1 #include <linux/init.h>
2 #include <linux/kernel.h>
3 #include <linux/netdevice.h>
4 #include <net/net_namespace.h>
5 #include <net/netfilter/nf_tables.h>
6 #include <linux/netfilter_ipv4.h>
7 #include <linux/netfilter_ipv6.h>
8 #include <linux/netfilter_bridge.h>
9 #include <linux/netfilter_arp.h>
10 #include <net/netfilter/nf_tables_ipv4.h>
11 #include <net/netfilter/nf_tables_ipv6.h>
13 #ifdef CONFIG_NF_TABLES_IPV4
14 static unsigned int nft_do_chain_ipv4(void *priv
,
16 const struct nf_hook_state
*state
)
18 struct nft_pktinfo pkt
;
20 nft_set_pktinfo(&pkt
, skb
, state
);
21 nft_set_pktinfo_ipv4(&pkt
, skb
);
23 return nft_do_chain(&pkt
, priv
);
26 static const struct nft_chain_type nft_chain_filter_ipv4
= {
28 .type
= NFT_CHAIN_T_DEFAULT
,
29 .family
= NFPROTO_IPV4
,
30 .hook_mask
= (1 << NF_INET_LOCAL_IN
) |
31 (1 << NF_INET_LOCAL_OUT
) |
32 (1 << NF_INET_FORWARD
) |
33 (1 << NF_INET_PRE_ROUTING
) |
34 (1 << NF_INET_POST_ROUTING
),
36 [NF_INET_LOCAL_IN
] = nft_do_chain_ipv4
,
37 [NF_INET_LOCAL_OUT
] = nft_do_chain_ipv4
,
38 [NF_INET_FORWARD
] = nft_do_chain_ipv4
,
39 [NF_INET_PRE_ROUTING
] = nft_do_chain_ipv4
,
40 [NF_INET_POST_ROUTING
] = nft_do_chain_ipv4
,
44 static void nft_chain_filter_ipv4_init(void)
46 nft_register_chain_type(&nft_chain_filter_ipv4
);
48 static void nft_chain_filter_ipv4_fini(void)
50 nft_unregister_chain_type(&nft_chain_filter_ipv4
);
54 static inline void nft_chain_filter_ipv4_init(void) {}
55 static inline void nft_chain_filter_ipv4_fini(void) {}
56 #endif /* CONFIG_NF_TABLES_IPV4 */
58 #ifdef CONFIG_NF_TABLES_ARP
59 static unsigned int nft_do_chain_arp(void *priv
, struct sk_buff
*skb
,
60 const struct nf_hook_state
*state
)
62 struct nft_pktinfo pkt
;
64 nft_set_pktinfo(&pkt
, skb
, state
);
65 nft_set_pktinfo_unspec(&pkt
, skb
);
67 return nft_do_chain(&pkt
, priv
);
70 static const struct nft_chain_type nft_chain_filter_arp
= {
72 .type
= NFT_CHAIN_T_DEFAULT
,
73 .family
= NFPROTO_ARP
,
75 .hook_mask
= (1 << NF_ARP_IN
) |
78 [NF_ARP_IN
] = nft_do_chain_arp
,
79 [NF_ARP_OUT
] = nft_do_chain_arp
,
83 static void nft_chain_filter_arp_init(void)
85 nft_register_chain_type(&nft_chain_filter_arp
);
88 static void nft_chain_filter_arp_fini(void)
90 nft_unregister_chain_type(&nft_chain_filter_arp
);
93 static inline void nft_chain_filter_arp_init(void) {}
94 static inline void nft_chain_filter_arp_fini(void) {}
95 #endif /* CONFIG_NF_TABLES_ARP */
97 #ifdef CONFIG_NF_TABLES_IPV6
98 static unsigned int nft_do_chain_ipv6(void *priv
,
100 const struct nf_hook_state
*state
)
102 struct nft_pktinfo pkt
;
104 nft_set_pktinfo(&pkt
, skb
, state
);
105 nft_set_pktinfo_ipv6(&pkt
, skb
);
107 return nft_do_chain(&pkt
, priv
);
110 static const struct nft_chain_type nft_chain_filter_ipv6
= {
112 .type
= NFT_CHAIN_T_DEFAULT
,
113 .family
= NFPROTO_IPV6
,
114 .hook_mask
= (1 << NF_INET_LOCAL_IN
) |
115 (1 << NF_INET_LOCAL_OUT
) |
116 (1 << NF_INET_FORWARD
) |
117 (1 << NF_INET_PRE_ROUTING
) |
118 (1 << NF_INET_POST_ROUTING
),
120 [NF_INET_LOCAL_IN
] = nft_do_chain_ipv6
,
121 [NF_INET_LOCAL_OUT
] = nft_do_chain_ipv6
,
122 [NF_INET_FORWARD
] = nft_do_chain_ipv6
,
123 [NF_INET_PRE_ROUTING
] = nft_do_chain_ipv6
,
124 [NF_INET_POST_ROUTING
] = nft_do_chain_ipv6
,
128 static void nft_chain_filter_ipv6_init(void)
130 nft_register_chain_type(&nft_chain_filter_ipv6
);
133 static void nft_chain_filter_ipv6_fini(void)
135 nft_unregister_chain_type(&nft_chain_filter_ipv6
);
138 static inline void nft_chain_filter_ipv6_init(void) {}
139 static inline void nft_chain_filter_ipv6_fini(void) {}
140 #endif /* CONFIG_NF_TABLES_IPV6 */
142 #ifdef CONFIG_NF_TABLES_INET
143 static unsigned int nft_do_chain_inet(void *priv
, struct sk_buff
*skb
,
144 const struct nf_hook_state
*state
)
146 struct nft_pktinfo pkt
;
148 nft_set_pktinfo(&pkt
, skb
, state
);
152 nft_set_pktinfo_ipv4(&pkt
, skb
);
155 nft_set_pktinfo_ipv6(&pkt
, skb
);
161 return nft_do_chain(&pkt
, priv
);
164 static unsigned int nft_do_chain_inet_ingress(void *priv
, struct sk_buff
*skb
,
165 const struct nf_hook_state
*state
)
167 struct nf_hook_state ingress_state
= *state
;
168 struct nft_pktinfo pkt
;
170 switch (skb
->protocol
) {
171 case htons(ETH_P_IP
):
172 /* Original hook is NFPROTO_NETDEV and NF_NETDEV_INGRESS. */
173 ingress_state
.pf
= NFPROTO_IPV4
;
174 ingress_state
.hook
= NF_INET_INGRESS
;
175 nft_set_pktinfo(&pkt
, skb
, &ingress_state
);
177 if (nft_set_pktinfo_ipv4_ingress(&pkt
, skb
) < 0)
180 case htons(ETH_P_IPV6
):
181 ingress_state
.pf
= NFPROTO_IPV6
;
182 ingress_state
.hook
= NF_INET_INGRESS
;
183 nft_set_pktinfo(&pkt
, skb
, &ingress_state
);
185 if (nft_set_pktinfo_ipv6_ingress(&pkt
, skb
) < 0)
192 return nft_do_chain(&pkt
, priv
);
195 static const struct nft_chain_type nft_chain_filter_inet
= {
197 .type
= NFT_CHAIN_T_DEFAULT
,
198 .family
= NFPROTO_INET
,
199 .hook_mask
= (1 << NF_INET_INGRESS
) |
200 (1 << NF_INET_LOCAL_IN
) |
201 (1 << NF_INET_LOCAL_OUT
) |
202 (1 << NF_INET_FORWARD
) |
203 (1 << NF_INET_PRE_ROUTING
) |
204 (1 << NF_INET_POST_ROUTING
),
206 [NF_INET_INGRESS
] = nft_do_chain_inet_ingress
,
207 [NF_INET_LOCAL_IN
] = nft_do_chain_inet
,
208 [NF_INET_LOCAL_OUT
] = nft_do_chain_inet
,
209 [NF_INET_FORWARD
] = nft_do_chain_inet
,
210 [NF_INET_PRE_ROUTING
] = nft_do_chain_inet
,
211 [NF_INET_POST_ROUTING
] = nft_do_chain_inet
,
215 static void nft_chain_filter_inet_init(void)
217 nft_register_chain_type(&nft_chain_filter_inet
);
220 static void nft_chain_filter_inet_fini(void)
222 nft_unregister_chain_type(&nft_chain_filter_inet
);
225 static inline void nft_chain_filter_inet_init(void) {}
226 static inline void nft_chain_filter_inet_fini(void) {}
227 #endif /* CONFIG_NF_TABLES_IPV6 */
229 #if IS_ENABLED(CONFIG_NF_TABLES_BRIDGE)
231 nft_do_chain_bridge(void *priv
,
233 const struct nf_hook_state
*state
)
235 struct nft_pktinfo pkt
;
237 nft_set_pktinfo(&pkt
, skb
, state
);
239 switch (eth_hdr(skb
)->h_proto
) {
240 case htons(ETH_P_IP
):
241 nft_set_pktinfo_ipv4_validate(&pkt
, skb
);
243 case htons(ETH_P_IPV6
):
244 nft_set_pktinfo_ipv6_validate(&pkt
, skb
);
247 nft_set_pktinfo_unspec(&pkt
, skb
);
251 return nft_do_chain(&pkt
, priv
);
254 static const struct nft_chain_type nft_chain_filter_bridge
= {
256 .type
= NFT_CHAIN_T_DEFAULT
,
257 .family
= NFPROTO_BRIDGE
,
258 .hook_mask
= (1 << NF_BR_PRE_ROUTING
) |
259 (1 << NF_BR_LOCAL_IN
) |
260 (1 << NF_BR_FORWARD
) |
261 (1 << NF_BR_LOCAL_OUT
) |
262 (1 << NF_BR_POST_ROUTING
),
264 [NF_BR_PRE_ROUTING
] = nft_do_chain_bridge
,
265 [NF_BR_LOCAL_IN
] = nft_do_chain_bridge
,
266 [NF_BR_FORWARD
] = nft_do_chain_bridge
,
267 [NF_BR_LOCAL_OUT
] = nft_do_chain_bridge
,
268 [NF_BR_POST_ROUTING
] = nft_do_chain_bridge
,
272 static void nft_chain_filter_bridge_init(void)
274 nft_register_chain_type(&nft_chain_filter_bridge
);
277 static void nft_chain_filter_bridge_fini(void)
279 nft_unregister_chain_type(&nft_chain_filter_bridge
);
282 static inline void nft_chain_filter_bridge_init(void) {}
283 static inline void nft_chain_filter_bridge_fini(void) {}
284 #endif /* CONFIG_NF_TABLES_BRIDGE */
286 #ifdef CONFIG_NF_TABLES_NETDEV
287 static unsigned int nft_do_chain_netdev(void *priv
, struct sk_buff
*skb
,
288 const struct nf_hook_state
*state
)
290 struct nft_pktinfo pkt
;
292 nft_set_pktinfo(&pkt
, skb
, state
);
294 switch (skb
->protocol
) {
295 case htons(ETH_P_IP
):
296 nft_set_pktinfo_ipv4_validate(&pkt
, skb
);
298 case htons(ETH_P_IPV6
):
299 nft_set_pktinfo_ipv6_validate(&pkt
, skb
);
302 nft_set_pktinfo_unspec(&pkt
, skb
);
306 return nft_do_chain(&pkt
, priv
);
309 static const struct nft_chain_type nft_chain_filter_netdev
= {
311 .type
= NFT_CHAIN_T_DEFAULT
,
312 .family
= NFPROTO_NETDEV
,
313 .hook_mask
= (1 << NF_NETDEV_INGRESS
),
315 [NF_NETDEV_INGRESS
] = nft_do_chain_netdev
,
319 static void nft_netdev_event(unsigned long event
, struct net_device
*dev
,
322 struct nft_base_chain
*basechain
= nft_base_chain(ctx
->chain
);
323 struct nft_hook
*hook
, *found
= NULL
;
326 if (event
!= NETDEV_UNREGISTER
)
329 list_for_each_entry(hook
, &basechain
->hook_list
, list
) {
330 if (hook
->ops
.dev
== dev
)
339 nf_unregister_net_hook(ctx
->net
, &found
->ops
);
340 list_del_rcu(&found
->list
);
341 kfree_rcu(found
, rcu
);
345 /* UNREGISTER events are also happening on netns exit.
347 * Although nf_tables core releases all tables/chains, only this event
348 * handler provides guarantee that hook->ops.dev is still accessible,
349 * so we cannot skip exiting net namespaces.
351 __nft_release_basechain(ctx
);
354 static int nf_tables_netdev_event(struct notifier_block
*this,
355 unsigned long event
, void *ptr
)
357 struct net_device
*dev
= netdev_notifier_info_to_dev(ptr
);
358 struct nft_table
*table
;
359 struct nft_chain
*chain
, *nr
;
360 struct nft_ctx ctx
= {
364 if (event
!= NETDEV_UNREGISTER
&&
365 event
!= NETDEV_CHANGENAME
)
368 mutex_lock(&ctx
.net
->nft
.commit_mutex
);
369 list_for_each_entry(table
, &ctx
.net
->nft
.tables
, list
) {
370 if (table
->family
!= NFPROTO_NETDEV
)
373 ctx
.family
= table
->family
;
375 list_for_each_entry_safe(chain
, nr
, &table
->chains
, list
) {
376 if (!nft_is_base_chain(chain
))
380 nft_netdev_event(event
, dev
, &ctx
);
383 mutex_unlock(&ctx
.net
->nft
.commit_mutex
);
388 static struct notifier_block nf_tables_netdev_notifier
= {
389 .notifier_call
= nf_tables_netdev_event
,
392 static int nft_chain_filter_netdev_init(void)
396 nft_register_chain_type(&nft_chain_filter_netdev
);
398 err
= register_netdevice_notifier(&nf_tables_netdev_notifier
);
400 goto err_register_netdevice_notifier
;
404 err_register_netdevice_notifier
:
405 nft_unregister_chain_type(&nft_chain_filter_netdev
);
410 static void nft_chain_filter_netdev_fini(void)
412 nft_unregister_chain_type(&nft_chain_filter_netdev
);
413 unregister_netdevice_notifier(&nf_tables_netdev_notifier
);
416 static inline int nft_chain_filter_netdev_init(void) { return 0; }
417 static inline void nft_chain_filter_netdev_fini(void) {}
418 #endif /* CONFIG_NF_TABLES_NETDEV */
420 int __init
nft_chain_filter_init(void)
424 err
= nft_chain_filter_netdev_init();
428 nft_chain_filter_ipv4_init();
429 nft_chain_filter_ipv6_init();
430 nft_chain_filter_arp_init();
431 nft_chain_filter_inet_init();
432 nft_chain_filter_bridge_init();
437 void nft_chain_filter_fini(void)
439 nft_chain_filter_bridge_fini();
440 nft_chain_filter_inet_fini();
441 nft_chain_filter_arp_fini();
442 nft_chain_filter_ipv6_fini();
443 nft_chain_filter_ipv4_fini();
444 nft_chain_filter_netdev_fini();