net/ipv4/inet_diag.c

   1 /*
   2  * inet_diag.c  Module for monitoring INET transport protocols sockets.
   3  *
   4  * Authors:     Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
   5  *
   6  *      This program is free software; you can redistribute it and/or
   7  *      modify it under the terms of the GNU General Public License
   8  *      as published by the Free Software Foundation; either version
   9  *      2 of the License, or (at your option) any later version.
  10  */
  11
  12 #include <linux/kernel.h>
  13 #include <linux/module.h>
  14 #include <linux/types.h>
  15 #include <linux/fcntl.h>
  16 #include <linux/random.h>
  17 #include <linux/slab.h>
  18 #include <linux/cache.h>
  19 #include <linux/init.h>
  20 #include <linux/time.h>
  21
  22 #include <net/icmp.h>
  23 #include <net/tcp.h>
  24 #include <net/ipv6.h>
  25 #include <net/inet_common.h>
  26 #include <net/inet_connection_sock.h>
  27 #include <net/inet_hashtables.h>
  28 #include <net/inet_timewait_sock.h>
  29 #include <net/inet6_hashtables.h>
  30 #include <net/netlink.h>
  31
  32 #include <linux/inet.h>
  33 #include <linux/stddef.h>
  34
  35 #include <linux/inet_diag.h>
  36 #include <linux/sock_diag.h>
  37
  38 static const struct inet_diag_handler **inet_diag_table;
  39
  40 struct inet_diag_entry {
  41         const __be32 *saddr;
  42         const __be32 *daddr;
  43         u16 sport;
  44         u16 dport;
  45         u16 family;
  46         u16 userlocks;
  47         u32 ifindex;
  48         u32 mark;
  49 };
  50
  51 static DEFINE_MUTEX(inet_diag_table_mutex);
  52
  53 static const struct inet_diag_handler *inet_diag_lock_handler(int proto)
  54 {
  55         if (!inet_diag_table[proto])
  56                 request_module("net-pf-%d-proto-%d-type-%d-%d", PF_NETLINK,
  57                                NETLINK_SOCK_DIAG, AF_INET, proto);
  58
  59         mutex_lock(&inet_diag_table_mutex);
  60         if (!inet_diag_table[proto])
  61                 return ERR_PTR(-ENOENT);
  62
  63         return inet_diag_table[proto];
  64 }
  65
  66 static void inet_diag_unlock_handler(const struct inet_diag_handler *handler)
  67 {
  68         mutex_unlock(&inet_diag_table_mutex);
  69 }
  70
  71 void inet_diag_msg_common_fill(struct inet_diag_msg *r, struct sock *sk)
  72 {
  73         r->idiag_family = sk->sk_family;
  74
  75         r->id.idiag_sport = htons(sk->sk_num);
  76         r->id.idiag_dport = sk->sk_dport;
  77         r->id.idiag_if = sk->sk_bound_dev_if;
  78         sock_diag_save_cookie(sk, r->id.idiag_cookie);
  79
  80 #if IS_ENABLED(CONFIG_IPV6)
  81         if (sk->sk_family == AF_INET6) {
  82                 *(struct in6_addr *)r->id.idiag_src = sk->sk_v6_rcv_saddr;
  83                 *(struct in6_addr *)r->id.idiag_dst = sk->sk_v6_daddr;
  84         } else
  85 #endif
  86         {
  87         memset(&r->id.idiag_src, 0, sizeof(r->id.idiag_src));
  88         memset(&r->id.idiag_dst, 0, sizeof(r->id.idiag_dst));
  89
  90         r->id.idiag_src[0] = sk->sk_rcv_saddr;
  91         r->id.idiag_dst[0] = sk->sk_daddr;
  92         }
  93 }
  94 EXPORT_SYMBOL_GPL(inet_diag_msg_common_fill);
  95
  96 static size_t inet_sk_attr_size(void)
  97 {
  98         return    nla_total_size(sizeof(struct tcp_info))
  99                 + nla_total_size(1) /* INET_DIAG_SHUTDOWN */
 100                 + nla_total_size(1) /* INET_DIAG_TOS */
 101                 + nla_total_size(1) /* INET_DIAG_TCLASS */
 102                 + nla_total_size(sizeof(struct inet_diag_meminfo))
 103                 + nla_total_size(sizeof(struct inet_diag_msg))
 104                 + nla_total_size(SK_MEMINFO_VARS * sizeof(u32))
 105                 + nla_total_size(TCP_CA_NAME_MAX)
 106                 + nla_total_size(sizeof(struct tcpvegas_info))
 107                 + 64;
 108 }
 109
 110 int inet_diag_msg_attrs_fill(struct sock *sk, struct sk_buff *skb,
 111                              struct inet_diag_msg *r, int ext,
 112                              struct user_namespace *user_ns)
 113 {
 114         const struct inet_sock *inet = inet_sk(sk);
 115
 116         if (nla_put_u8(skb, INET_DIAG_SHUTDOWN, sk->sk_shutdown))
 117                 goto errout;
 118
 119         /* IPv6 dual-stack sockets use inet->tos for IPv4 connections,
 120          * hence this needs to be included regardless of socket family.
 121          */
 122         if (ext & (1 << (INET_DIAG_TOS - 1)))
 123                 if (nla_put_u8(skb, INET_DIAG_TOS, inet->tos) < 0)
 124                         goto errout;
 125
 126 #if IS_ENABLED(CONFIG_IPV6)
 127         if (r->idiag_family == AF_INET6) {
 128                 if (ext & (1 << (INET_DIAG_TCLASS - 1)))
 129                         if (nla_put_u8(skb, INET_DIAG_TCLASS,
 130                                        inet6_sk(sk)->tclass) < 0)
 131                                 goto errout;
 132
 133                 if (((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE)) &&
 134                     nla_put_u8(skb, INET_DIAG_SKV6ONLY, ipv6_only_sock(sk)))
 135                         goto errout;
 136         }
 137 #endif
 138
 139         r->idiag_uid = from_kuid_munged(user_ns, sock_i_uid(sk));
 140         r->idiag_inode = sock_i_ino(sk);
 141
 142         return 0;
 143 errout:
 144         return 1;
 145 }
 146 EXPORT_SYMBOL_GPL(inet_diag_msg_attrs_fill);
 147
 148 int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
 149                       struct sk_buff *skb, const struct inet_diag_req_v2 *req,
 150                       struct user_namespace *user_ns,
 151                       u32 portid, u32 seq, u16 nlmsg_flags,
 152                       const struct nlmsghdr *unlh)
 153 {
 154         const struct tcp_congestion_ops *ca_ops;
 155         const struct inet_diag_handler *handler;
 156         int ext = req->idiag_ext;
 157         struct inet_diag_msg *r;
 158         struct nlmsghdr  *nlh;
 159         struct nlattr *attr;
 160         void *info = NULL;
 161
 162         handler = inet_diag_table[req->sdiag_protocol];
 163         BUG_ON(!handler);
 164
 165         nlh = nlmsg_put(skb, portid, seq, unlh->nlmsg_type, sizeof(*r),
 166                         nlmsg_flags);
 167         if (!nlh)
 168                 return -EMSGSIZE;
 169
 170         r = nlmsg_data(nlh);
 171         BUG_ON(!sk_fullsock(sk));
 172
 173         inet_diag_msg_common_fill(r, sk);
 174         r->idiag_state = sk->sk_state;
 175         r->idiag_timer = 0;
 176         r->idiag_retrans = 0;
 177
 178         if (inet_diag_msg_attrs_fill(sk, skb, r, ext, user_ns))
 179                 goto errout;
 180
 181         if (ext & (1 << (INET_DIAG_MEMINFO - 1))) {
 182                 struct inet_diag_meminfo minfo = {
 183                         .idiag_rmem = sk_rmem_alloc_get(sk),
 184                         .idiag_wmem = sk->sk_wmem_queued,
 185                         .idiag_fmem = sk->sk_forward_alloc,
 186                         .idiag_tmem = sk_wmem_alloc_get(sk),
 187                 };
 188
 189                 if (nla_put(skb, INET_DIAG_MEMINFO, sizeof(minfo), &minfo) < 0)
 190                         goto errout;
 191         }
 192
 193         if (ext & (1 << (INET_DIAG_SKMEMINFO - 1)))
 194                 if (sock_diag_put_meminfo(sk, skb, INET_DIAG_SKMEMINFO))
 195                         goto errout;
 196
 197         if (!icsk) {
 198                 handler->idiag_get_info(sk, r, NULL);
 199                 goto out;
 200         }
 201
 202         if (icsk->icsk_pending == ICSK_TIME_RETRANS ||
 203             icsk->icsk_pending == ICSK_TIME_EARLY_RETRANS ||
 204             icsk->icsk_pending == ICSK_TIME_LOSS_PROBE) {
 205                 r->idiag_timer = 1;
 206                 r->idiag_retrans = icsk->icsk_retransmits;
 207                 r->idiag_expires =
 208                         jiffies_to_msecs(icsk->icsk_timeout - jiffies);
 209         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
 210                 r->idiag_timer = 4;
 211                 r->idiag_retrans = icsk->icsk_probes_out;
 212                 r->idiag_expires =
 213                         jiffies_to_msecs(icsk->icsk_timeout - jiffies);
 214         } else if (timer_pending(&sk->sk_timer)) {
 215                 r->idiag_timer = 2;
 216                 r->idiag_retrans = icsk->icsk_probes_out;
 217                 r->idiag_expires =
 218                         jiffies_to_msecs(sk->sk_timer.expires - jiffies);
 219         } else {
 220                 r->idiag_timer = 0;
 221                 r->idiag_expires = 0;
 222         }
 223
 224         if ((ext & (1 << (INET_DIAG_INFO - 1))) && handler->idiag_info_size) {
 225                 attr = nla_reserve_64bit(skb, INET_DIAG_INFO,
 226                                          handler->idiag_info_size,
 227                                          INET_DIAG_PAD);
 228                 if (!attr)
 229                         goto errout;
 230
 231                 info = nla_data(attr);
 232         }
 233
 234         if (ext & (1 << (INET_DIAG_CONG - 1))) {
 235                 int err = 0;
 236
 237                 rcu_read_lock();
 238                 ca_ops = READ_ONCE(icsk->icsk_ca_ops);
 239                 if (ca_ops)
 240                         err = nla_put_string(skb, INET_DIAG_CONG, ca_ops->name);
 241                 rcu_read_unlock();
 242                 if (err < 0)
 243                         goto errout;
 244         }
 245
 246         handler->idiag_get_info(sk, r, info);
 247
 248         if (sk->sk_state < TCP_TIME_WAIT) {
 249                 union tcp_cc_info info;
 250                 size_t sz = 0;
 251                 int attr;
 252
 253                 rcu_read_lock();
 254                 ca_ops = READ_ONCE(icsk->icsk_ca_ops);
 255                 if (ca_ops && ca_ops->get_info)
 256                         sz = ca_ops->get_info(sk, ext, &attr, &info);
 257                 rcu_read_unlock();
 258                 if (sz && nla_put(skb, attr, sz, &info) < 0)
 259                         goto errout;
 260         }
 261
 262 out:
 263         nlmsg_end(skb, nlh);
 264         return 0;
 265
 266 errout:
 267         nlmsg_cancel(skb, nlh);
 268         return -EMSGSIZE;
 269 }
 270 EXPORT_SYMBOL_GPL(inet_sk_diag_fill);
 271
 272 static int inet_csk_diag_fill(struct sock *sk,
 273                               struct sk_buff *skb,
 274                               const struct inet_diag_req_v2 *req,
 275                               struct user_namespace *user_ns,
 276                               u32 portid, u32 seq, u16 nlmsg_flags,
 277                               const struct nlmsghdr *unlh)
 278 {
 279         return inet_sk_diag_fill(sk, inet_csk(sk), skb, req,
 280                                  user_ns, portid, seq, nlmsg_flags, unlh);
 281 }
 282
 283 static int inet_twsk_diag_fill(struct sock *sk,
 284                                struct sk_buff *skb,
 285                                u32 portid, u32 seq, u16 nlmsg_flags,
 286                                const struct nlmsghdr *unlh)
 287 {
 288         struct inet_timewait_sock *tw = inet_twsk(sk);
 289         struct inet_diag_msg *r;
 290         struct nlmsghdr *nlh;
 291         long tmo;
 292
 293         nlh = nlmsg_put(skb, portid, seq, unlh->nlmsg_type, sizeof(*r),
 294                         nlmsg_flags);
 295         if (!nlh)
 296                 return -EMSGSIZE;
 297
 298         r = nlmsg_data(nlh);
 299         BUG_ON(tw->tw_state != TCP_TIME_WAIT);
 300
 301         tmo = tw->tw_timer.expires - jiffies;
 302         if (tmo < 0)
 303                 tmo = 0;
 304
 305         inet_diag_msg_common_fill(r, sk);
 306         r->idiag_retrans      = 0;
 307
 308         r->idiag_state        = tw->tw_substate;
 309         r->idiag_timer        = 3;
 310         r->idiag_expires      = jiffies_to_msecs(tmo);
 311         r->idiag_rqueue       = 0;
 312         r->idiag_wqueue       = 0;
 313         r->idiag_uid          = 0;
 314         r->idiag_inode        = 0;
 315
 316         nlmsg_end(skb, nlh);
 317         return 0;
 318 }
 319
 320 static int inet_req_diag_fill(struct sock *sk, struct sk_buff *skb,
 321                               u32 portid, u32 seq, u16 nlmsg_flags,
 322                               const struct nlmsghdr *unlh)
 323 {
 324         struct inet_diag_msg *r;
 325         struct nlmsghdr *nlh;
 326         long tmo;
 327
 328         nlh = nlmsg_put(skb, portid, seq, unlh->nlmsg_type, sizeof(*r),
 329                         nlmsg_flags);
 330         if (!nlh)
 331                 return -EMSGSIZE;
 332
 333         r = nlmsg_data(nlh);
 334         inet_diag_msg_common_fill(r, sk);
 335         r->idiag_state = TCP_SYN_RECV;
 336         r->idiag_timer = 1;
 337         r->idiag_retrans = inet_reqsk(sk)->num_retrans;
 338
 339         BUILD_BUG_ON(offsetof(struct inet_request_sock, ir_cookie) !=
 340                      offsetof(struct sock, sk_cookie));
 341
 342         tmo = inet_reqsk(sk)->rsk_timer.expires - jiffies;
 343         r->idiag_expires = (tmo >= 0) ? jiffies_to_msecs(tmo) : 0;
 344         r->idiag_rqueue = 0;
 345         r->idiag_wqueue = 0;
 346         r->idiag_uid    = 0;
 347         r->idiag_inode  = 0;
 348
 349         nlmsg_end(skb, nlh);
 350         return 0;
 351 }
 352
 353 static int sk_diag_fill(struct sock *sk, struct sk_buff *skb,
 354                         const struct inet_diag_req_v2 *r,
 355                         struct user_namespace *user_ns,
 356                         u32 portid, u32 seq, u16 nlmsg_flags,
 357                         const struct nlmsghdr *unlh)
 358 {
 359         if (sk->sk_state == TCP_TIME_WAIT)
 360                 return inet_twsk_diag_fill(sk, skb, portid, seq,
 361                                            nlmsg_flags, unlh);
 362
 363         if (sk->sk_state == TCP_NEW_SYN_RECV)
 364                 return inet_req_diag_fill(sk, skb, portid, seq,
 365                                           nlmsg_flags, unlh);
 366
 367         return inet_csk_diag_fill(sk, skb, r, user_ns, portid, seq,
 368                                   nlmsg_flags, unlh);
 369 }
 370
 371 struct sock *inet_diag_find_one_icsk(struct net *net,
 372                                      struct inet_hashinfo *hashinfo,
 373                                      const struct inet_diag_req_v2 *req)
 374 {
 375         struct sock *sk;
 376
 377         rcu_read_lock();
 378         if (req->sdiag_family == AF_INET)
 379                 sk = inet_lookup(net, hashinfo, NULL, 0, req->id.idiag_dst[0],
 380                                  req->id.idiag_dport, req->id.idiag_src[0],
 381                                  req->id.idiag_sport, req->id.idiag_if);
 382 #if IS_ENABLED(CONFIG_IPV6)
 383         else if (req->sdiag_family == AF_INET6) {
 384                 if (ipv6_addr_v4mapped((struct in6_addr *)req->id.idiag_dst) &&
 385                     ipv6_addr_v4mapped((struct in6_addr *)req->id.idiag_src))
 386                         sk = inet_lookup(net, hashinfo, NULL, 0, req->id.idiag_dst[3],
 387                                          req->id.idiag_dport, req->id.idiag_src[3],
 388                                          req->id.idiag_sport, req->id.idiag_if);
 389                 else
 390                         sk = inet6_lookup(net, hashinfo, NULL, 0,
 391                                           (struct in6_addr *)req->id.idiag_dst,
 392                                           req->id.idiag_dport,
 393                                           (struct in6_addr *)req->id.idiag_src,
 394                                           req->id.idiag_sport,
 395                                           req->id.idiag_if);
 396         }
 397 #endif
 398         else {
 399                 rcu_read_unlock();
 400                 return ERR_PTR(-EINVAL);
 401         }
 402         rcu_read_unlock();
 403         if (!sk)
 404                 return ERR_PTR(-ENOENT);
 405
 406         if (sock_diag_check_cookie(sk, req->id.idiag_cookie)) {
 407                 sock_gen_put(sk);
 408                 return ERR_PTR(-ENOENT);
 409         }
 410
 411         return sk;
 412 }
 413 EXPORT_SYMBOL_GPL(inet_diag_find_one_icsk);
 414
 415 int inet_diag_dump_one_icsk(struct inet_hashinfo *hashinfo,
 416                             struct sk_buff *in_skb,
 417                             const struct nlmsghdr *nlh,
 418                             const struct inet_diag_req_v2 *req)
 419 {
 420         struct net *net = sock_net(in_skb->sk);
 421         struct sk_buff *rep;
 422         struct sock *sk;
 423         int err;
 424
 425         sk = inet_diag_find_one_icsk(net, hashinfo, req);
 426         if (IS_ERR(sk))
 427                 return PTR_ERR(sk);
 428
 429         rep = nlmsg_new(inet_sk_attr_size(), GFP_KERNEL);
 430         if (!rep) {
 431                 err = -ENOMEM;
 432                 goto out;
 433         }
 434
 435         err = sk_diag_fill(sk, rep, req,
 436                            sk_user_ns(NETLINK_CB(in_skb).sk),
 437                            NETLINK_CB(in_skb).portid,
 438                            nlh->nlmsg_seq, 0, nlh);
 439         if (err < 0) {
 440                 WARN_ON(err == -EMSGSIZE);
 441                 nlmsg_free(rep);
 442                 goto out;
 443         }
 444         err = netlink_unicast(net->diag_nlsk, rep, NETLINK_CB(in_skb).portid,
 445                               MSG_DONTWAIT);
 446         if (err > 0)
 447                 err = 0;
 448
 449 out:
 450         if (sk)
 451                 sock_gen_put(sk);
 452
 453         return err;
 454 }
 455 EXPORT_SYMBOL_GPL(inet_diag_dump_one_icsk);
 456
 457 static int inet_diag_cmd_exact(int cmd, struct sk_buff *in_skb,
 458                                const struct nlmsghdr *nlh,
 459                                const struct inet_diag_req_v2 *req)
 460 {
 461         const struct inet_diag_handler *handler;
 462         int err;
 463
 464         handler = inet_diag_lock_handler(req->sdiag_protocol);
 465         if (IS_ERR(handler))
 466                 err = PTR_ERR(handler);
 467         else if (cmd == SOCK_DIAG_BY_FAMILY)
 468                 err = handler->dump_one(in_skb, nlh, req);
 469         else if (cmd == SOCK_DESTROY && handler->destroy)
 470                 err = handler->destroy(in_skb, req);
 471         else
 472                 err = -EOPNOTSUPP;
 473         inet_diag_unlock_handler(handler);
 474
 475         return err;
 476 }
 477
 478 static int bitstring_match(const __be32 *a1, const __be32 *a2, int bits)
 479 {
 480         int words = bits >> 5;
 481
 482         bits &= 0x1f;
 483
 484         if (words) {
 485                 if (memcmp(a1, a2, words << 2))
 486                         return 0;
 487         }
 488         if (bits) {
 489                 __be32 w1, w2;
 490                 __be32 mask;
 491
 492                 w1 = a1[words];
 493                 w2 = a2[words];
 494
 495                 mask = htonl((0xffffffff) << (32 - bits));
 496
 497                 if ((w1 ^ w2) & mask)
 498                         return 0;
 499         }
 500
 501         return 1;
 502 }
 503
 504 static int inet_diag_bc_run(const struct nlattr *_bc,
 505                             const struct inet_diag_entry *entry)
 506 {
 507         const void *bc = nla_data(_bc);
 508         int len = nla_len(_bc);
 509
 510         while (len > 0) {
 511                 int yes = 1;
 512                 const struct inet_diag_bc_op *op = bc;
 513
 514                 switch (op->code) {
 515                 case INET_DIAG_BC_NOP:
 516                         break;
 517                 case INET_DIAG_BC_JMP:
 518                         yes = 0;
 519                         break;
 520                 case INET_DIAG_BC_S_GE:
 521                         yes = entry->sport >= op[1].no;
 522                         break;
 523                 case INET_DIAG_BC_S_LE:
 524                         yes = entry->sport <= op[1].no;
 525                         break;
 526                 case INET_DIAG_BC_D_GE:
 527                         yes = entry->dport >= op[1].no;
 528                         break;
 529                 case INET_DIAG_BC_D_LE:
 530                         yes = entry->dport <= op[1].no;
 531                         break;
 532                 case INET_DIAG_BC_AUTO:
 533                         yes = !(entry->userlocks & SOCK_BINDPORT_LOCK);
 534                         break;
 535                 case INET_DIAG_BC_S_COND:
 536                 case INET_DIAG_BC_D_COND: {
 537                         const struct inet_diag_hostcond *cond;
 538                         const __be32 *addr;
 539
 540                         cond = (const struct inet_diag_hostcond *)(op + 1);
 541                         if (cond->port != -1 &&
 542                             cond->port != (op->code == INET_DIAG_BC_S_COND ?
 543                                              entry->sport : entry->dport)) {
 544                                 yes = 0;
 545                                 break;
 546                         }
 547
 548                         if (op->code == INET_DIAG_BC_S_COND)
 549                                 addr = entry->saddr;
 550                         else
 551                                 addr = entry->daddr;
 552
 553                         if (cond->family != AF_UNSPEC &&
 554                             cond->family != entry->family) {
 555                                 if (entry->family == AF_INET6 &&
 556                                     cond->family == AF_INET) {
 557                                         if (addr[0] == 0 && addr[1] == 0 &&
 558                                             addr[2] == htonl(0xffff) &&
 559                                             bitstring_match(addr + 3,
 560                                                             cond->addr,
 561                                                             cond->prefix_len))
 562                                                 break;
 563                                 }
 564                                 yes = 0;
 565                                 break;
 566                         }
 567
 568                         if (cond->prefix_len == 0)
 569                                 break;
 570                         if (bitstring_match(addr, cond->addr,
 571                                             cond->prefix_len))
 572                                 break;
 573                         yes = 0;
 574                         break;
 575                 }
 576                 case INET_DIAG_BC_DEV_COND: {
 577                         u32 ifindex;
 578
 579                         ifindex = *((const u32 *)(op + 1));
 580                         if (ifindex != entry->ifindex)
 581                                 yes = 0;
 582                         break;
 583                 }
 584                 case INET_DIAG_BC_MARK_COND: {
 585                         struct inet_diag_markcond *cond;
 586
 587                         cond = (struct inet_diag_markcond *)(op + 1);
 588                         if ((entry->mark & cond->mask) != cond->mark)
 589                                 yes = 0;
 590                         break;
 591                 }
 592                 }
 593
 594                 if (yes) {
 595                         len -= op->yes;
 596                         bc += op->yes;
 597                 } else {
 598                         len -= op->no;
 599                         bc += op->no;
 600                 }
 601         }
 602         return len == 0;
 603 }
 604
 605 /* This helper is available for all sockets (ESTABLISH, TIMEWAIT, SYN_RECV)
 606  */
 607 static void entry_fill_addrs(struct inet_diag_entry *entry,
 608                              const struct sock *sk)
 609 {
 610 #if IS_ENABLED(CONFIG_IPV6)
 611         if (sk->sk_family == AF_INET6) {
 612                 entry->saddr = sk->sk_v6_rcv_saddr.s6_addr32;
 613                 entry->daddr = sk->sk_v6_daddr.s6_addr32;
 614         } else
 615 #endif
 616         {
 617                 entry->saddr = &sk->sk_rcv_saddr;
 618                 entry->daddr = &sk->sk_daddr;
 619         }
 620 }
 621
 622 int inet_diag_bc_sk(const struct nlattr *bc, struct sock *sk)
 623 {
 624         struct inet_sock *inet = inet_sk(sk);
 625         struct inet_diag_entry entry;
 626
 627         if (!bc)
 628                 return 1;
 629
 630         entry.family = sk->sk_family;
 631         entry_fill_addrs(&entry, sk);
 632         entry.sport = inet->inet_num;
 633         entry.dport = ntohs(inet->inet_dport);
 634         entry.ifindex = sk->sk_bound_dev_if;
 635         entry.userlocks = sk_fullsock(sk) ? sk->sk_userlocks : 0;
 636         if (sk_fullsock(sk))
 637                 entry.mark = sk->sk_mark;
 638         else if (sk->sk_state == TCP_NEW_SYN_RECV)
 639                 entry.mark = inet_rsk(inet_reqsk(sk))->ir_mark;
 640         else
 641                 entry.mark = 0;
 642
 643         return inet_diag_bc_run(bc, &entry);
 644 }
 645 EXPORT_SYMBOL_GPL(inet_diag_bc_sk);
 646
 647 static int valid_cc(const void *bc, int len, int cc)
 648 {
 649         while (len >= 0) {
 650                 const struct inet_diag_bc_op *op = bc;
 651
 652                 if (cc > len)
 653                         return 0;
 654                 if (cc == len)
 655                         return 1;
 656                 if (op->yes < 4 || op->yes & 3)
 657                         return 0;
 658                 len -= op->yes;
 659                 bc  += op->yes;
 660         }
 661         return 0;
 662 }
 663
 664 /* data is u32 ifindex */
 665 static bool valid_devcond(const struct inet_diag_bc_op *op, int len,
 666                           int *min_len)
 667 {
 668         /* Check ifindex space. */
 669         *min_len += sizeof(u32);
 670         if (len < *min_len)
 671                 return false;
 672
 673         return true;
 674 }
 675 /* Validate an inet_diag_hostcond. */
 676 static bool valid_hostcond(const struct inet_diag_bc_op *op, int len,
 677                            int *min_len)
 678 {
 679         struct inet_diag_hostcond *cond;
 680         int addr_len;
 681
 682         /* Check hostcond space. */
 683         *min_len += sizeof(struct inet_diag_hostcond);
 684         if (len < *min_len)
 685                 return false;
 686         cond = (struct inet_diag_hostcond *)(op + 1);
 687
 688         /* Check address family and address length. */
 689         switch (cond->family) {
 690         case AF_UNSPEC:
 691                 addr_len = 0;
 692                 break;
 693         case AF_INET:
 694                 addr_len = sizeof(struct in_addr);
 695                 break;
 696         case AF_INET6:
 697                 addr_len = sizeof(struct in6_addr);
 698                 break;
 699         default:
 700                 return false;
 701         }
 702         *min_len += addr_len;
 703         if (len < *min_len)
 704                 return false;
 705
 706         /* Check prefix length (in bits) vs address length (in bytes). */
 707         if (cond->prefix_len > 8 * addr_len)
 708                 return false;
 709
 710         return true;
 711 }
 712
 713 /* Validate a port comparison operator. */
 714 static bool valid_port_comparison(const struct inet_diag_bc_op *op,
 715                                   int len, int *min_len)
 716 {
 717         /* Port comparisons put the port in a follow-on inet_diag_bc_op. */
 718         *min_len += sizeof(struct inet_diag_bc_op);
 719         if (len < *min_len)
 720                 return false;
 721         return true;
 722 }
 723
 724 static bool valid_markcond(const struct inet_diag_bc_op *op, int len,
 725                            int *min_len)
 726 {
 727         *min_len += sizeof(struct inet_diag_markcond);
 728         return len >= *min_len;
 729 }
 730
 731 static int inet_diag_bc_audit(const struct nlattr *attr,
 732                               const struct sk_buff *skb)
 733 {
 734         bool net_admin = netlink_net_capable(skb, CAP_NET_ADMIN);
 735         const void *bytecode, *bc;
 736         int bytecode_len, len;
 737
 738         if (!attr || nla_len(attr) < sizeof(struct inet_diag_bc_op))
 739                 return -EINVAL;
 740
 741         bytecode = bc = nla_data(attr);
 742         len = bytecode_len = nla_len(attr);
 743
 744         while (len > 0) {
 745                 int min_len = sizeof(struct inet_diag_bc_op);
 746                 const struct inet_diag_bc_op *op = bc;
 747
 748                 switch (op->code) {
 749                 case INET_DIAG_BC_S_COND:
 750                 case INET_DIAG_BC_D_COND:
 751                         if (!valid_hostcond(bc, len, &min_len))
 752                                 return -EINVAL;
 753                         break;
 754                 case INET_DIAG_BC_DEV_COND:
 755                         if (!valid_devcond(bc, len, &min_len))
 756                                 return -EINVAL;
 757                         break;
 758                 case INET_DIAG_BC_S_GE:
 759                 case INET_DIAG_BC_S_LE:
 760                 case INET_DIAG_BC_D_GE:
 761                 case INET_DIAG_BC_D_LE:
 762                         if (!valid_port_comparison(bc, len, &min_len))
 763                                 return -EINVAL;
 764                         break;
 765                 case INET_DIAG_BC_MARK_COND:
 766                         if (!net_admin)
 767                                 return -EPERM;
 768                         if (!valid_markcond(bc, len, &min_len))
 769                                 return -EINVAL;
 770                         break;
 771                 case INET_DIAG_BC_AUTO:
 772                 case INET_DIAG_BC_JMP:
 773                 case INET_DIAG_BC_NOP:
 774                         break;
 775                 default:
 776                         return -EINVAL;
 777                 }
 778
 779                 if (op->code != INET_DIAG_BC_NOP) {
 780                         if (op->no < min_len || op->no > len + 4 || op->no & 3)
 781                                 return -EINVAL;
 782                         if (op->no < len &&
 783                             !valid_cc(bytecode, bytecode_len, len - op->no))
 784                                 return -EINVAL;
 785                 }
 786
 787                 if (op->yes < min_len || op->yes > len + 4 || op->yes & 3)
 788                         return -EINVAL;
 789                 bc  += op->yes;
 790                 len -= op->yes;
 791         }
 792         return len == 0 ? 0 : -EINVAL;
 793 }
 794
 795 static int inet_csk_diag_dump(struct sock *sk,
 796                               struct sk_buff *skb,
 797                               struct netlink_callback *cb,
 798                               const struct inet_diag_req_v2 *r,
 799                               const struct nlattr *bc)
 800 {
 801         if (!inet_diag_bc_sk(bc, sk))
 802                 return 0;
 803
 804         return inet_csk_diag_fill(sk, skb, r,
 805                                   sk_user_ns(NETLINK_CB(cb->skb).sk),
 806                                   NETLINK_CB(cb->skb).portid,
 807                                   cb->nlh->nlmsg_seq, NLM_F_MULTI, cb->nlh);
 808 }
 809
 810 static void twsk_build_assert(void)
 811 {
 812         BUILD_BUG_ON(offsetof(struct inet_timewait_sock, tw_family) !=
 813                      offsetof(struct sock, sk_family));
 814
 815         BUILD_BUG_ON(offsetof(struct inet_timewait_sock, tw_num) !=
 816                      offsetof(struct inet_sock, inet_num));
 817
 818         BUILD_BUG_ON(offsetof(struct inet_timewait_sock, tw_dport) !=
 819                      offsetof(struct inet_sock, inet_dport));
 820
 821         BUILD_BUG_ON(offsetof(struct inet_timewait_sock, tw_rcv_saddr) !=
 822                      offsetof(struct inet_sock, inet_rcv_saddr));
 823
 824         BUILD_BUG_ON(offsetof(struct inet_timewait_sock, tw_daddr) !=
 825                      offsetof(struct inet_sock, inet_daddr));
 826
 827 #if IS_ENABLED(CONFIG_IPV6)
 828         BUILD_BUG_ON(offsetof(struct inet_timewait_sock, tw_v6_rcv_saddr) !=
 829                      offsetof(struct sock, sk_v6_rcv_saddr));
 830
 831         BUILD_BUG_ON(offsetof(struct inet_timewait_sock, tw_v6_daddr) !=
 832                      offsetof(struct sock, sk_v6_daddr));
 833 #endif
 834 }
 835
 836 void inet_diag_dump_icsk(struct inet_hashinfo *hashinfo, struct sk_buff *skb,
 837                          struct netlink_callback *cb,
 838                          const struct inet_diag_req_v2 *r, struct nlattr *bc)
 839 {
 840         struct net *net = sock_net(skb->sk);
 841         int i, num, s_i, s_num;
 842         u32 idiag_states = r->idiag_states;
 843
 844         if (idiag_states & TCPF_SYN_RECV)
 845                 idiag_states |= TCPF_NEW_SYN_RECV;
 846         s_i = cb->args[1];
 847         s_num = num = cb->args[2];
 848
 849         if (cb->args[0] == 0) {
 850                 if (!(idiag_states & TCPF_LISTEN))
 851                         goto skip_listen_ht;
 852
 853                 for (i = s_i; i < INET_LHTABLE_SIZE; i++) {
 854                         struct inet_listen_hashbucket *ilb;
 855                         struct sock *sk;
 856
 857                         num = 0;
 858                         ilb = &hashinfo->listening_hash[i];
 859                         spin_lock_bh(&ilb->lock);
 860                         sk_for_each(sk, &ilb->head) {
 861                                 struct inet_sock *inet = inet_sk(sk);
 862
 863                                 if (!net_eq(sock_net(sk), net))
 864                                         continue;
 865
 866                                 if (num < s_num) {
 867                                         num++;
 868                                         continue;
 869                                 }
 870
 871                                 if (r->sdiag_family != AF_UNSPEC &&
 872                                     sk->sk_family != r->sdiag_family)
 873                                         goto next_listen;
 874
 875                                 if (r->id.idiag_sport != inet->inet_sport &&
 876                                     r->id.idiag_sport)
 877                                         goto next_listen;
 878
 879                                 if (r->id.idiag_dport ||
 880                                     cb->args[3] > 0)
 881                                         goto next_listen;
 882
 883                                 if (inet_csk_diag_dump(sk, skb, cb, r, bc) < 0) {
 884                                         spin_unlock_bh(&ilb->lock);
 885                                         goto done;
 886                                 }
 887
 888 next_listen:
 889                                 cb->args[3] = 0;
 890                                 cb->args[4] = 0;
 891                                 ++num;
 892                         }
 893                         spin_unlock_bh(&ilb->lock);
 894
 895                         s_num = 0;
 896                         cb->args[3] = 0;
 897                         cb->args[4] = 0;
 898                 }
 899 skip_listen_ht:
 900                 cb->args[0] = 1;
 901                 s_i = num = s_num = 0;
 902         }
 903
 904         if (!(idiag_states & ~TCPF_LISTEN))
 905                 goto out;
 906
 907         for (i = s_i; i <= hashinfo->ehash_mask; i++) {
 908                 struct inet_ehash_bucket *head = &hashinfo->ehash[i];
 909                 spinlock_t *lock = inet_ehash_lockp(hashinfo, i);
 910                 struct hlist_nulls_node *node;
 911                 struct sock *sk;
 912
 913                 num = 0;
 914
 915                 if (hlist_nulls_empty(&head->chain))
 916                         continue;
 917
 918                 if (i > s_i)
 919                         s_num = 0;
 920
 921                 spin_lock_bh(lock);
 922                 sk_nulls_for_each(sk, node, &head->chain) {
 923                         int state, res;
 924
 925                         if (!net_eq(sock_net(sk), net))
 926                                 continue;
 927                         if (num < s_num)
 928                                 goto next_normal;
 929                         state = (sk->sk_state == TCP_TIME_WAIT) ?
 930                                 inet_twsk(sk)->tw_substate : sk->sk_state;
 931                         if (!(idiag_states & (1 << state)))
 932                                 goto next_normal;
 933                         if (r->sdiag_family != AF_UNSPEC &&
 934                             sk->sk_family != r->sdiag_family)
 935                                 goto next_normal;
 936                         if (r->id.idiag_sport != htons(sk->sk_num) &&
 937                             r->id.idiag_sport)
 938                                 goto next_normal;
 939                         if (r->id.idiag_dport != sk->sk_dport &&
 940                             r->id.idiag_dport)
 941                                 goto next_normal;
 942                         twsk_build_assert();
 943
 944                         if (!inet_diag_bc_sk(bc, sk))
 945                                 goto next_normal;
 946
 947                         res = sk_diag_fill(sk, skb, r,
 948                                            sk_user_ns(NETLINK_CB(cb->skb).sk),
 949                                            NETLINK_CB(cb->skb).portid,
 950                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
 951                                            cb->nlh);
 952                         if (res < 0) {
 953                                 spin_unlock_bh(lock);
 954                                 goto done;
 955                         }
 956 next_normal:
 957                         ++num;
 958                 }
 959
 960                 spin_unlock_bh(lock);
 961                 cond_resched();
 962         }
 963
 964 done:
 965         cb->args[1] = i;
 966         cb->args[2] = num;
 967 out:
 968         ;
 969 }
 970 EXPORT_SYMBOL_GPL(inet_diag_dump_icsk);
 971
 972 static int __inet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
 973                             const struct inet_diag_req_v2 *r,
 974                             struct nlattr *bc)
 975 {
 976         const struct inet_diag_handler *handler;
 977         int err = 0;
 978
 979         handler = inet_diag_lock_handler(r->sdiag_protocol);
 980         if (!IS_ERR(handler))
 981                 handler->dump(skb, cb, r, bc);
 982         else
 983                 err = PTR_ERR(handler);
 984         inet_diag_unlock_handler(handler);
 985
 986         return err ? : skb->len;
 987 }
 988
 989 static int inet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
 990 {
 991         int hdrlen = sizeof(struct inet_diag_req_v2);
 992         struct nlattr *bc = NULL;
 993
 994         if (nlmsg_attrlen(cb->nlh, hdrlen))
 995                 bc = nlmsg_find_attr(cb->nlh, hdrlen, INET_DIAG_REQ_BYTECODE);
 996
 997         return __inet_diag_dump(skb, cb, nlmsg_data(cb->nlh), bc);
 998 }
 999
1000 static int inet_diag_type2proto(int type)
1001 {
1002         switch (type) {
1003         case TCPDIAG_GETSOCK:
1004                 return IPPROTO_TCP;
1005         case DCCPDIAG_GETSOCK:
1006                 return IPPROTO_DCCP;
1007         default:
1008                 return 0;
1009         }
1010 }
1011
1012 static int inet_diag_dump_compat(struct sk_buff *skb,
1013                                  struct netlink_callback *cb)
1014 {
1015         struct inet_diag_req *rc = nlmsg_data(cb->nlh);
1016         int hdrlen = sizeof(struct inet_diag_req);
1017         struct inet_diag_req_v2 req;
1018         struct nlattr *bc = NULL;
1019
1020         req.sdiag_family = AF_UNSPEC; /* compatibility */
1021         req.sdiag_protocol = inet_diag_type2proto(cb->nlh->nlmsg_type);
1022         req.idiag_ext = rc->idiag_ext;
1023         req.idiag_states = rc->idiag_states;
1024         req.id = rc->id;
1025
1026         if (nlmsg_attrlen(cb->nlh, hdrlen))
1027                 bc = nlmsg_find_attr(cb->nlh, hdrlen, INET_DIAG_REQ_BYTECODE);
1028
1029         return __inet_diag_dump(skb, cb, &req, bc);
1030 }
1031
1032 static int inet_diag_get_exact_compat(struct sk_buff *in_skb,
1033                                       const struct nlmsghdr *nlh)
1034 {
1035         struct inet_diag_req *rc = nlmsg_data(nlh);
1036         struct inet_diag_req_v2 req;
1037
1038         req.sdiag_family = rc->idiag_family;
1039         req.sdiag_protocol = inet_diag_type2proto(nlh->nlmsg_type);
1040         req.idiag_ext = rc->idiag_ext;
1041         req.idiag_states = rc->idiag_states;
1042         req.id = rc->id;
1043
1044         return inet_diag_cmd_exact(SOCK_DIAG_BY_FAMILY, in_skb, nlh, &req);
1045 }
1046
1047 static int inet_diag_rcv_msg_compat(struct sk_buff *skb, struct nlmsghdr *nlh)
1048 {
1049         int hdrlen = sizeof(struct inet_diag_req);
1050         struct net *net = sock_net(skb->sk);
1051
1052         if (nlh->nlmsg_type >= INET_DIAG_GETSOCK_MAX ||
1053             nlmsg_len(nlh) < hdrlen)
1054                 return -EINVAL;
1055
1056         if (nlh->nlmsg_flags & NLM_F_DUMP) {
1057                 if (nlmsg_attrlen(nlh, hdrlen)) {
1058                         struct nlattr *attr;
1059                         int err;
1060
1061                         attr = nlmsg_find_attr(nlh, hdrlen,
1062                                                INET_DIAG_REQ_BYTECODE);
1063                         err = inet_diag_bc_audit(attr, skb);
1064                         if (err)
1065                                 return err;
1066                 }
1067                 {
1068                         struct netlink_dump_control c = {
1069                                 .dump = inet_diag_dump_compat,
1070                         };
1071                         return netlink_dump_start(net->diag_nlsk, skb, nlh, &c);
1072                 }
1073         }
1074
1075         return inet_diag_get_exact_compat(skb, nlh);
1076 }
1077
1078 static int inet_diag_handler_cmd(struct sk_buff *skb, struct nlmsghdr *h)
1079 {
1080         int hdrlen = sizeof(struct inet_diag_req_v2);
1081         struct net *net = sock_net(skb->sk);
1082
1083         if (nlmsg_len(h) < hdrlen)
1084                 return -EINVAL;
1085
1086         if (h->nlmsg_type == SOCK_DIAG_BY_FAMILY &&
1087             h->nlmsg_flags & NLM_F_DUMP) {
1088                 if (nlmsg_attrlen(h, hdrlen)) {
1089                         struct nlattr *attr;
1090                         int err;
1091
1092                         attr = nlmsg_find_attr(h, hdrlen,
1093                                                INET_DIAG_REQ_BYTECODE);
1094                         err = inet_diag_bc_audit(attr, skb);
1095                         if (err)
1096                                 return err;
1097                 }
1098                 {
1099                         struct netlink_dump_control c = {
1100                                 .dump = inet_diag_dump,
1101                         };
1102                         return netlink_dump_start(net->diag_nlsk, skb, h, &c);
1103                 }
1104         }
1105
1106         return inet_diag_cmd_exact(h->nlmsg_type, skb, h, nlmsg_data(h));
1107 }
1108
1109 static
1110 int inet_diag_handler_get_info(struct sk_buff *skb, struct sock *sk)
1111 {
1112         const struct inet_diag_handler *handler;
1113         struct nlmsghdr *nlh;
1114         struct nlattr *attr;
1115         struct inet_diag_msg *r;
1116         void *info = NULL;
1117         int err = 0;
1118
1119         nlh = nlmsg_put(skb, 0, 0, SOCK_DIAG_BY_FAMILY, sizeof(*r), 0);
1120         if (!nlh)
1121                 return -ENOMEM;
1122
1123         r = nlmsg_data(nlh);
1124         memset(r, 0, sizeof(*r));
1125         inet_diag_msg_common_fill(r, sk);
1126         if (sk->sk_type == SOCK_DGRAM || sk->sk_type == SOCK_STREAM)
1127                 r->id.idiag_sport = inet_sk(sk)->inet_sport;
1128         r->idiag_state = sk->sk_state;
1129
1130         if ((err = nla_put_u8(skb, INET_DIAG_PROTOCOL, sk->sk_protocol))) {
1131                 nlmsg_cancel(skb, nlh);
1132                 return err;
1133         }
1134
1135         handler = inet_diag_lock_handler(sk->sk_protocol);
1136         if (IS_ERR(handler)) {
1137                 inet_diag_unlock_handler(handler);
1138                 nlmsg_cancel(skb, nlh);
1139                 return PTR_ERR(handler);
1140         }
1141
1142         attr = handler->idiag_info_size
1143                 ? nla_reserve_64bit(skb, INET_DIAG_INFO,
1144                                     handler->idiag_info_size,
1145                                     INET_DIAG_PAD)
1146                 : NULL;
1147         if (attr)
1148                 info = nla_data(attr);
1149
1150         handler->idiag_get_info(sk, r, info);
1151         inet_diag_unlock_handler(handler);
1152
1153         nlmsg_end(skb, nlh);
1154         return 0;
1155 }
1156
1157 static const struct sock_diag_handler inet_diag_handler = {
1158         .family = AF_INET,
1159         .dump = inet_diag_handler_cmd,
1160         .get_info = inet_diag_handler_get_info,
1161         .destroy = inet_diag_handler_cmd,
1162 };
1163
1164 static const struct sock_diag_handler inet6_diag_handler = {
1165         .family = AF_INET6,
1166         .dump = inet_diag_handler_cmd,
1167         .get_info = inet_diag_handler_get_info,
1168         .destroy = inet_diag_handler_cmd,
1169 };
1170
1171 int inet_diag_register(const struct inet_diag_handler *h)
1172 {
1173         const __u16 type = h->idiag_type;
1174         int err = -EINVAL;
1175
1176         if (type >= IPPROTO_MAX)
1177                 goto out;
1178
1179         mutex_lock(&inet_diag_table_mutex);
1180         err = -EEXIST;
1181         if (!inet_diag_table[type]) {
1182                 inet_diag_table[type] = h;
1183                 err = 0;
1184         }
1185         mutex_unlock(&inet_diag_table_mutex);
1186 out:
1187         return err;
1188 }
1189 EXPORT_SYMBOL_GPL(inet_diag_register);
1190
1191 void inet_diag_unregister(const struct inet_diag_handler *h)
1192 {
1193         const __u16 type = h->idiag_type;
1194
1195         if (type >= IPPROTO_MAX)
1196                 return;
1197
1198         mutex_lock(&inet_diag_table_mutex);
1199         inet_diag_table[type] = NULL;
1200         mutex_unlock(&inet_diag_table_mutex);
1201 }
1202 EXPORT_SYMBOL_GPL(inet_diag_unregister);
1203
1204 static int __init inet_diag_init(void)
1205 {
1206         const int inet_diag_table_size = (IPPROTO_MAX *
1207                                           sizeof(struct inet_diag_handler *));
1208         int err = -ENOMEM;
1209
1210         inet_diag_table = kzalloc(inet_diag_table_size, GFP_KERNEL);
1211         if (!inet_diag_table)
1212                 goto out;
1213
1214         err = sock_diag_register(&inet_diag_handler);
1215         if (err)
1216                 goto out_free_nl;
1217
1218         err = sock_diag_register(&inet6_diag_handler);
1219         if (err)
1220                 goto out_free_inet;
1221
1222         sock_diag_register_inet_compat(inet_diag_rcv_msg_compat);
1223 out:
1224         return err;
1225
1226 out_free_inet:
1227         sock_diag_unregister(&inet_diag_handler);
1228 out_free_nl:
1229         kfree(inet_diag_table);
1230         goto out;
1231 }
1232
1233 static void __exit inet_diag_exit(void)
1234 {
1235         sock_diag_unregister(&inet6_diag_handler);
1236         sock_diag_unregister(&inet_diag_handler);
1237         sock_diag_unregister_inet_compat(inet_diag_rcv_msg_compat);
1238         kfree(inet_diag_table);
1239 }
1240
1241 module_init(inet_diag_init);
1242 module_exit(inet_diag_exit);
1243 MODULE_LICENSE("GPL");
1244 MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_NETLINK, NETLINK_SOCK_DIAG, 2 /* AF_INET */);
1245 MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_NETLINK, NETLINK_SOCK_DIAG, 10 /* AF_INET6 */);