include/linux/netfilter.h

   1 #ifndef __LINUX_NETFILTER_H
   2 #define __LINUX_NETFILTER_H
   3
   4 #include <linux/init.h>
   5 #include <linux/skbuff.h>
   6 #include <linux/net.h>
   7 #include <linux/if.h>
   8 #include <linux/in.h>
   9 #include <linux/in6.h>
  10 #include <linux/wait.h>
  11 #include <linux/list.h>
  12 #include <linux/static_key.h>
  13 #include <linux/netfilter_defs.h>
  14 #include <linux/netdevice.h>
  15 #include <net/net_namespace.h>
  16
  17 #ifdef CONFIG_NETFILTER
  18 static inline int NF_DROP_GETERR(int verdict)
  19 {
  20         return -(verdict >> NF_VERDICT_QBITS);
  21 }
  22
  23 static inline int nf_inet_addr_cmp(const union nf_inet_addr *a1,
  24                                    const union nf_inet_addr *a2)
  25 {
  26         return a1->all[0] == a2->all[0] &&
  27                a1->all[1] == a2->all[1] &&
  28                a1->all[2] == a2->all[2] &&
  29                a1->all[3] == a2->all[3];
  30 }
  31
  32 static inline void nf_inet_addr_mask(const union nf_inet_addr *a1,
  33                                      union nf_inet_addr *result,
  34                                      const union nf_inet_addr *mask)
  35 {
  36         result->all[0] = a1->all[0] & mask->all[0];
  37         result->all[1] = a1->all[1] & mask->all[1];
  38         result->all[2] = a1->all[2] & mask->all[2];
  39         result->all[3] = a1->all[3] & mask->all[3];
  40 }
  41
  42 int netfilter_init(void);
  43
  44 struct sk_buff;
  45
  46 struct nf_hook_ops;
  47
  48 struct sock;
  49
  50 struct nf_hook_state {
  51         unsigned int hook;
  52         u_int8_t pf;
  53         struct net_device *in;
  54         struct net_device *out;
  55         struct sock *sk;
  56         struct net *net;
  57         int (*okfn)(struct net *, struct sock *, struct sk_buff *);
  58 };
  59
  60 typedef unsigned int nf_hookfn(void *priv,
  61                                struct sk_buff *skb,
  62                                const struct nf_hook_state *state);
  63 struct nf_hook_ops {
  64         struct list_head        list;
  65
  66         /* User fills in from here down. */
  67         nf_hookfn               *hook;
  68         struct net_device       *dev;
  69         void                    *priv;
  70         u_int8_t                pf;
  71         unsigned int            hooknum;
  72         /* Hooks are ordered in ascending priority. */
  73         int                     priority;
  74 };
  75
  76 struct nf_hook_entry {
  77         struct nf_hook_entry __rcu      *next;
  78         struct nf_hook_ops              ops;
  79         const struct nf_hook_ops        *orig_ops;
  80 };
  81
  82 static inline void
  83 nf_hook_entry_init(struct nf_hook_entry *entry, const struct nf_hook_ops *ops)
  84 {
  85         entry->next = NULL;
  86         entry->ops = *ops;
  87         entry->orig_ops = ops;
  88 }
  89
  90 static inline int
  91 nf_hook_entry_priority(const struct nf_hook_entry *entry)
  92 {
  93         return entry->ops.priority;
  94 }
  95
  96 static inline int
  97 nf_hook_entry_hookfn(const struct nf_hook_entry *entry, struct sk_buff *skb,
  98                      struct nf_hook_state *state)
  99 {
 100         return entry->ops.hook(entry->ops.priv, skb, state);
 101 }
 102
 103 static inline const struct nf_hook_ops *
 104 nf_hook_entry_ops(const struct nf_hook_entry *entry)
 105 {
 106         return entry->orig_ops;
 107 }
 108
 109 static inline void nf_hook_state_init(struct nf_hook_state *p,
 110                                       unsigned int hook,
 111                                       u_int8_t pf,
 112                                       struct net_device *indev,
 113                                       struct net_device *outdev,
 114                                       struct sock *sk,
 115                                       struct net *net,
 116                                       int (*okfn)(struct net *, struct sock *, struct sk_buff *))
 117 {
 118         p->hook = hook;
 119         p->pf = pf;
 120         p->in = indev;
 121         p->out = outdev;
 122         p->sk = sk;
 123         p->net = net;
 124         p->okfn = okfn;
 125 }
 126
 127
 128
 129 struct nf_sockopt_ops {
 130         struct list_head list;
 131
 132         u_int8_t pf;
 133
 134         /* Non-inclusive ranges: use 0/0/NULL to never get called. */
 135         int set_optmin;
 136         int set_optmax;
 137         int (*set)(struct sock *sk, int optval, void __user *user, unsigned int len);
 138 #ifdef CONFIG_COMPAT
 139         int (*compat_set)(struct sock *sk, int optval,
 140                         void __user *user, unsigned int len);
 141 #endif
 142         int get_optmin;
 143         int get_optmax;
 144         int (*get)(struct sock *sk, int optval, void __user *user, int *len);
 145 #ifdef CONFIG_COMPAT
 146         int (*compat_get)(struct sock *sk, int optval,
 147                         void __user *user, int *len);
 148 #endif
 149         /* Use the module struct to lock set/get code in place */
 150         struct module *owner;
 151 };
 152
 153 /* Function to register/unregister hook points. */
 154 int nf_register_net_hook(struct net *net, const struct nf_hook_ops *ops);
 155 void nf_unregister_net_hook(struct net *net, const struct nf_hook_ops *ops);
 156 int nf_register_net_hooks(struct net *net, const struct nf_hook_ops *reg,
 157                           unsigned int n);
 158 void nf_unregister_net_hooks(struct net *net, const struct nf_hook_ops *reg,
 159                              unsigned int n);
 160
 161 int nf_register_hook(struct nf_hook_ops *reg);
 162 void nf_unregister_hook(struct nf_hook_ops *reg);
 163 int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n);
 164 void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n);
 165 int _nf_register_hooks(struct nf_hook_ops *reg, unsigned int n);
 166 void _nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n);
 167
 168 /* Functions to register get/setsockopt ranges (non-inclusive).  You
 169    need to check permissions yourself! */
 170 int nf_register_sockopt(struct nf_sockopt_ops *reg);
 171 void nf_unregister_sockopt(struct nf_sockopt_ops *reg);
 172
 173 #ifdef HAVE_JUMP_LABEL
 174 extern struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
 175 #endif
 176
 177 int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state,
 178                  struct nf_hook_entry *entry);
 179
 180 /**
 181  *      nf_hook - call a netfilter hook
 182  *
 183  *      Returns 1 if the hook has allowed the packet to pass.  The function
 184  *      okfn must be invoked by the caller in this case.  Any other return
 185  *      value indicates the packet has been consumed by the hook.
 186  */
 187 static inline int nf_hook(u_int8_t pf, unsigned int hook, struct net *net,
 188                           struct sock *sk, struct sk_buff *skb,
 189                           struct net_device *indev, struct net_device *outdev,
 190                           int (*okfn)(struct net *, struct sock *, struct sk_buff *))
 191 {
 192         struct nf_hook_entry *hook_head;
 193         int ret = 1;
 194
 195 #ifdef HAVE_JUMP_LABEL
 196         if (__builtin_constant_p(pf) &&
 197             __builtin_constant_p(hook) &&
 198             !static_key_false(&nf_hooks_needed[pf][hook]))
 199                 return 1;
 200 #endif
 201
 202         rcu_read_lock();
 203         hook_head = rcu_dereference(net->nf.hooks[pf][hook]);
 204         if (hook_head) {
 205                 struct nf_hook_state state;
 206
 207                 nf_hook_state_init(&state, hook, pf, indev, outdev,
 208                                    sk, net, okfn);
 209
 210                 ret = nf_hook_slow(skb, &state, hook_head);
 211         }
 212         rcu_read_unlock();
 213
 214         return ret;
 215 }
 216
 217 /* Activate hook; either okfn or kfree_skb called, unless a hook
 218    returns NF_STOLEN (in which case, it's up to the hook to deal with
 219    the consequences).
 220
 221    Returns -ERRNO if packet dropped.  Zero means queued, stolen or
 222    accepted.
 223 */
 224
 225 /* RR:
 226    > I don't want nf_hook to return anything because people might forget
 227    > about async and trust the return value to mean "packet was ok".
 228
 229    AK:
 230    Just document it clearly, then you can expect some sense from kernel
 231    coders :)
 232 */
 233
 234 static inline int
 235 NF_HOOK_COND(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk,
 236              struct sk_buff *skb, struct net_device *in, struct net_device *out,
 237              int (*okfn)(struct net *, struct sock *, struct sk_buff *),
 238              bool cond)
 239 {
 240         int ret;
 241
 242         if (!cond ||
 243             ((ret = nf_hook(pf, hook, net, sk, skb, in, out, okfn)) == 1))
 244                 ret = okfn(net, sk, skb);
 245         return ret;
 246 }
 247
 248 static inline int
 249 NF_HOOK(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk, struct sk_buff *skb,
 250         struct net_device *in, struct net_device *out,
 251         int (*okfn)(struct net *, struct sock *, struct sk_buff *))
 252 {
 253         int ret = nf_hook(pf, hook, net, sk, skb, in, out, okfn);
 254         if (ret == 1)
 255                 ret = okfn(net, sk, skb);
 256         return ret;
 257 }
 258
 259 /* Call setsockopt() */
 260 int nf_setsockopt(struct sock *sk, u_int8_t pf, int optval, char __user *opt,
 261                   unsigned int len);
 262 int nf_getsockopt(struct sock *sk, u_int8_t pf, int optval, char __user *opt,
 263                   int *len);
 264 #ifdef CONFIG_COMPAT
 265 int compat_nf_setsockopt(struct sock *sk, u_int8_t pf, int optval,
 266                 char __user *opt, unsigned int len);
 267 int compat_nf_getsockopt(struct sock *sk, u_int8_t pf, int optval,
 268                 char __user *opt, int *len);
 269 #endif
 270
 271 /* Call this before modifying an existing packet: ensures it is
 272    modifiable and linear to the point you care about (writable_len).
 273    Returns true or false. */
 274 int skb_make_writable(struct sk_buff *skb, unsigned int writable_len);
 275
 276 struct flowi;
 277 struct nf_queue_entry;
 278
 279 struct nf_afinfo {
 280         unsigned short  family;
 281         __sum16         (*checksum)(struct sk_buff *skb, unsigned int hook,
 282                                     unsigned int dataoff, u_int8_t protocol);
 283         __sum16         (*checksum_partial)(struct sk_buff *skb,
 284                                             unsigned int hook,
 285                                             unsigned int dataoff,
 286                                             unsigned int len,
 287                                             u_int8_t protocol);
 288         int             (*route)(struct net *net, struct dst_entry **dst,
 289                                  struct flowi *fl, bool strict);
 290         void            (*saveroute)(const struct sk_buff *skb,
 291                                      struct nf_queue_entry *entry);
 292         int             (*reroute)(struct net *net, struct sk_buff *skb,
 293                                    const struct nf_queue_entry *entry);
 294         int             route_key_size;
 295 };
 296
 297 extern const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO];
 298 static inline const struct nf_afinfo *nf_get_afinfo(unsigned short family)
 299 {
 300         return rcu_dereference(nf_afinfo[family]);
 301 }
 302
 303 static inline __sum16
 304 nf_checksum(struct sk_buff *skb, unsigned int hook, unsigned int dataoff,
 305             u_int8_t protocol, unsigned short family)
 306 {
 307         const struct nf_afinfo *afinfo;
 308         __sum16 csum = 0;
 309
 310         rcu_read_lock();
 311         afinfo = nf_get_afinfo(family);
 312         if (afinfo)
 313                 csum = afinfo->checksum(skb, hook, dataoff, protocol);
 314         rcu_read_unlock();
 315         return csum;
 316 }
 317
 318 static inline __sum16
 319 nf_checksum_partial(struct sk_buff *skb, unsigned int hook,
 320                     unsigned int dataoff, unsigned int len,
 321                     u_int8_t protocol, unsigned short family)
 322 {
 323         const struct nf_afinfo *afinfo;
 324         __sum16 csum = 0;
 325
 326         rcu_read_lock();
 327         afinfo = nf_get_afinfo(family);
 328         if (afinfo)
 329                 csum = afinfo->checksum_partial(skb, hook, dataoff, len,
 330                                                 protocol);
 331         rcu_read_unlock();
 332         return csum;
 333 }
 334
 335 int nf_register_afinfo(const struct nf_afinfo *afinfo);
 336 void nf_unregister_afinfo(const struct nf_afinfo *afinfo);
 337
 338 #include <net/flow.h>
 339 extern void (*nf_nat_decode_session_hook)(struct sk_buff *, struct flowi *);
 340
 341 static inline void
 342 nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family)
 343 {
 344 #ifdef CONFIG_NF_NAT_NEEDED
 345         void (*decodefn)(struct sk_buff *, struct flowi *);
 346
 347         rcu_read_lock();
 348         decodefn = rcu_dereference(nf_nat_decode_session_hook);
 349         if (decodefn)
 350                 decodefn(skb, fl);
 351         rcu_read_unlock();
 352 #endif
 353 }
 354
 355 #else /* !CONFIG_NETFILTER */
 356 static inline int
 357 NF_HOOK_COND(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk,
 358              struct sk_buff *skb, struct net_device *in, struct net_device *out,
 359              int (*okfn)(struct net *, struct sock *, struct sk_buff *),
 360              bool cond)
 361 {
 362         return okfn(net, sk, skb);
 363 }
 364
 365 static inline int
 366 NF_HOOK(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk,
 367         struct sk_buff *skb, struct net_device *in, struct net_device *out,
 368         int (*okfn)(struct net *, struct sock *, struct sk_buff *))
 369 {
 370         return okfn(net, sk, skb);
 371 }
 372
 373 static inline int nf_hook(u_int8_t pf, unsigned int hook, struct net *net,
 374                           struct sock *sk, struct sk_buff *skb,
 375                           struct net_device *indev, struct net_device *outdev,
 376                           int (*okfn)(struct net *, struct sock *, struct sk_buff *))
 377 {
 378         return 1;
 379 }
 380 struct flowi;
 381 static inline void
 382 nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family)
 383 {
 384 }
 385 #endif /*CONFIG_NETFILTER*/
 386
 387 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
 388 #include <linux/netfilter/nf_conntrack_zones_common.h>
 389
 390 extern void (*ip_ct_attach)(struct sk_buff *, const struct sk_buff *) __rcu;
 391 void nf_ct_attach(struct sk_buff *, const struct sk_buff *);
 392 extern void (*nf_ct_destroy)(struct nf_conntrack *) __rcu;
 393 #else
 394 static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {}
 395 #endif
 396
 397 struct nf_conn;
 398 enum ip_conntrack_info;
 399 struct nlattr;
 400
 401 struct nfnl_ct_hook {
 402         struct nf_conn *(*get_ct)(const struct sk_buff *skb,
 403                                   enum ip_conntrack_info *ctinfo);
 404         size_t (*build_size)(const struct nf_conn *ct);
 405         int (*build)(struct sk_buff *skb, struct nf_conn *ct,
 406                      enum ip_conntrack_info ctinfo,
 407                      u_int16_t ct_attr, u_int16_t ct_info_attr);
 408         int (*parse)(const struct nlattr *attr, struct nf_conn *ct);
 409         int (*attach_expect)(const struct nlattr *attr, struct nf_conn *ct,
 410                              u32 portid, u32 report);
 411         void (*seq_adjust)(struct sk_buff *skb, struct nf_conn *ct,
 412                            enum ip_conntrack_info ctinfo, s32 off);
 413 };
 414 extern struct nfnl_ct_hook __rcu *nfnl_ct_hook;
 415
 416 /**
 417  * nf_skb_duplicated - TEE target has sent a packet
 418  *
 419  * When a xtables target sends a packet, the OUTPUT and POSTROUTING
 420  * hooks are traversed again, i.e. nft and xtables are invoked recursively.
 421  *
 422  * This is used by xtables TEE target to prevent the duplicated skb from
 423  * being duplicated again.
 424  */
 425 DECLARE_PER_CPU(bool, nf_skb_duplicated);
 426
 427 #endif /*__LINUX_NETFILTER_H*/