1 #ifndef __LINUX_NETFILTER_H 2 #define __LINUX_NETFILTER_H 3 4 #ifdef __KERNEL__ 5 #include <linux/init.h> 6 #include <linux/skbuff.h> 7 #include <linux/net.h> 8 #include <linux/if.h> 9 #include <linux/in.h> 10 #include <linux/in6.h> 11 #include <linux/wait.h> 12 #include <linux/list.h> 13 #endif 14 #include <linux/types.h> 15 #include <linux/compiler.h> 16 #include <linux/sysctl.h> 17 18 /* Responses from hook functions. */ 19 #define NF_DROP 0 20 #define NF_ACCEPT 1 21 #define NF_STOLEN 2 22 #define NF_QUEUE 3 23 #define NF_REPEAT 4 24 #define NF_STOP 5 25 #define NF_MAX_VERDICT NF_STOP 26 27 /* we overload the higher bits for encoding auxiliary data such as the queue 28 * number or errno values. Not nice, but better than additional function 29 * arguments. */ 30 #define NF_VERDICT_MASK 0x000000ff 31 32 /* extra verdict flags have mask 0x0000ff00 */ 33 #define NF_VERDICT_FLAG_QUEUE_BYPASS 0x00008000 34 35 /* queue number (NF_QUEUE) or errno (NF_DROP) */ 36 #define NF_VERDICT_QMASK 0xffff0000 37 #define NF_VERDICT_QBITS 16 38 39 #define NF_QUEUE_NR(x) ((((x) << 16) & NF_VERDICT_QMASK) | NF_QUEUE) 40 41 #define NF_DROP_ERR(x) (((-x) << 16) | NF_DROP) 42 43 /* only for userspace compatibility */ 44 #ifndef __KERNEL__ 45 /* Generic cache responses from hook functions. 46 <= 0x2000 is used for protocol-flags. */ 47 #define NFC_UNKNOWN 0x4000 48 #define NFC_ALTERED 0x8000 49 50 /* NF_VERDICT_BITS should be 8 now, but userspace might break if this changes */ 51 #define NF_VERDICT_BITS 16 52 #endif 53 54 enum nf_inet_hooks { 55 NF_INET_PRE_ROUTING, 56 NF_INET_LOCAL_IN, 57 NF_INET_FORWARD, 58 NF_INET_LOCAL_OUT, 59 NF_INET_POST_ROUTING, 60 NF_INET_NUMHOOKS 61 }; 62 63 enum { 64 NFPROTO_UNSPEC = 0, 65 NFPROTO_IPV4 = 2, 66 NFPROTO_ARP = 3, 67 NFPROTO_BRIDGE = 7, 68 NFPROTO_IPV6 = 10, 69 NFPROTO_DECNET = 12, 70 NFPROTO_NUMPROTO, 71 }; 72 73 union nf_inet_addr { 74 __u32 all[4]; 75 __be32 ip; 76 __be32 ip6[4]; 77 struct in_addr in; 78 struct in6_addr in6; 79 }; 80 81 #ifdef __KERNEL__ 82 #ifdef CONFIG_NETFILTER 83 static inline int NF_DROP_GETERR(int verdict) 84 { 85 return -(verdict >> NF_VERDICT_QBITS); 86 } 87 88 static inline int nf_inet_addr_cmp(const union nf_inet_addr *a1, 89 const union nf_inet_addr *a2) 90 { 91 return a1->all[0] == a2->all[0] && 92 a1->all[1] == a2->all[1] && 93 a1->all[2] == a2->all[2] && 94 a1->all[3] == a2->all[3]; 95 } 96 97 static inline void nf_inet_addr_mask(const union nf_inet_addr *a1, 98 union nf_inet_addr *result, 99 const union nf_inet_addr *mask) 100 { 101 result->all[0] = a1->all[0] & mask->all[0]; 102 result->all[1] = a1->all[1] & mask->all[1]; 103 result->all[2] = a1->all[2] & mask->all[2]; 104 result->all[3] = a1->all[3] & mask->all[3]; 105 } 106 107 extern void netfilter_init(void); 108 109 /* Largest hook number + 1 */ 110 #define NF_MAX_HOOKS 8 111 112 struct sk_buff; 113 114 typedef unsigned int nf_hookfn(unsigned int hooknum, 115 struct sk_buff *skb, 116 const struct net_device *in, 117 const struct net_device *out, 118 int (*okfn)(struct sk_buff *)); 119 120 struct nf_hook_ops { 121 struct list_head list; 122 123 /* User fills in from here down. */ 124 nf_hookfn *hook; 125 struct module *owner; 126 u_int8_t pf; 127 unsigned int hooknum; 128 /* Hooks are ordered in ascending priority. */ 129 int priority; 130 }; 131 132 struct nf_sockopt_ops { 133 struct list_head list; 134 135 u_int8_t pf; 136 137 /* Non-inclusive ranges: use 0/0/NULL to never get called. */ 138 int set_optmin; 139 int set_optmax; 140 int (*set)(struct sock *sk, int optval, void __user *user, unsigned int len); 141 #ifdef CONFIG_COMPAT 142 int (*compat_set)(struct sock *sk, int optval, 143 void __user *user, unsigned int len); 144 #endif 145 int get_optmin; 146 int get_optmax; 147 int (*get)(struct sock *sk, int optval, void __user *user, int *len); 148 #ifdef CONFIG_COMPAT 149 int (*compat_get)(struct sock *sk, int optval, 150 void __user *user, int *len); 151 #endif 152 /* Use the module struct to lock set/get code in place */ 153 struct module *owner; 154 }; 155 156 /* Function to register/unregister hook points. */ 157 int nf_register_hook(struct nf_hook_ops *reg); 158 void nf_unregister_hook(struct nf_hook_ops *reg); 159 int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n); 160 void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n); 161 162 /* Functions to register get/setsockopt ranges (non-inclusive). You 163 need to check permissions yourself! */ 164 int nf_register_sockopt(struct nf_sockopt_ops *reg); 165 void nf_unregister_sockopt(struct nf_sockopt_ops *reg); 166 167 extern struct list_head nf_hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS]; 168 169 #if defined(CONFIG_JUMP_LABEL) 170 #include <linux/static_key.h> 171 extern struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS]; 172 static inline bool nf_hooks_active(u_int8_t pf, unsigned int hook) 173 { 174 if (__builtin_constant_p(pf) && 175 __builtin_constant_p(hook)) 176 return static_key_false(&nf_hooks_needed[pf][hook]); 177 178 return !list_empty(&nf_hooks[pf][hook]); 179 } 180 #else 181 static inline bool nf_hooks_active(u_int8_t pf, unsigned int hook) 182 { 183 return !list_empty(&nf_hooks[pf][hook]); 184 } 185 #endif 186 187 int nf_hook_slow(u_int8_t pf, unsigned int hook, struct sk_buff *skb, 188 struct net_device *indev, struct net_device *outdev, 189 int (*okfn)(struct sk_buff *), int thresh); 190 191 /** 192 * nf_hook_thresh - call a netfilter hook 193 * 194 * Returns 1 if the hook has allowed the packet to pass. The function 195 * okfn must be invoked by the caller in this case. Any other return 196 * value indicates the packet has been consumed by the hook. 197 */ 198 static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook, 199 struct sk_buff *skb, 200 struct net_device *indev, 201 struct net_device *outdev, 202 int (*okfn)(struct sk_buff *), int thresh) 203 { 204 if (nf_hooks_active(pf, hook)) 205 return nf_hook_slow(pf, hook, skb, indev, outdev, okfn, thresh); 206 return 1; 207 } 208 209 static inline int nf_hook(u_int8_t pf, unsigned int hook, struct sk_buff *skb, 210 struct net_device *indev, struct net_device *outdev, 211 int (*okfn)(struct sk_buff *)) 212 { 213 return nf_hook_thresh(pf, hook, skb, indev, outdev, okfn, INT_MIN); 214 } 215 216 /* Activate hook; either okfn or kfree_skb called, unless a hook 217 returns NF_STOLEN (in which case, it's up to the hook to deal with 218 the consequences). 219 220 Returns -ERRNO if packet dropped. Zero means queued, stolen or 221 accepted. 222 */ 223 224 /* RR: 225 > I don't want nf_hook to return anything because people might forget 226 > about async and trust the return value to mean "packet was ok". 227 228 AK: 229 Just document it clearly, then you can expect some sense from kernel 230 coders :) 231 */ 232 233 static inline int 234 NF_HOOK_THRESH(uint8_t pf, unsigned int hook, struct sk_buff *skb, 235 struct net_device *in, struct net_device *out, 236 int (*okfn)(struct sk_buff *), int thresh) 237 { 238 int ret = nf_hook_thresh(pf, hook, skb, in, out, okfn, thresh); 239 if (ret == 1) 240 ret = okfn(skb); 241 return ret; 242 } 243 244 static inline int 245 NF_HOOK_COND(uint8_t pf, unsigned int hook, struct sk_buff *skb, 246 struct net_device *in, struct net_device *out, 247 int (*okfn)(struct sk_buff *), bool cond) 248 { 249 int ret; 250 251 if (!cond || 252 ((ret = nf_hook_thresh(pf, hook, skb, in, out, okfn, INT_MIN)) == 1)) 253 ret = okfn(skb); 254 return ret; 255 } 256 257 static inline int 258 NF_HOOK(uint8_t pf, unsigned int hook, struct sk_buff *skb, 259 struct net_device *in, struct net_device *out, 260 int (*okfn)(struct sk_buff *)) 261 { 262 return NF_HOOK_THRESH(pf, hook, skb, in, out, okfn, INT_MIN); 263 } 264 265 /* Call setsockopt() */ 266 int nf_setsockopt(struct sock *sk, u_int8_t pf, int optval, char __user *opt, 267 unsigned int len); 268 int nf_getsockopt(struct sock *sk, u_int8_t pf, int optval, char __user *opt, 269 int *len); 270 #ifdef CONFIG_COMPAT 271 int compat_nf_setsockopt(struct sock *sk, u_int8_t pf, int optval, 272 char __user *opt, unsigned int len); 273 int compat_nf_getsockopt(struct sock *sk, u_int8_t pf, int optval, 274 char __user *opt, int *len); 275 #endif 276 277 /* Call this before modifying an existing packet: ensures it is 278 modifiable and linear to the point you care about (writable_len). 279 Returns true or false. */ 280 extern int skb_make_writable(struct sk_buff *skb, unsigned int writable_len); 281 282 struct flowi; 283 struct nf_queue_entry; 284 285 struct nf_afinfo { 286 unsigned short family; 287 __sum16 (*checksum)(struct sk_buff *skb, unsigned int hook, 288 unsigned int dataoff, u_int8_t protocol); 289 __sum16 (*checksum_partial)(struct sk_buff *skb, 290 unsigned int hook, 291 unsigned int dataoff, 292 unsigned int len, 293 u_int8_t protocol); 294 int (*route)(struct net *net, struct dst_entry **dst, 295 struct flowi *fl, bool strict); 296 void (*saveroute)(const struct sk_buff *skb, 297 struct nf_queue_entry *entry); 298 int (*reroute)(struct sk_buff *skb, 299 const struct nf_queue_entry *entry); 300 int route_key_size; 301 }; 302 303 extern const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO]; 304 static inline const struct nf_afinfo *nf_get_afinfo(unsigned short family) 305 { 306 return rcu_dereference(nf_afinfo[family]); 307 } 308 309 static inline __sum16 310 nf_checksum(struct sk_buff *skb, unsigned int hook, unsigned int dataoff, 311 u_int8_t protocol, unsigned short family) 312 { 313 const struct nf_afinfo *afinfo; 314 __sum16 csum = 0; 315 316 rcu_read_lock(); 317 afinfo = nf_get_afinfo(family); 318 if (afinfo) 319 csum = afinfo->checksum(skb, hook, dataoff, protocol); 320 rcu_read_unlock(); 321 return csum; 322 } 323 324 static inline __sum16 325 nf_checksum_partial(struct sk_buff *skb, unsigned int hook, 326 unsigned int dataoff, unsigned int len, 327 u_int8_t protocol, unsigned short family) 328 { 329 const struct nf_afinfo *afinfo; 330 __sum16 csum = 0; 331 332 rcu_read_lock(); 333 afinfo = nf_get_afinfo(family); 334 if (afinfo) 335 csum = afinfo->checksum_partial(skb, hook, dataoff, len, 336 protocol); 337 rcu_read_unlock(); 338 return csum; 339 } 340 341 extern int nf_register_afinfo(const struct nf_afinfo *afinfo); 342 extern void nf_unregister_afinfo(const struct nf_afinfo *afinfo); 343 344 #include <net/flow.h> 345 extern void (*ip_nat_decode_session)(struct sk_buff *, struct flowi *); 346 347 static inline void 348 nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family) 349 { 350 #ifdef CONFIG_NF_NAT_NEEDED 351 void (*decodefn)(struct sk_buff *, struct flowi *); 352 353 if (family == AF_INET) { 354 rcu_read_lock(); 355 decodefn = rcu_dereference(ip_nat_decode_session); 356 if (decodefn) 357 decodefn(skb, fl); 358 rcu_read_unlock(); 359 } 360 #endif 361 } 362 363 #ifdef CONFIG_PROC_FS 364 #include <linux/proc_fs.h> 365 extern struct proc_dir_entry *proc_net_netfilter; 366 #endif 367 368 #else /* !CONFIG_NETFILTER */ 369 #define NF_HOOK(pf, hook, skb, indev, outdev, okfn) (okfn)(skb) 370 #define NF_HOOK_COND(pf, hook, skb, indev, outdev, okfn, cond) (okfn)(skb) 371 static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook, 372 struct sk_buff *skb, 373 struct net_device *indev, 374 struct net_device *outdev, 375 int (*okfn)(struct sk_buff *), int thresh) 376 { 377 return okfn(skb); 378 } 379 static inline int nf_hook(u_int8_t pf, unsigned int hook, struct sk_buff *skb, 380 struct net_device *indev, struct net_device *outdev, 381 int (*okfn)(struct sk_buff *)) 382 { 383 return 1; 384 } 385 struct flowi; 386 static inline void 387 nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family) 388 { 389 } 390 #endif /*CONFIG_NETFILTER*/ 391 392 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE) 393 extern void (*ip_ct_attach)(struct sk_buff *, struct sk_buff *) __rcu; 394 extern void nf_ct_attach(struct sk_buff *, struct sk_buff *); 395 extern void (*nf_ct_destroy)(struct nf_conntrack *) __rcu; 396 397 struct nf_conn; 398 struct nlattr; 399 400 struct nfq_ct_hook { 401 size_t (*build_size)(const struct nf_conn *ct); 402 int (*build)(struct sk_buff *skb, struct nf_conn *ct); 403 int (*parse)(const struct nlattr *attr, struct nf_conn *ct); 404 }; 405 extern struct nfq_ct_hook __rcu *nfq_ct_hook; 406 407 struct nfq_ct_nat_hook { 408 void (*seq_adjust)(struct sk_buff *skb, struct nf_conn *ct, 409 u32 ctinfo, int off); 410 }; 411 extern struct nfq_ct_nat_hook __rcu *nfq_ct_nat_hook; 412 #else 413 static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {} 414 #endif 415 416 #endif /*__KERNEL__*/ 417 #endif /*__LINUX_NETFILTER_H*/ 418