aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--net/core/Makefile1
-rw-r--r--net/core/netfilter.c737
-rw-r--r--net/netfilter/Makefile4
-rw-r--r--net/netfilter/core.c216
-rw-r--r--net/netfilter/nf_internals.h39
-rw-r--r--net/netfilter/nf_log.c165
-rw-r--r--net/netfilter/nf_queue.c273
-rw-r--r--net/netfilter/nf_sockopt.c132
8 files changed, 829 insertions, 738 deletions
diff --git a/net/core/Makefile b/net/core/Makefile
index f5f5e58943e8..630da0f0579e 100644
--- a/net/core/Makefile
+++ b/net/core/Makefile
@@ -12,7 +12,6 @@ obj-y += dev.o ethtool.o dev_mcast.o dst.o \
12 12
13obj-$(CONFIG_XFRM) += flow.o 13obj-$(CONFIG_XFRM) += flow.o
14obj-$(CONFIG_SYSFS) += net-sysfs.o 14obj-$(CONFIG_SYSFS) += net-sysfs.o
15obj-$(CONFIG_NETFILTER) += netfilter.o
16obj-$(CONFIG_NET_DIVERT) += dv.o 15obj-$(CONFIG_NET_DIVERT) += dv.o
17obj-$(CONFIG_NET_PKTGEN) += pktgen.o 16obj-$(CONFIG_NET_PKTGEN) += pktgen.o
18obj-$(CONFIG_NET_RADIO) += wireless.o 17obj-$(CONFIG_NET_RADIO) += wireless.o
diff --git a/net/core/netfilter.c b/net/core/netfilter.c
deleted file mode 100644
index 98cc61e79fea..000000000000
--- a/net/core/netfilter.c
+++ /dev/null
@@ -1,737 +0,0 @@
1/* netfilter.c: look after the filters for various protocols.
2 * Heavily influenced by the old firewall.c by David Bonn and Alan Cox.
3 *
4 * Thanks to Rob `CmdrTaco' Malda for not influencing this code in any
5 * way.
6 *
7 * Rusty Russell (C)2000 -- This code is GPL.
8 *
9 * February 2000: Modified by James Morris to have 1 queue per protocol.
10 * 15-Mar-2000: Added NF_REPEAT --RR.
11 * 08-May-2003: Internal logging interface added by Jozsef Kadlecsik.
12 */
13#include <linux/config.h>
14#include <linux/kernel.h>
15#include <linux/netfilter.h>
16#include <net/protocol.h>
17#include <linux/init.h>
18#include <linux/skbuff.h>
19#include <linux/wait.h>
20#include <linux/module.h>
21#include <linux/interrupt.h>
22#include <linux/if.h>
23#include <linux/netdevice.h>
24#include <linux/inetdevice.h>
25#include <linux/proc_fs.h>
26#include <net/sock.h>
27
28/* In this code, we can be waiting indefinitely for userspace to
29 * service a packet if a hook returns NF_QUEUE. We could keep a count
30 * of skbuffs queued for userspace, and not deregister a hook unless
31 * this is zero, but that sucks. Now, we simply check when the
32 * packets come back: if the hook is gone, the packet is discarded. */
33#ifdef CONFIG_NETFILTER_DEBUG
34#define NFDEBUG(format, args...) printk(format , ## args)
35#else
36#define NFDEBUG(format, args...)
37#endif
38
39/* Sockopts only registered and called from user context, so
40 net locking would be overkill. Also, [gs]etsockopt calls may
41 sleep. */
42static DECLARE_MUTEX(nf_sockopt_mutex);
43
44struct list_head nf_hooks[NPROTO][NF_MAX_HOOKS];
45static LIST_HEAD(nf_sockopts);
46static DEFINE_SPINLOCK(nf_hook_lock);
47
48/*
49 * A queue handler may be registered for each protocol. Each is protected by
50 * long term mutex. The handler must provide an an outfn() to accept packets
51 * for queueing and must reinject all packets it receives, no matter what.
52 */
53static struct nf_queue_handler_t {
54 nf_queue_outfn_t outfn;
55 void *data;
56} queue_handler[NPROTO];
57
58static struct nf_queue_rerouter *queue_rerouter;
59
60static DEFINE_RWLOCK(queue_handler_lock);
61
62int nf_register_hook(struct nf_hook_ops *reg)
63{
64 struct list_head *i;
65
66 spin_lock_bh(&nf_hook_lock);
67 list_for_each(i, &nf_hooks[reg->pf][reg->hooknum]) {
68 if (reg->priority < ((struct nf_hook_ops *)i)->priority)
69 break;
70 }
71 list_add_rcu(&reg->list, i->prev);
72 spin_unlock_bh(&nf_hook_lock);
73
74 synchronize_net();
75 return 0;
76}
77
78void nf_unregister_hook(struct nf_hook_ops *reg)
79{
80 spin_lock_bh(&nf_hook_lock);
81 list_del_rcu(&reg->list);
82 spin_unlock_bh(&nf_hook_lock);
83
84 synchronize_net();
85}
86
87/* Do exclusive ranges overlap? */
88static inline int overlap(int min1, int max1, int min2, int max2)
89{
90 return max1 > min2 && min1 < max2;
91}
92
93/* Functions to register sockopt ranges (exclusive). */
94int nf_register_sockopt(struct nf_sockopt_ops *reg)
95{
96 struct list_head *i;
97 int ret = 0;
98
99 if (down_interruptible(&nf_sockopt_mutex) != 0)
100 return -EINTR;
101
102 list_for_each(i, &nf_sockopts) {
103 struct nf_sockopt_ops *ops = (struct nf_sockopt_ops *)i;
104 if (ops->pf == reg->pf
105 && (overlap(ops->set_optmin, ops->set_optmax,
106 reg->set_optmin, reg->set_optmax)
107 || overlap(ops->get_optmin, ops->get_optmax,
108 reg->get_optmin, reg->get_optmax))) {
109 NFDEBUG("nf_sock overlap: %u-%u/%u-%u v %u-%u/%u-%u\n",
110 ops->set_optmin, ops->set_optmax,
111 ops->get_optmin, ops->get_optmax,
112 reg->set_optmin, reg->set_optmax,
113 reg->get_optmin, reg->get_optmax);
114 ret = -EBUSY;
115 goto out;
116 }
117 }
118
119 list_add(&reg->list, &nf_sockopts);
120out:
121 up(&nf_sockopt_mutex);
122 return ret;
123}
124
125void nf_unregister_sockopt(struct nf_sockopt_ops *reg)
126{
127 /* No point being interruptible: we're probably in cleanup_module() */
128 restart:
129 down(&nf_sockopt_mutex);
130 if (reg->use != 0) {
131 /* To be woken by nf_sockopt call... */
132 /* FIXME: Stuart Young's name appears gratuitously. */
133 set_current_state(TASK_UNINTERRUPTIBLE);
134 reg->cleanup_task = current;
135 up(&nf_sockopt_mutex);
136 schedule();
137 goto restart;
138 }
139 list_del(&reg->list);
140 up(&nf_sockopt_mutex);
141}
142
143/* Call get/setsockopt() */
144static int nf_sockopt(struct sock *sk, int pf, int val,
145 char __user *opt, int *len, int get)
146{
147 struct list_head *i;
148 struct nf_sockopt_ops *ops;
149 int ret;
150
151 if (down_interruptible(&nf_sockopt_mutex) != 0)
152 return -EINTR;
153
154 list_for_each(i, &nf_sockopts) {
155 ops = (struct nf_sockopt_ops *)i;
156 if (ops->pf == pf) {
157 if (get) {
158 if (val >= ops->get_optmin
159 && val < ops->get_optmax) {
160 ops->use++;
161 up(&nf_sockopt_mutex);
162 ret = ops->get(sk, val, opt, len);
163 goto out;
164 }
165 } else {
166 if (val >= ops->set_optmin
167 && val < ops->set_optmax) {
168 ops->use++;
169 up(&nf_sockopt_mutex);
170 ret = ops->set(sk, val, opt, *len);
171 goto out;
172 }
173 }
174 }
175 }
176 up(&nf_sockopt_mutex);
177 return -ENOPROTOOPT;
178
179 out:
180 down(&nf_sockopt_mutex);
181 ops->use--;
182 if (ops->cleanup_task)
183 wake_up_process(ops->cleanup_task);
184 up(&nf_sockopt_mutex);
185 return ret;
186}
187
188int nf_setsockopt(struct sock *sk, int pf, int val, char __user *opt,
189 int len)
190{
191 return nf_sockopt(sk, pf, val, opt, &len, 0);
192}
193
194int nf_getsockopt(struct sock *sk, int pf, int val, char __user *opt, int *len)
195{
196 return nf_sockopt(sk, pf, val, opt, len, 1);
197}
198
199static unsigned int nf_iterate(struct list_head *head,
200 struct sk_buff **skb,
201 int hook,
202 const struct net_device *indev,
203 const struct net_device *outdev,
204 struct list_head **i,
205 int (*okfn)(struct sk_buff *),
206 int hook_thresh)
207{
208 unsigned int verdict;
209
210 /*
211 * The caller must not block between calls to this
212 * function because of risk of continuing from deleted element.
213 */
214 list_for_each_continue_rcu(*i, head) {
215 struct nf_hook_ops *elem = (struct nf_hook_ops *)*i;
216
217 if (hook_thresh > elem->priority)
218 continue;
219
220 /* Optimization: we don't need to hold module
221 reference here, since function can't sleep. --RR */
222 verdict = elem->hook(hook, skb, indev, outdev, okfn);
223 if (verdict != NF_ACCEPT) {
224#ifdef CONFIG_NETFILTER_DEBUG
225 if (unlikely((verdict & NF_VERDICT_MASK)
226 > NF_MAX_VERDICT)) {
227 NFDEBUG("Evil return from %p(%u).\n",
228 elem->hook, hook);
229 continue;
230 }
231#endif
232 if (verdict != NF_REPEAT)
233 return verdict;
234 *i = (*i)->prev;
235 }
236 }
237 return NF_ACCEPT;
238}
239
240int nf_register_queue_handler(int pf, nf_queue_outfn_t outfn, void *data)
241{
242 int ret;
243
244 if (pf >= NPROTO)
245 return -EINVAL;
246
247 write_lock_bh(&queue_handler_lock);
248 if (queue_handler[pf].outfn)
249 ret = -EBUSY;
250 else {
251 queue_handler[pf].outfn = outfn;
252 queue_handler[pf].data = data;
253 ret = 0;
254 }
255 write_unlock_bh(&queue_handler_lock);
256
257 return ret;
258}
259
260/* The caller must flush their queue before this */
261int nf_unregister_queue_handler(int pf)
262{
263 if (pf >= NPROTO)
264 return -EINVAL;
265
266 write_lock_bh(&queue_handler_lock);
267 queue_handler[pf].outfn = NULL;
268 queue_handler[pf].data = NULL;
269 write_unlock_bh(&queue_handler_lock);
270
271 return 0;
272}
273
274int nf_register_queue_rerouter(int pf, struct nf_queue_rerouter *rer)
275{
276 if (pf >= NPROTO)
277 return -EINVAL;
278
279 write_lock_bh(&queue_handler_lock);
280 memcpy(&queue_rerouter[pf], rer, sizeof(queue_rerouter[pf]));
281 write_unlock_bh(&queue_handler_lock);
282
283 return 0;
284}
285
286int nf_unregister_queue_rerouter(int pf)
287{
288 if (pf >= NPROTO)
289 return -EINVAL;
290
291 write_lock_bh(&queue_handler_lock);
292 memset(&queue_rerouter[pf], 0, sizeof(queue_rerouter[pf]));
293 write_unlock_bh(&queue_handler_lock);
294 return 0;
295}
296
297void nf_unregister_queue_handlers(nf_queue_outfn_t outfn)
298{
299 int pf;
300
301 write_lock_bh(&queue_handler_lock);
302 for (pf = 0; pf < NPROTO; pf++) {
303 if (queue_handler[pf].outfn == outfn) {
304 queue_handler[pf].outfn = NULL;
305 queue_handler[pf].data = NULL;
306 }
307 }
308 write_unlock_bh(&queue_handler_lock);
309}
310
311/*
312 * Any packet that leaves via this function must come back
313 * through nf_reinject().
314 */
315static int nf_queue(struct sk_buff **skb,
316 struct list_head *elem,
317 int pf, unsigned int hook,
318 struct net_device *indev,
319 struct net_device *outdev,
320 int (*okfn)(struct sk_buff *),
321 unsigned int queuenum)
322{
323 int status;
324 struct nf_info *info;
325#ifdef CONFIG_BRIDGE_NETFILTER
326 struct net_device *physindev = NULL;
327 struct net_device *physoutdev = NULL;
328#endif
329
330 /* QUEUE == DROP if noone is waiting, to be safe. */
331 read_lock(&queue_handler_lock);
332 if (!queue_handler[pf].outfn) {
333 read_unlock(&queue_handler_lock);
334 kfree_skb(*skb);
335 return 1;
336 }
337
338 info = kmalloc(sizeof(*info)+queue_rerouter[pf].rer_size, GFP_ATOMIC);
339 if (!info) {
340 if (net_ratelimit())
341 printk(KERN_ERR "OOM queueing packet %p\n",
342 *skb);
343 read_unlock(&queue_handler_lock);
344 kfree_skb(*skb);
345 return 1;
346 }
347
348 *info = (struct nf_info) {
349 (struct nf_hook_ops *)elem, pf, hook, indev, outdev, okfn };
350
351 /* If it's going away, ignore hook. */
352 if (!try_module_get(info->elem->owner)) {
353 read_unlock(&queue_handler_lock);
354 kfree(info);
355 return 0;
356 }
357
358 /* Bump dev refs so they don't vanish while packet is out */
359 if (indev) dev_hold(indev);
360 if (outdev) dev_hold(outdev);
361
362#ifdef CONFIG_BRIDGE_NETFILTER
363 if ((*skb)->nf_bridge) {
364 physindev = (*skb)->nf_bridge->physindev;
365 if (physindev) dev_hold(physindev);
366 physoutdev = (*skb)->nf_bridge->physoutdev;
367 if (physoutdev) dev_hold(physoutdev);
368 }
369#endif
370 if (queue_rerouter[pf].save)
371 queue_rerouter[pf].save(*skb, info);
372
373 status = queue_handler[pf].outfn(*skb, info, queuenum,
374 queue_handler[pf].data);
375
376 if (status >= 0 && queue_rerouter[pf].reroute)
377 status = queue_rerouter[pf].reroute(skb, info);
378
379 read_unlock(&queue_handler_lock);
380
381 if (status < 0) {
382 /* James M doesn't say fuck enough. */
383 if (indev) dev_put(indev);
384 if (outdev) dev_put(outdev);
385#ifdef CONFIG_BRIDGE_NETFILTER
386 if (physindev) dev_put(physindev);
387 if (physoutdev) dev_put(physoutdev);
388#endif
389 module_put(info->elem->owner);
390 kfree(info);
391 kfree_skb(*skb);
392
393 return 1;
394 }
395
396 return 1;
397}
398
399/* Returns 1 if okfn() needs to be executed by the caller,
400 * -EPERM for NF_DROP, 0 otherwise. */
401int nf_hook_slow(int pf, unsigned int hook, struct sk_buff **pskb,
402 struct net_device *indev,
403 struct net_device *outdev,
404 int (*okfn)(struct sk_buff *),
405 int hook_thresh)
406{
407 struct list_head *elem;
408 unsigned int verdict;
409 int ret = 0;
410
411 /* We may already have this, but read-locks nest anyway */
412 rcu_read_lock();
413
414 elem = &nf_hooks[pf][hook];
415next_hook:
416 verdict = nf_iterate(&nf_hooks[pf][hook], pskb, hook, indev,
417 outdev, &elem, okfn, hook_thresh);
418 if (verdict == NF_ACCEPT || verdict == NF_STOP) {
419 ret = 1;
420 goto unlock;
421 } else if (verdict == NF_DROP) {
422 kfree_skb(*pskb);
423 ret = -EPERM;
424 } else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) {
425 NFDEBUG("nf_hook: Verdict = QUEUE.\n");
426 if (!nf_queue(pskb, elem, pf, hook, indev, outdev, okfn,
427 verdict >> NF_VERDICT_BITS))
428 goto next_hook;
429 }
430unlock:
431 rcu_read_unlock();
432 return ret;
433}
434
435void nf_reinject(struct sk_buff *skb, struct nf_info *info,
436 unsigned int verdict)
437{
438 struct list_head *elem = &info->elem->list;
439 struct list_head *i;
440
441 rcu_read_lock();
442
443 /* Release those devices we held, or Alexey will kill me. */
444 if (info->indev) dev_put(info->indev);
445 if (info->outdev) dev_put(info->outdev);
446#ifdef CONFIG_BRIDGE_NETFILTER
447 if (skb->nf_bridge) {
448 if (skb->nf_bridge->physindev)
449 dev_put(skb->nf_bridge->physindev);
450 if (skb->nf_bridge->physoutdev)
451 dev_put(skb->nf_bridge->physoutdev);
452 }
453#endif
454
455 /* Drop reference to owner of hook which queued us. */
456 module_put(info->elem->owner);
457
458 list_for_each_rcu(i, &nf_hooks[info->pf][info->hook]) {
459 if (i == elem)
460 break;
461 }
462
463 if (elem == &nf_hooks[info->pf][info->hook]) {
464 /* The module which sent it to userspace is gone. */
465 NFDEBUG("%s: module disappeared, dropping packet.\n",
466 __FUNCTION__);
467 verdict = NF_DROP;
468 }
469
470 /* Continue traversal iff userspace said ok... */
471 if (verdict == NF_REPEAT) {
472 elem = elem->prev;
473 verdict = NF_ACCEPT;
474 }
475
476 if (verdict == NF_ACCEPT) {
477 next_hook:
478 verdict = nf_iterate(&nf_hooks[info->pf][info->hook],
479 &skb, info->hook,
480 info->indev, info->outdev, &elem,
481 info->okfn, INT_MIN);
482 }
483
484 switch (verdict & NF_VERDICT_MASK) {
485 case NF_ACCEPT:
486 info->okfn(skb);
487 break;
488
489 case NF_QUEUE:
490 if (!nf_queue(&skb, elem, info->pf, info->hook,
491 info->indev, info->outdev, info->okfn,
492 verdict >> NF_VERDICT_BITS))
493 goto next_hook;
494 break;
495 }
496 rcu_read_unlock();
497
498 if (verdict == NF_DROP)
499 kfree_skb(skb);
500
501 kfree(info);
502 return;
503}
504
505int skb_make_writable(struct sk_buff **pskb, unsigned int writable_len)
506{
507 struct sk_buff *nskb;
508
509 if (writable_len > (*pskb)->len)
510 return 0;
511
512 /* Not exclusive use of packet? Must copy. */
513 if (skb_shared(*pskb) || skb_cloned(*pskb))
514 goto copy_skb;
515
516 return pskb_may_pull(*pskb, writable_len);
517
518copy_skb:
519 nskb = skb_copy(*pskb, GFP_ATOMIC);
520 if (!nskb)
521 return 0;
522 BUG_ON(skb_is_nonlinear(nskb));
523
524 /* Rest of kernel will get very unhappy if we pass it a
525 suddenly-orphaned skbuff */
526 if ((*pskb)->sk)
527 skb_set_owner_w(nskb, (*pskb)->sk);
528 kfree_skb(*pskb);
529 *pskb = nskb;
530 return 1;
531}
532EXPORT_SYMBOL(skb_make_writable);
533
534/* Internal logging interface, which relies on the real
535 LOG target modules */
536
537#define NF_LOG_PREFIXLEN 128
538
539static struct nf_logger *nf_logging[NPROTO]; /* = NULL */
540static DEFINE_SPINLOCK(nf_log_lock);
541
542int nf_log_register(int pf, struct nf_logger *logger)
543{
544 int ret = -EBUSY;
545
546 /* Any setup of logging members must be done before
547 * substituting pointer. */
548 spin_lock(&nf_log_lock);
549 if (!nf_logging[pf]) {
550 rcu_assign_pointer(nf_logging[pf], logger);
551 ret = 0;
552 }
553 spin_unlock(&nf_log_lock);
554 return ret;
555}
556
557void nf_log_unregister_pf(int pf)
558{
559 spin_lock(&nf_log_lock);
560 nf_logging[pf] = NULL;
561 spin_unlock(&nf_log_lock);
562
563 /* Give time to concurrent readers. */
564 synchronize_net();
565}
566
567void nf_log_unregister_logger(struct nf_logger *logger)
568{
569 int i;
570
571 spin_lock(&nf_log_lock);
572 for (i = 0; i < NPROTO; i++) {
573 if (nf_logging[i] == logger)
574 nf_logging[i] = NULL;
575 }
576 spin_unlock(&nf_log_lock);
577
578 synchronize_net();
579}
580
581void nf_log_packet(int pf,
582 unsigned int hooknum,
583 const struct sk_buff *skb,
584 const struct net_device *in,
585 const struct net_device *out,
586 struct nf_loginfo *loginfo,
587 const char *fmt, ...)
588{
589 va_list args;
590 char prefix[NF_LOG_PREFIXLEN];
591 struct nf_logger *logger;
592
593 rcu_read_lock();
594 logger = rcu_dereference(nf_logging[pf]);
595 if (logger) {
596 va_start(args, fmt);
597 vsnprintf(prefix, sizeof(prefix), fmt, args);
598 va_end(args);
599 /* We must read logging before nf_logfn[pf] */
600 logger->logfn(pf, hooknum, skb, in, out, loginfo, prefix);
601 } else if (net_ratelimit()) {
602 printk(KERN_WARNING "nf_log_packet: can\'t log since "
603 "no backend logging module loaded in! Please either "
604 "load one, or disable logging explicitly\n");
605 }
606 rcu_read_unlock();
607}
608EXPORT_SYMBOL(nf_log_register);
609EXPORT_SYMBOL(nf_log_unregister_pf);
610EXPORT_SYMBOL(nf_log_unregister_logger);
611EXPORT_SYMBOL(nf_log_packet);
612
613#ifdef CONFIG_PROC_FS
614struct proc_dir_entry *proc_net_netfilter;
615EXPORT_SYMBOL(proc_net_netfilter);
616
617static void *seq_start(struct seq_file *seq, loff_t *pos)
618{
619 rcu_read_lock();
620
621 if (*pos >= NPROTO)
622 return NULL;
623
624 return pos;
625}
626
627static void *seq_next(struct seq_file *s, void *v, loff_t *pos)
628{
629 (*pos)++;
630
631 if (*pos >= NPROTO)
632 return NULL;
633
634 return pos;
635}
636
637static void seq_stop(struct seq_file *s, void *v)
638{
639 rcu_read_unlock();
640}
641
642static int seq_show(struct seq_file *s, void *v)
643{
644 loff_t *pos = v;
645 const struct nf_logger *logger;
646
647 logger = rcu_dereference(nf_logging[*pos]);
648
649 if (!logger)
650 return seq_printf(s, "%2lld NONE\n", *pos);
651
652 return seq_printf(s, "%2lld %s\n", *pos, logger->name);
653}
654
655static struct seq_operations nflog_seq_ops = {
656 .start = seq_start,
657 .next = seq_next,
658 .stop = seq_stop,
659 .show = seq_show,
660};
661
662static int nflog_open(struct inode *inode, struct file *file)
663{
664 return seq_open(file, &nflog_seq_ops);
665}
666
667static struct file_operations nflog_file_ops = {
668 .owner = THIS_MODULE,
669 .open = nflog_open,
670 .read = seq_read,
671 .llseek = seq_lseek,
672 .release = seq_release,
673};
674
675#endif /* PROC_FS */
676
677
678/* This does not belong here, but locally generated errors need it if connection
679 tracking in use: without this, connection may not be in hash table, and hence
680 manufactured ICMP or RST packets will not be associated with it. */
681void (*ip_ct_attach)(struct sk_buff *, struct sk_buff *);
682
683void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb)
684{
685 void (*attach)(struct sk_buff *, struct sk_buff *);
686
687 if (skb->nfct && (attach = ip_ct_attach) != NULL) {
688 mb(); /* Just to be sure: must be read before executing this */
689 attach(new, skb);
690 }
691}
692
693void __init netfilter_init(void)
694{
695 int i, h;
696#ifdef CONFIG_PROC_FS
697 struct proc_dir_entry *pde;
698#endif
699
700 queue_rerouter = kmalloc(NPROTO * sizeof(struct nf_queue_rerouter),
701 GFP_KERNEL);
702 if (!queue_rerouter)
703 panic("netfilter: cannot allocate queue rerouter array\n");
704 memset(queue_rerouter, 0, NPROTO * sizeof(struct nf_queue_rerouter));
705
706 for (i = 0; i < NPROTO; i++) {
707 for (h = 0; h < NF_MAX_HOOKS; h++)
708 INIT_LIST_HEAD(&nf_hooks[i][h]);
709 }
710
711#ifdef CONFIG_PROC_FS
712 proc_net_netfilter = proc_mkdir("netfilter", proc_net);
713 if (!proc_net_netfilter)
714 panic("cannot create netfilter proc entry");
715 pde = create_proc_entry("nf_log", S_IRUGO, proc_net_netfilter);
716 if (!pde)
717 panic("cannot create /proc/net/netfilter/nf_log");
718 pde->proc_fops = &nflog_file_ops;
719#endif
720}
721
722EXPORT_SYMBOL(ip_ct_attach);
723EXPORT_SYMBOL(nf_ct_attach);
724EXPORT_SYMBOL(nf_getsockopt);
725EXPORT_SYMBOL(nf_hook_slow);
726EXPORT_SYMBOL(nf_hooks);
727EXPORT_SYMBOL(nf_register_hook);
728EXPORT_SYMBOL(nf_register_queue_handler);
729EXPORT_SYMBOL(nf_register_sockopt);
730EXPORT_SYMBOL(nf_reinject);
731EXPORT_SYMBOL(nf_setsockopt);
732EXPORT_SYMBOL(nf_unregister_hook);
733EXPORT_SYMBOL(nf_unregister_queue_handler);
734EXPORT_SYMBOL_GPL(nf_unregister_queue_handlers);
735EXPORT_SYMBOL_GPL(nf_register_queue_rerouter);
736EXPORT_SYMBOL_GPL(nf_unregister_queue_rerouter);
737EXPORT_SYMBOL(nf_unregister_sockopt);
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index c41caebc4a7c..b3b44f8b415a 100644
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -1,3 +1,7 @@
1netfilter-objs := core.o nf_log.o nf_queue.o nf_sockopt.o
2
3obj-$(CONFIG_NETFILTER) = netfilter.o
4
1obj-$(CONFIG_NETFILTER_NETLINK) += nfnetlink.o 5obj-$(CONFIG_NETFILTER_NETLINK) += nfnetlink.o
2obj-$(CONFIG_NETFILTER_NETLINK_QUEUE) += nfnetlink_queue.o 6obj-$(CONFIG_NETFILTER_NETLINK_QUEUE) += nfnetlink_queue.o
3obj-$(CONFIG_NETFILTER_NETLINK_LOG) += nfnetlink_log.o 7obj-$(CONFIG_NETFILTER_NETLINK_LOG) += nfnetlink_log.o
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
new file mode 100644
index 000000000000..1ceb1a6c254b
--- /dev/null
+++ b/net/netfilter/core.c
@@ -0,0 +1,216 @@
1/* netfilter.c: look after the filters for various protocols.
2 * Heavily influenced by the old firewall.c by David Bonn and Alan Cox.
3 *
4 * Thanks to Rob `CmdrTaco' Malda for not influencing this code in any
5 * way.
6 *
7 * Rusty Russell (C)2000 -- This code is GPL.
8 *
9 * February 2000: Modified by James Morris to have 1 queue per protocol.
10 * 15-Mar-2000: Added NF_REPEAT --RR.
11 * 08-May-2003: Internal logging interface added by Jozsef Kadlecsik.
12 */
13#include <linux/config.h>
14#include <linux/kernel.h>
15#include <linux/netfilter.h>
16#include <net/protocol.h>
17#include <linux/init.h>
18#include <linux/skbuff.h>
19#include <linux/wait.h>
20#include <linux/module.h>
21#include <linux/interrupt.h>
22#include <linux/if.h>
23#include <linux/netdevice.h>
24#include <linux/inetdevice.h>
25#include <linux/proc_fs.h>
26#include <net/sock.h>
27
28#include "nf_internals.h"
29
30/* In this code, we can be waiting indefinitely for userspace to
31 * service a packet if a hook returns NF_QUEUE. We could keep a count
32 * of skbuffs queued for userspace, and not deregister a hook unless
33 * this is zero, but that sucks. Now, we simply check when the
34 * packets come back: if the hook is gone, the packet is discarded. */
35struct list_head nf_hooks[NPROTO][NF_MAX_HOOKS];
36EXPORT_SYMBOL(nf_hooks);
37static DEFINE_SPINLOCK(nf_hook_lock);
38
39int nf_register_hook(struct nf_hook_ops *reg)
40{
41 struct list_head *i;
42
43 spin_lock_bh(&nf_hook_lock);
44 list_for_each(i, &nf_hooks[reg->pf][reg->hooknum]) {
45 if (reg->priority < ((struct nf_hook_ops *)i)->priority)
46 break;
47 }
48 list_add_rcu(&reg->list, i->prev);
49 spin_unlock_bh(&nf_hook_lock);
50
51 synchronize_net();
52 return 0;
53}
54EXPORT_SYMBOL(nf_register_hook);
55
56void nf_unregister_hook(struct nf_hook_ops *reg)
57{
58 spin_lock_bh(&nf_hook_lock);
59 list_del_rcu(&reg->list);
60 spin_unlock_bh(&nf_hook_lock);
61
62 synchronize_net();
63}
64EXPORT_SYMBOL(nf_unregister_hook);
65
66unsigned int nf_iterate(struct list_head *head,
67 struct sk_buff **skb,
68 int hook,
69 const struct net_device *indev,
70 const struct net_device *outdev,
71 struct list_head **i,
72 int (*okfn)(struct sk_buff *),
73 int hook_thresh)
74{
75 unsigned int verdict;
76
77 /*
78 * The caller must not block between calls to this
79 * function because of risk of continuing from deleted element.
80 */
81 list_for_each_continue_rcu(*i, head) {
82 struct nf_hook_ops *elem = (struct nf_hook_ops *)*i;
83
84 if (hook_thresh > elem->priority)
85 continue;
86
87 /* Optimization: we don't need to hold module
88 reference here, since function can't sleep. --RR */
89 verdict = elem->hook(hook, skb, indev, outdev, okfn);
90 if (verdict != NF_ACCEPT) {
91#ifdef CONFIG_NETFILTER_DEBUG
92 if (unlikely((verdict & NF_VERDICT_MASK)
93 > NF_MAX_VERDICT)) {
94 NFDEBUG("Evil return from %p(%u).\n",
95 elem->hook, hook);
96 continue;
97 }
98#endif
99 if (verdict != NF_REPEAT)
100 return verdict;
101 *i = (*i)->prev;
102 }
103 }
104 return NF_ACCEPT;
105}
106
107
108/* Returns 1 if okfn() needs to be executed by the caller,
109 * -EPERM for NF_DROP, 0 otherwise. */
110int nf_hook_slow(int pf, unsigned int hook, struct sk_buff **pskb,
111 struct net_device *indev,
112 struct net_device *outdev,
113 int (*okfn)(struct sk_buff *),
114 int hook_thresh)
115{
116 struct list_head *elem;
117 unsigned int verdict;
118 int ret = 0;
119
120 /* We may already have this, but read-locks nest anyway */
121 rcu_read_lock();
122
123 elem = &nf_hooks[pf][hook];
124next_hook:
125 verdict = nf_iterate(&nf_hooks[pf][hook], pskb, hook, indev,
126 outdev, &elem, okfn, hook_thresh);
127 if (verdict == NF_ACCEPT || verdict == NF_STOP) {
128 ret = 1;
129 goto unlock;
130 } else if (verdict == NF_DROP) {
131 kfree_skb(*pskb);
132 ret = -EPERM;
133 } else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) {
134 NFDEBUG("nf_hook: Verdict = QUEUE.\n");
135 if (!nf_queue(pskb, elem, pf, hook, indev, outdev, okfn,
136 verdict >> NF_VERDICT_BITS))
137 goto next_hook;
138 }
139unlock:
140 rcu_read_unlock();
141 return ret;
142}
143EXPORT_SYMBOL(nf_hook_slow);
144
145
146int skb_make_writable(struct sk_buff **pskb, unsigned int writable_len)
147{
148 struct sk_buff *nskb;
149
150 if (writable_len > (*pskb)->len)
151 return 0;
152
153 /* Not exclusive use of packet? Must copy. */
154 if (skb_shared(*pskb) || skb_cloned(*pskb))
155 goto copy_skb;
156
157 return pskb_may_pull(*pskb, writable_len);
158
159copy_skb:
160 nskb = skb_copy(*pskb, GFP_ATOMIC);
161 if (!nskb)
162 return 0;
163 BUG_ON(skb_is_nonlinear(nskb));
164
165 /* Rest of kernel will get very unhappy if we pass it a
166 suddenly-orphaned skbuff */
167 if ((*pskb)->sk)
168 skb_set_owner_w(nskb, (*pskb)->sk);
169 kfree_skb(*pskb);
170 *pskb = nskb;
171 return 1;
172}
173EXPORT_SYMBOL(skb_make_writable);
174
175
176/* This does not belong here, but locally generated errors need it if connection
177 tracking in use: without this, connection may not be in hash table, and hence
178 manufactured ICMP or RST packets will not be associated with it. */
179void (*ip_ct_attach)(struct sk_buff *, struct sk_buff *);
180EXPORT_SYMBOL(ip_ct_attach);
181
182void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb)
183{
184 void (*attach)(struct sk_buff *, struct sk_buff *);
185
186 if (skb->nfct && (attach = ip_ct_attach) != NULL) {
187 mb(); /* Just to be sure: must be read before executing this */
188 attach(new, skb);
189 }
190}
191EXPORT_SYMBOL(nf_ct_attach);
192
193#ifdef CONFIG_PROC_FS
194struct proc_dir_entry *proc_net_netfilter;
195EXPORT_SYMBOL(proc_net_netfilter);
196#endif
197
198void __init netfilter_init(void)
199{
200 int i, h;
201 for (i = 0; i < NPROTO; i++) {
202 for (h = 0; h < NF_MAX_HOOKS; h++)
203 INIT_LIST_HEAD(&nf_hooks[i][h]);
204 }
205
206#ifdef CONFIG_PROC_FS
207 proc_net_netfilter = proc_mkdir("netfilter", proc_net);
208 if (!proc_net_netfilter)
209 panic("cannot create netfilter proc entry");
210#endif
211
212 if (netfilter_queue_init() < 0)
213 panic("cannot initialize nf_queue");
214 if (netfilter_log_init() < 0)
215 panic("cannot initialize nf_log");
216}
diff --git a/net/netfilter/nf_internals.h b/net/netfilter/nf_internals.h
new file mode 100644
index 000000000000..6bdee2910617
--- /dev/null
+++ b/net/netfilter/nf_internals.h
@@ -0,0 +1,39 @@
1#ifndef _NF_INTERNALS_H
2#define _NF_INTERNALS_H
3
4#include <linux/config.h>
5#include <linux/list.h>
6#include <linux/skbuff.h>
7#include <linux/netdevice.h>
8
9#ifdef CONFIG_NETFILTER_DEBUG
10#define NFDEBUG(format, args...) printk(format , ## args)
11#else
12#define NFDEBUG(format, args...)
13#endif
14
15
16/* core.c */
17extern unsigned int nf_iterate(struct list_head *head,
18 struct sk_buff **skb,
19 int hook,
20 const struct net_device *indev,
21 const struct net_device *outdev,
22 struct list_head **i,
23 int (*okfn)(struct sk_buff *),
24 int hook_thresh);
25
26/* nf_queue.c */
27extern int nf_queue(struct sk_buff **skb,
28 struct list_head *elem,
29 int pf, unsigned int hook,
30 struct net_device *indev,
31 struct net_device *outdev,
32 int (*okfn)(struct sk_buff *),
33 unsigned int queuenum);
34extern int __init netfilter_queue_init(void);
35
36/* nf_log.c */
37extern int __init netfilter_log_init(void);
38
39#endif
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
new file mode 100644
index 000000000000..ec58c4d2c667
--- /dev/null
+++ b/net/netfilter/nf_log.c
@@ -0,0 +1,165 @@
1#include <linux/config.h>
2#include <linux/kernel.h>
3#include <linux/init.h>
4#include <linux/module.h>
5#include <linux/proc_fs.h>
6#include <linux/skbuff.h>
7#include <linux/netfilter.h>
8#include <net/protocol.h>
9
10#include "nf_internals.h"
11
12/* Internal logging interface, which relies on the real
13 LOG target modules */
14
15#define NF_LOG_PREFIXLEN 128
16
17static struct nf_logger *nf_logging[NPROTO]; /* = NULL */
18static DEFINE_SPINLOCK(nf_log_lock);
19
20int nf_log_register(int pf, struct nf_logger *logger)
21{
22 int ret = -EBUSY;
23
24 /* Any setup of logging members must be done before
25 * substituting pointer. */
26 spin_lock(&nf_log_lock);
27 if (!nf_logging[pf]) {
28 rcu_assign_pointer(nf_logging[pf], logger);
29 ret = 0;
30 }
31 spin_unlock(&nf_log_lock);
32 return ret;
33}
34EXPORT_SYMBOL(nf_log_register);
35
36void nf_log_unregister_pf(int pf)
37{
38 spin_lock(&nf_log_lock);
39 nf_logging[pf] = NULL;
40 spin_unlock(&nf_log_lock);
41
42 /* Give time to concurrent readers. */
43 synchronize_net();
44}
45EXPORT_SYMBOL(nf_log_unregister_pf);
46
47void nf_log_unregister_logger(struct nf_logger *logger)
48{
49 int i;
50
51 spin_lock(&nf_log_lock);
52 for (i = 0; i < NPROTO; i++) {
53 if (nf_logging[i] == logger)
54 nf_logging[i] = NULL;
55 }
56 spin_unlock(&nf_log_lock);
57
58 synchronize_net();
59}
60EXPORT_SYMBOL(nf_log_unregister_logger);
61
62void nf_log_packet(int pf,
63 unsigned int hooknum,
64 const struct sk_buff *skb,
65 const struct net_device *in,
66 const struct net_device *out,
67 struct nf_loginfo *loginfo,
68 const char *fmt, ...)
69{
70 va_list args;
71 char prefix[NF_LOG_PREFIXLEN];
72 struct nf_logger *logger;
73
74 rcu_read_lock();
75 logger = rcu_dereference(nf_logging[pf]);
76 if (logger) {
77 va_start(args, fmt);
78 vsnprintf(prefix, sizeof(prefix), fmt, args);
79 va_end(args);
80 /* We must read logging before nf_logfn[pf] */
81 logger->logfn(pf, hooknum, skb, in, out, loginfo, prefix);
82 } else if (net_ratelimit()) {
83 printk(KERN_WARNING "nf_log_packet: can\'t log since "
84 "no backend logging module loaded in! Please either "
85 "load one, or disable logging explicitly\n");
86 }
87 rcu_read_unlock();
88}
89EXPORT_SYMBOL(nf_log_packet);
90
91#ifdef CONFIG_PROC_FS
92static void *seq_start(struct seq_file *seq, loff_t *pos)
93{
94 rcu_read_lock();
95
96 if (*pos >= NPROTO)
97 return NULL;
98
99 return pos;
100}
101
102static void *seq_next(struct seq_file *s, void *v, loff_t *pos)
103{
104 (*pos)++;
105
106 if (*pos >= NPROTO)
107 return NULL;
108
109 return pos;
110}
111
112static void seq_stop(struct seq_file *s, void *v)
113{
114 rcu_read_unlock();
115}
116
117static int seq_show(struct seq_file *s, void *v)
118{
119 loff_t *pos = v;
120 const struct nf_logger *logger;
121
122 logger = rcu_dereference(nf_logging[*pos]);
123
124 if (!logger)
125 return seq_printf(s, "%2lld NONE\n", *pos);
126
127 return seq_printf(s, "%2lld %s\n", *pos, logger->name);
128}
129
130static struct seq_operations nflog_seq_ops = {
131 .start = seq_start,
132 .next = seq_next,
133 .stop = seq_stop,
134 .show = seq_show,
135};
136
137static int nflog_open(struct inode *inode, struct file *file)
138{
139 return seq_open(file, &nflog_seq_ops);
140}
141
142static struct file_operations nflog_file_ops = {
143 .owner = THIS_MODULE,
144 .open = nflog_open,
145 .read = seq_read,
146 .llseek = seq_lseek,
147 .release = seq_release,
148};
149
150#endif /* PROC_FS */
151
152
153int __init netfilter_log_init(void)
154{
155#ifdef CONFIG_PROC_FS
156 struct proc_dir_entry *pde;
157 pde = create_proc_entry("nf_log", S_IRUGO, proc_net_netfilter);
158#endif
159 if (!pde)
160 return -1;
161
162 pde->proc_fops = &nflog_file_ops;
163
164 return 0;
165}
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
new file mode 100644
index 000000000000..5586f843ed45
--- /dev/null
+++ b/net/netfilter/nf_queue.c
@@ -0,0 +1,273 @@
1#include <linux/config.h>
2#include <linux/kernel.h>
3#include <linux/init.h>
4#include <linux/module.h>
5#include <linux/proc_fs.h>
6#include <linux/skbuff.h>
7#include <linux/netfilter.h>
8#include <net/protocol.h>
9
10#include "nf_internals.h"
11
12/*
13 * A queue handler may be registered for each protocol. Each is protected by
14 * long term mutex. The handler must provide an an outfn() to accept packets
15 * for queueing and must reinject all packets it receives, no matter what.
16 */
17static struct nf_queue_handler_t {
18 nf_queue_outfn_t outfn;
19 void *data;
20} queue_handler[NPROTO];
21
22static struct nf_queue_rerouter *queue_rerouter;
23
24static DEFINE_RWLOCK(queue_handler_lock);
25
26
27int nf_register_queue_handler(int pf, nf_queue_outfn_t outfn, void *data)
28{
29 int ret;
30
31 if (pf >= NPROTO)
32 return -EINVAL;
33
34 write_lock_bh(&queue_handler_lock);
35 if (queue_handler[pf].outfn)
36 ret = -EBUSY;
37 else {
38 queue_handler[pf].outfn = outfn;
39 queue_handler[pf].data = data;
40 ret = 0;
41 }
42 write_unlock_bh(&queue_handler_lock);
43
44 return ret;
45}
46EXPORT_SYMBOL(nf_register_queue_handler);
47
48/* The caller must flush their queue before this */
49int nf_unregister_queue_handler(int pf)
50{
51 if (pf >= NPROTO)
52 return -EINVAL;
53
54 write_lock_bh(&queue_handler_lock);
55 queue_handler[pf].outfn = NULL;
56 queue_handler[pf].data = NULL;
57 write_unlock_bh(&queue_handler_lock);
58
59 return 0;
60}
61EXPORT_SYMBOL(nf_unregister_queue_handler);
62
63int nf_register_queue_rerouter(int pf, struct nf_queue_rerouter *rer)
64{
65 if (pf >= NPROTO)
66 return -EINVAL;
67
68 write_lock_bh(&queue_handler_lock);
69 memcpy(&queue_rerouter[pf], rer, sizeof(queue_rerouter[pf]));
70 write_unlock_bh(&queue_handler_lock);
71
72 return 0;
73}
74EXPORT_SYMBOL_GPL(nf_register_queue_rerouter);
75
76int nf_unregister_queue_rerouter(int pf)
77{
78 if (pf >= NPROTO)
79 return -EINVAL;
80
81 write_lock_bh(&queue_handler_lock);
82 memset(&queue_rerouter[pf], 0, sizeof(queue_rerouter[pf]));
83 write_unlock_bh(&queue_handler_lock);
84 return 0;
85}
86EXPORT_SYMBOL_GPL(nf_unregister_queue_rerouter);
87
88void nf_unregister_queue_handlers(nf_queue_outfn_t outfn)
89{
90 int pf;
91
92 write_lock_bh(&queue_handler_lock);
93 for (pf = 0; pf < NPROTO; pf++) {
94 if (queue_handler[pf].outfn == outfn) {
95 queue_handler[pf].outfn = NULL;
96 queue_handler[pf].data = NULL;
97 }
98 }
99 write_unlock_bh(&queue_handler_lock);
100}
101EXPORT_SYMBOL_GPL(nf_unregister_queue_handlers);
102
103/*
104 * Any packet that leaves via this function must come back
105 * through nf_reinject().
106 */
107int nf_queue(struct sk_buff **skb,
108 struct list_head *elem,
109 int pf, unsigned int hook,
110 struct net_device *indev,
111 struct net_device *outdev,
112 int (*okfn)(struct sk_buff *),
113 unsigned int queuenum)
114{
115 int status;
116 struct nf_info *info;
117#ifdef CONFIG_BRIDGE_NETFILTER
118 struct net_device *physindev = NULL;
119 struct net_device *physoutdev = NULL;
120#endif
121
122 /* QUEUE == DROP if noone is waiting, to be safe. */
123 read_lock(&queue_handler_lock);
124 if (!queue_handler[pf].outfn) {
125 read_unlock(&queue_handler_lock);
126 kfree_skb(*skb);
127 return 1;
128 }
129
130 info = kmalloc(sizeof(*info)+queue_rerouter[pf].rer_size, GFP_ATOMIC);
131 if (!info) {
132 if (net_ratelimit())
133 printk(KERN_ERR "OOM queueing packet %p\n",
134 *skb);
135 read_unlock(&queue_handler_lock);
136 kfree_skb(*skb);
137 return 1;
138 }
139
140 *info = (struct nf_info) {
141 (struct nf_hook_ops *)elem, pf, hook, indev, outdev, okfn };
142
143 /* If it's going away, ignore hook. */
144 if (!try_module_get(info->elem->owner)) {
145 read_unlock(&queue_handler_lock);
146 kfree(info);
147 return 0;
148 }
149
150 /* Bump dev refs so they don't vanish while packet is out */
151 if (indev) dev_hold(indev);
152 if (outdev) dev_hold(outdev);
153
154#ifdef CONFIG_BRIDGE_NETFILTER
155 if ((*skb)->nf_bridge) {
156 physindev = (*skb)->nf_bridge->physindev;
157 if (physindev) dev_hold(physindev);
158 physoutdev = (*skb)->nf_bridge->physoutdev;
159 if (physoutdev) dev_hold(physoutdev);
160 }
161#endif
162 if (queue_rerouter[pf].save)
163 queue_rerouter[pf].save(*skb, info);
164
165 status = queue_handler[pf].outfn(*skb, info, queuenum,
166 queue_handler[pf].data);
167
168 if (status >= 0 && queue_rerouter[pf].reroute)
169 status = queue_rerouter[pf].reroute(skb, info);
170
171 read_unlock(&queue_handler_lock);
172
173 if (status < 0) {
174 /* James M doesn't say fuck enough. */
175 if (indev) dev_put(indev);
176 if (outdev) dev_put(outdev);
177#ifdef CONFIG_BRIDGE_NETFILTER
178 if (physindev) dev_put(physindev);
179 if (physoutdev) dev_put(physoutdev);
180#endif
181 module_put(info->elem->owner);
182 kfree(info);
183 kfree_skb(*skb);
184
185 return 1;
186 }
187
188 return 1;
189}
190
191void nf_reinject(struct sk_buff *skb, struct nf_info *info,
192 unsigned int verdict)
193{
194 struct list_head *elem = &info->elem->list;
195 struct list_head *i;
196
197 rcu_read_lock();
198
199 /* Release those devices we held, or Alexey will kill me. */
200 if (info->indev) dev_put(info->indev);
201 if (info->outdev) dev_put(info->outdev);
202#ifdef CONFIG_BRIDGE_NETFILTER
203 if (skb->nf_bridge) {
204 if (skb->nf_bridge->physindev)
205 dev_put(skb->nf_bridge->physindev);
206 if (skb->nf_bridge->physoutdev)
207 dev_put(skb->nf_bridge->physoutdev);
208 }
209#endif
210
211 /* Drop reference to owner of hook which queued us. */
212 module_put(info->elem->owner);
213
214 list_for_each_rcu(i, &nf_hooks[info->pf][info->hook]) {
215 if (i == elem)
216 break;
217 }
218
219 if (elem == &nf_hooks[info->pf][info->hook]) {
220 /* The module which sent it to userspace is gone. */
221 NFDEBUG("%s: module disappeared, dropping packet.\n",
222 __FUNCTION__);
223 verdict = NF_DROP;
224 }
225
226 /* Continue traversal iff userspace said ok... */
227 if (verdict == NF_REPEAT) {
228 elem = elem->prev;
229 verdict = NF_ACCEPT;
230 }
231
232 if (verdict == NF_ACCEPT) {
233 next_hook:
234 verdict = nf_iterate(&nf_hooks[info->pf][info->hook],
235 &skb, info->hook,
236 info->indev, info->outdev, &elem,
237 info->okfn, INT_MIN);
238 }
239
240 switch (verdict & NF_VERDICT_MASK) {
241 case NF_ACCEPT:
242 info->okfn(skb);
243 break;
244
245 case NF_QUEUE:
246 if (!nf_queue(&skb, elem, info->pf, info->hook,
247 info->indev, info->outdev, info->okfn,
248 verdict >> NF_VERDICT_BITS))
249 goto next_hook;
250 break;
251 }
252 rcu_read_unlock();
253
254 if (verdict == NF_DROP)
255 kfree_skb(skb);
256
257 kfree(info);
258 return;
259}
260EXPORT_SYMBOL(nf_reinject);
261
262int __init netfilter_queue_init(void)
263{
264 queue_rerouter = kmalloc(NPROTO * sizeof(struct nf_queue_rerouter),
265 GFP_KERNEL);
266 if (!queue_rerouter)
267 return -ENOMEM;
268
269 memset(queue_rerouter, 0, NPROTO * sizeof(struct nf_queue_rerouter));
270
271 return 0;
272}
273
diff --git a/net/netfilter/nf_sockopt.c b/net/netfilter/nf_sockopt.c
new file mode 100644
index 000000000000..61a833a9caa6
--- /dev/null
+++ b/net/netfilter/nf_sockopt.c
@@ -0,0 +1,132 @@
1#include <linux/config.h>
2#include <linux/kernel.h>
3#include <linux/init.h>
4#include <linux/module.h>
5#include <linux/skbuff.h>
6#include <linux/netfilter.h>
7#include <net/sock.h>
8
9#include "nf_internals.h"
10
11/* Sockopts only registered and called from user context, so
12 net locking would be overkill. Also, [gs]etsockopt calls may
13 sleep. */
14static DECLARE_MUTEX(nf_sockopt_mutex);
15static LIST_HEAD(nf_sockopts);
16
17/* Do exclusive ranges overlap? */
18static inline int overlap(int min1, int max1, int min2, int max2)
19{
20 return max1 > min2 && min1 < max2;
21}
22
23/* Functions to register sockopt ranges (exclusive). */
24int nf_register_sockopt(struct nf_sockopt_ops *reg)
25{
26 struct list_head *i;
27 int ret = 0;
28
29 if (down_interruptible(&nf_sockopt_mutex) != 0)
30 return -EINTR;
31
32 list_for_each(i, &nf_sockopts) {
33 struct nf_sockopt_ops *ops = (struct nf_sockopt_ops *)i;
34 if (ops->pf == reg->pf
35 && (overlap(ops->set_optmin, ops->set_optmax,
36 reg->set_optmin, reg->set_optmax)
37 || overlap(ops->get_optmin, ops->get_optmax,
38 reg->get_optmin, reg->get_optmax))) {
39 NFDEBUG("nf_sock overlap: %u-%u/%u-%u v %u-%u/%u-%u\n",
40 ops->set_optmin, ops->set_optmax,
41 ops->get_optmin, ops->get_optmax,
42 reg->set_optmin, reg->set_optmax,
43 reg->get_optmin, reg->get_optmax);
44 ret = -EBUSY;
45 goto out;
46 }
47 }
48
49 list_add(&reg->list, &nf_sockopts);
50out:
51 up(&nf_sockopt_mutex);
52 return ret;
53}
54EXPORT_SYMBOL(nf_register_sockopt);
55
56void nf_unregister_sockopt(struct nf_sockopt_ops *reg)
57{
58 /* No point being interruptible: we're probably in cleanup_module() */
59 restart:
60 down(&nf_sockopt_mutex);
61 if (reg->use != 0) {
62 /* To be woken by nf_sockopt call... */
63 /* FIXME: Stuart Young's name appears gratuitously. */
64 set_current_state(TASK_UNINTERRUPTIBLE);
65 reg->cleanup_task = current;
66 up(&nf_sockopt_mutex);
67 schedule();
68 goto restart;
69 }
70 list_del(&reg->list);
71 up(&nf_sockopt_mutex);
72}
73EXPORT_SYMBOL(nf_unregister_sockopt);
74
75/* Call get/setsockopt() */
76static int nf_sockopt(struct sock *sk, int pf, int val,
77 char __user *opt, int *len, int get)
78{
79 struct list_head *i;
80 struct nf_sockopt_ops *ops;
81 int ret;
82
83 if (down_interruptible(&nf_sockopt_mutex) != 0)
84 return -EINTR;
85
86 list_for_each(i, &nf_sockopts) {
87 ops = (struct nf_sockopt_ops *)i;
88 if (ops->pf == pf) {
89 if (get) {
90 if (val >= ops->get_optmin
91 && val < ops->get_optmax) {
92 ops->use++;
93 up(&nf_sockopt_mutex);
94 ret = ops->get(sk, val, opt, len);
95 goto out;
96 }
97 } else {
98 if (val >= ops->set_optmin
99 && val < ops->set_optmax) {
100 ops->use++;
101 up(&nf_sockopt_mutex);
102 ret = ops->set(sk, val, opt, *len);
103 goto out;
104 }
105 }
106 }
107 }
108 up(&nf_sockopt_mutex);
109 return -ENOPROTOOPT;
110
111 out:
112 down(&nf_sockopt_mutex);
113 ops->use--;
114 if (ops->cleanup_task)
115 wake_up_process(ops->cleanup_task);
116 up(&nf_sockopt_mutex);
117 return ret;
118}
119
120int nf_setsockopt(struct sock *sk, int pf, int val, char __user *opt,
121 int len)
122{
123 return nf_sockopt(sk, pf, val, opt, &len, 0);
124}
125EXPORT_SYMBOL(nf_setsockopt);
126
127int nf_getsockopt(struct sock *sk, int pf, int val, char __user *opt, int *len)
128{
129 return nf_sockopt(sk, pf, val, opt, len, 1);
130}
131EXPORT_SYMBOL(nf_getsockopt);
132
generated by cgit v1.2.2 (git 2.25.0) at 2024-12-03 20:08:39 -0500