netfilter.h 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398
  1. #ifndef __LINUX_NETFILTER_H
  2. #define __LINUX_NETFILTER_H
  3. #ifdef __KERNEL__
  4. #include <linux/init.h>
  5. #include <linux/types.h>
  6. #include <linux/skbuff.h>
  7. #include <linux/net.h>
  8. #include <linux/if.h>
  9. #include <linux/wait.h>
  10. #include <linux/list.h>
  11. #endif
  12. #include <linux/compiler.h>
  13. /* Responses from hook functions. */
  14. #define NF_DROP 0
  15. #define NF_ACCEPT 1
  16. #define NF_STOLEN 2
  17. #define NF_QUEUE 3
  18. #define NF_REPEAT 4
  19. #define NF_STOP 5
  20. #define NF_MAX_VERDICT NF_STOP
  21. /* we overload the higher bits for encoding auxiliary data such as the queue
  22. * number. Not nice, but better than additional function arguments. */
  23. #define NF_VERDICT_MASK 0x0000ffff
  24. #define NF_VERDICT_BITS 16
  25. #define NF_VERDICT_QMASK 0xffff0000
  26. #define NF_VERDICT_QBITS 16
  27. #define NF_QUEUE_NR(x) (((x << NF_VERDICT_QBITS) & NF_VERDICT_QMASK) | NF_QUEUE)
  28. /* only for userspace compatibility */
  29. #ifndef __KERNEL__
  30. /* Generic cache responses from hook functions.
  31. <= 0x2000 is used for protocol-flags. */
  32. #define NFC_UNKNOWN 0x4000
  33. #define NFC_ALTERED 0x8000
  34. #endif
  35. #ifdef __KERNEL__
  36. #ifdef CONFIG_NETFILTER
  37. extern void netfilter_init(void);
  38. /* Largest hook number + 1 */
  39. #define NF_MAX_HOOKS 8
  40. struct sk_buff;
  41. struct net_device;
  42. typedef unsigned int nf_hookfn(unsigned int hooknum,
  43. struct sk_buff **skb,
  44. const struct net_device *in,
  45. const struct net_device *out,
  46. int (*okfn)(struct sk_buff *));
  47. struct nf_hook_ops
  48. {
  49. struct list_head list;
  50. /* User fills in from here down. */
  51. nf_hookfn *hook;
  52. struct module *owner;
  53. int pf;
  54. int hooknum;
  55. /* Hooks are ordered in ascending priority. */
  56. int priority;
  57. };
  58. struct nf_sockopt_ops
  59. {
  60. struct list_head list;
  61. int pf;
  62. /* Non-inclusive ranges: use 0/0/NULL to never get called. */
  63. int set_optmin;
  64. int set_optmax;
  65. int (*set)(struct sock *sk, int optval, void __user *user, unsigned int len);
  66. int (*compat_set)(struct sock *sk, int optval,
  67. void __user *user, unsigned int len);
  68. int get_optmin;
  69. int get_optmax;
  70. int (*get)(struct sock *sk, int optval, void __user *user, int *len);
  71. int (*compat_get)(struct sock *sk, int optval,
  72. void __user *user, int *len);
  73. /* Number of users inside set() or get(). */
  74. unsigned int use;
  75. struct task_struct *cleanup_task;
  76. };
  77. /* Each queued (to userspace) skbuff has one of these. */
  78. struct nf_info
  79. {
  80. /* The ops struct which sent us to userspace. */
  81. struct nf_hook_ops *elem;
  82. /* If we're sent to userspace, this keeps housekeeping info */
  83. int pf;
  84. unsigned int hook;
  85. struct net_device *indev, *outdev;
  86. int (*okfn)(struct sk_buff *);
  87. };
  88. /* Function to register/unregister hook points. */
  89. int nf_register_hook(struct nf_hook_ops *reg);
  90. void nf_unregister_hook(struct nf_hook_ops *reg);
  91. int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n);
  92. void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n);
  93. /* Functions to register get/setsockopt ranges (non-inclusive). You
  94. need to check permissions yourself! */
  95. int nf_register_sockopt(struct nf_sockopt_ops *reg);
  96. void nf_unregister_sockopt(struct nf_sockopt_ops *reg);
  97. #ifdef CONFIG_SYSCTL
  98. /* Sysctl registration */
  99. struct ctl_table_header *nf_register_sysctl_table(struct ctl_table *path,
  100. struct ctl_table *table);
  101. void nf_unregister_sysctl_table(struct ctl_table_header *header,
  102. struct ctl_table *table);
  103. extern struct ctl_table nf_net_netfilter_sysctl_path[];
  104. extern struct ctl_table nf_net_ipv4_netfilter_sysctl_path[];
  105. #endif /* CONFIG_SYSCTL */
  106. extern struct list_head nf_hooks[NPROTO][NF_MAX_HOOKS];
  107. /* those NF_LOG_* defines and struct nf_loginfo are legacy definitios that will
  108. * disappear once iptables is replaced with pkttables. Please DO NOT use them
  109. * for any new code! */
  110. #define NF_LOG_TCPSEQ 0x01 /* Log TCP sequence numbers */
  111. #define NF_LOG_TCPOPT 0x02 /* Log TCP options */
  112. #define NF_LOG_IPOPT 0x04 /* Log IP options */
  113. #define NF_LOG_UID 0x08 /* Log UID owning local socket */
  114. #define NF_LOG_MASK 0x0f
  115. #define NF_LOG_TYPE_LOG 0x01
  116. #define NF_LOG_TYPE_ULOG 0x02
  117. struct nf_loginfo {
  118. u_int8_t type;
  119. union {
  120. struct {
  121. u_int32_t copy_len;
  122. u_int16_t group;
  123. u_int16_t qthreshold;
  124. } ulog;
  125. struct {
  126. u_int8_t level;
  127. u_int8_t logflags;
  128. } log;
  129. } u;
  130. };
  131. typedef void nf_logfn(unsigned int pf,
  132. unsigned int hooknum,
  133. const struct sk_buff *skb,
  134. const struct net_device *in,
  135. const struct net_device *out,
  136. const struct nf_loginfo *li,
  137. const char *prefix);
  138. struct nf_logger {
  139. struct module *me;
  140. nf_logfn *logfn;
  141. char *name;
  142. };
  143. /* Function to register/unregister log function. */
  144. int nf_log_register(int pf, struct nf_logger *logger);
  145. void nf_log_unregister(struct nf_logger *logger);
  146. void nf_log_unregister_pf(int pf);
  147. /* Calls the registered backend logging function */
  148. void nf_log_packet(int pf,
  149. unsigned int hooknum,
  150. const struct sk_buff *skb,
  151. const struct net_device *in,
  152. const struct net_device *out,
  153. struct nf_loginfo *li,
  154. const char *fmt, ...);
  155. int nf_hook_slow(int pf, unsigned int hook, struct sk_buff **pskb,
  156. struct net_device *indev, struct net_device *outdev,
  157. int (*okfn)(struct sk_buff *), int thresh);
  158. /**
  159. * nf_hook_thresh - call a netfilter hook
  160. *
  161. * Returns 1 if the hook has allowed the packet to pass. The function
  162. * okfn must be invoked by the caller in this case. Any other return
  163. * value indicates the packet has been consumed by the hook.
  164. */
  165. static inline int nf_hook_thresh(int pf, unsigned int hook,
  166. struct sk_buff **pskb,
  167. struct net_device *indev,
  168. struct net_device *outdev,
  169. int (*okfn)(struct sk_buff *), int thresh,
  170. int cond)
  171. {
  172. if (!cond)
  173. return 1;
  174. #ifndef CONFIG_NETFILTER_DEBUG
  175. if (list_empty(&nf_hooks[pf][hook]))
  176. return 1;
  177. #endif
  178. return nf_hook_slow(pf, hook, pskb, indev, outdev, okfn, thresh);
  179. }
  180. static inline int nf_hook(int pf, unsigned int hook, struct sk_buff **pskb,
  181. struct net_device *indev, struct net_device *outdev,
  182. int (*okfn)(struct sk_buff *))
  183. {
  184. return nf_hook_thresh(pf, hook, pskb, indev, outdev, okfn, INT_MIN, 1);
  185. }
  186. /* Activate hook; either okfn or kfree_skb called, unless a hook
  187. returns NF_STOLEN (in which case, it's up to the hook to deal with
  188. the consequences).
  189. Returns -ERRNO if packet dropped. Zero means queued, stolen or
  190. accepted.
  191. */
  192. /* RR:
  193. > I don't want nf_hook to return anything because people might forget
  194. > about async and trust the return value to mean "packet was ok".
  195. AK:
  196. Just document it clearly, then you can expect some sense from kernel
  197. coders :)
  198. */
  199. /* This is gross, but inline doesn't cut it for avoiding the function
  200. call in fast path: gcc doesn't inline (needs value tracking?). --RR */
  201. /* HX: It's slightly less gross now. */
  202. #define NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, thresh) \
  203. ({int __ret; \
  204. if ((__ret=nf_hook_thresh(pf, hook, &(skb), indev, outdev, okfn, thresh, 1)) == 1)\
  205. __ret = (okfn)(skb); \
  206. __ret;})
  207. #define NF_HOOK_COND(pf, hook, skb, indev, outdev, okfn, cond) \
  208. ({int __ret; \
  209. if ((__ret=nf_hook_thresh(pf, hook, &(skb), indev, outdev, okfn, INT_MIN, cond)) == 1)\
  210. __ret = (okfn)(skb); \
  211. __ret;})
  212. #define NF_HOOK(pf, hook, skb, indev, outdev, okfn) \
  213. NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, INT_MIN)
  214. /* Call setsockopt() */
  215. int nf_setsockopt(struct sock *sk, int pf, int optval, char __user *opt,
  216. int len);
  217. int nf_getsockopt(struct sock *sk, int pf, int optval, char __user *opt,
  218. int *len);
  219. int compat_nf_setsockopt(struct sock *sk, int pf, int optval,
  220. char __user *opt, int len);
  221. int compat_nf_getsockopt(struct sock *sk, int pf, int optval,
  222. char __user *opt, int *len);
  223. /* Packet queuing */
  224. struct nf_queue_handler {
  225. int (*outfn)(struct sk_buff *skb, struct nf_info *info,
  226. unsigned int queuenum, void *data);
  227. void *data;
  228. char *name;
  229. };
  230. extern int nf_register_queue_handler(int pf,
  231. struct nf_queue_handler *qh);
  232. extern int nf_unregister_queue_handler(int pf);
  233. extern void nf_unregister_queue_handlers(struct nf_queue_handler *qh);
  234. extern void nf_reinject(struct sk_buff *skb,
  235. struct nf_info *info,
  236. unsigned int verdict);
  237. extern void (*ip_ct_attach)(struct sk_buff *, struct sk_buff *);
  238. extern void nf_ct_attach(struct sk_buff *, struct sk_buff *);
  239. /* FIXME: Before cache is ever used, this must be implemented for real. */
  240. extern void nf_invalidate_cache(int pf);
  241. /* Call this before modifying an existing packet: ensures it is
  242. modifiable and linear to the point you care about (writable_len).
  243. Returns true or false. */
  244. extern int skb_make_writable(struct sk_buff **pskb, unsigned int writable_len);
  245. static inline void nf_csum_replace4(__sum16 *sum, __be32 from, __be32 to)
  246. {
  247. __be32 diff[] = { ~from, to };
  248. *sum = csum_fold(csum_partial((char *)diff, sizeof(diff), ~csum_unfold(*sum)));
  249. }
  250. static inline void nf_csum_replace2(__sum16 *sum, __be16 from, __be16 to)
  251. {
  252. nf_csum_replace4(sum, (__force __be32)from, (__force __be32)to);
  253. }
  254. extern void nf_proto_csum_replace4(__sum16 *sum, struct sk_buff *skb,
  255. __be32 from, __be32 to, int pseudohdr);
  256. static inline void nf_proto_csum_replace2(__sum16 *sum, struct sk_buff *skb,
  257. __be16 from, __be16 to, int pseudohdr)
  258. {
  259. nf_proto_csum_replace4(sum, skb, (__force __be32)from,
  260. (__force __be32)to, pseudohdr);
  261. }
  262. struct nf_afinfo {
  263. unsigned short family;
  264. __sum16 (*checksum)(struct sk_buff *skb, unsigned int hook,
  265. unsigned int dataoff, u_int8_t protocol);
  266. void (*saveroute)(const struct sk_buff *skb,
  267. struct nf_info *info);
  268. int (*reroute)(struct sk_buff **skb,
  269. const struct nf_info *info);
  270. int route_key_size;
  271. };
  272. extern struct nf_afinfo *nf_afinfo[];
  273. static inline struct nf_afinfo *nf_get_afinfo(unsigned short family)
  274. {
  275. return rcu_dereference(nf_afinfo[family]);
  276. }
  277. static inline __sum16
  278. nf_checksum(struct sk_buff *skb, unsigned int hook, unsigned int dataoff,
  279. u_int8_t protocol, unsigned short family)
  280. {
  281. struct nf_afinfo *afinfo;
  282. __sum16 csum = 0;
  283. rcu_read_lock();
  284. afinfo = nf_get_afinfo(family);
  285. if (afinfo)
  286. csum = afinfo->checksum(skb, hook, dataoff, protocol);
  287. rcu_read_unlock();
  288. return csum;
  289. }
  290. extern int nf_register_afinfo(struct nf_afinfo *afinfo);
  291. extern void nf_unregister_afinfo(struct nf_afinfo *afinfo);
  292. #define nf_info_reroute(x) ((void *)x + sizeof(struct nf_info))
  293. #include <net/flow.h>
  294. extern void (*ip_nat_decode_session)(struct sk_buff *, struct flowi *);
  295. static inline void
  296. nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, int family)
  297. {
  298. #if defined(CONFIG_IP_NF_NAT_NEEDED) || defined(CONFIG_NF_NAT_NEEDED)
  299. void (*decodefn)(struct sk_buff *, struct flowi *);
  300. if (family == AF_INET && (decodefn = ip_nat_decode_session) != NULL)
  301. decodefn(skb, fl);
  302. #endif
  303. }
  304. #ifdef CONFIG_PROC_FS
  305. #include <linux/proc_fs.h>
  306. extern struct proc_dir_entry *proc_net_netfilter;
  307. #endif
  308. #else /* !CONFIG_NETFILTER */
  309. #define NF_HOOK(pf, hook, skb, indev, outdev, okfn) (okfn)(skb)
  310. #define NF_HOOK_COND(pf, hook, skb, indev, outdev, okfn, cond) (okfn)(skb)
  311. static inline int nf_hook_thresh(int pf, unsigned int hook,
  312. struct sk_buff **pskb,
  313. struct net_device *indev,
  314. struct net_device *outdev,
  315. int (*okfn)(struct sk_buff *), int thresh,
  316. int cond)
  317. {
  318. return okfn(*pskb);
  319. }
  320. static inline int nf_hook(int pf, unsigned int hook, struct sk_buff **pskb,
  321. struct net_device *indev, struct net_device *outdev,
  322. int (*okfn)(struct sk_buff *))
  323. {
  324. return 1;
  325. }
  326. static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {}
  327. struct flowi;
  328. static inline void
  329. nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, int family) {}
  330. #endif /*CONFIG_NETFILTER*/
  331. #endif /*__KERNEL__*/
  332. #endif /*__LINUX_NETFILTER_H*/