xref: /openbmc/linux/include/net/netfilter/nf_tables.h (revision 9144f784f852f9a125cabe9927b986d909bfa439)
1  /* SPDX-License-Identifier: GPL-2.0 */
2  #ifndef _NET_NF_TABLES_H
3  #define _NET_NF_TABLES_H
4  
5  #include <asm/unaligned.h>
6  #include <linux/list.h>
7  #include <linux/netfilter.h>
8  #include <linux/netfilter/nfnetlink.h>
9  #include <linux/netfilter/x_tables.h>
10  #include <linux/netfilter/nf_tables.h>
11  #include <linux/u64_stats_sync.h>
12  #include <linux/rhashtable.h>
13  #include <net/netfilter/nf_flow_table.h>
14  #include <net/netlink.h>
15  #include <net/flow_offload.h>
16  #include <net/netns/generic.h>
17  
18  #define NFT_MAX_HOOKS	(NF_INET_INGRESS + 1)
19  
20  struct module;
21  
22  #define NFT_JUMP_STACK_SIZE	16
23  
24  enum {
25  	NFT_PKTINFO_L4PROTO	= (1 << 0),
26  	NFT_PKTINFO_INNER	= (1 << 1),
27  	NFT_PKTINFO_INNER_FULL	= (1 << 2),
28  };
29  
30  struct nft_pktinfo {
31  	struct sk_buff			*skb;
32  	const struct nf_hook_state	*state;
33  	u8				flags;
34  	u8				tprot;
35  	u16				fragoff;
36  	u16				thoff;
37  	u16				inneroff;
38  };
39  
nft_sk(const struct nft_pktinfo * pkt)40  static inline struct sock *nft_sk(const struct nft_pktinfo *pkt)
41  {
42  	return pkt->state->sk;
43  }
44  
nft_thoff(const struct nft_pktinfo * pkt)45  static inline unsigned int nft_thoff(const struct nft_pktinfo *pkt)
46  {
47  	return pkt->thoff;
48  }
49  
nft_net(const struct nft_pktinfo * pkt)50  static inline struct net *nft_net(const struct nft_pktinfo *pkt)
51  {
52  	return pkt->state->net;
53  }
54  
nft_hook(const struct nft_pktinfo * pkt)55  static inline unsigned int nft_hook(const struct nft_pktinfo *pkt)
56  {
57  	return pkt->state->hook;
58  }
59  
nft_pf(const struct nft_pktinfo * pkt)60  static inline u8 nft_pf(const struct nft_pktinfo *pkt)
61  {
62  	return pkt->state->pf;
63  }
64  
nft_in(const struct nft_pktinfo * pkt)65  static inline const struct net_device *nft_in(const struct nft_pktinfo *pkt)
66  {
67  	return pkt->state->in;
68  }
69  
nft_out(const struct nft_pktinfo * pkt)70  static inline const struct net_device *nft_out(const struct nft_pktinfo *pkt)
71  {
72  	return pkt->state->out;
73  }
74  
nft_set_pktinfo(struct nft_pktinfo * pkt,struct sk_buff * skb,const struct nf_hook_state * state)75  static inline void nft_set_pktinfo(struct nft_pktinfo *pkt,
76  				   struct sk_buff *skb,
77  				   const struct nf_hook_state *state)
78  {
79  	pkt->skb = skb;
80  	pkt->state = state;
81  }
82  
nft_set_pktinfo_unspec(struct nft_pktinfo * pkt)83  static inline void nft_set_pktinfo_unspec(struct nft_pktinfo *pkt)
84  {
85  	pkt->flags = 0;
86  	pkt->tprot = 0;
87  	pkt->thoff = 0;
88  	pkt->fragoff = 0;
89  }
90  
91  /**
92   * 	struct nft_verdict - nf_tables verdict
93   *
94   * 	@code: nf_tables/netfilter verdict code
95   * 	@chain: destination chain for NFT_JUMP/NFT_GOTO
96   */
97  struct nft_verdict {
98  	u32				code;
99  	struct nft_chain		*chain;
100  };
101  
102  struct nft_data {
103  	union {
104  		u32			data[4];
105  		struct nft_verdict	verdict;
106  	};
107  } __attribute__((aligned(__alignof__(u64))));
108  
109  #define NFT_REG32_NUM		20
110  
111  /**
112   *	struct nft_regs - nf_tables register set
113   *
114   *	@data: data registers
115   *	@verdict: verdict register
116   *
117   *	The first four data registers alias to the verdict register.
118   */
119  struct nft_regs {
120  	union {
121  		u32			data[NFT_REG32_NUM];
122  		struct nft_verdict	verdict;
123  	};
124  };
125  
126  struct nft_regs_track {
127  	struct {
128  		const struct nft_expr		*selector;
129  		const struct nft_expr		*bitwise;
130  		u8				num_reg;
131  	} regs[NFT_REG32_NUM];
132  
133  	const struct nft_expr			*cur;
134  	const struct nft_expr			*last;
135  };
136  
137  /* Store/load an u8, u16 or u64 integer to/from the u32 data register.
138   *
139   * Note, when using concatenations, register allocation happens at 32-bit
140   * level. So for store instruction, pad the rest part with zero to avoid
141   * garbage values.
142   */
143  
nft_reg_store8(u32 * dreg,u8 val)144  static inline void nft_reg_store8(u32 *dreg, u8 val)
145  {
146  	*dreg = 0;
147  	*(u8 *)dreg = val;
148  }
149  
nft_reg_load8(const u32 * sreg)150  static inline u8 nft_reg_load8(const u32 *sreg)
151  {
152  	return *(u8 *)sreg;
153  }
154  
nft_reg_store16(u32 * dreg,u16 val)155  static inline void nft_reg_store16(u32 *dreg, u16 val)
156  {
157  	*dreg = 0;
158  	*(u16 *)dreg = val;
159  }
160  
nft_reg_store_be16(u32 * dreg,__be16 val)161  static inline void nft_reg_store_be16(u32 *dreg, __be16 val)
162  {
163  	nft_reg_store16(dreg, (__force __u16)val);
164  }
165  
nft_reg_load16(const u32 * sreg)166  static inline u16 nft_reg_load16(const u32 *sreg)
167  {
168  	return *(u16 *)sreg;
169  }
170  
nft_reg_load_be16(const u32 * sreg)171  static inline __be16 nft_reg_load_be16(const u32 *sreg)
172  {
173  	return (__force __be16)nft_reg_load16(sreg);
174  }
175  
nft_reg_load_be32(const u32 * sreg)176  static inline __be32 nft_reg_load_be32(const u32 *sreg)
177  {
178  	return *(__force __be32 *)sreg;
179  }
180  
nft_reg_store64(u64 * dreg,u64 val)181  static inline void nft_reg_store64(u64 *dreg, u64 val)
182  {
183  	put_unaligned(val, dreg);
184  }
185  
nft_reg_load64(const u32 * sreg)186  static inline u64 nft_reg_load64(const u32 *sreg)
187  {
188  	return get_unaligned((u64 *)sreg);
189  }
190  
nft_data_copy(u32 * dst,const struct nft_data * src,unsigned int len)191  static inline void nft_data_copy(u32 *dst, const struct nft_data *src,
192  				 unsigned int len)
193  {
194  	if (len % NFT_REG32_SIZE)
195  		dst[len / NFT_REG32_SIZE] = 0;
196  	memcpy(dst, src, len);
197  }
198  
199  /**
200   *	struct nft_ctx - nf_tables rule/set context
201   *
202   *	@net: net namespace
203   * 	@table: the table the chain is contained in
204   * 	@chain: the chain the rule is contained in
205   *	@nla: netlink attributes
206   *	@portid: netlink portID of the original message
207   *	@seq: netlink sequence number
208   *	@flags: modifiers to new request
209   *	@family: protocol family
210   *	@level: depth of the chains
211   *	@report: notify via unicast netlink message
212   */
213  struct nft_ctx {
214  	struct net			*net;
215  	struct nft_table		*table;
216  	struct nft_chain		*chain;
217  	const struct nlattr * const 	*nla;
218  	u32				portid;
219  	u32				seq;
220  	u16				flags;
221  	u8				family;
222  	u8				level;
223  	bool				report;
224  };
225  
226  enum nft_data_desc_flags {
227  	NFT_DATA_DESC_SETELEM	= (1 << 0),
228  };
229  
230  struct nft_data_desc {
231  	enum nft_data_types		type;
232  	unsigned int			size;
233  	unsigned int			len;
234  	unsigned int			flags;
235  };
236  
237  int nft_data_init(const struct nft_ctx *ctx, struct nft_data *data,
238  		  struct nft_data_desc *desc, const struct nlattr *nla);
239  void nft_data_hold(const struct nft_data *data, enum nft_data_types type);
240  void nft_data_release(const struct nft_data *data, enum nft_data_types type);
241  int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
242  		  enum nft_data_types type, unsigned int len);
243  
nft_dreg_to_type(enum nft_registers reg)244  static inline enum nft_data_types nft_dreg_to_type(enum nft_registers reg)
245  {
246  	return reg == NFT_REG_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE;
247  }
248  
nft_type_to_reg(enum nft_data_types type)249  static inline enum nft_registers nft_type_to_reg(enum nft_data_types type)
250  {
251  	return type == NFT_DATA_VERDICT ? NFT_REG_VERDICT : NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE;
252  }
253  
254  int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest);
255  int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg);
256  
257  int nft_parse_register_load(const struct nlattr *attr, u8 *sreg, u32 len);
258  int nft_parse_register_store(const struct nft_ctx *ctx,
259  			     const struct nlattr *attr, u8 *dreg,
260  			     const struct nft_data *data,
261  			     enum nft_data_types type, unsigned int len);
262  
263  /**
264   *	struct nft_userdata - user defined data associated with an object
265   *
266   *	@len: length of the data
267   *	@data: content
268   *
269   *	The presence of user data is indicated in an object specific fashion,
270   *	so a length of zero can't occur and the value "len" indicates data
271   *	of length len + 1.
272   */
273  struct nft_userdata {
274  	u8			len;
275  	unsigned char		data[];
276  };
277  
278  /**
279   *	struct nft_set_elem - generic representation of set elements
280   *
281   *	@key: element key
282   *	@key_end: closing element key
283   *	@data: element data
284   *	@priv: element private data and extensions
285   */
286  struct nft_set_elem {
287  	union {
288  		u32		buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)];
289  		struct nft_data	val;
290  	} key;
291  	union {
292  		u32		buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)];
293  		struct nft_data	val;
294  	} key_end;
295  	union {
296  		u32		buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)];
297  		struct nft_data val;
298  	} data;
299  	void			*priv;
300  };
301  
302  /**
303   * enum nft_iter_type - nftables set iterator type
304   *
305   * @NFT_ITER_READ: read-only iteration over set elements
306   * @NFT_ITER_UPDATE: iteration under mutex to update set element state
307   */
308  enum nft_iter_type {
309  	NFT_ITER_UNSPEC,
310  	NFT_ITER_READ,
311  	NFT_ITER_UPDATE,
312  };
313  
314  struct nft_set;
315  struct nft_set_iter {
316  	u8		genmask;
317  	enum nft_iter_type type:8;
318  	unsigned int	count;
319  	unsigned int	skip;
320  	int		err;
321  	int		(*fn)(const struct nft_ctx *ctx,
322  			      struct nft_set *set,
323  			      const struct nft_set_iter *iter,
324  			      struct nft_set_elem *elem);
325  };
326  
327  /**
328   *	struct nft_set_desc - description of set elements
329   *
330   *	@ktype: key type
331   *	@klen: key length
332   *	@dtype: data type
333   *	@dlen: data length
334   *	@objtype: object type
335   *	@size: number of set elements
336   *	@policy: set policy
337   *	@gc_int: garbage collector interval
338   *	@timeout: element timeout
339   *	@field_len: length of each field in concatenation, bytes
340   *	@field_count: number of concatenated fields in element
341   *	@expr: set must support for expressions
342   */
343  struct nft_set_desc {
344  	u32			ktype;
345  	unsigned int		klen;
346  	u32			dtype;
347  	unsigned int		dlen;
348  	u32			objtype;
349  	unsigned int		size;
350  	u32			policy;
351  	u32			gc_int;
352  	u64			timeout;
353  	u8			field_len[NFT_REG32_COUNT];
354  	u8			field_count;
355  	bool			expr;
356  };
357  
358  /**
359   *	enum nft_set_class - performance class
360   *
361   *	@NFT_SET_CLASS_O_1: constant, O(1)
362   *	@NFT_SET_CLASS_O_LOG_N: logarithmic, O(log N)
363   *	@NFT_SET_CLASS_O_N: linear, O(N)
364   */
365  enum nft_set_class {
366  	NFT_SET_CLASS_O_1,
367  	NFT_SET_CLASS_O_LOG_N,
368  	NFT_SET_CLASS_O_N,
369  };
370  
371  /**
372   *	struct nft_set_estimate - estimation of memory and performance
373   *				  characteristics
374   *
375   *	@size: required memory
376   *	@lookup: lookup performance class
377   *	@space: memory class
378   */
379  struct nft_set_estimate {
380  	u64			size;
381  	enum nft_set_class	lookup;
382  	enum nft_set_class	space;
383  };
384  
385  #define NFT_EXPR_MAXATTR		16
386  #define NFT_EXPR_SIZE(size)		(sizeof(struct nft_expr) + \
387  					 ALIGN(size, __alignof__(struct nft_expr)))
388  
389  /**
390   *	struct nft_expr - nf_tables expression
391   *
392   *	@ops: expression ops
393   *	@data: expression private data
394   */
395  struct nft_expr {
396  	const struct nft_expr_ops	*ops;
397  	unsigned char			data[]
398  		__attribute__((aligned(__alignof__(u64))));
399  };
400  
nft_expr_priv(const struct nft_expr * expr)401  static inline void *nft_expr_priv(const struct nft_expr *expr)
402  {
403  	return (void *)expr->data;
404  }
405  
406  struct nft_expr_info;
407  
408  int nft_expr_inner_parse(const struct nft_ctx *ctx, const struct nlattr *nla,
409  			 struct nft_expr_info *info);
410  int nft_expr_clone(struct nft_expr *dst, struct nft_expr *src);
411  void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr);
412  int nft_expr_dump(struct sk_buff *skb, unsigned int attr,
413  		  const struct nft_expr *expr, bool reset);
414  bool nft_expr_reduce_bitwise(struct nft_regs_track *track,
415  			     const struct nft_expr *expr);
416  
417  struct nft_set_ext;
418  
419  /**
420   *	struct nft_set_ops - nf_tables set operations
421   *
422   *	@lookup: look up an element within the set
423   *	@update: update an element if exists, add it if doesn't exist
424   *	@delete: delete an element
425   *	@insert: insert new element into set
426   *	@activate: activate new element in the next generation
427   *	@deactivate: lookup for element and deactivate it in the next generation
428   *	@flush: deactivate element in the next generation
429   *	@remove: remove element from set
430   *	@walk: iterate over all set elements
431   *	@get: get set elements
432   *	@commit: commit set elements
433   *	@abort: abort set elements
434   *	@privsize: function to return size of set private data
435   *	@estimate: estimate the required memory size and the lookup complexity class
436   *	@init: initialize private data of new set instance
437   *	@destroy: destroy private data of set instance
438   *	@gc_init: initialize garbage collection
439   *	@elemsize: element private size
440   *
441   *	Operations lookup, update and delete have simpler interfaces, are faster
442   *	and currently only used in the packet path. All the rest are slower,
443   *	control plane functions.
444   */
445  struct nft_set_ops {
446  	bool				(*lookup)(const struct net *net,
447  						  const struct nft_set *set,
448  						  const u32 *key,
449  						  const struct nft_set_ext **ext);
450  	bool				(*update)(struct nft_set *set,
451  						  const u32 *key,
452  						  void *(*new)(struct nft_set *,
453  							       const struct nft_expr *,
454  							       struct nft_regs *),
455  						  const struct nft_expr *expr,
456  						  struct nft_regs *regs,
457  						  const struct nft_set_ext **ext);
458  	bool				(*delete)(const struct nft_set *set,
459  						  const u32 *key);
460  
461  	int				(*insert)(const struct net *net,
462  						  const struct nft_set *set,
463  						  const struct nft_set_elem *elem,
464  						  struct nft_set_ext **ext);
465  	void				(*activate)(const struct net *net,
466  						    const struct nft_set *set,
467  						    const struct nft_set_elem *elem);
468  	void *				(*deactivate)(const struct net *net,
469  						      const struct nft_set *set,
470  						      const struct nft_set_elem *elem);
471  	bool				(*flush)(const struct net *net,
472  						 const struct nft_set *set,
473  						 void *priv);
474  	void				(*remove)(const struct net *net,
475  						  const struct nft_set *set,
476  						  const struct nft_set_elem *elem);
477  	void				(*walk)(const struct nft_ctx *ctx,
478  						struct nft_set *set,
479  						struct nft_set_iter *iter);
480  	void *				(*get)(const struct net *net,
481  					       const struct nft_set *set,
482  					       const struct nft_set_elem *elem,
483  					       unsigned int flags);
484  	void				(*commit)(const struct nft_set *set);
485  	void				(*abort)(const struct nft_set *set);
486  	u64				(*privsize)(const struct nlattr * const nla[],
487  						    const struct nft_set_desc *desc);
488  	bool				(*estimate)(const struct nft_set_desc *desc,
489  						    u32 features,
490  						    struct nft_set_estimate *est);
491  	int				(*init)(const struct nft_set *set,
492  						const struct nft_set_desc *desc,
493  						const struct nlattr * const nla[]);
494  	void				(*destroy)(const struct nft_ctx *ctx,
495  						   const struct nft_set *set);
496  	void				(*gc_init)(const struct nft_set *set);
497  
498  	unsigned int			elemsize;
499  };
500  
501  /**
502   *      struct nft_set_type - nf_tables set type
503   *
504   *      @ops: set ops for this type
505   *      @features: features supported by the implementation
506   */
507  struct nft_set_type {
508  	const struct nft_set_ops	ops;
509  	u32				features;
510  };
511  #define to_set_type(o) container_of(o, struct nft_set_type, ops)
512  
513  struct nft_set_elem_expr {
514  	u8				size;
515  	unsigned char			data[]
516  		__attribute__((aligned(__alignof__(struct nft_expr))));
517  };
518  
519  #define nft_setelem_expr_at(__elem_expr, __offset)			\
520  	((struct nft_expr *)&__elem_expr->data[__offset])
521  
522  #define nft_setelem_expr_foreach(__expr, __elem_expr, __size)		\
523  	for (__expr = nft_setelem_expr_at(__elem_expr, 0), __size = 0;	\
524  	     __size < (__elem_expr)->size;				\
525  	     __size += (__expr)->ops->size, __expr = ((void *)(__expr)) + (__expr)->ops->size)
526  
527  #define NFT_SET_EXPR_MAX	2
528  
529  /**
530   * 	struct nft_set - nf_tables set instance
531   *
532   *	@list: table set list node
533   *	@bindings: list of set bindings
534   *	@refs: internal refcounting for async set destruction
535   *	@table: table this set belongs to
536   *	@net: netnamespace this set belongs to
537   * 	@name: name of the set
538   *	@handle: unique handle of the set
539   * 	@ktype: key type (numeric type defined by userspace, not used in the kernel)
540   * 	@dtype: data type (verdict or numeric type defined by userspace)
541   * 	@objtype: object type (see NFT_OBJECT_* definitions)
542   * 	@size: maximum set size
543   *	@field_len: length of each field in concatenation, bytes
544   *	@field_count: number of concatenated fields in element
545   *	@use: number of rules references to this set
546   * 	@nelems: number of elements
547   * 	@ndeact: number of deactivated elements queued for removal
548   *	@timeout: default timeout value in jiffies
549   * 	@gc_int: garbage collection interval in msecs
550   *	@policy: set parameterization (see enum nft_set_policies)
551   *	@udlen: user data length
552   *	@udata: user data
553   *	@pending_update: list of pending update set element
554   * 	@ops: set ops
555   * 	@flags: set flags
556   *	@dead: set will be freed, never cleared
557   *	@genmask: generation mask
558   * 	@klen: key length
559   * 	@dlen: data length
560   *	@num_exprs: numbers of exprs
561   *	@exprs: stateful expression
562   *	@catchall_list: list of catch-all set element
563   * 	@data: private set data
564   */
565  struct nft_set {
566  	struct list_head		list;
567  	struct list_head		bindings;
568  	refcount_t			refs;
569  	struct nft_table		*table;
570  	possible_net_t			net;
571  	char				*name;
572  	u64				handle;
573  	u32				ktype;
574  	u32				dtype;
575  	u32				objtype;
576  	u32				size;
577  	u8				field_len[NFT_REG32_COUNT];
578  	u8				field_count;
579  	u32				use;
580  	atomic_t			nelems;
581  	u32				ndeact;
582  	u64				timeout;
583  	u32				gc_int;
584  	u16				policy;
585  	u16				udlen;
586  	unsigned char			*udata;
587  	struct list_head		pending_update;
588  	/* runtime data below here */
589  	const struct nft_set_ops	*ops ____cacheline_aligned;
590  	u16				flags:13,
591  					dead:1,
592  					genmask:2;
593  	u8				klen;
594  	u8				dlen;
595  	u8				num_exprs;
596  	struct nft_expr			*exprs[NFT_SET_EXPR_MAX];
597  	struct list_head		catchall_list;
598  	unsigned char			data[]
599  		__attribute__((aligned(__alignof__(u64))));
600  };
601  
nft_set_is_anonymous(const struct nft_set * set)602  static inline bool nft_set_is_anonymous(const struct nft_set *set)
603  {
604  	return set->flags & NFT_SET_ANONYMOUS;
605  }
606  
nft_set_priv(const struct nft_set * set)607  static inline void *nft_set_priv(const struct nft_set *set)
608  {
609  	return (void *)set->data;
610  }
611  
nft_set_datatype(const struct nft_set * set)612  static inline enum nft_data_types nft_set_datatype(const struct nft_set *set)
613  {
614  	return set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE;
615  }
616  
nft_set_gc_is_pending(const struct nft_set * s)617  static inline bool nft_set_gc_is_pending(const struct nft_set *s)
618  {
619  	return refcount_read(&s->refs) != 1;
620  }
621  
nft_set_container_of(const void * priv)622  static inline struct nft_set *nft_set_container_of(const void *priv)
623  {
624  	return (void *)priv - offsetof(struct nft_set, data);
625  }
626  
627  struct nft_set *nft_set_lookup_global(const struct net *net,
628  				      const struct nft_table *table,
629  				      const struct nlattr *nla_set_name,
630  				      const struct nlattr *nla_set_id,
631  				      u8 genmask);
632  
633  struct nft_set_ext *nft_set_catchall_lookup(const struct net *net,
634  					    const struct nft_set *set);
635  
nft_set_gc_interval(const struct nft_set * set)636  static inline unsigned long nft_set_gc_interval(const struct nft_set *set)
637  {
638  	u32 gc_int = READ_ONCE(set->gc_int);
639  
640  	return gc_int ? msecs_to_jiffies(gc_int) : HZ;
641  }
642  
643  /**
644   *	struct nft_set_binding - nf_tables set binding
645   *
646   *	@list: set bindings list node
647   *	@chain: chain containing the rule bound to the set
648   *	@flags: set action flags
649   *
650   *	A set binding contains all information necessary for validation
651   *	of new elements added to a bound set.
652   */
653  struct nft_set_binding {
654  	struct list_head		list;
655  	const struct nft_chain		*chain;
656  	u32				flags;
657  };
658  
659  enum nft_trans_phase;
660  void nf_tables_activate_set(const struct nft_ctx *ctx, struct nft_set *set);
661  void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set,
662  			      struct nft_set_binding *binding,
663  			      enum nft_trans_phase phase);
664  int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
665  		       struct nft_set_binding *binding);
666  void nf_tables_destroy_set(const struct nft_ctx *ctx, struct nft_set *set);
667  
668  /**
669   *	enum nft_set_extensions - set extension type IDs
670   *
671   *	@NFT_SET_EXT_KEY: element key
672   *	@NFT_SET_EXT_KEY_END: upper bound element key, for ranges
673   *	@NFT_SET_EXT_DATA: mapping data
674   *	@NFT_SET_EXT_FLAGS: element flags
675   *	@NFT_SET_EXT_TIMEOUT: element timeout
676   *	@NFT_SET_EXT_EXPIRATION: element expiration time
677   *	@NFT_SET_EXT_USERDATA: user data associated with the element
678   *	@NFT_SET_EXT_EXPRESSIONS: expressions assiciated with the element
679   *	@NFT_SET_EXT_OBJREF: stateful object reference associated with element
680   *	@NFT_SET_EXT_NUM: number of extension types
681   */
682  enum nft_set_extensions {
683  	NFT_SET_EXT_KEY,
684  	NFT_SET_EXT_KEY_END,
685  	NFT_SET_EXT_DATA,
686  	NFT_SET_EXT_FLAGS,
687  	NFT_SET_EXT_TIMEOUT,
688  	NFT_SET_EXT_EXPIRATION,
689  	NFT_SET_EXT_USERDATA,
690  	NFT_SET_EXT_EXPRESSIONS,
691  	NFT_SET_EXT_OBJREF,
692  	NFT_SET_EXT_NUM
693  };
694  
695  /**
696   *	struct nft_set_ext_type - set extension type
697   *
698   * 	@len: fixed part length of the extension
699   * 	@align: alignment requirements of the extension
700   */
701  struct nft_set_ext_type {
702  	u8	len;
703  	u8	align;
704  };
705  
706  extern const struct nft_set_ext_type nft_set_ext_types[];
707  
708  /**
709   *	struct nft_set_ext_tmpl - set extension template
710   *
711   *	@len: length of extension area
712   *	@offset: offsets of individual extension types
713   *	@ext_len: length of the expected extension(used to sanity check)
714   */
715  struct nft_set_ext_tmpl {
716  	u16	len;
717  	u8	offset[NFT_SET_EXT_NUM];
718  	u8	ext_len[NFT_SET_EXT_NUM];
719  };
720  
721  /**
722   *	struct nft_set_ext - set extensions
723   *
724   *	@genmask: generation mask, but also flags (see NFT_SET_ELEM_DEAD_BIT)
725   *	@offset: offsets of individual extension types
726   *	@data: beginning of extension data
727   *
728   *	This structure must be aligned to word size, otherwise atomic bitops
729   *	on genmask field can cause alignment failure on some archs.
730   */
731  struct nft_set_ext {
732  	u8	genmask;
733  	u8	offset[NFT_SET_EXT_NUM];
734  	char	data[];
735  } __aligned(BITS_PER_LONG / 8);
736  
nft_set_ext_prepare(struct nft_set_ext_tmpl * tmpl)737  static inline void nft_set_ext_prepare(struct nft_set_ext_tmpl *tmpl)
738  {
739  	memset(tmpl, 0, sizeof(*tmpl));
740  	tmpl->len = sizeof(struct nft_set_ext);
741  }
742  
nft_set_ext_add_length(struct nft_set_ext_tmpl * tmpl,u8 id,unsigned int len)743  static inline int nft_set_ext_add_length(struct nft_set_ext_tmpl *tmpl, u8 id,
744  					 unsigned int len)
745  {
746  	tmpl->len	 = ALIGN(tmpl->len, nft_set_ext_types[id].align);
747  	if (tmpl->len > U8_MAX)
748  		return -EINVAL;
749  
750  	tmpl->offset[id] = tmpl->len;
751  	tmpl->ext_len[id] = nft_set_ext_types[id].len + len;
752  	tmpl->len	+= tmpl->ext_len[id];
753  
754  	return 0;
755  }
756  
nft_set_ext_add(struct nft_set_ext_tmpl * tmpl,u8 id)757  static inline int nft_set_ext_add(struct nft_set_ext_tmpl *tmpl, u8 id)
758  {
759  	return nft_set_ext_add_length(tmpl, id, 0);
760  }
761  
nft_set_ext_init(struct nft_set_ext * ext,const struct nft_set_ext_tmpl * tmpl)762  static inline void nft_set_ext_init(struct nft_set_ext *ext,
763  				    const struct nft_set_ext_tmpl *tmpl)
764  {
765  	memcpy(ext->offset, tmpl->offset, sizeof(ext->offset));
766  }
767  
__nft_set_ext_exists(const struct nft_set_ext * ext,u8 id)768  static inline bool __nft_set_ext_exists(const struct nft_set_ext *ext, u8 id)
769  {
770  	return !!ext->offset[id];
771  }
772  
nft_set_ext_exists(const struct nft_set_ext * ext,u8 id)773  static inline bool nft_set_ext_exists(const struct nft_set_ext *ext, u8 id)
774  {
775  	return ext && __nft_set_ext_exists(ext, id);
776  }
777  
nft_set_ext(const struct nft_set_ext * ext,u8 id)778  static inline void *nft_set_ext(const struct nft_set_ext *ext, u8 id)
779  {
780  	return (void *)ext + ext->offset[id];
781  }
782  
nft_set_ext_key(const struct nft_set_ext * ext)783  static inline struct nft_data *nft_set_ext_key(const struct nft_set_ext *ext)
784  {
785  	return nft_set_ext(ext, NFT_SET_EXT_KEY);
786  }
787  
nft_set_ext_key_end(const struct nft_set_ext * ext)788  static inline struct nft_data *nft_set_ext_key_end(const struct nft_set_ext *ext)
789  {
790  	return nft_set_ext(ext, NFT_SET_EXT_KEY_END);
791  }
792  
nft_set_ext_data(const struct nft_set_ext * ext)793  static inline struct nft_data *nft_set_ext_data(const struct nft_set_ext *ext)
794  {
795  	return nft_set_ext(ext, NFT_SET_EXT_DATA);
796  }
797  
nft_set_ext_flags(const struct nft_set_ext * ext)798  static inline u8 *nft_set_ext_flags(const struct nft_set_ext *ext)
799  {
800  	return nft_set_ext(ext, NFT_SET_EXT_FLAGS);
801  }
802  
nft_set_ext_timeout(const struct nft_set_ext * ext)803  static inline u64 *nft_set_ext_timeout(const struct nft_set_ext *ext)
804  {
805  	return nft_set_ext(ext, NFT_SET_EXT_TIMEOUT);
806  }
807  
nft_set_ext_expiration(const struct nft_set_ext * ext)808  static inline u64 *nft_set_ext_expiration(const struct nft_set_ext *ext)
809  {
810  	return nft_set_ext(ext, NFT_SET_EXT_EXPIRATION);
811  }
812  
nft_set_ext_userdata(const struct nft_set_ext * ext)813  static inline struct nft_userdata *nft_set_ext_userdata(const struct nft_set_ext *ext)
814  {
815  	return nft_set_ext(ext, NFT_SET_EXT_USERDATA);
816  }
817  
nft_set_ext_expr(const struct nft_set_ext * ext)818  static inline struct nft_set_elem_expr *nft_set_ext_expr(const struct nft_set_ext *ext)
819  {
820  	return nft_set_ext(ext, NFT_SET_EXT_EXPRESSIONS);
821  }
822  
nft_set_elem_expired(const struct nft_set_ext * ext)823  static inline bool nft_set_elem_expired(const struct nft_set_ext *ext)
824  {
825  	return nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION) &&
826  	       time_is_before_eq_jiffies64(*nft_set_ext_expiration(ext));
827  }
828  
nft_set_elem_ext(const struct nft_set * set,void * elem)829  static inline struct nft_set_ext *nft_set_elem_ext(const struct nft_set *set,
830  						   void *elem)
831  {
832  	return elem + set->ops->elemsize;
833  }
834  
nft_set_ext_obj(const struct nft_set_ext * ext)835  static inline struct nft_object **nft_set_ext_obj(const struct nft_set_ext *ext)
836  {
837  	return nft_set_ext(ext, NFT_SET_EXT_OBJREF);
838  }
839  
840  struct nft_expr *nft_set_elem_expr_alloc(const struct nft_ctx *ctx,
841  					 const struct nft_set *set,
842  					 const struct nlattr *attr);
843  
844  void *nft_set_elem_init(const struct nft_set *set,
845  			const struct nft_set_ext_tmpl *tmpl,
846  			const u32 *key, const u32 *key_end, const u32 *data,
847  			u64 timeout, u64 expiration, gfp_t gfp);
848  int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set,
849  			    struct nft_expr *expr_array[]);
850  void nft_set_elem_destroy(const struct nft_set *set, void *elem,
851  			  bool destroy_expr);
852  void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,
853  				const struct nft_set *set, void *elem);
854  
855  struct nft_expr_ops;
856  /**
857   *	struct nft_expr_type - nf_tables expression type
858   *
859   *	@select_ops: function to select nft_expr_ops
860   *	@release_ops: release nft_expr_ops
861   *	@ops: default ops, used when no select_ops functions is present
862   *	@inner_ops: inner ops, used for inner packet operation
863   *	@list: used internally
864   *	@name: Identifier
865   *	@owner: module reference
866   *	@policy: netlink attribute policy
867   *	@maxattr: highest netlink attribute number
868   *	@family: address family for AF-specific types
869   *	@flags: expression type flags
870   */
871  struct nft_expr_type {
872  	const struct nft_expr_ops	*(*select_ops)(const struct nft_ctx *,
873  						       const struct nlattr * const tb[]);
874  	void				(*release_ops)(const struct nft_expr_ops *ops);
875  	const struct nft_expr_ops	*ops;
876  	const struct nft_expr_ops	*inner_ops;
877  	struct list_head		list;
878  	const char			*name;
879  	struct module			*owner;
880  	const struct nla_policy		*policy;
881  	unsigned int			maxattr;
882  	u8				family;
883  	u8				flags;
884  };
885  
886  #define NFT_EXPR_STATEFUL		0x1
887  #define NFT_EXPR_GC			0x2
888  
889  enum nft_trans_phase {
890  	NFT_TRANS_PREPARE,
891  	NFT_TRANS_PREPARE_ERROR,
892  	NFT_TRANS_ABORT,
893  	NFT_TRANS_COMMIT,
894  	NFT_TRANS_RELEASE
895  };
896  
897  struct nft_flow_rule;
898  struct nft_offload_ctx;
899  
900  /**
901   *	struct nft_expr_ops - nf_tables expression operations
902   *
903   *	@eval: Expression evaluation function
904   *	@clone: Expression clone function
905   *	@size: full expression size, including private data size
906   *	@init: initialization function
907   *	@activate: activate expression in the next generation
908   *	@deactivate: deactivate expression in next generation
909   *	@destroy: destruction function, called after synchronize_rcu
910   *	@destroy_clone: destruction clone function
911   *	@dump: function to dump parameters
912   *	@validate: validate expression, called during loop detection
913   *	@reduce: reduce expression
914   *	@gc: garbage collection expression
915   *	@offload: hardware offload expression
916   *	@offload_action: function to report true/false to allocate one slot or not in the flow
917   *			 offload array
918   *	@offload_stats: function to synchronize hardware stats via updating the counter expression
919   *	@type: expression type
920   *	@data: extra data to attach to this expression operation
921   */
922  struct nft_expr_ops {
923  	void				(*eval)(const struct nft_expr *expr,
924  						struct nft_regs *regs,
925  						const struct nft_pktinfo *pkt);
926  	int				(*clone)(struct nft_expr *dst,
927  						 const struct nft_expr *src);
928  	unsigned int			size;
929  
930  	int				(*init)(const struct nft_ctx *ctx,
931  						const struct nft_expr *expr,
932  						const struct nlattr * const tb[]);
933  	void				(*activate)(const struct nft_ctx *ctx,
934  						    const struct nft_expr *expr);
935  	void				(*deactivate)(const struct nft_ctx *ctx,
936  						      const struct nft_expr *expr,
937  						      enum nft_trans_phase phase);
938  	void				(*destroy)(const struct nft_ctx *ctx,
939  						   const struct nft_expr *expr);
940  	void				(*destroy_clone)(const struct nft_ctx *ctx,
941  							 const struct nft_expr *expr);
942  	int				(*dump)(struct sk_buff *skb,
943  						const struct nft_expr *expr,
944  						bool reset);
945  	int				(*validate)(const struct nft_ctx *ctx,
946  						    const struct nft_expr *expr,
947  						    const struct nft_data **data);
948  	bool				(*reduce)(struct nft_regs_track *track,
949  						  const struct nft_expr *expr);
950  	bool				(*gc)(struct net *net,
951  					      const struct nft_expr *expr);
952  	int				(*offload)(struct nft_offload_ctx *ctx,
953  						   struct nft_flow_rule *flow,
954  						   const struct nft_expr *expr);
955  	bool				(*offload_action)(const struct nft_expr *expr);
956  	void				(*offload_stats)(struct nft_expr *expr,
957  							 const struct flow_stats *stats);
958  	const struct nft_expr_type	*type;
959  	void				*data;
960  };
961  
962  /**
963   *	struct nft_rule - nf_tables rule
964   *
965   *	@list: used internally
966   *	@handle: rule handle
967   *	@genmask: generation mask
968   *	@dlen: length of expression data
969   *	@udata: user data is appended to the rule
970   *	@data: expression data
971   */
972  struct nft_rule {
973  	struct list_head		list;
974  	u64				handle:42,
975  					genmask:2,
976  					dlen:12,
977  					udata:1;
978  	unsigned char			data[]
979  		__attribute__((aligned(__alignof__(struct nft_expr))));
980  };
981  
nft_expr_first(const struct nft_rule * rule)982  static inline struct nft_expr *nft_expr_first(const struct nft_rule *rule)
983  {
984  	return (struct nft_expr *)&rule->data[0];
985  }
986  
nft_expr_next(const struct nft_expr * expr)987  static inline struct nft_expr *nft_expr_next(const struct nft_expr *expr)
988  {
989  	return ((void *)expr) + expr->ops->size;
990  }
991  
nft_expr_last(const struct nft_rule * rule)992  static inline struct nft_expr *nft_expr_last(const struct nft_rule *rule)
993  {
994  	return (struct nft_expr *)&rule->data[rule->dlen];
995  }
996  
nft_expr_more(const struct nft_rule * rule,const struct nft_expr * expr)997  static inline bool nft_expr_more(const struct nft_rule *rule,
998  				 const struct nft_expr *expr)
999  {
1000  	return expr != nft_expr_last(rule) && expr->ops;
1001  }
1002  
nft_userdata(const struct nft_rule * rule)1003  static inline struct nft_userdata *nft_userdata(const struct nft_rule *rule)
1004  {
1005  	return (void *)&rule->data[rule->dlen];
1006  }
1007  
1008  void nft_rule_expr_activate(const struct nft_ctx *ctx, struct nft_rule *rule);
1009  void nft_rule_expr_deactivate(const struct nft_ctx *ctx, struct nft_rule *rule,
1010  			      enum nft_trans_phase phase);
1011  void nf_tables_rule_destroy(const struct nft_ctx *ctx, struct nft_rule *rule);
1012  
nft_set_elem_update_expr(const struct nft_set_ext * ext,struct nft_regs * regs,const struct nft_pktinfo * pkt)1013  static inline void nft_set_elem_update_expr(const struct nft_set_ext *ext,
1014  					    struct nft_regs *regs,
1015  					    const struct nft_pktinfo *pkt)
1016  {
1017  	struct nft_set_elem_expr *elem_expr;
1018  	struct nft_expr *expr;
1019  	u32 size;
1020  
1021  	if (__nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS)) {
1022  		elem_expr = nft_set_ext_expr(ext);
1023  		nft_setelem_expr_foreach(expr, elem_expr, size) {
1024  			expr->ops->eval(expr, regs, pkt);
1025  			if (regs->verdict.code == NFT_BREAK)
1026  				return;
1027  		}
1028  	}
1029  }
1030  
1031  /*
1032   * The last pointer isn't really necessary, but the compiler isn't able to
1033   * determine that the result of nft_expr_last() is always the same since it
1034   * can't assume that the dlen value wasn't changed within calls in the loop.
1035   */
1036  #define nft_rule_for_each_expr(expr, last, rule) \
1037  	for ((expr) = nft_expr_first(rule), (last) = nft_expr_last(rule); \
1038  	     (expr) != (last); \
1039  	     (expr) = nft_expr_next(expr))
1040  
1041  #define NFT_CHAIN_POLICY_UNSET		U8_MAX
1042  
1043  struct nft_rule_dp {
1044  	u64				is_last:1,
1045  					dlen:12,
1046  					handle:42;	/* for tracing */
1047  	unsigned char			data[]
1048  		__attribute__((aligned(__alignof__(struct nft_expr))));
1049  };
1050  
1051  struct nft_rule_dp_last {
1052  	struct nft_rule_dp end;		/* end of nft_rule_blob marker */
1053  	struct rcu_head h;		/* call_rcu head */
1054  	struct nft_rule_blob *blob;	/* ptr to free via call_rcu */
1055  	const struct nft_chain *chain;	/* for nftables tracing */
1056  };
1057  
nft_rule_next(const struct nft_rule_dp * rule)1058  static inline const struct nft_rule_dp *nft_rule_next(const struct nft_rule_dp *rule)
1059  {
1060  	return (void *)rule + sizeof(*rule) + rule->dlen;
1061  }
1062  
1063  struct nft_rule_blob {
1064  	unsigned long			size;
1065  	unsigned char			data[]
1066  		__attribute__((aligned(__alignof__(struct nft_rule_dp))));
1067  };
1068  
1069  /**
1070   *	struct nft_chain - nf_tables chain
1071   *
1072   *	@blob_gen_0: rule blob pointer to the current generation
1073   *	@blob_gen_1: rule blob pointer to the future generation
1074   *	@rules: list of rules in the chain
1075   *	@list: used internally
1076   *	@rhlhead: used internally
1077   *	@table: table that this chain belongs to
1078   *	@handle: chain handle
1079   *	@use: number of jump references to this chain
1080   *	@flags: bitmask of enum NFTA_CHAIN_FLAGS
1081   *	@bound: bind or not
1082   *	@genmask: generation mask
1083   *	@name: name of the chain
1084   *	@udlen: user data length
1085   *	@udata: user data in the chain
1086   *	@blob_next: rule blob pointer to the next in the chain
1087   */
1088  struct nft_chain {
1089  	struct nft_rule_blob		__rcu *blob_gen_0;
1090  	struct nft_rule_blob		__rcu *blob_gen_1;
1091  	struct list_head		rules;
1092  	struct list_head		list;
1093  	struct rhlist_head		rhlhead;
1094  	struct nft_table		*table;
1095  	u64				handle;
1096  	u32				use;
1097  	u8				flags:5,
1098  					bound:1,
1099  					genmask:2;
1100  	char				*name;
1101  	u16				udlen;
1102  	u8				*udata;
1103  
1104  	/* Only used during control plane commit phase: */
1105  	struct nft_rule_blob		*blob_next;
1106  };
1107  
1108  int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain);
1109  int nft_setelem_validate(const struct nft_ctx *ctx, struct nft_set *set,
1110  			 const struct nft_set_iter *iter,
1111  			 struct nft_set_elem *elem);
1112  int nft_set_catchall_validate(const struct nft_ctx *ctx, struct nft_set *set);
1113  int nf_tables_bind_chain(const struct nft_ctx *ctx, struct nft_chain *chain);
1114  void nf_tables_unbind_chain(const struct nft_ctx *ctx, struct nft_chain *chain);
1115  
1116  enum nft_chain_types {
1117  	NFT_CHAIN_T_DEFAULT = 0,
1118  	NFT_CHAIN_T_ROUTE,
1119  	NFT_CHAIN_T_NAT,
1120  	NFT_CHAIN_T_MAX
1121  };
1122  
1123  /**
1124   * 	struct nft_chain_type - nf_tables chain type info
1125   *
1126   * 	@name: name of the type
1127   * 	@type: numeric identifier
1128   * 	@family: address family
1129   * 	@owner: module owner
1130   * 	@hook_mask: mask of valid hooks
1131   * 	@hooks: array of hook functions
1132   *	@ops_register: base chain register function
1133   *	@ops_unregister: base chain unregister function
1134   */
1135  struct nft_chain_type {
1136  	const char			*name;
1137  	enum nft_chain_types		type;
1138  	int				family;
1139  	struct module			*owner;
1140  	unsigned int			hook_mask;
1141  	nf_hookfn			*hooks[NFT_MAX_HOOKS];
1142  	int				(*ops_register)(struct net *net, const struct nf_hook_ops *ops);
1143  	void				(*ops_unregister)(struct net *net, const struct nf_hook_ops *ops);
1144  };
1145  
1146  int nft_chain_validate_dependency(const struct nft_chain *chain,
1147  				  enum nft_chain_types type);
1148  int nft_chain_validate_hooks(const struct nft_chain *chain,
1149                               unsigned int hook_flags);
1150  
nft_chain_binding(const struct nft_chain * chain)1151  static inline bool nft_chain_binding(const struct nft_chain *chain)
1152  {
1153  	return chain->flags & NFT_CHAIN_BINDING;
1154  }
1155  
nft_chain_is_bound(struct nft_chain * chain)1156  static inline bool nft_chain_is_bound(struct nft_chain *chain)
1157  {
1158  	return (chain->flags & NFT_CHAIN_BINDING) && chain->bound;
1159  }
1160  
1161  int nft_chain_add(struct nft_table *table, struct nft_chain *chain);
1162  void nft_chain_del(struct nft_chain *chain);
1163  void nf_tables_chain_destroy(struct nft_chain *chain);
1164  
1165  struct nft_stats {
1166  	u64			bytes;
1167  	u64			pkts;
1168  	struct u64_stats_sync	syncp;
1169  };
1170  
1171  struct nft_hook {
1172  	struct list_head	list;
1173  	struct nf_hook_ops	ops;
1174  	struct rcu_head		rcu;
1175  };
1176  
1177  /**
1178   *	struct nft_base_chain - nf_tables base chain
1179   *
1180   *	@ops: netfilter hook ops
1181   *	@hook_list: list of netfilter hooks (for NFPROTO_NETDEV family)
1182   *	@type: chain type
1183   *	@policy: default policy
1184   *	@flags: indicate the base chain disabled or not
1185   *	@stats: per-cpu chain stats
1186   *	@chain: the chain
1187   *	@flow_block: flow block (for hardware offload)
1188   */
1189  struct nft_base_chain {
1190  	struct nf_hook_ops		ops;
1191  	struct list_head		hook_list;
1192  	const struct nft_chain_type	*type;
1193  	u8				policy;
1194  	u8				flags;
1195  	struct nft_stats __percpu	*stats;
1196  	struct nft_chain		chain;
1197  	struct flow_block		flow_block;
1198  };
1199  
nft_base_chain(const struct nft_chain * chain)1200  static inline struct nft_base_chain *nft_base_chain(const struct nft_chain *chain)
1201  {
1202  	return container_of(chain, struct nft_base_chain, chain);
1203  }
1204  
nft_is_base_chain(const struct nft_chain * chain)1205  static inline bool nft_is_base_chain(const struct nft_chain *chain)
1206  {
1207  	return chain->flags & NFT_CHAIN_BASE;
1208  }
1209  
1210  int __nft_release_basechain(struct nft_ctx *ctx);
1211  
1212  unsigned int nft_do_chain(struct nft_pktinfo *pkt, void *priv);
1213  
nft_use_inc(u32 * use)1214  static inline bool nft_use_inc(u32 *use)
1215  {
1216  	if (*use == UINT_MAX)
1217  		return false;
1218  
1219  	(*use)++;
1220  
1221  	return true;
1222  }
1223  
nft_use_dec(u32 * use)1224  static inline void nft_use_dec(u32 *use)
1225  {
1226  	WARN_ON_ONCE((*use)-- == 0);
1227  }
1228  
1229  /* For error and abort path: restore use counter to previous state. */
nft_use_inc_restore(u32 * use)1230  static inline void nft_use_inc_restore(u32 *use)
1231  {
1232  	WARN_ON_ONCE(!nft_use_inc(use));
1233  }
1234  
1235  #define nft_use_dec_restore	nft_use_dec
1236  
1237  /**
1238   *	struct nft_table - nf_tables table
1239   *
1240   *	@list: used internally
1241   *	@chains_ht: chains in the table
1242   *	@chains: same, for stable walks
1243   *	@sets: sets in the table
1244   *	@objects: stateful objects in the table
1245   *	@flowtables: flow tables in the table
1246   *	@hgenerator: handle generator state
1247   *	@handle: table handle
1248   *	@use: number of chain references to this table
1249   *	@flags: table flag (see enum nft_table_flags)
1250   *	@genmask: generation mask
1251   *	@afinfo: address family info
1252   *	@name: name of the table
1253   *	@validate_state: internal, set when transaction adds jumps
1254   */
1255  struct nft_table {
1256  	struct list_head		list;
1257  	struct rhltable			chains_ht;
1258  	struct list_head		chains;
1259  	struct list_head		sets;
1260  	struct list_head		objects;
1261  	struct list_head		flowtables;
1262  	u64				hgenerator;
1263  	u64				handle;
1264  	u32				use;
1265  	u16				family:6,
1266  					flags:8,
1267  					genmask:2;
1268  	u32				nlpid;
1269  	char				*name;
1270  	u16				udlen;
1271  	u8				*udata;
1272  	u8				validate_state;
1273  };
1274  
nft_table_has_owner(const struct nft_table * table)1275  static inline bool nft_table_has_owner(const struct nft_table *table)
1276  {
1277  	return table->flags & NFT_TABLE_F_OWNER;
1278  }
1279  
nft_base_chain_netdev(int family,u32 hooknum)1280  static inline bool nft_base_chain_netdev(int family, u32 hooknum)
1281  {
1282  	return family == NFPROTO_NETDEV ||
1283  	       (family == NFPROTO_INET && hooknum == NF_INET_INGRESS);
1284  }
1285  
1286  void nft_register_chain_type(const struct nft_chain_type *);
1287  void nft_unregister_chain_type(const struct nft_chain_type *);
1288  
1289  int nft_register_expr(struct nft_expr_type *);
1290  void nft_unregister_expr(struct nft_expr_type *);
1291  
1292  int nft_verdict_dump(struct sk_buff *skb, int type,
1293  		     const struct nft_verdict *v);
1294  
1295  /**
1296   *	struct nft_object_hash_key - key to lookup nft_object
1297   *
1298   *	@name: name of the stateful object to look up
1299   *	@table: table the object belongs to
1300   */
1301  struct nft_object_hash_key {
1302  	const char                      *name;
1303  	const struct nft_table          *table;
1304  };
1305  
1306  /**
1307   *	struct nft_object - nf_tables stateful object
1308   *
1309   *	@list: table stateful object list node
1310   *	@rhlhead: nft_objname_ht node
1311   *	@key: keys that identify this object
1312   *	@genmask: generation mask
1313   *	@use: number of references to this stateful object
1314   *	@handle: unique object handle
1315   *	@udlen: length of user data
1316   *	@udata: user data
1317   *	@ops: object operations
1318   *	@data: object data, layout depends on type
1319   */
1320  struct nft_object {
1321  	struct list_head		list;
1322  	struct rhlist_head		rhlhead;
1323  	struct nft_object_hash_key	key;
1324  	u32				genmask:2;
1325  	u32				use;
1326  	u64				handle;
1327  	u16				udlen;
1328  	u8				*udata;
1329  	/* runtime data below here */
1330  	const struct nft_object_ops	*ops ____cacheline_aligned;
1331  	unsigned char			data[]
1332  		__attribute__((aligned(__alignof__(u64))));
1333  };
1334  
nft_obj_data(const struct nft_object * obj)1335  static inline void *nft_obj_data(const struct nft_object *obj)
1336  {
1337  	return (void *)obj->data;
1338  }
1339  
1340  #define nft_expr_obj(expr)	*((struct nft_object **)nft_expr_priv(expr))
1341  
1342  struct nft_object *nft_obj_lookup(const struct net *net,
1343  				  const struct nft_table *table,
1344  				  const struct nlattr *nla, u32 objtype,
1345  				  u8 genmask);
1346  
1347  void nft_obj_notify(struct net *net, const struct nft_table *table,
1348  		    struct nft_object *obj, u32 portid, u32 seq,
1349  		    int event, u16 flags, int family, int report, gfp_t gfp);
1350  
1351  /**
1352   *	struct nft_object_type - stateful object type
1353   *
1354   *	@select_ops: function to select nft_object_ops
1355   *	@ops: default ops, used when no select_ops functions is present
1356   *	@list: list node in list of object types
1357   *	@type: stateful object numeric type
1358   *	@owner: module owner
1359   *	@maxattr: maximum netlink attribute
1360   *	@family: address family for AF-specific object types
1361   *	@policy: netlink attribute policy
1362   */
1363  struct nft_object_type {
1364  	const struct nft_object_ops	*(*select_ops)(const struct nft_ctx *,
1365  						       const struct nlattr * const tb[]);
1366  	const struct nft_object_ops	*ops;
1367  	struct list_head		list;
1368  	u32				type;
1369  	unsigned int                    maxattr;
1370  	u8				family;
1371  	struct module			*owner;
1372  	const struct nla_policy		*policy;
1373  };
1374  
1375  /**
1376   *	struct nft_object_ops - stateful object operations
1377   *
1378   *	@eval: stateful object evaluation function
1379   *	@size: stateful object size
1380   *	@init: initialize object from netlink attributes
1381   *	@destroy: release existing stateful object
1382   *	@dump: netlink dump stateful object
1383   *	@update: update stateful object
1384   *	@type: pointer to object type
1385   */
1386  struct nft_object_ops {
1387  	void				(*eval)(struct nft_object *obj,
1388  						struct nft_regs *regs,
1389  						const struct nft_pktinfo *pkt);
1390  	unsigned int			size;
1391  	int				(*init)(const struct nft_ctx *ctx,
1392  						const struct nlattr *const tb[],
1393  						struct nft_object *obj);
1394  	void				(*destroy)(const struct nft_ctx *ctx,
1395  						   struct nft_object *obj);
1396  	int				(*dump)(struct sk_buff *skb,
1397  						struct nft_object *obj,
1398  						bool reset);
1399  	void				(*update)(struct nft_object *obj,
1400  						  struct nft_object *newobj);
1401  	const struct nft_object_type	*type;
1402  };
1403  
1404  int nft_register_obj(struct nft_object_type *obj_type);
1405  void nft_unregister_obj(struct nft_object_type *obj_type);
1406  
1407  #define NFT_NETDEVICE_MAX	256
1408  
1409  /**
1410   *	struct nft_flowtable - nf_tables flow table
1411   *
1412   *	@list: flow table list node in table list
1413   * 	@table: the table the flow table is contained in
1414   *	@name: name of this flow table
1415   *	@hooknum: hook number
1416   *	@ops_len: number of hooks in array
1417   *	@genmask: generation mask
1418   *	@use: number of references to this flow table
1419   * 	@handle: unique object handle
1420   *	@hook_list: hook list for hooks per net_device in flowtables
1421   *	@data: rhashtable and garbage collector
1422   */
1423  struct nft_flowtable {
1424  	struct list_head		list;
1425  	struct nft_table		*table;
1426  	char				*name;
1427  	int				hooknum;
1428  	int				ops_len;
1429  	u32				genmask:2;
1430  	u32				use;
1431  	u64				handle;
1432  	/* runtime data below here */
1433  	struct list_head		hook_list ____cacheline_aligned;
1434  	struct nf_flowtable		data;
1435  };
1436  
1437  struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table,
1438  					   const struct nlattr *nla,
1439  					   u8 genmask);
1440  
1441  void nf_tables_deactivate_flowtable(const struct nft_ctx *ctx,
1442  				    struct nft_flowtable *flowtable,
1443  				    enum nft_trans_phase phase);
1444  
1445  void nft_register_flowtable_type(struct nf_flowtable_type *type);
1446  void nft_unregister_flowtable_type(struct nf_flowtable_type *type);
1447  
1448  /**
1449   *	struct nft_traceinfo - nft tracing information and state
1450   *
1451   *	@trace: other struct members are initialised
1452   *	@nf_trace: copy of skb->nf_trace before rule evaluation
1453   *	@type: event type (enum nft_trace_types)
1454   *	@skbid: hash of skb to be used as trace id
1455   *	@packet_dumped: packet headers sent in a previous traceinfo message
1456   *	@basechain: base chain currently processed
1457   */
1458  struct nft_traceinfo {
1459  	bool				trace;
1460  	bool				nf_trace;
1461  	bool				packet_dumped;
1462  	enum nft_trace_types		type:8;
1463  	u32				skbid;
1464  	const struct nft_base_chain	*basechain;
1465  };
1466  
1467  void nft_trace_init(struct nft_traceinfo *info, const struct nft_pktinfo *pkt,
1468  		    const struct nft_chain *basechain);
1469  
1470  void nft_trace_notify(const struct nft_pktinfo *pkt,
1471  		      const struct nft_verdict *verdict,
1472  		      const struct nft_rule_dp *rule,
1473  		      struct nft_traceinfo *info);
1474  
1475  #define MODULE_ALIAS_NFT_CHAIN(family, name) \
1476  	MODULE_ALIAS("nft-chain-" __stringify(family) "-" name)
1477  
1478  #define MODULE_ALIAS_NFT_AF_EXPR(family, name) \
1479  	MODULE_ALIAS("nft-expr-" __stringify(family) "-" name)
1480  
1481  #define MODULE_ALIAS_NFT_EXPR(name) \
1482  	MODULE_ALIAS("nft-expr-" name)
1483  
1484  #define MODULE_ALIAS_NFT_OBJ(type) \
1485  	MODULE_ALIAS("nft-obj-" __stringify(type))
1486  
1487  #if IS_ENABLED(CONFIG_NF_TABLES)
1488  
1489  /*
1490   * The gencursor defines two generations, the currently active and the
1491   * next one. Objects contain a bitmask of 2 bits specifying the generations
1492   * they're active in. A set bit means they're inactive in the generation
1493   * represented by that bit.
1494   *
1495   * New objects start out as inactive in the current and active in the
1496   * next generation. When committing the ruleset the bitmask is cleared,
1497   * meaning they're active in all generations. When removing an object,
1498   * it is set inactive in the next generation. After committing the ruleset,
1499   * the objects are removed.
1500   */
nft_gencursor_next(const struct net * net)1501  static inline unsigned int nft_gencursor_next(const struct net *net)
1502  {
1503  	return net->nft.gencursor + 1 == 1 ? 1 : 0;
1504  }
1505  
nft_genmask_next(const struct net * net)1506  static inline u8 nft_genmask_next(const struct net *net)
1507  {
1508  	return 1 << nft_gencursor_next(net);
1509  }
1510  
nft_genmask_cur(const struct net * net)1511  static inline u8 nft_genmask_cur(const struct net *net)
1512  {
1513  	/* Use READ_ONCE() to prevent refetching the value for atomicity */
1514  	return 1 << READ_ONCE(net->nft.gencursor);
1515  }
1516  
1517  #define NFT_GENMASK_ANY		((1 << 0) | (1 << 1))
1518  
1519  /*
1520   * Generic transaction helpers
1521   */
1522  
1523  /* Check if this object is currently active. */
1524  #define nft_is_active(__net, __obj)				\
1525  	(((__obj)->genmask & nft_genmask_cur(__net)) == 0)
1526  
1527  /* Check if this object is active in the next generation. */
1528  #define nft_is_active_next(__net, __obj)			\
1529  	(((__obj)->genmask & nft_genmask_next(__net)) == 0)
1530  
1531  /* This object becomes active in the next generation. */
1532  #define nft_activate_next(__net, __obj)				\
1533  	(__obj)->genmask = nft_genmask_cur(__net)
1534  
1535  /* This object becomes inactive in the next generation. */
1536  #define nft_deactivate_next(__net, __obj)			\
1537          (__obj)->genmask = nft_genmask_next(__net)
1538  
1539  /* After committing the ruleset, clear the stale generation bit. */
1540  #define nft_clear(__net, __obj)					\
1541  	(__obj)->genmask &= ~nft_genmask_next(__net)
1542  #define nft_active_genmask(__obj, __genmask)			\
1543  	!((__obj)->genmask & __genmask)
1544  
1545  /*
1546   * Set element transaction helpers
1547   */
1548  
nft_set_elem_active(const struct nft_set_ext * ext,u8 genmask)1549  static inline bool nft_set_elem_active(const struct nft_set_ext *ext,
1550  				       u8 genmask)
1551  {
1552  	return !(ext->genmask & genmask);
1553  }
1554  
nft_set_elem_change_active(const struct net * net,const struct nft_set * set,struct nft_set_ext * ext)1555  static inline void nft_set_elem_change_active(const struct net *net,
1556  					      const struct nft_set *set,
1557  					      struct nft_set_ext *ext)
1558  {
1559  	ext->genmask ^= nft_genmask_next(net);
1560  }
1561  
1562  #endif /* IS_ENABLED(CONFIG_NF_TABLES) */
1563  
1564  #define NFT_SET_ELEM_DEAD_MASK	(1 << 2)
1565  
1566  #if defined(__LITTLE_ENDIAN_BITFIELD)
1567  #define NFT_SET_ELEM_DEAD_BIT	2
1568  #elif defined(__BIG_ENDIAN_BITFIELD)
1569  #define NFT_SET_ELEM_DEAD_BIT	(BITS_PER_LONG - BITS_PER_BYTE + 2)
1570  #else
1571  #error
1572  #endif
1573  
nft_set_elem_dead(struct nft_set_ext * ext)1574  static inline void nft_set_elem_dead(struct nft_set_ext *ext)
1575  {
1576  	unsigned long *word = (unsigned long *)ext;
1577  
1578  	BUILD_BUG_ON(offsetof(struct nft_set_ext, genmask) != 0);
1579  	set_bit(NFT_SET_ELEM_DEAD_BIT, word);
1580  }
1581  
nft_set_elem_is_dead(const struct nft_set_ext * ext)1582  static inline int nft_set_elem_is_dead(const struct nft_set_ext *ext)
1583  {
1584  	unsigned long *word = (unsigned long *)ext;
1585  
1586  	BUILD_BUG_ON(offsetof(struct nft_set_ext, genmask) != 0);
1587  	return test_bit(NFT_SET_ELEM_DEAD_BIT, word);
1588  }
1589  
1590  /**
1591   *	struct nft_trans - nf_tables object update in transaction
1592   *
1593   *	@list: used internally
1594   *	@binding_list: list of objects with possible bindings
1595   *	@msg_type: message type
1596   *	@put_net: ctx->net needs to be put
1597   *	@ctx: transaction context
1598   *	@data: internal information related to the transaction
1599   */
1600  struct nft_trans {
1601  	struct list_head		list;
1602  	struct list_head		binding_list;
1603  	int				msg_type;
1604  	bool				put_net;
1605  	struct nft_ctx			ctx;
1606  	char				data[];
1607  };
1608  
1609  struct nft_trans_rule {
1610  	struct nft_rule			*rule;
1611  	struct nft_flow_rule		*flow;
1612  	u32				rule_id;
1613  	bool				bound;
1614  };
1615  
1616  #define nft_trans_rule(trans)	\
1617  	(((struct nft_trans_rule *)trans->data)->rule)
1618  #define nft_trans_flow_rule(trans)	\
1619  	(((struct nft_trans_rule *)trans->data)->flow)
1620  #define nft_trans_rule_id(trans)	\
1621  	(((struct nft_trans_rule *)trans->data)->rule_id)
1622  #define nft_trans_rule_bound(trans)	\
1623  	(((struct nft_trans_rule *)trans->data)->bound)
1624  
1625  struct nft_trans_set {
1626  	struct nft_set			*set;
1627  	u32				set_id;
1628  	u32				gc_int;
1629  	u64				timeout;
1630  	bool				update;
1631  	bool				bound;
1632  	u32				size;
1633  };
1634  
1635  #define nft_trans_set(trans)	\
1636  	(((struct nft_trans_set *)trans->data)->set)
1637  #define nft_trans_set_id(trans)	\
1638  	(((struct nft_trans_set *)trans->data)->set_id)
1639  #define nft_trans_set_bound(trans)	\
1640  	(((struct nft_trans_set *)trans->data)->bound)
1641  #define nft_trans_set_update(trans)	\
1642  	(((struct nft_trans_set *)trans->data)->update)
1643  #define nft_trans_set_timeout(trans)	\
1644  	(((struct nft_trans_set *)trans->data)->timeout)
1645  #define nft_trans_set_gc_int(trans)	\
1646  	(((struct nft_trans_set *)trans->data)->gc_int)
1647  #define nft_trans_set_size(trans)	\
1648  	(((struct nft_trans_set *)trans->data)->size)
1649  
1650  struct nft_trans_chain {
1651  	struct nft_chain		*chain;
1652  	bool				update;
1653  	char				*name;
1654  	struct nft_stats __percpu	*stats;
1655  	u8				policy;
1656  	bool				bound;
1657  	u32				chain_id;
1658  	struct nft_base_chain		*basechain;
1659  	struct list_head		hook_list;
1660  };
1661  
1662  #define nft_trans_chain(trans)	\
1663  	(((struct nft_trans_chain *)trans->data)->chain)
1664  #define nft_trans_chain_update(trans)	\
1665  	(((struct nft_trans_chain *)trans->data)->update)
1666  #define nft_trans_chain_name(trans)	\
1667  	(((struct nft_trans_chain *)trans->data)->name)
1668  #define nft_trans_chain_stats(trans)	\
1669  	(((struct nft_trans_chain *)trans->data)->stats)
1670  #define nft_trans_chain_policy(trans)	\
1671  	(((struct nft_trans_chain *)trans->data)->policy)
1672  #define nft_trans_chain_bound(trans)	\
1673  	(((struct nft_trans_chain *)trans->data)->bound)
1674  #define nft_trans_chain_id(trans)	\
1675  	(((struct nft_trans_chain *)trans->data)->chain_id)
1676  #define nft_trans_basechain(trans)	\
1677  	(((struct nft_trans_chain *)trans->data)->basechain)
1678  #define nft_trans_chain_hooks(trans)	\
1679  	(((struct nft_trans_chain *)trans->data)->hook_list)
1680  
1681  struct nft_trans_table {
1682  	bool				update;
1683  };
1684  
1685  #define nft_trans_table_update(trans)	\
1686  	(((struct nft_trans_table *)trans->data)->update)
1687  
1688  struct nft_trans_elem {
1689  	struct nft_set			*set;
1690  	struct nft_set_elem		elem;
1691  	bool				bound;
1692  };
1693  
1694  #define nft_trans_elem_set(trans)	\
1695  	(((struct nft_trans_elem *)trans->data)->set)
1696  #define nft_trans_elem(trans)	\
1697  	(((struct nft_trans_elem *)trans->data)->elem)
1698  #define nft_trans_elem_set_bound(trans)	\
1699  	(((struct nft_trans_elem *)trans->data)->bound)
1700  
1701  struct nft_trans_obj {
1702  	struct nft_object		*obj;
1703  	struct nft_object		*newobj;
1704  	bool				update;
1705  };
1706  
1707  #define nft_trans_obj(trans)	\
1708  	(((struct nft_trans_obj *)trans->data)->obj)
1709  #define nft_trans_obj_newobj(trans) \
1710  	(((struct nft_trans_obj *)trans->data)->newobj)
1711  #define nft_trans_obj_update(trans)	\
1712  	(((struct nft_trans_obj *)trans->data)->update)
1713  
1714  struct nft_trans_flowtable {
1715  	struct nft_flowtable		*flowtable;
1716  	bool				update;
1717  	struct list_head		hook_list;
1718  	u32				flags;
1719  };
1720  
1721  #define nft_trans_flowtable(trans)	\
1722  	(((struct nft_trans_flowtable *)trans->data)->flowtable)
1723  #define nft_trans_flowtable_update(trans)	\
1724  	(((struct nft_trans_flowtable *)trans->data)->update)
1725  #define nft_trans_flowtable_hooks(trans)	\
1726  	(((struct nft_trans_flowtable *)trans->data)->hook_list)
1727  #define nft_trans_flowtable_flags(trans)	\
1728  	(((struct nft_trans_flowtable *)trans->data)->flags)
1729  
1730  #define NFT_TRANS_GC_BATCHCOUNT	256
1731  
1732  struct nft_trans_gc {
1733  	struct list_head	list;
1734  	struct net		*net;
1735  	struct nft_set		*set;
1736  	u32			seq;
1737  	u16			count;
1738  	void			*priv[NFT_TRANS_GC_BATCHCOUNT];
1739  	struct rcu_head		rcu;
1740  };
1741  
1742  struct nft_trans_gc *nft_trans_gc_alloc(struct nft_set *set,
1743  					unsigned int gc_seq, gfp_t gfp);
1744  void nft_trans_gc_destroy(struct nft_trans_gc *trans);
1745  
1746  struct nft_trans_gc *nft_trans_gc_queue_async(struct nft_trans_gc *gc,
1747  					      unsigned int gc_seq, gfp_t gfp);
1748  void nft_trans_gc_queue_async_done(struct nft_trans_gc *gc);
1749  
1750  struct nft_trans_gc *nft_trans_gc_queue_sync(struct nft_trans_gc *gc, gfp_t gfp);
1751  void nft_trans_gc_queue_sync_done(struct nft_trans_gc *trans);
1752  
1753  void nft_trans_gc_elem_add(struct nft_trans_gc *gc, void *priv);
1754  
1755  struct nft_trans_gc *nft_trans_gc_catchall_async(struct nft_trans_gc *gc,
1756  						 unsigned int gc_seq);
1757  struct nft_trans_gc *nft_trans_gc_catchall_sync(struct nft_trans_gc *gc);
1758  
1759  void nft_setelem_data_deactivate(const struct net *net,
1760  				 const struct nft_set *set,
1761  				 struct nft_set_elem *elem);
1762  
1763  int __init nft_chain_filter_init(void);
1764  void nft_chain_filter_fini(void);
1765  
1766  void __init nft_chain_route_init(void);
1767  void nft_chain_route_fini(void);
1768  
1769  void nf_tables_trans_destroy_flush_work(void);
1770  
1771  int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result);
1772  __be64 nf_jiffies64_to_msecs(u64 input);
1773  
1774  #ifdef CONFIG_MODULES
1775  __printf(2, 3) int nft_request_module(struct net *net, const char *fmt, ...);
1776  #else
nft_request_module(struct net * net,const char * fmt,...)1777  static inline int nft_request_module(struct net *net, const char *fmt, ...) { return -ENOENT; }
1778  #endif
1779  
1780  struct nftables_pernet {
1781  	struct list_head	tables;
1782  	struct list_head	commit_list;
1783  	struct list_head	binding_list;
1784  	struct list_head	module_list;
1785  	struct list_head	notify_list;
1786  	struct mutex		commit_mutex;
1787  	u64			table_handle;
1788  	unsigned int		base_seq;
1789  	unsigned int		gc_seq;
1790  	u8			validate_state;
1791  };
1792  
1793  extern unsigned int nf_tables_net_id;
1794  
nft_pernet(const struct net * net)1795  static inline struct nftables_pernet *nft_pernet(const struct net *net)
1796  {
1797  	return net_generic(net, nf_tables_net_id);
1798  }
1799  
1800  #define __NFT_REDUCE_READONLY	1UL
1801  #define NFT_REDUCE_READONLY	(void *)__NFT_REDUCE_READONLY
1802  
nft_reduce_is_readonly(const struct nft_expr * expr)1803  static inline bool nft_reduce_is_readonly(const struct nft_expr *expr)
1804  {
1805  	return expr->ops->reduce == NFT_REDUCE_READONLY;
1806  }
1807  
1808  void nft_reg_track_update(struct nft_regs_track *track,
1809  			  const struct nft_expr *expr, u8 dreg, u8 len);
1810  void nft_reg_track_cancel(struct nft_regs_track *track, u8 dreg, u8 len);
1811  void __nft_reg_track_cancel(struct nft_regs_track *track, u8 dreg);
1812  
nft_reg_track_cmp(struct nft_regs_track * track,const struct nft_expr * expr,u8 dreg)1813  static inline bool nft_reg_track_cmp(struct nft_regs_track *track,
1814  				     const struct nft_expr *expr, u8 dreg)
1815  {
1816  	return track->regs[dreg].selector &&
1817  	       track->regs[dreg].selector->ops == expr->ops &&
1818  	       track->regs[dreg].num_reg == 0;
1819  }
1820  
1821  #endif /* _NET_NF_TABLES_H */
1822