LCOV - code coverage report
Current view: top level - include/linux - netfilter.h (source / functions) Hit Total Coverage
Test: coverage.info Lines: 1 1 100.0 %
Date: 2017-01-25 Functions: 0 0 -

          Line data    Source code
       1             : #ifndef __LINUX_NETFILTER_H
       2             : #define __LINUX_NETFILTER_H
       3             : 
       4             : #ifdef __KERNEL__
       5             : #include <linux/init.h>
       6             : #include <linux/skbuff.h>
       7             : #include <linux/net.h>
       8             : #include <linux/if.h>
       9             : #include <linux/in.h>
      10             : #include <linux/in6.h>
      11             : #include <linux/wait.h>
      12             : #include <linux/list.h>
      13             : #endif
      14             : #include <linux/types.h>
      15             : #include <linux/compiler.h>
      16             : 
      17             : /* Responses from hook functions. */
      18             : #define NF_DROP 0
      19             : #define NF_ACCEPT 1
      20             : #define NF_STOLEN 2
      21             : #define NF_QUEUE 3
      22             : #define NF_REPEAT 4
      23             : #define NF_STOP 5
      24             : #define NF_MAX_VERDICT NF_STOP
      25             : 
      26             : /* we overload the higher bits for encoding auxiliary data such as the queue
      27             :  * number. Not nice, but better than additional function arguments. */
      28             : #define NF_VERDICT_MASK 0x0000ffff
      29             : #define NF_VERDICT_BITS 16
      30             : 
      31             : #define NF_VERDICT_QMASK 0xffff0000
      32             : #define NF_VERDICT_QBITS 16
      33             : 
      34             : #define NF_QUEUE_NR(x) ((((x) << NF_VERDICT_BITS) & NF_VERDICT_QMASK) | NF_QUEUE)
      35             : 
      36             : /* only for userspace compatibility */
      37             : #ifndef __KERNEL__
      38             : /* Generic cache responses from hook functions.
      39             :    <= 0x2000 is used for protocol-flags. */
      40             : #define NFC_UNKNOWN 0x4000
      41             : #define NFC_ALTERED 0x8000
      42             : #endif
      43             : 
      44             : enum nf_inet_hooks {
      45             :         NF_INET_PRE_ROUTING,
      46             :         NF_INET_LOCAL_IN,
      47             :         NF_INET_FORWARD,
      48             :         NF_INET_LOCAL_OUT,
      49             :         NF_INET_POST_ROUTING,
      50             :         NF_INET_NUMHOOKS
      51             : };
      52             : 
      53             : enum {
      54             :         NFPROTO_UNSPEC =  0,
      55             :         NFPROTO_IPV4   =  2,
      56             :         NFPROTO_ARP    =  3,
      57             :         NFPROTO_BRIDGE =  7,
      58             :         NFPROTO_IPV6   = 10,
      59             :         NFPROTO_DECNET = 12,
      60             :         NFPROTO_NUMPROTO,
      61             : };
      62             : 
      63             : union nf_inet_addr {
      64             :         __u32           all[4];
      65             :         __be32          ip;
      66             :         __be32          ip6[4];
      67             :         struct in_addr  in;
      68             :         struct in6_addr in6;
      69             : };
      70             : 
      71             : #ifdef __KERNEL__
      72             : #ifdef CONFIG_NETFILTER
      73             : 
      74             : static inline int nf_inet_addr_cmp(const union nf_inet_addr *a1,
      75             :                                    const union nf_inet_addr *a2)
      76             : {
      77             :         return a1->all[0] == a2->all[0] &&
      78             :                a1->all[1] == a2->all[1] &&
      79             :                a1->all[2] == a2->all[2] &&
      80             :                a1->all[3] == a2->all[3];
      81             : }
      82             : 
      83             : extern void netfilter_init(void);
      84             : 
      85             : /* Largest hook number + 1 */
      86             : #define NF_MAX_HOOKS 8
      87             : 
      88             : struct sk_buff;
      89             : 
      90             : typedef unsigned int nf_hookfn(unsigned int hooknum,
      91             :                                struct sk_buff *skb,
      92             :                                const struct net_device *in,
      93             :                                const struct net_device *out,
      94             :                                int (*okfn)(struct sk_buff *));
      95             : 
      96             : struct nf_hook_ops {
      97             :         struct list_head list;
      98             : 
      99             :         /* User fills in from here down. */
     100             :         nf_hookfn *hook;
     101             :         struct module *owner;
     102             :         u_int8_t pf;
     103             :         unsigned int hooknum;
     104             :         /* Hooks are ordered in ascending priority. */
     105             :         int priority;
     106             : };
     107             : 
     108             : struct nf_sockopt_ops {
     109             :         struct list_head list;
     110             : 
     111             :         u_int8_t pf;
     112             : 
     113             :         /* Non-inclusive ranges: use 0/0/NULL to never get called. */
     114             :         int set_optmin;
     115             :         int set_optmax;
     116             :         int (*set)(struct sock *sk, int optval, void __user *user, unsigned int len);
     117             :         int (*compat_set)(struct sock *sk, int optval,
     118             :                         void __user *user, unsigned int len);
     119             : 
     120             :         int get_optmin;
     121             :         int get_optmax;
     122             :         int (*get)(struct sock *sk, int optval, void __user *user, int *len);
     123             :         int (*compat_get)(struct sock *sk, int optval,
     124             :                         void __user *user, int *len);
     125             : 
     126             :         /* Use the module struct to lock set/get code in place */
     127             :         struct module *owner;
     128             : };
     129             : 
     130             : /* Function to register/unregister hook points. */
     131             : int nf_register_hook(struct nf_hook_ops *reg);
     132             : void nf_unregister_hook(struct nf_hook_ops *reg);
     133             : int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n);
     134             : void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n);
     135             : 
     136             : /* Functions to register get/setsockopt ranges (non-inclusive).  You
     137             :    need to check permissions yourself! */
     138             : int nf_register_sockopt(struct nf_sockopt_ops *reg);
     139             : void nf_unregister_sockopt(struct nf_sockopt_ops *reg);
     140             : 
     141             : #ifdef CONFIG_SYSCTL
     142             : /* Sysctl registration */
     143             : extern struct ctl_path nf_net_netfilter_sysctl_path[];
     144             : extern struct ctl_path nf_net_ipv4_netfilter_sysctl_path[];
     145             : #endif /* CONFIG_SYSCTL */
     146             : 
     147             : extern struct list_head nf_hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
     148             : 
     149             : int nf_hook_slow(u_int8_t pf, unsigned int hook, struct sk_buff *skb,
     150             :                  struct net_device *indev, struct net_device *outdev,
     151             :                  int (*okfn)(struct sk_buff *), int thresh);
     152             : 
     153             : /**
     154             :  *      nf_hook_thresh - call a netfilter hook
     155             :  *      
     156             :  *      Returns 1 if the hook has allowed the packet to pass.  The function
     157             :  *      okfn must be invoked by the caller in this case.  Any other return
     158             :  *      value indicates the packet has been consumed by the hook.
     159             :  */
     160             : static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook,
     161             :                                  struct sk_buff *skb,
     162             :                                  struct net_device *indev,
     163             :                                  struct net_device *outdev,
     164             :                                  int (*okfn)(struct sk_buff *), int thresh,
     165             :                                  int cond)
     166             : {
     167             :         if (!cond)
     168             :                 return 1;
     169             : #ifndef CONFIG_NETFILTER_DEBUG
     170             :         if (list_empty(&nf_hooks[pf][hook]))
     171             :                 return 1;
     172             : #endif
     173             :         return nf_hook_slow(pf, hook, skb, indev, outdev, okfn, thresh);
     174             : }
     175             : 
     176             : static inline int nf_hook(u_int8_t pf, unsigned int hook, struct sk_buff *skb,
     177             :                           struct net_device *indev, struct net_device *outdev,
     178             :                           int (*okfn)(struct sk_buff *))
     179             : {
     180             :         return nf_hook_thresh(pf, hook, skb, indev, outdev, okfn, INT_MIN, 1);
     181             : }
     182             :                    
     183             : /* Activate hook; either okfn or kfree_skb called, unless a hook
     184             :    returns NF_STOLEN (in which case, it's up to the hook to deal with
     185             :    the consequences).
     186             : 
     187             :    Returns -ERRNO if packet dropped.  Zero means queued, stolen or
     188             :    accepted.
     189             : */
     190             : 
     191             : /* RR:
     192             :    > I don't want nf_hook to return anything because people might forget
     193             :    > about async and trust the return value to mean "packet was ok".
     194             : 
     195             :    AK:
     196             :    Just document it clearly, then you can expect some sense from kernel
     197             :    coders :)
     198             : */
     199             : 
     200             : /* This is gross, but inline doesn't cut it for avoiding the function
     201             :    call in fast path: gcc doesn't inline (needs value tracking?). --RR */
     202             : 
     203             : /* HX: It's slightly less gross now. */
     204             : 
     205             : #define NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, thresh)             \
     206             : ({int __ret;                                                                   \
     207             : if ((__ret=nf_hook_thresh(pf, hook, (skb), indev, outdev, okfn, thresh, 1)) == 1)\
     208             :         __ret = (okfn)(skb);                                                   \
     209             : __ret;})
     210             : 
     211             : #define NF_HOOK_COND(pf, hook, skb, indev, outdev, okfn, cond)                 \
     212             : ({int __ret;                                                                   \
     213             : if ((__ret=nf_hook_thresh(pf, hook, (skb), indev, outdev, okfn, INT_MIN, cond)) == 1)\
     214             :         __ret = (okfn)(skb);                                                   \
     215             : __ret;})
     216             : 
     217             : #define NF_HOOK(pf, hook, skb, indev, outdev, okfn) \
     218             :         NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, INT_MIN)
     219             : 
     220             : /* Call setsockopt() */
     221             : int nf_setsockopt(struct sock *sk, u_int8_t pf, int optval, char __user *opt,
     222             :                   unsigned int len);
     223             : int nf_getsockopt(struct sock *sk, u_int8_t pf, int optval, char __user *opt,
     224             :                   int *len);
     225             : 
     226             : int compat_nf_setsockopt(struct sock *sk, u_int8_t pf, int optval,
     227             :                 char __user *opt, unsigned int len);
     228             : int compat_nf_getsockopt(struct sock *sk, u_int8_t pf, int optval,
     229             :                 char __user *opt, int *len);
     230             : 
     231             : /* Call this before modifying an existing packet: ensures it is
     232             :    modifiable and linear to the point you care about (writable_len).
     233             :    Returns true or false. */
     234             : extern int skb_make_writable(struct sk_buff *skb, unsigned int writable_len);
     235             : 
     236             : struct flowi;
     237             : struct nf_queue_entry;
     238             : 
     239             : struct nf_afinfo {
     240             :         unsigned short  family;
     241             :         __sum16         (*checksum)(struct sk_buff *skb, unsigned int hook,
     242             :                                     unsigned int dataoff, u_int8_t protocol);
     243             :         __sum16         (*checksum_partial)(struct sk_buff *skb,
     244             :                                             unsigned int hook,
     245             :                                             unsigned int dataoff,
     246             :                                             unsigned int len,
     247             :                                             u_int8_t protocol);
     248             :         int             (*route)(struct dst_entry **dst, struct flowi *fl);
     249             :         void            (*saveroute)(const struct sk_buff *skb,
     250             :                                      struct nf_queue_entry *entry);
     251             :         int             (*reroute)(struct sk_buff *skb,
     252             :                                    const struct nf_queue_entry *entry);
     253             :         int             route_key_size;
     254             : };
     255             : 
     256             : extern const struct nf_afinfo *nf_afinfo[NFPROTO_NUMPROTO];
     257             : static inline const struct nf_afinfo *nf_get_afinfo(unsigned short family)
     258             : {
     259             :         return rcu_dereference(nf_afinfo[family]);
     260             : }
     261             : 
     262             : static inline __sum16
     263             : nf_checksum(struct sk_buff *skb, unsigned int hook, unsigned int dataoff,
     264             :             u_int8_t protocol, unsigned short family)
     265             : {
     266             :         const struct nf_afinfo *afinfo;
     267             :         __sum16 csum = 0;
     268             : 
     269             :         rcu_read_lock();
     270             :         afinfo = nf_get_afinfo(family);
     271             :         if (afinfo)
     272             :                 csum = afinfo->checksum(skb, hook, dataoff, protocol);
     273             :         rcu_read_unlock();
     274             :         return csum;
     275             : }
     276             : 
     277             : static inline __sum16
     278             : nf_checksum_partial(struct sk_buff *skb, unsigned int hook,
     279             :                     unsigned int dataoff, unsigned int len,
     280             :                     u_int8_t protocol, unsigned short family)
     281             : {
     282             :         const struct nf_afinfo *afinfo;
     283             :         __sum16 csum = 0;
     284             : 
     285             :         rcu_read_lock();
     286             :         afinfo = nf_get_afinfo(family);
     287             :         if (afinfo)
     288             :                 csum = afinfo->checksum_partial(skb, hook, dataoff, len,
     289             :                                                 protocol);
     290             :         rcu_read_unlock();
     291             :         return csum;
     292             : }
     293             : 
     294             : extern int nf_register_afinfo(const struct nf_afinfo *afinfo);
     295             : extern void nf_unregister_afinfo(const struct nf_afinfo *afinfo);
     296             : 
     297             : #include <net/flow.h>
     298             : extern void (*ip_nat_decode_session)(struct sk_buff *, struct flowi *);
     299             : 
     300             : static inline void
     301             : nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family)
     302             : {
     303             : #ifdef CONFIG_NF_NAT_NEEDED
     304             :         void (*decodefn)(struct sk_buff *, struct flowi *);
     305             : 
     306             :         if (family == AF_INET) {
     307             :                 rcu_read_lock();
     308             :                 decodefn = rcu_dereference(ip_nat_decode_session);
     309             :                 if (decodefn)
     310             :                         decodefn(skb, fl);
     311             :                 rcu_read_unlock();
     312             :         }
     313             : #endif
     314             : }
     315             : 
     316             : #ifdef CONFIG_PROC_FS
     317             : #include <linux/proc_fs.h>
     318             : extern struct proc_dir_entry *proc_net_netfilter;
     319             : #endif
     320             : 
     321             : #else /* !CONFIG_NETFILTER */
     322             : #define NF_HOOK(pf, hook, skb, indev, outdev, okfn) (okfn)(skb)
     323             : #define NF_HOOK_COND(pf, hook, skb, indev, outdev, okfn, cond) (okfn)(skb)
     324             : static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook,
     325             :                                  struct sk_buff *skb,
     326             :                                  struct net_device *indev,
     327             :                                  struct net_device *outdev,
     328             :                                  int (*okfn)(struct sk_buff *), int thresh,
     329             :                                  int cond)
     330             : {
     331             :         return okfn(skb);
     332             : }
     333             : static inline int nf_hook(u_int8_t pf, unsigned int hook, struct sk_buff *skb,
     334             :                           struct net_device *indev, struct net_device *outdev,
     335             :                           int (*okfn)(struct sk_buff *))
     336             : {
     337             :         return 1;
     338             : }
     339           1 : struct flowi;
     340             : static inline void
     341             : nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family)
     342             : {
     343             : }
     344             : #endif /*CONFIG_NETFILTER*/
     345             : 
     346             : #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
     347             : extern void (*ip_ct_attach)(struct sk_buff *, struct sk_buff *);
     348             : extern void nf_ct_attach(struct sk_buff *, struct sk_buff *);
     349             : extern void (*nf_ct_destroy)(struct nf_conntrack *);
     350             : #else
     351             : static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {}
     352             : #endif
     353             : 
     354             : #endif /*__KERNEL__*/
     355             : #endif /*__LINUX_NETFILTER_H*/

Generated by: LCOV version 1.10