1 // SPDX-License-Identifier: GPL-2.0-only
3 * This is a module which is used for logging packets to userspace via
6 * (C) 2005 by Harald Welte <laforge@netfilter.org>
7 * (C) 2006-2012 Patrick McHardy <kaber@trash.net>
9 * Based on the old ipv4-only ipt_ULOG.c:
10 * (C) 2000-2004 by Harald Welte <laforge@netfilter.org>
13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
15 #include <linux/module.h>
16 #include <linux/skbuff.h>
17 #include <linux/if_arp.h>
18 #include <linux/init.h>
20 #include <linux/ipv6.h>
21 #include <linux/netdevice.h>
22 #include <linux/netfilter.h>
23 #include <linux/netfilter_bridge.h>
24 #include <net/netlink.h>
25 #include <linux/netfilter/nfnetlink.h>
26 #include <linux/netfilter/nfnetlink_log.h>
27 #include <linux/netfilter/nf_conntrack_common.h>
28 #include <linux/spinlock.h>
29 #include <linux/sysctl.h>
30 #include <linux/proc_fs.h>
31 #include <linux/security.h>
32 #include <linux/list.h>
33 #include <linux/slab.h>
35 #include <net/netfilter/nf_log.h>
36 #include <net/netns/generic.h>
38 #include <linux/atomic.h>
39 #include <linux/refcount.h>
42 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
43 #include "../bridge/br_private.h"
46 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
47 #include <net/netfilter/nf_conntrack.h>
50 #define NFULNL_COPY_DISABLED 0xff
51 #define NFULNL_NLBUFSIZ_DEFAULT NLMSG_GOODSIZE
52 #define NFULNL_TIMEOUT_DEFAULT 100 /* every second */
53 #define NFULNL_QTHRESH_DEFAULT 100 /* 100 packets */
54 /* max packet size is limited by 16-bit struct nfattr nfa_len field */
55 #define NFULNL_COPY_RANGE_MAX (0xFFFF - NLA_HDRLEN)
57 #define PRINTR(x, args...) do { if (net_ratelimit()) \
58 printk(x, ## args); } while (0);
60 struct nfulnl_instance
{
61 struct hlist_node hlist
; /* global list of instances */
63 refcount_t use
; /* use count */
65 unsigned int qlen
; /* number of nlmsgs in skb */
66 struct sk_buff
*skb
; /* pre-allocatd skb */
67 struct timer_list timer
;
69 struct user_namespace
*peer_user_ns
; /* User namespace of the peer process */
70 u32 peer_portid
; /* PORTID of the peer process */
72 /* configurable parameters */
73 unsigned int flushtimeout
; /* timeout until queue flush */
74 unsigned int nlbufsiz
; /* netlink buffer allocation size */
75 unsigned int qthreshold
; /* threshold of the queue */
77 u_int32_t seq
; /* instance-local sequential counter */
78 u_int16_t group_num
; /* number of this queue */
84 #define INSTANCE_BUCKETS 16
86 static unsigned int nfnl_log_net_id __read_mostly
;
89 spinlock_t instances_lock
;
90 struct hlist_head instance_table
[INSTANCE_BUCKETS
];
94 static struct nfnl_log_net
*nfnl_log_pernet(struct net
*net
)
96 return net_generic(net
, nfnl_log_net_id
);
99 static inline u_int8_t
instance_hashfn(u_int16_t group_num
)
101 return ((group_num
& 0xff) % INSTANCE_BUCKETS
);
104 static struct nfulnl_instance
*
105 __instance_lookup(struct nfnl_log_net
*log
, u_int16_t group_num
)
107 struct hlist_head
*head
;
108 struct nfulnl_instance
*inst
;
110 head
= &log
->instance_table
[instance_hashfn(group_num
)];
111 hlist_for_each_entry_rcu(inst
, head
, hlist
) {
112 if (inst
->group_num
== group_num
)
119 instance_get(struct nfulnl_instance
*inst
)
121 refcount_inc(&inst
->use
);
124 static struct nfulnl_instance
*
125 instance_lookup_get(struct nfnl_log_net
*log
, u_int16_t group_num
)
127 struct nfulnl_instance
*inst
;
130 inst
= __instance_lookup(log
, group_num
);
131 if (inst
&& !refcount_inc_not_zero(&inst
->use
))
133 rcu_read_unlock_bh();
138 static void nfulnl_instance_free_rcu(struct rcu_head
*head
)
140 struct nfulnl_instance
*inst
=
141 container_of(head
, struct nfulnl_instance
, rcu
);
145 module_put(THIS_MODULE
);
149 instance_put(struct nfulnl_instance
*inst
)
151 if (inst
&& refcount_dec_and_test(&inst
->use
))
152 call_rcu(&inst
->rcu
, nfulnl_instance_free_rcu
);
155 static void nfulnl_timer(struct timer_list
*t
);
157 static struct nfulnl_instance
*
158 instance_create(struct net
*net
, u_int16_t group_num
,
159 u32 portid
, struct user_namespace
*user_ns
)
161 struct nfulnl_instance
*inst
;
162 struct nfnl_log_net
*log
= nfnl_log_pernet(net
);
165 spin_lock_bh(&log
->instances_lock
);
166 if (__instance_lookup(log
, group_num
)) {
171 inst
= kzalloc(sizeof(*inst
), GFP_ATOMIC
);
177 if (!try_module_get(THIS_MODULE
)) {
183 INIT_HLIST_NODE(&inst
->hlist
);
184 spin_lock_init(&inst
->lock
);
185 /* needs to be two, since we _put() after creation */
186 refcount_set(&inst
->use
, 2);
188 timer_setup(&inst
->timer
, nfulnl_timer
, 0);
190 inst
->net
= get_net(net
);
191 inst
->peer_user_ns
= user_ns
;
192 inst
->peer_portid
= portid
;
193 inst
->group_num
= group_num
;
195 inst
->qthreshold
= NFULNL_QTHRESH_DEFAULT
;
196 inst
->flushtimeout
= NFULNL_TIMEOUT_DEFAULT
;
197 inst
->nlbufsiz
= NFULNL_NLBUFSIZ_DEFAULT
;
198 inst
->copy_mode
= NFULNL_COPY_PACKET
;
199 inst
->copy_range
= NFULNL_COPY_RANGE_MAX
;
201 hlist_add_head_rcu(&inst
->hlist
,
202 &log
->instance_table
[instance_hashfn(group_num
)]);
205 spin_unlock_bh(&log
->instances_lock
);
210 spin_unlock_bh(&log
->instances_lock
);
214 static void __nfulnl_flush(struct nfulnl_instance
*inst
);
216 /* called with BH disabled */
218 __instance_destroy(struct nfulnl_instance
*inst
)
220 /* first pull it out of the global list */
221 hlist_del_rcu(&inst
->hlist
);
223 /* then flush all pending packets from skb */
225 spin_lock(&inst
->lock
);
227 /* lockless readers wont be able to use us */
228 inst
->copy_mode
= NFULNL_COPY_DISABLED
;
231 __nfulnl_flush(inst
);
232 spin_unlock(&inst
->lock
);
234 /* and finally put the refcount */
239 instance_destroy(struct nfnl_log_net
*log
,
240 struct nfulnl_instance
*inst
)
242 spin_lock_bh(&log
->instances_lock
);
243 __instance_destroy(inst
);
244 spin_unlock_bh(&log
->instances_lock
);
248 nfulnl_set_mode(struct nfulnl_instance
*inst
, u_int8_t mode
,
253 spin_lock_bh(&inst
->lock
);
256 case NFULNL_COPY_NONE
:
257 case NFULNL_COPY_META
:
258 inst
->copy_mode
= mode
;
259 inst
->copy_range
= 0;
262 case NFULNL_COPY_PACKET
:
263 inst
->copy_mode
= mode
;
265 range
= NFULNL_COPY_RANGE_MAX
;
266 inst
->copy_range
= min_t(unsigned int,
267 range
, NFULNL_COPY_RANGE_MAX
);
275 spin_unlock_bh(&inst
->lock
);
281 nfulnl_set_nlbufsiz(struct nfulnl_instance
*inst
, u_int32_t nlbufsiz
)
285 spin_lock_bh(&inst
->lock
);
286 if (nlbufsiz
< NFULNL_NLBUFSIZ_DEFAULT
)
288 else if (nlbufsiz
> 131072)
291 inst
->nlbufsiz
= nlbufsiz
;
294 spin_unlock_bh(&inst
->lock
);
300 nfulnl_set_timeout(struct nfulnl_instance
*inst
, u_int32_t timeout
)
302 spin_lock_bh(&inst
->lock
);
303 inst
->flushtimeout
= timeout
;
304 spin_unlock_bh(&inst
->lock
);
308 nfulnl_set_qthresh(struct nfulnl_instance
*inst
, u_int32_t qthresh
)
310 spin_lock_bh(&inst
->lock
);
311 inst
->qthreshold
= qthresh
;
312 spin_unlock_bh(&inst
->lock
);
316 nfulnl_set_flags(struct nfulnl_instance
*inst
, u_int16_t flags
)
318 spin_lock_bh(&inst
->lock
);
320 spin_unlock_bh(&inst
->lock
);
325 static struct sk_buff
*
326 nfulnl_alloc_skb(struct net
*net
, u32 peer_portid
, unsigned int inst_size
,
327 unsigned int pkt_size
)
332 /* alloc skb which should be big enough for a whole multipart
333 * message. WARNING: has to be <= 128k due to slab restrictions */
335 n
= max(inst_size
, pkt_size
);
336 skb
= alloc_skb(n
, GFP_ATOMIC
| __GFP_NOWARN
);
339 /* try to allocate only as much as we need for current
342 skb
= alloc_skb(pkt_size
, GFP_ATOMIC
);
350 __nfulnl_send(struct nfulnl_instance
*inst
)
352 if (inst
->qlen
> 1) {
353 struct nlmsghdr
*nlh
= nlmsg_put(inst
->skb
, 0, 0,
355 sizeof(struct nfgenmsg
),
357 if (WARN_ONCE(!nlh
, "bad nlskb size: %u, tailroom %d\n",
358 inst
->skb
->len
, skb_tailroom(inst
->skb
))) {
359 kfree_skb(inst
->skb
);
363 nfnetlink_unicast(inst
->skb
, inst
->net
, inst
->peer_portid
);
370 __nfulnl_flush(struct nfulnl_instance
*inst
)
372 /* timer holds a reference */
373 if (del_timer(&inst
->timer
))
380 nfulnl_timer(struct timer_list
*t
)
382 struct nfulnl_instance
*inst
= from_timer(inst
, t
, timer
);
384 spin_lock_bh(&inst
->lock
);
387 spin_unlock_bh(&inst
->lock
);
391 static u32
nfulnl_get_bridge_size(const struct sk_buff
*skb
)
395 if (!skb_mac_header_was_set(skb
))
398 if (skb_vlan_tag_present(skb
)) {
399 size
+= nla_total_size(0); /* nested */
400 size
+= nla_total_size(sizeof(u16
)); /* id */
401 size
+= nla_total_size(sizeof(u16
)); /* tag */
404 if (skb
->network_header
> skb
->mac_header
)
405 size
+= nla_total_size(skb
->network_header
- skb
->mac_header
);
410 static int nfulnl_put_bridge(struct nfulnl_instance
*inst
, const struct sk_buff
*skb
)
412 if (!skb_mac_header_was_set(skb
))
415 if (skb_vlan_tag_present(skb
)) {
418 nest
= nla_nest_start(inst
->skb
, NFULA_VLAN
);
420 goto nla_put_failure
;
422 if (nla_put_be16(inst
->skb
, NFULA_VLAN_TCI
, htons(skb
->vlan_tci
)) ||
423 nla_put_be16(inst
->skb
, NFULA_VLAN_PROTO
, skb
->vlan_proto
))
424 goto nla_put_failure
;
426 nla_nest_end(inst
->skb
, nest
);
429 if (skb
->mac_header
< skb
->network_header
) {
430 int len
= (int)(skb
->network_header
- skb
->mac_header
);
432 if (nla_put(inst
->skb
, NFULA_L2HDR
, len
, skb_mac_header(skb
)))
433 goto nla_put_failure
;
442 /* This is an inline function, we don't really care about a long
443 * list of arguments */
445 __build_packet_message(struct nfnl_log_net
*log
,
446 struct nfulnl_instance
*inst
,
447 const struct sk_buff
*skb
,
448 unsigned int data_len
,
450 unsigned int hooknum
,
451 const struct net_device
*indev
,
452 const struct net_device
*outdev
,
453 const char *prefix
, unsigned int plen
,
454 const struct nfnl_ct_hook
*nfnl_ct
,
455 struct nf_conn
*ct
, enum ip_conntrack_info ctinfo
)
457 struct nfulnl_msg_packet_hdr pmsg
;
458 struct nlmsghdr
*nlh
;
459 sk_buff_data_t old_tail
= inst
->skb
->tail
;
461 const unsigned char *hwhdrp
;
463 nlh
= nfnl_msg_put(inst
->skb
, 0, 0,
464 nfnl_msg_type(NFNL_SUBSYS_ULOG
, NFULNL_MSG_PACKET
),
465 0, pf
, NFNETLINK_V0
, htons(inst
->group_num
));
469 memset(&pmsg
, 0, sizeof(pmsg
));
470 pmsg
.hw_protocol
= skb
->protocol
;
473 if (nla_put(inst
->skb
, NFULA_PACKET_HDR
, sizeof(pmsg
), &pmsg
))
474 goto nla_put_failure
;
477 nla_put(inst
->skb
, NFULA_PREFIX
, plen
, prefix
))
478 goto nla_put_failure
;
481 #if !IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
482 if (nla_put_be32(inst
->skb
, NFULA_IFINDEX_INDEV
,
483 htonl(indev
->ifindex
)))
484 goto nla_put_failure
;
486 if (pf
== PF_BRIDGE
) {
487 /* Case 1: outdev is physical input device, we need to
488 * look for bridge group (when called from
489 * netfilter_bridge) */
490 if (nla_put_be32(inst
->skb
, NFULA_IFINDEX_PHYSINDEV
,
491 htonl(indev
->ifindex
)) ||
492 /* this is the bridge group "brX" */
493 /* rcu_read_lock()ed by nf_hook_thresh or
496 nla_put_be32(inst
->skb
, NFULA_IFINDEX_INDEV
,
497 htonl(br_port_get_rcu(indev
)->br
->dev
->ifindex
)))
498 goto nla_put_failure
;
500 struct net_device
*physindev
;
502 /* Case 2: indev is bridge group, we need to look for
503 * physical device (when called from ipv4) */
504 if (nla_put_be32(inst
->skb
, NFULA_IFINDEX_INDEV
,
505 htonl(indev
->ifindex
)))
506 goto nla_put_failure
;
508 physindev
= nf_bridge_get_physindev(skb
);
510 nla_put_be32(inst
->skb
, NFULA_IFINDEX_PHYSINDEV
,
511 htonl(physindev
->ifindex
)))
512 goto nla_put_failure
;
518 #if !IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
519 if (nla_put_be32(inst
->skb
, NFULA_IFINDEX_OUTDEV
,
520 htonl(outdev
->ifindex
)))
521 goto nla_put_failure
;
523 if (pf
== PF_BRIDGE
) {
524 /* Case 1: outdev is physical output device, we need to
525 * look for bridge group (when called from
526 * netfilter_bridge) */
527 if (nla_put_be32(inst
->skb
, NFULA_IFINDEX_PHYSOUTDEV
,
528 htonl(outdev
->ifindex
)) ||
529 /* this is the bridge group "brX" */
530 /* rcu_read_lock()ed by nf_hook_thresh or
533 nla_put_be32(inst
->skb
, NFULA_IFINDEX_OUTDEV
,
534 htonl(br_port_get_rcu(outdev
)->br
->dev
->ifindex
)))
535 goto nla_put_failure
;
537 struct net_device
*physoutdev
;
539 /* Case 2: indev is a bridge group, we need to look
540 * for physical device (when called from ipv4) */
541 if (nla_put_be32(inst
->skb
, NFULA_IFINDEX_OUTDEV
,
542 htonl(outdev
->ifindex
)))
543 goto nla_put_failure
;
545 physoutdev
= nf_bridge_get_physoutdev(skb
);
547 nla_put_be32(inst
->skb
, NFULA_IFINDEX_PHYSOUTDEV
,
548 htonl(physoutdev
->ifindex
)))
549 goto nla_put_failure
;
555 nla_put_be32(inst
->skb
, NFULA_MARK
, htonl(skb
->mark
)))
556 goto nla_put_failure
;
558 if (indev
&& skb
->dev
&&
559 skb
->mac_header
!= skb
->network_header
) {
560 struct nfulnl_msg_packet_hw phw
;
563 memset(&phw
, 0, sizeof(phw
));
564 len
= dev_parse_header(skb
, phw
.hw_addr
);
566 phw
.hw_addrlen
= htons(len
);
567 if (nla_put(inst
->skb
, NFULA_HWADDR
, sizeof(phw
), &phw
))
568 goto nla_put_failure
;
572 if (indev
&& skb_mac_header_was_set(skb
)) {
573 if (nla_put_be16(inst
->skb
, NFULA_HWTYPE
, htons(skb
->dev
->type
)) ||
574 nla_put_be16(inst
->skb
, NFULA_HWLEN
,
575 htons(skb
->dev
->hard_header_len
)))
576 goto nla_put_failure
;
578 hwhdrp
= skb_mac_header(skb
);
580 if (skb
->dev
->type
== ARPHRD_SIT
)
583 if (hwhdrp
>= skb
->head
&&
584 nla_put(inst
->skb
, NFULA_HWHEADER
,
585 skb
->dev
->hard_header_len
, hwhdrp
))
586 goto nla_put_failure
;
589 if (hooknum
<= NF_INET_FORWARD
&& skb
->tstamp
) {
590 struct nfulnl_msg_packet_timestamp ts
;
591 struct timespec64 kts
= ktime_to_timespec64(skb
->tstamp
);
592 ts
.sec
= cpu_to_be64(kts
.tv_sec
);
593 ts
.usec
= cpu_to_be64(kts
.tv_nsec
/ NSEC_PER_USEC
);
595 if (nla_put(inst
->skb
, NFULA_TIMESTAMP
, sizeof(ts
), &ts
))
596 goto nla_put_failure
;
601 if (sk
&& sk_fullsock(sk
)) {
602 read_lock_bh(&sk
->sk_callback_lock
);
603 if (sk
->sk_socket
&& sk
->sk_socket
->file
) {
604 struct file
*file
= sk
->sk_socket
->file
;
605 const struct cred
*cred
= file
->f_cred
;
606 struct user_namespace
*user_ns
= inst
->peer_user_ns
;
607 __be32 uid
= htonl(from_kuid_munged(user_ns
, cred
->fsuid
));
608 __be32 gid
= htonl(from_kgid_munged(user_ns
, cred
->fsgid
));
609 read_unlock_bh(&sk
->sk_callback_lock
);
610 if (nla_put_be32(inst
->skb
, NFULA_UID
, uid
) ||
611 nla_put_be32(inst
->skb
, NFULA_GID
, gid
))
612 goto nla_put_failure
;
614 read_unlock_bh(&sk
->sk_callback_lock
);
617 /* local sequence number */
618 if ((inst
->flags
& NFULNL_CFG_F_SEQ
) &&
619 nla_put_be32(inst
->skb
, NFULA_SEQ
, htonl(inst
->seq
++)))
620 goto nla_put_failure
;
622 /* global sequence number */
623 if ((inst
->flags
& NFULNL_CFG_F_SEQ_GLOBAL
) &&
624 nla_put_be32(inst
->skb
, NFULA_SEQ_GLOBAL
,
625 htonl(atomic_inc_return(&log
->global_seq
))))
626 goto nla_put_failure
;
628 if (ct
&& nfnl_ct
->build(inst
->skb
, ct
, ctinfo
,
629 NFULA_CT
, NFULA_CT_INFO
) < 0)
630 goto nla_put_failure
;
632 if ((pf
== NFPROTO_NETDEV
|| pf
== NFPROTO_BRIDGE
) &&
633 nfulnl_put_bridge(inst
, skb
) < 0)
634 goto nla_put_failure
;
638 int size
= nla_attr_size(data_len
);
640 if (skb_tailroom(inst
->skb
) < nla_total_size(data_len
))
641 goto nla_put_failure
;
643 nla
= skb_put(inst
->skb
, nla_total_size(data_len
));
644 nla
->nla_type
= NFULA_PAYLOAD
;
647 if (skb_copy_bits(skb
, 0, nla_data(nla
), data_len
))
651 nlh
->nlmsg_len
= inst
->skb
->tail
- old_tail
;
655 PRINTR(KERN_ERR
"nfnetlink_log: error creating log nlmsg\n");
659 static const struct nf_loginfo default_loginfo
= {
660 .type
= NF_LOG_TYPE_ULOG
,
670 /* log handler for internal netfilter logging api */
672 nfulnl_log_packet(struct net
*net
,
674 unsigned int hooknum
,
675 const struct sk_buff
*skb
,
676 const struct net_device
*in
,
677 const struct net_device
*out
,
678 const struct nf_loginfo
*li_user
,
682 unsigned int data_len
;
683 struct nfulnl_instance
*inst
;
684 const struct nf_loginfo
*li
;
685 unsigned int qthreshold
;
686 unsigned int plen
= 0;
687 struct nfnl_log_net
*log
= nfnl_log_pernet(net
);
688 const struct nfnl_ct_hook
*nfnl_ct
= NULL
;
689 struct nf_conn
*ct
= NULL
;
690 enum ip_conntrack_info ctinfo
;
692 if (li_user
&& li_user
->type
== NF_LOG_TYPE_ULOG
)
695 li
= &default_loginfo
;
697 inst
= instance_lookup_get(log
, li
->u
.ulog
.group
);
702 plen
= strlen(prefix
) + 1;
704 /* FIXME: do we want to make the size calculation conditional based on
705 * what is actually present? way more branches and checks, but more
706 * memory efficient... */
707 size
= nlmsg_total_size(sizeof(struct nfgenmsg
))
708 + nla_total_size(sizeof(struct nfulnl_msg_packet_hdr
))
709 + nla_total_size(sizeof(u_int32_t
)) /* ifindex */
710 + nla_total_size(sizeof(u_int32_t
)) /* ifindex */
711 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
712 + nla_total_size(sizeof(u_int32_t
)) /* ifindex */
713 + nla_total_size(sizeof(u_int32_t
)) /* ifindex */
715 + nla_total_size(sizeof(u_int32_t
)) /* mark */
716 + nla_total_size(sizeof(u_int32_t
)) /* uid */
717 + nla_total_size(sizeof(u_int32_t
)) /* gid */
718 + nla_total_size(plen
) /* prefix */
719 + nla_total_size(sizeof(struct nfulnl_msg_packet_hw
))
720 + nla_total_size(sizeof(struct nfulnl_msg_packet_timestamp
))
721 + nla_total_size(sizeof(struct nfgenmsg
)); /* NLMSG_DONE */
723 if (in
&& skb_mac_header_was_set(skb
)) {
724 size
+= nla_total_size(skb
->dev
->hard_header_len
)
725 + nla_total_size(sizeof(u_int16_t
)) /* hwtype */
726 + nla_total_size(sizeof(u_int16_t
)); /* hwlen */
729 spin_lock_bh(&inst
->lock
);
731 if (inst
->flags
& NFULNL_CFG_F_SEQ
)
732 size
+= nla_total_size(sizeof(u_int32_t
));
733 if (inst
->flags
& NFULNL_CFG_F_SEQ_GLOBAL
)
734 size
+= nla_total_size(sizeof(u_int32_t
));
735 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
736 if (inst
->flags
& NFULNL_CFG_F_CONNTRACK
) {
737 nfnl_ct
= rcu_dereference(nfnl_ct_hook
);
738 if (nfnl_ct
!= NULL
) {
739 ct
= nf_ct_get(skb
, &ctinfo
);
741 size
+= nfnl_ct
->build_size(ct
);
745 if (pf
== NFPROTO_NETDEV
|| pf
== NFPROTO_BRIDGE
)
746 size
+= nfulnl_get_bridge_size(skb
);
748 qthreshold
= inst
->qthreshold
;
749 /* per-rule qthreshold overrides per-instance */
750 if (li
->u
.ulog
.qthreshold
)
751 if (qthreshold
> li
->u
.ulog
.qthreshold
)
752 qthreshold
= li
->u
.ulog
.qthreshold
;
755 switch (inst
->copy_mode
) {
756 case NFULNL_COPY_META
:
757 case NFULNL_COPY_NONE
:
761 case NFULNL_COPY_PACKET
:
762 data_len
= inst
->copy_range
;
763 if ((li
->u
.ulog
.flags
& NF_LOG_F_COPY_LEN
) &&
764 (li
->u
.ulog
.copy_len
< data_len
))
765 data_len
= li
->u
.ulog
.copy_len
;
767 if (data_len
> skb
->len
)
770 size
+= nla_total_size(data_len
);
773 case NFULNL_COPY_DISABLED
:
775 goto unlock_and_release
;
778 if (inst
->skb
&& size
> skb_tailroom(inst
->skb
)) {
779 /* either the queue len is too high or we don't have
780 * enough room in the skb left. flush to userspace. */
781 __nfulnl_flush(inst
);
785 inst
->skb
= nfulnl_alloc_skb(net
, inst
->peer_portid
,
786 inst
->nlbufsiz
, size
);
793 __build_packet_message(log
, inst
, skb
, data_len
, pf
,
794 hooknum
, in
, out
, prefix
, plen
,
795 nfnl_ct
, ct
, ctinfo
);
797 if (inst
->qlen
>= qthreshold
)
798 __nfulnl_flush(inst
);
799 /* timer_pending always called within inst->lock, so there
800 * is no chance of a race here */
801 else if (!timer_pending(&inst
->timer
)) {
803 inst
->timer
.expires
= jiffies
+ (inst
->flushtimeout
*HZ
/100);
804 add_timer(&inst
->timer
);
808 spin_unlock_bh(&inst
->lock
);
813 /* FIXME: statistics */
814 goto unlock_and_release
;
818 nfulnl_rcv_nl_event(struct notifier_block
*this,
819 unsigned long event
, void *ptr
)
821 struct netlink_notify
*n
= ptr
;
822 struct nfnl_log_net
*log
= nfnl_log_pernet(n
->net
);
824 if (event
== NETLINK_URELEASE
&& n
->protocol
== NETLINK_NETFILTER
) {
827 /* destroy all instances for this portid */
828 spin_lock_bh(&log
->instances_lock
);
829 for (i
= 0; i
< INSTANCE_BUCKETS
; i
++) {
830 struct hlist_node
*t2
;
831 struct nfulnl_instance
*inst
;
832 struct hlist_head
*head
= &log
->instance_table
[i
];
834 hlist_for_each_entry_safe(inst
, t2
, head
, hlist
) {
835 if (n
->portid
== inst
->peer_portid
)
836 __instance_destroy(inst
);
839 spin_unlock_bh(&log
->instances_lock
);
844 static struct notifier_block nfulnl_rtnl_notifier
= {
845 .notifier_call
= nfulnl_rcv_nl_event
,
848 static int nfulnl_recv_unsupp(struct net
*net
, struct sock
*ctnl
,
849 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
850 const struct nlattr
* const nfqa
[],
851 struct netlink_ext_ack
*extack
)
856 static struct nf_logger nfulnl_logger __read_mostly
= {
857 .name
= "nfnetlink_log",
858 .type
= NF_LOG_TYPE_ULOG
,
859 .logfn
= nfulnl_log_packet
,
863 static const struct nla_policy nfula_cfg_policy
[NFULA_CFG_MAX
+1] = {
864 [NFULA_CFG_CMD
] = { .len
= sizeof(struct nfulnl_msg_config_cmd
) },
865 [NFULA_CFG_MODE
] = { .len
= sizeof(struct nfulnl_msg_config_mode
) },
866 [NFULA_CFG_TIMEOUT
] = { .type
= NLA_U32
},
867 [NFULA_CFG_QTHRESH
] = { .type
= NLA_U32
},
868 [NFULA_CFG_NLBUFSIZ
] = { .type
= NLA_U32
},
869 [NFULA_CFG_FLAGS
] = { .type
= NLA_U16
},
872 static int nfulnl_recv_config(struct net
*net
, struct sock
*ctnl
,
873 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
874 const struct nlattr
* const nfula
[],
875 struct netlink_ext_ack
*extack
)
877 struct nfgenmsg
*nfmsg
= nlmsg_data(nlh
);
878 u_int16_t group_num
= ntohs(nfmsg
->res_id
);
879 struct nfulnl_instance
*inst
;
880 struct nfulnl_msg_config_cmd
*cmd
= NULL
;
881 struct nfnl_log_net
*log
= nfnl_log_pernet(net
);
885 if (nfula
[NFULA_CFG_CMD
]) {
886 u_int8_t pf
= nfmsg
->nfgen_family
;
887 cmd
= nla_data(nfula
[NFULA_CFG_CMD
]);
889 /* Commands without queue context */
890 switch (cmd
->command
) {
891 case NFULNL_CFG_CMD_PF_BIND
:
892 return nf_log_bind_pf(net
, pf
, &nfulnl_logger
);
893 case NFULNL_CFG_CMD_PF_UNBIND
:
894 nf_log_unbind_pf(net
, pf
);
899 inst
= instance_lookup_get(log
, group_num
);
900 if (inst
&& inst
->peer_portid
!= NETLINK_CB(skb
).portid
) {
905 /* Check if we support these flags in first place, dependencies should
906 * be there too not to break atomicity.
908 if (nfula
[NFULA_CFG_FLAGS
]) {
909 flags
= ntohs(nla_get_be16(nfula
[NFULA_CFG_FLAGS
]));
911 if ((flags
& NFULNL_CFG_F_CONNTRACK
) &&
912 !rcu_access_pointer(nfnl_ct_hook
)) {
913 #ifdef CONFIG_MODULES
914 nfnl_unlock(NFNL_SUBSYS_ULOG
);
915 request_module("ip_conntrack_netlink");
916 nfnl_lock(NFNL_SUBSYS_ULOG
);
917 if (rcu_access_pointer(nfnl_ct_hook
)) {
928 switch (cmd
->command
) {
929 case NFULNL_CFG_CMD_BIND
:
935 inst
= instance_create(net
, group_num
,
936 NETLINK_CB(skb
).portid
,
937 sk_user_ns(NETLINK_CB(skb
).sk
));
943 case NFULNL_CFG_CMD_UNBIND
:
949 instance_destroy(log
, inst
);
960 if (nfula
[NFULA_CFG_MODE
]) {
961 struct nfulnl_msg_config_mode
*params
=
962 nla_data(nfula
[NFULA_CFG_MODE
]);
964 nfulnl_set_mode(inst
, params
->copy_mode
,
965 ntohl(params
->copy_range
));
968 if (nfula
[NFULA_CFG_TIMEOUT
]) {
969 __be32 timeout
= nla_get_be32(nfula
[NFULA_CFG_TIMEOUT
]);
971 nfulnl_set_timeout(inst
, ntohl(timeout
));
974 if (nfula
[NFULA_CFG_NLBUFSIZ
]) {
975 __be32 nlbufsiz
= nla_get_be32(nfula
[NFULA_CFG_NLBUFSIZ
]);
977 nfulnl_set_nlbufsiz(inst
, ntohl(nlbufsiz
));
980 if (nfula
[NFULA_CFG_QTHRESH
]) {
981 __be32 qthresh
= nla_get_be32(nfula
[NFULA_CFG_QTHRESH
]);
983 nfulnl_set_qthresh(inst
, ntohl(qthresh
));
986 if (nfula
[NFULA_CFG_FLAGS
])
987 nfulnl_set_flags(inst
, flags
);
995 static const struct nfnl_callback nfulnl_cb
[NFULNL_MSG_MAX
] = {
996 [NFULNL_MSG_PACKET
] = { .call
= nfulnl_recv_unsupp
,
997 .attr_count
= NFULA_MAX
, },
998 [NFULNL_MSG_CONFIG
] = { .call
= nfulnl_recv_config
,
999 .attr_count
= NFULA_CFG_MAX
,
1000 .policy
= nfula_cfg_policy
},
1003 static const struct nfnetlink_subsystem nfulnl_subsys
= {
1005 .subsys_id
= NFNL_SUBSYS_ULOG
,
1006 .cb_count
= NFULNL_MSG_MAX
,
1010 #ifdef CONFIG_PROC_FS
1012 struct seq_net_private p
;
1013 unsigned int bucket
;
1016 static struct hlist_node
*get_first(struct net
*net
, struct iter_state
*st
)
1018 struct nfnl_log_net
*log
;
1022 log
= nfnl_log_pernet(net
);
1024 for (st
->bucket
= 0; st
->bucket
< INSTANCE_BUCKETS
; st
->bucket
++) {
1025 struct hlist_head
*head
= &log
->instance_table
[st
->bucket
];
1027 if (!hlist_empty(head
))
1028 return rcu_dereference_bh(hlist_first_rcu(head
));
1033 static struct hlist_node
*get_next(struct net
*net
, struct iter_state
*st
,
1034 struct hlist_node
*h
)
1036 h
= rcu_dereference_bh(hlist_next_rcu(h
));
1038 struct nfnl_log_net
*log
;
1039 struct hlist_head
*head
;
1041 if (++st
->bucket
>= INSTANCE_BUCKETS
)
1044 log
= nfnl_log_pernet(net
);
1045 head
= &log
->instance_table
[st
->bucket
];
1046 h
= rcu_dereference_bh(hlist_first_rcu(head
));
1051 static struct hlist_node
*get_idx(struct net
*net
, struct iter_state
*st
,
1054 struct hlist_node
*head
;
1055 head
= get_first(net
, st
);
1058 while (pos
&& (head
= get_next(net
, st
, head
)))
1060 return pos
? NULL
: head
;
1063 static void *seq_start(struct seq_file
*s
, loff_t
*pos
)
1067 return get_idx(seq_file_net(s
), s
->private, *pos
);
1070 static void *seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
1073 return get_next(seq_file_net(s
), s
->private, v
);
1076 static void seq_stop(struct seq_file
*s
, void *v
)
1079 rcu_read_unlock_bh();
1082 static int seq_show(struct seq_file
*s
, void *v
)
1084 const struct nfulnl_instance
*inst
= v
;
1086 seq_printf(s
, "%5u %6u %5u %1u %5u %6u %2u\n",
1088 inst
->peer_portid
, inst
->qlen
,
1089 inst
->copy_mode
, inst
->copy_range
,
1090 inst
->flushtimeout
, refcount_read(&inst
->use
));
1095 static const struct seq_operations nful_seq_ops
= {
1101 #endif /* PROC_FS */
1103 static int __net_init
nfnl_log_net_init(struct net
*net
)
1106 struct nfnl_log_net
*log
= nfnl_log_pernet(net
);
1107 #ifdef CONFIG_PROC_FS
1108 struct proc_dir_entry
*proc
;
1113 for (i
= 0; i
< INSTANCE_BUCKETS
; i
++)
1114 INIT_HLIST_HEAD(&log
->instance_table
[i
]);
1115 spin_lock_init(&log
->instances_lock
);
1117 #ifdef CONFIG_PROC_FS
1118 proc
= proc_create_net("nfnetlink_log", 0440, net
->nf
.proc_netfilter
,
1119 &nful_seq_ops
, sizeof(struct iter_state
));
1123 root_uid
= make_kuid(net
->user_ns
, 0);
1124 root_gid
= make_kgid(net
->user_ns
, 0);
1125 if (uid_valid(root_uid
) && gid_valid(root_gid
))
1126 proc_set_user(proc
, root_uid
, root_gid
);
1131 static void __net_exit
nfnl_log_net_exit(struct net
*net
)
1133 struct nfnl_log_net
*log
= nfnl_log_pernet(net
);
1136 #ifdef CONFIG_PROC_FS
1137 remove_proc_entry("nfnetlink_log", net
->nf
.proc_netfilter
);
1139 nf_log_unset(net
, &nfulnl_logger
);
1140 for (i
= 0; i
< INSTANCE_BUCKETS
; i
++)
1141 WARN_ON_ONCE(!hlist_empty(&log
->instance_table
[i
]));
1144 static struct pernet_operations nfnl_log_net_ops
= {
1145 .init
= nfnl_log_net_init
,
1146 .exit
= nfnl_log_net_exit
,
1147 .id
= &nfnl_log_net_id
,
1148 .size
= sizeof(struct nfnl_log_net
),
1151 static int __init
nfnetlink_log_init(void)
1155 status
= register_pernet_subsys(&nfnl_log_net_ops
);
1157 pr_err("failed to register pernet ops\n");
1161 netlink_register_notifier(&nfulnl_rtnl_notifier
);
1162 status
= nfnetlink_subsys_register(&nfulnl_subsys
);
1164 pr_err("failed to create netlink socket\n");
1165 goto cleanup_netlink_notifier
;
1168 status
= nf_log_register(NFPROTO_UNSPEC
, &nfulnl_logger
);
1170 pr_err("failed to register logger\n");
1171 goto cleanup_subsys
;
1177 nfnetlink_subsys_unregister(&nfulnl_subsys
);
1178 cleanup_netlink_notifier
:
1179 netlink_unregister_notifier(&nfulnl_rtnl_notifier
);
1180 unregister_pernet_subsys(&nfnl_log_net_ops
);
1185 static void __exit
nfnetlink_log_fini(void)
1187 nfnetlink_subsys_unregister(&nfulnl_subsys
);
1188 netlink_unregister_notifier(&nfulnl_rtnl_notifier
);
1189 unregister_pernet_subsys(&nfnl_log_net_ops
);
1190 nf_log_unregister(&nfulnl_logger
);
1193 MODULE_DESCRIPTION("netfilter userspace logging");
1194 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
1195 MODULE_LICENSE("GPL");
1196 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_ULOG
);
1197 MODULE_ALIAS_NF_LOGGER(AF_INET
, 1);
1198 MODULE_ALIAS_NF_LOGGER(AF_INET6
, 1);
1199 MODULE_ALIAS_NF_LOGGER(AF_BRIDGE
, 1);
1200 MODULE_ALIAS_NF_LOGGER(3, 1); /* NFPROTO_ARP */
1201 MODULE_ALIAS_NF_LOGGER(5, 1); /* NFPROTO_NETDEV */
1203 module_init(nfnetlink_log_init
);
1204 module_exit(nfnetlink_log_fini
);