net/netfilter/nft_immediate.c

Source file repositories/reference/linux-study-clean/net/netfilter/nft_immediate.c

File Facts

System
Linux kernel
Corpus path
net/netfilter/nft_immediate.c
Extension
.c
Size
8122 bytes
Lines
346
Domain
Networking Core
Bucket
Sockets, Protocols, Packet Path, And Network Policy
Inferred role
Networking Core: implementation source
Status
source implementation candidate

Why This File Exists

Networking stack implementation surface: socket APIs, protocol dispatch, packet flow, routing, filtering, and network namespaces.

Dependency Surface

Detected Declarations

Annotated Snippet

switch (priv->data.verdict.code) {
		case NFT_JUMP:
		case NFT_GOTO:
			err = nf_tables_bind_chain(ctx, chain);
			if (err < 0)
				goto err1;
			break;
		default:
			break;
		}
	}

	return 0;

err1:
	nft_data_release(&priv->data, desc.type);
	return err;
}

static void nft_immediate_activate(const struct nft_ctx *ctx,
				   const struct nft_expr *expr)
{
	const struct nft_immediate_expr *priv = nft_expr_priv(expr);
	const struct nft_data *data = &priv->data;
	struct nft_ctx chain_ctx;
	struct nft_chain *chain;
	struct nft_rule *rule;

	if (priv->dreg == NFT_REG_VERDICT) {
		switch (data->verdict.code) {
		case NFT_JUMP:
		case NFT_GOTO:
			chain = data->verdict.chain;
			if (!nft_chain_binding(chain))
				break;

			chain_ctx = *ctx;
			chain_ctx.chain = chain;

			list_for_each_entry(rule, &chain->rules, list)
				nft_rule_expr_activate(&chain_ctx, rule);

			nft_clear(ctx->net, chain);
			break;
		default:
			break;
		}
	}

	return nft_data_hold(&priv->data, nft_dreg_to_type(priv->dreg));
}

static void nft_immediate_chain_deactivate(const struct nft_ctx *ctx,
					   struct nft_chain *chain,
					   enum nft_trans_phase phase)
{
	struct nft_ctx chain_ctx;
	struct nft_rule *rule;

	chain_ctx = *ctx;
	chain_ctx.chain = chain;

	list_for_each_entry(rule, &chain->rules, list)
		nft_rule_expr_deactivate(&chain_ctx, rule, phase);
}

static void nft_immediate_deactivate(const struct nft_ctx *ctx,
				     const struct nft_expr *expr,
				     enum nft_trans_phase phase)
{
	const struct nft_immediate_expr *priv = nft_expr_priv(expr);
	const struct nft_data *data = &priv->data;
	struct nft_chain *chain;

	if (priv->dreg == NFT_REG_VERDICT) {
		switch (data->verdict.code) {
		case NFT_JUMP:
		case NFT_GOTO:
			chain = data->verdict.chain;
			if (!nft_chain_binding(chain))
				break;

			switch (phase) {
			case NFT_TRANS_PREPARE_ERROR:
				nf_tables_unbind_chain(ctx, chain);
				nft_deactivate_next(ctx->net, chain);
				break;
			case NFT_TRANS_PREPARE:
				nft_immediate_chain_deactivate(ctx, chain, phase);
				nft_deactivate_next(ctx->net, chain);

Annotation

Implementation Notes