Release 4.11 net/netfilter/core.c

Directory: net/netfilter
/* netfilter.c: look after the filters for various protocols.
 * Heavily influenced by the old firewall.c by David Bonn and Alan Cox.
 *
 * Thanks to Rob `CmdrTaco' Malda for not influencing this code in any
 * way.
 *
 * Rusty Russell (C)2000 -- This code is GPL.
 * Patrick McHardy (c) 2006-2012
 */
#include <linux/kernel.h>
#include <linux/netfilter.h>
#include <net/protocol.h>
#include <linux/init.h>
#include <linux/skbuff.h>
#include <linux/wait.h>
#include <linux/module.h>
#include <linux/interrupt.h>
#include <linux/if.h>
#include <linux/netdevice.h>
#include <linux/netfilter_ipv6.h>
#include <linux/inetdevice.h>
#include <linux/proc_fs.h>
#include <linux/mutex.h>
#include <linux/slab.h>
#include <linux/rcupdate.h>
#include <net/net_namespace.h>
#include <net/sock.h>

#include "nf_internals.h"

static DEFINE_MUTEX(afinfo_mutex);


const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO] __read_mostly;

EXPORT_SYMBOL(nf_afinfo);

const struct nf_ipv6_ops __rcu *nf_ipv6_ops __read_mostly;

EXPORT_SYMBOL_GPL(nf_ipv6_ops);

DEFINE_PER_CPU(bool, nf_skb_duplicated);

EXPORT_SYMBOL_GPL(nf_skb_duplicated);



int nf_register_afinfo(const struct nf_afinfo *afinfo)
{
	mutex_lock(&afinfo_mutex);
	RCU_INIT_POINTER(nf_afinfo[afinfo->family], afinfo);
	mutex_unlock(&afinfo_mutex);
	return 0;
}
Contributors
Person Tokens Prop Commits CommitProp
Patrick McHardy 36 94.74% 3 60.00%
Pablo Neira Ayuso 1 2.63% 1 20.00%
Stephen Hemminger 1 2.63% 1 20.00%
Total 38 100.00% 5 100.00%


EXPORT_SYMBOL_GPL(nf_register_afinfo);



void nf_unregister_afinfo(const struct nf_afinfo *afinfo)
{
	mutex_lock(&afinfo_mutex);
	RCU_INIT_POINTER(nf_afinfo[afinfo->family], NULL);
	mutex_unlock(&afinfo_mutex);
	synchronize_rcu();
}
Contributors
Person Tokens Prop Commits CommitProp
Patrick McHardy 37 97.37% 3 75.00%
Stephen Hemminger 1 2.63% 1 25.00%
Total 38 100.00% 4 100.00%


EXPORT_SYMBOL_GPL(nf_unregister_afinfo);

#ifdef HAVE_JUMP_LABEL

struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS];

EXPORT_SYMBOL(nf_hooks_needed);
#endif

static DEFINE_MUTEX(nf_hook_mutex);

#define nf_entry_dereference(e) \
	rcu_dereference_protected(e, lockdep_is_held(&nf_hook_mutex))



static struct nf_hook_entry __rcu **nf_hook_entry_head(struct net *net, const struct nf_hook_ops *reg)
{
	if (reg->pf != NFPROTO_NETDEV)
		return net->nf.hooks[reg->pf]+reg->hooknum;

#ifdef CONFIG_NETFILTER_INGRESS
	if (reg->hooknum == NF_NETDEV_INGRESS) {
		if (reg->dev && dev_net(reg->dev) == net)
			return &reg->dev->nf_hooks_ingress;
	}
#endif
	return NULL;
}

Contributors
Person Tokens Prop Commits CommitProp
Eric W. Biedermann 39 45.35% 2 25.00%
Pablo Neira Ayuso 23 26.74% 2 25.00%
Linus Torvalds 13 15.12% 1 12.50%
Harald Welte 7 8.14% 1 12.50%
Aaron Conole 4 4.65% 2 25.00%
Total 86 100.00% 8 100.00%



int nf_register_net_hook(struct net *net, const struct nf_hook_ops *reg)
{
	struct nf_hook_entry __rcu **pp;
	struct nf_hook_entry *entry, *p;

	if (reg->pf == NFPROTO_NETDEV) {
#ifndef CONFIG_NETFILTER_INGRESS
		if (reg->hooknum == NF_NETDEV_INGRESS)
			return -EOPNOTSUPP;
#endif
		if (reg->hooknum != NF_NETDEV_INGRESS ||
		    !reg->dev || dev_net(reg->dev) != net)
			return -EINVAL;
	}

	pp = nf_hook_entry_head(net, reg);
	if (!pp)
		return -EINVAL;

	entry = kmalloc(sizeof(*entry), GFP_KERNEL);
	if (!entry)
		return -ENOMEM;

	nf_hook_entry_init(entry, reg);

	mutex_lock(&nf_hook_mutex);

	/* Find the spot in the list */
	for (; (p = nf_entry_dereference(*pp)) != NULL; pp = &p->next) {
		if (reg->priority < nf_hook_entry_priority(p))
			break;
	}
	rcu_assign_pointer(entry->next, p);
	rcu_assign_pointer(*pp, entry);

	mutex_unlock(&nf_hook_mutex);
#ifdef CONFIG_NETFILTER_INGRESS
	if (reg->pf == NFPROTO_NETDEV && reg->hooknum == NF_NETDEV_INGRESS)
		net_inc_ingress_queue();
#endif
#ifdef HAVE_JUMP_LABEL
	static_key_slow_inc(&nf_hooks_needed[reg->pf][reg->hooknum]);
#endif
	return 0;
}
Contributors
Person Tokens Prop Commits CommitProp
Aaron Conole 91 37.45% 5 29.41%
Eric W. Biedermann 62 25.51% 4 23.53%
Linus Torvalds 42 17.28% 1 5.88%
Eric Dumazet 17 7.00% 1 5.88%
Harald Welte 15 6.17% 1 5.88%
Pablo Neira Ayuso 10 4.12% 2 11.76%
Zhouyi Zhou 3 1.23% 1 5.88%
Patrick McHardy 2 0.82% 1 5.88%
Ingo Molnar 1 0.41% 1 5.88%
Total 243 100.00% 17 100.00%


EXPORT_SYMBOL(nf_register_net_hook);



void nf_unregister_net_hook(struct net *net, const struct nf_hook_ops *reg)
{
	struct nf_hook_entry __rcu **pp;
	struct nf_hook_entry *p;

	pp = nf_hook_entry_head(net, reg);
	if (WARN_ON_ONCE(!pp))
		return;

	mutex_lock(&nf_hook_mutex);
	for (; (p = nf_entry_dereference(*pp)) != NULL; pp = &p->next) {
		if (nf_hook_entry_ops(p) == reg) {
			rcu_assign_pointer(*pp, p->next);
			break;
		}
	}
	mutex_unlock(&nf_hook_mutex);
	if (!p) {
		WARN(1, "nf_unregister_net_hook: hook not found!\n");
		return;
	}
#ifdef CONFIG_NETFILTER_INGRESS
	if (reg->pf == NFPROTO_NETDEV && reg->hooknum == NF_NETDEV_INGRESS)
		net_dec_ingress_queue();
#endif
#ifdef HAVE_JUMP_LABEL
	static_key_slow_dec(&nf_hooks_needed[reg->pf][reg->hooknum]);
#endif
	synchronize_net();
	nf_queue_nf_hook_drop(net, p);
	/* other cpu might still process nfqueue verdict that used reg */
	synchronize_net();
	kfree(p);
}
Contributors
Person Tokens Prop Commits CommitProp
Eric W. Biedermann 73 40.33% 2 13.33%
Linus Torvalds 37 20.44% 1 6.67%
Aaron Conole 22 12.15% 3 20.00%
Pablo Neira Ayuso 20 11.05% 3 20.00%
Harald Welte 17 9.39% 1 6.67%
Florian Westphal 4 2.21% 1 6.67%
Zhouyi Zhou 3 1.66% 1 6.67%
Patrick McHardy 2 1.10% 1 6.67%
Eric Dumazet 2 1.10% 1 6.67%
Ingo Molnar 1 0.55% 1 6.67%
Total 181 100.00% 15 100.00%


EXPORT_SYMBOL(nf_unregister_net_hook);



int nf_register_net_hooks(struct net *net, const struct nf_hook_ops *reg,
			  unsigned int n)
{
	unsigned int i;
	int err = 0;

	for (i = 0; i < n; i++) {
		err = nf_register_net_hook(net, &reg[i]);
		if (err)
			goto err;
	}
	return err;

err:
	if (i > 0)
		nf_unregister_net_hooks(net, reg, i);
	return err;
}
Contributors
Person Tokens Prop Commits CommitProp
Eric W. Biedermann 87 100.00% 1 100.00%
Total 87 100.00% 1 100.00%


EXPORT_SYMBOL(nf_register_net_hooks);



void nf_unregister_net_hooks(struct net *net, const struct nf_hook_ops *reg,
			     unsigned int n)
{
	while (n-- > 0)
		nf_unregister_net_hook(net, &reg[n]);
}
Contributors
Person Tokens Prop Commits CommitProp
Eric W. Biedermann 38 100.00% 1 100.00%
Total 38 100.00% 1 100.00%


EXPORT_SYMBOL(nf_unregister_net_hooks);

static LIST_HEAD(nf_hook_list);



static int _nf_register_hook(struct nf_hook_ops *reg)
{
	struct net *net, *last;
	int ret;

	for_each_net(net) {
		ret = nf_register_net_hook(net, reg);
		if (ret && ret != -ENOENT)
			goto rollback;
	}
	list_add_tail(&reg->list, &nf_hook_list);

	return 0;
rollback:
	last = net;
	for_each_net(net) {
		if (net == last)
			break;
		nf_unregister_net_hook(net, reg);
	}
	return ret;
}

Contributors
Person Tokens Prop Commits CommitProp
Eric W. Biedermann 86 93.48% 1 50.00%
Mahesh Bandewar 6 6.52% 1 50.00%
Total 92 100.00% 2 100.00%



int nf_register_hook(struct nf_hook_ops *reg)
{
	int ret;

	rtnl_lock();
	ret = _nf_register_hook(reg);
	rtnl_unlock();

	return ret;
}
Contributors
Person Tokens Prop Commits CommitProp
Mahesh Bandewar 22 75.86% 1 50.00%
Eric W. Biedermann 7 24.14% 1 50.00%
Total 29 100.00% 2 100.00%


EXPORT_SYMBOL(nf_register_hook);



static void _nf_unregister_hook(struct nf_hook_ops *reg)
{
	struct net *net;

	list_del(&reg->list);
	for_each_net(net)
		nf_unregister_net_hook(net, reg);
}

Contributors
Person Tokens Prop Commits CommitProp
Eric W. Biedermann 28 80.00% 2 50.00%
Eric Dumazet 4 11.43% 1 25.00%
Mahesh Bandewar 3 8.57% 1 25.00%
Total 35 100.00% 4 100.00%



void nf_unregister_hook(struct nf_hook_ops *reg)
{
	rtnl_lock();
	_nf_unregister_hook(reg);
	rtnl_unlock();
}
Contributors
Person Tokens Prop Commits CommitProp
Mahesh Bandewar 17 80.95% 1 33.33%
Eric W. Biedermann 3 14.29% 1 33.33%
Harald Welte 1 4.76% 1 33.33%
Total 21 100.00% 3 100.00%


EXPORT_SYMBOL(nf_unregister_hook);



int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n)
{
	unsigned int i;
	int err = 0;

	for (i = 0; i < n; i++) {
		err = nf_register_hook(&reg[i]);
		if (err)
			goto err;
	}
	return err;

err:
	if (i > 0)
		nf_unregister_hooks(reg, i);
	return err;
}
Contributors
Person Tokens Prop Commits CommitProp
Patrick McHardy 77 100.00% 1 100.00%
Total 77 100.00% 1 100.00%


EXPORT_SYMBOL(nf_register_hooks);

/* Caller MUST take rtnl_lock() */


int _nf_register_hooks(struct nf_hook_ops *reg, unsigned int n)
{
	unsigned int i;
	int err = 0;

	for (i = 0; i < n; i++) {
		err = _nf_register_hook(&reg[i]);
		if (err)
			goto err;
	}
	return err;

err:
	if (i > 0)
		_nf_unregister_hooks(reg, i);
	return err;
}
Contributors
Person Tokens Prop Commits CommitProp
Mahesh Bandewar 77 100.00% 1 100.00%
Total 77 100.00% 1 100.00%


EXPORT_SYMBOL(_nf_register_hooks);



void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n)
{
	while (n-- > 0)
		nf_unregister_hook(&reg[n]);
}
Contributors
Person Tokens Prop Commits CommitProp
Patrick McHardy 23 76.67% 1 50.00%
Changli Gao 7 23.33% 1 50.00%
Total 30 100.00% 2 100.00%


EXPORT_SYMBOL(nf_unregister_hooks);

/* Caller MUST take rtnl_lock */


void _nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n)
{
	while (n-- > 0)
		_nf_unregister_hook(&reg[n]);
}
Contributors
Person Tokens Prop Commits CommitProp
Mahesh Bandewar 30 100.00% 1 100.00%
Total 30 100.00% 1 100.00%


EXPORT_SYMBOL(_nf_unregister_hooks);

/* Returns 1 if okfn() needs to be executed by the caller,
 * -EPERM for NF_DROP, 0 otherwise.  Caller must hold rcu_read_lock. */


int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state,
		 struct nf_hook_entry *entry)
{
	unsigned int verdict;
	int ret;

	do {
		verdict = nf_hook_entry_hookfn(entry, skb, state);
		switch (verdict & NF_VERDICT_MASK) {
		case NF_ACCEPT:
			entry = rcu_dereference(entry->next);
			break;
		case NF_DROP:
			kfree_skb(skb);
			ret = NF_DROP_GETERR(verdict);
			if (ret == 0)
				ret = -EPERM;
			return ret;
		case NF_QUEUE:
			ret = nf_queue(skb, state, &entry, verdict);
			if (ret == 1 && entry)
				continue;
			return ret;
		default:
			/* Implicit handling for NF_STOLEN, as well as any other
                         * non conventional verdicts.
                         */
			return 0;
		}
	} while (entry);

	return 1;
}
Contributors
Person Tokens Prop Commits CommitProp
Harald Welte 52 39.10% 1 7.14%
Pablo Neira Ayuso 51 38.35% 4 28.57%
Eric Paris 11 8.27% 1 7.14%
Florian Westphal 8 6.02% 3 21.43%
Aaron Conole 4 3.01% 2 14.29%
David S. Miller 4 3.01% 1 7.14%
Herbert Xu 2 1.50% 1 7.14%
Michael Wang 1 0.75% 1 7.14%
Total 133 100.00% 14 100.00%


EXPORT_SYMBOL(nf_hook_slow);




int skb_make_writable(struct sk_buff *skb, unsigned int writable_len)
{
	if (writable_len > skb->len)
		return 0;

	/* Not exclusive use of packet?  Must copy. */
	if (!skb_cloned(skb)) {
		if (writable_len <= skb_headlen(skb))
			return 1;
	} else if (skb_clone_writable(skb, writable_len))
		return 1;

	if (writable_len <= skb_headlen(skb))
		writable_len = 0;
	else
		writable_len -= skb_headlen(skb);

	return !!__pskb_pull_tail(skb, writable_len);
}
Contributors
Person Tokens Prop Commits CommitProp
Harald Welte 47 51.09% 1 33.33%
Herbert Xu 39 42.39% 1 33.33%
Patrick McHardy 6 6.52% 1 33.33%
Total 92 100.00% 3 100.00%


EXPORT_SYMBOL(skb_make_writable);

/* This needs to be compiled in any case to avoid dependencies between the
 * nfnetlink_queue code and nf_conntrack.
 */

struct nfnl_ct_hook __rcu *nfnl_ct_hook __read_mostly;

EXPORT_SYMBOL_GPL(nfnl_ct_hook);

#if IS_ENABLED(CONFIG_NF_CONNTRACK)
/* This does not belong here, but locally generated errors need it if connection
   tracking in use: without this, connection may not be in hash table, and hence
   manufactured ICMP or RST packets will not be associated with it. */
void (*ip_ct_attach)(struct sk_buff *, const struct sk_buff *)
		
__rcu __read_mostly;
EXPORT_SYMBOL
(ip_ct_attach);



void nf_ct_attach(struct sk_buff *new, const struct sk_buff *skb)
{
	void (*attach)(struct sk_buff *, const struct sk_buff *);

	if (skb->_nfct) {
		rcu_read_lock();
		attach = rcu_dereference(ip_ct_attach);
		if (attach)
			attach(new, skb);
		rcu_read_unlock();
	}
}
Contributors
Person Tokens Prop Commits CommitProp
Harald Welte 46 71.88% 1 25.00%
Patrick McHardy 17 26.56% 2 50.00%
Florian Westphal 1 1.56% 1 25.00%
Total 64 100.00% 4 100.00%


EXPORT_SYMBOL(nf_ct_attach);


void (*nf_ct_destroy)(struct nf_conntrack *) __rcu __read_mostly;
EXPORT_SYMBOL
(nf_ct_destroy);



void nf_conntrack_destroy(struct nf_conntrack *nfct)
{
	void (*destroy)(struct nf_conntrack *);

	rcu_read_lock();
	destroy = rcu_dereference(nf_ct_destroy);
	BUG_ON(destroy == NULL);
	destroy(nfct);
	rcu_read_unlock();
}
Contributors
Person Tokens Prop Commits CommitProp
Yasuyuki Kozakai 46 100.00% 1 100.00%
Total 46 100.00% 1 100.00%


EXPORT_SYMBOL(nf_conntrack_destroy);

/* Built-in default zone used e.g. by modules. */

const struct nf_conntrack_zone nf_ct_zone_dflt = {
	.id	= NF_CT_DEFAULT_ZONE_ID,
	.dir	= NF_CT_DEFAULT_ZONE_DIR,
};

EXPORT_SYMBOL_GPL(nf_ct_zone_dflt);
#endif /* CONFIG_NF_CONNTRACK */

#ifdef CONFIG_NF_NAT_NEEDED

void (*nf_nat_decode_session_hook)(struct sk_buff *, struct flowi *);

EXPORT_SYMBOL(nf_nat_decode_session_hook);
#endif



static int nf_register_hook_list(struct net *net)
{
	struct nf_hook_ops *elem;
	int ret;

	rtnl_lock();
	list_for_each_entry(elem, &nf_hook_list, list) {
		ret = nf_register_net_hook(net, elem);
		if (ret && ret != -ENOENT)
			goto out_undo;
	}
	rtnl_unlock();
	return 0;

out_undo:
	list_for_each_entry_continue_reverse(elem, &nf_hook_list, list)
		nf_unregister_net_hook(net, elem);
	rtnl_unlock();
	return ret;
}

Contributors
Person Tokens Prop Commits CommitProp
Eric W. Biedermann 82 100.00% 1 100.00%
Total 82 100.00% 1 100.00%



static void nf_unregister_hook_list(struct net *net)
{
	struct nf_hook_ops *elem;

	rtnl_lock();
	list_for_each_entry(elem, &nf_hook_list, list)
		nf_unregister_net_hook(net, elem);
	rtnl_unlock();
}

Contributors
Person Tokens Prop Commits CommitProp
Eric W. Biedermann 37 100.00% 1 100.00%
Total 37 100.00% 1 100.00%



static int __net_init netfilter_net_init(struct net *net)
{
	int i, h, ret;

	for (i = 0; i < ARRAY_SIZE(net->nf.hooks); i++) {
		for (h = 0; h < NF_MAX_HOOKS; h++)
			RCU_INIT_POINTER(net->nf.hooks[i][h], NULL);
	}

#ifdef CONFIG_PROC_FS
	net->nf.proc_netfilter = proc_net_mkdir(net, "netfilter",
						net->proc_net);
	if (!net->nf.proc_netfilter) {
		if (!net_eq(net, &init_net))
			pr_err("cannot create netfilter proc entry");

		return -ENOMEM;
	}
#endif
	ret = nf_register_hook_list(net);
	if (ret)
		remove_proc_entry("netfilter", net->proc_net);

	return ret;
}

Contributors
Person Tokens Prop Commits CommitProp
Eric W. Biedermann 77 52.38% 1 25.00%
Gao Feng 60 40.82% 1 25.00%
Pablo Neira Ayuso 7 4.76% 1 25.00%
Aaron Conole 3 2.04% 1 25.00%
Total 147 100.00% 4 100.00%



static void __net_exit netfilter_net_exit(struct net *net)
{
	nf_unregister_hook_list(net);
	remove_proc_entry("netfilter", net->proc_net);
}

Contributors
Person Tokens Prop Commits CommitProp
Gao Feng 21 80.77% 1 50.00%
Eric W. Biedermann 5 19.23% 1 50.00%
Total 26 100.00% 2 100.00%


static struct pernet_operations netfilter_net_ops = {
	.init = netfilter_net_init,
	.exit = netfilter_net_exit,
};



int __init netfilter_init(void)
{
	int ret;

	ret = register_pernet_subsys(&netfilter_net_ops);
	if (ret < 0)
		goto err;

	ret = netfilter_log_init();
	if (ret < 0)
		goto err_pernet;

	return 0;
err_pernet:
	unregister_pernet_subsys(&netfilter_net_ops);
err:
	return ret;
}
Contributors
Person Tokens Prop Commits CommitProp
Pablo Neira Ayuso 32 55.17% 1 33.33%
Harald Welte 19 32.76% 1 33.33%
Gao Feng 7 12.07% 1 33.33%
Total 58 100.00% 3 100.00%

Overall Contributors
Person Tokens Prop Commits CommitProp
Eric W. Biedermann 654 30.50% 6 9.38%
Harald Welte 292 13.62% 1 1.56%
Patrick McHardy 269 12.55% 10 15.62%
Mahesh Bandewar 167 7.79% 1 1.56%
Pablo Neira Ayuso 155 7.23% 11 17.19%
Aaron Conole 135 6.30% 5 7.81%
Gao Feng 105 4.90% 1 1.56%
Linus Torvalds 92 4.29% 1 1.56%
Yasuyuki Kozakai 70 3.26% 2 3.12%
Eric Dumazet 53 2.47% 2 3.12%
Florian Westphal 41 1.91% 8 12.50%
Herbert Xu 41 1.91% 2 3.12%
Daniel Borkmann 23 1.07% 1 1.56%
Eric Paris 11 0.51% 1 1.56%
Zhouyi Zhou 9 0.42% 1 1.56%
Changli Gao 7 0.33% 1 1.56%
David S. Miller 4 0.19% 1 1.56%
Ken-ichirou MATSUZAWA 3 0.14% 1 1.56%
Tejun Heo 3 0.14% 1 1.56%
Ingo Molnar 3 0.14% 1 1.56%
Stephen Hemminger 2 0.09% 1 1.56%
Arnd Bergmann 1 0.05% 1 1.56%
Michael Wang 1 0.05% 1 1.56%
Igor Maravić 1 0.05% 1 1.56%
Jan Engelhardt 1 0.05% 1 1.56%
Martin Josefsson 1 0.05% 1 1.56%
Total 2144 100.00% 64 100.00%
Directory: net/netfilter

Information contained on this website is for historical information purposes only and does not indicate or represent copyright ownership.
Created with cregit.
Person	Tokens	Prop	Commits	CommitProp
Patrick McHardy	36	94.74%	3	60.00%
Pablo Neira Ayuso	1	2.63%	1	20.00%
Stephen Hemminger	1	2.63%	1	20.00%
Total	38	100.00%	5	100.00%
cregit-Linux how code gets into the kernel

Release 4.11 net/netfilter/core.c

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Overall Contributors
