1 #ifndef __LINUX_NETFILTER_H 2 #define __LINUX_NETFILTER_H 3 4 #ifdef __KERNEL__ 5 #include <linux/init.h> 6 #include <linux/skbuff.h> 7 #include <linux/net.h> 8 #include <linux/if.h> 9 #include <linux/in.h> 10 #include <linux/in6.h> 11 #include <linux/wait.h> 12 #include <linux/list.h> 13 #endif 14 #include <linux/types.h> 15 #include <linux/compiler.h> 16 17 /* Responses from hook functions. */ 18 #define NF_DROP 0 19 #define NF_ACCEPT 1 20 #define NF_STOLEN 2 21 #define NF_QUEUE 3 22 #define NF_REPEAT 4 23 #define NF_STOP 5 24 #define NF_MAX_VERDICT NF_STOP 25 26 /* we overload the higher bits for encoding auxiliary data such as the queue 27 * number or errno values. Not nice, but better than additional function 28 * arguments. */ 29 #define NF_VERDICT_MASK 0x000000ff 30 31 /* extra verdict flags have mask 0x0000ff00 */ 32 #define NF_VERDICT_FLAG_QUEUE_BYPASS 0x00008000 33 34 /* queue number (NF_QUEUE) or errno (NF_DROP) */ 35 #define NF_VERDICT_QMASK 0xffff0000 36 #define NF_VERDICT_QBITS 16 37 38 #define NF_QUEUE_NR(x) ((((x) << 16) & NF_VERDICT_QMASK) | NF_QUEUE) 39 40 #define NF_DROP_ERR(x) (((-x) << 16) | NF_DROP) 41 42 /* only for userspace compatibility */ 43 #ifndef __KERNEL__ 44 /* Generic cache responses from hook functions. 45 <= 0x2000 is used for protocol-flags. */ 46 #define NFC_UNKNOWN 0x4000 47 #define NFC_ALTERED 0x8000 48 49 /* NF_VERDICT_BITS should be 8 now, but userspace might break if this changes */ 50 #define NF_VERDICT_BITS 16 51 #endif 52 53 enum nf_inet_hooks { 54 NF_INET_PRE_ROUTING, 55 NF_INET_LOCAL_IN, 56 NF_INET_FORWARD, 57 NF_INET_LOCAL_OUT, 58 NF_INET_POST_ROUTING, 59 NF_INET_NUMHOOKS 60 }; 61 62 enum { 63 NFPROTO_UNSPEC = 0, 64 NFPROTO_IPV4 = 2, 65 NFPROTO_ARP = 3, 66 NFPROTO_BRIDGE = 7, 67 NFPROTO_IPV6 = 10, 68 NFPROTO_DECNET = 12, 69 NFPROTO_NUMPROTO, 70 }; 71 72 union nf_inet_addr { 73 __u32 all[4]; 74 __be32 ip; 75 __be32 ip6[4]; 76 struct in_addr in; 77 struct in6_addr in6; 78 }; 79 80 #ifdef __KERNEL__ 81 #ifdef CONFIG_NETFILTER 82 static inline int NF_DROP_GETERR(int verdict) 83 { 84 return -(verdict >> NF_VERDICT_QBITS); 85 } 86 87 static inline int nf_inet_addr_cmp(const union nf_inet_addr *a1, 88 const union nf_inet_addr *a2) 89 { 90 return a1->all[0] == a2->all[0] && 91 a1->all[1] == a2->all[1] && 92 a1->all[2] == a2->all[2] && 93 a1->all[3] == a2->all[3]; 94 } 95 96 extern void netfilter_init(void); 97 98 /* Largest hook number + 1 */ 99 #define NF_MAX_HOOKS 8 100 101 struct sk_buff; 102 103 typedef unsigned int nf_hookfn(unsigned int hooknum, 104 struct sk_buff *skb, 105 const struct net_device *in, 106 const struct net_device *out, 107 int (*okfn)(struct sk_buff *)); 108 109 struct nf_hook_ops { 110 struct list_head list; 111 112 /* User fills in from here down. */ 113 nf_hookfn *hook; 114 struct module *owner; 115 u_int8_t pf; 116 unsigned int hooknum; 117 /* Hooks are ordered in ascending priority. */ 118 int priority; 119 }; 120 121 struct nf_sockopt_ops { 122 struct list_head list; 123 124 u_int8_t pf; 125 126 /* Non-inclusive ranges: use 0/0/NULL to never get called. */ 127 int set_optmin; 128 int set_optmax; 129 int (*set)(struct sock *sk, int optval, void __user *user, unsigned int len); 130 #ifdef CONFIG_COMPAT 131 int (*compat_set)(struct sock *sk, int optval, 132 void __user *user, unsigned int len); 133 #endif 134 int get_optmin; 135 int get_optmax; 136 int (*get)(struct sock *sk, int optval, void __user *user, int *len); 137 #ifdef CONFIG_COMPAT 138 int (*compat_get)(struct sock *sk, int optval, 139 void __user *user, int *len); 140 #endif 141 /* Use the module struct to lock set/get code in place */ 142 struct module *owner; 143 }; 144 145 /* Function to register/unregister hook points. */ 146 int nf_register_hook(struct nf_hook_ops *reg); 147 void nf_unregister_hook(struct nf_hook_ops *reg); 148 int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n); 149 void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n); 150 151 /* Functions to register get/setsockopt ranges (non-inclusive). You 152 need to check permissions yourself! */ 153 int nf_register_sockopt(struct nf_sockopt_ops *reg); 154 void nf_unregister_sockopt(struct nf_sockopt_ops *reg); 155 156 #ifdef CONFIG_SYSCTL 157 /* Sysctl registration */ 158 extern struct ctl_path nf_net_netfilter_sysctl_path[]; 159 extern struct ctl_path nf_net_ipv4_netfilter_sysctl_path[]; 160 #endif /* CONFIG_SYSCTL */ 161 162 extern struct list_head nf_hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS]; 163 164 int nf_hook_slow(u_int8_t pf, unsigned int hook, struct sk_buff *skb, 165 struct net_device *indev, struct net_device *outdev, 166 int (*okfn)(struct sk_buff *), int thresh); 167 168 /** 169 * nf_hook_thresh - call a netfilter hook 170 * 171 * Returns 1 if the hook has allowed the packet to pass. The function 172 * okfn must be invoked by the caller in this case. Any other return 173 * value indicates the packet has been consumed by the hook. 174 */ 175 static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook, 176 struct sk_buff *skb, 177 struct net_device *indev, 178 struct net_device *outdev, 179 int (*okfn)(struct sk_buff *), int thresh) 180 { 181 #ifndef CONFIG_NETFILTER_DEBUG 182 if (list_empty(&nf_hooks[pf][hook])) 183 return 1; 184 #endif 185 return nf_hook_slow(pf, hook, skb, indev, outdev, okfn, thresh); 186 } 187 188 static inline int nf_hook(u_int8_t pf, unsigned int hook, struct sk_buff *skb, 189 struct net_device *indev, struct net_device *outdev, 190 int (*okfn)(struct sk_buff *)) 191 { 192 return nf_hook_thresh(pf, hook, skb, indev, outdev, okfn, INT_MIN); 193 } 194 195 /* Activate hook; either okfn or kfree_skb called, unless a hook 196 returns NF_STOLEN (in which case, it's up to the hook to deal with 197 the consequences). 198 199 Returns -ERRNO if packet dropped. Zero means queued, stolen or 200 accepted. 201 */ 202 203 /* RR: 204 > I don't want nf_hook to return anything because people might forget 205 > about async and trust the return value to mean "packet was ok". 206 207 AK: 208 Just document it clearly, then you can expect some sense from kernel 209 coders :) 210 */ 211 212 static inline int 213 NF_HOOK_THRESH(uint8_t pf, unsigned int hook, struct sk_buff *skb, 214 struct net_device *in, struct net_device *out, 215 int (*okfn)(struct sk_buff *), int thresh) 216 { 217 int ret = nf_hook_thresh(pf, hook, skb, in, out, okfn, thresh); 218 if (ret == 1) 219 ret = okfn(skb); 220 return ret; 221 } 222 223 static inline int 224 NF_HOOK_COND(uint8_t pf, unsigned int hook, struct sk_buff *skb, 225 struct net_device *in, struct net_device *out, 226 int (*okfn)(struct sk_buff *), bool cond) 227 { 228 int ret; 229 230 if (!cond || 231 ((ret = nf_hook_thresh(pf, hook, skb, in, out, okfn, INT_MIN)) == 1)) 232 ret = okfn(skb); 233 return ret; 234 } 235 236 static inline int 237 NF_HOOK(uint8_t pf, unsigned int hook, struct sk_buff *skb, 238 struct net_device *in, struct net_device *out, 239 int (*okfn)(struct sk_buff *)) 240 { 241 return NF_HOOK_THRESH(pf, hook, skb, in, out, okfn, INT_MIN); 242 } 243 244 /* Call setsockopt() */ 245 int nf_setsockopt(struct sock *sk, u_int8_t pf, int optval, char __user *opt, 246 unsigned int len); 247 int nf_getsockopt(struct sock *sk, u_int8_t pf, int optval, char __user *opt, 248 int *len); 249 #ifdef CONFIG_COMPAT 250 int compat_nf_setsockopt(struct sock *sk, u_int8_t pf, int optval, 251 char __user *opt, unsigned int len); 252 int compat_nf_getsockopt(struct sock *sk, u_int8_t pf, int optval, 253 char __user *opt, int *len); 254 #endif 255 256 /* Call this before modifying an existing packet: ensures it is 257 modifiable and linear to the point you care about (writable_len). 258 Returns true or false. */ 259 extern int skb_make_writable(struct sk_buff *skb, unsigned int writable_len); 260 261 struct flowi; 262 struct nf_queue_entry; 263 264 struct nf_afinfo { 265 unsigned short family; 266 __sum16 (*checksum)(struct sk_buff *skb, unsigned int hook, 267 unsigned int dataoff, u_int8_t protocol); 268 __sum16 (*checksum_partial)(struct sk_buff *skb, 269 unsigned int hook, 270 unsigned int dataoff, 271 unsigned int len, 272 u_int8_t protocol); 273 int (*route)(struct net *net, struct dst_entry **dst, 274 struct flowi *fl, bool strict); 275 void (*saveroute)(const struct sk_buff *skb, 276 struct nf_queue_entry *entry); 277 int (*reroute)(struct sk_buff *skb, 278 const struct nf_queue_entry *entry); 279 int route_key_size; 280 }; 281 282 extern const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO]; 283 static inline const struct nf_afinfo *nf_get_afinfo(unsigned short family) 284 { 285 return rcu_dereference(nf_afinfo[family]); 286 } 287 288 static inline __sum16 289 nf_checksum(struct sk_buff *skb, unsigned int hook, unsigned int dataoff, 290 u_int8_t protocol, unsigned short family) 291 { 292 const struct nf_afinfo *afinfo; 293 __sum16 csum = 0; 294 295 rcu_read_lock(); 296 afinfo = nf_get_afinfo(family); 297 if (afinfo) 298 csum = afinfo->checksum(skb, hook, dataoff, protocol); 299 rcu_read_unlock(); 300 return csum; 301 } 302 303 static inline __sum16 304 nf_checksum_partial(struct sk_buff *skb, unsigned int hook, 305 unsigned int dataoff, unsigned int len, 306 u_int8_t protocol, unsigned short family) 307 { 308 const struct nf_afinfo *afinfo; 309 __sum16 csum = 0; 310 311 rcu_read_lock(); 312 afinfo = nf_get_afinfo(family); 313 if (afinfo) 314 csum = afinfo->checksum_partial(skb, hook, dataoff, len, 315 protocol); 316 rcu_read_unlock(); 317 return csum; 318 } 319 320 extern int nf_register_afinfo(const struct nf_afinfo *afinfo); 321 extern void nf_unregister_afinfo(const struct nf_afinfo *afinfo); 322 323 #include <net/flow.h> 324 extern void (*ip_nat_decode_session)(struct sk_buff *, struct flowi *); 325 326 static inline void 327 nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family) 328 { 329 #ifdef CONFIG_NF_NAT_NEEDED 330 void (*decodefn)(struct sk_buff *, struct flowi *); 331 332 if (family == AF_INET) { 333 rcu_read_lock(); 334 decodefn = rcu_dereference(ip_nat_decode_session); 335 if (decodefn) 336 decodefn(skb, fl); 337 rcu_read_unlock(); 338 } 339 #endif 340 } 341 342 #ifdef CONFIG_PROC_FS 343 #include <linux/proc_fs.h> 344 extern struct proc_dir_entry *proc_net_netfilter; 345 #endif 346 347 #else /* !CONFIG_NETFILTER */ 348 #define NF_HOOK(pf, hook, skb, indev, outdev, okfn) (okfn)(skb) 349 #define NF_HOOK_COND(pf, hook, skb, indev, outdev, okfn, cond) (okfn)(skb) 350 static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook, 351 struct sk_buff *skb, 352 struct net_device *indev, 353 struct net_device *outdev, 354 int (*okfn)(struct sk_buff *), int thresh) 355 { 356 return okfn(skb); 357 } 358 static inline int nf_hook(u_int8_t pf, unsigned int hook, struct sk_buff *skb, 359 struct net_device *indev, struct net_device *outdev, 360 int (*okfn)(struct sk_buff *)) 361 { 362 return 1; 363 } 364 struct flowi; 365 static inline void 366 nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family) 367 { 368 } 369 #endif /*CONFIG_NETFILTER*/ 370 371 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE) 372 extern void (*ip_ct_attach)(struct sk_buff *, struct sk_buff *) __rcu; 373 extern void nf_ct_attach(struct sk_buff *, struct sk_buff *); 374 extern void (*nf_ct_destroy)(struct nf_conntrack *) __rcu; 375 #else 376 static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {} 377 #endif 378 379 #endif /*__KERNEL__*/ 380 #endif /*__LINUX_NETFILTER_H*/ 381