfnetlink_subsystem *n) 134 { 135 nfnl_lock(n->subsys_id); 136 table[n->subsys_id].subsys = NULL; 137 nfnl_unlock(n->subsys_id); 138 synchronize_rcu(); 139 return 0; 140 } 141 EXPORT_SYMBOL_GPL(nfnetlink_subsys_unregister); 142 143 static inline const struct nfnetlink_subsystem *nfnetlink_get_subsys(u16 type) 144 { 145 u8 subsys_id = NFNL_SUBSYS_ID(type); 146 147 if (subsys_id >= NFNL_SUBSYS_COUNT) 148 return NULL; 149 150 return rcu_dereference(table[subsys_id].subsys); 151 } 152 153 static inline const struct nfnl_callback * 154 nfnetlink_find_client(u16 type, const struct nfnetlink_subsystem *ss) 155 { 156 u8 cb_id = NFNL_MSG_TYPE(type); 157 158 if (cb_id >= ss->cb_count) 159 return NULL; 160 161 return &ss->cb[cb_id]; 162 } 163 164 int nfnetlink_has_listeners(struct net *net, unsigned int group) 165 { 166 struct nfnl_net *nfnlnet = nfnl_pernet(net); 167 168 return netlink_has_listeners(nfnlnet->nfnl, group); 169 } 170 EXPORT_SYMBOL_GPL(nfnetlink_has_listeners); 171 172 int nfnetlink_send(struct sk_buff *skb, struct net *net, u32 portid, 173 unsigned int group, int echo, gfp_t flags) 174 { 175 struct nfnl_net *nfnlnet = nfnl_pernet(net); 176 177 return nlmsg_notify(nfnlnet->nfnl, skb, portid, group, echo, flags); 178 } 179 EXPORT_SYMBOL_GPL(nfnetlink_send); 180 181 int nfnetlink_set_err(struct net *net, u32 portid, u32 group, int error) 182 { 183 struct nfnl_net *nfnlnet = nfnl_pernet(net); 184 185 return netlink_set_err(nfnlnet->nfnl, portid, group, error); 186 } 187 EXPORT_SYMBOL_GPL(nfnetlink_set_err); 188 189 int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u32 portid) 190 { 191 struct nfnl_net *nfnlnet = nfnl_pernet(net); 192 int err; 193 194 err = nlmsg_unicast(nfnlnet->nfnl, skb, portid); 195 if (err == -EAGAIN) 196 err = -ENOBUFS; 197 198 return err; 199 } 200 EXPORT_SYMBOL_GPL(nfnetlink_unicast); 201 202 void nfnetlink_broadcast(struct net *net, struct sk_buff *skb, __u32 portid, 203 __u32 group, gfp_t allocation) 204 { 205 struct nfnl_net *nfnlnet = nfnl_pernet(net); 206 207 netlink_broadcast(nfnlnet->nfnl, skb, portid, group, allocation); 208 } 209 EXPORT_SYMBOL_GPL(nfnetlink_broadcast); 210 211 /* Process one complete nfnetlink message. */ 212 static int nfnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, 213 struct netlink_ext_ack *extack) 214 { 215 struct net *net = sock_net(skb->sk); 216 const struct nfnl_callback *nc; 217 const struct nfnetlink_subsystem *ss; 218 int type, err; 219 220 /* All the messages must at least contain nfgenmsg */ 221 if (nlmsg_len(nlh) < sizeof(struct nfgenmsg)) 222 return 0; 223 224 type = nlh->nlmsg_type; 225 replay: 226 rcu_read_lock(); 227 228 ss = nfnetlink_get_subsys(type); 229 if (!ss) { 230 #ifdef CONFIG_MODULES 231 rcu_read_unlock(); 232 request_module("nfnetlink-subsys-%d", NFNL_SUBSYS_ID(type)); 233 rcu_read_lock(); 234 ss = nfnetlink_get_subsys(type); 235 if (!ss) 236 #endif 237 { 238 rcu_read_unlock(); 239 return -EINVAL; 240 } 241 } 242 243 nc = nfnetlink_find_client(type, ss); 244 if (!nc) { 245 rcu_read_unlock(); 246 return -EINVAL; 247 } 248 249 { 250 int min_len = nlmsg_total_size(sizeof(struct nfgenmsg)); 251 struct nfnl_net *nfnlnet = nfnl_pernet(net); 252 u8 cb_id = NFNL_MSG_TYPE(nlh->nlmsg_type); 253 struct nlattr *cda[NFNL_MAX_ATTR_COUNT + 1]; 254 struct nlattr *attr = (void *)nlh + min_len; 255 int attrlen = nlh->nlmsg_len - min_len; 256 __u8 subsys_id = NFNL_SUBSYS_ID(type); 257 struct nfnl_info info = { 258 .net = net, 259 .sk = nfnlnet->nfnl, 260 .nlh = nlh, 261 .nfmsg = nlmsg_data(nlh), 262 .extack = extack, 263 }; 264 265 /* Sanity-check NFNL_MAX_ATTR_COUNT */ 266 if (ss->cb[cb_id].attr_count > NFNL_MAX_ATTR_COUNT) { 267 rcu_read_unlock(); 268 return -ENOMEM; 269 } 270 271 err = nla_parse_deprecated(cda, ss->cb[cb_id].attr_count, 272 attr, attrlen, 273 ss->cb[cb_id].policy, extack); 274 if (err < 0) { 275 rcu_read_unlock(); 276 return err; 277 } 278 279 if (!nc->call) { 280 rcu_read_unlock(); 281 return -EINVAL; 282 } 283 284 switch (nc->type) { 285 case NFNL_CB_RCU: 286 err = nc->call(skb, &info, (const struct nlattr **)cda); 287 rcu_read_unlock(); 288 break; 289 case NFNL_CB_MUTEX: 290 rcu_read_unlock(); 291 nfnl_lock(subsys_id); 292 if (nfnl_dereference_protected(subsys_id) != ss || 293 nfnetlink_find_client(type, ss) != nc) { 294 err = -EAGAIN; 295 break; 296 } 297 err = nc->call(skb, &info, (const struct nlattr **)cda); 298 nfnl_unlock(subsys_id); 299 break; 300 default: 301 rcu_read_unlock(); 302 err = -EINVAL; 303 break; 304 } 305 if (err == -EAGAIN) 306 goto replay; 307 return err; 308 } 309 } 310 311 struct nfnl_err { 312 struct list_head head; 313 struct nlmsghdr *nlh; 314 int err; 315 struct netlink_ext_ack extack; 316 }; 317 318 static int nfnl_err_add(struct list_head *list, struct nlmsghdr *nlh, int err, 319 const struct netlink_ext_ack *extack) 320 { 321 struct nfnl_err *nfnl_err; 322 323 nfnl_err = kmalloc(sizeof(struct nfnl_err), GFP_KERNEL); 324 if (nfnl_err == NULL) 325 return -ENOMEM; 326 327 nfnl_err->nlh = nlh; 328 nfnl_err->err = err; 329 nfnl_err->extack = *extack; 330 list_add_tail(&nfnl_err->head, list); 331 332 return 0; 333 } 334 335 static void nfnl_err_del(struct nfnl_err *nfnl_err) 336 { 337 list_del(&nfnl_err->head); 338 kfree(nfnl_err); 339 } 340 341 static void nfnl_err_reset(struct list_head *err_list) 342 { 343 struct nfnl_err *nfnl_err, *next; 344 345 list_for_each_entry_safe(nfnl_err, next, err_list, head) 346 nfnl_err_del(nfnl_err); 347 } 348 349 static void nfnl_err_deliver(struct list_head *err_list, struct sk_buff *skb) 350 { 351 struct nfnl_err *nfnl_err, *next; 352 353 list_for_each_entry_safe(nfnl_err, next, err_list, head) { 354 netlink_ack(skb, nfnl_err->nlh, nfnl_err->err, 355 &nfnl_err->extack); 356 nfnl_err_del(nfnl_err); 357 } 358 } 359 360 enum { 361 NFNL_BATCH_FAILURE = (1 << 0), 362 NFNL_BATCH_DONE = (1 << 1), 363 NFNL_BATCH_REPLAY = (1 << 2), 364 }; 365 366 static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh, 367 u16 subsys_id, u32 genid) 368 { 369 struct sk_buff *oskb = skb; 370 struct net *net = sock_net(skb->sk); 371 const struct nfnetlink_subsystem *ss; 372 const struct nfnl_callback *nc; 373 struct netlink_ext_ack extack; 374 LIST_HEAD(err_list); 375 u32 status; 376 int err; 377 378 if (subsys_id >= NFNL_SUBSYS_COUNT) 379 return netlink_ack(skb, nlh, -EINVAL, NULL); 380 replay: 381 status = 0; 382 replay_abort: 383 skb = netlink_skb_clone(oskb, GFP_KERNEL); 384 if (!skb) 385 return netlink_ack(oskb, nlh, -ENOMEM, NULL); 386 387 nfnl_lock(subsys_id); 388 ss = nfnl_dereference_protected(subsys_id); 389 if (!ss) { 390 #ifdef CONFIG_MODULES 391 nfnl_unlock(subsys_id); 392 request_module("nfnetlink-subsys-%d", subsys_id); 393 nfnl_lock(subsys_id); 394 ss = nfnl_dereference_protected(subsys_id); 395 if (!ss) 396 #endif 397 { 398 nfnl_unlock(subsys_id); 399 netlink_ack(oskb, nlh, -EOPNOTSUPP, NULL); 400 return kfree_skb(skb); 401 } 402 } 403 404 if (!ss->valid_genid || !ss->commit || !ss->abort) { 405 nfnl_unlock(subsys_id); 406 netlink_ack(oskb, nlh, -EOPNOTSUPP, NULL); 407 return kfree_skb(skb); 408 } 409 410 if (!try_module_get(ss->owner)) { 411 nfnl_unlock(subsys_id); 412 netlink_ack(oskb, nlh, -EOPNOTSUPP, NULL); 413 return kfree_skb(skb); 414 } 415 416 if (!ss->valid_genid(net, genid)) { 417 module_put(ss->owner); 418 nfnl_unlock(subsys_id); 419 netlink_ack(oskb, nlh, -ERESTART, NULL); 420 return kfree_skb(skb); 421 } 422 423 nfnl_unlock(subsys_id); 424 425 while (skb->len >= nlmsg_total_size(0)) { 426 int msglen, type; 427 428 if (fatal_signal_pending(current)) { 429 nfnl_err_reset(&err_list); 430 err = -EINTR; 431 status = NFNL_BATCH_FAILURE; 432 goto done; 433 } 434 435 memset(&extack, 0, sizeof(extack)); 436 nlh = nlmsg_hdr(skb); 437 err = 0; 438 439 if (nlh->nlmsg_len < NLMSG_HDRLEN || 440 skb->len < nlh->nlmsg_len || 441 nlmsg_len(nlh) < sizeof(struct nfgenmsg)) { 442 nfnl_err_reset(&err_list); 443 status |= NFNL_BATCH_FAILURE; 444 goto done; 445 } 446 447 /* Only requests are handled by the kernel */ 448 if (!(nlh->nlmsg_flags & NLM_F_REQUEST)) { 449 err = -EINVAL; 450 goto ack; 451 } 452 453 type = nlh->nlmsg_type; 454 if (type == NFNL_MSG_BATCH_BEGIN) { 455 /* Malformed: Batch begin twice */ 456 nfnl_err_reset(&err_list); 457 status |= NFNL_BATCH_FAILURE; 458 goto done; 459 } else if (type == NFNL_MSG_BATCH_END) { 460 status |= NFNL_BATCH_DONE; 461 goto done; 462 } else if (type < NLMSG_MIN_TYPE) { 463 err = -EINVAL; 464 goto ack; 465 } 466 467 /* We only accept a batch with messages for the same 468 * subsystem. 469 */ 470 if (NFNL_SUBSYS_ID(type) != subsys_id) { 471 err = -EINVAL; 472 goto ack; 473 } 474 475 nc = nfnetlink_find_client(type, ss); 476 if (!nc) { 477 err = -EINVAL; 478 goto ack; 479 } 480 481 if (nc->type != NFNL_CB_BATCH) { 482 err = -EINVAL; 483 goto ack; 484 } 485 486 { 487 int min_len = nlmsg_total_size(sizeof(struct nfgenmsg)); 488 struct nfnl_net *nfnlnet = nfnl_pernet(net); 489 struct nlattr *cda[NFNL_MAX_ATTR_COUNT + 1]; 490 struct nlattr *attr = (void *)nlh + min_len; 491 u8 cb_id = NFNL_MSG_TYPE(nlh->nlmsg_type); 492 int attrlen = nlh->nlmsg_len - min_len; 493 struct nfnl_info info = { 494 .net = net, 495 .sk = nfnlnet->nfnl, 496 .nlh = nlh, 497 .nfmsg = nlmsg_data(nlh), 498 .extack = &extack, 499 }; 500 501 /* Sanity-check NFTA_MAX_ATTR */ 502 if (ss->cb[cb_id].attr_count > NFNL_MAX_ATTR_COUNT) { 503 err = -ENOMEM; 504 goto ack; 505 } 506 507 err = nla_parse_deprecated(cda, 508 ss->cb[cb_id].attr_count, 509 attr, attrlen, 510 ss->cb[cb_id].policy, NULL); 511 if (err < 0) 512 goto ack; 513 514 err = nc->call(skb, &info, (const struct nlattr **)cda); 515 516 /* The lock was released to autoload some module, we 517 * have to abort and start from scratch using the 518 * original skb. 519 */ 520 if (err == -EAGAIN) { 521 status |= NFNL_BATCH_REPLAY; 522 goto done; 523 } 524 } 525 ack: 526 if (nlh->nlmsg_flags & NLM_F_ACK || err) { 527 /* Errors are delivered once the full batch has been 528 * processed, this avoids that the same error is 529 * reported several times when replaying the batch. 530 */ 531 if (nfnl_err_add(&err_list, nlh, err, &extack) < 0) { 532 /* We failed to enqueue an error, reset the 533 * list of errors and send OOM to userspace 534 * pointing to the batch header. 535 */ 536 nfnl_err_reset(&err_list); 537 netlink_ack(oskb, nlmsg_hdr(oskb), -ENOMEM, 538 NULL); 539 status |= NFNL_BATCH_FAILURE; 540 goto done; 541 } 542 /* We don't stop processing the batch on errors, thus, 543 * userspace gets all the errors that the batch 544 * triggers. 545 */ 546 if (err) 547 status |= NFNL_BATCH_FAILURE; 548 } 549 550 msglen = NLMSG_ALIGN(nlh->nlmsg_len); 551 if (msglen > skb->len) 552 msglen = skb->len; 553 skb_pull(skb, msglen); 554 } 555 done: 556 if (status & NFNL_BATCH_REPLAY) { 557 ss->abort(net, oskb, NFNL_ABORT_AUTOLOAD); 558 nfnl_err_reset(&err_list); 559 kfree_skb(skb); 560 module_put(ss->owner); 561 goto replay; 562 } else if (status == NFNL_BATCH_DONE) { 563 err = ss->commit(net, oskb); 564 if (err == -EAGAIN) { 565 status |= NFNL_BATCH_REPLAY; 566 goto done; 567 } else if (err) { 568 ss->abort(net, oskb, NFNL_ABORT_NONE); 569 netlink_ack(oskb, nlmsg_hdr(oskb), err, NULL); 570 } 571 } else { 572 enum nfnl_abort_action abort_action; 573 574 if (status & NFNL_BATCH_FAILURE) 575 abort_action = NFNL_ABORT_NONE; 576 else 577 abort_action = NFNL_ABORT_VALIDATE; 578 579 err = ss->abort(net, oskb, abort_action); 580 if (err == -EAGAIN) { 581 nfnl_err_reset(&err_list); 582 kfree_skb(skb); 583 module_put(ss->owner); 584 status |= NFNL_BATCH_FAILURE; 585 goto replay_abort; 586 } 587 } 588 if (ss->cleanup) 589 ss->cleanup(net); 590 591 nfnl_err_deliver(&err_list, oskb); 592 kfree_skb(skb); 593 module_put(ss->owner); 594 } 595 596 static const struct nla_policy nfnl_batch_policy[NFNL_BATCH_MAX + 1] = { 597 [NFNL_BATCH_GENID] = { .type = NLA_U32 }, 598 }; 599 600 static void nfnetlink_rcv_skb_batch(struct sk_buff *skb, struct nlmsghdr *nlh) 601 { 602 int min_len = nlmsg_total_size(sizeof(struct nfgenmsg)); 603 struct nlattr *attr = (void *)nlh + min_len; 604 struct nlattr *cda[NFNL_BATCH_MAX + 1]; 605 int attrlen = nlh->nlmsg_len - min_len; 606 struct nfgenmsg *nfgenmsg; 607 int msglen, err; 608 u32 gen_id = 0; 609 u16 res_id; 610 611 msglen = NLMSG_ALIGN(nlh->nlmsg_len); 612 if (msglen > skb->len) 613 msglen = skb->len; 614 615 if (skb->len < NLMSG_HDRLEN + sizeof(struct nfgenmsg)) 616 return; 617 618 err = nla_parse_deprecated(cda, NFNL_BATCH_MAX, attr, attrlen, 619 nfnl_batch_policy, NULL); 620 if (err < 0) { 621 netlink_ack(skb, nlh, err, NULL); 622 return; 623 } 624 if (cda[NFNL_BATCH_GENID]) 625 gen_id = ntohl(nla_get_be32(cda[NFNL_BATCH_GENID])); 626 627 nfgenmsg = nlmsg_data(nlh); 628 skb_pull(skb, msglen); 629 /* Work around old nft using host byte order */ 630 if (nfgenmsg->res_id == NFNL_SUBSYS_NFTABLES) 631 res_id = NFNL_SUBSYS_NFTABLES; 632 else 633 res_id = ntohs(nfgenmsg->res_id); 634 635 nfnetlink_rcv_batch(skb, nlh, res_id, gen_id); 636 } 637 638 static void nfnetlink_rcv(struct sk_buff *skb) 639 { 640 struct nlmsghdr *nlh = nlmsg_hdr(skb); 641 642 if (skb->len < NLMSG_HDRLEN || 643 nlh->nlmsg_len < NLMSG_HDRLEN || 644 skb->len < nlh->nlmsg_len) 645 return; 646 647 if (!netlink_net_capable(skb, CAP_NET_ADMIN)) { 648 netlink_ack(skb, nlh, -EPERM, NULL); 649 return; 650 } 651 652 if (nlh->nlmsg_type == NFNL_MSG_BATCH_BEGIN) 653 nfnetlink_rcv_skb_batch(skb, nlh); 654 else 655 netlink_rcv_skb(skb, nfnetlink_rcv_msg); 656 } 657 658 static int nfnetlink_bind(struct net *net, int group) 659 { 660 const struct nfnetlink_subsystem *ss; 661 int type; 662 663 if (group <= NFNLGRP_NONE || group > NFNLGRP_MAX) 664 return 0; 665 666 type = nfnl_group2type[group]; 667 668 rcu_read_lock(); 669 ss = nfnetlink_get_subsys(type << 8); 670 rcu_read_unlock(); 671 if (!ss) 672 request_module_nowait("nfnetlink-subsys-%d", type); 673 674 #ifdef CONFIG_NF_CONNTRACK_EVENTS 675 if (type == NFNL_SUBSYS_CTNETLINK) { 676 struct nfnl_net *nfnlnet = nfnl_pernet(net); 677 678 nfnl_lock(NFNL_SUBSYS_CTNETLINK); 679 680 if (WARN_ON_ONCE(nfnlnet->ctnetlink_listeners == UINT_MAX)) { 681 nfnl_unlock(NFNL_SUBSYS_CTNETLINK); 682 return -EOVERFLOW; 683 } 684 685 nfnlnet->ctnetlink_listeners++; 686 if (nfnlnet->ctnetlink_listeners == 1) 687 WRITE_ONCE(net->ct.ctnetlink_has_listener, true); 688 nfnl_unlock(NFNL_SUBSYS_CTNETLINK); 689 } 690 #endif 691 return 0; 692 } 693 694 static void nfnetlink_unbind(struct net *net, int group) 695 { 696 #ifdef CONFIG_NF_CONNTRACK_EVENTS 697 int type = nfnl_group2type[group]; 698 699 if (type == NFNL_SUBSYS_CTNETLINK) { 700 struct nfnl_net *nfnlnet = nfnl_pernet(net); 701 702 nfnl_lock(NFNL_SUBSYS_CTNETLINK); 703 WARN_ON_ONCE(nfnlnet->ctnetlink_listeners == 0); 704 nfnlnet->ctnetlink_listeners--; 705 if (nfnlnet->ctnetlink_listeners == 0) 706 WRITE_ONCE(net->ct.ctnetlink_has_listener, false); 707 nfnl_unlock(NFNL_SUBSYS_CTNETLINK); 708 } 709 #endif 710 } 711 712 static int __net_init nfnetlink_net_init(struct net *net) 713 { 714 struct nfnl_net *nfnlnet = nfnl_pernet(net); 715 struct netlink_kernel_cfg cfg = { 716 .groups = NFNLGRP_MAX, 717 .input = nfnetlink_rcv, 718 .bind = nfnetlink_bind, 719 .unbind = nfnetlink_unbind, 720 }; 721 722 nfnlnet->nfnl = netlink_kernel_create(net, NETLINK_NETFILTER, &cfg); 723 if (!nfnlnet->nfnl) 724 return -ENOMEM; 725 return 0; 726 } 727 728 static void __net_exit nfnetlink_net_exit_batch(struct list_head *net_exit_list) 729 { 730 struct nfnl_net *nfnlnet; 731 struct net *net; 732 733 list_for_each_entry(net, net_exit_list, exit_list) { 734 nfnlnet = nfnl_pernet(net); 735 736 netlink_kernel_release(nfnlnet->nfnl); 737 } 738 } 739 740 static struct pernet_operations nfnetlink_net_ops = { 741 .init = nfnetlink_net_init, 742 .exit_batch = nfnetlink_net_exit_batch, 743 .id = &nfnetlink_pernet_id, 744 .size = sizeof(struct nfnl_net), 745 }; 746 747 static int __init nfnetlink_init(void) 748 { 749 int i; 750 751 for (i = NFNLGRP_NONE + 1; i <= NFNLGRP_MAX; i++) 752 BUG_ON(nfnl_group2type[i] == NFNL_SUBSYS_NONE); 753 754 for (i=0; i<NFNL_SUBSYS_COUNT; i++) 755 __mutex_init(&table[i].mutex, nfnl_lockdep_names[i], &nfnl_lockdep_keys[i]); 756 757 return register_pernet_subsys(&nfnetlink_net_ops); 758 } 759 760 static void __exit nfnetlink_exit(void) 761 { 762 unregister_pernet_subsys(&nfnetlink_net_ops); 763 } 764 module_init(nfnetlink_init); 765 module_exit(nfnetlink_exit); 766