1 #ifndef __LINUX_NETFILTER_H 2 #define __LINUX_NETFILTER_H 3 4 #ifdef __KERNEL__ 5 #include <linux/init.h> 6 #include <linux/skbuff.h> 7 #include <linux/net.h> 8 #include <linux/if.h> 9 #include <linux/in.h> 10 #include <linux/in6.h> 11 #include <linux/wait.h> 12 #include <linux/list.h> 13 #endif 14 #include <linux/types.h> 15 #include <linux/compiler.h> 16 #include <linux/sysctl.h> 17 18 /* Responses from hook functions. */ 19 #define NF_DROP 0 20 #define NF_ACCEPT 1 21 #define NF_STOLEN 2 22 #define NF_QUEUE 3 23 #define NF_REPEAT 4 24 #define NF_STOP 5 25 #define NF_MAX_VERDICT NF_STOP 26 27 /* we overload the higher bits for encoding auxiliary data such as the queue 28 * number or errno values. Not nice, but better than additional function 29 * arguments. */ 30 #define NF_VERDICT_MASK 0x000000ff 31 32 /* extra verdict flags have mask 0x0000ff00 */ 33 #define NF_VERDICT_FLAG_QUEUE_BYPASS 0x00008000 34 35 /* queue number (NF_QUEUE) or errno (NF_DROP) */ 36 #define NF_VERDICT_QMASK 0xffff0000 37 #define NF_VERDICT_QBITS 16 38 39 #define NF_QUEUE_NR(x) ((((x) << 16) & NF_VERDICT_QMASK) | NF_QUEUE) 40 41 #define NF_DROP_ERR(x) (((-x) << 16) | NF_DROP) 42 43 /* only for userspace compatibility */ 44 #ifndef __KERNEL__ 45 /* Generic cache responses from hook functions. 46 <= 0x2000 is used for protocol-flags. */ 47 #define NFC_UNKNOWN 0x4000 48 #define NFC_ALTERED 0x8000 49 50 /* NF_VERDICT_BITS should be 8 now, but userspace might break if this changes */ 51 #define NF_VERDICT_BITS 16 52 #endif 53 54 enum nf_inet_hooks { 55 NF_INET_PRE_ROUTING, 56 NF_INET_LOCAL_IN, 57 NF_INET_FORWARD, 58 NF_INET_LOCAL_OUT, 59 NF_INET_POST_ROUTING, 60 NF_INET_NUMHOOKS 61 }; 62 63 enum { 64 NFPROTO_UNSPEC = 0, 65 NFPROTO_IPV4 = 2, 66 NFPROTO_ARP = 3, 67 NFPROTO_BRIDGE = 7, 68 NFPROTO_IPV6 = 10, 69 NFPROTO_DECNET = 12, 70 NFPROTO_NUMPROTO, 71 }; 72 73 union nf_inet_addr { 74 __u32 all[4]; 75 __be32 ip; 76 __be32 ip6[4]; 77 struct in_addr in; 78 struct in6_addr in6; 79 }; 80 81 #ifdef __KERNEL__ 82 #ifdef CONFIG_NETFILTER 83 static inline int NF_DROP_GETERR(int verdict) 84 { 85 return -(verdict >> NF_VERDICT_QBITS); 86 } 87 88 static inline int nf_inet_addr_cmp(const union nf_inet_addr *a1, 89 const union nf_inet_addr *a2) 90 { 91 return a1->all[0] == a2->all[0] && 92 a1->all[1] == a2->all[1] && 93 a1->all[2] == a2->all[2] && 94 a1->all[3] == a2->all[3]; 95 } 96 97 extern void netfilter_init(void); 98 99 /* Largest hook number + 1 */ 100 #define NF_MAX_HOOKS 8 101 102 struct sk_buff; 103 104 typedef unsigned int nf_hookfn(unsigned int hooknum, 105 struct sk_buff *skb, 106 const struct net_device *in, 107 const struct net_device *out, 108 int (*okfn)(struct sk_buff *)); 109 110 struct nf_hook_ops { 111 struct list_head list; 112 113 /* User fills in from here down. */ 114 nf_hookfn *hook; 115 struct module *owner; 116 u_int8_t pf; 117 unsigned int hooknum; 118 /* Hooks are ordered in ascending priority. */ 119 int priority; 120 }; 121 122 struct nf_sockopt_ops { 123 struct list_head list; 124 125 u_int8_t pf; 126 127 /* Non-inclusive ranges: use 0/0/NULL to never get called. */ 128 int set_optmin; 129 int set_optmax; 130 int (*set)(struct sock *sk, int optval, void __user *user, unsigned int len); 131 #ifdef CONFIG_COMPAT 132 int (*compat_set)(struct sock *sk, int optval, 133 void __user *user, unsigned int len); 134 #endif 135 int get_optmin; 136 int get_optmax; 137 int (*get)(struct sock *sk, int optval, void __user *user, int *len); 138 #ifdef CONFIG_COMPAT 139 int (*compat_get)(struct sock *sk, int optval, 140 void __user *user, int *len); 141 #endif 142 /* Use the module struct to lock set/get code in place */ 143 struct module *owner; 144 }; 145 146 /* Function to register/unregister hook points. */ 147 int nf_register_hook(struct nf_hook_ops *reg); 148 void nf_unregister_hook(struct nf_hook_ops *reg); 149 int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n); 150 void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n); 151 152 /* Functions to register get/setsockopt ranges (non-inclusive). You 153 need to check permissions yourself! */ 154 int nf_register_sockopt(struct nf_sockopt_ops *reg); 155 void nf_unregister_sockopt(struct nf_sockopt_ops *reg); 156 157 #ifdef CONFIG_SYSCTL 158 /* Sysctl registration */ 159 extern struct ctl_path nf_net_netfilter_sysctl_path[]; 160 extern struct ctl_path nf_net_ipv4_netfilter_sysctl_path[]; 161 #endif /* CONFIG_SYSCTL */ 162 163 extern struct list_head nf_hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS]; 164 165 #if defined(CONFIG_JUMP_LABEL) 166 #include <linux/static_key.h> 167 extern struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS]; 168 static inline bool nf_hooks_active(u_int8_t pf, unsigned int hook) 169 { 170 if (__builtin_constant_p(pf) && 171 __builtin_constant_p(hook)) 172 return static_key_false(&nf_hooks_needed[pf][hook]); 173 174 return !list_empty(&nf_hooks[pf][hook]); 175 } 176 #else 177 static inline bool nf_hooks_active(u_int8_t pf, unsigned int hook) 178 { 179 return !list_empty(&nf_hooks[pf][hook]); 180 } 181 #endif 182 183 int nf_hook_slow(u_int8_t pf, unsigned int hook, struct sk_buff *skb, 184 struct net_device *indev, struct net_device *outdev, 185 int (*okfn)(struct sk_buff *), int thresh); 186 187 /** 188 * nf_hook_thresh - call a netfilter hook 189 * 190 * Returns 1 if the hook has allowed the packet to pass. The function 191 * okfn must be invoked by the caller in this case. Any other return 192 * value indicates the packet has been consumed by the hook. 193 */ 194 static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook, 195 struct sk_buff *skb, 196 struct net_device *indev, 197 struct net_device *outdev, 198 int (*okfn)(struct sk_buff *), int thresh) 199 { 200 if (nf_hooks_active(pf, hook)) 201 return nf_hook_slow(pf, hook, skb, indev, outdev, okfn, thresh); 202 return 1; 203 } 204 205 static inline int nf_hook(u_int8_t pf, unsigned int hook, struct sk_buff *skb, 206 struct net_device *indev, struct net_device *outdev, 207 int (*okfn)(struct sk_buff *)) 208 { 209 return nf_hook_thresh(pf, hook, skb, indev, outdev, okfn, INT_MIN); 210 } 211 212 /* Activate hook; either okfn or kfree_skb called, unless a hook 213 returns NF_STOLEN (in which case, it's up to the hook to deal with 214 the consequences). 215 216 Returns -ERRNO if packet dropped. Zero means queued, stolen or 217 accepted. 218 */ 219 220 /* RR: 221 > I don't want nf_hook to return anything because people might forget 222 > about async and trust the return value to mean "packet was ok". 223 224 AK: 225 Just document it clearly, then you can expect some sense from kernel 226 coders :) 227 */ 228 229 static inline int 230 NF_HOOK_THRESH(uint8_t pf, unsigned int hook, struct sk_buff *skb, 231 struct net_device *in, struct net_device *out, 232 int (*okfn)(struct sk_buff *), int thresh) 233 { 234 int ret = nf_hook_thresh(pf, hook, skb, in, out, okfn, thresh); 235 if (ret == 1) 236 ret = okfn(skb); 237 return ret; 238 } 239 240 static inline int 241 NF_HOOK_COND(uint8_t pf, unsigned int hook, struct sk_buff *skb, 242 struct net_device *in, struct net_device *out, 243 int (*okfn)(struct sk_buff *), bool cond) 244 { 245 int ret; 246 247 if (!cond || 248 ((ret = nf_hook_thresh(pf, hook, skb, in, out, okfn, INT_MIN)) == 1)) 249 ret = okfn(skb); 250 return ret; 251 } 252 253 static inline int 254 NF_HOOK(uint8_t pf, unsigned int hook, struct sk_buff *skb, 255 struct net_device *in, struct net_device *out, 256 int (*okfn)(struct sk_buff *)) 257 { 258 return NF_HOOK_THRESH(pf, hook, skb, in, out, okfn, INT_MIN); 259 } 260 261 /* Call setsockopt() */ 262 int nf_setsockopt(struct sock *sk, u_int8_t pf, int optval, char __user *opt, 263 unsigned int len); 264 int nf_getsockopt(struct sock *sk, u_int8_t pf, int optval, char __user *opt, 265 int *len); 266 #ifdef CONFIG_COMPAT 267 int compat_nf_setsockopt(struct sock *sk, u_int8_t pf, int optval, 268 char __user *opt, unsigned int len); 269 int compat_nf_getsockopt(struct sock *sk, u_int8_t pf, int optval, 270 char __user *opt, int *len); 271 #endif 272 273 /* Call this before modifying an existing packet: ensures it is 274 modifiable and linear to the point you care about (writable_len). 275 Returns true or false. */ 276 extern int skb_make_writable(struct sk_buff *skb, unsigned int writable_len); 277 278 struct flowi; 279 struct nf_queue_entry; 280 281 struct nf_afinfo { 282 unsigned short family; 283 __sum16 (*checksum)(struct sk_buff *skb, unsigned int hook, 284 unsigned int dataoff, u_int8_t protocol); 285 __sum16 (*checksum_partial)(struct sk_buff *skb, 286 unsigned int hook, 287 unsigned int dataoff, 288 unsigned int len, 289 u_int8_t protocol); 290 int (*route)(struct net *net, struct dst_entry **dst, 291 struct flowi *fl, bool strict); 292 void (*saveroute)(const struct sk_buff *skb, 293 struct nf_queue_entry *entry); 294 int (*reroute)(struct sk_buff *skb, 295 const struct nf_queue_entry *entry); 296 int route_key_size; 297 }; 298 299 extern const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO]; 300 static inline const struct nf_afinfo *nf_get_afinfo(unsigned short family) 301 { 302 return rcu_dereference(nf_afinfo[family]); 303 } 304 305 static inline __sum16 306 nf_checksum(struct sk_buff *skb, unsigned int hook, unsigned int dataoff, 307 u_int8_t protocol, unsigned short family) 308 { 309 const struct nf_afinfo *afinfo; 310 __sum16 csum = 0; 311 312 rcu_read_lock(); 313 afinfo = nf_get_afinfo(family); 314 if (afinfo) 315 csum = afinfo->checksum(skb, hook, dataoff, protocol); 316 rcu_read_unlock(); 317 return csum; 318 } 319 320 static inline __sum16 321 nf_checksum_partial(struct sk_buff *skb, unsigned int hook, 322 unsigned int dataoff, unsigned int len, 323 u_int8_t protocol, unsigned short family) 324 { 325 const struct nf_afinfo *afinfo; 326 __sum16 csum = 0; 327 328 rcu_read_lock(); 329 afinfo = nf_get_afinfo(family); 330 if (afinfo) 331 csum = afinfo->checksum_partial(skb, hook, dataoff, len, 332 protocol); 333 rcu_read_unlock(); 334 return csum; 335 } 336 337 extern int nf_register_afinfo(const struct nf_afinfo *afinfo); 338 extern void nf_unregister_afinfo(const struct nf_afinfo *afinfo); 339 340 #include <net/flow.h> 341 extern void (*ip_nat_decode_session)(struct sk_buff *, struct flowi *); 342 343 static inline void 344 nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family) 345 { 346 #ifdef CONFIG_NF_NAT_NEEDED 347 void (*decodefn)(struct sk_buff *, struct flowi *); 348 349 if (family == AF_INET) { 350 rcu_read_lock(); 351 decodefn = rcu_dereference(ip_nat_decode_session); 352 if (decodefn) 353 decodefn(skb, fl); 354 rcu_read_unlock(); 355 } 356 #endif 357 } 358 359 #ifdef CONFIG_PROC_FS 360 #include <linux/proc_fs.h> 361 extern struct proc_dir_entry *proc_net_netfilter; 362 #endif 363 364 #else /* !CONFIG_NETFILTER */ 365 #define NF_HOOK(pf, hook, skb, indev, outdev, okfn) (okfn)(skb) 366 #define NF_HOOK_COND(pf, hook, skb, indev, outdev, okfn, cond) (okfn)(skb) 367 static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook, 368 struct sk_buff *skb, 369 struct net_device *indev, 370 struct net_device *outdev, 371 int (*okfn)(struct sk_buff *), int thresh) 372 { 373 return okfn(skb); 374 } 375 static inline int nf_hook(u_int8_t pf, unsigned int hook, struct sk_buff *skb, 376 struct net_device *indev, struct net_device *outdev, 377 int (*okfn)(struct sk_buff *)) 378 { 379 return 1; 380 } 381 struct flowi; 382 static inline void 383 nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family) 384 { 385 } 386 #endif /*CONFIG_NETFILTER*/ 387 388 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE) 389 extern void (*ip_ct_attach)(struct sk_buff *, struct sk_buff *) __rcu; 390 extern void nf_ct_attach(struct sk_buff *, struct sk_buff *); 391 extern void (*nf_ct_destroy)(struct nf_conntrack *) __rcu; 392 #else 393 static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {} 394 #endif 395 396 #endif /*__KERNEL__*/ 397 #endif /*__LINUX_NETFILTER_H*/ 398