~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/nf_tables_core.c

Version: ~ [ linux-5.10-rc1 ] ~ [ linux-5.9.1 ] ~ [ linux-5.8.16 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.72 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.152 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.202 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.240 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.240 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.85 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
  3  *
  4  * This program is free software; you can redistribute it and/or modify
  5  * it under the terms of the GNU General Public License version 2 as
  6  * published by the Free Software Foundation.
  7  *
  8  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  9  */
 10 
 11 #include <linux/kernel.h>
 12 #include <linux/module.h>
 13 #include <linux/init.h>
 14 #include <linux/list.h>
 15 #include <linux/rculist.h>
 16 #include <linux/skbuff.h>
 17 #include <linux/netlink.h>
 18 #include <linux/netfilter.h>
 19 #include <linux/static_key.h>
 20 #include <linux/netfilter/nfnetlink.h>
 21 #include <linux/netfilter/nf_tables.h>
 22 #include <net/netfilter/nf_tables_core.h>
 23 #include <net/netfilter/nf_tables.h>
 24 #include <net/netfilter/nf_log.h>
 25 
 26 static const char *const comments[__NFT_TRACETYPE_MAX] = {
 27         [NFT_TRACETYPE_POLICY]  = "policy",
 28         [NFT_TRACETYPE_RETURN]  = "return",
 29         [NFT_TRACETYPE_RULE]    = "rule",
 30 };
 31 
 32 static struct nf_loginfo trace_loginfo = {
 33         .type = NF_LOG_TYPE_LOG,
 34         .u = {
 35                 .log = {
 36                         .level = LOGLEVEL_WARNING,
 37                         .logflags = NF_LOG_MASK,
 38                 },
 39         },
 40 };
 41 
 42 static noinline void __nft_trace_packet(struct nft_traceinfo *info,
 43                                         const struct nft_chain *chain,
 44                                         int rulenum, enum nft_trace_types type)
 45 {
 46         const struct nft_pktinfo *pkt = info->pkt;
 47 
 48         if (!info->trace || !pkt->skb->nf_trace)
 49                 return;
 50 
 51         info->chain = chain;
 52         info->type = type;
 53 
 54         nft_trace_notify(info);
 55 
 56         nf_log_trace(pkt->net, pkt->pf, pkt->hook, pkt->skb, pkt->in,
 57                      pkt->out, &trace_loginfo, "TRACE: %s:%s:%s:%u ",
 58                      chain->table->name, chain->name, comments[type],
 59                      rulenum);
 60 }
 61 
 62 static inline void nft_trace_packet(struct nft_traceinfo *info,
 63                                     const struct nft_chain *chain,
 64                                     const struct nft_rule *rule,
 65                                     int rulenum,
 66                                     enum nft_trace_types type)
 67 {
 68         if (static_branch_unlikely(&nft_trace_enabled)) {
 69                 info->rule = rule;
 70                 __nft_trace_packet(info, chain, rulenum, type);
 71         }
 72 }
 73 
 74 static void nft_cmp_fast_eval(const struct nft_expr *expr,
 75                               struct nft_regs *regs)
 76 {
 77         const struct nft_cmp_fast_expr *priv = nft_expr_priv(expr);
 78         u32 mask = nft_cmp_fast_mask(priv->len);
 79 
 80         if ((regs->data[priv->sreg] & mask) == priv->data)
 81                 return;
 82         regs->verdict.code = NFT_BREAK;
 83 }
 84 
 85 static bool nft_payload_fast_eval(const struct nft_expr *expr,
 86                                   struct nft_regs *regs,
 87                                   const struct nft_pktinfo *pkt)
 88 {
 89         const struct nft_payload *priv = nft_expr_priv(expr);
 90         const struct sk_buff *skb = pkt->skb;
 91         u32 *dest = &regs->data[priv->dreg];
 92         unsigned char *ptr;
 93 
 94         if (priv->base == NFT_PAYLOAD_NETWORK_HEADER)
 95                 ptr = skb_network_header(skb);
 96         else
 97                 ptr = skb_network_header(skb) + pkt->xt.thoff;
 98 
 99         ptr += priv->offset;
100 
101         if (unlikely(ptr + priv->len >= skb_tail_pointer(skb)))
102                 return false;
103 
104         *dest = 0;
105         if (priv->len == 2)
106                 *(u16 *)dest = *(u16 *)ptr;
107         else if (priv->len == 4)
108                 *(u32 *)dest = *(u32 *)ptr;
109         else
110                 *(u8 *)dest = *(u8 *)ptr;
111         return true;
112 }
113 
114 struct nft_jumpstack {
115         const struct nft_chain  *chain;
116         const struct nft_rule   *rule;
117         int                     rulenum;
118 };
119 
120 unsigned int
121 nft_do_chain(struct nft_pktinfo *pkt, void *priv)
122 {
123         const struct nft_chain *chain = priv, *basechain = chain;
124         const struct net *net = pkt->net;
125         const struct nft_rule *rule;
126         const struct nft_expr *expr, *last;
127         struct nft_regs regs;
128         unsigned int stackptr = 0;
129         struct nft_jumpstack jumpstack[NFT_JUMP_STACK_SIZE];
130         struct nft_stats *stats;
131         int rulenum;
132         unsigned int gencursor = nft_genmask_cur(net);
133         struct nft_traceinfo info;
134 
135         info.trace = false;
136         if (static_branch_unlikely(&nft_trace_enabled))
137                 nft_trace_init(&info, pkt, &regs.verdict, basechain);
138 do_chain:
139         rulenum = 0;
140         rule = list_entry(&chain->rules, struct nft_rule, list);
141 next_rule:
142         regs.verdict.code = NFT_CONTINUE;
143         list_for_each_entry_continue_rcu(rule, &chain->rules, list) {
144 
145                 /* This rule is not active, skip. */
146                 if (unlikely(rule->genmask & gencursor))
147                         continue;
148 
149                 rulenum++;
150 
151                 nft_rule_for_each_expr(expr, last, rule) {
152                         if (expr->ops == &nft_cmp_fast_ops)
153                                 nft_cmp_fast_eval(expr, &regs);
154                         else if (expr->ops != &nft_payload_fast_ops ||
155                                  !nft_payload_fast_eval(expr, &regs, pkt))
156                                 expr->ops->eval(expr, &regs, pkt);
157 
158                         if (regs.verdict.code != NFT_CONTINUE)
159                                 break;
160                 }
161 
162                 switch (regs.verdict.code) {
163                 case NFT_BREAK:
164                         regs.verdict.code = NFT_CONTINUE;
165                         continue;
166                 case NFT_CONTINUE:
167                         nft_trace_packet(&info, chain, rule,
168                                          rulenum, NFT_TRACETYPE_RULE);
169                         continue;
170                 }
171                 break;
172         }
173 
174         switch (regs.verdict.code & NF_VERDICT_MASK) {
175         case NF_ACCEPT:
176         case NF_DROP:
177         case NF_QUEUE:
178                 nft_trace_packet(&info, chain, rule,
179                                  rulenum, NFT_TRACETYPE_RULE);
180                 return regs.verdict.code;
181         }
182 
183         switch (regs.verdict.code) {
184         case NFT_JUMP:
185                 BUG_ON(stackptr >= NFT_JUMP_STACK_SIZE);
186                 jumpstack[stackptr].chain = chain;
187                 jumpstack[stackptr].rule  = rule;
188                 jumpstack[stackptr].rulenum = rulenum;
189                 stackptr++;
190                 /* fall through */
191         case NFT_GOTO:
192                 nft_trace_packet(&info, chain, rule,
193                                  rulenum, NFT_TRACETYPE_RULE);
194 
195                 chain = regs.verdict.chain;
196                 goto do_chain;
197         case NFT_CONTINUE:
198                 rulenum++;
199                 /* fall through */
200         case NFT_RETURN:
201                 nft_trace_packet(&info, chain, rule,
202                                  rulenum, NFT_TRACETYPE_RETURN);
203                 break;
204         default:
205                 WARN_ON(1);
206         }
207 
208         if (stackptr > 0) {
209                 stackptr--;
210                 chain = jumpstack[stackptr].chain;
211                 rule  = jumpstack[stackptr].rule;
212                 rulenum = jumpstack[stackptr].rulenum;
213                 goto next_rule;
214         }
215 
216         nft_trace_packet(&info, basechain, NULL, -1,
217                          NFT_TRACETYPE_POLICY);
218 
219         rcu_read_lock_bh();
220         stats = this_cpu_ptr(rcu_dereference(nft_base_chain(basechain)->stats));
221         u64_stats_update_begin(&stats->syncp);
222         stats->pkts++;
223         stats->bytes += pkt->skb->len;
224         u64_stats_update_end(&stats->syncp);
225         rcu_read_unlock_bh();
226 
227         return nft_base_chain(basechain)->policy;
228 }
229 EXPORT_SYMBOL_GPL(nft_do_chain);
230 
231 int __init nf_tables_core_module_init(void)
232 {
233         int err;
234 
235         err = nft_immediate_module_init();
236         if (err < 0)
237                 goto err1;
238 
239         err = nft_cmp_module_init();
240         if (err < 0)
241                 goto err2;
242 
243         err = nft_lookup_module_init();
244         if (err < 0)
245                 goto err3;
246 
247         err = nft_bitwise_module_init();
248         if (err < 0)
249                 goto err4;
250 
251         err = nft_byteorder_module_init();
252         if (err < 0)
253                 goto err5;
254 
255         err = nft_payload_module_init();
256         if (err < 0)
257                 goto err6;
258 
259         err = nft_dynset_module_init();
260         if (err < 0)
261                 goto err7;
262 
263         return 0;
264 
265 err7:
266         nft_payload_module_exit();
267 err6:
268         nft_byteorder_module_exit();
269 err5:
270         nft_bitwise_module_exit();
271 err4:
272         nft_lookup_module_exit();
273 err3:
274         nft_cmp_module_exit();
275 err2:
276         nft_immediate_module_exit();
277 err1:
278         return err;
279 }
280 
281 void nf_tables_core_module_exit(void)
282 {
283         nft_dynset_module_exit();
284         nft_payload_module_exit();
285         nft_byteorder_module_exit();
286         nft_bitwise_module_exit();
287         nft_lookup_module_exit();
288         nft_cmp_module_exit();
289         nft_immediate_module_exit();
290 }
291 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp