~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/include/linux/netfilter/x_tables.h

Version: ~ [ linux-5.3 ] ~ [ linux-5.2.15 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.73 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.144 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.193 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.193 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.73 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 #ifndef _X_TABLES_H
  2 #define _X_TABLES_H
  3 
  4 
  5 #include <linux/netdevice.h>
  6 #include <linux/static_key.h>
  7 #include <uapi/linux/netfilter/x_tables.h>
  8 
  9 /**
 10  * struct xt_action_param - parameters for matches/targets
 11  *
 12  * @match:      the match extension
 13  * @target:     the target extension
 14  * @matchinfo:  per-match data
 15  * @targetinfo: per-target data
 16  * @net         network namespace through which the action was invoked
 17  * @in:         input netdevice
 18  * @out:        output netdevice
 19  * @fragoff:    packet is a fragment, this is the data offset
 20  * @thoff:      position of transport header relative to skb->data
 21  * @hook:       hook number given packet came from
 22  * @family:     Actual NFPROTO_* through which the function is invoked
 23  *              (helpful when match->family == NFPROTO_UNSPEC)
 24  *
 25  * Fields written to by extensions:
 26  *
 27  * @hotdrop:    drop packet if we had inspection problems
 28  */
 29 struct xt_action_param {
 30         union {
 31                 const struct xt_match *match;
 32                 const struct xt_target *target;
 33         };
 34         union {
 35                 const void *matchinfo, *targinfo;
 36         };
 37         struct net *net;
 38         const struct net_device *in, *out;
 39         int fragoff;
 40         unsigned int thoff;
 41         unsigned int hooknum;
 42         u_int8_t family;
 43         bool hotdrop;
 44 };
 45 
 46 /**
 47  * struct xt_mtchk_param - parameters for match extensions'
 48  * checkentry functions
 49  *
 50  * @net:        network namespace through which the check was invoked
 51  * @table:      table the rule is tried to be inserted into
 52  * @entryinfo:  the family-specific rule data
 53  *              (struct ipt_ip, ip6t_ip, arpt_arp or (note) ebt_entry)
 54  * @match:      struct xt_match through which this function was invoked
 55  * @matchinfo:  per-match data
 56  * @hook_mask:  via which hooks the new rule is reachable
 57  * Other fields as above.
 58  */
 59 struct xt_mtchk_param {
 60         struct net *net;
 61         const char *table;
 62         const void *entryinfo;
 63         const struct xt_match *match;
 64         void *matchinfo;
 65         unsigned int hook_mask;
 66         u_int8_t family;
 67         bool nft_compat;
 68 };
 69 
 70 /**
 71  * struct xt_mdtor_param - match destructor parameters
 72  * Fields as above.
 73  */
 74 struct xt_mtdtor_param {
 75         struct net *net;
 76         const struct xt_match *match;
 77         void *matchinfo;
 78         u_int8_t family;
 79 };
 80 
 81 /**
 82  * struct xt_tgchk_param - parameters for target extensions'
 83  * checkentry functions
 84  *
 85  * @entryinfo:  the family-specific rule data
 86  *              (struct ipt_entry, ip6t_entry, arpt_entry, ebt_entry)
 87  *
 88  * Other fields see above.
 89  */
 90 struct xt_tgchk_param {
 91         struct net *net;
 92         const char *table;
 93         const void *entryinfo;
 94         const struct xt_target *target;
 95         void *targinfo;
 96         unsigned int hook_mask;
 97         u_int8_t family;
 98         bool nft_compat;
 99 };
100 
101 /* Target destructor parameters */
102 struct xt_tgdtor_param {
103         struct net *net;
104         const struct xt_target *target;
105         void *targinfo;
106         u_int8_t family;
107 };
108 
109 struct xt_match {
110         struct list_head list;
111 
112         const char name[XT_EXTENSION_MAXNAMELEN];
113         u_int8_t revision;
114 
115         /* Return true or false: return FALSE and set *hotdrop = 1 to
116            force immediate packet drop. */
117         /* Arguments changed since 2.6.9, as this must now handle
118            non-linear skb, using skb_header_pointer and
119            skb_ip_make_writable. */
120         bool (*match)(const struct sk_buff *skb,
121                       struct xt_action_param *);
122 
123         /* Called when user tries to insert an entry of this type. */
124         int (*checkentry)(const struct xt_mtchk_param *);
125 
126         /* Called when entry of this type deleted. */
127         void (*destroy)(const struct xt_mtdtor_param *);
128 #ifdef CONFIG_COMPAT
129         /* Called when userspace align differs from kernel space one */
130         void (*compat_from_user)(void *dst, const void *src);
131         int (*compat_to_user)(void __user *dst, const void *src);
132 #endif
133         /* Set this to THIS_MODULE if you are a module, otherwise NULL */
134         struct module *me;
135 
136         const char *table;
137         unsigned int matchsize;
138 #ifdef CONFIG_COMPAT
139         unsigned int compatsize;
140 #endif
141         unsigned int hooks;
142         unsigned short proto;
143 
144         unsigned short family;
145 };
146 
147 /* Registration hooks for targets. */
148 struct xt_target {
149         struct list_head list;
150 
151         const char name[XT_EXTENSION_MAXNAMELEN];
152         u_int8_t revision;
153 
154         /* Returns verdict. Argument order changed since 2.6.9, as this
155            must now handle non-linear skbs, using skb_copy_bits and
156            skb_ip_make_writable. */
157         unsigned int (*target)(struct sk_buff *skb,
158                                const struct xt_action_param *);
159 
160         /* Called when user tries to insert an entry of this type:
161            hook_mask is a bitmask of hooks from which it can be
162            called. */
163         /* Should return 0 on success or an error code otherwise (-Exxxx). */
164         int (*checkentry)(const struct xt_tgchk_param *);
165 
166         /* Called when entry of this type deleted. */
167         void (*destroy)(const struct xt_tgdtor_param *);
168 #ifdef CONFIG_COMPAT
169         /* Called when userspace align differs from kernel space one */
170         void (*compat_from_user)(void *dst, const void *src);
171         int (*compat_to_user)(void __user *dst, const void *src);
172 #endif
173         /* Set this to THIS_MODULE if you are a module, otherwise NULL */
174         struct module *me;
175 
176         const char *table;
177         unsigned int targetsize;
178 #ifdef CONFIG_COMPAT
179         unsigned int compatsize;
180 #endif
181         unsigned int hooks;
182         unsigned short proto;
183 
184         unsigned short family;
185 };
186 
187 /* Furniture shopping... */
188 struct xt_table {
189         struct list_head list;
190 
191         /* What hooks you will enter on */
192         unsigned int valid_hooks;
193 
194         /* Man behind the curtain... */
195         struct xt_table_info *private;
196 
197         /* Set this to THIS_MODULE if you are a module, otherwise NULL */
198         struct module *me;
199 
200         u_int8_t af;            /* address/protocol family */
201         int priority;           /* hook order */
202 
203         /* called when table is needed in the given netns */
204         int (*table_init)(struct net *net);
205 
206         /* A unique name... */
207         const char name[XT_TABLE_MAXNAMELEN];
208 };
209 
210 #include <linux/netfilter_ipv4.h>
211 
212 /* The table itself */
213 struct xt_table_info {
214         /* Size per table */
215         unsigned int size;
216         /* Number of entries: FIXME. --RR */
217         unsigned int number;
218         /* Initial number of entries. Needed for module usage count */
219         unsigned int initial_entries;
220 
221         /* Entry points and underflows */
222         unsigned int hook_entry[NF_INET_NUMHOOKS];
223         unsigned int underflow[NF_INET_NUMHOOKS];
224 
225         /*
226          * Number of user chains. Since tables cannot have loops, at most
227          * @stacksize jumps (number of user chains) can possibly be made.
228          */
229         unsigned int stacksize;
230         void ***jumpstack;
231 
232         unsigned char entries[0] __aligned(8);
233 };
234 
235 int xt_register_target(struct xt_target *target);
236 void xt_unregister_target(struct xt_target *target);
237 int xt_register_targets(struct xt_target *target, unsigned int n);
238 void xt_unregister_targets(struct xt_target *target, unsigned int n);
239 
240 int xt_register_match(struct xt_match *target);
241 void xt_unregister_match(struct xt_match *target);
242 int xt_register_matches(struct xt_match *match, unsigned int n);
243 void xt_unregister_matches(struct xt_match *match, unsigned int n);
244 
245 int xt_check_entry_offsets(const void *base, const char *elems,
246                            unsigned int target_offset,
247                            unsigned int next_offset);
248 
249 int xt_check_match(struct xt_mtchk_param *, unsigned int size, u_int8_t proto,
250                    bool inv_proto);
251 int xt_check_target(struct xt_tgchk_param *, unsigned int size, u_int8_t proto,
252                     bool inv_proto);
253 
254 void *xt_copy_counters_from_user(const void __user *user, unsigned int len,
255                                  struct xt_counters_info *info, bool compat);
256 
257 struct xt_table *xt_register_table(struct net *net,
258                                    const struct xt_table *table,
259                                    struct xt_table_info *bootstrap,
260                                    struct xt_table_info *newinfo);
261 void *xt_unregister_table(struct xt_table *table);
262 
263 struct xt_table_info *xt_replace_table(struct xt_table *table,
264                                        unsigned int num_counters,
265                                        struct xt_table_info *newinfo,
266                                        int *error);
267 
268 struct xt_match *xt_find_match(u8 af, const char *name, u8 revision);
269 struct xt_target *xt_find_target(u8 af, const char *name, u8 revision);
270 struct xt_match *xt_request_find_match(u8 af, const char *name, u8 revision);
271 struct xt_target *xt_request_find_target(u8 af, const char *name, u8 revision);
272 int xt_find_revision(u8 af, const char *name, u8 revision, int target,
273                      int *err);
274 
275 struct xt_table *xt_find_table_lock(struct net *net, u_int8_t af,
276                                     const char *name);
277 void xt_table_unlock(struct xt_table *t);
278 
279 int xt_proto_init(struct net *net, u_int8_t af);
280 void xt_proto_fini(struct net *net, u_int8_t af);
281 
282 struct xt_table_info *xt_alloc_table_info(unsigned int size);
283 void xt_free_table_info(struct xt_table_info *info);
284 
285 /**
286  * xt_recseq - recursive seqcount for netfilter use
287  * 
288  * Packet processing changes the seqcount only if no recursion happened
289  * get_counters() can use read_seqcount_begin()/read_seqcount_retry(),
290  * because we use the normal seqcount convention :
291  * Low order bit set to 1 if a writer is active.
292  */
293 DECLARE_PER_CPU(seqcount_t, xt_recseq);
294 
295 /* xt_tee_enabled - true if x_tables needs to handle reentrancy
296  *
297  * Enabled if current ip(6)tables ruleset has at least one -j TEE rule.
298  */
299 extern struct static_key xt_tee_enabled;
300 
301 /**
302  * xt_write_recseq_begin - start of a write section
303  *
304  * Begin packet processing : all readers must wait the end
305  * 1) Must be called with preemption disabled
306  * 2) softirqs must be disabled too (or we should use this_cpu_add())
307  * Returns :
308  *  1 if no recursion on this cpu
309  *  0 if recursion detected
310  */
311 static inline unsigned int xt_write_recseq_begin(void)
312 {
313         unsigned int addend;
314 
315         /*
316          * Low order bit of sequence is set if we already
317          * called xt_write_recseq_begin().
318          */
319         addend = (__this_cpu_read(xt_recseq.sequence) + 1) & 1;
320 
321         /*
322          * This is kind of a write_seqcount_begin(), but addend is 0 or 1
323          * We dont check addend value to avoid a test and conditional jump,
324          * since addend is most likely 1
325          */
326         __this_cpu_add(xt_recseq.sequence, addend);
327         smp_wmb();
328 
329         return addend;
330 }
331 
332 /**
333  * xt_write_recseq_end - end of a write section
334  * @addend: return value from previous xt_write_recseq_begin()
335  *
336  * End packet processing : all readers can proceed
337  * 1) Must be called with preemption disabled
338  * 2) softirqs must be disabled too (or we should use this_cpu_add())
339  */
340 static inline void xt_write_recseq_end(unsigned int addend)
341 {
342         /* this is kind of a write_seqcount_end(), but addend is 0 or 1 */
343         smp_wmb();
344         __this_cpu_add(xt_recseq.sequence, addend);
345 }
346 
347 /*
348  * This helper is performance critical and must be inlined
349  */
350 static inline unsigned long ifname_compare_aligned(const char *_a,
351                                                    const char *_b,
352                                                    const char *_mask)
353 {
354         const unsigned long *a = (const unsigned long *)_a;
355         const unsigned long *b = (const unsigned long *)_b;
356         const unsigned long *mask = (const unsigned long *)_mask;
357         unsigned long ret;
358 
359         ret = (a[0] ^ b[0]) & mask[0];
360         if (IFNAMSIZ > sizeof(unsigned long))
361                 ret |= (a[1] ^ b[1]) & mask[1];
362         if (IFNAMSIZ > 2 * sizeof(unsigned long))
363                 ret |= (a[2] ^ b[2]) & mask[2];
364         if (IFNAMSIZ > 3 * sizeof(unsigned long))
365                 ret |= (a[3] ^ b[3]) & mask[3];
366         BUILD_BUG_ON(IFNAMSIZ > 4 * sizeof(unsigned long));
367         return ret;
368 }
369 
370 
371 /* On SMP, ip(6)t_entry->counters.pcnt holds address of the
372  * real (percpu) counter.  On !SMP, its just the packet count,
373  * so nothing needs to be done there.
374  *
375  * xt_percpu_counter_alloc returns the address of the percpu
376  * counter, or 0 on !SMP. We force an alignment of 16 bytes
377  * so that bytes/packets share a common cache line.
378  *
379  * Hence caller must use IS_ERR_VALUE to check for error, this
380  * allows us to return 0 for single core systems without forcing
381  * callers to deal with SMP vs. NONSMP issues.
382  */
383 static inline unsigned long xt_percpu_counter_alloc(void)
384 {
385         if (nr_cpu_ids > 1) {
386                 void __percpu *res = __alloc_percpu(sizeof(struct xt_counters),
387                                                     sizeof(struct xt_counters));
388 
389                 if (res == NULL)
390                         return -ENOMEM;
391 
392                 return (__force unsigned long) res;
393         }
394 
395         return 0;
396 }
397 static inline void xt_percpu_counter_free(u64 pcnt)
398 {
399         if (nr_cpu_ids > 1)
400                 free_percpu((void __percpu *) (unsigned long) pcnt);
401 }
402 
403 static inline struct xt_counters *
404 xt_get_this_cpu_counter(struct xt_counters *cnt)
405 {
406         if (nr_cpu_ids > 1)
407                 return this_cpu_ptr((void __percpu *) (unsigned long) cnt->pcnt);
408 
409         return cnt;
410 }
411 
412 static inline struct xt_counters *
413 xt_get_per_cpu_counter(struct xt_counters *cnt, unsigned int cpu)
414 {
415         if (nr_cpu_ids > 1)
416                 return per_cpu_ptr((void __percpu *) (unsigned long) cnt->pcnt, cpu);
417 
418         return cnt;
419 }
420 
421 struct nf_hook_ops *xt_hook_ops_alloc(const struct xt_table *, nf_hookfn *);
422 
423 #ifdef CONFIG_COMPAT
424 #include <net/compat.h>
425 
426 struct compat_xt_entry_match {
427         union {
428                 struct {
429                         u_int16_t match_size;
430                         char name[XT_FUNCTION_MAXNAMELEN - 1];
431                         u_int8_t revision;
432                 } user;
433                 struct {
434                         u_int16_t match_size;
435                         compat_uptr_t match;
436                 } kernel;
437                 u_int16_t match_size;
438         } u;
439         unsigned char data[0];
440 };
441 
442 struct compat_xt_entry_target {
443         union {
444                 struct {
445                         u_int16_t target_size;
446                         char name[XT_FUNCTION_MAXNAMELEN - 1];
447                         u_int8_t revision;
448                 } user;
449                 struct {
450                         u_int16_t target_size;
451                         compat_uptr_t target;
452                 } kernel;
453                 u_int16_t target_size;
454         } u;
455         unsigned char data[0];
456 };
457 
458 /* FIXME: this works only on 32 bit tasks
459  * need to change whole approach in order to calculate align as function of
460  * current task alignment */
461 
462 struct compat_xt_counters {
463         compat_u64 pcnt, bcnt;                  /* Packet and byte counters */
464 };
465 
466 struct compat_xt_counters_info {
467         char name[XT_TABLE_MAXNAMELEN];
468         compat_uint_t num_counters;
469         struct compat_xt_counters counters[0];
470 };
471 
472 struct _compat_xt_align {
473         __u8 u8;
474         __u16 u16;
475         __u32 u32;
476         compat_u64 u64;
477 };
478 
479 #define COMPAT_XT_ALIGN(s) __ALIGN_KERNEL((s), __alignof__(struct _compat_xt_align))
480 
481 void xt_compat_lock(u_int8_t af);
482 void xt_compat_unlock(u_int8_t af);
483 
484 int xt_compat_add_offset(u_int8_t af, unsigned int offset, int delta);
485 void xt_compat_flush_offsets(u_int8_t af);
486 void xt_compat_init_offsets(u_int8_t af, unsigned int number);
487 int xt_compat_calc_jump(u_int8_t af, unsigned int offset);
488 
489 int xt_compat_match_offset(const struct xt_match *match);
490 void xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr,
491                               unsigned int *size);
492 int xt_compat_match_to_user(const struct xt_entry_match *m,
493                             void __user **dstptr, unsigned int *size);
494 
495 int xt_compat_target_offset(const struct xt_target *target);
496 void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr,
497                                 unsigned int *size);
498 int xt_compat_target_to_user(const struct xt_entry_target *t,
499                              void __user **dstptr, unsigned int *size);
500 int xt_compat_check_entry_offsets(const void *base, const char *elems,
501                                   unsigned int target_offset,
502                                   unsigned int next_offset);
503 
504 #endif /* CONFIG_COMPAT */
505 #endif /* _X_TABLES_H */
506 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp