netfilter.h 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415
  1. #ifndef __LINUX_NETFILTER_H
  2. #define __LINUX_NETFILTER_H
  3. #ifdef __KERNEL__
  4. #include <linux/init.h>
  5. #include <linux/skbuff.h>
  6. #include <linux/net.h>
  7. #include <linux/if.h>
  8. #include <linux/in.h>
  9. #include <linux/in6.h>
  10. #include <linux/wait.h>
  11. #include <linux/list.h>
  12. #endif
  13. #include <linux/types.h>
  14. #include <linux/compiler.h>
  15. #include <linux/sysctl.h>
  16. /* Responses from hook functions. */
  17. #define NF_DROP 0
  18. #define NF_ACCEPT 1
  19. #define NF_STOLEN 2
  20. #define NF_QUEUE 3
  21. #define NF_REPEAT 4
  22. #define NF_STOP 5
  23. #define NF_MAX_VERDICT NF_STOP
  24. /* we overload the higher bits for encoding auxiliary data such as the queue
  25. * number or errno values. Not nice, but better than additional function
  26. * arguments. */
  27. #define NF_VERDICT_MASK 0x000000ff
  28. /* extra verdict flags have mask 0x0000ff00 */
  29. #define NF_VERDICT_FLAG_QUEUE_BYPASS 0x00008000
  30. /* queue number (NF_QUEUE) or errno (NF_DROP) */
  31. #define NF_VERDICT_QMASK 0xffff0000
  32. #define NF_VERDICT_QBITS 16
  33. #define NF_QUEUE_NR(x) ((((x) << 16) & NF_VERDICT_QMASK) | NF_QUEUE)
  34. #define NF_DROP_ERR(x) (((-x) << 16) | NF_DROP)
  35. /* only for userspace compatibility */
  36. #ifndef __KERNEL__
  37. /* Generic cache responses from hook functions.
  38. <= 0x2000 is used for protocol-flags. */
  39. #define NFC_UNKNOWN 0x4000
  40. #define NFC_ALTERED 0x8000
  41. /* NF_VERDICT_BITS should be 8 now, but userspace might break if this changes */
  42. #define NF_VERDICT_BITS 16
  43. #endif
  44. enum nf_inet_hooks {
  45. NF_INET_PRE_ROUTING,
  46. NF_INET_LOCAL_IN,
  47. NF_INET_FORWARD,
  48. NF_INET_LOCAL_OUT,
  49. NF_INET_POST_ROUTING,
  50. NF_INET_NUMHOOKS
  51. };
  52. enum {
  53. NFPROTO_UNSPEC = 0,
  54. NFPROTO_IPV4 = 2,
  55. NFPROTO_ARP = 3,
  56. NFPROTO_BRIDGE = 7,
  57. NFPROTO_IPV6 = 10,
  58. NFPROTO_DECNET = 12,
  59. NFPROTO_NUMPROTO,
  60. };
  61. union nf_inet_addr {
  62. __u32 all[4];
  63. __be32 ip;
  64. __be32 ip6[4];
  65. struct in_addr in;
  66. struct in6_addr in6;
  67. };
  68. #ifdef __KERNEL__
  69. #ifdef CONFIG_NETFILTER
  70. static inline int NF_DROP_GETERR(int verdict)
  71. {
  72. return -(verdict >> NF_VERDICT_QBITS);
  73. }
  74. static inline int nf_inet_addr_cmp(const union nf_inet_addr *a1,
  75. const union nf_inet_addr *a2)
  76. {
  77. return a1->all[0] == a2->all[0] &&
  78. a1->all[1] == a2->all[1] &&
  79. a1->all[2] == a2->all[2] &&
  80. a1->all[3] == a2->all[3];
  81. }
  82. static inline void nf_inet_addr_mask(const union nf_inet_addr *a1,
  83. union nf_inet_addr *result,
  84. const union nf_inet_addr *mask)
  85. {
  86. result->all[0] = a1->all[0] & mask->all[0];
  87. result->all[1] = a1->all[1] & mask->all[1];
  88. result->all[2] = a1->all[2] & mask->all[2];
  89. result->all[3] = a1->all[3] & mask->all[3];
  90. }
  91. extern void netfilter_init(void);
  92. /* Largest hook number + 1 */
  93. #define NF_MAX_HOOKS 8
  94. struct sk_buff;
  95. typedef unsigned int nf_hookfn(unsigned int hooknum,
  96. struct sk_buff *skb,
  97. const struct net_device *in,
  98. const struct net_device *out,
  99. int (*okfn)(struct sk_buff *));
  100. struct nf_hook_ops {
  101. struct list_head list;
  102. /* User fills in from here down. */
  103. nf_hookfn *hook;
  104. struct module *owner;
  105. u_int8_t pf;
  106. unsigned int hooknum;
  107. /* Hooks are ordered in ascending priority. */
  108. int priority;
  109. };
  110. struct nf_sockopt_ops {
  111. struct list_head list;
  112. u_int8_t pf;
  113. /* Non-inclusive ranges: use 0/0/NULL to never get called. */
  114. int set_optmin;
  115. int set_optmax;
  116. int (*set)(struct sock *sk, int optval, void __user *user, unsigned int len);
  117. #ifdef CONFIG_COMPAT
  118. int (*compat_set)(struct sock *sk, int optval,
  119. void __user *user, unsigned int len);
  120. #endif
  121. int get_optmin;
  122. int get_optmax;
  123. int (*get)(struct sock *sk, int optval, void __user *user, int *len);
  124. #ifdef CONFIG_COMPAT
  125. int (*compat_get)(struct sock *sk, int optval,
  126. void __user *user, int *len);
  127. #endif
  128. /* Use the module struct to lock set/get code in place */
  129. struct module *owner;
  130. };
  131. /* Function to register/unregister hook points. */
  132. int nf_register_hook(struct nf_hook_ops *reg);
  133. void nf_unregister_hook(struct nf_hook_ops *reg);
  134. int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n);
  135. void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n);
  136. /* Functions to register get/setsockopt ranges (non-inclusive). You
  137. need to check permissions yourself! */
  138. int nf_register_sockopt(struct nf_sockopt_ops *reg);
  139. void nf_unregister_sockopt(struct nf_sockopt_ops *reg);
  140. extern struct list_head nf_hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
  141. #if defined(CONFIG_JUMP_LABEL)
  142. #include <linux/static_key.h>
  143. extern struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
  144. static inline bool nf_hooks_active(u_int8_t pf, unsigned int hook)
  145. {
  146. if (__builtin_constant_p(pf) &&
  147. __builtin_constant_p(hook))
  148. return static_key_false(&nf_hooks_needed[pf][hook]);
  149. return !list_empty(&nf_hooks[pf][hook]);
  150. }
  151. #else
  152. static inline bool nf_hooks_active(u_int8_t pf, unsigned int hook)
  153. {
  154. return !list_empty(&nf_hooks[pf][hook]);
  155. }
  156. #endif
  157. int nf_hook_slow(u_int8_t pf, unsigned int hook, struct sk_buff *skb,
  158. struct net_device *indev, struct net_device *outdev,
  159. int (*okfn)(struct sk_buff *), int thresh);
  160. /**
  161. * nf_hook_thresh - call a netfilter hook
  162. *
  163. * Returns 1 if the hook has allowed the packet to pass. The function
  164. * okfn must be invoked by the caller in this case. Any other return
  165. * value indicates the packet has been consumed by the hook.
  166. */
  167. static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook,
  168. struct sk_buff *skb,
  169. struct net_device *indev,
  170. struct net_device *outdev,
  171. int (*okfn)(struct sk_buff *), int thresh)
  172. {
  173. if (nf_hooks_active(pf, hook))
  174. return nf_hook_slow(pf, hook, skb, indev, outdev, okfn, thresh);
  175. return 1;
  176. }
  177. static inline int nf_hook(u_int8_t pf, unsigned int hook, struct sk_buff *skb,
  178. struct net_device *indev, struct net_device *outdev,
  179. int (*okfn)(struct sk_buff *))
  180. {
  181. return nf_hook_thresh(pf, hook, skb, indev, outdev, okfn, INT_MIN);
  182. }
  183. /* Activate hook; either okfn or kfree_skb called, unless a hook
  184. returns NF_STOLEN (in which case, it's up to the hook to deal with
  185. the consequences).
  186. Returns -ERRNO if packet dropped. Zero means queued, stolen or
  187. accepted.
  188. */
  189. /* RR:
  190. > I don't want nf_hook to return anything because people might forget
  191. > about async and trust the return value to mean "packet was ok".
  192. AK:
  193. Just document it clearly, then you can expect some sense from kernel
  194. coders :)
  195. */
  196. static inline int
  197. NF_HOOK_THRESH(uint8_t pf, unsigned int hook, struct sk_buff *skb,
  198. struct net_device *in, struct net_device *out,
  199. int (*okfn)(struct sk_buff *), int thresh)
  200. {
  201. int ret = nf_hook_thresh(pf, hook, skb, in, out, okfn, thresh);
  202. if (ret == 1)
  203. ret = okfn(skb);
  204. return ret;
  205. }
  206. static inline int
  207. NF_HOOK_COND(uint8_t pf, unsigned int hook, struct sk_buff *skb,
  208. struct net_device *in, struct net_device *out,
  209. int (*okfn)(struct sk_buff *), bool cond)
  210. {
  211. int ret;
  212. if (!cond ||
  213. ((ret = nf_hook_thresh(pf, hook, skb, in, out, okfn, INT_MIN)) == 1))
  214. ret = okfn(skb);
  215. return ret;
  216. }
  217. static inline int
  218. NF_HOOK(uint8_t pf, unsigned int hook, struct sk_buff *skb,
  219. struct net_device *in, struct net_device *out,
  220. int (*okfn)(struct sk_buff *))
  221. {
  222. return NF_HOOK_THRESH(pf, hook, skb, in, out, okfn, INT_MIN);
  223. }
  224. /* Call setsockopt() */
  225. int nf_setsockopt(struct sock *sk, u_int8_t pf, int optval, char __user *opt,
  226. unsigned int len);
  227. int nf_getsockopt(struct sock *sk, u_int8_t pf, int optval, char __user *opt,
  228. int *len);
  229. #ifdef CONFIG_COMPAT
  230. int compat_nf_setsockopt(struct sock *sk, u_int8_t pf, int optval,
  231. char __user *opt, unsigned int len);
  232. int compat_nf_getsockopt(struct sock *sk, u_int8_t pf, int optval,
  233. char __user *opt, int *len);
  234. #endif
  235. /* Call this before modifying an existing packet: ensures it is
  236. modifiable and linear to the point you care about (writable_len).
  237. Returns true or false. */
  238. extern int skb_make_writable(struct sk_buff *skb, unsigned int writable_len);
  239. struct flowi;
  240. struct nf_queue_entry;
  241. struct nf_afinfo {
  242. unsigned short family;
  243. __sum16 (*checksum)(struct sk_buff *skb, unsigned int hook,
  244. unsigned int dataoff, u_int8_t protocol);
  245. __sum16 (*checksum_partial)(struct sk_buff *skb,
  246. unsigned int hook,
  247. unsigned int dataoff,
  248. unsigned int len,
  249. u_int8_t protocol);
  250. int (*route)(struct net *net, struct dst_entry **dst,
  251. struct flowi *fl, bool strict);
  252. void (*saveroute)(const struct sk_buff *skb,
  253. struct nf_queue_entry *entry);
  254. int (*reroute)(struct sk_buff *skb,
  255. const struct nf_queue_entry *entry);
  256. int route_key_size;
  257. };
  258. extern const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO];
  259. static inline const struct nf_afinfo *nf_get_afinfo(unsigned short family)
  260. {
  261. return rcu_dereference(nf_afinfo[family]);
  262. }
  263. static inline __sum16
  264. nf_checksum(struct sk_buff *skb, unsigned int hook, unsigned int dataoff,
  265. u_int8_t protocol, unsigned short family)
  266. {
  267. const struct nf_afinfo *afinfo;
  268. __sum16 csum = 0;
  269. rcu_read_lock();
  270. afinfo = nf_get_afinfo(family);
  271. if (afinfo)
  272. csum = afinfo->checksum(skb, hook, dataoff, protocol);
  273. rcu_read_unlock();
  274. return csum;
  275. }
  276. static inline __sum16
  277. nf_checksum_partial(struct sk_buff *skb, unsigned int hook,
  278. unsigned int dataoff, unsigned int len,
  279. u_int8_t protocol, unsigned short family)
  280. {
  281. const struct nf_afinfo *afinfo;
  282. __sum16 csum = 0;
  283. rcu_read_lock();
  284. afinfo = nf_get_afinfo(family);
  285. if (afinfo)
  286. csum = afinfo->checksum_partial(skb, hook, dataoff, len,
  287. protocol);
  288. rcu_read_unlock();
  289. return csum;
  290. }
  291. extern int nf_register_afinfo(const struct nf_afinfo *afinfo);
  292. extern void nf_unregister_afinfo(const struct nf_afinfo *afinfo);
  293. #include <net/flow.h>
  294. extern void (*nf_nat_decode_session_hook)(struct sk_buff *, struct flowi *);
  295. static inline void
  296. nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family)
  297. {
  298. #ifdef CONFIG_NF_NAT_NEEDED
  299. void (*decodefn)(struct sk_buff *, struct flowi *);
  300. rcu_read_lock();
  301. decodefn = rcu_dereference(nf_nat_decode_session_hook);
  302. if (decodefn)
  303. decodefn(skb, fl);
  304. rcu_read_unlock();
  305. #endif
  306. }
  307. #ifdef CONFIG_PROC_FS
  308. #include <linux/proc_fs.h>
  309. extern struct proc_dir_entry *proc_net_netfilter;
  310. #endif
  311. #else /* !CONFIG_NETFILTER */
  312. #define NF_HOOK(pf, hook, skb, indev, outdev, okfn) (okfn)(skb)
  313. #define NF_HOOK_COND(pf, hook, skb, indev, outdev, okfn, cond) (okfn)(skb)
  314. static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook,
  315. struct sk_buff *skb,
  316. struct net_device *indev,
  317. struct net_device *outdev,
  318. int (*okfn)(struct sk_buff *), int thresh)
  319. {
  320. return okfn(skb);
  321. }
  322. static inline int nf_hook(u_int8_t pf, unsigned int hook, struct sk_buff *skb,
  323. struct net_device *indev, struct net_device *outdev,
  324. int (*okfn)(struct sk_buff *))
  325. {
  326. return 1;
  327. }
  328. struct flowi;
  329. static inline void
  330. nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family)
  331. {
  332. }
  333. #endif /*CONFIG_NETFILTER*/
  334. #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
  335. extern void (*ip_ct_attach)(struct sk_buff *, struct sk_buff *) __rcu;
  336. extern void nf_ct_attach(struct sk_buff *, struct sk_buff *);
  337. extern void (*nf_ct_destroy)(struct nf_conntrack *) __rcu;
  338. struct nf_conn;
  339. struct nlattr;
  340. struct nfq_ct_hook {
  341. size_t (*build_size)(const struct nf_conn *ct);
  342. int (*build)(struct sk_buff *skb, struct nf_conn *ct);
  343. int (*parse)(const struct nlattr *attr, struct nf_conn *ct);
  344. };
  345. extern struct nfq_ct_hook __rcu *nfq_ct_hook;
  346. struct nfq_ct_nat_hook {
  347. void (*seq_adjust)(struct sk_buff *skb, struct nf_conn *ct,
  348. u32 ctinfo, int off);
  349. };
  350. extern struct nfq_ct_nat_hook __rcu *nfq_ct_nat_hook;
  351. #else
  352. static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {}
  353. #endif
  354. #endif /*__KERNEL__*/
  355. #endif /*__LINUX_NETFILTER_H*/