Release 4.8 net/netfilter/core.c

Directory: net/netfilter
/* netfilter.c: look after the filters for various protocols.
 * Heavily influenced by the old firewall.c by David Bonn and Alan Cox.
 *
 * Thanks to Rob `CmdrTaco' Malda for not influencing this code in any
 * way.
 *
 * Rusty Russell (C)2000 -- This code is GPL.
 * Patrick McHardy (c) 2006-2012
 */
#include <linux/kernel.h>
#include <linux/netfilter.h>
#include <net/protocol.h>
#include <linux/init.h>
#include <linux/skbuff.h>
#include <linux/wait.h>
#include <linux/module.h>
#include <linux/interrupt.h>
#include <linux/if.h>
#include <linux/netdevice.h>
#include <linux/netfilter_ipv6.h>
#include <linux/inetdevice.h>
#include <linux/proc_fs.h>
#include <linux/mutex.h>
#include <linux/slab.h>
#include <net/net_namespace.h>
#include <net/sock.h>

#include "nf_internals.h"

static DEFINE_MUTEX(afinfo_mutex);


const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO] __read_mostly;

EXPORT_SYMBOL(nf_afinfo);

const struct nf_ipv6_ops __rcu *nf_ipv6_ops __read_mostly;

EXPORT_SYMBOL_GPL(nf_ipv6_ops);

DEFINE_PER_CPU(bool, nf_skb_duplicated);

EXPORT_SYMBOL_GPL(nf_skb_duplicated);



int nf_register_afinfo(const struct nf_afinfo *afinfo)
{
	mutex_lock(&afinfo_mutex);
	RCU_INIT_POINTER(nf_afinfo[afinfo->family], afinfo);
	mutex_unlock(&afinfo_mutex);
	return 0;
}
Contributors
Person Tokens Prop Commits CommitProp
patrick mchardy patrick mchardy 36 94.74% 3 60.00%
pablo neira ayuso pablo neira ayuso 1 2.63% 1 20.00%
stephen hemminger stephen hemminger 1 2.63% 1 20.00%
Total 38 100.00% 5 100.00%


EXPORT_SYMBOL_GPL(nf_register_afinfo);



void nf_unregister_afinfo(const struct nf_afinfo *afinfo)
{
	mutex_lock(&afinfo_mutex);
	RCU_INIT_POINTER(nf_afinfo[afinfo->family], NULL);
	mutex_unlock(&afinfo_mutex);
	synchronize_rcu();
}
Contributors
Person Tokens Prop Commits CommitProp
patrick mchardy patrick mchardy 37 97.37% 3 75.00%
stephen hemminger stephen hemminger 1 2.63% 1 25.00%
Total 38 100.00% 4 100.00%


EXPORT_SYMBOL_GPL(nf_unregister_afinfo);

#ifdef HAVE_JUMP_LABEL

struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS];

EXPORT_SYMBOL(nf_hooks_needed);
#endif

static DEFINE_MUTEX(nf_hook_mutex);



static struct list_head *nf_find_hook_list(struct net *net,
					   const struct nf_hook_ops *reg)
{
	struct list_head *hook_list = NULL;

	if (reg->pf != NFPROTO_NETDEV)
		hook_list = &net->nf.hooks[reg->pf][reg->hooknum];
	else if (reg->hooknum == NF_NETDEV_INGRESS) {
#ifdef CONFIG_NETFILTER_INGRESS
		if (reg->dev && dev_net(reg->dev) == net)
			hook_list = &reg->dev->nf_hooks_ingress;
#endif
	}
	return hook_list;
}

Contributors
Person Tokens Prop Commits CommitProp
eric w. biederman eric w. biederman 53 55.21% 2 40.00%
pablo neira ayuso pablo neira ayuso 35 36.46% 2 40.00%
harald welte harald welte 8 8.33% 1 20.00%
Total 96 100.00% 5 100.00%


struct nf_hook_entry {
	
const struct nf_hook_ops	*orig_ops;
	
struct nf_hook_ops		ops;
};



int nf_register_net_hook(struct net *net, const struct nf_hook_ops *reg)
{
	struct list_head *hook_list;
	struct nf_hook_entry *entry;
	struct nf_hook_ops *elem;

	entry = kmalloc(sizeof(*entry), GFP_KERNEL);
	if (!entry)
		return -ENOMEM;

	entry->orig_ops	= reg;
	entry->ops	= *reg;

	hook_list = nf_find_hook_list(net, reg);
	if (!hook_list) {
		kfree(entry);
		return -ENOENT;
	}

	mutex_lock(&nf_hook_mutex);
	list_for_each_entry(elem, hook_list, list) {
		if (reg->priority < elem->priority)
			break;
	}
	list_add_rcu(&entry->ops.list, elem->list.prev);
	mutex_unlock(&nf_hook_mutex);
#ifdef CONFIG_NETFILTER_INGRESS
	if (reg->pf == NFPROTO_NETDEV && reg->hooknum == NF_NETDEV_INGRESS)
		net_inc_ingress_queue();
#endif
#ifdef HAVE_JUMP_LABEL
	static_key_slow_inc(&nf_hooks_needed[reg->pf][reg->hooknum]);
#endif
	return 0;
}
Contributors
Person Tokens Prop Commits CommitProp
eric w. biederman eric w. biederman 96 51.61% 4 30.77%
harald welte harald welte 33 17.74% 1 7.69%
pablo neira ayuso pablo neira ayuso 26 13.98% 3 23.08%
eric dumazet eric dumazet 17 9.14% 1 7.69%
li zefan li zefan 8 4.30% 1 7.69%
zhouyi zhou zhouyi zhou 3 1.61% 1 7.69%
patrick mchardy patrick mchardy 2 1.08% 1 7.69%
ingo molnar ingo molnar 1 0.54% 1 7.69%
Total 186 100.00% 13 100.00%


EXPORT_SYMBOL(nf_register_net_hook);



void nf_unregister_net_hook(struct net *net, const struct nf_hook_ops *reg)
{
	struct list_head *hook_list;
	struct nf_hook_entry *entry;
	struct nf_hook_ops *elem;

	hook_list = nf_find_hook_list(net, reg);
	if (!hook_list)
		return;

	mutex_lock(&nf_hook_mutex);
	list_for_each_entry(elem, hook_list, list) {
		entry = container_of(elem, struct nf_hook_entry, ops);
		if (entry->orig_ops == reg) {
			list_del_rcu(&entry->ops.list);
			break;
		}
	}
	mutex_unlock(&nf_hook_mutex);
	if (&elem->list == hook_list) {
		WARN(1, "nf_unregister_net_hook: hook not found!\n");
		return;
	}
#ifdef CONFIG_NETFILTER_INGRESS
	if (reg->pf == NFPROTO_NETDEV && reg->hooknum == NF_NETDEV_INGRESS)
		net_dec_ingress_queue();
#endif
#ifdef HAVE_JUMP_LABEL
	static_key_slow_dec(&nf_hooks_needed[reg->pf][reg->hooknum]);
#endif
	synchronize_net();
	nf_queue_nf_hook_drop(net, &entry->ops);
	/* other cpu might still process nfqueue verdict that used reg */
	synchronize_net();
	kfree(entry);
}
Contributors
Person Tokens Prop Commits CommitProp
eric w. biederman eric w. biederman 97 52.43% 2 16.67%
pablo neira ayuso pablo neira ayuso 51 27.57% 4 33.33%
harald welte harald welte 23 12.43% 1 8.33%
patrick mchardy patrick mchardy 4 2.16% 1 8.33%
florian westphal florian westphal 4 2.16% 1 8.33%
zhouyi zhou zhouyi zhou 3 1.62% 1 8.33%
eric dumazet eric dumazet 2 1.08% 1 8.33%
ingo molnar ingo molnar 1 0.54% 1 8.33%
Total 185 100.00% 12 100.00%


EXPORT_SYMBOL(nf_unregister_net_hook);



int nf_register_net_hooks(struct net *net, const struct nf_hook_ops *reg,
			  unsigned int n)
{
	unsigned int i;
	int err = 0;

	for (i = 0; i < n; i++) {
		err = nf_register_net_hook(net, &reg[i]);
		if (err)
			goto err;
	}
	return err;

err:
	if (i > 0)
		nf_unregister_net_hooks(net, reg, i);
	return err;
}
Contributors
Person Tokens Prop Commits CommitProp
eric w. biederman eric w. biederman 87 100.00% 1 100.00%
Total 87 100.00% 1 100.00%


EXPORT_SYMBOL(nf_register_net_hooks);



void nf_unregister_net_hooks(struct net *net, const struct nf_hook_ops *reg,
			     unsigned int n)
{
	while (n-- > 0)
		nf_unregister_net_hook(net, &reg[n]);
}
Contributors
Person Tokens Prop Commits CommitProp
eric w. biederman eric w. biederman 38 100.00% 1 100.00%
Total 38 100.00% 1 100.00%


EXPORT_SYMBOL(nf_unregister_net_hooks);

static LIST_HEAD(nf_hook_list);



int nf_register_hook(struct nf_hook_ops *reg)
{
	struct net *net, *last;
	int ret;

	rtnl_lock();
	for_each_net(net) {
		ret = nf_register_net_hook(net, reg);
		if (ret && ret != -ENOENT)
			goto rollback;
	}
	list_add_tail(&reg->list, &nf_hook_list);
	rtnl_unlock();

	return 0;
rollback:
	last = net;
	for_each_net(net) {
		if (net == last)
			break;
		nf_unregister_net_hook(net, reg);
	}
	rtnl_unlock();
	return ret;
}
Contributors
Person Tokens Prop Commits CommitProp
eric w. biederman eric w. biederman 100 100.00% 1 100.00%
Total 100 100.00% 1 100.00%


EXPORT_SYMBOL(nf_register_hook);



void nf_unregister_hook(struct nf_hook_ops *reg)
{
	struct net *net;

	rtnl_lock();
	list_del(&reg->list);
	for_each_net(net)
		nf_unregister_net_hook(net, reg);
	rtnl_unlock();
}
Contributors
Person Tokens Prop Commits CommitProp
eric w. biederman eric w. biederman 35 87.50% 2 50.00%
eric dumazet eric dumazet 4 10.00% 1 25.00%
harald welte harald welte 1 2.50% 1 25.00%
Total 40 100.00% 4 100.00%


EXPORT_SYMBOL(nf_unregister_hook);



int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n)
{
	unsigned int i;
	int err = 0;

	for (i = 0; i < n; i++) {
		err = nf_register_hook(&reg[i]);
		if (err)
			goto err;
	}
	return err;

err:
	if (i > 0)
		nf_unregister_hooks(reg, i);
	return err;
}
Contributors
Person Tokens Prop Commits CommitProp
patrick mchardy patrick mchardy 77 100.00% 1 100.00%
Total 77 100.00% 1 100.00%


EXPORT_SYMBOL(nf_register_hooks);



void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n)
{
	while (n-- > 0)
		nf_unregister_hook(&reg[n]);
}
Contributors
Person Tokens Prop Commits CommitProp
patrick mchardy patrick mchardy 23 76.67% 1 50.00%
changli gao changli gao 7 23.33% 1 50.00%
Total 30 100.00% 2 100.00%


EXPORT_SYMBOL(nf_unregister_hooks);



unsigned int nf_iterate(struct list_head *head,
			struct sk_buff *skb,
			struct nf_hook_state *state,
			struct nf_hook_ops **elemp)
{
	unsigned int verdict;

	/*
         * The caller must not block between calls to this
         * function because of risk of continuing from deleted element.
         */
	list_for_each_entry_continue_rcu((*elemp), head, list) {
		if (state->thresh > (*elemp)->priority)
			continue;

		/* Optimization: we don't need to hold module
                   reference here, since function can't sleep. --RR */
repeat:
		verdict = (*elemp)->hook((*elemp)->priv, skb, state);
		if (verdict != NF_ACCEPT) {
#ifdef CONFIG_NETFILTER_DEBUG
			if (unlikely((verdict & NF_VERDICT_MASK)
							> NF_MAX_VERDICT)) {
				NFDEBUG("Evil return from %p(%u).\n",
					(*elemp)->hook, state->hook);
				continue;
			}
#endif
			if (verdict != NF_REPEAT)
				return verdict;
			goto repeat;
		}
	}
	return NF_ACCEPT;
}


Contributors
Person Tokens Prop Commits CommitProp
harald welte harald welte 96 68.57% 1 12.50%
michael wang michael wang 24 17.14% 2 25.00%
david s. miller david s. miller 8 5.71% 1 12.50%
patrick mchardy patrick mchardy 7 5.00% 2 25.00%
eric w. biederman eric w. biederman 4 2.86% 1 12.50%
hideaki yoshifuji hideaki yoshifuji 1 0.71% 1 12.50%
Total 140 100.00% 8 100.00%

/* Returns 1 if okfn() needs to be executed by the caller,
 * -EPERM for NF_DROP, 0 otherwise. */


int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state)
{
	struct nf_hook_ops *elem;
	unsigned int verdict;
	int ret = 0;

	/* We may already have this, but read-locks nest anyway */
	rcu_read_lock();

	elem = list_entry_rcu(state->hook_list, struct nf_hook_ops, list);
next_hook:
	verdict = nf_iterate(state->hook_list, skb, state, &elem);
	if (verdict == NF_ACCEPT || verdict == NF_STOP) {
		ret = 1;
	} else if ((verdict & NF_VERDICT_MASK) == NF_DROP) {
		kfree_skb(skb);
		ret = NF_DROP_GETERR(verdict);
		if (ret == 0)
			ret = -EPERM;
	} else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) {
		int err = nf_queue(skb, elem, state,
				   verdict >> NF_VERDICT_QBITS);
		if (err < 0) {
			if (err == -ESRCH &&
			   (verdict & NF_VERDICT_FLAG_QUEUE_BYPASS))
				goto next_hook;
			kfree_skb(skb);
		}
	}
	rcu_read_unlock();
	return ret;
}
Contributors
Person Tokens Prop Commits CommitProp
harald welte harald welte 106 58.56% 1 9.09%
florian westphal florian westphal 37 20.44% 5 45.45%
eric paris eric paris 15 8.29% 1 9.09%
michael wang michael wang 9 4.97% 1 9.09%
david s. miller david s. miller 8 4.42% 1 9.09%
herbert xu herbert xu 4 2.21% 1 9.09%
pablo neira ayuso pablo neira ayuso 2 1.10% 1 9.09%
Total 181 100.00% 11 100.00%


EXPORT_SYMBOL(nf_hook_slow);




int skb_make_writable(struct sk_buff *skb, unsigned int writable_len)
{
	if (writable_len > skb->len)
		return 0;

	/* Not exclusive use of packet?  Must copy. */
	if (!skb_cloned(skb)) {
		if (writable_len <= skb_headlen(skb))
			return 1;
	} else if (skb_clone_writable(skb, writable_len))
		return 1;

	if (writable_len <= skb_headlen(skb))
		writable_len = 0;
	else
		writable_len -= skb_headlen(skb);

	return !!__pskb_pull_tail(skb, writable_len);
}
Contributors
Person Tokens Prop Commits CommitProp
harald welte harald welte 47 51.09% 1 33.33%
herbert xu herbert xu 39 42.39% 1 33.33%
patrick mchardy patrick mchardy 6 6.52% 1 33.33%
Total 92 100.00% 3 100.00%


EXPORT_SYMBOL(skb_make_writable);

/* This needs to be compiled in any case to avoid dependencies between the
 * nfnetlink_queue code and nf_conntrack.
 */

struct nfnl_ct_hook __rcu *nfnl_ct_hook __read_mostly;

EXPORT_SYMBOL_GPL(nfnl_ct_hook);

#if IS_ENABLED(CONFIG_NF_CONNTRACK)
/* This does not belong here, but locally generated errors need it if connection
   tracking in use: without this, connection may not be in hash table, and hence
   manufactured ICMP or RST packets will not be associated with it. */
void (*ip_ct_attach)(struct sk_buff *, const struct sk_buff *)
		
__rcu __read_mostly;
EXPORT_SYMBOL
(ip_ct_attach);



void nf_ct_attach(struct sk_buff *new, const struct sk_buff *skb)
{
	void (*attach)(struct sk_buff *, const struct sk_buff *);

	if (skb->nfct) {
		rcu_read_lock();
		attach = rcu_dereference(ip_ct_attach);
		if (attach)
			attach(new, skb);
		rcu_read_unlock();
	}
}
Contributors
Person Tokens Prop Commits CommitProp
harald welte harald welte 47 73.44% 1 33.33%
patrick mchardy patrick mchardy 17 26.56% 2 66.67%
Total 64 100.00% 3 100.00%


EXPORT_SYMBOL(nf_ct_attach);


void (*nf_ct_destroy)(struct nf_conntrack *) __rcu __read_mostly;
EXPORT_SYMBOL
(nf_ct_destroy);



void nf_conntrack_destroy(struct nf_conntrack *nfct)
{
	void (*destroy)(struct nf_conntrack *);

	rcu_read_lock();
	destroy = rcu_dereference(nf_ct_destroy);
	BUG_ON(destroy == NULL);
	destroy(nfct);
	rcu_read_unlock();
}
Contributors
Person Tokens Prop Commits CommitProp
yasuyuki kozakai yasuyuki kozakai 46 100.00% 1 100.00%
Total 46 100.00% 1 100.00%


EXPORT_SYMBOL(nf_conntrack_destroy);

/* Built-in default zone used e.g. by modules. */

const struct nf_conntrack_zone nf_ct_zone_dflt = {
	.id	= NF_CT_DEFAULT_ZONE_ID,
	.dir	= NF_CT_DEFAULT_ZONE_DIR,
};

EXPORT_SYMBOL_GPL(nf_ct_zone_dflt);
#endif /* CONFIG_NF_CONNTRACK */

#ifdef CONFIG_NF_NAT_NEEDED

void (*nf_nat_decode_session_hook)(struct sk_buff *, struct flowi *);

EXPORT_SYMBOL(nf_nat_decode_session_hook);
#endif



static int nf_register_hook_list(struct net *net)
{
	struct nf_hook_ops *elem;
	int ret;

	rtnl_lock();
	list_for_each_entry(elem, &nf_hook_list, list) {
		ret = nf_register_net_hook(net, elem);
		if (ret && ret != -ENOENT)
			goto out_undo;
	}
	rtnl_unlock();
	return 0;

out_undo:
	list_for_each_entry_continue_reverse(elem, &nf_hook_list, list)
		nf_unregister_net_hook(net, elem);
	rtnl_unlock();
	return ret;
}

Contributors
Person Tokens Prop Commits CommitProp
eric w. biederman eric w. biederman 82 100.00% 1 100.00%
Total 82 100.00% 1 100.00%



static void nf_unregister_hook_list(struct net *net)
{
	struct nf_hook_ops *elem;

	rtnl_lock();
	list_for_each_entry(elem, &nf_hook_list, list)
		nf_unregister_net_hook(net, elem);
	rtnl_unlock();
}

Contributors
Person Tokens Prop Commits CommitProp
eric w. biederman eric w. biederman 37 100.00% 1 100.00%
Total 37 100.00% 1 100.00%



static int __net_init netfilter_net_init(struct net *net)
{
	int i, h, ret;

	for (i = 0; i < ARRAY_SIZE(net->nf.hooks); i++) {
		for (h = 0; h < NF_MAX_HOOKS; h++)
			INIT_LIST_HEAD(&net->nf.hooks[i][h]);
	}

#ifdef CONFIG_PROC_FS
	net->nf.proc_netfilter = proc_net_mkdir(net, "netfilter",
						net->proc_net);
	if (!net->nf.proc_netfilter) {
		if (!net_eq(net, &init_net))
			pr_err("cannot create netfilter proc entry");

		return -ENOMEM;
	}
#endif
	ret = nf_register_hook_list(net);
	if (ret)
		remove_proc_entry("netfilter", net->proc_net);

	return ret;
}

Contributors
Person Tokens Prop Commits CommitProp
eric w. biederman eric w. biederman 79 54.11% 1 33.33%
gao feng gao feng 60 41.10% 1 33.33%
pablo neira ayuso pablo neira ayuso 7 4.79% 1 33.33%
Total 146 100.00% 3 100.00%



static void __net_exit netfilter_net_exit(struct net *net)
{
	nf_unregister_hook_list(net);
	remove_proc_entry("netfilter", net->proc_net);
}

Contributors
Person Tokens Prop Commits CommitProp
gao feng gao feng 21 80.77% 1 50.00%
eric w. biederman eric w. biederman 5 19.23% 1 50.00%
Total 26 100.00% 2 100.00%


static struct pernet_operations netfilter_net_ops = {
	.init = netfilter_net_init,
	.exit = netfilter_net_exit,
};



int __init netfilter_init(void)
{
	int ret;

	ret = register_pernet_subsys(&netfilter_net_ops);
	if (ret < 0)
		goto err;

	ret = netfilter_log_init();
	if (ret < 0)
		goto err_pernet;

	return 0;
err_pernet:
	unregister_pernet_subsys(&netfilter_net_ops);
err:
	return ret;
}
Contributors
Person Tokens Prop Commits CommitProp
pablo neira ayuso pablo neira ayuso 32 55.17% 1 33.33%
harald welte harald welte 19 32.76% 1 33.33%
gao feng gao feng 7 12.07% 1 33.33%
Total 58 100.00% 3 100.00%

Overall Contributors
Person Tokens Prop Commits CommitProp
eric w. biederman eric w. biederman 743 34.78% 7 11.29%
harald welte harald welte 469 21.96% 1 1.61%
patrick mchardy patrick mchardy 278 13.01% 12 19.35%
pablo neira ayuso pablo neira ayuso 179 8.38% 9 14.52%
gao feng gao feng 105 4.92% 1 1.61%
yasuyuki kozakai yasuyuki kozakai 70 3.28% 2 3.23%
florian westphal florian westphal 69 3.23% 9 14.52%
eric dumazet eric dumazet 53 2.48% 2 3.23%
herbert xu herbert xu 43 2.01% 2 3.23%
michael wang michael wang 33 1.54% 2 3.23%
daniel borkmann daniel borkmann 23 1.08% 1 1.61%
david s. miller david s. miller 16 0.75% 1 1.61%
eric paris eric paris 15 0.70% 1 1.61%
zhouyi zhou zhouyi zhou 9 0.42% 1 1.61%
li zefan li zefan 8 0.37% 1 1.61%
changli gao changli gao 7 0.33% 1 1.61%
tejun heo tejun heo 3 0.14% 1 1.61%
ingo molnar ingo molnar 3 0.14% 1 1.61%
ken-ichirou matsuzawa ken-ichirou matsuzawa 3 0.14% 1 1.61%
stephen hemminger stephen hemminger 2 0.09% 1 1.61%
martin josefsson martin josefsson 1 0.05% 1 1.61%
hideaki yoshifuji hideaki yoshifuji 1 0.05% 1 1.61%
jan engelhardt jan engelhardt 1 0.05% 1 1.61%
arnd bergmann arnd bergmann 1 0.05% 1 1.61%
igor maravic igor maravic 1 0.05% 1 1.61%
Total 2136 100.00% 62 100.00%
  Directory: net/netfilter

Information contained on this website is for historical information purposes only and does not indicate or represent copyright ownership.
	Person	Tokens	Prop	Commits	CommitProp
patrick mchardy	patrick mchardy	36	94.74%	3	60.00%
pablo neira ayuso	pablo neira ayuso	1	2.63%	1	20.00%
stephen hemminger	stephen hemminger	1	2.63%	1	20.00%
	Total	38	100.00%	5	100.00%
cregit-Linux how code gets into the kernel

Release 4.8 net/netfilter/core.c

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Contributors

Overall Contributors
