1 /*
2 * NETLINK Netlink attributes
3 *
4 * Authors: Thomas Graf <tgraf@suug.ch>
5 * Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
6 */
7
8 #include <linux/export.h>
9 #include <linux/kernel.h>
10 #include <linux/errno.h>
11 #include <linux/jiffies.h>
12 #include <linux/netdevice.h>
13 #include <linux/skbuff.h>
14 #include <linux/string.h>
15 #include <linux/types.h>
16 #include <linux/ratelimit.h>
17 #include <net/netlink.h>
18
19 static const u16 nla_attr_minlen[NLA_TYPE_MAX+1] = {
20 [NLA_U8] = sizeof(u8),
21 [NLA_U16] = sizeof(u16),
22 [NLA_U32] = sizeof(u32),
23 [NLA_U64] = sizeof(u64),
24 [NLA_MSECS] = sizeof(u64),
25 [NLA_NESTED] = NLA_HDRLEN,
26 };
27
validate_nla(const struct nlattr * nla,int maxtype,const struct nla_policy * policy)28 static int validate_nla(const struct nlattr *nla, int maxtype,
29 const struct nla_policy *policy)
30 {
31 const struct nla_policy *pt;
32 int minlen = 0, attrlen = nla_len(nla), type = nla_type(nla);
33
34 if (type <= 0 || type > maxtype)
35 return 0;
36
37 pt = &policy[type];
38
39 BUG_ON(pt->type > NLA_TYPE_MAX);
40
41 switch (pt->type) {
42 case NLA_FLAG:
43 if (attrlen > 0)
44 return -ERANGE;
45 break;
46
47 case NLA_NUL_STRING:
48 if (pt->len)
49 minlen = min_t(int, attrlen, pt->len + 1);
50 else
51 minlen = attrlen;
52
53 if (!minlen || memchr(nla_data(nla), '\0', minlen) == NULL)
54 return -EINVAL;
55 /* fall through */
56
57 case NLA_STRING:
58 if (attrlen < 1)
59 return -ERANGE;
60
61 if (pt->len) {
62 char *buf = nla_data(nla);
63
64 if (buf[attrlen - 1] == '\0')
65 attrlen--;
66
67 if (attrlen > pt->len)
68 return -ERANGE;
69 }
70 break;
71
72 case NLA_BINARY:
73 if (pt->len && attrlen > pt->len)
74 return -ERANGE;
75 break;
76
77 case NLA_NESTED_COMPAT:
78 if (attrlen < pt->len)
79 return -ERANGE;
80 if (attrlen < NLA_ALIGN(pt->len))
81 break;
82 if (attrlen < NLA_ALIGN(pt->len) + NLA_HDRLEN)
83 return -ERANGE;
84 nla = nla_data(nla) + NLA_ALIGN(pt->len);
85 if (attrlen < NLA_ALIGN(pt->len) + NLA_HDRLEN + nla_len(nla))
86 return -ERANGE;
87 break;
88 case NLA_NESTED:
89 /* a nested attributes is allowed to be empty; if its not,
90 * it must have a size of at least NLA_HDRLEN.
91 */
92 if (attrlen == 0)
93 break;
94 default:
95 if (pt->len)
96 minlen = pt->len;
97 else if (pt->type != NLA_UNSPEC)
98 minlen = nla_attr_minlen[pt->type];
99
100 if (attrlen < minlen)
101 return -ERANGE;
102 }
103
104 return 0;
105 }
106
107 /**
108 * nla_validate - Validate a stream of attributes
109 * @head: head of attribute stream
110 * @len: length of attribute stream
111 * @maxtype: maximum attribute type to be expected
112 * @policy: validation policy
113 *
114 * Validates all attributes in the specified attribute stream against the
115 * specified policy. Attributes with a type exceeding maxtype will be
116 * ignored. See documenation of struct nla_policy for more details.
117 *
118 * Returns 0 on success or a negative error code.
119 */
nla_validate(const struct nlattr * head,int len,int maxtype,const struct nla_policy * policy)120 int nla_validate(const struct nlattr *head, int len, int maxtype,
121 const struct nla_policy *policy)
122 {
123 const struct nlattr *nla;
124 int rem, err;
125
126 nla_for_each_attr(nla, head, len, rem) {
127 err = validate_nla(nla, maxtype, policy);
128 if (err < 0)
129 goto errout;
130 }
131
132 err = 0;
133 errout:
134 return err;
135 }
136
137 /**
138 * nla_policy_len - Determin the max. length of a policy
139 * @policy: policy to use
140 * @n: number of policies
141 *
142 * Determines the max. length of the policy. It is currently used
143 * to allocated Netlink buffers roughly the size of the actual
144 * message.
145 *
146 * Returns 0 on success or a negative error code.
147 */
148 int
nla_policy_len(const struct nla_policy * p,int n)149 nla_policy_len(const struct nla_policy *p, int n)
150 {
151 int i, len = 0;
152
153 for (i = 0; i < n; i++, p++) {
154 if (p->len)
155 len += nla_total_size(p->len);
156 else if (nla_attr_minlen[p->type])
157 len += nla_total_size(nla_attr_minlen[p->type]);
158 }
159
160 return len;
161 }
162
163 /**
164 * nla_parse - Parse a stream of attributes into a tb buffer
165 * @tb: destination array with maxtype+1 elements
166 * @maxtype: maximum attribute type to be expected
167 * @head: head of attribute stream
168 * @len: length of attribute stream
169 * @policy: validation policy
170 *
171 * Parses a stream of attributes and stores a pointer to each attribute in
172 * the tb array accessible via the attribute type. Attributes with a type
173 * exceeding maxtype will be silently ignored for backwards compatibility
174 * reasons. policy may be set to NULL if no validation is required.
175 *
176 * Returns 0 on success or a negative error code.
177 */
nla_parse(struct nlattr ** tb,int maxtype,const struct nlattr * head,int len,const struct nla_policy * policy)178 int nla_parse(struct nlattr **tb, int maxtype, const struct nlattr *head,
179 int len, const struct nla_policy *policy)
180 {
181 const struct nlattr *nla;
182 int rem, err;
183
184 memset(tb, 0, sizeof(struct nlattr *) * (maxtype + 1));
185
186 nla_for_each_attr(nla, head, len, rem) {
187 u16 type = nla_type(nla);
188
189 if (type > 0 && type <= maxtype) {
190 if (policy) {
191 err = validate_nla(nla, maxtype, policy);
192 if (err < 0)
193 goto errout;
194 }
195
196 tb[type] = (struct nlattr *)nla;
197 }
198 }
199
200 if (unlikely(rem > 0))
201 pr_warn_ratelimited("netlink: %d bytes leftover after parsing attributes in process `%s'.\n",
202 rem, current->comm);
203
204 err = 0;
205 errout:
206 return err;
207 }
208
209 /**
210 * nla_find - Find a specific attribute in a stream of attributes
211 * @head: head of attribute stream
212 * @len: length of attribute stream
213 * @attrtype: type of attribute to look for
214 *
215 * Returns the first attribute in the stream matching the specified type.
216 */
nla_find(const struct nlattr * head,int len,int attrtype)217 struct nlattr *nla_find(const struct nlattr *head, int len, int attrtype)
218 {
219 const struct nlattr *nla;
220 int rem;
221
222 nla_for_each_attr(nla, head, len, rem)
223 if (nla_type(nla) == attrtype)
224 return (struct nlattr *)nla;
225
226 return NULL;
227 }
228
229 /**
230 * nla_strlcpy - Copy string attribute payload into a sized buffer
231 * @dst: where to copy the string to
232 * @nla: attribute to copy the string from
233 * @dstsize: size of destination buffer
234 *
235 * Copies at most dstsize - 1 bytes into the destination buffer.
236 * The result is always a valid NUL-terminated string. Unlike
237 * strlcpy the destination buffer is always padded out.
238 *
239 * Returns the length of the source buffer.
240 */
nla_strlcpy(char * dst,const struct nlattr * nla,size_t dstsize)241 size_t nla_strlcpy(char *dst, const struct nlattr *nla, size_t dstsize)
242 {
243 size_t srclen = nla_len(nla);
244 char *src = nla_data(nla);
245
246 if (srclen > 0 && src[srclen - 1] == '\0')
247 srclen--;
248
249 if (dstsize > 0) {
250 size_t len = (srclen >= dstsize) ? dstsize - 1 : srclen;
251
252 memset(dst, 0, dstsize);
253 memcpy(dst, src, len);
254 }
255
256 return srclen;
257 }
258
259 /**
260 * nla_memcpy - Copy a netlink attribute into another memory area
261 * @dest: where to copy to memcpy
262 * @src: netlink attribute to copy from
263 * @count: size of the destination area
264 *
265 * Note: The number of bytes copied is limited by the length of
266 * attribute's payload. memcpy
267 *
268 * Returns the number of bytes copied.
269 */
nla_memcpy(void * dest,const struct nlattr * src,int count)270 int nla_memcpy(void *dest, const struct nlattr *src, int count)
271 {
272 int minlen = min_t(int, count, nla_len(src));
273
274 memcpy(dest, nla_data(src), minlen);
275
276 return minlen;
277 }
278
279 /**
280 * nla_memcmp - Compare an attribute with sized memory area
281 * @nla: netlink attribute
282 * @data: memory area
283 * @size: size of memory area
284 */
nla_memcmp(const struct nlattr * nla,const void * data,size_t size)285 int nla_memcmp(const struct nlattr *nla, const void *data,
286 size_t size)
287 {
288 int d = nla_len(nla) - size;
289
290 if (d == 0)
291 d = memcmp(nla_data(nla), data, size);
292
293 return d;
294 }
295
296 /**
297 * nla_strcmp - Compare a string attribute against a string
298 * @nla: netlink string attribute
299 * @str: another string
300 */
nla_strcmp(const struct nlattr * nla,const char * str)301 int nla_strcmp(const struct nlattr *nla, const char *str)
302 {
303 int len = strlen(str);
304 char *buf = nla_data(nla);
305 int attrlen = nla_len(nla);
306 int d;
307
308 if (attrlen > 0 && buf[attrlen - 1] == '\0')
309 attrlen--;
310
311 d = attrlen - len;
312 if (d == 0)
313 d = memcmp(nla_data(nla), str, len);
314
315 return d;
316 }
317
318 #ifdef CONFIG_NET
319 /**
320 * __nla_reserve - reserve room for attribute on the skb
321 * @skb: socket buffer to reserve room on
322 * @attrtype: attribute type
323 * @attrlen: length of attribute payload
324 *
325 * Adds a netlink attribute header to a socket buffer and reserves
326 * room for the payload but does not copy it.
327 *
328 * The caller is responsible to ensure that the skb provides enough
329 * tailroom for the attribute header and payload.
330 */
__nla_reserve(struct sk_buff * skb,int attrtype,int attrlen)331 struct nlattr *__nla_reserve(struct sk_buff *skb, int attrtype, int attrlen)
332 {
333 struct nlattr *nla;
334
335 nla = (struct nlattr *) skb_put(skb, nla_total_size(attrlen));
336 nla->nla_type = attrtype;
337 nla->nla_len = nla_attr_size(attrlen);
338
339 memset((unsigned char *) nla + nla->nla_len, 0, nla_padlen(attrlen));
340
341 return nla;
342 }
343 EXPORT_SYMBOL(__nla_reserve);
344
345 /**
346 * __nla_reserve_nohdr - reserve room for attribute without header
347 * @skb: socket buffer to reserve room on
348 * @attrlen: length of attribute payload
349 *
350 * Reserves room for attribute payload without a header.
351 *
352 * The caller is responsible to ensure that the skb provides enough
353 * tailroom for the payload.
354 */
__nla_reserve_nohdr(struct sk_buff * skb,int attrlen)355 void *__nla_reserve_nohdr(struct sk_buff *skb, int attrlen)
356 {
357 void *start;
358
359 start = skb_put(skb, NLA_ALIGN(attrlen));
360 memset(start, 0, NLA_ALIGN(attrlen));
361
362 return start;
363 }
364 EXPORT_SYMBOL(__nla_reserve_nohdr);
365
366 /**
367 * nla_reserve - reserve room for attribute on the skb
368 * @skb: socket buffer to reserve room on
369 * @attrtype: attribute type
370 * @attrlen: length of attribute payload
371 *
372 * Adds a netlink attribute header to a socket buffer and reserves
373 * room for the payload but does not copy it.
374 *
375 * Returns NULL if the tailroom of the skb is insufficient to store
376 * the attribute header and payload.
377 */
nla_reserve(struct sk_buff * skb,int attrtype,int attrlen)378 struct nlattr *nla_reserve(struct sk_buff *skb, int attrtype, int attrlen)
379 {
380 if (unlikely(skb_tailroom(skb) < nla_total_size(attrlen)))
381 return NULL;
382
383 return __nla_reserve(skb, attrtype, attrlen);
384 }
385 EXPORT_SYMBOL(nla_reserve);
386
387 /**
388 * nla_reserve_nohdr - reserve room for attribute without header
389 * @skb: socket buffer to reserve room on
390 * @attrlen: length of attribute payload
391 *
392 * Reserves room for attribute payload without a header.
393 *
394 * Returns NULL if the tailroom of the skb is insufficient to store
395 * the attribute payload.
396 */
nla_reserve_nohdr(struct sk_buff * skb,int attrlen)397 void *nla_reserve_nohdr(struct sk_buff *skb, int attrlen)
398 {
399 if (unlikely(skb_tailroom(skb) < NLA_ALIGN(attrlen)))
400 return NULL;
401
402 return __nla_reserve_nohdr(skb, attrlen);
403 }
404 EXPORT_SYMBOL(nla_reserve_nohdr);
405
406 /**
407 * __nla_put - Add a netlink attribute to a socket buffer
408 * @skb: socket buffer to add attribute to
409 * @attrtype: attribute type
410 * @attrlen: length of attribute payload
411 * @data: head of attribute payload
412 *
413 * The caller is responsible to ensure that the skb provides enough
414 * tailroom for the attribute header and payload.
415 */
__nla_put(struct sk_buff * skb,int attrtype,int attrlen,const void * data)416 void __nla_put(struct sk_buff *skb, int attrtype, int attrlen,
417 const void *data)
418 {
419 struct nlattr *nla;
420
421 nla = __nla_reserve(skb, attrtype, attrlen);
422 memcpy(nla_data(nla), data, attrlen);
423 }
424 EXPORT_SYMBOL(__nla_put);
425
426 /**
427 * __nla_put_nohdr - Add a netlink attribute without header
428 * @skb: socket buffer to add attribute to
429 * @attrlen: length of attribute payload
430 * @data: head of attribute payload
431 *
432 * The caller is responsible to ensure that the skb provides enough
433 * tailroom for the attribute payload.
434 */
__nla_put_nohdr(struct sk_buff * skb,int attrlen,const void * data)435 void __nla_put_nohdr(struct sk_buff *skb, int attrlen, const void *data)
436 {
437 void *start;
438
439 start = __nla_reserve_nohdr(skb, attrlen);
440 memcpy(start, data, attrlen);
441 }
442 EXPORT_SYMBOL(__nla_put_nohdr);
443
444 /**
445 * nla_put - Add a netlink attribute to a socket buffer
446 * @skb: socket buffer to add attribute to
447 * @attrtype: attribute type
448 * @attrlen: length of attribute payload
449 * @data: head of attribute payload
450 *
451 * Returns -EMSGSIZE if the tailroom of the skb is insufficient to store
452 * the attribute header and payload.
453 */
nla_put(struct sk_buff * skb,int attrtype,int attrlen,const void * data)454 int nla_put(struct sk_buff *skb, int attrtype, int attrlen, const void *data)
455 {
456 if (unlikely(skb_tailroom(skb) < nla_total_size(attrlen)))
457 return -EMSGSIZE;
458
459 __nla_put(skb, attrtype, attrlen, data);
460 return 0;
461 }
462 EXPORT_SYMBOL(nla_put);
463
464 /**
465 * nla_put_nohdr - Add a netlink attribute without header
466 * @skb: socket buffer to add attribute to
467 * @attrlen: length of attribute payload
468 * @data: head of attribute payload
469 *
470 * Returns -EMSGSIZE if the tailroom of the skb is insufficient to store
471 * the attribute payload.
472 */
nla_put_nohdr(struct sk_buff * skb,int attrlen,const void * data)473 int nla_put_nohdr(struct sk_buff *skb, int attrlen, const void *data)
474 {
475 if (unlikely(skb_tailroom(skb) < NLA_ALIGN(attrlen)))
476 return -EMSGSIZE;
477
478 __nla_put_nohdr(skb, attrlen, data);
479 return 0;
480 }
481 EXPORT_SYMBOL(nla_put_nohdr);
482
483 /**
484 * nla_append - Add a netlink attribute without header or padding
485 * @skb: socket buffer to add attribute to
486 * @attrlen: length of attribute payload
487 * @data: head of attribute payload
488 *
489 * Returns -EMSGSIZE if the tailroom of the skb is insufficient to store
490 * the attribute payload.
491 */
nla_append(struct sk_buff * skb,int attrlen,const void * data)492 int nla_append(struct sk_buff *skb, int attrlen, const void *data)
493 {
494 if (unlikely(skb_tailroom(skb) < NLA_ALIGN(attrlen)))
495 return -EMSGSIZE;
496
497 memcpy(skb_put(skb, attrlen), data, attrlen);
498 return 0;
499 }
500 EXPORT_SYMBOL(nla_append);
501 #endif
502
503 EXPORT_SYMBOL(nla_validate);
504 EXPORT_SYMBOL(nla_policy_len);
505 EXPORT_SYMBOL(nla_parse);
506 EXPORT_SYMBOL(nla_find);
507 EXPORT_SYMBOL(nla_strlcpy);
508 EXPORT_SYMBOL(nla_memcpy);
509 EXPORT_SYMBOL(nla_memcmp);
510 EXPORT_SYMBOL(nla_strcmp);
511