1 /* Netfilter messages via netlink socket. Allows for user space
2 * protocol helpers and general trouble making from userspace.
4 * (C) 2001 by Jay Schulist <jschlst@samba.org>,
5 * (C) 2002-2005 by Harald Welte <laforge@gnumonks.org>
6 * (C) 2005,2007 by Pablo Neira Ayuso <pablo@netfilter.org>
8 * Initial netfilter messages via netlink development funded and
9 * generally made possible by Network Robots, Inc. (www.networkrobots.com)
11 * Further development of this code funded by Astaro AG (http://www.astaro.com)
13 * This software may be used and distributed according to the terms
14 * of the GNU General Public License, incorporated herein by reference.
17 #include <linux/module.h>
18 #include <linux/types.h>
19 #include <linux/socket.h>
20 #include <linux/kernel.h>
21 #include <linux/string.h>
22 #include <linux/sockios.h>
23 #include <linux/net.h>
24 #include <linux/skbuff.h>
25 #include <asm/uaccess.h>
27 #include <net/netlink.h>
28 #include <linux/init.h>
30 #include <linux/netlink.h>
31 #include <linux/netfilter/nfnetlink.h>
33 MODULE_LICENSE("GPL");
34 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
35 MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK
, NETLINK_NETFILTER
);
37 static char __initdata nfversion
[] = "0.30";
39 static const struct nfnetlink_subsystem __rcu
*subsys_table
[NFNL_SUBSYS_COUNT
];
40 static DEFINE_MUTEX(nfnl_mutex
);
42 static const int nfnl_group2type
[NFNLGRP_MAX
+1] = {
43 [NFNLGRP_CONNTRACK_NEW
] = NFNL_SUBSYS_CTNETLINK
,
44 [NFNLGRP_CONNTRACK_UPDATE
] = NFNL_SUBSYS_CTNETLINK
,
45 [NFNLGRP_CONNTRACK_DESTROY
] = NFNL_SUBSYS_CTNETLINK
,
46 [NFNLGRP_CONNTRACK_EXP_NEW
] = NFNL_SUBSYS_CTNETLINK_EXP
,
47 [NFNLGRP_CONNTRACK_EXP_UPDATE
] = NFNL_SUBSYS_CTNETLINK_EXP
,
48 [NFNLGRP_CONNTRACK_EXP_DESTROY
] = NFNL_SUBSYS_CTNETLINK_EXP
,
53 mutex_lock(&nfnl_mutex
);
55 EXPORT_SYMBOL_GPL(nfnl_lock
);
57 void nfnl_unlock(void)
59 mutex_unlock(&nfnl_mutex
);
61 EXPORT_SYMBOL_GPL(nfnl_unlock
);
63 int nfnetlink_subsys_register(const struct nfnetlink_subsystem
*n
)
66 if (subsys_table
[n
->subsys_id
]) {
70 rcu_assign_pointer(subsys_table
[n
->subsys_id
], n
);
75 EXPORT_SYMBOL_GPL(nfnetlink_subsys_register
);
77 int nfnetlink_subsys_unregister(const struct nfnetlink_subsystem
*n
)
80 subsys_table
[n
->subsys_id
] = NULL
;
85 EXPORT_SYMBOL_GPL(nfnetlink_subsys_unregister
);
87 static inline const struct nfnetlink_subsystem
*nfnetlink_get_subsys(u_int16_t type
)
89 u_int8_t subsys_id
= NFNL_SUBSYS_ID(type
);
91 if (subsys_id
>= NFNL_SUBSYS_COUNT
)
94 return rcu_dereference(subsys_table
[subsys_id
]);
97 static inline const struct nfnl_callback
*
98 nfnetlink_find_client(u_int16_t type
, const struct nfnetlink_subsystem
*ss
)
100 u_int8_t cb_id
= NFNL_MSG_TYPE(type
);
102 if (cb_id
>= ss
->cb_count
)
105 return &ss
->cb
[cb_id
];
108 int nfnetlink_has_listeners(struct net
*net
, unsigned int group
)
110 return netlink_has_listeners(net
->nfnl
, group
);
112 EXPORT_SYMBOL_GPL(nfnetlink_has_listeners
);
114 int nfnetlink_send(struct sk_buff
*skb
, struct net
*net
, u32 pid
,
115 unsigned int group
, int echo
, gfp_t flags
)
117 return nlmsg_notify(net
->nfnl
, skb
, pid
, group
, echo
, flags
);
119 EXPORT_SYMBOL_GPL(nfnetlink_send
);
121 int nfnetlink_set_err(struct net
*net
, u32 pid
, u32 group
, int error
)
123 return netlink_set_err(net
->nfnl
, pid
, group
, error
);
125 EXPORT_SYMBOL_GPL(nfnetlink_set_err
);
127 int nfnetlink_unicast(struct sk_buff
*skb
, struct net
*net
, u_int32_t pid
, int flags
)
129 return netlink_unicast(net
->nfnl
, skb
, pid
, flags
);
131 EXPORT_SYMBOL_GPL(nfnetlink_unicast
);
133 /* Process one complete nfnetlink message. */
134 static int nfnetlink_rcv_msg(struct sk_buff
*skb
, struct nlmsghdr
*nlh
)
136 struct net
*net
= sock_net(skb
->sk
);
137 const struct nfnl_callback
*nc
;
138 const struct nfnetlink_subsystem
*ss
;
141 if (!capable(CAP_NET_ADMIN
))
144 /* All the messages must at least contain nfgenmsg */
145 if (nlh
->nlmsg_len
< NLMSG_LENGTH(sizeof(struct nfgenmsg
)))
148 type
= nlh
->nlmsg_type
;
151 ss
= nfnetlink_get_subsys(type
);
153 #ifdef CONFIG_MODULES
155 request_module("nfnetlink-subsys-%d", NFNL_SUBSYS_ID(type
));
157 ss
= nfnetlink_get_subsys(type
);
166 nc
= nfnetlink_find_client(type
, ss
);
173 int min_len
= NLMSG_SPACE(sizeof(struct nfgenmsg
));
174 u_int8_t cb_id
= NFNL_MSG_TYPE(nlh
->nlmsg_type
);
175 struct nlattr
*cda
[ss
->cb
[cb_id
].attr_count
+ 1];
176 struct nlattr
*attr
= (void *)nlh
+ min_len
;
177 int attrlen
= nlh
->nlmsg_len
- min_len
;
179 err
= nla_parse(cda
, ss
->cb
[cb_id
].attr_count
,
180 attr
, attrlen
, ss
->cb
[cb_id
].policy
);
187 err
= nc
->call_rcu(net
->nfnl
, skb
, nlh
,
188 (const struct nlattr
**)cda
);
193 if (rcu_dereference_protected(
194 subsys_table
[NFNL_SUBSYS_ID(type
)],
195 lockdep_is_held(&nfnl_mutex
)) != ss
||
196 nfnetlink_find_client(type
, ss
) != nc
)
199 err
= nc
->call(net
->nfnl
, skb
, nlh
,
200 (const struct nlattr
**)cda
);
211 static void nfnetlink_rcv(struct sk_buff
*skb
)
213 netlink_rcv_skb(skb
, &nfnetlink_rcv_msg
);
216 #ifdef CONFIG_MODULES
217 static void nfnetlink_bind(int group
)
219 const struct nfnetlink_subsystem
*ss
;
220 int type
= nfnl_group2type
[group
];
223 ss
= nfnetlink_get_subsys(type
);
226 request_module("nfnetlink-subsys-%d", type
);
233 static int __net_init
nfnetlink_net_init(struct net
*net
)
236 struct netlink_kernel_cfg cfg
= {
237 .groups
= NFNLGRP_MAX
,
238 .input
= nfnetlink_rcv
,
239 #ifdef CONFIG_MODULES
240 .bind
= nfnetlink_bind
,
244 nfnl
= netlink_kernel_create(net
, NETLINK_NETFILTER
, &cfg
);
247 net
->nfnl_stash
= nfnl
;
248 rcu_assign_pointer(net
->nfnl
, nfnl
);
252 static void __net_exit
nfnetlink_net_exit_batch(struct list_head
*net_exit_list
)
256 list_for_each_entry(net
, net_exit_list
, exit_list
)
257 RCU_INIT_POINTER(net
->nfnl
, NULL
);
259 list_for_each_entry(net
, net_exit_list
, exit_list
)
260 netlink_kernel_release(net
->nfnl_stash
);
263 static struct pernet_operations nfnetlink_net_ops
= {
264 .init
= nfnetlink_net_init
,
265 .exit_batch
= nfnetlink_net_exit_batch
,
268 static int __init
nfnetlink_init(void)
270 pr_info("Netfilter messages via NETLINK v%s.\n", nfversion
);
271 return register_pernet_subsys(&nfnetlink_net_ops
);
274 static void __exit
nfnetlink_exit(void)
276 pr_info("Removing netfilter NETLINK layer.\n");
277 unregister_pernet_subsys(&nfnetlink_net_ops
);
279 module_init(nfnetlink_init
);
280 module_exit(nfnetlink_exit
);