path: root/src/nlmsg.c

/*
 * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published
 * by the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 */
#include <arpa/inet.h>
#include <time.h>
#include <endian.h>
#include <stdlib.h>
#include <string.h>

#include <libmnl/libmnl.h>

#ifndef __aligned_be64
#define __aligned_be64 __be64 __attribute__((aligned(8)))
#define __aligned_le64 __le64 __attribute__((aligned(8)))
#endif

#include <linux/netfilter/nfnetlink_queue.h>

#include <libnetfilter_queue/libnetfilter_queue.h>

#include "internal.h"

/**
 * \defgroup nfq_verd Verdict helpers
 * @{
 */

/**
 * nfq_nlmsg_verdict_put - Put a verdict into a Netlink message
 * \param nlh Pointer to netlink message
 * \param id ID assigned to packet by netfilter
 * \param verdict verdict to return to netfilter (see \b Verdicts below)
 * \par Verdicts
 * __NF_DROP__ Drop the packet. This is final.
 * \n
 * __NF_ACCEPT__ Accept the packet. Processing of the current base chain
 * and any called chains terminates,
 * but the packet may still be processed by subsequently invoked base chains.
 * \n
 * __NF_STOP__ Like __NF_ACCEPT__, but skip any further base chains using the
 * current hook.
 * \n
 * __NF_REPEAT__ Like __NF_ACCEPT__, but re-queue this packet to the
 * current base chain. One way to prevent a re-queueing loop is to
 * also set a packet mark using nfq_nlmsg_verdict_put_mark() and have the
 * program test for this mark in \c attr[NFQA_MARK]; or have the nefilter rules
 * do this test.
 * \n
 * __NF_QUEUE_NR__(*new_queue*) Like __NF_ACCEPT__, but queue this packet to
 * queue number *new_queue*. As with the command-line \b queue \b num verdict,
 * if no process is listening to that queue then the packet is discarded; but
 * again like with the command-line, one may OR in a flag to bypass *new_queue*
 *  if there is no listener, as in this snippet:
 * \verbatim
       nfq_nlmsg_verdict_put(nlh, id, NF_QUEUE_NR(new_queue) |
	       NF_VERDICT_FLAG_QUEUE_BYPASS);
\endverbatim
 *
 * See examples/nf-queue.c, line
 * <a class="el" href="nf-queue_8c_source.html#l00046">46</a>
 * for an example of how to use this function in context.
 * The calling sequence is \b main --> \b mnl_cb_run --> \b queue_cb -->
 * \b nfq_send_verdict --> \b nfq_nlmsg_verdict_put
 * (\b cb being short for \b callback).
 */
EXPORT_SYMBOL
void nfq_nlmsg_verdict_put(struct nlmsghdr *nlh, int id, int verdict)
{
	struct nfqnl_msg_verdict_hdr vh = {
		.verdict	= htonl(verdict),
		.id		= htonl(id),
	};
	mnl_attr_put(nlh, NFQA_VERDICT_HDR, sizeof(vh), &vh);
}

/**
 * nfq_nlmsg_verdict_put_mark - Put a packet mark into a netlink message
 * \param nlh Pointer to netlink message
 * \param mark Value of mark to put
 *
 * The mark becomes part of the packet's metadata, and may be tested by the *nft
 * primary expression* **meta mark**
 * \sa __nft__(1)
 */
EXPORT_SYMBOL
void nfq_nlmsg_verdict_put_mark(struct nlmsghdr *nlh, uint32_t mark)
{
	mnl_attr_put_u32(nlh, NFQA_MARK, htonl(mark));
}

EXPORT_SYMBOL
/**
 * nfq_nlmsg_verdict_put_pkt - Put replacement packet content into a netlink
 * message
 * \param nlh Pointer to netlink message
 * \param pkt Pointer to start of modified IP datagram
 * \param plen Length of modified IP datagram
 *
 * There is only ever a need to return packet content if it has been modified.
 * Usually one of the nfq_*_mangle_* functions does the modifying.
 *
 * This code snippet uses nfq_udp_mangle_ipv4. See nf-queue.c for
 * context:
 * \verbatim
// main calls queue_cb (line 64) to process an enqueued packet:
	// Extra variables
	uint8_t *payload, *rep_data;
	unsigned int match_offset, match_len, rep_len;

	// The next line was commented-out (with payload void*)
	payload = mnl_attr_get_payload(attr[NFQA_PAYLOAD]);
	// Copy data to a packet buffer (allow 255 bytes for mangling).
	pktb = pktb_alloc(AF_INET, payload, plen, 255);
	// (decide that this packet needs mangling)
	nfq_udp_mangle_ipv4(pktb, match_offset, match_len, rep_data, rep_len);
	// nfq_udp_mangle_ipv4 updates packet length, no need to track locally

	// Eventually nfq_send_verdict (line 39) gets called
	// The received packet may or may not have been modified.
	// Add this code before nfq_nlmsg_verdict_put call:
	if (pktb_mangled(pktb))
		nfq_nlmsg_verdict_put_pkt(nlh, pktb_data(pktb), pktb_len(pktb));
\endverbatim
 */
void nfq_nlmsg_verdict_put_pkt(struct nlmsghdr *nlh, const void *pkt,
			       uint32_t plen)
{
	mnl_attr_put(nlh, NFQA_PAYLOAD, plen, pkt);
}

/**
 * @}
 */

/**
 * \defgroup nfq_cfg Config helpers
 * @{
 */

/**
 * nfq_nlmsg_cfg_put_cmd Add netlink config command to netlink message
 * \param nlh Pointer to netlink message
 * \param pf Packet family (e.g. AF_INET)
 * \param cmd nfqueue nfnetlink command.
 *
 * Possible commands are:
 *
 * - NFQNL_CFG_CMD_NONE: Do nothing. It can be useful to know if the queue
 *   subsystem is working.
 * - NFQNL_CFG_CMD_BIND: Binds the program to a specific queue.
 * - NFQNL_CFG_CMD_UNBIND: Unbinds the program to a specifiq queue.
 *
 * Obsolete commands:
 * - NFQNL_CFG_CMD_PF_BIND: Binds to process packets belonging to the given
 *   protocol family (ie. PF_INET, PF_INET6, etc).
 * - NFQNL_CFG_CMD_PF_UNBIND: Unbinds from processing packets belonging to the
 *   given protocol family.  Both commands are ignored by Linux kernel 3.8 and
 *   later versions.
 */
EXPORT_SYMBOL
void nfq_nlmsg_cfg_put_cmd(struct nlmsghdr *nlh, uint16_t pf, uint8_t cmd)
{
	struct nfqnl_msg_config_cmd command = {
		.command = cmd,
		.pf = htons(pf),
	};
	mnl_attr_put(nlh, NFQA_CFG_CMD, sizeof(command), &command);
}

/**
 * nfq_nlmsg_cfg_put_params Add parameter to netlink message
 * \param nlh Pointer to netlink message
 * \param mode one of NFQNL_COPY_NONE, NFQNL_COPY_META or NFQNL_COPY_PACKET
 * \param range value of parameter
 */
EXPORT_SYMBOL
void nfq_nlmsg_cfg_put_params(struct nlmsghdr *nlh, uint8_t mode, int range)
{
	struct nfqnl_msg_config_params params = {
		.copy_range = htonl(range),
		.copy_mode = mode,
	};
	mnl_attr_put(nlh, NFQA_CFG_PARAMS, sizeof(params), &params);
}

/**
 * nfq_nlmsg_cfg_put_qmaxlen Add queue maximum length to netlink message
 * \param nlh Pointer to netlink message
 * \param queue_maxlen Maximum queue length
 */
EXPORT_SYMBOL
void nfq_nlmsg_cfg_put_qmaxlen(struct nlmsghdr *nlh, uint32_t queue_maxlen)
{
	mnl_attr_put_u32(nlh, NFQA_CFG_QUEUE_MAXLEN, htonl(queue_maxlen));
}

/**
 * @}
 */

/**
 * \defgroup nlmsg Netlink message helper functions
 * @{
 */

static int nfq_pkt_parse_attr_cb(const struct nlattr *attr, void *data)
{
	const struct nlattr **tb = data;
	int type = mnl_attr_get_type(attr);

	/* skip unsupported attribute in user-space */
	if (mnl_attr_type_valid(attr, NFQA_MAX) < 0)
		return MNL_CB_OK;

	switch(type) {
	case NFQA_MARK:
	case NFQA_IFINDEX_INDEV:
	case NFQA_IFINDEX_OUTDEV:
	case NFQA_IFINDEX_PHYSINDEV:
	case NFQA_IFINDEX_PHYSOUTDEV:
	case NFQA_CAP_LEN:
	case NFQA_SKB_INFO:
	case NFQA_SECCTX:
	case NFQA_UID:
	case NFQA_GID:
	case NFQA_CT_INFO:
		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
			return MNL_CB_ERROR;
		break;
	case NFQA_TIMESTAMP:
		if (mnl_attr_validate2(attr, MNL_TYPE_UNSPEC,
		    sizeof(struct nfqnl_msg_packet_timestamp)) < 0) {
			return MNL_CB_ERROR;
		}
		break;
	case NFQA_HWADDR:
		if (mnl_attr_validate2(attr, MNL_TYPE_UNSPEC,
		    sizeof(struct nfqnl_msg_packet_hw)) < 0) {
			return MNL_CB_ERROR;
		}
		break;
	case NFQA_PACKET_HDR:
		if (mnl_attr_validate2(attr, MNL_TYPE_UNSPEC,
		    sizeof(struct nfqnl_msg_packet_hdr)) < 0) {
			return MNL_CB_ERROR;
		}
		break;
	case NFQA_PAYLOAD:
	case NFQA_CT:
	case NFQA_EXP:
		break;
	}
	tb[type] = attr;
	return MNL_CB_OK;
}

/**
 * nfq_nlmsg_parse - set packet attributes from netlink message
 * \param nlh Pointer to netlink message
 * \param attr Pointer to array of attributes to set
 * \returns MNL_CB_OK on success or MNL_CB_ERROR if any error occurs
 */
EXPORT_SYMBOL
int nfq_nlmsg_parse(const struct nlmsghdr *nlh, struct nlattr **attr)
{
	return mnl_attr_parse(nlh, sizeof(struct nfgenmsg),
			      nfq_pkt_parse_attr_cb, attr);
}

/**
 * nfq_nlmsg_put - Convert memory buffer into a Netlink buffer
 * \param *buf Pointer to memory buffer
 * \param type Either NFQNL_MSG_CONFIG or NFQNL_MSG_VERDICT
 * \param queue_num Queue number
 * \returns Pointer to netlink message
 */
EXPORT_SYMBOL
struct nlmsghdr *nfq_nlmsg_put(char *buf, int type, uint32_t queue_num)
{
	struct nlmsghdr *nlh = mnl_nlmsg_put_header(buf);
	nlh->nlmsg_type = (NFNL_SUBSYS_QUEUE << 8) | type;
	nlh->nlmsg_flags = NLM_F_REQUEST;

	struct nfgenmsg *nfg = mnl_nlmsg_put_extra_header(nlh, sizeof(*nfg));
	nfg->nfgen_family = AF_UNSPEC;
	nfg->version = NFNETLINK_V0;
	nfg->res_id = htons(queue_num);

	return nlh;
}

/**
 * @}
 */