1 #include <linux/kernel.h>
2 #include <linux/init.h>
3 #include <linux/module.h>
4 #include <linux/proc_fs.h>
5 #include <linux/skbuff.h>
6 #include <linux/netfilter.h>
7 #include <linux/seq_file.h>
8 #include <linux/rcupdate.h>
9 #include <net/protocol.h>
11 #include "nf_internals.h"
14 * A queue handler may be registered for each protocol. Each is protected by
15 * long term mutex. The handler must provide an an outfn() to accept packets
16 * for queueing and must reinject all packets it receives, no matter what.
18 static struct nf_queue_handler *queue_handler[NPROTO];
20 static DEFINE_MUTEX(queue_handler_mutex);
22 /* return EBUSY when somebody else is registered, return EEXIST if the
23 * same handler is registered, return 0 in case of success. */
24 int nf_register_queue_handler(int pf, struct nf_queue_handler *qh)
31 mutex_lock(&queue_handler_mutex);
32 if (queue_handler[pf] == qh)
34 else if (queue_handler[pf])
37 rcu_assign_pointer(queue_handler[pf], qh);
40 mutex_unlock(&queue_handler_mutex);
44 EXPORT_SYMBOL(nf_register_queue_handler);
46 /* The caller must flush their queue before this */
47 int nf_unregister_queue_handler(int pf, struct nf_queue_handler *qh)
52 mutex_lock(&queue_handler_mutex);
53 if (queue_handler[pf] != qh) {
54 mutex_unlock(&queue_handler_mutex);
58 rcu_assign_pointer(queue_handler[pf], NULL);
59 mutex_unlock(&queue_handler_mutex);
65 EXPORT_SYMBOL(nf_unregister_queue_handler);
67 void nf_unregister_queue_handlers(struct nf_queue_handler *qh)
71 mutex_lock(&queue_handler_mutex);
72 for (pf = 0; pf < NPROTO; pf++) {
73 if (queue_handler[pf] == qh)
74 rcu_assign_pointer(queue_handler[pf], NULL);
76 mutex_unlock(&queue_handler_mutex);
80 EXPORT_SYMBOL_GPL(nf_unregister_queue_handlers);
83 * Any packet that leaves via this function must come back
84 * through nf_reinject().
86 static int __nf_queue(struct sk_buff *skb,
87 struct list_head *elem,
88 int pf, unsigned int hook,
89 struct net_device *indev,
90 struct net_device *outdev,
91 int (*okfn)(struct sk_buff *),
92 unsigned int queuenum)
96 #ifdef CONFIG_BRIDGE_NETFILTER
97 struct net_device *physindev = NULL;
98 struct net_device *physoutdev = NULL;
100 struct nf_afinfo *afinfo;
101 struct nf_queue_handler *qh;
103 /* QUEUE == DROP if noone is waiting, to be safe. */
106 qh = rcu_dereference(queue_handler[pf]);
113 afinfo = nf_get_afinfo(pf);
120 info = kmalloc(sizeof(*info) + afinfo->route_key_size, GFP_ATOMIC);
123 printk(KERN_ERR "OOM queueing packet %p\n",
130 *info = (struct nf_info) {
131 (struct nf_hook_ops *)elem, pf, hook, indev, outdev, okfn };
133 /* If it's going away, ignore hook. */
134 if (!try_module_get(info->elem->owner)) {
140 /* Bump dev refs so they don't vanish while packet is out */
145 #ifdef CONFIG_BRIDGE_NETFILTER
146 if (skb->nf_bridge) {
147 physindev = skb->nf_bridge->physindev;
150 physoutdev = skb->nf_bridge->physoutdev;
152 dev_hold(physoutdev);
155 afinfo->saveroute(skb, info);
156 status = qh->outfn(skb, info, queuenum, qh->data);
161 /* James M doesn't say fuck enough. */
166 #ifdef CONFIG_BRIDGE_NETFILTER
172 module_put(info->elem->owner);
182 int nf_queue(struct sk_buff *skb,
183 struct list_head *elem,
184 int pf, unsigned int hook,
185 struct net_device *indev,
186 struct net_device *outdev,
187 int (*okfn)(struct sk_buff *),
188 unsigned int queuenum)
190 struct sk_buff *segs;
192 if (!skb_is_gso(skb))
193 return __nf_queue(skb, elem, pf, hook, indev, outdev, okfn,
198 skb->protocol = htons(ETH_P_IP);
201 skb->protocol = htons(ETH_P_IPV6);
205 segs = skb_gso_segment(skb, 0);
207 if (unlikely(IS_ERR(segs)))
211 struct sk_buff *nskb = segs->next;
214 if (!__nf_queue(segs, elem, pf, hook, indev, outdev, okfn,
222 void nf_reinject(struct sk_buff *skb, struct nf_info *info,
223 unsigned int verdict)
225 struct list_head *elem = &info->elem->list;
226 struct nf_afinfo *afinfo;
230 /* Release those devices we held, or Alexey will kill me. */
232 dev_put(info->indev);
234 dev_put(info->outdev);
235 #ifdef CONFIG_BRIDGE_NETFILTER
236 if (skb->nf_bridge) {
237 if (skb->nf_bridge->physindev)
238 dev_put(skb->nf_bridge->physindev);
239 if (skb->nf_bridge->physoutdev)
240 dev_put(skb->nf_bridge->physoutdev);
244 /* Drop reference to owner of hook which queued us. */
245 module_put(info->elem->owner);
247 /* Continue traversal iff userspace said ok... */
248 if (verdict == NF_REPEAT) {
253 if (verdict == NF_ACCEPT) {
254 afinfo = nf_get_afinfo(info->pf);
255 if (!afinfo || afinfo->reroute(skb, info) < 0)
259 if (verdict == NF_ACCEPT) {
261 verdict = nf_iterate(&nf_hooks[info->pf][info->hook],
263 info->indev, info->outdev, &elem,
264 info->okfn, INT_MIN);
267 switch (verdict & NF_VERDICT_MASK) {
274 if (!__nf_queue(skb, elem, info->pf, info->hook,
275 info->indev, info->outdev, info->okfn,
276 verdict >> NF_VERDICT_BITS))
286 EXPORT_SYMBOL(nf_reinject);
288 #ifdef CONFIG_PROC_FS
289 static void *seq_start(struct seq_file *seq, loff_t *pos)
297 static void *seq_next(struct seq_file *s, void *v, loff_t *pos)
307 static void seq_stop(struct seq_file *s, void *v)
312 static int seq_show(struct seq_file *s, void *v)
316 struct nf_queue_handler *qh;
319 qh = rcu_dereference(queue_handler[*pos]);
321 ret = seq_printf(s, "%2lld NONE\n", *pos);
323 ret = seq_printf(s, "%2lld %s\n", *pos, qh->name);
329 static const struct seq_operations nfqueue_seq_ops = {
336 static int nfqueue_open(struct inode *inode, struct file *file)
338 return seq_open(file, &nfqueue_seq_ops);
341 static const struct file_operations nfqueue_file_ops = {
342 .owner = THIS_MODULE,
343 .open = nfqueue_open,
346 .release = seq_release,
351 int __init netfilter_queue_init(void)
353 #ifdef CONFIG_PROC_FS
354 struct proc_dir_entry *pde;
356 pde = create_proc_entry("nf_queue", S_IRUGO, proc_net_netfilter);
359 pde->proc_fops = &nfqueue_file_ops;