Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bbd86b9f authored by Harald Welte's avatar Harald Welte Committed by David S. Miller
Browse files

[NETFILTER]: add /proc/net/netfilter interface to nf_queue 



This patch adds a /proc/net/netfilter/nf_queue file, similar to the
recently-added /proc/net/netfilter/nf_log.  It indicates which queue
handler is registered to which protocol family.  This is useful since
there are now multiple queue handlers in the treee (ip[6]_queue,
nfnetlink_queue).

Signed-off-by: default avatarHarald Welte <laforge@netfilter.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent fbcd923c

include/linux/netfilter.h

+8 −5
Original line number Original line Diff line number Diff line
@@ -225,13 +225,16 @@ int nf_getsockopt(struct sock *sk, int pf, int optval, char __user *opt, 
		  int *len);

		  int *len);





/* Packet queuing */

/* Packet queuing */

typedef int (*nf_queue_outfn_t)(struct sk_buff *skb, 

struct nf_queue_handler {

                                struct nf_info *info,

	int (*outfn)(struct sk_buff *skb, struct nf_info *info,

		     unsigned int queuenum, void *data);

		     unsigned int queuenum, void *data);

	void *data;

	char *name;

};

extern int nf_register_queue_handler(int pf, 

extern int nf_register_queue_handler(int pf, 

                                     nf_queue_outfn_t outfn, void *data);

                                     struct nf_queue_handler *qh);

extern int nf_unregister_queue_handler(int pf);

extern int nf_unregister_queue_handler(int pf);

extern void nf_unregister_queue_handlers(nf_queue_outfn_t outfn);

extern void nf_unregister_queue_handlers(struct nf_queue_handler *qh);

extern void nf_reinject(struct sk_buff *skb,

extern void nf_reinject(struct sk_buff *skb,

			struct nf_info *info,

			struct nf_info *info,

			unsigned int verdict);

			unsigned int verdict);

net/ipv4/netfilter/ip_queue.c

+7 −2
Original line number Original line Diff line number Diff line
@@ -656,6 +656,11 @@ ipq_get_info(char *buffer, char **start, off_t offset, int length) 
}

}

#endif /* CONFIG_PROC_FS */

#endif /* CONFIG_PROC_FS */





static struct nf_queue_handler nfqh = {

	.name	= "ip_queue",

	.outfn	= &ipq_enqueue_packet,

};



static int

static int

init_or_cleanup(int init)

init_or_cleanup(int init)

{

{
@@ -684,7 +689,7 @@ init_or_cleanup(int init) 
	register_netdevice_notifier(&ipq_dev_notifier);

	register_netdevice_notifier(&ipq_dev_notifier);

	ipq_sysctl_header = register_sysctl_table(ipq_root_table, 0);

	ipq_sysctl_header = register_sysctl_table(ipq_root_table, 0);

	

	

	status = nf_register_queue_handler(PF_INET, ipq_enqueue_packet, NULL);

	status = nf_register_queue_handler(PF_INET, &nfqh);

	if (status < 0) {

	if (status < 0) {

		printk(KERN_ERR "ip_queue: failed to register queue handler\n");

		printk(KERN_ERR "ip_queue: failed to register queue handler\n");

		goto cleanup_sysctl;

		goto cleanup_sysctl;
@@ -692,7 +697,7 @@ init_or_cleanup(int init) 
	return status;

	return status;





cleanup:

cleanup:

	nf_unregister_queue_handlers(&ipq_enqueue_packet);

	nf_unregister_queue_handlers(&nfqh);

	synchronize_net();

	synchronize_net();

	ipq_flush(NF_DROP);

	ipq_flush(NF_DROP);

net/ipv6/netfilter/ip6_queue.c

+7 −2
Original line number Original line Diff line number Diff line
@@ -652,6 +652,11 @@ ipq_get_info(char *buffer, char **start, off_t offset, int length) 
	return len;

	return len;

}

}





static struct nf_queue_handler nfqh = {

	.name	= "ip6_queue",

	.outfn	= &ipq_enqueue_packet,

};



static int

static int

init_or_cleanup(int init)

init_or_cleanup(int init)

{

{
@@ -679,7 +684,7 @@ init_or_cleanup(int init) 
	register_netdevice_notifier(&ipq_dev_notifier);

	register_netdevice_notifier(&ipq_dev_notifier);

	ipq_sysctl_header = register_sysctl_table(ipq_root_table, 0);

	ipq_sysctl_header = register_sysctl_table(ipq_root_table, 0);

	

	

	status = nf_register_queue_handler(PF_INET6, ipq_enqueue_packet, NULL);

	status = nf_register_queue_handler(PF_INET6, &nfqh);

	if (status < 0) {

	if (status < 0) {

		printk(KERN_ERR "ip6_queue: failed to register queue handler\n");

		printk(KERN_ERR "ip6_queue: failed to register queue handler\n");

		goto cleanup_sysctl;

		goto cleanup_sysctl;
@@ -687,7 +692,7 @@ init_or_cleanup(int init) 
	return status;

	return status;





cleanup:

cleanup:

	nf_unregister_queue_handlers(&ipq_enqueue_packet);

	nf_unregister_queue_handlers(&nfqh);

	synchronize_net();

	synchronize_net();

	ipq_flush(NF_DROP);

	ipq_flush(NF_DROP);

net/netfilter/nf_log.c

+1 −0
Original line number Original line Diff line number Diff line
@@ -5,6 +5,7 @@ 
#include <linux/proc_fs.h>

#include <linux/proc_fs.h>

#include <linux/skbuff.h>

#include <linux/skbuff.h>

#include <linux/netfilter.h>

#include <linux/netfilter.h>

#include <linux/seq_file.h>

#include <net/protocol.h>

#include <net/protocol.h>





#include "nf_internals.h"

#include "nf_internals.h"

net/netfilter/nf_queue.c

+86 −20
Original line number Original line Diff line number Diff line
@@ -5,6 +5,7 @@ 
#include <linux/proc_fs.h>

#include <linux/proc_fs.h>

#include <linux/skbuff.h>

#include <linux/skbuff.h>

#include <linux/netfilter.h>

#include <linux/netfilter.h>

#include <linux/seq_file.h>

#include <net/protocol.h>

#include <net/protocol.h>





#include "nf_internals.h"

#include "nf_internals.h"
@@ -14,17 +15,12 @@ 
 * long term mutex.  The handler must provide an an outfn() to accept packets

 * long term mutex.  The handler must provide an an outfn() to accept packets

 * for queueing and must reinject all packets it receives, no matter what.

 * for queueing and must reinject all packets it receives, no matter what.

 */

 */

static struct nf_queue_handler_t {

static struct nf_queue_handler *queue_handler[NPROTO];

	nf_queue_outfn_t outfn;

	void *data;

} queue_handler[NPROTO];



static struct nf_queue_rerouter *queue_rerouter;

static struct nf_queue_rerouter *queue_rerouter;





static DEFINE_RWLOCK(queue_handler_lock);

static DEFINE_RWLOCK(queue_handler_lock);







int nf_register_queue_handler(int pf, struct nf_queue_handler *qh)

int nf_register_queue_handler(int pf, nf_queue_outfn_t outfn, void *data)

{      

{      

	int ret;

	int ret;
@@ -32,11 +28,10 @@ int nf_register_queue_handler(int pf, nf_queue_outfn_t outfn, void *data) 
		return -EINVAL;

		return -EINVAL;





	write_lock_bh(&queue_handler_lock);

	write_lock_bh(&queue_handler_lock);

	if (queue_handler[pf].outfn)

	if (queue_handler[pf])

		ret = -EBUSY;

		ret = -EBUSY;

	else {

	else {

		queue_handler[pf].outfn = outfn;

		queue_handler[pf] = qh;

		queue_handler[pf].data = data;

		ret = 0;

		ret = 0;

	}

	}

	write_unlock_bh(&queue_handler_lock);

	write_unlock_bh(&queue_handler_lock);
@@ -52,8 +47,7 @@ int nf_unregister_queue_handler(int pf) 
		return -EINVAL;

		return -EINVAL;





	write_lock_bh(&queue_handler_lock);

	write_lock_bh(&queue_handler_lock);

	queue_handler[pf].outfn = NULL;

	queue_handler[pf] = NULL;

	queue_handler[pf].data = NULL;

	write_unlock_bh(&queue_handler_lock);

	write_unlock_bh(&queue_handler_lock);

	

	

	return 0;

	return 0;
@@ -85,16 +79,14 @@ int nf_unregister_queue_rerouter(int pf) 
}

}

EXPORT_SYMBOL_GPL(nf_unregister_queue_rerouter);

EXPORT_SYMBOL_GPL(nf_unregister_queue_rerouter);





void nf_unregister_queue_handlers(nf_queue_outfn_t outfn)

void nf_unregister_queue_handlers(struct nf_queue_handler *qh)

{

{

	int pf;

	int pf;





	write_lock_bh(&queue_handler_lock);

	write_lock_bh(&queue_handler_lock);

	for (pf = 0; pf < NPROTO; pf++)  {

	for (pf = 0; pf < NPROTO; pf++)  {

		if (queue_handler[pf].outfn == outfn) {

		if (queue_handler[pf] == qh)

			queue_handler[pf].outfn = NULL;

			queue_handler[pf] = NULL;

			queue_handler[pf].data = NULL;

		}

	}

	}

	write_unlock_bh(&queue_handler_lock);

	write_unlock_bh(&queue_handler_lock);

}

}
@@ -121,7 +113,7 @@ int nf_queue(struct sk_buff **skb, 




	/* QUEUE == DROP if noone is waiting, to be safe. */

	/* QUEUE == DROP if noone is waiting, to be safe. */

	read_lock(&queue_handler_lock);

	read_lock(&queue_handler_lock);

	if (!queue_handler[pf].outfn) {

	if (!queue_handler[pf]->outfn) {

		read_unlock(&queue_handler_lock);

		read_unlock(&queue_handler_lock);

		kfree_skb(*skb);

		kfree_skb(*skb);

		return 1;

		return 1;
@@ -162,8 +154,8 @@ int nf_queue(struct sk_buff **skb, 
	if (queue_rerouter[pf].save)

	if (queue_rerouter[pf].save)

		queue_rerouter[pf].save(*skb, info);

		queue_rerouter[pf].save(*skb, info);





	status = queue_handler[pf].outfn(*skb, info, queuenum,

	status = queue_handler[pf]->outfn(*skb, info, queuenum,

					 queue_handler[pf].data);

					  queue_handler[pf]->data);





	if (status >= 0 && queue_rerouter[pf].reroute)

	if (status >= 0 && queue_rerouter[pf].reroute)

		status = queue_rerouter[pf].reroute(skb, info);

		status = queue_rerouter[pf].reroute(skb, info);
@@ -259,13 +251,87 @@ void nf_reinject(struct sk_buff *skb, struct nf_info *info, 
}

}

EXPORT_SYMBOL(nf_reinject);

EXPORT_SYMBOL(nf_reinject);





#ifdef CONFIG_PROC_FS

static void *seq_start(struct seq_file *seq, loff_t *pos)

{

	if (*pos >= NPROTO)

		return NULL;



	return pos;

}



static void *seq_next(struct seq_file *s, void *v, loff_t *pos)

{

	(*pos)++;



	if (*pos >= NPROTO)

		return NULL;



	return pos;

}



static void seq_stop(struct seq_file *s, void *v)

{



}



static int seq_show(struct seq_file *s, void *v)

{

	int ret;

	loff_t *pos = v;

	struct nf_queue_handler *qh;



	read_lock_bh(&queue_handler_lock);

	qh = queue_handler[*pos];

	if (!qh)

		ret = seq_printf(s, "%2lld NONE\n", *pos);

	else

		ret = seq_printf(s, "%2lld %s\n", *pos, qh->name);

	read_unlock_bh(&queue_handler_lock);



	return ret;

}



static struct seq_operations nfqueue_seq_ops = {

	.start	= seq_start,

	.next	= seq_next,

	.stop	= seq_stop,

	.show	= seq_show,

};



static int nfqueue_open(struct inode *inode, struct file *file)

{

	return seq_open(file, &nfqueue_seq_ops);

}



static struct file_operations nfqueue_file_ops = {

	.owner	 = THIS_MODULE,

	.open	 = nfqueue_open,

	.read	 = seq_read,

	.llseek	 = seq_lseek,

	.release = seq_release,

};

#endif /* PROC_FS */





int __init netfilter_queue_init(void)

int __init netfilter_queue_init(void)

{

{

#ifdef CONFIG_PROC_FS

	struct proc_dir_entry *pde;

#endif

	queue_rerouter = kmalloc(NPROTO * sizeof(struct nf_queue_rerouter),

	queue_rerouter = kmalloc(NPROTO * sizeof(struct nf_queue_rerouter),

				 GFP_KERNEL);

				 GFP_KERNEL);

	if (!queue_rerouter)

	if (!queue_rerouter)

		return -ENOMEM;

		return -ENOMEM;





#ifdef CONFIG_PROC_FS

	pde = create_proc_entry("nf_queue", S_IRUGO, proc_net_netfilter);

	if (!pde) {

		kfree(queue_rerouter);

		return -1;

	}

	pde->proc_fops = &nfqueue_file_ops;

#endif

	memset(queue_rerouter, 0, NPROTO * sizeof(struct nf_queue_rerouter));

	memset(queue_rerouter, 0, NPROTO * sizeof(struct nf_queue_rerouter));





	return 0;

	return 0;