1/* netfilter.c: look after the filters for various protocols.
2 * Heavily influenced by the old firewall.c by David Bonn and Alan Cox.
3 *
4 * Thanks to Rob `CmdrTaco' Malda for not influencing this code in any
5 * way.
6 *
7 * This code is GPL.
8 */
9#include <linux/kernel.h>
10#include <linux/netfilter.h>
11#include <net/protocol.h>
12#include <linux/init.h>
13#include <linux/skbuff.h>
14#include <linux/wait.h>
15#include <linux/module.h>
16#include <linux/interrupt.h>
17#include <linux/if.h>
18#include <linux/netdevice.h>
19#include <linux/netfilter_ipv6.h>
20#include <linux/inetdevice.h>
21#include <linux/proc_fs.h>
22#include <linux/mutex.h>
23#include <linux/mm.h>
24#include <linux/rcupdate.h>
25#include <net/net_namespace.h>
26#include <net/netfilter/nf_queue.h>
27#include <net/sock.h>
28
29#include "nf_internals.h"
30
31const struct nf_ipv6_ops __rcu *nf_ipv6_ops __read_mostly;
32EXPORT_SYMBOL_GPL(nf_ipv6_ops);
33
34DEFINE_PER_CPU(bool, nf_skb_duplicated);
35EXPORT_SYMBOL_GPL(nf_skb_duplicated);
36
37#ifdef CONFIG_JUMP_LABEL
38struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
39EXPORT_SYMBOL(nf_hooks_needed);
40#endif
41
42static DEFINE_MUTEX(nf_hook_mutex);
43
44/* max hooks per family/hooknum */
45#define MAX_HOOK_COUNT 1024
46
47#define nf_entry_dereference(e) \
48 rcu_dereference_protected(e, lockdep_is_held(&nf_hook_mutex))
49
50static struct nf_hook_entries *allocate_hook_entries_size(u16 num)
51{
52 struct nf_hook_entries *e;
53 size_t alloc = sizeof(*e) +
54 sizeof(struct nf_hook_entry) * num +
55 sizeof(struct nf_hook_ops *) * num +
56 sizeof(struct nf_hook_entries_rcu_head);
57
58 if (num == 0)
59 return NULL;
60
61 e = kvzalloc(size: alloc, GFP_KERNEL_ACCOUNT);
62 if (e)
63 e->num_hook_entries = num;
64 return e;
65}
66
67static void __nf_hook_entries_free(struct rcu_head *h)
68{
69 struct nf_hook_entries_rcu_head *head;
70
71 head = container_of(h, struct nf_hook_entries_rcu_head, head);
72 kvfree(addr: head->allocation);
73}
74
75static void nf_hook_entries_free(struct nf_hook_entries *e)
76{
77 struct nf_hook_entries_rcu_head *head;
78 struct nf_hook_ops **ops;
79 unsigned int num;
80
81 if (!e)
82 return;
83
84 num = e->num_hook_entries;
85 ops = nf_hook_entries_get_hook_ops(e);
86 head = (void *)&ops[num];
87 head->allocation = e;
88 call_rcu(head: &head->head, func: __nf_hook_entries_free);
89}
90
91static unsigned int accept_all(void *priv,
92 struct sk_buff *skb,
93 const struct nf_hook_state *state)
94{
95 return NF_ACCEPT; /* ACCEPT makes nf_hook_slow call next hook */
96}
97
98static const struct nf_hook_ops dummy_ops = {
99 .hook = accept_all,
100 .priority = INT_MIN,
101};
102
103static struct nf_hook_entries *
104nf_hook_entries_grow(const struct nf_hook_entries *old,
105 const struct nf_hook_ops *reg)
106{
107 unsigned int i, alloc_entries, nhooks, old_entries;
108 struct nf_hook_ops **orig_ops = NULL;
109 struct nf_hook_ops **new_ops;
110 struct nf_hook_entries *new;
111 bool inserted = false;
112
113 alloc_entries = 1;
114 old_entries = old ? old->num_hook_entries : 0;
115
116 if (old) {
117 orig_ops = nf_hook_entries_get_hook_ops(e: old);
118
119 for (i = 0; i < old_entries; i++) {
120 if (orig_ops[i] != &dummy_ops)
121 alloc_entries++;
122
123 /* Restrict BPF hook type to force a unique priority, not
124 * shared at attach time.
125 *
126 * This is mainly to avoid ordering issues between two
127 * different bpf programs, this doesn't prevent a normal
128 * hook at same priority as a bpf one (we don't want to
129 * prevent defrag, conntrack, iptables etc from attaching).
130 */
131 if (reg->priority == orig_ops[i]->priority &&
132 reg->hook_ops_type == NF_HOOK_OP_BPF)
133 return ERR_PTR(error: -EBUSY);
134 }
135 }
136
137 if (alloc_entries > MAX_HOOK_COUNT)
138 return ERR_PTR(error: -E2BIG);
139
140 new = allocate_hook_entries_size(num: alloc_entries);
141 if (!new)
142 return ERR_PTR(error: -ENOMEM);
143
144 new_ops = nf_hook_entries_get_hook_ops(e: new);
145
146 i = 0;
147 nhooks = 0;
148 while (i < old_entries) {
149 if (orig_ops[i] == &dummy_ops) {
150 ++i;
151 continue;
152 }
153
154 if (inserted || reg->priority > orig_ops[i]->priority) {
155 new_ops[nhooks] = (void *)orig_ops[i];
156 new->hooks[nhooks] = old->hooks[i];
157 i++;
158 } else {
159 new_ops[nhooks] = (void *)reg;
160 new->hooks[nhooks].hook = reg->hook;
161 new->hooks[nhooks].priv = reg->priv;
162 inserted = true;
163 }
164 nhooks++;
165 }
166
167 if (!inserted) {
168 new_ops[nhooks] = (void *)reg;
169 new->hooks[nhooks].hook = reg->hook;
170 new->hooks[nhooks].priv = reg->priv;
171 }
172
173 return new;
174}
175
176static void hooks_validate(const struct nf_hook_entries *hooks)
177{
178#ifdef CONFIG_DEBUG_MISC
179 struct nf_hook_ops **orig_ops;
180 int prio = INT_MIN;
181 size_t i = 0;
182
183 orig_ops = nf_hook_entries_get_hook_ops(e: hooks);
184
185 for (i = 0; i < hooks->num_hook_entries; i++) {
186 if (orig_ops[i] == &dummy_ops)
187 continue;
188
189 WARN_ON(orig_ops[i]->priority < prio);
190
191 if (orig_ops[i]->priority > prio)
192 prio = orig_ops[i]->priority;
193 }
194#endif
195}
196
197int nf_hook_entries_insert_raw(struct nf_hook_entries __rcu **pp,
198 const struct nf_hook_ops *reg)
199{
200 struct nf_hook_entries *new_hooks;
201 struct nf_hook_entries *p;
202
203 p = rcu_dereference_raw(*pp);
204 new_hooks = nf_hook_entries_grow(old: p, reg);
205 if (IS_ERR(ptr: new_hooks))
206 return PTR_ERR(ptr: new_hooks);
207
208 hooks_validate(hooks: new_hooks);
209
210 rcu_assign_pointer(*pp, new_hooks);
211
212 BUG_ON(p == new_hooks);
213 nf_hook_entries_free(e: p);
214 return 0;
215}
216EXPORT_SYMBOL_GPL(nf_hook_entries_insert_raw);
217
218/*
219 * __nf_hook_entries_try_shrink - try to shrink hook array
220 *
221 * @old -- current hook blob at @pp
222 * @pp -- location of hook blob
223 *
224 * Hook unregistration must always succeed, so to-be-removed hooks
225 * are replaced by a dummy one that will just move to next hook.
226 *
227 * This counts the current dummy hooks, attempts to allocate new blob,
228 * copies the live hooks, then replaces and discards old one.
229 *
230 * return values:
231 *
232 * Returns address to free, or NULL.
233 */
234static void *__nf_hook_entries_try_shrink(struct nf_hook_entries *old,
235 struct nf_hook_entries __rcu **pp)
236{
237 unsigned int i, j, skip = 0, hook_entries;
238 struct nf_hook_entries *new = NULL;
239 struct nf_hook_ops **orig_ops;
240 struct nf_hook_ops **new_ops;
241
242 if (WARN_ON_ONCE(!old))
243 return NULL;
244
245 orig_ops = nf_hook_entries_get_hook_ops(e: old);
246 for (i = 0; i < old->num_hook_entries; i++) {
247 if (orig_ops[i] == &dummy_ops)
248 skip++;
249 }
250
251 /* if skip == hook_entries all hooks have been removed */
252 hook_entries = old->num_hook_entries;
253 if (skip == hook_entries)
254 goto out_assign;
255
256 if (skip == 0)
257 return NULL;
258
259 hook_entries -= skip;
260 new = allocate_hook_entries_size(num: hook_entries);
261 if (!new)
262 return NULL;
263
264 new_ops = nf_hook_entries_get_hook_ops(e: new);
265 for (i = 0, j = 0; i < old->num_hook_entries; i++) {
266 if (orig_ops[i] == &dummy_ops)
267 continue;
268 new->hooks[j] = old->hooks[i];
269 new_ops[j] = (void *)orig_ops[i];
270 j++;
271 }
272 hooks_validate(hooks: new);
273out_assign:
274 rcu_assign_pointer(*pp, new);
275 return old;
276}
277
278static struct nf_hook_entries __rcu **
279nf_hook_entry_head(struct net *net, int pf, unsigned int hooknum,
280 struct net_device *dev)
281{
282 switch (pf) {
283 case NFPROTO_NETDEV:
284 break;
285#ifdef CONFIG_NETFILTER_FAMILY_ARP
286 case NFPROTO_ARP:
287 if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_arp) <= hooknum))
288 return NULL;
289 return net->nf.hooks_arp + hooknum;
290#endif
291#ifdef CONFIG_NETFILTER_FAMILY_BRIDGE
292 case NFPROTO_BRIDGE:
293 if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_bridge) <= hooknum))
294 return NULL;
295 return net->nf.hooks_bridge + hooknum;
296#endif
297#ifdef CONFIG_NETFILTER_INGRESS
298 case NFPROTO_INET:
299 if (WARN_ON_ONCE(hooknum != NF_INET_INGRESS))
300 return NULL;
301 if (!dev || dev_net(dev) != net) {
302 WARN_ON_ONCE(1);
303 return NULL;
304 }
305 return &dev->nf_hooks_ingress;
306#endif
307 case NFPROTO_IPV4:
308 if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_ipv4) <= hooknum))
309 return NULL;
310 return net->nf.hooks_ipv4 + hooknum;
311 case NFPROTO_IPV6:
312 if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_ipv6) <= hooknum))
313 return NULL;
314 return net->nf.hooks_ipv6 + hooknum;
315 default:
316 WARN_ON_ONCE(1);
317 return NULL;
318 }
319
320#ifdef CONFIG_NETFILTER_INGRESS
321 if (hooknum == NF_NETDEV_INGRESS) {
322 if (dev && dev_net(dev) == net)
323 return &dev->nf_hooks_ingress;
324 }
325#endif
326#ifdef CONFIG_NETFILTER_EGRESS
327 if (hooknum == NF_NETDEV_EGRESS) {
328 if (dev && dev_net(dev) == net)
329 return &dev->nf_hooks_egress;
330 }
331#endif
332 WARN_ON_ONCE(1);
333 return NULL;
334}
335
336static int nf_ingress_check(struct net *net, const struct nf_hook_ops *reg,
337 int hooknum)
338{
339#ifndef CONFIG_NETFILTER_INGRESS
340 if (reg->hooknum == hooknum)
341 return -EOPNOTSUPP;
342#endif
343 if (reg->hooknum != hooknum ||
344 !reg->dev || dev_net(dev: reg->dev) != net)
345 return -EINVAL;
346
347 return 0;
348}
349
350static inline bool __maybe_unused nf_ingress_hook(const struct nf_hook_ops *reg,
351 int pf)
352{
353 if ((pf == NFPROTO_NETDEV && reg->hooknum == NF_NETDEV_INGRESS) ||
354 (pf == NFPROTO_INET && reg->hooknum == NF_INET_INGRESS))
355 return true;
356
357 return false;
358}
359
360static inline bool __maybe_unused nf_egress_hook(const struct nf_hook_ops *reg,
361 int pf)
362{
363 return pf == NFPROTO_NETDEV && reg->hooknum == NF_NETDEV_EGRESS;
364}
365
366static void nf_static_key_inc(const struct nf_hook_ops *reg, int pf)
367{
368#ifdef CONFIG_JUMP_LABEL
369 int hooknum;
370
371 if (pf == NFPROTO_INET && reg->hooknum == NF_INET_INGRESS) {
372 pf = NFPROTO_NETDEV;
373 hooknum = NF_NETDEV_INGRESS;
374 } else {
375 hooknum = reg->hooknum;
376 }
377 static_key_slow_inc(key: &nf_hooks_needed[pf][hooknum]);
378#endif
379}
380
381static void nf_static_key_dec(const struct nf_hook_ops *reg, int pf)
382{
383#ifdef CONFIG_JUMP_LABEL
384 int hooknum;
385
386 if (pf == NFPROTO_INET && reg->hooknum == NF_INET_INGRESS) {
387 pf = NFPROTO_NETDEV;
388 hooknum = NF_NETDEV_INGRESS;
389 } else {
390 hooknum = reg->hooknum;
391 }
392 static_key_slow_dec(key: &nf_hooks_needed[pf][hooknum]);
393#endif
394}
395
396static int __nf_register_net_hook(struct net *net, int pf,
397 const struct nf_hook_ops *reg)
398{
399 struct nf_hook_entries *p, *new_hooks;
400 struct nf_hook_entries __rcu **pp;
401 int err;
402
403 switch (pf) {
404 case NFPROTO_NETDEV:
405#ifndef CONFIG_NETFILTER_INGRESS
406 if (reg->hooknum == NF_NETDEV_INGRESS)
407 return -EOPNOTSUPP;
408#endif
409#ifndef CONFIG_NETFILTER_EGRESS
410 if (reg->hooknum == NF_NETDEV_EGRESS)
411 return -EOPNOTSUPP;
412#endif
413 if ((reg->hooknum != NF_NETDEV_INGRESS &&
414 reg->hooknum != NF_NETDEV_EGRESS) ||
415 !reg->dev || dev_net(dev: reg->dev) != net)
416 return -EINVAL;
417 break;
418 case NFPROTO_INET:
419 if (reg->hooknum != NF_INET_INGRESS)
420 break;
421
422 err = nf_ingress_check(net, reg, hooknum: NF_INET_INGRESS);
423 if (err < 0)
424 return err;
425 break;
426 }
427
428 pp = nf_hook_entry_head(net, pf, hooknum: reg->hooknum, dev: reg->dev);
429 if (!pp)
430 return -EINVAL;
431
432 mutex_lock(&nf_hook_mutex);
433
434 p = nf_entry_dereference(*pp);
435 new_hooks = nf_hook_entries_grow(old: p, reg);
436
437 if (!IS_ERR(ptr: new_hooks)) {
438 hooks_validate(hooks: new_hooks);
439 rcu_assign_pointer(*pp, new_hooks);
440 }
441
442 mutex_unlock(lock: &nf_hook_mutex);
443 if (IS_ERR(ptr: new_hooks))
444 return PTR_ERR(ptr: new_hooks);
445
446#ifdef CONFIG_NETFILTER_INGRESS
447 if (nf_ingress_hook(reg, pf))
448 net_inc_ingress_queue();
449#endif
450#ifdef CONFIG_NETFILTER_EGRESS
451 if (nf_egress_hook(reg, pf))
452 net_inc_egress_queue();
453#endif
454 nf_static_key_inc(reg, pf);
455
456 BUG_ON(p == new_hooks);
457 nf_hook_entries_free(e: p);
458 return 0;
459}
460
461/*
462 * nf_remove_net_hook - remove a hook from blob
463 *
464 * @oldp: current address of hook blob
465 * @unreg: hook to unregister
466 *
467 * This cannot fail, hook unregistration must always succeed.
468 * Therefore replace the to-be-removed hook with a dummy hook.
469 */
470static bool nf_remove_net_hook(struct nf_hook_entries *old,
471 const struct nf_hook_ops *unreg)
472{
473 struct nf_hook_ops **orig_ops;
474 unsigned int i;
475
476 orig_ops = nf_hook_entries_get_hook_ops(e: old);
477 for (i = 0; i < old->num_hook_entries; i++) {
478 if (orig_ops[i] != unreg)
479 continue;
480 WRITE_ONCE(old->hooks[i].hook, accept_all);
481 WRITE_ONCE(orig_ops[i], (void *)&dummy_ops);
482 return true;
483 }
484
485 return false;
486}
487
488static void __nf_unregister_net_hook(struct net *net, int pf,
489 const struct nf_hook_ops *reg)
490{
491 struct nf_hook_entries __rcu **pp;
492 struct nf_hook_entries *p;
493
494 pp = nf_hook_entry_head(net, pf, hooknum: reg->hooknum, dev: reg->dev);
495 if (!pp)
496 return;
497
498 mutex_lock(&nf_hook_mutex);
499
500 p = nf_entry_dereference(*pp);
501 if (WARN_ON_ONCE(!p)) {
502 mutex_unlock(lock: &nf_hook_mutex);
503 return;
504 }
505
506 if (nf_remove_net_hook(old: p, unreg: reg)) {
507#ifdef CONFIG_NETFILTER_INGRESS
508 if (nf_ingress_hook(reg, pf))
509 net_dec_ingress_queue();
510#endif
511#ifdef CONFIG_NETFILTER_EGRESS
512 if (nf_egress_hook(reg, pf))
513 net_dec_egress_queue();
514#endif
515 nf_static_key_dec(reg, pf);
516 } else {
517 WARN_ONCE(1, "hook not found, pf %d num %d", pf, reg->hooknum);
518 }
519
520 p = __nf_hook_entries_try_shrink(old: p, pp);
521 mutex_unlock(lock: &nf_hook_mutex);
522 if (!p)
523 return;
524
525 nf_queue_nf_hook_drop(net);
526 nf_hook_entries_free(e: p);
527}
528
529void nf_unregister_net_hook(struct net *net, const struct nf_hook_ops *reg)
530{
531 if (reg->pf == NFPROTO_INET) {
532 if (reg->hooknum == NF_INET_INGRESS) {
533 __nf_unregister_net_hook(net, pf: NFPROTO_INET, reg);
534 } else {
535 __nf_unregister_net_hook(net, pf: NFPROTO_IPV4, reg);
536 __nf_unregister_net_hook(net, pf: NFPROTO_IPV6, reg);
537 }
538 } else {
539 __nf_unregister_net_hook(net, pf: reg->pf, reg);
540 }
541}
542EXPORT_SYMBOL(nf_unregister_net_hook);
543
544void nf_hook_entries_delete_raw(struct nf_hook_entries __rcu **pp,
545 const struct nf_hook_ops *reg)
546{
547 struct nf_hook_entries *p;
548
549 p = rcu_dereference_raw(*pp);
550 if (nf_remove_net_hook(old: p, unreg: reg)) {
551 p = __nf_hook_entries_try_shrink(old: p, pp);
552 nf_hook_entries_free(e: p);
553 }
554}
555EXPORT_SYMBOL_GPL(nf_hook_entries_delete_raw);
556
557int nf_register_net_hook(struct net *net, const struct nf_hook_ops *reg)
558{
559 int err;
560
561 if (reg->pf == NFPROTO_INET) {
562 if (reg->hooknum == NF_INET_INGRESS) {
563 err = __nf_register_net_hook(net, pf: NFPROTO_INET, reg);
564 if (err < 0)
565 return err;
566 } else {
567 err = __nf_register_net_hook(net, pf: NFPROTO_IPV4, reg);
568 if (err < 0)
569 return err;
570
571 err = __nf_register_net_hook(net, pf: NFPROTO_IPV6, reg);
572 if (err < 0) {
573 __nf_unregister_net_hook(net, pf: NFPROTO_IPV4, reg);
574 return err;
575 }
576 }
577 } else {
578 err = __nf_register_net_hook(net, pf: reg->pf, reg);
579 if (err < 0)
580 return err;
581 }
582
583 return 0;
584}
585EXPORT_SYMBOL(nf_register_net_hook);
586
587int nf_register_net_hooks(struct net *net, const struct nf_hook_ops *reg,
588 unsigned int n)
589{
590 unsigned int i;
591 int err = 0;
592
593 for (i = 0; i < n; i++) {
594 err = nf_register_net_hook(net, &reg[i]);
595 if (err)
596 goto err;
597 }
598 return err;
599
600err:
601 if (i > 0)
602 nf_unregister_net_hooks(net, reg, n: i);
603 return err;
604}
605EXPORT_SYMBOL(nf_register_net_hooks);
606
607void nf_unregister_net_hooks(struct net *net, const struct nf_hook_ops *reg,
608 unsigned int hookcount)
609{
610 unsigned int i;
611
612 for (i = 0; i < hookcount; i++)
613 nf_unregister_net_hook(net, &reg[i]);
614}
615EXPORT_SYMBOL(nf_unregister_net_hooks);
616
617/* Returns 1 if okfn() needs to be executed by the caller,
618 * -EPERM for NF_DROP, 0 otherwise. Caller must hold rcu_read_lock. */
619int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state,
620 const struct nf_hook_entries *e, unsigned int s)
621{
622 unsigned int verdict;
623 int ret;
624
625 for (; s < e->num_hook_entries; s++) {
626 verdict = nf_hook_entry_hookfn(entry: &e->hooks[s], skb, state);
627 switch (verdict & NF_VERDICT_MASK) {
628 case NF_ACCEPT:
629 break;
630 case NF_DROP:
631 kfree_skb_reason(skb,
632 reason: SKB_DROP_REASON_NETFILTER_DROP);
633 ret = NF_DROP_GETERR(verdict);
634 if (ret == 0)
635 ret = -EPERM;
636 return ret;
637 case NF_QUEUE:
638 ret = nf_queue(skb, state, index: s, verdict);
639 if (ret == 1)
640 continue;
641 return ret;
642 case NF_STOLEN:
643 return NF_DROP_GETERR(verdict);
644 default:
645 WARN_ON_ONCE(1);
646 return 0;
647 }
648 }
649
650 return 1;
651}
652EXPORT_SYMBOL(nf_hook_slow);
653
654void nf_hook_slow_list(struct list_head *head, struct nf_hook_state *state,
655 const struct nf_hook_entries *e)
656{
657 struct sk_buff *skb, *next;
658 struct list_head sublist;
659 int ret;
660
661 INIT_LIST_HEAD(list: &sublist);
662
663 list_for_each_entry_safe(skb, next, head, list) {
664 skb_list_del_init(skb);
665 ret = nf_hook_slow(skb, state, e, 0);
666 if (ret == 1)
667 list_add_tail(new: &skb->list, head: &sublist);
668 }
669 /* Put passed packets back on main list */
670 list_splice(list: &sublist, head);
671}
672EXPORT_SYMBOL(nf_hook_slow_list);
673
674/* This needs to be compiled in any case to avoid dependencies between the
675 * nfnetlink_queue code and nf_conntrack.
676 */
677const struct nfnl_ct_hook __rcu *nfnl_ct_hook __read_mostly;
678EXPORT_SYMBOL_GPL(nfnl_ct_hook);
679
680const struct nf_ct_hook __rcu *nf_ct_hook __read_mostly;
681EXPORT_SYMBOL_GPL(nf_ct_hook);
682
683const struct nf_defrag_hook __rcu *nf_defrag_v4_hook __read_mostly;
684EXPORT_SYMBOL_GPL(nf_defrag_v4_hook);
685
686const struct nf_defrag_hook __rcu *nf_defrag_v6_hook __read_mostly;
687EXPORT_SYMBOL_GPL(nf_defrag_v6_hook);
688
689#if IS_ENABLED(CONFIG_NF_CONNTRACK)
690u8 nf_ctnetlink_has_listener;
691EXPORT_SYMBOL_GPL(nf_ctnetlink_has_listener);
692
693const struct nf_nat_hook __rcu *nf_nat_hook __read_mostly;
694EXPORT_SYMBOL_GPL(nf_nat_hook);
695
696/* This does not belong here, but locally generated errors need it if connection
697 * tracking in use: without this, connection may not be in hash table, and hence
698 * manufactured ICMP or RST packets will not be associated with it.
699 */
700void nf_ct_attach(struct sk_buff *new, const struct sk_buff *skb)
701{
702 const struct nf_ct_hook *ct_hook;
703
704 if (skb->_nfct) {
705 rcu_read_lock();
706 ct_hook = rcu_dereference(nf_ct_hook);
707 if (ct_hook)
708 ct_hook->attach(new, skb);
709 rcu_read_unlock();
710 }
711}
712EXPORT_SYMBOL(nf_ct_attach);
713
714void nf_conntrack_destroy(struct nf_conntrack *nfct)
715{
716 const struct nf_ct_hook *ct_hook;
717
718 rcu_read_lock();
719 ct_hook = rcu_dereference(nf_ct_hook);
720 if (ct_hook)
721 ct_hook->destroy(nfct);
722 rcu_read_unlock();
723
724 WARN_ON(!ct_hook);
725}
726EXPORT_SYMBOL(nf_conntrack_destroy);
727
728void nf_ct_set_closing(struct nf_conntrack *nfct)
729{
730 const struct nf_ct_hook *ct_hook;
731
732 if (!nfct)
733 return;
734
735 rcu_read_lock();
736 ct_hook = rcu_dereference(nf_ct_hook);
737 if (ct_hook)
738 ct_hook->set_closing(nfct);
739
740 rcu_read_unlock();
741}
742EXPORT_SYMBOL_GPL(nf_ct_set_closing);
743
744bool nf_ct_get_tuple_skb(struct nf_conntrack_tuple *dst_tuple,
745 const struct sk_buff *skb)
746{
747 const struct nf_ct_hook *ct_hook;
748 bool ret = false;
749
750 rcu_read_lock();
751 ct_hook = rcu_dereference(nf_ct_hook);
752 if (ct_hook)
753 ret = ct_hook->get_tuple_skb(dst_tuple, skb);
754 rcu_read_unlock();
755 return ret;
756}
757EXPORT_SYMBOL(nf_ct_get_tuple_skb);
758
759/* Built-in default zone used e.g. by modules. */
760const struct nf_conntrack_zone nf_ct_zone_dflt = {
761 .id = NF_CT_DEFAULT_ZONE_ID,
762 .dir = NF_CT_DEFAULT_ZONE_DIR,
763};
764EXPORT_SYMBOL_GPL(nf_ct_zone_dflt);
765#endif /* CONFIG_NF_CONNTRACK */
766
767static void __net_init
768__netfilter_net_init(struct nf_hook_entries __rcu **e, int max)
769{
770 int h;
771
772 for (h = 0; h < max; h++)
773 RCU_INIT_POINTER(e[h], NULL);
774}
775
776static int __net_init netfilter_net_init(struct net *net)
777{
778 __netfilter_net_init(e: net->nf.hooks_ipv4, ARRAY_SIZE(net->nf.hooks_ipv4));
779 __netfilter_net_init(e: net->nf.hooks_ipv6, ARRAY_SIZE(net->nf.hooks_ipv6));
780#ifdef CONFIG_NETFILTER_FAMILY_ARP
781 __netfilter_net_init(e: net->nf.hooks_arp, ARRAY_SIZE(net->nf.hooks_arp));
782#endif
783#ifdef CONFIG_NETFILTER_FAMILY_BRIDGE
784 __netfilter_net_init(e: net->nf.hooks_bridge, ARRAY_SIZE(net->nf.hooks_bridge));
785#endif
786#ifdef CONFIG_PROC_FS
787 net->nf.proc_netfilter = proc_net_mkdir(net, name: "netfilter",
788 parent: net->proc_net);
789 if (!net->nf.proc_netfilter) {
790 if (!net_eq(net1: net, net2: &init_net))
791 pr_err("cannot create netfilter proc entry");
792
793 return -ENOMEM;
794 }
795#endif
796
797 return 0;
798}
799
800static void __net_exit netfilter_net_exit(struct net *net)
801{
802 remove_proc_entry("netfilter", net->proc_net);
803}
804
805static struct pernet_operations netfilter_net_ops = {
806 .init = netfilter_net_init,
807 .exit = netfilter_net_exit,
808};
809
810int __init netfilter_init(void)
811{
812 int ret;
813
814 ret = register_pernet_subsys(&netfilter_net_ops);
815 if (ret < 0)
816 goto err;
817
818 ret = netfilter_log_init();
819 if (ret < 0)
820 goto err_pernet;
821
822 return 0;
823err_pernet:
824 unregister_pernet_subsys(&netfilter_net_ops);
825err:
826 return ret;
827}
828

source code of linux/net/netfilter/core.c