cregit-Linux how code gets into the kernel

Release 4.10 net/netfilter/core.c

Directory: net/netfilter
/* netfilter.c: look after the filters for various protocols.
 * Heavily influenced by the old firewall.c by David Bonn and Alan Cox.
 *
 * Thanks to Rob `CmdrTaco' Malda for not influencing this code in any
 * way.
 *
 * Rusty Russell (C)2000 -- This code is GPL.
 * Patrick McHardy (c) 2006-2012
 */
#include <linux/kernel.h>
#include <linux/netfilter.h>
#include <net/protocol.h>
#include <linux/init.h>
#include <linux/skbuff.h>
#include <linux/wait.h>
#include <linux/module.h>
#include <linux/interrupt.h>
#include <linux/if.h>
#include <linux/netdevice.h>
#include <linux/netfilter_ipv6.h>
#include <linux/inetdevice.h>
#include <linux/proc_fs.h>
#include <linux/mutex.h>
#include <linux/slab.h>
#include <linux/rcupdate.h>
#include <net/net_namespace.h>
#include <net/sock.h>

#include "nf_internals.h"

static DEFINE_MUTEX(afinfo_mutex);


const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO] __read_mostly;

EXPORT_SYMBOL(nf_afinfo);

const struct nf_ipv6_ops __rcu *nf_ipv6_ops __read_mostly;

EXPORT_SYMBOL_GPL(nf_ipv6_ops);

DEFINE_PER_CPU(bool, nf_skb_duplicated);

EXPORT_SYMBOL_GPL(nf_skb_duplicated);


int nf_register_afinfo(const struct nf_afinfo *afinfo) { mutex_lock(&afinfo_mutex); RCU_INIT_POINTER(nf_afinfo[afinfo->family], afinfo); mutex_unlock(&afinfo_mutex); return 0; }

Contributors

PersonTokensPropCommitsCommitProp
patrick mchardypatrick mchardy3694.74%360.00%
pablo neira ayusopablo neira ayuso12.63%120.00%
stephen hemmingerstephen hemminger12.63%120.00%
Total38100.00%5100.00%

EXPORT_SYMBOL_GPL(nf_register_afinfo);
void nf_unregister_afinfo(const struct nf_afinfo *afinfo) { mutex_lock(&afinfo_mutex); RCU_INIT_POINTER(nf_afinfo[afinfo->family], NULL); mutex_unlock(&afinfo_mutex); synchronize_rcu(); }

Contributors

PersonTokensPropCommitsCommitProp
patrick mchardypatrick mchardy3797.37%375.00%
stephen hemmingerstephen hemminger12.63%125.00%
Total38100.00%4100.00%

EXPORT_SYMBOL_GPL(nf_unregister_afinfo); #ifdef HAVE_JUMP_LABEL struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS]; EXPORT_SYMBOL(nf_hooks_needed); #endif static DEFINE_MUTEX(nf_hook_mutex); #define nf_entry_dereference(e) \ rcu_dereference_protected(e, lockdep_is_held(&nf_hook_mutex))
static struct nf_hook_entry __rcu **nf_hook_entry_head(struct net *net, const struct nf_hook_ops *reg) { if (reg->pf != NFPROTO_NETDEV) return net->nf.hooks[reg->pf]+reg->hooknum; #ifdef CONFIG_NETFILTER_INGRESS if (reg->hooknum == NF_NETDEV_INGRESS) { if (reg->dev && dev_net(reg->dev) == net) return &reg->dev->nf_hooks_ingress; } #endif return NULL; }

Contributors

PersonTokensPropCommitsCommitProp
eric w. biedermaneric w. biederman3945.35%225.00%
pablo neira ayusopablo neira ayuso2326.74%225.00%
linus torvaldslinus torvalds1315.12%112.50%
harald welteharald welte78.14%112.50%
aaron conoleaaron conole44.65%225.00%
Total86100.00%8100.00%


int nf_register_net_hook(struct net *net, const struct nf_hook_ops *reg) { struct nf_hook_entry __rcu **pp; struct nf_hook_entry *entry, *p; if (reg->pf == NFPROTO_NETDEV) { #ifndef CONFIG_NETFILTER_INGRESS if (reg->hooknum == NF_NETDEV_INGRESS) return -EOPNOTSUPP; #endif if (reg->hooknum != NF_NETDEV_INGRESS || !reg->dev || dev_net(reg->dev) != net) return -EINVAL; } pp = nf_hook_entry_head(net, reg); if (!pp) return -EINVAL; entry = kmalloc(sizeof(*entry), GFP_KERNEL); if (!entry) return -ENOMEM; nf_hook_entry_init(entry, reg); mutex_lock(&nf_hook_mutex); /* Find the spot in the list */ for (; (p = nf_entry_dereference(*pp)) != NULL; pp = &p->next) { if (reg->priority < nf_hook_entry_priority(p)) break; } rcu_assign_pointer(entry->next, p); rcu_assign_pointer(*pp, entry); mutex_unlock(&nf_hook_mutex); #ifdef CONFIG_NETFILTER_INGRESS if (reg->pf == NFPROTO_NETDEV && reg->hooknum == NF_NETDEV_INGRESS) net_inc_ingress_queue(); #endif #ifdef HAVE_JUMP_LABEL static_key_slow_inc(&nf_hooks_needed[reg->pf][reg->hooknum]); #endif return 0; }

Contributors

PersonTokensPropCommitsCommitProp
aaron conoleaaron conole9137.45%529.41%
eric w. biedermaneric w. biederman6225.51%423.53%
linus torvaldslinus torvalds4217.28%15.88%
eric dumazeteric dumazet177.00%15.88%
harald welteharald welte156.17%15.88%
pablo neira ayusopablo neira ayuso104.12%211.76%
zhouyi zhouzhouyi zhou31.23%15.88%
patrick mchardypatrick mchardy20.82%15.88%
ingo molnaringo molnar10.41%15.88%
Total243100.00%17100.00%

EXPORT_SYMBOL(nf_register_net_hook);
void nf_unregister_net_hook(struct net *net, const struct nf_hook_ops *reg) { struct nf_hook_entry __rcu **pp; struct nf_hook_entry *p; pp = nf_hook_entry_head(net, reg); if (WARN_ON_ONCE(!pp)) return; mutex_lock(&nf_hook_mutex); for (; (p = nf_entry_dereference(*pp)) != NULL; pp = &p->next) { if (nf_hook_entry_ops(p) == reg) { rcu_assign_pointer(*pp, p->next); break; } } mutex_unlock(&nf_hook_mutex); if (!p) { WARN(1, "nf_unregister_net_hook: hook not found!\n"); return; } #ifdef CONFIG_NETFILTER_INGRESS if (reg->pf == NFPROTO_NETDEV && reg->hooknum == NF_NETDEV_INGRESS) net_dec_ingress_queue(); #endif #ifdef HAVE_JUMP_LABEL static_key_slow_dec(&nf_hooks_needed[reg->pf][reg->hooknum]); #endif synchronize_net(); nf_queue_nf_hook_drop(net, p); /* other cpu might still process nfqueue verdict that used reg */ synchronize_net(); kfree(p); }

Contributors

PersonTokensPropCommitsCommitProp
eric w. biedermaneric w. biederman7340.33%213.33%
linus torvaldslinus torvalds3720.44%16.67%
aaron conoleaaron conole2212.15%320.00%
pablo neira ayusopablo neira ayuso2011.05%320.00%
harald welteharald welte179.39%16.67%
florian westphalflorian westphal42.21%16.67%
zhouyi zhouzhouyi zhou31.66%16.67%
patrick mchardypatrick mchardy21.10%16.67%
eric dumazeteric dumazet21.10%16.67%
ingo molnaringo molnar10.55%16.67%
Total181100.00%15100.00%

EXPORT_SYMBOL(nf_unregister_net_hook);
int nf_register_net_hooks(struct net *net, const struct nf_hook_ops *reg, unsigned int n) { unsigned int i; int err = 0; for (i = 0; i < n; i++) { err = nf_register_net_hook(net, &reg[i]); if (err) goto err; } return err; err: if (i > 0) nf_unregister_net_hooks(net, reg, i); return err; }

Contributors

PersonTokensPropCommitsCommitProp
eric w. biedermaneric w. biederman87100.00%1100.00%
Total87100.00%1100.00%

EXPORT_SYMBOL(nf_register_net_hooks);
void nf_unregister_net_hooks(struct net *net, const struct nf_hook_ops *reg, unsigned int n) { while (n-- > 0) nf_unregister_net_hook(net, &reg[n]); }

Contributors

PersonTokensPropCommitsCommitProp
eric w. biedermaneric w. biederman38100.00%1100.00%
Total38100.00%1100.00%

EXPORT_SYMBOL(nf_unregister_net_hooks); static LIST_HEAD(nf_hook_list);
static int _nf_register_hook(struct nf_hook_ops *reg) { struct net *net, *last; int ret; for_each_net(net) { ret = nf_register_net_hook(net, reg); if (ret && ret != -ENOENT) goto rollback; } list_add_tail(&reg->list, &nf_hook_list); return 0; rollback: last = net; for_each_net(net) { if (net == last) break; nf_unregister_net_hook(net, reg); } return ret; }

Contributors

PersonTokensPropCommitsCommitProp
eric w. biedermaneric w. biederman8693.48%150.00%
mahesh bandewarmahesh bandewar66.52%150.00%
Total92100.00%2100.00%


int nf_register_hook(struct nf_hook_ops *reg) { int ret; rtnl_lock(); ret = _nf_register_hook(reg); rtnl_unlock(); return ret; }

Contributors

PersonTokensPropCommitsCommitProp
mahesh bandewarmahesh bandewar2275.86%150.00%
eric w. biedermaneric w. biederman724.14%150.00%
Total29100.00%2100.00%

EXPORT_SYMBOL(nf_register_hook);
static void _nf_unregister_hook(struct nf_hook_ops *reg) { struct net *net; list_del(&reg->list); for_each_net(net) nf_unregister_net_hook(net, reg); }

Contributors

PersonTokensPropCommitsCommitProp
eric w. biedermaneric w. biederman2880.00%250.00%
eric dumazeteric dumazet411.43%125.00%
mahesh bandewarmahesh bandewar38.57%125.00%
Total35100.00%4100.00%


void nf_unregister_hook(struct nf_hook_ops *reg) { rtnl_lock(); _nf_unregister_hook(reg); rtnl_unlock(); }

Contributors

PersonTokensPropCommitsCommitProp
mahesh bandewarmahesh bandewar1780.95%133.33%
eric w. biedermaneric w. biederman314.29%133.33%
harald welteharald welte14.76%133.33%
Total21100.00%3100.00%

EXPORT_SYMBOL(nf_unregister_hook);
int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n) { unsigned int i; int err = 0; for (i = 0; i < n; i++) { err = nf_register_hook(&reg[i]); if (err) goto err; } return err; err: if (i > 0) nf_unregister_hooks(reg, i); return err; }

Contributors

PersonTokensPropCommitsCommitProp
patrick mchardypatrick mchardy77100.00%1100.00%
Total77100.00%1100.00%

EXPORT_SYMBOL(nf_register_hooks); /* Caller MUST take rtnl_lock() */
int _nf_register_hooks(struct nf_hook_ops *reg, unsigned int n) { unsigned int i; int err = 0; for (i = 0; i < n; i++) { err = _nf_register_hook(&reg[i]); if (err) goto err; } return err; err: if (i > 0) _nf_unregister_hooks(reg, i); return err; }

Contributors

PersonTokensPropCommitsCommitProp
mahesh bandewarmahesh bandewar77100.00%1100.00%
Total77100.00%1100.00%

EXPORT_SYMBOL(_nf_register_hooks);
void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n) { while (n-- > 0) nf_unregister_hook(&reg[n]); }

Contributors

PersonTokensPropCommitsCommitProp
patrick mchardypatrick mchardy2376.67%150.00%
changli gaochangli gao723.33%150.00%
Total30100.00%2100.00%

EXPORT_SYMBOL(nf_unregister_hooks); /* Caller MUST take rtnl_lock */
void _nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n) { while (n-- > 0) _nf_unregister_hook(&reg[n]); }

Contributors

PersonTokensPropCommitsCommitProp
mahesh bandewarmahesh bandewar30100.00%1100.00%
Total30100.00%1100.00%

EXPORT_SYMBOL(_nf_unregister_hooks); /* Returns 1 if okfn() needs to be executed by the caller, * -EPERM for NF_DROP, 0 otherwise. Caller must hold rcu_read_lock. */
int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state, struct nf_hook_entry *entry) { unsigned int verdict; int ret; do { verdict = nf_hook_entry_hookfn(entry, skb, state); switch (verdict & NF_VERDICT_MASK) { case NF_ACCEPT: entry = rcu_dereference(entry->next); break; case NF_DROP: kfree_skb(skb); ret = NF_DROP_GETERR(verdict); if (ret == 0) ret = -EPERM; return ret; case NF_QUEUE: ret = nf_queue(skb, state, &entry, verdict); if (ret == 1 && entry) continue; return ret; default: /* Implicit handling for NF_STOLEN, as well as any other * non conventional verdicts. */ return 0; } } while (entry); return 1; }

Contributors

PersonTokensPropCommitsCommitProp
harald welteharald welte5239.10%17.14%
pablo neira ayusopablo neira ayuso5138.35%428.57%
eric pariseric paris118.27%17.14%
florian westphalflorian westphal86.02%321.43%
david s. millerdavid s. miller43.01%17.14%
aaron conoleaaron conole43.01%214.29%
herbert xuherbert xu21.50%17.14%
michael wangmichael wang10.75%17.14%
Total133100.00%14100.00%

EXPORT_SYMBOL(nf_hook_slow);
int skb_make_writable(struct sk_buff *skb, unsigned int writable_len) { if (writable_len > skb->len) return 0; /* Not exclusive use of packet? Must copy. */ if (!skb_cloned(skb)) { if (writable_len <= skb_headlen(skb)) return 1; } else if (skb_clone_writable(skb, writable_len)) return 1; if (writable_len <= skb_headlen(skb)) writable_len = 0; else writable_len -= skb_headlen(skb); return !!__pskb_pull_tail(skb, writable_len); }

Contributors

PersonTokensPropCommitsCommitProp
harald welteharald welte4751.09%133.33%
herbert xuherbert xu3942.39%133.33%
patrick mchardypatrick mchardy66.52%133.33%
Total92100.00%3100.00%

EXPORT_SYMBOL(skb_make_writable); /* This needs to be compiled in any case to avoid dependencies between the * nfnetlink_queue code and nf_conntrack. */ struct nfnl_ct_hook __rcu *nfnl_ct_hook __read_mostly; EXPORT_SYMBOL_GPL(nfnl_ct_hook); #if IS_ENABLED(CONFIG_NF_CONNTRACK) /* This does not belong here, but locally generated errors need it if connection tracking in use: without this, connection may not be in hash table, and hence manufactured ICMP or RST packets will not be associated with it. */ void (*ip_ct_attach)(struct sk_buff *, const struct sk_buff *) __rcu __read_mostly; EXPORT_SYMBOL (ip_ct_attach);
void nf_ct_attach(struct sk_buff *new, const struct sk_buff *skb) { void (*attach)(struct sk_buff *, const struct sk_buff *); if (skb->nfct) { rcu_read_lock(); attach = rcu_dereference(ip_ct_attach); if (attach) attach(new, skb); rcu_read_unlock(); } }

Contributors

PersonTokensPropCommitsCommitProp
harald welteharald welte4773.44%133.33%
patrick mchardypatrick mchardy1726.56%266.67%
Total64100.00%3100.00%

EXPORT_SYMBOL(nf_ct_attach); void (*nf_ct_destroy)(struct nf_conntrack *) __rcu __read_mostly; EXPORT_SYMBOL (nf_ct_destroy);
void nf_conntrack_destroy(struct nf_conntrack *nfct) { void (*destroy)(struct nf_conntrack *); rcu_read_lock(); destroy = rcu_dereference(nf_ct_destroy); BUG_ON(destroy == NULL); destroy(nfct); rcu_read_unlock(); }

Contributors

PersonTokensPropCommitsCommitProp
yasuyuki kozakaiyasuyuki kozakai46100.00%1100.00%
Total46100.00%1100.00%

EXPORT_SYMBOL(nf_conntrack_destroy); /* Built-in default zone used e.g. by modules. */ const struct nf_conntrack_zone nf_ct_zone_dflt = { .id = NF_CT_DEFAULT_ZONE_ID, .dir = NF_CT_DEFAULT_ZONE_DIR, }; EXPORT_SYMBOL_GPL(nf_ct_zone_dflt); #endif /* CONFIG_NF_CONNTRACK */ #ifdef CONFIG_NF_NAT_NEEDED void (*nf_nat_decode_session_hook)(struct sk_buff *, struct flowi *); EXPORT_SYMBOL(nf_nat_decode_session_hook); #endif
static int nf_register_hook_list(struct net *net) { struct nf_hook_ops *elem; int ret; rtnl_lock(); list_for_each_entry(elem, &nf_hook_list, list) { ret = nf_register_net_hook(net, elem); if (ret && ret != -ENOENT) goto out_undo; } rtnl_unlock(); return 0; out_undo: list_for_each_entry_continue_reverse(elem, &nf_hook_list, list) nf_unregister_net_hook(net, elem); rtnl_unlock(); return ret; }

Contributors

PersonTokensPropCommitsCommitProp
eric w. biedermaneric w. biederman82100.00%1100.00%
Total82100.00%1100.00%


static void nf_unregister_hook_list(struct net *net) { struct nf_hook_ops *elem; rtnl_lock(); list_for_each_entry(elem, &nf_hook_list, list) nf_unregister_net_hook(net, elem); rtnl_unlock(); }

Contributors

PersonTokensPropCommitsCommitProp
eric w. biedermaneric w. biederman37100.00%1100.00%
Total37100.00%1100.00%


static int __net_init netfilter_net_init(struct net *net) { int i, h, ret; for (i = 0; i < ARRAY_SIZE(net->nf.hooks); i++) { for (h = 0; h < NF_MAX_HOOKS; h++) RCU_INIT_POINTER(net->nf.hooks[i][h], NULL); } #ifdef CONFIG_PROC_FS net->nf.proc_netfilter = proc_net_mkdir(net, "netfilter", net->proc_net); if (!net->nf.proc_netfilter) { if (!net_eq(net, &init_net)) pr_err("cannot create netfilter proc entry"); return -ENOMEM; } #endif ret = nf_register_hook_list(net); if (ret) remove_proc_entry("netfilter", net->proc_net); return ret; }

Contributors

PersonTokensPropCommitsCommitProp
eric w. biedermaneric w. biederman7752.38%125.00%
gao fenggao feng6040.82%125.00%
pablo neira ayusopablo neira ayuso74.76%125.00%
aaron conoleaaron conole32.04%125.00%
Total147100.00%4100.00%


static void __net_exit netfilter_net_exit(struct net *net) { nf_unregister_hook_list(net); remove_proc_entry("netfilter", net->proc_net); }

Contributors

PersonTokensPropCommitsCommitProp
gao fenggao feng2180.77%150.00%
eric w. biedermaneric w. biederman519.23%150.00%
Total26100.00%2100.00%

static struct pernet_operations netfilter_net_ops = { .init = netfilter_net_init, .exit = netfilter_net_exit, };
int __init netfilter_init(void) { int ret; ret = register_pernet_subsys(&netfilter_net_ops); if (ret < 0) goto err; ret = netfilter_log_init(); if (ret < 0) goto err_pernet; return 0; err_pernet: unregister_pernet_subsys(&netfilter_net_ops); err: return ret; }

Contributors

PersonTokensPropCommitsCommitProp
pablo neira ayusopablo neira ayuso3255.17%133.33%
harald welteharald welte1932.76%133.33%
gao fenggao feng712.07%133.33%
Total58100.00%3100.00%


Overall Contributors

PersonTokensPropCommitsCommitProp
eric w. biedermaneric w. biederman65430.50%69.52%
harald welteharald welte29313.67%11.59%
patrick mchardypatrick mchardy26912.55%1015.87%
mahesh bandewarmahesh bandewar1677.79%11.59%
pablo neira ayusopablo neira ayuso1557.23%1117.46%
aaron conoleaaron conole1356.30%57.94%
gao fenggao feng1054.90%11.59%
linus torvaldslinus torvalds924.29%11.59%
yasuyuki kozakaiyasuyuki kozakai703.26%23.17%
eric dumazeteric dumazet532.47%23.17%
herbert xuherbert xu411.91%23.17%
florian westphalflorian westphal401.87%711.11%
daniel borkmanndaniel borkmann231.07%11.59%
eric pariseric paris110.51%11.59%
zhouyi zhouzhouyi zhou90.42%11.59%
changli gaochangli gao70.33%11.59%
david s. millerdavid s. miller40.19%11.59%
tejun heotejun heo30.14%11.59%
ingo molnaringo molnar30.14%11.59%
ken-ichirou matsuzawaken-ichirou matsuzawa30.14%11.59%
stephen hemmingerstephen hemminger20.09%11.59%
martin josefssonmartin josefsson10.05%11.59%
michael wangmichael wang10.05%11.59%
igor maravicigor maravic10.05%11.59%
jan engelhardtjan engelhardt10.05%11.59%
arnd bergmannarnd bergmann10.05%11.59%
Total2144100.00%63100.00%
Directory: net/netfilter
Information contained on this website is for historical information purposes only and does not indicate or represent copyright ownership.