netfilter.h 10.6 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8
#ifndef __LINUX_NETFILTER_H
#define __LINUX_NETFILTER_H

#ifdef __KERNEL__
#include <linux/init.h>
#include <linux/types.h>
#include <linux/skbuff.h>
#include <linux/net.h>
9
#include <linux/netdevice.h>
L
Linus Torvalds 已提交
10
#include <linux/if.h>
11 12
#include <linux/in.h>
#include <linux/in6.h>
L
Linus Torvalds 已提交
13 14
#include <linux/wait.h>
#include <linux/list.h>
15
#include <net/net_namespace.h>
L
Linus Torvalds 已提交
16 17 18 19 20 21 22 23 24 25 26 27
#endif
#include <linux/compiler.h>

/* Responses from hook functions. */
#define NF_DROP 0
#define NF_ACCEPT 1
#define NF_STOLEN 2
#define NF_QUEUE 3
#define NF_REPEAT 4
#define NF_STOP 5
#define NF_MAX_VERDICT NF_STOP

28 29 30 31 32 33 34 35
/* we overload the higher bits for encoding auxiliary data such as the queue
 * number. Not nice, but better than additional function arguments. */
#define NF_VERDICT_MASK 0x0000ffff
#define NF_VERDICT_BITS 16

#define NF_VERDICT_QMASK 0xffff0000
#define NF_VERDICT_QBITS 16

36
#define NF_QUEUE_NR(x) ((((x) << NF_VERDICT_BITS) & NF_VERDICT_QMASK) | NF_QUEUE)
37

38 39
/* only for userspace compatibility */
#ifndef __KERNEL__
L
Linus Torvalds 已提交
40 41 42 43
/* Generic cache responses from hook functions.
   <= 0x2000 is used for protocol-flags. */
#define NFC_UNKNOWN 0x4000
#define NFC_ALTERED 0x8000
44
#endif
L
Linus Torvalds 已提交
45

46 47 48 49 50 51 52 53 54
enum nf_inet_hooks {
	NF_INET_PRE_ROUTING,
	NF_INET_LOCAL_IN,
	NF_INET_FORWARD,
	NF_INET_LOCAL_OUT,
	NF_INET_POST_ROUTING,
	NF_INET_NUMHOOKS
};

55
union nf_inet_addr {
56
	__u32		all[4];
57 58
	__be32		ip;
	__be32		ip6[4];
59 60
	struct in_addr	in;
	struct in6_addr	in6;
61 62
};

L
Linus Torvalds 已提交
63 64 65
#ifdef __KERNEL__
#ifdef CONFIG_NETFILTER

66 67 68 69 70 71 72 73 74
static inline int nf_inet_addr_cmp(const union nf_inet_addr *a1,
				   const union nf_inet_addr *a2)
{
	return a1->all[0] == a2->all[0] &&
	       a1->all[1] == a2->all[1] &&
	       a1->all[2] == a2->all[2] &&
	       a1->all[3] == a2->all[3];
}

L
Linus Torvalds 已提交
75 76 77 78 79 80 81 82
extern void netfilter_init(void);

/* Largest hook number + 1 */
#define NF_MAX_HOOKS 8

struct sk_buff;

typedef unsigned int nf_hookfn(unsigned int hooknum,
83
			       struct sk_buff *skb,
L
Linus Torvalds 已提交
84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110
			       const struct net_device *in,
			       const struct net_device *out,
			       int (*okfn)(struct sk_buff *));

struct nf_hook_ops
{
	struct list_head list;

	/* User fills in from here down. */
	nf_hookfn *hook;
	struct module *owner;
	int pf;
	int hooknum;
	/* Hooks are ordered in ascending priority. */
	int priority;
};

struct nf_sockopt_ops
{
	struct list_head list;

	int pf;

	/* Non-inclusive ranges: use 0/0/NULL to never get called. */
	int set_optmin;
	int set_optmax;
	int (*set)(struct sock *sk, int optval, void __user *user, unsigned int len);
111 112
	int (*compat_set)(struct sock *sk, int optval,
			void __user *user, unsigned int len);
L
Linus Torvalds 已提交
113 114 115 116

	int get_optmin;
	int get_optmax;
	int (*get)(struct sock *sk, int optval, void __user *user, int *len);
117 118
	int (*compat_get)(struct sock *sk, int optval,
			void __user *user, int *len);
L
Linus Torvalds 已提交
119

120 121
	/* Use the module struct to lock set/get code in place */
	struct module *owner;
L
Linus Torvalds 已提交
122 123 124 125 126
};

/* Function to register/unregister hook points. */
int nf_register_hook(struct nf_hook_ops *reg);
void nf_unregister_hook(struct nf_hook_ops *reg);
127 128
int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n);
void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n);
L
Linus Torvalds 已提交
129 130 131 132 133 134

/* Functions to register get/setsockopt ranges (non-inclusive).  You
   need to check permissions yourself! */
int nf_register_sockopt(struct nf_sockopt_ops *reg);
void nf_unregister_sockopt(struct nf_sockopt_ops *reg);

135 136
#ifdef CONFIG_SYSCTL
/* Sysctl registration */
137 138
extern struct ctl_path nf_net_netfilter_sysctl_path[];
extern struct ctl_path nf_net_ipv4_netfilter_sysctl_path[];
139 140
#endif /* CONFIG_SYSCTL */

L
Linus Torvalds 已提交
141 142
extern struct list_head nf_hooks[NPROTO][NF_MAX_HOOKS];

143
int nf_hook_slow(int pf, unsigned int hook, struct sk_buff *skb,
144 145 146 147 148 149 150 151 152 153 154
		 struct net_device *indev, struct net_device *outdev,
		 int (*okfn)(struct sk_buff *), int thresh);

/**
 *	nf_hook_thresh - call a netfilter hook
 *	
 *	Returns 1 if the hook has allowed the packet to pass.  The function
 *	okfn must be invoked by the caller in this case.  Any other return
 *	value indicates the packet has been consumed by the hook.
 */
static inline int nf_hook_thresh(int pf, unsigned int hook,
155
				 struct sk_buff *skb,
156 157
				 struct net_device *indev,
				 struct net_device *outdev,
158 159
				 int (*okfn)(struct sk_buff *), int thresh,
				 int cond)
160
{
161 162
	if (!cond)
		return 1;
163 164 165 166
#ifndef CONFIG_NETFILTER_DEBUG
	if (list_empty(&nf_hooks[pf][hook]))
		return 1;
#endif
167
	return nf_hook_slow(pf, hook, skb, indev, outdev, okfn, thresh);
168 169
}

170
static inline int nf_hook(int pf, unsigned int hook, struct sk_buff *skb,
171 172 173
			  struct net_device *indev, struct net_device *outdev,
			  int (*okfn)(struct sk_buff *))
{
174
	return nf_hook_thresh(pf, hook, skb, indev, outdev, okfn, INT_MIN, 1);
175
}
L
Linus Torvalds 已提交
176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195
                   
/* Activate hook; either okfn or kfree_skb called, unless a hook
   returns NF_STOLEN (in which case, it's up to the hook to deal with
   the consequences).

   Returns -ERRNO if packet dropped.  Zero means queued, stolen or
   accepted.
*/

/* RR:
   > I don't want nf_hook to return anything because people might forget
   > about async and trust the return value to mean "packet was ok".

   AK:
   Just document it clearly, then you can expect some sense from kernel
   coders :)
*/

/* This is gross, but inline doesn't cut it for avoiding the function
   call in fast path: gcc doesn't inline (needs value tracking?). --RR */
196 197 198

/* HX: It's slightly less gross now. */

L
Linus Torvalds 已提交
199 200
#define NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, thresh)	       \
({int __ret;								       \
201
if ((__ret=nf_hook_thresh(pf, hook, (skb), indev, outdev, okfn, thresh, 1)) == 1)\
202 203 204 205 206
	__ret = (okfn)(skb);						       \
__ret;})

#define NF_HOOK_COND(pf, hook, skb, indev, outdev, okfn, cond)		       \
({int __ret;								       \
207
if ((__ret=nf_hook_thresh(pf, hook, (skb), indev, outdev, okfn, INT_MIN, cond)) == 1)\
L
Linus Torvalds 已提交
208 209 210
	__ret = (okfn)(skb);						       \
__ret;})

211 212
#define NF_HOOK(pf, hook, skb, indev, outdev, okfn) \
	NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, INT_MIN)
L
Linus Torvalds 已提交
213 214 215 216 217 218 219

/* Call setsockopt() */
int nf_setsockopt(struct sock *sk, int pf, int optval, char __user *opt, 
		  int len);
int nf_getsockopt(struct sock *sk, int pf, int optval, char __user *opt,
		  int *len);

220 221 222 223 224
int compat_nf_setsockopt(struct sock *sk, int pf, int optval,
		char __user *opt, int len);
int compat_nf_getsockopt(struct sock *sk, int pf, int optval,
		char __user *opt, int *len);

225 226 227
/* Call this before modifying an existing packet: ensures it is
   modifiable and linear to the point you care about (writable_len).
   Returns true or false. */
228
extern int skb_make_writable(struct sk_buff *skb, unsigned int writable_len);
229

230
struct flowi;
231
struct nf_queue_entry;
232

233 234
struct nf_afinfo {
	unsigned short	family;
235
	__sum16		(*checksum)(struct sk_buff *skb, unsigned int hook,
236
				    unsigned int dataoff, u_int8_t protocol);
237 238 239 240 241
	__sum16		(*checksum_partial)(struct sk_buff *skb,
					    unsigned int hook,
					    unsigned int dataoff,
					    unsigned int len,
					    u_int8_t protocol);
242
	int		(*route)(struct dst_entry **dst, struct flowi *fl);
243
	void		(*saveroute)(const struct sk_buff *skb,
244
				     struct nf_queue_entry *entry);
245
	int		(*reroute)(struct sk_buff *skb,
246
				   const struct nf_queue_entry *entry);
247
	int		route_key_size;
248 249
};

250 251
extern const struct nf_afinfo *nf_afinfo[NPROTO];
static inline const struct nf_afinfo *nf_get_afinfo(unsigned short family)
252 253 254
{
	return rcu_dereference(nf_afinfo[family]);
}
255

256
static inline __sum16
257 258 259
nf_checksum(struct sk_buff *skb, unsigned int hook, unsigned int dataoff,
	    u_int8_t protocol, unsigned short family)
{
260
	const struct nf_afinfo *afinfo;
261
	__sum16 csum = 0;
262 263 264 265 266 267 268 269 270

	rcu_read_lock();
	afinfo = nf_get_afinfo(family);
	if (afinfo)
		csum = afinfo->checksum(skb, hook, dataoff, protocol);
	rcu_read_unlock();
	return csum;
}

271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287
static inline __sum16
nf_checksum_partial(struct sk_buff *skb, unsigned int hook,
		    unsigned int dataoff, unsigned int len,
		    u_int8_t protocol, unsigned short family)
{
	const struct nf_afinfo *afinfo;
	__sum16 csum = 0;

	rcu_read_lock();
	afinfo = nf_get_afinfo(family);
	if (afinfo)
		csum = afinfo->checksum_partial(skb, hook, dataoff, len,
						protocol);
	rcu_read_unlock();
	return csum;
}

288 289
extern int nf_register_afinfo(const struct nf_afinfo *afinfo);
extern void nf_unregister_afinfo(const struct nf_afinfo *afinfo);
290

291 292 293 294 295 296
#include <net/flow.h>
extern void (*ip_nat_decode_session)(struct sk_buff *, struct flowi *);

static inline void
nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, int family)
{
297
#ifdef CONFIG_NF_NAT_NEEDED
298 299
	void (*decodefn)(struct sk_buff *, struct flowi *);

300 301 302 303 304 305 306
	if (family == AF_INET) {
		rcu_read_lock();
		decodefn = rcu_dereference(ip_nat_decode_session);
		if (decodefn)
			decodefn(skb, fl);
		rcu_read_unlock();
	}
307 308 309
#endif
}

310 311 312 313 314
#ifdef CONFIG_PROC_FS
#include <linux/proc_fs.h>
extern struct proc_dir_entry *proc_net_netfilter;
#endif

L
Linus Torvalds 已提交
315 316
#else /* !CONFIG_NETFILTER */
#define NF_HOOK(pf, hook, skb, indev, outdev, okfn) (okfn)(skb)
317
#define NF_HOOK_COND(pf, hook, skb, indev, outdev, okfn, cond) (okfn)(skb)
318
static inline int nf_hook_thresh(int pf, unsigned int hook,
319
				 struct sk_buff *skb,
320 321
				 struct net_device *indev,
				 struct net_device *outdev,
322 323
				 int (*okfn)(struct sk_buff *), int thresh,
				 int cond)
324
{
325
	return okfn(skb);
326
}
327
static inline int nf_hook(int pf, unsigned int hook, struct sk_buff *skb,
328 329 330
			  struct net_device *indev, struct net_device *outdev,
			  int (*okfn)(struct sk_buff *))
{
331
	return 1;
332 333
}
struct flowi;
334 335
static inline void
nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, int family) {}
L
Linus Torvalds 已提交
336 337
#endif /*CONFIG_NETFILTER*/

338 339 340
#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
extern void (*ip_ct_attach)(struct sk_buff *, struct sk_buff *);
extern void nf_ct_attach(struct sk_buff *, struct sk_buff *);
341
extern void (*nf_ct_destroy)(struct nf_conntrack *);
342 343 344 345
#else
static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {}
#endif

346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396
static inline struct net *nf_pre_routing_net(const struct net_device *in,
					     const struct net_device *out)
{
#ifdef CONFIG_NET_NS
	return in->nd_net;
#else
	return &init_net;
#endif
}

static inline struct net *nf_local_in_net(const struct net_device *in,
					  const struct net_device *out)
{
#ifdef CONFIG_NET_NS
	return in->nd_net;
#else
	return &init_net;
#endif
}

static inline struct net *nf_forward_net(const struct net_device *in,
					 const struct net_device *out)
{
#ifdef CONFIG_NET_NS
	BUG_ON(in->nd_net != out->nd_net);
	return in->nd_net;
#else
	return &init_net;
#endif
}

static inline struct net *nf_local_out_net(const struct net_device *in,
					   const struct net_device *out)
{
#ifdef CONFIG_NET_NS
	return out->nd_net;
#else
	return &init_net;
#endif
}

static inline struct net *nf_post_routing_net(const struct net_device *in,
					      const struct net_device *out)
{
#ifdef CONFIG_NET_NS
	return out->nd_net;
#else
	return &init_net;
#endif
}

L
Linus Torvalds 已提交
397 398
#endif /*__KERNEL__*/
#endif /*__LINUX_NETFILTER_H*/