1 #ifndef _NET_NF_TABLES_H
2 #define _NET_NF_TABLES_H
4 #include <linux/list.h>
5 #include <linux/netfilter.h>
6 #include <linux/netfilter/nf_tables.h>
7 #include <net/netlink.h>
9 #define NFT_JUMP_STACK_SIZE 16
13 const struct net_device
*in
;
14 const struct net_device
*out
;
25 struct nft_chain
*chain
;
28 } __attribute__((aligned(__alignof__(u64
))));
30 static inline int nft_data_cmp(const struct nft_data
*d1
,
31 const struct nft_data
*d2
,
34 return memcmp(d1
->data
, d2
->data
, len
);
37 static inline void nft_data_copy(struct nft_data
*dst
,
38 const struct nft_data
*src
)
40 BUILD_BUG_ON(__alignof__(*dst
) != __alignof__(u64
));
41 *(u64
*)&dst
->data
[0] = *(u64
*)&src
->data
[0];
42 *(u64
*)&dst
->data
[2] = *(u64
*)&src
->data
[2];
45 static inline void nft_data_debug(const struct nft_data
*data
)
47 pr_debug("data[0]=%x data[1]=%x data[2]=%x data[3]=%x\n",
48 data
->data
[0], data
->data
[1],
49 data
->data
[2], data
->data
[3]);
53 * struct nft_ctx - nf_tables rule/set context
56 * @nlh: netlink message header
57 * @afi: address family info
58 * @table: the table the chain is contained in
59 * @chain: the chain the rule is contained in
62 const struct sk_buff
*skb
;
63 const struct nlmsghdr
*nlh
;
64 const struct nft_af_info
*afi
;
65 const struct nft_table
*table
;
66 const struct nft_chain
*chain
;
69 struct nft_data_desc
{
70 enum nft_data_types type
;
74 extern int nft_data_init(const struct nft_ctx
*ctx
, struct nft_data
*data
,
75 struct nft_data_desc
*desc
, const struct nlattr
*nla
);
76 extern void nft_data_uninit(const struct nft_data
*data
,
77 enum nft_data_types type
);
78 extern int nft_data_dump(struct sk_buff
*skb
, int attr
,
79 const struct nft_data
*data
,
80 enum nft_data_types type
, unsigned int len
);
82 static inline enum nft_data_types
nft_dreg_to_type(enum nft_registers reg
)
84 return reg
== NFT_REG_VERDICT
? NFT_DATA_VERDICT
: NFT_DATA_VALUE
;
87 static inline enum nft_registers
nft_type_to_reg(enum nft_data_types type
)
89 return type
== NFT_DATA_VERDICT
? NFT_REG_VERDICT
: NFT_REG_1
;
92 extern int nft_validate_input_register(enum nft_registers reg
);
93 extern int nft_validate_output_register(enum nft_registers reg
);
94 extern int nft_validate_data_load(const struct nft_ctx
*ctx
,
95 enum nft_registers reg
,
96 const struct nft_data
*data
,
97 enum nft_data_types type
);
100 * struct nft_set_elem - generic representation of set elements
102 * @cookie: implementation specific element cookie
104 * @data: element data (maps only)
105 * @flags: element flags (end of interval)
107 * The cookie can be used to store a handle to the element for subsequent
110 struct nft_set_elem
{
113 struct nft_data data
;
118 struct nft_set_iter
{
122 int (*fn
)(const struct nft_ctx
*ctx
,
123 const struct nft_set
*set
,
124 const struct nft_set_iter
*iter
,
125 const struct nft_set_elem
*elem
);
129 * struct nft_set_ops - nf_tables set operations
131 * @lookup: look up an element within the set
132 * @insert: insert new element into set
133 * @remove: remove element from set
134 * @walk: iterate over all set elemeennts
135 * @privsize: function to return size of set private data
136 * @init: initialize private data of new set instance
137 * @destroy: destroy private data of set instance
138 * @list: nf_tables_set_ops list node
139 * @owner: module reference
140 * @features: features supported by the implementation
143 bool (*lookup
)(const struct nft_set
*set
,
144 const struct nft_data
*key
,
145 struct nft_data
*data
);
146 int (*get
)(const struct nft_set
*set
,
147 struct nft_set_elem
*elem
);
148 int (*insert
)(const struct nft_set
*set
,
149 const struct nft_set_elem
*elem
);
150 void (*remove
)(const struct nft_set
*set
,
151 const struct nft_set_elem
*elem
);
152 void (*walk
)(const struct nft_ctx
*ctx
,
153 const struct nft_set
*set
,
154 struct nft_set_iter
*iter
);
156 unsigned int (*privsize
)(const struct nlattr
* const nla
[]);
157 int (*init
)(const struct nft_set
*set
,
158 const struct nlattr
* const nla
[]);
159 void (*destroy
)(const struct nft_set
*set
);
161 struct list_head list
;
162 struct module
*owner
;
166 extern int nft_register_set(struct nft_set_ops
*ops
);
167 extern void nft_unregister_set(struct nft_set_ops
*ops
);
170 * struct nft_set - nf_tables set instance
172 * @list: table set list node
173 * @bindings: list of set bindings
174 * @name: name of the set
175 * @ktype: key type (numeric type defined by userspace, not used in the kernel)
176 * @dtype: data type (verdict or numeric type defined by userspace)
181 * @data: private set data
184 struct list_head list
;
185 struct list_head bindings
;
189 /* runtime data below here */
190 const struct nft_set_ops
*ops ____cacheline_aligned
;
195 __attribute__((aligned(__alignof__(u64
))));
198 static inline void *nft_set_priv(const struct nft_set
*set
)
200 return (void *)set
->data
;
203 extern struct nft_set
*nf_tables_set_lookup(const struct nft_table
*table
,
204 const struct nlattr
*nla
);
207 * struct nft_set_binding - nf_tables set binding
209 * @list: set bindings list node
210 * @chain: chain containing the rule bound to the set
212 * A set binding contains all information necessary for validation
213 * of new elements added to a bound set.
215 struct nft_set_binding
{
216 struct list_head list
;
217 const struct nft_chain
*chain
;
220 extern int nf_tables_bind_set(const struct nft_ctx
*ctx
, struct nft_set
*set
,
221 struct nft_set_binding
*binding
);
222 extern void nf_tables_unbind_set(const struct nft_ctx
*ctx
, struct nft_set
*set
,
223 struct nft_set_binding
*binding
);
227 * struct nft_expr_type - nf_tables expression type
229 * @select_ops: function to select nft_expr_ops
230 * @ops: default ops, used when no select_ops functions is present
231 * @list: used internally
233 * @owner: module reference
234 * @policy: netlink attribute policy
235 * @maxattr: highest netlink attribute number
237 struct nft_expr_type
{
238 const struct nft_expr_ops
*(*select_ops
)(const struct nlattr
* const tb
[]);
239 const struct nft_expr_ops
*ops
;
240 struct list_head list
;
242 struct module
*owner
;
243 const struct nla_policy
*policy
;
244 unsigned int maxattr
;
248 * struct nft_expr_ops - nf_tables expression operations
250 * @eval: Expression evaluation function
251 * @size: full expression size, including private data size
252 * @init: initialization function
253 * @destroy: destruction function
254 * @dump: function to dump parameters
255 * @type: expression type
258 struct nft_expr_ops
{
259 void (*eval
)(const struct nft_expr
*expr
,
260 struct nft_data data
[NFT_REG_MAX
+ 1],
261 const struct nft_pktinfo
*pkt
);
264 int (*init
)(const struct nft_ctx
*ctx
,
265 const struct nft_expr
*expr
,
266 const struct nlattr
* const tb
[]);
267 void (*destroy
)(const struct nft_expr
*expr
);
268 int (*dump
)(struct sk_buff
*skb
,
269 const struct nft_expr
*expr
);
270 const struct nft_data
* (*get_verdict
)(const struct nft_expr
*expr
);
271 const struct nft_expr_type
*type
;
274 #define NFT_EXPR_MAXATTR 16
275 #define NFT_EXPR_SIZE(size) (sizeof(struct nft_expr) + \
276 ALIGN(size, __alignof__(struct nft_expr)))
279 * struct nft_expr - nf_tables expression
281 * @ops: expression ops
282 * @data: expression private data
285 const struct nft_expr_ops
*ops
;
286 unsigned char data
[];
289 static inline void *nft_expr_priv(const struct nft_expr
*expr
)
291 return (void *)expr
->data
;
295 * struct nft_rule - nf_tables rule
297 * @list: used internally
298 * @rcu_head: used internally for rcu
299 * @handle: rule handle
300 * @dlen: length of expression data
301 * @data: expression data
304 struct list_head list
;
305 struct rcu_head rcu_head
;
309 __attribute__((aligned(__alignof__(struct nft_expr
))));
312 static inline struct nft_expr
*nft_expr_first(const struct nft_rule
*rule
)
314 return (struct nft_expr
*)&rule
->data
[0];
317 static inline struct nft_expr
*nft_expr_next(const struct nft_expr
*expr
)
319 return ((void *)expr
) + expr
->ops
->size
;
322 static inline struct nft_expr
*nft_expr_last(const struct nft_rule
*rule
)
324 return (struct nft_expr
*)&rule
->data
[rule
->dlen
];
328 * The last pointer isn't really necessary, but the compiler isn't able to
329 * determine that the result of nft_expr_last() is always the same since it
330 * can't assume that the dlen value wasn't changed within calls in the loop.
332 #define nft_rule_for_each_expr(expr, last, rule) \
333 for ((expr) = nft_expr_first(rule), (last) = nft_expr_last(rule); \
335 (expr) = nft_expr_next(expr))
337 enum nft_chain_flags
{
338 NFT_BASE_CHAIN
= 0x1,
342 * struct nft_chain - nf_tables chain
344 * @rules: list of rules in the chain
345 * @list: used internally
346 * @rcu_head: used internally
347 * @handle: chain handle
348 * @flags: bitmask of enum nft_chain_flags
349 * @use: number of jump references to this chain
350 * @level: length of longest path to this chain
351 * @name: name of the chain
354 struct list_head rules
;
355 struct list_head list
;
356 struct rcu_head rcu_head
;
361 char name
[NFT_CHAIN_MAXNAMELEN
];
364 enum nft_chain_type
{
365 NFT_CHAIN_T_DEFAULT
= 0,
372 * struct nft_base_chain - nf_tables base chain
374 * @ops: netfilter hook ops
378 struct nft_base_chain
{
379 struct nf_hook_ops ops
;
380 enum nft_chain_type type
;
381 struct nft_chain chain
;
384 static inline struct nft_base_chain
*nft_base_chain(const struct nft_chain
*chain
)
386 return container_of(chain
, struct nft_base_chain
, chain
);
389 extern unsigned int nft_do_chain(const struct nf_hook_ops
*ops
,
391 const struct net_device
*in
,
392 const struct net_device
*out
,
393 int (*okfn
)(struct sk_buff
*));
396 * struct nft_table - nf_tables table
398 * @list: used internally
399 * @chains: chains in the table
400 * @sets: sets in the table
401 * @hgenerator: handle generator state
402 * @use: number of chain references to this table
403 * @flags: table flag (see enum nft_table_flags)
404 * @name: name of the table
407 struct list_head list
;
408 struct list_head chains
;
409 struct list_head sets
;
417 * struct nft_af_info - nf_tables address family info
419 * @list: used internally
420 * @family: address family
421 * @nhooks: number of hooks in this family
422 * @owner: module owner
423 * @tables: used internally
424 * @hooks: hookfn overrides for packet validation
427 struct list_head list
;
430 struct module
*owner
;
431 struct list_head tables
;
432 nf_hookfn
*hooks
[NF_MAX_HOOKS
];
435 extern int nft_register_afinfo(struct nft_af_info
*);
436 extern void nft_unregister_afinfo(struct nft_af_info
*);
438 struct nf_chain_type
{
439 unsigned int hook_mask
;
441 enum nft_chain_type type
;
442 nf_hookfn
*fn
[NF_MAX_HOOKS
];
447 extern int nft_register_chain_type(struct nf_chain_type
*);
448 extern void nft_unregister_chain_type(struct nf_chain_type
*);
450 extern int nft_register_expr(struct nft_expr_type
*);
451 extern void nft_unregister_expr(struct nft_expr_type
*);
453 #define MODULE_ALIAS_NFT_FAMILY(family) \
454 MODULE_ALIAS("nft-afinfo-" __stringify(family))
456 #define MODULE_ALIAS_NFT_CHAIN(family, name) \
457 MODULE_ALIAS("nft-chain-" __stringify(family) "-" name)
459 #define MODULE_ALIAS_NFT_EXPR(name) \
460 MODULE_ALIAS("nft-expr-" name)
462 #define MODULE_ALIAS_NFT_SET() \
463 MODULE_ALIAS("nft-set")
465 #endif /* _NET_NF_TABLES_H */