xref: /openbmc/linux/include/linux/netfilter.h (revision 185c8f33) 
1 /* SPDX-License-Identifier: GPL-2.0 */
2 #ifndef __LINUX_NETFILTER_H
3 #define __LINUX_NETFILTER_H
4 
5 #include <linux/init.h>
6 #include <linux/skbuff.h>
7 #include <linux/net.h>
8 #include <linux/if.h>
9 #include <linux/in.h>
10 #include <linux/in6.h>
11 #include <linux/wait.h>
12 #include <linux/list.h>
13 #include <linux/static_key.h>
14 #include <linux/netfilter_defs.h>
15 #include <linux/netdevice.h>
16 #include <linux/sockptr.h>
17 #include <net/net_namespace.h>
18 
19 static inline int NF_DROP_GETERR(int verdict)
20 {
21 	return -(verdict >> NF_VERDICT_QBITS);
22 }
23 
24 static inline int nf_inet_addr_cmp(const union nf_inet_addr *a1,
25 				   const union nf_inet_addr *a2)
26 {
27 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && BITS_PER_LONG == 64
28 	const unsigned long *ul1 = (const unsigned long *)a1;
29 	const unsigned long *ul2 = (const unsigned long *)a2;
30 
31 	return ((ul1[0] ^ ul2[0]) | (ul1[1] ^ ul2[1])) == 0UL;
32 #else
33 	return a1->all[0] == a2->all[0] &&
34 	       a1->all[1] == a2->all[1] &&
35 	       a1->all[2] == a2->all[2] &&
36 	       a1->all[3] == a2->all[3];
37 #endif
38 }
39 
40 static inline void nf_inet_addr_mask(const union nf_inet_addr *a1,
41 				     union nf_inet_addr *result,
42 				     const union nf_inet_addr *mask)
43 {
44 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && BITS_PER_LONG == 64
45 	const unsigned long *ua = (const unsigned long *)a1;
46 	unsigned long *ur = (unsigned long *)result;
47 	const unsigned long *um = (const unsigned long *)mask;
48 
49 	ur[0] = ua[0] & um[0];
50 	ur[1] = ua[1] & um[1];
51 #else
52 	result->all[0] = a1->all[0] & mask->all[0];
53 	result->all[1] = a1->all[1] & mask->all[1];
54 	result->all[2] = a1->all[2] & mask->all[2];
55 	result->all[3] = a1->all[3] & mask->all[3];
56 #endif
57 }
58 
59 int netfilter_init(void);
60 
61 struct sk_buff;
62 
63 struct nf_hook_ops;
64 
65 struct sock;
66 
67 struct nf_hook_state {
68 	u8 hook;
69 	u8 pf;
70 	struct net_device *in;
71 	struct net_device *out;
72 	struct sock *sk;
73 	struct net *net;
74 	int (*okfn)(struct net *, struct sock *, struct sk_buff *);
75 };
76 
77 typedef unsigned int nf_hookfn(void *priv,
78 			       struct sk_buff *skb,
79 			       const struct nf_hook_state *state);
80 enum nf_hook_ops_type {
81 	NF_HOOK_OP_UNDEFINED,
82 	NF_HOOK_OP_NF_TABLES,
83 	NF_HOOK_OP_BPF,
84 };
85 
86 struct nf_hook_ops {
87 	/* User fills in from here down. */
88 	nf_hookfn		*hook;
89 	struct net_device	*dev;
90 	void			*priv;
91 	u8			pf;
92 	enum nf_hook_ops_type	hook_ops_type:8;
93 	unsigned int		hooknum;
94 	/* Hooks are ordered in ascending priority. */
95 	int			priority;
96 };
97 
98 struct nf_hook_entry {
99 	nf_hookfn			*hook;
100 	void				*priv;
101 };
102 
103 struct nf_hook_entries_rcu_head {
104 	struct rcu_head head;
105 	void	*allocation;
106 };
107 
108 struct nf_hook_entries {
109 	u16				num_hook_entries;
110 	/* padding */
111 	struct nf_hook_entry		hooks[];
112 
113 	/* trailer: pointers to original orig_ops of each hook,
114 	 * followed by rcu_head and scratch space used for freeing
115 	 * the structure via call_rcu.
116 	 *
117 	 *   This is not part of struct nf_hook_entry since its only
118 	 *   needed in slow path (hook register/unregister):
119 	 * const struct nf_hook_ops     *orig_ops[]
120 	 *
121 	 *   For the same reason, we store this at end -- its
122 	 *   only needed when a hook is deleted, not during
123 	 *   packet path processing:
124 	 * struct nf_hook_entries_rcu_head     head
125 	 */
126 };
127 
128 #ifdef CONFIG_NETFILTER
129 static inline struct nf_hook_ops **nf_hook_entries_get_hook_ops(const struct nf_hook_entries *e)
130 {
131 	unsigned int n = e->num_hook_entries;
132 	const void *hook_end;
133 
134 	hook_end = &e->hooks[n]; /* this is *past* ->hooks[]! */
135 
136 	return (struct nf_hook_ops **)hook_end;
137 }
138 
139 static inline int
140 nf_hook_entry_hookfn(const struct nf_hook_entry *entry, struct sk_buff *skb,
141 		     struct nf_hook_state *state)
142 {
143 	return entry->hook(entry->priv, skb, state);
144 }
145 
146 static inline void nf_hook_state_init(struct nf_hook_state *p,
147 				      unsigned int hook,
148 				      u_int8_t pf,
149 				      struct net_device *indev,
150 				      struct net_device *outdev,
151 				      struct sock *sk,
152 				      struct net *net,
153 				      int (*okfn)(struct net *, struct sock *, struct sk_buff *))
154 {
155 	p->hook = hook;
156 	p->pf = pf;
157 	p->in = indev;
158 	p->out = outdev;
159 	p->sk = sk;
160 	p->net = net;
161 	p->okfn = okfn;
162 }
163 
164 
165 
166 struct nf_sockopt_ops {
167 	struct list_head list;
168 
169 	u_int8_t pf;
170 
171 	/* Non-inclusive ranges: use 0/0/NULL to never get called. */
172 	int set_optmin;
173 	int set_optmax;
174 	int (*set)(struct sock *sk, int optval, sockptr_t arg,
175 		   unsigned int len);
176 	int get_optmin;
177 	int get_optmax;
178 	int (*get)(struct sock *sk, int optval, void __user *user, int *len);
179 	/* Use the module struct to lock set/get code in place */
180 	struct module *owner;
181 };
182 
183 /* Function to register/unregister hook points. */
184 int nf_register_net_hook(struct net *net, const struct nf_hook_ops *ops);
185 void nf_unregister_net_hook(struct net *net, const struct nf_hook_ops *ops);
186 int nf_register_net_hooks(struct net *net, const struct nf_hook_ops *reg,
187 			  unsigned int n);
188 void nf_unregister_net_hooks(struct net *net, const struct nf_hook_ops *reg,
189 			     unsigned int n);
190 
191 /* Functions to register get/setsockopt ranges (non-inclusive).  You
192    need to check permissions yourself! */
193 int nf_register_sockopt(struct nf_sockopt_ops *reg);
194 void nf_unregister_sockopt(struct nf_sockopt_ops *reg);
195 
196 #ifdef CONFIG_JUMP_LABEL
197 extern struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
198 #endif
199 
200 int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state,
201 		 const struct nf_hook_entries *e, unsigned int i);
202 
203 void nf_hook_slow_list(struct list_head *head, struct nf_hook_state *state,
204 		       const struct nf_hook_entries *e);
205 /**
206  *	nf_hook - call a netfilter hook
207  *
208  *	Returns 1 if the hook has allowed the packet to pass.  The function
209  *	okfn must be invoked by the caller in this case.  Any other return
210  *	value indicates the packet has been consumed by the hook.
211  */
212 static inline int nf_hook(u_int8_t pf, unsigned int hook, struct net *net,
213 			  struct sock *sk, struct sk_buff *skb,
214 			  struct net_device *indev, struct net_device *outdev,
215 			  int (*okfn)(struct net *, struct sock *, struct sk_buff *))
216 {
217 	struct nf_hook_entries *hook_head = NULL;
218 	int ret = 1;
219 
220 #ifdef CONFIG_JUMP_LABEL
221 	if (__builtin_constant_p(pf) &&
222 	    __builtin_constant_p(hook) &&
223 	    !static_key_false(&nf_hooks_needed[pf][hook]))
224 		return 1;
225 #endif
226 
227 	rcu_read_lock();
228 	switch (pf) {
229 	case NFPROTO_IPV4:
230 		hook_head = rcu_dereference(net->nf.hooks_ipv4[hook]);
231 		break;
232 	case NFPROTO_IPV6:
233 		hook_head = rcu_dereference(net->nf.hooks_ipv6[hook]);
234 		break;
235 	case NFPROTO_ARP:
236 #ifdef CONFIG_NETFILTER_FAMILY_ARP
237 		if (WARN_ON_ONCE(hook >= ARRAY_SIZE(net->nf.hooks_arp)))
238 			break;
239 		hook_head = rcu_dereference(net->nf.hooks_arp[hook]);
240 #endif
241 		break;
242 	case NFPROTO_BRIDGE:
243 #ifdef CONFIG_NETFILTER_FAMILY_BRIDGE
244 		hook_head = rcu_dereference(net->nf.hooks_bridge[hook]);
245 #endif
246 		break;
247 	default:
248 		WARN_ON_ONCE(1);
249 		break;
250 	}
251 
252 	if (hook_head) {
253 		struct nf_hook_state state;
254 
255 		nf_hook_state_init(&state, hook, pf, indev, outdev,
256 				   sk, net, okfn);
257 
258 		ret = nf_hook_slow(skb, &state, hook_head, 0);
259 	}
260 	rcu_read_unlock();
261 
262 	return ret;
263 }
264 
265 /* Activate hook; either okfn or kfree_skb called, unless a hook
266    returns NF_STOLEN (in which case, it's up to the hook to deal with
267    the consequences).
268 
269    Returns -ERRNO if packet dropped.  Zero means queued, stolen or
270    accepted.
271 */
272 
273 /* RR:
274    > I don't want nf_hook to return anything because people might forget
275    > about async and trust the return value to mean "packet was ok".
276 
277    AK:
278    Just document it clearly, then you can expect some sense from kernel
279    coders :)
280 */
281 
282 static inline int
283 NF_HOOK_COND(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk,
284 	     struct sk_buff *skb, struct net_device *in, struct net_device *out,
285 	     int (*okfn)(struct net *, struct sock *, struct sk_buff *),
286 	     bool cond)
287 {
288 	int ret;
289 
290 	if (!cond ||
291 	    ((ret = nf_hook(pf, hook, net, sk, skb, in, out, okfn)) == 1))
292 		ret = okfn(net, sk, skb);
293 	return ret;
294 }
295 
296 static inline int
297 NF_HOOK(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk, struct sk_buff *skb,
298 	struct net_device *in, struct net_device *out,
299 	int (*okfn)(struct net *, struct sock *, struct sk_buff *))
300 {
301 	int ret = nf_hook(pf, hook, net, sk, skb, in, out, okfn);
302 	if (ret == 1)
303 		ret = okfn(net, sk, skb);
304 	return ret;
305 }
306 
307 static inline void
308 NF_HOOK_LIST(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk,
309 	     struct list_head *head, struct net_device *in, struct net_device *out,
310 	     int (*okfn)(struct net *, struct sock *, struct sk_buff *))
311 {
312 	struct nf_hook_entries *hook_head = NULL;
313 
314 #ifdef CONFIG_JUMP_LABEL
315 	if (__builtin_constant_p(pf) &&
316 	    __builtin_constant_p(hook) &&
317 	    !static_key_false(&nf_hooks_needed[pf][hook]))
318 		return;
319 #endif
320 
321 	rcu_read_lock();
322 	switch (pf) {
323 	case NFPROTO_IPV4:
324 		hook_head = rcu_dereference(net->nf.hooks_ipv4[hook]);
325 		break;
326 	case NFPROTO_IPV6:
327 		hook_head = rcu_dereference(net->nf.hooks_ipv6[hook]);
328 		break;
329 	default:
330 		WARN_ON_ONCE(1);
331 		break;
332 	}
333 
334 	if (hook_head) {
335 		struct nf_hook_state state;
336 
337 		nf_hook_state_init(&state, hook, pf, in, out, sk, net, okfn);
338 
339 		nf_hook_slow_list(head, &state, hook_head);
340 	}
341 	rcu_read_unlock();
342 }
343 
344 /* Call setsockopt() */
345 int nf_setsockopt(struct sock *sk, u_int8_t pf, int optval, sockptr_t opt,
346 		  unsigned int len);
347 int nf_getsockopt(struct sock *sk, u_int8_t pf, int optval, char __user *opt,
348 		  int *len);
349 
350 struct flowi;
351 struct nf_queue_entry;
352 
353 __sum16 nf_checksum(struct sk_buff *skb, unsigned int hook,
354 		    unsigned int dataoff, u_int8_t protocol,
355 		    unsigned short family);
356 
357 __sum16 nf_checksum_partial(struct sk_buff *skb, unsigned int hook,
358 			    unsigned int dataoff, unsigned int len,
359 			    u_int8_t protocol, unsigned short family);
360 int nf_route(struct net *net, struct dst_entry **dst, struct flowi *fl,
361 	     bool strict, unsigned short family);
362 int nf_reroute(struct sk_buff *skb, struct nf_queue_entry *entry);
363 
364 #include <net/flow.h>
365 
366 struct nf_conn;
367 enum nf_nat_manip_type;
368 struct nlattr;
369 enum ip_conntrack_dir;
370 
371 struct nf_nat_hook {
372 	int (*parse_nat_setup)(struct nf_conn *ct, enum nf_nat_manip_type manip,
373 			       const struct nlattr *attr);
374 	void (*decode_session)(struct sk_buff *skb, struct flowi *fl);
375 	unsigned int (*manip_pkt)(struct sk_buff *skb, struct nf_conn *ct,
376 				  enum nf_nat_manip_type mtype,
377 				  enum ip_conntrack_dir dir);
378 	void (*remove_nat_bysrc)(struct nf_conn *ct);
379 };
380 
381 extern const struct nf_nat_hook __rcu *nf_nat_hook;
382 
383 static inline void
384 nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family)
385 {
386 #if IS_ENABLED(CONFIG_NF_NAT)
387 	const struct nf_nat_hook *nat_hook;
388 
389 	rcu_read_lock();
390 	nat_hook = rcu_dereference(nf_nat_hook);
391 	if (nat_hook && nat_hook->decode_session)
392 		nat_hook->decode_session(skb, fl);
393 	rcu_read_unlock();
394 #endif
395 }
396 
397 #else /* !CONFIG_NETFILTER */
398 static inline int
399 NF_HOOK_COND(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk,
400 	     struct sk_buff *skb, struct net_device *in, struct net_device *out,
401 	     int (*okfn)(struct net *, struct sock *, struct sk_buff *),
402 	     bool cond)
403 {
404 	return okfn(net, sk, skb);
405 }
406 
407 static inline int
408 NF_HOOK(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk,
409 	struct sk_buff *skb, struct net_device *in, struct net_device *out,
410 	int (*okfn)(struct net *, struct sock *, struct sk_buff *))
411 {
412 	return okfn(net, sk, skb);
413 }
414 
415 static inline void
416 NF_HOOK_LIST(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk,
417 	     struct list_head *head, struct net_device *in, struct net_device *out,
418 	     int (*okfn)(struct net *, struct sock *, struct sk_buff *))
419 {
420 	/* nothing to do */
421 }
422 
423 static inline int nf_hook(u_int8_t pf, unsigned int hook, struct net *net,
424 			  struct sock *sk, struct sk_buff *skb,
425 			  struct net_device *indev, struct net_device *outdev,
426 			  int (*okfn)(struct net *, struct sock *, struct sk_buff *))
427 {
428 	return 1;
429 }
430 struct flowi;
431 static inline void
432 nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family)
433 {
434 }
435 #endif /*CONFIG_NETFILTER*/
436 
437 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
438 #include <linux/netfilter/nf_conntrack_zones_common.h>
439 
440 void nf_ct_attach(struct sk_buff *, const struct sk_buff *);
441 void nf_ct_set_closing(struct nf_conntrack *nfct);
442 struct nf_conntrack_tuple;
443 bool nf_ct_get_tuple_skb(struct nf_conntrack_tuple *dst_tuple,
444 			 const struct sk_buff *skb);
445 #else
446 static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {}
447 static inline void nf_ct_set_closing(struct nf_conntrack *nfct) {}
448 struct nf_conntrack_tuple;
449 static inline bool nf_ct_get_tuple_skb(struct nf_conntrack_tuple *dst_tuple,
450 				       const struct sk_buff *skb)
451 {
452 	return false;
453 }
454 #endif
455 
456 struct nf_conn;
457 enum ip_conntrack_info;
458 
459 struct nf_ct_hook {
460 	int (*update)(struct net *net, struct sk_buff *skb);
461 	void (*destroy)(struct nf_conntrack *);
462 	bool (*get_tuple_skb)(struct nf_conntrack_tuple *,
463 			      const struct sk_buff *);
464 	void (*attach)(struct sk_buff *nskb, const struct sk_buff *skb);
465 	void (*set_closing)(struct nf_conntrack *nfct);
466 };
467 extern const struct nf_ct_hook __rcu *nf_ct_hook;
468 
469 struct nlattr;
470 
471 struct nfnl_ct_hook {
472 	size_t (*build_size)(const struct nf_conn *ct);
473 	int (*build)(struct sk_buff *skb, struct nf_conn *ct,
474 		     enum ip_conntrack_info ctinfo,
475 		     u_int16_t ct_attr, u_int16_t ct_info_attr);
476 	int (*parse)(const struct nlattr *attr, struct nf_conn *ct);
477 	int (*attach_expect)(const struct nlattr *attr, struct nf_conn *ct,
478 			     u32 portid, u32 report);
479 	void (*seq_adjust)(struct sk_buff *skb, struct nf_conn *ct,
480 			   enum ip_conntrack_info ctinfo, s32 off);
481 };
482 extern const struct nfnl_ct_hook __rcu *nfnl_ct_hook;
483 
484 /*
485  * nf_skb_duplicated - TEE target has sent a packet
486  *
487  * When a xtables target sends a packet, the OUTPUT and POSTROUTING
488  * hooks are traversed again, i.e. nft and xtables are invoked recursively.
489  *
490  * This is used by xtables TEE target to prevent the duplicated skb from
491  * being duplicated again.
492  */
493 DECLARE_PER_CPU(bool, nf_skb_duplicated);
494 
495 /*
496  * Contains bitmask of ctnetlink event subscribers, if any.
497  * Can't be pernet due to NETLINK_LISTEN_ALL_NSID setsockopt flag.
498  */
499 extern u8 nf_ctnetlink_has_listener;
500 #endif /*__LINUX_NETFILTER_H*/
501