1 /* Netfilter messages via netlink socket. Allows for user space
2 * protocol helpers and general trouble making from userspace.
4 * (C) 2001 by Jay Schulist <jschlst@samba.org>,
5 * (C) 2002-2005 by Harald Welte <laforge@gnumonks.org>
6 * (C) 2005-2017 by Pablo Neira Ayuso <pablo@netfilter.org>
8 * Initial netfilter messages via netlink development funded and
9 * generally made possible by Network Robots, Inc. (www.networkrobots.com)
11 * Further development of this code funded by Astaro AG (http://www.astaro.com)
13 * This software may be used and distributed according to the terms
14 * of the GNU General Public License, incorporated herein by reference.
17 #include <linux/module.h>
18 #include <linux/types.h>
19 #include <linux/socket.h>
20 #include <linux/kernel.h>
21 #include <linux/string.h>
22 #include <linux/sockios.h>
23 #include <linux/net.h>
24 #include <linux/skbuff.h>
25 #include <linux/uaccess.h>
27 #include <linux/init.h>
29 #include <net/netlink.h>
30 #include <linux/netfilter/nfnetlink.h>
32 MODULE_LICENSE("GPL");
33 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
34 MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK
, NETLINK_NETFILTER
);
36 #define nfnl_dereference_protected(id) \
37 rcu_dereference_protected(table[(id)].subsys, \
38 lockdep_nfnl_is_held((id)))
40 static char __initdata nfversion
[] = "0.30";
44 const struct nfnetlink_subsystem __rcu
*subsys
;
45 } table
[NFNL_SUBSYS_COUNT
];
47 static const int nfnl_group2type
[NFNLGRP_MAX
+1] = {
48 [NFNLGRP_CONNTRACK_NEW
] = NFNL_SUBSYS_CTNETLINK
,
49 [NFNLGRP_CONNTRACK_UPDATE
] = NFNL_SUBSYS_CTNETLINK
,
50 [NFNLGRP_CONNTRACK_DESTROY
] = NFNL_SUBSYS_CTNETLINK
,
51 [NFNLGRP_CONNTRACK_EXP_NEW
] = NFNL_SUBSYS_CTNETLINK_EXP
,
52 [NFNLGRP_CONNTRACK_EXP_UPDATE
] = NFNL_SUBSYS_CTNETLINK_EXP
,
53 [NFNLGRP_CONNTRACK_EXP_DESTROY
] = NFNL_SUBSYS_CTNETLINK_EXP
,
54 [NFNLGRP_NFTABLES
] = NFNL_SUBSYS_NFTABLES
,
55 [NFNLGRP_ACCT_QUOTA
] = NFNL_SUBSYS_ACCT
,
56 [NFNLGRP_NFTRACE
] = NFNL_SUBSYS_NFTABLES
,
59 void nfnl_lock(__u8 subsys_id
)
61 mutex_lock(&table
[subsys_id
].mutex
);
63 EXPORT_SYMBOL_GPL(nfnl_lock
);
65 void nfnl_unlock(__u8 subsys_id
)
67 mutex_unlock(&table
[subsys_id
].mutex
);
69 EXPORT_SYMBOL_GPL(nfnl_unlock
);
71 #ifdef CONFIG_PROVE_LOCKING
72 bool lockdep_nfnl_is_held(u8 subsys_id
)
74 return lockdep_is_held(&table
[subsys_id
].mutex
);
76 EXPORT_SYMBOL_GPL(lockdep_nfnl_is_held
);
79 int nfnetlink_subsys_register(const struct nfnetlink_subsystem
*n
)
81 nfnl_lock(n
->subsys_id
);
82 if (table
[n
->subsys_id
].subsys
) {
83 nfnl_unlock(n
->subsys_id
);
86 rcu_assign_pointer(table
[n
->subsys_id
].subsys
, n
);
87 nfnl_unlock(n
->subsys_id
);
91 EXPORT_SYMBOL_GPL(nfnetlink_subsys_register
);
93 int nfnetlink_subsys_unregister(const struct nfnetlink_subsystem
*n
)
95 nfnl_lock(n
->subsys_id
);
96 table
[n
->subsys_id
].subsys
= NULL
;
97 nfnl_unlock(n
->subsys_id
);
101 EXPORT_SYMBOL_GPL(nfnetlink_subsys_unregister
);
103 static inline const struct nfnetlink_subsystem
*nfnetlink_get_subsys(u16 type
)
105 u8 subsys_id
= NFNL_SUBSYS_ID(type
);
107 if (subsys_id
>= NFNL_SUBSYS_COUNT
)
110 return rcu_dereference(table
[subsys_id
].subsys
);
113 static inline const struct nfnl_callback
*
114 nfnetlink_find_client(u16 type
, const struct nfnetlink_subsystem
*ss
)
116 u8 cb_id
= NFNL_MSG_TYPE(type
);
118 if (cb_id
>= ss
->cb_count
)
121 return &ss
->cb
[cb_id
];
124 int nfnetlink_has_listeners(struct net
*net
, unsigned int group
)
126 return netlink_has_listeners(net
->nfnl
, group
);
128 EXPORT_SYMBOL_GPL(nfnetlink_has_listeners
);
130 int nfnetlink_send(struct sk_buff
*skb
, struct net
*net
, u32 portid
,
131 unsigned int group
, int echo
, gfp_t flags
)
133 return nlmsg_notify(net
->nfnl
, skb
, portid
, group
, echo
, flags
);
135 EXPORT_SYMBOL_GPL(nfnetlink_send
);
137 int nfnetlink_set_err(struct net
*net
, u32 portid
, u32 group
, int error
)
139 return netlink_set_err(net
->nfnl
, portid
, group
, error
);
141 EXPORT_SYMBOL_GPL(nfnetlink_set_err
);
143 int nfnetlink_unicast(struct sk_buff
*skb
, struct net
*net
, u32 portid
,
146 return netlink_unicast(net
->nfnl
, skb
, portid
, flags
);
148 EXPORT_SYMBOL_GPL(nfnetlink_unicast
);
150 /* Process one complete nfnetlink message. */
151 static int nfnetlink_rcv_msg(struct sk_buff
*skb
, struct nlmsghdr
*nlh
)
153 struct net
*net
= sock_net(skb
->sk
);
154 const struct nfnl_callback
*nc
;
155 const struct nfnetlink_subsystem
*ss
;
158 /* All the messages must at least contain nfgenmsg */
159 if (nlmsg_len(nlh
) < sizeof(struct nfgenmsg
))
162 type
= nlh
->nlmsg_type
;
165 ss
= nfnetlink_get_subsys(type
);
167 #ifdef CONFIG_MODULES
169 request_module("nfnetlink-subsys-%d", NFNL_SUBSYS_ID(type
));
171 ss
= nfnetlink_get_subsys(type
);
180 nc
= nfnetlink_find_client(type
, ss
);
187 int min_len
= nlmsg_total_size(sizeof(struct nfgenmsg
));
188 u8 cb_id
= NFNL_MSG_TYPE(nlh
->nlmsg_type
);
189 struct nlattr
*cda
[ss
->cb
[cb_id
].attr_count
+ 1];
190 struct nlattr
*attr
= (void *)nlh
+ min_len
;
191 int attrlen
= nlh
->nlmsg_len
- min_len
;
192 __u8 subsys_id
= NFNL_SUBSYS_ID(type
);
194 err
= nla_parse(cda
, ss
->cb
[cb_id
].attr_count
,
195 attr
, attrlen
, ss
->cb
[cb_id
].policy
);
202 err
= nc
->call_rcu(net
, net
->nfnl
, skb
, nlh
,
203 (const struct nlattr
**)cda
);
207 nfnl_lock(subsys_id
);
208 if (nfnl_dereference_protected(subsys_id
) != ss
||
209 nfnetlink_find_client(type
, ss
) != nc
)
212 err
= nc
->call(net
, net
->nfnl
, skb
, nlh
,
213 (const struct nlattr
**)cda
);
216 nfnl_unlock(subsys_id
);
225 struct list_head head
;
226 struct nlmsghdr
*nlh
;
230 static int nfnl_err_add(struct list_head
*list
, struct nlmsghdr
*nlh
, int err
)
232 struct nfnl_err
*nfnl_err
;
234 nfnl_err
= kmalloc(sizeof(struct nfnl_err
), GFP_KERNEL
);
235 if (nfnl_err
== NULL
)
240 list_add_tail(&nfnl_err
->head
, list
);
245 static void nfnl_err_del(struct nfnl_err
*nfnl_err
)
247 list_del(&nfnl_err
->head
);
251 static void nfnl_err_reset(struct list_head
*err_list
)
253 struct nfnl_err
*nfnl_err
, *next
;
255 list_for_each_entry_safe(nfnl_err
, next
, err_list
, head
)
256 nfnl_err_del(nfnl_err
);
259 static void nfnl_err_deliver(struct list_head
*err_list
, struct sk_buff
*skb
)
261 struct nfnl_err
*nfnl_err
, *next
;
263 list_for_each_entry_safe(nfnl_err
, next
, err_list
, head
) {
264 netlink_ack(skb
, nfnl_err
->nlh
, nfnl_err
->err
);
265 nfnl_err_del(nfnl_err
);
270 NFNL_BATCH_FAILURE
= (1 << 0),
271 NFNL_BATCH_DONE
= (1 << 1),
272 NFNL_BATCH_REPLAY
= (1 << 2),
275 static void nfnetlink_rcv_batch(struct sk_buff
*skb
, struct nlmsghdr
*nlh
,
276 u16 subsys_id
, u32 genid
)
278 struct sk_buff
*oskb
= skb
;
279 struct net
*net
= sock_net(skb
->sk
);
280 const struct nfnetlink_subsystem
*ss
;
281 const struct nfnl_callback
*nc
;
286 if (subsys_id
>= NFNL_SUBSYS_COUNT
)
287 return netlink_ack(skb
, nlh
, -EINVAL
);
291 skb
= netlink_skb_clone(oskb
, GFP_KERNEL
);
293 return netlink_ack(oskb
, nlh
, -ENOMEM
);
295 nfnl_lock(subsys_id
);
296 ss
= nfnl_dereference_protected(subsys_id
);
298 #ifdef CONFIG_MODULES
299 nfnl_unlock(subsys_id
);
300 request_module("nfnetlink-subsys-%d", subsys_id
);
301 nfnl_lock(subsys_id
);
302 ss
= nfnl_dereference_protected(subsys_id
);
306 nfnl_unlock(subsys_id
);
307 netlink_ack(oskb
, nlh
, -EOPNOTSUPP
);
308 return kfree_skb(skb
);
312 if (!ss
->commit
|| !ss
->abort
) {
313 nfnl_unlock(subsys_id
);
314 netlink_ack(oskb
, nlh
, -EOPNOTSUPP
);
315 return kfree_skb(skb
);
318 if (genid
&& ss
->valid_genid
&& !ss
->valid_genid(net
, genid
)) {
319 nfnl_unlock(subsys_id
);
320 netlink_ack(oskb
, nlh
, -ERESTART
);
321 return kfree_skb(skb
);
324 while (skb
->len
>= nlmsg_total_size(0)) {
327 nlh
= nlmsg_hdr(skb
);
330 if (nlh
->nlmsg_len
< NLMSG_HDRLEN
||
331 skb
->len
< nlh
->nlmsg_len
||
332 nlmsg_len(nlh
) < sizeof(struct nfgenmsg
)) {
333 nfnl_err_reset(&err_list
);
334 status
|= NFNL_BATCH_FAILURE
;
338 /* Only requests are handled by the kernel */
339 if (!(nlh
->nlmsg_flags
& NLM_F_REQUEST
)) {
344 type
= nlh
->nlmsg_type
;
345 if (type
== NFNL_MSG_BATCH_BEGIN
) {
346 /* Malformed: Batch begin twice */
347 nfnl_err_reset(&err_list
);
348 status
|= NFNL_BATCH_FAILURE
;
350 } else if (type
== NFNL_MSG_BATCH_END
) {
351 status
|= NFNL_BATCH_DONE
;
353 } else if (type
< NLMSG_MIN_TYPE
) {
358 /* We only accept a batch with messages for the same
361 if (NFNL_SUBSYS_ID(type
) != subsys_id
) {
366 nc
= nfnetlink_find_client(type
, ss
);
373 int min_len
= nlmsg_total_size(sizeof(struct nfgenmsg
));
374 u8 cb_id
= NFNL_MSG_TYPE(nlh
->nlmsg_type
);
375 struct nlattr
*cda
[ss
->cb
[cb_id
].attr_count
+ 1];
376 struct nlattr
*attr
= (void *)nlh
+ min_len
;
377 int attrlen
= nlh
->nlmsg_len
- min_len
;
379 err
= nla_parse(cda
, ss
->cb
[cb_id
].attr_count
,
380 attr
, attrlen
, ss
->cb
[cb_id
].policy
);
384 if (nc
->call_batch
) {
385 err
= nc
->call_batch(net
, net
->nfnl
, skb
, nlh
,
386 (const struct nlattr
**)cda
);
389 /* The lock was released to autoload some module, we
390 * have to abort and start from scratch using the
393 if (err
== -EAGAIN
) {
394 status
|= NFNL_BATCH_REPLAY
;
399 if (nlh
->nlmsg_flags
& NLM_F_ACK
|| err
) {
400 /* Errors are delivered once the full batch has been
401 * processed, this avoids that the same error is
402 * reported several times when replaying the batch.
404 if (nfnl_err_add(&err_list
, nlh
, err
) < 0) {
405 /* We failed to enqueue an error, reset the
406 * list of errors and send OOM to userspace
407 * pointing to the batch header.
409 nfnl_err_reset(&err_list
);
410 netlink_ack(oskb
, nlmsg_hdr(oskb
), -ENOMEM
);
411 status
|= NFNL_BATCH_FAILURE
;
414 /* We don't stop processing the batch on errors, thus,
415 * userspace gets all the errors that the batch
419 status
|= NFNL_BATCH_FAILURE
;
422 msglen
= NLMSG_ALIGN(nlh
->nlmsg_len
);
423 if (msglen
> skb
->len
)
425 skb_pull(skb
, msglen
);
428 if (status
& NFNL_BATCH_REPLAY
) {
429 ss
->abort(net
, oskb
);
430 nfnl_err_reset(&err_list
);
431 nfnl_unlock(subsys_id
);
434 } else if (status
== NFNL_BATCH_DONE
) {
435 ss
->commit(net
, oskb
);
437 ss
->abort(net
, oskb
);
440 nfnl_err_deliver(&err_list
, oskb
);
441 nfnl_unlock(subsys_id
);
445 static const struct nla_policy nfnl_batch_policy
[NFNL_BATCH_MAX
+ 1] = {
446 [NFNL_BATCH_GENID
] = { .type
= NLA_U32
},
449 static void nfnetlink_rcv_skb_batch(struct sk_buff
*skb
, struct nlmsghdr
*nlh
)
451 int min_len
= nlmsg_total_size(sizeof(struct nfgenmsg
));
452 struct nlattr
*attr
= (void *)nlh
+ min_len
;
453 struct nlattr
*cda
[NFNL_BATCH_MAX
+ 1];
454 int attrlen
= nlh
->nlmsg_len
- min_len
;
455 struct nfgenmsg
*nfgenmsg
;
460 msglen
= NLMSG_ALIGN(nlh
->nlmsg_len
);
461 if (msglen
> skb
->len
)
464 if (nlh
->nlmsg_len
< NLMSG_HDRLEN
||
465 skb
->len
< NLMSG_HDRLEN
+ sizeof(struct nfgenmsg
))
468 err
= nla_parse(cda
, NFNL_BATCH_MAX
, attr
, attrlen
, nfnl_batch_policy
);
470 netlink_ack(skb
, nlh
, err
);
473 if (cda
[NFNL_BATCH_GENID
])
474 gen_id
= ntohl(nla_get_be32(cda
[NFNL_BATCH_GENID
]));
476 nfgenmsg
= nlmsg_data(nlh
);
477 skb_pull(skb
, msglen
);
478 /* Work around old nft using host byte order */
479 if (nfgenmsg
->res_id
== NFNL_SUBSYS_NFTABLES
)
480 res_id
= NFNL_SUBSYS_NFTABLES
;
482 res_id
= ntohs(nfgenmsg
->res_id
);
484 nfnetlink_rcv_batch(skb
, nlh
, res_id
, gen_id
);
487 static void nfnetlink_rcv(struct sk_buff
*skb
)
489 struct nlmsghdr
*nlh
= nlmsg_hdr(skb
);
491 if (nlh
->nlmsg_len
< NLMSG_HDRLEN
||
492 skb
->len
< nlh
->nlmsg_len
)
495 if (!netlink_net_capable(skb
, CAP_NET_ADMIN
)) {
496 netlink_ack(skb
, nlh
, -EPERM
);
500 if (nlh
->nlmsg_type
== NFNL_MSG_BATCH_BEGIN
)
501 nfnetlink_rcv_skb_batch(skb
, nlh
);
503 netlink_rcv_skb(skb
, &nfnetlink_rcv_msg
);
506 #ifdef CONFIG_MODULES
507 static int nfnetlink_bind(struct net
*net
, int group
)
509 const struct nfnetlink_subsystem
*ss
;
512 if (group
<= NFNLGRP_NONE
|| group
> NFNLGRP_MAX
)
515 type
= nfnl_group2type
[group
];
518 ss
= nfnetlink_get_subsys(type
<< 8);
521 request_module("nfnetlink-subsys-%d", type
);
526 static int __net_init
nfnetlink_net_init(struct net
*net
)
529 struct netlink_kernel_cfg cfg
= {
530 .groups
= NFNLGRP_MAX
,
531 .input
= nfnetlink_rcv
,
532 #ifdef CONFIG_MODULES
533 .bind
= nfnetlink_bind
,
537 nfnl
= netlink_kernel_create(net
, NETLINK_NETFILTER
, &cfg
);
540 net
->nfnl_stash
= nfnl
;
541 rcu_assign_pointer(net
->nfnl
, nfnl
);
545 static void __net_exit
nfnetlink_net_exit_batch(struct list_head
*net_exit_list
)
549 list_for_each_entry(net
, net_exit_list
, exit_list
)
550 RCU_INIT_POINTER(net
->nfnl
, NULL
);
552 list_for_each_entry(net
, net_exit_list
, exit_list
)
553 netlink_kernel_release(net
->nfnl_stash
);
556 static struct pernet_operations nfnetlink_net_ops
= {
557 .init
= nfnetlink_net_init
,
558 .exit_batch
= nfnetlink_net_exit_batch
,
561 static int __init
nfnetlink_init(void)
565 for (i
= NFNLGRP_NONE
+ 1; i
<= NFNLGRP_MAX
; i
++)
566 BUG_ON(nfnl_group2type
[i
] == NFNL_SUBSYS_NONE
);
568 for (i
=0; i
<NFNL_SUBSYS_COUNT
; i
++)
569 mutex_init(&table
[i
].mutex
);
571 pr_info("Netfilter messages via NETLINK v%s.\n", nfversion
);
572 return register_pernet_subsys(&nfnetlink_net_ops
);
575 static void __exit
nfnetlink_exit(void)
577 pr_info("Removing netfilter NETLINK layer.\n");
578 unregister_pernet_subsys(&nfnetlink_net_ops
);
580 module_init(nfnetlink_init
);
581 module_exit(nfnetlink_exit
);