net/bridge/netfilter/ebt_ulog.c

   1 /*
   2  * netfilter module for userspace bridged Ethernet frames logging daemons
   3  *
   4  *      Authors:
   5  *      Bart De Schuymer <bdschuym@pandora.be>
   6  *      Harald Welte <laforge@netfilter.org>
   7  *
   8  *  November, 2004
   9  *
  10  * Based on ipt_ULOG.c, which is
  11  * (C) 2000-2002 by Harald Welte <laforge@netfilter.org>
  12  *
  13  * This module accepts two parameters:
  14  *
  15  * nlbufsiz:
  16  *   The parameter specifies how big the buffer for each netlink multicast
  17  * group is. e.g. If you say nlbufsiz=8192, up to eight kb of packets will
  18  * get accumulated in the kernel until they are sent to userspace. It is
  19  * NOT possible to allocate more than 128kB, and it is strongly discouraged,
  20  * because atomically allocating 128kB inside the network rx softirq is not
  21  * reliable. Please also keep in mind that this buffer size is allocated for
  22  * each nlgroup you are using, so the total kernel memory usage increases
  23  * by that factor.
  24  *
  25  * flushtimeout:
  26  *   Specify, after how many hundredths of a second the queue should be
  27  *   flushed even if it is not full yet.
  28  *
  29  */
  30 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  31 #include <linux/module.h>
  32 #include <linux/slab.h>
  33 #include <linux/spinlock.h>
  34 #include <linux/socket.h>
  35 #include <linux/skbuff.h>
  36 #include <linux/kernel.h>
  37 #include <linux/timer.h>
  38 #include <net/netlink.h>
  39 #include <linux/netdevice.h>
  40 #include <linux/netfilter/x_tables.h>
  41 #include <linux/netfilter_bridge/ebtables.h>
  42 #include <linux/netfilter_bridge/ebt_ulog.h>
  43 #include <net/netfilter/nf_log.h>
  44 #include <net/netns/generic.h>
  45 #include <net/sock.h>
  46 #include "../br_private.h"
  47
  48 static unsigned int nlbufsiz = NLMSG_GOODSIZE;
  49 module_param(nlbufsiz, uint, 0600);
  50 MODULE_PARM_DESC(nlbufsiz, "netlink buffer size (number of bytes) "
  51                            "(defaults to 4096)");
  52
  53 static unsigned int flushtimeout = 10;
  54 module_param(flushtimeout, uint, 0600);
  55 MODULE_PARM_DESC(flushtimeout, "buffer flush timeout (hundredths ofa second) "
  56                                "(defaults to 10)");
  57
  58 typedef struct {
  59         unsigned int qlen;              /* number of nlmsgs' in the skb */
  60         struct nlmsghdr *lastnlh;       /* netlink header of last msg in skb */
  61         struct sk_buff *skb;            /* the pre-allocated skb */
  62         struct timer_list timer;        /* the timer function */
  63         spinlock_t lock;                /* the per-queue lock */
  64 } ebt_ulog_buff_t;
  65
  66 static int ebt_ulog_net_id __read_mostly;
  67 struct ebt_ulog_net {
  68         unsigned int nlgroup[EBT_ULOG_MAXNLGROUPS];
  69         ebt_ulog_buff_t ulog_buffers[EBT_ULOG_MAXNLGROUPS];
  70         struct sock *ebtulognl;
  71 };
  72
  73 static struct ebt_ulog_net *ebt_ulog_pernet(struct net *net)
  74 {
  75         return net_generic(net, ebt_ulog_net_id);
  76 }
  77
  78 /* send one ulog_buff_t to userspace */
  79 static void ulog_send(struct ebt_ulog_net *ebt, unsigned int nlgroup)
  80 {
  81         ebt_ulog_buff_t *ub = &ebt->ulog_buffers[nlgroup];
  82
  83         del_timer(&ub->timer);
  84
  85         if (!ub->skb)
  86                 return;
  87
  88         /* last nlmsg needs NLMSG_DONE */
  89         if (ub->qlen > 1)
  90                 ub->lastnlh->nlmsg_type = NLMSG_DONE;
  91
  92         NETLINK_CB(ub->skb).dst_group = nlgroup + 1;
  93         netlink_broadcast(ebt->ebtulognl, ub->skb, 0, nlgroup + 1, GFP_ATOMIC);
  94
  95         ub->qlen = 0;
  96         ub->skb = NULL;
  97 }
  98
  99 /* timer function to flush queue in flushtimeout time */
 100 static void ulog_timer(unsigned long data)
 101 {
 102         struct ebt_ulog_net *ebt = container_of((void *)data,
 103                                                 struct ebt_ulog_net,
 104                                                 nlgroup[*(unsigned int *)data]);
 105
 106         ebt_ulog_buff_t *ub = &ebt->ulog_buffers[*(unsigned int *)data];
 107         spin_lock_bh(&ub->lock);
 108         if (ub->skb)
 109                 ulog_send(ebt, *(unsigned int *)data);
 110         spin_unlock_bh(&ub->lock);
 111 }
 112
 113 static struct sk_buff *ulog_alloc_skb(unsigned int size)
 114 {
 115         struct sk_buff *skb;
 116         unsigned int n;
 117
 118         n = max(size, nlbufsiz);
 119         skb = alloc_skb(n, GFP_ATOMIC | __GFP_NOWARN);
 120         if (!skb) {
 121                 if (n > size) {
 122                         /* try to allocate only as much as we need for
 123                          * current packet */
 124                         skb = alloc_skb(size, GFP_ATOMIC);
 125                         if (!skb)
 126                                 pr_debug("cannot even allocate buffer of size %ub\n",
 127                                          size);
 128                 }
 129         }
 130
 131         return skb;
 132 }
 133
 134 static void ebt_ulog_packet(struct net *net, unsigned int hooknr,
 135                             const struct sk_buff *skb,
 136                             const struct net_device *in,
 137                             const struct net_device *out,
 138                             const struct ebt_ulog_info *uloginfo,
 139                             const char *prefix)
 140 {
 141         ebt_ulog_packet_msg_t *pm;
 142         size_t size, copy_len;
 143         struct nlmsghdr *nlh;
 144         struct ebt_ulog_net *ebt = ebt_ulog_pernet(net);
 145         unsigned int group = uloginfo->nlgroup;
 146         ebt_ulog_buff_t *ub = &ebt->ulog_buffers[group];
 147         spinlock_t *lock = &ub->lock;
 148         ktime_t kt;
 149
 150         if ((uloginfo->cprange == 0) ||
 151             (uloginfo->cprange > skb->len + ETH_HLEN))
 152                 copy_len = skb->len + ETH_HLEN;
 153         else
 154                 copy_len = uloginfo->cprange;
 155
 156         size = nlmsg_total_size(sizeof(*pm) + copy_len);
 157         if (size > nlbufsiz) {
 158                 pr_debug("Size %Zd needed, but nlbufsiz=%d\n", size, nlbufsiz);
 159                 return;
 160         }
 161
 162         spin_lock_bh(lock);
 163
 164         if (!ub->skb) {
 165                 if (!(ub->skb = ulog_alloc_skb(size)))
 166                         goto unlock;
 167         } else if (size > skb_tailroom(ub->skb)) {
 168                 ulog_send(ebt, group);
 169
 170                 if (!(ub->skb = ulog_alloc_skb(size)))
 171                         goto unlock;
 172         }
 173
 174         nlh = nlmsg_put(ub->skb, 0, ub->qlen, 0,
 175                         size - NLMSG_ALIGN(sizeof(*nlh)), 0);
 176         if (!nlh) {
 177                 kfree_skb(ub->skb);
 178                 ub->skb = NULL;
 179                 goto unlock;
 180         }
 181         ub->qlen++;
 182
 183         pm = nlmsg_data(nlh);
 184         memset(pm, 0, sizeof(*pm));
 185
 186         /* Fill in the ulog data */
 187         pm->version = EBT_ULOG_VERSION;
 188         kt = ktime_get_real();
 189         pm->stamp = ktime_to_timeval(kt);
 190         if (ub->qlen == 1)
 191                 ub->skb->tstamp = kt;
 192         pm->data_len = copy_len;
 193         pm->mark = skb->mark;
 194         pm->hook = hooknr;
 195         if (uloginfo->prefix != NULL)
 196                 strcpy(pm->prefix, uloginfo->prefix);
 197
 198         if (in) {
 199                 strcpy(pm->physindev, in->name);
 200                 /* If in isn't a bridge, then physindev==indev */
 201                 if (br_port_exists(in))
 202                         /* rcu_read_lock()ed by nf_hook_slow */
 203                         strcpy(pm->indev, br_port_get_rcu(in)->br->dev->name);
 204                 else
 205                         strcpy(pm->indev, in->name);
 206         }
 207
 208         if (out) {
 209                 /* If out exists, then out is a bridge port */
 210                 strcpy(pm->physoutdev, out->name);
 211                 /* rcu_read_lock()ed by nf_hook_slow */
 212                 strcpy(pm->outdev, br_port_get_rcu(out)->br->dev->name);
 213         }
 214
 215         if (skb_copy_bits(skb, -ETH_HLEN, pm->data, copy_len) < 0)
 216                 BUG();
 217
 218         if (ub->qlen > 1)
 219                 ub->lastnlh->nlmsg_flags |= NLM_F_MULTI;
 220
 221         ub->lastnlh = nlh;
 222
 223         if (ub->qlen >= uloginfo->qthreshold)
 224                 ulog_send(ebt, group);
 225         else if (!timer_pending(&ub->timer)) {
 226                 ub->timer.expires = jiffies + flushtimeout * HZ / 100;
 227                 add_timer(&ub->timer);
 228         }
 229
 230 unlock:
 231         spin_unlock_bh(lock);
 232 }
 233
 234 /* this function is registered with the netfilter core */
 235 static void ebt_log_packet(struct net *net, u_int8_t pf, unsigned int hooknum,
 236    const struct sk_buff *skb, const struct net_device *in,
 237    const struct net_device *out, const struct nf_loginfo *li,
 238    const char *prefix)
 239 {
 240         struct ebt_ulog_info loginfo;
 241
 242         if (!li || li->type != NF_LOG_TYPE_ULOG) {
 243                 loginfo.nlgroup = EBT_ULOG_DEFAULT_NLGROUP;
 244                 loginfo.cprange = 0;
 245                 loginfo.qthreshold = EBT_ULOG_DEFAULT_QTHRESHOLD;
 246                 loginfo.prefix[0] = '\0';
 247         } else {
 248                 loginfo.nlgroup = li->u.ulog.group;
 249                 loginfo.cprange = li->u.ulog.copy_len;
 250                 loginfo.qthreshold = li->u.ulog.qthreshold;
 251                 strlcpy(loginfo.prefix, prefix, sizeof(loginfo.prefix));
 252         }
 253
 254         ebt_ulog_packet(net, hooknum, skb, in, out, &loginfo, prefix);
 255 }
 256
 257 static unsigned int
 258 ebt_ulog_tg(struct sk_buff *skb, const struct xt_action_param *par)
 259 {
 260         struct net *net = dev_net(par->in ? par->in : par->out);
 261
 262         ebt_ulog_packet(net, par->hooknum, skb, par->in, par->out,
 263                         par->targinfo, NULL);
 264         return EBT_CONTINUE;
 265 }
 266
 267 static int ebt_ulog_tg_check(const struct xt_tgchk_param *par)
 268 {
 269         struct ebt_ulog_info *uloginfo = par->targinfo;
 270
 271         if (!par->net->xt.ebt_ulog_warn_deprecated) {
 272                 pr_info("ebt_ulog is deprecated and it will be removed soon, "
 273                         "use ebt_nflog instead\n");
 274                 par->net->xt.ebt_ulog_warn_deprecated = true;
 275         }
 276
 277         if (uloginfo->nlgroup > 31)
 278                 return -EINVAL;
 279
 280         uloginfo->prefix[EBT_ULOG_PREFIX_LEN - 1] = '\0';
 281
 282         if (uloginfo->qthreshold > EBT_ULOG_MAX_QLEN)
 283                 uloginfo->qthreshold = EBT_ULOG_MAX_QLEN;
 284
 285         return 0;
 286 }
 287
 288 static struct xt_target ebt_ulog_tg_reg __read_mostly = {
 289         .name           = "ulog",
 290         .revision       = 0,
 291         .family         = NFPROTO_BRIDGE,
 292         .target         = ebt_ulog_tg,
 293         .checkentry     = ebt_ulog_tg_check,
 294         .targetsize     = sizeof(struct ebt_ulog_info),
 295         .me             = THIS_MODULE,
 296 };
 297
 298 static struct nf_logger ebt_ulog_logger __read_mostly = {
 299         .name           = "ebt_ulog",
 300         .logfn          = &ebt_log_packet,
 301         .me             = THIS_MODULE,
 302 };
 303
 304 static int __net_init ebt_ulog_net_init(struct net *net)
 305 {
 306         int i;
 307         struct ebt_ulog_net *ebt = ebt_ulog_pernet(net);
 308
 309         struct netlink_kernel_cfg cfg = {
 310                 .groups = EBT_ULOG_MAXNLGROUPS,
 311         };
 312
 313         /* initialize ulog_buffers */
 314         for (i = 0; i < EBT_ULOG_MAXNLGROUPS; i++) {
 315                 ebt->nlgroup[i] = i;
 316                 setup_timer(&ebt->ulog_buffers[i].timer, ulog_timer,
 317                             (unsigned long)&ebt->nlgroup[i]);
 318                 spin_lock_init(&ebt->ulog_buffers[i].lock);
 319         }
 320
 321         ebt->ebtulognl = netlink_kernel_create(net, NETLINK_NFLOG, &cfg);
 322         if (!ebt->ebtulognl)
 323                 return -ENOMEM;
 324
 325         nf_log_set(net, NFPROTO_BRIDGE, &ebt_ulog_logger);
 326         return 0;
 327 }
 328
 329 static void __net_exit ebt_ulog_net_fini(struct net *net)
 330 {
 331         int i;
 332         struct ebt_ulog_net *ebt = ebt_ulog_pernet(net);
 333
 334         nf_log_unset(net, &ebt_ulog_logger);
 335         for (i = 0; i < EBT_ULOG_MAXNLGROUPS; i++) {
 336                 ebt_ulog_buff_t *ub = &ebt->ulog_buffers[i];
 337                 del_timer(&ub->timer);
 338
 339                 if (ub->skb) {
 340                         kfree_skb(ub->skb);
 341                         ub->skb = NULL;
 342                 }
 343         }
 344         netlink_kernel_release(ebt->ebtulognl);
 345 }
 346
 347 static struct pernet_operations ebt_ulog_net_ops = {
 348         .init = ebt_ulog_net_init,
 349         .exit = ebt_ulog_net_fini,
 350         .id   = &ebt_ulog_net_id,
 351         .size = sizeof(struct ebt_ulog_net),
 352 };
 353
 354 static int __init ebt_ulog_init(void)
 355 {
 356         int ret;
 357
 358         if (nlbufsiz >= 128*1024) {
 359                 pr_warn("Netlink buffer has to be <= 128kB,"
 360                         "please try a smaller nlbufsiz parameter.\n");
 361                 return -EINVAL;
 362         }
 363
 364         ret = register_pernet_subsys(&ebt_ulog_net_ops);
 365         if (ret)
 366                 goto out_pernet;
 367
 368         ret = xt_register_target(&ebt_ulog_tg_reg);
 369         if (ret)
 370                 goto out_target;
 371
 372         nf_log_register(NFPROTO_BRIDGE, &ebt_ulog_logger);
 373
 374         return 0;
 375
 376 out_target:
 377         unregister_pernet_subsys(&ebt_ulog_net_ops);
 378 out_pernet:
 379         return ret;
 380 }
 381
 382 static void __exit ebt_ulog_fini(void)
 383 {
 384         nf_log_unregister(&ebt_ulog_logger);
 385         xt_unregister_target(&ebt_ulog_tg_reg);
 386         unregister_pernet_subsys(&ebt_ulog_net_ops);
 387 }
 388
 389 module_init(ebt_ulog_init);
 390 module_exit(ebt_ulog_fini);
 391 MODULE_LICENSE("GPL");
 392 MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
 393 MODULE_DESCRIPTION("Ebtables: Packet logging to netlink using ULOG");