![Harald Welte](/assets/img/avatar_default.png)
Prior to this patch, every nfnetlink subsystem had to specify it's attribute count. However, in reality the attribute count depends on the message type within the subsystem, not the subsystem itself. This patch moves 'attr_count' from 'struct nfnetlink_subsys' into nfnl_callback to fix this. Signed-off-by: Harald Welte <laforge@netfilter.org> Signed-off-by: David S. Miller <davem@davemloft.net>
376 lines
8.6 KiB
C
376 lines
8.6 KiB
C
/* Netfilter messages via netlink socket. Allows for user space
|
|
* protocol helpers and general trouble making from userspace.
|
|
*
|
|
* (C) 2001 by Jay Schulist <jschlst@samba.org>,
|
|
* (C) 2002-2005 by Harald Welte <laforge@gnumonks.org>
|
|
* (C) 2005 by Pablo Neira Ayuso <pablo@eurodev.net>
|
|
*
|
|
* Initial netfilter messages via netlink development funded and
|
|
* generally made possible by Network Robots, Inc. (www.networkrobots.com)
|
|
*
|
|
* Further development of this code funded by Astaro AG (http://www.astaro.com)
|
|
*
|
|
* This software may be used and distributed according to the terms
|
|
* of the GNU General Public License, incorporated herein by reference.
|
|
*/
|
|
|
|
#include <linux/config.h>
|
|
#include <linux/module.h>
|
|
#include <linux/types.h>
|
|
#include <linux/socket.h>
|
|
#include <linux/kernel.h>
|
|
#include <linux/major.h>
|
|
#include <linux/sched.h>
|
|
#include <linux/timer.h>
|
|
#include <linux/string.h>
|
|
#include <linux/sockios.h>
|
|
#include <linux/net.h>
|
|
#include <linux/fcntl.h>
|
|
#include <linux/skbuff.h>
|
|
#include <asm/uaccess.h>
|
|
#include <asm/system.h>
|
|
#include <net/sock.h>
|
|
#include <linux/init.h>
|
|
#include <linux/spinlock.h>
|
|
|
|
#include <linux/netfilter.h>
|
|
#include <linux/netlink.h>
|
|
#include <linux/netfilter/nfnetlink.h>
|
|
|
|
MODULE_LICENSE("GPL");
|
|
MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
|
|
MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_NETFILTER);
|
|
|
|
static char __initdata nfversion[] = "0.30";
|
|
|
|
#if 0
|
|
#define DEBUGP(format, args...) \
|
|
printk(KERN_DEBUG "%s(%d):%s(): " format, __FILE__, \
|
|
__LINE__, __FUNCTION__, ## args)
|
|
#else
|
|
#define DEBUGP(format, args...)
|
|
#endif
|
|
|
|
static struct sock *nfnl = NULL;
|
|
static struct nfnetlink_subsystem *subsys_table[NFNL_SUBSYS_COUNT];
|
|
DECLARE_MUTEX(nfnl_sem);
|
|
|
|
void nfnl_lock(void)
|
|
{
|
|
nfnl_shlock();
|
|
}
|
|
|
|
void nfnl_unlock(void)
|
|
{
|
|
nfnl_shunlock();
|
|
}
|
|
|
|
int nfnetlink_subsys_register(struct nfnetlink_subsystem *n)
|
|
{
|
|
DEBUGP("registering subsystem ID %u\n", n->subsys_id);
|
|
|
|
nfnl_lock();
|
|
if (subsys_table[n->subsys_id]) {
|
|
nfnl_unlock();
|
|
return -EBUSY;
|
|
}
|
|
subsys_table[n->subsys_id] = n;
|
|
nfnl_unlock();
|
|
|
|
return 0;
|
|
}
|
|
|
|
int nfnetlink_subsys_unregister(struct nfnetlink_subsystem *n)
|
|
{
|
|
DEBUGP("unregistering subsystem ID %u\n", n->subsys_id);
|
|
|
|
nfnl_lock();
|
|
subsys_table[n->subsys_id] = NULL;
|
|
nfnl_unlock();
|
|
|
|
return 0;
|
|
}
|
|
|
|
static inline struct nfnetlink_subsystem *nfnetlink_get_subsys(u_int16_t type)
|
|
{
|
|
u_int8_t subsys_id = NFNL_SUBSYS_ID(type);
|
|
|
|
if (subsys_id >= NFNL_SUBSYS_COUNT
|
|
|| subsys_table[subsys_id] == NULL)
|
|
return NULL;
|
|
|
|
return subsys_table[subsys_id];
|
|
}
|
|
|
|
static inline struct nfnl_callback *
|
|
nfnetlink_find_client(u_int16_t type, struct nfnetlink_subsystem *ss)
|
|
{
|
|
u_int8_t cb_id = NFNL_MSG_TYPE(type);
|
|
|
|
if (cb_id >= ss->cb_count) {
|
|
DEBUGP("msgtype %u >= %u, returning\n", type, ss->cb_count);
|
|
return NULL;
|
|
}
|
|
|
|
return &ss->cb[cb_id];
|
|
}
|
|
|
|
void __nfa_fill(struct sk_buff *skb, int attrtype, int attrlen,
|
|
const void *data)
|
|
{
|
|
struct nfattr *nfa;
|
|
int size = NFA_LENGTH(attrlen);
|
|
|
|
nfa = (struct nfattr *)skb_put(skb, NFA_ALIGN(size));
|
|
nfa->nfa_type = attrtype;
|
|
nfa->nfa_len = size;
|
|
memcpy(NFA_DATA(nfa), data, attrlen);
|
|
memset(NFA_DATA(nfa) + attrlen, 0, NFA_ALIGN(size) - size);
|
|
}
|
|
|
|
int nfattr_parse(struct nfattr *tb[], int maxattr, struct nfattr *nfa, int len)
|
|
{
|
|
memset(tb, 0, sizeof(struct nfattr *) * maxattr);
|
|
|
|
while (NFA_OK(nfa, len)) {
|
|
unsigned flavor = nfa->nfa_type;
|
|
if (flavor && flavor <= maxattr)
|
|
tb[flavor-1] = nfa;
|
|
nfa = NFA_NEXT(nfa, len);
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
/**
|
|
* nfnetlink_check_attributes - check and parse nfnetlink attributes
|
|
*
|
|
* subsys: nfnl subsystem for which this message is to be parsed
|
|
* nlmsghdr: netlink message to be checked/parsed
|
|
* cda: array of pointers, needs to be at least subsys->attr_count big
|
|
*
|
|
*/
|
|
static int
|
|
nfnetlink_check_attributes(struct nfnetlink_subsystem *subsys,
|
|
struct nlmsghdr *nlh, struct nfattr *cda[])
|
|
{
|
|
int min_len;
|
|
u_int16_t attr_count;
|
|
u_int8_t cb_id = NFNL_MSG_TYPE(nlh->nlmsg_type);
|
|
|
|
if (unlikely(cb_id >= subsys->cb_count)) {
|
|
DEBUGP("msgtype %u >= %u, returning\n",
|
|
cb_id, subsys->cb_count);
|
|
return -EINVAL;
|
|
}
|
|
|
|
attr_count = subsys->cb[cb_id].attr_count;
|
|
|
|
memset(cda, 0, sizeof(struct nfattr *) * attr_count);
|
|
|
|
/* check attribute lengths. */
|
|
min_len = NLMSG_ALIGN(sizeof(struct nfgenmsg));
|
|
if (nlh->nlmsg_len < min_len)
|
|
return -EINVAL;
|
|
|
|
if (nlh->nlmsg_len > min_len) {
|
|
struct nfattr *attr = NFM_NFA(NLMSG_DATA(nlh));
|
|
int attrlen = nlh->nlmsg_len - NLMSG_ALIGN(min_len);
|
|
|
|
while (NFA_OK(attr, attrlen)) {
|
|
unsigned flavor = attr->nfa_type;
|
|
if (flavor) {
|
|
if (flavor > attr_count)
|
|
return -EINVAL;
|
|
cda[flavor - 1] = attr;
|
|
}
|
|
attr = NFA_NEXT(attr, attrlen);
|
|
}
|
|
} else
|
|
return -EINVAL;
|
|
|
|
return 0;
|
|
}
|
|
|
|
int nfnetlink_send(struct sk_buff *skb, u32 pid, unsigned group, int echo)
|
|
{
|
|
int allocation = in_interrupt() ? GFP_ATOMIC : GFP_KERNEL;
|
|
int err = 0;
|
|
|
|
NETLINK_CB(skb).dst_groups = group;
|
|
if (echo)
|
|
atomic_inc(&skb->users);
|
|
netlink_broadcast(nfnl, skb, pid, group, allocation);
|
|
if (echo)
|
|
err = netlink_unicast(nfnl, skb, pid, MSG_DONTWAIT);
|
|
|
|
return err;
|
|
}
|
|
|
|
int nfnetlink_unicast(struct sk_buff *skb, u_int32_t pid, int flags)
|
|
{
|
|
return netlink_unicast(nfnl, skb, pid, flags);
|
|
}
|
|
|
|
/* Process one complete nfnetlink message. */
|
|
static inline int nfnetlink_rcv_msg(struct sk_buff *skb,
|
|
struct nlmsghdr *nlh, int *errp)
|
|
{
|
|
struct nfnl_callback *nc;
|
|
struct nfnetlink_subsystem *ss;
|
|
int type, err = 0;
|
|
|
|
DEBUGP("entered; subsys=%u, msgtype=%u\n",
|
|
NFNL_SUBSYS_ID(nlh->nlmsg_type),
|
|
NFNL_MSG_TYPE(nlh->nlmsg_type));
|
|
|
|
/* Only requests are handled by kernel now. */
|
|
if (!(nlh->nlmsg_flags & NLM_F_REQUEST)) {
|
|
DEBUGP("received non-request message\n");
|
|
return 0;
|
|
}
|
|
|
|
/* All the messages must at least contain nfgenmsg */
|
|
if (nlh->nlmsg_len <
|
|
NLMSG_LENGTH(NLMSG_ALIGN(sizeof(struct nfgenmsg)))) {
|
|
DEBUGP("received message was too short\n");
|
|
return 0;
|
|
}
|
|
|
|
type = nlh->nlmsg_type;
|
|
ss = nfnetlink_get_subsys(type);
|
|
if (!ss) {
|
|
#ifdef CONFIG_KMOD
|
|
/* don't call nfnl_shunlock, since it would reenter
|
|
* with further packet processing */
|
|
up(&nfnl_sem);
|
|
request_module("nfnetlink-subsys-%d", NFNL_SUBSYS_ID(type));
|
|
nfnl_shlock();
|
|
ss = nfnetlink_get_subsys(type);
|
|
if (!ss)
|
|
#endif
|
|
goto err_inval;
|
|
}
|
|
|
|
nc = nfnetlink_find_client(type, ss);
|
|
if (!nc) {
|
|
DEBUGP("unable to find client for type %d\n", type);
|
|
goto err_inval;
|
|
}
|
|
|
|
if (nc->cap_required &&
|
|
!cap_raised(NETLINK_CB(skb).eff_cap, nc->cap_required)) {
|
|
DEBUGP("permission denied for type %d\n", type);
|
|
*errp = -EPERM;
|
|
return -1;
|
|
}
|
|
|
|
{
|
|
u_int16_t attr_count =
|
|
ss->cb[NFNL_MSG_TYPE(nlh->nlmsg_type)].attr_count;
|
|
struct nfattr *cda[attr_count];
|
|
|
|
memset(cda, 0, sizeof(struct nfattr *) * attr_count);
|
|
|
|
err = nfnetlink_check_attributes(ss, nlh, cda);
|
|
if (err < 0)
|
|
goto err_inval;
|
|
|
|
DEBUGP("calling handler\n");
|
|
err = nc->call(nfnl, skb, nlh, cda, errp);
|
|
*errp = err;
|
|
return err;
|
|
}
|
|
|
|
err_inval:
|
|
DEBUGP("returning -EINVAL\n");
|
|
*errp = -EINVAL;
|
|
return -1;
|
|
}
|
|
|
|
/* Process one packet of messages. */
|
|
static inline int nfnetlink_rcv_skb(struct sk_buff *skb)
|
|
{
|
|
int err;
|
|
struct nlmsghdr *nlh;
|
|
|
|
while (skb->len >= NLMSG_SPACE(0)) {
|
|
u32 rlen;
|
|
|
|
nlh = (struct nlmsghdr *)skb->data;
|
|
if (nlh->nlmsg_len < sizeof(struct nlmsghdr)
|
|
|| skb->len < nlh->nlmsg_len)
|
|
return 0;
|
|
rlen = NLMSG_ALIGN(nlh->nlmsg_len);
|
|
if (rlen > skb->len)
|
|
rlen = skb->len;
|
|
if (nfnetlink_rcv_msg(skb, nlh, &err)) {
|
|
if (!err)
|
|
return -1;
|
|
netlink_ack(skb, nlh, err);
|
|
} else
|
|
if (nlh->nlmsg_flags & NLM_F_ACK)
|
|
netlink_ack(skb, nlh, 0);
|
|
skb_pull(skb, rlen);
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static void nfnetlink_rcv(struct sock *sk, int len)
|
|
{
|
|
do {
|
|
struct sk_buff *skb;
|
|
|
|
if (nfnl_shlock_nowait())
|
|
return;
|
|
|
|
while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
|
|
if (nfnetlink_rcv_skb(skb)) {
|
|
if (skb->len)
|
|
skb_queue_head(&sk->sk_receive_queue,
|
|
skb);
|
|
else
|
|
kfree_skb(skb);
|
|
break;
|
|
}
|
|
kfree_skb(skb);
|
|
}
|
|
|
|
/* don't call nfnl_shunlock, since it would reenter
|
|
* with further packet processing */
|
|
up(&nfnl_sem);
|
|
} while(nfnl && nfnl->sk_receive_queue.qlen);
|
|
}
|
|
|
|
void __exit nfnetlink_exit(void)
|
|
{
|
|
printk("Removing netfilter NETLINK layer.\n");
|
|
sock_release(nfnl->sk_socket);
|
|
return;
|
|
}
|
|
|
|
int __init nfnetlink_init(void)
|
|
{
|
|
printk("Netfilter messages via NETLINK v%s.\n", nfversion);
|
|
|
|
nfnl = netlink_kernel_create(NETLINK_NETFILTER, nfnetlink_rcv,
|
|
THIS_MODULE);
|
|
if (!nfnl) {
|
|
printk(KERN_ERR "cannot initialize nfnetlink!\n");
|
|
return -1;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
module_init(nfnetlink_init);
|
|
module_exit(nfnetlink_exit);
|
|
|
|
EXPORT_SYMBOL_GPL(nfnetlink_subsys_register);
|
|
EXPORT_SYMBOL_GPL(nfnetlink_subsys_unregister);
|
|
EXPORT_SYMBOL_GPL(nfnetlink_send);
|
|
EXPORT_SYMBOL_GPL(nfnetlink_unicast);
|
|
EXPORT_SYMBOL_GPL(nfattr_parse);
|
|
EXPORT_SYMBOL_GPL(__nfa_fill);
|