1 #ifndef __LINUX_NETFILTER_H
2 #define __LINUX_NETFILTER_H
4 #include <linux/init.h>
5 #include <linux/skbuff.h>
10 #include <linux/wait.h>
11 #include <linux/list.h>
12 #include <uapi/linux/netfilter.h>
13 #ifdef CONFIG_NETFILTER
14 static inline int NF_DROP_GETERR(int verdict)
16 return -(verdict >> NF_VERDICT_QBITS);
19 static inline int nf_inet_addr_cmp(const union nf_inet_addr *a1,
20 const union nf_inet_addr *a2)
22 return a1->all[0] == a2->all[0] &&
23 a1->all[1] == a2->all[1] &&
24 a1->all[2] == a2->all[2] &&
25 a1->all[3] == a2->all[3];
28 static inline void nf_inet_addr_mask(const union nf_inet_addr *a1,
29 union nf_inet_addr *result,
30 const union nf_inet_addr *mask)
32 result->all[0] = a1->all[0] & mask->all[0];
33 result->all[1] = a1->all[1] & mask->all[1];
34 result->all[2] = a1->all[2] & mask->all[2];
35 result->all[3] = a1->all[3] & mask->all[3];
38 extern void netfilter_init(void);
40 /* Largest hook number + 1 */
41 #define NF_MAX_HOOKS 8
45 typedef unsigned int nf_hookfn(unsigned int hooknum,
47 const struct net_device *in,
48 const struct net_device *out,
49 int (*okfn)(struct sk_buff *));
52 struct list_head list;
54 /* User fills in from here down. */
59 /* Hooks are ordered in ascending priority. */
63 struct nf_sockopt_ops {
64 struct list_head list;
68 /* Non-inclusive ranges: use 0/0/NULL to never get called. */
71 int (*set)(struct sock *sk, int optval, void __user *user, unsigned int len);
73 int (*compat_set)(struct sock *sk, int optval,
74 void __user *user, unsigned int len);
78 int (*get)(struct sock *sk, int optval, void __user *user, int *len);
80 int (*compat_get)(struct sock *sk, int optval,
81 void __user *user, int *len);
83 /* Use the module struct to lock set/get code in place */
87 /* Function to register/unregister hook points. */
88 int nf_register_hook(struct nf_hook_ops *reg);
89 void nf_unregister_hook(struct nf_hook_ops *reg);
90 int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n);
91 void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n);
93 /* Functions to register get/setsockopt ranges (non-inclusive). You
94 need to check permissions yourself! */
95 int nf_register_sockopt(struct nf_sockopt_ops *reg);
96 void nf_unregister_sockopt(struct nf_sockopt_ops *reg);
98 extern struct list_head nf_hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
100 #if defined(CONFIG_JUMP_LABEL)
101 #include <linux/static_key.h>
102 extern struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
103 static inline bool nf_hooks_active(u_int8_t pf, unsigned int hook)
105 if (__builtin_constant_p(pf) &&
106 __builtin_constant_p(hook))
107 return static_key_false(&nf_hooks_needed[pf][hook]);
109 return !list_empty(&nf_hooks[pf][hook]);
112 static inline bool nf_hooks_active(u_int8_t pf, unsigned int hook)
114 return !list_empty(&nf_hooks[pf][hook]);
118 int nf_hook_slow(u_int8_t pf, unsigned int hook, struct sk_buff *skb,
119 struct net_device *indev, struct net_device *outdev,
120 int (*okfn)(struct sk_buff *), int thresh);
123 * nf_hook_thresh - call a netfilter hook
125 * Returns 1 if the hook has allowed the packet to pass. The function
126 * okfn must be invoked by the caller in this case. Any other return
127 * value indicates the packet has been consumed by the hook.
129 static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook,
131 struct net_device *indev,
132 struct net_device *outdev,
133 int (*okfn)(struct sk_buff *), int thresh)
135 if (nf_hooks_active(pf, hook))
136 return nf_hook_slow(pf, hook, skb, indev, outdev, okfn, thresh);
140 static inline int nf_hook(u_int8_t pf, unsigned int hook, struct sk_buff *skb,
141 struct net_device *indev, struct net_device *outdev,
142 int (*okfn)(struct sk_buff *))
144 return nf_hook_thresh(pf, hook, skb, indev, outdev, okfn, INT_MIN);
147 /* Activate hook; either okfn or kfree_skb called, unless a hook
148 returns NF_STOLEN (in which case, it's up to the hook to deal with
151 Returns -ERRNO if packet dropped. Zero means queued, stolen or
156 > I don't want nf_hook to return anything because people might forget
157 > about async and trust the return value to mean "packet was ok".
160 Just document it clearly, then you can expect some sense from kernel
165 NF_HOOK_THRESH(uint8_t pf, unsigned int hook, struct sk_buff *skb,
166 struct net_device *in, struct net_device *out,
167 int (*okfn)(struct sk_buff *), int thresh)
169 int ret = nf_hook_thresh(pf, hook, skb, in, out, okfn, thresh);
176 NF_HOOK_COND(uint8_t pf, unsigned int hook, struct sk_buff *skb,
177 struct net_device *in, struct net_device *out,
178 int (*okfn)(struct sk_buff *), bool cond)
183 ((ret = nf_hook_thresh(pf, hook, skb, in, out, okfn, INT_MIN)) == 1))
189 NF_HOOK(uint8_t pf, unsigned int hook, struct sk_buff *skb,
190 struct net_device *in, struct net_device *out,
191 int (*okfn)(struct sk_buff *))
193 return NF_HOOK_THRESH(pf, hook, skb, in, out, okfn, INT_MIN);
196 /* Call setsockopt() */
197 int nf_setsockopt(struct sock *sk, u_int8_t pf, int optval, char __user *opt,
199 int nf_getsockopt(struct sock *sk, u_int8_t pf, int optval, char __user *opt,
202 int compat_nf_setsockopt(struct sock *sk, u_int8_t pf, int optval,
203 char __user *opt, unsigned int len);
204 int compat_nf_getsockopt(struct sock *sk, u_int8_t pf, int optval,
205 char __user *opt, int *len);
208 /* Call this before modifying an existing packet: ensures it is
209 modifiable and linear to the point you care about (writable_len).
210 Returns true or false. */
211 extern int skb_make_writable(struct sk_buff *skb, unsigned int writable_len);
214 struct nf_queue_entry;
217 unsigned short family;
218 __sum16 (*checksum)(struct sk_buff *skb, unsigned int hook,
219 unsigned int dataoff, u_int8_t protocol);
220 __sum16 (*checksum_partial)(struct sk_buff *skb,
222 unsigned int dataoff,
225 int (*route)(struct net *net, struct dst_entry **dst,
226 struct flowi *fl, bool strict);
227 void (*saveroute)(const struct sk_buff *skb,
228 struct nf_queue_entry *entry);
229 int (*reroute)(struct sk_buff *skb,
230 const struct nf_queue_entry *entry);
234 extern const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO];
235 static inline const struct nf_afinfo *nf_get_afinfo(unsigned short family)
237 return rcu_dereference(nf_afinfo[family]);
240 static inline __sum16
241 nf_checksum(struct sk_buff *skb, unsigned int hook, unsigned int dataoff,
242 u_int8_t protocol, unsigned short family)
244 const struct nf_afinfo *afinfo;
248 afinfo = nf_get_afinfo(family);
250 csum = afinfo->checksum(skb, hook, dataoff, protocol);
255 static inline __sum16
256 nf_checksum_partial(struct sk_buff *skb, unsigned int hook,
257 unsigned int dataoff, unsigned int len,
258 u_int8_t protocol, unsigned short family)
260 const struct nf_afinfo *afinfo;
264 afinfo = nf_get_afinfo(family);
266 csum = afinfo->checksum_partial(skb, hook, dataoff, len,
272 extern int nf_register_afinfo(const struct nf_afinfo *afinfo);
273 extern void nf_unregister_afinfo(const struct nf_afinfo *afinfo);
275 #include <net/flow.h>
276 extern void (*nf_nat_decode_session_hook)(struct sk_buff *, struct flowi *);
279 nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family)
281 #ifdef CONFIG_NF_NAT_NEEDED
282 void (*decodefn)(struct sk_buff *, struct flowi *);
285 decodefn = rcu_dereference(nf_nat_decode_session_hook);
292 #else /* !CONFIG_NETFILTER */
293 #define NF_HOOK(pf, hook, skb, indev, outdev, okfn) (okfn)(skb)
294 #define NF_HOOK_COND(pf, hook, skb, indev, outdev, okfn, cond) (okfn)(skb)
295 static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook,
297 struct net_device *indev,
298 struct net_device *outdev,
299 int (*okfn)(struct sk_buff *), int thresh)
303 static inline int nf_hook(u_int8_t pf, unsigned int hook, struct sk_buff *skb,
304 struct net_device *indev, struct net_device *outdev,
305 int (*okfn)(struct sk_buff *))
311 nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family)
314 #endif /*CONFIG_NETFILTER*/
316 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
317 extern void (*ip_ct_attach)(struct sk_buff *, struct sk_buff *) __rcu;
318 extern void nf_ct_attach(struct sk_buff *, struct sk_buff *);
319 extern void (*nf_ct_destroy)(struct nf_conntrack *) __rcu;
325 size_t (*build_size)(const struct nf_conn *ct);
326 int (*build)(struct sk_buff *skb, struct nf_conn *ct);
327 int (*parse)(const struct nlattr *attr, struct nf_conn *ct);
329 extern struct nfq_ct_hook __rcu *nfq_ct_hook;
331 struct nfq_ct_nat_hook {
332 void (*seq_adjust)(struct sk_buff *skb, struct nf_conn *ct,
333 u32 ctinfo, int off);
335 extern struct nfq_ct_nat_hook __rcu *nfq_ct_nat_hook;
337 static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {}
340 #endif /*__LINUX_NETFILTER_H*/