~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/include/linux/netfilter.h

Version: ~ [ linux-5.16-rc3 ] ~ [ linux-5.15.5 ] ~ [ linux-5.14.21 ] ~ [ linux-5.13.19 ] ~ [ linux-5.12.19 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.82 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.162 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.218 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.256 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.291 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.293 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 #ifndef __LINUX_NETFILTER_H
  2 #define __LINUX_NETFILTER_H
  3 
  4 #include <linux/init.h>
  5 #include <linux/skbuff.h>
  6 #include <linux/net.h>
  7 #include <linux/if.h>
  8 #include <linux/in.h>
  9 #include <linux/in6.h>
 10 #include <linux/wait.h>
 11 #include <linux/list.h>
 12 #include <linux/static_key.h>
 13 #include <linux/netfilter_defs.h>
 14 #include <linux/netdevice.h>
 15 #include <net/net_namespace.h>
 16 
 17 #ifdef CONFIG_NETFILTER
 18 static inline int NF_DROP_GETERR(int verdict)
 19 {
 20         return -(verdict >> NF_VERDICT_QBITS);
 21 }
 22 
 23 static inline int nf_inet_addr_cmp(const union nf_inet_addr *a1,
 24                                    const union nf_inet_addr *a2)
 25 {
 26         return a1->all[0] == a2->all[0] &&
 27                a1->all[1] == a2->all[1] &&
 28                a1->all[2] == a2->all[2] &&
 29                a1->all[3] == a2->all[3];
 30 }
 31 
 32 static inline void nf_inet_addr_mask(const union nf_inet_addr *a1,
 33                                      union nf_inet_addr *result,
 34                                      const union nf_inet_addr *mask)
 35 {
 36         result->all[0] = a1->all[0] & mask->all[0];
 37         result->all[1] = a1->all[1] & mask->all[1];
 38         result->all[2] = a1->all[2] & mask->all[2];
 39         result->all[3] = a1->all[3] & mask->all[3];
 40 }
 41 
 42 int netfilter_init(void);
 43 
 44 struct sk_buff;
 45 
 46 struct nf_hook_ops;
 47 
 48 struct sock;
 49 
 50 struct nf_hook_state {
 51         unsigned int hook;
 52         int thresh;
 53         u_int8_t pf;
 54         struct net_device *in;
 55         struct net_device *out;
 56         struct sock *sk;
 57         struct net *net;
 58         struct list_head *hook_list;
 59         int (*okfn)(struct net *, struct sock *, struct sk_buff *);
 60 };
 61 
 62 static inline void nf_hook_state_init(struct nf_hook_state *p,
 63                                       struct list_head *hook_list,
 64                                       unsigned int hook,
 65                                       int thresh, u_int8_t pf,
 66                                       struct net_device *indev,
 67                                       struct net_device *outdev,
 68                                       struct sock *sk,
 69                                       struct net *net,
 70                                       int (*okfn)(struct net *, struct sock *, struct sk_buff *))
 71 {
 72         p->hook = hook;
 73         p->thresh = thresh;
 74         p->pf = pf;
 75         p->in = indev;
 76         p->out = outdev;
 77         p->sk = sk;
 78         p->net = net;
 79         p->hook_list = hook_list;
 80         p->okfn = okfn;
 81 }
 82 
 83 typedef unsigned int nf_hookfn(void *priv,
 84                                struct sk_buff *skb,
 85                                const struct nf_hook_state *state);
 86 
 87 struct nf_hook_ops {
 88         struct list_head        list;
 89 
 90         /* User fills in from here down. */
 91         nf_hookfn               *hook;
 92         struct net_device       *dev;
 93         void                    *priv;
 94         u_int8_t                pf;
 95         unsigned int            hooknum;
 96         /* Hooks are ordered in ascending priority. */
 97         int                     priority;
 98 };
 99 
100 struct nf_sockopt_ops {
101         struct list_head list;
102 
103         u_int8_t pf;
104 
105         /* Non-inclusive ranges: use 0/0/NULL to never get called. */
106         int set_optmin;
107         int set_optmax;
108         int (*set)(struct sock *sk, int optval, void __user *user, unsigned int len);
109 #ifdef CONFIG_COMPAT
110         int (*compat_set)(struct sock *sk, int optval,
111                         void __user *user, unsigned int len);
112 #endif
113         int get_optmin;
114         int get_optmax;
115         int (*get)(struct sock *sk, int optval, void __user *user, int *len);
116 #ifdef CONFIG_COMPAT
117         int (*compat_get)(struct sock *sk, int optval,
118                         void __user *user, int *len);
119 #endif
120         /* Use the module struct to lock set/get code in place */
121         struct module *owner;
122 };
123 
124 /* Function to register/unregister hook points. */
125 int nf_register_net_hook(struct net *net, const struct nf_hook_ops *ops);
126 void nf_unregister_net_hook(struct net *net, const struct nf_hook_ops *ops);
127 int nf_register_net_hooks(struct net *net, const struct nf_hook_ops *reg,
128                           unsigned int n);
129 void nf_unregister_net_hooks(struct net *net, const struct nf_hook_ops *reg,
130                              unsigned int n);
131 
132 int nf_register_hook(struct nf_hook_ops *reg);
133 void nf_unregister_hook(struct nf_hook_ops *reg);
134 int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n);
135 void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n);
136 
137 /* Functions to register get/setsockopt ranges (non-inclusive).  You
138    need to check permissions yourself! */
139 int nf_register_sockopt(struct nf_sockopt_ops *reg);
140 void nf_unregister_sockopt(struct nf_sockopt_ops *reg);
141 
142 #ifdef HAVE_JUMP_LABEL
143 extern struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
144 
145 static inline bool nf_hook_list_active(struct list_head *hook_list,
146                                        u_int8_t pf, unsigned int hook)
147 {
148         if (__builtin_constant_p(pf) &&
149             __builtin_constant_p(hook))
150                 return static_key_false(&nf_hooks_needed[pf][hook]);
151 
152         return !list_empty(hook_list);
153 }
154 #else
155 static inline bool nf_hook_list_active(struct list_head *hook_list,
156                                        u_int8_t pf, unsigned int hook)
157 {
158         return !list_empty(hook_list);
159 }
160 #endif
161 
162 int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state);
163 
164 /**
165  *      nf_hook_thresh - call a netfilter hook
166  *
167  *      Returns 1 if the hook has allowed the packet to pass.  The function
168  *      okfn must be invoked by the caller in this case.  Any other return
169  *      value indicates the packet has been consumed by the hook.
170  */
171 static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook,
172                                  struct net *net,
173                                  struct sock *sk,
174                                  struct sk_buff *skb,
175                                  struct net_device *indev,
176                                  struct net_device *outdev,
177                                  int (*okfn)(struct net *, struct sock *, struct sk_buff *),
178                                  int thresh)
179 {
180         struct list_head *hook_list = &net->nf.hooks[pf][hook];
181 
182         if (nf_hook_list_active(hook_list, pf, hook)) {
183                 struct nf_hook_state state;
184 
185                 nf_hook_state_init(&state, hook_list, hook, thresh,
186                                    pf, indev, outdev, sk, net, okfn);
187                 return nf_hook_slow(skb, &state);
188         }
189         return 1;
190 }
191 
192 static inline int nf_hook(u_int8_t pf, unsigned int hook, struct net *net,
193                           struct sock *sk, struct sk_buff *skb,
194                           struct net_device *indev, struct net_device *outdev,
195                           int (*okfn)(struct net *, struct sock *, struct sk_buff *))
196 {
197         return nf_hook_thresh(pf, hook, net, sk, skb, indev, outdev, okfn, INT_MIN);
198 }
199                    
200 /* Activate hook; either okfn or kfree_skb called, unless a hook
201    returns NF_STOLEN (in which case, it's up to the hook to deal with
202    the consequences).
203 
204    Returns -ERRNO if packet dropped.  Zero means queued, stolen or
205    accepted.
206 */
207 
208 /* RR:
209    > I don't want nf_hook to return anything because people might forget
210    > about async and trust the return value to mean "packet was ok".
211 
212    AK:
213    Just document it clearly, then you can expect some sense from kernel
214    coders :)
215 */
216 
217 static inline int
218 NF_HOOK_THRESH(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk,
219                struct sk_buff *skb, struct net_device *in,
220                struct net_device *out,
221                int (*okfn)(struct net *, struct sock *, struct sk_buff *),
222                int thresh)
223 {
224         int ret = nf_hook_thresh(pf, hook, net, sk, skb, in, out, okfn, thresh);
225         if (ret == 1)
226                 ret = okfn(net, sk, skb);
227         return ret;
228 }
229 
230 static inline int
231 NF_HOOK_COND(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk,
232              struct sk_buff *skb, struct net_device *in, struct net_device *out,
233              int (*okfn)(struct net *, struct sock *, struct sk_buff *),
234              bool cond)
235 {
236         int ret;
237 
238         if (!cond ||
239             ((ret = nf_hook_thresh(pf, hook, net, sk, skb, in, out, okfn, INT_MIN)) == 1))
240                 ret = okfn(net, sk, skb);
241         return ret;
242 }
243 
244 static inline int
245 NF_HOOK(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk, struct sk_buff *skb,
246         struct net_device *in, struct net_device *out,
247         int (*okfn)(struct net *, struct sock *, struct sk_buff *))
248 {
249         return NF_HOOK_THRESH(pf, hook, net, sk, skb, in, out, okfn, INT_MIN);
250 }
251 
252 /* Call setsockopt() */
253 int nf_setsockopt(struct sock *sk, u_int8_t pf, int optval, char __user *opt,
254                   unsigned int len);
255 int nf_getsockopt(struct sock *sk, u_int8_t pf, int optval, char __user *opt,
256                   int *len);
257 #ifdef CONFIG_COMPAT
258 int compat_nf_setsockopt(struct sock *sk, u_int8_t pf, int optval,
259                 char __user *opt, unsigned int len);
260 int compat_nf_getsockopt(struct sock *sk, u_int8_t pf, int optval,
261                 char __user *opt, int *len);
262 #endif
263 
264 /* Call this before modifying an existing packet: ensures it is
265    modifiable and linear to the point you care about (writable_len).
266    Returns true or false. */
267 int skb_make_writable(struct sk_buff *skb, unsigned int writable_len);
268 
269 struct flowi;
270 struct nf_queue_entry;
271 
272 struct nf_afinfo {
273         unsigned short  family;
274         __sum16         (*checksum)(struct sk_buff *skb, unsigned int hook,
275                                     unsigned int dataoff, u_int8_t protocol);
276         __sum16         (*checksum_partial)(struct sk_buff *skb,
277                                             unsigned int hook,
278                                             unsigned int dataoff,
279                                             unsigned int len,
280                                             u_int8_t protocol);
281         int             (*route)(struct net *net, struct dst_entry **dst,
282                                  struct flowi *fl, bool strict);
283         void            (*saveroute)(const struct sk_buff *skb,
284                                      struct nf_queue_entry *entry);
285         int             (*reroute)(struct net *net, struct sk_buff *skb,
286                                    const struct nf_queue_entry *entry);
287         int             route_key_size;
288 };
289 
290 extern const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO];
291 static inline const struct nf_afinfo *nf_get_afinfo(unsigned short family)
292 {
293         return rcu_dereference(nf_afinfo[family]);
294 }
295 
296 static inline __sum16
297 nf_checksum(struct sk_buff *skb, unsigned int hook, unsigned int dataoff,
298             u_int8_t protocol, unsigned short family)
299 {
300         const struct nf_afinfo *afinfo;
301         __sum16 csum = 0;
302 
303         rcu_read_lock();
304         afinfo = nf_get_afinfo(family);
305         if (afinfo)
306                 csum = afinfo->checksum(skb, hook, dataoff, protocol);
307         rcu_read_unlock();
308         return csum;
309 }
310 
311 static inline __sum16
312 nf_checksum_partial(struct sk_buff *skb, unsigned int hook,
313                     unsigned int dataoff, unsigned int len,
314                     u_int8_t protocol, unsigned short family)
315 {
316         const struct nf_afinfo *afinfo;
317         __sum16 csum = 0;
318 
319         rcu_read_lock();
320         afinfo = nf_get_afinfo(family);
321         if (afinfo)
322                 csum = afinfo->checksum_partial(skb, hook, dataoff, len,
323                                                 protocol);
324         rcu_read_unlock();
325         return csum;
326 }
327 
328 int nf_register_afinfo(const struct nf_afinfo *afinfo);
329 void nf_unregister_afinfo(const struct nf_afinfo *afinfo);
330 
331 #include <net/flow.h>
332 extern void (*nf_nat_decode_session_hook)(struct sk_buff *, struct flowi *);
333 
334 static inline void
335 nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family)
336 {
337 #ifdef CONFIG_NF_NAT_NEEDED
338         void (*decodefn)(struct sk_buff *, struct flowi *);
339 
340         rcu_read_lock();
341         decodefn = rcu_dereference(nf_nat_decode_session_hook);
342         if (decodefn)
343                 decodefn(skb, fl);
344         rcu_read_unlock();
345 #endif
346 }
347 
348 #else /* !CONFIG_NETFILTER */
349 static inline int
350 NF_HOOK_COND(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk,
351              struct sk_buff *skb, struct net_device *in, struct net_device *out,
352              int (*okfn)(struct net *, struct sock *, struct sk_buff *),
353              bool cond)
354 {
355         return okfn(net, sk, skb);
356 }
357 
358 static inline int
359 NF_HOOK(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk,
360         struct sk_buff *skb, struct net_device *in, struct net_device *out,
361         int (*okfn)(struct net *, struct sock *, struct sk_buff *))
362 {
363         return okfn(net, sk, skb);
364 }
365 
366 static inline int nf_hook(u_int8_t pf, unsigned int hook, struct net *net,
367                           struct sock *sk, struct sk_buff *skb,
368                           struct net_device *indev, struct net_device *outdev,
369                           int (*okfn)(struct net *, struct sock *, struct sk_buff *))
370 {
371         return 1;
372 }
373 struct flowi;
374 static inline void
375 nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family)
376 {
377 }
378 #endif /*CONFIG_NETFILTER*/
379 
380 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
381 #include <linux/netfilter/nf_conntrack_zones_common.h>
382 
383 extern void (*ip_ct_attach)(struct sk_buff *, const struct sk_buff *) __rcu;
384 void nf_ct_attach(struct sk_buff *, const struct sk_buff *);
385 extern void (*nf_ct_destroy)(struct nf_conntrack *) __rcu;
386 #else
387 static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {}
388 #endif
389 
390 struct nf_conn;
391 enum ip_conntrack_info;
392 struct nlattr;
393 
394 struct nfnl_ct_hook {
395         struct nf_conn *(*get_ct)(const struct sk_buff *skb,
396                                   enum ip_conntrack_info *ctinfo);
397         size_t (*build_size)(const struct nf_conn *ct);
398         int (*build)(struct sk_buff *skb, struct nf_conn *ct,
399                      enum ip_conntrack_info ctinfo,
400                      u_int16_t ct_attr, u_int16_t ct_info_attr);
401         int (*parse)(const struct nlattr *attr, struct nf_conn *ct);
402         int (*attach_expect)(const struct nlattr *attr, struct nf_conn *ct,
403                              u32 portid, u32 report);
404         void (*seq_adjust)(struct sk_buff *skb, struct nf_conn *ct,
405                            enum ip_conntrack_info ctinfo, s32 off);
406 };
407 extern struct nfnl_ct_hook __rcu *nfnl_ct_hook;
408 
409 /**
410  * nf_skb_duplicated - TEE target has sent a packet
411  *
412  * When a xtables target sends a packet, the OUTPUT and POSTROUTING
413  * hooks are traversed again, i.e. nft and xtables are invoked recursively.
414  *
415  * This is used by xtables TEE target to prevent the duplicated skb from
416  * being duplicated again.
417  */
418 DECLARE_PER_CPU(bool, nf_skb_duplicated);
419 
420 #endif /*__LINUX_NETFILTER_H*/
421 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp