netfilter.h 8.7 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23
#ifndef __LINUX_NETFILTER_H
#define __LINUX_NETFILTER_H

#ifdef __KERNEL__
#include <linux/init.h>
#include <linux/types.h>
#include <linux/skbuff.h>
#include <linux/net.h>
#include <linux/if.h>
#include <linux/wait.h>
#include <linux/list.h>
#endif
#include <linux/compiler.h>

/* Responses from hook functions. */
#define NF_DROP 0
#define NF_ACCEPT 1
#define NF_STOLEN 2
#define NF_QUEUE 3
#define NF_REPEAT 4
#define NF_STOP 5
#define NF_MAX_VERDICT NF_STOP

24 25 26 27 28 29 30 31
/* we overload the higher bits for encoding auxiliary data such as the queue
 * number. Not nice, but better than additional function arguments. */
#define NF_VERDICT_MASK 0x0000ffff
#define NF_VERDICT_BITS 16

#define NF_VERDICT_QMASK 0xffff0000
#define NF_VERDICT_QBITS 16

32
#define NF_QUEUE_NR(x) (((x << NF_VERDICT_QBITS) & NF_VERDICT_QMASK) | NF_QUEUE)
33

34 35
/* only for userspace compatibility */
#ifndef __KERNEL__
L
Linus Torvalds 已提交
36 37 38 39
/* Generic cache responses from hook functions.
   <= 0x2000 is used for protocol-flags. */
#define NFC_UNKNOWN 0x4000
#define NFC_ALTERED 0x8000
40
#endif
L
Linus Torvalds 已提交
41

42 43 44 45 46 47 48 49 50
enum nf_inet_hooks {
	NF_INET_PRE_ROUTING,
	NF_INET_LOCAL_IN,
	NF_INET_FORWARD,
	NF_INET_LOCAL_OUT,
	NF_INET_POST_ROUTING,
	NF_INET_NUMHOOKS
};

51 52 53 54 55 56
union nf_inet_addr {
	u_int32_t	all[4];
	__be32		ip;
	__be32		ip6[4];
};

L
Linus Torvalds 已提交
57 58 59 60 61 62 63 64 65 66 67 68
#ifdef __KERNEL__
#ifdef CONFIG_NETFILTER

extern void netfilter_init(void);

/* Largest hook number + 1 */
#define NF_MAX_HOOKS 8

struct sk_buff;
struct net_device;

typedef unsigned int nf_hookfn(unsigned int hooknum,
69
			       struct sk_buff *skb,
L
Linus Torvalds 已提交
70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96
			       const struct net_device *in,
			       const struct net_device *out,
			       int (*okfn)(struct sk_buff *));

struct nf_hook_ops
{
	struct list_head list;

	/* User fills in from here down. */
	nf_hookfn *hook;
	struct module *owner;
	int pf;
	int hooknum;
	/* Hooks are ordered in ascending priority. */
	int priority;
};

struct nf_sockopt_ops
{
	struct list_head list;

	int pf;

	/* Non-inclusive ranges: use 0/0/NULL to never get called. */
	int set_optmin;
	int set_optmax;
	int (*set)(struct sock *sk, int optval, void __user *user, unsigned int len);
97 98
	int (*compat_set)(struct sock *sk, int optval,
			void __user *user, unsigned int len);
L
Linus Torvalds 已提交
99 100 101 102

	int get_optmin;
	int get_optmax;
	int (*get)(struct sock *sk, int optval, void __user *user, int *len);
103 104
	int (*compat_get)(struct sock *sk, int optval,
			void __user *user, int *len);
L
Linus Torvalds 已提交
105

106 107
	/* Use the module struct to lock set/get code in place */
	struct module *owner;
L
Linus Torvalds 已提交
108 109 110 111 112
};

/* Function to register/unregister hook points. */
int nf_register_hook(struct nf_hook_ops *reg);
void nf_unregister_hook(struct nf_hook_ops *reg);
113 114
int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n);
void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n);
L
Linus Torvalds 已提交
115 116 117 118 119 120

/* Functions to register get/setsockopt ranges (non-inclusive).  You
   need to check permissions yourself! */
int nf_register_sockopt(struct nf_sockopt_ops *reg);
void nf_unregister_sockopt(struct nf_sockopt_ops *reg);

121 122
#ifdef CONFIG_SYSCTL
/* Sysctl registration */
123 124
extern struct ctl_path nf_net_netfilter_sysctl_path[];
extern struct ctl_path nf_net_ipv4_netfilter_sysctl_path[];
125 126
#endif /* CONFIG_SYSCTL */

L
Linus Torvalds 已提交
127 128
extern struct list_head nf_hooks[NPROTO][NF_MAX_HOOKS];

129
int nf_hook_slow(int pf, unsigned int hook, struct sk_buff *skb,
130 131 132 133 134 135 136 137 138 139 140
		 struct net_device *indev, struct net_device *outdev,
		 int (*okfn)(struct sk_buff *), int thresh);

/**
 *	nf_hook_thresh - call a netfilter hook
 *	
 *	Returns 1 if the hook has allowed the packet to pass.  The function
 *	okfn must be invoked by the caller in this case.  Any other return
 *	value indicates the packet has been consumed by the hook.
 */
static inline int nf_hook_thresh(int pf, unsigned int hook,
141
				 struct sk_buff *skb,
142 143
				 struct net_device *indev,
				 struct net_device *outdev,
144 145
				 int (*okfn)(struct sk_buff *), int thresh,
				 int cond)
146
{
147 148
	if (!cond)
		return 1;
149 150 151 152
#ifndef CONFIG_NETFILTER_DEBUG
	if (list_empty(&nf_hooks[pf][hook]))
		return 1;
#endif
153
	return nf_hook_slow(pf, hook, skb, indev, outdev, okfn, thresh);
154 155
}

156
static inline int nf_hook(int pf, unsigned int hook, struct sk_buff *skb,
157 158 159
			  struct net_device *indev, struct net_device *outdev,
			  int (*okfn)(struct sk_buff *))
{
160
	return nf_hook_thresh(pf, hook, skb, indev, outdev, okfn, INT_MIN, 1);
161
}
L
Linus Torvalds 已提交
162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181
                   
/* Activate hook; either okfn or kfree_skb called, unless a hook
   returns NF_STOLEN (in which case, it's up to the hook to deal with
   the consequences).

   Returns -ERRNO if packet dropped.  Zero means queued, stolen or
   accepted.
*/

/* RR:
   > I don't want nf_hook to return anything because people might forget
   > about async and trust the return value to mean "packet was ok".

   AK:
   Just document it clearly, then you can expect some sense from kernel
   coders :)
*/

/* This is gross, but inline doesn't cut it for avoiding the function
   call in fast path: gcc doesn't inline (needs value tracking?). --RR */
182 183 184

/* HX: It's slightly less gross now. */

L
Linus Torvalds 已提交
185 186
#define NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, thresh)	       \
({int __ret;								       \
187
if ((__ret=nf_hook_thresh(pf, hook, (skb), indev, outdev, okfn, thresh, 1)) == 1)\
188 189 190 191 192
	__ret = (okfn)(skb);						       \
__ret;})

#define NF_HOOK_COND(pf, hook, skb, indev, outdev, okfn, cond)		       \
({int __ret;								       \
193
if ((__ret=nf_hook_thresh(pf, hook, (skb), indev, outdev, okfn, INT_MIN, cond)) == 1)\
L
Linus Torvalds 已提交
194 195 196
	__ret = (okfn)(skb);						       \
__ret;})

197 198
#define NF_HOOK(pf, hook, skb, indev, outdev, okfn) \
	NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, INT_MIN)
L
Linus Torvalds 已提交
199 200 201 202 203 204 205

/* Call setsockopt() */
int nf_setsockopt(struct sock *sk, int pf, int optval, char __user *opt, 
		  int len);
int nf_getsockopt(struct sock *sk, int pf, int optval, char __user *opt,
		  int *len);

206 207 208 209 210
int compat_nf_setsockopt(struct sock *sk, int pf, int optval,
		char __user *opt, int len);
int compat_nf_getsockopt(struct sock *sk, int pf, int optval,
		char __user *opt, int *len);

211 212 213
/* Call this before modifying an existing packet: ensures it is
   modifiable and linear to the point you care about (writable_len).
   Returns true or false. */
214
extern int skb_make_writable(struct sk_buff *skb, unsigned int writable_len);
215

216
struct flowi;
217
struct nf_queue_entry;
218

219 220
struct nf_afinfo {
	unsigned short	family;
221
	__sum16		(*checksum)(struct sk_buff *skb, unsigned int hook,
222
				    unsigned int dataoff, u_int8_t protocol);
223
	int		(*route)(struct dst_entry **dst, struct flowi *fl);
224
	void		(*saveroute)(const struct sk_buff *skb,
225
				     struct nf_queue_entry *entry);
226
	int		(*reroute)(struct sk_buff *skb,
227
				   const struct nf_queue_entry *entry);
228
	int		route_key_size;
229 230
};

231 232
extern const struct nf_afinfo *nf_afinfo[NPROTO];
static inline const struct nf_afinfo *nf_get_afinfo(unsigned short family)
233 234 235
{
	return rcu_dereference(nf_afinfo[family]);
}
236

237
static inline __sum16
238 239 240
nf_checksum(struct sk_buff *skb, unsigned int hook, unsigned int dataoff,
	    u_int8_t protocol, unsigned short family)
{
241
	const struct nf_afinfo *afinfo;
242
	__sum16 csum = 0;
243 244 245 246 247 248 249 250 251

	rcu_read_lock();
	afinfo = nf_get_afinfo(family);
	if (afinfo)
		csum = afinfo->checksum(skb, hook, dataoff, protocol);
	rcu_read_unlock();
	return csum;
}

252 253
extern int nf_register_afinfo(const struct nf_afinfo *afinfo);
extern void nf_unregister_afinfo(const struct nf_afinfo *afinfo);
254

255 256 257 258 259 260
#include <net/flow.h>
extern void (*ip_nat_decode_session)(struct sk_buff *, struct flowi *);

static inline void
nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, int family)
{
261
#ifdef CONFIG_NF_NAT_NEEDED
262 263
	void (*decodefn)(struct sk_buff *, struct flowi *);

264 265 266 267 268 269 270
	if (family == AF_INET) {
		rcu_read_lock();
		decodefn = rcu_dereference(ip_nat_decode_session);
		if (decodefn)
			decodefn(skb, fl);
		rcu_read_unlock();
	}
271 272 273
#endif
}

274 275 276 277 278
#ifdef CONFIG_PROC_FS
#include <linux/proc_fs.h>
extern struct proc_dir_entry *proc_net_netfilter;
#endif

L
Linus Torvalds 已提交
279 280
#else /* !CONFIG_NETFILTER */
#define NF_HOOK(pf, hook, skb, indev, outdev, okfn) (okfn)(skb)
281
#define NF_HOOK_COND(pf, hook, skb, indev, outdev, okfn, cond) (okfn)(skb)
282
static inline int nf_hook_thresh(int pf, unsigned int hook,
283
				 struct sk_buff *skb,
284 285
				 struct net_device *indev,
				 struct net_device *outdev,
286 287
				 int (*okfn)(struct sk_buff *), int thresh,
				 int cond)
288
{
289
	return okfn(skb);
290
}
291
static inline int nf_hook(int pf, unsigned int hook, struct sk_buff *skb,
292 293 294
			  struct net_device *indev, struct net_device *outdev,
			  int (*okfn)(struct sk_buff *))
{
295
	return 1;
296 297
}
struct flowi;
298 299
static inline void
nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, int family) {}
L
Linus Torvalds 已提交
300 301
#endif /*CONFIG_NETFILTER*/

302 303 304
#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
extern void (*ip_ct_attach)(struct sk_buff *, struct sk_buff *);
extern void nf_ct_attach(struct sk_buff *, struct sk_buff *);
305
extern void (*nf_ct_destroy)(struct nf_conntrack *);
306 307 308 309
#else
static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {}
#endif

L
Linus Torvalds 已提交
310 311
#endif /*__KERNEL__*/
#endif /*__LINUX_NETFILTER_H*/