| 1 |
|
| 2 | #ifndef _NETFILTER_NETDEV_H_
|
| 3 | #define _NETFILTER_NETDEV_H_
|
| 4 |
|
| 5 | #include <linux/netfilter.h>
|
| 6 | #include <linux/netdevice.h>
|
| 7 |
|
| 8 | #ifdef CONFIG_NETFILTER_INGRESS
|
| 9 | static inline bool nf_hook_ingress_active(const struct sk_buff *skb)
|
| 10 | {
|
| 11 | #ifdef CONFIG_JUMP_LABEL
|
| 12 | if (!static_key_false(&nf_hooks_needed[NFPROTO_NETDEV][NF_NETDEV_INGRESS]))
|
| 13 | return false;
|
| 14 | #endif
|
| 15 | return rcu_access_pointer(skb->dev->nf_hooks_ingress);
|
| 16 | }
|
| 17 |
|
| 18 |
|
| 19 | static inline int nf_hook_ingress(struct sk_buff *skb)
|
| 20 | {
|
| 21 | struct nf_hook_entries *e = rcu_dereference(skb->dev->nf_hooks_ingress);
|
| 22 | struct nf_hook_state state;
|
| 23 | int ret;
|
| 24 |
|
| 25 | |
| 26 | * after the check in nf_hook_ingress_active evaluated to true.
|
| 27 |
|
| 28 | if (unlikely(!e))
|
| 29 | return 0;
|
| 30 |
|
| 31 | nf_hook_state_init(&state, NF_NETDEV_INGRESS,
|
| 32 | NFPROTO_NETDEV, skb->dev, NULL, NULL,
|
| 33 | dev_net(skb->dev), NULL);
|
| 34 | ret = nf_hook_slow(skb, &state, e, 0);
|
| 35 | if (ret == 0)
|
| 36 | return -1;
|
| 37 |
|
| 38 | return ret;
|
| 39 | }
|
| 40 |
|
| 41 | #else
|
| 42 | static inline int nf_hook_ingress_active(struct sk_buff *skb)
|
| 43 | {
|
| 44 | return 0;
|
| 45 | }
|
| 46 |
|
| 47 | static inline int nf_hook_ingress(struct sk_buff *skb)
|
| 48 | {
|
| 49 | return 0;
|
| 50 | }
|
| 51 | #endif
|
| 52 |
|
| 53 | #ifdef CONFIG_NETFILTER_EGRESS
|
| 54 | static inline bool nf_hook_egress_active(void)
|
| 55 | {
|
| 56 | #ifdef CONFIG_JUMP_LABEL
|
| 57 | if (!static_key_false(&nf_hooks_needed[NFPROTO_NETDEV][NF_NETDEV_EGRESS]))
|
| 58 | return false;
|
| 59 | #endif
|
| 60 | return true;
|
| 61 | }
|
| 62 |
|
| 63 | |
| 64 | * nf_hook_egress - classify packets before transmission
|
| 65 | * @skb: packet to be classified
|
| 66 | * @rc: result code which shall be returned by __dev_queue_xmit() on failure
|
| 67 | * @dev: netdev whose egress hooks shall be applied to @skb
|
| 68 | *
|
| 69 | * Caller must hold rcu_read_lock.
|
| 70 | *
|
| 71 | * On ingress, packets are classified first by tc, then by netfilter.
|
| 72 | * On egress, the order is reversed for symmetry. Conceptually, tc and
|
| 73 | * netfilter can be thought of as layers, with netfilter layered above tc:
|
| 74 | * When tc redirects a packet to another interface, netfilter is not applied
|
| 75 | * because the packet is on the tc layer.
|
| 76 | *
|
| 77 | * The nf_skip_egress flag controls whether netfilter is applied on egress.
|
| 78 | * It is updated by __netif_receive_skb_core() and __dev_queue_xmit() when the
|
| 79 | * packet passes through tc and netfilter. Because __dev_queue_xmit() may be
|
| 80 | * called recursively by tunnel drivers such as vxlan, the flag is reverted to
|
| 81 | * false after sch_handle_egress(). This ensures that netfilter is applied
|
| 82 | * both on the overlay and underlying network.
|
| 83 | *
|
| 84 | * Returns: @skb on success or %NULL if the packet was consumed or filtered.
|
| 85 |
|
| 86 | static inline struct sk_buff *nf_hook_egress(struct sk_buff *skb, int *rc,
|
| 87 | struct net_device *dev)
|
| 88 | {
|
| 89 | struct nf_hook_entries *e;
|
| 90 | struct nf_hook_state state;
|
| 91 | int ret;
|
| 92 |
|
| 93 | #ifdef CONFIG_NETFILTER_SKIP_EGRESS
|
| 94 | if (skb->nf_skip_egress)
|
| 95 | return skb;
|
| 96 | #endif
|
| 97 |
|
| 98 | e = rcu_dereference_check(dev->nf_hooks_egress, rcu_read_lock_bh_held());
|
| 99 | if (!e)
|
| 100 | return skb;
|
| 101 |
|
| 102 | nf_hook_state_init(&state, NF_NETDEV_EGRESS,
|
| 103 | NFPROTO_NETDEV, NULL, dev, NULL,
|
| 104 | dev_net(dev), NULL);
|
| 105 |
|
| 106 |
|
| 107 | rcu_read_lock();
|
| 108 | ret = nf_hook_slow(skb, &state, e, 0);
|
| 109 | rcu_read_unlock();
|
| 110 |
|
| 111 | if (ret == 1) {
|
| 112 | return skb;
|
| 113 | } else if (ret < 0) {
|
| 114 | *rc = NET_XMIT_DROP;
|
| 115 | return NULL;
|
| 116 | } else {
|
| 117 | *rc = NET_XMIT_SUCCESS;
|
| 118 | return NULL;
|
| 119 | }
|
| 120 | }
|
| 121 | #else
|
| 122 | static inline bool nf_hook_egress_active(void)
|
| 123 | {
|
| 124 | return false;
|
| 125 | }
|
| 126 |
|
| 127 | static inline struct sk_buff *nf_hook_egress(struct sk_buff *skb, int *rc,
|
| 128 | struct net_device *dev)
|
| 129 | {
|
| 130 | return skb;
|
| 131 | }
|
| 132 | #endif
|
| 133 |
|
| 134 | static inline void nf_skip_egress(struct sk_buff *skb, bool skip)
|
| 135 | {
|
| 136 | #ifdef CONFIG_NET_EGRESS
|
| 137 | skb->nf_skip_egress = skip;
|
| 138 | #endif
|
| 139 | }
|
| 140 |
|
| 141 | static inline void nf_hook_netdev_init(struct net_device *dev)
|
| 142 | {
|
| 143 | #ifdef CONFIG_NETFILTER_INGRESS
|
| 144 | RCU_INIT_POINTER(dev->nf_hooks_ingress, NULL);
|
| 145 | #endif
|
| 146 | #ifdef CONFIG_NETFILTER_EGRESS
|
| 147 | RCU_INIT_POINTER(dev->nf_hooks_egress, NULL);
|
| 148 | #endif
|
| 149 | }
|
| 150 |
|
| 151 | #endif
|