netfilter.h 11.6 KB
Newer Older
Linus Torvalds's avatar
Linus Torvalds committed
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
#ifndef __LINUX_NETFILTER_H
#define __LINUX_NETFILTER_H

#ifdef __KERNEL__
#include <linux/init.h>
#include <linux/types.h>
#include <linux/skbuff.h>
#include <linux/net.h>
#include <linux/if.h>
#include <linux/wait.h>
#include <linux/list.h>
#endif
#include <linux/compiler.h>

/* Responses from hook functions. */
#define NF_DROP 0
#define NF_ACCEPT 1
#define NF_STOLEN 2
#define NF_QUEUE 3
#define NF_REPEAT 4
#define NF_STOP 5
#define NF_MAX_VERDICT NF_STOP

24
25
26
27
28
29
30
31
/* we overload the higher bits for encoding auxiliary data such as the queue
 * number. Not nice, but better than additional function arguments. */
#define NF_VERDICT_MASK 0x0000ffff
#define NF_VERDICT_BITS 16

#define NF_VERDICT_QMASK 0xffff0000
#define NF_VERDICT_QBITS 16

32
#define NF_QUEUE_NR(x) (((x << NF_VERDICT_QBITS) & NF_VERDICT_QMASK) | NF_QUEUE)
33

34
35
/* only for userspace compatibility */
#ifndef __KERNEL__
Linus Torvalds's avatar
Linus Torvalds committed
36
37
38
39
/* Generic cache responses from hook functions.
   <= 0x2000 is used for protocol-flags. */
#define NFC_UNKNOWN 0x4000
#define NFC_ALTERED 0x8000
40
#endif
Linus Torvalds's avatar
Linus Torvalds committed
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81

#ifdef __KERNEL__
#ifdef CONFIG_NETFILTER

extern void netfilter_init(void);

/* Largest hook number + 1 */
#define NF_MAX_HOOKS 8

struct sk_buff;
struct net_device;

typedef unsigned int nf_hookfn(unsigned int hooknum,
			       struct sk_buff **skb,
			       const struct net_device *in,
			       const struct net_device *out,
			       int (*okfn)(struct sk_buff *));

struct nf_hook_ops
{
	struct list_head list;

	/* User fills in from here down. */
	nf_hookfn *hook;
	struct module *owner;
	int pf;
	int hooknum;
	/* Hooks are ordered in ascending priority. */
	int priority;
};

struct nf_sockopt_ops
{
	struct list_head list;

	int pf;

	/* Non-inclusive ranges: use 0/0/NULL to never get called. */
	int set_optmin;
	int set_optmax;
	int (*set)(struct sock *sk, int optval, void __user *user, unsigned int len);
82
83
	int (*compat_set)(struct sock *sk, int optval,
			void __user *user, unsigned int len);
Linus Torvalds's avatar
Linus Torvalds committed
84
85
86
87

	int get_optmin;
	int get_optmax;
	int (*get)(struct sock *sk, int optval, void __user *user, int *len);
88
89
	int (*compat_get)(struct sock *sk, int optval,
			void __user *user, int *len);
Linus Torvalds's avatar
Linus Torvalds committed
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111

	/* Number of users inside set() or get(). */
	unsigned int use;
	struct task_struct *cleanup_task;
};

/* Each queued (to userspace) skbuff has one of these. */
struct nf_info
{
	/* The ops struct which sent us to userspace. */
	struct nf_hook_ops *elem;
	
	/* If we're sent to userspace, this keeps housekeeping info */
	int pf;
	unsigned int hook;
	struct net_device *indev, *outdev;
	int (*okfn)(struct sk_buff *);
};
                                                                                
/* Function to register/unregister hook points. */
int nf_register_hook(struct nf_hook_ops *reg);
void nf_unregister_hook(struct nf_hook_ops *reg);
112
113
int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n);
void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n);
Linus Torvalds's avatar
Linus Torvalds committed
114
115
116
117
118
119

/* Functions to register get/setsockopt ranges (non-inclusive).  You
   need to check permissions yourself! */
int nf_register_sockopt(struct nf_sockopt_ops *reg);
void nf_unregister_sockopt(struct nf_sockopt_ops *reg);

120
121
122
123
124
125
126
127
128
129
#ifdef CONFIG_SYSCTL
/* Sysctl registration */
struct ctl_table_header *nf_register_sysctl_table(struct ctl_table *path,
						  struct ctl_table *table);
void nf_unregister_sysctl_table(struct ctl_table_header *header,
				struct ctl_table *table);
extern struct ctl_table nf_net_netfilter_sysctl_path[];
extern struct ctl_table nf_net_ipv4_netfilter_sysctl_path[];
#endif /* CONFIG_SYSCTL */

Linus Torvalds's avatar
Linus Torvalds committed
130
131
extern struct list_head nf_hooks[NPROTO][NF_MAX_HOOKS];

132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
/* those NF_LOG_* defines and struct nf_loginfo are legacy definitios that will
 * disappear once iptables is replaced with pkttables.  Please DO NOT use them
 * for any new code! */
#define NF_LOG_TCPSEQ		0x01	/* Log TCP sequence numbers */
#define NF_LOG_TCPOPT		0x02	/* Log TCP options */
#define NF_LOG_IPOPT		0x04	/* Log IP options */
#define NF_LOG_UID		0x08	/* Log UID owning local socket */
#define NF_LOG_MASK		0x0f

#define NF_LOG_TYPE_LOG		0x01
#define NF_LOG_TYPE_ULOG	0x02

struct nf_loginfo {
	u_int8_t type;
	union {
		struct {
			u_int32_t copy_len;
			u_int16_t group;
			u_int16_t qthreshold;
		} ulog;
		struct {
			u_int8_t level;
			u_int8_t logflags;
		} log;
	} u;
};

typedef void nf_logfn(unsigned int pf,
		      unsigned int hooknum,
Linus Torvalds's avatar
Linus Torvalds committed
161
162
163
		      const struct sk_buff *skb,
		      const struct net_device *in,
		      const struct net_device *out,
164
		      const struct nf_loginfo *li,
Linus Torvalds's avatar
Linus Torvalds committed
165
166
		      const char *prefix);

167
168
169
170
171
172
struct nf_logger {
	struct module	*me;
	nf_logfn 	*logfn;
	char		*name;
};

Linus Torvalds's avatar
Linus Torvalds committed
173
/* Function to register/unregister log function. */
174
int nf_log_register(int pf, struct nf_logger *logger);
175
int nf_log_unregister_pf(int pf);
176
void nf_log_unregister_logger(struct nf_logger *logger);
Linus Torvalds's avatar
Linus Torvalds committed
177
178
179
180
181
182
183

/* Calls the registered backend logging function */
void nf_log_packet(int pf,
		   unsigned int hooknum,
		   const struct sk_buff *skb,
		   const struct net_device *in,
		   const struct net_device *out,
184
		   struct nf_loginfo *li,
Linus Torvalds's avatar
Linus Torvalds committed
185
		   const char *fmt, ...);
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201

int nf_hook_slow(int pf, unsigned int hook, struct sk_buff **pskb,
		 struct net_device *indev, struct net_device *outdev,
		 int (*okfn)(struct sk_buff *), int thresh);

/**
 *	nf_hook_thresh - call a netfilter hook
 *	
 *	Returns 1 if the hook has allowed the packet to pass.  The function
 *	okfn must be invoked by the caller in this case.  Any other return
 *	value indicates the packet has been consumed by the hook.
 */
static inline int nf_hook_thresh(int pf, unsigned int hook,
				 struct sk_buff **pskb,
				 struct net_device *indev,
				 struct net_device *outdev,
202
203
				 int (*okfn)(struct sk_buff *), int thresh,
				 int cond)
204
{
205
206
	if (!cond)
		return 1;
207
208
209
210
211
212
213
214
215
216
217
#ifndef CONFIG_NETFILTER_DEBUG
	if (list_empty(&nf_hooks[pf][hook]))
		return 1;
#endif
	return nf_hook_slow(pf, hook, pskb, indev, outdev, okfn, thresh);
}

static inline int nf_hook(int pf, unsigned int hook, struct sk_buff **pskb,
			  struct net_device *indev, struct net_device *outdev,
			  int (*okfn)(struct sk_buff *))
{
218
	return nf_hook_thresh(pf, hook, pskb, indev, outdev, okfn, INT_MIN, 1);
219
}
Linus Torvalds's avatar
Linus Torvalds committed
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
                   
/* Activate hook; either okfn or kfree_skb called, unless a hook
   returns NF_STOLEN (in which case, it's up to the hook to deal with
   the consequences).

   Returns -ERRNO if packet dropped.  Zero means queued, stolen or
   accepted.
*/

/* RR:
   > I don't want nf_hook to return anything because people might forget
   > about async and trust the return value to mean "packet was ok".

   AK:
   Just document it clearly, then you can expect some sense from kernel
   coders :)
*/

/* This is gross, but inline doesn't cut it for avoiding the function
   call in fast path: gcc doesn't inline (needs value tracking?). --RR */
240
241
242

/* HX: It's slightly less gross now. */

Linus Torvalds's avatar
Linus Torvalds committed
243
244
#define NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, thresh)	       \
({int __ret;								       \
245
246
247
248
249
250
251
if ((__ret=nf_hook_thresh(pf, hook, &(skb), indev, outdev, okfn, thresh, 1)) == 1)\
	__ret = (okfn)(skb);						       \
__ret;})

#define NF_HOOK_COND(pf, hook, skb, indev, outdev, okfn, cond)		       \
({int __ret;								       \
if ((__ret=nf_hook_thresh(pf, hook, &(skb), indev, outdev, okfn, INT_MIN, cond)) == 1)\
Linus Torvalds's avatar
Linus Torvalds committed
252
253
254
	__ret = (okfn)(skb);						       \
__ret;})

255
256
#define NF_HOOK(pf, hook, skb, indev, outdev, okfn) \
	NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, INT_MIN)
Linus Torvalds's avatar
Linus Torvalds committed
257
258
259
260
261
262
263

/* Call setsockopt() */
int nf_setsockopt(struct sock *sk, int pf, int optval, char __user *opt, 
		  int len);
int nf_getsockopt(struct sock *sk, int pf, int optval, char __user *opt,
		  int *len);

264
265
266
267
268
int compat_nf_setsockopt(struct sock *sk, int pf, int optval,
		char __user *opt, int len);
int compat_nf_getsockopt(struct sock *sk, int pf, int optval,
		char __user *opt, int *len);

Linus Torvalds's avatar
Linus Torvalds committed
269
/* Packet queuing */
270
271
272
273
274
275
struct nf_queue_handler {
	int (*outfn)(struct sk_buff *skb, struct nf_info *info,
		     unsigned int queuenum, void *data);
	void *data;
	char *name;
};
Linus Torvalds's avatar
Linus Torvalds committed
276
extern int nf_register_queue_handler(int pf, 
277
                                     struct nf_queue_handler *qh);
Linus Torvalds's avatar
Linus Torvalds committed
278
extern int nf_unregister_queue_handler(int pf);
279
extern void nf_unregister_queue_handlers(struct nf_queue_handler *qh);
Linus Torvalds's avatar
Linus Torvalds committed
280
281
282
283
284
285
286
287
288
289
extern void nf_reinject(struct sk_buff *skb,
			struct nf_info *info,
			unsigned int verdict);

extern void (*ip_ct_attach)(struct sk_buff *, struct sk_buff *);
extern void nf_ct_attach(struct sk_buff *, struct sk_buff *);

/* FIXME: Before cache is ever used, this must be implemented for real. */
extern void nf_invalidate_cache(int pf);

290
291
292
293
294
/* Call this before modifying an existing packet: ensures it is
   modifiable and linear to the point you care about (writable_len).
   Returns true or false. */
extern int skb_make_writable(struct sk_buff **pskb, unsigned int writable_len);

295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
static inline void nf_csum_replace4(__sum16 *sum, __be32 from, __be32 to)
{
	__be32 diff[] = { ~from, to };

	*sum = csum_fold(csum_partial((char *)diff, sizeof(diff), ~csum_unfold(*sum)));
}

static inline void nf_csum_replace2(__sum16 *sum, __be16 from, __be16 to)
{
	nf_csum_replace4(sum, (__force __be32)from, (__force __be32)to);
}

extern void nf_proto_csum_replace4(__sum16 *sum, struct sk_buff *skb,
				      __be32 from, __be32 to, int pseudohdr);

static inline void nf_proto_csum_replace2(__sum16 *sum, struct sk_buff *skb,
				      __be16 from, __be16 to, int pseudohdr)
{
	nf_proto_csum_replace4(sum, skb, (__force __be32)from,
				(__force __be32)to, pseudohdr);
}
316

317
318
struct nf_afinfo {
	unsigned short	family;
319
	__sum16		(*checksum)(struct sk_buff *skb, unsigned int hook,
320
				    unsigned int dataoff, u_int8_t protocol);
321
322
323
324
325
	void		(*saveroute)(const struct sk_buff *skb,
				     struct nf_info *info);
	int		(*reroute)(struct sk_buff **skb,
				   const struct nf_info *info);
	int		route_key_size;
326
327
};

328
329
330
331
332
extern struct nf_afinfo *nf_afinfo[];
static inline struct nf_afinfo *nf_get_afinfo(unsigned short family)
{
	return rcu_dereference(nf_afinfo[family]);
}
333

334
static inline __sum16
335
336
337
338
nf_checksum(struct sk_buff *skb, unsigned int hook, unsigned int dataoff,
	    u_int8_t protocol, unsigned short family)
{
	struct nf_afinfo *afinfo;
339
	__sum16 csum = 0;
340
341
342
343
344
345
346
347
348

	rcu_read_lock();
	afinfo = nf_get_afinfo(family);
	if (afinfo)
		csum = afinfo->checksum(skb, hook, dataoff, protocol);
	rcu_read_unlock();
	return csum;
}

349
350
351
352
extern int nf_register_afinfo(struct nf_afinfo *afinfo);
extern void nf_unregister_afinfo(struct nf_afinfo *afinfo);

#define nf_info_reroute(x) ((void *)x + sizeof(struct nf_info))
353

354
355
356
357
358
359
#include <net/flow.h>
extern void (*ip_nat_decode_session)(struct sk_buff *, struct flowi *);

static inline void
nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, int family)
{
360
#if defined(CONFIG_IP_NF_NAT_NEEDED) || defined(CONFIG_NF_NAT_NEEDED)
361
362
363
364
365
366
367
	void (*decodefn)(struct sk_buff *, struct flowi *);

	if (family == AF_INET && (decodefn = ip_nat_decode_session) != NULL)
		decodefn(skb, fl);
#endif
}

368
369
370
371
372
#ifdef CONFIG_PROC_FS
#include <linux/proc_fs.h>
extern struct proc_dir_entry *proc_net_netfilter;
#endif

Linus Torvalds's avatar
Linus Torvalds committed
373
374
#else /* !CONFIG_NETFILTER */
#define NF_HOOK(pf, hook, skb, indev, outdev, okfn) (okfn)(skb)
375
#define NF_HOOK_COND(pf, hook, skb, indev, outdev, okfn, cond) (okfn)(skb)
376
377
378
379
static inline int nf_hook_thresh(int pf, unsigned int hook,
				 struct sk_buff **pskb,
				 struct net_device *indev,
				 struct net_device *outdev,
380
381
				 int (*okfn)(struct sk_buff *), int thresh,
				 int cond)
382
383
384
385
386
387
388
{
	return okfn(*pskb);
}
static inline int nf_hook(int pf, unsigned int hook, struct sk_buff **pskb,
			  struct net_device *indev, struct net_device *outdev,
			  int (*okfn)(struct sk_buff *))
{
389
	return 1;
390
}
Linus Torvalds's avatar
Linus Torvalds committed
391
static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {}
392
struct flowi;
393
394
static inline void
nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, int family) {}
Linus Torvalds's avatar
Linus Torvalds committed
395
396
397
398
#endif /*CONFIG_NETFILTER*/

#endif /*__KERNEL__*/
#endif /*__LINUX_NETFILTER_H*/