blob: 5c4b730a2e68fab5e33fe5b81ee386d2db5f1a7e [file] [log] [blame]
Harald Weltef6ebe772005-08-09 20:21:49 -07001#include <linux/kernel.h>
Tejun Heo5a0e3ad2010-03-24 17:04:11 +09002#include <linux/slab.h>
Harald Weltef6ebe772005-08-09 20:21:49 -07003#include <linux/init.h>
4#include <linux/module.h>
5#include <linux/proc_fs.h>
6#include <linux/skbuff.h>
7#include <linux/netfilter.h>
Harald Weltebbd86b9f2005-08-09 20:23:11 -07008#include <linux/seq_file.h>
Patrick McHardy7a11b982006-02-27 13:03:24 -08009#include <linux/rcupdate.h>
Harald Weltef6ebe772005-08-09 20:21:49 -070010#include <net/protocol.h>
Patrick McHardyc01cd422007-12-05 01:24:48 -080011#include <net/netfilter/nf_queue.h>
Eric Dumazet7fee2262010-05-11 23:19:48 +000012#include <net/dst.h>
Harald Weltef6ebe772005-08-09 20:21:49 -070013
14#include "nf_internals.h"
15
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -080016/*
Harald Weltef6ebe772005-08-09 20:21:49 -070017 * A queue handler may be registered for each protocol. Each is protected by
18 * long term mutex. The handler must provide an an outfn() to accept packets
19 * for queueing and must reinject all packets it receives, no matter what.
20 */
Arnd Bergmann0906a372010-03-09 20:59:15 +010021static const struct nf_queue_handler __rcu *queue_handler[NFPROTO_NUMPROTO] __read_mostly;
Harald Weltef6ebe772005-08-09 20:21:49 -070022
Yasuyuki Kozakai585426f2007-07-07 22:40:26 -070023static DEFINE_MUTEX(queue_handler_mutex);
Harald Weltef6ebe772005-08-09 20:21:49 -070024
Harald Welted72367b2005-08-09 20:23:36 -070025/* return EBUSY when somebody else is registered, return EEXIST if the
26 * same handler is registered, return 0 in case of success. */
Jan Engelhardt76108ce2008-10-08 11:35:00 +020027int nf_register_queue_handler(u_int8_t pf, const struct nf_queue_handler *qh)
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -080028{
Harald Weltef6ebe772005-08-09 20:21:49 -070029 int ret;
Eric Dumazet0e60ebe2010-11-15 18:17:21 +010030 const struct nf_queue_handler *old;
Harald Weltef6ebe772005-08-09 20:21:49 -070031
Jan Engelhardt7e9c6ee2008-10-08 11:35:00 +020032 if (pf >= ARRAY_SIZE(queue_handler))
Harald Weltef6ebe772005-08-09 20:21:49 -070033 return -EINVAL;
34
Yasuyuki Kozakai585426f2007-07-07 22:40:26 -070035 mutex_lock(&queue_handler_mutex);
Eric Dumazet0e60ebe2010-11-15 18:17:21 +010036 old = rcu_dereference_protected(queue_handler[pf],
37 lockdep_is_held(&queue_handler_mutex));
38 if (old == qh)
Harald Welted72367b2005-08-09 20:23:36 -070039 ret = -EEXIST;
Eric Dumazet0e60ebe2010-11-15 18:17:21 +010040 else if (old)
Harald Weltef6ebe772005-08-09 20:21:49 -070041 ret = -EBUSY;
42 else {
Yasuyuki Kozakai585426f2007-07-07 22:40:26 -070043 rcu_assign_pointer(queue_handler[pf], qh);
Harald Weltef6ebe772005-08-09 20:21:49 -070044 ret = 0;
45 }
Yasuyuki Kozakai585426f2007-07-07 22:40:26 -070046 mutex_unlock(&queue_handler_mutex);
Harald Weltef6ebe772005-08-09 20:21:49 -070047
48 return ret;
49}
50EXPORT_SYMBOL(nf_register_queue_handler);
51
52/* The caller must flush their queue before this */
Jan Engelhardt76108ce2008-10-08 11:35:00 +020053int nf_unregister_queue_handler(u_int8_t pf, const struct nf_queue_handler *qh)
Harald Weltef6ebe772005-08-09 20:21:49 -070054{
Eric Dumazet0e60ebe2010-11-15 18:17:21 +010055 const struct nf_queue_handler *old;
56
Jan Engelhardt7e9c6ee2008-10-08 11:35:00 +020057 if (pf >= ARRAY_SIZE(queue_handler))
Harald Weltef6ebe772005-08-09 20:21:49 -070058 return -EINVAL;
59
Yasuyuki Kozakai585426f2007-07-07 22:40:26 -070060 mutex_lock(&queue_handler_mutex);
Eric Dumazet0e60ebe2010-11-15 18:17:21 +010061 old = rcu_dereference_protected(queue_handler[pf],
62 lockdep_is_held(&queue_handler_mutex));
63 if (old && old != qh) {
Yasuyuki Kozakai585426f2007-07-07 22:40:26 -070064 mutex_unlock(&queue_handler_mutex);
Yasuyuki Kozakaice7663d2007-07-07 22:40:08 -070065 return -EINVAL;
66 }
67
Yasuyuki Kozakai585426f2007-07-07 22:40:26 -070068 rcu_assign_pointer(queue_handler[pf], NULL);
69 mutex_unlock(&queue_handler_mutex);
70
71 synchronize_rcu();
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -080072
Harald Weltef6ebe772005-08-09 20:21:49 -070073 return 0;
74}
75EXPORT_SYMBOL(nf_unregister_queue_handler);
76
Patrick McHardye3ac5292007-12-05 01:23:57 -080077void nf_unregister_queue_handlers(const struct nf_queue_handler *qh)
Harald Weltef6ebe772005-08-09 20:21:49 -070078{
Jan Engelhardt76108ce2008-10-08 11:35:00 +020079 u_int8_t pf;
Harald Weltef6ebe772005-08-09 20:21:49 -070080
Yasuyuki Kozakai585426f2007-07-07 22:40:26 -070081 mutex_lock(&queue_handler_mutex);
Jan Engelhardt7e9c6ee2008-10-08 11:35:00 +020082 for (pf = 0; pf < ARRAY_SIZE(queue_handler); pf++) {
Eric Dumazet0e60ebe2010-11-15 18:17:21 +010083 if (rcu_dereference_protected(
84 queue_handler[pf],
85 lockdep_is_held(&queue_handler_mutex)
86 ) == qh)
Yasuyuki Kozakai585426f2007-07-07 22:40:26 -070087 rcu_assign_pointer(queue_handler[pf], NULL);
Harald Weltef6ebe772005-08-09 20:21:49 -070088 }
Yasuyuki Kozakai585426f2007-07-07 22:40:26 -070089 mutex_unlock(&queue_handler_mutex);
90
91 synchronize_rcu();
Harald Weltef6ebe772005-08-09 20:21:49 -070092}
93EXPORT_SYMBOL_GPL(nf_unregister_queue_handlers);
94
Patrick McHardydaaa8be2007-12-05 01:27:19 -080095static void nf_queue_entry_release_refs(struct nf_queue_entry *entry)
96{
97 /* Release those devices we held, or Alexey will kill me. */
98 if (entry->indev)
99 dev_put(entry->indev);
100 if (entry->outdev)
101 dev_put(entry->outdev);
102#ifdef CONFIG_BRIDGE_NETFILTER
103 if (entry->skb->nf_bridge) {
104 struct nf_bridge_info *nf_bridge = entry->skb->nf_bridge;
105
106 if (nf_bridge->physindev)
107 dev_put(nf_bridge->physindev);
108 if (nf_bridge->physoutdev)
109 dev_put(nf_bridge->physoutdev);
110 }
111#endif
112 /* Drop reference to owner of hook which queued us. */
113 module_put(entry->elem->owner);
114}
115
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800116/*
117 * Any packet that leaves via this function must come back
Harald Weltef6ebe772005-08-09 20:21:49 -0700118 * through nf_reinject().
119 */
Patrick McHardy394f5452006-08-05 00:58:52 -0700120static int __nf_queue(struct sk_buff *skb,
121 struct list_head *elem,
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200122 u_int8_t pf, unsigned int hook,
Patrick McHardy394f5452006-08-05 00:58:52 -0700123 struct net_device *indev,
124 struct net_device *outdev,
125 int (*okfn)(struct sk_buff *),
126 unsigned int queuenum)
Harald Weltef6ebe772005-08-09 20:21:49 -0700127{
Florian Westphalf1585082011-01-18 15:27:28 +0100128 int status = -ENOENT;
Patrick McHardydaaa8be2007-12-05 01:27:19 -0800129 struct nf_queue_entry *entry = NULL;
Harald Weltef6ebe772005-08-09 20:21:49 -0700130#ifdef CONFIG_BRIDGE_NETFILTER
Patrick McHardydaaa8be2007-12-05 01:27:19 -0800131 struct net_device *physindev;
132 struct net_device *physoutdev;
Harald Weltef6ebe772005-08-09 20:21:49 -0700133#endif
Patrick McHardy1e796fd2007-12-17 22:42:27 -0800134 const struct nf_afinfo *afinfo;
Patrick McHardye3ac5292007-12-05 01:23:57 -0800135 const struct nf_queue_handler *qh;
Harald Weltef6ebe772005-08-09 20:21:49 -0700136
137 /* QUEUE == DROP if noone is waiting, to be safe. */
Yasuyuki Kozakai585426f2007-07-07 22:40:26 -0700138 rcu_read_lock();
139
140 qh = rcu_dereference(queue_handler[pf]);
Patrick McHardydaaa8be2007-12-05 01:27:19 -0800141 if (!qh)
142 goto err_unlock;
Harald Weltef6ebe772005-08-09 20:21:49 -0700143
Patrick McHardybce80322006-04-06 14:18:09 -0700144 afinfo = nf_get_afinfo(pf);
Patrick McHardydaaa8be2007-12-05 01:27:19 -0800145 if (!afinfo)
146 goto err_unlock;
Patrick McHardybce80322006-04-06 14:18:09 -0700147
Patrick McHardy02f014d2007-12-05 01:26:33 -0800148 entry = kmalloc(sizeof(*entry) + afinfo->route_key_size, GFP_ATOMIC);
Florian Westphalf1585082011-01-18 15:27:28 +0100149 if (!entry) {
150 status = -ENOMEM;
Patrick McHardydaaa8be2007-12-05 01:27:19 -0800151 goto err_unlock;
Florian Westphalf1585082011-01-18 15:27:28 +0100152 }
Harald Weltef6ebe772005-08-09 20:21:49 -0700153
Patrick McHardy02f014d2007-12-05 01:26:33 -0800154 *entry = (struct nf_queue_entry) {
155 .skb = skb,
156 .elem = list_entry(elem, struct nf_hook_ops, list),
157 .pf = pf,
158 .hook = hook,
159 .indev = indev,
160 .outdev = outdev,
161 .okfn = okfn,
162 };
Harald Weltef6ebe772005-08-09 20:21:49 -0700163
164 /* If it's going away, ignore hook. */
Patrick McHardy02f014d2007-12-05 01:26:33 -0800165 if (!try_module_get(entry->elem->owner)) {
Florian Westphal06cdb632011-01-18 15:28:38 +0100166 status = -ECANCELED;
167 goto err_unlock;
Harald Weltef6ebe772005-08-09 20:21:49 -0700168 }
Harald Weltef6ebe772005-08-09 20:21:49 -0700169 /* Bump dev refs so they don't vanish while packet is out */
Patrick McHardy8b1cf0d2007-12-05 01:23:17 -0800170 if (indev)
171 dev_hold(indev);
172 if (outdev)
173 dev_hold(outdev);
Harald Weltef6ebe772005-08-09 20:21:49 -0700174#ifdef CONFIG_BRIDGE_NETFILTER
Patrick McHardy394f5452006-08-05 00:58:52 -0700175 if (skb->nf_bridge) {
176 physindev = skb->nf_bridge->physindev;
Patrick McHardy8b1cf0d2007-12-05 01:23:17 -0800177 if (physindev)
178 dev_hold(physindev);
Patrick McHardy394f5452006-08-05 00:58:52 -0700179 physoutdev = skb->nf_bridge->physoutdev;
Patrick McHardy8b1cf0d2007-12-05 01:23:17 -0800180 if (physoutdev)
181 dev_hold(physoutdev);
Harald Weltef6ebe772005-08-09 20:21:49 -0700182 }
183#endif
Eric Dumazet7fee2262010-05-11 23:19:48 +0000184 skb_dst_force(skb);
Patrick McHardy02f014d2007-12-05 01:26:33 -0800185 afinfo->saveroute(skb, entry);
186 status = qh->outfn(entry, queuenum);
Harald Weltef6ebe772005-08-09 20:21:49 -0700187
Yasuyuki Kozakai585426f2007-07-07 22:40:26 -0700188 rcu_read_unlock();
Harald Weltef6ebe772005-08-09 20:21:49 -0700189
190 if (status < 0) {
Patrick McHardydaaa8be2007-12-05 01:27:19 -0800191 nf_queue_entry_release_refs(entry);
192 goto err;
Harald Weltef6ebe772005-08-09 20:21:49 -0700193 }
194
Florian Westphalf1585082011-01-18 15:27:28 +0100195 return 0;
Patrick McHardydaaa8be2007-12-05 01:27:19 -0800196
197err_unlock:
198 rcu_read_unlock();
199err:
Patrick McHardydaaa8be2007-12-05 01:27:19 -0800200 kfree(entry);
Florian Westphalf1585082011-01-18 15:27:28 +0100201 return status;
Harald Weltef6ebe772005-08-09 20:21:49 -0700202}
203
Patrick McHardy394f5452006-08-05 00:58:52 -0700204int nf_queue(struct sk_buff *skb,
205 struct list_head *elem,
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200206 u_int8_t pf, unsigned int hook,
Patrick McHardy394f5452006-08-05 00:58:52 -0700207 struct net_device *indev,
208 struct net_device *outdev,
209 int (*okfn)(struct sk_buff *),
210 unsigned int queuenum)
211{
212 struct sk_buff *segs;
Florian Westphalf1585082011-01-18 15:27:28 +0100213 int err;
214 unsigned int queued;
Patrick McHardy394f5452006-08-05 00:58:52 -0700215
216 if (!skb_is_gso(skb))
217 return __nf_queue(skb, elem, pf, hook, indev, outdev, okfn,
218 queuenum);
219
220 switch (pf) {
Jan Engelhardt4b1e27e2009-04-14 14:26:49 +0200221 case NFPROTO_IPV4:
Patrick McHardy394f5452006-08-05 00:58:52 -0700222 skb->protocol = htons(ETH_P_IP);
223 break;
Jan Engelhardt4b1e27e2009-04-14 14:26:49 +0200224 case NFPROTO_IPV6:
Patrick McHardy394f5452006-08-05 00:58:52 -0700225 skb->protocol = htons(ETH_P_IPV6);
226 break;
227 }
228
229 segs = skb_gso_segment(skb, 0);
Florian Westphalf1585082011-01-18 15:27:28 +0100230 /* Does not use PTR_ERR to limit the number of error codes that can be
231 * returned by nf_queue. For instance, callers rely on -ECANCELED to mean
232 * 'ignore this hook'.
233 */
Hirofumi Nakagawa801678c2008-04-29 01:03:09 -0700234 if (IS_ERR(segs))
Florian Westphalf1585082011-01-18 15:27:28 +0100235 return -EINVAL;
Patrick McHardy394f5452006-08-05 00:58:52 -0700236
Florian Westphalf1585082011-01-18 15:27:28 +0100237 queued = 0;
238 err = 0;
Patrick McHardy394f5452006-08-05 00:58:52 -0700239 do {
240 struct sk_buff *nskb = segs->next;
241
242 segs->next = NULL;
Florian Westphalf1585082011-01-18 15:27:28 +0100243 if (err == 0)
244 err = __nf_queue(segs, elem, pf, hook, indev,
245 outdev, okfn, queuenum);
246 if (err == 0)
247 queued++;
248 else
Patrick McHardy394f5452006-08-05 00:58:52 -0700249 kfree_skb(segs);
250 segs = nskb;
251 } while (segs);
Florian Westphalf1585082011-01-18 15:27:28 +0100252
Florian Westphal06cdb632011-01-18 15:28:38 +0100253 /* also free orig skb if only some segments were queued */
Florian Westphalf1585082011-01-18 15:27:28 +0100254 if (unlikely(err && queued))
255 err = 0;
Florian Westphal06cdb632011-01-18 15:28:38 +0100256 if (err == 0)
257 kfree_skb(skb);
Florian Westphalf1585082011-01-18 15:27:28 +0100258 return err;
Patrick McHardy394f5452006-08-05 00:58:52 -0700259}
260
Patrick McHardy02f014d2007-12-05 01:26:33 -0800261void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
Harald Weltef6ebe772005-08-09 20:21:49 -0700262{
Patrick McHardy02f014d2007-12-05 01:26:33 -0800263 struct sk_buff *skb = entry->skb;
264 struct list_head *elem = &entry->elem->list;
Patrick McHardy1e796fd2007-12-17 22:42:27 -0800265 const struct nf_afinfo *afinfo;
Florian Westphalf1585082011-01-18 15:27:28 +0100266 int err;
Harald Weltef6ebe772005-08-09 20:21:49 -0700267
268 rcu_read_lock();
269
Patrick McHardydaaa8be2007-12-05 01:27:19 -0800270 nf_queue_entry_release_refs(entry);
Harald Weltef6ebe772005-08-09 20:21:49 -0700271
Harald Weltef6ebe772005-08-09 20:21:49 -0700272 /* Continue traversal iff userspace said ok... */
273 if (verdict == NF_REPEAT) {
274 elem = elem->prev;
275 verdict = NF_ACCEPT;
276 }
277
278 if (verdict == NF_ACCEPT) {
Patrick McHardy02f014d2007-12-05 01:26:33 -0800279 afinfo = nf_get_afinfo(entry->pf);
280 if (!afinfo || afinfo->reroute(skb, entry) < 0)
Patrick McHardy7a11b982006-02-27 13:03:24 -0800281 verdict = NF_DROP;
282 }
283
284 if (verdict == NF_ACCEPT) {
Harald Weltef6ebe772005-08-09 20:21:49 -0700285 next_hook:
Patrick McHardy02f014d2007-12-05 01:26:33 -0800286 verdict = nf_iterate(&nf_hooks[entry->pf][entry->hook],
287 skb, entry->hook,
288 entry->indev, entry->outdev, &elem,
289 entry->okfn, INT_MIN);
Harald Weltef6ebe772005-08-09 20:21:49 -0700290 }
291
292 switch (verdict & NF_VERDICT_MASK) {
293 case NF_ACCEPT:
Patrick McHardy3bc38712006-07-24 22:52:47 -0700294 case NF_STOP:
Patrick McHardy4b3d15e2007-12-05 01:27:02 -0800295 local_bh_disable();
Patrick McHardy02f014d2007-12-05 01:26:33 -0800296 entry->okfn(skb);
Patrick McHardy4b3d15e2007-12-05 01:27:02 -0800297 local_bh_enable();
Harald Weltef6ebe772005-08-09 20:21:49 -0700298 break;
Harald Weltef6ebe772005-08-09 20:21:49 -0700299 case NF_QUEUE:
Florian Westphalf1585082011-01-18 15:27:28 +0100300 err = __nf_queue(skb, elem, entry->pf, entry->hook,
301 entry->indev, entry->outdev, entry->okfn,
302 verdict >> NF_VERDICT_BITS);
Florian Westphal06cdb632011-01-18 15:28:38 +0100303 if (err < 0) {
304 if (err == -ECANCELED)
305 goto next_hook;
306 kfree_skb(skb);
307 }
Harald Weltef6ebe772005-08-09 20:21:49 -0700308 break;
Eric Dumazet64507fd2010-02-19 15:28:38 +0100309 case NF_STOLEN:
Patrick McHardy3bc38712006-07-24 22:52:47 -0700310 default:
311 kfree_skb(skb);
Harald Weltef6ebe772005-08-09 20:21:49 -0700312 }
313 rcu_read_unlock();
Patrick McHardy02f014d2007-12-05 01:26:33 -0800314 kfree(entry);
Harald Weltef6ebe772005-08-09 20:21:49 -0700315}
316EXPORT_SYMBOL(nf_reinject);
317
Harald Weltebbd86b9f2005-08-09 20:23:11 -0700318#ifdef CONFIG_PROC_FS
319static void *seq_start(struct seq_file *seq, loff_t *pos)
320{
Jan Engelhardt7e9c6ee2008-10-08 11:35:00 +0200321 if (*pos >= ARRAY_SIZE(queue_handler))
Harald Weltebbd86b9f2005-08-09 20:23:11 -0700322 return NULL;
323
324 return pos;
325}
326
327static void *seq_next(struct seq_file *s, void *v, loff_t *pos)
328{
329 (*pos)++;
330
Jan Engelhardt7e9c6ee2008-10-08 11:35:00 +0200331 if (*pos >= ARRAY_SIZE(queue_handler))
Harald Weltebbd86b9f2005-08-09 20:23:11 -0700332 return NULL;
333
334 return pos;
335}
336
337static void seq_stop(struct seq_file *s, void *v)
338{
339
340}
341
342static int seq_show(struct seq_file *s, void *v)
343{
344 int ret;
345 loff_t *pos = v;
Patrick McHardye3ac5292007-12-05 01:23:57 -0800346 const struct nf_queue_handler *qh;
Harald Weltebbd86b9f2005-08-09 20:23:11 -0700347
Yasuyuki Kozakai585426f2007-07-07 22:40:26 -0700348 rcu_read_lock();
349 qh = rcu_dereference(queue_handler[*pos]);
Harald Weltebbd86b9f2005-08-09 20:23:11 -0700350 if (!qh)
351 ret = seq_printf(s, "%2lld NONE\n", *pos);
352 else
353 ret = seq_printf(s, "%2lld %s\n", *pos, qh->name);
Yasuyuki Kozakai585426f2007-07-07 22:40:26 -0700354 rcu_read_unlock();
Harald Weltebbd86b9f2005-08-09 20:23:11 -0700355
356 return ret;
357}
358
Philippe De Muyter56b3d972007-07-10 23:07:31 -0700359static const struct seq_operations nfqueue_seq_ops = {
Harald Weltebbd86b9f2005-08-09 20:23:11 -0700360 .start = seq_start,
361 .next = seq_next,
362 .stop = seq_stop,
363 .show = seq_show,
364};
365
366static int nfqueue_open(struct inode *inode, struct file *file)
367{
368 return seq_open(file, &nfqueue_seq_ops);
369}
370
Arjan van de Venda7071d2007-02-12 00:55:36 -0800371static const struct file_operations nfqueue_file_ops = {
Harald Weltebbd86b9f2005-08-09 20:23:11 -0700372 .owner = THIS_MODULE,
373 .open = nfqueue_open,
374 .read = seq_read,
375 .llseek = seq_lseek,
376 .release = seq_release,
377};
378#endif /* PROC_FS */
379
380
Harald Weltef6ebe772005-08-09 20:21:49 -0700381int __init netfilter_queue_init(void)
382{
Harald Weltebbd86b9f2005-08-09 20:23:11 -0700383#ifdef CONFIG_PROC_FS
Denis V. Lunev8eeee8b2008-03-27 16:55:53 -0700384 if (!proc_create("nf_queue", S_IRUGO,
385 proc_net_netfilter, &nfqueue_file_ops))
Harald Weltebbd86b9f2005-08-09 20:23:11 -0700386 return -1;
Harald Weltebbd86b9f2005-08-09 20:23:11 -0700387#endif
Harald Weltef6ebe772005-08-09 20:21:49 -0700388 return 0;
389}
390