Blame view
net/netfilter/nfnetlink.c
5.53 KB
f9e815b37
|
1 2 3 4 5 |
/* Netfilter messages via netlink socket. Allows for user space * protocol helpers and general trouble making from userspace. * * (C) 2001 by Jay Schulist <jschlst@samba.org>, * (C) 2002-2005 by Harald Welte <laforge@gnumonks.org> |
67ca39660
|
6 |
* (C) 2005,2007 by Pablo Neira Ayuso <pablo@netfilter.org> |
f9e815b37
|
7 8 9 10 11 12 13 14 15 |
* * Initial netfilter messages via netlink development funded and * generally made possible by Network Robots, Inc. (www.networkrobots.com) * * Further development of this code funded by Astaro AG (http://www.astaro.com) * * This software may be used and distributed according to the terms * of the GNU General Public License, incorporated herein by reference. */ |
f9e815b37
|
16 17 18 19 |
#include <linux/module.h> #include <linux/types.h> #include <linux/socket.h> #include <linux/kernel.h> |
f9e815b37
|
20 21 22 |
#include <linux/string.h> #include <linux/sockios.h> #include <linux/net.h> |
f9e815b37
|
23 24 25 26 |
#include <linux/skbuff.h> #include <asm/uaccess.h> #include <asm/system.h> #include <net/sock.h> |
a3c5029cf
|
27 |
#include <net/netlink.h> |
f9e815b37
|
28 |
#include <linux/init.h> |
f9e815b37
|
29 |
|
f9e815b37
|
30 31 32 33 |
#include <linux/netlink.h> #include <linux/netfilter/nfnetlink.h> MODULE_LICENSE("GPL"); |
4fdb3bb72
|
34 35 |
MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>"); MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_NETFILTER); |
f9e815b37
|
36 37 |
static char __initdata nfversion[] = "0.30"; |
7c8d4cb41
|
38 |
static const struct nfnetlink_subsystem *subsys_table[NFNL_SUBSYS_COUNT]; |
a3c5029cf
|
39 |
static DEFINE_MUTEX(nfnl_mutex); |
f9e815b37
|
40 |
|
e6a7d3c04
|
41 |
void nfnl_lock(void) |
f9e815b37
|
42 |
{ |
a3c5029cf
|
43 |
mutex_lock(&nfnl_mutex); |
f9e815b37
|
44 |
} |
e6a7d3c04
|
45 |
EXPORT_SYMBOL_GPL(nfnl_lock); |
f9e815b37
|
46 |
|
e6a7d3c04
|
47 |
void nfnl_unlock(void) |
a3c5029cf
|
48 49 |
{ mutex_unlock(&nfnl_mutex); |
f9e815b37
|
50 |
} |
e6a7d3c04
|
51 |
EXPORT_SYMBOL_GPL(nfnl_unlock); |
f9e815b37
|
52 |
|
7c8d4cb41
|
53 |
int nfnetlink_subsys_register(const struct nfnetlink_subsystem *n) |
f9e815b37
|
54 |
{ |
f9e815b37
|
55 |
nfnl_lock(); |
0ab43f849
|
56 57 58 59 |
if (subsys_table[n->subsys_id]) { nfnl_unlock(); return -EBUSY; } |
f9e815b37
|
60 61 62 63 64 |
subsys_table[n->subsys_id] = n; nfnl_unlock(); return 0; } |
f4bc177f0
|
65 |
EXPORT_SYMBOL_GPL(nfnetlink_subsys_register); |
f9e815b37
|
66 |
|
7c8d4cb41
|
67 |
int nfnetlink_subsys_unregister(const struct nfnetlink_subsystem *n) |
f9e815b37
|
68 |
{ |
f9e815b37
|
69 70 71 72 73 74 |
nfnl_lock(); subsys_table[n->subsys_id] = NULL; nfnl_unlock(); return 0; } |
f4bc177f0
|
75 |
EXPORT_SYMBOL_GPL(nfnetlink_subsys_unregister); |
f9e815b37
|
76 |
|
7c8d4cb41
|
77 |
static inline const struct nfnetlink_subsystem *nfnetlink_get_subsys(u_int16_t type) |
f9e815b37
|
78 79 |
{ u_int8_t subsys_id = NFNL_SUBSYS_ID(type); |
ac0f1d989
|
80 |
if (subsys_id >= NFNL_SUBSYS_COUNT) |
f9e815b37
|
81 82 83 84 |
return NULL; return subsys_table[subsys_id]; } |
7c8d4cb41
|
85 86 |
static inline const struct nfnl_callback * nfnetlink_find_client(u_int16_t type, const struct nfnetlink_subsystem *ss) |
f9e815b37
|
87 88 |
{ u_int8_t cb_id = NFNL_MSG_TYPE(type); |
601e68e10
|
89 |
|
67ca39660
|
90 |
if (cb_id >= ss->cb_count) |
f9e815b37
|
91 |
return NULL; |
f9e815b37
|
92 93 94 |
return &ss->cb[cb_id]; } |
cd8c20b65
|
95 |
int nfnetlink_has_listeners(struct net *net, unsigned int group) |
a24276924
|
96 |
{ |
cd8c20b65
|
97 |
return netlink_has_listeners(net->nfnl, group); |
a24276924
|
98 99 |
} EXPORT_SYMBOL_GPL(nfnetlink_has_listeners); |
cd8c20b65
|
100 |
int nfnetlink_send(struct sk_buff *skb, struct net *net, u32 pid, |
e34d5c1a4
|
101 |
unsigned group, int echo, gfp_t flags) |
f9e815b37
|
102 |
{ |
cd8c20b65
|
103 |
return nlmsg_notify(net->nfnl, skb, pid, group, echo, flags); |
f9e815b37
|
104 |
} |
f4bc177f0
|
105 |
EXPORT_SYMBOL_GPL(nfnetlink_send); |
f9e815b37
|
106 |
|
37b7ef720
|
107 |
int nfnetlink_set_err(struct net *net, u32 pid, u32 group, int error) |
dd5b6ce6f
|
108 |
{ |
37b7ef720
|
109 |
return netlink_set_err(net->nfnl, pid, group, error); |
dd5b6ce6f
|
110 111 |
} EXPORT_SYMBOL_GPL(nfnetlink_set_err); |
cd8c20b65
|
112 |
int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u_int32_t pid, int flags) |
f9e815b37
|
113 |
{ |
cd8c20b65
|
114 |
return netlink_unicast(net->nfnl, skb, pid, flags); |
f9e815b37
|
115 |
} |
f4bc177f0
|
116 |
EXPORT_SYMBOL_GPL(nfnetlink_unicast); |
f9e815b37
|
117 118 |
/* Process one complete nfnetlink message. */ |
1d00a4eb4
|
119 |
static int nfnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh) |
f9e815b37
|
120 |
{ |
cd8c20b65
|
121 |
struct net *net = sock_net(skb->sk); |
7c8d4cb41
|
122 123 |
const struct nfnl_callback *nc; const struct nfnetlink_subsystem *ss; |
1d00a4eb4
|
124 |
int type, err; |
f9e815b37
|
125 |
|
1d00a4eb4
|
126 127 |
if (security_netlink_recv(skb, CAP_NET_ADMIN)) return -EPERM; |
37d2e7a20
|
128 |
|
f9e815b37
|
129 |
/* All the messages must at least contain nfgenmsg */ |
f49c857ff
|
130 |
if (nlh->nlmsg_len < NLMSG_LENGTH(sizeof(struct nfgenmsg))) |
f9e815b37
|
131 |
return 0; |
f9e815b37
|
132 133 |
type = nlh->nlmsg_type; |
e6a7d3c04
|
134 |
replay: |
f9e815b37
|
135 |
ss = nfnetlink_get_subsys(type); |
0ab43f849
|
136 |
if (!ss) { |
95a5afca4
|
137 |
#ifdef CONFIG_MODULES |
3b71535f3
|
138 |
nfnl_unlock(); |
37d2e7a20
|
139 |
request_module("nfnetlink-subsys-%d", NFNL_SUBSYS_ID(type)); |
a3c5029cf
|
140 |
nfnl_lock(); |
37d2e7a20
|
141 |
ss = nfnetlink_get_subsys(type); |
0ab43f849
|
142 143 |
if (!ss) #endif |
1d00a4eb4
|
144 |
return -EINVAL; |
0ab43f849
|
145 |
} |
f9e815b37
|
146 147 |
nc = nfnetlink_find_client(type, ss); |
67ca39660
|
148 |
if (!nc) |
1d00a4eb4
|
149 |
return -EINVAL; |
f9e815b37
|
150 |
|
f9e815b37
|
151 |
{ |
e37305782
|
152 153 |
int min_len = NLMSG_SPACE(sizeof(struct nfgenmsg)); u_int8_t cb_id = NFNL_MSG_TYPE(nlh->nlmsg_type); |
f49c857ff
|
154 155 156 157 158 159 160 161 |
struct nlattr *cda[ss->cb[cb_id].attr_count + 1]; struct nlattr *attr = (void *)nlh + min_len; int attrlen = nlh->nlmsg_len - min_len; err = nla_parse(cda, ss->cb[cb_id].attr_count, attr, attrlen, ss->cb[cb_id].policy); if (err < 0) return err; |
601e68e10
|
162 |
|
cd8c20b65
|
163 |
err = nc->call(net->nfnl, skb, nlh, (const struct nlattr **)cda); |
e6a7d3c04
|
164 165 166 |
if (err == -EAGAIN) goto replay; return err; |
f9e815b37
|
167 |
} |
f9e815b37
|
168 |
} |
cd40b7d39
|
169 |
static void nfnetlink_rcv(struct sk_buff *skb) |
f9e815b37
|
170 |
{ |
cd40b7d39
|
171 172 173 |
nfnl_lock(); netlink_rcv_skb(skb, &nfnetlink_rcv_msg); nfnl_unlock(); |
f9e815b37
|
174 |
} |
cd8c20b65
|
175 |
static int __net_init nfnetlink_net_init(struct net *net) |
f9e815b37
|
176 |
{ |
cd8c20b65
|
177 178 179 180 181 182 183 184 185 |
struct sock *nfnl; nfnl = netlink_kernel_create(net, NETLINK_NETFILTER, NFNLGRP_MAX, nfnetlink_rcv, NULL, THIS_MODULE); if (!nfnl) return -ENOMEM; net->nfnl_stash = nfnl; rcu_assign_pointer(net->nfnl, nfnl); return 0; |
f9e815b37
|
186 |
} |
cd8c20b65
|
187 |
static void __net_exit nfnetlink_net_exit_batch(struct list_head *net_exit_list) |
f9e815b37
|
188 |
{ |
cd8c20b65
|
189 |
struct net *net; |
f9e815b37
|
190 |
|
cd8c20b65
|
191 192 193 194 195 196 |
list_for_each_entry(net, net_exit_list, exit_list) rcu_assign_pointer(net->nfnl, NULL); synchronize_net(); list_for_each_entry(net, net_exit_list, exit_list) netlink_kernel_release(net->nfnl_stash); } |
f9e815b37
|
197 |
|
cd8c20b65
|
198 199 200 201 202 203 204 |
static struct pernet_operations nfnetlink_net_ops = { .init = nfnetlink_net_init, .exit_batch = nfnetlink_net_exit_batch, }; static int __init nfnetlink_init(void) { |
654d0fbdc
|
205 206 |
pr_info("Netfilter messages via NETLINK v%s. ", nfversion); |
cd8c20b65
|
207 |
return register_pernet_subsys(&nfnetlink_net_ops); |
f9e815b37
|
208 |
} |
cd8c20b65
|
209 210 |
static void __exit nfnetlink_exit(void) { |
654d0fbdc
|
211 212 |
pr_info("Removing netfilter NETLINK layer. "); |
cd8c20b65
|
213 214 |
unregister_pernet_subsys(&nfnetlink_net_ops); } |
f9e815b37
|
215 216 |
module_init(nfnetlink_init); module_exit(nfnetlink_exit); |