Changes in iptable_raw.c

94090b23 - netfilter: add missing module descriptions

Sat, 04 Nov 2023 10:14:05 +0000

netfilter: add missing module descriptionsW=1 builds warn on missing MODULE_DESCRIPTION, add them.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/iptable_raw.c

8844e010 - netfilter: iptables: allow use of ipt_do_table as hookfn

Mon, 11 Oct 2021 15:15:10 +0000

netfilter: iptables: allow use of ipt_do_table as hookfnThis is possible now that the xt_table structure is passed in via *priv.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/iptable_raw.c

cc807215 - netfilter: iptable_raw: drop bogus net_init annotation

Fri, 17 Sep 2021 09:56:25 +0000

netfilter: iptable_raw: drop bogus net_init annotationThis is a leftover from the times when this function was wired up viapernet_operations. Now its called when userspace asks for the table.With CONFIG_NET_NS=n, iptable_raw_table_init memory has been discardedalready and we get a kernel crash.Other tables are fine, __net_init annotation was removed already.Fixes: fdacd57c79b7 ("netfilter: x_tables: never register tables by default")Reported-by: youling 257 Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/iptable_raw.c

fdacd57c - netfilter: x_tables: never register tables by default

Tue, 03 Aug 2021 14:47:19 +0000

netfilter: x_tables: never register tables by defaultFor historical reasons x_tables still register tables by default in theinitial namespace.Only newly created net namespaces add the hook on demand.This means that the init_net always pays hook cost, even if no filteringrules are added (e.g. only used inside a single netns).Note that the hooks are added even when 'iptables -L' is called.This is because there is no way to tell 'iptables -A' and 'iptables -L'apart at kernel level.The only solution would be to register the table, but delay hookregistration until the first rule gets added (or policy gets changed).That however means that counters are not hooked either, so 'iptables -L'would always show 0-counters even when traffic is flowing which might beunexpected.This keeps table and hook registration consistent with what is already donein non-init netns: first iptables(-save) invocation registers both tableand hooks.This applies the same solution adopted for ebtables.All tables register a template that contains the l3 family, the nameand a constructor function that is called when the initial table has tobe added.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/iptable_raw.c

ae689334 - netfilter: ip_tables: pass table pointer via nf_hook_ops

Wed, 21 Apr 2021 07:51:07 +0000

netfilter: ip_tables: pass table pointer via nf_hook_opsiptable_x modules rely on 'struct net' to contain a pointer to thetable that should be evaluated.In order to remove these pointers from struct net, pass them viathe 'priv' pointer in a similar fashion as nf_tables passes therule data.To do that, duplicate the nf_hook_info array passed in from theiptable_x modules, update the ops->priv pointers of the copy torefer to the table and then change the hookfn implementations tojust pass the 'priv' argument to the traverser.After this patch, the xt_table pointers can already be removedfrom struct net.However, changes to struct net result in re-compile of the entirenetwork stack, so do the removal after arptables and ip6tableshave been converted as well.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/iptable_raw.c

f68772ed - netfilter: x_tables: remove paranoia tests

Wed, 21 Apr 2021 07:51:05 +0000

netfilter: x_tables: remove paranoia testsNo need for these.There is only one caller, the xtables core, when the table is registeredfor the first time with a particular network namespace.After ->table_init() call, the table is linked into the tables[af] list,so next call to that function will skip the ->table_init().Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/iptable_raw.c

20a9df33 - netfilter: iptables: unregister the tables by name

Wed, 21 Apr 2021 07:51:02 +0000

netfilter: iptables: unregister the tables by namextables stores the xt_table structs in the struct net. This isn'tneeded anymore, the structures could be passed via the netfilter hook'private' pointer to the hook functions, which would allow us to removethose pointers from struct net.As a first step, reduce the number of accesses to thenet->ipv4.ip6table_{raw,filter,...} pointers.This allows the tables to get unregistered by name instead of having topass the raw address.The xt_table structure cane looked up by name+address family instead.This patch is useless as-is (the backends still have the raw pointeraddress), but it lowers the bar to remove those.It also allows to put the 'was table registered in the first place' checkinto ip_tables.c rather than have it in each table sub module.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/iptable_raw.c

cf4cbc61 - netfilter: iptables: Add a .pre_exit hook in all iptable_foo.c.

Mon, 22 Jun 2020 17:10:12 +0000

netfilter: iptables: Add a .pre_exit hook in all iptable_foo.c.Using new helpers ipt_unregister_table_pre_exit() andipt_unregister_table_exit().Fixes: b9e69e127397 ("netfilter: xtables: don't hook tables by default")Signed-off-by: David Wilder Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/iptable_raw.c

fe03d474 - Update my email address

Mon, 10 Jun 2019 11:00:24 +0000

Update my email addressIt's better to use my kadlec@netfilter.org email address inthe source code. I might not be able to usekadlec@blackhole.kfki.hu in the future.Signed-off-by: Jozsef Kadlecsik Signed-off-by: Jozsef Kadlecsik List of files: /linux-6.15/net/ipv4/netfilter/iptable_raw.c

09c434b8 - treewide: Add SPDX license identifier for more missed files

Sun, 19 May 2019 12:08:20 +0000

treewide: Add SPDX license identifier for more missed filesAdd SPDX license identifiers to all files which: - Have no license information of any form - Have MODULE_LICENCE("GPL*") inside which was used in the initial scan/conversion to ignore the fileThese files fall under the project license, GPL v2 only. The resulting SPDXlicense identifier is: GPL-2.0-onlySigned-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman List of files: /linux-6.15/net/ipv4/netfilter/iptable_raw.c

2f635cee - net: Drop pernet_operations::async

Tue, 27 Mar 2018 15:02:13 +0000

net: Drop pernet_operations::asyncSynchronous pernet_operations are not allowed anymore.All are asynchronous. So, drop the structure member.Signed-off-by: Kirill Tkhai Signed-off-by: David S. Miller List of files: /linux-6.15/net/ipv4/netfilter/iptable_raw.c

65f828c3 - net: Convert iptable_raw_net_ops

Wed, 07 Mar 2018 09:40:58 +0000

net: Convert iptable_raw_net_opsThese pernet_operations unregister net::ipv4::iptable_raw table.Another net/pernet_operations do not send ipv4 packets to foreignnet namespaces. So, we mark them async.Signed-off-by: Kirill Tkhai Signed-off-by: David S. Miller List of files: /linux-6.15/net/ipv4/netfilter/iptable_raw.c

b069b37a - netfilter: nf_defrag: mark xt_table structures 'const' again

Mon, 15 Jan 2018 15:49:05 +0000

netfilter: nf_defrag: mark xt_table structures 'const' againAs a side-effect of adding the module option, we now get a sectionmismatch warning:WARNING: net/ipv4/netfilter/iptable_raw.o(.data+0x1c): Section mismatch in reference from the variable packet_raw to the function .init.text:iptable_raw_table_init()The variable packet_raw referencesthe function __init iptable_raw_table_init()If the reference is valid then annotate thevariable with __init* or __refdata (see linux/init.h) or name the variable:*_template, *_timer, *_sht, *_ops, *_probe, *_probe_one, *_consoleApparently it's ok to link to a __net_init function from .rodata but notfrom .data. We can address this by rearranging the logic so that thestructure is read-only again. Instead of writing to the .priority fieldlater, we have an extra copies of the structure with that flag. An addedadvantage is that that we don't have writable function pointers with thisapproach.Fixes: 902d6a4c2a4f ("netfilter: nf_defrag: Skip defrag if NOTRACK is set")Signed-off-by: Arnd Bergmann Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/iptable_raw.c

902d6a4c - netfilter: nf_defrag: Skip defrag if NOTRACK is set

Thu, 11 Jan 2018 03:51:57 +0000

netfilter: nf_defrag: Skip defrag if NOTRACK is setconntrack defrag is needed only if some module like CONNTRACK or NATexplicitly requests it. For plain forwarding scenarios, defrag isnot needed and can be skipped if NOTRACK is set in a rule.Since conntrack defrag is currently higher priority than raw table,setting NOTRACK is not sufficient. We need to move raw to a higherpriority for iptables only.This is achieved by introducing a module parameter "raw_before_defrag"which allows to change the priority of raw table to place it beforedefrag. By default, the parameter is disabled and the priority of rawtable is NF_IP_PRI_RAW to support legacy behavior. If the moduleparameter is enabled, then the priority of the raw table is set toNF_IP_PRI_RAW_BEFORE_DEFRAG.Signed-off-by: Subash Abhinov Kasiviswanathan Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/iptable_raw.c

a7f87b47 - netfilter: remove defensive check on malformed packets from raw sockets

Sat, 30 Dec 2017 21:41:46 +0000

netfilter: remove defensive check on malformed packets from raw socketsUsers cannot forge malformed IPv4/IPv6 headers via raw sockets that theycan inject into the stack. Specifically, not for IPv4 since 55888dfb6ba7("AF_RAW: Augment raw_send_hdrinc to expand skb to fit iphdr->ihl(v2)"). IPv6 raw sockets also ensure that packets have a well-formedIPv6 header available in the skbuff.At quick glance, br_netfilter also validates layer 3 headers and itdrops malformed both IPv4 and IPv6 packets.Therefore, let's remove this defensive check all over the place.Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/iptable_raw.c

b9e69e12 - netfilter: xtables: don't hook tables by default

Thu, 25 Feb 2016 09:08:36 +0000

netfilter: xtables: don't hook tables by defaultdelay hook registration until the table is being requested inside anamespace.Historically, a particular table (iptables mangle, ip6tables filter, etc)was registered on module load.When netns support was added to iptables only the ip/ip6tables ruleset wasmade namespace aware, not the actual hook points.This means f.e. that when ipt_filter table/module is loaded on a system,then each namespace on that system has an (empty) iptables filter ruleset.In other words, if a namespace sends a packet, such skb is 'caught' bynetfilter machinery and fed to hooking points for that table (i.e. INPUT,FORWARD, etc).Thanks to Eric Biederman, hooks are no longer global, but per namespace.This means that we can avoid allocation of empty ruleset in a namespace anddefer hook registration until we need the functionality.We register a tables hook entry points ONLY in the initial namespace.When an iptables get/setockopt is issued inside a given namespace, we checkif the table is found in the per-namespace list.If not, we attempt to find it in the initial namespace, and, if found,create an empty default table in the requesting namespace and register theneeded hooks.Hook points are destroyed only once namespace is deleted, there is no'usage count' (it makes no sense since there is no 'remove table' operationin xtables api).Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/iptable_raw.c

a67dd266 - netfilter: xtables: prepare for on-demand hook register

Thu, 25 Feb 2016 09:08:35 +0000

netfilter: xtables: prepare for on-demand hook registerThis change prepares for upcoming on-demand xtables hook registration.We change the protoypes of the register/unregister functions.A followup patch will then add nf_hook_register/unregister callsto the iptables one.Once a hook is registered packets will be picked up, so all assignmentsof the formnet->ipv4.iptable_$table = new_tablehave to be moved to ip(6)t_register_table, else we can see NULLnet->ipv4.iptable_$table later.This patch doesn't change functionality; without this the actual changesimply gets too big.Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/iptable_raw.c

06198b34 - netfilter: Pass priv instead of nf_hook_ops to netfilter hooks

Fri, 18 Sep 2015 19:33:06 +0000

netfilter: Pass priv instead of nf_hook_ops to netfilter hooksOnly pass the void *priv parameter out of the nf_hook_ops. That isall any of the functions are interested now, and by limiting what ispassed it becomes simpler to change implementation details.Signed-off-by: "Eric W. Biederman" Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/iptable_raw.c

6cb8ff3f - inet netfilter: Remove hook from ip6t_do_table, arp_do_table, ipt_do_table

Fri, 18 Sep 2015 19:32:55 +0000

inet netfilter: Remove hook from ip6t_do_table, arp_do_table, ipt_do_tableThe values of ops->hooknum and state->hook are guaraneted to be equalmaking the hook argument to ip6t_do_table, arp_do_table, andipt_do_table is unnecessary. Remove the unnecessary hook argument.In the callers use state->hook instead of ops->hooknum for clarity andto reduce the number of cachelines the callers touch.Signed-off-by: "Eric W. Biederman" Signed-off-by: Pablo Neira Ayuso List of files: /linux-6.15/net/ipv4/netfilter/iptable_raw.c

9dff2c96 - netfilter: Use nf_hook_state.net

Wed, 16 Sep 2015 01:04:17 +0000

netfilter: Use nf_hook_state.netInstead of saying "net = dev_net(state->in?state->in:state->out)"just say "state->net". As that information is now availabe,much less confusing and much less error prone.Signed-off-by: "Eric W. Biederman" Signed-off-by: David S. Miller List of files: /linux-6.15/net/ipv4/netfilter/iptable_raw.c