hc
2024-05-10 23fa18eaa71266feff7ba8d83022d9e1cc83c65a
kernel/include/linux/netfilter.h
....@@ -13,9 +13,10 @@
1313 #include <linux/static_key.h>
1414 #include <linux/netfilter_defs.h>
1515 #include <linux/netdevice.h>
16
+#include <linux/sockptr.h>
17
+#include <linux/android_kabi.h>
1618 #include <net/net_namespace.h>
1719
18
-#ifdef CONFIG_NETFILTER
1920 static inline int NF_DROP_GETERR(int verdict)
2021 {
2122 return -(verdict >> NF_VERDICT_QBITS);
....@@ -24,20 +25,36 @@
2425 static inline int nf_inet_addr_cmp(const union nf_inet_addr *a1,
2526 const union nf_inet_addr *a2)
2627 {
28
+#if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && BITS_PER_LONG == 64
29
+ const unsigned long *ul1 = (const unsigned long *)a1;
30
+ const unsigned long *ul2 = (const unsigned long *)a2;
31
+
32
+ return ((ul1[0] ^ ul2[0]) | (ul1[1] ^ ul2[1])) == 0UL;
33
+#else
2734 return a1->all[0] == a2->all[0] &&
2835 a1->all[1] == a2->all[1] &&
2936 a1->all[2] == a2->all[2] &&
3037 a1->all[3] == a2->all[3];
38
+#endif
3139 }
3240
3341 static inline void nf_inet_addr_mask(const union nf_inet_addr *a1,
3442 union nf_inet_addr *result,
3543 const union nf_inet_addr *mask)
3644 {
45
+#if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && BITS_PER_LONG == 64
46
+ const unsigned long *ua = (const unsigned long *)a1;
47
+ unsigned long *ur = (unsigned long *)result;
48
+ const unsigned long *um = (const unsigned long *)mask;
49
+
50
+ ur[0] = ua[0] & um[0];
51
+ ur[1] = ua[1] & um[1];
52
+#else
3753 result->all[0] = a1->all[0] & mask->all[0];
3854 result->all[1] = a1->all[1] & mask->all[1];
3955 result->all[2] = a1->all[2] & mask->all[2];
4056 result->all[3] = a1->all[3] & mask->all[3];
57
+#endif
4158 }
4259
4360 int netfilter_init(void);
....@@ -102,6 +119,7 @@
102119 */
103120 };
104121
122
+#ifdef CONFIG_NETFILTER
105123 static inline struct nf_hook_ops **nf_hook_entries_get_hook_ops(const struct nf_hook_entries *e)
106124 {
107125 unsigned int n = e->num_hook_entries;
....@@ -147,20 +165,15 @@
147165 /* Non-inclusive ranges: use 0/0/NULL to never get called. */
148166 int set_optmin;
149167 int set_optmax;
150
- int (*set)(struct sock *sk, int optval, void __user *user, unsigned int len);
151
-#ifdef CONFIG_COMPAT
152
- int (*compat_set)(struct sock *sk, int optval,
153
- void __user *user, unsigned int len);
154
-#endif
168
+ int (*set)(struct sock *sk, int optval, sockptr_t arg,
169
+ unsigned int len);
155170 int get_optmin;
156171 int get_optmax;
157172 int (*get)(struct sock *sk, int optval, void __user *user, int *len);
158
-#ifdef CONFIG_COMPAT
159
- int (*compat_get)(struct sock *sk, int optval,
160
- void __user *user, int *len);
161
-#endif
162173 /* Use the module struct to lock set/get code in place */
163174 struct module *owner;
175
+
176
+ ANDROID_KABI_RESERVE(1);
164177 };
165178
166179 /* Function to register/unregister hook points. */
....@@ -183,6 +196,8 @@
183196 int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state,
184197 const struct nf_hook_entries *e, unsigned int i);
185198
199
+void nf_hook_slow_list(struct list_head *head, struct nf_hook_state *state,
200
+ const struct nf_hook_entries *e);
186201 /**
187202 * nf_hook - call a netfilter hook
188203 *
....@@ -225,11 +240,6 @@
225240 hook_head = rcu_dereference(net->nf.hooks_bridge[hook]);
226241 #endif
227242 break;
228
-#if IS_ENABLED(CONFIG_DECNET)
229
- case NFPROTO_DECNET:
230
- hook_head = rcu_dereference(net->nf.hooks_decnet[hook]);
231
- break;
232
-#endif
233243 default:
234244 WARN_ON_ONCE(1);
235245 break;
....@@ -295,35 +305,43 @@
295305 struct list_head *head, struct net_device *in, struct net_device *out,
296306 int (*okfn)(struct net *, struct sock *, struct sk_buff *))
297307 {
298
- struct sk_buff *skb, *next;
299
- struct list_head sublist;
308
+ struct nf_hook_entries *hook_head = NULL;
300309
301
- INIT_LIST_HEAD(&sublist);
302
- list_for_each_entry_safe(skb, next, head, list) {
303
- skb_list_del_init(skb);
304
- if (nf_hook(pf, hook, net, sk, skb, in, out, okfn) == 1)
305
- list_add_tail(&skb->list, &sublist);
310
+#ifdef CONFIG_JUMP_LABEL
311
+ if (__builtin_constant_p(pf) &&
312
+ __builtin_constant_p(hook) &&
313
+ !static_key_false(&nf_hooks_needed[pf][hook]))
314
+ return;
315
+#endif
316
+
317
+ rcu_read_lock();
318
+ switch (pf) {
319
+ case NFPROTO_IPV4:
320
+ hook_head = rcu_dereference(net->nf.hooks_ipv4[hook]);
321
+ break;
322
+ case NFPROTO_IPV6:
323
+ hook_head = rcu_dereference(net->nf.hooks_ipv6[hook]);
324
+ break;
325
+ default:
326
+ WARN_ON_ONCE(1);
327
+ break;
306328 }
307
- /* Put passed packets back on main list */
308
- list_splice(&sublist, head);
329
+
330
+ if (hook_head) {
331
+ struct nf_hook_state state;
332
+
333
+ nf_hook_state_init(&state, hook, pf, in, out, sk, net, okfn);
334
+
335
+ nf_hook_slow_list(head, &state, hook_head);
336
+ }
337
+ rcu_read_unlock();
309338 }
310339
311340 /* Call setsockopt() */
312
-int nf_setsockopt(struct sock *sk, u_int8_t pf, int optval, char __user *opt,
341
+int nf_setsockopt(struct sock *sk, u_int8_t pf, int optval, sockptr_t opt,
313342 unsigned int len);
314343 int nf_getsockopt(struct sock *sk, u_int8_t pf, int optval, char __user *opt,
315344 int *len);
316
-#ifdef CONFIG_COMPAT
317
-int compat_nf_setsockopt(struct sock *sk, u_int8_t pf, int optval,
318
- char __user *opt, unsigned int len);
319
-int compat_nf_getsockopt(struct sock *sk, u_int8_t pf, int optval,
320
- char __user *opt, int *len);
321
-#endif
322
-
323
-/* Call this before modifying an existing packet: ensures it is
324
- modifiable and linear to the point you care about (writable_len).
325
- Returns true or false. */
326
-int skb_make_writable(struct sk_buff *skb, unsigned int writable_len);
327345
328346 struct flowi;
329347 struct nf_queue_entry;
....@@ -353,6 +371,8 @@
353371 unsigned int (*manip_pkt)(struct sk_buff *skb, struct nf_conn *ct,
354372 enum nf_nat_manip_type mtype,
355373 enum ip_conntrack_dir dir);
374
+
375
+ ANDROID_KABI_RESERVE(1);
356376 };
357377
358378 extern struct nf_nat_hook __rcu *nf_nat_hook;
....@@ -360,7 +380,7 @@
360380 static inline void
361381 nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family)
362382 {
363
-#ifdef CONFIG_NF_NAT_NEEDED
383
+#if IS_ENABLED(CONFIG_NF_NAT)
364384 struct nf_nat_hook *nat_hook;
365385
366386 rcu_read_lock();
....@@ -411,7 +431,7 @@
411431 }
412432 #endif /*CONFIG_NETFILTER*/
413433
414
-#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
434
+#if IS_ENABLED(CONFIG_NF_CONNTRACK)
415435 #include <linux/netfilter/nf_conntrack_zones_common.h>
416436
417437 extern void (*ip_ct_attach)(struct sk_buff *, const struct sk_buff *) __rcu;
....@@ -437,6 +457,8 @@
437457 void (*destroy)(struct nf_conntrack *);
438458 bool (*get_tuple_skb)(struct nf_conntrack_tuple *,
439459 const struct sk_buff *);
460
+
461
+ ANDROID_KABI_RESERVE(1);
440462 };
441463 extern struct nf_ct_hook __rcu *nf_ct_hook;
442464
....@@ -454,6 +476,8 @@
454476 u32 portid, u32 report);
455477 void (*seq_adjust)(struct sk_buff *skb, struct nf_conn *ct,
456478 enum ip_conntrack_info ctinfo, s32 off);
479
+
480
+ ANDROID_KABI_RESERVE(1);
457481 };
458482 extern struct nfnl_ct_hook __rcu *nfnl_ct_hook;
459483