~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/nfnetlink_log.c

Version: ~ [ linux-5.6-rc3 ] ~ [ linux-5.5.6 ] ~ [ linux-5.4.22 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.106 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.171 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.214 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.214 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.82 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * This is a module which is used for logging packets to userspace via
  3  * nfetlink.
  4  *
  5  * (C) 2005 by Harald Welte <laforge@netfilter.org>
  6  * (C) 2006-2012 Patrick McHardy <kaber@trash.net>
  7  *
  8  * Based on the old ipv4-only ipt_ULOG.c:
  9  * (C) 2000-2004 by Harald Welte <laforge@netfilter.org>
 10  *
 11  * This program is free software; you can redistribute it and/or modify
 12  * it under the terms of the GNU General Public License version 2 as
 13  * published by the Free Software Foundation.
 14  */
 15 #include <linux/module.h>
 16 #include <linux/skbuff.h>
 17 #include <linux/if_arp.h>
 18 #include <linux/init.h>
 19 #include <linux/ip.h>
 20 #include <linux/ipv6.h>
 21 #include <linux/netdevice.h>
 22 #include <linux/netfilter.h>
 23 #include <net/netlink.h>
 24 #include <linux/netfilter/nfnetlink.h>
 25 #include <linux/netfilter/nfnetlink_log.h>
 26 #include <linux/spinlock.h>
 27 #include <linux/sysctl.h>
 28 #include <linux/proc_fs.h>
 29 #include <linux/security.h>
 30 #include <linux/list.h>
 31 #include <linux/slab.h>
 32 #include <net/sock.h>
 33 #include <net/netfilter/nf_log.h>
 34 #include <net/netns/generic.h>
 35 #include <net/netfilter/nfnetlink_log.h>
 36 
 37 #include <linux/atomic.h>
 38 
 39 #ifdef CONFIG_BRIDGE_NETFILTER
 40 #include "../bridge/br_private.h"
 41 #endif
 42 
 43 #define NFULNL_NLBUFSIZ_DEFAULT NLMSG_GOODSIZE
 44 #define NFULNL_TIMEOUT_DEFAULT  100     /* every second */
 45 #define NFULNL_QTHRESH_DEFAULT  100     /* 100 packets */
 46 /* max packet size is limited by 16-bit struct nfattr nfa_len field */
 47 #define NFULNL_COPY_RANGE_MAX   (0xFFFF - NLA_HDRLEN)
 48 
 49 #define PRINTR(x, args...)      do { if (net_ratelimit()) \
 50                                      printk(x, ## args); } while (0);
 51 
 52 struct nfulnl_instance {
 53         struct hlist_node hlist;        /* global list of instances */
 54         spinlock_t lock;
 55         atomic_t use;                   /* use count */
 56 
 57         unsigned int qlen;              /* number of nlmsgs in skb */
 58         struct sk_buff *skb;            /* pre-allocatd skb */
 59         struct timer_list timer;
 60         struct net *net;
 61         struct user_namespace *peer_user_ns;    /* User namespace of the peer process */
 62         int peer_portid;                        /* PORTID of the peer process */
 63 
 64         /* configurable parameters */
 65         unsigned int flushtimeout;      /* timeout until queue flush */
 66         unsigned int nlbufsiz;          /* netlink buffer allocation size */
 67         unsigned int qthreshold;        /* threshold of the queue */
 68         u_int32_t copy_range;
 69         u_int32_t seq;                  /* instance-local sequential counter */
 70         u_int16_t group_num;            /* number of this queue */
 71         u_int16_t flags;
 72         u_int8_t copy_mode;
 73         struct rcu_head rcu;
 74 };
 75 
 76 #define INSTANCE_BUCKETS        16
 77 
 78 static int nfnl_log_net_id __read_mostly;
 79 
 80 struct nfnl_log_net {
 81         spinlock_t instances_lock;
 82         struct hlist_head instance_table[INSTANCE_BUCKETS];
 83         atomic_t global_seq;
 84 };
 85 
 86 static struct nfnl_log_net *nfnl_log_pernet(struct net *net)
 87 {
 88         return net_generic(net, nfnl_log_net_id);
 89 }
 90 
 91 static inline u_int8_t instance_hashfn(u_int16_t group_num)
 92 {
 93         return ((group_num & 0xff) % INSTANCE_BUCKETS);
 94 }
 95 
 96 static struct nfulnl_instance *
 97 __instance_lookup(struct nfnl_log_net *log, u_int16_t group_num)
 98 {
 99         struct hlist_head *head;
100         struct nfulnl_instance *inst;
101 
102         head = &log->instance_table[instance_hashfn(group_num)];
103         hlist_for_each_entry_rcu(inst, head, hlist) {
104                 if (inst->group_num == group_num)
105                         return inst;
106         }
107         return NULL;
108 }
109 
110 static inline void
111 instance_get(struct nfulnl_instance *inst)
112 {
113         atomic_inc(&inst->use);
114 }
115 
116 static struct nfulnl_instance *
117 instance_lookup_get(struct nfnl_log_net *log, u_int16_t group_num)
118 {
119         struct nfulnl_instance *inst;
120 
121         rcu_read_lock_bh();
122         inst = __instance_lookup(log, group_num);
123         if (inst && !atomic_inc_not_zero(&inst->use))
124                 inst = NULL;
125         rcu_read_unlock_bh();
126 
127         return inst;
128 }
129 
130 static void nfulnl_instance_free_rcu(struct rcu_head *head)
131 {
132         struct nfulnl_instance *inst =
133                 container_of(head, struct nfulnl_instance, rcu);
134 
135         put_net(inst->net);
136         kfree(inst);
137         module_put(THIS_MODULE);
138 }
139 
140 static void
141 instance_put(struct nfulnl_instance *inst)
142 {
143         if (inst && atomic_dec_and_test(&inst->use))
144                 call_rcu_bh(&inst->rcu, nfulnl_instance_free_rcu);
145 }
146 
147 static void nfulnl_timer(unsigned long data);
148 
149 static struct nfulnl_instance *
150 instance_create(struct net *net, u_int16_t group_num,
151                 int portid, struct user_namespace *user_ns)
152 {
153         struct nfulnl_instance *inst;
154         struct nfnl_log_net *log = nfnl_log_pernet(net);
155         int err;
156 
157         spin_lock_bh(&log->instances_lock);
158         if (__instance_lookup(log, group_num)) {
159                 err = -EEXIST;
160                 goto out_unlock;
161         }
162 
163         inst = kzalloc(sizeof(*inst), GFP_ATOMIC);
164         if (!inst) {
165                 err = -ENOMEM;
166                 goto out_unlock;
167         }
168 
169         if (!try_module_get(THIS_MODULE)) {
170                 kfree(inst);
171                 err = -EAGAIN;
172                 goto out_unlock;
173         }
174 
175         INIT_HLIST_NODE(&inst->hlist);
176         spin_lock_init(&inst->lock);
177         /* needs to be two, since we _put() after creation */
178         atomic_set(&inst->use, 2);
179 
180         setup_timer(&inst->timer, nfulnl_timer, (unsigned long)inst);
181 
182         inst->net = get_net(net);
183         inst->peer_user_ns = user_ns;
184         inst->peer_portid = portid;
185         inst->group_num = group_num;
186 
187         inst->qthreshold        = NFULNL_QTHRESH_DEFAULT;
188         inst->flushtimeout      = NFULNL_TIMEOUT_DEFAULT;
189         inst->nlbufsiz          = NFULNL_NLBUFSIZ_DEFAULT;
190         inst->copy_mode         = NFULNL_COPY_PACKET;
191         inst->copy_range        = NFULNL_COPY_RANGE_MAX;
192 
193         hlist_add_head_rcu(&inst->hlist,
194                        &log->instance_table[instance_hashfn(group_num)]);
195 
196 
197         spin_unlock_bh(&log->instances_lock);
198 
199         return inst;
200 
201 out_unlock:
202         spin_unlock_bh(&log->instances_lock);
203         return ERR_PTR(err);
204 }
205 
206 static void __nfulnl_flush(struct nfulnl_instance *inst);
207 
208 /* called with BH disabled */
209 static void
210 __instance_destroy(struct nfulnl_instance *inst)
211 {
212         /* first pull it out of the global list */
213         hlist_del_rcu(&inst->hlist);
214 
215         /* then flush all pending packets from skb */
216 
217         spin_lock(&inst->lock);
218 
219         /* lockless readers wont be able to use us */
220         inst->copy_mode = NFULNL_COPY_DISABLED;
221 
222         if (inst->skb)
223                 __nfulnl_flush(inst);
224         spin_unlock(&inst->lock);
225 
226         /* and finally put the refcount */
227         instance_put(inst);
228 }
229 
230 static inline void
231 instance_destroy(struct nfnl_log_net *log,
232                  struct nfulnl_instance *inst)
233 {
234         spin_lock_bh(&log->instances_lock);
235         __instance_destroy(inst);
236         spin_unlock_bh(&log->instances_lock);
237 }
238 
239 static int
240 nfulnl_set_mode(struct nfulnl_instance *inst, u_int8_t mode,
241                   unsigned int range)
242 {
243         int status = 0;
244 
245         spin_lock_bh(&inst->lock);
246 
247         switch (mode) {
248         case NFULNL_COPY_NONE:
249         case NFULNL_COPY_META:
250                 inst->copy_mode = mode;
251                 inst->copy_range = 0;
252                 break;
253 
254         case NFULNL_COPY_PACKET:
255                 inst->copy_mode = mode;
256                 if (range == 0)
257                         range = NFULNL_COPY_RANGE_MAX;
258                 inst->copy_range = min_t(unsigned int,
259                                          range, NFULNL_COPY_RANGE_MAX);
260                 break;
261 
262         default:
263                 status = -EINVAL;
264                 break;
265         }
266 
267         spin_unlock_bh(&inst->lock);
268 
269         return status;
270 }
271 
272 static int
273 nfulnl_set_nlbufsiz(struct nfulnl_instance *inst, u_int32_t nlbufsiz)
274 {
275         int status;
276 
277         spin_lock_bh(&inst->lock);
278         if (nlbufsiz < NFULNL_NLBUFSIZ_DEFAULT)
279                 status = -ERANGE;
280         else if (nlbufsiz > 131072)
281                 status = -ERANGE;
282         else {
283                 inst->nlbufsiz = nlbufsiz;
284                 status = 0;
285         }
286         spin_unlock_bh(&inst->lock);
287 
288         return status;
289 }
290 
291 static int
292 nfulnl_set_timeout(struct nfulnl_instance *inst, u_int32_t timeout)
293 {
294         spin_lock_bh(&inst->lock);
295         inst->flushtimeout = timeout;
296         spin_unlock_bh(&inst->lock);
297 
298         return 0;
299 }
300 
301 static int
302 nfulnl_set_qthresh(struct nfulnl_instance *inst, u_int32_t qthresh)
303 {
304         spin_lock_bh(&inst->lock);
305         inst->qthreshold = qthresh;
306         spin_unlock_bh(&inst->lock);
307 
308         return 0;
309 }
310 
311 static int
312 nfulnl_set_flags(struct nfulnl_instance *inst, u_int16_t flags)
313 {
314         spin_lock_bh(&inst->lock);
315         inst->flags = flags;
316         spin_unlock_bh(&inst->lock);
317 
318         return 0;
319 }
320 
321 static struct sk_buff *
322 nfulnl_alloc_skb(struct net *net, u32 peer_portid, unsigned int inst_size,
323                  unsigned int pkt_size)
324 {
325         struct sk_buff *skb;
326         unsigned int n;
327 
328         /* alloc skb which should be big enough for a whole multipart
329          * message.  WARNING: has to be <= 128k due to slab restrictions */
330 
331         n = max(inst_size, pkt_size);
332         skb = nfnetlink_alloc_skb(net, n, peer_portid, GFP_ATOMIC);
333         if (!skb) {
334                 if (n > pkt_size) {
335                         /* try to allocate only as much as we need for current
336                          * packet */
337 
338                         skb = nfnetlink_alloc_skb(net, pkt_size,
339                                                   peer_portid, GFP_ATOMIC);
340                         if (!skb)
341                                 pr_err("nfnetlink_log: can't even alloc %u bytes\n",
342                                        pkt_size);
343                 }
344         }
345 
346         return skb;
347 }
348 
349 static void
350 __nfulnl_send(struct nfulnl_instance *inst)
351 {
352         if (inst->qlen > 1) {
353                 struct nlmsghdr *nlh = nlmsg_put(inst->skb, 0, 0,
354                                                  NLMSG_DONE,
355                                                  sizeof(struct nfgenmsg),
356                                                  0);
357                 if (WARN_ONCE(!nlh, "bad nlskb size: %u, tailroom %d\n",
358                               inst->skb->len, skb_tailroom(inst->skb))) {
359                         kfree_skb(inst->skb);
360                         goto out;
361                 }
362         }
363         nfnetlink_unicast(inst->skb, inst->net, inst->peer_portid,
364                           MSG_DONTWAIT);
365 out:
366         inst->qlen = 0;
367         inst->skb = NULL;
368 }
369 
370 static void
371 __nfulnl_flush(struct nfulnl_instance *inst)
372 {
373         /* timer holds a reference */
374         if (del_timer(&inst->timer))
375                 instance_put(inst);
376         if (inst->skb)
377                 __nfulnl_send(inst);
378 }
379 
380 static void
381 nfulnl_timer(unsigned long data)
382 {
383         struct nfulnl_instance *inst = (struct nfulnl_instance *)data;
384 
385         spin_lock_bh(&inst->lock);
386         if (inst->skb)
387                 __nfulnl_send(inst);
388         spin_unlock_bh(&inst->lock);
389         instance_put(inst);
390 }
391 
392 /* This is an inline function, we don't really care about a long
393  * list of arguments */
394 static inline int
395 __build_packet_message(struct nfnl_log_net *log,
396                         struct nfulnl_instance *inst,
397                         const struct sk_buff *skb,
398                         unsigned int data_len,
399                         u_int8_t pf,
400                         unsigned int hooknum,
401                         const struct net_device *indev,
402                         const struct net_device *outdev,
403                         const char *prefix, unsigned int plen)
404 {
405         struct nfulnl_msg_packet_hdr pmsg;
406         struct nlmsghdr *nlh;
407         struct nfgenmsg *nfmsg;
408         sk_buff_data_t old_tail = inst->skb->tail;
409         struct sock *sk;
410         const unsigned char *hwhdrp;
411 
412         nlh = nlmsg_put(inst->skb, 0, 0,
413                         NFNL_SUBSYS_ULOG << 8 | NFULNL_MSG_PACKET,
414                         sizeof(struct nfgenmsg), 0);
415         if (!nlh)
416                 return -1;
417         nfmsg = nlmsg_data(nlh);
418         nfmsg->nfgen_family = pf;
419         nfmsg->version = NFNETLINK_V0;
420         nfmsg->res_id = htons(inst->group_num);
421 
422         memset(&pmsg, 0, sizeof(pmsg));
423         pmsg.hw_protocol        = skb->protocol;
424         pmsg.hook               = hooknum;
425 
426         if (nla_put(inst->skb, NFULA_PACKET_HDR, sizeof(pmsg), &pmsg))
427                 goto nla_put_failure;
428 
429         if (prefix &&
430             nla_put(inst->skb, NFULA_PREFIX, plen, prefix))
431                 goto nla_put_failure;
432 
433         if (indev) {
434 #ifndef CONFIG_BRIDGE_NETFILTER
435                 if (nla_put_be32(inst->skb, NFULA_IFINDEX_INDEV,
436                                  htonl(indev->ifindex)))
437                         goto nla_put_failure;
438 #else
439                 if (pf == PF_BRIDGE) {
440                         /* Case 1: outdev is physical input device, we need to
441                          * look for bridge group (when called from
442                          * netfilter_bridge) */
443                         if (nla_put_be32(inst->skb, NFULA_IFINDEX_PHYSINDEV,
444                                          htonl(indev->ifindex)) ||
445                         /* this is the bridge group "brX" */
446                         /* rcu_read_lock()ed by nf_hook_slow or nf_log_packet */
447                             nla_put_be32(inst->skb, NFULA_IFINDEX_INDEV,
448                                          htonl(br_port_get_rcu(indev)->br->dev->ifindex)))
449                                 goto nla_put_failure;
450                 } else {
451                         /* Case 2: indev is bridge group, we need to look for
452                          * physical device (when called from ipv4) */
453                         if (nla_put_be32(inst->skb, NFULA_IFINDEX_INDEV,
454                                          htonl(indev->ifindex)))
455                                 goto nla_put_failure;
456                         if (skb->nf_bridge && skb->nf_bridge->physindev &&
457                             nla_put_be32(inst->skb, NFULA_IFINDEX_PHYSINDEV,
458                                          htonl(skb->nf_bridge->physindev->ifindex)))
459                                 goto nla_put_failure;
460                 }
461 #endif
462         }
463 
464         if (outdev) {
465 #ifndef CONFIG_BRIDGE_NETFILTER
466                 if (nla_put_be32(inst->skb, NFULA_IFINDEX_OUTDEV,
467                                  htonl(outdev->ifindex)))
468                         goto nla_put_failure;
469 #else
470                 if (pf == PF_BRIDGE) {
471                         /* Case 1: outdev is physical output device, we need to
472                          * look for bridge group (when called from
473                          * netfilter_bridge) */
474                         if (nla_put_be32(inst->skb, NFULA_IFINDEX_PHYSOUTDEV,
475                                          htonl(outdev->ifindex)) ||
476                         /* this is the bridge group "brX" */
477                         /* rcu_read_lock()ed by nf_hook_slow or nf_log_packet */
478                             nla_put_be32(inst->skb, NFULA_IFINDEX_OUTDEV,
479                                          htonl(br_port_get_rcu(outdev)->br->dev->ifindex)))
480                                 goto nla_put_failure;
481                 } else {
482                         /* Case 2: indev is a bridge group, we need to look
483                          * for physical device (when called from ipv4) */
484                         if (nla_put_be32(inst->skb, NFULA_IFINDEX_OUTDEV,
485                                          htonl(outdev->ifindex)))
486                                 goto nla_put_failure;
487                         if (skb->nf_bridge && skb->nf_bridge->physoutdev &&
488                             nla_put_be32(inst->skb, NFULA_IFINDEX_PHYSOUTDEV,
489                                          htonl(skb->nf_bridge->physoutdev->ifindex)))
490                                 goto nla_put_failure;
491                 }
492 #endif
493         }
494 
495         if (skb->mark &&
496             nla_put_be32(inst->skb, NFULA_MARK, htonl(skb->mark)))
497                 goto nla_put_failure;
498 
499         if (indev && skb->dev &&
500             skb->mac_header != skb->network_header) {
501                 struct nfulnl_msg_packet_hw phw;
502                 int len;
503 
504                 memset(&phw, 0, sizeof(phw));
505                 len = dev_parse_header(skb, phw.hw_addr);
506                 if (len > 0) {
507                         phw.hw_addrlen = htons(len);
508                         if (nla_put(inst->skb, NFULA_HWADDR, sizeof(phw), &phw))
509                                 goto nla_put_failure;
510                 }
511         }
512 
513         if (indev && skb_mac_header_was_set(skb)) {
514                 if (nla_put_be16(inst->skb, NFULA_HWTYPE, htons(skb->dev->type)) ||
515                     nla_put_be16(inst->skb, NFULA_HWLEN,
516                                  htons(skb->dev->hard_header_len)))
517                         goto nla_put_failure;
518 
519                 hwhdrp = skb_mac_header(skb);
520 
521                 if (skb->dev->type == ARPHRD_SIT)
522                         hwhdrp -= ETH_HLEN;
523 
524                 if (hwhdrp >= skb->head &&
525                     nla_put(inst->skb, NFULA_HWHEADER,
526                             skb->dev->hard_header_len, hwhdrp))
527                         goto nla_put_failure;
528         }
529 
530         if (skb->tstamp.tv64) {
531                 struct nfulnl_msg_packet_timestamp ts;
532                 struct timeval tv = ktime_to_timeval(skb->tstamp);
533                 ts.sec = cpu_to_be64(tv.tv_sec);
534                 ts.usec = cpu_to_be64(tv.tv_usec);
535 
536                 if (nla_put(inst->skb, NFULA_TIMESTAMP, sizeof(ts), &ts))
537                         goto nla_put_failure;
538         }
539 
540         /* UID */
541         sk = skb->sk;
542         if (sk && sk->sk_state != TCP_TIME_WAIT) {
543                 read_lock_bh(&sk->sk_callback_lock);
544                 if (sk->sk_socket && sk->sk_socket->file) {
545                         struct file *file = sk->sk_socket->file;
546                         const struct cred *cred = file->f_cred;
547                         struct user_namespace *user_ns = inst->peer_user_ns;
548                         __be32 uid = htonl(from_kuid_munged(user_ns, cred->fsuid));
549                         __be32 gid = htonl(from_kgid_munged(user_ns, cred->fsgid));
550                         read_unlock_bh(&sk->sk_callback_lock);
551                         if (nla_put_be32(inst->skb, NFULA_UID, uid) ||
552                             nla_put_be32(inst->skb, NFULA_GID, gid))
553                                 goto nla_put_failure;
554                 } else
555                         read_unlock_bh(&sk->sk_callback_lock);
556         }
557 
558         /* local sequence number */
559         if ((inst->flags & NFULNL_CFG_F_SEQ) &&
560             nla_put_be32(inst->skb, NFULA_SEQ, htonl(inst->seq++)))
561                 goto nla_put_failure;
562 
563         /* global sequence number */
564         if ((inst->flags & NFULNL_CFG_F_SEQ_GLOBAL) &&
565             nla_put_be32(inst->skb, NFULA_SEQ_GLOBAL,
566                          htonl(atomic_inc_return(&log->global_seq))))
567                 goto nla_put_failure;
568 
569         if (data_len) {
570                 struct nlattr *nla;
571                 int size = nla_attr_size(data_len);
572 
573                 if (skb_tailroom(inst->skb) < nla_total_size(data_len)) {
574                         printk(KERN_WARNING "nfnetlink_log: no tailroom!\n");
575                         return -1;
576                 }
577 
578                 nla = (struct nlattr *)skb_put(inst->skb, nla_total_size(data_len));
579                 nla->nla_type = NFULA_PAYLOAD;
580                 nla->nla_len = size;
581 
582                 if (skb_copy_bits(skb, 0, nla_data(nla), data_len))
583                         BUG();
584         }
585 
586         nlh->nlmsg_len = inst->skb->tail - old_tail;
587         return 0;
588 
589 nla_put_failure:
590         PRINTR(KERN_ERR "nfnetlink_log: error creating log nlmsg\n");
591         return -1;
592 }
593 
594 #define RCV_SKB_FAIL(err) do { netlink_ack(skb, nlh, (err)); return; } while (0)
595 
596 static struct nf_loginfo default_loginfo = {
597         .type =         NF_LOG_TYPE_ULOG,
598         .u = {
599                 .ulog = {
600                         .copy_len       = 0xffff,
601                         .group          = 0,
602                         .qthreshold     = 1,
603                 },
604         },
605 };
606 
607 /* log handler for internal netfilter logging api */
608 void
609 nfulnl_log_packet(struct net *net,
610                   u_int8_t pf,
611                   unsigned int hooknum,
612                   const struct sk_buff *skb,
613                   const struct net_device *in,
614                   const struct net_device *out,
615                   const struct nf_loginfo *li_user,
616                   const char *prefix)
617 {
618         unsigned int size, data_len;
619         struct nfulnl_instance *inst;
620         const struct nf_loginfo *li;
621         unsigned int qthreshold;
622         unsigned int plen;
623         struct nfnl_log_net *log = nfnl_log_pernet(net);
624 
625         if (li_user && li_user->type == NF_LOG_TYPE_ULOG)
626                 li = li_user;
627         else
628                 li = &default_loginfo;
629 
630         inst = instance_lookup_get(log, li->u.ulog.group);
631         if (!inst)
632                 return;
633 
634         plen = 0;
635         if (prefix)
636                 plen = strlen(prefix) + 1;
637 
638         /* FIXME: do we want to make the size calculation conditional based on
639          * what is actually present?  way more branches and checks, but more
640          * memory efficient... */
641         size =    nlmsg_total_size(sizeof(struct nfgenmsg))
642                 + nla_total_size(sizeof(struct nfulnl_msg_packet_hdr))
643                 + nla_total_size(sizeof(u_int32_t))     /* ifindex */
644                 + nla_total_size(sizeof(u_int32_t))     /* ifindex */
645 #ifdef CONFIG_BRIDGE_NETFILTER
646                 + nla_total_size(sizeof(u_int32_t))     /* ifindex */
647                 + nla_total_size(sizeof(u_int32_t))     /* ifindex */
648 #endif
649                 + nla_total_size(sizeof(u_int32_t))     /* mark */
650                 + nla_total_size(sizeof(u_int32_t))     /* uid */
651                 + nla_total_size(sizeof(u_int32_t))     /* gid */
652                 + nla_total_size(plen)                  /* prefix */
653                 + nla_total_size(sizeof(struct nfulnl_msg_packet_hw))
654                 + nla_total_size(sizeof(struct nfulnl_msg_packet_timestamp))
655                 + nla_total_size(sizeof(struct nfgenmsg));      /* NLMSG_DONE */
656 
657         if (in && skb_mac_header_was_set(skb)) {
658                 size +=   nla_total_size(skb->dev->hard_header_len)
659                         + nla_total_size(sizeof(u_int16_t))     /* hwtype */
660                         + nla_total_size(sizeof(u_int16_t));    /* hwlen */
661         }
662 
663         spin_lock_bh(&inst->lock);
664 
665         if (inst->flags & NFULNL_CFG_F_SEQ)
666                 size += nla_total_size(sizeof(u_int32_t));
667         if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL)
668                 size += nla_total_size(sizeof(u_int32_t));
669 
670         qthreshold = inst->qthreshold;
671         /* per-rule qthreshold overrides per-instance */
672         if (li->u.ulog.qthreshold)
673                 if (qthreshold > li->u.ulog.qthreshold)
674                         qthreshold = li->u.ulog.qthreshold;
675 
676 
677         switch (inst->copy_mode) {
678         case NFULNL_COPY_META:
679         case NFULNL_COPY_NONE:
680                 data_len = 0;
681                 break;
682 
683         case NFULNL_COPY_PACKET:
684                 if (inst->copy_range > skb->len)
685                         data_len = skb->len;
686                 else
687                         data_len = inst->copy_range;
688 
689                 size += nla_total_size(data_len);
690                 break;
691 
692         case NFULNL_COPY_DISABLED:
693         default:
694                 goto unlock_and_release;
695         }
696 
697         if (inst->skb && size > skb_tailroom(inst->skb)) {
698                 /* either the queue len is too high or we don't have
699                  * enough room in the skb left. flush to userspace. */
700                 __nfulnl_flush(inst);
701         }
702 
703         if (!inst->skb) {
704                 inst->skb = nfulnl_alloc_skb(net, inst->peer_portid,
705                                              inst->nlbufsiz, size);
706                 if (!inst->skb)
707                         goto alloc_failure;
708         }
709 
710         inst->qlen++;
711 
712         __build_packet_message(log, inst, skb, data_len, pf,
713                                 hooknum, in, out, prefix, plen);
714 
715         if (inst->qlen >= qthreshold)
716                 __nfulnl_flush(inst);
717         /* timer_pending always called within inst->lock, so there
718          * is no chance of a race here */
719         else if (!timer_pending(&inst->timer)) {
720                 instance_get(inst);
721                 inst->timer.expires = jiffies + (inst->flushtimeout*HZ/100);
722                 add_timer(&inst->timer);
723         }
724 
725 unlock_and_release:
726         spin_unlock_bh(&inst->lock);
727         instance_put(inst);
728         return;
729 
730 alloc_failure:
731         /* FIXME: statistics */
732         goto unlock_and_release;
733 }
734 EXPORT_SYMBOL_GPL(nfulnl_log_packet);
735 
736 static int
737 nfulnl_rcv_nl_event(struct notifier_block *this,
738                    unsigned long event, void *ptr)
739 {
740         struct netlink_notify *n = ptr;
741         struct nfnl_log_net *log = nfnl_log_pernet(n->net);
742 
743         if (event == NETLINK_URELEASE && n->protocol == NETLINK_NETFILTER) {
744                 int i;
745 
746                 /* destroy all instances for this portid */
747                 spin_lock_bh(&log->instances_lock);
748                 for  (i = 0; i < INSTANCE_BUCKETS; i++) {
749                         struct hlist_node *t2;
750                         struct nfulnl_instance *inst;
751                         struct hlist_head *head = &log->instance_table[i];
752 
753                         hlist_for_each_entry_safe(inst, t2, head, hlist) {
754                                 if (n->portid == inst->peer_portid)
755                                         __instance_destroy(inst);
756                         }
757                 }
758                 spin_unlock_bh(&log->instances_lock);
759         }
760         return NOTIFY_DONE;
761 }
762 
763 static struct notifier_block nfulnl_rtnl_notifier = {
764         .notifier_call  = nfulnl_rcv_nl_event,
765 };
766 
767 static int
768 nfulnl_recv_unsupp(struct sock *ctnl, struct sk_buff *skb,
769                    const struct nlmsghdr *nlh,
770                    const struct nlattr * const nfqa[])
771 {
772         return -ENOTSUPP;
773 }
774 
775 static struct nf_logger nfulnl_logger __read_mostly = {
776         .name   = "nfnetlink_log",
777         .type   = NF_LOG_TYPE_ULOG,
778         .logfn  = &nfulnl_log_packet,
779         .me     = THIS_MODULE,
780 };
781 
782 static const struct nla_policy nfula_cfg_policy[NFULA_CFG_MAX+1] = {
783         [NFULA_CFG_CMD]         = { .len = sizeof(struct nfulnl_msg_config_cmd) },
784         [NFULA_CFG_MODE]        = { .len = sizeof(struct nfulnl_msg_config_mode) },
785         [NFULA_CFG_TIMEOUT]     = { .type = NLA_U32 },
786         [NFULA_CFG_QTHRESH]     = { .type = NLA_U32 },
787         [NFULA_CFG_NLBUFSIZ]    = { .type = NLA_U32 },
788         [NFULA_CFG_FLAGS]       = { .type = NLA_U16 },
789 };
790 
791 static int
792 nfulnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
793                    const struct nlmsghdr *nlh,
794                    const struct nlattr * const nfula[])
795 {
796         struct nfgenmsg *nfmsg = nlmsg_data(nlh);
797         u_int16_t group_num = ntohs(nfmsg->res_id);
798         struct nfulnl_instance *inst;
799         struct nfulnl_msg_config_cmd *cmd = NULL;
800         struct net *net = sock_net(ctnl);
801         struct nfnl_log_net *log = nfnl_log_pernet(net);
802         int ret = 0;
803 
804         if (nfula[NFULA_CFG_CMD]) {
805                 u_int8_t pf = nfmsg->nfgen_family;
806                 cmd = nla_data(nfula[NFULA_CFG_CMD]);
807 
808                 /* Commands without queue context */
809                 switch (cmd->command) {
810                 case NFULNL_CFG_CMD_PF_BIND:
811                         return nf_log_bind_pf(net, pf, &nfulnl_logger);
812                 case NFULNL_CFG_CMD_PF_UNBIND:
813                         nf_log_unbind_pf(net, pf);
814                         return 0;
815                 }
816         }
817 
818         inst = instance_lookup_get(log, group_num);
819         if (inst && inst->peer_portid != NETLINK_CB(skb).portid) {
820                 ret = -EPERM;
821                 goto out_put;
822         }
823 
824         if (cmd != NULL) {
825                 switch (cmd->command) {
826                 case NFULNL_CFG_CMD_BIND:
827                         if (inst) {
828                                 ret = -EBUSY;
829                                 goto out_put;
830                         }
831 
832                         inst = instance_create(net, group_num,
833                                                NETLINK_CB(skb).portid,
834                                                sk_user_ns(NETLINK_CB(skb).sk));
835                         if (IS_ERR(inst)) {
836                                 ret = PTR_ERR(inst);
837                                 goto out;
838                         }
839                         break;
840                 case NFULNL_CFG_CMD_UNBIND:
841                         if (!inst) {
842                                 ret = -ENODEV;
843                                 goto out;
844                         }
845 
846                         instance_destroy(log, inst);
847                         goto out_put;
848                 default:
849                         ret = -ENOTSUPP;
850                         break;
851                 }
852         }
853 
854         if (nfula[NFULA_CFG_MODE]) {
855                 struct nfulnl_msg_config_mode *params;
856                 params = nla_data(nfula[NFULA_CFG_MODE]);
857 
858                 if (!inst) {
859                         ret = -ENODEV;
860                         goto out;
861                 }
862                 nfulnl_set_mode(inst, params->copy_mode,
863                                 ntohl(params->copy_range));
864         }
865 
866         if (nfula[NFULA_CFG_TIMEOUT]) {
867                 __be32 timeout = nla_get_be32(nfula[NFULA_CFG_TIMEOUT]);
868 
869                 if (!inst) {
870                         ret = -ENODEV;
871                         goto out;
872                 }
873                 nfulnl_set_timeout(inst, ntohl(timeout));
874         }
875 
876         if (nfula[NFULA_CFG_NLBUFSIZ]) {
877                 __be32 nlbufsiz = nla_get_be32(nfula[NFULA_CFG_NLBUFSIZ]);
878 
879                 if (!inst) {
880                         ret = -ENODEV;
881                         goto out;
882                 }
883                 nfulnl_set_nlbufsiz(inst, ntohl(nlbufsiz));
884         }
885 
886         if (nfula[NFULA_CFG_QTHRESH]) {
887                 __be32 qthresh = nla_get_be32(nfula[NFULA_CFG_QTHRESH]);
888 
889                 if (!inst) {
890                         ret = -ENODEV;
891                         goto out;
892                 }
893                 nfulnl_set_qthresh(inst, ntohl(qthresh));
894         }
895 
896         if (nfula[NFULA_CFG_FLAGS]) {
897                 __be16 flags = nla_get_be16(nfula[NFULA_CFG_FLAGS]);
898 
899                 if (!inst) {
900                         ret = -ENODEV;
901                         goto out;
902                 }
903                 nfulnl_set_flags(inst, ntohs(flags));
904         }
905 
906 out_put:
907         instance_put(inst);
908 out:
909         return ret;
910 }
911 
912 static const struct nfnl_callback nfulnl_cb[NFULNL_MSG_MAX] = {
913         [NFULNL_MSG_PACKET]     = { .call = nfulnl_recv_unsupp,
914                                     .attr_count = NFULA_MAX, },
915         [NFULNL_MSG_CONFIG]     = { .call = nfulnl_recv_config,
916                                     .attr_count = NFULA_CFG_MAX,
917                                     .policy = nfula_cfg_policy },
918 };
919 
920 static const struct nfnetlink_subsystem nfulnl_subsys = {
921         .name           = "log",
922         .subsys_id      = NFNL_SUBSYS_ULOG,
923         .cb_count       = NFULNL_MSG_MAX,
924         .cb             = nfulnl_cb,
925 };
926 
927 #ifdef CONFIG_PROC_FS
928 struct iter_state {
929         struct seq_net_private p;
930         unsigned int bucket;
931 };
932 
933 static struct hlist_node *get_first(struct net *net, struct iter_state *st)
934 {
935         struct nfnl_log_net *log;
936         if (!st)
937                 return NULL;
938 
939         log = nfnl_log_pernet(net);
940 
941         for (st->bucket = 0; st->bucket < INSTANCE_BUCKETS; st->bucket++) {
942                 struct hlist_head *head = &log->instance_table[st->bucket];
943 
944                 if (!hlist_empty(head))
945                         return rcu_dereference_bh(hlist_first_rcu(head));
946         }
947         return NULL;
948 }
949 
950 static struct hlist_node *get_next(struct net *net, struct iter_state *st,
951                                    struct hlist_node *h)
952 {
953         h = rcu_dereference_bh(hlist_next_rcu(h));
954         while (!h) {
955                 struct nfnl_log_net *log;
956                 struct hlist_head *head;
957 
958                 if (++st->bucket >= INSTANCE_BUCKETS)
959                         return NULL;
960 
961                 log = nfnl_log_pernet(net);
962                 head = &log->instance_table[st->bucket];
963                 h = rcu_dereference_bh(hlist_first_rcu(head));
964         }
965         return h;
966 }
967 
968 static struct hlist_node *get_idx(struct net *net, struct iter_state *st,
969                                   loff_t pos)
970 {
971         struct hlist_node *head;
972         head = get_first(net, st);
973 
974         if (head)
975                 while (pos && (head = get_next(net, st, head)))
976                         pos--;
977         return pos ? NULL : head;
978 }
979 
980 static void *seq_start(struct seq_file *s, loff_t *pos)
981         __acquires(rcu_bh)
982 {
983         rcu_read_lock_bh();
984         return get_idx(seq_file_net(s), s->private, *pos);
985 }
986 
987 static void *seq_next(struct seq_file *s, void *v, loff_t *pos)
988 {
989         (*pos)++;
990         return get_next(seq_file_net(s), s->private, v);
991 }
992 
993 static void seq_stop(struct seq_file *s, void *v)
994         __releases(rcu_bh)
995 {
996         rcu_read_unlock_bh();
997 }
998 
999 static int seq_show(struct seq_file *s, void *v)
1000 {
1001         const struct nfulnl_instance *inst = v;
1002 
1003         return seq_printf(s, "%5d %6d %5d %1d %5d %6d %2d\n",
1004                           inst->group_num,
1005                           inst->peer_portid, inst->qlen,
1006                           inst->copy_mode, inst->copy_range,
1007                           inst->flushtimeout, atomic_read(&inst->use));
1008 }
1009 
1010 static const struct seq_operations nful_seq_ops = {
1011         .start  = seq_start,
1012         .next   = seq_next,
1013         .stop   = seq_stop,
1014         .show   = seq_show,
1015 };
1016 
1017 static int nful_open(struct inode *inode, struct file *file)
1018 {
1019         return seq_open_net(inode, file, &nful_seq_ops,
1020                             sizeof(struct iter_state));
1021 }
1022 
1023 static const struct file_operations nful_file_ops = {
1024         .owner   = THIS_MODULE,
1025         .open    = nful_open,
1026         .read    = seq_read,
1027         .llseek  = seq_lseek,
1028         .release = seq_release_net,
1029 };
1030 
1031 #endif /* PROC_FS */
1032 
1033 static int __net_init nfnl_log_net_init(struct net *net)
1034 {
1035         unsigned int i;
1036         struct nfnl_log_net *log = nfnl_log_pernet(net);
1037 
1038         for (i = 0; i < INSTANCE_BUCKETS; i++)
1039                 INIT_HLIST_HEAD(&log->instance_table[i]);
1040         spin_lock_init(&log->instances_lock);
1041 
1042 #ifdef CONFIG_PROC_FS
1043         if (!proc_create("nfnetlink_log", 0440,
1044                          net->nf.proc_netfilter, &nful_file_ops))
1045                 return -ENOMEM;
1046 #endif
1047         return 0;
1048 }
1049 
1050 static void __net_exit nfnl_log_net_exit(struct net *net)
1051 {
1052 #ifdef CONFIG_PROC_FS
1053         remove_proc_entry("nfnetlink_log", net->nf.proc_netfilter);
1054 #endif
1055         nf_log_unset(net, &nfulnl_logger);
1056 }
1057 
1058 static struct pernet_operations nfnl_log_net_ops = {
1059         .init   = nfnl_log_net_init,
1060         .exit   = nfnl_log_net_exit,
1061         .id     = &nfnl_log_net_id,
1062         .size   = sizeof(struct nfnl_log_net),
1063 };
1064 
1065 static int __init nfnetlink_log_init(void)
1066 {
1067         int status = -ENOMEM;
1068 
1069         netlink_register_notifier(&nfulnl_rtnl_notifier);
1070         status = nfnetlink_subsys_register(&nfulnl_subsys);
1071         if (status < 0) {
1072                 pr_err("log: failed to create netlink socket\n");
1073                 goto cleanup_netlink_notifier;
1074         }
1075 
1076         status = nf_log_register(NFPROTO_UNSPEC, &nfulnl_logger);
1077         if (status < 0) {
1078                 pr_err("log: failed to register logger\n");
1079                 goto cleanup_subsys;
1080         }
1081 
1082         status = register_pernet_subsys(&nfnl_log_net_ops);
1083         if (status < 0) {
1084                 pr_err("log: failed to register pernet ops\n");
1085                 goto cleanup_logger;
1086         }
1087         return status;
1088 
1089 cleanup_logger:
1090         nf_log_unregister(&nfulnl_logger);
1091 cleanup_subsys:
1092         nfnetlink_subsys_unregister(&nfulnl_subsys);
1093 cleanup_netlink_notifier:
1094         netlink_unregister_notifier(&nfulnl_rtnl_notifier);
1095         return status;
1096 }
1097 
1098 static void __exit nfnetlink_log_fini(void)
1099 {
1100         unregister_pernet_subsys(&nfnl_log_net_ops);
1101         nf_log_unregister(&nfulnl_logger);
1102         nfnetlink_subsys_unregister(&nfulnl_subsys);
1103         netlink_unregister_notifier(&nfulnl_rtnl_notifier);
1104 }
1105 
1106 MODULE_DESCRIPTION("netfilter userspace logging");
1107 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
1108 MODULE_LICENSE("GPL");
1109 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_ULOG);
1110 MODULE_ALIAS_NF_LOGGER(AF_INET, 1);
1111 MODULE_ALIAS_NF_LOGGER(AF_INET6, 1);
1112 MODULE_ALIAS_NF_LOGGER(AF_BRIDGE, 1);
1113 
1114 module_init(nfnetlink_log_init);
1115 module_exit(nfnetlink_log_fini);
1116 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp