include/net/netfilter/nf_tables.h

   1 #ifndef _NET_NF_TABLES_H
   2 #define _NET_NF_TABLES_H
   3
   4 #include <linux/list.h>
   5 #include <linux/netfilter.h>
   6 #include <linux/netfilter/nfnetlink.h>
   7 #include <linux/netfilter/x_tables.h>
   8 #include <linux/netfilter/nf_tables.h>
   9 #include <net/netlink.h>
  10
  11 #define NFT_JUMP_STACK_SIZE     16
  12
  13 struct nft_pktinfo {
  14         struct sk_buff                  *skb;
  15         const struct net_device         *in;
  16         const struct net_device         *out;
  17         const struct nf_hook_ops        *ops;
  18         u8                              nhoff;
  19         u8                              thoff;
  20         u8                              tprot;
  21         /* for x_tables compatibility */
  22         struct xt_action_param          xt;
  23 };
  24
  25 static inline void nft_set_pktinfo(struct nft_pktinfo *pkt,
  26                                    const struct nf_hook_ops *ops,
  27                                    struct sk_buff *skb,
  28                                    const struct net_device *in,
  29                                    const struct net_device *out)
  30 {
  31         pkt->skb = skb;
  32         pkt->in = pkt->xt.in = in;
  33         pkt->out = pkt->xt.out = out;
  34         pkt->ops = ops;
  35         pkt->xt.hooknum = ops->hooknum;
  36         pkt->xt.family = ops->pf;
  37 }
  38
  39 struct nft_data {
  40         union {
  41                 u32                             data[4];
  42                 struct {
  43                         u32                     verdict;
  44                         struct nft_chain        *chain;
  45                 };
  46         };
  47 } __attribute__((aligned(__alignof__(u64))));
  48
  49 static inline int nft_data_cmp(const struct nft_data *d1,
  50                                const struct nft_data *d2,
  51                                unsigned int len)
  52 {
  53         return memcmp(d1->data, d2->data, len);
  54 }
  55
  56 static inline void nft_data_copy(struct nft_data *dst,
  57                                  const struct nft_data *src)
  58 {
  59         BUILD_BUG_ON(__alignof__(*dst) != __alignof__(u64));
  60         *(u64 *)&dst->data[0] = *(u64 *)&src->data[0];
  61         *(u64 *)&dst->data[2] = *(u64 *)&src->data[2];
  62 }
  63
  64 static inline void nft_data_debug(const struct nft_data *data)
  65 {
  66         pr_debug("data[0]=%x data[1]=%x data[2]=%x data[3]=%x\n",
  67                  data->data[0], data->data[1],
  68                  data->data[2], data->data[3]);
  69 }
  70
  71 /**
  72  *      struct nft_ctx - nf_tables rule/set context
  73  *
  74  *      @net: net namespace
  75  *      @skb: netlink skb
  76  *      @nlh: netlink message header
  77  *      @afi: address family info
  78  *      @table: the table the chain is contained in
  79  *      @chain: the chain the rule is contained in
  80  *      @nla: netlink attributes
  81  */
  82 struct nft_ctx {
  83         struct net                      *net;
  84         const struct sk_buff            *skb;
  85         const struct nlmsghdr           *nlh;
  86         const struct nft_af_info        *afi;
  87         const struct nft_table          *table;
  88         const struct nft_chain          *chain;
  89         const struct nlattr * const     *nla;
  90 };
  91
  92 struct nft_data_desc {
  93         enum nft_data_types             type;
  94         unsigned int                    len;
  95 };
  96
  97 int nft_data_init(const struct nft_ctx *ctx, struct nft_data *data,
  98                   struct nft_data_desc *desc, const struct nlattr *nla);
  99 void nft_data_uninit(const struct nft_data *data, enum nft_data_types type);
 100 int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
 101                   enum nft_data_types type, unsigned int len);
 102
 103 static inline enum nft_data_types nft_dreg_to_type(enum nft_registers reg)
 104 {
 105         return reg == NFT_REG_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE;
 106 }
 107
 108 static inline enum nft_registers nft_type_to_reg(enum nft_data_types type)
 109 {
 110         return type == NFT_DATA_VERDICT ? NFT_REG_VERDICT : NFT_REG_1;
 111 }
 112
 113 int nft_validate_input_register(enum nft_registers reg);
 114 int nft_validate_output_register(enum nft_registers reg);
 115 int nft_validate_data_load(const struct nft_ctx *ctx, enum nft_registers reg,
 116                            const struct nft_data *data,
 117                            enum nft_data_types type);
 118
 119 /**
 120  *      struct nft_set_elem - generic representation of set elements
 121  *
 122  *      @cookie: implementation specific element cookie
 123  *      @key: element key
 124  *      @data: element data (maps only)
 125  *      @flags: element flags (end of interval)
 126  *
 127  *      The cookie can be used to store a handle to the element for subsequent
 128  *      removal.
 129  */
 130 struct nft_set_elem {
 131         void                    *cookie;
 132         struct nft_data         key;
 133         struct nft_data         data;
 134         u32                     flags;
 135 };
 136
 137 struct nft_set;
 138 struct nft_set_iter {
 139         unsigned int    count;
 140         unsigned int    skip;
 141         int             err;
 142         int             (*fn)(const struct nft_ctx *ctx,
 143                               const struct nft_set *set,
 144                               const struct nft_set_iter *iter,
 145                               const struct nft_set_elem *elem);
 146 };
 147
 148 /**
 149  *      struct nft_set_ops - nf_tables set operations
 150  *
 151  *      @lookup: look up an element within the set
 152  *      @insert: insert new element into set
 153  *      @remove: remove element from set
 154  *      @walk: iterate over all set elemeennts
 155  *      @privsize: function to return size of set private data
 156  *      @init: initialize private data of new set instance
 157  *      @destroy: destroy private data of set instance
 158  *      @list: nf_tables_set_ops list node
 159  *      @owner: module reference
 160  *      @features: features supported by the implementation
 161  */
 162 struct nft_set_ops {
 163         bool                            (*lookup)(const struct nft_set *set,
 164                                                   const struct nft_data *key,
 165                                                   struct nft_data *data);
 166         int                             (*get)(const struct nft_set *set,
 167                                                struct nft_set_elem *elem);
 168         int                             (*insert)(const struct nft_set *set,
 169                                                   const struct nft_set_elem *elem);
 170         void                            (*remove)(const struct nft_set *set,
 171                                                   const struct nft_set_elem *elem);
 172         void                            (*walk)(const struct nft_ctx *ctx,
 173                                                 const struct nft_set *set,
 174                                                 struct nft_set_iter *iter);
 175
 176         unsigned int                    (*privsize)(const struct nlattr * const nla[]);
 177         int                             (*init)(const struct nft_set *set,
 178                                                 const struct nlattr * const nla[]);
 179         void                            (*destroy)(const struct nft_set *set);
 180
 181         struct list_head                list;
 182         struct module                   *owner;
 183         u32                             features;
 184 };
 185
 186 int nft_register_set(struct nft_set_ops *ops);
 187 void nft_unregister_set(struct nft_set_ops *ops);
 188
 189 /**
 190  *      struct nft_set - nf_tables set instance
 191  *
 192  *      @list: table set list node
 193  *      @bindings: list of set bindings
 194  *      @name: name of the set
 195  *      @ktype: key type (numeric type defined by userspace, not used in the kernel)
 196  *      @dtype: data type (verdict or numeric type defined by userspace)
 197  *      @ops: set ops
 198  *      @flags: set flags
 199  *      @klen: key length
 200  *      @dlen: data length
 201  *      @data: private set data
 202  */
 203 struct nft_set {
 204         struct list_head                list;
 205         struct list_head                bindings;
 206         char                            name[IFNAMSIZ];
 207         u32                             ktype;
 208         u32                             dtype;
 209         /* runtime data below here */
 210         const struct nft_set_ops        *ops ____cacheline_aligned;
 211         u16                             flags;
 212         u8                              klen;
 213         u8                              dlen;
 214         unsigned char                   data[]
 215                 __attribute__((aligned(__alignof__(u64))));
 216 };
 217
 218 static inline void *nft_set_priv(const struct nft_set *set)
 219 {
 220         return (void *)set->data;
 221 }
 222
 223 struct nft_set *nf_tables_set_lookup(const struct nft_table *table,
 224                                      const struct nlattr *nla);
 225
 226 /**
 227  *      struct nft_set_binding - nf_tables set binding
 228  *
 229  *      @list: set bindings list node
 230  *      @chain: chain containing the rule bound to the set
 231  *
 232  *      A set binding contains all information necessary for validation
 233  *      of new elements added to a bound set.
 234  */
 235 struct nft_set_binding {
 236         struct list_head                list;
 237         const struct nft_chain          *chain;
 238 };
 239
 240 int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
 241                        struct nft_set_binding *binding);
 242 void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
 243                           struct nft_set_binding *binding);
 244
 245
 246 /**
 247  *      struct nft_expr_type - nf_tables expression type
 248  *
 249  *      @select_ops: function to select nft_expr_ops
 250  *      @ops: default ops, used when no select_ops functions is present
 251  *      @list: used internally
 252  *      @name: Identifier
 253  *      @owner: module reference
 254  *      @policy: netlink attribute policy
 255  *      @maxattr: highest netlink attribute number
 256  *      @family: address family for AF-specific types
 257  */
 258 struct nft_expr_type {
 259         const struct nft_expr_ops       *(*select_ops)(const struct nft_ctx *,
 260                                                        const struct nlattr * const tb[]);
 261         const struct nft_expr_ops       *ops;
 262         struct list_head                list;
 263         const char                      *name;
 264         struct module                   *owner;
 265         const struct nla_policy         *policy;
 266         unsigned int                    maxattr;
 267         u8                              family;
 268 };
 269
 270 /**
 271  *      struct nft_expr_ops - nf_tables expression operations
 272  *
 273  *      @eval: Expression evaluation function
 274  *      @size: full expression size, including private data size
 275  *      @init: initialization function
 276  *      @destroy: destruction function
 277  *      @dump: function to dump parameters
 278  *      @type: expression type
 279  *      @validate: validate expression, called during loop detection
 280  *      @data: extra data to attach to this expression operation
 281  */
 282 struct nft_expr;
 283 struct nft_expr_ops {
 284         void                            (*eval)(const struct nft_expr *expr,
 285                                                 struct nft_data data[NFT_REG_MAX + 1],
 286                                                 const struct nft_pktinfo *pkt);
 287         unsigned int                    size;
 288
 289         int                             (*init)(const struct nft_ctx *ctx,
 290                                                 const struct nft_expr *expr,
 291                                                 const struct nlattr * const tb[]);
 292         void                            (*destroy)(const struct nft_ctx *ctx,
 293                                                    const struct nft_expr *expr);
 294         int                             (*dump)(struct sk_buff *skb,
 295                                                 const struct nft_expr *expr);
 296         int                             (*validate)(const struct nft_ctx *ctx,
 297                                                     const struct nft_expr *expr,
 298                                                     const struct nft_data **data);
 299         const struct nft_expr_type      *type;
 300         void                            *data;
 301 };
 302
 303 #define NFT_EXPR_MAXATTR                16
 304 #define NFT_EXPR_SIZE(size)             (sizeof(struct nft_expr) + \
 305                                          ALIGN(size, __alignof__(struct nft_expr)))
 306
 307 /**
 308  *      struct nft_expr - nf_tables expression
 309  *
 310  *      @ops: expression ops
 311  *      @data: expression private data
 312  */
 313 struct nft_expr {
 314         const struct nft_expr_ops       *ops;
 315         unsigned char                   data[];
 316 };
 317
 318 static inline void *nft_expr_priv(const struct nft_expr *expr)
 319 {
 320         return (void *)expr->data;
 321 }
 322
 323 /**
 324  *      struct nft_rule - nf_tables rule
 325  *
 326  *      @list: used internally
 327  *      @handle: rule handle
 328  *      @genmask: generation mask
 329  *      @dlen: length of expression data
 330  *      @ulen: length of user data (used for comments)
 331  *      @data: expression data
 332  */
 333 struct nft_rule {
 334         struct list_head                list;
 335         u64                             handle:42,
 336                                         genmask:2,
 337                                         dlen:12,
 338                                         ulen:8;
 339         unsigned char                   data[]
 340                 __attribute__((aligned(__alignof__(struct nft_expr))));
 341 };
 342
 343 /**
 344  *      struct nft_rule_trans - nf_tables rule update in transaction
 345  *
 346  *      @list: used internally
 347  *      @ctx: rule context
 348  *      @rule: rule that needs to be updated
 349  */
 350 struct nft_rule_trans {
 351         struct list_head                list;
 352         struct nft_ctx                  ctx;
 353         struct nft_rule                 *rule;
 354 };
 355
 356 static inline struct nft_expr *nft_expr_first(const struct nft_rule *rule)
 357 {
 358         return (struct nft_expr *)&rule->data[0];
 359 }
 360
 361 static inline struct nft_expr *nft_expr_next(const struct nft_expr *expr)
 362 {
 363         return ((void *)expr) + expr->ops->size;
 364 }
 365
 366 static inline struct nft_expr *nft_expr_last(const struct nft_rule *rule)
 367 {
 368         return (struct nft_expr *)&rule->data[rule->dlen];
 369 }
 370
 371 static inline void *nft_userdata(const struct nft_rule *rule)
 372 {
 373         return (void *)&rule->data[rule->dlen];
 374 }
 375
 376 /*
 377  * The last pointer isn't really necessary, but the compiler isn't able to
 378  * determine that the result of nft_expr_last() is always the same since it
 379  * can't assume that the dlen value wasn't changed within calls in the loop.
 380  */
 381 #define nft_rule_for_each_expr(expr, last, rule) \
 382         for ((expr) = nft_expr_first(rule), (last) = nft_expr_last(rule); \
 383              (expr) != (last); \
 384              (expr) = nft_expr_next(expr))
 385
 386 enum nft_chain_flags {
 387         NFT_BASE_CHAIN                  = 0x1,
 388 };
 389
 390 /**
 391  *      struct nft_chain - nf_tables chain
 392  *
 393  *      @rules: list of rules in the chain
 394  *      @list: used internally
 395  *      @net: net namespace that this chain belongs to
 396  *      @table: table that this chain belongs to
 397  *      @handle: chain handle
 398  *      @flags: bitmask of enum nft_chain_flags
 399  *      @use: number of jump references to this chain
 400  *      @level: length of longest path to this chain
 401  *      @name: name of the chain
 402  */
 403 struct nft_chain {
 404         struct list_head                rules;
 405         struct list_head                list;
 406         struct net                      *net;
 407         struct nft_table                *table;
 408         u64                             handle;
 409         u8                              flags;
 410         u16                             use;
 411         u16                             level;
 412         char                            name[NFT_CHAIN_MAXNAMELEN];
 413 };
 414
 415 enum nft_chain_type {
 416         NFT_CHAIN_T_DEFAULT = 0,
 417         NFT_CHAIN_T_ROUTE,
 418         NFT_CHAIN_T_NAT,
 419         NFT_CHAIN_T_MAX
 420 };
 421
 422 struct nft_stats {
 423         u64 bytes;
 424         u64 pkts;
 425 };
 426
 427 #define NFT_HOOK_OPS_MAX                2
 428
 429 /**
 430  *      struct nft_base_chain - nf_tables base chain
 431  *
 432  *      @ops: netfilter hook ops
 433  *      @type: chain type
 434  *      @policy: default policy
 435  *      @stats: per-cpu chain stats
 436  *      @chain: the chain
 437  */
 438 struct nft_base_chain {
 439         struct nf_hook_ops              ops[NFT_HOOK_OPS_MAX];
 440         const struct nf_chain_type      *type;
 441         u8                              policy;
 442         struct nft_stats __percpu       *stats;
 443         struct nft_chain                chain;
 444 };
 445
 446 static inline struct nft_base_chain *nft_base_chain(const struct nft_chain *chain)
 447 {
 448         return container_of(chain, struct nft_base_chain, chain);
 449 }
 450
 451 unsigned int nft_do_chain(struct nft_pktinfo *pkt,
 452                           const struct nf_hook_ops *ops);
 453
 454 /**
 455  *      struct nft_table - nf_tables table
 456  *
 457  *      @list: used internally
 458  *      @chains: chains in the table
 459  *      @sets: sets in the table
 460  *      @hgenerator: handle generator state
 461  *      @use: number of chain references to this table
 462  *      @flags: table flag (see enum nft_table_flags)
 463  *      @name: name of the table
 464  */
 465 struct nft_table {
 466         struct list_head                list;
 467         struct list_head                chains;
 468         struct list_head                sets;
 469         u64                             hgenerator;
 470         u32                             use;
 471         u16                             flags;
 472         char                            name[];
 473 };
 474
 475 /**
 476  *      struct nft_af_info - nf_tables address family info
 477  *
 478  *      @list: used internally
 479  *      @family: address family
 480  *      @nhooks: number of hooks in this family
 481  *      @owner: module owner
 482  *      @tables: used internally
 483  *      @nops: number of hook ops in this family
 484  *      @hook_ops_init: initialization function for chain hook ops
 485  *      @hooks: hookfn overrides for packet validation
 486  */
 487 struct nft_af_info {
 488         struct list_head                list;
 489         int                             family;
 490         unsigned int                    nhooks;
 491         struct module                   *owner;
 492         struct list_head                tables;
 493         unsigned int                    nops;
 494         void                            (*hook_ops_init)(struct nf_hook_ops *,
 495                                                          unsigned int);
 496         nf_hookfn                       *hooks[NF_MAX_HOOKS];
 497 };
 498
 499 int nft_register_afinfo(struct net *, struct nft_af_info *);
 500 void nft_unregister_afinfo(struct nft_af_info *);
 501
 502 /**
 503  *      struct nf_chain_type - nf_tables chain type info
 504  *
 505  *      @name: name of the type
 506  *      @type: numeric identifier
 507  *      @family: address family
 508  *      @owner: module owner
 509  *      @hook_mask: mask of valid hooks
 510  *      @hooks: hookfn overrides
 511  */
 512 struct nf_chain_type {
 513         const char                      *name;
 514         enum nft_chain_type             type;
 515         int                             family;
 516         struct module                   *owner;
 517         unsigned int                    hook_mask;
 518         nf_hookfn                       *hooks[NF_MAX_HOOKS];
 519 };
 520
 521 int nft_register_chain_type(const struct nf_chain_type *);
 522 void nft_unregister_chain_type(const struct nf_chain_type *);
 523
 524 int nft_register_expr(struct nft_expr_type *);
 525 void nft_unregister_expr(struct nft_expr_type *);
 526
 527 #define nft_dereference(p)                                      \
 528         nfnl_dereference(p, NFNL_SUBSYS_NFTABLES)
 529
 530 #define MODULE_ALIAS_NFT_FAMILY(family) \
 531         MODULE_ALIAS("nft-afinfo-" __stringify(family))
 532
 533 #define MODULE_ALIAS_NFT_CHAIN(family, name) \
 534         MODULE_ALIAS("nft-chain-" __stringify(family) "-" name)
 535
 536 #define MODULE_ALIAS_NFT_AF_EXPR(family, name) \
 537         MODULE_ALIAS("nft-expr-" __stringify(family) "-" name)
 538
 539 #define MODULE_ALIAS_NFT_EXPR(name) \
 540         MODULE_ALIAS("nft-expr-" name)
 541
 542 #define MODULE_ALIAS_NFT_SET() \
 543         MODULE_ALIAS("nft-set")
 544
 545 #endif /* _NET_NF_TABLES_H */