1/* netfilter.c: look after the filters for various protocols.
2 * Heavily influenced by the old firewall.c by David Bonn and Alan Cox.
3 *
4 * Thanks to Rob `CmdrTaco' Malda for not influencing this code in any
5 * way.
6 *
7 * Rusty Russell (C)2000 -- This code is GPL.
8 * Patrick McHardy (c) 2006-2012
9 */
10#include <linux/kernel.h>
11#include <linux/netfilter.h>
12#include <net/protocol.h>
13#include <linux/init.h>
14#include <linux/skbuff.h>
15#include <linux/wait.h>
16#include <linux/module.h>
17#include <linux/interrupt.h>
18#include <linux/if.h>
19#include <linux/netdevice.h>
20#include <linux/inetdevice.h>
21#include <linux/proc_fs.h>
22#include <linux/mutex.h>
23#include <linux/slab.h>
24#include <net/net_namespace.h>
25#include <net/sock.h>
26
27#include "nf_internals.h"
28
29static DEFINE_MUTEX(afinfo_mutex);
30
31const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO] __read_mostly;
32EXPORT_SYMBOL(nf_afinfo);
33const struct nf_ipv6_ops __rcu *nf_ipv6_ops __read_mostly;
34EXPORT_SYMBOL_GPL(nf_ipv6_ops);
35
36int nf_register_afinfo(const struct nf_afinfo *afinfo)
37{
38	mutex_lock(&afinfo_mutex);
39	RCU_INIT_POINTER(nf_afinfo[afinfo->family], afinfo);
40	mutex_unlock(&afinfo_mutex);
41	return 0;
42}
43EXPORT_SYMBOL_GPL(nf_register_afinfo);
44
45void nf_unregister_afinfo(const struct nf_afinfo *afinfo)
46{
47	mutex_lock(&afinfo_mutex);
48	RCU_INIT_POINTER(nf_afinfo[afinfo->family], NULL);
49	mutex_unlock(&afinfo_mutex);
50	synchronize_rcu();
51}
52EXPORT_SYMBOL_GPL(nf_unregister_afinfo);
53
54struct list_head nf_hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS] __read_mostly;
55EXPORT_SYMBOL(nf_hooks);
56
57#ifdef HAVE_JUMP_LABEL
58struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
59EXPORT_SYMBOL(nf_hooks_needed);
60#endif
61
62static DEFINE_MUTEX(nf_hook_mutex);
63
64int nf_register_hook(struct nf_hook_ops *reg)
65{
66	struct nf_hook_ops *elem;
67
68	mutex_lock(&nf_hook_mutex);
69	list_for_each_entry(elem, &nf_hooks[reg->pf][reg->hooknum], list) {
70		if (reg->priority < elem->priority)
71			break;
72	}
73	list_add_rcu(&reg->list, elem->list.prev);
74	mutex_unlock(&nf_hook_mutex);
75#ifdef HAVE_JUMP_LABEL
76	static_key_slow_inc(&nf_hooks_needed[reg->pf][reg->hooknum]);
77#endif
78	return 0;
79}
80EXPORT_SYMBOL(nf_register_hook);
81
82void nf_unregister_hook(struct nf_hook_ops *reg)
83{
84	mutex_lock(&nf_hook_mutex);
85	list_del_rcu(&reg->list);
86	mutex_unlock(&nf_hook_mutex);
87#ifdef HAVE_JUMP_LABEL
88	static_key_slow_dec(&nf_hooks_needed[reg->pf][reg->hooknum]);
89#endif
90	synchronize_net();
91}
92EXPORT_SYMBOL(nf_unregister_hook);
93
94int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n)
95{
96	unsigned int i;
97	int err = 0;
98
99	for (i = 0; i < n; i++) {
100		err = nf_register_hook(&reg[i]);
101		if (err)
102			goto err;
103	}
104	return err;
105
106err:
107	if (i > 0)
108		nf_unregister_hooks(reg, i);
109	return err;
110}
111EXPORT_SYMBOL(nf_register_hooks);
112
113void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n)
114{
115	while (n-- > 0)
116		nf_unregister_hook(&reg[n]);
117}
118EXPORT_SYMBOL(nf_unregister_hooks);
119
120unsigned int nf_iterate(struct list_head *head,
121			struct sk_buff *skb,
122			unsigned int hook,
123			const struct net_device *indev,
124			const struct net_device *outdev,
125			struct nf_hook_ops **elemp,
126			int (*okfn)(struct sk_buff *),
127			int hook_thresh)
128{
129	unsigned int verdict;
130
131	/*
132	 * The caller must not block between calls to this
133	 * function because of risk of continuing from deleted element.
134	 */
135	list_for_each_entry_continue_rcu((*elemp), head, list) {
136		if (hook_thresh > (*elemp)->priority)
137			continue;
138
139		/* Optimization: we don't need to hold module
140		   reference here, since function can't sleep. --RR */
141repeat:
142		verdict = (*elemp)->hook(*elemp, skb, indev, outdev, okfn);
143		if (verdict != NF_ACCEPT) {
144#ifdef CONFIG_NETFILTER_DEBUG
145			if (unlikely((verdict & NF_VERDICT_MASK)
146							> NF_MAX_VERDICT)) {
147				NFDEBUG("Evil return from %p(%u).\n",
148					(*elemp)->hook, hook);
149				continue;
150			}
151#endif
152			if (verdict != NF_REPEAT)
153				return verdict;
154			goto repeat;
155		}
156	}
157	return NF_ACCEPT;
158}
159
160
161/* Returns 1 if okfn() needs to be executed by the caller,
162 * -EPERM for NF_DROP, 0 otherwise. */
163int nf_hook_slow(u_int8_t pf, unsigned int hook, struct sk_buff *skb,
164		 struct net_device *indev,
165		 struct net_device *outdev,
166		 int (*okfn)(struct sk_buff *),
167		 int hook_thresh)
168{
169	struct nf_hook_ops *elem;
170	unsigned int verdict;
171	int ret = 0;
172
173	/* We may already have this, but read-locks nest anyway */
174	rcu_read_lock();
175
176	elem = list_entry_rcu(&nf_hooks[pf][hook], struct nf_hook_ops, list);
177next_hook:
178	verdict = nf_iterate(&nf_hooks[pf][hook], skb, hook, indev,
179			     outdev, &elem, okfn, hook_thresh);
180	if (verdict == NF_ACCEPT || verdict == NF_STOP) {
181		ret = 1;
182	} else if ((verdict & NF_VERDICT_MASK) == NF_DROP) {
183		kfree_skb(skb);
184		ret = NF_DROP_GETERR(verdict);
185		if (ret == 0)
186			ret = -EPERM;
187	} else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) {
188		int err = nf_queue(skb, elem, pf, hook, indev, outdev, okfn,
189						verdict >> NF_VERDICT_QBITS);
190		if (err < 0) {
191			if (err == -ECANCELED)
192				goto next_hook;
193			if (err == -ESRCH &&
194			   (verdict & NF_VERDICT_FLAG_QUEUE_BYPASS))
195				goto next_hook;
196			kfree_skb(skb);
197		}
198	}
199	rcu_read_unlock();
200	return ret;
201}
202EXPORT_SYMBOL(nf_hook_slow);
203
204
205int skb_make_writable(struct sk_buff *skb, unsigned int writable_len)
206{
207	if (writable_len > skb->len)
208		return 0;
209
210	/* Not exclusive use of packet?  Must copy. */
211	if (!skb_cloned(skb)) {
212		if (writable_len <= skb_headlen(skb))
213			return 1;
214	} else if (skb_clone_writable(skb, writable_len))
215		return 1;
216
217	if (writable_len <= skb_headlen(skb))
218		writable_len = 0;
219	else
220		writable_len -= skb_headlen(skb);
221
222	return !!__pskb_pull_tail(skb, writable_len);
223}
224EXPORT_SYMBOL(skb_make_writable);
225
226#if IS_ENABLED(CONFIG_NF_CONNTRACK)
227/* This does not belong here, but locally generated errors need it if connection
228   tracking in use: without this, connection may not be in hash table, and hence
229   manufactured ICMP or RST packets will not be associated with it. */
230void (*ip_ct_attach)(struct sk_buff *, const struct sk_buff *)
231		__rcu __read_mostly;
232EXPORT_SYMBOL(ip_ct_attach);
233
234void nf_ct_attach(struct sk_buff *new, const struct sk_buff *skb)
235{
236	void (*attach)(struct sk_buff *, const struct sk_buff *);
237
238	if (skb->nfct) {
239		rcu_read_lock();
240		attach = rcu_dereference(ip_ct_attach);
241		if (attach)
242			attach(new, skb);
243		rcu_read_unlock();
244	}
245}
246EXPORT_SYMBOL(nf_ct_attach);
247
248void (*nf_ct_destroy)(struct nf_conntrack *) __rcu __read_mostly;
249EXPORT_SYMBOL(nf_ct_destroy);
250
251void nf_conntrack_destroy(struct nf_conntrack *nfct)
252{
253	void (*destroy)(struct nf_conntrack *);
254
255	rcu_read_lock();
256	destroy = rcu_dereference(nf_ct_destroy);
257	BUG_ON(destroy == NULL);
258	destroy(nfct);
259	rcu_read_unlock();
260}
261EXPORT_SYMBOL(nf_conntrack_destroy);
262
263struct nfq_ct_hook __rcu *nfq_ct_hook __read_mostly;
264EXPORT_SYMBOL_GPL(nfq_ct_hook);
265
266struct nfq_ct_nat_hook __rcu *nfq_ct_nat_hook __read_mostly;
267EXPORT_SYMBOL_GPL(nfq_ct_nat_hook);
268
269#endif /* CONFIG_NF_CONNTRACK */
270
271#ifdef CONFIG_NF_NAT_NEEDED
272void (*nf_nat_decode_session_hook)(struct sk_buff *, struct flowi *);
273EXPORT_SYMBOL(nf_nat_decode_session_hook);
274#endif
275
276static int __net_init netfilter_net_init(struct net *net)
277{
278#ifdef CONFIG_PROC_FS
279	net->nf.proc_netfilter = proc_net_mkdir(net, "netfilter",
280						net->proc_net);
281	if (!net->nf.proc_netfilter) {
282		if (!net_eq(net, &init_net))
283			pr_err("cannot create netfilter proc entry");
284
285		return -ENOMEM;
286	}
287#endif
288	return 0;
289}
290
291static void __net_exit netfilter_net_exit(struct net *net)
292{
293	remove_proc_entry("netfilter", net->proc_net);
294}
295
296static struct pernet_operations netfilter_net_ops = {
297	.init = netfilter_net_init,
298	.exit = netfilter_net_exit,
299};
300
301int __init netfilter_init(void)
302{
303	int i, h, ret;
304
305	for (i = 0; i < ARRAY_SIZE(nf_hooks); i++) {
306		for (h = 0; h < NF_MAX_HOOKS; h++)
307			INIT_LIST_HEAD(&nf_hooks[i][h]);
308	}
309
310	ret = register_pernet_subsys(&netfilter_net_ops);
311	if (ret < 0)
312		goto err;
313
314	ret = netfilter_log_init();
315	if (ret < 0)
316		goto err_pernet;
317
318	return 0;
319err_pernet:
320	unregister_pernet_subsys(&netfilter_net_ops);
321err:
322	return ret;
323}
324