1/* Modified by Broadcom Corp. Portions Copyright (c) Broadcom Corp, 2012. */ 2#ifndef __LINUX_NETFILTER_H 3#define __LINUX_NETFILTER_H 4 5#ifdef __KERNEL__ 6#include <linux/init.h> 7#include <linux/skbuff.h> 8#include <linux/net.h> 9#include <linux/if.h> 10#include <linux/in.h> 11#include <linux/in6.h> 12#include <linux/wait.h> 13#include <linux/list.h> 14#endif 15#include <linux/types.h> 16#include <linux/compiler.h> 17 18/* Responses from hook functions. */ 19#define NF_DROP 0 20#define NF_ACCEPT 1 21#define NF_STOLEN 2 22#define NF_QUEUE 3 23#define NF_REPEAT 4 24#define NF_STOP 5 25#define NF_MAX_VERDICT NF_STOP 26 27/* we overload the higher bits for encoding auxiliary data such as the queue 28 * number or errno values. Not nice, but better than additional function 29 * arguments. */ 30#define NF_VERDICT_MASK 0x000000ff 31 32/* extra verdict flags have mask 0x0000ff00 */ 33#define NF_VERDICT_FLAG_QUEUE_BYPASS 0x00008000 34 35/* queue number (NF_QUEUE) or errno (NF_DROP) */ 36#define NF_VERDICT_QMASK 0xffff0000 37#define NF_VERDICT_QBITS 16 38 39#define NF_QUEUE_NR(x) ((((x) << 16) & NF_VERDICT_QMASK) | NF_QUEUE) 40 41#define NF_DROP_ERR(x) (((-x) << 16) | NF_DROP) 42 43/* only for userspace compatibility */ 44#ifndef __KERNEL__ 45/* Generic cache responses from hook functions. 46 <= 0x2000 is used for protocol-flags. */ 47#define NFC_UNKNOWN 0x4000 48#define NFC_ALTERED 0x8000 49 50/* NF_VERDICT_BITS should be 8 now, but userspace might break if this changes */ 51#define NF_VERDICT_BITS 16 52#endif 53 54enum nf_inet_hooks { 55 NF_INET_PRE_ROUTING, 56 NF_INET_LOCAL_IN, 57 NF_INET_FORWARD, 58 NF_INET_LOCAL_OUT, 59 NF_INET_POST_ROUTING, 60 NF_INET_NUMHOOKS 61}; 62 63enum { 64 NFPROTO_UNSPEC = 0, 65 NFPROTO_IPV4 = 2, 66 NFPROTO_ARP = 3, 67 NFPROTO_BRIDGE = 7, 68 NFPROTO_IPV6 = 10, 69 NFPROTO_DECNET = 12, 70 NFPROTO_NUMPROTO, 71}; 72 73union nf_inet_addr { 74 __u32 all[4]; 75 __be32 ip; 76 __be32 ip6[4]; 77 struct in_addr in; 78 struct in6_addr in6; 79}; 80 81#ifdef __KERNEL__ 82#ifdef CONFIG_NETFILTER 83static inline int NF_DROP_GETERR(int verdict) 84{ 85 return -(verdict >> NF_VERDICT_QBITS); 86} 87 88static inline int nf_inet_addr_cmp(const union nf_inet_addr *a1, 89 const union nf_inet_addr *a2) 90{ 91 return a1->all[0] == a2->all[0] && 92 a1->all[1] == a2->all[1] && 93 a1->all[2] == a2->all[2] && 94 a1->all[3] == a2->all[3]; 95} 96 97extern void netfilter_init(void); 98 99/* Largest hook number + 1 */ 100#define NF_MAX_HOOKS 8 101 102struct sk_buff; 103 104typedef unsigned int nf_hookfn(unsigned int hooknum, 105 struct sk_buff *skb, 106 const struct net_device *in, 107 const struct net_device *out, 108 int (*okfn)(struct sk_buff *)); 109 110struct nf_hook_ops { 111 struct list_head list; 112 113 /* User fills in from here down. */ 114 nf_hookfn *hook; 115 struct module *owner; 116 u_int8_t pf; 117 unsigned int hooknum; 118 /* Hooks are ordered in ascending priority. */ 119 int priority; 120}; 121 122struct nf_sockopt_ops { 123 struct list_head list; 124 125 u_int8_t pf; 126 127 /* Non-inclusive ranges: use 0/0/NULL to never get called. */ 128 int set_optmin; 129 int set_optmax; 130 int (*set)(struct sock *sk, int optval, void __user *user, unsigned int len); 131#ifdef CONFIG_COMPAT 132 int (*compat_set)(struct sock *sk, int optval, 133 void __user *user, unsigned int len); 134#endif 135 int get_optmin; 136 int get_optmax; 137 int (*get)(struct sock *sk, int optval, void __user *user, int *len); 138#ifdef CONFIG_COMPAT 139 int (*compat_get)(struct sock *sk, int optval, 140 void __user *user, int *len); 141#endif 142 /* Use the module struct to lock set/get code in place */ 143 struct module *owner; 144}; 145 146/* Function to register/unregister hook points. */ 147int nf_register_hook(struct nf_hook_ops *reg); 148void nf_unregister_hook(struct nf_hook_ops *reg); 149int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n); 150void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n); 151 152/* Functions to register get/setsockopt ranges (non-inclusive). You 153 need to check permissions yourself! */ 154int nf_register_sockopt(struct nf_sockopt_ops *reg); 155void nf_unregister_sockopt(struct nf_sockopt_ops *reg); 156 157#ifdef CONFIG_SYSCTL 158/* Sysctl registration */ 159extern struct ctl_path nf_net_netfilter_sysctl_path[]; 160extern struct ctl_path nf_net_ipv4_netfilter_sysctl_path[]; 161#endif /* CONFIG_SYSCTL */ 162 163extern struct list_head nf_hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS]; 164 165int nf_hook_slow(u_int8_t pf, unsigned int hook, struct sk_buff *skb, 166 struct net_device *indev, struct net_device *outdev, 167 int (*okfn)(struct sk_buff *), int thresh); 168 169/** 170 * nf_hook_thresh - call a netfilter hook 171 * 172 * Returns 1 if the hook has allowed the packet to pass. The function 173 * okfn must be invoked by the caller in this case. Any other return 174 * value indicates the packet has been consumed by the hook. 175 */ 176static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook, 177 struct sk_buff *skb, 178 struct net_device *indev, 179 struct net_device *outdev, 180 int (*okfn)(struct sk_buff *), int thresh) 181{ 182#ifndef CONFIG_NETFILTER_DEBUG 183 if (list_empty(&nf_hooks[pf][hook])) 184 return 1; 185#endif 186 return nf_hook_slow(pf, hook, skb, indev, outdev, okfn, thresh); 187} 188 189static inline int nf_hook(u_int8_t pf, unsigned int hook, struct sk_buff *skb, 190 struct net_device *indev, struct net_device *outdev, 191 int (*okfn)(struct sk_buff *)) 192{ 193 return nf_hook_thresh(pf, hook, skb, indev, outdev, okfn, INT_MIN); 194} 195 196/* Activate hook; either okfn or kfree_skb called, unless a hook 197 returns NF_STOLEN (in which case, it's up to the hook to deal with 198 the consequences). 199 200 Returns -ERRNO if packet dropped. Zero means queued, stolen or 201 accepted. 202*/ 203 204/* RR: 205 > I don't want nf_hook to return anything because people might forget 206 > about async and trust the return value to mean "packet was ok". 207 208 AK: 209 Just document it clearly, then you can expect some sense from kernel 210 coders :) 211*/ 212 213static inline int 214NF_HOOK_THRESH(uint8_t pf, unsigned int hook, struct sk_buff *skb, 215 struct net_device *in, struct net_device *out, 216 int (*okfn)(struct sk_buff *), int thresh) 217{ 218 int ret = nf_hook_thresh(pf, hook, skb, in, out, okfn, thresh); 219 if (ret == 1) 220 ret = okfn(skb); 221 return ret; 222} 223 224static inline int 225NF_HOOK_COND(uint8_t pf, unsigned int hook, struct sk_buff *skb, 226 struct net_device *in, struct net_device *out, 227 int (*okfn)(struct sk_buff *), bool cond) 228{ 229 int ret; 230 231 if (!cond || 232 ((ret = nf_hook_thresh(pf, hook, skb, in, out, okfn, INT_MIN)) == 1)) 233 ret = okfn(skb); 234 return ret; 235} 236 237static inline int 238NF_HOOK(uint8_t pf, unsigned int hook, struct sk_buff *skb, 239 struct net_device *in, struct net_device *out, 240 int (*okfn)(struct sk_buff *)) 241{ 242 return NF_HOOK_THRESH(pf, hook, skb, in, out, okfn, INT_MIN); 243} 244 245/* Call setsockopt() */ 246int nf_setsockopt(struct sock *sk, u_int8_t pf, int optval, char __user *opt, 247 unsigned int len); 248int nf_getsockopt(struct sock *sk, u_int8_t pf, int optval, char __user *opt, 249 int *len); 250#ifdef CONFIG_COMPAT 251int compat_nf_setsockopt(struct sock *sk, u_int8_t pf, int optval, 252 char __user *opt, unsigned int len); 253int compat_nf_getsockopt(struct sock *sk, u_int8_t pf, int optval, 254 char __user *opt, int *len); 255#endif 256 257/* Call this before modifying an existing packet: ensures it is 258 modifiable and linear to the point you care about (writable_len). 259 Returns true or false. */ 260extern int skb_make_writable(struct sk_buff *skb, unsigned int writable_len); 261 262struct flowi; 263struct nf_queue_entry; 264 265struct nf_afinfo { 266 unsigned short family; 267 __sum16 (*checksum)(struct sk_buff *skb, unsigned int hook, 268 unsigned int dataoff, u_int8_t protocol); 269 __sum16 (*checksum_partial)(struct sk_buff *skb, 270 unsigned int hook, 271 unsigned int dataoff, 272 unsigned int len, 273 u_int8_t protocol); 274 int (*route)(struct dst_entry **dst, struct flowi *fl); 275 void (*saveroute)(const struct sk_buff *skb, 276 struct nf_queue_entry *entry); 277 int (*reroute)(struct sk_buff *skb, 278 const struct nf_queue_entry *entry); 279 int route_key_size; 280}; 281 282extern const struct nf_afinfo *nf_afinfo[NFPROTO_NUMPROTO]; 283static inline const struct nf_afinfo *nf_get_afinfo(unsigned short family) 284{ 285 return rcu_dereference(nf_afinfo[family]); 286} 287 288static inline __sum16 289nf_checksum(struct sk_buff *skb, unsigned int hook, unsigned int dataoff, 290 u_int8_t protocol, unsigned short family) 291{ 292 const struct nf_afinfo *afinfo; 293 __sum16 csum = 0; 294 295 rcu_read_lock(); 296 afinfo = nf_get_afinfo(family); 297 if (afinfo) 298 csum = afinfo->checksum(skb, hook, dataoff, protocol); 299 rcu_read_unlock(); 300 return csum; 301} 302 303static inline __sum16 304nf_checksum_partial(struct sk_buff *skb, unsigned int hook, 305 unsigned int dataoff, unsigned int len, 306 u_int8_t protocol, unsigned short family) 307{ 308 const struct nf_afinfo *afinfo; 309 __sum16 csum = 0; 310 311 rcu_read_lock(); 312 afinfo = nf_get_afinfo(family); 313 if (afinfo) 314 csum = afinfo->checksum_partial(skb, hook, dataoff, len, 315 protocol); 316 rcu_read_unlock(); 317 return csum; 318} 319 320extern int nf_register_afinfo(const struct nf_afinfo *afinfo); 321extern void nf_unregister_afinfo(const struct nf_afinfo *afinfo); 322 323#include <net/flow.h> 324extern void (*ip_nat_decode_session)(struct sk_buff *, struct flowi *); 325 326static inline void 327nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family) 328{ 329#ifdef CONFIG_NF_NAT_NEEDED 330 void (*decodefn)(struct sk_buff *, struct flowi *); 331 332 if (family == AF_INET) { 333 rcu_read_lock(); 334 decodefn = rcu_dereference(ip_nat_decode_session); 335 if (decodefn) 336 decodefn(skb, fl); 337 rcu_read_unlock(); 338 } 339#endif 340} 341 342#ifdef CONFIG_PROC_FS 343#include <linux/proc_fs.h> 344extern struct proc_dir_entry *proc_net_netfilter; 345#endif 346 347#else /* !CONFIG_NETFILTER */ 348#define NF_HOOK(pf, hook, skb, indev, outdev, okfn) (okfn)(skb) 349#define NF_HOOK_COND(pf, hook, skb, indev, outdev, okfn, cond) (okfn)(skb) 350static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook, 351 struct sk_buff *skb, 352 struct net_device *indev, 353 struct net_device *outdev, 354 int (*okfn)(struct sk_buff *), int thresh) 355{ 356 return okfn(skb); 357} 358static inline int nf_hook(u_int8_t pf, unsigned int hook, struct sk_buff *skb, 359 struct net_device *indev, struct net_device *outdev, 360 int (*okfn)(struct sk_buff *)) 361{ 362 return 1; 363} 364struct flowi; 365static inline void 366nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family) 367{ 368} 369#endif /*CONFIG_NETFILTER*/ 370 371#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE) 372extern void (*ip_ct_attach)(struct sk_buff *, struct sk_buff *); 373extern void nf_ct_attach(struct sk_buff *, struct sk_buff *); 374extern void (*nf_ct_destroy)(struct nf_conntrack *); 375#else 376static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {} 377#endif 378 379#endif /*__KERNEL__*/ 380#endif /*__LINUX_NETFILTER_H*/ 381