2 * Copyright (c) 2016 Fabien Siron <fabien.siron@epita.fr>
3 * Copyright (c) 2016 Dmitry V. Levin <ldv@altlinux.org>
4 * Copyright (c) 2016-2017 The strace developers.
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. The name of the author may not be used to endorse or promote products
16 * derived from this software without specific prior written permission.
18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
19 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
20 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
21 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
22 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
23 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
24 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
25 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33 #include <linux/audit.h>
34 #include <linux/rtnetlink.h>
35 #include <linux/xfrm.h>
36 #include "xlat/netlink_ack_flags.h"
37 #include "xlat/netlink_flags.h"
38 #include "xlat/netlink_get_flags.h"
39 #include "xlat/netlink_new_flags.h"
40 #include "xlat/netlink_protocols.h"
41 #include "xlat/netlink_types.h"
42 #include "xlat/nf_acct_msg_types.h"
43 #include "xlat/nf_cthelper_msg_types.h"
44 #include "xlat/nf_ctnetlink_exp_msg_types.h"
45 #include "xlat/nf_ctnetlink_msg_types.h"
46 #include "xlat/nf_cttimeout_msg_types.h"
47 #include "xlat/nf_ipset_msg_types.h"
48 #include "xlat/nf_nft_compat_msg_types.h"
49 #include "xlat/nf_nftables_msg_types.h"
50 #include "xlat/nf_osf_msg_types.h"
51 #include "xlat/nf_queue_msg_types.h"
52 #include "xlat/nf_ulog_msg_types.h"
53 #include "xlat/nl_audit_types.h"
54 #include "xlat/nl_crypto_types.h"
55 #include "xlat/nl_netfilter_msg_types.h"
56 #include "xlat/nl_netfilter_subsys_ids.h"
57 #include "xlat/nl_selinux_types.h"
58 #include "xlat/nl_sock_diag_types.h"
59 #include "xlat/nl_xfrm_types.h"
60 #include "xlat/nlmsgerr_attrs.h"
63 * Fetch a struct nlmsghdr from the given address.
66 fetch_nlmsghdr(struct tcb *const tcp, struct nlmsghdr *const nlmsghdr,
67 const kernel_ulong_t addr, const kernel_ulong_t len)
69 if (len < sizeof(struct nlmsghdr)) {
70 printstr_ex(tcp, addr, len, QUOTE_FORCE_HEX);
74 if (umove_or_printaddr(tcp, addr, nlmsghdr))
81 get_fd_nl_family(struct tcb *const tcp, const int fd)
83 const unsigned long inode = getfdinode(tcp, fd);
87 const char *const details = get_sockaddr_by_inode(tcp, fd, inode);
91 const char *const nl_details = STR_STRIP_PREFIX(details, "NETLINK:[");
92 if (nl_details == details)
95 const struct xlat *xlats = netlink_protocols;
96 for (; xlats->str; ++xlats) {
97 const char *name = STR_STRIP_PREFIX(xlats->str, "NETLINK_");
98 if (!strncmp(nl_details, name, strlen(name)))
102 if (*nl_details >= '0' && *nl_details <= '9')
103 return atoi(nl_details);
109 decode_nlmsg_type_default(const struct xlat *const xlat,
111 const char *const dflt)
113 printxval(xlat, type, dflt);
117 decode_nlmsg_type_generic(const struct xlat *const xlat,
119 const char *const dflt)
121 printxval(genl_families_xlat(), type, dflt);
124 static const struct {
125 const struct xlat *const xlat;
126 const char *const dflt;
127 } nf_nlmsg_types[] = {
128 [NFNL_SUBSYS_CTNETLINK] = {
129 nf_ctnetlink_msg_types,
132 [NFNL_SUBSYS_CTNETLINK_EXP] = {
133 nf_ctnetlink_exp_msg_types,
136 [NFNL_SUBSYS_QUEUE] = { nf_queue_msg_types, "NFQNL_MSG_???" },
137 [NFNL_SUBSYS_ULOG] = { nf_ulog_msg_types, "NFULNL_MSG_???" },
138 [NFNL_SUBSYS_OSF] = { nf_osf_msg_types, "OSF_MSG_???" },
139 [NFNL_SUBSYS_IPSET] = { nf_ipset_msg_types, "IPSET_CMD_???" },
140 [NFNL_SUBSYS_ACCT] = { nf_acct_msg_types, "NFNL_MSG_ACCT_???" },
141 [NFNL_SUBSYS_CTNETLINK_TIMEOUT] = {
142 nf_cttimeout_msg_types,
143 "IPCTNL_MSG_TIMEOUT_???"
145 [NFNL_SUBSYS_CTHELPER] = {
146 nf_cthelper_msg_types,
147 "NFNL_MSG_CTHELPER_???"
149 [NFNL_SUBSYS_NFTABLES] = { nf_nftables_msg_types, "NFT_MSG_???" },
150 [NFNL_SUBSYS_NFT_COMPAT] = {
151 nf_nft_compat_msg_types,
152 "NFNL_MSG_COMPAT_???"
157 decode_nlmsg_type_netfilter(const struct xlat *const xlat,
159 const char *const dflt)
161 /* Reserved control nfnetlink messages first. */
162 const char *const text = xlookup(nl_netfilter_msg_types, type);
169 * Other netfilter message types are split
170 * in two pieces: 8 bits subsystem and 8 bits type.
172 const uint8_t subsys_id = (uint8_t) (type >> 8);
173 const uint8_t msg_type = (uint8_t) type;
175 printxval(xlat, subsys_id, dflt);
178 if (subsys_id < ARRAY_SIZE(nf_nlmsg_types))
179 printxval(nf_nlmsg_types[subsys_id].xlat,
180 msg_type, nf_nlmsg_types[subsys_id].dflt);
182 tprintf("%#x", msg_type);
185 typedef void (*nlmsg_types_decoder_t)(const struct xlat *,
189 static const struct {
190 const nlmsg_types_decoder_t decoder;
191 const struct xlat *const xlat;
192 const char *const dflt;
194 [NETLINK_AUDIT] = { NULL, nl_audit_types, "AUDIT_???" },
195 [NETLINK_CRYPTO] = { NULL, nl_crypto_types, "CRYPTO_MSG_???" },
196 [NETLINK_GENERIC] = {
197 decode_nlmsg_type_generic,
201 [NETLINK_NETFILTER] = {
202 decode_nlmsg_type_netfilter,
203 nl_netfilter_subsys_ids,
206 [NETLINK_ROUTE] = { NULL, nl_route_types, "RTM_???" },
207 [NETLINK_SELINUX] = { NULL, nl_selinux_types, "SELNL_MSG_???" },
208 [NETLINK_SOCK_DIAG] = { NULL, nl_sock_diag_types, "SOCK_DIAG_???" },
209 [NETLINK_XFRM] = { NULL, nl_xfrm_types, "XFRM_MSG_???" }
213 * As all valid netlink families are positive integers, use unsigned int
214 * for family here to filter out -1.
217 decode_nlmsg_type(const uint16_t type, const unsigned int family)
219 nlmsg_types_decoder_t decoder = decode_nlmsg_type_default;
220 const struct xlat *xlat = netlink_types;
221 const char *dflt = "NLMSG_???";
224 * type < NLMSG_MIN_TYPE are reserved control messages
225 * that need no family-specific decoding.
227 if (type >= NLMSG_MIN_TYPE && family < ARRAY_SIZE(nlmsg_types)) {
228 if (nlmsg_types[family].decoder)
229 decoder = nlmsg_types[family].decoder;
230 if (nlmsg_types[family].xlat)
231 xlat = nlmsg_types[family].xlat;
232 if (nlmsg_types[family].dflt)
233 dflt = nlmsg_types[family].dflt;
236 decoder(xlat, type, dflt);
239 static const struct xlat *
240 decode_nlmsg_flags_crypto(const uint16_t type)
243 case CRYPTO_MSG_NEWALG:
244 return netlink_new_flags;
245 case CRYPTO_MSG_GETALG:
246 return netlink_get_flags;
252 static const struct xlat *
253 decode_nlmsg_flags_route(const uint16_t type)
255 if (type == RTM_DELACTION)
256 return netlink_get_flags;
259 return netlink_new_flags;
261 return netlink_get_flags;
267 static const struct xlat *
268 decode_nlmsg_flags_sock_diag(const uint16_t type)
270 return netlink_get_flags;
273 static const struct xlat *
274 decode_nlmsg_flags_xfrm(const uint16_t type)
278 case XFRM_MSG_NEWPOLICY:
280 case XFRM_MSG_NEWSADINFO:
281 case XFRM_MSG_NEWSPDINFO:
282 return netlink_new_flags;
284 case XFRM_MSG_GETPOLICY:
286 case XFRM_MSG_GETSADINFO:
287 case XFRM_MSG_GETSPDINFO:
288 return netlink_get_flags;
294 typedef const struct xlat *(*nlmsg_flags_decoder_t)(const uint16_t type);
296 static const nlmsg_flags_decoder_t nlmsg_flags[] = {
297 [NETLINK_CRYPTO] = decode_nlmsg_flags_crypto,
298 [NETLINK_ROUTE] = decode_nlmsg_flags_route,
299 [NETLINK_SOCK_DIAG] = decode_nlmsg_flags_sock_diag,
300 [NETLINK_XFRM] = decode_nlmsg_flags_xfrm
304 * As all valid netlink families are positive integers, use unsigned int
305 * for family here to filter out -1.
308 decode_nlmsg_flags(const uint16_t flags, const uint16_t type,
309 const unsigned int family)
311 const struct xlat *table = NULL;
313 if (type < NLMSG_MIN_TYPE) {
314 if (type == NLMSG_ERROR)
315 table = netlink_ack_flags;
316 } else if (family < ARRAY_SIZE(nlmsg_flags) && nlmsg_flags[family])
317 table = nlmsg_flags[family](type);
319 printflags_ex(flags, "NLM_F_???", netlink_flags, table, NULL);
323 print_nlmsghdr(struct tcb *tcp,
326 const struct nlmsghdr *const nlmsghdr)
328 /* print the whole structure regardless of its nlmsg_len */
330 tprintf("{len=%u, type=", nlmsghdr->nlmsg_len);
332 decode_nlmsg_type(nlmsghdr->nlmsg_type, family);
335 decode_nlmsg_flags(nlmsghdr->nlmsg_flags,
336 nlmsghdr->nlmsg_type, family);
338 tprintf(", seq=%u, pid=%u}", nlmsghdr->nlmsg_seq,
339 nlmsghdr->nlmsg_pid);
343 print_cookie(struct tcb *const tcp, void *const elem_buf,
344 const size_t elem_size, void *const opaque_data)
346 tprintf("%" PRIu8, *(uint8_t *) elem_buf);
352 decode_nlmsgerr_attr_cookie(struct tcb *const tcp,
353 const kernel_ulong_t addr,
354 const unsigned int len,
355 const void *const opaque_data)
358 const size_t nmemb = len / sizeof(cookie);
360 print_array(tcp, addr, nmemb, &cookie, sizeof(cookie),
361 umoven_or_printaddr, print_cookie, 0);
366 static const nla_decoder_t nlmsgerr_nla_decoders[] = {
367 [NLMSGERR_ATTR_MSG] = decode_nla_str,
368 [NLMSGERR_ATTR_OFFS] = decode_nla_u32,
369 [NLMSGERR_ATTR_COOKIE] = decode_nlmsgerr_attr_cookie
373 decode_nlmsghdr_with_payload(struct tcb *const tcp,
376 const struct nlmsghdr *const nlmsghdr,
377 const kernel_ulong_t addr,
378 const kernel_ulong_t len);
381 decode_nlmsgerr(struct tcb *const tcp,
390 if (len < sizeof(err.error)) {
391 printstr_ex(tcp, addr, len, QUOTE_FORCE_HEX);
395 if (umove_or_printaddr(tcp, addr, &err.error))
399 if (err.error < 0 && (unsigned) -err.error < nerrnos) {
400 tprintf("-%s", errnoent[-err.error]);
402 tprintf("%d", err.error);
405 addr += offsetof(struct nlmsgerr, msg);
406 len -= offsetof(struct nlmsgerr, msg);
410 if (fetch_nlmsghdr(tcp, &err.msg, addr, len)) {
411 unsigned int payload =
412 capped ? sizeof(err.msg) : err.msg.nlmsg_len;
416 decode_nlmsghdr_with_payload(tcp, fd, family,
417 &err.msg, addr, payload);
420 decode_nlattr(tcp, addr + payload,
421 len - payload, nlmsgerr_attrs,
423 nlmsgerr_nla_decoders,
424 ARRAY_SIZE(nlmsgerr_nla_decoders),
433 static const netlink_decoder_t netlink_decoders[] = {
434 #ifdef HAVE_LINUX_CRYPTOUSER_H
435 [NETLINK_CRYPTO] = decode_netlink_crypto,
437 [NETLINK_ROUTE] = decode_netlink_route,
438 [NETLINK_SELINUX] = decode_netlink_selinux,
439 [NETLINK_SOCK_DIAG] = decode_netlink_sock_diag
443 decode_payload(struct tcb *const tcp,
446 const struct nlmsghdr *const nlmsghdr,
447 const kernel_ulong_t addr,
448 const unsigned int len)
450 if (nlmsghdr->nlmsg_type == NLMSG_ERROR) {
451 decode_nlmsgerr(tcp, fd, family, addr, len,
452 nlmsghdr->nlmsg_flags & NLM_F_CAPPED);
457 * While most of NLMSG_DONE messages indeed have payloads
458 * containing just a single integer, there are few exceptions,
459 * so pass payloads of NLMSG_DONE messages to family-specific
460 * netlink payload decoders.
462 * Other types of reserved control messages need no family-specific
463 * netlink payload decoding.
465 if ((nlmsghdr->nlmsg_type >= NLMSG_MIN_TYPE
466 || nlmsghdr->nlmsg_type == NLMSG_DONE)
467 && (unsigned int) family < ARRAY_SIZE(netlink_decoders)
468 && netlink_decoders[family]
469 && netlink_decoders[family](tcp, nlmsghdr, addr, len)) {
473 if (nlmsghdr->nlmsg_type == NLMSG_DONE && len == sizeof(int)) {
476 if (!umove_or_printaddr(tcp, addr, &num))
481 printstr_ex(tcp, addr, len, QUOTE_FORCE_HEX);
485 decode_nlmsghdr_with_payload(struct tcb *const tcp,
488 const struct nlmsghdr *const nlmsghdr,
489 const kernel_ulong_t addr,
490 const kernel_ulong_t len)
492 const unsigned int nlmsg_len =
493 nlmsghdr->nlmsg_len > len ? len : nlmsghdr->nlmsg_len;
495 if (nlmsg_len > NLMSG_HDRLEN)
498 print_nlmsghdr(tcp, fd, family, nlmsghdr);
500 if (nlmsg_len > NLMSG_HDRLEN) {
502 decode_payload(tcp, fd, family, nlmsghdr, addr + NLMSG_HDRLEN,
503 nlmsg_len - NLMSG_HDRLEN);
509 decode_netlink(struct tcb *const tcp,
514 const int family = get_fd_nl_family(tcp, fd);
516 if (family == NETLINK_KOBJECT_UEVENT) {
517 printstrn(tcp, addr, len);
521 struct nlmsghdr nlmsghdr;
522 bool print_array = false;
525 for (elt = 0; fetch_nlmsghdr(tcp, &nlmsghdr, addr, len); elt++) {
526 if (abbrev(tcp) && elt == max_strlen) {
531 unsigned int nlmsg_len = NLMSG_ALIGN(nlmsghdr.nlmsg_len);
532 kernel_ulong_t next_addr = 0;
533 kernel_ulong_t next_len = 0;
535 if (nlmsghdr.nlmsg_len >= NLMSG_HDRLEN) {
536 next_len = (len >= nlmsg_len) ? len - nlmsg_len : 0;
538 if (next_len && addr + nlmsg_len > addr)
539 next_addr = addr + nlmsg_len;
542 if (!print_array && next_addr) {
547 decode_nlmsghdr_with_payload(tcp, fd, family,
548 &nlmsghdr, addr, len);