1 #include <linux/kernel.h>
2 #include <linux/init.h>
3 #include <linux/module.h>
4 #include <linux/proc_fs.h>
5 #include <linux/skbuff.h>
6 #include <linux/netfilter.h>
7 #include <linux/seq_file.h>
8 #include <linux/rcupdate.h>
9 #include <net/protocol.h>
10 #include <net/netfilter/nf_queue.h>
12 #include "nf_internals.h"
15 * A queue handler may be registered for each protocol. Each is protected by
16 * long term mutex. The handler must provide an an outfn() to accept packets
17 * for queueing and must reinject all packets it receives, no matter what.
19 static const struct nf_queue_handler
*queue_handler
[NPROTO
];
21 static DEFINE_MUTEX(queue_handler_mutex
);
23 /* return EBUSY when somebody else is registered, return EEXIST if the
24 * same handler is registered, return 0 in case of success. */
25 int nf_register_queue_handler(int pf
, const struct nf_queue_handler
*qh
)
32 mutex_lock(&queue_handler_mutex
);
33 if (queue_handler
[pf
] == qh
)
35 else if (queue_handler
[pf
])
38 rcu_assign_pointer(queue_handler
[pf
], qh
);
41 mutex_unlock(&queue_handler_mutex
);
45 EXPORT_SYMBOL(nf_register_queue_handler
);
47 /* The caller must flush their queue before this */
48 int nf_unregister_queue_handler(int pf
, const struct nf_queue_handler
*qh
)
53 mutex_lock(&queue_handler_mutex
);
54 if (queue_handler
[pf
] != qh
) {
55 mutex_unlock(&queue_handler_mutex
);
59 rcu_assign_pointer(queue_handler
[pf
], NULL
);
60 mutex_unlock(&queue_handler_mutex
);
66 EXPORT_SYMBOL(nf_unregister_queue_handler
);
68 void nf_unregister_queue_handlers(const struct nf_queue_handler
*qh
)
72 mutex_lock(&queue_handler_mutex
);
73 for (pf
= 0; pf
< NPROTO
; pf
++) {
74 if (queue_handler
[pf
] == qh
)
75 rcu_assign_pointer(queue_handler
[pf
], NULL
);
77 mutex_unlock(&queue_handler_mutex
);
81 EXPORT_SYMBOL_GPL(nf_unregister_queue_handlers
);
84 * Any packet that leaves via this function must come back
85 * through nf_reinject().
87 static int __nf_queue(struct sk_buff
*skb
,
88 struct list_head
*elem
,
89 int pf
, unsigned int hook
,
90 struct net_device
*indev
,
91 struct net_device
*outdev
,
92 int (*okfn
)(struct sk_buff
*),
93 unsigned int queuenum
)
97 #ifdef CONFIG_BRIDGE_NETFILTER
98 struct net_device
*physindev
= NULL
;
99 struct net_device
*physoutdev
= NULL
;
101 struct nf_afinfo
*afinfo
;
102 const struct nf_queue_handler
*qh
;
104 /* QUEUE == DROP if noone is waiting, to be safe. */
107 qh
= rcu_dereference(queue_handler
[pf
]);
114 afinfo
= nf_get_afinfo(pf
);
121 info
= kmalloc(sizeof(*info
) + afinfo
->route_key_size
, GFP_ATOMIC
);
124 printk(KERN_ERR
"OOM queueing packet %p\n",
131 *info
= (struct nf_info
) {
132 (struct nf_hook_ops
*)elem
, pf
, hook
, indev
, outdev
, okfn
};
134 /* If it's going away, ignore hook. */
135 if (!try_module_get(info
->elem
->owner
)) {
141 /* Bump dev refs so they don't vanish while packet is out */
146 #ifdef CONFIG_BRIDGE_NETFILTER
147 if (skb
->nf_bridge
) {
148 physindev
= skb
->nf_bridge
->physindev
;
151 physoutdev
= skb
->nf_bridge
->physoutdev
;
153 dev_hold(physoutdev
);
156 afinfo
->saveroute(skb
, info
);
157 status
= qh
->outfn(skb
, info
, queuenum
);
162 /* James M doesn't say fuck enough. */
167 #ifdef CONFIG_BRIDGE_NETFILTER
173 module_put(info
->elem
->owner
);
183 int nf_queue(struct sk_buff
*skb
,
184 struct list_head
*elem
,
185 int pf
, unsigned int hook
,
186 struct net_device
*indev
,
187 struct net_device
*outdev
,
188 int (*okfn
)(struct sk_buff
*),
189 unsigned int queuenum
)
191 struct sk_buff
*segs
;
193 if (!skb_is_gso(skb
))
194 return __nf_queue(skb
, elem
, pf
, hook
, indev
, outdev
, okfn
,
199 skb
->protocol
= htons(ETH_P_IP
);
202 skb
->protocol
= htons(ETH_P_IPV6
);
206 segs
= skb_gso_segment(skb
, 0);
208 if (unlikely(IS_ERR(segs
)))
212 struct sk_buff
*nskb
= segs
->next
;
215 if (!__nf_queue(segs
, elem
, pf
, hook
, indev
, outdev
, okfn
,
223 void nf_reinject(struct sk_buff
*skb
, struct nf_info
*info
,
224 unsigned int verdict
)
226 struct list_head
*elem
= &info
->elem
->list
;
227 struct nf_afinfo
*afinfo
;
231 /* Release those devices we held, or Alexey will kill me. */
233 dev_put(info
->indev
);
235 dev_put(info
->outdev
);
236 #ifdef CONFIG_BRIDGE_NETFILTER
237 if (skb
->nf_bridge
) {
238 if (skb
->nf_bridge
->physindev
)
239 dev_put(skb
->nf_bridge
->physindev
);
240 if (skb
->nf_bridge
->physoutdev
)
241 dev_put(skb
->nf_bridge
->physoutdev
);
245 /* Drop reference to owner of hook which queued us. */
246 module_put(info
->elem
->owner
);
248 /* Continue traversal iff userspace said ok... */
249 if (verdict
== NF_REPEAT
) {
254 if (verdict
== NF_ACCEPT
) {
255 afinfo
= nf_get_afinfo(info
->pf
);
256 if (!afinfo
|| afinfo
->reroute(skb
, info
) < 0)
260 if (verdict
== NF_ACCEPT
) {
262 verdict
= nf_iterate(&nf_hooks
[info
->pf
][info
->hook
],
264 info
->indev
, info
->outdev
, &elem
,
265 info
->okfn
, INT_MIN
);
268 switch (verdict
& NF_VERDICT_MASK
) {
275 if (!__nf_queue(skb
, elem
, info
->pf
, info
->hook
,
276 info
->indev
, info
->outdev
, info
->okfn
,
277 verdict
>> NF_VERDICT_BITS
))
287 EXPORT_SYMBOL(nf_reinject
);
289 #ifdef CONFIG_PROC_FS
290 static void *seq_start(struct seq_file
*seq
, loff_t
*pos
)
298 static void *seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
308 static void seq_stop(struct seq_file
*s
, void *v
)
313 static int seq_show(struct seq_file
*s
, void *v
)
317 const struct nf_queue_handler
*qh
;
320 qh
= rcu_dereference(queue_handler
[*pos
]);
322 ret
= seq_printf(s
, "%2lld NONE\n", *pos
);
324 ret
= seq_printf(s
, "%2lld %s\n", *pos
, qh
->name
);
330 static const struct seq_operations nfqueue_seq_ops
= {
337 static int nfqueue_open(struct inode
*inode
, struct file
*file
)
339 return seq_open(file
, &nfqueue_seq_ops
);
342 static const struct file_operations nfqueue_file_ops
= {
343 .owner
= THIS_MODULE
,
344 .open
= nfqueue_open
,
347 .release
= seq_release
,
352 int __init
netfilter_queue_init(void)
354 #ifdef CONFIG_PROC_FS
355 struct proc_dir_entry
*pde
;
357 pde
= create_proc_entry("nf_queue", S_IRUGO
, proc_net_netfilter
);
360 pde
->proc_fops
= &nfqueue_file_ops
;