2005-04-17 06:20:36 +08:00
|
|
|
#ifndef __LINUX_NETFILTER_H
|
|
|
|
|
#define __LINUX_NETFILTER_H
|
|
|
|
|
|
|
|
|
|
#include <linux/init.h>
|
|
|
|
|
#include <linux/skbuff.h>
|
|
|
|
|
#include <linux/net.h>
|
|
|
|
|
#include <linux/if.h>
|
2008-01-15 15:40:34 +08:00
|
|
|
#include <linux/in.h>
|
|
|
|
|
#include <linux/in6.h>
|
2005-04-17 06:20:36 +08:00
|
|
|
#include <linux/wait.h>
|
|
|
|
|
#include <linux/list.h>
|
2014-08-22 10:40:15 +08:00
|
|
|
#include <linux/static_key.h>
|
2012-10-13 17:46:48 +08:00
|
|
|
#include <uapi/linux/netfilter.h>
|
2005-04-17 06:20:36 +08:00
|
|
|
#ifdef CONFIG_NETFILTER
|
2011-01-18 22:52:14 +08:00
|
|
|
static inline int NF_DROP_GETERR(int verdict)
|
|
|
|
|
{
|
|
|
|
|
return -(verdict >> NF_VERDICT_QBITS);
|
|
|
|
|
}
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2008-03-26 11:09:33 +08:00
|
|
|
static inline int nf_inet_addr_cmp(const union nf_inet_addr *a1,
|
|
|
|
|
const union nf_inet_addr *a2)
|
|
|
|
|
{
|
|
|
|
|
return a1->all[0] == a2->all[0] &&
|
|
|
|
|
a1->all[1] == a2->all[1] &&
|
|
|
|
|
a1->all[2] == a2->all[2] &&
|
|
|
|
|
a1->all[3] == a2->all[3];
|
|
|
|
|
}
|
|
|
|
|
|
2012-05-18 04:08:57 +08:00
|
|
|
static inline void nf_inet_addr_mask(const union nf_inet_addr *a1,
|
|
|
|
|
union nf_inet_addr *result,
|
|
|
|
|
const union nf_inet_addr *mask)
|
|
|
|
|
{
|
|
|
|
|
result->all[0] = a1->all[0] & mask->all[0];
|
|
|
|
|
result->all[1] = a1->all[1] & mask->all[1];
|
|
|
|
|
result->all[2] = a1->all[2] & mask->all[2];
|
|
|
|
|
result->all[3] = a1->all[3] & mask->all[3];
|
|
|
|
|
}
|
|
|
|
|
|
2013-09-27 05:48:15 +08:00
|
|
|
int netfilter_init(void);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
/* Largest hook number + 1 */
|
|
|
|
|
#define NF_MAX_HOOKS 8
|
|
|
|
|
|
|
|
|
|
struct sk_buff;
|
|
|
|
|
|
2013-10-10 15:21:55 +08:00
|
|
|
struct nf_hook_ops;
|
2015-04-04 04:23:58 +08:00
|
|
|
|
|
|
|
|
struct nf_hook_state {
|
|
|
|
|
unsigned int hook;
|
|
|
|
|
int thresh;
|
|
|
|
|
u_int8_t pf;
|
|
|
|
|
struct net_device *in;
|
|
|
|
|
struct net_device *out;
|
|
|
|
|
int (*okfn)(struct sk_buff *);
|
|
|
|
|
};
|
|
|
|
|
|
2015-04-06 10:18:54 +08:00
|
|
|
static inline void nf_hook_state_init(struct nf_hook_state *p,
|
|
|
|
|
unsigned int hook,
|
|
|
|
|
int thresh, u_int8_t pf,
|
|
|
|
|
struct net_device *indev,
|
|
|
|
|
struct net_device *outdev,
|
|
|
|
|
int (*okfn)(struct sk_buff *))
|
|
|
|
|
{
|
|
|
|
|
p->hook = hook;
|
|
|
|
|
p->thresh = thresh;
|
|
|
|
|
p->pf = pf;
|
|
|
|
|
p->in = indev;
|
|
|
|
|
p->out = outdev;
|
|
|
|
|
p->okfn = okfn;
|
|
|
|
|
}
|
|
|
|
|
|
2013-10-10 15:21:55 +08:00
|
|
|
typedef unsigned int nf_hookfn(const struct nf_hook_ops *ops,
|
2007-10-15 15:53:15 +08:00
|
|
|
struct sk_buff *skb,
|
2015-04-04 08:32:56 +08:00
|
|
|
const struct nf_hook_state *state);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2009-11-05 01:50:58 +08:00
|
|
|
struct nf_hook_ops {
|
2005-04-17 06:20:36 +08:00
|
|
|
struct list_head list;
|
|
|
|
|
|
|
|
|
|
/* User fills in from here down. */
|
netfilter: add nftables
This patch adds nftables which is the intended successor of iptables.
This packet filtering framework reuses the existing netfilter hooks,
the connection tracking system, the NAT subsystem, the transparent
proxying engine, the logging infrastructure and the userspace packet
queueing facilities.
In a nutshell, nftables provides a pseudo-state machine with 4 general
purpose registers of 128 bits and 1 specific purpose register to store
verdicts. This pseudo-machine comes with an extensible instruction set,
a.k.a. "expressions" in the nftables jargon. The expressions included
in this patch provide the basic functionality, they are:
* bitwise: to perform bitwise operations.
* byteorder: to change from host/network endianess.
* cmp: to compare data with the content of the registers.
* counter: to enable counters on rules.
* ct: to store conntrack keys into register.
* exthdr: to match IPv6 extension headers.
* immediate: to load data into registers.
* limit: to limit matching based on packet rate.
* log: to log packets.
* meta: to match metainformation that usually comes with the skbuff.
* nat: to perform Network Address Translation.
* payload: to fetch data from the packet payload and store it into
registers.
* reject (IPv4 only): to explicitly close connection, eg. TCP RST.
Using this instruction-set, the userspace utility 'nft' can transform
the rules expressed in human-readable text representation (using a
new syntax, inspired by tcpdump) to nftables bytecode.
nftables also inherits the table, chain and rule objects from
iptables, but in a more configurable way, and it also includes the
original datatype-agnostic set infrastructure with mapping support.
This set infrastructure is enhanced in the follow up patch (netfilter:
nf_tables: add netlink set API).
This patch includes the following components:
* the netlink API: net/netfilter/nf_tables_api.c and
include/uapi/netfilter/nf_tables.h
* the packet filter core: net/netfilter/nf_tables_core.c
* the expressions (described above): net/netfilter/nft_*.c
* the filter tables: arp, IPv4, IPv6 and bridge:
net/ipv4/netfilter/nf_tables_ipv4.c
net/ipv6/netfilter/nf_tables_ipv6.c
net/ipv4/netfilter/nf_tables_arp.c
net/bridge/netfilter/nf_tables_bridge.c
* the NAT table (IPv4 only):
net/ipv4/netfilter/nf_table_nat_ipv4.c
* the route table (similar to mangle):
net/ipv4/netfilter/nf_table_route_ipv4.c
net/ipv6/netfilter/nf_table_route_ipv6.c
* internal definitions under:
include/net/netfilter/nf_tables.h
include/net/netfilter/nf_tables_core.h
* It also includes an skeleton expression:
net/netfilter/nft_expr_template.c
and the preliminary implementation of the meta target
net/netfilter/nft_meta_target.c
It also includes a change in struct nf_hook_ops to add a new
pointer to store private data to the hook, that is used to store
the rule list per chain.
This patch is based on the patch from Patrick McHardy, plus merged
accumulated cleanups, fixes and small enhancements to the nftables
code that has been done since 2009, which are:
From Patrick McHardy:
* nf_tables: adjust netlink handler function signatures
* nf_tables: only retry table lookup after successful table module load
* nf_tables: fix event notification echo and avoid unnecessary messages
* nft_ct: add l3proto support
* nf_tables: pass expression context to nft_validate_data_load()
* nf_tables: remove redundant definition
* nft_ct: fix maxattr initialization
* nf_tables: fix invalid event type in nf_tables_getrule()
* nf_tables: simplify nft_data_init() usage
* nf_tables: build in more core modules
* nf_tables: fix double lookup expression unregistation
* nf_tables: move expression initialization to nf_tables_core.c
* nf_tables: build in payload module
* nf_tables: use NFPROTO constants
* nf_tables: rename pid variables to portid
* nf_tables: save 48 bits per rule
* nf_tables: introduce chain rename
* nf_tables: check for duplicate names on chain rename
* nf_tables: remove ability to specify handles for new rules
* nf_tables: return error for rule change request
* nf_tables: return error for NLM_F_REPLACE without rule handle
* nf_tables: include NLM_F_APPEND/NLM_F_REPLACE flags in rule notification
* nf_tables: fix NLM_F_MULTI usage in netlink notifications
* nf_tables: include NLM_F_APPEND in rule dumps
From Pablo Neira Ayuso:
* nf_tables: fix stack overflow in nf_tables_newrule
* nf_tables: nft_ct: fix compilation warning
* nf_tables: nft_ct: fix crash with invalid packets
* nft_log: group and qthreshold are 2^16
* nf_tables: nft_meta: fix socket uid,gid handling
* nft_counter: allow to restore counters
* nf_tables: fix module autoload
* nf_tables: allow to remove all rules placed in one chain
* nf_tables: use 64-bits rule handle instead of 16-bits
* nf_tables: fix chain after rule deletion
* nf_tables: improve deletion performance
* nf_tables: add missing code in route chain type
* nf_tables: rise maximum number of expressions from 12 to 128
* nf_tables: don't delete table if in use
* nf_tables: fix basechain release
From Tomasz Bursztyka:
* nf_tables: Add support for changing users chain's name
* nf_tables: Change chain's name to be fixed sized
* nf_tables: Add support for replacing a rule by another one
* nf_tables: Update uapi nftables netlink header documentation
From Florian Westphal:
* nft_log: group is u16, snaplen u32
From Phil Oester:
* nf_tables: operational limit match
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-10-14 17:00:02 +08:00
|
|
|
nf_hookfn *hook;
|
|
|
|
|
struct module *owner;
|
|
|
|
|
void *priv;
|
|
|
|
|
u_int8_t pf;
|
|
|
|
|
unsigned int hooknum;
|
2005-04-17 06:20:36 +08:00
|
|
|
/* Hooks are ordered in ascending priority. */
|
netfilter: add nftables
This patch adds nftables which is the intended successor of iptables.
This packet filtering framework reuses the existing netfilter hooks,
the connection tracking system, the NAT subsystem, the transparent
proxying engine, the logging infrastructure and the userspace packet
queueing facilities.
In a nutshell, nftables provides a pseudo-state machine with 4 general
purpose registers of 128 bits and 1 specific purpose register to store
verdicts. This pseudo-machine comes with an extensible instruction set,
a.k.a. "expressions" in the nftables jargon. The expressions included
in this patch provide the basic functionality, they are:
* bitwise: to perform bitwise operations.
* byteorder: to change from host/network endianess.
* cmp: to compare data with the content of the registers.
* counter: to enable counters on rules.
* ct: to store conntrack keys into register.
* exthdr: to match IPv6 extension headers.
* immediate: to load data into registers.
* limit: to limit matching based on packet rate.
* log: to log packets.
* meta: to match metainformation that usually comes with the skbuff.
* nat: to perform Network Address Translation.
* payload: to fetch data from the packet payload and store it into
registers.
* reject (IPv4 only): to explicitly close connection, eg. TCP RST.
Using this instruction-set, the userspace utility 'nft' can transform
the rules expressed in human-readable text representation (using a
new syntax, inspired by tcpdump) to nftables bytecode.
nftables also inherits the table, chain and rule objects from
iptables, but in a more configurable way, and it also includes the
original datatype-agnostic set infrastructure with mapping support.
This set infrastructure is enhanced in the follow up patch (netfilter:
nf_tables: add netlink set API).
This patch includes the following components:
* the netlink API: net/netfilter/nf_tables_api.c and
include/uapi/netfilter/nf_tables.h
* the packet filter core: net/netfilter/nf_tables_core.c
* the expressions (described above): net/netfilter/nft_*.c
* the filter tables: arp, IPv4, IPv6 and bridge:
net/ipv4/netfilter/nf_tables_ipv4.c
net/ipv6/netfilter/nf_tables_ipv6.c
net/ipv4/netfilter/nf_tables_arp.c
net/bridge/netfilter/nf_tables_bridge.c
* the NAT table (IPv4 only):
net/ipv4/netfilter/nf_table_nat_ipv4.c
* the route table (similar to mangle):
net/ipv4/netfilter/nf_table_route_ipv4.c
net/ipv6/netfilter/nf_table_route_ipv6.c
* internal definitions under:
include/net/netfilter/nf_tables.h
include/net/netfilter/nf_tables_core.h
* It also includes an skeleton expression:
net/netfilter/nft_expr_template.c
and the preliminary implementation of the meta target
net/netfilter/nft_meta_target.c
It also includes a change in struct nf_hook_ops to add a new
pointer to store private data to the hook, that is used to store
the rule list per chain.
This patch is based on the patch from Patrick McHardy, plus merged
accumulated cleanups, fixes and small enhancements to the nftables
code that has been done since 2009, which are:
From Patrick McHardy:
* nf_tables: adjust netlink handler function signatures
* nf_tables: only retry table lookup after successful table module load
* nf_tables: fix event notification echo and avoid unnecessary messages
* nft_ct: add l3proto support
* nf_tables: pass expression context to nft_validate_data_load()
* nf_tables: remove redundant definition
* nft_ct: fix maxattr initialization
* nf_tables: fix invalid event type in nf_tables_getrule()
* nf_tables: simplify nft_data_init() usage
* nf_tables: build in more core modules
* nf_tables: fix double lookup expression unregistation
* nf_tables: move expression initialization to nf_tables_core.c
* nf_tables: build in payload module
* nf_tables: use NFPROTO constants
* nf_tables: rename pid variables to portid
* nf_tables: save 48 bits per rule
* nf_tables: introduce chain rename
* nf_tables: check for duplicate names on chain rename
* nf_tables: remove ability to specify handles for new rules
* nf_tables: return error for rule change request
* nf_tables: return error for NLM_F_REPLACE without rule handle
* nf_tables: include NLM_F_APPEND/NLM_F_REPLACE flags in rule notification
* nf_tables: fix NLM_F_MULTI usage in netlink notifications
* nf_tables: include NLM_F_APPEND in rule dumps
From Pablo Neira Ayuso:
* nf_tables: fix stack overflow in nf_tables_newrule
* nf_tables: nft_ct: fix compilation warning
* nf_tables: nft_ct: fix crash with invalid packets
* nft_log: group and qthreshold are 2^16
* nf_tables: nft_meta: fix socket uid,gid handling
* nft_counter: allow to restore counters
* nf_tables: fix module autoload
* nf_tables: allow to remove all rules placed in one chain
* nf_tables: use 64-bits rule handle instead of 16-bits
* nf_tables: fix chain after rule deletion
* nf_tables: improve deletion performance
* nf_tables: add missing code in route chain type
* nf_tables: rise maximum number of expressions from 12 to 128
* nf_tables: don't delete table if in use
* nf_tables: fix basechain release
From Tomasz Bursztyka:
* nf_tables: Add support for changing users chain's name
* nf_tables: Change chain's name to be fixed sized
* nf_tables: Add support for replacing a rule by another one
* nf_tables: Update uapi nftables netlink header documentation
From Florian Westphal:
* nft_log: group is u16, snaplen u32
From Phil Oester:
* nf_tables: operational limit match
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-10-14 17:00:02 +08:00
|
|
|
int priority;
|
2005-04-17 06:20:36 +08:00
|
|
|
};
|
|
|
|
|
|
2009-11-05 01:50:58 +08:00
|
|
|
struct nf_sockopt_ops {
|
2005-04-17 06:20:36 +08:00
|
|
|
struct list_head list;
|
|
|
|
|
|
2008-10-08 17:35:00 +08:00
|
|
|
u_int8_t pf;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
/* Non-inclusive ranges: use 0/0/NULL to never get called. */
|
|
|
|
|
int set_optmin;
|
|
|
|
|
int set_optmax;
|
|
|
|
|
int (*set)(struct sock *sk, int optval, void __user *user, unsigned int len);
|
2010-02-02 22:03:24 +08:00
|
|
|
#ifdef CONFIG_COMPAT
|
2006-03-21 14:45:21 +08:00
|
|
|
int (*compat_set)(struct sock *sk, int optval,
|
|
|
|
|
void __user *user, unsigned int len);
|
2010-02-02 22:03:24 +08:00
|
|
|
#endif
|
2005-04-17 06:20:36 +08:00
|
|
|
int get_optmin;
|
|
|
|
|
int get_optmax;
|
|
|
|
|
int (*get)(struct sock *sk, int optval, void __user *user, int *len);
|
2010-02-02 22:03:24 +08:00
|
|
|
#ifdef CONFIG_COMPAT
|
2006-03-21 14:45:21 +08:00
|
|
|
int (*compat_get)(struct sock *sk, int optval,
|
|
|
|
|
void __user *user, int *len);
|
2010-02-02 22:03:24 +08:00
|
|
|
#endif
|
[NETFILTER]: Fix/improve deadlock condition on module removal netfilter
So I've had a deadlock reported to me. I've found that the sequence of
events goes like this:
1) process A (modprobe) runs to remove ip_tables.ko
2) process B (iptables-restore) runs and calls setsockopt on a netfilter socket,
increasing the ip_tables socket_ops use count
3) process A acquires a file lock on the file ip_tables.ko, calls remove_module
in the kernel, which in turn executes the ip_tables module cleanup routine,
which calls nf_unregister_sockopt
4) nf_unregister_sockopt, seeing that the use count is non-zero, puts the
calling process into uninterruptible sleep, expecting the process using the
socket option code to wake it up when it exits the kernel
4) the user of the socket option code (process B) in do_ipt_get_ctl, calls
ipt_find_table_lock, which in this case calls request_module to load
ip_tables_nat.ko
5) request_module forks a copy of modprobe (process C) to load the module and
blocks until modprobe exits.
6) Process C. forked by request_module process the dependencies of
ip_tables_nat.ko, of which ip_tables.ko is one.
7) Process C attempts to lock the request module and all its dependencies, it
blocks when it attempts to lock ip_tables.ko (which was previously locked in
step 3)
Theres not really any great permanent solution to this that I can see, but I've
developed a two part solution that corrects the problem
Part 1) Modifies the nf_sockopt registration code so that, instead of using a
use counter internal to the nf_sockopt_ops structure, we instead use a pointer
to the registering modules owner to do module reference counting when nf_sockopt
calls a modules set/get routine. This prevents the deadlock by preventing set 4
from happening.
Part 2) Enhances the modprobe utilty so that by default it preforms non-blocking
remove operations (the same way rmmod does), and add an option to explicity
request blocking operation. So if you select blocking operation in modprobe you
can still cause the above deadlock, but only if you explicity try (and since
root can do any old stupid thing it would like.... :) ).
Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2007-09-11 17:28:26 +08:00
|
|
|
/* Use the module struct to lock set/get code in place */
|
|
|
|
|
struct module *owner;
|
2005-04-17 06:20:36 +08:00
|
|
|
};
|
|
|
|
|
|
|
|
|
|
/* Function to register/unregister hook points. */
|
|
|
|
|
int nf_register_hook(struct nf_hook_ops *reg);
|
|
|
|
|
void nf_unregister_hook(struct nf_hook_ops *reg);
|
2006-04-07 05:09:12 +08:00
|
|
|
int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n);
|
|
|
|
|
void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
/* Functions to register get/setsockopt ranges (non-inclusive). You
|
|
|
|
|
need to check permissions yourself! */
|
|
|
|
|
int nf_register_sockopt(struct nf_sockopt_ops *reg);
|
|
|
|
|
void nf_unregister_sockopt(struct nf_sockopt_ops *reg);
|
|
|
|
|
|
2008-10-08 17:35:00 +08:00
|
|
|
extern struct list_head nf_hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2014-08-22 10:40:15 +08:00
|
|
|
#ifdef HAVE_JUMP_LABEL
|
2012-02-24 15:31:31 +08:00
|
|
|
extern struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
|
2014-08-22 10:40:15 +08:00
|
|
|
|
2011-11-19 01:32:46 +08:00
|
|
|
static inline bool nf_hooks_active(u_int8_t pf, unsigned int hook)
|
|
|
|
|
{
|
|
|
|
|
if (__builtin_constant_p(pf) &&
|
|
|
|
|
__builtin_constant_p(hook))
|
2012-02-24 15:31:31 +08:00
|
|
|
return static_key_false(&nf_hooks_needed[pf][hook]);
|
2011-11-19 01:32:46 +08:00
|
|
|
|
|
|
|
|
return !list_empty(&nf_hooks[pf][hook]);
|
|
|
|
|
}
|
|
|
|
|
#else
|
|
|
|
|
static inline bool nf_hooks_active(u_int8_t pf, unsigned int hook)
|
|
|
|
|
{
|
|
|
|
|
return !list_empty(&nf_hooks[pf][hook]);
|
|
|
|
|
}
|
|
|
|
|
#endif
|
|
|
|
|
|
2015-04-04 04:23:58 +08:00
|
|
|
int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state);
|
2006-01-07 15:01:48 +08:00
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* nf_hook_thresh - call a netfilter hook
|
|
|
|
|
*
|
|
|
|
|
* Returns 1 if the hook has allowed the packet to pass. The function
|
|
|
|
|
* okfn must be invoked by the caller in this case. Any other return
|
|
|
|
|
* value indicates the packet has been consumed by the hook.
|
|
|
|
|
*/
|
2008-10-08 17:35:00 +08:00
|
|
|
static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook,
|
2007-10-15 15:53:15 +08:00
|
|
|
struct sk_buff *skb,
|
2006-01-07 15:01:48 +08:00
|
|
|
struct net_device *indev,
|
|
|
|
|
struct net_device *outdev,
|
2009-06-05 23:31:46 +08:00
|
|
|
int (*okfn)(struct sk_buff *), int thresh)
|
2006-01-07 15:01:48 +08:00
|
|
|
{
|
2015-04-04 04:23:58 +08:00
|
|
|
if (nf_hooks_active(pf, hook)) {
|
2015-04-06 10:18:54 +08:00
|
|
|
struct nf_hook_state state;
|
2015-04-04 04:23:58 +08:00
|
|
|
|
2015-04-06 10:18:54 +08:00
|
|
|
nf_hook_state_init(&state, hook, thresh, pf,
|
|
|
|
|
indev, outdev, okfn);
|
2015-04-04 04:23:58 +08:00
|
|
|
return nf_hook_slow(skb, &state);
|
|
|
|
|
}
|
2011-11-19 01:32:46 +08:00
|
|
|
return 1;
|
2006-01-07 15:01:48 +08:00
|
|
|
}
|
|
|
|
|
|
2008-10-08 17:35:00 +08:00
|
|
|
static inline int nf_hook(u_int8_t pf, unsigned int hook, struct sk_buff *skb,
|
2006-01-07 15:01:48 +08:00
|
|
|
struct net_device *indev, struct net_device *outdev,
|
|
|
|
|
int (*okfn)(struct sk_buff *))
|
|
|
|
|
{
|
2009-06-05 23:31:46 +08:00
|
|
|
return nf_hook_thresh(pf, hook, skb, indev, outdev, okfn, INT_MIN);
|
2006-01-07 15:01:48 +08:00
|
|
|
}
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
/* Activate hook; either okfn or kfree_skb called, unless a hook
|
|
|
|
|
returns NF_STOLEN (in which case, it's up to the hook to deal with
|
|
|
|
|
the consequences).
|
|
|
|
|
|
|
|
|
|
Returns -ERRNO if packet dropped. Zero means queued, stolen or
|
|
|
|
|
accepted.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
/* RR:
|
|
|
|
|
> I don't want nf_hook to return anything because people might forget
|
|
|
|
|
> about async and trust the return value to mean "packet was ok".
|
|
|
|
|
|
|
|
|
|
AK:
|
|
|
|
|
Just document it clearly, then you can expect some sense from kernel
|
|
|
|
|
coders :)
|
|
|
|
|
*/
|
|
|
|
|
|
2009-06-13 10:13:26 +08:00
|
|
|
static inline int
|
|
|
|
|
NF_HOOK_THRESH(uint8_t pf, unsigned int hook, struct sk_buff *skb,
|
|
|
|
|
struct net_device *in, struct net_device *out,
|
|
|
|
|
int (*okfn)(struct sk_buff *), int thresh)
|
|
|
|
|
{
|
|
|
|
|
int ret = nf_hook_thresh(pf, hook, skb, in, out, okfn, thresh);
|
|
|
|
|
if (ret == 1)
|
|
|
|
|
ret = okfn(skb);
|
|
|
|
|
return ret;
|
|
|
|
|
}
|
2006-02-16 07:10:22 +08:00
|
|
|
|
2009-06-13 10:13:26 +08:00
|
|
|
static inline int
|
|
|
|
|
NF_HOOK_COND(uint8_t pf, unsigned int hook, struct sk_buff *skb,
|
|
|
|
|
struct net_device *in, struct net_device *out,
|
|
|
|
|
int (*okfn)(struct sk_buff *), bool cond)
|
|
|
|
|
{
|
2010-02-19 15:03:28 +08:00
|
|
|
int ret;
|
|
|
|
|
|
|
|
|
|
if (!cond ||
|
2010-11-12 15:26:06 +08:00
|
|
|
((ret = nf_hook_thresh(pf, hook, skb, in, out, okfn, INT_MIN)) == 1))
|
2009-06-13 10:13:26 +08:00
|
|
|
ret = okfn(skb);
|
|
|
|
|
return ret;
|
|
|
|
|
}
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2009-06-13 10:13:26 +08:00
|
|
|
static inline int
|
|
|
|
|
NF_HOOK(uint8_t pf, unsigned int hook, struct sk_buff *skb,
|
|
|
|
|
struct net_device *in, struct net_device *out,
|
|
|
|
|
int (*okfn)(struct sk_buff *))
|
|
|
|
|
{
|
|
|
|
|
return NF_HOOK_THRESH(pf, hook, skb, in, out, okfn, INT_MIN);
|
|
|
|
|
}
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
/* Call setsockopt() */
|
2008-10-08 17:35:00 +08:00
|
|
|
int nf_setsockopt(struct sock *sk, u_int8_t pf, int optval, char __user *opt,
|
2009-10-01 07:12:20 +08:00
|
|
|
unsigned int len);
|
2008-10-08 17:35:00 +08:00
|
|
|
int nf_getsockopt(struct sock *sk, u_int8_t pf, int optval, char __user *opt,
|
2005-04-17 06:20:36 +08:00
|
|
|
int *len);
|
2010-02-02 22:03:24 +08:00
|
|
|
#ifdef CONFIG_COMPAT
|
2008-10-08 17:35:00 +08:00
|
|
|
int compat_nf_setsockopt(struct sock *sk, u_int8_t pf, int optval,
|
2009-10-01 07:12:20 +08:00
|
|
|
char __user *opt, unsigned int len);
|
2008-10-08 17:35:00 +08:00
|
|
|
int compat_nf_getsockopt(struct sock *sk, u_int8_t pf, int optval,
|
2006-03-21 14:45:21 +08:00
|
|
|
char __user *opt, int *len);
|
2010-02-02 22:03:24 +08:00
|
|
|
#endif
|
2006-03-21 14:45:21 +08:00
|
|
|
|
2005-08-10 10:37:23 +08:00
|
|
|
/* Call this before modifying an existing packet: ensures it is
|
|
|
|
|
modifiable and linear to the point you care about (writable_len).
|
|
|
|
|
Returns true or false. */
|
2013-09-27 05:48:15 +08:00
|
|
|
int skb_make_writable(struct sk_buff *skb, unsigned int writable_len);
|
2005-08-10 10:37:23 +08:00
|
|
|
|
2007-12-05 17:22:05 +08:00
|
|
|
struct flowi;
|
2007-12-05 17:26:33 +08:00
|
|
|
struct nf_queue_entry;
|
2007-12-05 17:24:48 +08:00
|
|
|
|
2006-04-07 05:18:09 +08:00
|
|
|
struct nf_afinfo {
|
|
|
|
|
unsigned short family;
|
2006-11-15 13:40:42 +08:00
|
|
|
__sum16 (*checksum)(struct sk_buff *skb, unsigned int hook,
|
2006-04-07 05:18:43 +08:00
|
|
|
unsigned int dataoff, u_int8_t protocol);
|
2008-03-20 22:15:53 +08:00
|
|
|
__sum16 (*checksum_partial)(struct sk_buff *skb,
|
|
|
|
|
unsigned int hook,
|
|
|
|
|
unsigned int dataoff,
|
|
|
|
|
unsigned int len,
|
|
|
|
|
u_int8_t protocol);
|
2011-04-04 22:56:29 +08:00
|
|
|
int (*route)(struct net *net, struct dst_entry **dst,
|
2011-04-04 23:00:54 +08:00
|
|
|
struct flowi *fl, bool strict);
|
2006-04-07 05:18:09 +08:00
|
|
|
void (*saveroute)(const struct sk_buff *skb,
|
2007-12-05 17:26:33 +08:00
|
|
|
struct nf_queue_entry *entry);
|
2007-10-15 15:53:15 +08:00
|
|
|
int (*reroute)(struct sk_buff *skb,
|
2007-12-05 17:26:33 +08:00
|
|
|
const struct nf_queue_entry *entry);
|
2006-04-07 05:18:09 +08:00
|
|
|
int route_key_size;
|
2005-08-10 10:42:34 +08:00
|
|
|
};
|
|
|
|
|
|
2010-11-16 01:17:21 +08:00
|
|
|
extern const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO];
|
2007-12-18 14:42:27 +08:00
|
|
|
static inline const struct nf_afinfo *nf_get_afinfo(unsigned short family)
|
2006-04-07 05:18:09 +08:00
|
|
|
{
|
|
|
|
|
return rcu_dereference(nf_afinfo[family]);
|
|
|
|
|
}
|
2005-08-10 10:42:34 +08:00
|
|
|
|
2006-11-15 13:40:42 +08:00
|
|
|
static inline __sum16
|
2006-04-07 05:18:43 +08:00
|
|
|
nf_checksum(struct sk_buff *skb, unsigned int hook, unsigned int dataoff,
|
|
|
|
|
u_int8_t protocol, unsigned short family)
|
|
|
|
|
{
|
2007-12-18 14:42:27 +08:00
|
|
|
const struct nf_afinfo *afinfo;
|
2006-11-15 13:40:42 +08:00
|
|
|
__sum16 csum = 0;
|
2006-04-07 05:18:43 +08:00
|
|
|
|
|
|
|
|
rcu_read_lock();
|
|
|
|
|
afinfo = nf_get_afinfo(family);
|
|
|
|
|
if (afinfo)
|
|
|
|
|
csum = afinfo->checksum(skb, hook, dataoff, protocol);
|
|
|
|
|
rcu_read_unlock();
|
|
|
|
|
return csum;
|
|
|
|
|
}
|
|
|
|
|
|
2008-03-20 22:15:53 +08:00
|
|
|
static inline __sum16
|
|
|
|
|
nf_checksum_partial(struct sk_buff *skb, unsigned int hook,
|
|
|
|
|
unsigned int dataoff, unsigned int len,
|
|
|
|
|
u_int8_t protocol, unsigned short family)
|
|
|
|
|
{
|
|
|
|
|
const struct nf_afinfo *afinfo;
|
|
|
|
|
__sum16 csum = 0;
|
|
|
|
|
|
|
|
|
|
rcu_read_lock();
|
|
|
|
|
afinfo = nf_get_afinfo(family);
|
|
|
|
|
if (afinfo)
|
|
|
|
|
csum = afinfo->checksum_partial(skb, hook, dataoff, len,
|
|
|
|
|
protocol);
|
|
|
|
|
rcu_read_unlock();
|
|
|
|
|
return csum;
|
|
|
|
|
}
|
|
|
|
|
|
2013-09-27 05:48:15 +08:00
|
|
|
int nf_register_afinfo(const struct nf_afinfo *afinfo);
|
|
|
|
|
void nf_unregister_afinfo(const struct nf_afinfo *afinfo);
|
2006-04-07 05:18:09 +08:00
|
|
|
|
2006-01-07 15:06:30 +08:00
|
|
|
#include <net/flow.h>
|
2012-08-27 01:14:06 +08:00
|
|
|
extern void (*nf_nat_decode_session_hook)(struct sk_buff *, struct flowi *);
|
2006-01-07 15:06:30 +08:00
|
|
|
|
|
|
|
|
static inline void
|
2008-10-08 17:35:00 +08:00
|
|
|
nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family)
|
2006-01-07 15:06:30 +08:00
|
|
|
{
|
2007-12-18 14:42:51 +08:00
|
|
|
#ifdef CONFIG_NF_NAT_NEEDED
|
2006-01-07 15:06:30 +08:00
|
|
|
void (*decodefn)(struct sk_buff *, struct flowi *);
|
|
|
|
|
|
2012-08-27 01:14:06 +08:00
|
|
|
rcu_read_lock();
|
|
|
|
|
decodefn = rcu_dereference(nf_nat_decode_session_hook);
|
|
|
|
|
if (decodefn)
|
|
|
|
|
decodefn(skb, fl);
|
|
|
|
|
rcu_read_unlock();
|
2006-01-07 15:06:30 +08:00
|
|
|
#endif
|
|
|
|
|
}
|
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
#else /* !CONFIG_NETFILTER */
|
|
|
|
|
#define NF_HOOK(pf, hook, skb, indev, outdev, okfn) (okfn)(skb)
|
2006-02-16 07:10:22 +08:00
|
|
|
#define NF_HOOK_COND(pf, hook, skb, indev, outdev, okfn, cond) (okfn)(skb)
|
2008-10-08 17:35:00 +08:00
|
|
|
static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook,
|
2007-10-15 15:53:15 +08:00
|
|
|
struct sk_buff *skb,
|
2006-01-08 04:50:27 +08:00
|
|
|
struct net_device *indev,
|
|
|
|
|
struct net_device *outdev,
|
2009-06-05 23:31:46 +08:00
|
|
|
int (*okfn)(struct sk_buff *), int thresh)
|
2006-01-08 04:50:27 +08:00
|
|
|
{
|
2007-10-15 15:53:15 +08:00
|
|
|
return okfn(skb);
|
2006-01-08 04:50:27 +08:00
|
|
|
}
|
2008-10-08 17:35:00 +08:00
|
|
|
static inline int nf_hook(u_int8_t pf, unsigned int hook, struct sk_buff *skb,
|
2006-01-08 04:50:27 +08:00
|
|
|
struct net_device *indev, struct net_device *outdev,
|
|
|
|
|
int (*okfn)(struct sk_buff *))
|
|
|
|
|
{
|
2006-02-16 07:18:19 +08:00
|
|
|
return 1;
|
2006-01-08 04:50:27 +08:00
|
|
|
}
|
|
|
|
|
struct flowi;
|
2006-01-07 15:06:30 +08:00
|
|
|
static inline void
|
2008-10-08 17:35:00 +08:00
|
|
|
nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family)
|
|
|
|
|
{
|
|
|
|
|
}
|
2005-04-17 06:20:36 +08:00
|
|
|
#endif /*CONFIG_NETFILTER*/
|
|
|
|
|
|
2007-03-24 02:17:07 +08:00
|
|
|
#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
|
2013-07-29 04:54:08 +08:00
|
|
|
extern void (*ip_ct_attach)(struct sk_buff *, const struct sk_buff *) __rcu;
|
2013-09-27 05:48:15 +08:00
|
|
|
void nf_ct_attach(struct sk_buff *, const struct sk_buff *);
|
2010-11-16 01:17:21 +08:00
|
|
|
extern void (*nf_ct_destroy)(struct nf_conntrack *) __rcu;
|
2012-06-07 18:13:39 +08:00
|
|
|
|
|
|
|
|
struct nf_conn;
|
2013-08-27 14:50:12 +08:00
|
|
|
enum ip_conntrack_info;
|
2012-06-07 18:13:39 +08:00
|
|
|
struct nlattr;
|
|
|
|
|
|
|
|
|
|
struct nfq_ct_hook {
|
|
|
|
|
size_t (*build_size)(const struct nf_conn *ct);
|
|
|
|
|
int (*build)(struct sk_buff *skb, struct nf_conn *ct);
|
|
|
|
|
int (*parse)(const struct nlattr *attr, struct nf_conn *ct);
|
2013-08-08 00:13:20 +08:00
|
|
|
int (*attach_expect)(const struct nlattr *attr, struct nf_conn *ct,
|
|
|
|
|
u32 portid, u32 report);
|
2012-06-07 19:31:25 +08:00
|
|
|
void (*seq_adjust)(struct sk_buff *skb, struct nf_conn *ct,
|
2013-08-27 14:50:12 +08:00
|
|
|
enum ip_conntrack_info ctinfo, s32 off);
|
2012-06-07 18:13:39 +08:00
|
|
|
};
|
2013-08-27 14:50:12 +08:00
|
|
|
extern struct nfq_ct_hook __rcu *nfq_ct_hook;
|
2007-03-24 02:17:07 +08:00
|
|
|
#else
|
|
|
|
|
static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {}
|
|
|
|
|
#endif
|
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
#endif /*__LINUX_NETFILTER_H*/
|