1b2441318SGreg Kroah-Hartman /* SPDX-License-Identifier: GPL-2.0 */
296518518SPatrick McHardy #ifndef _NET_NF_TABLES_H
396518518SPatrick McHardy #define _NET_NF_TABLES_H
496518518SPatrick McHardy
5a1b840adSAnder Juaristi #include <asm/unaligned.h>
696518518SPatrick McHardy #include <linux/list.h>
796518518SPatrick McHardy #include <linux/netfilter.h>
867a8fc27SPatrick McHardy #include <linux/netfilter/nfnetlink.h>
90ca743a5SPablo Neira Ayuso #include <linux/netfilter/x_tables.h>
1096518518SPatrick McHardy #include <linux/netfilter/nf_tables.h>
11ce355e20SEric Dumazet #include <linux/u64_stats_sync.h>
121b2470e5SFlorian Westphal #include <linux/rhashtable.h>
133b49e2e9SPablo Neira Ayuso #include <net/netfilter/nf_flow_table.h>
1496518518SPatrick McHardy #include <net/netlink.h>
1514bfb13fSPablo Neira Ayuso #include <net/flow_offload.h>
16d59d2f82SPablo Neira Ayuso #include <net/netns/generic.h>
1796518518SPatrick McHardy
18d25e2e93SPablo Neira Ayuso #define NFT_MAX_HOOKS (NF_INET_INGRESS + 1)
19d25e2e93SPablo Neira Ayuso
20a4cb98f3SPaul Gortmaker struct module;
21a4cb98f3SPaul Gortmaker
2220a69341SPatrick McHardy #define NFT_JUMP_STACK_SIZE 16
2320a69341SPatrick McHardy
24b5bdc6f9SPablo Neira Ayuso enum {
25b5bdc6f9SPablo Neira Ayuso NFT_PKTINFO_L4PROTO = (1 << 0),
26c46b38dcSPablo Neira Ayuso NFT_PKTINFO_INNER = (1 << 1),
270e795b37SPablo Neira Ayuso NFT_PKTINFO_INNER_FULL = (1 << 2),
28b5bdc6f9SPablo Neira Ayuso };
29b5bdc6f9SPablo Neira Ayuso
3096518518SPatrick McHardy struct nft_pktinfo {
3196518518SPatrick McHardy struct sk_buff *skb;
32897389deSFlorian Westphal const struct nf_hook_state *state;
33b5bdc6f9SPablo Neira Ayuso u8 flags;
344566bf27SPatrick McHardy u8 tprot;
35897389deSFlorian Westphal u16 fragoff;
36e7a1caa6SFlorian Westphal u16 thoff;
37e7a1caa6SFlorian Westphal u16 inneroff;
3896518518SPatrick McHardy };
3996518518SPatrick McHardy
nft_sk(const struct nft_pktinfo * pkt)4085554eb9SFlorian Westphal static inline struct sock *nft_sk(const struct nft_pktinfo *pkt)
4185554eb9SFlorian Westphal {
42897389deSFlorian Westphal return pkt->state->sk;
4385554eb9SFlorian Westphal }
4485554eb9SFlorian Westphal
nft_thoff(const struct nft_pktinfo * pkt)452d7b4aceSFlorian Westphal static inline unsigned int nft_thoff(const struct nft_pktinfo *pkt)
462d7b4aceSFlorian Westphal {
47897389deSFlorian Westphal return pkt->thoff;
482d7b4aceSFlorian Westphal }
492d7b4aceSFlorian Westphal
nft_net(const struct nft_pktinfo * pkt)500e5a1c7eSPablo Neira Ayuso static inline struct net *nft_net(const struct nft_pktinfo *pkt)
510e5a1c7eSPablo Neira Ayuso {
52897389deSFlorian Westphal return pkt->state->net;
530e5a1c7eSPablo Neira Ayuso }
540e5a1c7eSPablo Neira Ayuso
nft_hook(const struct nft_pktinfo * pkt)550e5a1c7eSPablo Neira Ayuso static inline unsigned int nft_hook(const struct nft_pktinfo *pkt)
560e5a1c7eSPablo Neira Ayuso {
57897389deSFlorian Westphal return pkt->state->hook;
580e5a1c7eSPablo Neira Ayuso }
590e5a1c7eSPablo Neira Ayuso
nft_pf(const struct nft_pktinfo * pkt)600e5a1c7eSPablo Neira Ayuso static inline u8 nft_pf(const struct nft_pktinfo *pkt)
610e5a1c7eSPablo Neira Ayuso {
62897389deSFlorian Westphal return pkt->state->pf;
630e5a1c7eSPablo Neira Ayuso }
640e5a1c7eSPablo Neira Ayuso
nft_in(const struct nft_pktinfo * pkt)650e5a1c7eSPablo Neira Ayuso static inline const struct net_device *nft_in(const struct nft_pktinfo *pkt)
660e5a1c7eSPablo Neira Ayuso {
67897389deSFlorian Westphal return pkt->state->in;
680e5a1c7eSPablo Neira Ayuso }
690e5a1c7eSPablo Neira Ayuso
nft_out(const struct nft_pktinfo * pkt)700e5a1c7eSPablo Neira Ayuso static inline const struct net_device *nft_out(const struct nft_pktinfo *pkt)
710e5a1c7eSPablo Neira Ayuso {
72897389deSFlorian Westphal return pkt->state->out;
730e5a1c7eSPablo Neira Ayuso }
740e5a1c7eSPablo Neira Ayuso
nft_set_pktinfo(struct nft_pktinfo * pkt,struct sk_buff * skb,const struct nf_hook_state * state)750ca743a5SPablo Neira Ayuso static inline void nft_set_pktinfo(struct nft_pktinfo *pkt,
760ca743a5SPablo Neira Ayuso struct sk_buff *skb,
77073bfd56SDavid S. Miller const struct nf_hook_state *state)
780ca743a5SPablo Neira Ayuso {
790ca743a5SPablo Neira Ayuso pkt->skb = skb;
80897389deSFlorian Westphal pkt->state = state;
810ca743a5SPablo Neira Ayuso }
820ca743a5SPablo Neira Ayuso
nft_set_pktinfo_unspec(struct nft_pktinfo * pkt)83f06ad944SFlorian Westphal static inline void nft_set_pktinfo_unspec(struct nft_pktinfo *pkt)
84beac5afaSPablo Neira Ayuso {
85b5bdc6f9SPablo Neira Ayuso pkt->flags = 0;
86beac5afaSPablo Neira Ayuso pkt->tprot = 0;
87897389deSFlorian Westphal pkt->thoff = 0;
88897389deSFlorian Westphal pkt->fragoff = 0;
89beac5afaSPablo Neira Ayuso }
90beac5afaSPablo Neira Ayuso
91a55e22e9SPatrick McHardy /**
92a55e22e9SPatrick McHardy * struct nft_verdict - nf_tables verdict
93a55e22e9SPatrick McHardy *
94a55e22e9SPatrick McHardy * @code: nf_tables/netfilter verdict code
95a55e22e9SPatrick McHardy * @chain: destination chain for NFT_JUMP/NFT_GOTO
96a55e22e9SPatrick McHardy */
97a55e22e9SPatrick McHardy struct nft_verdict {
98a55e22e9SPatrick McHardy u32 code;
99a55e22e9SPatrick McHardy struct nft_chain *chain;
100a55e22e9SPatrick McHardy };
101a55e22e9SPatrick McHardy
10296518518SPatrick McHardy struct nft_data {
10396518518SPatrick McHardy union {
10496518518SPatrick McHardy u32 data[4];
1051ca2e170SPatrick McHardy struct nft_verdict verdict;
10696518518SPatrick McHardy };
10796518518SPatrick McHardy } __attribute__((aligned(__alignof__(u64))));
10896518518SPatrick McHardy
109642c8effSPablo Neira Ayuso #define NFT_REG32_NUM 20
110642c8effSPablo Neira Ayuso
111a55e22e9SPatrick McHardy /**
112a55e22e9SPatrick McHardy * struct nft_regs - nf_tables register set
113a55e22e9SPatrick McHardy *
114a55e22e9SPatrick McHardy * @data: data registers
115a55e22e9SPatrick McHardy * @verdict: verdict register
116a55e22e9SPatrick McHardy *
117a55e22e9SPatrick McHardy * The first four data registers alias to the verdict register.
118a55e22e9SPatrick McHardy */
119a55e22e9SPatrick McHardy struct nft_regs {
120a55e22e9SPatrick McHardy union {
121642c8effSPablo Neira Ayuso u32 data[NFT_REG32_NUM];
122a55e22e9SPatrick McHardy struct nft_verdict verdict;
123a55e22e9SPatrick McHardy };
124a55e22e9SPatrick McHardy };
125a55e22e9SPatrick McHardy
12612e4ecfaSPablo Neira Ayuso struct nft_regs_track {
12712e4ecfaSPablo Neira Ayuso struct {
12812e4ecfaSPablo Neira Ayuso const struct nft_expr *selector;
12912e4ecfaSPablo Neira Ayuso const struct nft_expr *bitwise;
13034cc9e52SPablo Neira Ayuso u8 num_reg;
13112e4ecfaSPablo Neira Ayuso } regs[NFT_REG32_NUM];
13212e4ecfaSPablo Neira Ayuso
13312e4ecfaSPablo Neira Ayuso const struct nft_expr *cur;
13412e4ecfaSPablo Neira Ayuso const struct nft_expr *last;
13512e4ecfaSPablo Neira Ayuso };
13612e4ecfaSPablo Neira Ayuso
137a1b840adSAnder Juaristi /* Store/load an u8, u16 or u64 integer to/from the u32 data register.
13810596608SLiping Zhang *
13910596608SLiping Zhang * Note, when using concatenations, register allocation happens at 32-bit
14010596608SLiping Zhang * level. So for store instruction, pad the rest part with zero to avoid
14110596608SLiping Zhang * garbage values.
14210596608SLiping Zhang */
14310596608SLiping Zhang
nft_reg_store8(u32 * dreg,u8 val)14410596608SLiping Zhang static inline void nft_reg_store8(u32 *dreg, u8 val)
14510596608SLiping Zhang {
14610596608SLiping Zhang *dreg = 0;
14710596608SLiping Zhang *(u8 *)dreg = val;
14810596608SLiping Zhang }
14910596608SLiping Zhang
nft_reg_load8(const u32 * sreg)1507cd9a58dSPablo Neira Ayuso static inline u8 nft_reg_load8(const u32 *sreg)
151a1b840adSAnder Juaristi {
152a1b840adSAnder Juaristi return *(u8 *)sreg;
153a1b840adSAnder Juaristi }
154a1b840adSAnder Juaristi
nft_reg_store16(u32 * dreg,u16 val)155a1b840adSAnder Juaristi static inline void nft_reg_store16(u32 *dreg, u16 val)
156a1b840adSAnder Juaristi {
157a1b840adSAnder Juaristi *dreg = 0;
158a1b840adSAnder Juaristi *(u16 *)dreg = val;
159a1b840adSAnder Juaristi }
160a1b840adSAnder Juaristi
nft_reg_store_be16(u32 * dreg,__be16 val)1617278b3c1SFlorian Westphal static inline void nft_reg_store_be16(u32 *dreg, __be16 val)
1627278b3c1SFlorian Westphal {
1637278b3c1SFlorian Westphal nft_reg_store16(dreg, (__force __u16)val);
1647278b3c1SFlorian Westphal }
1657278b3c1SFlorian Westphal
nft_reg_load16(const u32 * sreg)1667cd9a58dSPablo Neira Ayuso static inline u16 nft_reg_load16(const u32 *sreg)
16710596608SLiping Zhang {
16810596608SLiping Zhang return *(u16 *)sreg;
16910596608SLiping Zhang }
17010596608SLiping Zhang
nft_reg_load_be16(const u32 * sreg)1717278b3c1SFlorian Westphal static inline __be16 nft_reg_load_be16(const u32 *sreg)
1727278b3c1SFlorian Westphal {
1737278b3c1SFlorian Westphal return (__force __be16)nft_reg_load16(sreg);
1747278b3c1SFlorian Westphal }
1757278b3c1SFlorian Westphal
nft_reg_load_be32(const u32 * sreg)1767278b3c1SFlorian Westphal static inline __be32 nft_reg_load_be32(const u32 *sreg)
1777278b3c1SFlorian Westphal {
1787278b3c1SFlorian Westphal return *(__force __be32 *)sreg;
1797278b3c1SFlorian Westphal }
1807278b3c1SFlorian Westphal
nft_reg_store64(u64 * dreg,u64 val)181013deed3SDan Carpenter static inline void nft_reg_store64(u64 *dreg, u64 val)
18210596608SLiping Zhang {
183013deed3SDan Carpenter put_unaligned(val, dreg);
184a1b840adSAnder Juaristi }
185a1b840adSAnder Juaristi
nft_reg_load64(const u32 * sreg)1867cd9a58dSPablo Neira Ayuso static inline u64 nft_reg_load64(const u32 *sreg)
187a1b840adSAnder Juaristi {
188a1b840adSAnder Juaristi return get_unaligned((u64 *)sreg);
18910596608SLiping Zhang }
19010596608SLiping Zhang
nft_data_copy(u32 * dst,const struct nft_data * src,unsigned int len)19149499c3eSPatrick McHardy static inline void nft_data_copy(u32 *dst, const struct nft_data *src,
19249499c3eSPatrick McHardy unsigned int len)
19396518518SPatrick McHardy {
1941e105e6aSFlorian Westphal if (len % NFT_REG32_SIZE)
1951e105e6aSFlorian Westphal dst[len / NFT_REG32_SIZE] = 0;
19649499c3eSPatrick McHardy memcpy(dst, src, len);
19796518518SPatrick McHardy }
19896518518SPatrick McHardy
19996518518SPatrick McHardy /**
20020a69341SPatrick McHardy * struct nft_ctx - nf_tables rule/set context
20196518518SPatrick McHardy *
20299633ab2SPablo Neira Ayuso * @net: net namespace
20396518518SPatrick McHardy * @table: the table the chain is contained in
20496518518SPatrick McHardy * @chain: the chain the rule is contained in
2050ca743a5SPablo Neira Ayuso * @nla: netlink attributes
206128ad332SPablo Neira Ayuso * @portid: netlink portID of the original message
207128ad332SPablo Neira Ayuso * @seq: netlink sequence number
20836596dadSPablo Neira Ayuso * @family: protocol family
20926b2f552STaehee Yoo * @level: depth of the chains
210128ad332SPablo Neira Ayuso * @report: notify via unicast netlink message
21196518518SPatrick McHardy */
21296518518SPatrick McHardy struct nft_ctx {
21399633ab2SPablo Neira Ayuso struct net *net;
2147c95f6d8SPablo Neira Ayuso struct nft_table *table;
2157c95f6d8SPablo Neira Ayuso struct nft_chain *chain;
2160ca743a5SPablo Neira Ayuso const struct nlattr * const *nla;
217128ad332SPablo Neira Ayuso u32 portid;
218128ad332SPablo Neira Ayuso u32 seq;
219c9626a2cSPablo Neira Ayuso u16 flags;
22036596dadSPablo Neira Ayuso u8 family;
22126b2f552STaehee Yoo u8 level;
222128ad332SPablo Neira Ayuso bool report;
22396518518SPatrick McHardy };
22496518518SPatrick McHardy
225f323ef3aSPablo Neira Ayuso enum nft_data_desc_flags {
226f323ef3aSPablo Neira Ayuso NFT_DATA_DESC_SETELEM = (1 << 0),
227f323ef3aSPablo Neira Ayuso };
228f323ef3aSPablo Neira Ayuso
22996518518SPatrick McHardy struct nft_data_desc {
23096518518SPatrick McHardy enum nft_data_types type;
231341b6941SPablo Neira Ayuso unsigned int size;
23296518518SPatrick McHardy unsigned int len;
233f323ef3aSPablo Neira Ayuso unsigned int flags;
23496518518SPatrick McHardy };
23596518518SPatrick McHardy
236341b6941SPablo Neira Ayuso int nft_data_init(const struct nft_ctx *ctx, struct nft_data *data,
23796518518SPatrick McHardy struct nft_data_desc *desc, const struct nlattr *nla);
238bb7b40aeSPablo Neira Ayuso void nft_data_hold(const struct nft_data *data, enum nft_data_types type);
23959105446SPablo Neira Ayuso void nft_data_release(const struct nft_data *data, enum nft_data_types type);
2405eccdfaaSJoe Perches int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
24196518518SPatrick McHardy enum nft_data_types type, unsigned int len);
24296518518SPatrick McHardy
nft_dreg_to_type(enum nft_registers reg)24396518518SPatrick McHardy static inline enum nft_data_types nft_dreg_to_type(enum nft_registers reg)
24496518518SPatrick McHardy {
24596518518SPatrick McHardy return reg == NFT_REG_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE;
24696518518SPatrick McHardy }
24796518518SPatrick McHardy
nft_type_to_reg(enum nft_data_types type)24820a69341SPatrick McHardy static inline enum nft_registers nft_type_to_reg(enum nft_data_types type)
24920a69341SPatrick McHardy {
250bf798657SPablo Neira Ayuso return type == NFT_DATA_VERDICT ? NFT_REG_VERDICT : NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE;
25120a69341SPatrick McHardy }
25220a69341SPatrick McHardy
253f1d505bbSJohn W. Linville int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest);
254b1c96ed3SPatrick McHardy int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg);
255b1c96ed3SPatrick McHardy
2564f16d25cSPablo Neira Ayuso int nft_parse_register_load(const struct nlattr *attr, u8 *sreg, u32 len);
257345023b0SPablo Neira Ayuso int nft_parse_register_store(const struct nft_ctx *ctx,
258345023b0SPablo Neira Ayuso const struct nlattr *attr, u8 *dreg,
25996518518SPatrick McHardy const struct nft_data *data,
26045d9bcdaSPatrick McHardy enum nft_data_types type, unsigned int len);
26196518518SPatrick McHardy
26286f1ec32SPatrick McHardy /**
26386f1ec32SPatrick McHardy * struct nft_userdata - user defined data associated with an object
26486f1ec32SPatrick McHardy *
26586f1ec32SPatrick McHardy * @len: length of the data
26686f1ec32SPatrick McHardy * @data: content
26786f1ec32SPatrick McHardy *
26886f1ec32SPatrick McHardy * The presence of user data is indicated in an object specific fashion,
26986f1ec32SPatrick McHardy * so a length of zero can't occur and the value "len" indicates data
27086f1ec32SPatrick McHardy * of length len + 1.
27186f1ec32SPatrick McHardy */
27286f1ec32SPatrick McHardy struct nft_userdata {
27386f1ec32SPatrick McHardy u8 len;
2746daf1414SGustavo A. R. Silva unsigned char data[];
27586f1ec32SPatrick McHardy };
27686f1ec32SPatrick McHardy
27796518518SPatrick McHardy /**
27820a69341SPatrick McHardy * struct nft_set_elem - generic representation of set elements
27920a69341SPatrick McHardy *
28020a69341SPatrick McHardy * @key: element key
2817b225d0bSPablo Neira Ayuso * @key_end: closing element key
282fe2811ebSPatrick McHardy * @priv: element private data and extensions
28320a69341SPatrick McHardy */
28420a69341SPatrick McHardy struct nft_set_elem {
2857d740264SPatrick McHardy union {
2867d740264SPatrick McHardy u32 buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)];
2877d740264SPatrick McHardy struct nft_data val;
2887d740264SPatrick McHardy } key;
2897b225d0bSPablo Neira Ayuso union {
2907b225d0bSPablo Neira Ayuso u32 buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)];
2917b225d0bSPablo Neira Ayuso struct nft_data val;
2927b225d0bSPablo Neira Ayuso } key_end;
293fdb9c405SPablo Neira Ayuso union {
294fdb9c405SPablo Neira Ayuso u32 buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)];
295fdb9c405SPablo Neira Ayuso struct nft_data val;
296fdb9c405SPablo Neira Ayuso } data;
297fe2811ebSPatrick McHardy void *priv;
29820a69341SPatrick McHardy };
29920a69341SPatrick McHardy
30020a69341SPatrick McHardy struct nft_set;
30120a69341SPatrick McHardy struct nft_set_iter {
3028588ac09SPablo Neira Ayuso u8 genmask;
30320a69341SPatrick McHardy unsigned int count;
30420a69341SPatrick McHardy unsigned int skip;
30520a69341SPatrick McHardy int err;
30620a69341SPatrick McHardy int (*fn)(const struct nft_ctx *ctx,
307de70185dSPablo Neira Ayuso struct nft_set *set,
30820a69341SPatrick McHardy const struct nft_set_iter *iter,
309de70185dSPablo Neira Ayuso struct nft_set_elem *elem);
31020a69341SPatrick McHardy };
31120a69341SPatrick McHardy
31220a69341SPatrick McHardy /**
313c50b960cSPatrick McHardy * struct nft_set_desc - description of set elements
314c50b960cSPatrick McHardy *
315bed4a63eSPablo Neira Ayuso * @ktype: key type
316c50b960cSPatrick McHardy * @klen: key length
317bed4a63eSPablo Neira Ayuso * @dtype: data type
318c50b960cSPatrick McHardy * @dlen: data length
319bed4a63eSPablo Neira Ayuso * @objtype: object type
320bed4a63eSPablo Neira Ayuso * @flags: flags
321c50b960cSPatrick McHardy * @size: number of set elements
322bed4a63eSPablo Neira Ayuso * @policy: set policy
323bed4a63eSPablo Neira Ayuso * @gc_int: garbage collector interval
324f3a2181eSStefano Brivio * @field_len: length of each field in concatenation, bytes
325f3a2181eSStefano Brivio * @field_count: number of concatenated fields in element
326d56aab26SPablo Neira Ayuso * @expr: set must support for expressions
327c50b960cSPatrick McHardy */
328c50b960cSPatrick McHardy struct nft_set_desc {
329bed4a63eSPablo Neira Ayuso u32 ktype;
330c50b960cSPatrick McHardy unsigned int klen;
331bed4a63eSPablo Neira Ayuso u32 dtype;
332c50b960cSPatrick McHardy unsigned int dlen;
333bed4a63eSPablo Neira Ayuso u32 objtype;
334c50b960cSPatrick McHardy unsigned int size;
335bed4a63eSPablo Neira Ayuso u32 policy;
336bed4a63eSPablo Neira Ayuso u32 gc_int;
337bed4a63eSPablo Neira Ayuso u64 timeout;
338f3a2181eSStefano Brivio u8 field_len[NFT_REG32_COUNT];
339f3a2181eSStefano Brivio u8 field_count;
340d56aab26SPablo Neira Ayuso bool expr;
341c50b960cSPatrick McHardy };
342c50b960cSPatrick McHardy
343c50b960cSPatrick McHardy /**
344c50b960cSPatrick McHardy * enum nft_set_class - performance class
345c50b960cSPatrick McHardy *
346c50b960cSPatrick McHardy * @NFT_LOOKUP_O_1: constant, O(1)
347c50b960cSPatrick McHardy * @NFT_LOOKUP_O_LOG_N: logarithmic, O(log N)
348c50b960cSPatrick McHardy * @NFT_LOOKUP_O_N: linear, O(N)
349c50b960cSPatrick McHardy */
350c50b960cSPatrick McHardy enum nft_set_class {
351c50b960cSPatrick McHardy NFT_SET_CLASS_O_1,
352c50b960cSPatrick McHardy NFT_SET_CLASS_O_LOG_N,
353c50b960cSPatrick McHardy NFT_SET_CLASS_O_N,
354c50b960cSPatrick McHardy };
355c50b960cSPatrick McHardy
356c50b960cSPatrick McHardy /**
357c50b960cSPatrick McHardy * struct nft_set_estimate - estimation of memory and performance
358c50b960cSPatrick McHardy * characteristics
359c50b960cSPatrick McHardy *
360c50b960cSPatrick McHardy * @size: required memory
36155af753cSPablo Neira Ayuso * @lookup: lookup performance class
3620b5a7874SPablo Neira Ayuso * @space: memory class
363c50b960cSPatrick McHardy */
364c50b960cSPatrick McHardy struct nft_set_estimate {
3654ef360ddSTaehee Yoo u64 size;
36655af753cSPablo Neira Ayuso enum nft_set_class lookup;
3670b5a7874SPablo Neira Ayuso enum nft_set_class space;
368c50b960cSPatrick McHardy };
369c50b960cSPatrick McHardy
37092b211a2SPablo Neira Ayuso #define NFT_EXPR_MAXATTR 16
37192b211a2SPablo Neira Ayuso #define NFT_EXPR_SIZE(size) (sizeof(struct nft_expr) + \
37292b211a2SPablo Neira Ayuso ALIGN(size, __alignof__(struct nft_expr)))
37392b211a2SPablo Neira Ayuso
37492b211a2SPablo Neira Ayuso /**
37592b211a2SPablo Neira Ayuso * struct nft_expr - nf_tables expression
37692b211a2SPablo Neira Ayuso *
37792b211a2SPablo Neira Ayuso * @ops: expression ops
37892b211a2SPablo Neira Ayuso * @data: expression private data
37992b211a2SPablo Neira Ayuso */
38092b211a2SPablo Neira Ayuso struct nft_expr {
38192b211a2SPablo Neira Ayuso const struct nft_expr_ops *ops;
38292b211a2SPablo Neira Ayuso unsigned char data[]
38392b211a2SPablo Neira Ayuso __attribute__((aligned(__alignof__(u64))));
38492b211a2SPablo Neira Ayuso };
38592b211a2SPablo Neira Ayuso
nft_expr_priv(const struct nft_expr * expr)38692b211a2SPablo Neira Ayuso static inline void *nft_expr_priv(const struct nft_expr *expr)
38792b211a2SPablo Neira Ayuso {
38892b211a2SPablo Neira Ayuso return (void *)expr->data;
38992b211a2SPablo Neira Ayuso }
39092b211a2SPablo Neira Ayuso
3913a07327dSPablo Neira Ayuso struct nft_expr_info;
3923a07327dSPablo Neira Ayuso
3933a07327dSPablo Neira Ayuso int nft_expr_inner_parse(const struct nft_ctx *ctx, const struct nlattr *nla,
3943a07327dSPablo Neira Ayuso struct nft_expr_info *info);
39592b211a2SPablo Neira Ayuso int nft_expr_clone(struct nft_expr *dst, struct nft_expr *src);
39692b211a2SPablo Neira Ayuso void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr);
39792b211a2SPablo Neira Ayuso int nft_expr_dump(struct sk_buff *skb, unsigned int attr,
3988daa8fdeSPhil Sutter const struct nft_expr *expr, bool reset);
399be5650f8SPablo Neira Ayuso bool nft_expr_reduce_bitwise(struct nft_regs_track *track,
400be5650f8SPablo Neira Ayuso const struct nft_expr *expr);
40192b211a2SPablo Neira Ayuso
402b2832dd6SPatrick McHardy struct nft_set_ext;
403b2832dd6SPatrick McHardy
404c50b960cSPatrick McHardy /**
40520a69341SPatrick McHardy * struct nft_set_ops - nf_tables set operations
40620a69341SPatrick McHardy *
40720a69341SPatrick McHardy * @lookup: look up an element within the set
408d0a8d877SAnder Juaristi * @update: update an element if exists, add it if doesn't exist
409d0a8d877SAnder Juaristi * @delete: delete an element
41020a69341SPatrick McHardy * @insert: insert new element into set
411cc02e457SPatrick McHardy * @activate: activate new element in the next generation
4128411b644SPablo Neira Ayuso * @deactivate: lookup for element and deactivate it in the next generation
4131ba1c414SPablo Neira Ayuso * @flush: deactivate element in the next generation
41420a69341SPatrick McHardy * @remove: remove element from set
415d0a8d877SAnder Juaristi * @walk: iterate over all set elements
416ba0e4d99SPablo Neira Ayuso * @get: get set elements
41720a69341SPatrick McHardy * @privsize: function to return size of set private data
41820a69341SPatrick McHardy * @init: initialize private data of new set instance
41920a69341SPatrick McHardy * @destroy: destroy private data of set instance
420fe2811ebSPatrick McHardy * @elemsize: element private size
421d0a8d877SAnder Juaristi *
422d0a8d877SAnder Juaristi * Operations lookup, update and delete have simpler interfaces, are faster
423d0a8d877SAnder Juaristi * and currently only used in the packet path. All the rest are slower,
424d0a8d877SAnder Juaristi * control plane functions.
42520a69341SPatrick McHardy */
42620a69341SPatrick McHardy struct nft_set_ops {
42742a55769SPablo Neira Ayuso bool (*lookup)(const struct net *net,
42842a55769SPablo Neira Ayuso const struct nft_set *set,
4298cd8937aSPatrick McHardy const u32 *key,
430b2832dd6SPatrick McHardy const struct nft_set_ext **ext);
43122fe54d5SPatrick McHardy bool (*update)(struct nft_set *set,
4328cd8937aSPatrick McHardy const u32 *key,
43322fe54d5SPatrick McHardy void *(*new)(struct nft_set *,
43422fe54d5SPatrick McHardy const struct nft_expr *,
435a55e22e9SPatrick McHardy struct nft_regs *),
43622fe54d5SPatrick McHardy const struct nft_expr *expr,
437a55e22e9SPatrick McHardy struct nft_regs *regs,
43822fe54d5SPatrick McHardy const struct nft_set_ext **ext);
439d0a8d877SAnder Juaristi bool (*delete)(const struct nft_set *set,
440d0a8d877SAnder Juaristi const u32 *key);
44122fe54d5SPatrick McHardy
44242a55769SPablo Neira Ayuso int (*insert)(const struct net *net,
44342a55769SPablo Neira Ayuso const struct nft_set *set,
444c016c7e4SPablo Neira Ayuso const struct nft_set_elem *elem,
445c016c7e4SPablo Neira Ayuso struct nft_set_ext **ext);
44642a55769SPablo Neira Ayuso void (*activate)(const struct net *net,
44742a55769SPablo Neira Ayuso const struct nft_set *set,
448cc02e457SPatrick McHardy const struct nft_set_elem *elem);
44942a55769SPablo Neira Ayuso void * (*deactivate)(const struct net *net,
45042a55769SPablo Neira Ayuso const struct nft_set *set,
451cc02e457SPatrick McHardy const struct nft_set_elem *elem);
4521ba1c414SPablo Neira Ayuso bool (*flush)(const struct net *net,
4538411b644SPablo Neira Ayuso const struct nft_set *set,
4548411b644SPablo Neira Ayuso void *priv);
4555cb82a38SPablo Neira Ayuso void (*remove)(const struct net *net,
4565cb82a38SPablo Neira Ayuso const struct nft_set *set,
45720a69341SPatrick McHardy const struct nft_set_elem *elem);
45820a69341SPatrick McHardy void (*walk)(const struct nft_ctx *ctx,
459de70185dSPablo Neira Ayuso struct nft_set *set,
46020a69341SPatrick McHardy struct nft_set_iter *iter);
461ba0e4d99SPablo Neira Ayuso void * (*get)(const struct net *net,
462ba0e4d99SPablo Neira Ayuso const struct nft_set *set,
463ba0e4d99SPablo Neira Ayuso const struct nft_set_elem *elem,
464ba0e4d99SPablo Neira Ayuso unsigned int flags);
465212ed75dSPablo Neira Ayuso void (*commit)(const struct nft_set *set);
466212ed75dSPablo Neira Ayuso void (*abort)(const struct nft_set *set);
4674ef360ddSTaehee Yoo u64 (*privsize)(const struct nlattr * const nla[],
468347b408dSPablo Neira Ayuso const struct nft_set_desc *desc);
469c50b960cSPatrick McHardy bool (*estimate)(const struct nft_set_desc *desc,
470c50b960cSPatrick McHardy u32 features,
471c50b960cSPatrick McHardy struct nft_set_estimate *est);
47220a69341SPatrick McHardy int (*init)(const struct nft_set *set,
473c50b960cSPatrick McHardy const struct nft_set_desc *desc,
47420a69341SPatrick McHardy const struct nlattr * const nla[]);
475628bd3e4SPablo Neira Ayuso void (*destroy)(const struct nft_ctx *ctx,
476628bd3e4SPablo Neira Ayuso const struct nft_set *set);
47779b174adSPablo Neira Ayuso void (*gc_init)(const struct nft_set *set);
47820a69341SPatrick McHardy
479fe2811ebSPatrick McHardy unsigned int elemsize;
48020a69341SPatrick McHardy };
48120a69341SPatrick McHardy
48271cc0873SPhil Sutter /**
48371cc0873SPhil Sutter * struct nft_set_type - nf_tables set type
48471cc0873SPhil Sutter *
48571cc0873SPhil Sutter * @ops: set ops for this type
48671cc0873SPhil Sutter * @features: features supported by the implementation
48771cc0873SPhil Sutter */
48871cc0873SPhil Sutter struct nft_set_type {
48971cc0873SPhil Sutter const struct nft_set_ops ops;
49071cc0873SPhil Sutter u32 features;
49171cc0873SPhil Sutter };
49271cc0873SPhil Sutter #define to_set_type(o) container_of(o, struct nft_set_type, ops)
49371cc0873SPhil Sutter
494563125a7SPablo Neira Ayuso struct nft_set_elem_expr {
495563125a7SPablo Neira Ayuso u8 size;
496563125a7SPablo Neira Ayuso unsigned char data[]
497563125a7SPablo Neira Ayuso __attribute__((aligned(__alignof__(struct nft_expr))));
498563125a7SPablo Neira Ayuso };
499563125a7SPablo Neira Ayuso
500563125a7SPablo Neira Ayuso #define nft_setelem_expr_at(__elem_expr, __offset) \
501563125a7SPablo Neira Ayuso ((struct nft_expr *)&__elem_expr->data[__offset])
502563125a7SPablo Neira Ayuso
503563125a7SPablo Neira Ayuso #define nft_setelem_expr_foreach(__expr, __elem_expr, __size) \
504563125a7SPablo Neira Ayuso for (__expr = nft_setelem_expr_at(__elem_expr, 0), __size = 0; \
505563125a7SPablo Neira Ayuso __size < (__elem_expr)->size; \
506563125a7SPablo Neira Ayuso __size += (__expr)->ops->size, __expr = ((void *)(__expr)) + (__expr)->ops->size)
507563125a7SPablo Neira Ayuso
5088cfd9b0fSPablo Neira Ayuso #define NFT_SET_EXPR_MAX 2
5098cfd9b0fSPablo Neira Ayuso
51020a69341SPatrick McHardy /**
51120a69341SPatrick McHardy * struct nft_set - nf_tables set instance
51220a69341SPatrick McHardy *
51320a69341SPatrick McHardy * @list: table set list node
51420a69341SPatrick McHardy * @bindings: list of set bindings
5155f68718bSPablo Neira Ayuso * @refs: internal refcounting for async set destruction
5163453c927SPablo Neira Ayuso * @table: table this set belongs to
5173453c927SPablo Neira Ayuso * @net: netnamespace this set belongs to
51820a69341SPatrick McHardy * @name: name of the set
5193ecbfd65SHarsha Sharma * @handle: unique handle of the set
52020a69341SPatrick McHardy * @ktype: key type (numeric type defined by userspace, not used in the kernel)
52120a69341SPatrick McHardy * @dtype: data type (verdict or numeric type defined by userspace)
5228aeff920SPablo Neira Ayuso * @objtype: object type (see NFT_OBJECT_* definitions)
523c50b960cSPatrick McHardy * @size: maximum set size
524f3a2181eSStefano Brivio * @field_len: length of each field in concatenation, bytes
525f3a2181eSStefano Brivio * @field_count: number of concatenated fields in element
526273fe3f1SPablo Neira Ayuso * @use: number of rules references to this set
527c50b960cSPatrick McHardy * @nelems: number of elements
5283dd0673aSPatrick McHardy * @ndeact: number of deactivated elements queued for removal
529d3e2a111SAnders K. Pedersen * @timeout: default timeout value in jiffies
530761da293SPatrick McHardy * @gc_int: garbage collection interval in msecs
5319363dc4bSArturo Borrero * @policy: set parameterization (see enum nft_set_policies)
532e6d8ecacSCarlos Falgueras García * @udlen: user data length
533e6d8ecacSCarlos Falgueras García * @udata: user data
53465038428SPablo Neira Ayuso * @expr: stateful expression
53520a69341SPatrick McHardy * @ops: set ops
53620a69341SPatrick McHardy * @flags: set flags
53708713cb0SFlorian Westphal * @dead: set will be freed, never cleared
53837a9cc52SPablo Neira Ayuso * @genmask: generation mask
53920a69341SPatrick McHardy * @klen: key length
54020a69341SPatrick McHardy * @dlen: data length
54120a69341SPatrick McHardy * @data: private set data
54220a69341SPatrick McHardy */
54320a69341SPatrick McHardy struct nft_set {
54420a69341SPatrick McHardy struct list_head list;
54520a69341SPatrick McHardy struct list_head bindings;
5465f68718bSPablo Neira Ayuso refcount_t refs;
5473453c927SPablo Neira Ayuso struct nft_table *table;
5483453c927SPablo Neira Ayuso possible_net_t net;
54938745490SPhil Sutter char *name;
5503ecbfd65SHarsha Sharma u64 handle;
55120a69341SPatrick McHardy u32 ktype;
55220a69341SPatrick McHardy u32 dtype;
5538aeff920SPablo Neira Ayuso u32 objtype;
554c50b960cSPatrick McHardy u32 size;
555f3a2181eSStefano Brivio u8 field_len[NFT_REG32_COUNT];
556f3a2181eSStefano Brivio u8 field_count;
557273fe3f1SPablo Neira Ayuso u32 use;
5583dd0673aSPatrick McHardy atomic_t nelems;
5593dd0673aSPatrick McHardy u32 ndeact;
560761da293SPatrick McHardy u64 timeout;
561761da293SPatrick McHardy u32 gc_int;
5629363dc4bSArturo Borrero u16 policy;
563e6d8ecacSCarlos Falgueras García u16 udlen;
564e6d8ecacSCarlos Falgueras García unsigned char *udata;
565212ed75dSPablo Neira Ayuso struct list_head pending_update;
56620a69341SPatrick McHardy /* runtime data below here */
56720a69341SPatrick McHardy const struct nft_set_ops *ops ____cacheline_aligned;
5685f68718bSPablo Neira Ayuso u16 flags:13,
5695f68718bSPablo Neira Ayuso dead:1,
57037a9cc52SPablo Neira Ayuso genmask:2;
57120a69341SPatrick McHardy u8 klen;
57220a69341SPatrick McHardy u8 dlen;
5738cfd9b0fSPablo Neira Ayuso u8 num_exprs;
5748cfd9b0fSPablo Neira Ayuso struct nft_expr *exprs[NFT_SET_EXPR_MAX];
575aaa31047SPablo Neira Ayuso struct list_head catchall_list;
57620a69341SPatrick McHardy unsigned char data[]
57720a69341SPatrick McHardy __attribute__((aligned(__alignof__(u64))));
57820a69341SPatrick McHardy };
57920a69341SPatrick McHardy
nft_set_is_anonymous(const struct nft_set * set)580408070d6SPablo Neira Ayuso static inline bool nft_set_is_anonymous(const struct nft_set *set)
581408070d6SPablo Neira Ayuso {
582408070d6SPablo Neira Ayuso return set->flags & NFT_SET_ANONYMOUS;
583408070d6SPablo Neira Ayuso }
584408070d6SPablo Neira Ayuso
nft_set_priv(const struct nft_set * set)58520a69341SPatrick McHardy static inline void *nft_set_priv(const struct nft_set *set)
58620a69341SPatrick McHardy {
58720a69341SPatrick McHardy return (void *)set->data;
58820a69341SPatrick McHardy }
58920a69341SPatrick McHardy
nft_set_gc_is_pending(const struct nft_set * s)5908e51830eSFlorian Westphal static inline bool nft_set_gc_is_pending(const struct nft_set *s)
5918e51830eSFlorian Westphal {
5928e51830eSFlorian Westphal return refcount_read(&s->refs) != 1;
5938e51830eSFlorian Westphal }
5948e51830eSFlorian Westphal
nft_set_container_of(const void * priv)5959d098292SPatrick McHardy static inline struct nft_set *nft_set_container_of(const void *priv)
5969d098292SPatrick McHardy {
5979d098292SPatrick McHardy return (void *)priv - offsetof(struct nft_set, data);
5989d098292SPatrick McHardy }
5999d098292SPatrick McHardy
60010659cbaSPablo Neira Ayuso struct nft_set *nft_set_lookup_global(const struct net *net,
601c7a72e3fSPablo Neira Ayuso const struct nft_table *table,
602c7a72e3fSPablo Neira Ayuso const struct nlattr *nla_set_name,
603c7a72e3fSPablo Neira Ayuso const struct nlattr *nla_set_id,
604c7a72e3fSPablo Neira Ayuso u8 genmask);
60520a69341SPatrick McHardy
606aaa31047SPablo Neira Ayuso struct nft_set_ext *nft_set_catchall_lookup(const struct net *net,
607aaa31047SPablo Neira Ayuso const struct nft_set *set);
608aaa31047SPablo Neira Ayuso
nft_set_gc_interval(const struct nft_set * set)609761da293SPatrick McHardy static inline unsigned long nft_set_gc_interval(const struct nft_set *set)
610761da293SPatrick McHardy {
611123b9961SPablo Neira Ayuso u32 gc_int = READ_ONCE(set->gc_int);
612123b9961SPablo Neira Ayuso
613123b9961SPablo Neira Ayuso return gc_int ? msecs_to_jiffies(gc_int) : HZ;
614761da293SPatrick McHardy }
615761da293SPatrick McHardy
61620a69341SPatrick McHardy /**
61720a69341SPatrick McHardy * struct nft_set_binding - nf_tables set binding
61820a69341SPatrick McHardy *
61920a69341SPatrick McHardy * @list: set bindings list node
62020a69341SPatrick McHardy * @chain: chain containing the rule bound to the set
62111113e19SPatrick McHardy * @flags: set action flags
62220a69341SPatrick McHardy *
62320a69341SPatrick McHardy * A set binding contains all information necessary for validation
62420a69341SPatrick McHardy * of new elements added to a bound set.
62520a69341SPatrick McHardy */
62620a69341SPatrick McHardy struct nft_set_binding {
62720a69341SPatrick McHardy struct list_head list;
62820a69341SPatrick McHardy const struct nft_chain *chain;
62911113e19SPatrick McHardy u32 flags;
63020a69341SPatrick McHardy };
63120a69341SPatrick McHardy
632273fe3f1SPablo Neira Ayuso enum nft_trans_phase;
633c1592a89SPablo Neira Ayuso void nf_tables_activate_set(const struct nft_ctx *ctx, struct nft_set *set);
634273fe3f1SPablo Neira Ayuso void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set,
635273fe3f1SPablo Neira Ayuso struct nft_set_binding *binding,
636273fe3f1SPablo Neira Ayuso enum nft_trans_phase phase);
6375eccdfaaSJoe Perches int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
63820a69341SPatrick McHardy struct nft_set_binding *binding);
639cd5125d8SFlorian Westphal void nf_tables_destroy_set(const struct nft_ctx *ctx, struct nft_set *set);
64020a69341SPatrick McHardy
6413ac4c07aSPatrick McHardy /**
6423ac4c07aSPatrick McHardy * enum nft_set_extensions - set extension type IDs
6433ac4c07aSPatrick McHardy *
6443ac4c07aSPatrick McHardy * @NFT_SET_EXT_KEY: element key
6457b225d0bSPablo Neira Ayuso * @NFT_SET_EXT_KEY_END: upper bound element key, for ranges
6463ac4c07aSPatrick McHardy * @NFT_SET_EXT_DATA: mapping data
6473ac4c07aSPatrick McHardy * @NFT_SET_EXT_FLAGS: element flags
648c3e1b005SPatrick McHardy * @NFT_SET_EXT_TIMEOUT: element timeout
649c3e1b005SPatrick McHardy * @NFT_SET_EXT_EXPIRATION: element expiration time
65068e942e8SPatrick McHardy * @NFT_SET_EXT_USERDATA: user data associated with the element
651563125a7SPablo Neira Ayuso * @NFT_SET_EXT_EXPRESSIONS: expressions assiciated with the element
6528aeff920SPablo Neira Ayuso * @NFT_SET_EXT_OBJREF: stateful object reference associated with element
6533ac4c07aSPatrick McHardy * @NFT_SET_EXT_NUM: number of extension types
6543ac4c07aSPatrick McHardy */
6553ac4c07aSPatrick McHardy enum nft_set_extensions {
6563ac4c07aSPatrick McHardy NFT_SET_EXT_KEY,
6577b225d0bSPablo Neira Ayuso NFT_SET_EXT_KEY_END,
6583ac4c07aSPatrick McHardy NFT_SET_EXT_DATA,
6593ac4c07aSPatrick McHardy NFT_SET_EXT_FLAGS,
660c3e1b005SPatrick McHardy NFT_SET_EXT_TIMEOUT,
661c3e1b005SPatrick McHardy NFT_SET_EXT_EXPIRATION,
66268e942e8SPatrick McHardy NFT_SET_EXT_USERDATA,
663563125a7SPablo Neira Ayuso NFT_SET_EXT_EXPRESSIONS,
6648aeff920SPablo Neira Ayuso NFT_SET_EXT_OBJREF,
6653ac4c07aSPatrick McHardy NFT_SET_EXT_NUM
6663ac4c07aSPatrick McHardy };
6673ac4c07aSPatrick McHardy
6683ac4c07aSPatrick McHardy /**
6693ac4c07aSPatrick McHardy * struct nft_set_ext_type - set extension type
6703ac4c07aSPatrick McHardy *
6713ac4c07aSPatrick McHardy * @len: fixed part length of the extension
6723ac4c07aSPatrick McHardy * @align: alignment requirements of the extension
6733ac4c07aSPatrick McHardy */
6743ac4c07aSPatrick McHardy struct nft_set_ext_type {
6753ac4c07aSPatrick McHardy u8 len;
6763ac4c07aSPatrick McHardy u8 align;
6773ac4c07aSPatrick McHardy };
6783ac4c07aSPatrick McHardy
6793ac4c07aSPatrick McHardy extern const struct nft_set_ext_type nft_set_ext_types[];
6803ac4c07aSPatrick McHardy
6813ac4c07aSPatrick McHardy /**
6823ac4c07aSPatrick McHardy * struct nft_set_ext_tmpl - set extension template
6833ac4c07aSPatrick McHardy *
6843ac4c07aSPatrick McHardy * @len: length of extension area
6853ac4c07aSPatrick McHardy * @offset: offsets of individual extension types
6863ac4c07aSPatrick McHardy */
6873ac4c07aSPatrick McHardy struct nft_set_ext_tmpl {
6883ac4c07aSPatrick McHardy u16 len;
6893ac4c07aSPatrick McHardy u8 offset[NFT_SET_EXT_NUM];
69034aae2c2SPablo Neira Ayuso u8 ext_len[NFT_SET_EXT_NUM];
6913ac4c07aSPatrick McHardy };
6923ac4c07aSPatrick McHardy
6933ac4c07aSPatrick McHardy /**
6943ac4c07aSPatrick McHardy * struct nft_set_ext - set extensions
6953ac4c07aSPatrick McHardy *
696cc02e457SPatrick McHardy * @genmask: generation mask
6973ac4c07aSPatrick McHardy * @offset: offsets of individual extension types
6983ac4c07aSPatrick McHardy * @data: beginning of extension data
6993ac4c07aSPatrick McHardy */
7003ac4c07aSPatrick McHardy struct nft_set_ext {
701cc02e457SPatrick McHardy u8 genmask;
7023ac4c07aSPatrick McHardy u8 offset[NFT_SET_EXT_NUM];
7036daf1414SGustavo A. R. Silva char data[];
7043ac4c07aSPatrick McHardy };
7053ac4c07aSPatrick McHardy
nft_set_ext_prepare(struct nft_set_ext_tmpl * tmpl)7063ac4c07aSPatrick McHardy static inline void nft_set_ext_prepare(struct nft_set_ext_tmpl *tmpl)
7073ac4c07aSPatrick McHardy {
7083ac4c07aSPatrick McHardy memset(tmpl, 0, sizeof(*tmpl));
7093ac4c07aSPatrick McHardy tmpl->len = sizeof(struct nft_set_ext);
7103ac4c07aSPatrick McHardy }
7113ac4c07aSPatrick McHardy
nft_set_ext_add_length(struct nft_set_ext_tmpl * tmpl,u8 id,unsigned int len)712c39ba4deSPablo Neira Ayuso static inline int nft_set_ext_add_length(struct nft_set_ext_tmpl *tmpl, u8 id,
7133ac4c07aSPatrick McHardy unsigned int len)
7143ac4c07aSPatrick McHardy {
7153ac4c07aSPatrick McHardy tmpl->len = ALIGN(tmpl->len, nft_set_ext_types[id].align);
716c39ba4deSPablo Neira Ayuso if (tmpl->len > U8_MAX)
717c39ba4deSPablo Neira Ayuso return -EINVAL;
718c39ba4deSPablo Neira Ayuso
7193ac4c07aSPatrick McHardy tmpl->offset[id] = tmpl->len;
72034aae2c2SPablo Neira Ayuso tmpl->ext_len[id] = nft_set_ext_types[id].len + len;
72134aae2c2SPablo Neira Ayuso tmpl->len += tmpl->ext_len[id];
722c39ba4deSPablo Neira Ayuso
723c39ba4deSPablo Neira Ayuso return 0;
7243ac4c07aSPatrick McHardy }
7253ac4c07aSPatrick McHardy
nft_set_ext_add(struct nft_set_ext_tmpl * tmpl,u8 id)726c39ba4deSPablo Neira Ayuso static inline int nft_set_ext_add(struct nft_set_ext_tmpl *tmpl, u8 id)
7273ac4c07aSPatrick McHardy {
728c39ba4deSPablo Neira Ayuso return nft_set_ext_add_length(tmpl, id, 0);
7293ac4c07aSPatrick McHardy }
7303ac4c07aSPatrick McHardy
nft_set_ext_init(struct nft_set_ext * ext,const struct nft_set_ext_tmpl * tmpl)7313ac4c07aSPatrick McHardy static inline void nft_set_ext_init(struct nft_set_ext *ext,
7323ac4c07aSPatrick McHardy const struct nft_set_ext_tmpl *tmpl)
7333ac4c07aSPatrick McHardy {
7343ac4c07aSPatrick McHardy memcpy(ext->offset, tmpl->offset, sizeof(ext->offset));
7353ac4c07aSPatrick McHardy }
7363ac4c07aSPatrick McHardy
__nft_set_ext_exists(const struct nft_set_ext * ext,u8 id)7373ac4c07aSPatrick McHardy static inline bool __nft_set_ext_exists(const struct nft_set_ext *ext, u8 id)
7383ac4c07aSPatrick McHardy {
7393ac4c07aSPatrick McHardy return !!ext->offset[id];
7403ac4c07aSPatrick McHardy }
7413ac4c07aSPatrick McHardy
nft_set_ext_exists(const struct nft_set_ext * ext,u8 id)7423ac4c07aSPatrick McHardy static inline bool nft_set_ext_exists(const struct nft_set_ext *ext, u8 id)
7433ac4c07aSPatrick McHardy {
7443ac4c07aSPatrick McHardy return ext && __nft_set_ext_exists(ext, id);
7453ac4c07aSPatrick McHardy }
7463ac4c07aSPatrick McHardy
nft_set_ext(const struct nft_set_ext * ext,u8 id)7473ac4c07aSPatrick McHardy static inline void *nft_set_ext(const struct nft_set_ext *ext, u8 id)
7483ac4c07aSPatrick McHardy {
7493ac4c07aSPatrick McHardy return (void *)ext + ext->offset[id];
7503ac4c07aSPatrick McHardy }
7513ac4c07aSPatrick McHardy
nft_set_ext_key(const struct nft_set_ext * ext)7523ac4c07aSPatrick McHardy static inline struct nft_data *nft_set_ext_key(const struct nft_set_ext *ext)
7533ac4c07aSPatrick McHardy {
7543ac4c07aSPatrick McHardy return nft_set_ext(ext, NFT_SET_EXT_KEY);
7553ac4c07aSPatrick McHardy }
7563ac4c07aSPatrick McHardy
nft_set_ext_key_end(const struct nft_set_ext * ext)7577b225d0bSPablo Neira Ayuso static inline struct nft_data *nft_set_ext_key_end(const struct nft_set_ext *ext)
7587b225d0bSPablo Neira Ayuso {
7597b225d0bSPablo Neira Ayuso return nft_set_ext(ext, NFT_SET_EXT_KEY_END);
7607b225d0bSPablo Neira Ayuso }
7617b225d0bSPablo Neira Ayuso
nft_set_ext_data(const struct nft_set_ext * ext)7623ac4c07aSPatrick McHardy static inline struct nft_data *nft_set_ext_data(const struct nft_set_ext *ext)
7633ac4c07aSPatrick McHardy {
7643ac4c07aSPatrick McHardy return nft_set_ext(ext, NFT_SET_EXT_DATA);
7653ac4c07aSPatrick McHardy }
7663ac4c07aSPatrick McHardy
nft_set_ext_flags(const struct nft_set_ext * ext)7673ac4c07aSPatrick McHardy static inline u8 *nft_set_ext_flags(const struct nft_set_ext *ext)
7683ac4c07aSPatrick McHardy {
7693ac4c07aSPatrick McHardy return nft_set_ext(ext, NFT_SET_EXT_FLAGS);
7703ac4c07aSPatrick McHardy }
771ef1f7df9SPatrick McHardy
nft_set_ext_timeout(const struct nft_set_ext * ext)772c3e1b005SPatrick McHardy static inline u64 *nft_set_ext_timeout(const struct nft_set_ext *ext)
773c3e1b005SPatrick McHardy {
774c3e1b005SPatrick McHardy return nft_set_ext(ext, NFT_SET_EXT_TIMEOUT);
775c3e1b005SPatrick McHardy }
776c3e1b005SPatrick McHardy
nft_set_ext_expiration(const struct nft_set_ext * ext)7778e1102d5SFlorian Westphal static inline u64 *nft_set_ext_expiration(const struct nft_set_ext *ext)
778c3e1b005SPatrick McHardy {
779c3e1b005SPatrick McHardy return nft_set_ext(ext, NFT_SET_EXT_EXPIRATION);
780c3e1b005SPatrick McHardy }
781c3e1b005SPatrick McHardy
nft_set_ext_userdata(const struct nft_set_ext * ext)78268e942e8SPatrick McHardy static inline struct nft_userdata *nft_set_ext_userdata(const struct nft_set_ext *ext)
78368e942e8SPatrick McHardy {
78468e942e8SPatrick McHardy return nft_set_ext(ext, NFT_SET_EXT_USERDATA);
78568e942e8SPatrick McHardy }
78668e942e8SPatrick McHardy
nft_set_ext_expr(const struct nft_set_ext * ext)787563125a7SPablo Neira Ayuso static inline struct nft_set_elem_expr *nft_set_ext_expr(const struct nft_set_ext *ext)
788f25ad2e9SPatrick McHardy {
789563125a7SPablo Neira Ayuso return nft_set_ext(ext, NFT_SET_EXT_EXPRESSIONS);
790f25ad2e9SPatrick McHardy }
791f25ad2e9SPatrick McHardy
nft_set_elem_expired(const struct nft_set_ext * ext)792c3e1b005SPatrick McHardy static inline bool nft_set_elem_expired(const struct nft_set_ext *ext)
793c3e1b005SPatrick McHardy {
794c3e1b005SPatrick McHardy return nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION) &&
7958e1102d5SFlorian Westphal time_is_before_eq_jiffies64(*nft_set_ext_expiration(ext));
796c3e1b005SPatrick McHardy }
797c3e1b005SPatrick McHardy
nft_set_elem_ext(const struct nft_set * set,void * elem)798fe2811ebSPatrick McHardy static inline struct nft_set_ext *nft_set_elem_ext(const struct nft_set *set,
799fe2811ebSPatrick McHardy void *elem)
800fe2811ebSPatrick McHardy {
801fe2811ebSPatrick McHardy return elem + set->ops->elemsize;
802fe2811ebSPatrick McHardy }
803fe2811ebSPatrick McHardy
nft_set_ext_obj(const struct nft_set_ext * ext)8048aeff920SPablo Neira Ayuso static inline struct nft_object **nft_set_ext_obj(const struct nft_set_ext *ext)
8058aeff920SPablo Neira Ayuso {
8068aeff920SPablo Neira Ayuso return nft_set_ext(ext, NFT_SET_EXT_OBJREF);
8078aeff920SPablo Neira Ayuso }
8088aeff920SPablo Neira Ayuso
809a7fc9368SPablo Neira Ayuso struct nft_expr *nft_set_elem_expr_alloc(const struct nft_ctx *ctx,
810a7fc9368SPablo Neira Ayuso const struct nft_set *set,
811a7fc9368SPablo Neira Ayuso const struct nlattr *attr);
812a7fc9368SPablo Neira Ayuso
81322fe54d5SPatrick McHardy void *nft_set_elem_init(const struct nft_set *set,
81422fe54d5SPatrick McHardy const struct nft_set_ext_tmpl *tmpl,
8157b225d0bSPablo Neira Ayuso const u32 *key, const u32 *key_end, const u32 *data,
81679ebb5bbSLaura Garcia Liebana u64 timeout, u64 expiration, gfp_t gfp);
817fca05d4dSPablo Neira Ayuso int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set,
818fca05d4dSPablo Neira Ayuso struct nft_expr *expr_array[]);
81961f9e292SLiping Zhang void nft_set_elem_destroy(const struct nft_set *set, void *elem,
82061f9e292SLiping Zhang bool destroy_expr);
821628bd3e4SPablo Neira Ayuso void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,
822628bd3e4SPablo Neira Ayuso const struct nft_set *set, void *elem);
82361edafbbSPatrick McHardy
824b8e20400SPablo Neira Ayuso struct nft_expr_ops;
825cfed7e1bSPatrick McHardy /**
826ef1f7df9SPatrick McHardy * struct nft_expr_type - nf_tables expression type
82796518518SPatrick McHardy *
828ef1f7df9SPatrick McHardy * @select_ops: function to select nft_expr_ops
829b8e20400SPablo Neira Ayuso * @release_ops: release nft_expr_ops
830ef1f7df9SPatrick McHardy * @ops: default ops, used when no select_ops functions is present
83196518518SPatrick McHardy * @list: used internally
83296518518SPatrick McHardy * @name: Identifier
83396518518SPatrick McHardy * @owner: module reference
83496518518SPatrick McHardy * @policy: netlink attribute policy
83596518518SPatrick McHardy * @maxattr: highest netlink attribute number
83664d46806SPatrick McHardy * @family: address family for AF-specific types
837151d799aSPatrick McHardy * @flags: expression type flags
838ef1f7df9SPatrick McHardy */
839ef1f7df9SPatrick McHardy struct nft_expr_type {
8400ca743a5SPablo Neira Ayuso const struct nft_expr_ops *(*select_ops)(const struct nft_ctx *,
8410ca743a5SPablo Neira Ayuso const struct nlattr * const tb[]);
842b8e20400SPablo Neira Ayuso void (*release_ops)(const struct nft_expr_ops *ops);
843ef1f7df9SPatrick McHardy const struct nft_expr_ops *ops;
8443a07327dSPablo Neira Ayuso const struct nft_expr_ops *inner_ops;
845ef1f7df9SPatrick McHardy struct list_head list;
846ef1f7df9SPatrick McHardy const char *name;
847ef1f7df9SPatrick McHardy struct module *owner;
848ef1f7df9SPatrick McHardy const struct nla_policy *policy;
849ef1f7df9SPatrick McHardy unsigned int maxattr;
85064d46806SPatrick McHardy u8 family;
851151d799aSPatrick McHardy u8 flags;
852ef1f7df9SPatrick McHardy };
853ef1f7df9SPatrick McHardy
854151d799aSPatrick McHardy #define NFT_EXPR_STATEFUL 0x1
85579b174adSPablo Neira Ayuso #define NFT_EXPR_GC 0x2
856151d799aSPatrick McHardy
857f6ac8585SPablo Neira Ayuso enum nft_trans_phase {
858f6ac8585SPablo Neira Ayuso NFT_TRANS_PREPARE,
85926b5a571SPablo Neira Ayuso NFT_TRANS_PREPARE_ERROR,
860f6ac8585SPablo Neira Ayuso NFT_TRANS_ABORT,
861f6ac8585SPablo Neira Ayuso NFT_TRANS_COMMIT,
862f6ac8585SPablo Neira Ayuso NFT_TRANS_RELEASE
863f6ac8585SPablo Neira Ayuso };
864f6ac8585SPablo Neira Ayuso
865c9626a2cSPablo Neira Ayuso struct nft_flow_rule;
866c9626a2cSPablo Neira Ayuso struct nft_offload_ctx;
867c9626a2cSPablo Neira Ayuso
868ef1f7df9SPatrick McHardy /**
869ef1f7df9SPatrick McHardy * struct nft_expr_ops - nf_tables expression operations
870ef1f7df9SPatrick McHardy *
871ef1f7df9SPatrick McHardy * @eval: Expression evaluation function
87296518518SPatrick McHardy * @size: full expression size, including private data size
873ef1f7df9SPatrick McHardy * @init: initialization function
874cd5125d8SFlorian Westphal * @activate: activate expression in the next generation
875cd5125d8SFlorian Westphal * @deactivate: deactivate expression in next generation
876cd5125d8SFlorian Westphal * @destroy: destruction function, called after synchronize_rcu
877ef1f7df9SPatrick McHardy * @dump: function to dump parameters
878ef1f7df9SPatrick McHardy * @type: expression type
8790ca743a5SPablo Neira Ayuso * @validate: validate expression, called during loop detection
8800ca743a5SPablo Neira Ayuso * @data: extra data to attach to this expression operation
88196518518SPatrick McHardy */
88296518518SPatrick McHardy struct nft_expr_ops {
88396518518SPatrick McHardy void (*eval)(const struct nft_expr *expr,
884a55e22e9SPatrick McHardy struct nft_regs *regs,
88596518518SPatrick McHardy const struct nft_pktinfo *pkt);
886086f3321SPablo Neira Ayuso int (*clone)(struct nft_expr *dst,
887086f3321SPablo Neira Ayuso const struct nft_expr *src);
888ef1f7df9SPatrick McHardy unsigned int size;
889ef1f7df9SPatrick McHardy
89096518518SPatrick McHardy int (*init)(const struct nft_ctx *ctx,
89196518518SPatrick McHardy const struct nft_expr *expr,
89296518518SPatrick McHardy const struct nlattr * const tb[]);
893bb7b40aeSPablo Neira Ayuso void (*activate)(const struct nft_ctx *ctx,
894bb7b40aeSPablo Neira Ayuso const struct nft_expr *expr);
895bb7b40aeSPablo Neira Ayuso void (*deactivate)(const struct nft_ctx *ctx,
896f6ac8585SPablo Neira Ayuso const struct nft_expr *expr,
897f6ac8585SPablo Neira Ayuso enum nft_trans_phase phase);
89862472bceSPatrick McHardy void (*destroy)(const struct nft_ctx *ctx,
89962472bceSPatrick McHardy const struct nft_expr *expr);
900371ebcbbSPablo Neira Ayuso void (*destroy_clone)(const struct nft_ctx *ctx,
901371ebcbbSPablo Neira Ayuso const struct nft_expr *expr);
90296518518SPatrick McHardy int (*dump)(struct sk_buff *skb,
9037d34aa3eSPhil Sutter const struct nft_expr *expr,
9047d34aa3eSPhil Sutter bool reset);
9050ca743a5SPablo Neira Ayuso int (*validate)(const struct nft_ctx *ctx,
9060ca743a5SPablo Neira Ayuso const struct nft_expr *expr,
9070ca743a5SPablo Neira Ayuso const struct nft_data **data);
90812e4ecfaSPablo Neira Ayuso bool (*reduce)(struct nft_regs_track *track,
90912e4ecfaSPablo Neira Ayuso const struct nft_expr *expr);
91079b174adSPablo Neira Ayuso bool (*gc)(struct net *net,
91179b174adSPablo Neira Ayuso const struct nft_expr *expr);
912c9626a2cSPablo Neira Ayuso int (*offload)(struct nft_offload_ctx *ctx,
913c9626a2cSPablo Neira Ayuso struct nft_flow_rule *flow,
914c9626a2cSPablo Neira Ayuso const struct nft_expr *expr);
915b1a5983fSPablo Neira Ayuso bool (*offload_action)(const struct nft_expr *expr);
916b72920f6SPablo Neira Ayuso void (*offload_stats)(struct nft_expr *expr,
917b72920f6SPablo Neira Ayuso const struct flow_stats *stats);
918ef1f7df9SPatrick McHardy const struct nft_expr_type *type;
9190ca743a5SPablo Neira Ayuso void *data;
92096518518SPatrick McHardy };
92196518518SPatrick McHardy
92296518518SPatrick McHardy /**
92396518518SPatrick McHardy * struct nft_rule - nf_tables rule
92496518518SPatrick McHardy *
92596518518SPatrick McHardy * @list: used internally
92696518518SPatrick McHardy * @handle: rule handle
9270628b123SPablo Neira Ayuso * @genmask: generation mask
92896518518SPatrick McHardy * @dlen: length of expression data
92986f1ec32SPatrick McHardy * @udata: user data is appended to the rule
93096518518SPatrick McHardy * @data: expression data
93196518518SPatrick McHardy */
93296518518SPatrick McHardy struct nft_rule {
93396518518SPatrick McHardy struct list_head list;
9340768b3b3SPablo Neira Ayuso u64 handle:42,
9350628b123SPablo Neira Ayuso genmask:2,
9360768b3b3SPablo Neira Ayuso dlen:12,
93786f1ec32SPatrick McHardy udata:1;
93896518518SPatrick McHardy unsigned char data[]
93996518518SPatrick McHardy __attribute__((aligned(__alignof__(struct nft_expr))));
94096518518SPatrick McHardy };
94196518518SPatrick McHardy
nft_expr_first(const struct nft_rule * rule)94296518518SPatrick McHardy static inline struct nft_expr *nft_expr_first(const struct nft_rule *rule)
94396518518SPatrick McHardy {
94496518518SPatrick McHardy return (struct nft_expr *)&rule->data[0];
94596518518SPatrick McHardy }
94696518518SPatrick McHardy
nft_expr_next(const struct nft_expr * expr)94796518518SPatrick McHardy static inline struct nft_expr *nft_expr_next(const struct nft_expr *expr)
94896518518SPatrick McHardy {
94996518518SPatrick McHardy return ((void *)expr) + expr->ops->size;
95096518518SPatrick McHardy }
95196518518SPatrick McHardy
nft_expr_last(const struct nft_rule * rule)95296518518SPatrick McHardy static inline struct nft_expr *nft_expr_last(const struct nft_rule *rule)
95396518518SPatrick McHardy {
95496518518SPatrick McHardy return (struct nft_expr *)&rule->data[rule->dlen];
95596518518SPatrick McHardy }
95696518518SPatrick McHardy
nft_expr_more(const struct nft_rule * rule,const struct nft_expr * expr)95731cc578aSSaeed Mirzamohammadi static inline bool nft_expr_more(const struct nft_rule *rule,
95831cc578aSSaeed Mirzamohammadi const struct nft_expr *expr)
95931cc578aSSaeed Mirzamohammadi {
96031cc578aSSaeed Mirzamohammadi return expr != nft_expr_last(rule) && expr->ops;
96131cc578aSSaeed Mirzamohammadi }
96231cc578aSSaeed Mirzamohammadi
nft_userdata(const struct nft_rule * rule)96386f1ec32SPatrick McHardy static inline struct nft_userdata *nft_userdata(const struct nft_rule *rule)
9640768b3b3SPablo Neira Ayuso {
9650768b3b3SPablo Neira Ayuso return (void *)&rule->data[rule->dlen];
9660768b3b3SPablo Neira Ayuso }
9670768b3b3SPablo Neira Ayuso
9684bedf9eeSPablo Neira Ayuso void nft_rule_expr_activate(const struct nft_ctx *ctx, struct nft_rule *rule);
9694bedf9eeSPablo Neira Ayuso void nft_rule_expr_deactivate(const struct nft_ctx *ctx, struct nft_rule *rule,
9704bedf9eeSPablo Neira Ayuso enum nft_trans_phase phase);
9714bedf9eeSPablo Neira Ayuso void nf_tables_rule_destroy(const struct nft_ctx *ctx, struct nft_rule *rule);
972d0e2c7deSPablo Neira Ayuso
nft_set_elem_update_expr(const struct nft_set_ext * ext,struct nft_regs * regs,const struct nft_pktinfo * pkt)97376adfafeSPablo Neira Ayuso static inline void nft_set_elem_update_expr(const struct nft_set_ext *ext,
97476adfafeSPablo Neira Ayuso struct nft_regs *regs,
97576adfafeSPablo Neira Ayuso const struct nft_pktinfo *pkt)
97676adfafeSPablo Neira Ayuso {
977563125a7SPablo Neira Ayuso struct nft_set_elem_expr *elem_expr;
97876adfafeSPablo Neira Ayuso struct nft_expr *expr;
979563125a7SPablo Neira Ayuso u32 size;
98076adfafeSPablo Neira Ayuso
981563125a7SPablo Neira Ayuso if (__nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS)) {
982563125a7SPablo Neira Ayuso elem_expr = nft_set_ext_expr(ext);
983563125a7SPablo Neira Ayuso nft_setelem_expr_foreach(expr, elem_expr, size) {
98476adfafeSPablo Neira Ayuso expr->ops->eval(expr, regs, pkt);
985563125a7SPablo Neira Ayuso if (regs->verdict.code == NFT_BREAK)
986563125a7SPablo Neira Ayuso return;
987563125a7SPablo Neira Ayuso }
98876adfafeSPablo Neira Ayuso }
98976adfafeSPablo Neira Ayuso }
99076adfafeSPablo Neira Ayuso
99196518518SPatrick McHardy /*
99296518518SPatrick McHardy * The last pointer isn't really necessary, but the compiler isn't able to
99396518518SPatrick McHardy * determine that the result of nft_expr_last() is always the same since it
99496518518SPatrick McHardy * can't assume that the dlen value wasn't changed within calls in the loop.
99596518518SPatrick McHardy */
99696518518SPatrick McHardy #define nft_rule_for_each_expr(expr, last, rule) \
99796518518SPatrick McHardy for ((expr) = nft_expr_first(rule), (last) = nft_expr_last(rule); \
99896518518SPatrick McHardy (expr) != (last); \
99996518518SPatrick McHardy (expr) = nft_expr_next(expr))
100096518518SPatrick McHardy
1001ad652f38SPablo Neira Ayuso #define NFT_CHAIN_POLICY_UNSET U8_MAX
1002ad652f38SPablo Neira Ayuso
10032c865a8aSPablo Neira Ayuso struct nft_rule_dp {
10042c865a8aSPablo Neira Ayuso u64 is_last:1,
10052c865a8aSPablo Neira Ayuso dlen:12,
10062c865a8aSPablo Neira Ayuso handle:42; /* for tracing */
10072c865a8aSPablo Neira Ayuso unsigned char data[]
10082c865a8aSPablo Neira Ayuso __attribute__((aligned(__alignof__(struct nft_expr))));
10092c865a8aSPablo Neira Ayuso };
10102c865a8aSPablo Neira Ayuso
101163e9bbbcSFlorian Westphal struct nft_rule_dp_last {
101263e9bbbcSFlorian Westphal struct nft_rule_dp end; /* end of nft_rule_blob marker */
101363e9bbbcSFlorian Westphal struct rcu_head h; /* call_rcu head */
101463e9bbbcSFlorian Westphal struct nft_rule_blob *blob; /* ptr to free via call_rcu */
101563e9bbbcSFlorian Westphal const struct nft_chain *chain; /* for nftables tracing */
101663e9bbbcSFlorian Westphal };
101763e9bbbcSFlorian Westphal
nft_rule_next(const struct nft_rule_dp * rule)101863e9bbbcSFlorian Westphal static inline const struct nft_rule_dp *nft_rule_next(const struct nft_rule_dp *rule)
101963e9bbbcSFlorian Westphal {
102063e9bbbcSFlorian Westphal return (void *)rule + sizeof(*rule) + rule->dlen;
102163e9bbbcSFlorian Westphal }
102263e9bbbcSFlorian Westphal
10232c865a8aSPablo Neira Ayuso struct nft_rule_blob {
10242c865a8aSPablo Neira Ayuso unsigned long size;
10252c865a8aSPablo Neira Ayuso unsigned char data[]
10262c865a8aSPablo Neira Ayuso __attribute__((aligned(__alignof__(struct nft_rule_dp))));
10272c865a8aSPablo Neira Ayuso };
10282c865a8aSPablo Neira Ayuso
102996518518SPatrick McHardy /**
103096518518SPatrick McHardy * struct nft_chain - nf_tables chain
103196518518SPatrick McHardy *
103296518518SPatrick McHardy * @rules: list of rules in the chain
103396518518SPatrick McHardy * @list: used internally
10341b2470e5SFlorian Westphal * @rhlhead: used internally
1035b5bc89bfSPablo Neira Ayuso * @table: table that this chain belongs to
103696518518SPatrick McHardy * @handle: chain handle
103796518518SPatrick McHardy * @use: number of jump references to this chain
1038a0a7379eSPablo Neira Ayuso * @flags: bitmask of enum nft_chain_flags
103996518518SPatrick McHardy * @name: name of the chain
104096518518SPatrick McHardy */
104196518518SPatrick McHardy struct nft_chain {
10422c865a8aSPablo Neira Ayuso struct nft_rule_blob __rcu *blob_gen_0;
10432c865a8aSPablo Neira Ayuso struct nft_rule_blob __rcu *blob_gen_1;
104496518518SPatrick McHardy struct list_head rules;
104596518518SPatrick McHardy struct list_head list;
10461b2470e5SFlorian Westphal struct rhlist_head rhlhead;
1047b5bc89bfSPablo Neira Ayuso struct nft_table *table;
104896518518SPatrick McHardy u64 handle;
1049a0a7379eSPablo Neira Ayuso u32 use;
1050d0e2c7deSPablo Neira Ayuso u8 flags:5,
1051d0e2c7deSPablo Neira Ayuso bound:1,
1052664b0f8cSPablo Neira Ayuso genmask:2;
1053b7263e07SPhil Sutter char *name;
1054002f2176SJose M. Guisado Gomez u16 udlen;
1055002f2176SJose M. Guisado Gomez u8 *udata;
10560cbc06b3SFlorian Westphal
10570cbc06b3SFlorian Westphal /* Only used during control plane commit phase: */
10582c865a8aSPablo Neira Ayuso struct nft_rule_blob *blob_next;
105996518518SPatrick McHardy };
106096518518SPatrick McHardy
1061a654de8fSPablo Neira Ayuso int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain);
1062d46fc894SPablo Neira Ayuso int nft_setelem_validate(const struct nft_ctx *ctx, struct nft_set *set,
1063d46fc894SPablo Neira Ayuso const struct nft_set_iter *iter,
1064d46fc894SPablo Neira Ayuso struct nft_set_elem *elem);
1065d46fc894SPablo Neira Ayuso int nft_set_catchall_validate(const struct nft_ctx *ctx, struct nft_set *set);
10664bedf9eeSPablo Neira Ayuso int nf_tables_bind_chain(const struct nft_ctx *ctx, struct nft_chain *chain);
106726b5a571SPablo Neira Ayuso void nf_tables_unbind_chain(const struct nft_ctx *ctx, struct nft_chain *chain);
1068a654de8fSPablo Neira Ayuso
106932537e91SPablo Neira Ayuso enum nft_chain_types {
10709370761cSPablo Neira Ayuso NFT_CHAIN_T_DEFAULT = 0,
10719370761cSPablo Neira Ayuso NFT_CHAIN_T_ROUTE,
10729370761cSPablo Neira Ayuso NFT_CHAIN_T_NAT,
10739370761cSPablo Neira Ayuso NFT_CHAIN_T_MAX
10749370761cSPablo Neira Ayuso };
10759370761cSPablo Neira Ayuso
10761a1e1a12SPatrick McHardy /**
107732537e91SPablo Neira Ayuso * struct nft_chain_type - nf_tables chain type info
10781a1e1a12SPatrick McHardy *
10791a1e1a12SPatrick McHardy * @name: name of the type
10801a1e1a12SPatrick McHardy * @type: numeric identifier
10811a1e1a12SPatrick McHardy * @family: address family
10821a1e1a12SPatrick McHardy * @owner: module owner
10831a1e1a12SPatrick McHardy * @hook_mask: mask of valid hooks
1084c2f9eafeSPablo Neira Ayuso * @hooks: array of hook functions
10854e25ceb8SFlorian Westphal * @ops_register: base chain register function
10864e25ceb8SFlorian Westphal * @ops_unregister: base chain unregister function
10871a1e1a12SPatrick McHardy */
108832537e91SPablo Neira Ayuso struct nft_chain_type {
10891a1e1a12SPatrick McHardy const char *name;
109032537e91SPablo Neira Ayuso enum nft_chain_types type;
10911a1e1a12SPatrick McHardy int family;
10921a1e1a12SPatrick McHardy struct module *owner;
10931a1e1a12SPatrick McHardy unsigned int hook_mask;
1094d25e2e93SPablo Neira Ayuso nf_hookfn *hooks[NFT_MAX_HOOKS];
10954e25ceb8SFlorian Westphal int (*ops_register)(struct net *net, const struct nf_hook_ops *ops);
10964e25ceb8SFlorian Westphal void (*ops_unregister)(struct net *net, const struct nf_hook_ops *ops);
10971a1e1a12SPatrick McHardy };
10981a1e1a12SPatrick McHardy
10997210e4e3SPablo Neira Ayuso int nft_chain_validate_dependency(const struct nft_chain *chain,
110032537e91SPablo Neira Ayuso enum nft_chain_types type);
110175e8d06dSPablo Neira Ayuso int nft_chain_validate_hooks(const struct nft_chain *chain,
110275e8d06dSPablo Neira Ayuso unsigned int hook_flags);
11037210e4e3SPablo Neira Ayuso
nft_chain_binding(const struct nft_chain * chain)11044bedf9eeSPablo Neira Ayuso static inline bool nft_chain_binding(const struct nft_chain *chain)
11054bedf9eeSPablo Neira Ayuso {
11064bedf9eeSPablo Neira Ayuso return chain->flags & NFT_CHAIN_BINDING;
11074bedf9eeSPablo Neira Ayuso }
11084bedf9eeSPablo Neira Ayuso
nft_chain_is_bound(struct nft_chain * chain)1109d0e2c7deSPablo Neira Ayuso static inline bool nft_chain_is_bound(struct nft_chain *chain)
1110d0e2c7deSPablo Neira Ayuso {
1111d0e2c7deSPablo Neira Ayuso return (chain->flags & NFT_CHAIN_BINDING) && chain->bound;
1112d0e2c7deSPablo Neira Ayuso }
1113d0e2c7deSPablo Neira Ayuso
11144bedf9eeSPablo Neira Ayuso int nft_chain_add(struct nft_table *table, struct nft_chain *chain);
1115d0e2c7deSPablo Neira Ayuso void nft_chain_del(struct nft_chain *chain);
1116d0e2c7deSPablo Neira Ayuso void nf_tables_chain_destroy(struct nft_ctx *ctx);
1117d0e2c7deSPablo Neira Ayuso
11180ca743a5SPablo Neira Ayuso struct nft_stats {
11190ca743a5SPablo Neira Ayuso u64 bytes;
11200ca743a5SPablo Neira Ayuso u64 pkts;
1121ce355e20SEric Dumazet struct u64_stats_sync syncp;
11220ca743a5SPablo Neira Ayuso };
11230ca743a5SPablo Neira Ayuso
11243f0465a9SPablo Neira Ayuso struct nft_hook {
11253f0465a9SPablo Neira Ayuso struct list_head list;
11263f0465a9SPablo Neira Ayuso struct nf_hook_ops ops;
11273f0465a9SPablo Neira Ayuso struct rcu_head rcu;
11283f0465a9SPablo Neira Ayuso };
11293f0465a9SPablo Neira Ayuso
113096518518SPatrick McHardy /**
113196518518SPatrick McHardy * struct nft_base_chain - nf_tables base chain
113296518518SPatrick McHardy *
113396518518SPatrick McHardy * @ops: netfilter hook ops
1134d54725cdSPablo Neira Ayuso * @hook_list: list of netfilter hooks (for NFPROTO_NETDEV family)
11359370761cSPablo Neira Ayuso * @type: chain type
11360ca743a5SPablo Neira Ayuso * @policy: default policy
11370ca743a5SPablo Neira Ayuso * @stats: per-cpu chain stats
113896518518SPatrick McHardy * @chain: the chain
113914bfb13fSPablo Neira Ayuso * @flow_block: flow block (for hardware offload)
114096518518SPatrick McHardy */
114196518518SPatrick McHardy struct nft_base_chain {
1142c974a3a3SPablo Neira Ayuso struct nf_hook_ops ops;
1143d54725cdSPablo Neira Ayuso struct list_head hook_list;
114432537e91SPablo Neira Ayuso const struct nft_chain_type *type;
11450ca743a5SPablo Neira Ayuso u8 policy;
1146835b8033SPablo Neira Ayuso u8 flags;
11470ca743a5SPablo Neira Ayuso struct nft_stats __percpu *stats;
114896518518SPatrick McHardy struct nft_chain chain;
114914bfb13fSPablo Neira Ayuso struct flow_block flow_block;
115096518518SPatrick McHardy };
115196518518SPatrick McHardy
nft_base_chain(const struct nft_chain * chain)115296518518SPatrick McHardy static inline struct nft_base_chain *nft_base_chain(const struct nft_chain *chain)
115396518518SPatrick McHardy {
115496518518SPatrick McHardy return container_of(chain, struct nft_base_chain, chain);
115596518518SPatrick McHardy }
115696518518SPatrick McHardy
nft_is_base_chain(const struct nft_chain * chain)1157f323d954SPablo Neira Ayuso static inline bool nft_is_base_chain(const struct nft_chain *chain)
1158f323d954SPablo Neira Ayuso {
115967c49de4SPablo Neira Ayuso return chain->flags & NFT_CHAIN_BASE;
1160f323d954SPablo Neira Ayuso }
1161f323d954SPablo Neira Ayuso
11625ebe0b0eSPablo Neira Ayuso int __nft_release_basechain(struct nft_ctx *ctx);
1163835b8033SPablo Neira Ayuso
116406198b34SEric W. Biederman unsigned int nft_do_chain(struct nft_pktinfo *pkt, void *priv);
116596518518SPatrick McHardy
nft_use_inc(u32 * use)11661689f259SPablo Neira Ayuso static inline bool nft_use_inc(u32 *use)
11671689f259SPablo Neira Ayuso {
11681689f259SPablo Neira Ayuso if (*use == UINT_MAX)
11691689f259SPablo Neira Ayuso return false;
11701689f259SPablo Neira Ayuso
11711689f259SPablo Neira Ayuso (*use)++;
11721689f259SPablo Neira Ayuso
11731689f259SPablo Neira Ayuso return true;
11741689f259SPablo Neira Ayuso }
11751689f259SPablo Neira Ayuso
nft_use_dec(u32 * use)11761689f259SPablo Neira Ayuso static inline void nft_use_dec(u32 *use)
11771689f259SPablo Neira Ayuso {
11781689f259SPablo Neira Ayuso WARN_ON_ONCE((*use)-- == 0);
11791689f259SPablo Neira Ayuso }
11801689f259SPablo Neira Ayuso
11811689f259SPablo Neira Ayuso /* For error and abort path: restore use counter to previous state. */
nft_use_inc_restore(u32 * use)11821689f259SPablo Neira Ayuso static inline void nft_use_inc_restore(u32 *use)
11831689f259SPablo Neira Ayuso {
11841689f259SPablo Neira Ayuso WARN_ON_ONCE(!nft_use_inc(use));
11851689f259SPablo Neira Ayuso }
11861689f259SPablo Neira Ayuso
11871689f259SPablo Neira Ayuso #define nft_use_dec_restore nft_use_dec
11881689f259SPablo Neira Ayuso
118996518518SPatrick McHardy /**
119096518518SPatrick McHardy * struct nft_table - nf_tables table
119196518518SPatrick McHardy *
119296518518SPatrick McHardy * @list: used internally
11931b2470e5SFlorian Westphal * @chains_ht: chains in the table
11941b2470e5SFlorian Westphal * @chains: same, for stable walks
119596518518SPatrick McHardy * @sets: sets in the table
1196e5009240SPablo Neira Ayuso * @objects: stateful objects in the table
11973b49e2e9SPablo Neira Ayuso * @flowtables: flow tables in the table
119896518518SPatrick McHardy * @hgenerator: handle generator state
11993ecbfd65SHarsha Sharma * @handle: table handle
120096518518SPatrick McHardy * @use: number of chain references to this table
120196518518SPatrick McHardy * @flags: table flag (see enum nft_table_flags)
1202f2a6d766SPablo Neira Ayuso * @genmask: generation mask
120336596dadSPablo Neira Ayuso * @afinfo: address family info
120496518518SPatrick McHardy * @name: name of the table
120500c320f9SFlorian Westphal * @validate_state: internal, set when transaction adds jumps
120696518518SPatrick McHardy */
120796518518SPatrick McHardy struct nft_table {
120896518518SPatrick McHardy struct list_head list;
12091b2470e5SFlorian Westphal struct rhltable chains_ht;
121096518518SPatrick McHardy struct list_head chains;
121196518518SPatrick McHardy struct list_head sets;
1212e5009240SPablo Neira Ayuso struct list_head objects;
12133b49e2e9SPablo Neira Ayuso struct list_head flowtables;
121496518518SPatrick McHardy u64 hgenerator;
12153ecbfd65SHarsha Sharma u64 handle;
121696518518SPatrick McHardy u32 use;
121798319cb9SPablo Neira Ayuso u16 family:6,
121898319cb9SPablo Neira Ayuso flags:8,
1219f2a6d766SPablo Neira Ayuso genmask:2;
12206001a930SPablo Neira Ayuso u32 nlpid;
1221e46abbccSPhil Sutter char *name;
12227a81575bSJose M. Guisado Gomez u16 udlen;
12237a81575bSJose M. Guisado Gomez u8 *udata;
122400c320f9SFlorian Westphal u8 validate_state;
1225ebddf1a8SPablo Neira Ayuso };
1226ebddf1a8SPablo Neira Ayuso
nft_table_has_owner(const struct nft_table * table)12276001a930SPablo Neira Ayuso static inline bool nft_table_has_owner(const struct nft_table *table)
12286001a930SPablo Neira Ayuso {
12296001a930SPablo Neira Ayuso return table->flags & NFT_TABLE_F_OWNER;
12306001a930SPablo Neira Ayuso }
12316001a930SPablo Neira Ayuso
nft_base_chain_netdev(int family,u32 hooknum)1232d3519cb8SPablo Neira Ayuso static inline bool nft_base_chain_netdev(int family, u32 hooknum)
1233d3519cb8SPablo Neira Ayuso {
1234d3519cb8SPablo Neira Ayuso return family == NFPROTO_NETDEV ||
1235d3519cb8SPablo Neira Ayuso (family == NFPROTO_INET && hooknum == NF_INET_INGRESS);
1236d3519cb8SPablo Neira Ayuso }
1237d3519cb8SPablo Neira Ayuso
1238cc07eeb0SPablo Neira Ayuso void nft_register_chain_type(const struct nft_chain_type *);
123932537e91SPablo Neira Ayuso void nft_unregister_chain_type(const struct nft_chain_type *);
124096518518SPatrick McHardy
12415eccdfaaSJoe Perches int nft_register_expr(struct nft_expr_type *);
12425eccdfaaSJoe Perches void nft_unregister_expr(struct nft_expr_type *);
124396518518SPatrick McHardy
124433d5a7b1SFlorian Westphal int nft_verdict_dump(struct sk_buff *skb, int type,
124533d5a7b1SFlorian Westphal const struct nft_verdict *v);
124633d5a7b1SFlorian Westphal
124733d5a7b1SFlorian Westphal /**
1248d152159bSFlorian Westphal * struct nft_object_hash_key - key to lookup nft_object
1249d152159bSFlorian Westphal *
1250d152159bSFlorian Westphal * @name: name of the stateful object to look up
1251d152159bSFlorian Westphal * @table: table the object belongs to
1252d152159bSFlorian Westphal */
1253d152159bSFlorian Westphal struct nft_object_hash_key {
1254d152159bSFlorian Westphal const char *name;
1255d152159bSFlorian Westphal const struct nft_table *table;
1256d152159bSFlorian Westphal };
1257d152159bSFlorian Westphal
1258d152159bSFlorian Westphal /**
1259e5009240SPablo Neira Ayuso * struct nft_object - nf_tables stateful object
1260e5009240SPablo Neira Ayuso *
1261e5009240SPablo Neira Ayuso * @list: table stateful object list node
1262d152159bSFlorian Westphal * @key: keys that identify this object
12634d44175aSFlorian Westphal * @rhlhead: nft_objname_ht node
1264e5009240SPablo Neira Ayuso * @genmask: generation mask
1265e5009240SPablo Neira Ayuso * @use: number of references to this stateful object
12663ecbfd65SHarsha Sharma * @handle: unique object handle
1267dfc46034SPablo M. Bermudo Garay * @ops: object operations
12683ecbfd65SHarsha Sharma * @data: object data, layout depends on type
1269e5009240SPablo Neira Ayuso */
1270e5009240SPablo Neira Ayuso struct nft_object {
1271e5009240SPablo Neira Ayuso struct list_head list;
12724d44175aSFlorian Westphal struct rhlist_head rhlhead;
1273d152159bSFlorian Westphal struct nft_object_hash_key key;
12741689f259SPablo Neira Ayuso u32 genmask:2;
12751689f259SPablo Neira Ayuso u32 use;
12763ecbfd65SHarsha Sharma u64 handle;
1277b131c964SJose M. Guisado Gomez u16 udlen;
1278b131c964SJose M. Guisado Gomez u8 *udata;
1279e5009240SPablo Neira Ayuso /* runtime data below here */
1280dfc46034SPablo M. Bermudo Garay const struct nft_object_ops *ops ____cacheline_aligned;
1281e5009240SPablo Neira Ayuso unsigned char data[]
1282e5009240SPablo Neira Ayuso __attribute__((aligned(__alignof__(u64))));
1283e5009240SPablo Neira Ayuso };
1284e5009240SPablo Neira Ayuso
nft_obj_data(const struct nft_object * obj)1285e5009240SPablo Neira Ayuso static inline void *nft_obj_data(const struct nft_object *obj)
1286e5009240SPablo Neira Ayuso {
1287e5009240SPablo Neira Ayuso return (void *)obj->data;
1288e5009240SPablo Neira Ayuso }
1289e5009240SPablo Neira Ayuso
1290e5009240SPablo Neira Ayuso #define nft_expr_obj(expr) *((struct nft_object **)nft_expr_priv(expr))
1291e5009240SPablo Neira Ayuso
12924d44175aSFlorian Westphal struct nft_object *nft_obj_lookup(const struct net *net,
12934d44175aSFlorian Westphal const struct nft_table *table,
1294e5009240SPablo Neira Ayuso const struct nlattr *nla, u32 objtype,
1295e5009240SPablo Neira Ayuso u8 genmask);
1296e5009240SPablo Neira Ayuso
1297d152159bSFlorian Westphal void nft_obj_notify(struct net *net, const struct nft_table *table,
12982599e989SPablo Neira Ayuso struct nft_object *obj, u32 portid, u32 seq,
12996fb721cfSPablo Neira Ayuso int event, u16 flags, int family, int report, gfp_t gfp);
13002599e989SPablo Neira Ayuso
1301e5009240SPablo Neira Ayuso /**
1302e5009240SPablo Neira Ayuso * struct nft_object_type - stateful object type
1303e5009240SPablo Neira Ayuso *
1304dfc46034SPablo M. Bermudo Garay * @select_ops: function to select nft_object_ops
1305dfc46034SPablo M. Bermudo Garay * @ops: default ops, used when no select_ops functions is present
1306e5009240SPablo Neira Ayuso * @list: list node in list of object types
1307e5009240SPablo Neira Ayuso * @type: stateful object numeric type
1308e5009240SPablo Neira Ayuso * @owner: module owner
1309e5009240SPablo Neira Ayuso * @maxattr: maximum netlink attribute
1310*ce76746aSPablo Neira Ayuso * @family: address family for AF-specific object types
1311e5009240SPablo Neira Ayuso * @policy: netlink attribute policy
1312dfc46034SPablo M. Bermudo Garay */
1313dfc46034SPablo M. Bermudo Garay struct nft_object_type {
1314dfc46034SPablo M. Bermudo Garay const struct nft_object_ops *(*select_ops)(const struct nft_ctx *,
1315dfc46034SPablo M. Bermudo Garay const struct nlattr * const tb[]);
1316dfc46034SPablo M. Bermudo Garay const struct nft_object_ops *ops;
1317dfc46034SPablo M. Bermudo Garay struct list_head list;
1318dfc46034SPablo M. Bermudo Garay u32 type;
1319dfc46034SPablo M. Bermudo Garay unsigned int maxattr;
1320*ce76746aSPablo Neira Ayuso u8 family;
1321dfc46034SPablo M. Bermudo Garay struct module *owner;
1322dfc46034SPablo M. Bermudo Garay const struct nla_policy *policy;
1323dfc46034SPablo M. Bermudo Garay };
1324dfc46034SPablo M. Bermudo Garay
1325dfc46034SPablo M. Bermudo Garay /**
1326dfc46034SPablo M. Bermudo Garay * struct nft_object_ops - stateful object operations
1327dfc46034SPablo M. Bermudo Garay *
1328dfc46034SPablo M. Bermudo Garay * @eval: stateful object evaluation function
1329dfc46034SPablo M. Bermudo Garay * @size: stateful object size
1330e5009240SPablo Neira Ayuso * @init: initialize object from netlink attributes
1331e5009240SPablo Neira Ayuso * @destroy: release existing stateful object
1332e5009240SPablo Neira Ayuso * @dump: netlink dump stateful object
1333d62d0ba9SFernando Fernandez Mancera * @update: update stateful object
1334e5009240SPablo Neira Ayuso */
1335dfc46034SPablo M. Bermudo Garay struct nft_object_ops {
1336e5009240SPablo Neira Ayuso void (*eval)(struct nft_object *obj,
1337e5009240SPablo Neira Ayuso struct nft_regs *regs,
1338e5009240SPablo Neira Ayuso const struct nft_pktinfo *pkt);
1339e5009240SPablo Neira Ayuso unsigned int size;
134084fba055SFlorian Westphal int (*init)(const struct nft_ctx *ctx,
134184fba055SFlorian Westphal const struct nlattr *const tb[],
1342e5009240SPablo Neira Ayuso struct nft_object *obj);
134300bfb320SPablo Neira Ayuso void (*destroy)(const struct nft_ctx *ctx,
134400bfb320SPablo Neira Ayuso struct nft_object *obj);
1345e5009240SPablo Neira Ayuso int (*dump)(struct sk_buff *skb,
134643da04a5SPablo Neira Ayuso struct nft_object *obj,
134743da04a5SPablo Neira Ayuso bool reset);
1348d62d0ba9SFernando Fernandez Mancera void (*update)(struct nft_object *obj,
1349d62d0ba9SFernando Fernandez Mancera struct nft_object *newobj);
1350dfc46034SPablo M. Bermudo Garay const struct nft_object_type *type;
1351e5009240SPablo Neira Ayuso };
1352e5009240SPablo Neira Ayuso
1353e5009240SPablo Neira Ayuso int nft_register_obj(struct nft_object_type *obj_type);
1354e5009240SPablo Neira Ayuso void nft_unregister_obj(struct nft_object_type *obj_type);
1355e5009240SPablo Neira Ayuso
1356cb662ac6SPablo Neira Ayuso #define NFT_NETDEVICE_MAX 256
1357d92191aaSPablo Neira Ayuso
1358e5009240SPablo Neira Ayuso /**
13593b49e2e9SPablo Neira Ayuso * struct nft_flowtable - nf_tables flow table
13603b49e2e9SPablo Neira Ayuso *
13613b49e2e9SPablo Neira Ayuso * @list: flow table list node in table list
13623b49e2e9SPablo Neira Ayuso * @table: the table the flow table is contained in
13633b49e2e9SPablo Neira Ayuso * @name: name of this flow table
13643b49e2e9SPablo Neira Ayuso * @hooknum: hook number
13653b49e2e9SPablo Neira Ayuso * @ops_len: number of hooks in array
13663b49e2e9SPablo Neira Ayuso * @genmask: generation mask
13673b49e2e9SPablo Neira Ayuso * @use: number of references to this flow table
13683ecbfd65SHarsha Sharma * @handle: unique object handle
1369d92191aaSPablo Neira Ayuso * @dev_name: array of device names
13703b49e2e9SPablo Neira Ayuso * @data: rhashtable and garbage collector
13713b49e2e9SPablo Neira Ayuso * @ops: array of hooks
13723b49e2e9SPablo Neira Ayuso */
13733b49e2e9SPablo Neira Ayuso struct nft_flowtable {
13743b49e2e9SPablo Neira Ayuso struct list_head list;
13753b49e2e9SPablo Neira Ayuso struct nft_table *table;
13763b49e2e9SPablo Neira Ayuso char *name;
13773b49e2e9SPablo Neira Ayuso int hooknum;
13783b49e2e9SPablo Neira Ayuso int ops_len;
13791689f259SPablo Neira Ayuso u32 genmask:2;
13801689f259SPablo Neira Ayuso u32 use;
13813ecbfd65SHarsha Sharma u64 handle;
13823b49e2e9SPablo Neira Ayuso /* runtime data below here */
13833f0465a9SPablo Neira Ayuso struct list_head hook_list ____cacheline_aligned;
13843b49e2e9SPablo Neira Ayuso struct nf_flowtable data;
13853b49e2e9SPablo Neira Ayuso };
13863b49e2e9SPablo Neira Ayuso
1387cac20fcdSPablo Neira Ayuso struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table,
13883b49e2e9SPablo Neira Ayuso const struct nlattr *nla,
13893b49e2e9SPablo Neira Ayuso u8 genmask);
13903b49e2e9SPablo Neira Ayuso
13919b05b6e1SLaura Garcia Liebana void nf_tables_deactivate_flowtable(const struct nft_ctx *ctx,
13929b05b6e1SLaura Garcia Liebana struct nft_flowtable *flowtable,
13939b05b6e1SLaura Garcia Liebana enum nft_trans_phase phase);
13949b05b6e1SLaura Garcia Liebana
13953b49e2e9SPablo Neira Ayuso void nft_register_flowtable_type(struct nf_flowtable_type *type);
13963b49e2e9SPablo Neira Ayuso void nft_unregister_flowtable_type(struct nf_flowtable_type *type);
13973b49e2e9SPablo Neira Ayuso
13983b49e2e9SPablo Neira Ayuso /**
139933d5a7b1SFlorian Westphal * struct nft_traceinfo - nft tracing information and state
140033d5a7b1SFlorian Westphal *
1401e34b9ed9SFlorian Westphal * @trace: other struct members are initialised
1402e34b9ed9SFlorian Westphal * @nf_trace: copy of skb->nf_trace before rule evaluation
1403e34b9ed9SFlorian Westphal * @type: event type (enum nft_trace_types)
1404e34b9ed9SFlorian Westphal * @skbid: hash of skb to be used as trace id
1405e34b9ed9SFlorian Westphal * @packet_dumped: packet headers sent in a previous traceinfo message
140633d5a7b1SFlorian Westphal * @basechain: base chain currently processed
140733d5a7b1SFlorian Westphal */
140833d5a7b1SFlorian Westphal struct nft_traceinfo {
1409e34b9ed9SFlorian Westphal bool trace;
1410e34b9ed9SFlorian Westphal bool nf_trace;
1411e34b9ed9SFlorian Westphal bool packet_dumped;
1412e34b9ed9SFlorian Westphal enum nft_trace_types type:8;
1413e34b9ed9SFlorian Westphal u32 skbid;
141433d5a7b1SFlorian Westphal const struct nft_base_chain *basechain;
141533d5a7b1SFlorian Westphal };
141633d5a7b1SFlorian Westphal
141733d5a7b1SFlorian Westphal void nft_trace_init(struct nft_traceinfo *info, const struct nft_pktinfo *pkt,
141833d5a7b1SFlorian Westphal const struct nft_chain *basechain);
141933d5a7b1SFlorian Westphal
1420698bb828SFlorian Westphal void nft_trace_notify(const struct nft_pktinfo *pkt,
14210a202145SFlorian Westphal const struct nft_verdict *verdict,
142246df4175SFlorian Westphal const struct nft_rule_dp *rule,
1423698bb828SFlorian Westphal struct nft_traceinfo *info);
142433d5a7b1SFlorian Westphal
14259370761cSPablo Neira Ayuso #define MODULE_ALIAS_NFT_CHAIN(family, name) \
14269370761cSPablo Neira Ayuso MODULE_ALIAS("nft-chain-" __stringify(family) "-" name)
142796518518SPatrick McHardy
142864d46806SPatrick McHardy #define MODULE_ALIAS_NFT_AF_EXPR(family, name) \
142964d46806SPatrick McHardy MODULE_ALIAS("nft-expr-" __stringify(family) "-" name)
143064d46806SPatrick McHardy
143196518518SPatrick McHardy #define MODULE_ALIAS_NFT_EXPR(name) \
143296518518SPatrick McHardy MODULE_ALIAS("nft-expr-" name)
143396518518SPatrick McHardy
1434e5009240SPablo Neira Ayuso #define MODULE_ALIAS_NFT_OBJ(type) \
1435e5009240SPablo Neira Ayuso MODULE_ALIAS("nft-obj-" __stringify(type))
1436e5009240SPablo Neira Ayuso
143747e640afSJeremy Sowden #if IS_ENABLED(CONFIG_NF_TABLES)
143847e640afSJeremy Sowden
1439ea4bd995SPatrick McHardy /*
1440ea4bd995SPatrick McHardy * The gencursor defines two generations, the currently active and the
1441ea4bd995SPatrick McHardy * next one. Objects contain a bitmask of 2 bits specifying the generations
1442ea4bd995SPatrick McHardy * they're active in. A set bit means they're inactive in the generation
1443ea4bd995SPatrick McHardy * represented by that bit.
1444ea4bd995SPatrick McHardy *
1445ea4bd995SPatrick McHardy * New objects start out as inactive in the current and active in the
1446ea4bd995SPatrick McHardy * next generation. When committing the ruleset the bitmask is cleared,
1447ea4bd995SPatrick McHardy * meaning they're active in all generations. When removing an object,
1448ea4bd995SPatrick McHardy * it is set inactive in the next generation. After committing the ruleset,
1449ea4bd995SPatrick McHardy * the objects are removed.
1450ea4bd995SPatrick McHardy */
nft_gencursor_next(const struct net * net)1451ea4bd995SPatrick McHardy static inline unsigned int nft_gencursor_next(const struct net *net)
1452ea4bd995SPatrick McHardy {
1453ea4bd995SPatrick McHardy return net->nft.gencursor + 1 == 1 ? 1 : 0;
1454ea4bd995SPatrick McHardy }
1455ea4bd995SPatrick McHardy
nft_genmask_next(const struct net * net)1456ea4bd995SPatrick McHardy static inline u8 nft_genmask_next(const struct net *net)
1457ea4bd995SPatrick McHardy {
1458ea4bd995SPatrick McHardy return 1 << nft_gencursor_next(net);
1459ea4bd995SPatrick McHardy }
1460ea4bd995SPatrick McHardy
nft_genmask_cur(const struct net * net)1461ea4bd995SPatrick McHardy static inline u8 nft_genmask_cur(const struct net *net)
1462ea4bd995SPatrick McHardy {
146314cd5d4aSMark Rutland /* Use READ_ONCE() to prevent refetching the value for atomicity */
146414cd5d4aSMark Rutland return 1 << READ_ONCE(net->nft.gencursor);
1465ea4bd995SPatrick McHardy }
1466ea4bd995SPatrick McHardy
146722fe54d5SPatrick McHardy #define NFT_GENMASK_ANY ((1 << 0) | (1 << 1))
146822fe54d5SPatrick McHardy
1469cc02e457SPatrick McHardy /*
1470889f7ee7SPablo Neira Ayuso * Generic transaction helpers
1471889f7ee7SPablo Neira Ayuso */
1472889f7ee7SPablo Neira Ayuso
1473889f7ee7SPablo Neira Ayuso /* Check if this object is currently active. */
1474889f7ee7SPablo Neira Ayuso #define nft_is_active(__net, __obj) \
1475889f7ee7SPablo Neira Ayuso (((__obj)->genmask & nft_genmask_cur(__net)) == 0)
1476889f7ee7SPablo Neira Ayuso
1477889f7ee7SPablo Neira Ayuso /* Check if this object is active in the next generation. */
1478889f7ee7SPablo Neira Ayuso #define nft_is_active_next(__net, __obj) \
1479889f7ee7SPablo Neira Ayuso (((__obj)->genmask & nft_genmask_next(__net)) == 0)
1480889f7ee7SPablo Neira Ayuso
1481889f7ee7SPablo Neira Ayuso /* This object becomes active in the next generation. */
1482889f7ee7SPablo Neira Ayuso #define nft_activate_next(__net, __obj) \
1483889f7ee7SPablo Neira Ayuso (__obj)->genmask = nft_genmask_cur(__net)
1484889f7ee7SPablo Neira Ayuso
1485889f7ee7SPablo Neira Ayuso /* This object becomes inactive in the next generation. */
1486889f7ee7SPablo Neira Ayuso #define nft_deactivate_next(__net, __obj) \
1487889f7ee7SPablo Neira Ayuso (__obj)->genmask = nft_genmask_next(__net)
1488889f7ee7SPablo Neira Ayuso
1489889f7ee7SPablo Neira Ayuso /* After committing the ruleset, clear the stale generation bit. */
1490889f7ee7SPablo Neira Ayuso #define nft_clear(__net, __obj) \
1491889f7ee7SPablo Neira Ayuso (__obj)->genmask &= ~nft_genmask_next(__net)
1492f2a6d766SPablo Neira Ayuso #define nft_active_genmask(__obj, __genmask) \
1493f2a6d766SPablo Neira Ayuso !((__obj)->genmask & __genmask)
1494889f7ee7SPablo Neira Ayuso
1495889f7ee7SPablo Neira Ayuso /*
1496cc02e457SPatrick McHardy * Set element transaction helpers
1497cc02e457SPatrick McHardy */
1498cc02e457SPatrick McHardy
nft_set_elem_active(const struct nft_set_ext * ext,u8 genmask)1499cc02e457SPatrick McHardy static inline bool nft_set_elem_active(const struct nft_set_ext *ext,
1500cc02e457SPatrick McHardy u8 genmask)
1501cc02e457SPatrick McHardy {
1502cc02e457SPatrick McHardy return !(ext->genmask & genmask);
1503cc02e457SPatrick McHardy }
1504cc02e457SPatrick McHardy
nft_set_elem_change_active(const struct net * net,const struct nft_set * set,struct nft_set_ext * ext)150542a55769SPablo Neira Ayuso static inline void nft_set_elem_change_active(const struct net *net,
150642a55769SPablo Neira Ayuso const struct nft_set *set,
1507cc02e457SPatrick McHardy struct nft_set_ext *ext)
1508cc02e457SPatrick McHardy {
150942a55769SPablo Neira Ayuso ext->genmask ^= nft_genmask_next(net);
1510cc02e457SPatrick McHardy }
1511cc02e457SPatrick McHardy
151247e640afSJeremy Sowden #endif /* IS_ENABLED(CONFIG_NF_TABLES) */
151347e640afSJeremy Sowden
1514a2dd0233SPablo Neira Ayuso #define NFT_SET_ELEM_DEAD_MASK (1 << 2)
151569086658SPatrick McHardy
151669086658SPatrick McHardy #if defined(__LITTLE_ENDIAN_BITFIELD)
1517a2dd0233SPablo Neira Ayuso #define NFT_SET_ELEM_DEAD_BIT 2
151869086658SPatrick McHardy #elif defined(__BIG_ENDIAN_BITFIELD)
1519a2dd0233SPablo Neira Ayuso #define NFT_SET_ELEM_DEAD_BIT (BITS_PER_LONG - BITS_PER_BYTE + 2)
15205f68718bSPablo Neira Ayuso #else
15215f68718bSPablo Neira Ayuso #error
15225f68718bSPablo Neira Ayuso #endif
15235f68718bSPablo Neira Ayuso
nft_set_elem_dead(struct nft_set_ext * ext)15245f68718bSPablo Neira Ayuso static inline void nft_set_elem_dead(struct nft_set_ext *ext)
15255f68718bSPablo Neira Ayuso {
15265f68718bSPablo Neira Ayuso unsigned long *word = (unsigned long *)ext;
15275f68718bSPablo Neira Ayuso
15285f68718bSPablo Neira Ayuso BUILD_BUG_ON(offsetof(struct nft_set_ext, genmask) != 0);
15295f68718bSPablo Neira Ayuso set_bit(NFT_SET_ELEM_DEAD_BIT, word);
15305f68718bSPablo Neira Ayuso }
15315f68718bSPablo Neira Ayuso
nft_set_elem_is_dead(const struct nft_set_ext * ext)15325f68718bSPablo Neira Ayuso static inline int nft_set_elem_is_dead(const struct nft_set_ext *ext)
15335f68718bSPablo Neira Ayuso {
15345f68718bSPablo Neira Ayuso unsigned long *word = (unsigned long *)ext;
15355f68718bSPablo Neira Ayuso
15365f68718bSPablo Neira Ayuso BUILD_BUG_ON(offsetof(struct nft_set_ext, genmask) != 0);
15375f68718bSPablo Neira Ayuso return test_bit(NFT_SET_ELEM_DEAD_BIT, word);
15385f68718bSPablo Neira Ayuso }
15395f68718bSPablo Neira Ayuso
15401a1e1a12SPatrick McHardy /**
15411a1e1a12SPatrick McHardy * struct nft_trans - nf_tables object update in transaction
15421a1e1a12SPatrick McHardy *
15431a1e1a12SPatrick McHardy * @list: used internally
1544938154b9SPablo Neira Ayuso * @binding_list: list of objects with possible bindings
15451a1e1a12SPatrick McHardy * @msg_type: message type
15460935d558SFlorian Westphal * @put_net: ctx->net needs to be put
15471a1e1a12SPatrick McHardy * @ctx: transaction context
15481a1e1a12SPatrick McHardy * @data: internal information related to the transaction
15491a1e1a12SPatrick McHardy */
15501a1e1a12SPatrick McHardy struct nft_trans {
15511a1e1a12SPatrick McHardy struct list_head list;
1552938154b9SPablo Neira Ayuso struct list_head binding_list;
15531a1e1a12SPatrick McHardy int msg_type;
15540935d558SFlorian Westphal bool put_net;
15551a1e1a12SPatrick McHardy struct nft_ctx ctx;
15566daf1414SGustavo A. R. Silva char data[];
15571a1e1a12SPatrick McHardy };
15581a1e1a12SPatrick McHardy
15591a1e1a12SPatrick McHardy struct nft_trans_rule {
15601a1e1a12SPatrick McHardy struct nft_rule *rule;
1561c9626a2cSPablo Neira Ayuso struct nft_flow_rule *flow;
15621a94e38dSPablo Neira Ayuso u32 rule_id;
15634bedf9eeSPablo Neira Ayuso bool bound;
15641a1e1a12SPatrick McHardy };
15651a1e1a12SPatrick McHardy
15661a1e1a12SPatrick McHardy #define nft_trans_rule(trans) \
15671a1e1a12SPatrick McHardy (((struct nft_trans_rule *)trans->data)->rule)
1568c9626a2cSPablo Neira Ayuso #define nft_trans_flow_rule(trans) \
1569c9626a2cSPablo Neira Ayuso (((struct nft_trans_rule *)trans->data)->flow)
15701a94e38dSPablo Neira Ayuso #define nft_trans_rule_id(trans) \
15711a94e38dSPablo Neira Ayuso (((struct nft_trans_rule *)trans->data)->rule_id)
15724bedf9eeSPablo Neira Ayuso #define nft_trans_rule_bound(trans) \
15734bedf9eeSPablo Neira Ayuso (((struct nft_trans_rule *)trans->data)->bound)
15741a1e1a12SPatrick McHardy
15751a1e1a12SPatrick McHardy struct nft_trans_set {
15761a1e1a12SPatrick McHardy struct nft_set *set;
15771a1e1a12SPatrick McHardy u32 set_id;
1578123b9961SPablo Neira Ayuso u32 gc_int;
1579123b9961SPablo Neira Ayuso u64 timeout;
1580123b9961SPablo Neira Ayuso bool update;
15816a0a8d10SPablo Neira Ayuso bool bound;
158296b2ef9bSFlorian Westphal u32 size;
15831a1e1a12SPatrick McHardy };
15841a1e1a12SPatrick McHardy
15851a1e1a12SPatrick McHardy #define nft_trans_set(trans) \
15861a1e1a12SPatrick McHardy (((struct nft_trans_set *)trans->data)->set)
15871a1e1a12SPatrick McHardy #define nft_trans_set_id(trans) \
15881a1e1a12SPatrick McHardy (((struct nft_trans_set *)trans->data)->set_id)
15896a0a8d10SPablo Neira Ayuso #define nft_trans_set_bound(trans) \
15906a0a8d10SPablo Neira Ayuso (((struct nft_trans_set *)trans->data)->bound)
1591123b9961SPablo Neira Ayuso #define nft_trans_set_update(trans) \
1592123b9961SPablo Neira Ayuso (((struct nft_trans_set *)trans->data)->update)
1593123b9961SPablo Neira Ayuso #define nft_trans_set_timeout(trans) \
1594123b9961SPablo Neira Ayuso (((struct nft_trans_set *)trans->data)->timeout)
1595123b9961SPablo Neira Ayuso #define nft_trans_set_gc_int(trans) \
1596123b9961SPablo Neira Ayuso (((struct nft_trans_set *)trans->data)->gc_int)
159796b2ef9bSFlorian Westphal #define nft_trans_set_size(trans) \
159896b2ef9bSFlorian Westphal (((struct nft_trans_set *)trans->data)->size)
15991a1e1a12SPatrick McHardy
16001a1e1a12SPatrick McHardy struct nft_trans_chain {
16014bedf9eeSPablo Neira Ayuso struct nft_chain *chain;
16021a1e1a12SPatrick McHardy bool update;
1603b7263e07SPhil Sutter char *name;
16041a1e1a12SPatrick McHardy struct nft_stats __percpu *stats;
16051a1e1a12SPatrick McHardy u8 policy;
16064bedf9eeSPablo Neira Ayuso bool bound;
160774cccc3dSPablo Neira Ayuso u32 chain_id;
1608b9703ed4SPablo Neira Ayuso struct nft_base_chain *basechain;
1609b9703ed4SPablo Neira Ayuso struct list_head hook_list;
16101a1e1a12SPatrick McHardy };
16111a1e1a12SPatrick McHardy
16124bedf9eeSPablo Neira Ayuso #define nft_trans_chain(trans) \
16134bedf9eeSPablo Neira Ayuso (((struct nft_trans_chain *)trans->data)->chain)
16141a1e1a12SPatrick McHardy #define nft_trans_chain_update(trans) \
16151a1e1a12SPatrick McHardy (((struct nft_trans_chain *)trans->data)->update)
16161a1e1a12SPatrick McHardy #define nft_trans_chain_name(trans) \
16171a1e1a12SPatrick McHardy (((struct nft_trans_chain *)trans->data)->name)
16181a1e1a12SPatrick McHardy #define nft_trans_chain_stats(trans) \
16191a1e1a12SPatrick McHardy (((struct nft_trans_chain *)trans->data)->stats)
16201a1e1a12SPatrick McHardy #define nft_trans_chain_policy(trans) \
16211a1e1a12SPatrick McHardy (((struct nft_trans_chain *)trans->data)->policy)
16224bedf9eeSPablo Neira Ayuso #define nft_trans_chain_bound(trans) \
16234bedf9eeSPablo Neira Ayuso (((struct nft_trans_chain *)trans->data)->bound)
162474cccc3dSPablo Neira Ayuso #define nft_trans_chain_id(trans) \
162574cccc3dSPablo Neira Ayuso (((struct nft_trans_chain *)trans->data)->chain_id)
1626b9703ed4SPablo Neira Ayuso #define nft_trans_basechain(trans) \
1627b9703ed4SPablo Neira Ayuso (((struct nft_trans_chain *)trans->data)->basechain)
1628b9703ed4SPablo Neira Ayuso #define nft_trans_chain_hooks(trans) \
1629b9703ed4SPablo Neira Ayuso (((struct nft_trans_chain *)trans->data)->hook_list)
16301a1e1a12SPatrick McHardy
16311a1e1a12SPatrick McHardy struct nft_trans_table {
16321a1e1a12SPatrick McHardy bool update;
16331a1e1a12SPatrick McHardy };
16341a1e1a12SPatrick McHardy
16351a1e1a12SPatrick McHardy #define nft_trans_table_update(trans) \
16361a1e1a12SPatrick McHardy (((struct nft_trans_table *)trans->data)->update)
16371a1e1a12SPatrick McHardy
16381a1e1a12SPatrick McHardy struct nft_trans_elem {
16391a1e1a12SPatrick McHardy struct nft_set *set;
16401a1e1a12SPatrick McHardy struct nft_set_elem elem;
16416a0a8d10SPablo Neira Ayuso bool bound;
16421a1e1a12SPatrick McHardy };
16431a1e1a12SPatrick McHardy
16441a1e1a12SPatrick McHardy #define nft_trans_elem_set(trans) \
16451a1e1a12SPatrick McHardy (((struct nft_trans_elem *)trans->data)->set)
16461a1e1a12SPatrick McHardy #define nft_trans_elem(trans) \
16471a1e1a12SPatrick McHardy (((struct nft_trans_elem *)trans->data)->elem)
16486a0a8d10SPablo Neira Ayuso #define nft_trans_elem_set_bound(trans) \
16496a0a8d10SPablo Neira Ayuso (((struct nft_trans_elem *)trans->data)->bound)
16501a1e1a12SPatrick McHardy
1651e5009240SPablo Neira Ayuso struct nft_trans_obj {
1652e5009240SPablo Neira Ayuso struct nft_object *obj;
1653d62d0ba9SFernando Fernandez Mancera struct nft_object *newobj;
1654d62d0ba9SFernando Fernandez Mancera bool update;
1655e5009240SPablo Neira Ayuso };
1656e5009240SPablo Neira Ayuso
1657e5009240SPablo Neira Ayuso #define nft_trans_obj(trans) \
1658e5009240SPablo Neira Ayuso (((struct nft_trans_obj *)trans->data)->obj)
1659d62d0ba9SFernando Fernandez Mancera #define nft_trans_obj_newobj(trans) \
1660d62d0ba9SFernando Fernandez Mancera (((struct nft_trans_obj *)trans->data)->newobj)
1661d62d0ba9SFernando Fernandez Mancera #define nft_trans_obj_update(trans) \
1662d62d0ba9SFernando Fernandez Mancera (((struct nft_trans_obj *)trans->data)->update)
1663e5009240SPablo Neira Ayuso
16643b49e2e9SPablo Neira Ayuso struct nft_trans_flowtable {
16653b49e2e9SPablo Neira Ayuso struct nft_flowtable *flowtable;
166678d9f48fSPablo Neira Ayuso bool update;
166778d9f48fSPablo Neira Ayuso struct list_head hook_list;
16687b35582cSPablo Neira Ayuso u32 flags;
16693b49e2e9SPablo Neira Ayuso };
16703b49e2e9SPablo Neira Ayuso
16713b49e2e9SPablo Neira Ayuso #define nft_trans_flowtable(trans) \
16723b49e2e9SPablo Neira Ayuso (((struct nft_trans_flowtable *)trans->data)->flowtable)
167378d9f48fSPablo Neira Ayuso #define nft_trans_flowtable_update(trans) \
167478d9f48fSPablo Neira Ayuso (((struct nft_trans_flowtable *)trans->data)->update)
167578d9f48fSPablo Neira Ayuso #define nft_trans_flowtable_hooks(trans) \
167678d9f48fSPablo Neira Ayuso (((struct nft_trans_flowtable *)trans->data)->hook_list)
16777b35582cSPablo Neira Ayuso #define nft_trans_flowtable_flags(trans) \
16787b35582cSPablo Neira Ayuso (((struct nft_trans_flowtable *)trans->data)->flags)
16793b49e2e9SPablo Neira Ayuso
16805f68718bSPablo Neira Ayuso #define NFT_TRANS_GC_BATCHCOUNT 256
16815f68718bSPablo Neira Ayuso
16825f68718bSPablo Neira Ayuso struct nft_trans_gc {
16835f68718bSPablo Neira Ayuso struct list_head list;
16845f68718bSPablo Neira Ayuso struct net *net;
16855f68718bSPablo Neira Ayuso struct nft_set *set;
16865f68718bSPablo Neira Ayuso u32 seq;
1687cf5000a7SFlorian Westphal u16 count;
16885f68718bSPablo Neira Ayuso void *priv[NFT_TRANS_GC_BATCHCOUNT];
16895f68718bSPablo Neira Ayuso struct rcu_head rcu;
16905f68718bSPablo Neira Ayuso };
16915f68718bSPablo Neira Ayuso
16925f68718bSPablo Neira Ayuso struct nft_trans_gc *nft_trans_gc_alloc(struct nft_set *set,
16935f68718bSPablo Neira Ayuso unsigned int gc_seq, gfp_t gfp);
16945f68718bSPablo Neira Ayuso void nft_trans_gc_destroy(struct nft_trans_gc *trans);
16955f68718bSPablo Neira Ayuso
16965f68718bSPablo Neira Ayuso struct nft_trans_gc *nft_trans_gc_queue_async(struct nft_trans_gc *gc,
16975f68718bSPablo Neira Ayuso unsigned int gc_seq, gfp_t gfp);
16985f68718bSPablo Neira Ayuso void nft_trans_gc_queue_async_done(struct nft_trans_gc *gc);
16995f68718bSPablo Neira Ayuso
17005f68718bSPablo Neira Ayuso struct nft_trans_gc *nft_trans_gc_queue_sync(struct nft_trans_gc *gc, gfp_t gfp);
17015f68718bSPablo Neira Ayuso void nft_trans_gc_queue_sync_done(struct nft_trans_gc *trans);
17025f68718bSPablo Neira Ayuso
17035f68718bSPablo Neira Ayuso void nft_trans_gc_elem_add(struct nft_trans_gc *gc, void *priv);
17045f68718bSPablo Neira Ayuso
17054a9e12eaSPablo Neira Ayuso struct nft_trans_gc *nft_trans_gc_catchall_async(struct nft_trans_gc *gc,
17065f68718bSPablo Neira Ayuso unsigned int gc_seq);
17074a9e12eaSPablo Neira Ayuso struct nft_trans_gc *nft_trans_gc_catchall_sync(struct nft_trans_gc *gc);
17085f68718bSPablo Neira Ayuso
17095f68718bSPablo Neira Ayuso void nft_setelem_data_deactivate(const struct net *net,
17105f68718bSPablo Neira Ayuso const struct nft_set *set,
17115f68718bSPablo Neira Ayuso struct nft_set_elem *elem);
17125f68718bSPablo Neira Ayuso
171302c7b25eSPablo Neira Ayuso int __init nft_chain_filter_init(void);
1714d209df3eSFlorian Westphal void nft_chain_filter_fini(void);
171502c7b25eSPablo Neira Ayuso
1716c1deb065SFlorian Westphal void __init nft_chain_route_init(void);
1717c1deb065SFlorian Westphal void nft_chain_route_fini(void);
1718ffe8923fSFlorian Westphal
1719ffe8923fSFlorian Westphal void nf_tables_trans_destroy_flush_work(void);
1720917d80d3SPablo Neira Ayuso
1721917d80d3SPablo Neira Ayuso int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result);
1722917d80d3SPablo Neira Ayuso __be64 nf_jiffies64_to_msecs(u64 input);
1723917d80d3SPablo Neira Ayuso
1724cefa31a9SFlorian Westphal #ifdef CONFIG_MODULES
1725cefa31a9SFlorian Westphal __printf(2, 3) int nft_request_module(struct net *net, const char *fmt, ...);
1726cefa31a9SFlorian Westphal #else
nft_request_module(struct net * net,const char * fmt,...)1727cefa31a9SFlorian Westphal static inline int nft_request_module(struct net *net, const char *fmt, ...) { return -ENOENT; }
1728cefa31a9SFlorian Westphal #endif
17290854db2aSFlorian Westphal
17300854db2aSFlorian Westphal struct nftables_pernet {
17310854db2aSFlorian Westphal struct list_head tables;
17320854db2aSFlorian Westphal struct list_head commit_list;
1733938154b9SPablo Neira Ayuso struct list_head binding_list;
17340854db2aSFlorian Westphal struct list_head module_list;
17350854db2aSFlorian Westphal struct list_head notify_list;
17360854db2aSFlorian Westphal struct mutex commit_mutex;
1737ab482c6bSPablo Neira Ayuso u64 table_handle;
17380854db2aSFlorian Westphal unsigned int base_seq;
17395f68718bSPablo Neira Ayuso unsigned int gc_seq;
17404b80ced9SFlorian Westphal u8 validate_state;
17410854db2aSFlorian Westphal };
17420854db2aSFlorian Westphal
1743d59d2f82SPablo Neira Ayuso extern unsigned int nf_tables_net_id;
1744d59d2f82SPablo Neira Ayuso
nft_pernet(const struct net * net)1745d59d2f82SPablo Neira Ayuso static inline struct nftables_pernet *nft_pernet(const struct net *net)
1746d59d2f82SPablo Neira Ayuso {
1747d59d2f82SPablo Neira Ayuso return net_generic(net, nf_tables_net_id);
1748d59d2f82SPablo Neira Ayuso }
1749d59d2f82SPablo Neira Ayuso
1750b2d30654SPablo Neira Ayuso #define __NFT_REDUCE_READONLY 1UL
1751b2d30654SPablo Neira Ayuso #define NFT_REDUCE_READONLY (void *)__NFT_REDUCE_READONLY
1752b2d30654SPablo Neira Ayuso
nft_reduce_is_readonly(const struct nft_expr * expr)1753b2d30654SPablo Neira Ayuso static inline bool nft_reduce_is_readonly(const struct nft_expr *expr)
1754b2d30654SPablo Neira Ayuso {
1755b2d30654SPablo Neira Ayuso return expr->ops->reduce == NFT_REDUCE_READONLY;
1756b2d30654SPablo Neira Ayuso }
1757b2d30654SPablo Neira Ayuso
175834cc9e52SPablo Neira Ayuso void nft_reg_track_update(struct nft_regs_track *track,
175934cc9e52SPablo Neira Ayuso const struct nft_expr *expr, u8 dreg, u8 len);
176034cc9e52SPablo Neira Ayuso void nft_reg_track_cancel(struct nft_regs_track *track, u8 dreg, u8 len);
176134cc9e52SPablo Neira Ayuso void __nft_reg_track_cancel(struct nft_regs_track *track, u8 dreg);
176234cc9e52SPablo Neira Ayuso
nft_reg_track_cmp(struct nft_regs_track * track,const struct nft_expr * expr,u8 dreg)176334cc9e52SPablo Neira Ayuso static inline bool nft_reg_track_cmp(struct nft_regs_track *track,
176434cc9e52SPablo Neira Ayuso const struct nft_expr *expr, u8 dreg)
176534cc9e52SPablo Neira Ayuso {
176634cc9e52SPablo Neira Ayuso return track->regs[dreg].selector &&
176734cc9e52SPablo Neira Ayuso track->regs[dreg].selector->ops == expr->ops &&
176834cc9e52SPablo Neira Ayuso track->regs[dreg].num_reg == 0;
176934cc9e52SPablo Neira Ayuso }
177034cc9e52SPablo Neira Ayuso
177196518518SPatrick McHardy #endif /* _NET_NF_TABLES_H */
1772