netfilter.h 11.8 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23
#ifndef __LINUX_NETFILTER_H
#define __LINUX_NETFILTER_H

#ifdef __KERNEL__
#include <linux/init.h>
#include <linux/types.h>
#include <linux/skbuff.h>
#include <linux/net.h>
#include <linux/if.h>
#include <linux/wait.h>
#include <linux/list.h>
#endif
#include <linux/compiler.h>

/* Responses from hook functions. */
#define NF_DROP 0
#define NF_ACCEPT 1
#define NF_STOLEN 2
#define NF_QUEUE 3
#define NF_REPEAT 4
#define NF_STOP 5
#define NF_MAX_VERDICT NF_STOP

24 25 26 27 28 29 30 31
/* we overload the higher bits for encoding auxiliary data such as the queue
 * number. Not nice, but better than additional function arguments. */
#define NF_VERDICT_MASK 0x0000ffff
#define NF_VERDICT_BITS 16

#define NF_VERDICT_QMASK 0xffff0000
#define NF_VERDICT_QBITS 16

32
#define NF_QUEUE_NR(x) (((x << NF_VERDICT_QBITS) & NF_VERDICT_QMASK) | NF_QUEUE)
33

34 35
/* only for userspace compatibility */
#ifndef __KERNEL__
L
Linus Torvalds 已提交
36 37 38 39
/* Generic cache responses from hook functions.
   <= 0x2000 is used for protocol-flags. */
#define NFC_UNKNOWN 0x4000
#define NFC_ALTERED 0x8000
40
#endif
L
Linus Torvalds 已提交
41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81

#ifdef __KERNEL__
#ifdef CONFIG_NETFILTER

extern void netfilter_init(void);

/* Largest hook number + 1 */
#define NF_MAX_HOOKS 8

struct sk_buff;
struct net_device;

typedef unsigned int nf_hookfn(unsigned int hooknum,
			       struct sk_buff **skb,
			       const struct net_device *in,
			       const struct net_device *out,
			       int (*okfn)(struct sk_buff *));

struct nf_hook_ops
{
	struct list_head list;

	/* User fills in from here down. */
	nf_hookfn *hook;
	struct module *owner;
	int pf;
	int hooknum;
	/* Hooks are ordered in ascending priority. */
	int priority;
};

struct nf_sockopt_ops
{
	struct list_head list;

	int pf;

	/* Non-inclusive ranges: use 0/0/NULL to never get called. */
	int set_optmin;
	int set_optmax;
	int (*set)(struct sock *sk, int optval, void __user *user, unsigned int len);
82 83
	int (*compat_set)(struct sock *sk, int optval,
			void __user *user, unsigned int len);
L
Linus Torvalds 已提交
84 85 86 87

	int get_optmin;
	int get_optmax;
	int (*get)(struct sock *sk, int optval, void __user *user, int *len);
88 89
	int (*compat_get)(struct sock *sk, int optval,
			void __user *user, int *len);
L
Linus Torvalds 已提交
90

91 92
	/* Use the module struct to lock set/get code in place */
	struct module *owner;
L
Linus Torvalds 已提交
93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110
};

/* Each queued (to userspace) skbuff has one of these. */
struct nf_info
{
	/* The ops struct which sent us to userspace. */
	struct nf_hook_ops *elem;
	
	/* If we're sent to userspace, this keeps housekeeping info */
	int pf;
	unsigned int hook;
	struct net_device *indev, *outdev;
	int (*okfn)(struct sk_buff *);
};
                                                                                
/* Function to register/unregister hook points. */
int nf_register_hook(struct nf_hook_ops *reg);
void nf_unregister_hook(struct nf_hook_ops *reg);
111 112
int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n);
void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n);
L
Linus Torvalds 已提交
113 114 115 116 117 118

/* Functions to register get/setsockopt ranges (non-inclusive).  You
   need to check permissions yourself! */
int nf_register_sockopt(struct nf_sockopt_ops *reg);
void nf_unregister_sockopt(struct nf_sockopt_ops *reg);

119 120 121 122 123 124 125 126 127 128
#ifdef CONFIG_SYSCTL
/* Sysctl registration */
struct ctl_table_header *nf_register_sysctl_table(struct ctl_table *path,
						  struct ctl_table *table);
void nf_unregister_sysctl_table(struct ctl_table_header *header,
				struct ctl_table *table);
extern struct ctl_table nf_net_netfilter_sysctl_path[];
extern struct ctl_table nf_net_ipv4_netfilter_sysctl_path[];
#endif /* CONFIG_SYSCTL */

L
Linus Torvalds 已提交
129 130
extern struct list_head nf_hooks[NPROTO][NF_MAX_HOOKS];

131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159
/* those NF_LOG_* defines and struct nf_loginfo are legacy definitios that will
 * disappear once iptables is replaced with pkttables.  Please DO NOT use them
 * for any new code! */
#define NF_LOG_TCPSEQ		0x01	/* Log TCP sequence numbers */
#define NF_LOG_TCPOPT		0x02	/* Log TCP options */
#define NF_LOG_IPOPT		0x04	/* Log IP options */
#define NF_LOG_UID		0x08	/* Log UID owning local socket */
#define NF_LOG_MASK		0x0f

#define NF_LOG_TYPE_LOG		0x01
#define NF_LOG_TYPE_ULOG	0x02

struct nf_loginfo {
	u_int8_t type;
	union {
		struct {
			u_int32_t copy_len;
			u_int16_t group;
			u_int16_t qthreshold;
		} ulog;
		struct {
			u_int8_t level;
			u_int8_t logflags;
		} log;
	} u;
};

typedef void nf_logfn(unsigned int pf,
		      unsigned int hooknum,
L
Linus Torvalds 已提交
160 161 162
		      const struct sk_buff *skb,
		      const struct net_device *in,
		      const struct net_device *out,
163
		      const struct nf_loginfo *li,
L
Linus Torvalds 已提交
164 165
		      const char *prefix);

166 167 168 169 170 171
struct nf_logger {
	struct module	*me;
	nf_logfn 	*logfn;
	char		*name;
};

L
Linus Torvalds 已提交
172
/* Function to register/unregister log function. */
173
int nf_log_register(int pf, struct nf_logger *logger);
174
void nf_log_unregister(struct nf_logger *logger);
175
void nf_log_unregister_pf(int pf);
L
Linus Torvalds 已提交
176 177 178 179 180 181 182

/* Calls the registered backend logging function */
void nf_log_packet(int pf,
		   unsigned int hooknum,
		   const struct sk_buff *skb,
		   const struct net_device *in,
		   const struct net_device *out,
183
		   struct nf_loginfo *li,
L
Linus Torvalds 已提交
184
		   const char *fmt, ...);
185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200

int nf_hook_slow(int pf, unsigned int hook, struct sk_buff **pskb,
		 struct net_device *indev, struct net_device *outdev,
		 int (*okfn)(struct sk_buff *), int thresh);

/**
 *	nf_hook_thresh - call a netfilter hook
 *	
 *	Returns 1 if the hook has allowed the packet to pass.  The function
 *	okfn must be invoked by the caller in this case.  Any other return
 *	value indicates the packet has been consumed by the hook.
 */
static inline int nf_hook_thresh(int pf, unsigned int hook,
				 struct sk_buff **pskb,
				 struct net_device *indev,
				 struct net_device *outdev,
201 202
				 int (*okfn)(struct sk_buff *), int thresh,
				 int cond)
203
{
204 205
	if (!cond)
		return 1;
206 207 208 209 210 211 212 213 214 215 216
#ifndef CONFIG_NETFILTER_DEBUG
	if (list_empty(&nf_hooks[pf][hook]))
		return 1;
#endif
	return nf_hook_slow(pf, hook, pskb, indev, outdev, okfn, thresh);
}

static inline int nf_hook(int pf, unsigned int hook, struct sk_buff **pskb,
			  struct net_device *indev, struct net_device *outdev,
			  int (*okfn)(struct sk_buff *))
{
217
	return nf_hook_thresh(pf, hook, pskb, indev, outdev, okfn, INT_MIN, 1);
218
}
L
Linus Torvalds 已提交
219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238
                   
/* Activate hook; either okfn or kfree_skb called, unless a hook
   returns NF_STOLEN (in which case, it's up to the hook to deal with
   the consequences).

   Returns -ERRNO if packet dropped.  Zero means queued, stolen or
   accepted.
*/

/* RR:
   > I don't want nf_hook to return anything because people might forget
   > about async and trust the return value to mean "packet was ok".

   AK:
   Just document it clearly, then you can expect some sense from kernel
   coders :)
*/

/* This is gross, but inline doesn't cut it for avoiding the function
   call in fast path: gcc doesn't inline (needs value tracking?). --RR */
239 240 241

/* HX: It's slightly less gross now. */

L
Linus Torvalds 已提交
242 243
#define NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, thresh)	       \
({int __ret;								       \
244 245 246 247 248 249 250
if ((__ret=nf_hook_thresh(pf, hook, &(skb), indev, outdev, okfn, thresh, 1)) == 1)\
	__ret = (okfn)(skb);						       \
__ret;})

#define NF_HOOK_COND(pf, hook, skb, indev, outdev, okfn, cond)		       \
({int __ret;								       \
if ((__ret=nf_hook_thresh(pf, hook, &(skb), indev, outdev, okfn, INT_MIN, cond)) == 1)\
L
Linus Torvalds 已提交
251 252 253
	__ret = (okfn)(skb);						       \
__ret;})

254 255
#define NF_HOOK(pf, hook, skb, indev, outdev, okfn) \
	NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, INT_MIN)
L
Linus Torvalds 已提交
256 257 258 259 260 261 262

/* Call setsockopt() */
int nf_setsockopt(struct sock *sk, int pf, int optval, char __user *opt, 
		  int len);
int nf_getsockopt(struct sock *sk, int pf, int optval, char __user *opt,
		  int *len);

263 264 265 266 267
int compat_nf_setsockopt(struct sock *sk, int pf, int optval,
		char __user *opt, int len);
int compat_nf_getsockopt(struct sock *sk, int pf, int optval,
		char __user *opt, int *len);

L
Linus Torvalds 已提交
268
/* Packet queuing */
269 270 271 272 273 274
struct nf_queue_handler {
	int (*outfn)(struct sk_buff *skb, struct nf_info *info,
		     unsigned int queuenum, void *data);
	void *data;
	char *name;
};
L
Linus Torvalds 已提交
275
extern int nf_register_queue_handler(int pf, 
276
                                     struct nf_queue_handler *qh);
277 278
extern int nf_unregister_queue_handler(int pf,
				       struct nf_queue_handler *qh);
279
extern void nf_unregister_queue_handlers(struct nf_queue_handler *qh);
L
Linus Torvalds 已提交
280 281 282 283 284 285 286
extern void nf_reinject(struct sk_buff *skb,
			struct nf_info *info,
			unsigned int verdict);

/* FIXME: Before cache is ever used, this must be implemented for real. */
extern void nf_invalidate_cache(int pf);

287 288 289 290 291
/* Call this before modifying an existing packet: ensures it is
   modifiable and linear to the point you care about (writable_len).
   Returns true or false. */
extern int skb_make_writable(struct sk_buff **pskb, unsigned int writable_len);

A
Al Viro 已提交
292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312
static inline void nf_csum_replace4(__sum16 *sum, __be32 from, __be32 to)
{
	__be32 diff[] = { ~from, to };

	*sum = csum_fold(csum_partial((char *)diff, sizeof(diff), ~csum_unfold(*sum)));
}

static inline void nf_csum_replace2(__sum16 *sum, __be16 from, __be16 to)
{
	nf_csum_replace4(sum, (__force __be32)from, (__force __be32)to);
}

extern void nf_proto_csum_replace4(__sum16 *sum, struct sk_buff *skb,
				      __be32 from, __be32 to, int pseudohdr);

static inline void nf_proto_csum_replace2(__sum16 *sum, struct sk_buff *skb,
				      __be16 from, __be16 to, int pseudohdr)
{
	nf_proto_csum_replace4(sum, skb, (__force __be32)from,
				(__force __be32)to, pseudohdr);
}
313

314 315
struct nf_afinfo {
	unsigned short	family;
316
	__sum16		(*checksum)(struct sk_buff *skb, unsigned int hook,
317
				    unsigned int dataoff, u_int8_t protocol);
318 319 320 321 322
	void		(*saveroute)(const struct sk_buff *skb,
				     struct nf_info *info);
	int		(*reroute)(struct sk_buff **skb,
				   const struct nf_info *info);
	int		route_key_size;
323 324
};

325 326 327 328 329
extern struct nf_afinfo *nf_afinfo[];
static inline struct nf_afinfo *nf_get_afinfo(unsigned short family)
{
	return rcu_dereference(nf_afinfo[family]);
}
330

331
static inline __sum16
332 333 334 335
nf_checksum(struct sk_buff *skb, unsigned int hook, unsigned int dataoff,
	    u_int8_t protocol, unsigned short family)
{
	struct nf_afinfo *afinfo;
336
	__sum16 csum = 0;
337 338 339 340 341 342 343 344 345

	rcu_read_lock();
	afinfo = nf_get_afinfo(family);
	if (afinfo)
		csum = afinfo->checksum(skb, hook, dataoff, protocol);
	rcu_read_unlock();
	return csum;
}

346 347 348 349
extern int nf_register_afinfo(struct nf_afinfo *afinfo);
extern void nf_unregister_afinfo(struct nf_afinfo *afinfo);

#define nf_info_reroute(x) ((void *)x + sizeof(struct nf_info))
350

351 352 353 354 355 356
#include <net/flow.h>
extern void (*ip_nat_decode_session)(struct sk_buff *, struct flowi *);

static inline void
nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, int family)
{
357
#if defined(CONFIG_IP_NF_NAT_NEEDED) || defined(CONFIG_NF_NAT_NEEDED)
358 359 360 361 362 363 364
	void (*decodefn)(struct sk_buff *, struct flowi *);

	if (family == AF_INET && (decodefn = ip_nat_decode_session) != NULL)
		decodefn(skb, fl);
#endif
}

365 366 367 368 369
#ifdef CONFIG_PROC_FS
#include <linux/proc_fs.h>
extern struct proc_dir_entry *proc_net_netfilter;
#endif

L
Linus Torvalds 已提交
370 371
#else /* !CONFIG_NETFILTER */
#define NF_HOOK(pf, hook, skb, indev, outdev, okfn) (okfn)(skb)
372
#define NF_HOOK_COND(pf, hook, skb, indev, outdev, okfn, cond) (okfn)(skb)
373 374 375 376
static inline int nf_hook_thresh(int pf, unsigned int hook,
				 struct sk_buff **pskb,
				 struct net_device *indev,
				 struct net_device *outdev,
377 378
				 int (*okfn)(struct sk_buff *), int thresh,
				 int cond)
379 380 381 382 383 384 385
{
	return okfn(*pskb);
}
static inline int nf_hook(int pf, unsigned int hook, struct sk_buff **pskb,
			  struct net_device *indev, struct net_device *outdev,
			  int (*okfn)(struct sk_buff *))
{
386
	return 1;
387 388
}
struct flowi;
389 390
static inline void
nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, int family) {}
L
Linus Torvalds 已提交
391 392
#endif /*CONFIG_NETFILTER*/

393 394 395
#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
extern void (*ip_ct_attach)(struct sk_buff *, struct sk_buff *);
extern void nf_ct_attach(struct sk_buff *, struct sk_buff *);
396
extern void (*nf_ct_destroy)(struct nf_conntrack *);
397 398 399 400
#else
static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {}
#endif

L
Linus Torvalds 已提交
401 402
#endif /*__KERNEL__*/
#endif /*__LINUX_NETFILTER_H*/