xref: /openbmc/linux/net/netfilter/nfnetlink.c (revision 31b90347)
1 /* Netfilter messages via netlink socket. Allows for user space
2  * protocol helpers and general trouble making from userspace.
3  *
4  * (C) 2001 by Jay Schulist <jschlst@samba.org>,
5  * (C) 2002-2005 by Harald Welte <laforge@gnumonks.org>
6  * (C) 2005,2007 by Pablo Neira Ayuso <pablo@netfilter.org>
7  *
8  * Initial netfilter messages via netlink development funded and
9  * generally made possible by Network Robots, Inc. (www.networkrobots.com)
10  *
11  * Further development of this code funded by Astaro AG (http://www.astaro.com)
12  *
13  * This software may be used and distributed according to the terms
14  * of the GNU General Public License, incorporated herein by reference.
15  */
16 
17 #include <linux/module.h>
18 #include <linux/types.h>
19 #include <linux/socket.h>
20 #include <linux/kernel.h>
21 #include <linux/string.h>
22 #include <linux/sockios.h>
23 #include <linux/net.h>
24 #include <linux/skbuff.h>
25 #include <asm/uaccess.h>
26 #include <net/sock.h>
27 #include <linux/init.h>
28 
29 #include <net/netlink.h>
30 #include <linux/netfilter/nfnetlink.h>
31 
32 MODULE_LICENSE("GPL");
33 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
34 MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_NETFILTER);
35 
36 static char __initdata nfversion[] = "0.30";
37 
38 static struct {
39 	struct mutex				mutex;
40 	const struct nfnetlink_subsystem __rcu	*subsys;
41 } table[NFNL_SUBSYS_COUNT];
42 
43 static const int nfnl_group2type[NFNLGRP_MAX+1] = {
44 	[NFNLGRP_CONNTRACK_NEW]		= NFNL_SUBSYS_CTNETLINK,
45 	[NFNLGRP_CONNTRACK_UPDATE]	= NFNL_SUBSYS_CTNETLINK,
46 	[NFNLGRP_CONNTRACK_DESTROY]	= NFNL_SUBSYS_CTNETLINK,
47 	[NFNLGRP_CONNTRACK_EXP_NEW]	= NFNL_SUBSYS_CTNETLINK_EXP,
48 	[NFNLGRP_CONNTRACK_EXP_UPDATE]	= NFNL_SUBSYS_CTNETLINK_EXP,
49 	[NFNLGRP_CONNTRACK_EXP_DESTROY] = NFNL_SUBSYS_CTNETLINK_EXP,
50 };
51 
52 void nfnl_lock(__u8 subsys_id)
53 {
54 	mutex_lock(&table[subsys_id].mutex);
55 }
56 EXPORT_SYMBOL_GPL(nfnl_lock);
57 
58 void nfnl_unlock(__u8 subsys_id)
59 {
60 	mutex_unlock(&table[subsys_id].mutex);
61 }
62 EXPORT_SYMBOL_GPL(nfnl_unlock);
63 
64 int nfnetlink_subsys_register(const struct nfnetlink_subsystem *n)
65 {
66 	nfnl_lock(n->subsys_id);
67 	if (table[n->subsys_id].subsys) {
68 		nfnl_unlock(n->subsys_id);
69 		return -EBUSY;
70 	}
71 	rcu_assign_pointer(table[n->subsys_id].subsys, n);
72 	nfnl_unlock(n->subsys_id);
73 
74 	return 0;
75 }
76 EXPORT_SYMBOL_GPL(nfnetlink_subsys_register);
77 
78 int nfnetlink_subsys_unregister(const struct nfnetlink_subsystem *n)
79 {
80 	nfnl_lock(n->subsys_id);
81 	table[n->subsys_id].subsys = NULL;
82 	nfnl_unlock(n->subsys_id);
83 	synchronize_rcu();
84 	return 0;
85 }
86 EXPORT_SYMBOL_GPL(nfnetlink_subsys_unregister);
87 
88 static inline const struct nfnetlink_subsystem *nfnetlink_get_subsys(u_int16_t type)
89 {
90 	u_int8_t subsys_id = NFNL_SUBSYS_ID(type);
91 
92 	if (subsys_id >= NFNL_SUBSYS_COUNT)
93 		return NULL;
94 
95 	return rcu_dereference(table[subsys_id].subsys);
96 }
97 
98 static inline const struct nfnl_callback *
99 nfnetlink_find_client(u_int16_t type, const struct nfnetlink_subsystem *ss)
100 {
101 	u_int8_t cb_id = NFNL_MSG_TYPE(type);
102 
103 	if (cb_id >= ss->cb_count)
104 		return NULL;
105 
106 	return &ss->cb[cb_id];
107 }
108 
109 int nfnetlink_has_listeners(struct net *net, unsigned int group)
110 {
111 	return netlink_has_listeners(net->nfnl, group);
112 }
113 EXPORT_SYMBOL_GPL(nfnetlink_has_listeners);
114 
115 struct sk_buff *nfnetlink_alloc_skb(struct net *net, unsigned int size,
116 				    u32 dst_portid, gfp_t gfp_mask)
117 {
118 	return netlink_alloc_skb(net->nfnl, size, dst_portid, gfp_mask);
119 }
120 EXPORT_SYMBOL_GPL(nfnetlink_alloc_skb);
121 
122 int nfnetlink_send(struct sk_buff *skb, struct net *net, u32 portid,
123 		   unsigned int group, int echo, gfp_t flags)
124 {
125 	return nlmsg_notify(net->nfnl, skb, portid, group, echo, flags);
126 }
127 EXPORT_SYMBOL_GPL(nfnetlink_send);
128 
129 int nfnetlink_set_err(struct net *net, u32 portid, u32 group, int error)
130 {
131 	return netlink_set_err(net->nfnl, portid, group, error);
132 }
133 EXPORT_SYMBOL_GPL(nfnetlink_set_err);
134 
135 int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u32 portid,
136 		      int flags)
137 {
138 	return netlink_unicast(net->nfnl, skb, portid, flags);
139 }
140 EXPORT_SYMBOL_GPL(nfnetlink_unicast);
141 
142 /* Process one complete nfnetlink message. */
143 static int nfnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
144 {
145 	struct net *net = sock_net(skb->sk);
146 	const struct nfnl_callback *nc;
147 	const struct nfnetlink_subsystem *ss;
148 	int type, err;
149 
150 	/* All the messages must at least contain nfgenmsg */
151 	if (nlmsg_len(nlh) < sizeof(struct nfgenmsg))
152 		return 0;
153 
154 	type = nlh->nlmsg_type;
155 replay:
156 	rcu_read_lock();
157 	ss = nfnetlink_get_subsys(type);
158 	if (!ss) {
159 #ifdef CONFIG_MODULES
160 		rcu_read_unlock();
161 		request_module("nfnetlink-subsys-%d", NFNL_SUBSYS_ID(type));
162 		rcu_read_lock();
163 		ss = nfnetlink_get_subsys(type);
164 		if (!ss)
165 #endif
166 		{
167 			rcu_read_unlock();
168 			return -EINVAL;
169 		}
170 	}
171 
172 	nc = nfnetlink_find_client(type, ss);
173 	if (!nc) {
174 		rcu_read_unlock();
175 		return -EINVAL;
176 	}
177 
178 	{
179 		int min_len = nlmsg_total_size(sizeof(struct nfgenmsg));
180 		u_int8_t cb_id = NFNL_MSG_TYPE(nlh->nlmsg_type);
181 		struct nlattr *cda[ss->cb[cb_id].attr_count + 1];
182 		struct nlattr *attr = (void *)nlh + min_len;
183 		int attrlen = nlh->nlmsg_len - min_len;
184 		__u8 subsys_id = NFNL_SUBSYS_ID(type);
185 
186 		err = nla_parse(cda, ss->cb[cb_id].attr_count,
187 				attr, attrlen, ss->cb[cb_id].policy);
188 		if (err < 0) {
189 			rcu_read_unlock();
190 			return err;
191 		}
192 
193 		if (nc->call_rcu) {
194 			err = nc->call_rcu(net->nfnl, skb, nlh,
195 					   (const struct nlattr **)cda);
196 			rcu_read_unlock();
197 		} else {
198 			rcu_read_unlock();
199 			nfnl_lock(subsys_id);
200 			if (rcu_dereference_protected(table[subsys_id].subsys,
201 				lockdep_is_held(&table[subsys_id].mutex)) != ss ||
202 			    nfnetlink_find_client(type, ss) != nc)
203 				err = -EAGAIN;
204 			else if (nc->call)
205 				err = nc->call(net->nfnl, skb, nlh,
206 						   (const struct nlattr **)cda);
207 			else
208 				err = -EINVAL;
209 			nfnl_unlock(subsys_id);
210 		}
211 		if (err == -EAGAIN)
212 			goto replay;
213 		return err;
214 	}
215 }
216 
217 static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
218 				u_int16_t subsys_id)
219 {
220 	struct sk_buff *nskb, *oskb = skb;
221 	struct net *net = sock_net(skb->sk);
222 	const struct nfnetlink_subsystem *ss;
223 	const struct nfnl_callback *nc;
224 	bool success = true, done = false;
225 	int err;
226 
227 	if (subsys_id >= NFNL_SUBSYS_COUNT)
228 		return netlink_ack(skb, nlh, -EINVAL);
229 replay:
230 	nskb = netlink_skb_clone(oskb, GFP_KERNEL);
231 	if (!nskb)
232 		return netlink_ack(oskb, nlh, -ENOMEM);
233 
234 	nskb->sk = oskb->sk;
235 	skb = nskb;
236 
237 	nfnl_lock(subsys_id);
238 	ss = rcu_dereference_protected(table[subsys_id].subsys,
239 				       lockdep_is_held(&table[subsys_id].mutex));
240 	if (!ss) {
241 #ifdef CONFIG_MODULES
242 		nfnl_unlock(subsys_id);
243 		request_module("nfnetlink-subsys-%d", subsys_id);
244 		nfnl_lock(subsys_id);
245 		ss = rcu_dereference_protected(table[subsys_id].subsys,
246 					       lockdep_is_held(&table[subsys_id].mutex));
247 		if (!ss)
248 #endif
249 		{
250 			nfnl_unlock(subsys_id);
251 			kfree_skb(nskb);
252 			return netlink_ack(skb, nlh, -EOPNOTSUPP);
253 		}
254 	}
255 
256 	if (!ss->commit || !ss->abort) {
257 		nfnl_unlock(subsys_id);
258 		kfree_skb(nskb);
259 		return netlink_ack(skb, nlh, -EOPNOTSUPP);
260 	}
261 
262 	while (skb->len >= nlmsg_total_size(0)) {
263 		int msglen, type;
264 
265 		nlh = nlmsg_hdr(skb);
266 		err = 0;
267 
268 		if (nlh->nlmsg_len < NLMSG_HDRLEN) {
269 			err = -EINVAL;
270 			goto ack;
271 		}
272 
273 		/* Only requests are handled by the kernel */
274 		if (!(nlh->nlmsg_flags & NLM_F_REQUEST)) {
275 			err = -EINVAL;
276 			goto ack;
277 		}
278 
279 		type = nlh->nlmsg_type;
280 		if (type == NFNL_MSG_BATCH_BEGIN) {
281 			/* Malformed: Batch begin twice */
282 			success = false;
283 			goto done;
284 		} else if (type == NFNL_MSG_BATCH_END) {
285 			done = true;
286 			goto done;
287 		} else if (type < NLMSG_MIN_TYPE) {
288 			err = -EINVAL;
289 			goto ack;
290 		}
291 
292 		/* We only accept a batch with messages for the same
293 		 * subsystem.
294 		 */
295 		if (NFNL_SUBSYS_ID(type) != subsys_id) {
296 			err = -EINVAL;
297 			goto ack;
298 		}
299 
300 		nc = nfnetlink_find_client(type, ss);
301 		if (!nc) {
302 			err = -EINVAL;
303 			goto ack;
304 		}
305 
306 		{
307 			int min_len = nlmsg_total_size(sizeof(struct nfgenmsg));
308 			u_int8_t cb_id = NFNL_MSG_TYPE(nlh->nlmsg_type);
309 			struct nlattr *cda[ss->cb[cb_id].attr_count + 1];
310 			struct nlattr *attr = (void *)nlh + min_len;
311 			int attrlen = nlh->nlmsg_len - min_len;
312 
313 			err = nla_parse(cda, ss->cb[cb_id].attr_count,
314 					attr, attrlen, ss->cb[cb_id].policy);
315 			if (err < 0)
316 				goto ack;
317 
318 			if (nc->call_batch) {
319 				err = nc->call_batch(net->nfnl, skb, nlh,
320 						     (const struct nlattr **)cda);
321 			}
322 
323 			/* The lock was released to autoload some module, we
324 			 * have to abort and start from scratch using the
325 			 * original skb.
326 			 */
327 			if (err == -EAGAIN) {
328 				ss->abort(skb);
329 				nfnl_unlock(subsys_id);
330 				kfree_skb(nskb);
331 				goto replay;
332 			}
333 		}
334 ack:
335 		if (nlh->nlmsg_flags & NLM_F_ACK || err) {
336 			/* We don't stop processing the batch on errors, thus,
337 			 * userspace gets all the errors that the batch
338 			 * triggers.
339 			 */
340 			netlink_ack(skb, nlh, err);
341 			if (err)
342 				success = false;
343 		}
344 
345 		msglen = NLMSG_ALIGN(nlh->nlmsg_len);
346 		if (msglen > skb->len)
347 			msglen = skb->len;
348 		skb_pull(skb, msglen);
349 	}
350 done:
351 	if (success && done)
352 		ss->commit(skb);
353 	else
354 		ss->abort(skb);
355 
356 	nfnl_unlock(subsys_id);
357 	kfree_skb(nskb);
358 }
359 
360 static void nfnetlink_rcv(struct sk_buff *skb)
361 {
362 	struct nlmsghdr *nlh = nlmsg_hdr(skb);
363 	struct net *net = sock_net(skb->sk);
364 	int msglen;
365 
366 	if (nlh->nlmsg_len < NLMSG_HDRLEN ||
367 	    skb->len < nlh->nlmsg_len)
368 		return;
369 
370 	if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) {
371 		netlink_ack(skb, nlh, -EPERM);
372 		return;
373 	}
374 
375 	if (nlh->nlmsg_type == NFNL_MSG_BATCH_BEGIN) {
376 		struct nfgenmsg *nfgenmsg;
377 
378 		msglen = NLMSG_ALIGN(nlh->nlmsg_len);
379 		if (msglen > skb->len)
380 			msglen = skb->len;
381 
382 		if (nlh->nlmsg_len < NLMSG_HDRLEN ||
383 		    skb->len < NLMSG_HDRLEN + sizeof(struct nfgenmsg))
384 			return;
385 
386 		nfgenmsg = nlmsg_data(nlh);
387 		skb_pull(skb, msglen);
388 		nfnetlink_rcv_batch(skb, nlh, nfgenmsg->res_id);
389 	} else {
390 		netlink_rcv_skb(skb, &nfnetlink_rcv_msg);
391 	}
392 }
393 
394 #ifdef CONFIG_MODULES
395 static void nfnetlink_bind(int group)
396 {
397 	const struct nfnetlink_subsystem *ss;
398 	int type = nfnl_group2type[group];
399 
400 	rcu_read_lock();
401 	ss = nfnetlink_get_subsys(type);
402 	if (!ss) {
403 		rcu_read_unlock();
404 		request_module("nfnetlink-subsys-%d", type);
405 		return;
406 	}
407 	rcu_read_unlock();
408 }
409 #endif
410 
411 static int __net_init nfnetlink_net_init(struct net *net)
412 {
413 	struct sock *nfnl;
414 	struct netlink_kernel_cfg cfg = {
415 		.groups	= NFNLGRP_MAX,
416 		.input	= nfnetlink_rcv,
417 #ifdef CONFIG_MODULES
418 		.bind	= nfnetlink_bind,
419 #endif
420 	};
421 
422 	nfnl = netlink_kernel_create(net, NETLINK_NETFILTER, &cfg);
423 	if (!nfnl)
424 		return -ENOMEM;
425 	net->nfnl_stash = nfnl;
426 	rcu_assign_pointer(net->nfnl, nfnl);
427 	return 0;
428 }
429 
430 static void __net_exit nfnetlink_net_exit_batch(struct list_head *net_exit_list)
431 {
432 	struct net *net;
433 
434 	list_for_each_entry(net, net_exit_list, exit_list)
435 		RCU_INIT_POINTER(net->nfnl, NULL);
436 	synchronize_net();
437 	list_for_each_entry(net, net_exit_list, exit_list)
438 		netlink_kernel_release(net->nfnl_stash);
439 }
440 
441 static struct pernet_operations nfnetlink_net_ops = {
442 	.init		= nfnetlink_net_init,
443 	.exit_batch	= nfnetlink_net_exit_batch,
444 };
445 
446 static int __init nfnetlink_init(void)
447 {
448 	int i;
449 
450 	for (i=0; i<NFNL_SUBSYS_COUNT; i++)
451 		mutex_init(&table[i].mutex);
452 
453 	pr_info("Netfilter messages via NETLINK v%s.\n", nfversion);
454 	return register_pernet_subsys(&nfnetlink_net_ops);
455 }
456 
457 static void __exit nfnetlink_exit(void)
458 {
459 	pr_info("Removing netfilter NETLINK layer.\n");
460 	unregister_pernet_subsys(&nfnetlink_net_ops);
461 }
462 module_init(nfnetlink_init);
463 module_exit(nfnetlink_exit);
464