Commit 5418d388 authored by Lukas Wunner's avatar Lukas Wunner Committed by Pablo Neira Ayuso
Browse files

netfilter: Generalize ingress hook 



Prepare for addition of a netfilter egress hook by generalizing the
ingress hook introduced by commit e687ad60 ("netfilter: add
netfilter ingress hook after handle_ing() under unique static key").

In particular, rename and refactor the ingress hook's static inlines
such that they can be reused for an egress hook.

No functional change intended.

Signed-off-by: default avatarLukas Wunner <lukas@wunner.de>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent b030f194

include/linux/netfilter_netdev.h

+31 −14
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0 */

#ifndef _NETFILTER_INGRESS_H_

#define _NETFILTER_INGRESS_H_

#ifndef _NETFILTER_NETDEV_H_

#define _NETFILTER_NETDEV_H_



#include <linux/netfilter.h>

#include <linux/netdevice.h>



#ifdef CONFIG_NETFILTER_INGRESS

static inline bool nf_hook_ingress_active(const struct sk_buff *skb)

#ifdef CONFIG_NETFILTER

static __always_inline bool nf_hook_netdev_active(enum nf_dev_hooks hooknum,

					  struct nf_hook_entries __rcu *hooks)

{

#ifdef CONFIG_JUMP_LABEL

	if (!static_key_false(&nf_hooks_needed[NFPROTO_NETDEV][NF_NETDEV_INGRESS]))

	if (!static_key_false(&nf_hooks_needed[NFPROTO_NETDEV][hooknum]))

		return false;

#endif

	return rcu_access_pointer(skb->dev->nf_hooks_ingress);

	return rcu_access_pointer(hooks);

}



/* caller must hold rcu_read_lock */

static inline int nf_hook_ingress(struct sk_buff *skb)

static __always_inline int nf_hook_netdev(struct sk_buff *skb,

					  enum nf_dev_hooks hooknum,

					  struct nf_hook_entries __rcu *hooks)

{

	struct nf_hook_entries *e = rcu_dereference(skb->dev->nf_hooks_ingress);

	struct nf_hook_entries *e = rcu_dereference(hooks);

	struct nf_hook_state state;

	int ret;



	/* Must recheck the ingress hook head, in the event it became NULL

	 * after the check in nf_hook_ingress_active evaluated to true.

	/* Must recheck the hook head, in the event it became NULL

	 * after the check in nf_hook_netdev_active evaluated to true.

	 */

	if (unlikely(!e))

		return 0;



	nf_hook_state_init(&state, NF_NETDEV_INGRESS,

	nf_hook_state_init(&state, hooknum,

			   NFPROTO_NETDEV, skb->dev, NULL, NULL,

			   dev_net(skb->dev), NULL);

	ret = nf_hook_slow(skb, &state, e, 0);
@@ -37,10 +40,26 @@ static inline int nf_hook_ingress(struct sk_buff *skb) 


	return ret;

}

#endif /* CONFIG_NETFILTER */



static inline void nf_hook_ingress_init(struct net_device *dev)

static inline void nf_hook_netdev_init(struct net_device *dev)

{

#ifdef CONFIG_NETFILTER_INGRESS

	RCU_INIT_POINTER(dev->nf_hooks_ingress, NULL);

#endif

}



#ifdef CONFIG_NETFILTER_INGRESS

static inline bool nf_hook_ingress_active(const struct sk_buff *skb)

{

	return nf_hook_netdev_active(NF_NETDEV_INGRESS,

				     skb->dev->nf_hooks_ingress);

}



static inline int nf_hook_ingress(struct sk_buff *skb)

{

	return nf_hook_netdev(skb, NF_NETDEV_INGRESS,

			      skb->dev->nf_hooks_ingress);

}

#else /* CONFIG_NETFILTER_INGRESS */

static inline int nf_hook_ingress_active(struct sk_buff *skb)
@@ -52,7 +71,5 @@ static inline int nf_hook_ingress(struct sk_buff *skb) 
{

	return 0;

}



static inline void nf_hook_ingress_init(struct net_device *dev) {}

#endif /* CONFIG_NETFILTER_INGRESS */

#endif /* _NETFILTER_INGRESS_H_ */

net/core/dev.c

+1 −1
Original line number Diff line number Diff line
@@ -9846,7 +9846,7 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name, 
	if (!dev->ethtool_ops)

		dev->ethtool_ops = &default_ethtool_ops;



	nf_hook_ingress_init(dev);

	nf_hook_netdev_init(dev);



	return dev;

CRA Git | Maintained and supported by SUSTech CRA and CCSE