Commit 29a26a56 authored by Eric W. Biederman's avatar Eric W. Biederman Committed by David S. Miller
Browse files

netfilter: Pass struct net into the netfilter hooks 



Pass a network namespace parameter into the netfilter hooks.  At the
call site of the netfilter hooks the path a packet is taking through
the network stack is well known which allows the network namespace to
be easily and reliabily.

This allows the replacement of magic code like
"dev_net(state->in?:state->out)" that appears at the start of most
netfilter hooks with "state->net".

In almost all cases the network namespace passed in is derived
from the first network device passed in, guaranteeing those
paths will not see any changes in practice.

The exceptions are:
xfrm/xfrm_output.c:xfrm_output_resume()         xs_net(skb_dst(skb)->xfrm)
ipvs/ip_vs_xmit.c:ip_vs_nat_send_or_cont()      ip_vs_conn_net(cp)
ipvs/ip_vs_xmit.c:ip_vs_send_or_cont()          ip_vs_conn_net(cp)
ipv4/raw.c:raw_send_hdrinc()                    sock_net(sk)
ipv6/ip6_output.c:ip6_xmit()			sock_net(sk)
ipv6/ndisc.c:ndisc_send_skb()                   dev_net(skb->dev) not dev_net(dst->dev)
ipv6/raw.c:raw6_send_hdrinc()                   sock_net(sk)
br_netfilter_hooks.c:br_nf_pre_routing_finish() dev_net(skb->dev) before skb->dev is set to nf_bridge->physindev

In all cases these exceptions seem to be a better expression for the
network namespace the packet is being processed in then the historic
"dev_net(in?in:out)".  I am documenting them in case something odd
pops up and someone starts trying to track down what happened.

Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 04eb4489

drivers/net/vrf.c

+4 −3
Original line number Diff line number Diff line
@@ -298,14 +298,15 @@ err: 
static int vrf_output(struct sock *sk, struct sk_buff *skb)

{

	struct net_device *dev = skb_dst(skb)->dev;

	struct net *net = dev_net(dev);



	IP_UPD_PO_STATS(dev_net(dev), IPSTATS_MIB_OUT, skb->len);

	IP_UPD_PO_STATS(net, IPSTATS_MIB_OUT, skb->len);



	skb->dev = dev;

	skb->protocol = htons(ETH_P_IP);



	return NF_HOOK_COND(NFPROTO_IPV4, NF_INET_POST_ROUTING, sk, skb,

			    NULL, dev,

	return NF_HOOK_COND(NFPROTO_IPV4, NF_INET_POST_ROUTING,

			    net, sk, skb, NULL, dev,

			    vrf_finish_output,

			    !(IPCB(skb)->flags & IPSKB_REROUTED));

}

include/linux/netfilter.h

+12 −15
Original line number Diff line number Diff line
@@ -190,12 +190,11 @@ static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook, 
	return 1;

}



static inline int nf_hook(u_int8_t pf, unsigned int hook, struct sock *sk,

			  struct sk_buff *skb, struct net_device *indev,

			  struct net_device *outdev,

static inline int nf_hook(u_int8_t pf, unsigned int hook, struct net *net,

			  struct sock *sk, struct sk_buff *skb,

			  struct net_device *indev, struct net_device *outdev,

			  int (*okfn)(struct sock *, struct sk_buff *))

{

	struct net *net = dev_net(indev ? indev : outdev);

	return nf_hook_thresh(pf, hook, net, sk, skb, indev, outdev, okfn, INT_MIN);

}
@@ -217,12 +216,11 @@ static inline int nf_hook(u_int8_t pf, unsigned int hook, struct sock *sk, 
*/



static inline int

NF_HOOK_THRESH(uint8_t pf, unsigned int hook, struct sock *sk,

NF_HOOK_THRESH(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk,

	       struct sk_buff *skb, struct net_device *in,

	       struct net_device *out,

	       int (*okfn)(struct sock *, struct sk_buff *), int thresh)

{

	struct net *net = dev_net(in ? in : out);

	int ret = nf_hook_thresh(pf, hook, net, sk, skb, in, out, okfn, thresh);

	if (ret == 1)

		ret = okfn(sk, skb);
@@ -230,11 +228,10 @@ NF_HOOK_THRESH(uint8_t pf, unsigned int hook, struct sock *sk, 
}



static inline int

NF_HOOK_COND(uint8_t pf, unsigned int hook, struct sock *sk,

NF_HOOK_COND(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk,

	     struct sk_buff *skb, struct net_device *in, struct net_device *out,

	     int (*okfn)(struct sock *, struct sk_buff *), bool cond)

{

	struct net *net = dev_net(in ? in : out);

	int ret;



	if (!cond ||
@@ -244,11 +241,11 @@ NF_HOOK_COND(uint8_t pf, unsigned int hook, struct sock *sk, 
}



static inline int

NF_HOOK(uint8_t pf, unsigned int hook, struct sock *sk, struct sk_buff *skb,

NF_HOOK(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk, struct sk_buff *skb,

	struct net_device *in, struct net_device *out,

	int (*okfn)(struct sock *, struct sk_buff *))

{

	return NF_HOOK_THRESH(pf, hook, sk, skb, in, out, okfn, INT_MIN);

	return NF_HOOK_THRESH(pf, hook, net, sk, skb, in, out, okfn, INT_MIN);

}



/* Call setsockopt() */
@@ -348,11 +345,11 @@ nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family) 
}



#else /* !CONFIG_NETFILTER */

#define NF_HOOK(pf, hook, sk, skb, indev, outdev, okfn) (okfn)(sk, skb)

#define NF_HOOK_COND(pf, hook, sk, skb, indev, outdev, okfn, cond) (okfn)(sk, skb)

static inline int nf_hook(u_int8_t pf, unsigned int hook, struct sock *sk,

			  struct sk_buff *skb, struct net_device *indev,

			  struct net_device *outdev,

#define NF_HOOK(pf, hook, net, sk, skb, indev, outdev, okfn) (okfn)(sk, skb)

#define NF_HOOK_COND(pf, hook, net, sk, skb, indev, outdev, okfn, cond) (okfn)(sk, skb)

static inline int nf_hook(u_int8_t pf, unsigned int hook, struct net *net,

			  struct sock *sk, struct sk_buff *skb,

			  struct net_device *indev, struct net_device *outdev,

			  int (*okfn)(struct sock *, struct sk_buff *))

{

	return 1;

net/bridge/br_forward.c

+7 −6
Original line number Diff line number Diff line
@@ -67,8 +67,9 @@ EXPORT_SYMBOL_GPL(br_dev_queue_push_xmit); 


int br_forward_finish(struct sock *sk, struct sk_buff *skb)

{

	return NF_HOOK(NFPROTO_BRIDGE, NF_BR_POST_ROUTING, sk, skb,

		       NULL, skb->dev,

	struct net *net = dev_net(skb->dev);

	return NF_HOOK(NFPROTO_BRIDGE, NF_BR_POST_ROUTING,

		       net, sk, skb, NULL, skb->dev,

		       br_dev_queue_push_xmit);



}
@@ -92,8 +93,8 @@ static void __br_deliver(const struct net_bridge_port *to, struct sk_buff *skb) 
		return;

	}



	NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, NULL, skb,

		NULL, skb->dev,

	NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT,

		dev_net(skb->dev), NULL, skb,NULL, skb->dev,

		br_forward_finish);

}
@@ -114,8 +115,8 @@ static void __br_forward(const struct net_bridge_port *to, struct sk_buff *skb) 
	skb->dev = to->dev;

	skb_forward_csum(skb);



	NF_HOOK(NFPROTO_BRIDGE, NF_BR_FORWARD, NULL, skb,

		indev, skb->dev,

	NF_HOOK(NFPROTO_BRIDGE, NF_BR_FORWARD,

		dev_net(indev), NULL, skb, indev, skb->dev,

		br_forward_finish);

}

net/bridge/br_input.c

+7 −6
Original line number Diff line number Diff line
@@ -60,8 +60,8 @@ static int br_pass_frame_up(struct sk_buff *skb) 
	if (!skb)

		return NET_RX_DROP;



	return NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN, NULL, skb,

		       indev, NULL,

	return NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN,

		       dev_net(indev), NULL, skb, indev, NULL,

		       br_netif_receive_skb);

}
@@ -283,8 +283,9 @@ rx_handler_result_t br_handle_frame(struct sk_buff **pskb) 
		}



		/* Deliver packet to local host only */

		if (NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN, NULL, skb,

			    skb->dev, NULL, br_handle_local_finish)) {

		if (NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN,

			    dev_net(skb->dev), NULL, skb, skb->dev, NULL,

			    br_handle_local_finish)) {

			return RX_HANDLER_CONSUMED; /* consumed by filter */

		} else {

			*pskb = skb;
@@ -308,8 +309,8 @@ forward: 
		if (ether_addr_equal(p->br->dev->dev_addr, dest))

			skb->pkt_type = PACKET_HOST;



		NF_HOOK(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING, NULL, skb,

			skb->dev, NULL,

		NF_HOOK(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING,

			dev_net(skb->dev), NULL, skb, skb->dev, NULL,

			br_handle_frame_finish);

		break;

	default:

net/bridge/br_multicast.c

+2 −2
Original line number Diff line number Diff line
@@ -829,8 +829,8 @@ static void __br_multicast_send_query(struct net_bridge *br, 


	if (port) {

		skb->dev = port->dev;

		NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, NULL, skb,

			NULL, skb->dev,

		NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT,

			dev_net(port->dev), NULL, skb, NULL, skb->dev,

			br_dev_queue_push_xmit);

	} else {

		br_multicast_select_own_querier(br, ip, skb);

CRA Git | Maintained and supported by SUSTech CRA and CCSE