cregit-Linux how code gets into the kernel

Release 4.9 net/netfilter/core.c

Directory: net/netfilter
/* netfilter.c: look after the filters for various protocols.
 * Heavily influenced by the old firewall.c by David Bonn and Alan Cox.
 *
 * Thanks to Rob `CmdrTaco' Malda for not influencing this code in any
 * way.
 *
 * Rusty Russell (C)2000 -- This code is GPL.
 * Patrick McHardy (c) 2006-2012
 */
#include <linux/kernel.h>
#include <linux/netfilter.h>
#include <net/protocol.h>
#include <linux/init.h>
#include <linux/skbuff.h>
#include <linux/wait.h>
#include <linux/module.h>
#include <linux/interrupt.h>
#include <linux/if.h>
#include <linux/netdevice.h>
#include <linux/netfilter_ipv6.h>
#include <linux/inetdevice.h>
#include <linux/proc_fs.h>
#include <linux/mutex.h>
#include <linux/slab.h>
#include <linux/rcupdate.h>
#include <net/net_namespace.h>
#include <net/sock.h>

#include "nf_internals.h"

static DEFINE_MUTEX(afinfo_mutex);


const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO] __read_mostly;

EXPORT_SYMBOL(nf_afinfo);

const struct nf_ipv6_ops __rcu *nf_ipv6_ops __read_mostly;

EXPORT_SYMBOL_GPL(nf_ipv6_ops);

DEFINE_PER_CPU(bool, nf_skb_duplicated);

EXPORT_SYMBOL_GPL(nf_skb_duplicated);


int nf_register_afinfo(const struct nf_afinfo *afinfo) { mutex_lock(&afinfo_mutex); RCU_INIT_POINTER(nf_afinfo[afinfo->family], afinfo); mutex_unlock(&afinfo_mutex); return 0; }

Contributors

PersonTokensPropCommitsCommitProp
patrick mchardypatrick mchardy3694.74%360.00%
pablo neira ayusopablo neira ayuso12.63%120.00%
stephen hemmingerstephen hemminger12.63%120.00%
Total38100.00%5100.00%

EXPORT_SYMBOL_GPL(nf_register_afinfo);
void nf_unregister_afinfo(const struct nf_afinfo *afinfo) { mutex_lock(&afinfo_mutex); RCU_INIT_POINTER(nf_afinfo[afinfo->family], NULL); mutex_unlock(&afinfo_mutex); synchronize_rcu(); }

Contributors

PersonTokensPropCommitsCommitProp
patrick mchardypatrick mchardy3797.37%375.00%
stephen hemmingerstephen hemminger12.63%125.00%
Total38100.00%4100.00%

EXPORT_SYMBOL_GPL(nf_unregister_afinfo); #ifdef HAVE_JUMP_LABEL struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS]; EXPORT_SYMBOL(nf_hooks_needed); #endif static DEFINE_MUTEX(nf_hook_mutex); #define nf_entry_dereference(e) \ rcu_dereference_protected(e, lockdep_is_held(&nf_hook_mutex))
static struct nf_hook_entry __rcu **nf_hook_entry_head(struct net *net, const struct nf_hook_ops *reg) { if (reg->pf != NFPROTO_NETDEV) return net->nf.hooks[reg->pf]+reg->hooknum; #ifdef CONFIG_NETFILTER_INGRESS if (reg->hooknum == NF_NETDEV_INGRESS) { if (reg->dev && dev_net(reg->dev) == net) return &reg->dev->nf_hooks_ingress; } #endif return NULL; }

Contributors

PersonTokensPropCommitsCommitProp
eric w. biedermaneric w. biederman3945.35%225.00%
pablo neira ayusopablo neira ayuso2326.74%225.00%
linus torvaldslinus torvalds1315.12%112.50%
harald welteharald welte78.14%112.50%
aaron conoleaaron conole44.65%225.00%
Total86100.00%8100.00%


int nf_register_net_hook(struct net *net, const struct nf_hook_ops *reg) { struct nf_hook_entry __rcu **pp; struct nf_hook_entry *entry, *p; if (reg->pf == NFPROTO_NETDEV) { #ifndef CONFIG_NETFILTER_INGRESS if (reg->hooknum == NF_NETDEV_INGRESS) return -EOPNOTSUPP; #endif if (reg->hooknum != NF_NETDEV_INGRESS || !reg->dev || dev_net(reg->dev) != net) return -EINVAL; } pp = nf_hook_entry_head(net, reg); if (!pp) return -EINVAL; entry = kmalloc(sizeof(*entry), GFP_KERNEL); if (!entry) return -ENOMEM; entry->orig_ops = reg; entry->ops = *reg; entry->next = NULL; mutex_lock(&nf_hook_mutex); /* Find the spot in the list */ while ((p = nf_entry_dereference(*pp)) != NULL) { if (reg->priority < p->orig_ops->priority) break; pp = &p->next; } rcu_assign_pointer(entry->next, p); rcu_assign_pointer(*pp, entry); mutex_unlock(&nf_hook_mutex); #ifdef CONFIG_NETFILTER_INGRESS if (reg->pf == NFPROTO_NETDEV && reg->hooknum == NF_NETDEV_INGRESS) net_inc_ingress_queue(); #endif #ifdef HAVE_JUMP_LABEL static_key_slow_inc(&nf_hooks_needed[reg->pf][reg->hooknum]); #endif return 0; }

Contributors

PersonTokensPropCommitsCommitProp
aaron conoleaaron conole8332.55%320.00%
eric w. biedermaneric w. biederman7127.84%426.67%
linus torvaldslinus torvalds4718.43%16.67%
eric dumazeteric dumazet176.67%16.67%
harald welteharald welte176.67%16.67%
pablo neira ayusopablo neira ayuso145.49%213.33%
zhouyi zhouzhouyi zhou31.18%16.67%
patrick mchardypatrick mchardy20.78%16.67%
ingo molnaringo molnar10.39%16.67%
Total255100.00%15100.00%

EXPORT_SYMBOL(nf_register_net_hook);
void nf_unregister_net_hook(struct net *net, const struct nf_hook_ops *reg) { struct nf_hook_entry __rcu **pp; struct nf_hook_entry *p; pp = nf_hook_entry_head(net, reg); if (WARN_ON_ONCE(!pp)) return; mutex_lock(&nf_hook_mutex); while ((p = nf_entry_dereference(*pp)) != NULL) { if (p->orig_ops == reg) { rcu_assign_pointer(*pp, p->next); break; } pp = &p->next; } mutex_unlock(&nf_hook_mutex); if (!p) { WARN(1, "nf_unregister_net_hook: hook not found!\n"); return; } #ifdef CONFIG_NETFILTER_INGRESS if (reg->pf == NFPROTO_NETDEV && reg->hooknum == NF_NETDEV_INGRESS) net_dec_ingress_queue(); #endif #ifdef HAVE_JUMP_LABEL static_key_slow_dec(&nf_hooks_needed[reg->pf][reg->hooknum]); #endif synchronize_net(); nf_queue_nf_hook_drop(net, p); /* other cpu might still process nfqueue verdict that used reg */ synchronize_net(); kfree(p); }

Contributors

PersonTokensPropCommitsCommitProp
eric w. biedermaneric w. biederman7441.34%215.38%
linus torvaldslinus torvalds4122.91%17.69%
pablo neira ayusopablo neira ayuso2111.73%323.08%
harald welteharald welte179.50%17.69%
aaron conoleaaron conole147.82%17.69%
florian westphalflorian westphal42.23%17.69%
zhouyi zhouzhouyi zhou31.68%17.69%
eric dumazeteric dumazet21.12%17.69%
patrick mchardypatrick mchardy21.12%17.69%
ingo molnaringo molnar10.56%17.69%
Total179100.00%13100.00%

EXPORT_SYMBOL(nf_unregister_net_hook);
int nf_register_net_hooks(struct net *net, const struct nf_hook_ops *reg, unsigned int n) { unsigned int i; int err = 0; for (i = 0; i < n; i++) { err = nf_register_net_hook(net, &reg[i]); if (err) goto err; } return err; err: if (i > 0) nf_unregister_net_hooks(net, reg, i); return err; }

Contributors

PersonTokensPropCommitsCommitProp
eric w. biedermaneric w. biederman87100.00%1100.00%
Total87100.00%1100.00%

EXPORT_SYMBOL(nf_register_net_hooks);
void nf_unregister_net_hooks(struct net *net, const struct nf_hook_ops *reg, unsigned int n) { while (n-- > 0) nf_unregister_net_hook(net, &reg[n]); }

Contributors

PersonTokensPropCommitsCommitProp
eric w. biedermaneric w. biederman38100.00%1100.00%
Total38100.00%1100.00%

EXPORT_SYMBOL(nf_unregister_net_hooks); static LIST_HEAD(nf_hook_list);
static int _nf_register_hook(struct nf_hook_ops *reg) { struct net *net, *last; int ret; for_each_net(net) { ret = nf_register_net_hook(net, reg); if (ret && ret != -ENOENT) goto rollback; } list_add_tail(&reg->list, &nf_hook_list); return 0; rollback: last = net; for_each_net(net) { if (net == last) break; nf_unregister_net_hook(net, reg); } return ret; }

Contributors

PersonTokensPropCommitsCommitProp
eric w. biedermaneric w. biederman8693.48%150.00%
mahesh bandewarmahesh bandewar66.52%150.00%
Total92100.00%2100.00%


int nf_register_hook(struct nf_hook_ops *reg) { int ret; rtnl_lock(); ret = _nf_register_hook(reg); rtnl_unlock(); return ret; }

Contributors

PersonTokensPropCommitsCommitProp
mahesh bandewarmahesh bandewar2275.86%150.00%
eric w. biedermaneric w. biederman724.14%150.00%
Total29100.00%2100.00%

EXPORT_SYMBOL(nf_register_hook);
static void _nf_unregister_hook(struct nf_hook_ops *reg) { struct net *net; list_del(&reg->list); for_each_net(net) nf_unregister_net_hook(net, reg); }

Contributors

PersonTokensPropCommitsCommitProp
eric w. biedermaneric w. biederman2880.00%250.00%
eric dumazeteric dumazet411.43%125.00%
mahesh bandewarmahesh bandewar38.57%125.00%
Total35100.00%4100.00%


void nf_unregister_hook(struct nf_hook_ops *reg) { rtnl_lock(); _nf_unregister_hook(reg); rtnl_unlock(); }

Contributors

PersonTokensPropCommitsCommitProp
mahesh bandewarmahesh bandewar1780.95%133.33%
eric w. biedermaneric w. biederman314.29%133.33%
harald welteharald welte14.76%133.33%
Total21100.00%3100.00%

EXPORT_SYMBOL(nf_unregister_hook);
int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n) { unsigned int i; int err = 0; for (i = 0; i < n; i++) { err = nf_register_hook(&reg[i]); if (err) goto err; } return err; err: if (i > 0) nf_unregister_hooks(reg, i); return err; }

Contributors

PersonTokensPropCommitsCommitProp
patrick mchardypatrick mchardy77100.00%1100.00%
Total77100.00%1100.00%

EXPORT_SYMBOL(nf_register_hooks); /* Caller MUST take rtnl_lock() */
int _nf_register_hooks(struct nf_hook_ops *reg, unsigned int n) { unsigned int i; int err = 0; for (i = 0; i < n; i++) { err = _nf_register_hook(&reg[i]); if (err) goto err; } return err; err: if (i > 0) _nf_unregister_hooks(reg, i); return err; }

Contributors

PersonTokensPropCommitsCommitProp
mahesh bandewarmahesh bandewar77100.00%1100.00%
Total77100.00%1100.00%

EXPORT_SYMBOL(_nf_register_hooks);
void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n) { while (n-- > 0) nf_unregister_hook(&reg[n]); }

Contributors

PersonTokensPropCommitsCommitProp
patrick mchardypatrick mchardy2376.67%150.00%
changli gaochangli gao723.33%150.00%
Total30100.00%2100.00%

EXPORT_SYMBOL(nf_unregister_hooks); /* Caller MUST take rtnl_lock */
void _nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n) { while (n-- > 0) _nf_unregister_hook(&reg[n]); }

Contributors

PersonTokensPropCommitsCommitProp
mahesh bandewarmahesh bandewar30100.00%1100.00%
Total30100.00%1100.00%

EXPORT_SYMBOL(_nf_unregister_hooks);
unsigned int nf_iterate(struct sk_buff *skb, struct nf_hook_state *state, struct nf_hook_entry **entryp) { unsigned int verdict; /* * The caller must not block between calls to this * function because of risk of continuing from deleted element. */ while (*entryp) { if (state->thresh > (*entryp)->ops.priority) { *entryp = rcu_dereference((*entryp)->next); continue; } /* Optimization: we don't need to hold module reference here, since function can't sleep. --RR */ repeat: verdict = (*entryp)->ops.hook((*entryp)->ops.priv, skb, state); if (verdict != NF_ACCEPT) { #ifdef CONFIG_NETFILTER_DEBUG if (unlikely((verdict & NF_VERDICT_MASK) > NF_MAX_VERDICT)) { NFDEBUG("Evil return from %p(%u).\n", (*entryp)->ops.hook, state->hook); *entryp = rcu_dereference((*entryp)->next); continue; } #endif if (verdict != NF_REPEAT) return verdict; goto repeat; } *entryp = rcu_dereference((*entryp)->next); } return NF_ACCEPT; }

Contributors

PersonTokensPropCommitsCommitProp
harald welteharald welte9150.28%111.11%
aaron conoleaaron conole6033.15%111.11%
michael wangmichael wang116.08%222.22%
david s. millerdavid s. miller84.42%111.11%
patrick mchardypatrick mchardy63.31%222.22%
eric w. biedermaneric w. biederman42.21%111.11%
hideaki yoshifujihideaki yoshifuji10.55%111.11%
Total181100.00%9100.00%

/* Returns 1 if okfn() needs to be executed by the caller, * -EPERM for NF_DROP, 0 otherwise. Caller must hold rcu_read_lock. */
int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state) { struct nf_hook_entry *entry; unsigned int verdict; int ret = 0; entry = rcu_dereference(state->hook_entries); next_hook: verdict = nf_iterate(skb, state, &entry); if (verdict == NF_ACCEPT || verdict == NF_STOP) { ret = 1; } else if ((verdict & NF_VERDICT_MASK) == NF_DROP) { kfree_skb(skb); ret = NF_DROP_GETERR(verdict); if (ret == 0) ret = -EPERM; } else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) { ret = nf_queue(skb, state, &entry, verdict); if (ret == 1 && entry) goto next_hook; } return ret; }

Contributors

PersonTokensPropCommitsCommitProp
harald welteharald welte9263.45%110.00%
eric pariseric paris1510.34%110.00%
florian westphalflorian westphal117.59%330.00%
aaron conoleaaron conole85.52%110.00%
pablo neira ayusopablo neira ayuso74.83%110.00%
david s. millerdavid s. miller64.14%110.00%
herbert xuherbert xu42.76%110.00%
michael wangmichael wang21.38%110.00%
Total145100.00%10100.00%

EXPORT_SYMBOL(nf_hook_slow);
int skb_make_writable(struct sk_buff *skb, unsigned int writable_len) { if (writable_len > skb->len) return 0; /* Not exclusive use of packet? Must copy. */ if (!skb_cloned(skb)) { if (writable_len <= skb_headlen(skb)) return 1; } else if (skb_clone_writable(skb, writable_len)) return 1; if (writable_len <= skb_headlen(skb)) writable_len = 0; else writable_len -= skb_headlen(skb); return !!__pskb_pull_tail(skb, writable_len); }

Contributors

PersonTokensPropCommitsCommitProp
harald welteharald welte4751.09%133.33%
herbert xuherbert xu3942.39%133.33%
patrick mchardypatrick mchardy66.52%133.33%
Total92100.00%3100.00%

EXPORT_SYMBOL(skb_make_writable); /* This needs to be compiled in any case to avoid dependencies between the * nfnetlink_queue code and nf_conntrack. */ struct nfnl_ct_hook __rcu *nfnl_ct_hook __read_mostly; EXPORT_SYMBOL_GPL(nfnl_ct_hook); #if IS_ENABLED(CONFIG_NF_CONNTRACK) /* This does not belong here, but locally generated errors need it if connection tracking in use: without this, connection may not be in hash table, and hence manufactured ICMP or RST packets will not be associated with it. */ void (*ip_ct_attach)(struct sk_buff *, const struct sk_buff *) __rcu __read_mostly; EXPORT_SYMBOL (ip_ct_attach);
void nf_ct_attach(struct sk_buff *new, const struct sk_buff *skb) { void (*attach)(struct sk_buff *, const struct sk_buff *); if (skb->nfct) { rcu_read_lock(); attach = rcu_dereference(ip_ct_attach); if (attach) attach(new, skb); rcu_read_unlock(); } }

Contributors

PersonTokensPropCommitsCommitProp
harald welteharald welte4773.44%133.33%
patrick mchardypatrick mchardy1726.56%266.67%
Total64100.00%3100.00%

EXPORT_SYMBOL(nf_ct_attach); void (*nf_ct_destroy)(struct nf_conntrack *) __rcu __read_mostly; EXPORT_SYMBOL (nf_ct_destroy);
void nf_conntrack_destroy(struct nf_conntrack *nfct) { void (*destroy)(struct nf_conntrack *); rcu_read_lock(); destroy = rcu_dereference(nf_ct_destroy); BUG_ON(destroy == NULL); destroy(nfct); rcu_read_unlock(); }

Contributors

PersonTokensPropCommitsCommitProp
yasuyuki kozakaiyasuyuki kozakai46100.00%1100.00%
Total46100.00%1100.00%

EXPORT_SYMBOL(nf_conntrack_destroy); /* Built-in default zone used e.g. by modules. */ const struct nf_conntrack_zone nf_ct_zone_dflt = { .id = NF_CT_DEFAULT_ZONE_ID, .dir = NF_CT_DEFAULT_ZONE_DIR, }; EXPORT_SYMBOL_GPL(nf_ct_zone_dflt); #endif /* CONFIG_NF_CONNTRACK */ #ifdef CONFIG_NF_NAT_NEEDED void (*nf_nat_decode_session_hook)(struct sk_buff *, struct flowi *); EXPORT_SYMBOL(nf_nat_decode_session_hook); #endif
static int nf_register_hook_list(struct net *net) { struct nf_hook_ops *elem; int ret; rtnl_lock(); list_for_each_entry(elem, &nf_hook_list, list) { ret = nf_register_net_hook(net, elem); if (ret && ret != -ENOENT) goto out_undo; } rtnl_unlock(); return 0; out_undo: list_for_each_entry_continue_reverse(elem, &nf_hook_list, list) nf_unregister_net_hook(net, elem); rtnl_unlock(); return ret; }

Contributors

PersonTokensPropCommitsCommitProp
eric w. biedermaneric w. biederman82100.00%1100.00%
Total82100.00%1100.00%


static void nf_unregister_hook_list(struct net *net) { struct nf_hook_ops *elem; rtnl_lock(); list_for_each_entry(elem, &nf_hook_list, list) nf_unregister_net_hook(net, elem); rtnl_unlock(); }

Contributors

PersonTokensPropCommitsCommitProp
eric w. biedermaneric w. biederman37100.00%1100.00%
Total37100.00%1100.00%


static int __net_init netfilter_net_init(struct net *net) { int i, h, ret; for (i = 0; i < ARRAY_SIZE(net->nf.hooks); i++) { for (h = 0; h < NF_MAX_HOOKS; h++) RCU_INIT_POINTER(net->nf.hooks[i][h], NULL); } #ifdef CONFIG_PROC_FS net->nf.proc_netfilter = proc_net_mkdir(net, "netfilter", net->proc_net); if (!net->nf.proc_netfilter) { if (!net_eq(net, &init_net)) pr_err("cannot create netfilter proc entry"); return -ENOMEM; } #endif ret = nf_register_hook_list(net); if (ret) remove_proc_entry("netfilter", net->proc_net); return ret; }

Contributors

PersonTokensPropCommitsCommitProp
eric w. biedermaneric w. biederman7752.38%125.00%
gao fenggao feng6040.82%125.00%
pablo neira ayusopablo neira ayuso74.76%125.00%
aaron conoleaaron conole32.04%125.00%
Total147100.00%4100.00%


static void __net_exit netfilter_net_exit(struct net *net) { nf_unregister_hook_list(net); remove_proc_entry("netfilter", net->proc_net); }

Contributors

PersonTokensPropCommitsCommitProp
gao fenggao feng2180.77%150.00%
eric w. biedermaneric w. biederman519.23%150.00%
Total26100.00%2100.00%

static struct pernet_operations netfilter_net_ops = { .init = netfilter_net_init, .exit = netfilter_net_exit, };
int __init netfilter_init(void) { int ret; ret = register_pernet_subsys(&netfilter_net_ops); if (ret < 0) goto err; ret = netfilter_log_init(); if (ret < 0) goto err_pernet; return 0; err_pernet: unregister_pernet_subsys(&netfilter_net_ops); err: return ret; }

Contributors

PersonTokensPropCommitsCommitProp
pablo neira ayusopablo neira ayuso3255.17%133.33%
harald welteharald welte1932.76%133.33%
gao fenggao feng712.07%133.33%
Total58100.00%3100.00%


Overall Contributors

PersonTokensPropCommitsCommitProp
eric w. biedermaneric w. biederman66828.46%710.94%
harald welteharald welte42618.15%11.56%
patrick mchardypatrick mchardy27511.72%1218.75%
aaron conoleaaron conole1847.84%46.25%
mahesh bandewarmahesh bandewar1677.12%11.56%
pablo neira ayusopablo neira ayuso1154.90%812.50%
gao fenggao feng1054.47%11.56%
linus torvaldslinus torvalds1014.30%11.56%
yasuyuki kozakaiyasuyuki kozakai702.98%23.12%
eric dumazeteric dumazet532.26%23.12%
florian westphalflorian westphal431.83%710.94%
herbert xuherbert xu431.83%23.12%
daniel borkmanndaniel borkmann230.98%11.56%
eric pariseric paris150.64%11.56%
david s. millerdavid s. miller140.60%11.56%
michael wangmichael wang130.55%23.12%
zhouyi zhouzhouyi zhou90.38%11.56%
changli gaochangli gao70.30%11.56%
tejun heotejun heo30.13%11.56%
ingo molnaringo molnar30.13%11.56%
ken-ichirou matsuzawaken-ichirou matsuzawa30.13%11.56%
stephen hemmingerstephen hemminger20.09%11.56%
martin josefssonmartin josefsson10.04%11.56%
hideaki yoshifujihideaki yoshifuji10.04%11.56%
jan engelhardtjan engelhardt10.04%11.56%
arnd bergmannarnd bergmann10.04%11.56%
igor maravicigor maravic10.04%11.56%
Total2347100.00%64100.00%
Directory: net/netfilter