• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * This is a module which is used for queueing IPv4 packets and
3  * communicating with userspace via netlink.
4  *
5  * (C) 2000-2002 James Morris <jmorris@intercode.com.au>
6  * (C) 2003-2005 Netfilter Core Team <coreteam@netfilter.org>
7  *
8  * This program is free software; you can redistribute it and/or modify
9  * it under the terms of the GNU General Public License version 2 as
10  * published by the Free Software Foundation.
11  */
12 #include <linux/module.h>
13 #include <linux/skbuff.h>
14 #include <linux/init.h>
15 #include <linux/ip.h>
16 #include <linux/notifier.h>
17 #include <linux/netdevice.h>
18 #include <linux/netfilter.h>
19 #include <linux/netfilter_ipv4/ip_queue.h>
20 #include <linux/netfilter_ipv4/ip_tables.h>
21 #include <linux/netlink.h>
22 #include <linux/spinlock.h>
23 #include <linux/sysctl.h>
24 #include <linux/proc_fs.h>
25 #include <linux/seq_file.h>
26 #include <linux/security.h>
27 #include <linux/mutex.h>
28 #include <net/net_namespace.h>
29 #include <net/sock.h>
30 #include <net/route.h>
31 #include <net/netfilter/nf_queue.h>
32 #include <net/ip.h>
33 
34 #define IPQ_QMAX_DEFAULT 1024
35 #define IPQ_PROC_FS_NAME "ip_queue"
36 #define NET_IPQ_QMAX 2088
37 #define NET_IPQ_QMAX_NAME "ip_queue_maxlen"
38 
39 typedef int (*ipq_cmpfn)(struct nf_queue_entry *, unsigned long);
40 
41 static unsigned char copy_mode __read_mostly = IPQ_COPY_NONE;
42 static unsigned int queue_maxlen __read_mostly = IPQ_QMAX_DEFAULT;
43 static DEFINE_RWLOCK(queue_lock);
44 static int peer_pid __read_mostly;
45 static unsigned int copy_range __read_mostly;
46 static unsigned int queue_total;
47 static unsigned int queue_dropped = 0;
48 static unsigned int queue_user_dropped = 0;
49 static struct sock *ipqnl __read_mostly;
50 static LIST_HEAD(queue_list);
51 static DEFINE_MUTEX(ipqnl_mutex);
52 
53 static inline void
__ipq_enqueue_entry(struct nf_queue_entry * entry)54 __ipq_enqueue_entry(struct nf_queue_entry *entry)
55 {
56        list_add_tail(&entry->list, &queue_list);
57        queue_total++;
58 }
59 
60 static inline int
__ipq_set_mode(unsigned char mode,unsigned int range)61 __ipq_set_mode(unsigned char mode, unsigned int range)
62 {
63 	int status = 0;
64 
65 	switch(mode) {
66 	case IPQ_COPY_NONE:
67 	case IPQ_COPY_META:
68 		copy_mode = mode;
69 		copy_range = 0;
70 		break;
71 
72 	case IPQ_COPY_PACKET:
73 		copy_mode = mode;
74 		copy_range = range;
75 		if (copy_range > 0xFFFF)
76 			copy_range = 0xFFFF;
77 		break;
78 
79 	default:
80 		status = -EINVAL;
81 
82 	}
83 	return status;
84 }
85 
86 static void __ipq_flush(ipq_cmpfn cmpfn, unsigned long data);
87 
88 static inline void
__ipq_reset(void)89 __ipq_reset(void)
90 {
91 	peer_pid = 0;
92 	net_disable_timestamp();
93 	__ipq_set_mode(IPQ_COPY_NONE, 0);
94 	__ipq_flush(NULL, 0);
95 }
96 
97 static struct nf_queue_entry *
ipq_find_dequeue_entry(unsigned long id)98 ipq_find_dequeue_entry(unsigned long id)
99 {
100 	struct nf_queue_entry *entry = NULL, *i;
101 
102 	write_lock_bh(&queue_lock);
103 
104 	list_for_each_entry(i, &queue_list, list) {
105 		if ((unsigned long)i == id) {
106 			entry = i;
107 			break;
108 		}
109 	}
110 
111 	if (entry) {
112 		list_del(&entry->list);
113 		queue_total--;
114 	}
115 
116 	write_unlock_bh(&queue_lock);
117 	return entry;
118 }
119 
120 static void
__ipq_flush(ipq_cmpfn cmpfn,unsigned long data)121 __ipq_flush(ipq_cmpfn cmpfn, unsigned long data)
122 {
123 	struct nf_queue_entry *entry, *next;
124 
125 	list_for_each_entry_safe(entry, next, &queue_list, list) {
126 		if (!cmpfn || cmpfn(entry, data)) {
127 			list_del(&entry->list);
128 			queue_total--;
129 			nf_reinject(entry, NF_DROP);
130 		}
131 	}
132 }
133 
134 static void
ipq_flush(ipq_cmpfn cmpfn,unsigned long data)135 ipq_flush(ipq_cmpfn cmpfn, unsigned long data)
136 {
137 	write_lock_bh(&queue_lock);
138 	__ipq_flush(cmpfn, data);
139 	write_unlock_bh(&queue_lock);
140 }
141 
142 static struct sk_buff *
ipq_build_packet_message(struct nf_queue_entry * entry,int * errp)143 ipq_build_packet_message(struct nf_queue_entry *entry, int *errp)
144 {
145 	sk_buff_data_t old_tail;
146 	size_t size = 0;
147 	size_t data_len = 0;
148 	struct sk_buff *skb;
149 	struct ipq_packet_msg *pmsg;
150 	struct nlmsghdr *nlh;
151 	struct timeval tv;
152 
153 	read_lock_bh(&queue_lock);
154 
155 	switch (copy_mode) {
156 	case IPQ_COPY_META:
157 	case IPQ_COPY_NONE:
158 		size = NLMSG_SPACE(sizeof(*pmsg));
159 		break;
160 
161 	case IPQ_COPY_PACKET:
162 		if ((entry->skb->ip_summed == CHECKSUM_PARTIAL ||
163 		     entry->skb->ip_summed == CHECKSUM_COMPLETE) &&
164 		    (*errp = skb_checksum_help(entry->skb))) {
165 			read_unlock_bh(&queue_lock);
166 			return NULL;
167 		}
168 		if (copy_range == 0 || copy_range > entry->skb->len)
169 			data_len = entry->skb->len;
170 		else
171 			data_len = copy_range;
172 
173 		size = NLMSG_SPACE(sizeof(*pmsg) + data_len);
174 		break;
175 
176 	default:
177 		*errp = -EINVAL;
178 		read_unlock_bh(&queue_lock);
179 		return NULL;
180 	}
181 
182 	read_unlock_bh(&queue_lock);
183 
184 	skb = alloc_skb(size, GFP_ATOMIC);
185 	if (!skb)
186 		goto nlmsg_failure;
187 
188 	old_tail = skb->tail;
189 	nlh = NLMSG_PUT(skb, 0, 0, IPQM_PACKET, size - sizeof(*nlh));
190 	pmsg = NLMSG_DATA(nlh);
191 	memset(pmsg, 0, sizeof(*pmsg));
192 
193 	pmsg->packet_id       = (unsigned long )entry;
194 	pmsg->data_len        = data_len;
195 	tv = ktime_to_timeval(entry->skb->tstamp);
196 	pmsg->timestamp_sec   = tv.tv_sec;
197 	pmsg->timestamp_usec  = tv.tv_usec;
198 	pmsg->mark            = entry->skb->mark;
199 	pmsg->hook            = entry->hook;
200 	pmsg->hw_protocol     = entry->skb->protocol;
201 
202 	if (entry->indev)
203 		strcpy(pmsg->indev_name, entry->indev->name);
204 	else
205 		pmsg->indev_name[0] = '\0';
206 
207 	if (entry->outdev)
208 		strcpy(pmsg->outdev_name, entry->outdev->name);
209 	else
210 		pmsg->outdev_name[0] = '\0';
211 
212 	if (entry->indev && entry->skb->dev) {
213 		pmsg->hw_type = entry->skb->dev->type;
214 		pmsg->hw_addrlen = dev_parse_header(entry->skb,
215 						    pmsg->hw_addr);
216 	}
217 
218 	if (data_len)
219 		if (skb_copy_bits(entry->skb, 0, pmsg->payload, data_len))
220 			BUG();
221 
222 	nlh->nlmsg_len = skb->tail - old_tail;
223 	return skb;
224 
225 nlmsg_failure:
226 	*errp = -EINVAL;
227 	printk(KERN_ERR "ip_queue: error creating packet message\n");
228 	return NULL;
229 }
230 
231 static int
ipq_enqueue_packet(struct nf_queue_entry * entry,unsigned int queuenum)232 ipq_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
233 {
234 	int status = -EINVAL;
235 	struct sk_buff *nskb;
236 
237 	if (copy_mode == IPQ_COPY_NONE)
238 		return -EAGAIN;
239 
240 	nskb = ipq_build_packet_message(entry, &status);
241 	if (nskb == NULL)
242 		return status;
243 
244 	write_lock_bh(&queue_lock);
245 
246 	if (!peer_pid)
247 		goto err_out_free_nskb;
248 
249 	if (queue_total >= queue_maxlen) {
250 		queue_dropped++;
251 		status = -ENOSPC;
252 		if (net_ratelimit())
253 			  printk (KERN_WARNING "ip_queue: full at %d entries, "
254 				  "dropping packets(s). Dropped: %d\n", queue_total,
255 				  queue_dropped);
256 		goto err_out_free_nskb;
257 	}
258 
259 	/* netlink_unicast will either free the nskb or attach it to a socket */
260 	status = netlink_unicast(ipqnl, nskb, peer_pid, MSG_DONTWAIT);
261 	if (status < 0) {
262 		queue_user_dropped++;
263 		goto err_out_unlock;
264 	}
265 
266 	__ipq_enqueue_entry(entry);
267 
268 	write_unlock_bh(&queue_lock);
269 	return status;
270 
271 err_out_free_nskb:
272 	kfree_skb(nskb);
273 
274 err_out_unlock:
275 	write_unlock_bh(&queue_lock);
276 	return status;
277 }
278 
279 static int
ipq_mangle_ipv4(ipq_verdict_msg_t * v,struct nf_queue_entry * e)280 ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct nf_queue_entry *e)
281 {
282 	int diff;
283 	struct iphdr *user_iph = (struct iphdr *)v->payload;
284 	struct sk_buff *nskb;
285 
286 	if (v->data_len < sizeof(*user_iph))
287 		return 0;
288 	diff = v->data_len - e->skb->len;
289 	if (diff < 0) {
290 		if (pskb_trim(e->skb, v->data_len))
291 			return -ENOMEM;
292 	} else if (diff > 0) {
293 		if (v->data_len > 0xFFFF)
294 			return -EINVAL;
295 		if (diff > skb_tailroom(e->skb)) {
296 			nskb = skb_copy_expand(e->skb, skb_headroom(e->skb),
297 					       diff, GFP_ATOMIC);
298 			if (!nskb) {
299 				printk(KERN_WARNING "ip_queue: error "
300 				      "in mangle, dropping packet\n");
301 				return -ENOMEM;
302 			}
303 			kfree_skb(e->skb);
304 			e->skb = nskb;
305 		}
306 		skb_put(e->skb, diff);
307 	}
308 	if (!skb_make_writable(e->skb, v->data_len))
309 		return -ENOMEM;
310 	skb_copy_to_linear_data(e->skb, v->payload, v->data_len);
311 	e->skb->ip_summed = CHECKSUM_NONE;
312 
313 	return 0;
314 }
315 
316 static int
ipq_set_verdict(struct ipq_verdict_msg * vmsg,unsigned int len)317 ipq_set_verdict(struct ipq_verdict_msg *vmsg, unsigned int len)
318 {
319 	struct nf_queue_entry *entry;
320 
321 	if (vmsg->value > NF_MAX_VERDICT)
322 		return -EINVAL;
323 
324 	entry = ipq_find_dequeue_entry(vmsg->id);
325 	if (entry == NULL)
326 		return -ENOENT;
327 	else {
328 		int verdict = vmsg->value;
329 
330 		if (vmsg->data_len && vmsg->data_len == len)
331 			if (ipq_mangle_ipv4(vmsg, entry) < 0)
332 				verdict = NF_DROP;
333 
334 		nf_reinject(entry, verdict);
335 		return 0;
336 	}
337 }
338 
339 static int
ipq_set_mode(unsigned char mode,unsigned int range)340 ipq_set_mode(unsigned char mode, unsigned int range)
341 {
342 	int status;
343 
344 	write_lock_bh(&queue_lock);
345 	status = __ipq_set_mode(mode, range);
346 	write_unlock_bh(&queue_lock);
347 	return status;
348 }
349 
350 static int
ipq_receive_peer(struct ipq_peer_msg * pmsg,unsigned char type,unsigned int len)351 ipq_receive_peer(struct ipq_peer_msg *pmsg,
352 		 unsigned char type, unsigned int len)
353 {
354 	int status = 0;
355 
356 	if (len < sizeof(*pmsg))
357 		return -EINVAL;
358 
359 	switch (type) {
360 	case IPQM_MODE:
361 		status = ipq_set_mode(pmsg->msg.mode.value,
362 				      pmsg->msg.mode.range);
363 		break;
364 
365 	case IPQM_VERDICT:
366 		if (pmsg->msg.verdict.value > NF_MAX_VERDICT)
367 			status = -EINVAL;
368 		else
369 			status = ipq_set_verdict(&pmsg->msg.verdict,
370 						 len - sizeof(*pmsg));
371 			break;
372 	default:
373 		status = -EINVAL;
374 	}
375 	return status;
376 }
377 
378 static int
dev_cmp(struct nf_queue_entry * entry,unsigned long ifindex)379 dev_cmp(struct nf_queue_entry *entry, unsigned long ifindex)
380 {
381 	if (entry->indev)
382 		if (entry->indev->ifindex == ifindex)
383 			return 1;
384 	if (entry->outdev)
385 		if (entry->outdev->ifindex == ifindex)
386 			return 1;
387 #ifdef CONFIG_BRIDGE_NETFILTER
388 	if (entry->skb->nf_bridge) {
389 		if (entry->skb->nf_bridge->physindev &&
390 		    entry->skb->nf_bridge->physindev->ifindex == ifindex)
391 			return 1;
392 		if (entry->skb->nf_bridge->physoutdev &&
393 		    entry->skb->nf_bridge->physoutdev->ifindex == ifindex)
394 			return 1;
395 	}
396 #endif
397 	return 0;
398 }
399 
400 static void
ipq_dev_drop(int ifindex)401 ipq_dev_drop(int ifindex)
402 {
403 	ipq_flush(dev_cmp, ifindex);
404 }
405 
406 #define RCV_SKB_FAIL(err) do { netlink_ack(skb, nlh, (err)); return; } while (0)
407 
408 static inline void
__ipq_rcv_skb(struct sk_buff * skb)409 __ipq_rcv_skb(struct sk_buff *skb)
410 {
411 	int status, type, pid, flags, nlmsglen, skblen;
412 	struct nlmsghdr *nlh;
413 
414 	skblen = skb->len;
415 	if (skblen < sizeof(*nlh))
416 		return;
417 
418 	nlh = nlmsg_hdr(skb);
419 	nlmsglen = nlh->nlmsg_len;
420 	if (nlmsglen < sizeof(*nlh) || skblen < nlmsglen)
421 		return;
422 
423 	pid = nlh->nlmsg_pid;
424 	flags = nlh->nlmsg_flags;
425 
426 	if(pid <= 0 || !(flags & NLM_F_REQUEST) || flags & NLM_F_MULTI)
427 		RCV_SKB_FAIL(-EINVAL);
428 
429 	if (flags & MSG_TRUNC)
430 		RCV_SKB_FAIL(-ECOMM);
431 
432 	type = nlh->nlmsg_type;
433 	if (type < NLMSG_NOOP || type >= IPQM_MAX)
434 		RCV_SKB_FAIL(-EINVAL);
435 
436 	if (type <= IPQM_BASE)
437 		return;
438 
439 	if (security_netlink_recv(skb, CAP_NET_ADMIN))
440 		RCV_SKB_FAIL(-EPERM);
441 
442 	write_lock_bh(&queue_lock);
443 
444 	if (peer_pid) {
445 		if (peer_pid != pid) {
446 			write_unlock_bh(&queue_lock);
447 			RCV_SKB_FAIL(-EBUSY);
448 		}
449 	} else {
450 		net_enable_timestamp();
451 		peer_pid = pid;
452 	}
453 
454 	write_unlock_bh(&queue_lock);
455 
456 	status = ipq_receive_peer(NLMSG_DATA(nlh), type,
457 				  nlmsglen - NLMSG_LENGTH(0));
458 	if (status < 0)
459 		RCV_SKB_FAIL(status);
460 
461 	if (flags & NLM_F_ACK)
462 		netlink_ack(skb, nlh, 0);
463 	return;
464 }
465 
466 static void
ipq_rcv_skb(struct sk_buff * skb)467 ipq_rcv_skb(struct sk_buff *skb)
468 {
469 	mutex_lock(&ipqnl_mutex);
470 	__ipq_rcv_skb(skb);
471 	mutex_unlock(&ipqnl_mutex);
472 }
473 
474 static int
ipq_rcv_dev_event(struct notifier_block * this,unsigned long event,void * ptr)475 ipq_rcv_dev_event(struct notifier_block *this,
476 		  unsigned long event, void *ptr)
477 {
478 	struct net_device *dev = ptr;
479 
480 	if (!net_eq(dev_net(dev), &init_net))
481 		return NOTIFY_DONE;
482 
483 	/* Drop any packets associated with the downed device */
484 	if (event == NETDEV_DOWN)
485 		ipq_dev_drop(dev->ifindex);
486 	return NOTIFY_DONE;
487 }
488 
489 static struct notifier_block ipq_dev_notifier = {
490 	.notifier_call	= ipq_rcv_dev_event,
491 };
492 
493 static int
ipq_rcv_nl_event(struct notifier_block * this,unsigned long event,void * ptr)494 ipq_rcv_nl_event(struct notifier_block *this,
495 		 unsigned long event, void *ptr)
496 {
497 	struct netlink_notify *n = ptr;
498 
499 	if (event == NETLINK_URELEASE &&
500 	    n->protocol == NETLINK_FIREWALL && n->pid) {
501 		write_lock_bh(&queue_lock);
502 		if ((n->net == &init_net) && (n->pid == peer_pid))
503 			__ipq_reset();
504 		write_unlock_bh(&queue_lock);
505 	}
506 	return NOTIFY_DONE;
507 }
508 
509 static struct notifier_block ipq_nl_notifier = {
510 	.notifier_call	= ipq_rcv_nl_event,
511 };
512 
513 #ifdef CONFIG_SYSCTL
514 static struct ctl_table_header *ipq_sysctl_header;
515 
516 static ctl_table ipq_table[] = {
517 	{
518 		.ctl_name	= NET_IPQ_QMAX,
519 		.procname	= NET_IPQ_QMAX_NAME,
520 		.data		= &queue_maxlen,
521 		.maxlen		= sizeof(queue_maxlen),
522 		.mode		= 0644,
523 		.proc_handler	= proc_dointvec
524 	},
525 	{ .ctl_name = 0 }
526 };
527 #endif
528 
529 #ifdef CONFIG_PROC_FS
ip_queue_show(struct seq_file * m,void * v)530 static int ip_queue_show(struct seq_file *m, void *v)
531 {
532 	read_lock_bh(&queue_lock);
533 
534 	seq_printf(m,
535 		      "Peer PID          : %d\n"
536 		      "Copy mode         : %hu\n"
537 		      "Copy range        : %u\n"
538 		      "Queue length      : %u\n"
539 		      "Queue max. length : %u\n"
540 		      "Queue dropped     : %u\n"
541 		      "Netlink dropped   : %u\n",
542 		      peer_pid,
543 		      copy_mode,
544 		      copy_range,
545 		      queue_total,
546 		      queue_maxlen,
547 		      queue_dropped,
548 		      queue_user_dropped);
549 
550 	read_unlock_bh(&queue_lock);
551 	return 0;
552 }
553 
ip_queue_open(struct inode * inode,struct file * file)554 static int ip_queue_open(struct inode *inode, struct file *file)
555 {
556 	return single_open(file, ip_queue_show, NULL);
557 }
558 
559 static const struct file_operations ip_queue_proc_fops = {
560 	.open		= ip_queue_open,
561 	.read		= seq_read,
562 	.llseek		= seq_lseek,
563 	.release	= single_release,
564 	.owner		= THIS_MODULE,
565 };
566 #endif
567 
568 static const struct nf_queue_handler nfqh = {
569 	.name	= "ip_queue",
570 	.outfn	= &ipq_enqueue_packet,
571 };
572 
ip_queue_init(void)573 static int __init ip_queue_init(void)
574 {
575 	int status = -ENOMEM;
576 	struct proc_dir_entry *proc __maybe_unused;
577 
578 	netlink_register_notifier(&ipq_nl_notifier);
579 	ipqnl = netlink_kernel_create(&init_net, NETLINK_FIREWALL, 0,
580 				      ipq_rcv_skb, NULL, THIS_MODULE);
581 	if (ipqnl == NULL) {
582 		printk(KERN_ERR "ip_queue: failed to create netlink socket\n");
583 		goto cleanup_netlink_notifier;
584 	}
585 
586 #ifdef CONFIG_PROC_FS
587 	proc = proc_create(IPQ_PROC_FS_NAME, 0, init_net.proc_net,
588 			   &ip_queue_proc_fops);
589 	if (!proc) {
590 		printk(KERN_ERR "ip_queue: failed to create proc entry\n");
591 		goto cleanup_ipqnl;
592 	}
593 #endif
594 	register_netdevice_notifier(&ipq_dev_notifier);
595 #ifdef CONFIG_SYSCTL
596 	ipq_sysctl_header = register_sysctl_paths(net_ipv4_ctl_path, ipq_table);
597 #endif
598 	status = nf_register_queue_handler(PF_INET, &nfqh);
599 	if (status < 0) {
600 		printk(KERN_ERR "ip_queue: failed to register queue handler\n");
601 		goto cleanup_sysctl;
602 	}
603 	return status;
604 
605 cleanup_sysctl:
606 #ifdef CONFIG_SYSCTL
607 	unregister_sysctl_table(ipq_sysctl_header);
608 #endif
609 	unregister_netdevice_notifier(&ipq_dev_notifier);
610 	proc_net_remove(&init_net, IPQ_PROC_FS_NAME);
611 cleanup_ipqnl: __maybe_unused
612 	netlink_kernel_release(ipqnl);
613 	mutex_lock(&ipqnl_mutex);
614 	mutex_unlock(&ipqnl_mutex);
615 
616 cleanup_netlink_notifier:
617 	netlink_unregister_notifier(&ipq_nl_notifier);
618 	return status;
619 }
620 
ip_queue_fini(void)621 static void __exit ip_queue_fini(void)
622 {
623 	nf_unregister_queue_handlers(&nfqh);
624 	synchronize_net();
625 	ipq_flush(NULL, 0);
626 
627 #ifdef CONFIG_SYSCTL
628 	unregister_sysctl_table(ipq_sysctl_header);
629 #endif
630 	unregister_netdevice_notifier(&ipq_dev_notifier);
631 	proc_net_remove(&init_net, IPQ_PROC_FS_NAME);
632 
633 	netlink_kernel_release(ipqnl);
634 	mutex_lock(&ipqnl_mutex);
635 	mutex_unlock(&ipqnl_mutex);
636 
637 	netlink_unregister_notifier(&ipq_nl_notifier);
638 }
639 
640 MODULE_DESCRIPTION("IPv4 packet queue handler");
641 MODULE_AUTHOR("James Morris <jmorris@intercode.com.au>");
642 MODULE_LICENSE("GPL");
643 
644 module_init(ip_queue_init);
645 module_exit(ip_queue_fini);
646