[NET]: Support multiple network namespaces with netlink
[linux-2.6.git] / net / ipv6 / netfilter / ip6_queue.c
1 /*
2  * This is a module which is used for queueing IPv6 packets and
3  * communicating with userspace via netlink.
4  *
5  * (C) 2001 Fernando Anton, this code is GPL.
6  *     IPv64 Project - Work based in IPv64 draft by Arturo Azcorra.
7  *     Universidad Carlos III de Madrid - Leganes (Madrid) - Spain
8  *     Universidad Politecnica de Alcala de Henares - Alcala de H. (Madrid) - Spain
9  *     email: fanton@it.uc3m.es
10  *
11  * This program is free software; you can redistribute it and/or modify
12  * it under the terms of the GNU General Public License version 2 as
13  * published by the Free Software Foundation.
14  */
15 #include <linux/module.h>
16 #include <linux/skbuff.h>
17 #include <linux/init.h>
18 #include <linux/ipv6.h>
19 #include <linux/notifier.h>
20 #include <linux/netdevice.h>
21 #include <linux/netfilter.h>
22 #include <linux/netlink.h>
23 #include <linux/spinlock.h>
24 #include <linux/sysctl.h>
25 #include <linux/proc_fs.h>
26 #include <linux/mutex.h>
27 #include <net/net_namespace.h>
28 #include <net/sock.h>
29 #include <net/ipv6.h>
30 #include <net/ip6_route.h>
31 #include <linux/netfilter_ipv4/ip_queue.h>
32 #include <linux/netfilter_ipv4/ip_tables.h>
33 #include <linux/netfilter_ipv6/ip6_tables.h>
34
35 #define IPQ_QMAX_DEFAULT 1024
36 #define IPQ_PROC_FS_NAME "ip6_queue"
37 #define NET_IPQ_QMAX 2088
38 #define NET_IPQ_QMAX_NAME "ip6_queue_maxlen"
39
40 struct ipq_queue_entry {
41         struct list_head list;
42         struct nf_info *info;
43         struct sk_buff *skb;
44 };
45
46 typedef int (*ipq_cmpfn)(struct ipq_queue_entry *, unsigned long);
47
48 static unsigned char copy_mode __read_mostly = IPQ_COPY_NONE;
49 static unsigned int queue_maxlen __read_mostly = IPQ_QMAX_DEFAULT;
50 static DEFINE_RWLOCK(queue_lock);
51 static int peer_pid __read_mostly;
52 static unsigned int copy_range __read_mostly;
53 static unsigned int queue_total;
54 static unsigned int queue_dropped = 0;
55 static unsigned int queue_user_dropped = 0;
56 static struct sock *ipqnl __read_mostly;
57 static LIST_HEAD(queue_list);
58 static DEFINE_MUTEX(ipqnl_mutex);
59
60 static void
61 ipq_issue_verdict(struct ipq_queue_entry *entry, int verdict)
62 {
63         local_bh_disable();
64         nf_reinject(entry->skb, entry->info, verdict);
65         local_bh_enable();
66         kfree(entry);
67 }
68
69 static inline void
70 __ipq_enqueue_entry(struct ipq_queue_entry *entry)
71 {
72        list_add(&entry->list, &queue_list);
73        queue_total++;
74 }
75
76 /*
77  * Find and return a queued entry matched by cmpfn, or return the last
78  * entry if cmpfn is NULL.
79  */
80 static inline struct ipq_queue_entry *
81 __ipq_find_entry(ipq_cmpfn cmpfn, unsigned long data)
82 {
83         struct list_head *p;
84
85         list_for_each_prev(p, &queue_list) {
86                 struct ipq_queue_entry *entry = (struct ipq_queue_entry *)p;
87
88                 if (!cmpfn || cmpfn(entry, data))
89                         return entry;
90         }
91         return NULL;
92 }
93
94 static inline void
95 __ipq_dequeue_entry(struct ipq_queue_entry *entry)
96 {
97         list_del(&entry->list);
98         queue_total--;
99 }
100
101 static inline struct ipq_queue_entry *
102 __ipq_find_dequeue_entry(ipq_cmpfn cmpfn, unsigned long data)
103 {
104         struct ipq_queue_entry *entry;
105
106         entry = __ipq_find_entry(cmpfn, data);
107         if (entry == NULL)
108                 return NULL;
109
110         __ipq_dequeue_entry(entry);
111         return entry;
112 }
113
114
115 static inline void
116 __ipq_flush(int verdict)
117 {
118         struct ipq_queue_entry *entry;
119
120         while ((entry = __ipq_find_dequeue_entry(NULL, 0)))
121                 ipq_issue_verdict(entry, verdict);
122 }
123
124 static inline int
125 __ipq_set_mode(unsigned char mode, unsigned int range)
126 {
127         int status = 0;
128
129         switch(mode) {
130         case IPQ_COPY_NONE:
131         case IPQ_COPY_META:
132                 copy_mode = mode;
133                 copy_range = 0;
134                 break;
135
136         case IPQ_COPY_PACKET:
137                 copy_mode = mode;
138                 copy_range = range;
139                 if (copy_range > 0xFFFF)
140                         copy_range = 0xFFFF;
141                 break;
142
143         default:
144                 status = -EINVAL;
145
146         }
147         return status;
148 }
149
150 static inline void
151 __ipq_reset(void)
152 {
153         peer_pid = 0;
154         net_disable_timestamp();
155         __ipq_set_mode(IPQ_COPY_NONE, 0);
156         __ipq_flush(NF_DROP);
157 }
158
159 static struct ipq_queue_entry *
160 ipq_find_dequeue_entry(ipq_cmpfn cmpfn, unsigned long data)
161 {
162         struct ipq_queue_entry *entry;
163
164         write_lock_bh(&queue_lock);
165         entry = __ipq_find_dequeue_entry(cmpfn, data);
166         write_unlock_bh(&queue_lock);
167         return entry;
168 }
169
170 static void
171 ipq_flush(int verdict)
172 {
173         write_lock_bh(&queue_lock);
174         __ipq_flush(verdict);
175         write_unlock_bh(&queue_lock);
176 }
177
178 static struct sk_buff *
179 ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
180 {
181         sk_buff_data_t old_tail;
182         size_t size = 0;
183         size_t data_len = 0;
184         struct sk_buff *skb;
185         struct ipq_packet_msg *pmsg;
186         struct nlmsghdr *nlh;
187         struct timeval tv;
188
189         read_lock_bh(&queue_lock);
190
191         switch (copy_mode) {
192         case IPQ_COPY_META:
193         case IPQ_COPY_NONE:
194                 size = NLMSG_SPACE(sizeof(*pmsg));
195                 data_len = 0;
196                 break;
197
198         case IPQ_COPY_PACKET:
199                 if ((entry->skb->ip_summed == CHECKSUM_PARTIAL ||
200                      entry->skb->ip_summed == CHECKSUM_COMPLETE) &&
201                     (*errp = skb_checksum_help(entry->skb))) {
202                         read_unlock_bh(&queue_lock);
203                         return NULL;
204                 }
205                 if (copy_range == 0 || copy_range > entry->skb->len)
206                         data_len = entry->skb->len;
207                 else
208                         data_len = copy_range;
209
210                 size = NLMSG_SPACE(sizeof(*pmsg) + data_len);
211                 break;
212
213         default:
214                 *errp = -EINVAL;
215                 read_unlock_bh(&queue_lock);
216                 return NULL;
217         }
218
219         read_unlock_bh(&queue_lock);
220
221         skb = alloc_skb(size, GFP_ATOMIC);
222         if (!skb)
223                 goto nlmsg_failure;
224
225         old_tail = skb->tail;
226         nlh = NLMSG_PUT(skb, 0, 0, IPQM_PACKET, size - sizeof(*nlh));
227         pmsg = NLMSG_DATA(nlh);
228         memset(pmsg, 0, sizeof(*pmsg));
229
230         pmsg->packet_id       = (unsigned long )entry;
231         pmsg->data_len        = data_len;
232         tv = ktime_to_timeval(entry->skb->tstamp);
233         pmsg->timestamp_sec   = tv.tv_sec;
234         pmsg->timestamp_usec  = tv.tv_usec;
235         pmsg->mark            = entry->skb->mark;
236         pmsg->hook            = entry->info->hook;
237         pmsg->hw_protocol     = entry->skb->protocol;
238
239         if (entry->info->indev)
240                 strcpy(pmsg->indev_name, entry->info->indev->name);
241         else
242                 pmsg->indev_name[0] = '\0';
243
244         if (entry->info->outdev)
245                 strcpy(pmsg->outdev_name, entry->info->outdev->name);
246         else
247                 pmsg->outdev_name[0] = '\0';
248
249         if (entry->info->indev && entry->skb->dev) {
250                 pmsg->hw_type = entry->skb->dev->type;
251                 if (entry->skb->dev->hard_header_parse)
252                         pmsg->hw_addrlen =
253                                 entry->skb->dev->hard_header_parse(entry->skb,
254                                                                    pmsg->hw_addr);
255         }
256
257         if (data_len)
258                 if (skb_copy_bits(entry->skb, 0, pmsg->payload, data_len))
259                         BUG();
260
261         nlh->nlmsg_len = skb->tail - old_tail;
262         return skb;
263
264 nlmsg_failure:
265         if (skb)
266                 kfree_skb(skb);
267         *errp = -EINVAL;
268         printk(KERN_ERR "ip6_queue: error creating packet message\n");
269         return NULL;
270 }
271
272 static int
273 ipq_enqueue_packet(struct sk_buff *skb, struct nf_info *info,
274                    unsigned int queuenum, void *data)
275 {
276         int status = -EINVAL;
277         struct sk_buff *nskb;
278         struct ipq_queue_entry *entry;
279
280         if (copy_mode == IPQ_COPY_NONE)
281                 return -EAGAIN;
282
283         entry = kmalloc(sizeof(*entry), GFP_ATOMIC);
284         if (entry == NULL) {
285                 printk(KERN_ERR "ip6_queue: OOM in ipq_enqueue_packet()\n");
286                 return -ENOMEM;
287         }
288
289         entry->info = info;
290         entry->skb = skb;
291
292         nskb = ipq_build_packet_message(entry, &status);
293         if (nskb == NULL)
294                 goto err_out_free;
295
296         write_lock_bh(&queue_lock);
297
298         if (!peer_pid)
299                 goto err_out_free_nskb;
300
301         if (queue_total >= queue_maxlen) {
302                 queue_dropped++;
303                 status = -ENOSPC;
304                 if (net_ratelimit())
305                         printk (KERN_WARNING "ip6_queue: fill at %d entries, "
306                                 "dropping packet(s).  Dropped: %d\n", queue_total,
307                                 queue_dropped);
308                 goto err_out_free_nskb;
309         }
310
311         /* netlink_unicast will either free the nskb or attach it to a socket */
312         status = netlink_unicast(ipqnl, nskb, peer_pid, MSG_DONTWAIT);
313         if (status < 0) {
314                 queue_user_dropped++;
315                 goto err_out_unlock;
316         }
317
318         __ipq_enqueue_entry(entry);
319
320         write_unlock_bh(&queue_lock);
321         return status;
322
323 err_out_free_nskb:
324         kfree_skb(nskb);
325
326 err_out_unlock:
327         write_unlock_bh(&queue_lock);
328
329 err_out_free:
330         kfree(entry);
331         return status;
332 }
333
334 static int
335 ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
336 {
337         int diff;
338         struct ipv6hdr *user_iph = (struct ipv6hdr *)v->payload;
339
340         if (v->data_len < sizeof(*user_iph))
341                 return 0;
342         diff = v->data_len - e->skb->len;
343         if (diff < 0) {
344                 if (pskb_trim(e->skb, v->data_len))
345                         return -ENOMEM;
346         } else if (diff > 0) {
347                 if (v->data_len > 0xFFFF)
348                         return -EINVAL;
349                 if (diff > skb_tailroom(e->skb)) {
350                         struct sk_buff *newskb;
351
352                         newskb = skb_copy_expand(e->skb,
353                                                  skb_headroom(e->skb),
354                                                  diff,
355                                                  GFP_ATOMIC);
356                         if (newskb == NULL) {
357                                 printk(KERN_WARNING "ip6_queue: OOM "
358                                       "in mangle, dropping packet\n");
359                                 return -ENOMEM;
360                         }
361                         if (e->skb->sk)
362                                 skb_set_owner_w(newskb, e->skb->sk);
363                         kfree_skb(e->skb);
364                         e->skb = newskb;
365                 }
366                 skb_put(e->skb, diff);
367         }
368         if (!skb_make_writable(&e->skb, v->data_len))
369                 return -ENOMEM;
370         skb_copy_to_linear_data(e->skb, v->payload, v->data_len);
371         e->skb->ip_summed = CHECKSUM_NONE;
372
373         return 0;
374 }
375
376 static inline int
377 id_cmp(struct ipq_queue_entry *e, unsigned long id)
378 {
379         return (id == (unsigned long )e);
380 }
381
382 static int
383 ipq_set_verdict(struct ipq_verdict_msg *vmsg, unsigned int len)
384 {
385         struct ipq_queue_entry *entry;
386
387         if (vmsg->value > NF_MAX_VERDICT)
388                 return -EINVAL;
389
390         entry = ipq_find_dequeue_entry(id_cmp, vmsg->id);
391         if (entry == NULL)
392                 return -ENOENT;
393         else {
394                 int verdict = vmsg->value;
395
396                 if (vmsg->data_len && vmsg->data_len == len)
397                         if (ipq_mangle_ipv6(vmsg, entry) < 0)
398                                 verdict = NF_DROP;
399
400                 ipq_issue_verdict(entry, verdict);
401                 return 0;
402         }
403 }
404
405 static int
406 ipq_set_mode(unsigned char mode, unsigned int range)
407 {
408         int status;
409
410         write_lock_bh(&queue_lock);
411         status = __ipq_set_mode(mode, range);
412         write_unlock_bh(&queue_lock);
413         return status;
414 }
415
416 static int
417 ipq_receive_peer(struct ipq_peer_msg *pmsg,
418                  unsigned char type, unsigned int len)
419 {
420         int status = 0;
421
422         if (len < sizeof(*pmsg))
423                 return -EINVAL;
424
425         switch (type) {
426         case IPQM_MODE:
427                 status = ipq_set_mode(pmsg->msg.mode.value,
428                                       pmsg->msg.mode.range);
429                 break;
430
431         case IPQM_VERDICT:
432                 if (pmsg->msg.verdict.value > NF_MAX_VERDICT)
433                         status = -EINVAL;
434                 else
435                         status = ipq_set_verdict(&pmsg->msg.verdict,
436                                                  len - sizeof(*pmsg));
437                         break;
438         default:
439                 status = -EINVAL;
440         }
441         return status;
442 }
443
444 static int
445 dev_cmp(struct ipq_queue_entry *entry, unsigned long ifindex)
446 {
447         if (entry->info->indev)
448                 if (entry->info->indev->ifindex == ifindex)
449                         return 1;
450
451         if (entry->info->outdev)
452                 if (entry->info->outdev->ifindex == ifindex)
453                         return 1;
454
455         return 0;
456 }
457
458 static void
459 ipq_dev_drop(int ifindex)
460 {
461         struct ipq_queue_entry *entry;
462
463         while ((entry = ipq_find_dequeue_entry(dev_cmp, ifindex)) != NULL)
464                 ipq_issue_verdict(entry, NF_DROP);
465 }
466
467 #define RCV_SKB_FAIL(err) do { netlink_ack(skb, nlh, (err)); return; } while (0)
468
469 static inline void
470 ipq_rcv_skb(struct sk_buff *skb)
471 {
472         int status, type, pid, flags, nlmsglen, skblen;
473         struct nlmsghdr *nlh;
474
475         skblen = skb->len;
476         if (skblen < sizeof(*nlh))
477                 return;
478
479         nlh = nlmsg_hdr(skb);
480         nlmsglen = nlh->nlmsg_len;
481         if (nlmsglen < sizeof(*nlh) || skblen < nlmsglen)
482                 return;
483
484         pid = nlh->nlmsg_pid;
485         flags = nlh->nlmsg_flags;
486
487         if(pid <= 0 || !(flags & NLM_F_REQUEST) || flags & NLM_F_MULTI)
488                 RCV_SKB_FAIL(-EINVAL);
489
490         if (flags & MSG_TRUNC)
491                 RCV_SKB_FAIL(-ECOMM);
492
493         type = nlh->nlmsg_type;
494         if (type < NLMSG_NOOP || type >= IPQM_MAX)
495                 RCV_SKB_FAIL(-EINVAL);
496
497         if (type <= IPQM_BASE)
498                 return;
499
500         if (security_netlink_recv(skb, CAP_NET_ADMIN))
501                 RCV_SKB_FAIL(-EPERM);
502
503         write_lock_bh(&queue_lock);
504
505         if (peer_pid) {
506                 if (peer_pid != pid) {
507                         write_unlock_bh(&queue_lock);
508                         RCV_SKB_FAIL(-EBUSY);
509                 }
510         } else {
511                 net_enable_timestamp();
512                 peer_pid = pid;
513         }
514
515         write_unlock_bh(&queue_lock);
516
517         status = ipq_receive_peer(NLMSG_DATA(nlh), type,
518                                   nlmsglen - NLMSG_LENGTH(0));
519         if (status < 0)
520                 RCV_SKB_FAIL(status);
521
522         if (flags & NLM_F_ACK)
523                 netlink_ack(skb, nlh, 0);
524         return;
525 }
526
527 static void
528 ipq_rcv_sk(struct sock *sk, int len)
529 {
530         struct sk_buff *skb;
531         unsigned int qlen;
532
533         mutex_lock(&ipqnl_mutex);
534
535         for (qlen = skb_queue_len(&sk->sk_receive_queue); qlen; qlen--) {
536                 skb = skb_dequeue(&sk->sk_receive_queue);
537                 ipq_rcv_skb(skb);
538                 kfree_skb(skb);
539         }
540
541         mutex_unlock(&ipqnl_mutex);
542 }
543
544 static int
545 ipq_rcv_dev_event(struct notifier_block *this,
546                   unsigned long event, void *ptr)
547 {
548         struct net_device *dev = ptr;
549
550         if (dev->nd_net != &init_net)
551                 return NOTIFY_DONE;
552
553         /* Drop any packets associated with the downed device */
554         if (event == NETDEV_DOWN)
555                 ipq_dev_drop(dev->ifindex);
556         return NOTIFY_DONE;
557 }
558
559 static struct notifier_block ipq_dev_notifier = {
560         .notifier_call  = ipq_rcv_dev_event,
561 };
562
563 static int
564 ipq_rcv_nl_event(struct notifier_block *this,
565                  unsigned long event, void *ptr)
566 {
567         struct netlink_notify *n = ptr;
568
569         if (event == NETLINK_URELEASE &&
570             n->protocol == NETLINK_IP6_FW && n->pid) {
571                 write_lock_bh(&queue_lock);
572                 if ((n->net == &init_net) && (n->pid == peer_pid))
573                         __ipq_reset();
574                 write_unlock_bh(&queue_lock);
575         }
576         return NOTIFY_DONE;
577 }
578
579 static struct notifier_block ipq_nl_notifier = {
580         .notifier_call  = ipq_rcv_nl_event,
581 };
582
583 static struct ctl_table_header *ipq_sysctl_header;
584
585 static ctl_table ipq_table[] = {
586         {
587                 .ctl_name       = NET_IPQ_QMAX,
588                 .procname       = NET_IPQ_QMAX_NAME,
589                 .data           = &queue_maxlen,
590                 .maxlen         = sizeof(queue_maxlen),
591                 .mode           = 0644,
592                 .proc_handler   = proc_dointvec
593         },
594         { .ctl_name = 0 }
595 };
596
597 static ctl_table ipq_dir_table[] = {
598         {
599                 .ctl_name       = NET_IPV6,
600                 .procname       = "ipv6",
601                 .mode           = 0555,
602                 .child          = ipq_table
603         },
604         { .ctl_name = 0 }
605 };
606
607 static ctl_table ipq_root_table[] = {
608         {
609                 .ctl_name       = CTL_NET,
610                 .procname       = "net",
611                 .mode           = 0555,
612                 .child          = ipq_dir_table
613         },
614         { .ctl_name = 0 }
615 };
616
617 #ifdef CONFIG_PROC_FS
618 static int
619 ipq_get_info(char *buffer, char **start, off_t offset, int length)
620 {
621         int len;
622
623         read_lock_bh(&queue_lock);
624
625         len = sprintf(buffer,
626                       "Peer PID          : %d\n"
627                       "Copy mode         : %hu\n"
628                       "Copy range        : %u\n"
629                       "Queue length      : %u\n"
630                       "Queue max. length : %u\n"
631                       "Queue dropped     : %u\n"
632                       "Netfilter dropped : %u\n",
633                       peer_pid,
634                       copy_mode,
635                       copy_range,
636                       queue_total,
637                       queue_maxlen,
638                       queue_dropped,
639                       queue_user_dropped);
640
641         read_unlock_bh(&queue_lock);
642
643         *start = buffer + offset;
644         len -= offset;
645         if (len > length)
646                 len = length;
647         else if (len < 0)
648                 len = 0;
649         return len;
650 }
651 #endif /* CONFIG_PROC_FS */
652
653 static struct nf_queue_handler nfqh = {
654         .name   = "ip6_queue",
655         .outfn  = &ipq_enqueue_packet,
656 };
657
658 static int __init ip6_queue_init(void)
659 {
660         int status = -ENOMEM;
661         struct proc_dir_entry *proc;
662
663         netlink_register_notifier(&ipq_nl_notifier);
664         ipqnl = netlink_kernel_create(&init_net, NETLINK_IP6_FW, 0, ipq_rcv_sk,
665                                         NULL, THIS_MODULE);
666         if (ipqnl == NULL) {
667                 printk(KERN_ERR "ip6_queue: failed to create netlink socket\n");
668                 goto cleanup_netlink_notifier;
669         }
670
671         proc = proc_net_create(&init_net, IPQ_PROC_FS_NAME, 0, ipq_get_info);
672         if (proc)
673                 proc->owner = THIS_MODULE;
674         else {
675                 printk(KERN_ERR "ip6_queue: failed to create proc entry\n");
676                 goto cleanup_ipqnl;
677         }
678
679         register_netdevice_notifier(&ipq_dev_notifier);
680         ipq_sysctl_header = register_sysctl_table(ipq_root_table);
681
682         status = nf_register_queue_handler(PF_INET6, &nfqh);
683         if (status < 0) {
684                 printk(KERN_ERR "ip6_queue: failed to register queue handler\n");
685                 goto cleanup_sysctl;
686         }
687         return status;
688
689 cleanup_sysctl:
690         unregister_sysctl_table(ipq_sysctl_header);
691         unregister_netdevice_notifier(&ipq_dev_notifier);
692         proc_net_remove(&init_net, IPQ_PROC_FS_NAME);
693
694 cleanup_ipqnl:
695         sock_release(ipqnl->sk_socket);
696         mutex_lock(&ipqnl_mutex);
697         mutex_unlock(&ipqnl_mutex);
698
699 cleanup_netlink_notifier:
700         netlink_unregister_notifier(&ipq_nl_notifier);
701         return status;
702 }
703
704 static void __exit ip6_queue_fini(void)
705 {
706         nf_unregister_queue_handlers(&nfqh);
707         synchronize_net();
708         ipq_flush(NF_DROP);
709
710         unregister_sysctl_table(ipq_sysctl_header);
711         unregister_netdevice_notifier(&ipq_dev_notifier);
712         proc_net_remove(&init_net, IPQ_PROC_FS_NAME);
713
714         sock_release(ipqnl->sk_socket);
715         mutex_lock(&ipqnl_mutex);
716         mutex_unlock(&ipqnl_mutex);
717
718         netlink_unregister_notifier(&ipq_nl_notifier);
719 }
720
721 MODULE_DESCRIPTION("IPv6 packet queue handler");
722 MODULE_LICENSE("GPL");
723
724 module_init(ip6_queue_init);
725 module_exit(ip6_queue_fini);