Pileus Git - ~andy/linux/blob - net/ipv4/inet_diag.c

   1 /*
   2  * inet_diag.c  Module for monitoring INET transport protocols sockets.
   3  *
   4  * Authors:     Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
   5  *
   6  *      This program is free software; you can redistribute it and/or
   7  *      modify it under the terms of the GNU General Public License
   8  *      as published by the Free Software Foundation; either version
   9  *      2 of the License, or (at your option) any later version.
  10  */
  11
  12 #include <linux/kernel.h>
  13 #include <linux/module.h>
  14 #include <linux/types.h>
  15 #include <linux/fcntl.h>
  16 #include <linux/random.h>
  17 #include <linux/slab.h>
  18 #include <linux/cache.h>
  19 #include <linux/init.h>
  20 #include <linux/time.h>
  21
  22 #include <net/icmp.h>
  23 #include <net/tcp.h>
  24 #include <net/ipv6.h>
  25 #include <net/inet_common.h>
  26 #include <net/inet_connection_sock.h>
  27 #include <net/inet_hashtables.h>
  28 #include <net/inet_timewait_sock.h>
  29 #include <net/inet6_hashtables.h>
  30 #include <net/netlink.h>
  31
  32 #include <linux/inet.h>
  33 #include <linux/stddef.h>
  34
  35 #include <linux/inet_diag.h>
  36 #include <linux/sock_diag.h>
  37
  38 static const struct inet_diag_handler **inet_diag_table;
  39
  40 struct inet_diag_entry {
  41         __be32 *saddr;
  42         __be32 *daddr;
  43         u16 sport;
  44         u16 dport;
  45         u16 family;
  46         u16 userlocks;
  47 #if IS_ENABLED(CONFIG_IPV6)
  48         struct in6_addr saddr_storage;  /* for IPv4-mapped-IPv6 addresses */
  49         struct in6_addr daddr_storage;  /* for IPv4-mapped-IPv6 addresses */
  50 #endif
  51 };
  52
  53 static DEFINE_MUTEX(inet_diag_table_mutex);
  54
  55 static const struct inet_diag_handler *inet_diag_lock_handler(int proto)
  56 {
  57         if (!inet_diag_table[proto])
  58                 request_module("net-pf-%d-proto-%d-type-%d-%d", PF_NETLINK,
  59                                NETLINK_SOCK_DIAG, AF_INET, proto);
  60
  61         mutex_lock(&inet_diag_table_mutex);
  62         if (!inet_diag_table[proto])
  63                 return ERR_PTR(-ENOENT);
  64
  65         return inet_diag_table[proto];
  66 }
  67
  68 static inline void inet_diag_unlock_handler(
  69         const struct inet_diag_handler *handler)
  70 {
  71         mutex_unlock(&inet_diag_table_mutex);
  72 }
  73
  74 int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
  75                               struct sk_buff *skb, struct inet_diag_req_v2 *req,
  76                               struct user_namespace *user_ns,
  77                               u32 portid, u32 seq, u16 nlmsg_flags,
  78                               const struct nlmsghdr *unlh)
  79 {
  80         const struct inet_sock *inet = inet_sk(sk);
  81         struct inet_diag_msg *r;
  82         struct nlmsghdr  *nlh;
  83         struct nlattr *attr;
  84         void *info = NULL;
  85         const struct inet_diag_handler *handler;
  86         int ext = req->idiag_ext;
  87
  88         handler = inet_diag_table[req->sdiag_protocol];
  89         BUG_ON(handler == NULL);
  90
  91         nlh = nlmsg_put(skb, portid, seq, unlh->nlmsg_type, sizeof(*r),
  92                         nlmsg_flags);
  93         if (!nlh)
  94                 return -EMSGSIZE;
  95
  96         r = nlmsg_data(nlh);
  97         BUG_ON(sk->sk_state == TCP_TIME_WAIT);
  98
  99         r->idiag_family = sk->sk_family;
 100         r->idiag_state = sk->sk_state;
 101         r->idiag_timer = 0;
 102         r->idiag_retrans = 0;
 103
 104         r->id.idiag_if = sk->sk_bound_dev_if;
 105         sock_diag_save_cookie(sk, r->id.idiag_cookie);
 106
 107         r->id.idiag_sport = inet->inet_sport;
 108         r->id.idiag_dport = inet->inet_dport;
 109         r->id.idiag_src[0] = inet->inet_rcv_saddr;
 110         r->id.idiag_dst[0] = inet->inet_daddr;
 111
 112         if (nla_put_u8(skb, INET_DIAG_SHUTDOWN, sk->sk_shutdown))
 113                 goto errout;
 114
 115         /* IPv6 dual-stack sockets use inet->tos for IPv4 connections,
 116          * hence this needs to be included regardless of socket family.
 117          */
 118         if (ext & (1 << (INET_DIAG_TOS - 1)))
 119                 if (nla_put_u8(skb, INET_DIAG_TOS, inet->tos) < 0)
 120                         goto errout;
 121
 122 #if IS_ENABLED(CONFIG_IPV6)
 123         if (r->idiag_family == AF_INET6) {
 124
 125                 *(struct in6_addr *)r->id.idiag_src = sk->sk_v6_rcv_saddr;
 126                 *(struct in6_addr *)r->id.idiag_dst = sk->sk_v6_daddr;
 127
 128                 if (ext & (1 << (INET_DIAG_TCLASS - 1)))
 129                         if (nla_put_u8(skb, INET_DIAG_TCLASS,
 130                                        inet6_sk(sk)->tclass) < 0)
 131                                 goto errout;
 132         }
 133 #endif
 134
 135         r->idiag_uid = from_kuid_munged(user_ns, sock_i_uid(sk));
 136         r->idiag_inode = sock_i_ino(sk);
 137
 138         if (ext & (1 << (INET_DIAG_MEMINFO - 1))) {
 139                 struct inet_diag_meminfo minfo = {
 140                         .idiag_rmem = sk_rmem_alloc_get(sk),
 141                         .idiag_wmem = sk->sk_wmem_queued,
 142                         .idiag_fmem = sk->sk_forward_alloc,
 143                         .idiag_tmem = sk_wmem_alloc_get(sk),
 144                 };
 145
 146                 if (nla_put(skb, INET_DIAG_MEMINFO, sizeof(minfo), &minfo) < 0)
 147                         goto errout;
 148         }
 149
 150         if (ext & (1 << (INET_DIAG_SKMEMINFO - 1)))
 151                 if (sock_diag_put_meminfo(sk, skb, INET_DIAG_SKMEMINFO))
 152                         goto errout;
 153
 154         if (icsk == NULL) {
 155                 handler->idiag_get_info(sk, r, NULL);
 156                 goto out;
 157         }
 158
 159 #define EXPIRES_IN_MS(tmo)  DIV_ROUND_UP((tmo - jiffies) * 1000, HZ)
 160
 161         if (icsk->icsk_pending == ICSK_TIME_RETRANS ||
 162             icsk->icsk_pending == ICSK_TIME_EARLY_RETRANS ||
 163             icsk->icsk_pending == ICSK_TIME_LOSS_PROBE) {
 164                 r->idiag_timer = 1;
 165                 r->idiag_retrans = icsk->icsk_retransmits;
 166                 r->idiag_expires = EXPIRES_IN_MS(icsk->icsk_timeout);
 167         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
 168                 r->idiag_timer = 4;
 169                 r->idiag_retrans = icsk->icsk_probes_out;
 170                 r->idiag_expires = EXPIRES_IN_MS(icsk->icsk_timeout);
 171         } else if (timer_pending(&sk->sk_timer)) {
 172                 r->idiag_timer = 2;
 173                 r->idiag_retrans = icsk->icsk_probes_out;
 174                 r->idiag_expires = EXPIRES_IN_MS(sk->sk_timer.expires);
 175         } else {
 176                 r->idiag_timer = 0;
 177                 r->idiag_expires = 0;
 178         }
 179 #undef EXPIRES_IN_MS
 180
 181         if (ext & (1 << (INET_DIAG_INFO - 1))) {
 182                 attr = nla_reserve(skb, INET_DIAG_INFO,
 183                                    sizeof(struct tcp_info));
 184                 if (!attr)
 185                         goto errout;
 186
 187                 info = nla_data(attr);
 188         }
 189
 190         if ((ext & (1 << (INET_DIAG_CONG - 1))) && icsk->icsk_ca_ops)
 191                 if (nla_put_string(skb, INET_DIAG_CONG,
 192                                    icsk->icsk_ca_ops->name) < 0)
 193                         goto errout;
 194
 195         handler->idiag_get_info(sk, r, info);
 196
 197         if (sk->sk_state < TCP_TIME_WAIT &&
 198             icsk->icsk_ca_ops && icsk->icsk_ca_ops->get_info)
 199                 icsk->icsk_ca_ops->get_info(sk, ext, skb);
 200
 201 out:
 202         return nlmsg_end(skb, nlh);
 203
 204 errout:
 205         nlmsg_cancel(skb, nlh);
 206         return -EMSGSIZE;
 207 }
 208 EXPORT_SYMBOL_GPL(inet_sk_diag_fill);
 209
 210 static int inet_csk_diag_fill(struct sock *sk,
 211                               struct sk_buff *skb, struct inet_diag_req_v2 *req,
 212                               struct user_namespace *user_ns,
 213                               u32 portid, u32 seq, u16 nlmsg_flags,
 214                               const struct nlmsghdr *unlh)
 215 {
 216         return inet_sk_diag_fill(sk, inet_csk(sk),
 217                         skb, req, user_ns, portid, seq, nlmsg_flags, unlh);
 218 }
 219
 220 static int inet_twsk_diag_fill(struct inet_timewait_sock *tw,
 221                                struct sk_buff *skb, struct inet_diag_req_v2 *req,
 222                                u32 portid, u32 seq, u16 nlmsg_flags,
 223                                const struct nlmsghdr *unlh)
 224 {
 225         s32 tmo;
 226         struct inet_diag_msg *r;
 227         struct nlmsghdr *nlh;
 228
 229         nlh = nlmsg_put(skb, portid, seq, unlh->nlmsg_type, sizeof(*r),
 230                         nlmsg_flags);
 231         if (!nlh)
 232                 return -EMSGSIZE;
 233
 234         r = nlmsg_data(nlh);
 235         BUG_ON(tw->tw_state != TCP_TIME_WAIT);
 236
 237         tmo = tw->tw_ttd - inet_tw_time_stamp();
 238         if (tmo < 0)
 239                 tmo = 0;
 240
 241         r->idiag_family       = tw->tw_family;
 242         r->idiag_retrans      = 0;
 243         r->id.idiag_if        = tw->tw_bound_dev_if;
 244         sock_diag_save_cookie(tw, r->id.idiag_cookie);
 245         r->id.idiag_sport     = tw->tw_sport;
 246         r->id.idiag_dport     = tw->tw_dport;
 247         r->id.idiag_src[0]    = tw->tw_rcv_saddr;
 248         r->id.idiag_dst[0]    = tw->tw_daddr;
 249         r->idiag_state        = tw->tw_substate;
 250         r->idiag_timer        = 3;
 251         r->idiag_expires      = jiffies_to_msecs(tmo);
 252         r->idiag_rqueue       = 0;
 253         r->idiag_wqueue       = 0;
 254         r->idiag_uid          = 0;
 255         r->idiag_inode        = 0;
 256 #if IS_ENABLED(CONFIG_IPV6)
 257         if (tw->tw_family == AF_INET6) {
 258                 *(struct in6_addr *)r->id.idiag_src = tw->tw_v6_rcv_saddr;
 259                 *(struct in6_addr *)r->id.idiag_dst = tw->tw_v6_daddr;
 260         }
 261 #endif
 262
 263         return nlmsg_end(skb, nlh);
 264 }
 265
 266 static int sk_diag_fill(struct sock *sk, struct sk_buff *skb,
 267                         struct inet_diag_req_v2 *r,
 268                         struct user_namespace *user_ns,
 269                         u32 portid, u32 seq, u16 nlmsg_flags,
 270                         const struct nlmsghdr *unlh)
 271 {
 272         if (sk->sk_state == TCP_TIME_WAIT)
 273                 return inet_twsk_diag_fill(inet_twsk(sk), skb, r, portid, seq,
 274                                            nlmsg_flags, unlh);
 275
 276         return inet_csk_diag_fill(sk, skb, r, user_ns, portid, seq,
 277                                   nlmsg_flags, unlh);
 278 }
 279
 280 int inet_diag_dump_one_icsk(struct inet_hashinfo *hashinfo, struct sk_buff *in_skb,
 281                 const struct nlmsghdr *nlh, struct inet_diag_req_v2 *req)
 282 {
 283         int err;
 284         struct sock *sk;
 285         struct sk_buff *rep;
 286         struct net *net = sock_net(in_skb->sk);
 287
 288         err = -EINVAL;
 289         if (req->sdiag_family == AF_INET) {
 290                 sk = inet_lookup(net, hashinfo, req->id.idiag_dst[0],
 291                                  req->id.idiag_dport, req->id.idiag_src[0],
 292                                  req->id.idiag_sport, req->id.idiag_if);
 293         }
 294 #if IS_ENABLED(CONFIG_IPV6)
 295         else if (req->sdiag_family == AF_INET6) {
 296                 sk = inet6_lookup(net, hashinfo,
 297                                   (struct in6_addr *)req->id.idiag_dst,
 298                                   req->id.idiag_dport,
 299                                   (struct in6_addr *)req->id.idiag_src,
 300                                   req->id.idiag_sport,
 301                                   req->id.idiag_if);
 302         }
 303 #endif
 304         else {
 305                 goto out_nosk;
 306         }
 307
 308         err = -ENOENT;
 309         if (sk == NULL)
 310                 goto out_nosk;
 311
 312         err = sock_diag_check_cookie(sk, req->id.idiag_cookie);
 313         if (err)
 314                 goto out;
 315
 316         rep = nlmsg_new(sizeof(struct inet_diag_msg) +
 317                         sizeof(struct inet_diag_meminfo) +
 318                         sizeof(struct tcp_info) + 64, GFP_KERNEL);
 319         if (!rep) {
 320                 err = -ENOMEM;
 321                 goto out;
 322         }
 323
 324         err = sk_diag_fill(sk, rep, req,
 325                            sk_user_ns(NETLINK_CB(in_skb).sk),
 326                            NETLINK_CB(in_skb).portid,
 327                            nlh->nlmsg_seq, 0, nlh);
 328         if (err < 0) {
 329                 WARN_ON(err == -EMSGSIZE);
 330                 nlmsg_free(rep);
 331                 goto out;
 332         }
 333         err = netlink_unicast(net->diag_nlsk, rep, NETLINK_CB(in_skb).portid,
 334                               MSG_DONTWAIT);
 335         if (err > 0)
 336                 err = 0;
 337
 338 out:
 339         if (sk) {
 340                 if (sk->sk_state == TCP_TIME_WAIT)
 341                         inet_twsk_put((struct inet_timewait_sock *)sk);
 342                 else
 343                         sock_put(sk);
 344         }
 345 out_nosk:
 346         return err;
 347 }
 348 EXPORT_SYMBOL_GPL(inet_diag_dump_one_icsk);
 349
 350 static int inet_diag_get_exact(struct sk_buff *in_skb,
 351                                const struct nlmsghdr *nlh,
 352                                struct inet_diag_req_v2 *req)
 353 {
 354         const struct inet_diag_handler *handler;
 355         int err;
 356
 357         handler = inet_diag_lock_handler(req->sdiag_protocol);
 358         if (IS_ERR(handler))
 359                 err = PTR_ERR(handler);
 360         else
 361                 err = handler->dump_one(in_skb, nlh, req);
 362         inet_diag_unlock_handler(handler);
 363
 364         return err;
 365 }
 366
 367 static int bitstring_match(const __be32 *a1, const __be32 *a2, int bits)
 368 {
 369         int words = bits >> 5;
 370
 371         bits &= 0x1f;
 372
 373         if (words) {
 374                 if (memcmp(a1, a2, words << 2))
 375                         return 0;
 376         }
 377         if (bits) {
 378                 __be32 w1, w2;
 379                 __be32 mask;
 380
 381                 w1 = a1[words];
 382                 w2 = a2[words];
 383
 384                 mask = htonl((0xffffffff) << (32 - bits));
 385
 386                 if ((w1 ^ w2) & mask)
 387                         return 0;
 388         }
 389
 390         return 1;
 391 }
 392
 393
 394 static int inet_diag_bc_run(const struct nlattr *_bc,
 395                 const struct inet_diag_entry *entry)
 396 {
 397         const void *bc = nla_data(_bc);
 398         int len = nla_len(_bc);
 399
 400         while (len > 0) {
 401                 int yes = 1;
 402                 const struct inet_diag_bc_op *op = bc;
 403
 404                 switch (op->code) {
 405                 case INET_DIAG_BC_NOP:
 406                         break;
 407                 case INET_DIAG_BC_JMP:
 408                         yes = 0;
 409                         break;
 410                 case INET_DIAG_BC_S_GE:
 411                         yes = entry->sport >= op[1].no;
 412                         break;
 413                 case INET_DIAG_BC_S_LE:
 414                         yes = entry->sport <= op[1].no;
 415                         break;
 416                 case INET_DIAG_BC_D_GE:
 417                         yes = entry->dport >= op[1].no;
 418                         break;
 419                 case INET_DIAG_BC_D_LE:
 420                         yes = entry->dport <= op[1].no;
 421                         break;
 422                 case INET_DIAG_BC_AUTO:
 423                         yes = !(entry->userlocks & SOCK_BINDPORT_LOCK);
 424                         break;
 425                 case INET_DIAG_BC_S_COND:
 426                 case INET_DIAG_BC_D_COND: {
 427                         struct inet_diag_hostcond *cond;
 428                         __be32 *addr;
 429
 430                         cond = (struct inet_diag_hostcond *)(op + 1);
 431                         if (cond->port != -1 &&
 432                             cond->port != (op->code == INET_DIAG_BC_S_COND ?
 433                                              entry->sport : entry->dport)) {
 434                                 yes = 0;
 435                                 break;
 436                         }
 437
 438                         if (op->code == INET_DIAG_BC_S_COND)
 439                                 addr = entry->saddr;
 440                         else
 441                                 addr = entry->daddr;
 442
 443                         if (cond->family != AF_UNSPEC &&
 444                             cond->family != entry->family) {
 445                                 if (entry->family == AF_INET6 &&
 446                                     cond->family == AF_INET) {
 447                                         if (addr[0] == 0 && addr[1] == 0 &&
 448                                             addr[2] == htonl(0xffff) &&
 449                                             bitstring_match(addr + 3,
 450                                                             cond->addr,
 451                                                             cond->prefix_len))
 452                                                 break;
 453                                 }
 454                                 yes = 0;
 455                                 break;
 456                         }
 457
 458                         if (cond->prefix_len == 0)
 459                                 break;
 460                         if (bitstring_match(addr, cond->addr,
 461                                             cond->prefix_len))
 462                                 break;
 463                         yes = 0;
 464                         break;
 465                 }
 466                 }
 467
 468                 if (yes) {
 469                         len -= op->yes;
 470                         bc += op->yes;
 471                 } else {
 472                         len -= op->no;
 473                         bc += op->no;
 474                 }
 475         }
 476         return len == 0;
 477 }
 478
 479 int inet_diag_bc_sk(const struct nlattr *bc, struct sock *sk)
 480 {
 481         struct inet_diag_entry entry;
 482         struct inet_sock *inet = inet_sk(sk);
 483
 484         if (bc == NULL)
 485                 return 1;
 486
 487         entry.family = sk->sk_family;
 488 #if IS_ENABLED(CONFIG_IPV6)
 489         if (entry.family == AF_INET6) {
 490
 491                 entry.saddr = sk->sk_v6_rcv_saddr.s6_addr32;
 492                 entry.daddr = sk->sk_v6_daddr.s6_addr32;
 493         } else
 494 #endif
 495         {
 496                 entry.saddr = &inet->inet_rcv_saddr;
 497                 entry.daddr = &inet->inet_daddr;
 498         }
 499         entry.sport = inet->inet_num;
 500         entry.dport = ntohs(inet->inet_dport);
 501         entry.userlocks = sk->sk_userlocks;
 502
 503         return inet_diag_bc_run(bc, &entry);
 504 }
 505 EXPORT_SYMBOL_GPL(inet_diag_bc_sk);
 506
 507 static int valid_cc(const void *bc, int len, int cc)
 508 {
 509         while (len >= 0) {
 510                 const struct inet_diag_bc_op *op = bc;
 511
 512                 if (cc > len)
 513                         return 0;
 514                 if (cc == len)
 515                         return 1;
 516                 if (op->yes < 4 || op->yes & 3)
 517                         return 0;
 518                 len -= op->yes;
 519                 bc  += op->yes;
 520         }
 521         return 0;
 522 }
 523
 524 /* Validate an inet_diag_hostcond. */
 525 static bool valid_hostcond(const struct inet_diag_bc_op *op, int len,
 526                            int *min_len)
 527 {
 528         int addr_len;
 529         struct inet_diag_hostcond *cond;
 530
 531         /* Check hostcond space. */
 532         *min_len += sizeof(struct inet_diag_hostcond);
 533         if (len < *min_len)
 534                 return false;
 535         cond = (struct inet_diag_hostcond *)(op + 1);
 536
 537         /* Check address family and address length. */
 538         switch (cond->family) {
 539         case AF_UNSPEC:
 540                 addr_len = 0;
 541                 break;
 542         case AF_INET:
 543                 addr_len = sizeof(struct in_addr);
 544                 break;
 545         case AF_INET6:
 546                 addr_len = sizeof(struct in6_addr);
 547                 break;
 548         default:
 549                 return false;
 550         }
 551         *min_len += addr_len;
 552         if (len < *min_len)
 553                 return false;
 554
 555         /* Check prefix length (in bits) vs address length (in bytes). */
 556         if (cond->prefix_len > 8 * addr_len)
 557                 return false;
 558
 559         return true;
 560 }
 561
 562 /* Validate a port comparison operator. */
 563 static inline bool valid_port_comparison(const struct inet_diag_bc_op *op,
 564                                          int len, int *min_len)
 565 {
 566         /* Port comparisons put the port in a follow-on inet_diag_bc_op. */
 567         *min_len += sizeof(struct inet_diag_bc_op);
 568         if (len < *min_len)
 569                 return false;
 570         return true;
 571 }
 572
 573 static int inet_diag_bc_audit(const void *bytecode, int bytecode_len)
 574 {
 575         const void *bc = bytecode;
 576         int  len = bytecode_len;
 577
 578         while (len > 0) {
 579                 const struct inet_diag_bc_op *op = bc;
 580                 int min_len = sizeof(struct inet_diag_bc_op);
 581
 582 //printk("BC: %d %d %d {%d} / %d\n", op->code, op->yes, op->no, op[1].no, len);
 583                 switch (op->code) {
 584                 case INET_DIAG_BC_S_COND:
 585                 case INET_DIAG_BC_D_COND:
 586                         if (!valid_hostcond(bc, len, &min_len))
 587                                 return -EINVAL;
 588                         break;
 589                 case INET_DIAG_BC_S_GE:
 590                 case INET_DIAG_BC_S_LE:
 591                 case INET_DIAG_BC_D_GE:
 592                 case INET_DIAG_BC_D_LE:
 593                         if (!valid_port_comparison(bc, len, &min_len))
 594                                 return -EINVAL;
 595                         break;
 596                 case INET_DIAG_BC_AUTO:
 597                 case INET_DIAG_BC_JMP:
 598                 case INET_DIAG_BC_NOP:
 599                         break;
 600                 default:
 601                         return -EINVAL;
 602                 }
 603
 604                 if (op->code != INET_DIAG_BC_NOP) {
 605                         if (op->no < min_len || op->no > len + 4 || op->no & 3)
 606                                 return -EINVAL;
 607                         if (op->no < len &&
 608                             !valid_cc(bytecode, bytecode_len, len - op->no))
 609                                 return -EINVAL;
 610                 }
 611
 612                 if (op->yes < min_len || op->yes > len + 4 || op->yes & 3)
 613                         return -EINVAL;
 614                 bc  += op->yes;
 615                 len -= op->yes;
 616         }
 617         return len == 0 ? 0 : -EINVAL;
 618 }
 619
 620 static int inet_csk_diag_dump(struct sock *sk,
 621                               struct sk_buff *skb,
 622                               struct netlink_callback *cb,
 623                               struct inet_diag_req_v2 *r,
 624                               const struct nlattr *bc)
 625 {
 626         if (!inet_diag_bc_sk(bc, sk))
 627                 return 0;
 628
 629         return inet_csk_diag_fill(sk, skb, r,
 630                                   sk_user_ns(NETLINK_CB(cb->skb).sk),
 631                                   NETLINK_CB(cb->skb).portid,
 632                                   cb->nlh->nlmsg_seq, NLM_F_MULTI, cb->nlh);
 633 }
 634
 635 static int inet_twsk_diag_dump(struct sock *sk,
 636                                struct sk_buff *skb,
 637                                struct netlink_callback *cb,
 638                                struct inet_diag_req_v2 *r,
 639                                const struct nlattr *bc)
 640 {
 641         struct inet_timewait_sock *tw = inet_twsk(sk);
 642
 643         if (bc != NULL) {
 644                 struct inet_diag_entry entry;
 645
 646                 entry.family = tw->tw_family;
 647 #if IS_ENABLED(CONFIG_IPV6)
 648                 if (tw->tw_family == AF_INET6) {
 649                         entry.saddr = tw->tw_v6_rcv_saddr.s6_addr32;
 650                         entry.daddr = tw->tw_v6_daddr.s6_addr32;
 651                 } else
 652 #endif
 653                 {
 654                         entry.saddr = &tw->tw_rcv_saddr;
 655                         entry.daddr = &tw->tw_daddr;
 656                 }
 657                 entry.sport = tw->tw_num;
 658                 entry.dport = ntohs(tw->tw_dport);
 659                 entry.userlocks = 0;
 660
 661                 if (!inet_diag_bc_run(bc, &entry))
 662                         return 0;
 663         }
 664
 665         return inet_twsk_diag_fill(tw, skb, r,
 666                                    NETLINK_CB(cb->skb).portid,
 667                                    cb->nlh->nlmsg_seq, NLM_F_MULTI, cb->nlh);
 668 }
 669
 670 /* Get the IPv4, IPv6, or IPv4-mapped-IPv6 local and remote addresses
 671  * from a request_sock. For IPv4-mapped-IPv6 we must map IPv4 to IPv6.
 672  */
 673 static inline void inet_diag_req_addrs(const struct sock *sk,
 674                                        const struct request_sock *req,
 675                                        struct inet_diag_entry *entry)
 676 {
 677         struct inet_request_sock *ireq = inet_rsk(req);
 678
 679 #if IS_ENABLED(CONFIG_IPV6)
 680         if (sk->sk_family == AF_INET6) {
 681                 if (req->rsk_ops->family == AF_INET6) {
 682                         entry->saddr = inet6_rsk(req)->loc_addr.s6_addr32;
 683                         entry->daddr = inet6_rsk(req)->rmt_addr.s6_addr32;
 684                 } else if (req->rsk_ops->family == AF_INET) {
 685                         ipv6_addr_set_v4mapped(ireq->loc_addr,
 686                                                &entry->saddr_storage);
 687                         ipv6_addr_set_v4mapped(ireq->rmt_addr,
 688                                                &entry->daddr_storage);
 689                         entry->saddr = entry->saddr_storage.s6_addr32;
 690                         entry->daddr = entry->daddr_storage.s6_addr32;
 691                 }
 692         } else
 693 #endif
 694         {
 695                 entry->saddr = &ireq->loc_addr;
 696                 entry->daddr = &ireq->rmt_addr;
 697         }
 698 }
 699
 700 static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
 701                               struct request_sock *req,
 702                               struct user_namespace *user_ns,
 703                               u32 portid, u32 seq,
 704                               const struct nlmsghdr *unlh)
 705 {
 706         const struct inet_request_sock *ireq = inet_rsk(req);
 707         struct inet_sock *inet = inet_sk(sk);
 708         struct inet_diag_msg *r;
 709         struct nlmsghdr *nlh;
 710         long tmo;
 711
 712         nlh = nlmsg_put(skb, portid, seq, unlh->nlmsg_type, sizeof(*r),
 713                         NLM_F_MULTI);
 714         if (!nlh)
 715                 return -EMSGSIZE;
 716
 717         r = nlmsg_data(nlh);
 718         r->idiag_family = sk->sk_family;
 719         r->idiag_state = TCP_SYN_RECV;
 720         r->idiag_timer = 1;
 721         r->idiag_retrans = req->num_retrans;
 722
 723         r->id.idiag_if = sk->sk_bound_dev_if;
 724         sock_diag_save_cookie(req, r->id.idiag_cookie);
 725
 726         tmo = req->expires - jiffies;
 727         if (tmo < 0)
 728                 tmo = 0;
 729
 730         r->id.idiag_sport = inet->inet_sport;
 731         r->id.idiag_dport = ireq->rmt_port;
 732         r->id.idiag_src[0] = ireq->loc_addr;
 733         r->id.idiag_dst[0] = ireq->rmt_addr;
 734         r->idiag_expires = jiffies_to_msecs(tmo);
 735         r->idiag_rqueue = 0;
 736         r->idiag_wqueue = 0;
 737         r->idiag_uid = from_kuid_munged(user_ns, sock_i_uid(sk));
 738         r->idiag_inode = 0;
 739 #if IS_ENABLED(CONFIG_IPV6)
 740         if (r->idiag_family == AF_INET6) {
 741                 struct inet_diag_entry entry;
 742                 inet_diag_req_addrs(sk, req, &entry);
 743                 memcpy(r->id.idiag_src, entry.saddr, sizeof(struct in6_addr));
 744                 memcpy(r->id.idiag_dst, entry.daddr, sizeof(struct in6_addr));
 745         }
 746 #endif
 747
 748         return nlmsg_end(skb, nlh);
 749 }
 750
 751 static int inet_diag_dump_reqs(struct sk_buff *skb, struct sock *sk,
 752                                struct netlink_callback *cb,
 753                                struct inet_diag_req_v2 *r,
 754                                const struct nlattr *bc)
 755 {
 756         struct inet_diag_entry entry;
 757         struct inet_connection_sock *icsk = inet_csk(sk);
 758         struct listen_sock *lopt;
 759         struct inet_sock *inet = inet_sk(sk);
 760         int j, s_j;
 761         int reqnum, s_reqnum;
 762         int err = 0;
 763
 764         s_j = cb->args[3];
 765         s_reqnum = cb->args[4];
 766
 767         if (s_j > 0)
 768                 s_j--;
 769
 770         entry.family = sk->sk_family;
 771
 772         read_lock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
 773
 774         lopt = icsk->icsk_accept_queue.listen_opt;
 775         if (!lopt || !lopt->qlen)
 776                 goto out;
 777
 778         if (bc != NULL) {
 779                 entry.sport = inet->inet_num;
 780                 entry.userlocks = sk->sk_userlocks;
 781         }
 782
 783         for (j = s_j; j < lopt->nr_table_entries; j++) {
 784                 struct request_sock *req, *head = lopt->syn_table[j];
 785
 786                 reqnum = 0;
 787                 for (req = head; req; reqnum++, req = req->dl_next) {
 788                         struct inet_request_sock *ireq = inet_rsk(req);
 789
 790                         if (reqnum < s_reqnum)
 791                                 continue;
 792                         if (r->id.idiag_dport != ireq->rmt_port &&
 793                             r->id.idiag_dport)
 794                                 continue;
 795
 796                         if (bc) {
 797                                 inet_diag_req_addrs(sk, req, &entry);
 798                                 entry.dport = ntohs(ireq->rmt_port);
 799
 800                                 if (!inet_diag_bc_run(bc, &entry))
 801                                         continue;
 802                         }
 803
 804                         err = inet_diag_fill_req(skb, sk, req,
 805                                                sk_user_ns(NETLINK_CB(cb->skb).sk),
 806                                                NETLINK_CB(cb->skb).portid,
 807                                                cb->nlh->nlmsg_seq, cb->nlh);
 808                         if (err < 0) {
 809                                 cb->args[3] = j + 1;
 810                                 cb->args[4] = reqnum;
 811                                 goto out;
 812                         }
 813                 }
 814
 815                 s_reqnum = 0;
 816         }
 817
 818 out:
 819         read_unlock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
 820
 821         return err;
 822 }
 823
 824 void inet_diag_dump_icsk(struct inet_hashinfo *hashinfo, struct sk_buff *skb,
 825                 struct netlink_callback *cb, struct inet_diag_req_v2 *r, struct nlattr *bc)
 826 {
 827         int i, num;
 828         int s_i, s_num;
 829         struct net *net = sock_net(skb->sk);
 830
 831         s_i = cb->args[1];
 832         s_num = num = cb->args[2];
 833
 834         if (cb->args[0] == 0) {
 835                 if (!(r->idiag_states & (TCPF_LISTEN | TCPF_SYN_RECV)))
 836                         goto skip_listen_ht;
 837
 838                 for (i = s_i; i < INET_LHTABLE_SIZE; i++) {
 839                         struct sock *sk;
 840                         struct hlist_nulls_node *node;
 841                         struct inet_listen_hashbucket *ilb;
 842
 843                         num = 0;
 844                         ilb = &hashinfo->listening_hash[i];
 845                         spin_lock_bh(&ilb->lock);
 846                         sk_nulls_for_each(sk, node, &ilb->head) {
 847                                 struct inet_sock *inet = inet_sk(sk);
 848
 849                                 if (!net_eq(sock_net(sk), net))
 850                                         continue;
 851
 852                                 if (num < s_num) {
 853                                         num++;
 854                                         continue;
 855                                 }
 856
 857                                 if (r->sdiag_family != AF_UNSPEC &&
 858                                                 sk->sk_family != r->sdiag_family)
 859                                         goto next_listen;
 860
 861                                 if (r->id.idiag_sport != inet->inet_sport &&
 862                                     r->id.idiag_sport)
 863                                         goto next_listen;
 864
 865                                 if (!(r->idiag_states & TCPF_LISTEN) ||
 866                                     r->id.idiag_dport ||
 867                                     cb->args[3] > 0)
 868                                         goto syn_recv;
 869
 870                                 if (inet_csk_diag_dump(sk, skb, cb, r, bc) < 0) {
 871                                         spin_unlock_bh(&ilb->lock);
 872                                         goto done;
 873                                 }
 874
 875 syn_recv:
 876                                 if (!(r->idiag_states & TCPF_SYN_RECV))
 877                                         goto next_listen;
 878
 879                                 if (inet_diag_dump_reqs(skb, sk, cb, r, bc) < 0) {
 880                                         spin_unlock_bh(&ilb->lock);
 881                                         goto done;
 882                                 }
 883
 884 next_listen:
 885                                 cb->args[3] = 0;
 886                                 cb->args[4] = 0;
 887                                 ++num;
 888                         }
 889                         spin_unlock_bh(&ilb->lock);
 890
 891                         s_num = 0;
 892                         cb->args[3] = 0;
 893                         cb->args[4] = 0;
 894                 }
 895 skip_listen_ht:
 896                 cb->args[0] = 1;
 897                 s_i = num = s_num = 0;
 898         }
 899
 900         if (!(r->idiag_states & ~(TCPF_LISTEN | TCPF_SYN_RECV)))
 901                 goto out;
 902
 903         for (i = s_i; i <= hashinfo->ehash_mask; i++) {
 904                 struct inet_ehash_bucket *head = &hashinfo->ehash[i];
 905                 spinlock_t *lock = inet_ehash_lockp(hashinfo, i);
 906                 struct sock *sk;
 907                 struct hlist_nulls_node *node;
 908
 909                 num = 0;
 910
 911                 if (hlist_nulls_empty(&head->chain))
 912                         continue;
 913
 914                 if (i > s_i)
 915                         s_num = 0;
 916
 917                 spin_lock_bh(lock);
 918                 sk_nulls_for_each(sk, node, &head->chain) {
 919                         int res;
 920
 921                         if (!net_eq(sock_net(sk), net))
 922                                 continue;
 923                         if (num < s_num)
 924                                 goto next_normal;
 925                         if (!(r->idiag_states & (1 << sk->sk_state)))
 926                                 goto next_normal;
 927                         if (r->sdiag_family != AF_UNSPEC &&
 928                             sk->sk_family != r->sdiag_family)
 929                                 goto next_normal;
 930                         if (r->id.idiag_sport != htons(sk->sk_num) &&
 931                             r->id.idiag_sport)
 932                                 goto next_normal;
 933                         if (r->id.idiag_dport != sk->sk_dport &&
 934                             r->id.idiag_dport)
 935                                 goto next_normal;
 936                         if (sk->sk_state == TCP_TIME_WAIT)
 937                                 res = inet_twsk_diag_dump(sk, skb, cb, r, bc);
 938                         else
 939                                 res = inet_csk_diag_dump(sk, skb, cb, r, bc);
 940                         if (res < 0) {
 941                                 spin_unlock_bh(lock);
 942                                 goto done;
 943                         }
 944 next_normal:
 945                         ++num;
 946                 }
 947
 948                 spin_unlock_bh(lock);
 949         }
 950
 951 done:
 952         cb->args[1] = i;
 953         cb->args[2] = num;
 954 out:
 955         ;
 956 }
 957 EXPORT_SYMBOL_GPL(inet_diag_dump_icsk);
 958
 959 static int __inet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
 960                 struct inet_diag_req_v2 *r, struct nlattr *bc)
 961 {
 962         const struct inet_diag_handler *handler;
 963         int err = 0;
 964
 965         handler = inet_diag_lock_handler(r->sdiag_protocol);
 966         if (!IS_ERR(handler))
 967                 handler->dump(skb, cb, r, bc);
 968         else
 969                 err = PTR_ERR(handler);
 970         inet_diag_unlock_handler(handler);
 971
 972         return err ? : skb->len;
 973 }
 974
 975 static int inet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
 976 {
 977         struct nlattr *bc = NULL;
 978         int hdrlen = sizeof(struct inet_diag_req_v2);
 979
 980         if (nlmsg_attrlen(cb->nlh, hdrlen))
 981                 bc = nlmsg_find_attr(cb->nlh, hdrlen, INET_DIAG_REQ_BYTECODE);
 982
 983         return __inet_diag_dump(skb, cb, nlmsg_data(cb->nlh), bc);
 984 }
 985
 986 static inline int inet_diag_type2proto(int type)
 987 {
 988         switch (type) {
 989         case TCPDIAG_GETSOCK:
 990                 return IPPROTO_TCP;
 991         case DCCPDIAG_GETSOCK:
 992                 return IPPROTO_DCCP;
 993         default:
 994                 return 0;
 995         }
 996 }
 997
 998 static int inet_diag_dump_compat(struct sk_buff *skb, struct netlink_callback *cb)
 999 {
1000         struct inet_diag_req *rc = nlmsg_data(cb->nlh);
1001         struct inet_diag_req_v2 req;
1002         struct nlattr *bc = NULL;
1003         int hdrlen = sizeof(struct inet_diag_req);
1004
1005         req.sdiag_family = AF_UNSPEC; /* compatibility */
1006         req.sdiag_protocol = inet_diag_type2proto(cb->nlh->nlmsg_type);
1007         req.idiag_ext = rc->idiag_ext;
1008         req.idiag_states = rc->idiag_states;
1009         req.id = rc->id;
1010
1011         if (nlmsg_attrlen(cb->nlh, hdrlen))
1012                 bc = nlmsg_find_attr(cb->nlh, hdrlen, INET_DIAG_REQ_BYTECODE);
1013
1014         return __inet_diag_dump(skb, cb, &req, bc);
1015 }
1016
1017 static int inet_diag_get_exact_compat(struct sk_buff *in_skb,
1018                                const struct nlmsghdr *nlh)
1019 {
1020         struct inet_diag_req *rc = nlmsg_data(nlh);
1021         struct inet_diag_req_v2 req;
1022
1023         req.sdiag_family = rc->idiag_family;
1024         req.sdiag_protocol = inet_diag_type2proto(nlh->nlmsg_type);
1025         req.idiag_ext = rc->idiag_ext;
1026         req.idiag_states = rc->idiag_states;
1027         req.id = rc->id;
1028
1029         return inet_diag_get_exact(in_skb, nlh, &req);
1030 }
1031
1032 static int inet_diag_rcv_msg_compat(struct sk_buff *skb, struct nlmsghdr *nlh)
1033 {
1034         int hdrlen = sizeof(struct inet_diag_req);
1035         struct net *net = sock_net(skb->sk);
1036
1037         if (nlh->nlmsg_type >= INET_DIAG_GETSOCK_MAX ||
1038             nlmsg_len(nlh) < hdrlen)
1039                 return -EINVAL;
1040
1041         if (nlh->nlmsg_flags & NLM_F_DUMP) {
1042                 if (nlmsg_attrlen(nlh, hdrlen)) {
1043                         struct nlattr *attr;
1044
1045                         attr = nlmsg_find_attr(nlh, hdrlen,
1046                                                INET_DIAG_REQ_BYTECODE);
1047                         if (attr == NULL ||
1048                             nla_len(attr) < sizeof(struct inet_diag_bc_op) ||
1049                             inet_diag_bc_audit(nla_data(attr), nla_len(attr)))
1050                                 return -EINVAL;
1051                 }
1052                 {
1053                         struct netlink_dump_control c = {
1054                                 .dump = inet_diag_dump_compat,
1055                         };
1056                         return netlink_dump_start(net->diag_nlsk, skb, nlh, &c);
1057                 }
1058         }
1059
1060         return inet_diag_get_exact_compat(skb, nlh);
1061 }
1062
1063 static int inet_diag_handler_dump(struct sk_buff *skb, struct nlmsghdr *h)
1064 {
1065         int hdrlen = sizeof(struct inet_diag_req_v2);
1066         struct net *net = sock_net(skb->sk);
1067
1068         if (nlmsg_len(h) < hdrlen)
1069                 return -EINVAL;
1070
1071         if (h->nlmsg_flags & NLM_F_DUMP) {
1072                 if (nlmsg_attrlen(h, hdrlen)) {
1073                         struct nlattr *attr;
1074                         attr = nlmsg_find_attr(h, hdrlen,
1075                                                INET_DIAG_REQ_BYTECODE);
1076                         if (attr == NULL ||
1077                             nla_len(attr) < sizeof(struct inet_diag_bc_op) ||
1078                             inet_diag_bc_audit(nla_data(attr), nla_len(attr)))
1079                                 return -EINVAL;
1080                 }
1081                 {
1082                         struct netlink_dump_control c = {
1083                                 .dump = inet_diag_dump,
1084                         };
1085                         return netlink_dump_start(net->diag_nlsk, skb, h, &c);
1086                 }
1087         }
1088
1089         return inet_diag_get_exact(skb, h, nlmsg_data(h));
1090 }
1091
1092 static const struct sock_diag_handler inet_diag_handler = {
1093         .family = AF_INET,
1094         .dump = inet_diag_handler_dump,
1095 };
1096
1097 static const struct sock_diag_handler inet6_diag_handler = {
1098         .family = AF_INET6,
1099         .dump = inet_diag_handler_dump,
1100 };
1101
1102 int inet_diag_register(const struct inet_diag_handler *h)
1103 {
1104         const __u16 type = h->idiag_type;
1105         int err = -EINVAL;
1106
1107         if (type >= IPPROTO_MAX)
1108                 goto out;
1109
1110         mutex_lock(&inet_diag_table_mutex);
1111         err = -EEXIST;
1112         if (inet_diag_table[type] == NULL) {
1113                 inet_diag_table[type] = h;
1114                 err = 0;
1115         }
1116         mutex_unlock(&inet_diag_table_mutex);
1117 out:
1118         return err;
1119 }
1120 EXPORT_SYMBOL_GPL(inet_diag_register);
1121
1122 void inet_diag_unregister(const struct inet_diag_handler *h)
1123 {
1124         const __u16 type = h->idiag_type;
1125
1126         if (type >= IPPROTO_MAX)
1127                 return;
1128
1129         mutex_lock(&inet_diag_table_mutex);
1130         inet_diag_table[type] = NULL;
1131         mutex_unlock(&inet_diag_table_mutex);
1132 }
1133 EXPORT_SYMBOL_GPL(inet_diag_unregister);
1134
1135 static int __init inet_diag_init(void)
1136 {
1137         const int inet_diag_table_size = (IPPROTO_MAX *
1138                                           sizeof(struct inet_diag_handler *));
1139         int err = -ENOMEM;
1140
1141         inet_diag_table = kzalloc(inet_diag_table_size, GFP_KERNEL);
1142         if (!inet_diag_table)
1143                 goto out;
1144
1145         err = sock_diag_register(&inet_diag_handler);
1146         if (err)
1147                 goto out_free_nl;
1148
1149         err = sock_diag_register(&inet6_diag_handler);
1150         if (err)
1151                 goto out_free_inet;
1152
1153         sock_diag_register_inet_compat(inet_diag_rcv_msg_compat);
1154 out:
1155         return err;
1156
1157 out_free_inet:
1158         sock_diag_unregister(&inet_diag_handler);
1159 out_free_nl:
1160         kfree(inet_diag_table);
1161         goto out;
1162 }
1163
1164 static void __exit inet_diag_exit(void)
1165 {
1166         sock_diag_unregister(&inet6_diag_handler);
1167         sock_diag_unregister(&inet_diag_handler);
1168         sock_diag_unregister_inet_compat(inet_diag_rcv_msg_compat);
1169         kfree(inet_diag_table);
1170 }
1171
1172 module_init(inet_diag_init);
1173 module_exit(inet_diag_exit);
1174 MODULE_LICENSE("GPL");
1175 MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_NETLINK, NETLINK_SOCK_DIAG, 2 /* AF_INET */);
1176 MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_NETLINK, NETLINK_SOCK_DIAG, 10 /* AF_INET6 */);