~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/nf_queue.c

Version: ~ [ linux-5.12-rc1 ] ~ [ linux-5.11.2 ] ~ [ linux-5.10.19 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.101 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.177 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.222 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.258 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.258 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * Rusty Russell (C)2000 -- This code is GPL.
  3  * Patrick McHardy (c) 2006-2012
  4  */
  5 
  6 #include <linux/kernel.h>
  7 #include <linux/slab.h>
  8 #include <linux/init.h>
  9 #include <linux/module.h>
 10 #include <linux/proc_fs.h>
 11 #include <linux/skbuff.h>
 12 #include <linux/netfilter.h>
 13 #include <linux/netfilter_bridge.h>
 14 #include <linux/seq_file.h>
 15 #include <linux/rcupdate.h>
 16 #include <net/protocol.h>
 17 #include <net/netfilter/nf_queue.h>
 18 #include <net/dst.h>
 19 
 20 #include "nf_internals.h"
 21 
 22 /*
 23  * Hook for nfnetlink_queue to register its queue handler.
 24  * We do this so that most of the NFQUEUE code can be modular.
 25  *
 26  * Once the queue is registered it must reinject all packets it
 27  * receives, no matter what.
 28  */
 29 
 30 /* return EBUSY when somebody else is registered, return EEXIST if the
 31  * same handler is registered, return 0 in case of success. */
 32 void nf_register_queue_handler(struct net *net, const struct nf_queue_handler *qh)
 33 {
 34         /* should never happen, we only have one queueing backend in kernel */
 35         WARN_ON(rcu_access_pointer(net->nf.queue_handler));
 36         rcu_assign_pointer(net->nf.queue_handler, qh);
 37 }
 38 EXPORT_SYMBOL(nf_register_queue_handler);
 39 
 40 /* The caller must flush their queue before this */
 41 void nf_unregister_queue_handler(struct net *net)
 42 {
 43         RCU_INIT_POINTER(net->nf.queue_handler, NULL);
 44 }
 45 EXPORT_SYMBOL(nf_unregister_queue_handler);
 46 
 47 void nf_queue_entry_release_refs(struct nf_queue_entry *entry)
 48 {
 49         struct nf_hook_state *state = &entry->state;
 50 
 51         /* Release those devices we held, or Alexey will kill me. */
 52         if (state->in)
 53                 dev_put(state->in);
 54         if (state->out)
 55                 dev_put(state->out);
 56         if (state->sk)
 57                 sock_put(state->sk);
 58 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
 59         if (entry->skb->nf_bridge) {
 60                 struct net_device *physdev;
 61 
 62                 physdev = nf_bridge_get_physindev(entry->skb);
 63                 if (physdev)
 64                         dev_put(physdev);
 65                 physdev = nf_bridge_get_physoutdev(entry->skb);
 66                 if (physdev)
 67                         dev_put(physdev);
 68         }
 69 #endif
 70 }
 71 EXPORT_SYMBOL_GPL(nf_queue_entry_release_refs);
 72 
 73 /* Bump dev refs so they don't vanish while packet is out */
 74 void nf_queue_entry_get_refs(struct nf_queue_entry *entry)
 75 {
 76         struct nf_hook_state *state = &entry->state;
 77 
 78         if (state->in)
 79                 dev_hold(state->in);
 80         if (state->out)
 81                 dev_hold(state->out);
 82         if (state->sk)
 83                 sock_hold(state->sk);
 84 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
 85         if (entry->skb->nf_bridge) {
 86                 struct net_device *physdev;
 87 
 88                 physdev = nf_bridge_get_physindev(entry->skb);
 89                 if (physdev)
 90                         dev_hold(physdev);
 91                 physdev = nf_bridge_get_physoutdev(entry->skb);
 92                 if (physdev)
 93                         dev_hold(physdev);
 94         }
 95 #endif
 96 }
 97 EXPORT_SYMBOL_GPL(nf_queue_entry_get_refs);
 98 
 99 void nf_queue_nf_hook_drop(struct net *net, struct nf_hook_ops *ops)
100 {
101         const struct nf_queue_handler *qh;
102 
103         rcu_read_lock();
104         qh = rcu_dereference(net->nf.queue_handler);
105         if (qh)
106                 qh->nf_hook_drop(net, ops);
107         rcu_read_unlock();
108 }
109 
110 /*
111  * Any packet that leaves via this function must come back
112  * through nf_reinject().
113  */
114 int nf_queue(struct sk_buff *skb,
115              struct nf_hook_ops *elem,
116              struct nf_hook_state *state,
117              unsigned int queuenum)
118 {
119         int status = -ENOENT;
120         struct nf_queue_entry *entry = NULL;
121         const struct nf_afinfo *afinfo;
122         const struct nf_queue_handler *qh;
123         struct net *net = state->net;
124 
125         /* QUEUE == DROP if no one is waiting, to be safe. */
126         qh = rcu_dereference(net->nf.queue_handler);
127         if (!qh) {
128                 status = -ESRCH;
129                 goto err;
130         }
131 
132         afinfo = nf_get_afinfo(state->pf);
133         if (!afinfo)
134                 goto err;
135 
136         entry = kmalloc(sizeof(*entry) + afinfo->route_key_size, GFP_ATOMIC);
137         if (!entry) {
138                 status = -ENOMEM;
139                 goto err;
140         }
141 
142         *entry = (struct nf_queue_entry) {
143                 .skb    = skb,
144                 .elem   = elem,
145                 .state  = *state,
146                 .size   = sizeof(*entry) + afinfo->route_key_size,
147         };
148 
149         nf_queue_entry_get_refs(entry);
150         skb_dst_force(skb);
151         afinfo->saveroute(skb, entry);
152         status = qh->outfn(entry, queuenum);
153 
154         if (status < 0) {
155                 nf_queue_entry_release_refs(entry);
156                 goto err;
157         }
158 
159         return 0;
160 
161 err:
162         kfree(entry);
163         return status;
164 }
165 
166 void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
167 {
168         struct sk_buff *skb = entry->skb;
169         struct nf_hook_ops *elem = entry->elem;
170         const struct nf_afinfo *afinfo;
171         int err;
172 
173         nf_queue_entry_release_refs(entry);
174 
175         /* Continue traversal iff userspace said ok... */
176         if (verdict == NF_REPEAT)
177                 verdict = elem->hook(elem->priv, skb, &entry->state);
178 
179         if (verdict == NF_ACCEPT) {
180                 afinfo = nf_get_afinfo(entry->state.pf);
181                 if (!afinfo || afinfo->reroute(entry->state.net, skb, entry) < 0)
182                         verdict = NF_DROP;
183         }
184 
185         entry->state.thresh = INT_MIN;
186 
187         if (verdict == NF_ACCEPT) {
188         next_hook:
189                 verdict = nf_iterate(entry->state.hook_list,
190                                      skb, &entry->state, &elem);
191         }
192 
193         switch (verdict & NF_VERDICT_MASK) {
194         case NF_ACCEPT:
195         case NF_STOP:
196                 local_bh_disable();
197                 entry->state.okfn(entry->state.net, entry->state.sk, skb);
198                 local_bh_enable();
199                 break;
200         case NF_QUEUE:
201                 err = nf_queue(skb, elem, &entry->state,
202                                verdict >> NF_VERDICT_QBITS);
203                 if (err < 0) {
204                         if (err == -ESRCH &&
205                            (verdict & NF_VERDICT_FLAG_QUEUE_BYPASS))
206                                 goto next_hook;
207                         kfree_skb(skb);
208                 }
209                 break;
210         case NF_STOLEN:
211                 break;
212         default:
213                 kfree_skb(skb);
214         }
215 
216         kfree(entry);
217 }
218 EXPORT_SYMBOL(nf_reinject);
219 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp