Blame view
net/netfilter/nfnetlink_log.c
29.4 KB
d2912cb15
|
1 |
// SPDX-License-Identifier: GPL-2.0-only |
0597f2680
|
2 3 4 5 6 |
/* * This is a module which is used for logging packets to userspace via * nfetlink. * * (C) 2005 by Harald Welte <laforge@netfilter.org> |
f229f6ce4
|
7 |
* (C) 2006-2012 Patrick McHardy <kaber@trash.net> |
0597f2680
|
8 9 10 |
* * Based on the old ipv4-only ipt_ULOG.c: * (C) 2000-2004 by Harald Welte <laforge@netfilter.org> |
0597f2680
|
11 |
*/ |
beacd3e8e
|
12 13 |
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt |
0597f2680
|
14 15 |
#include <linux/module.h> #include <linux/skbuff.h> |
e035edd16
|
16 |
#include <linux/if_arp.h> |
0597f2680
|
17 18 19 20 21 |
#include <linux/init.h> #include <linux/ip.h> #include <linux/ipv6.h> #include <linux/netdevice.h> #include <linux/netfilter.h> |
c737b7c45
|
22 |
#include <linux/netfilter_bridge.h> |
573ce260b
|
23 |
#include <net/netlink.h> |
0597f2680
|
24 25 |
#include <linux/netfilter/nfnetlink.h> #include <linux/netfilter/nfnetlink_log.h> |
a29a9a585
|
26 |
#include <linux/netfilter/nf_conntrack_common.h> |
0597f2680
|
27 28 29 30 31 |
#include <linux/spinlock.h> #include <linux/sysctl.h> #include <linux/proc_fs.h> #include <linux/security.h> #include <linux/list.h> |
5a0e3ad6a
|
32 |
#include <linux/slab.h> |
0597f2680
|
33 |
#include <net/sock.h> |
f01ffbd6e
|
34 |
#include <net/netfilter/nf_log.h> |
9368a53c4
|
35 |
#include <net/netns/generic.h> |
0597f2680
|
36 |
|
60063497a
|
37 |
#include <linux/atomic.h> |
b54ab92b8
|
38 |
#include <linux/refcount.h> |
0597f2680
|
39 |
|
1109a90c0
|
40 |
#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) |
fbcd923c3
|
41 42 |
#include "../bridge/br_private.h" #endif |
ce20cdf49
|
43 |
#define NFULNL_COPY_DISABLED 0xff |
c2db29243
|
44 |
#define NFULNL_NLBUFSIZ_DEFAULT NLMSG_GOODSIZE |
2c6764b74
|
45 |
#define NFULNL_TIMEOUT_DEFAULT 100 /* every second */ |
0597f2680
|
46 |
#define NFULNL_QTHRESH_DEFAULT 100 /* 100 packets */ |
c1e7dc91e
|
47 48 |
/* max packet size is limited by 16-bit struct nfattr nfa_len field */ #define NFULNL_COPY_RANGE_MAX (0xFFFF - NLA_HDRLEN) |
0597f2680
|
49 50 51 |
#define PRINTR(x, args...) do { if (net_ratelimit()) \ printk(x, ## args); } while (0); |
0597f2680
|
52 53 54 |
struct nfulnl_instance { struct hlist_node hlist; /* global list of instances */ spinlock_t lock; |
b54ab92b8
|
55 |
refcount_t use; /* use count */ |
0597f2680
|
56 57 58 |
unsigned int qlen; /* number of nlmsgs in skb */ struct sk_buff *skb; /* pre-allocatd skb */ |
0597f2680
|
59 |
struct timer_list timer; |
9368a53c4
|
60 |
struct net *net; |
9eea9515c
|
61 |
struct user_namespace *peer_user_ns; /* User namespace of the peer process */ |
cc6bc4486
|
62 |
u32 peer_portid; /* PORTID of the peer process */ |
0597f2680
|
63 64 65 66 67 68 |
/* configurable parameters */ unsigned int flushtimeout; /* timeout until queue flush */ unsigned int nlbufsiz; /* netlink buffer allocation size */ unsigned int qthreshold; /* threshold of the queue */ u_int32_t copy_range; |
0af5f6c1e
|
69 |
u_int32_t seq; /* instance-local sequential counter */ |
0597f2680
|
70 |
u_int16_t group_num; /* number of this queue */ |
0af5f6c1e
|
71 |
u_int16_t flags; |
601e68e10
|
72 |
u_int8_t copy_mode; |
bed1be208
|
73 |
struct rcu_head rcu; |
0597f2680
|
74 |
}; |
0597f2680
|
75 |
#define INSTANCE_BUCKETS 16 |
0597f2680
|
76 |
|
c7d03a00b
|
77 |
static unsigned int nfnl_log_net_id __read_mostly; |
9368a53c4
|
78 79 80 81 82 83 84 85 86 87 88 |
struct nfnl_log_net { spinlock_t instances_lock; struct hlist_head instance_table[INSTANCE_BUCKETS]; atomic_t global_seq; }; static struct nfnl_log_net *nfnl_log_pernet(struct net *net) { return net_generic(net, nfnl_log_net_id); } |
0597f2680
|
89 90 91 92 93 94 |
static inline u_int8_t instance_hashfn(u_int16_t group_num) { return ((group_num & 0xff) % INSTANCE_BUCKETS); } static struct nfulnl_instance * |
9368a53c4
|
95 |
__instance_lookup(struct nfnl_log_net *log, u_int16_t group_num) |
0597f2680
|
96 97 |
{ struct hlist_head *head; |
0597f2680
|
98 |
struct nfulnl_instance *inst; |
9368a53c4
|
99 |
head = &log->instance_table[instance_hashfn(group_num)]; |
b67bfe0d4
|
100 |
hlist_for_each_entry_rcu(inst, head, hlist) { |
0597f2680
|
101 102 103 104 105 106 107 108 109 |
if (inst->group_num == group_num) return inst; } return NULL; } static inline void instance_get(struct nfulnl_instance *inst) { |
b54ab92b8
|
110 |
refcount_inc(&inst->use); |
0597f2680
|
111 112 113 |
} static struct nfulnl_instance * |
9368a53c4
|
114 |
instance_lookup_get(struct nfnl_log_net *log, u_int16_t group_num) |
0597f2680
|
115 116 |
{ struct nfulnl_instance *inst; |
bed1be208
|
117 |
rcu_read_lock_bh(); |
9368a53c4
|
118 |
inst = __instance_lookup(log, group_num); |
b54ab92b8
|
119 |
if (inst && !refcount_inc_not_zero(&inst->use)) |
f5c5440d4
|
120 |
inst = NULL; |
bed1be208
|
121 |
rcu_read_unlock_bh(); |
0597f2680
|
122 123 124 |
return inst; } |
bed1be208
|
125 126 |
static void nfulnl_instance_free_rcu(struct rcu_head *head) { |
9368a53c4
|
127 128 129 130 131 |
struct nfulnl_instance *inst = container_of(head, struct nfulnl_instance, rcu); put_net(inst->net); kfree(inst); |
bed1be208
|
132 133 |
module_put(THIS_MODULE); } |
0597f2680
|
134 135 136 |
static void instance_put(struct nfulnl_instance *inst) { |
b54ab92b8
|
137 |
if (inst && refcount_dec_and_test(&inst->use)) |
c8d1da400
|
138 |
call_rcu(&inst->rcu, nfulnl_instance_free_rcu); |
0597f2680
|
139 |
} |
e99e88a9d
|
140 |
static void nfulnl_timer(struct timer_list *t); |
0597f2680
|
141 142 |
static struct nfulnl_instance * |
9368a53c4
|
143 |
instance_create(struct net *net, u_int16_t group_num, |
cc6bc4486
|
144 |
u32 portid, struct user_namespace *user_ns) |
0597f2680
|
145 146 |
{ struct nfulnl_instance *inst; |
9368a53c4
|
147 |
struct nfnl_log_net *log = nfnl_log_pernet(net); |
baab2ce7d
|
148 |
int err; |
0597f2680
|
149 |
|
9368a53c4
|
150 151 |
spin_lock_bh(&log->instances_lock); if (__instance_lookup(log, group_num)) { |
baab2ce7d
|
152 |
err = -EEXIST; |
0597f2680
|
153 154 |
goto out_unlock; } |
10dfdc69e
|
155 |
inst = kzalloc(sizeof(*inst), GFP_ATOMIC); |
baab2ce7d
|
156 157 |
if (!inst) { err = -ENOMEM; |
0597f2680
|
158 |
goto out_unlock; |
baab2ce7d
|
159 |
} |
0597f2680
|
160 |
|
aace57e05
|
161 162 |
if (!try_module_get(THIS_MODULE)) { kfree(inst); |
baab2ce7d
|
163 |
err = -EAGAIN; |
aace57e05
|
164 165 |
goto out_unlock; } |
0597f2680
|
166 |
INIT_HLIST_NODE(&inst->hlist); |
181a46a56
|
167 |
spin_lock_init(&inst->lock); |
0597f2680
|
168 |
/* needs to be two, since we _put() after creation */ |
b54ab92b8
|
169 |
refcount_set(&inst->use, 2); |
0597f2680
|
170 |
|
e99e88a9d
|
171 |
timer_setup(&inst->timer, nfulnl_timer, 0); |
0597f2680
|
172 |
|
9368a53c4
|
173 |
inst->net = get_net(net); |
9eea9515c
|
174 |
inst->peer_user_ns = user_ns; |
15e473046
|
175 |
inst->peer_portid = portid; |
0597f2680
|
176 177 178 179 180 181 |
inst->group_num = group_num; inst->qthreshold = NFULNL_QTHRESH_DEFAULT; inst->flushtimeout = NFULNL_TIMEOUT_DEFAULT; inst->nlbufsiz = NFULNL_NLBUFSIZ_DEFAULT; inst->copy_mode = NFULNL_COPY_PACKET; |
6b6ec99a0
|
182 |
inst->copy_range = NFULNL_COPY_RANGE_MAX; |
0597f2680
|
183 |
|
f5c5440d4
|
184 |
hlist_add_head_rcu(&inst->hlist, |
9368a53c4
|
185 |
&log->instance_table[instance_hashfn(group_num)]); |
0597f2680
|
186 |
|
9368a53c4
|
187 |
spin_unlock_bh(&log->instances_lock); |
0597f2680
|
188 189 |
return inst; |
0597f2680
|
190 |
out_unlock: |
9368a53c4
|
191 |
spin_unlock_bh(&log->instances_lock); |
baab2ce7d
|
192 |
return ERR_PTR(err); |
0597f2680
|
193 |
} |
e35670614
|
194 |
static void __nfulnl_flush(struct nfulnl_instance *inst); |
0597f2680
|
195 |
|
f5c5440d4
|
196 |
/* called with BH disabled */ |
0597f2680
|
197 |
static void |
9afdb00c8
|
198 |
__instance_destroy(struct nfulnl_instance *inst) |
0597f2680
|
199 200 |
{ /* first pull it out of the global list */ |
f5c5440d4
|
201 |
hlist_del_rcu(&inst->hlist); |
0597f2680
|
202 |
|
0597f2680
|
203 |
/* then flush all pending packets from skb */ |
f5c5440d4
|
204 205 206 207 |
spin_lock(&inst->lock); /* lockless readers wont be able to use us */ inst->copy_mode = NFULNL_COPY_DISABLED; |
e35670614
|
208 209 |
if (inst->skb) __nfulnl_flush(inst); |
f5c5440d4
|
210 |
spin_unlock(&inst->lock); |
0597f2680
|
211 212 213 |
/* and finally put the refcount */ instance_put(inst); |
0597f2680
|
214 215 216 |
} static inline void |
9368a53c4
|
217 218 |
instance_destroy(struct nfnl_log_net *log, struct nfulnl_instance *inst) |
0597f2680
|
219 |
{ |
9368a53c4
|
220 |
spin_lock_bh(&log->instances_lock); |
9afdb00c8
|
221 |
__instance_destroy(inst); |
9368a53c4
|
222 |
spin_unlock_bh(&log->instances_lock); |
0597f2680
|
223 224 225 226 227 228 229 230 231 |
} static int nfulnl_set_mode(struct nfulnl_instance *inst, u_int8_t mode, unsigned int range) { int status = 0; spin_lock_bh(&inst->lock); |
601e68e10
|
232 |
|
0597f2680
|
233 234 235 236 237 238 |
switch (mode) { case NFULNL_COPY_NONE: case NFULNL_COPY_META: inst->copy_mode = mode; inst->copy_range = 0; break; |
601e68e10
|
239 |
|
0597f2680
|
240 241 |
case NFULNL_COPY_PACKET: inst->copy_mode = mode; |
c1e7dc91e
|
242 243 |
if (range == 0) range = NFULNL_COPY_RANGE_MAX; |
6b6ec99a0
|
244 245 |
inst->copy_range = min_t(unsigned int, range, NFULNL_COPY_RANGE_MAX); |
0597f2680
|
246 |
break; |
601e68e10
|
247 |
|
0597f2680
|
248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 |
default: status = -EINVAL; break; } spin_unlock_bh(&inst->lock); return status; } static int nfulnl_set_nlbufsiz(struct nfulnl_instance *inst, u_int32_t nlbufsiz) { int status; spin_lock_bh(&inst->lock); if (nlbufsiz < NFULNL_NLBUFSIZ_DEFAULT) status = -ERANGE; else if (nlbufsiz > 131072) status = -ERANGE; else { inst->nlbufsiz = nlbufsiz; status = 0; } spin_unlock_bh(&inst->lock); return status; } |
23509fcd4
|
276 |
static void |
0597f2680
|
277 278 279 280 281 |
nfulnl_set_timeout(struct nfulnl_instance *inst, u_int32_t timeout) { spin_lock_bh(&inst->lock); inst->flushtimeout = timeout; spin_unlock_bh(&inst->lock); |
0597f2680
|
282 |
} |
23509fcd4
|
283 |
static void |
0597f2680
|
284 285 286 287 288 |
nfulnl_set_qthresh(struct nfulnl_instance *inst, u_int32_t qthresh) { spin_lock_bh(&inst->lock); inst->qthreshold = qthresh; spin_unlock_bh(&inst->lock); |
0597f2680
|
289 |
} |
0af5f6c1e
|
290 291 292 293 |
static int nfulnl_set_flags(struct nfulnl_instance *inst, u_int16_t flags) { spin_lock_bh(&inst->lock); |
ee433530d
|
294 |
inst->flags = flags; |
0af5f6c1e
|
295 296 297 298 |
spin_unlock_bh(&inst->lock); return 0; } |
c6a8f6483
|
299 |
static struct sk_buff * |
afff14f60
|
300 301 |
nfulnl_alloc_skb(struct net *net, u32 peer_portid, unsigned int inst_size, unsigned int pkt_size) |
0597f2680
|
302 303 |
{ struct sk_buff *skb; |
ad2ad0f96
|
304 |
unsigned int n; |
0597f2680
|
305 |
|
0597f2680
|
306 307 |
/* alloc skb which should be big enough for a whole multipart * message. WARNING: has to be <= 128k due to slab restrictions */ |
ad2ad0f96
|
308 |
n = max(inst_size, pkt_size); |
0813fbc91
|
309 |
skb = alloc_skb(n, GFP_ATOMIC | __GFP_NOWARN); |
0597f2680
|
310 |
if (!skb) { |
ad2ad0f96
|
311 312 313 |
if (n > pkt_size) { /* try to allocate only as much as we need for current * packet */ |
0597f2680
|
314 |
|
905f0a739
|
315 |
skb = alloc_skb(pkt_size, GFP_ATOMIC); |
ad2ad0f96
|
316 |
} |
0597f2680
|
317 318 319 320 |
} return skb; } |
b51d3fa36
|
321 |
static void |
0597f2680
|
322 323 |
__nfulnl_send(struct nfulnl_instance *inst) { |
d550d0958
|
324 325 326 327 328 |
if (inst->qlen > 1) { struct nlmsghdr *nlh = nlmsg_put(inst->skb, 0, 0, NLMSG_DONE, sizeof(struct nfgenmsg), 0); |
b51d3fa36
|
329 330 331 332 |
if (WARN_ONCE(!nlh, "bad nlskb size: %u, tailroom %d ", inst->skb->len, skb_tailroom(inst->skb))) { kfree_skb(inst->skb); |
d550d0958
|
333 |
goto out; |
b51d3fa36
|
334 |
} |
d550d0958
|
335 |
} |
b51d3fa36
|
336 337 338 |
nfnetlink_unicast(inst->skb, inst->net, inst->peer_portid, MSG_DONTWAIT); out: |
0597f2680
|
339 340 |
inst->qlen = 0; inst->skb = NULL; |
0597f2680
|
341 |
} |
e35670614
|
342 343 344 345 346 347 348 349 350 |
static void __nfulnl_flush(struct nfulnl_instance *inst) { /* timer holds a reference */ if (del_timer(&inst->timer)) instance_put(inst); if (inst->skb) __nfulnl_send(inst); } |
c6a8f6483
|
351 |
static void |
e99e88a9d
|
352 |
nfulnl_timer(struct timer_list *t) |
0597f2680
|
353 |
{ |
e99e88a9d
|
354 |
struct nfulnl_instance *inst = from_timer(inst, t, timer); |
0597f2680
|
355 |
|
0597f2680
|
356 |
spin_lock_bh(&inst->lock); |
370e6a878
|
357 358 |
if (inst->skb) __nfulnl_send(inst); |
0597f2680
|
359 |
spin_unlock_bh(&inst->lock); |
05f7b7b36
|
360 |
instance_put(inst); |
0597f2680
|
361 |
} |
65af4a107
|
362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 |
static u32 nfulnl_get_bridge_size(const struct sk_buff *skb) { u32 size = 0; if (!skb_mac_header_was_set(skb)) return 0; if (skb_vlan_tag_present(skb)) { size += nla_total_size(0); /* nested */ size += nla_total_size(sizeof(u16)); /* id */ size += nla_total_size(sizeof(u16)); /* tag */ } if (skb->network_header > skb->mac_header) size += nla_total_size(skb->network_header - skb->mac_header); return size; } static int nfulnl_put_bridge(struct nfulnl_instance *inst, const struct sk_buff *skb) { if (!skb_mac_header_was_set(skb)) return 0; if (skb_vlan_tag_present(skb)) { struct nlattr *nest; nest = nla_nest_start(inst->skb, NFULA_VLAN); if (!nest) goto nla_put_failure; if (nla_put_be16(inst->skb, NFULA_VLAN_TCI, htons(skb->vlan_tci)) || nla_put_be16(inst->skb, NFULA_VLAN_PROTO, skb->vlan_proto)) goto nla_put_failure; nla_nest_end(inst->skb, nest); } if (skb->mac_header < skb->network_header) { int len = (int)(skb->network_header - skb->mac_header); if (nla_put(inst->skb, NFULA_L2HDR, len, skb_mac_header(skb))) goto nla_put_failure; } return 0; nla_put_failure: return -1; } |
0af5f6c1e
|
412 413 |
/* This is an inline function, we don't really care about a long * list of arguments */ |
601e68e10
|
414 |
static inline int |
9368a53c4
|
415 416 |
__build_packet_message(struct nfnl_log_net *log, struct nfulnl_instance *inst, |
601e68e10
|
417 |
const struct sk_buff *skb, |
0597f2680
|
418 |
unsigned int data_len, |
76108cea0
|
419 |
u_int8_t pf, |
0597f2680
|
420 421 422 |
unsigned int hooknum, const struct net_device *indev, const struct net_device *outdev, |
a29a9a585
|
423 424 425 |
const char *prefix, unsigned int plen, const struct nfnl_ct_hook *nfnl_ct, struct nf_conn *ct, enum ip_conntrack_info ctinfo) |
0597f2680
|
426 |
{ |
0597f2680
|
427 428 429 |
struct nfulnl_msg_packet_hdr pmsg; struct nlmsghdr *nlh; struct nfgenmsg *nfmsg; |
27a884dc3
|
430 |
sk_buff_data_t old_tail = inst->skb->tail; |
0626af313
|
431 |
struct sock *sk; |
0c36b48b3
|
432 |
const unsigned char *hwhdrp; |
0597f2680
|
433 |
|
d550d0958
|
434 |
nlh = nlmsg_put(inst->skb, 0, 0, |
dedb67c4b
|
435 |
nfnl_msg_type(NFNL_SUBSYS_ULOG, NFULNL_MSG_PACKET), |
d550d0958
|
436 437 438 439 |
sizeof(struct nfgenmsg), 0); if (!nlh) return -1; nfmsg = nlmsg_data(nlh); |
0597f2680
|
440 441 442 |
nfmsg->nfgen_family = pf; nfmsg->version = NFNETLINK_V0; nfmsg->res_id = htons(inst->group_num); |
e4d091d7b
|
443 |
memset(&pmsg, 0, sizeof(pmsg)); |
febf0a431
|
444 |
pmsg.hw_protocol = skb->protocol; |
0597f2680
|
445 |
pmsg.hook = hooknum; |
1db20a529
|
446 447 |
if (nla_put(inst->skb, NFULA_PACKET_HDR, sizeof(pmsg), &pmsg)) goto nla_put_failure; |
0597f2680
|
448 |
|
1db20a529
|
449 450 451 |
if (prefix && nla_put(inst->skb, NFULA_PREFIX, plen, prefix)) goto nla_put_failure; |
0597f2680
|
452 453 |
if (indev) { |
1109a90c0
|
454 |
#if !IS_ENABLED(CONFIG_BRIDGE_NETFILTER) |
1db20a529
|
455 456 457 |
if (nla_put_be32(inst->skb, NFULA_IFINDEX_INDEV, htonl(indev->ifindex))) goto nla_put_failure; |
fbcd923c3
|
458 459 460 461 462 |
#else if (pf == PF_BRIDGE) { /* Case 1: outdev is physical input device, we need to * look for bridge group (when called from * netfilter_bridge) */ |
1db20a529
|
463 464 |
if (nla_put_be32(inst->skb, NFULA_IFINDEX_PHYSINDEV, htonl(indev->ifindex)) || |
fbcd923c3
|
465 |
/* this is the bridge group "brX" */ |
e2361cb90
|
466 467 468 |
/* rcu_read_lock()ed by nf_hook_thresh or * nf_log_packet. */ |
1db20a529
|
469 470 471 |
nla_put_be32(inst->skb, NFULA_IFINDEX_INDEV, htonl(br_port_get_rcu(indev)->br->dev->ifindex))) goto nla_put_failure; |
fbcd923c3
|
472 |
} else { |
c737b7c45
|
473 |
struct net_device *physindev; |
fbcd923c3
|
474 475 |
/* Case 2: indev is bridge group, we need to look for * physical device (when called from ipv4) */ |
1db20a529
|
476 477 478 |
if (nla_put_be32(inst->skb, NFULA_IFINDEX_INDEV, htonl(indev->ifindex))) goto nla_put_failure; |
c737b7c45
|
479 480 481 |
physindev = nf_bridge_get_physindev(skb); if (physindev && |
1db20a529
|
482 |
nla_put_be32(inst->skb, NFULA_IFINDEX_PHYSINDEV, |
c737b7c45
|
483 |
htonl(physindev->ifindex))) |
1db20a529
|
484 |
goto nla_put_failure; |
fbcd923c3
|
485 486 |
} #endif |
0597f2680
|
487 488 489 |
} if (outdev) { |
1109a90c0
|
490 |
#if !IS_ENABLED(CONFIG_BRIDGE_NETFILTER) |
1db20a529
|
491 492 493 |
if (nla_put_be32(inst->skb, NFULA_IFINDEX_OUTDEV, htonl(outdev->ifindex))) goto nla_put_failure; |
fbcd923c3
|
494 495 496 497 498 |
#else if (pf == PF_BRIDGE) { /* Case 1: outdev is physical output device, we need to * look for bridge group (when called from * netfilter_bridge) */ |
1db20a529
|
499 500 |
if (nla_put_be32(inst->skb, NFULA_IFINDEX_PHYSOUTDEV, htonl(outdev->ifindex)) || |
fbcd923c3
|
501 |
/* this is the bridge group "brX" */ |
e2361cb90
|
502 503 504 |
/* rcu_read_lock()ed by nf_hook_thresh or * nf_log_packet. */ |
1db20a529
|
505 506 507 |
nla_put_be32(inst->skb, NFULA_IFINDEX_OUTDEV, htonl(br_port_get_rcu(outdev)->br->dev->ifindex))) goto nla_put_failure; |
fbcd923c3
|
508 |
} else { |
c737b7c45
|
509 |
struct net_device *physoutdev; |
fbcd923c3
|
510 511 |
/* Case 2: indev is a bridge group, we need to look * for physical device (when called from ipv4) */ |
1db20a529
|
512 513 514 |
if (nla_put_be32(inst->skb, NFULA_IFINDEX_OUTDEV, htonl(outdev->ifindex))) goto nla_put_failure; |
c737b7c45
|
515 516 517 |
physoutdev = nf_bridge_get_physoutdev(skb); if (physoutdev && |
1db20a529
|
518 |
nla_put_be32(inst->skb, NFULA_IFINDEX_PHYSOUTDEV, |
c737b7c45
|
519 |
htonl(physoutdev->ifindex))) |
1db20a529
|
520 |
goto nla_put_failure; |
fbcd923c3
|
521 522 |
} #endif |
0597f2680
|
523 |
} |
1db20a529
|
524 525 526 |
if (skb->mark && nla_put_be32(inst->skb, NFULA_MARK, htonl(skb->mark))) goto nla_put_failure; |
0597f2680
|
527 |
|
2c38de4c1
|
528 529 |
if (indev && skb->dev && skb->mac_header != skb->network_header) { |
0597f2680
|
530 |
struct nfulnl_msg_packet_hw phw; |
e4d091d7b
|
531 532 533 534 |
int len; memset(&phw, 0, sizeof(phw)); len = dev_parse_header(skb, phw.hw_addr); |
b95cce357
|
535 536 |
if (len > 0) { phw.hw_addrlen = htons(len); |
1db20a529
|
537 538 |
if (nla_put(inst->skb, NFULA_HWADDR, sizeof(phw), &phw)) goto nla_put_failure; |
b95cce357
|
539 |
} |
0597f2680
|
540 |
} |
72961ecf8
|
541 |
if (indev && skb_mac_header_was_set(skb)) { |
2dba62c30
|
542 |
if (nla_put_be16(inst->skb, NFULA_HWTYPE, htons(skb->dev->type)) || |
1db20a529
|
543 |
nla_put_be16(inst->skb, NFULA_HWLEN, |
0c36b48b3
|
544 545 546 547 548 549 550 551 552 553 554 |
htons(skb->dev->hard_header_len))) goto nla_put_failure; hwhdrp = skb_mac_header(skb); if (skb->dev->type == ARPHRD_SIT) hwhdrp -= ETH_HLEN; if (hwhdrp >= skb->head && nla_put(inst->skb, NFULA_HWHEADER, skb->dev->hard_header_len, hwhdrp)) |
1db20a529
|
555 |
goto nla_put_failure; |
72961ecf8
|
556 |
} |
916f6efae
|
557 |
if (hooknum <= NF_INET_FORWARD && skb->tstamp) { |
0597f2680
|
558 |
struct nfulnl_msg_packet_timestamp ts; |
f6389ecbc
|
559 560 561 |
struct timespec64 kts = ktime_to_timespec64(skb->tstamp); ts.sec = cpu_to_be64(kts.tv_sec); ts.usec = cpu_to_be64(kts.tv_nsec / NSEC_PER_USEC); |
0597f2680
|
562 |
|
1db20a529
|
563 564 |
if (nla_put(inst->skb, NFULA_TIMESTAMP, sizeof(ts), &ts)) goto nla_put_failure; |
0597f2680
|
565 566 567 |
} /* UID */ |
0626af313
|
568 |
sk = skb->sk; |
a8399231f
|
569 |
if (sk && sk_fullsock(sk)) { |
0626af313
|
570 571 572 |
read_lock_bh(&sk->sk_callback_lock); if (sk->sk_socket && sk->sk_socket->file) { struct file *file = sk->sk_socket->file; |
437589a74
|
573 574 575 576 |
const struct cred *cred = file->f_cred; struct user_namespace *user_ns = inst->peer_user_ns; __be32 uid = htonl(from_kuid_munged(user_ns, cred->fsuid)); __be32 gid = htonl(from_kgid_munged(user_ns, cred->fsgid)); |
0626af313
|
577 |
read_unlock_bh(&sk->sk_callback_lock); |
1db20a529
|
578 579 580 |
if (nla_put_be32(inst->skb, NFULA_UID, uid) || nla_put_be32(inst->skb, NFULA_GID, gid)) goto nla_put_failure; |
0597f2680
|
581 |
} else |
0626af313
|
582 |
read_unlock_bh(&sk->sk_callback_lock); |
0597f2680
|
583 |
} |
0af5f6c1e
|
584 |
/* local sequence number */ |
1db20a529
|
585 586 587 |
if ((inst->flags & NFULNL_CFG_F_SEQ) && nla_put_be32(inst->skb, NFULA_SEQ, htonl(inst->seq++))) goto nla_put_failure; |
0dfedd287
|
588 |
|
0af5f6c1e
|
589 |
/* global sequence number */ |
1db20a529
|
590 591 |
if ((inst->flags & NFULNL_CFG_F_SEQ_GLOBAL) && nla_put_be32(inst->skb, NFULA_SEQ_GLOBAL, |
9368a53c4
|
592 |
htonl(atomic_inc_return(&log->global_seq)))) |
1db20a529
|
593 |
goto nla_put_failure; |
0af5f6c1e
|
594 |
|
a29a9a585
|
595 596 597 |
if (ct && nfnl_ct->build(inst->skb, ct, ctinfo, NFULA_CT, NFULA_CT_INFO) < 0) goto nla_put_failure; |
65af4a107
|
598 599 600 |
if ((pf == NFPROTO_NETDEV || pf == NFPROTO_BRIDGE) && nfulnl_put_bridge(inst, skb) < 0) goto nla_put_failure; |
0597f2680
|
601 |
if (data_len) { |
df6fb868d
|
602 603 |
struct nlattr *nla; int size = nla_attr_size(data_len); |
0597f2680
|
604 |
|
822516154
|
605 606 |
if (skb_tailroom(inst->skb) < nla_total_size(data_len)) goto nla_put_failure; |
0597f2680
|
607 |
|
4df864c1d
|
608 |
nla = skb_put(inst->skb, nla_total_size(data_len)); |
df6fb868d
|
609 610 |
nla->nla_type = NFULA_PAYLOAD; nla->nla_len = size; |
0597f2680
|
611 |
|
df6fb868d
|
612 |
if (skb_copy_bits(skb, 0, nla_data(nla), data_len)) |
0597f2680
|
613 614 |
BUG(); } |
601e68e10
|
615 |
|
0597f2680
|
616 617 |
nlh->nlmsg_len = inst->skb->tail - old_tail; return 0; |
df6fb868d
|
618 |
nla_put_failure: |
0597f2680
|
619 620 621 622 |
PRINTR(KERN_ERR "nfnetlink_log: error creating log nlmsg "); return -1; } |
549d2d41c
|
623 |
static const struct nf_loginfo default_loginfo = { |
0597f2680
|
624 625 626 627 628 629 630 631 632 633 634 |
.type = NF_LOG_TYPE_ULOG, .u = { .ulog = { .copy_len = 0xffff, .group = 0, .qthreshold = 1, }, }, }; /* log handler for internal netfilter logging api */ |
ce20cdf49
|
635 |
static void |
8cdb46da0
|
636 637 |
nfulnl_log_packet(struct net *net, u_int8_t pf, |
0597f2680
|
638 639 640 641 642 643 644 |
unsigned int hooknum, const struct sk_buff *skb, const struct net_device *in, const struct net_device *out, const struct nf_loginfo *li_user, const char *prefix) { |
a29a9a585
|
645 646 |
size_t size; unsigned int data_len; |
0597f2680
|
647 648 649 |
struct nfulnl_instance *inst; const struct nf_loginfo *li; unsigned int qthreshold; |
ce20cdf49
|
650 |
unsigned int plen = 0; |
9368a53c4
|
651 |
struct nfnl_log_net *log = nfnl_log_pernet(net); |
a29a9a585
|
652 653 654 |
const struct nfnl_ct_hook *nfnl_ct = NULL; struct nf_conn *ct = NULL; enum ip_conntrack_info uninitialized_var(ctinfo); |
0597f2680
|
655 |
|
601e68e10
|
656 |
if (li_user && li_user->type == NF_LOG_TYPE_ULOG) |
0597f2680
|
657 658 659 |
li = li_user; else li = &default_loginfo; |
9368a53c4
|
660 |
inst = instance_lookup_get(log, li->u.ulog.group); |
0597f2680
|
661 |
if (!inst) |
0597f2680
|
662 |
return; |
0597f2680
|
663 |
|
d7a5c3244
|
664 |
if (prefix) |
881dbfe8a
|
665 |
plen = strlen(prefix) + 1; |
d7a5c3244
|
666 |
|
0597f2680
|
667 668 669 |
/* FIXME: do we want to make the size calculation conditional based on * what is actually present? way more branches and checks, but more * memory efficient... */ |
7e59b3fea
|
670 |
size = nlmsg_total_size(sizeof(struct nfgenmsg)) |
df6fb868d
|
671 672 673 |
+ nla_total_size(sizeof(struct nfulnl_msg_packet_hdr)) + nla_total_size(sizeof(u_int32_t)) /* ifindex */ + nla_total_size(sizeof(u_int32_t)) /* ifindex */ |
1109a90c0
|
674 |
#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) |
df6fb868d
|
675 676 |
+ nla_total_size(sizeof(u_int32_t)) /* ifindex */ + nla_total_size(sizeof(u_int32_t)) /* ifindex */ |
fbcd923c3
|
677 |
#endif |
df6fb868d
|
678 679 |
+ nla_total_size(sizeof(u_int32_t)) /* mark */ + nla_total_size(sizeof(u_int32_t)) /* uid */ |
76aa1ce13
|
680 |
+ nla_total_size(sizeof(u_int32_t)) /* gid */ |
df6fb868d
|
681 682 |
+ nla_total_size(plen) /* prefix */ + nla_total_size(sizeof(struct nfulnl_msg_packet_hw)) |
9dfa1dfe4
|
683 684 |
+ nla_total_size(sizeof(struct nfulnl_msg_packet_timestamp)) + nla_total_size(sizeof(struct nfgenmsg)); /* NLMSG_DONE */ |
0597f2680
|
685 |
|
eeff9beec
|
686 |
if (in && skb_mac_header_was_set(skb)) { |
7e59b3fea
|
687 |
size += nla_total_size(skb->dev->hard_header_len) |
eeff9beec
|
688 689 690 |
+ nla_total_size(sizeof(u_int16_t)) /* hwtype */ + nla_total_size(sizeof(u_int16_t)); /* hwlen */ } |
0597f2680
|
691 |
spin_lock_bh(&inst->lock); |
0af5f6c1e
|
692 |
if (inst->flags & NFULNL_CFG_F_SEQ) |
df6fb868d
|
693 |
size += nla_total_size(sizeof(u_int32_t)); |
0af5f6c1e
|
694 |
if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL) |
df6fb868d
|
695 |
size += nla_total_size(sizeof(u_int32_t)); |
a29a9a585
|
696 697 698 699 700 701 702 703 |
if (inst->flags & NFULNL_CFG_F_CONNTRACK) { nfnl_ct = rcu_dereference(nfnl_ct_hook); if (nfnl_ct != NULL) { ct = nfnl_ct->get_ct(skb, &ctinfo); if (ct != NULL) size += nfnl_ct->build_size(ct); } } |
65af4a107
|
704 705 |
if (pf == NFPROTO_NETDEV || pf == NFPROTO_BRIDGE) size += nfulnl_get_bridge_size(skb); |
0af5f6c1e
|
706 |
|
0597f2680
|
707 708 |
qthreshold = inst->qthreshold; /* per-rule qthreshold overrides per-instance */ |
5ca431f9a
|
709 710 711 |
if (li->u.ulog.qthreshold) if (qthreshold > li->u.ulog.qthreshold) qthreshold = li->u.ulog.qthreshold; |
601e68e10
|
712 |
|
0597f2680
|
713 714 715 716 717 |
switch (inst->copy_mode) { case NFULNL_COPY_META: case NFULNL_COPY_NONE: data_len = 0; break; |
601e68e10
|
718 |
|
0597f2680
|
719 |
case NFULNL_COPY_PACKET: |
7643507fe
|
720 721 722 723 724 725 |
data_len = inst->copy_range; if ((li->u.ulog.flags & NF_LOG_F_COPY_LEN) && (li->u.ulog.copy_len < data_len)) data_len = li->u.ulog.copy_len; if (data_len > skb->len) |
0597f2680
|
726 |
data_len = skb->len; |
601e68e10
|
727 |
|
df6fb868d
|
728 |
size += nla_total_size(data_len); |
0597f2680
|
729 |
break; |
601e68e10
|
730 |
|
f5c5440d4
|
731 |
case NFULNL_COPY_DISABLED: |
0597f2680
|
732 |
default: |
55b5a91e1
|
733 |
goto unlock_and_release; |
0597f2680
|
734 |
} |
9dfa1dfe4
|
735 |
if (inst->skb && size > skb_tailroom(inst->skb)) { |
0597f2680
|
736 737 |
/* either the queue len is too high or we don't have * enough room in the skb left. flush to userspace. */ |
e35670614
|
738 |
__nfulnl_flush(inst); |
55b5a91e1
|
739 |
} |
0597f2680
|
740 |
|
55b5a91e1
|
741 |
if (!inst->skb) { |
afff14f60
|
742 743 |
inst->skb = nfulnl_alloc_skb(net, inst->peer_portid, inst->nlbufsiz, size); |
55b5a91e1
|
744 |
if (!inst->skb) |
0597f2680
|
745 |
goto alloc_failure; |
0597f2680
|
746 |
} |
0597f2680
|
747 |
inst->qlen++; |
9368a53c4
|
748 |
__build_packet_message(log, inst, skb, data_len, pf, |
a29a9a585
|
749 750 |
hooknum, in, out, prefix, plen, nfnl_ct, ct, ctinfo); |
0597f2680
|
751 |
|
d63b043d9
|
752 753 |
if (inst->qlen >= qthreshold) __nfulnl_flush(inst); |
0597f2680
|
754 755 |
/* timer_pending always called within inst->lock, so there * is no chance of a race here */ |
d63b043d9
|
756 |
else if (!timer_pending(&inst->timer)) { |
0597f2680
|
757 758 759 760 |
instance_get(inst); inst->timer.expires = jiffies + (inst->flushtimeout*HZ/100); add_timer(&inst->timer); } |
0597f2680
|
761 |
|
ed32abeaf
|
762 763 764 |
unlock_and_release: spin_unlock_bh(&inst->lock); instance_put(inst); |
0597f2680
|
765 766 767 |
return; alloc_failure: |
0597f2680
|
768 |
/* FIXME: statistics */ |
ed32abeaf
|
769 |
goto unlock_and_release; |
0597f2680
|
770 771 772 773 774 775 776 |
} static int nfulnl_rcv_nl_event(struct notifier_block *this, unsigned long event, void *ptr) { struct netlink_notify *n = ptr; |
9368a53c4
|
777 |
struct nfnl_log_net *log = nfnl_log_pernet(n->net); |
0597f2680
|
778 |
|
dee5817e8
|
779 |
if (event == NETLINK_URELEASE && n->protocol == NETLINK_NETFILTER) { |
0597f2680
|
780 |
int i; |
15e473046
|
781 |
/* destroy all instances for this portid */ |
9368a53c4
|
782 |
spin_lock_bh(&log->instances_lock); |
0597f2680
|
783 |
for (i = 0; i < INSTANCE_BUCKETS; i++) { |
b67bfe0d4
|
784 |
struct hlist_node *t2; |
0597f2680
|
785 |
struct nfulnl_instance *inst; |
9368a53c4
|
786 |
struct hlist_head *head = &log->instance_table[i]; |
0597f2680
|
787 |
|
b67bfe0d4
|
788 |
hlist_for_each_entry_safe(inst, t2, head, hlist) { |
9368a53c4
|
789 |
if (n->portid == inst->peer_portid) |
0597f2680
|
790 791 792 |
__instance_destroy(inst); } } |
9368a53c4
|
793 |
spin_unlock_bh(&log->instances_lock); |
0597f2680
|
794 795 796 797 798 799 800 |
} return NOTIFY_DONE; } static struct notifier_block nfulnl_rtnl_notifier = { .notifier_call = nfulnl_rcv_nl_event, }; |
7b8002a15
|
801 802 |
static int nfulnl_recv_unsupp(struct net *net, struct sock *ctnl, struct sk_buff *skb, const struct nlmsghdr *nlh, |
04ba724b6
|
803 804 |
const struct nlattr * const nfqa[], struct netlink_ext_ack *extack) |
0597f2680
|
805 806 807 |
{ return -ENOTSUPP; } |
ca735b3aa
|
808 |
static struct nf_logger nfulnl_logger __read_mostly = { |
0597f2680
|
809 |
.name = "nfnetlink_log", |
5962815a6
|
810 |
.type = NF_LOG_TYPE_ULOG, |
d4ef38354
|
811 |
.logfn = nfulnl_log_packet, |
0597f2680
|
812 813 |
.me = THIS_MODULE, }; |
fd8281ada
|
814 815 816 817 818 819 820 |
static const struct nla_policy nfula_cfg_policy[NFULA_CFG_MAX+1] = { [NFULA_CFG_CMD] = { .len = sizeof(struct nfulnl_msg_config_cmd) }, [NFULA_CFG_MODE] = { .len = sizeof(struct nfulnl_msg_config_mode) }, [NFULA_CFG_TIMEOUT] = { .type = NLA_U32 }, [NFULA_CFG_QTHRESH] = { .type = NLA_U32 }, [NFULA_CFG_NLBUFSIZ] = { .type = NLA_U32 }, [NFULA_CFG_FLAGS] = { .type = NLA_U16 }, |
0597f2680
|
821 |
}; |
7b8002a15
|
822 823 |
static int nfulnl_recv_config(struct net *net, struct sock *ctnl, struct sk_buff *skb, const struct nlmsghdr *nlh, |
04ba724b6
|
824 825 |
const struct nlattr * const nfula[], struct netlink_ext_ack *extack) |
0597f2680
|
826 |
{ |
d550d0958
|
827 |
struct nfgenmsg *nfmsg = nlmsg_data(nlh); |
0597f2680
|
828 829 |
u_int16_t group_num = ntohs(nfmsg->res_id); struct nfulnl_instance *inst; |
b7047a1c8
|
830 |
struct nfulnl_msg_config_cmd *cmd = NULL; |
9368a53c4
|
831 |
struct nfnl_log_net *log = nfnl_log_pernet(net); |
0597f2680
|
832 |
int ret = 0; |
c872a2d9e
|
833 |
u16 flags = 0; |
0597f2680
|
834 |
|
b7047a1c8
|
835 836 837 838 839 840 841 |
if (nfula[NFULA_CFG_CMD]) { u_int8_t pf = nfmsg->nfgen_family; cmd = nla_data(nfula[NFULA_CFG_CMD]); /* Commands without queue context */ switch (cmd->command) { case NFULNL_CFG_CMD_PF_BIND: |
30e0c6a6b
|
842 |
return nf_log_bind_pf(net, pf, &nfulnl_logger); |
b7047a1c8
|
843 |
case NFULNL_CFG_CMD_PF_UNBIND: |
30e0c6a6b
|
844 |
nf_log_unbind_pf(net, pf); |
b7047a1c8
|
845 846 847 |
return 0; } } |
9368a53c4
|
848 |
inst = instance_lookup_get(log, group_num); |
15e473046
|
849 |
if (inst && inst->peer_portid != NETLINK_CB(skb).portid) { |
c0506365a
|
850 851 852 |
ret = -EPERM; goto out_put; } |
8cbc87082
|
853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 |
/* Check if we support these flags in first place, dependencies should * be there too not to break atomicity. */ if (nfula[NFULA_CFG_FLAGS]) { flags = ntohs(nla_get_be16(nfula[NFULA_CFG_FLAGS])); if ((flags & NFULNL_CFG_F_CONNTRACK) && !rcu_access_pointer(nfnl_ct_hook)) { #ifdef CONFIG_MODULES nfnl_unlock(NFNL_SUBSYS_ULOG); request_module("ip_conntrack_netlink"); nfnl_lock(NFNL_SUBSYS_ULOG); if (rcu_access_pointer(nfnl_ct_hook)) { ret = -EAGAIN; goto out_put; } #endif ret = -EOPNOTSUPP; goto out_put; } } |
b7047a1c8
|
874 |
if (cmd != NULL) { |
0597f2680
|
875 876 877 878 879 880 |
switch (cmd->command) { case NFULNL_CFG_CMD_BIND: if (inst) { ret = -EBUSY; goto out_put; } |
9368a53c4
|
881 |
inst = instance_create(net, group_num, |
15e473046
|
882 |
NETLINK_CB(skb).portid, |
e32123e59
|
883 |
sk_user_ns(NETLINK_CB(skb).sk)); |
baab2ce7d
|
884 885 |
if (IS_ERR(inst)) { ret = PTR_ERR(inst); |
f414c16c0
|
886 |
goto out; |
0597f2680
|
887 888 889 890 891 |
} break; case NFULNL_CFG_CMD_UNBIND: if (!inst) { ret = -ENODEV; |
f414c16c0
|
892 |
goto out; |
0597f2680
|
893 |
} |
9368a53c4
|
894 |
instance_destroy(log, inst); |
a49c65037
|
895 |
goto out_put; |
0597f2680
|
896 |
default: |
cd21f0ac4
|
897 |
ret = -ENOTSUPP; |
eb075954e
|
898 |
goto out_put; |
0597f2680
|
899 |
} |
336a3b3ee
|
900 901 902 |
} else if (!inst) { ret = -ENODEV; goto out; |
0597f2680
|
903 |
} |
df6fb868d
|
904 |
if (nfula[NFULA_CFG_MODE]) { |
336a3b3ee
|
905 906 |
struct nfulnl_msg_config_mode *params = nla_data(nfula[NFULA_CFG_MODE]); |
0597f2680
|
907 908 |
nfulnl_set_mode(inst, params->copy_mode, |
d1208b999
|
909 |
ntohl(params->copy_range)); |
0597f2680
|
910 |
} |
df6fb868d
|
911 |
if (nfula[NFULA_CFG_TIMEOUT]) { |
0dfedd287
|
912 |
__be32 timeout = nla_get_be32(nfula[NFULA_CFG_TIMEOUT]); |
0597f2680
|
913 914 915 |
nfulnl_set_timeout(inst, ntohl(timeout)); } |
df6fb868d
|
916 |
if (nfula[NFULA_CFG_NLBUFSIZ]) { |
0dfedd287
|
917 |
__be32 nlbufsiz = nla_get_be32(nfula[NFULA_CFG_NLBUFSIZ]); |
0597f2680
|
918 919 920 |
nfulnl_set_nlbufsiz(inst, ntohl(nlbufsiz)); } |
df6fb868d
|
921 |
if (nfula[NFULA_CFG_QTHRESH]) { |
0dfedd287
|
922 |
__be32 qthresh = nla_get_be32(nfula[NFULA_CFG_QTHRESH]); |
0597f2680
|
923 924 925 |
nfulnl_set_qthresh(inst, ntohl(qthresh)); } |
8cbc87082
|
926 |
if (nfula[NFULA_CFG_FLAGS]) |
a29a9a585
|
927 |
nfulnl_set_flags(inst, flags); |
0af5f6c1e
|
928 |
|
0597f2680
|
929 930 |
out_put: instance_put(inst); |
dd16704eb
|
931 |
out: |
0597f2680
|
932 933 |
return ret; } |
7c8d4cb41
|
934 |
static const struct nfnl_callback nfulnl_cb[NFULNL_MSG_MAX] = { |
0597f2680
|
935 |
[NFULNL_MSG_PACKET] = { .call = nfulnl_recv_unsupp, |
37d2e7a20
|
936 |
.attr_count = NFULA_MAX, }, |
0597f2680
|
937 |
[NFULNL_MSG_CONFIG] = { .call = nfulnl_recv_config, |
fd8281ada
|
938 939 |
.attr_count = NFULA_CFG_MAX, .policy = nfula_cfg_policy }, |
0597f2680
|
940 |
}; |
7c8d4cb41
|
941 |
static const struct nfnetlink_subsystem nfulnl_subsys = { |
0597f2680
|
942 943 944 |
.name = "log", .subsys_id = NFNL_SUBSYS_ULOG, .cb_count = NFULNL_MSG_MAX, |
0597f2680
|
945 946 947 948 949 |
.cb = nfulnl_cb, }; #ifdef CONFIG_PROC_FS struct iter_state { |
9368a53c4
|
950 |
struct seq_net_private p; |
0597f2680
|
951 952 |
unsigned int bucket; }; |
9368a53c4
|
953 |
static struct hlist_node *get_first(struct net *net, struct iter_state *st) |
0597f2680
|
954 |
{ |
9368a53c4
|
955 |
struct nfnl_log_net *log; |
0597f2680
|
956 957 |
if (!st) return NULL; |
9368a53c4
|
958 |
log = nfnl_log_pernet(net); |
0597f2680
|
959 |
for (st->bucket = 0; st->bucket < INSTANCE_BUCKETS; st->bucket++) { |
9368a53c4
|
960 961 962 963 |
struct hlist_head *head = &log->instance_table[st->bucket]; if (!hlist_empty(head)) return rcu_dereference_bh(hlist_first_rcu(head)); |
0597f2680
|
964 965 966 |
} return NULL; } |
9368a53c4
|
967 968 |
static struct hlist_node *get_next(struct net *net, struct iter_state *st, struct hlist_node *h) |
0597f2680
|
969 |
{ |
0e60ebe04
|
970 |
h = rcu_dereference_bh(hlist_next_rcu(h)); |
0597f2680
|
971 |
while (!h) { |
9368a53c4
|
972 973 |
struct nfnl_log_net *log; struct hlist_head *head; |
0597f2680
|
974 975 |
if (++st->bucket >= INSTANCE_BUCKETS) return NULL; |
9368a53c4
|
976 977 978 |
log = nfnl_log_pernet(net); head = &log->instance_table[st->bucket]; h = rcu_dereference_bh(hlist_first_rcu(head)); |
0597f2680
|
979 980 981 |
} return h; } |
9368a53c4
|
982 983 |
static struct hlist_node *get_idx(struct net *net, struct iter_state *st, loff_t pos) |
0597f2680
|
984 985 |
{ struct hlist_node *head; |
9368a53c4
|
986 |
head = get_first(net, st); |
0597f2680
|
987 988 |
if (head) |
9368a53c4
|
989 |
while (pos && (head = get_next(net, st, head))) |
0597f2680
|
990 991 992 |
pos--; return pos ? NULL : head; } |
9368a53c4
|
993 |
static void *seq_start(struct seq_file *s, loff_t *pos) |
bed1be208
|
994 |
__acquires(rcu_bh) |
0597f2680
|
995 |
{ |
bed1be208
|
996 |
rcu_read_lock_bh(); |
9368a53c4
|
997 |
return get_idx(seq_file_net(s), s->private, *pos); |
0597f2680
|
998 999 1000 1001 1002 |
} static void *seq_next(struct seq_file *s, void *v, loff_t *pos) { (*pos)++; |
9368a53c4
|
1003 |
return get_next(seq_file_net(s), s->private, v); |
0597f2680
|
1004 1005 1006 |
} static void seq_stop(struct seq_file *s, void *v) |
bed1be208
|
1007 |
__releases(rcu_bh) |
0597f2680
|
1008 |
{ |
bed1be208
|
1009 |
rcu_read_unlock_bh(); |
0597f2680
|
1010 1011 1012 1013 1014 |
} static int seq_show(struct seq_file *s, void *v) { const struct nfulnl_instance *inst = v; |
20a1d1652
|
1015 1016 |
seq_printf(s, "%5u %6u %5u %1u %5u %6u %2u ", |
1ca9e4177
|
1017 1018 1019 |
inst->group_num, inst->peer_portid, inst->qlen, inst->copy_mode, inst->copy_range, |
b54ab92b8
|
1020 |
inst->flushtimeout, refcount_read(&inst->use)); |
1ca9e4177
|
1021 1022 |
return 0; |
0597f2680
|
1023 |
} |
56b3d975b
|
1024 |
static const struct seq_operations nful_seq_ops = { |
0597f2680
|
1025 1026 1027 1028 1029 |
.start = seq_start, .next = seq_next, .stop = seq_stop, .show = seq_show, }; |
0597f2680
|
1030 |
#endif /* PROC_FS */ |
9368a53c4
|
1031 |
static int __net_init nfnl_log_net_init(struct net *net) |
0597f2680
|
1032 |
{ |
9368a53c4
|
1033 1034 |
unsigned int i; struct nfnl_log_net *log = nfnl_log_pernet(net); |
f13f2aeed
|
1035 1036 1037 1038 1039 |
#ifdef CONFIG_PROC_FS struct proc_dir_entry *proc; kuid_t root_uid; kgid_t root_gid; #endif |
601e68e10
|
1040 |
|
0597f2680
|
1041 |
for (i = 0; i < INSTANCE_BUCKETS; i++) |
9368a53c4
|
1042 1043 1044 1045 |
INIT_HLIST_HEAD(&log->instance_table[i]); spin_lock_init(&log->instances_lock); #ifdef CONFIG_PROC_FS |
c35063722
|
1046 1047 |
proc = proc_create_net("nfnetlink_log", 0440, net->nf.proc_netfilter, &nful_seq_ops, sizeof(struct iter_state)); |
f13f2aeed
|
1048 |
if (!proc) |
9368a53c4
|
1049 |
return -ENOMEM; |
f13f2aeed
|
1050 1051 1052 1053 1054 |
root_uid = make_kuid(net->user_ns, 0); root_gid = make_kgid(net->user_ns, 0); if (uid_valid(root_uid) && gid_valid(root_gid)) proc_set_user(proc, root_uid, root_gid); |
9368a53c4
|
1055 1056 1057 1058 1059 1060 |
#endif return 0; } static void __net_exit nfnl_log_net_exit(struct net *net) { |
613d0776d
|
1061 1062 |
struct nfnl_log_net *log = nfnl_log_pernet(net); unsigned int i; |
e778f56e2
|
1063 |
#ifdef CONFIG_PROC_FS |
9368a53c4
|
1064 |
remove_proc_entry("nfnetlink_log", net->nf.proc_netfilter); |
e778f56e2
|
1065 |
#endif |
45c2aff64
|
1066 |
nf_log_unset(net, &nfulnl_logger); |
613d0776d
|
1067 1068 |
for (i = 0; i < INSTANCE_BUCKETS; i++) WARN_ON_ONCE(!hlist_empty(&log->instance_table[i])); |
9368a53c4
|
1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 |
} static struct pernet_operations nfnl_log_net_ops = { .init = nfnl_log_net_init, .exit = nfnl_log_net_exit, .id = &nfnl_log_net_id, .size = sizeof(struct nfnl_log_net), }; static int __init nfnetlink_log_init(void) { |
3bfe04980
|
1080 1081 1082 1083 1084 1085 1086 1087 |
int status; status = register_pernet_subsys(&nfnl_log_net_ops); if (status < 0) { pr_err("failed to register pernet ops "); goto out; } |
601e68e10
|
1088 |
|
0597f2680
|
1089 1090 1091 |
netlink_register_notifier(&nfulnl_rtnl_notifier); status = nfnetlink_subsys_register(&nfulnl_subsys); if (status < 0) { |
beacd3e8e
|
1092 1093 |
pr_err("failed to create netlink socket "); |
0597f2680
|
1094 1095 |
goto cleanup_netlink_notifier; } |
ca735b3aa
|
1096 1097 |
status = nf_log_register(NFPROTO_UNSPEC, &nfulnl_logger); if (status < 0) { |
beacd3e8e
|
1098 1099 |
pr_err("failed to register logger "); |
ca735b3aa
|
1100 1101 |
goto cleanup_subsys; } |
0597f2680
|
1102 |
return status; |
0597f2680
|
1103 |
cleanup_subsys: |
0597f2680
|
1104 1105 1106 |
nfnetlink_subsys_unregister(&nfulnl_subsys); cleanup_netlink_notifier: netlink_unregister_notifier(&nfulnl_rtnl_notifier); |
3bfe04980
|
1107 1108 |
unregister_pernet_subsys(&nfnl_log_net_ops); out: |
0597f2680
|
1109 1110 |
return status; } |
65b4b4e81
|
1111 |
static void __exit nfnetlink_log_fini(void) |
0597f2680
|
1112 |
{ |
32292a7ff
|
1113 1114 |
nfnetlink_subsys_unregister(&nfulnl_subsys); netlink_unregister_notifier(&nfulnl_rtnl_notifier); |
3bfe04980
|
1115 |
unregister_pernet_subsys(&nfnl_log_net_ops); |
c83fa1960
|
1116 |
nf_log_unregister(&nfulnl_logger); |
0597f2680
|
1117 1118 1119 1120 1121 |
} MODULE_DESCRIPTION("netfilter userspace logging"); MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>"); MODULE_LICENSE("GPL"); |
f682faefb
|
1122 |
MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_ULOG); |
fab4085f4
|
1123 1124 1125 |
MODULE_ALIAS_NF_LOGGER(AF_INET, 1); MODULE_ALIAS_NF_LOGGER(AF_INET6, 1); MODULE_ALIAS_NF_LOGGER(AF_BRIDGE, 1); |
2497b8462
|
1126 |
MODULE_ALIAS_NF_LOGGER(3, 1); /* NFPROTO_ARP */ |
a7647080d
|
1127 |
MODULE_ALIAS_NF_LOGGER(5, 1); /* NFPROTO_NETDEV */ |
0597f2680
|
1128 |
|
65b4b4e81
|
1129 1130 |
module_init(nfnetlink_log_init); module_exit(nfnetlink_log_fini); |