1 #ifndef _NF_FLOW_TABLE_H
2 #define _NF_FLOW_TABLE_H
6 #include <linux/netdevice.h>
7 #include <linux/rhashtable-types.h>
8 #include <linux/rcupdate.h>
9 #include <linux/netfilter.h>
10 #include <linux/netfilter/nf_conntrack_tuple_common.h>
11 #include <net/flow_offload.h>
17 enum flow_offload_tuple_dir
;
20 struct flow_dissector_key_meta meta
;
21 struct flow_dissector_key_control control
;
22 struct flow_dissector_key_control enc_control
;
23 struct flow_dissector_key_basic basic
;
25 struct flow_dissector_key_ipv4_addrs ipv4
;
26 struct flow_dissector_key_ipv6_addrs ipv6
;
28 struct flow_dissector_key_keyid enc_key_id
;
30 struct flow_dissector_key_ipv4_addrs enc_ipv4
;
31 struct flow_dissector_key_ipv6_addrs enc_ipv6
;
33 struct flow_dissector_key_tcp tcp
;
34 struct flow_dissector_key_ports tp
;
35 } __aligned(BITS_PER_LONG
/ 8); /* Ensure that we can do comparisons as longs. */
37 struct nf_flow_match
{
38 struct flow_dissector dissector
;
39 struct nf_flow_key key
;
40 struct nf_flow_key mask
;
44 struct nf_flow_match match
;
45 struct flow_rule
*rule
;
48 struct nf_flowtable_type
{
49 struct list_head list
;
51 int (*init
)(struct nf_flowtable
*ft
);
52 int (*setup
)(struct nf_flowtable
*ft
,
53 struct net_device
*dev
,
54 enum flow_block_command cmd
);
55 int (*action
)(struct net
*net
,
56 const struct flow_offload
*flow
,
57 enum flow_offload_tuple_dir dir
,
58 struct nf_flow_rule
*flow_rule
);
59 void (*free
)(struct nf_flowtable
*ft
);
64 enum nf_flowtable_flags
{
65 NF_FLOWTABLE_HW_OFFLOAD
= 0x1, /* NFT_FLOWTABLE_HW_OFFLOAD */
66 NF_FLOWTABLE_COUNTER
= 0x2, /* NFT_FLOWTABLE_COUNTER */
70 struct list_head list
;
71 struct rhashtable rhashtable
;
73 const struct nf_flowtable_type
*type
;
74 struct delayed_work gc_work
;
76 struct flow_block flow_block
;
77 struct rw_semaphore flow_block_lock
; /* Guards flow_block */
81 static inline bool nf_flowtable_hw_offload(struct nf_flowtable
*flowtable
)
83 return flowtable
->flags
& NF_FLOWTABLE_HW_OFFLOAD
;
86 enum flow_offload_tuple_dir
{
87 FLOW_OFFLOAD_DIR_ORIGINAL
= IP_CT_DIR_ORIGINAL
,
88 FLOW_OFFLOAD_DIR_REPLY
= IP_CT_DIR_REPLY
,
90 #define FLOW_OFFLOAD_DIR_MAX IP_CT_DIR_MAX
92 enum flow_offload_xmit_type
{
93 FLOW_OFFLOAD_XMIT_NEIGH
= 0,
94 FLOW_OFFLOAD_XMIT_XFRM
,
95 FLOW_OFFLOAD_XMIT_DIRECT
,
98 #define NF_FLOW_TABLE_ENCAP_MAX 2
100 struct flow_offload_tuple
{
102 struct in_addr src_v4
;
103 struct in6_addr src_v6
;
106 struct in_addr dst_v4
;
107 struct in6_addr dst_v6
;
121 } encap
[NF_FLOW_TABLE_ENCAP_MAX
];
123 /* All members above are keys for lookups, see flow_offload_hash(). */
131 struct dst_entry
*dst_cache
;
134 u8 h_source
[ETH_ALEN
];
140 struct flow_offload_tuple_rhash
{
141 struct rhash_head node
;
142 struct flow_offload_tuple tuple
;
156 enum flow_offload_type
{
157 NF_FLOW_OFFLOAD_UNSPEC
= 0,
158 NF_FLOW_OFFLOAD_ROUTE
,
161 struct flow_offload
{
162 struct flow_offload_tuple_rhash tuplehash
[FLOW_OFFLOAD_DIR_MAX
];
167 struct rcu_head rcu_head
;
170 #define NF_FLOW_TIMEOUT (30 * HZ)
171 #define nf_flowtable_time_stamp (u32)jiffies
173 static inline __s32
nf_flow_timeout_delta(unsigned int timeout
)
175 return (__s32
)(timeout
- nf_flowtable_time_stamp
);
178 struct nf_flow_route
{
180 struct dst_entry
*dst
;
186 } encap
[NF_FLOW_TABLE_ENCAP_MAX
];
191 u8 h_source
[ETH_ALEN
];
194 enum flow_offload_xmit_type xmit_type
;
195 } tuple
[FLOW_OFFLOAD_DIR_MAX
];
198 struct flow_offload
*flow_offload_alloc(struct nf_conn
*ct
);
199 void flow_offload_free(struct flow_offload
*flow
);
202 nf_flow_table_offload_add_cb(struct nf_flowtable
*flow_table
,
203 flow_setup_cb_t
*cb
, void *cb_priv
)
205 struct flow_block
*block
= &flow_table
->flow_block
;
206 struct flow_block_cb
*block_cb
;
209 down_write(&flow_table
->flow_block_lock
);
210 block_cb
= flow_block_cb_lookup(block
, cb
, cb_priv
);
216 block_cb
= flow_block_cb_alloc(cb
, cb_priv
, cb_priv
, NULL
);
217 if (IS_ERR(block_cb
)) {
218 err
= PTR_ERR(block_cb
);
222 list_add_tail(&block_cb
->list
, &block
->cb_list
);
225 up_write(&flow_table
->flow_block_lock
);
230 nf_flow_table_offload_del_cb(struct nf_flowtable
*flow_table
,
231 flow_setup_cb_t
*cb
, void *cb_priv
)
233 struct flow_block
*block
= &flow_table
->flow_block
;
234 struct flow_block_cb
*block_cb
;
236 down_write(&flow_table
->flow_block_lock
);
237 block_cb
= flow_block_cb_lookup(block
, cb
, cb_priv
);
239 list_del(&block_cb
->list
);
240 flow_block_cb_free(block_cb
);
244 up_write(&flow_table
->flow_block_lock
);
247 int flow_offload_route_init(struct flow_offload
*flow
,
248 const struct nf_flow_route
*route
);
250 int flow_offload_add(struct nf_flowtable
*flow_table
, struct flow_offload
*flow
);
251 void flow_offload_refresh(struct nf_flowtable
*flow_table
,
252 struct flow_offload
*flow
);
254 struct flow_offload_tuple_rhash
*flow_offload_lookup(struct nf_flowtable
*flow_table
,
255 struct flow_offload_tuple
*tuple
);
256 void nf_flow_table_gc_cleanup(struct nf_flowtable
*flowtable
,
257 struct net_device
*dev
);
258 void nf_flow_table_cleanup(struct net_device
*dev
);
260 int nf_flow_table_init(struct nf_flowtable
*flow_table
);
261 void nf_flow_table_free(struct nf_flowtable
*flow_table
);
263 void flow_offload_teardown(struct flow_offload
*flow
);
265 void nf_flow_snat_port(const struct flow_offload
*flow
,
266 struct sk_buff
*skb
, unsigned int thoff
,
267 u8 protocol
, enum flow_offload_tuple_dir dir
);
268 void nf_flow_dnat_port(const struct flow_offload
*flow
,
269 struct sk_buff
*skb
, unsigned int thoff
,
270 u8 protocol
, enum flow_offload_tuple_dir dir
);
276 unsigned int nf_flow_offload_ip_hook(void *priv
, struct sk_buff
*skb
,
277 const struct nf_hook_state
*state
);
278 unsigned int nf_flow_offload_ipv6_hook(void *priv
, struct sk_buff
*skb
,
279 const struct nf_hook_state
*state
);
281 #define MODULE_ALIAS_NF_FLOWTABLE(family) \
282 MODULE_ALIAS("nf-flowtable-" __stringify(family))
284 void nf_flow_offload_add(struct nf_flowtable
*flowtable
,
285 struct flow_offload
*flow
);
286 void nf_flow_offload_del(struct nf_flowtable
*flowtable
,
287 struct flow_offload
*flow
);
288 void nf_flow_offload_stats(struct nf_flowtable
*flowtable
,
289 struct flow_offload
*flow
);
291 void nf_flow_table_offload_flush(struct nf_flowtable
*flowtable
);
292 int nf_flow_table_offload_setup(struct nf_flowtable
*flowtable
,
293 struct net_device
*dev
,
294 enum flow_block_command cmd
);
295 int nf_flow_rule_route_ipv4(struct net
*net
, const struct flow_offload
*flow
,
296 enum flow_offload_tuple_dir dir
,
297 struct nf_flow_rule
*flow_rule
);
298 int nf_flow_rule_route_ipv6(struct net
*net
, const struct flow_offload
*flow
,
299 enum flow_offload_tuple_dir dir
,
300 struct nf_flow_rule
*flow_rule
);
302 int nf_flow_table_offload_init(void);
303 void nf_flow_table_offload_exit(void);
305 #endif /* _NF_FLOW_TABLE_H */