1 /* SPDX-License-Identifier: GPL-2.0 */
2 #ifndef __LINUX_NETFILTER_H
3 #define __LINUX_NETFILTER_H
5 #include <linux/init.h>
6 #include <linux/skbuff.h>
10 #include <linux/in6.h>
11 #include <linux/wait.h>
12 #include <linux/list.h>
13 #include <linux/static_key.h>
14 #include <linux/netfilter_defs.h>
15 #include <linux/netdevice.h>
16 #include <net/net_namespace.h>
18 #ifdef CONFIG_NETFILTER
19 static inline int NF_DROP_GETERR(int verdict
)
21 return -(verdict
>> NF_VERDICT_QBITS
);
24 static inline int nf_inet_addr_cmp(const union nf_inet_addr
*a1
,
25 const union nf_inet_addr
*a2
)
27 return a1
->all
[0] == a2
->all
[0] &&
28 a1
->all
[1] == a2
->all
[1] &&
29 a1
->all
[2] == a2
->all
[2] &&
30 a1
->all
[3] == a2
->all
[3];
33 static inline void nf_inet_addr_mask(const union nf_inet_addr
*a1
,
34 union nf_inet_addr
*result
,
35 const union nf_inet_addr
*mask
)
37 result
->all
[0] = a1
->all
[0] & mask
->all
[0];
38 result
->all
[1] = a1
->all
[1] & mask
->all
[1];
39 result
->all
[2] = a1
->all
[2] & mask
->all
[2];
40 result
->all
[3] = a1
->all
[3] & mask
->all
[3];
43 int netfilter_init(void);
51 struct nf_hook_state
{
54 struct net_device
*in
;
55 struct net_device
*out
;
58 int (*okfn
)(struct net
*, struct sock
*, struct sk_buff
*);
61 typedef unsigned int nf_hookfn(void *priv
,
63 const struct nf_hook_state
*state
);
65 /* User fills in from here down. */
67 struct net_device
*dev
;
71 /* Hooks are ordered in ascending priority. */
75 struct nf_hook_entry
{
80 struct nf_hook_entries_rcu_head
{
85 struct nf_hook_entries
{
88 struct nf_hook_entry hooks
[];
90 /* trailer: pointers to original orig_ops of each hook,
91 * followed by rcu_head and scratch space used for freeing
92 * the structure via call_rcu.
94 * This is not part of struct nf_hook_entry since its only
95 * needed in slow path (hook register/unregister):
96 * const struct nf_hook_ops *orig_ops[]
98 * For the same reason, we store this at end -- its
99 * only needed when a hook is deleted, not during
100 * packet path processing:
101 * struct nf_hook_entries_rcu_head head
105 static inline struct nf_hook_ops
**nf_hook_entries_get_hook_ops(const struct nf_hook_entries
*e
)
107 unsigned int n
= e
->num_hook_entries
;
108 const void *hook_end
;
110 hook_end
= &e
->hooks
[n
]; /* this is *past* ->hooks[]! */
112 return (struct nf_hook_ops
**)hook_end
;
116 nf_hook_entry_hookfn(const struct nf_hook_entry
*entry
, struct sk_buff
*skb
,
117 struct nf_hook_state
*state
)
119 return entry
->hook(entry
->priv
, skb
, state
);
122 static inline void nf_hook_state_init(struct nf_hook_state
*p
,
125 struct net_device
*indev
,
126 struct net_device
*outdev
,
129 int (*okfn
)(struct net
*, struct sock
*, struct sk_buff
*))
142 struct nf_sockopt_ops
{
143 struct list_head list
;
147 /* Non-inclusive ranges: use 0/0/NULL to never get called. */
150 int (*set
)(struct sock
*sk
, int optval
, void __user
*user
, unsigned int len
);
152 int (*compat_set
)(struct sock
*sk
, int optval
,
153 void __user
*user
, unsigned int len
);
157 int (*get
)(struct sock
*sk
, int optval
, void __user
*user
, int *len
);
159 int (*compat_get
)(struct sock
*sk
, int optval
,
160 void __user
*user
, int *len
);
162 /* Use the module struct to lock set/get code in place */
163 struct module
*owner
;
166 /* Function to register/unregister hook points. */
167 int nf_register_net_hook(struct net
*net
, const struct nf_hook_ops
*ops
);
168 void nf_unregister_net_hook(struct net
*net
, const struct nf_hook_ops
*ops
);
169 int nf_register_net_hooks(struct net
*net
, const struct nf_hook_ops
*reg
,
171 void nf_unregister_net_hooks(struct net
*net
, const struct nf_hook_ops
*reg
,
174 /* Functions to register get/setsockopt ranges (non-inclusive). You
175 need to check permissions yourself! */
176 int nf_register_sockopt(struct nf_sockopt_ops
*reg
);
177 void nf_unregister_sockopt(struct nf_sockopt_ops
*reg
);
179 #ifdef HAVE_JUMP_LABEL
180 extern struct static_key nf_hooks_needed
[NFPROTO_NUMPROTO
][NF_MAX_HOOKS
];
183 int nf_hook_slow(struct sk_buff
*skb
, struct nf_hook_state
*state
,
184 const struct nf_hook_entries
*e
, unsigned int i
);
187 * nf_hook - call a netfilter hook
189 * Returns 1 if the hook has allowed the packet to pass. The function
190 * okfn must be invoked by the caller in this case. Any other return
191 * value indicates the packet has been consumed by the hook.
193 static inline int nf_hook(u_int8_t pf
, unsigned int hook
, struct net
*net
,
194 struct sock
*sk
, struct sk_buff
*skb
,
195 struct net_device
*indev
, struct net_device
*outdev
,
196 int (*okfn
)(struct net
*, struct sock
*, struct sk_buff
*))
198 struct nf_hook_entries
*hook_head
= NULL
;
201 #ifdef HAVE_JUMP_LABEL
202 if (__builtin_constant_p(pf
) &&
203 __builtin_constant_p(hook
) &&
204 !static_key_false(&nf_hooks_needed
[pf
][hook
]))
211 hook_head
= rcu_dereference(net
->nf
.hooks_ipv4
[hook
]);
214 hook_head
= rcu_dereference(net
->nf
.hooks_ipv6
[hook
]);
217 #ifdef CONFIG_NETFILTER_FAMILY_ARP
218 if (WARN_ON_ONCE(hook
>= ARRAY_SIZE(net
->nf
.hooks_arp
)))
220 hook_head
= rcu_dereference(net
->nf
.hooks_arp
[hook
]);
224 #ifdef CONFIG_NETFILTER_FAMILY_BRIDGE
225 hook_head
= rcu_dereference(net
->nf
.hooks_bridge
[hook
]);
228 #if IS_ENABLED(CONFIG_DECNET)
230 hook_head
= rcu_dereference(net
->nf
.hooks_decnet
[hook
]);
239 struct nf_hook_state state
;
241 nf_hook_state_init(&state
, hook
, pf
, indev
, outdev
,
244 ret
= nf_hook_slow(skb
, &state
, hook_head
, 0);
251 /* Activate hook; either okfn or kfree_skb called, unless a hook
252 returns NF_STOLEN (in which case, it's up to the hook to deal with
255 Returns -ERRNO if packet dropped. Zero means queued, stolen or
260 > I don't want nf_hook to return anything because people might forget
261 > about async and trust the return value to mean "packet was ok".
264 Just document it clearly, then you can expect some sense from kernel
269 NF_HOOK_COND(uint8_t pf
, unsigned int hook
, struct net
*net
, struct sock
*sk
,
270 struct sk_buff
*skb
, struct net_device
*in
, struct net_device
*out
,
271 int (*okfn
)(struct net
*, struct sock
*, struct sk_buff
*),
277 ((ret
= nf_hook(pf
, hook
, net
, sk
, skb
, in
, out
, okfn
)) == 1))
278 ret
= okfn(net
, sk
, skb
);
283 NF_HOOK(uint8_t pf
, unsigned int hook
, struct net
*net
, struct sock
*sk
, struct sk_buff
*skb
,
284 struct net_device
*in
, struct net_device
*out
,
285 int (*okfn
)(struct net
*, struct sock
*, struct sk_buff
*))
287 int ret
= nf_hook(pf
, hook
, net
, sk
, skb
, in
, out
, okfn
);
289 ret
= okfn(net
, sk
, skb
);
294 NF_HOOK_LIST(uint8_t pf
, unsigned int hook
, struct net
*net
, struct sock
*sk
,
295 struct list_head
*head
, struct net_device
*in
, struct net_device
*out
,
296 int (*okfn
)(struct net
*, struct sock
*, struct sk_buff
*))
298 struct sk_buff
*skb
, *next
;
299 struct list_head sublist
;
301 INIT_LIST_HEAD(&sublist
);
302 list_for_each_entry_safe(skb
, next
, head
, list
) {
303 list_del(&skb
->list
);
304 if (nf_hook(pf
, hook
, net
, sk
, skb
, in
, out
, okfn
) == 1)
305 list_add_tail(&skb
->list
, &sublist
);
307 /* Put passed packets back on main list */
308 list_splice(&sublist
, head
);
311 /* Call setsockopt() */
312 int nf_setsockopt(struct sock
*sk
, u_int8_t pf
, int optval
, char __user
*opt
,
314 int nf_getsockopt(struct sock
*sk
, u_int8_t pf
, int optval
, char __user
*opt
,
317 int compat_nf_setsockopt(struct sock
*sk
, u_int8_t pf
, int optval
,
318 char __user
*opt
, unsigned int len
);
319 int compat_nf_getsockopt(struct sock
*sk
, u_int8_t pf
, int optval
,
320 char __user
*opt
, int *len
);
323 /* Call this before modifying an existing packet: ensures it is
324 modifiable and linear to the point you care about (writable_len).
325 Returns true or false. */
326 int skb_make_writable(struct sk_buff
*skb
, unsigned int writable_len
);
329 struct nf_queue_entry
;
331 __sum16
nf_checksum(struct sk_buff
*skb
, unsigned int hook
,
332 unsigned int dataoff
, u_int8_t protocol
,
333 unsigned short family
);
335 __sum16
nf_checksum_partial(struct sk_buff
*skb
, unsigned int hook
,
336 unsigned int dataoff
, unsigned int len
,
337 u_int8_t protocol
, unsigned short family
);
338 int nf_route(struct net
*net
, struct dst_entry
**dst
, struct flowi
*fl
,
339 bool strict
, unsigned short family
);
340 int nf_reroute(struct sk_buff
*skb
, struct nf_queue_entry
*entry
);
342 #include <net/flow.h>
345 enum nf_nat_manip_type
;
347 enum ip_conntrack_dir
;
350 int (*parse_nat_setup
)(struct nf_conn
*ct
, enum nf_nat_manip_type manip
,
351 const struct nlattr
*attr
);
352 void (*decode_session
)(struct sk_buff
*skb
, struct flowi
*fl
);
353 unsigned int (*manip_pkt
)(struct sk_buff
*skb
, struct nf_conn
*ct
,
354 enum nf_nat_manip_type mtype
,
355 enum ip_conntrack_dir dir
);
358 extern struct nf_nat_hook __rcu
*nf_nat_hook
;
361 nf_nat_decode_session(struct sk_buff
*skb
, struct flowi
*fl
, u_int8_t family
)
363 #ifdef CONFIG_NF_NAT_NEEDED
364 struct nf_nat_hook
*nat_hook
;
367 nat_hook
= rcu_dereference(nf_nat_hook
);
368 if (nat_hook
&& nat_hook
->decode_session
)
369 nat_hook
->decode_session(skb
, fl
);
374 #else /* !CONFIG_NETFILTER */
376 NF_HOOK_COND(uint8_t pf
, unsigned int hook
, struct net
*net
, struct sock
*sk
,
377 struct sk_buff
*skb
, struct net_device
*in
, struct net_device
*out
,
378 int (*okfn
)(struct net
*, struct sock
*, struct sk_buff
*),
381 return okfn(net
, sk
, skb
);
385 NF_HOOK(uint8_t pf
, unsigned int hook
, struct net
*net
, struct sock
*sk
,
386 struct sk_buff
*skb
, struct net_device
*in
, struct net_device
*out
,
387 int (*okfn
)(struct net
*, struct sock
*, struct sk_buff
*))
389 return okfn(net
, sk
, skb
);
393 NF_HOOK_LIST(uint8_t pf
, unsigned int hook
, struct net
*net
, struct sock
*sk
,
394 struct list_head
*head
, struct net_device
*in
, struct net_device
*out
,
395 int (*okfn
)(struct net
*, struct sock
*, struct sk_buff
*))
400 static inline int nf_hook(u_int8_t pf
, unsigned int hook
, struct net
*net
,
401 struct sock
*sk
, struct sk_buff
*skb
,
402 struct net_device
*indev
, struct net_device
*outdev
,
403 int (*okfn
)(struct net
*, struct sock
*, struct sk_buff
*))
409 nf_nat_decode_session(struct sk_buff
*skb
, struct flowi
*fl
, u_int8_t family
)
412 #endif /*CONFIG_NETFILTER*/
414 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
415 #include <linux/netfilter/nf_conntrack_zones_common.h>
417 extern void (*ip_ct_attach
)(struct sk_buff
*, const struct sk_buff
*) __rcu
;
418 void nf_ct_attach(struct sk_buff
*, const struct sk_buff
*);
419 struct nf_conntrack_tuple
;
420 bool nf_ct_get_tuple_skb(struct nf_conntrack_tuple
*dst_tuple
,
421 const struct sk_buff
*skb
);
423 static inline void nf_ct_attach(struct sk_buff
*new, struct sk_buff
*skb
) {}
424 struct nf_conntrack_tuple
;
425 static inline bool nf_ct_get_tuple_skb(struct nf_conntrack_tuple
*dst_tuple
,
426 const struct sk_buff
*skb
)
433 enum ip_conntrack_info
;
436 int (*update
)(struct net
*net
, struct sk_buff
*skb
);
437 void (*destroy
)(struct nf_conntrack
*);
438 bool (*get_tuple_skb
)(struct nf_conntrack_tuple
*,
439 const struct sk_buff
*);
441 extern struct nf_ct_hook __rcu
*nf_ct_hook
;
445 struct nfnl_ct_hook
{
446 struct nf_conn
*(*get_ct
)(const struct sk_buff
*skb
,
447 enum ip_conntrack_info
*ctinfo
);
448 size_t (*build_size
)(const struct nf_conn
*ct
);
449 int (*build
)(struct sk_buff
*skb
, struct nf_conn
*ct
,
450 enum ip_conntrack_info ctinfo
,
451 u_int16_t ct_attr
, u_int16_t ct_info_attr
);
452 int (*parse
)(const struct nlattr
*attr
, struct nf_conn
*ct
);
453 int (*attach_expect
)(const struct nlattr
*attr
, struct nf_conn
*ct
,
454 u32 portid
, u32 report
);
455 void (*seq_adjust
)(struct sk_buff
*skb
, struct nf_conn
*ct
,
456 enum ip_conntrack_info ctinfo
, s32 off
);
458 extern struct nfnl_ct_hook __rcu
*nfnl_ct_hook
;
461 * nf_skb_duplicated - TEE target has sent a packet
463 * When a xtables target sends a packet, the OUTPUT and POSTROUTING
464 * hooks are traversed again, i.e. nft and xtables are invoked recursively.
466 * This is used by xtables TEE target to prevent the duplicated skb from
467 * being duplicated again.
469 DECLARE_PER_CPU(bool, nf_skb_duplicated
);
471 #endif /*__LINUX_NETFILTER_H*/