~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/nf_tables_core.c

Version: ~ [ linux-5.14-rc3 ] ~ [ linux-5.13.5 ] ~ [ linux-5.12.19 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.53 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.135 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.198 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.240 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.276 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.276 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
  3  *
  4  * This program is free software; you can redistribute it and/or modify
  5  * it under the terms of the GNU General Public License version 2 as
  6  * published by the Free Software Foundation.
  7  *
  8  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  9  */
 10 
 11 #include <linux/module.h>
 12 #include <linux/init.h>
 13 #include <linux/list.h>
 14 #include <linux/rculist.h>
 15 #include <linux/skbuff.h>
 16 #include <linux/netlink.h>
 17 #include <linux/netfilter.h>
 18 #include <linux/netfilter/nfnetlink.h>
 19 #include <linux/netfilter/nf_tables.h>
 20 #include <net/netfilter/nf_tables_core.h>
 21 #include <net/netfilter/nf_tables.h>
 22 #include <net/netfilter/nf_log.h>
 23 
 24 static void nft_cmp_fast_eval(const struct nft_expr *expr,
 25                               struct nft_data data[NFT_REG_MAX + 1])
 26 {
 27         const struct nft_cmp_fast_expr *priv = nft_expr_priv(expr);
 28         u32 mask = nft_cmp_fast_mask(priv->len);
 29 
 30         if ((data[priv->sreg].data[0] & mask) == priv->data)
 31                 return;
 32         data[NFT_REG_VERDICT].verdict = NFT_BREAK;
 33 }
 34 
 35 static bool nft_payload_fast_eval(const struct nft_expr *expr,
 36                                   struct nft_data data[NFT_REG_MAX + 1],
 37                                   const struct nft_pktinfo *pkt)
 38 {
 39         const struct nft_payload *priv = nft_expr_priv(expr);
 40         const struct sk_buff *skb = pkt->skb;
 41         struct nft_data *dest = &data[priv->dreg];
 42         unsigned char *ptr;
 43 
 44         if (priv->base == NFT_PAYLOAD_NETWORK_HEADER)
 45                 ptr = skb_network_header(skb);
 46         else
 47                 ptr = skb_network_header(skb) + pkt->xt.thoff;
 48 
 49         ptr += priv->offset;
 50 
 51         if (unlikely(ptr + priv->len >= skb_tail_pointer(skb)))
 52                 return false;
 53 
 54         if (priv->len == 2)
 55                 *(u16 *)dest->data = *(u16 *)ptr;
 56         else if (priv->len == 4)
 57                 *(u32 *)dest->data = *(u32 *)ptr;
 58         else
 59                 *(u8 *)dest->data = *(u8 *)ptr;
 60         return true;
 61 }
 62 
 63 struct nft_jumpstack {
 64         const struct nft_chain  *chain;
 65         const struct nft_rule   *rule;
 66         int                     rulenum;
 67 };
 68 
 69 enum nft_trace {
 70         NFT_TRACE_RULE,
 71         NFT_TRACE_RETURN,
 72         NFT_TRACE_POLICY,
 73 };
 74 
 75 static const char *const comments[] = {
 76         [NFT_TRACE_RULE]        = "rule",
 77         [NFT_TRACE_RETURN]      = "return",
 78         [NFT_TRACE_POLICY]      = "policy",
 79 };
 80 
 81 static struct nf_loginfo trace_loginfo = {
 82         .type = NF_LOG_TYPE_LOG,
 83         .u = {
 84                 .log = {
 85                         .level = 4,
 86                         .logflags = NF_LOG_MASK,
 87                 },
 88         },
 89 };
 90 
 91 static void nft_trace_packet(const struct nft_pktinfo *pkt,
 92                              const struct nft_chain *chain,
 93                              int rulenum, enum nft_trace type)
 94 {
 95         struct net *net = dev_net(pkt->in ? pkt->in : pkt->out);
 96 
 97         nf_log_trace(net, pkt->xt.family, pkt->ops->hooknum, pkt->skb, pkt->in,
 98                      pkt->out, &trace_loginfo, "TRACE: %s:%s:%s:%u ",
 99                      chain->table->name, chain->name, comments[type],
100                      rulenum);
101 }
102 
103 unsigned int
104 nft_do_chain(struct nft_pktinfo *pkt, const struct nf_hook_ops *ops)
105 {
106         const struct nft_chain *chain = ops->priv, *basechain = chain;
107         const struct nft_rule *rule;
108         const struct nft_expr *expr, *last;
109         struct nft_data data[NFT_REG_MAX + 1];
110         unsigned int stackptr = 0;
111         struct nft_jumpstack jumpstack[NFT_JUMP_STACK_SIZE];
112         struct nft_stats *stats;
113         int rulenum;
114         /*
115          * Cache cursor to avoid problems in case that the cursor is updated
116          * while traversing the ruleset.
117          */
118         unsigned int gencursor = ACCESS_ONCE(chain->net->nft.gencursor);
119 
120 do_chain:
121         rulenum = 0;
122         rule = list_entry(&chain->rules, struct nft_rule, list);
123 next_rule:
124         data[NFT_REG_VERDICT].verdict = NFT_CONTINUE;
125         list_for_each_entry_continue_rcu(rule, &chain->rules, list) {
126 
127                 /* This rule is not active, skip. */
128                 if (unlikely(rule->genmask & (1 << gencursor)))
129                         continue;
130 
131                 rulenum++;
132 
133                 nft_rule_for_each_expr(expr, last, rule) {
134                         if (expr->ops == &nft_cmp_fast_ops)
135                                 nft_cmp_fast_eval(expr, data);
136                         else if (expr->ops != &nft_payload_fast_ops ||
137                                  !nft_payload_fast_eval(expr, data, pkt))
138                                 expr->ops->eval(expr, data, pkt);
139 
140                         if (data[NFT_REG_VERDICT].verdict != NFT_CONTINUE)
141                                 break;
142                 }
143 
144                 switch (data[NFT_REG_VERDICT].verdict) {
145                 case NFT_BREAK:
146                         data[NFT_REG_VERDICT].verdict = NFT_CONTINUE;
147                         continue;
148                 case NFT_CONTINUE:
149                         if (unlikely(pkt->skb->nf_trace))
150                                 nft_trace_packet(pkt, chain, rulenum, NFT_TRACE_RULE);
151                         continue;
152                 }
153                 break;
154         }
155 
156         switch (data[NFT_REG_VERDICT].verdict & NF_VERDICT_MASK) {
157         case NF_ACCEPT:
158         case NF_DROP:
159         case NF_QUEUE:
160                 if (unlikely(pkt->skb->nf_trace))
161                         nft_trace_packet(pkt, chain, rulenum, NFT_TRACE_RULE);
162 
163                 return data[NFT_REG_VERDICT].verdict;
164         }
165 
166         switch (data[NFT_REG_VERDICT].verdict) {
167         case NFT_JUMP:
168                 if (unlikely(pkt->skb->nf_trace))
169                         nft_trace_packet(pkt, chain, rulenum, NFT_TRACE_RULE);
170 
171                 BUG_ON(stackptr >= NFT_JUMP_STACK_SIZE);
172                 jumpstack[stackptr].chain = chain;
173                 jumpstack[stackptr].rule  = rule;
174                 jumpstack[stackptr].rulenum = rulenum;
175                 stackptr++;
176                 chain = data[NFT_REG_VERDICT].chain;
177                 goto do_chain;
178         case NFT_GOTO:
179                 if (unlikely(pkt->skb->nf_trace))
180                         nft_trace_packet(pkt, chain, rulenum, NFT_TRACE_RULE);
181 
182                 chain = data[NFT_REG_VERDICT].chain;
183                 goto do_chain;
184         case NFT_RETURN:
185                 if (unlikely(pkt->skb->nf_trace))
186                         nft_trace_packet(pkt, chain, rulenum, NFT_TRACE_RETURN);
187                 break;
188         case NFT_CONTINUE:
189                 if (unlikely(pkt->skb->nf_trace && !(chain->flags & NFT_BASE_CHAIN)))
190                         nft_trace_packet(pkt, chain, ++rulenum, NFT_TRACE_RETURN);
191                 break;
192         default:
193                 WARN_ON(1);
194         }
195 
196         if (stackptr > 0) {
197                 stackptr--;
198                 chain = jumpstack[stackptr].chain;
199                 rule  = jumpstack[stackptr].rule;
200                 rulenum = jumpstack[stackptr].rulenum;
201                 goto next_rule;
202         }
203 
204         if (unlikely(pkt->skb->nf_trace))
205                 nft_trace_packet(pkt, basechain, -1, NFT_TRACE_POLICY);
206 
207         rcu_read_lock_bh();
208         stats = this_cpu_ptr(rcu_dereference(nft_base_chain(basechain)->stats));
209         u64_stats_update_begin(&stats->syncp);
210         stats->pkts++;
211         stats->bytes += pkt->skb->len;
212         u64_stats_update_end(&stats->syncp);
213         rcu_read_unlock_bh();
214 
215         return nft_base_chain(basechain)->policy;
216 }
217 EXPORT_SYMBOL_GPL(nft_do_chain);
218 
219 int __init nf_tables_core_module_init(void)
220 {
221         int err;
222 
223         err = nft_immediate_module_init();
224         if (err < 0)
225                 goto err1;
226 
227         err = nft_cmp_module_init();
228         if (err < 0)
229                 goto err2;
230 
231         err = nft_lookup_module_init();
232         if (err < 0)
233                 goto err3;
234 
235         err = nft_bitwise_module_init();
236         if (err < 0)
237                 goto err4;
238 
239         err = nft_byteorder_module_init();
240         if (err < 0)
241                 goto err5;
242 
243         err = nft_payload_module_init();
244         if (err < 0)
245                 goto err6;
246 
247         return 0;
248 
249 err6:
250         nft_byteorder_module_exit();
251 err5:
252         nft_bitwise_module_exit();
253 err4:
254         nft_lookup_module_exit();
255 err3:
256         nft_cmp_module_exit();
257 err2:
258         nft_immediate_module_exit();
259 err1:
260         return err;
261 }
262 
263 void nf_tables_core_module_exit(void)
264 {
265         nft_payload_module_exit();
266         nft_byteorder_module_exit();
267         nft_bitwise_module_exit();
268         nft_lookup_module_exit();
269         nft_cmp_module_exit();
270         nft_immediate_module_exit();
271 }
272 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp