~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/nf_tables_core.c

Version: ~ [ linux-5.3-rc5 ] ~ [ linux-5.2.9 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.67 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.139 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.189 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.189 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.72 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
  3  *
  4  * This program is free software; you can redistribute it and/or modify
  5  * it under the terms of the GNU General Public License version 2 as
  6  * published by the Free Software Foundation.
  7  *
  8  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  9  */
 10 
 11 #include <linux/kernel.h>
 12 #include <linux/module.h>
 13 #include <linux/init.h>
 14 #include <linux/list.h>
 15 #include <linux/rculist.h>
 16 #include <linux/skbuff.h>
 17 #include <linux/netlink.h>
 18 #include <linux/netfilter.h>
 19 #include <linux/static_key.h>
 20 #include <linux/netfilter/nfnetlink.h>
 21 #include <linux/netfilter/nf_tables.h>
 22 #include <net/netfilter/nf_tables_core.h>
 23 #include <net/netfilter/nf_tables.h>
 24 #include <net/netfilter/nf_log.h>
 25 
 26 static const char *const comments[__NFT_TRACETYPE_MAX] = {
 27         [NFT_TRACETYPE_POLICY]  = "policy",
 28         [NFT_TRACETYPE_RETURN]  = "return",
 29         [NFT_TRACETYPE_RULE]    = "rule",
 30 };
 31 
 32 static struct nf_loginfo trace_loginfo = {
 33         .type = NF_LOG_TYPE_LOG,
 34         .u = {
 35                 .log = {
 36                         .level = LOGLEVEL_WARNING,
 37                         .logflags = NF_LOG_DEFAULT_MASK,
 38                 },
 39         },
 40 };
 41 
 42 static noinline void __nft_trace_packet(struct nft_traceinfo *info,
 43                                         const struct nft_chain *chain,
 44                                         int rulenum, enum nft_trace_types type)
 45 {
 46         const struct nft_pktinfo *pkt = info->pkt;
 47 
 48         if (!info->trace || !pkt->skb->nf_trace)
 49                 return;
 50 
 51         info->chain = chain;
 52         info->type = type;
 53 
 54         nft_trace_notify(info);
 55 
 56         nf_log_trace(nft_net(pkt), nft_pf(pkt), nft_hook(pkt), pkt->skb,
 57                      nft_in(pkt), nft_out(pkt), &trace_loginfo,
 58                      "TRACE: %s:%s:%s:%u ",
 59                      chain->table->name, chain->name, comments[type], rulenum);
 60 }
 61 
 62 static inline void nft_trace_packet(struct nft_traceinfo *info,
 63                                     const struct nft_chain *chain,
 64                                     const struct nft_rule *rule,
 65                                     int rulenum,
 66                                     enum nft_trace_types type)
 67 {
 68         if (static_branch_unlikely(&nft_trace_enabled)) {
 69                 info->rule = rule;
 70                 __nft_trace_packet(info, chain, rulenum, type);
 71         }
 72 }
 73 
 74 static void nft_cmp_fast_eval(const struct nft_expr *expr,
 75                               struct nft_regs *regs)
 76 {
 77         const struct nft_cmp_fast_expr *priv = nft_expr_priv(expr);
 78         u32 mask = nft_cmp_fast_mask(priv->len);
 79 
 80         if ((regs->data[priv->sreg] & mask) == priv->data)
 81                 return;
 82         regs->verdict.code = NFT_BREAK;
 83 }
 84 
 85 static bool nft_payload_fast_eval(const struct nft_expr *expr,
 86                                   struct nft_regs *regs,
 87                                   const struct nft_pktinfo *pkt)
 88 {
 89         const struct nft_payload *priv = nft_expr_priv(expr);
 90         const struct sk_buff *skb = pkt->skb;
 91         u32 *dest = &regs->data[priv->dreg];
 92         unsigned char *ptr;
 93 
 94         if (priv->base == NFT_PAYLOAD_NETWORK_HEADER)
 95                 ptr = skb_network_header(skb);
 96         else {
 97                 if (!pkt->tprot_set)
 98                         return false;
 99                 ptr = skb_network_header(skb) + pkt->xt.thoff;
100         }
101 
102         ptr += priv->offset;
103 
104         if (unlikely(ptr + priv->len > skb_tail_pointer(skb)))
105                 return false;
106 
107         *dest = 0;
108         if (priv->len == 2)
109                 *(u16 *)dest = *(u16 *)ptr;
110         else if (priv->len == 4)
111                 *(u32 *)dest = *(u32 *)ptr;
112         else
113                 *(u8 *)dest = *(u8 *)ptr;
114         return true;
115 }
116 
117 struct nft_jumpstack {
118         const struct nft_chain  *chain;
119         const struct nft_rule   *rule;
120         int                     rulenum;
121 };
122 
123 unsigned int
124 nft_do_chain(struct nft_pktinfo *pkt, void *priv)
125 {
126         const struct nft_chain *chain = priv, *basechain = chain;
127         const struct net *net = nft_net(pkt);
128         const struct nft_rule *rule;
129         const struct nft_expr *expr, *last;
130         struct nft_regs regs;
131         unsigned int stackptr = 0;
132         struct nft_jumpstack jumpstack[NFT_JUMP_STACK_SIZE];
133         struct nft_stats *stats;
134         int rulenum;
135         unsigned int gencursor = nft_genmask_cur(net);
136         struct nft_traceinfo info;
137 
138         info.trace = false;
139         if (static_branch_unlikely(&nft_trace_enabled))
140                 nft_trace_init(&info, pkt, &regs.verdict, basechain);
141 do_chain:
142         rulenum = 0;
143         rule = list_entry(&chain->rules, struct nft_rule, list);
144 next_rule:
145         regs.verdict.code = NFT_CONTINUE;
146         list_for_each_entry_continue_rcu(rule, &chain->rules, list) {
147 
148                 /* This rule is not active, skip. */
149                 if (unlikely(rule->genmask & gencursor))
150                         continue;
151 
152                 rulenum++;
153 
154                 nft_rule_for_each_expr(expr, last, rule) {
155                         if (expr->ops == &nft_cmp_fast_ops)
156                                 nft_cmp_fast_eval(expr, &regs);
157                         else if (expr->ops != &nft_payload_fast_ops ||
158                                  !nft_payload_fast_eval(expr, &regs, pkt))
159                                 expr->ops->eval(expr, &regs, pkt);
160 
161                         if (regs.verdict.code != NFT_CONTINUE)
162                                 break;
163                 }
164 
165                 switch (regs.verdict.code) {
166                 case NFT_BREAK:
167                         regs.verdict.code = NFT_CONTINUE;
168                         continue;
169                 case NFT_CONTINUE:
170                         nft_trace_packet(&info, chain, rule,
171                                          rulenum, NFT_TRACETYPE_RULE);
172                         continue;
173                 }
174                 break;
175         }
176 
177         switch (regs.verdict.code & NF_VERDICT_MASK) {
178         case NF_ACCEPT:
179         case NF_DROP:
180         case NF_QUEUE:
181         case NF_STOLEN:
182                 nft_trace_packet(&info, chain, rule,
183                                  rulenum, NFT_TRACETYPE_RULE);
184                 return regs.verdict.code;
185         }
186 
187         switch (regs.verdict.code) {
188         case NFT_JUMP:
189                 BUG_ON(stackptr >= NFT_JUMP_STACK_SIZE);
190                 jumpstack[stackptr].chain = chain;
191                 jumpstack[stackptr].rule  = rule;
192                 jumpstack[stackptr].rulenum = rulenum;
193                 stackptr++;
194                 /* fall through */
195         case NFT_GOTO:
196                 nft_trace_packet(&info, chain, rule,
197                                  rulenum, NFT_TRACETYPE_RULE);
198 
199                 chain = regs.verdict.chain;
200                 goto do_chain;
201         case NFT_CONTINUE:
202                 rulenum++;
203                 /* fall through */
204         case NFT_RETURN:
205                 nft_trace_packet(&info, chain, rule,
206                                  rulenum, NFT_TRACETYPE_RETURN);
207                 break;
208         default:
209                 WARN_ON(1);
210         }
211 
212         if (stackptr > 0) {
213                 stackptr--;
214                 chain = jumpstack[stackptr].chain;
215                 rule  = jumpstack[stackptr].rule;
216                 rulenum = jumpstack[stackptr].rulenum;
217                 goto next_rule;
218         }
219 
220         nft_trace_packet(&info, basechain, NULL, -1,
221                          NFT_TRACETYPE_POLICY);
222 
223         rcu_read_lock_bh();
224         stats = this_cpu_ptr(rcu_dereference(nft_base_chain(basechain)->stats));
225         u64_stats_update_begin(&stats->syncp);
226         stats->pkts++;
227         stats->bytes += pkt->skb->len;
228         u64_stats_update_end(&stats->syncp);
229         rcu_read_unlock_bh();
230 
231         return nft_base_chain(basechain)->policy;
232 }
233 EXPORT_SYMBOL_GPL(nft_do_chain);
234 
235 static struct nft_expr_type *nft_basic_types[] = {
236         &nft_imm_type,
237         &nft_cmp_type,
238         &nft_lookup_type,
239         &nft_bitwise_type,
240         &nft_byteorder_type,
241         &nft_payload_type,
242         &nft_dynset_type,
243         &nft_range_type,
244 };
245 
246 int __init nf_tables_core_module_init(void)
247 {
248         int err, i;
249 
250         for (i = 0; i < ARRAY_SIZE(nft_basic_types); i++) {
251                 err = nft_register_expr(nft_basic_types[i]);
252                 if (err)
253                         goto err;
254         }
255 
256         return 0;
257 
258 err:
259         while (i-- > 0)
260                 nft_unregister_expr(nft_basic_types[i]);
261         return err;
262 }
263 
264 void nf_tables_core_module_exit(void)
265 {
266         int i;
267 
268         i = ARRAY_SIZE(nft_basic_types);
269         while (i-- > 0)
270                 nft_unregister_expr(nft_basic_types[i]);
271 }
272 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp