1 #ifndef _NET_NF_TABLES_H 2 #define _NET_NF_TABLES_H 3 4 #include <linux/module.h> 5 #include <linux/list.h> 6 #include <linux/netfilter.h> 7 #include <linux/netfilter/nfnetlink.h> 8 #include <linux/netfilter/x_tables.h> 9 #include <linux/netfilter/nf_tables.h> 10 #include <linux/u64_stats_sync.h> 11 #include <net/netlink.h> 12 13 #define NFT_JUMP_STACK_SIZE 16 14 15 struct nft_pktinfo { 16 struct sk_buff *skb; 17 struct net *net; 18 const struct net_device *in; 19 const struct net_device *out; 20 u8 pf; 21 u8 hook; 22 u8 tprot; 23 /* for x_tables compatibility */ 24 struct xt_action_param xt; 25 }; 26 27 static inline void nft_set_pktinfo(struct nft_pktinfo *pkt, 28 struct sk_buff *skb, 29 const struct nf_hook_state *state) 30 { 31 pkt->skb = skb; 32 pkt->net = pkt->xt.net = state->net; 33 pkt->in = pkt->xt.in = state->in; 34 pkt->out = pkt->xt.out = state->out; 35 pkt->hook = pkt->xt.hooknum = state->hook; 36 pkt->pf = pkt->xt.family = state->pf; 37 } 38 39 /** 40 * struct nft_verdict - nf_tables verdict 41 * 42 * @code: nf_tables/netfilter verdict code 43 * @chain: destination chain for NFT_JUMP/NFT_GOTO 44 */ 45 struct nft_verdict { 46 u32 code; 47 struct nft_chain *chain; 48 }; 49 50 struct nft_data { 51 union { 52 u32 data[4]; 53 struct nft_verdict verdict; 54 }; 55 } __attribute__((aligned(__alignof__(u64)))); 56 57 /** 58 * struct nft_regs - nf_tables register set 59 * 60 * @data: data registers 61 * @verdict: verdict register 62 * 63 * The first four data registers alias to the verdict register. 64 */ 65 struct nft_regs { 66 union { 67 u32 data[20]; 68 struct nft_verdict verdict; 69 }; 70 }; 71 72 static inline void nft_data_copy(u32 *dst, const struct nft_data *src, 73 unsigned int len) 74 { 75 memcpy(dst, src, len); 76 } 77 78 static inline void nft_data_debug(const struct nft_data *data) 79 { 80 pr_debug("data[0]=%x data[1]=%x data[2]=%x data[3]=%x\n", 81 data->data[0], data->data[1], 82 data->data[2], data->data[3]); 83 } 84 85 /** 86 * struct nft_ctx - nf_tables rule/set context 87 * 88 * @net: net namespace 89 * @afi: address family info 90 * @table: the table the chain is contained in 91 * @chain: the chain the rule is contained in 92 * @nla: netlink attributes 93 * @portid: netlink portID of the original message 94 * @seq: netlink sequence number 95 * @report: notify via unicast netlink message 96 */ 97 struct nft_ctx { 98 struct net *net; 99 struct nft_af_info *afi; 100 struct nft_table *table; 101 struct nft_chain *chain; 102 const struct nlattr * const *nla; 103 u32 portid; 104 u32 seq; 105 bool report; 106 }; 107 108 struct nft_data_desc { 109 enum nft_data_types type; 110 unsigned int len; 111 }; 112 113 int nft_data_init(const struct nft_ctx *ctx, 114 struct nft_data *data, unsigned int size, 115 struct nft_data_desc *desc, const struct nlattr *nla); 116 void nft_data_uninit(const struct nft_data *data, enum nft_data_types type); 117 int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data, 118 enum nft_data_types type, unsigned int len); 119 120 static inline enum nft_data_types nft_dreg_to_type(enum nft_registers reg) 121 { 122 return reg == NFT_REG_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE; 123 } 124 125 static inline enum nft_registers nft_type_to_reg(enum nft_data_types type) 126 { 127 return type == NFT_DATA_VERDICT ? NFT_REG_VERDICT : NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE; 128 } 129 130 unsigned int nft_parse_register(const struct nlattr *attr); 131 int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg); 132 133 int nft_validate_register_load(enum nft_registers reg, unsigned int len); 134 int nft_validate_register_store(const struct nft_ctx *ctx, 135 enum nft_registers reg, 136 const struct nft_data *data, 137 enum nft_data_types type, unsigned int len); 138 139 /** 140 * struct nft_userdata - user defined data associated with an object 141 * 142 * @len: length of the data 143 * @data: content 144 * 145 * The presence of user data is indicated in an object specific fashion, 146 * so a length of zero can't occur and the value "len" indicates data 147 * of length len + 1. 148 */ 149 struct nft_userdata { 150 u8 len; 151 unsigned char data[0]; 152 }; 153 154 /** 155 * struct nft_set_elem - generic representation of set elements 156 * 157 * @key: element key 158 * @priv: element private data and extensions 159 */ 160 struct nft_set_elem { 161 union { 162 u32 buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)]; 163 struct nft_data val; 164 } key; 165 void *priv; 166 }; 167 168 struct nft_set; 169 struct nft_set_iter { 170 u8 genmask; 171 unsigned int count; 172 unsigned int skip; 173 int err; 174 int (*fn)(const struct nft_ctx *ctx, 175 const struct nft_set *set, 176 const struct nft_set_iter *iter, 177 const struct nft_set_elem *elem); 178 }; 179 180 /** 181 * struct nft_set_desc - description of set elements 182 * 183 * @klen: key length 184 * @dlen: data length 185 * @size: number of set elements 186 */ 187 struct nft_set_desc { 188 unsigned int klen; 189 unsigned int dlen; 190 unsigned int size; 191 }; 192 193 /** 194 * enum nft_set_class - performance class 195 * 196 * @NFT_LOOKUP_O_1: constant, O(1) 197 * @NFT_LOOKUP_O_LOG_N: logarithmic, O(log N) 198 * @NFT_LOOKUP_O_N: linear, O(N) 199 */ 200 enum nft_set_class { 201 NFT_SET_CLASS_O_1, 202 NFT_SET_CLASS_O_LOG_N, 203 NFT_SET_CLASS_O_N, 204 }; 205 206 /** 207 * struct nft_set_estimate - estimation of memory and performance 208 * characteristics 209 * 210 * @size: required memory 211 * @class: lookup performance class 212 */ 213 struct nft_set_estimate { 214 unsigned int size; 215 enum nft_set_class class; 216 }; 217 218 struct nft_set_ext; 219 struct nft_expr; 220 221 /** 222 * struct nft_set_ops - nf_tables set operations 223 * 224 * @lookup: look up an element within the set 225 * @insert: insert new element into set 226 * @activate: activate new element in the next generation 227 * @deactivate: deactivate element in the next generation 228 * @remove: remove element from set 229 * @walk: iterate over all set elemeennts 230 * @privsize: function to return size of set private data 231 * @init: initialize private data of new set instance 232 * @destroy: destroy private data of set instance 233 * @list: nf_tables_set_ops list node 234 * @owner: module reference 235 * @elemsize: element private size 236 * @features: features supported by the implementation 237 */ 238 struct nft_set_ops { 239 bool (*lookup)(const struct nft_set *set, 240 const u32 *key, 241 const struct nft_set_ext **ext); 242 bool (*update)(struct nft_set *set, 243 const u32 *key, 244 void *(*new)(struct nft_set *, 245 const struct nft_expr *, 246 struct nft_regs *), 247 const struct nft_expr *expr, 248 struct nft_regs *regs, 249 const struct nft_set_ext **ext); 250 251 int (*insert)(const struct nft_set *set, 252 const struct nft_set_elem *elem); 253 void (*activate)(const struct nft_set *set, 254 const struct nft_set_elem *elem); 255 void * (*deactivate)(const struct nft_set *set, 256 const struct nft_set_elem *elem); 257 void (*remove)(const struct nft_set *set, 258 const struct nft_set_elem *elem); 259 void (*walk)(const struct nft_ctx *ctx, 260 const struct nft_set *set, 261 struct nft_set_iter *iter); 262 263 unsigned int (*privsize)(const struct nlattr * const nla[]); 264 bool (*estimate)(const struct nft_set_desc *desc, 265 u32 features, 266 struct nft_set_estimate *est); 267 int (*init)(const struct nft_set *set, 268 const struct nft_set_desc *desc, 269 const struct nlattr * const nla[]); 270 void (*destroy)(const struct nft_set *set); 271 272 struct list_head list; 273 struct module *owner; 274 unsigned int elemsize; 275 u32 features; 276 }; 277 278 int nft_register_set(struct nft_set_ops *ops); 279 void nft_unregister_set(struct nft_set_ops *ops); 280 281 /** 282 * struct nft_set - nf_tables set instance 283 * 284 * @list: table set list node 285 * @bindings: list of set bindings 286 * @name: name of the set 287 * @ktype: key type (numeric type defined by userspace, not used in the kernel) 288 * @dtype: data type (verdict or numeric type defined by userspace) 289 * @size: maximum set size 290 * @nelems: number of elements 291 * @ndeact: number of deactivated elements queued for removal 292 * @timeout: default timeout value in msecs 293 * @gc_int: garbage collection interval in msecs 294 * @policy: set parameterization (see enum nft_set_policies) 295 * @udlen: user data length 296 * @udata: user data 297 * @ops: set ops 298 * @pnet: network namespace 299 * @flags: set flags 300 * @klen: key length 301 * @dlen: data length 302 * @data: private set data 303 */ 304 struct nft_set { 305 struct list_head list; 306 struct list_head bindings; 307 char name[NFT_SET_MAXNAMELEN]; 308 u32 ktype; 309 u32 dtype; 310 u32 size; 311 atomic_t nelems; 312 u32 ndeact; 313 u64 timeout; 314 u32 gc_int; 315 u16 policy; 316 u16 udlen; 317 unsigned char *udata; 318 /* runtime data below here */ 319 const struct nft_set_ops *ops ____cacheline_aligned; 320 possible_net_t pnet; 321 u16 flags; 322 u8 klen; 323 u8 dlen; 324 unsigned char data[] 325 __attribute__((aligned(__alignof__(u64)))); 326 }; 327 328 static inline void *nft_set_priv(const struct nft_set *set) 329 { 330 return (void *)set->data; 331 } 332 333 static inline struct nft_set *nft_set_container_of(const void *priv) 334 { 335 return (void *)priv - offsetof(struct nft_set, data); 336 } 337 338 struct nft_set *nf_tables_set_lookup(const struct nft_table *table, 339 const struct nlattr *nla); 340 struct nft_set *nf_tables_set_lookup_byid(const struct net *net, 341 const struct nlattr *nla); 342 343 static inline unsigned long nft_set_gc_interval(const struct nft_set *set) 344 { 345 return set->gc_int ? msecs_to_jiffies(set->gc_int) : HZ; 346 } 347 348 /** 349 * struct nft_set_binding - nf_tables set binding 350 * 351 * @list: set bindings list node 352 * @chain: chain containing the rule bound to the set 353 * @flags: set action flags 354 * 355 * A set binding contains all information necessary for validation 356 * of new elements added to a bound set. 357 */ 358 struct nft_set_binding { 359 struct list_head list; 360 const struct nft_chain *chain; 361 u32 flags; 362 }; 363 364 int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set, 365 struct nft_set_binding *binding); 366 void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set, 367 struct nft_set_binding *binding); 368 369 /** 370 * enum nft_set_extensions - set extension type IDs 371 * 372 * @NFT_SET_EXT_KEY: element key 373 * @NFT_SET_EXT_DATA: mapping data 374 * @NFT_SET_EXT_FLAGS: element flags 375 * @NFT_SET_EXT_TIMEOUT: element timeout 376 * @NFT_SET_EXT_EXPIRATION: element expiration time 377 * @NFT_SET_EXT_USERDATA: user data associated with the element 378 * @NFT_SET_EXT_EXPR: expression assiociated with the element 379 * @NFT_SET_EXT_NUM: number of extension types 380 */ 381 enum nft_set_extensions { 382 NFT_SET_EXT_KEY, 383 NFT_SET_EXT_DATA, 384 NFT_SET_EXT_FLAGS, 385 NFT_SET_EXT_TIMEOUT, 386 NFT_SET_EXT_EXPIRATION, 387 NFT_SET_EXT_USERDATA, 388 NFT_SET_EXT_EXPR, 389 NFT_SET_EXT_NUM 390 }; 391 392 /** 393 * struct nft_set_ext_type - set extension type 394 * 395 * @len: fixed part length of the extension 396 * @align: alignment requirements of the extension 397 */ 398 struct nft_set_ext_type { 399 u8 len; 400 u8 align; 401 }; 402 403 extern const struct nft_set_ext_type nft_set_ext_types[]; 404 405 /** 406 * struct nft_set_ext_tmpl - set extension template 407 * 408 * @len: length of extension area 409 * @offset: offsets of individual extension types 410 */ 411 struct nft_set_ext_tmpl { 412 u16 len; 413 u8 offset[NFT_SET_EXT_NUM]; 414 }; 415 416 /** 417 * struct nft_set_ext - set extensions 418 * 419 * @genmask: generation mask 420 * @offset: offsets of individual extension types 421 * @data: beginning of extension data 422 */ 423 struct nft_set_ext { 424 u8 genmask; 425 u8 offset[NFT_SET_EXT_NUM]; 426 char data[0]; 427 }; 428 429 static inline void nft_set_ext_prepare(struct nft_set_ext_tmpl *tmpl) 430 { 431 memset(tmpl, 0, sizeof(*tmpl)); 432 tmpl->len = sizeof(struct nft_set_ext); 433 } 434 435 static inline void nft_set_ext_add_length(struct nft_set_ext_tmpl *tmpl, u8 id, 436 unsigned int len) 437 { 438 tmpl->len = ALIGN(tmpl->len, nft_set_ext_types[id].align); 439 BUG_ON(tmpl->len > U8_MAX); 440 tmpl->offset[id] = tmpl->len; 441 tmpl->len += nft_set_ext_types[id].len + len; 442 } 443 444 static inline void nft_set_ext_add(struct nft_set_ext_tmpl *tmpl, u8 id) 445 { 446 nft_set_ext_add_length(tmpl, id, 0); 447 } 448 449 static inline void nft_set_ext_init(struct nft_set_ext *ext, 450 const struct nft_set_ext_tmpl *tmpl) 451 { 452 memcpy(ext->offset, tmpl->offset, sizeof(ext->offset)); 453 } 454 455 static inline bool __nft_set_ext_exists(const struct nft_set_ext *ext, u8 id) 456 { 457 return !!ext->offset[id]; 458 } 459 460 static inline bool nft_set_ext_exists(const struct nft_set_ext *ext, u8 id) 461 { 462 return ext && __nft_set_ext_exists(ext, id); 463 } 464 465 static inline void *nft_set_ext(const struct nft_set_ext *ext, u8 id) 466 { 467 return (void *)ext + ext->offset[id]; 468 } 469 470 static inline struct nft_data *nft_set_ext_key(const struct nft_set_ext *ext) 471 { 472 return nft_set_ext(ext, NFT_SET_EXT_KEY); 473 } 474 475 static inline struct nft_data *nft_set_ext_data(const struct nft_set_ext *ext) 476 { 477 return nft_set_ext(ext, NFT_SET_EXT_DATA); 478 } 479 480 static inline u8 *nft_set_ext_flags(const struct nft_set_ext *ext) 481 { 482 return nft_set_ext(ext, NFT_SET_EXT_FLAGS); 483 } 484 485 static inline u64 *nft_set_ext_timeout(const struct nft_set_ext *ext) 486 { 487 return nft_set_ext(ext, NFT_SET_EXT_TIMEOUT); 488 } 489 490 static inline unsigned long *nft_set_ext_expiration(const struct nft_set_ext *ext) 491 { 492 return nft_set_ext(ext, NFT_SET_EXT_EXPIRATION); 493 } 494 495 static inline struct nft_userdata *nft_set_ext_userdata(const struct nft_set_ext *ext) 496 { 497 return nft_set_ext(ext, NFT_SET_EXT_USERDATA); 498 } 499 500 static inline struct nft_expr *nft_set_ext_expr(const struct nft_set_ext *ext) 501 { 502 return nft_set_ext(ext, NFT_SET_EXT_EXPR); 503 } 504 505 static inline bool nft_set_elem_expired(const struct nft_set_ext *ext) 506 { 507 return nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION) && 508 time_is_before_eq_jiffies(*nft_set_ext_expiration(ext)); 509 } 510 511 static inline struct nft_set_ext *nft_set_elem_ext(const struct nft_set *set, 512 void *elem) 513 { 514 return elem + set->ops->elemsize; 515 } 516 517 void *nft_set_elem_init(const struct nft_set *set, 518 const struct nft_set_ext_tmpl *tmpl, 519 const u32 *key, const u32 *data, 520 u64 timeout, gfp_t gfp); 521 void nft_set_elem_destroy(const struct nft_set *set, void *elem); 522 523 /** 524 * struct nft_set_gc_batch_head - nf_tables set garbage collection batch 525 * 526 * @rcu: rcu head 527 * @set: set the elements belong to 528 * @cnt: count of elements 529 */ 530 struct nft_set_gc_batch_head { 531 struct rcu_head rcu; 532 const struct nft_set *set; 533 unsigned int cnt; 534 }; 535 536 #define NFT_SET_GC_BATCH_SIZE ((PAGE_SIZE - \ 537 sizeof(struct nft_set_gc_batch_head)) / \ 538 sizeof(void *)) 539 540 /** 541 * struct nft_set_gc_batch - nf_tables set garbage collection batch 542 * 543 * @head: GC batch head 544 * @elems: garbage collection elements 545 */ 546 struct nft_set_gc_batch { 547 struct nft_set_gc_batch_head head; 548 void *elems[NFT_SET_GC_BATCH_SIZE]; 549 }; 550 551 struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set, 552 gfp_t gfp); 553 void nft_set_gc_batch_release(struct rcu_head *rcu); 554 555 static inline void nft_set_gc_batch_complete(struct nft_set_gc_batch *gcb) 556 { 557 if (gcb != NULL) 558 call_rcu(&gcb->head.rcu, nft_set_gc_batch_release); 559 } 560 561 static inline struct nft_set_gc_batch * 562 nft_set_gc_batch_check(const struct nft_set *set, struct nft_set_gc_batch *gcb, 563 gfp_t gfp) 564 { 565 if (gcb != NULL) { 566 if (gcb->head.cnt + 1 < ARRAY_SIZE(gcb->elems)) 567 return gcb; 568 nft_set_gc_batch_complete(gcb); 569 } 570 return nft_set_gc_batch_alloc(set, gfp); 571 } 572 573 static inline void nft_set_gc_batch_add(struct nft_set_gc_batch *gcb, 574 void *elem) 575 { 576 gcb->elems[gcb->head.cnt++] = elem; 577 } 578 579 /** 580 * struct nft_expr_type - nf_tables expression type 581 * 582 * @select_ops: function to select nft_expr_ops 583 * @ops: default ops, used when no select_ops functions is present 584 * @list: used internally 585 * @name: Identifier 586 * @owner: module reference 587 * @policy: netlink attribute policy 588 * @maxattr: highest netlink attribute number 589 * @family: address family for AF-specific types 590 * @flags: expression type flags 591 */ 592 struct nft_expr_type { 593 const struct nft_expr_ops *(*select_ops)(const struct nft_ctx *, 594 const struct nlattr * const tb[]); 595 const struct nft_expr_ops *ops; 596 struct list_head list; 597 const char *name; 598 struct module *owner; 599 const struct nla_policy *policy; 600 unsigned int maxattr; 601 u8 family; 602 u8 flags; 603 }; 604 605 #define NFT_EXPR_STATEFUL 0x1 606 607 /** 608 * struct nft_expr_ops - nf_tables expression operations 609 * 610 * @eval: Expression evaluation function 611 * @size: full expression size, including private data size 612 * @init: initialization function 613 * @destroy: destruction function 614 * @dump: function to dump parameters 615 * @type: expression type 616 * @validate: validate expression, called during loop detection 617 * @data: extra data to attach to this expression operation 618 */ 619 struct nft_expr; 620 struct nft_expr_ops { 621 void (*eval)(const struct nft_expr *expr, 622 struct nft_regs *regs, 623 const struct nft_pktinfo *pkt); 624 int (*clone)(struct nft_expr *dst, 625 const struct nft_expr *src); 626 unsigned int size; 627 628 int (*init)(const struct nft_ctx *ctx, 629 const struct nft_expr *expr, 630 const struct nlattr * const tb[]); 631 void (*destroy)(const struct nft_ctx *ctx, 632 const struct nft_expr *expr); 633 int (*dump)(struct sk_buff *skb, 634 const struct nft_expr *expr); 635 int (*validate)(const struct nft_ctx *ctx, 636 const struct nft_expr *expr, 637 const struct nft_data **data); 638 const struct nft_expr_type *type; 639 void *data; 640 }; 641 642 #define NFT_EXPR_MAXATTR 16 643 #define NFT_EXPR_SIZE(size) (sizeof(struct nft_expr) + \ 644 ALIGN(size, __alignof__(struct nft_expr))) 645 646 /** 647 * struct nft_expr - nf_tables expression 648 * 649 * @ops: expression ops 650 * @data: expression private data 651 */ 652 struct nft_expr { 653 const struct nft_expr_ops *ops; 654 unsigned char data[]; 655 }; 656 657 static inline void *nft_expr_priv(const struct nft_expr *expr) 658 { 659 return (void *)expr->data; 660 } 661 662 struct nft_expr *nft_expr_init(const struct nft_ctx *ctx, 663 const struct nlattr *nla); 664 void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr); 665 int nft_expr_dump(struct sk_buff *skb, unsigned int attr, 666 const struct nft_expr *expr); 667 668 static inline int nft_expr_clone(struct nft_expr *dst, struct nft_expr *src) 669 { 670 int err; 671 672 __module_get(src->ops->type->owner); 673 if (src->ops->clone) { 674 dst->ops = src->ops; 675 err = src->ops->clone(dst, src); 676 if (err < 0) 677 return err; 678 } else { 679 memcpy(dst, src, src->ops->size); 680 } 681 return 0; 682 } 683 684 /** 685 * struct nft_rule - nf_tables rule 686 * 687 * @list: used internally 688 * @handle: rule handle 689 * @genmask: generation mask 690 * @dlen: length of expression data 691 * @udata: user data is appended to the rule 692 * @data: expression data 693 */ 694 struct nft_rule { 695 struct list_head list; 696 u64 handle:42, 697 genmask:2, 698 dlen:12, 699 udata:1; 700 unsigned char data[] 701 __attribute__((aligned(__alignof__(struct nft_expr)))); 702 }; 703 704 static inline struct nft_expr *nft_expr_first(const struct nft_rule *rule) 705 { 706 return (struct nft_expr *)&rule->data[0]; 707 } 708 709 static inline struct nft_expr *nft_expr_next(const struct nft_expr *expr) 710 { 711 return ((void *)expr) + expr->ops->size; 712 } 713 714 static inline struct nft_expr *nft_expr_last(const struct nft_rule *rule) 715 { 716 return (struct nft_expr *)&rule->data[rule->dlen]; 717 } 718 719 static inline struct nft_userdata *nft_userdata(const struct nft_rule *rule) 720 { 721 return (void *)&rule->data[rule->dlen]; 722 } 723 724 /* 725 * The last pointer isn't really necessary, but the compiler isn't able to 726 * determine that the result of nft_expr_last() is always the same since it 727 * can't assume that the dlen value wasn't changed within calls in the loop. 728 */ 729 #define nft_rule_for_each_expr(expr, last, rule) \ 730 for ((expr) = nft_expr_first(rule), (last) = nft_expr_last(rule); \ 731 (expr) != (last); \ 732 (expr) = nft_expr_next(expr)) 733 734 enum nft_chain_flags { 735 NFT_BASE_CHAIN = 0x1, 736 NFT_CHAIN_INACTIVE = 0x2, 737 }; 738 739 /** 740 * struct nft_chain - nf_tables chain 741 * 742 * @rules: list of rules in the chain 743 * @list: used internally 744 * @table: table that this chain belongs to 745 * @handle: chain handle 746 * @use: number of jump references to this chain 747 * @level: length of longest path to this chain 748 * @flags: bitmask of enum nft_chain_flags 749 * @name: name of the chain 750 */ 751 struct nft_chain { 752 struct list_head rules; 753 struct list_head list; 754 struct nft_table *table; 755 u64 handle; 756 u32 use; 757 u16 level; 758 u8 flags; 759 char name[NFT_CHAIN_MAXNAMELEN]; 760 }; 761 762 enum nft_chain_type { 763 NFT_CHAIN_T_DEFAULT = 0, 764 NFT_CHAIN_T_ROUTE, 765 NFT_CHAIN_T_NAT, 766 NFT_CHAIN_T_MAX 767 }; 768 769 /** 770 * struct nf_chain_type - nf_tables chain type info 771 * 772 * @name: name of the type 773 * @type: numeric identifier 774 * @family: address family 775 * @owner: module owner 776 * @hook_mask: mask of valid hooks 777 * @hooks: hookfn overrides 778 */ 779 struct nf_chain_type { 780 const char *name; 781 enum nft_chain_type type; 782 int family; 783 struct module *owner; 784 unsigned int hook_mask; 785 nf_hookfn *hooks[NF_MAX_HOOKS]; 786 }; 787 788 int nft_chain_validate_dependency(const struct nft_chain *chain, 789 enum nft_chain_type type); 790 int nft_chain_validate_hooks(const struct nft_chain *chain, 791 unsigned int hook_flags); 792 793 struct nft_stats { 794 u64 bytes; 795 u64 pkts; 796 struct u64_stats_sync syncp; 797 }; 798 799 #define NFT_HOOK_OPS_MAX 2 800 #define NFT_BASECHAIN_DISABLED (1 << 0) 801 802 /** 803 * struct nft_base_chain - nf_tables base chain 804 * 805 * @ops: netfilter hook ops 806 * @pnet: net namespace that this chain belongs to 807 * @type: chain type 808 * @policy: default policy 809 * @stats: per-cpu chain stats 810 * @chain: the chain 811 * @dev_name: device name that this base chain is attached to (if any) 812 */ 813 struct nft_base_chain { 814 struct nf_hook_ops ops[NFT_HOOK_OPS_MAX]; 815 possible_net_t pnet; 816 const struct nf_chain_type *type; 817 u8 policy; 818 u8 flags; 819 struct nft_stats __percpu *stats; 820 struct nft_chain chain; 821 char dev_name[IFNAMSIZ]; 822 }; 823 824 static inline struct nft_base_chain *nft_base_chain(const struct nft_chain *chain) 825 { 826 return container_of(chain, struct nft_base_chain, chain); 827 } 828 829 int __nft_release_basechain(struct nft_ctx *ctx); 830 831 unsigned int nft_do_chain(struct nft_pktinfo *pkt, void *priv); 832 833 /** 834 * struct nft_table - nf_tables table 835 * 836 * @list: used internally 837 * @chains: chains in the table 838 * @sets: sets in the table 839 * @hgenerator: handle generator state 840 * @use: number of chain references to this table 841 * @flags: table flag (see enum nft_table_flags) 842 * @name: name of the table 843 */ 844 struct nft_table { 845 struct list_head list; 846 struct list_head chains; 847 struct list_head sets; 848 u64 hgenerator; 849 u32 use; 850 u16 flags; 851 char name[NFT_TABLE_MAXNAMELEN]; 852 }; 853 854 enum nft_af_flags { 855 NFT_AF_NEEDS_DEV = (1 << 0), 856 }; 857 858 /** 859 * struct nft_af_info - nf_tables address family info 860 * 861 * @list: used internally 862 * @family: address family 863 * @nhooks: number of hooks in this family 864 * @owner: module owner 865 * @tables: used internally 866 * @flags: family flags 867 * @nops: number of hook ops in this family 868 * @hook_ops_init: initialization function for chain hook ops 869 * @hooks: hookfn overrides for packet validation 870 */ 871 struct nft_af_info { 872 struct list_head list; 873 int family; 874 unsigned int nhooks; 875 struct module *owner; 876 struct list_head tables; 877 u32 flags; 878 unsigned int nops; 879 void (*hook_ops_init)(struct nf_hook_ops *, 880 unsigned int); 881 nf_hookfn *hooks[NF_MAX_HOOKS]; 882 }; 883 884 int nft_register_afinfo(struct net *, struct nft_af_info *); 885 void nft_unregister_afinfo(struct net *, struct nft_af_info *); 886 887 int nft_register_chain_type(const struct nf_chain_type *); 888 void nft_unregister_chain_type(const struct nf_chain_type *); 889 890 int nft_register_expr(struct nft_expr_type *); 891 void nft_unregister_expr(struct nft_expr_type *); 892 893 int nft_verdict_dump(struct sk_buff *skb, int type, 894 const struct nft_verdict *v); 895 896 /** 897 * struct nft_traceinfo - nft tracing information and state 898 * 899 * @pkt: pktinfo currently processed 900 * @basechain: base chain currently processed 901 * @chain: chain currently processed 902 * @rule: rule that was evaluated 903 * @verdict: verdict given by rule 904 * @type: event type (enum nft_trace_types) 905 * @packet_dumped: packet headers sent in a previous traceinfo message 906 * @trace: other struct members are initialised 907 */ 908 struct nft_traceinfo { 909 const struct nft_pktinfo *pkt; 910 const struct nft_base_chain *basechain; 911 const struct nft_chain *chain; 912 const struct nft_rule *rule; 913 const struct nft_verdict *verdict; 914 enum nft_trace_types type; 915 bool packet_dumped; 916 bool trace; 917 }; 918 919 void nft_trace_init(struct nft_traceinfo *info, const struct nft_pktinfo *pkt, 920 const struct nft_verdict *verdict, 921 const struct nft_chain *basechain); 922 923 void nft_trace_notify(struct nft_traceinfo *info); 924 925 #define nft_dereference(p) \ 926 nfnl_dereference(p, NFNL_SUBSYS_NFTABLES) 927 928 #define MODULE_ALIAS_NFT_FAMILY(family) \ 929 MODULE_ALIAS("nft-afinfo-" __stringify(family)) 930 931 #define MODULE_ALIAS_NFT_CHAIN(family, name) \ 932 MODULE_ALIAS("nft-chain-" __stringify(family) "-" name) 933 934 #define MODULE_ALIAS_NFT_AF_EXPR(family, name) \ 935 MODULE_ALIAS("nft-expr-" __stringify(family) "-" name) 936 937 #define MODULE_ALIAS_NFT_EXPR(name) \ 938 MODULE_ALIAS("nft-expr-" name) 939 940 #define MODULE_ALIAS_NFT_SET() \ 941 MODULE_ALIAS("nft-set") 942 943 /* 944 * The gencursor defines two generations, the currently active and the 945 * next one. Objects contain a bitmask of 2 bits specifying the generations 946 * they're active in. A set bit means they're inactive in the generation 947 * represented by that bit. 948 * 949 * New objects start out as inactive in the current and active in the 950 * next generation. When committing the ruleset the bitmask is cleared, 951 * meaning they're active in all generations. When removing an object, 952 * it is set inactive in the next generation. After committing the ruleset, 953 * the objects are removed. 954 */ 955 static inline unsigned int nft_gencursor_next(const struct net *net) 956 { 957 return net->nft.gencursor + 1 == 1 ? 1 : 0; 958 } 959 960 static inline u8 nft_genmask_next(const struct net *net) 961 { 962 return 1 << nft_gencursor_next(net); 963 } 964 965 static inline u8 nft_genmask_cur(const struct net *net) 966 { 967 /* Use ACCESS_ONCE() to prevent refetching the value for atomicity */ 968 return 1 << ACCESS_ONCE(net->nft.gencursor); 969 } 970 971 #define NFT_GENMASK_ANY ((1 << 0) | (1 << 1)) 972 973 /* 974 * Set element transaction helpers 975 */ 976 977 static inline bool nft_set_elem_active(const struct nft_set_ext *ext, 978 u8 genmask) 979 { 980 return !(ext->genmask & genmask); 981 } 982 983 static inline void nft_set_elem_change_active(const struct nft_set *set, 984 struct nft_set_ext *ext) 985 { 986 ext->genmask ^= nft_genmask_next(read_pnet(&set->pnet)); 987 } 988 989 /* 990 * We use a free bit in the genmask field to indicate the element 991 * is busy, meaning it is currently being processed either by 992 * the netlink API or GC. 993 * 994 * Even though the genmask is only a single byte wide, this works 995 * because the extension structure if fully constant once initialized, 996 * so there are no non-atomic write accesses unless it is already 997 * marked busy. 998 */ 999 #define NFT_SET_ELEM_BUSY_MASK (1 << 2) 1000 1001 #if defined(__LITTLE_ENDIAN_BITFIELD) 1002 #define NFT_SET_ELEM_BUSY_BIT 2 1003 #elif defined(__BIG_ENDIAN_BITFIELD) 1004 #define NFT_SET_ELEM_BUSY_BIT (BITS_PER_LONG - BITS_PER_BYTE + 2) 1005 #else 1006 #error 1007 #endif 1008 1009 static inline int nft_set_elem_mark_busy(struct nft_set_ext *ext) 1010 { 1011 unsigned long *word = (unsigned long *)ext; 1012 1013 BUILD_BUG_ON(offsetof(struct nft_set_ext, genmask) != 0); 1014 return test_and_set_bit(NFT_SET_ELEM_BUSY_BIT, word); 1015 } 1016 1017 static inline void nft_set_elem_clear_busy(struct nft_set_ext *ext) 1018 { 1019 unsigned long *word = (unsigned long *)ext; 1020 1021 clear_bit(NFT_SET_ELEM_BUSY_BIT, word); 1022 } 1023 1024 /** 1025 * struct nft_trans - nf_tables object update in transaction 1026 * 1027 * @list: used internally 1028 * @msg_type: message type 1029 * @ctx: transaction context 1030 * @data: internal information related to the transaction 1031 */ 1032 struct nft_trans { 1033 struct list_head list; 1034 int msg_type; 1035 struct nft_ctx ctx; 1036 char data[0]; 1037 }; 1038 1039 struct nft_trans_rule { 1040 struct nft_rule *rule; 1041 }; 1042 1043 #define nft_trans_rule(trans) \ 1044 (((struct nft_trans_rule *)trans->data)->rule) 1045 1046 struct nft_trans_set { 1047 struct nft_set *set; 1048 u32 set_id; 1049 }; 1050 1051 #define nft_trans_set(trans) \ 1052 (((struct nft_trans_set *)trans->data)->set) 1053 #define nft_trans_set_id(trans) \ 1054 (((struct nft_trans_set *)trans->data)->set_id) 1055 1056 struct nft_trans_chain { 1057 bool update; 1058 char name[NFT_CHAIN_MAXNAMELEN]; 1059 struct nft_stats __percpu *stats; 1060 u8 policy; 1061 }; 1062 1063 #define nft_trans_chain_update(trans) \ 1064 (((struct nft_trans_chain *)trans->data)->update) 1065 #define nft_trans_chain_name(trans) \ 1066 (((struct nft_trans_chain *)trans->data)->name) 1067 #define nft_trans_chain_stats(trans) \ 1068 (((struct nft_trans_chain *)trans->data)->stats) 1069 #define nft_trans_chain_policy(trans) \ 1070 (((struct nft_trans_chain *)trans->data)->policy) 1071 1072 struct nft_trans_table { 1073 bool update; 1074 bool enable; 1075 }; 1076 1077 #define nft_trans_table_update(trans) \ 1078 (((struct nft_trans_table *)trans->data)->update) 1079 #define nft_trans_table_enable(trans) \ 1080 (((struct nft_trans_table *)trans->data)->enable) 1081 1082 struct nft_trans_elem { 1083 struct nft_set *set; 1084 struct nft_set_elem elem; 1085 }; 1086 1087 #define nft_trans_elem_set(trans) \ 1088 (((struct nft_trans_elem *)trans->data)->set) 1089 #define nft_trans_elem(trans) \ 1090 (((struct nft_trans_elem *)trans->data)->elem) 1091 1092 #endif /* _NET_NF_TABLES_H */ 1093