1/*
2 * inet_diag.c	Module for monitoring INET transport protocols sockets.
3 *
4 * Authors:	Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
5 *
6 *	This program is free software; you can redistribute it and/or
7 *      modify it under the terms of the GNU General Public License
8 *      as published by the Free Software Foundation; either version
9 *      2 of the License, or (at your option) any later version.
10 */
11
12#include <linux/kernel.h>
13#include <linux/module.h>
14#include <linux/types.h>
15#include <linux/fcntl.h>
16#include <linux/random.h>
17#include <linux/slab.h>
18#include <linux/cache.h>
19#include <linux/init.h>
20#include <linux/time.h>
21
22#include <net/icmp.h>
23#include <net/tcp.h>
24#include <net/ipv6.h>
25#include <net/inet_common.h>
26#include <net/inet_connection_sock.h>
27#include <net/inet_hashtables.h>
28#include <net/inet_timewait_sock.h>
29#include <net/inet6_hashtables.h>
30#include <net/netlink.h>
31
32#include <linux/inet.h>
33#include <linux/stddef.h>
34
35#include <linux/inet_diag.h>
36#include <linux/sock_diag.h>
37
38static const struct inet_diag_handler **inet_diag_table;
39
40struct inet_diag_entry {
41	__be32 *saddr;
42	__be32 *daddr;
43	u16 sport;
44	u16 dport;
45	u16 family;
46	u16 userlocks;
47#if IS_ENABLED(CONFIG_IPV6)
48	struct in6_addr saddr_storage;	/* for IPv4-mapped-IPv6 addresses */
49	struct in6_addr daddr_storage;	/* for IPv4-mapped-IPv6 addresses */
50#endif
51};
52
53static DEFINE_MUTEX(inet_diag_table_mutex);
54
55static const struct inet_diag_handler *inet_diag_lock_handler(int proto)
56{
57	if (!inet_diag_table[proto])
58		request_module("net-pf-%d-proto-%d-type-%d-%d", PF_NETLINK,
59			       NETLINK_SOCK_DIAG, AF_INET, proto);
60
61	mutex_lock(&inet_diag_table_mutex);
62	if (!inet_diag_table[proto])
63		return ERR_PTR(-ENOENT);
64
65	return inet_diag_table[proto];
66}
67
68static inline void inet_diag_unlock_handler(
69	const struct inet_diag_handler *handler)
70{
71	mutex_unlock(&inet_diag_table_mutex);
72}
73
74int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
75			      struct sk_buff *skb, struct inet_diag_req_v2 *req,
76			      struct user_namespace *user_ns,
77			      u32 portid, u32 seq, u16 nlmsg_flags,
78			      const struct nlmsghdr *unlh)
79{
80	const struct inet_sock *inet = inet_sk(sk);
81	struct inet_diag_msg *r;
82	struct nlmsghdr  *nlh;
83	struct nlattr *attr;
84	void *info = NULL;
85	const struct inet_diag_handler *handler;
86	int ext = req->idiag_ext;
87
88	handler = inet_diag_table[req->sdiag_protocol];
89	BUG_ON(handler == NULL);
90
91	nlh = nlmsg_put(skb, portid, seq, unlh->nlmsg_type, sizeof(*r),
92			nlmsg_flags);
93	if (!nlh)
94		return -EMSGSIZE;
95
96	r = nlmsg_data(nlh);
97	BUG_ON(sk->sk_state == TCP_TIME_WAIT);
98
99	r->idiag_family = sk->sk_family;
100	r->idiag_state = sk->sk_state;
101	r->idiag_timer = 0;
102	r->idiag_retrans = 0;
103
104	r->id.idiag_if = sk->sk_bound_dev_if;
105	sock_diag_save_cookie(sk, r->id.idiag_cookie);
106
107	r->id.idiag_sport = inet->inet_sport;
108	r->id.idiag_dport = inet->inet_dport;
109	r->id.idiag_src[0] = inet->inet_rcv_saddr;
110	r->id.idiag_dst[0] = inet->inet_daddr;
111
112	if (nla_put_u8(skb, INET_DIAG_SHUTDOWN, sk->sk_shutdown))
113		goto errout;
114
115	/* IPv6 dual-stack sockets use inet->tos for IPv4 connections,
116	 * hence this needs to be included regardless of socket family.
117	 */
118	if (ext & (1 << (INET_DIAG_TOS - 1)))
119		if (nla_put_u8(skb, INET_DIAG_TOS, inet->tos) < 0)
120			goto errout;
121
122#if IS_ENABLED(CONFIG_IPV6)
123	if (r->idiag_family == AF_INET6) {
124		const struct ipv6_pinfo *np = inet6_sk(sk);
125
126		*(struct in6_addr *)r->id.idiag_src = np->rcv_saddr;
127		*(struct in6_addr *)r->id.idiag_dst = np->daddr;
128
129		if (ext & (1 << (INET_DIAG_TCLASS - 1)))
130			if (nla_put_u8(skb, INET_DIAG_TCLASS, np->tclass) < 0)
131				goto errout;
132	}
133#endif
134
135	r->idiag_uid = from_kuid_munged(user_ns, sock_i_uid(sk));
136	r->idiag_inode = sock_i_ino(sk);
137
138	if (ext & (1 << (INET_DIAG_MEMINFO - 1))) {
139		struct inet_diag_meminfo minfo = {
140			.idiag_rmem = sk_rmem_alloc_get(sk),
141			.idiag_wmem = sk->sk_wmem_queued,
142			.idiag_fmem = sk->sk_forward_alloc,
143			.idiag_tmem = sk_wmem_alloc_get(sk),
144		};
145
146		if (nla_put(skb, INET_DIAG_MEMINFO, sizeof(minfo), &minfo) < 0)
147			goto errout;
148	}
149
150	if (ext & (1 << (INET_DIAG_SKMEMINFO - 1)))
151		if (sock_diag_put_meminfo(sk, skb, INET_DIAG_SKMEMINFO))
152			goto errout;
153
154	if (icsk == NULL) {
155		handler->idiag_get_info(sk, r, NULL);
156		goto out;
157	}
158
159#define EXPIRES_IN_MS(tmo)  DIV_ROUND_UP((tmo - jiffies) * 1000, HZ)
160
161	if (icsk->icsk_pending == ICSK_TIME_RETRANS ||
162	    icsk->icsk_pending == ICSK_TIME_EARLY_RETRANS ||
163	    icsk->icsk_pending == ICSK_TIME_LOSS_PROBE) {
164		r->idiag_timer = 1;
165		r->idiag_retrans = icsk->icsk_retransmits;
166		r->idiag_expires = EXPIRES_IN_MS(icsk->icsk_timeout);
167	} else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
168		r->idiag_timer = 4;
169		r->idiag_retrans = icsk->icsk_probes_out;
170		r->idiag_expires = EXPIRES_IN_MS(icsk->icsk_timeout);
171	} else if (timer_pending(&sk->sk_timer)) {
172		r->idiag_timer = 2;
173		r->idiag_retrans = icsk->icsk_probes_out;
174		r->idiag_expires = EXPIRES_IN_MS(sk->sk_timer.expires);
175	} else {
176		r->idiag_timer = 0;
177		r->idiag_expires = 0;
178	}
179#undef EXPIRES_IN_MS
180
181	if (ext & (1 << (INET_DIAG_INFO - 1))) {
182		attr = nla_reserve(skb, INET_DIAG_INFO,
183				   sizeof(struct tcp_info));
184		if (!attr)
185			goto errout;
186
187		info = nla_data(attr);
188	}
189
190	if ((ext & (1 << (INET_DIAG_CONG - 1))) && icsk->icsk_ca_ops)
191		if (nla_put_string(skb, INET_DIAG_CONG,
192				   icsk->icsk_ca_ops->name) < 0)
193			goto errout;
194
195	handler->idiag_get_info(sk, r, info);
196
197	if (sk->sk_state < TCP_TIME_WAIT &&
198	    icsk->icsk_ca_ops && icsk->icsk_ca_ops->get_info)
199		icsk->icsk_ca_ops->get_info(sk, ext, skb);
200
201out:
202	return nlmsg_end(skb, nlh);
203
204errout:
205	nlmsg_cancel(skb, nlh);
206	return -EMSGSIZE;
207}
208EXPORT_SYMBOL_GPL(inet_sk_diag_fill);
209
210static int inet_csk_diag_fill(struct sock *sk,
211			      struct sk_buff *skb, struct inet_diag_req_v2 *req,
212			      struct user_namespace *user_ns,
213			      u32 portid, u32 seq, u16 nlmsg_flags,
214			      const struct nlmsghdr *unlh)
215{
216	return inet_sk_diag_fill(sk, inet_csk(sk),
217			skb, req, user_ns, portid, seq, nlmsg_flags, unlh);
218}
219
220static int inet_twsk_diag_fill(struct inet_timewait_sock *tw,
221			       struct sk_buff *skb, struct inet_diag_req_v2 *req,
222			       u32 portid, u32 seq, u16 nlmsg_flags,
223			       const struct nlmsghdr *unlh)
224{
225	long tmo;
226	struct inet_diag_msg *r;
227	struct nlmsghdr *nlh;
228
229	nlh = nlmsg_put(skb, portid, seq, unlh->nlmsg_type, sizeof(*r),
230			nlmsg_flags);
231	if (!nlh)
232		return -EMSGSIZE;
233
234	r = nlmsg_data(nlh);
235	BUG_ON(tw->tw_state != TCP_TIME_WAIT);
236
237	tmo = tw->tw_ttd - jiffies;
238	if (tmo < 0)
239		tmo = 0;
240
241	r->idiag_family	      = tw->tw_family;
242	r->idiag_retrans      = 0;
243	r->id.idiag_if	      = tw->tw_bound_dev_if;
244	sock_diag_save_cookie(tw, r->id.idiag_cookie);
245	r->id.idiag_sport     = tw->tw_sport;
246	r->id.idiag_dport     = tw->tw_dport;
247	r->id.idiag_src[0]    = tw->tw_rcv_saddr;
248	r->id.idiag_dst[0]    = tw->tw_daddr;
249	r->idiag_state	      = tw->tw_substate;
250	r->idiag_timer	      = 3;
251	r->idiag_expires      = DIV_ROUND_UP(tmo * 1000, HZ);
252	r->idiag_rqueue	      = 0;
253	r->idiag_wqueue	      = 0;
254	r->idiag_uid	      = 0;
255	r->idiag_inode	      = 0;
256#if IS_ENABLED(CONFIG_IPV6)
257	if (tw->tw_family == AF_INET6) {
258		const struct inet6_timewait_sock *tw6 =
259						inet6_twsk((struct sock *)tw);
260
261		*(struct in6_addr *)r->id.idiag_src = tw6->tw_v6_rcv_saddr;
262		*(struct in6_addr *)r->id.idiag_dst = tw6->tw_v6_daddr;
263	}
264#endif
265
266	return nlmsg_end(skb, nlh);
267}
268
269static int sk_diag_fill(struct sock *sk, struct sk_buff *skb,
270			struct inet_diag_req_v2 *r,
271			struct user_namespace *user_ns,
272			u32 portid, u32 seq, u16 nlmsg_flags,
273			const struct nlmsghdr *unlh)
274{
275	if (sk->sk_state == TCP_TIME_WAIT)
276		return inet_twsk_diag_fill((struct inet_timewait_sock *)sk,
277					   skb, r, portid, seq, nlmsg_flags,
278					   unlh);
279	return inet_csk_diag_fill(sk, skb, r, user_ns, portid, seq, nlmsg_flags, unlh);
280}
281
282int inet_diag_dump_one_icsk(struct inet_hashinfo *hashinfo, struct sk_buff *in_skb,
283		const struct nlmsghdr *nlh, struct inet_diag_req_v2 *req)
284{
285	int err;
286	struct sock *sk;
287	struct sk_buff *rep;
288	struct net *net = sock_net(in_skb->sk);
289
290	err = -EINVAL;
291	if (req->sdiag_family == AF_INET) {
292		sk = inet_lookup(net, hashinfo, req->id.idiag_dst[0],
293				 req->id.idiag_dport, req->id.idiag_src[0],
294				 req->id.idiag_sport, req->id.idiag_if);
295	}
296#if IS_ENABLED(CONFIG_IPV6)
297	else if (req->sdiag_family == AF_INET6) {
298		sk = inet6_lookup(net, hashinfo,
299				  (struct in6_addr *)req->id.idiag_dst,
300				  req->id.idiag_dport,
301				  (struct in6_addr *)req->id.idiag_src,
302				  req->id.idiag_sport,
303				  req->id.idiag_if);
304	}
305#endif
306	else {
307		goto out_nosk;
308	}
309
310	err = -ENOENT;
311	if (sk == NULL)
312		goto out_nosk;
313
314	err = sock_diag_check_cookie(sk, req->id.idiag_cookie);
315	if (err)
316		goto out;
317
318	rep = nlmsg_new(sizeof(struct inet_diag_msg) +
319			sizeof(struct inet_diag_meminfo) +
320			sizeof(struct tcp_info) + 64, GFP_KERNEL);
321	if (!rep) {
322		err = -ENOMEM;
323		goto out;
324	}
325
326	err = sk_diag_fill(sk, rep, req,
327			   sk_user_ns(NETLINK_CB(in_skb).sk),
328			   NETLINK_CB(in_skb).portid,
329			   nlh->nlmsg_seq, 0, nlh);
330	if (err < 0) {
331		WARN_ON(err == -EMSGSIZE);
332		nlmsg_free(rep);
333		goto out;
334	}
335	err = netlink_unicast(net->diag_nlsk, rep, NETLINK_CB(in_skb).portid,
336			      MSG_DONTWAIT);
337	if (err > 0)
338		err = 0;
339
340out:
341	if (sk) {
342		if (sk->sk_state == TCP_TIME_WAIT)
343			inet_twsk_put((struct inet_timewait_sock *)sk);
344		else
345			sock_put(sk);
346	}
347out_nosk:
348	return err;
349}
350EXPORT_SYMBOL_GPL(inet_diag_dump_one_icsk);
351
352static int inet_diag_get_exact(struct sk_buff *in_skb,
353			       const struct nlmsghdr *nlh,
354			       struct inet_diag_req_v2 *req)
355{
356	const struct inet_diag_handler *handler;
357	int err;
358
359	handler = inet_diag_lock_handler(req->sdiag_protocol);
360	if (IS_ERR(handler))
361		err = PTR_ERR(handler);
362	else
363		err = handler->dump_one(in_skb, nlh, req);
364	inet_diag_unlock_handler(handler);
365
366	return err;
367}
368
369static int bitstring_match(const __be32 *a1, const __be32 *a2, int bits)
370{
371	int words = bits >> 5;
372
373	bits &= 0x1f;
374
375	if (words) {
376		if (memcmp(a1, a2, words << 2))
377			return 0;
378	}
379	if (bits) {
380		__be32 w1, w2;
381		__be32 mask;
382
383		w1 = a1[words];
384		w2 = a2[words];
385
386		mask = htonl((0xffffffff) << (32 - bits));
387
388		if ((w1 ^ w2) & mask)
389			return 0;
390	}
391
392	return 1;
393}
394
395
396static int inet_diag_bc_run(const struct nlattr *_bc,
397		const struct inet_diag_entry *entry)
398{
399	const void *bc = nla_data(_bc);
400	int len = nla_len(_bc);
401
402	while (len > 0) {
403		int yes = 1;
404		const struct inet_diag_bc_op *op = bc;
405
406		switch (op->code) {
407		case INET_DIAG_BC_NOP:
408			break;
409		case INET_DIAG_BC_JMP:
410			yes = 0;
411			break;
412		case INET_DIAG_BC_S_GE:
413			yes = entry->sport >= op[1].no;
414			break;
415		case INET_DIAG_BC_S_LE:
416			yes = entry->sport <= op[1].no;
417			break;
418		case INET_DIAG_BC_D_GE:
419			yes = entry->dport >= op[1].no;
420			break;
421		case INET_DIAG_BC_D_LE:
422			yes = entry->dport <= op[1].no;
423			break;
424		case INET_DIAG_BC_AUTO:
425			yes = !(entry->userlocks & SOCK_BINDPORT_LOCK);
426			break;
427		case INET_DIAG_BC_S_COND:
428		case INET_DIAG_BC_D_COND: {
429			struct inet_diag_hostcond *cond;
430			__be32 *addr;
431
432			cond = (struct inet_diag_hostcond *)(op + 1);
433			if (cond->port != -1 &&
434			    cond->port != (op->code == INET_DIAG_BC_S_COND ?
435					     entry->sport : entry->dport)) {
436				yes = 0;
437				break;
438			}
439
440			if (op->code == INET_DIAG_BC_S_COND)
441				addr = entry->saddr;
442			else
443				addr = entry->daddr;
444
445			if (cond->family != AF_UNSPEC &&
446			    cond->family != entry->family) {
447				if (entry->family == AF_INET6 &&
448				    cond->family == AF_INET) {
449					if (addr[0] == 0 && addr[1] == 0 &&
450					    addr[2] == htonl(0xffff) &&
451					    bitstring_match(addr + 3,
452							    cond->addr,
453							    cond->prefix_len))
454						break;
455				}
456				yes = 0;
457				break;
458			}
459
460			if (cond->prefix_len == 0)
461				break;
462			if (bitstring_match(addr, cond->addr,
463					    cond->prefix_len))
464				break;
465			yes = 0;
466			break;
467		}
468		}
469
470		if (yes) {
471			len -= op->yes;
472			bc += op->yes;
473		} else {
474			len -= op->no;
475			bc += op->no;
476		}
477	}
478	return len == 0;
479}
480
481int inet_diag_bc_sk(const struct nlattr *bc, struct sock *sk)
482{
483	struct inet_diag_entry entry;
484	struct inet_sock *inet = inet_sk(sk);
485
486	if (bc == NULL)
487		return 1;
488
489	entry.family = sk->sk_family;
490#if IS_ENABLED(CONFIG_IPV6)
491	if (entry.family == AF_INET6) {
492		struct ipv6_pinfo *np = inet6_sk(sk);
493
494		entry.saddr = np->rcv_saddr.s6_addr32;
495		entry.daddr = np->daddr.s6_addr32;
496	} else
497#endif
498	{
499		entry.saddr = &inet->inet_rcv_saddr;
500		entry.daddr = &inet->inet_daddr;
501	}
502	entry.sport = inet->inet_num;
503	entry.dport = ntohs(inet->inet_dport);
504	entry.userlocks = sk->sk_userlocks;
505
506	return inet_diag_bc_run(bc, &entry);
507}
508EXPORT_SYMBOL_GPL(inet_diag_bc_sk);
509
510static int valid_cc(const void *bc, int len, int cc)
511{
512	while (len >= 0) {
513		const struct inet_diag_bc_op *op = bc;
514
515		if (cc > len)
516			return 0;
517		if (cc == len)
518			return 1;
519		if (op->yes < 4 || op->yes & 3)
520			return 0;
521		len -= op->yes;
522		bc  += op->yes;
523	}
524	return 0;
525}
526
527/* Validate an inet_diag_hostcond. */
528static bool valid_hostcond(const struct inet_diag_bc_op *op, int len,
529			   int *min_len)
530{
531	int addr_len;
532	struct inet_diag_hostcond *cond;
533
534	/* Check hostcond space. */
535	*min_len += sizeof(struct inet_diag_hostcond);
536	if (len < *min_len)
537		return false;
538	cond = (struct inet_diag_hostcond *)(op + 1);
539
540	/* Check address family and address length. */
541	switch (cond->family) {
542	case AF_UNSPEC:
543		addr_len = 0;
544		break;
545	case AF_INET:
546		addr_len = sizeof(struct in_addr);
547		break;
548	case AF_INET6:
549		addr_len = sizeof(struct in6_addr);
550		break;
551	default:
552		return false;
553	}
554	*min_len += addr_len;
555	if (len < *min_len)
556		return false;
557
558	/* Check prefix length (in bits) vs address length (in bytes). */
559	if (cond->prefix_len > 8 * addr_len)
560		return false;
561
562	return true;
563}
564
565/* Validate a port comparison operator. */
566static inline bool valid_port_comparison(const struct inet_diag_bc_op *op,
567					 int len, int *min_len)
568{
569	/* Port comparisons put the port in a follow-on inet_diag_bc_op. */
570	*min_len += sizeof(struct inet_diag_bc_op);
571	if (len < *min_len)
572		return false;
573	return true;
574}
575
576static int inet_diag_bc_audit(const void *bytecode, int bytecode_len)
577{
578	const void *bc = bytecode;
579	int  len = bytecode_len;
580
581	while (len > 0) {
582		const struct inet_diag_bc_op *op = bc;
583		int min_len = sizeof(struct inet_diag_bc_op);
584
585//printk("BC: %d %d %d {%d} / %d\n", op->code, op->yes, op->no, op[1].no, len);
586		switch (op->code) {
587		case INET_DIAG_BC_S_COND:
588		case INET_DIAG_BC_D_COND:
589			if (!valid_hostcond(bc, len, &min_len))
590				return -EINVAL;
591			break;
592		case INET_DIAG_BC_S_GE:
593		case INET_DIAG_BC_S_LE:
594		case INET_DIAG_BC_D_GE:
595		case INET_DIAG_BC_D_LE:
596			if (!valid_port_comparison(bc, len, &min_len))
597				return -EINVAL;
598			break;
599		case INET_DIAG_BC_AUTO:
600		case INET_DIAG_BC_JMP:
601		case INET_DIAG_BC_NOP:
602			break;
603		default:
604			return -EINVAL;
605		}
606
607		if (op->code != INET_DIAG_BC_NOP) {
608			if (op->no < min_len || op->no > len + 4 || op->no & 3)
609				return -EINVAL;
610			if (op->no < len &&
611			    !valid_cc(bytecode, bytecode_len, len - op->no))
612				return -EINVAL;
613		}
614
615		if (op->yes < min_len || op->yes > len + 4 || op->yes & 3)
616			return -EINVAL;
617		bc  += op->yes;
618		len -= op->yes;
619	}
620	return len == 0 ? 0 : -EINVAL;
621}
622
623static int inet_csk_diag_dump(struct sock *sk,
624			      struct sk_buff *skb,
625			      struct netlink_callback *cb,
626			      struct inet_diag_req_v2 *r,
627			      const struct nlattr *bc)
628{
629	if (!inet_diag_bc_sk(bc, sk))
630		return 0;
631
632	return inet_csk_diag_fill(sk, skb, r,
633				  sk_user_ns(NETLINK_CB(cb->skb).sk),
634				  NETLINK_CB(cb->skb).portid,
635				  cb->nlh->nlmsg_seq, NLM_F_MULTI, cb->nlh);
636}
637
638static int inet_twsk_diag_dump(struct inet_timewait_sock *tw,
639			       struct sk_buff *skb,
640			       struct netlink_callback *cb,
641			       struct inet_diag_req_v2 *r,
642			       const struct nlattr *bc)
643{
644	if (bc != NULL) {
645		struct inet_diag_entry entry;
646
647		entry.family = tw->tw_family;
648#if IS_ENABLED(CONFIG_IPV6)
649		if (tw->tw_family == AF_INET6) {
650			struct inet6_timewait_sock *tw6 =
651						inet6_twsk((struct sock *)tw);
652			entry.saddr = tw6->tw_v6_rcv_saddr.s6_addr32;
653			entry.daddr = tw6->tw_v6_daddr.s6_addr32;
654		} else
655#endif
656		{
657			entry.saddr = &tw->tw_rcv_saddr;
658			entry.daddr = &tw->tw_daddr;
659		}
660		entry.sport = tw->tw_num;
661		entry.dport = ntohs(tw->tw_dport);
662		entry.userlocks = 0;
663
664		if (!inet_diag_bc_run(bc, &entry))
665			return 0;
666	}
667
668	return inet_twsk_diag_fill(tw, skb, r,
669				   NETLINK_CB(cb->skb).portid,
670				   cb->nlh->nlmsg_seq, NLM_F_MULTI, cb->nlh);
671}
672
673/* Get the IPv4, IPv6, or IPv4-mapped-IPv6 local and remote addresses
674 * from a request_sock. For IPv4-mapped-IPv6 we must map IPv4 to IPv6.
675 */
676static inline void inet_diag_req_addrs(const struct sock *sk,
677				       const struct request_sock *req,
678				       struct inet_diag_entry *entry)
679{
680	struct inet_request_sock *ireq = inet_rsk(req);
681
682#if IS_ENABLED(CONFIG_IPV6)
683	if (sk->sk_family == AF_INET6) {
684		if (req->rsk_ops->family == AF_INET6) {
685			entry->saddr = inet6_rsk(req)->loc_addr.s6_addr32;
686			entry->daddr = inet6_rsk(req)->rmt_addr.s6_addr32;
687		} else if (req->rsk_ops->family == AF_INET) {
688			ipv6_addr_set_v4mapped(ireq->loc_addr,
689					       &entry->saddr_storage);
690			ipv6_addr_set_v4mapped(ireq->rmt_addr,
691					       &entry->daddr_storage);
692			entry->saddr = entry->saddr_storage.s6_addr32;
693			entry->daddr = entry->daddr_storage.s6_addr32;
694		}
695	} else
696#endif
697	{
698		entry->saddr = &ireq->loc_addr;
699		entry->daddr = &ireq->rmt_addr;
700	}
701}
702
703static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
704			      struct request_sock *req,
705			      struct user_namespace *user_ns,
706			      u32 portid, u32 seq,
707			      const struct nlmsghdr *unlh)
708{
709	const struct inet_request_sock *ireq = inet_rsk(req);
710	struct inet_sock *inet = inet_sk(sk);
711	struct inet_diag_msg *r;
712	struct nlmsghdr *nlh;
713	long tmo;
714
715	nlh = nlmsg_put(skb, portid, seq, unlh->nlmsg_type, sizeof(*r),
716			NLM_F_MULTI);
717	if (!nlh)
718		return -EMSGSIZE;
719
720	r = nlmsg_data(nlh);
721	r->idiag_family = sk->sk_family;
722	r->idiag_state = TCP_SYN_RECV;
723	r->idiag_timer = 1;
724	r->idiag_retrans = req->num_retrans;
725
726	r->id.idiag_if = sk->sk_bound_dev_if;
727	sock_diag_save_cookie(req, r->id.idiag_cookie);
728
729	tmo = req->expires - jiffies;
730	if (tmo < 0)
731		tmo = 0;
732
733	r->id.idiag_sport = inet->inet_sport;
734	r->id.idiag_dport = ireq->rmt_port;
735	r->id.idiag_src[0] = ireq->loc_addr;
736	r->id.idiag_dst[0] = ireq->rmt_addr;
737	r->idiag_expires = jiffies_to_msecs(tmo);
738	r->idiag_rqueue = 0;
739	r->idiag_wqueue = 0;
740	r->idiag_uid = from_kuid_munged(user_ns, sock_i_uid(sk));
741	r->idiag_inode = 0;
742#if IS_ENABLED(CONFIG_IPV6)
743	if (r->idiag_family == AF_INET6) {
744		struct inet_diag_entry entry;
745		inet_diag_req_addrs(sk, req, &entry);
746		memcpy(r->id.idiag_src, entry.saddr, sizeof(struct in6_addr));
747		memcpy(r->id.idiag_dst, entry.daddr, sizeof(struct in6_addr));
748	}
749#endif
750
751	return nlmsg_end(skb, nlh);
752}
753
754static int inet_diag_dump_reqs(struct sk_buff *skb, struct sock *sk,
755			       struct netlink_callback *cb,
756			       struct inet_diag_req_v2 *r,
757			       const struct nlattr *bc)
758{
759	struct inet_diag_entry entry;
760	struct inet_connection_sock *icsk = inet_csk(sk);
761	struct listen_sock *lopt;
762	struct inet_sock *inet = inet_sk(sk);
763	int j, s_j;
764	int reqnum, s_reqnum;
765	int err = 0;
766
767	s_j = cb->args[3];
768	s_reqnum = cb->args[4];
769
770	if (s_j > 0)
771		s_j--;
772
773	entry.family = sk->sk_family;
774
775	read_lock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
776
777	lopt = icsk->icsk_accept_queue.listen_opt;
778	if (!lopt || !lopt->qlen)
779		goto out;
780
781	if (bc != NULL) {
782		entry.sport = inet->inet_num;
783		entry.userlocks = sk->sk_userlocks;
784	}
785
786	for (j = s_j; j < lopt->nr_table_entries; j++) {
787		struct request_sock *req, *head = lopt->syn_table[j];
788
789		reqnum = 0;
790		for (req = head; req; reqnum++, req = req->dl_next) {
791			struct inet_request_sock *ireq = inet_rsk(req);
792
793			if (reqnum < s_reqnum)
794				continue;
795			if (r->id.idiag_dport != ireq->rmt_port &&
796			    r->id.idiag_dport)
797				continue;
798
799			if (bc) {
800				inet_diag_req_addrs(sk, req, &entry);
801				entry.dport = ntohs(ireq->rmt_port);
802
803				if (!inet_diag_bc_run(bc, &entry))
804					continue;
805			}
806
807			err = inet_diag_fill_req(skb, sk, req,
808					       sk_user_ns(NETLINK_CB(cb->skb).sk),
809					       NETLINK_CB(cb->skb).portid,
810					       cb->nlh->nlmsg_seq, cb->nlh);
811			if (err < 0) {
812				cb->args[3] = j + 1;
813				cb->args[4] = reqnum;
814				goto out;
815			}
816		}
817
818		s_reqnum = 0;
819	}
820
821out:
822	read_unlock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
823
824	return err;
825}
826
827void inet_diag_dump_icsk(struct inet_hashinfo *hashinfo, struct sk_buff *skb,
828		struct netlink_callback *cb, struct inet_diag_req_v2 *r, struct nlattr *bc)
829{
830	int i, num;
831	int s_i, s_num;
832	struct net *net = sock_net(skb->sk);
833
834	s_i = cb->args[1];
835	s_num = num = cb->args[2];
836
837	if (cb->args[0] == 0) {
838		if (!(r->idiag_states & (TCPF_LISTEN | TCPF_SYN_RECV)))
839			goto skip_listen_ht;
840
841		for (i = s_i; i < INET_LHTABLE_SIZE; i++) {
842			struct sock *sk;
843			struct hlist_nulls_node *node;
844			struct inet_listen_hashbucket *ilb;
845
846			num = 0;
847			ilb = &hashinfo->listening_hash[i];
848			spin_lock_bh(&ilb->lock);
849			sk_nulls_for_each(sk, node, &ilb->head) {
850				struct inet_sock *inet = inet_sk(sk);
851
852				if (!net_eq(sock_net(sk), net))
853					continue;
854
855				if (num < s_num) {
856					num++;
857					continue;
858				}
859
860				if (r->sdiag_family != AF_UNSPEC &&
861						sk->sk_family != r->sdiag_family)
862					goto next_listen;
863
864				if (r->id.idiag_sport != inet->inet_sport &&
865				    r->id.idiag_sport)
866					goto next_listen;
867
868				if (!(r->idiag_states & TCPF_LISTEN) ||
869				    r->id.idiag_dport ||
870				    cb->args[3] > 0)
871					goto syn_recv;
872
873				if (inet_csk_diag_dump(sk, skb, cb, r, bc) < 0) {
874					spin_unlock_bh(&ilb->lock);
875					goto done;
876				}
877
878syn_recv:
879				if (!(r->idiag_states & TCPF_SYN_RECV))
880					goto next_listen;
881
882				if (inet_diag_dump_reqs(skb, sk, cb, r, bc) < 0) {
883					spin_unlock_bh(&ilb->lock);
884					goto done;
885				}
886
887next_listen:
888				cb->args[3] = 0;
889				cb->args[4] = 0;
890				++num;
891			}
892			spin_unlock_bh(&ilb->lock);
893
894			s_num = 0;
895			cb->args[3] = 0;
896			cb->args[4] = 0;
897		}
898skip_listen_ht:
899		cb->args[0] = 1;
900		s_i = num = s_num = 0;
901	}
902
903	if (!(r->idiag_states & ~(TCPF_LISTEN | TCPF_SYN_RECV)))
904		goto out;
905
906	for (i = s_i; i <= hashinfo->ehash_mask; i++) {
907		struct inet_ehash_bucket *head = &hashinfo->ehash[i];
908		spinlock_t *lock = inet_ehash_lockp(hashinfo, i);
909		struct sock *sk;
910		struct hlist_nulls_node *node;
911
912		num = 0;
913
914		if (hlist_nulls_empty(&head->chain) &&
915			hlist_nulls_empty(&head->twchain))
916			continue;
917
918		if (i > s_i)
919			s_num = 0;
920
921		spin_lock_bh(lock);
922		sk_nulls_for_each(sk, node, &head->chain) {
923			struct inet_sock *inet = inet_sk(sk);
924
925			if (!net_eq(sock_net(sk), net))
926				continue;
927			if (num < s_num)
928				goto next_normal;
929			if (!(r->idiag_states & (1 << sk->sk_state)))
930				goto next_normal;
931			if (r->sdiag_family != AF_UNSPEC &&
932					sk->sk_family != r->sdiag_family)
933				goto next_normal;
934			if (r->id.idiag_sport != inet->inet_sport &&
935			    r->id.idiag_sport)
936				goto next_normal;
937			if (r->id.idiag_dport != inet->inet_dport &&
938			    r->id.idiag_dport)
939				goto next_normal;
940			if (inet_csk_diag_dump(sk, skb, cb, r, bc) < 0) {
941				spin_unlock_bh(lock);
942				goto done;
943			}
944next_normal:
945			++num;
946		}
947
948		if (r->idiag_states & TCPF_TIME_WAIT) {
949			struct inet_timewait_sock *tw;
950
951			inet_twsk_for_each(tw, node,
952				    &head->twchain) {
953				if (!net_eq(twsk_net(tw), net))
954					continue;
955
956				if (num < s_num)
957					goto next_dying;
958				if (r->sdiag_family != AF_UNSPEC &&
959						tw->tw_family != r->sdiag_family)
960					goto next_dying;
961				if (r->id.idiag_sport != tw->tw_sport &&
962				    r->id.idiag_sport)
963					goto next_dying;
964				if (r->id.idiag_dport != tw->tw_dport &&
965				    r->id.idiag_dport)
966					goto next_dying;
967				if (inet_twsk_diag_dump(tw, skb, cb, r, bc) < 0) {
968					spin_unlock_bh(lock);
969					goto done;
970				}
971next_dying:
972				++num;
973			}
974		}
975		spin_unlock_bh(lock);
976	}
977
978done:
979	cb->args[1] = i;
980	cb->args[2] = num;
981out:
982	;
983}
984EXPORT_SYMBOL_GPL(inet_diag_dump_icsk);
985
986static int __inet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
987		struct inet_diag_req_v2 *r, struct nlattr *bc)
988{
989	const struct inet_diag_handler *handler;
990	int err = 0;
991
992	handler = inet_diag_lock_handler(r->sdiag_protocol);
993	if (!IS_ERR(handler))
994		handler->dump(skb, cb, r, bc);
995	else
996		err = PTR_ERR(handler);
997	inet_diag_unlock_handler(handler);
998
999	return err ? : skb->len;
1000}
1001
1002static int inet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
1003{
1004	struct nlattr *bc = NULL;
1005	int hdrlen = sizeof(struct inet_diag_req_v2);
1006
1007	if (nlmsg_attrlen(cb->nlh, hdrlen))
1008		bc = nlmsg_find_attr(cb->nlh, hdrlen, INET_DIAG_REQ_BYTECODE);
1009
1010	return __inet_diag_dump(skb, cb, nlmsg_data(cb->nlh), bc);
1011}
1012
1013static inline int inet_diag_type2proto(int type)
1014{
1015	switch (type) {
1016	case TCPDIAG_GETSOCK:
1017		return IPPROTO_TCP;
1018	case DCCPDIAG_GETSOCK:
1019		return IPPROTO_DCCP;
1020	default:
1021		return 0;
1022	}
1023}
1024
1025static int inet_diag_dump_compat(struct sk_buff *skb, struct netlink_callback *cb)
1026{
1027	struct inet_diag_req *rc = nlmsg_data(cb->nlh);
1028	struct inet_diag_req_v2 req;
1029	struct nlattr *bc = NULL;
1030	int hdrlen = sizeof(struct inet_diag_req);
1031
1032	req.sdiag_family = AF_UNSPEC; /* compatibility */
1033	req.sdiag_protocol = inet_diag_type2proto(cb->nlh->nlmsg_type);
1034	req.idiag_ext = rc->idiag_ext;
1035	req.idiag_states = rc->idiag_states;
1036	req.id = rc->id;
1037
1038	if (nlmsg_attrlen(cb->nlh, hdrlen))
1039		bc = nlmsg_find_attr(cb->nlh, hdrlen, INET_DIAG_REQ_BYTECODE);
1040
1041	return __inet_diag_dump(skb, cb, &req, bc);
1042}
1043
1044static int inet_diag_get_exact_compat(struct sk_buff *in_skb,
1045			       const struct nlmsghdr *nlh)
1046{
1047	struct inet_diag_req *rc = nlmsg_data(nlh);
1048	struct inet_diag_req_v2 req;
1049
1050	req.sdiag_family = rc->idiag_family;
1051	req.sdiag_protocol = inet_diag_type2proto(nlh->nlmsg_type);
1052	req.idiag_ext = rc->idiag_ext;
1053	req.idiag_states = rc->idiag_states;
1054	req.id = rc->id;
1055
1056	return inet_diag_get_exact(in_skb, nlh, &req);
1057}
1058
1059static int inet_diag_rcv_msg_compat(struct sk_buff *skb, struct nlmsghdr *nlh)
1060{
1061	int hdrlen = sizeof(struct inet_diag_req);
1062	struct net *net = sock_net(skb->sk);
1063
1064	if (nlh->nlmsg_type >= INET_DIAG_GETSOCK_MAX ||
1065	    nlmsg_len(nlh) < hdrlen)
1066		return -EINVAL;
1067
1068	if (nlh->nlmsg_flags & NLM_F_DUMP) {
1069		if (nlmsg_attrlen(nlh, hdrlen)) {
1070			struct nlattr *attr;
1071
1072			attr = nlmsg_find_attr(nlh, hdrlen,
1073					       INET_DIAG_REQ_BYTECODE);
1074			if (attr == NULL ||
1075			    nla_len(attr) < sizeof(struct inet_diag_bc_op) ||
1076			    inet_diag_bc_audit(nla_data(attr), nla_len(attr)))
1077				return -EINVAL;
1078		}
1079		{
1080			struct netlink_dump_control c = {
1081				.dump = inet_diag_dump_compat,
1082			};
1083			return netlink_dump_start(net->diag_nlsk, skb, nlh, &c);
1084		}
1085	}
1086
1087	return inet_diag_get_exact_compat(skb, nlh);
1088}
1089
1090static int inet_diag_handler_dump(struct sk_buff *skb, struct nlmsghdr *h)
1091{
1092	int hdrlen = sizeof(struct inet_diag_req_v2);
1093	struct net *net = sock_net(skb->sk);
1094
1095	if (nlmsg_len(h) < hdrlen)
1096		return -EINVAL;
1097
1098	if (h->nlmsg_flags & NLM_F_DUMP) {
1099		if (nlmsg_attrlen(h, hdrlen)) {
1100			struct nlattr *attr;
1101			attr = nlmsg_find_attr(h, hdrlen,
1102					       INET_DIAG_REQ_BYTECODE);
1103			if (attr == NULL ||
1104			    nla_len(attr) < sizeof(struct inet_diag_bc_op) ||
1105			    inet_diag_bc_audit(nla_data(attr), nla_len(attr)))
1106				return -EINVAL;
1107		}
1108		{
1109			struct netlink_dump_control c = {
1110				.dump = inet_diag_dump,
1111			};
1112			return netlink_dump_start(net->diag_nlsk, skb, h, &c);
1113		}
1114	}
1115
1116	return inet_diag_get_exact(skb, h, nlmsg_data(h));
1117}
1118
1119static const struct sock_diag_handler inet_diag_handler = {
1120	.family = AF_INET,
1121	.dump = inet_diag_handler_dump,
1122};
1123
1124static const struct sock_diag_handler inet6_diag_handler = {
1125	.family = AF_INET6,
1126	.dump = inet_diag_handler_dump,
1127};
1128
1129int inet_diag_register(const struct inet_diag_handler *h)
1130{
1131	const __u16 type = h->idiag_type;
1132	int err = -EINVAL;
1133
1134	if (type >= IPPROTO_MAX)
1135		goto out;
1136
1137	mutex_lock(&inet_diag_table_mutex);
1138	err = -EEXIST;
1139	if (inet_diag_table[type] == NULL) {
1140		inet_diag_table[type] = h;
1141		err = 0;
1142	}
1143	mutex_unlock(&inet_diag_table_mutex);
1144out:
1145	return err;
1146}
1147EXPORT_SYMBOL_GPL(inet_diag_register);
1148
1149void inet_diag_unregister(const struct inet_diag_handler *h)
1150{
1151	const __u16 type = h->idiag_type;
1152
1153	if (type >= IPPROTO_MAX)
1154		return;
1155
1156	mutex_lock(&inet_diag_table_mutex);
1157	inet_diag_table[type] = NULL;
1158	mutex_unlock(&inet_diag_table_mutex);
1159}
1160EXPORT_SYMBOL_GPL(inet_diag_unregister);
1161
1162static int __init inet_diag_init(void)
1163{
1164	const int inet_diag_table_size = (IPPROTO_MAX *
1165					  sizeof(struct inet_diag_handler *));
1166	int err = -ENOMEM;
1167
1168	inet_diag_table = kzalloc(inet_diag_table_size, GFP_KERNEL);
1169	if (!inet_diag_table)
1170		goto out;
1171
1172	err = sock_diag_register(&inet_diag_handler);
1173	if (err)
1174		goto out_free_nl;
1175
1176	err = sock_diag_register(&inet6_diag_handler);
1177	if (err)
1178		goto out_free_inet;
1179
1180	sock_diag_register_inet_compat(inet_diag_rcv_msg_compat);
1181out:
1182	return err;
1183
1184out_free_inet:
1185	sock_diag_unregister(&inet_diag_handler);
1186out_free_nl:
1187	kfree(inet_diag_table);
1188	goto out;
1189}
1190
1191static void __exit inet_diag_exit(void)
1192{
1193	sock_diag_unregister(&inet6_diag_handler);
1194	sock_diag_unregister(&inet_diag_handler);
1195	sock_diag_unregister_inet_compat(inet_diag_rcv_msg_compat);
1196	kfree(inet_diag_table);
1197}
1198
1199module_init(inet_diag_init);
1200module_exit(inet_diag_exit);
1201MODULE_LICENSE("GPL");
1202MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_NETLINK, NETLINK_SOCK_DIAG, 2 /* AF_INET */);
1203MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_NETLINK, NETLINK_SOCK_DIAG, 10 /* AF_INET6 */);
1204