Version:  2.0.40 2.2.26 2.4.37 3.13 3.14 3.15 3.16 3.17 3.18 3.19 4.0 4.1 4.2 4.3 4.4 4.5 4.6 4.7 4.8 4.9 4.10

Linux/net/netfilter/core.c

  1 /* netfilter.c: look after the filters for various protocols.
  2  * Heavily influenced by the old firewall.c by David Bonn and Alan Cox.
  3  *
  4  * Thanks to Rob `CmdrTaco' Malda for not influencing this code in any
  5  * way.
  6  *
  7  * Rusty Russell (C)2000 -- This code is GPL.
  8  * Patrick McHardy (c) 2006-2012
  9  */
 10 #include <linux/kernel.h>
 11 #include <linux/netfilter.h>
 12 #include <net/protocol.h>
 13 #include <linux/init.h>
 14 #include <linux/skbuff.h>
 15 #include <linux/wait.h>
 16 #include <linux/module.h>
 17 #include <linux/interrupt.h>
 18 #include <linux/if.h>
 19 #include <linux/netdevice.h>
 20 #include <linux/netfilter_ipv6.h>
 21 #include <linux/inetdevice.h>
 22 #include <linux/proc_fs.h>
 23 #include <linux/mutex.h>
 24 #include <linux/slab.h>
 25 #include <linux/rcupdate.h>
 26 #include <net/net_namespace.h>
 27 #include <net/sock.h>
 28 
 29 #include "nf_internals.h"
 30 
 31 static DEFINE_MUTEX(afinfo_mutex);
 32 
 33 const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO] __read_mostly;
 34 EXPORT_SYMBOL(nf_afinfo);
 35 const struct nf_ipv6_ops __rcu *nf_ipv6_ops __read_mostly;
 36 EXPORT_SYMBOL_GPL(nf_ipv6_ops);
 37 
 38 DEFINE_PER_CPU(bool, nf_skb_duplicated);
 39 EXPORT_SYMBOL_GPL(nf_skb_duplicated);
 40 
 41 int nf_register_afinfo(const struct nf_afinfo *afinfo)
 42 {
 43         mutex_lock(&afinfo_mutex);
 44         RCU_INIT_POINTER(nf_afinfo[afinfo->family], afinfo);
 45         mutex_unlock(&afinfo_mutex);
 46         return 0;
 47 }
 48 EXPORT_SYMBOL_GPL(nf_register_afinfo);
 49 
 50 void nf_unregister_afinfo(const struct nf_afinfo *afinfo)
 51 {
 52         mutex_lock(&afinfo_mutex);
 53         RCU_INIT_POINTER(nf_afinfo[afinfo->family], NULL);
 54         mutex_unlock(&afinfo_mutex);
 55         synchronize_rcu();
 56 }
 57 EXPORT_SYMBOL_GPL(nf_unregister_afinfo);
 58 
 59 #ifdef HAVE_JUMP_LABEL
 60 struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
 61 EXPORT_SYMBOL(nf_hooks_needed);
 62 #endif
 63 
 64 static DEFINE_MUTEX(nf_hook_mutex);
 65 #define nf_entry_dereference(e) \
 66         rcu_dereference_protected(e, lockdep_is_held(&nf_hook_mutex))
 67 
 68 static struct nf_hook_entry __rcu **nf_hook_entry_head(struct net *net, const struct nf_hook_ops *reg)
 69 {
 70         if (reg->pf != NFPROTO_NETDEV)
 71                 return net->nf.hooks[reg->pf]+reg->hooknum;
 72 
 73 #ifdef CONFIG_NETFILTER_INGRESS
 74         if (reg->hooknum == NF_NETDEV_INGRESS) {
 75                 if (reg->dev && dev_net(reg->dev) == net)
 76                         return &reg->dev->nf_hooks_ingress;
 77         }
 78 #endif
 79         return NULL;
 80 }
 81 
 82 int nf_register_net_hook(struct net *net, const struct nf_hook_ops *reg)
 83 {
 84         struct nf_hook_entry __rcu **pp;
 85         struct nf_hook_entry *entry, *p;
 86 
 87         if (reg->pf == NFPROTO_NETDEV) {
 88 #ifndef CONFIG_NETFILTER_INGRESS
 89                 if (reg->hooknum == NF_NETDEV_INGRESS)
 90                         return -EOPNOTSUPP;
 91 #endif
 92                 if (reg->hooknum != NF_NETDEV_INGRESS ||
 93                     !reg->dev || dev_net(reg->dev) != net)
 94                         return -EINVAL;
 95         }
 96 
 97         pp = nf_hook_entry_head(net, reg);
 98         if (!pp)
 99                 return -EINVAL;
100 
101         entry = kmalloc(sizeof(*entry), GFP_KERNEL);
102         if (!entry)
103                 return -ENOMEM;
104 
105         nf_hook_entry_init(entry, reg);
106 
107         mutex_lock(&nf_hook_mutex);
108 
109         /* Find the spot in the list */
110         for (; (p = nf_entry_dereference(*pp)) != NULL; pp = &p->next) {
111                 if (reg->priority < nf_hook_entry_priority(p))
112                         break;
113         }
114         rcu_assign_pointer(entry->next, p);
115         rcu_assign_pointer(*pp, entry);
116 
117         mutex_unlock(&nf_hook_mutex);
118 #ifdef CONFIG_NETFILTER_INGRESS
119         if (reg->pf == NFPROTO_NETDEV && reg->hooknum == NF_NETDEV_INGRESS)
120                 net_inc_ingress_queue();
121 #endif
122 #ifdef HAVE_JUMP_LABEL
123         static_key_slow_inc(&nf_hooks_needed[reg->pf][reg->hooknum]);
124 #endif
125         return 0;
126 }
127 EXPORT_SYMBOL(nf_register_net_hook);
128 
129 void nf_unregister_net_hook(struct net *net, const struct nf_hook_ops *reg)
130 {
131         struct nf_hook_entry __rcu **pp;
132         struct nf_hook_entry *p;
133 
134         pp = nf_hook_entry_head(net, reg);
135         if (WARN_ON_ONCE(!pp))
136                 return;
137 
138         mutex_lock(&nf_hook_mutex);
139         for (; (p = nf_entry_dereference(*pp)) != NULL; pp = &p->next) {
140                 if (nf_hook_entry_ops(p) == reg) {
141                         rcu_assign_pointer(*pp, p->next);
142                         break;
143                 }
144         }
145         mutex_unlock(&nf_hook_mutex);
146         if (!p) {
147                 WARN(1, "nf_unregister_net_hook: hook not found!\n");
148                 return;
149         }
150 #ifdef CONFIG_NETFILTER_INGRESS
151         if (reg->pf == NFPROTO_NETDEV && reg->hooknum == NF_NETDEV_INGRESS)
152                 net_dec_ingress_queue();
153 #endif
154 #ifdef HAVE_JUMP_LABEL
155         static_key_slow_dec(&nf_hooks_needed[reg->pf][reg->hooknum]);
156 #endif
157         synchronize_net();
158         nf_queue_nf_hook_drop(net, p);
159         /* other cpu might still process nfqueue verdict that used reg */
160         synchronize_net();
161         kfree(p);
162 }
163 EXPORT_SYMBOL(nf_unregister_net_hook);
164 
165 int nf_register_net_hooks(struct net *net, const struct nf_hook_ops *reg,
166                           unsigned int n)
167 {
168         unsigned int i;
169         int err = 0;
170 
171         for (i = 0; i < n; i++) {
172                 err = nf_register_net_hook(net, &reg[i]);
173                 if (err)
174                         goto err;
175         }
176         return err;
177 
178 err:
179         if (i > 0)
180                 nf_unregister_net_hooks(net, reg, i);
181         return err;
182 }
183 EXPORT_SYMBOL(nf_register_net_hooks);
184 
185 void nf_unregister_net_hooks(struct net *net, const struct nf_hook_ops *reg,
186                              unsigned int n)
187 {
188         while (n-- > 0)
189                 nf_unregister_net_hook(net, &reg[n]);
190 }
191 EXPORT_SYMBOL(nf_unregister_net_hooks);
192 
193 static LIST_HEAD(nf_hook_list);
194 
195 static int _nf_register_hook(struct nf_hook_ops *reg)
196 {
197         struct net *net, *last;
198         int ret;
199 
200         for_each_net(net) {
201                 ret = nf_register_net_hook(net, reg);
202                 if (ret && ret != -ENOENT)
203                         goto rollback;
204         }
205         list_add_tail(&reg->list, &nf_hook_list);
206 
207         return 0;
208 rollback:
209         last = net;
210         for_each_net(net) {
211                 if (net == last)
212                         break;
213                 nf_unregister_net_hook(net, reg);
214         }
215         return ret;
216 }
217 
218 int nf_register_hook(struct nf_hook_ops *reg)
219 {
220         int ret;
221 
222         rtnl_lock();
223         ret = _nf_register_hook(reg);
224         rtnl_unlock();
225 
226         return ret;
227 }
228 EXPORT_SYMBOL(nf_register_hook);
229 
230 static void _nf_unregister_hook(struct nf_hook_ops *reg)
231 {
232         struct net *net;
233 
234         list_del(&reg->list);
235         for_each_net(net)
236                 nf_unregister_net_hook(net, reg);
237 }
238 
239 void nf_unregister_hook(struct nf_hook_ops *reg)
240 {
241         rtnl_lock();
242         _nf_unregister_hook(reg);
243         rtnl_unlock();
244 }
245 EXPORT_SYMBOL(nf_unregister_hook);
246 
247 int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n)
248 {
249         unsigned int i;
250         int err = 0;
251 
252         for (i = 0; i < n; i++) {
253                 err = nf_register_hook(&reg[i]);
254                 if (err)
255                         goto err;
256         }
257         return err;
258 
259 err:
260         if (i > 0)
261                 nf_unregister_hooks(reg, i);
262         return err;
263 }
264 EXPORT_SYMBOL(nf_register_hooks);
265 
266 /* Caller MUST take rtnl_lock() */
267 int _nf_register_hooks(struct nf_hook_ops *reg, unsigned int n)
268 {
269         unsigned int i;
270         int err = 0;
271 
272         for (i = 0; i < n; i++) {
273                 err = _nf_register_hook(&reg[i]);
274                 if (err)
275                         goto err;
276         }
277         return err;
278 
279 err:
280         if (i > 0)
281                 _nf_unregister_hooks(reg, i);
282         return err;
283 }
284 EXPORT_SYMBOL(_nf_register_hooks);
285 
286 void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n)
287 {
288         while (n-- > 0)
289                 nf_unregister_hook(&reg[n]);
290 }
291 EXPORT_SYMBOL(nf_unregister_hooks);
292 
293 /* Caller MUST take rtnl_lock */
294 void _nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n)
295 {
296         while (n-- > 0)
297                 _nf_unregister_hook(&reg[n]);
298 }
299 EXPORT_SYMBOL(_nf_unregister_hooks);
300 
301 /* Returns 1 if okfn() needs to be executed by the caller,
302  * -EPERM for NF_DROP, 0 otherwise.  Caller must hold rcu_read_lock. */
303 int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state,
304                  struct nf_hook_entry *entry)
305 {
306         unsigned int verdict;
307         int ret;
308 
309         do {
310                 verdict = nf_hook_entry_hookfn(entry, skb, state);
311                 switch (verdict & NF_VERDICT_MASK) {
312                 case NF_ACCEPT:
313                         entry = rcu_dereference(entry->next);
314                         break;
315                 case NF_DROP:
316                         kfree_skb(skb);
317                         ret = NF_DROP_GETERR(verdict);
318                         if (ret == 0)
319                                 ret = -EPERM;
320                         return ret;
321                 case NF_QUEUE:
322                         ret = nf_queue(skb, state, &entry, verdict);
323                         if (ret == 1 && entry)
324                                 continue;
325                         return ret;
326                 default:
327                         /* Implicit handling for NF_STOLEN, as well as any other
328                          * non conventional verdicts.
329                          */
330                         return 0;
331                 }
332         } while (entry);
333 
334         return 1;
335 }
336 EXPORT_SYMBOL(nf_hook_slow);
337 
338 
339 int skb_make_writable(struct sk_buff *skb, unsigned int writable_len)
340 {
341         if (writable_len > skb->len)
342                 return 0;
343 
344         /* Not exclusive use of packet?  Must copy. */
345         if (!skb_cloned(skb)) {
346                 if (writable_len <= skb_headlen(skb))
347                         return 1;
348         } else if (skb_clone_writable(skb, writable_len))
349                 return 1;
350 
351         if (writable_len <= skb_headlen(skb))
352                 writable_len = 0;
353         else
354                 writable_len -= skb_headlen(skb);
355 
356         return !!__pskb_pull_tail(skb, writable_len);
357 }
358 EXPORT_SYMBOL(skb_make_writable);
359 
360 /* This needs to be compiled in any case to avoid dependencies between the
361  * nfnetlink_queue code and nf_conntrack.
362  */
363 struct nfnl_ct_hook __rcu *nfnl_ct_hook __read_mostly;
364 EXPORT_SYMBOL_GPL(nfnl_ct_hook);
365 
366 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
367 /* This does not belong here, but locally generated errors need it if connection
368    tracking in use: without this, connection may not be in hash table, and hence
369    manufactured ICMP or RST packets will not be associated with it. */
370 void (*ip_ct_attach)(struct sk_buff *, const struct sk_buff *)
371                 __rcu __read_mostly;
372 EXPORT_SYMBOL(ip_ct_attach);
373 
374 void nf_ct_attach(struct sk_buff *new, const struct sk_buff *skb)
375 {
376         void (*attach)(struct sk_buff *, const struct sk_buff *);
377 
378         if (skb->nfct) {
379                 rcu_read_lock();
380                 attach = rcu_dereference(ip_ct_attach);
381                 if (attach)
382                         attach(new, skb);
383                 rcu_read_unlock();
384         }
385 }
386 EXPORT_SYMBOL(nf_ct_attach);
387 
388 void (*nf_ct_destroy)(struct nf_conntrack *) __rcu __read_mostly;
389 EXPORT_SYMBOL(nf_ct_destroy);
390 
391 void nf_conntrack_destroy(struct nf_conntrack *nfct)
392 {
393         void (*destroy)(struct nf_conntrack *);
394 
395         rcu_read_lock();
396         destroy = rcu_dereference(nf_ct_destroy);
397         BUG_ON(destroy == NULL);
398         destroy(nfct);
399         rcu_read_unlock();
400 }
401 EXPORT_SYMBOL(nf_conntrack_destroy);
402 
403 /* Built-in default zone used e.g. by modules. */
404 const struct nf_conntrack_zone nf_ct_zone_dflt = {
405         .id     = NF_CT_DEFAULT_ZONE_ID,
406         .dir    = NF_CT_DEFAULT_ZONE_DIR,
407 };
408 EXPORT_SYMBOL_GPL(nf_ct_zone_dflt);
409 #endif /* CONFIG_NF_CONNTRACK */
410 
411 #ifdef CONFIG_NF_NAT_NEEDED
412 void (*nf_nat_decode_session_hook)(struct sk_buff *, struct flowi *);
413 EXPORT_SYMBOL(nf_nat_decode_session_hook);
414 #endif
415 
416 static int nf_register_hook_list(struct net *net)
417 {
418         struct nf_hook_ops *elem;
419         int ret;
420 
421         rtnl_lock();
422         list_for_each_entry(elem, &nf_hook_list, list) {
423                 ret = nf_register_net_hook(net, elem);
424                 if (ret && ret != -ENOENT)
425                         goto out_undo;
426         }
427         rtnl_unlock();
428         return 0;
429 
430 out_undo:
431         list_for_each_entry_continue_reverse(elem, &nf_hook_list, list)
432                 nf_unregister_net_hook(net, elem);
433         rtnl_unlock();
434         return ret;
435 }
436 
437 static void nf_unregister_hook_list(struct net *net)
438 {
439         struct nf_hook_ops *elem;
440 
441         rtnl_lock();
442         list_for_each_entry(elem, &nf_hook_list, list)
443                 nf_unregister_net_hook(net, elem);
444         rtnl_unlock();
445 }
446 
447 static int __net_init netfilter_net_init(struct net *net)
448 {
449         int i, h, ret;
450 
451         for (i = 0; i < ARRAY_SIZE(net->nf.hooks); i++) {
452                 for (h = 0; h < NF_MAX_HOOKS; h++)
453                         RCU_INIT_POINTER(net->nf.hooks[i][h], NULL);
454         }
455 
456 #ifdef CONFIG_PROC_FS
457         net->nf.proc_netfilter = proc_net_mkdir(net, "netfilter",
458                                                 net->proc_net);
459         if (!net->nf.proc_netfilter) {
460                 if (!net_eq(net, &init_net))
461                         pr_err("cannot create netfilter proc entry");
462 
463                 return -ENOMEM;
464         }
465 #endif
466         ret = nf_register_hook_list(net);
467         if (ret)
468                 remove_proc_entry("netfilter", net->proc_net);
469 
470         return ret;
471 }
472 
473 static void __net_exit netfilter_net_exit(struct net *net)
474 {
475         nf_unregister_hook_list(net);
476         remove_proc_entry("netfilter", net->proc_net);
477 }
478 
479 static struct pernet_operations netfilter_net_ops = {
480         .init = netfilter_net_init,
481         .exit = netfilter_net_exit,
482 };
483 
484 int __init netfilter_init(void)
485 {
486         int ret;
487 
488         ret = register_pernet_subsys(&netfilter_net_ops);
489         if (ret < 0)
490                 goto err;
491 
492         ret = netfilter_log_init();
493         if (ret < 0)
494                 goto err_pernet;
495 
496         return 0;
497 err_pernet:
498         unregister_pernet_subsys(&netfilter_net_ops);
499 err:
500         return ret;
501 }
502 

This page was automatically generated by LXR 0.3.1 (source).  •  Linux is a registered trademark of Linus Torvalds  •  Contact us