~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/ipv4/netfilter/ipt_ULOG.c

Version: ~ [ linux-5.12-rc7 ] ~ [ linux-5.11.13 ] ~ [ linux-5.10.29 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.111 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.186 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.230 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.266 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.266 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * netfilter module for userspace packet logging daemons
  3  *
  4  * (C) 2000-2004 by Harald Welte <laforge@netfilter.org>
  5  * (C) 1999-2001 Paul `Rusty' Russell
  6  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
  7  * (C) 2005-2007 Patrick McHardy <kaber@trash.net>
  8  *
  9  * This program is free software; you can redistribute it and/or modify
 10  * it under the terms of the GNU General Public License version 2 as
 11  * published by the Free Software Foundation.
 12  *
 13  * This module accepts two parameters:
 14  *
 15  * nlbufsiz:
 16  *   The parameter specifies how big the buffer for each netlink multicast
 17  * group is. e.g. If you say nlbufsiz=8192, up to eight kb of packets will
 18  * get accumulated in the kernel until they are sent to userspace. It is
 19  * NOT possible to allocate more than 128kB, and it is strongly discouraged,
 20  * because atomically allocating 128kB inside the network rx softirq is not
 21  * reliable. Please also keep in mind that this buffer size is allocated for
 22  * each nlgroup you are using, so the total kernel memory usage increases
 23  * by that factor.
 24  *
 25  * Actually you should use nlbufsiz a bit smaller than PAGE_SIZE, since
 26  * nlbufsiz is used with alloc_skb, which adds another
 27  * sizeof(struct skb_shared_info).  Use NLMSG_GOODSIZE instead.
 28  *
 29  * flushtimeout:
 30  *   Specify, after how many hundredths of a second the queue should be
 31  *   flushed even if it is not full yet.
 32  */
 33 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 34 #include <linux/module.h>
 35 #include <linux/spinlock.h>
 36 #include <linux/socket.h>
 37 #include <linux/slab.h>
 38 #include <linux/skbuff.h>
 39 #include <linux/kernel.h>
 40 #include <linux/timer.h>
 41 #include <net/netlink.h>
 42 #include <linux/netdevice.h>
 43 #include <linux/mm.h>
 44 #include <linux/moduleparam.h>
 45 #include <linux/netfilter.h>
 46 #include <linux/netfilter/x_tables.h>
 47 #include <linux/netfilter_ipv4/ipt_ULOG.h>
 48 #include <net/netfilter/nf_log.h>
 49 #include <net/netns/generic.h>
 50 #include <net/sock.h>
 51 #include <linux/bitops.h>
 52 #include <asm/unaligned.h>
 53 
 54 MODULE_LICENSE("GPL");
 55 MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>");
 56 MODULE_DESCRIPTION("Xtables: packet logging to netlink using ULOG");
 57 MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_NFLOG);
 58 
 59 #define ULOG_NL_EVENT           111             /* Harald's favorite number */
 60 #define ULOG_MAXNLGROUPS        32              /* numer of nlgroups */
 61 
 62 static unsigned int nlbufsiz = NLMSG_GOODSIZE;
 63 module_param(nlbufsiz, uint, 0400);
 64 MODULE_PARM_DESC(nlbufsiz, "netlink buffer size");
 65 
 66 static unsigned int flushtimeout = 10;
 67 module_param(flushtimeout, uint, 0600);
 68 MODULE_PARM_DESC(flushtimeout, "buffer flush timeout (hundredths of a second)");
 69 
 70 static bool nflog = true;
 71 module_param(nflog, bool, 0400);
 72 MODULE_PARM_DESC(nflog, "register as internal netfilter logging module");
 73 
 74 /* global data structures */
 75 
 76 typedef struct {
 77         unsigned int qlen;              /* number of nlmsgs' in the skb */
 78         struct nlmsghdr *lastnlh;       /* netlink header of last msg in skb */
 79         struct sk_buff *skb;            /* the pre-allocated skb */
 80         struct timer_list timer;        /* the timer function */
 81 } ulog_buff_t;
 82 
 83 static int ulog_net_id __read_mostly;
 84 struct ulog_net {
 85         unsigned int nlgroup[ULOG_MAXNLGROUPS];
 86         ulog_buff_t ulog_buffers[ULOG_MAXNLGROUPS];
 87         struct sock *nflognl;
 88         spinlock_t lock;
 89 };
 90 
 91 static struct ulog_net *ulog_pernet(struct net *net)
 92 {
 93         return net_generic(net, ulog_net_id);
 94 }
 95 
 96 /* send one ulog_buff_t to userspace */
 97 static void ulog_send(struct ulog_net *ulog, unsigned int nlgroupnum)
 98 {
 99         ulog_buff_t *ub = &ulog->ulog_buffers[nlgroupnum];
100 
101         pr_debug("ulog_send: timer is deleting\n");
102         del_timer(&ub->timer);
103 
104         if (!ub->skb) {
105                 pr_debug("ulog_send: nothing to send\n");
106                 return;
107         }
108 
109         /* last nlmsg needs NLMSG_DONE */
110         if (ub->qlen > 1)
111                 ub->lastnlh->nlmsg_type = NLMSG_DONE;
112 
113         NETLINK_CB(ub->skb).dst_group = nlgroupnum + 1;
114         pr_debug("throwing %d packets to netlink group %u\n",
115                  ub->qlen, nlgroupnum + 1);
116         netlink_broadcast(ulog->nflognl, ub->skb, 0, nlgroupnum + 1,
117                           GFP_ATOMIC);
118 
119         ub->qlen = 0;
120         ub->skb = NULL;
121         ub->lastnlh = NULL;
122 }
123 
124 
125 /* timer function to flush queue in flushtimeout time */
126 static void ulog_timer(unsigned long data)
127 {
128         unsigned int groupnum = *((unsigned int *)data);
129         struct ulog_net *ulog = container_of((void *)data,
130                                              struct ulog_net,
131                                              nlgroup[groupnum]);
132         pr_debug("timer function called, calling ulog_send\n");
133 
134         /* lock to protect against somebody modifying our structure
135          * from ipt_ulog_target at the same time */
136         spin_lock_bh(&ulog->lock);
137         ulog_send(ulog, groupnum);
138         spin_unlock_bh(&ulog->lock);
139 }
140 
141 static struct sk_buff *ulog_alloc_skb(unsigned int size)
142 {
143         struct sk_buff *skb;
144         unsigned int n;
145 
146         /* alloc skb which should be big enough for a whole
147          * multipart message. WARNING: has to be <= 131000
148          * due to slab allocator restrictions */
149 
150         n = max(size, nlbufsiz);
151         skb = alloc_skb(n, GFP_ATOMIC | __GFP_NOWARN);
152         if (!skb) {
153                 if (n > size) {
154                         /* try to allocate only as much as we need for
155                          * current packet */
156 
157                         skb = alloc_skb(size, GFP_ATOMIC);
158                         if (!skb)
159                                 pr_debug("cannot even allocate %ub\n", size);
160                 }
161         }
162 
163         return skb;
164 }
165 
166 static void ipt_ulog_packet(struct net *net,
167                             unsigned int hooknum,
168                             const struct sk_buff *skb,
169                             const struct net_device *in,
170                             const struct net_device *out,
171                             const struct ipt_ulog_info *loginfo,
172                             const char *prefix)
173 {
174         ulog_buff_t *ub;
175         ulog_packet_msg_t *pm;
176         size_t size, copy_len;
177         struct nlmsghdr *nlh;
178         struct timeval tv;
179         struct ulog_net *ulog = ulog_pernet(net);
180 
181         /* ffs == find first bit set, necessary because userspace
182          * is already shifting groupnumber, but we need unshifted.
183          * ffs() returns [1..32], we need [0..31] */
184         unsigned int groupnum = ffs(loginfo->nl_group) - 1;
185 
186         /* calculate the size of the skb needed */
187         if (loginfo->copy_range == 0 || loginfo->copy_range > skb->len)
188                 copy_len = skb->len;
189         else
190                 copy_len = loginfo->copy_range;
191 
192         size = nlmsg_total_size(sizeof(*pm) + copy_len);
193 
194         ub = &ulog->ulog_buffers[groupnum];
195 
196         spin_lock_bh(&ulog->lock);
197 
198         if (!ub->skb) {
199                 if (!(ub->skb = ulog_alloc_skb(size)))
200                         goto alloc_failure;
201         } else if (ub->qlen >= loginfo->qthreshold ||
202                    size > skb_tailroom(ub->skb)) {
203                 /* either the queue len is too high or we don't have
204                  * enough room in nlskb left. send it to userspace. */
205 
206                 ulog_send(ulog, groupnum);
207 
208                 if (!(ub->skb = ulog_alloc_skb(size)))
209                         goto alloc_failure;
210         }
211 
212         pr_debug("qlen %d, qthreshold %Zu\n", ub->qlen, loginfo->qthreshold);
213 
214         nlh = nlmsg_put(ub->skb, 0, ub->qlen, ULOG_NL_EVENT,
215                         sizeof(*pm)+copy_len, 0);
216         if (!nlh) {
217                 pr_debug("error during nlmsg_put\n");
218                 goto out_unlock;
219         }
220         ub->qlen++;
221 
222         pm = nlmsg_data(nlh);
223         memset(pm, 0, sizeof(*pm));
224 
225         /* We might not have a timestamp, get one */
226         if (skb->tstamp.tv64 == 0)
227                 __net_timestamp((struct sk_buff *)skb);
228 
229         /* copy hook, prefix, timestamp, payload, etc. */
230         pm->data_len = copy_len;
231         tv = ktime_to_timeval(skb->tstamp);
232         put_unaligned(tv.tv_sec, &pm->timestamp_sec);
233         put_unaligned(tv.tv_usec, &pm->timestamp_usec);
234         put_unaligned(skb->mark, &pm->mark);
235         pm->hook = hooknum;
236         if (prefix != NULL) {
237                 strncpy(pm->prefix, prefix, sizeof(pm->prefix) - 1);
238                 pm->prefix[sizeof(pm->prefix) - 1] = '\0';
239         }
240         else if (loginfo->prefix[0] != '\0')
241                 strncpy(pm->prefix, loginfo->prefix, sizeof(pm->prefix));
242 
243         if (in && in->hard_header_len > 0 &&
244             skb->mac_header != skb->network_header &&
245             in->hard_header_len <= ULOG_MAC_LEN) {
246                 memcpy(pm->mac, skb_mac_header(skb), in->hard_header_len);
247                 pm->mac_len = in->hard_header_len;
248         } else
249                 pm->mac_len = 0;
250 
251         if (in)
252                 strncpy(pm->indev_name, in->name, sizeof(pm->indev_name));
253 
254         if (out)
255                 strncpy(pm->outdev_name, out->name, sizeof(pm->outdev_name));
256 
257         /* copy_len <= skb->len, so can't fail. */
258         if (skb_copy_bits(skb, 0, pm->payload, copy_len) < 0)
259                 BUG();
260 
261         /* check if we are building multi-part messages */
262         if (ub->qlen > 1)
263                 ub->lastnlh->nlmsg_flags |= NLM_F_MULTI;
264 
265         ub->lastnlh = nlh;
266 
267         /* if timer isn't already running, start it */
268         if (!timer_pending(&ub->timer)) {
269                 ub->timer.expires = jiffies + flushtimeout * HZ / 100;
270                 add_timer(&ub->timer);
271         }
272 
273         /* if threshold is reached, send message to userspace */
274         if (ub->qlen >= loginfo->qthreshold) {
275                 if (loginfo->qthreshold > 1)
276                         nlh->nlmsg_type = NLMSG_DONE;
277                 ulog_send(ulog, groupnum);
278         }
279 out_unlock:
280         spin_unlock_bh(&ulog->lock);
281 
282         return;
283 
284 alloc_failure:
285         pr_debug("Error building netlink message\n");
286         spin_unlock_bh(&ulog->lock);
287 }
288 
289 static unsigned int
290 ulog_tg(struct sk_buff *skb, const struct xt_action_param *par)
291 {
292         struct net *net = dev_net(par->in ? par->in : par->out);
293 
294         ipt_ulog_packet(net, par->hooknum, skb, par->in, par->out,
295                         par->targinfo, NULL);
296         return XT_CONTINUE;
297 }
298 
299 static void ipt_logfn(struct net *net,
300                       u_int8_t pf,
301                       unsigned int hooknum,
302                       const struct sk_buff *skb,
303                       const struct net_device *in,
304                       const struct net_device *out,
305                       const struct nf_loginfo *li,
306                       const char *prefix)
307 {
308         struct ipt_ulog_info loginfo;
309 
310         if (!li || li->type != NF_LOG_TYPE_ULOG) {
311                 loginfo.nl_group = ULOG_DEFAULT_NLGROUP;
312                 loginfo.copy_range = 0;
313                 loginfo.qthreshold = ULOG_DEFAULT_QTHRESHOLD;
314                 loginfo.prefix[0] = '\0';
315         } else {
316                 loginfo.nl_group = li->u.ulog.group;
317                 loginfo.copy_range = li->u.ulog.copy_len;
318                 loginfo.qthreshold = li->u.ulog.qthreshold;
319                 strlcpy(loginfo.prefix, prefix, sizeof(loginfo.prefix));
320         }
321 
322         ipt_ulog_packet(net, hooknum, skb, in, out, &loginfo, prefix);
323 }
324 
325 static int ulog_tg_check(const struct xt_tgchk_param *par)
326 {
327         const struct ipt_ulog_info *loginfo = par->targinfo;
328 
329         if (!par->net->xt.ulog_warn_deprecated) {
330                 pr_info("ULOG is deprecated and it will be removed soon, "
331                         "use NFLOG instead\n");
332                 par->net->xt.ulog_warn_deprecated = true;
333         }
334 
335         if (loginfo->prefix[sizeof(loginfo->prefix) - 1] != '\0') {
336                 pr_debug("prefix not null-terminated\n");
337                 return -EINVAL;
338         }
339         if (loginfo->qthreshold > ULOG_MAX_QLEN) {
340                 pr_debug("queue threshold %Zu > MAX_QLEN\n",
341                          loginfo->qthreshold);
342                 return -EINVAL;
343         }
344         return 0;
345 }
346 
347 #ifdef CONFIG_COMPAT
348 struct compat_ipt_ulog_info {
349         compat_uint_t   nl_group;
350         compat_size_t   copy_range;
351         compat_size_t   qthreshold;
352         char            prefix[ULOG_PREFIX_LEN];
353 };
354 
355 static void ulog_tg_compat_from_user(void *dst, const void *src)
356 {
357         const struct compat_ipt_ulog_info *cl = src;
358         struct ipt_ulog_info l = {
359                 .nl_group       = cl->nl_group,
360                 .copy_range     = cl->copy_range,
361                 .qthreshold     = cl->qthreshold,
362         };
363 
364         memcpy(l.prefix, cl->prefix, sizeof(l.prefix));
365         memcpy(dst, &l, sizeof(l));
366 }
367 
368 static int ulog_tg_compat_to_user(void __user *dst, const void *src)
369 {
370         const struct ipt_ulog_info *l = src;
371         struct compat_ipt_ulog_info cl = {
372                 .nl_group       = l->nl_group,
373                 .copy_range     = l->copy_range,
374                 .qthreshold     = l->qthreshold,
375         };
376 
377         memcpy(cl.prefix, l->prefix, sizeof(cl.prefix));
378         return copy_to_user(dst, &cl, sizeof(cl)) ? -EFAULT : 0;
379 }
380 #endif /* CONFIG_COMPAT */
381 
382 static struct xt_target ulog_tg_reg __read_mostly = {
383         .name           = "ULOG",
384         .family         = NFPROTO_IPV4,
385         .target         = ulog_tg,
386         .targetsize     = sizeof(struct ipt_ulog_info),
387         .checkentry     = ulog_tg_check,
388 #ifdef CONFIG_COMPAT
389         .compatsize     = sizeof(struct compat_ipt_ulog_info),
390         .compat_from_user = ulog_tg_compat_from_user,
391         .compat_to_user = ulog_tg_compat_to_user,
392 #endif
393         .me             = THIS_MODULE,
394 };
395 
396 static struct nf_logger ipt_ulog_logger __read_mostly = {
397         .name           = "ipt_ULOG",
398         .logfn          = ipt_logfn,
399         .me             = THIS_MODULE,
400 };
401 
402 static int __net_init ulog_tg_net_init(struct net *net)
403 {
404         int i;
405         struct ulog_net *ulog = ulog_pernet(net);
406         struct netlink_kernel_cfg cfg = {
407                 .groups = ULOG_MAXNLGROUPS,
408         };
409 
410         spin_lock_init(&ulog->lock);
411         /* initialize ulog_buffers */
412         for (i = 0; i < ULOG_MAXNLGROUPS; i++) {
413                 ulog->nlgroup[i] = i;
414                 setup_timer(&ulog->ulog_buffers[i].timer, ulog_timer,
415                             (unsigned long)&ulog->nlgroup[i]);
416         }
417 
418         ulog->nflognl = netlink_kernel_create(net, NETLINK_NFLOG, &cfg);
419         if (!ulog->nflognl)
420                 return -ENOMEM;
421 
422         if (nflog)
423                 nf_log_set(net, NFPROTO_IPV4, &ipt_ulog_logger);
424 
425         return 0;
426 }
427 
428 static void __net_exit ulog_tg_net_exit(struct net *net)
429 {
430         ulog_buff_t *ub;
431         int i;
432         struct ulog_net *ulog = ulog_pernet(net);
433 
434         if (nflog)
435                 nf_log_unset(net, &ipt_ulog_logger);
436 
437         netlink_kernel_release(ulog->nflognl);
438 
439         /* remove pending timers and free allocated skb's */
440         for (i = 0; i < ULOG_MAXNLGROUPS; i++) {
441                 ub = &ulog->ulog_buffers[i];
442                 pr_debug("timer is deleting\n");
443                 del_timer(&ub->timer);
444 
445                 if (ub->skb) {
446                         kfree_skb(ub->skb);
447                         ub->skb = NULL;
448                 }
449         }
450 }
451 
452 static struct pernet_operations ulog_tg_net_ops = {
453         .init = ulog_tg_net_init,
454         .exit = ulog_tg_net_exit,
455         .id   = &ulog_net_id,
456         .size = sizeof(struct ulog_net),
457 };
458 
459 static int __init ulog_tg_init(void)
460 {
461         int ret;
462         pr_debug("init module\n");
463 
464         if (nlbufsiz > 128*1024) {
465                 pr_warn("Netlink buffer has to be <= 128kB\n");
466                 return -EINVAL;
467         }
468 
469         ret = register_pernet_subsys(&ulog_tg_net_ops);
470         if (ret)
471                 goto out_pernet;
472 
473         ret = xt_register_target(&ulog_tg_reg);
474         if (ret < 0)
475                 goto out_target;
476 
477         if (nflog)
478                 nf_log_register(NFPROTO_IPV4, &ipt_ulog_logger);
479 
480         return 0;
481 
482 out_target:
483         unregister_pernet_subsys(&ulog_tg_net_ops);
484 out_pernet:
485         return ret;
486 }
487 
488 static void __exit ulog_tg_exit(void)
489 {
490         pr_debug("cleanup_module\n");
491         if (nflog)
492                 nf_log_unregister(&ipt_ulog_logger);
493         xt_unregister_target(&ulog_tg_reg);
494         unregister_pernet_subsys(&ulog_tg_net_ops);
495 }
496 
497 module_init(ulog_tg_init);
498 module_exit(ulog_tg_exit);
499 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp