1
2#ifndef _NET_NF_TABLES_H
3#define _NET_NF_TABLES_H
4
5#include <asm/unaligned.h>
6#include <linux/list.h>
7#include <linux/netfilter.h>
8#include <linux/netfilter/nfnetlink.h>
9#include <linux/netfilter/x_tables.h>
10#include <linux/netfilter/nf_tables.h>
11#include <linux/u64_stats_sync.h>
12#include <linux/rhashtable.h>
13#include <net/netfilter/nf_flow_table.h>
14#include <net/netlink.h>
15#include <net/flow_offload.h>
16
17struct module;
18
19#define NFT_JUMP_STACK_SIZE 16
20
21struct nft_pktinfo {
22 struct sk_buff *skb;
23 bool tprot_set;
24 u8 tprot;
25
26 struct xt_action_param xt;
27};
28
29static inline struct net *nft_net(const struct nft_pktinfo *pkt)
30{
31 return pkt->xt.state->net;
32}
33
34static inline unsigned int nft_hook(const struct nft_pktinfo *pkt)
35{
36 return pkt->xt.state->hook;
37}
38
39static inline u8 nft_pf(const struct nft_pktinfo *pkt)
40{
41 return pkt->xt.state->pf;
42}
43
44static inline const struct net_device *nft_in(const struct nft_pktinfo *pkt)
45{
46 return pkt->xt.state->in;
47}
48
49static inline const struct net_device *nft_out(const struct nft_pktinfo *pkt)
50{
51 return pkt->xt.state->out;
52}
53
54static inline void nft_set_pktinfo(struct nft_pktinfo *pkt,
55 struct sk_buff *skb,
56 const struct nf_hook_state *state)
57{
58 pkt->skb = skb;
59 pkt->xt.state = state;
60}
61
62static inline void nft_set_pktinfo_unspec(struct nft_pktinfo *pkt,
63 struct sk_buff *skb)
64{
65 pkt->tprot_set = false;
66 pkt->tprot = 0;
67 pkt->xt.thoff = 0;
68 pkt->xt.fragoff = 0;
69}
70
71
72
73
74
75
76
77struct nft_verdict {
78 u32 code;
79 struct nft_chain *chain;
80};
81
82struct nft_data {
83 union {
84 u32 data[4];
85 struct nft_verdict verdict;
86 };
87} __attribute__((aligned(__alignof__(u64))));
88
89
90
91
92
93
94
95
96
97struct nft_regs {
98 union {
99 u32 data[20];
100 struct nft_verdict verdict;
101 };
102};
103
104
105
106
107
108
109
110
111static inline void nft_reg_store8(u32 *dreg, u8 val)
112{
113 *dreg = 0;
114 *(u8 *)dreg = val;
115}
116
117static inline u8 nft_reg_load8(const u32 *sreg)
118{
119 return *(u8 *)sreg;
120}
121
122static inline void nft_reg_store16(u32 *dreg, u16 val)
123{
124 *dreg = 0;
125 *(u16 *)dreg = val;
126}
127
128static inline u16 nft_reg_load16(const u32 *sreg)
129{
130 return *(u16 *)sreg;
131}
132
133static inline void nft_reg_store64(u32 *dreg, u64 val)
134{
135 put_unaligned(val, (u64 *)dreg);
136}
137
138static inline u64 nft_reg_load64(const u32 *sreg)
139{
140 return get_unaligned((u64 *)sreg);
141}
142
143static inline void nft_data_copy(u32 *dst, const struct nft_data *src,
144 unsigned int len)
145{
146 memcpy(dst, src, len);
147}
148
149static inline void nft_data_debug(const struct nft_data *data)
150{
151 pr_debug("data[0]=%x data[1]=%x data[2]=%x data[3]=%x\n",
152 data->data[0], data->data[1],
153 data->data[2], data->data[3]);
154}
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169struct nft_ctx {
170 struct net *net;
171 struct nft_table *table;
172 struct nft_chain *chain;
173 const struct nlattr * const *nla;
174 u32 portid;
175 u32 seq;
176 u16 flags;
177 u8 family;
178 u8 level;
179 bool report;
180};
181
182struct nft_data_desc {
183 enum nft_data_types type;
184 unsigned int len;
185};
186
187int nft_data_init(const struct nft_ctx *ctx,
188 struct nft_data *data, unsigned int size,
189 struct nft_data_desc *desc, const struct nlattr *nla);
190void nft_data_hold(const struct nft_data *data, enum nft_data_types type);
191void nft_data_release(const struct nft_data *data, enum nft_data_types type);
192int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
193 enum nft_data_types type, unsigned int len);
194
195static inline enum nft_data_types nft_dreg_to_type(enum nft_registers reg)
196{
197 return reg == NFT_REG_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE;
198}
199
200static inline enum nft_registers nft_type_to_reg(enum nft_data_types type)
201{
202 return type == NFT_DATA_VERDICT ? NFT_REG_VERDICT : NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE;
203}
204
205int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest);
206unsigned int nft_parse_register(const struct nlattr *attr);
207int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg);
208
209int nft_validate_register_load(enum nft_registers reg, unsigned int len);
210int nft_validate_register_store(const struct nft_ctx *ctx,
211 enum nft_registers reg,
212 const struct nft_data *data,
213 enum nft_data_types type, unsigned int len);
214
215
216
217
218
219
220
221
222
223
224
225struct nft_userdata {
226 u8 len;
227 unsigned char data[0];
228};
229
230
231
232
233
234
235
236
237struct nft_set_elem {
238 union {
239 u32 buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)];
240 struct nft_data val;
241 } key;
242 union {
243 u32 buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)];
244 struct nft_data val;
245 } key_end;
246 void *priv;
247};
248
249struct nft_set;
250struct nft_set_iter {
251 u8 genmask;
252 unsigned int count;
253 unsigned int skip;
254 int err;
255 int (*fn)(const struct nft_ctx *ctx,
256 struct nft_set *set,
257 const struct nft_set_iter *iter,
258 struct nft_set_elem *elem);
259};
260
261
262
263
264
265
266
267
268
269
270struct nft_set_desc {
271 unsigned int klen;
272 unsigned int dlen;
273 unsigned int size;
274 u8 field_len[NFT_REG32_COUNT];
275 u8 field_count;
276};
277
278
279
280
281
282
283
284
285enum nft_set_class {
286 NFT_SET_CLASS_O_1,
287 NFT_SET_CLASS_O_LOG_N,
288 NFT_SET_CLASS_O_N,
289};
290
291
292
293
294
295
296
297
298
299struct nft_set_estimate {
300 u64 size;
301 enum nft_set_class lookup;
302 enum nft_set_class space;
303};
304
305struct nft_set_ext;
306struct nft_expr;
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330struct nft_set_ops {
331 bool (*lookup)(const struct net *net,
332 const struct nft_set *set,
333 const u32 *key,
334 const struct nft_set_ext **ext);
335 bool (*update)(struct nft_set *set,
336 const u32 *key,
337 void *(*new)(struct nft_set *,
338 const struct nft_expr *,
339 struct nft_regs *),
340 const struct nft_expr *expr,
341 struct nft_regs *regs,
342 const struct nft_set_ext **ext);
343 bool (*delete)(const struct nft_set *set,
344 const u32 *key);
345
346 int (*insert)(const struct net *net,
347 const struct nft_set *set,
348 const struct nft_set_elem *elem,
349 struct nft_set_ext **ext);
350 void (*activate)(const struct net *net,
351 const struct nft_set *set,
352 const struct nft_set_elem *elem);
353 void * (*deactivate)(const struct net *net,
354 const struct nft_set *set,
355 const struct nft_set_elem *elem);
356 bool (*flush)(const struct net *net,
357 const struct nft_set *set,
358 void *priv);
359 void (*remove)(const struct net *net,
360 const struct nft_set *set,
361 const struct nft_set_elem *elem);
362 void (*walk)(const struct nft_ctx *ctx,
363 struct nft_set *set,
364 struct nft_set_iter *iter);
365 void * (*get)(const struct net *net,
366 const struct nft_set *set,
367 const struct nft_set_elem *elem,
368 unsigned int flags);
369
370 u64 (*privsize)(const struct nlattr * const nla[],
371 const struct nft_set_desc *desc);
372 bool (*estimate)(const struct nft_set_desc *desc,
373 u32 features,
374 struct nft_set_estimate *est);
375 int (*init)(const struct nft_set *set,
376 const struct nft_set_desc *desc,
377 const struct nlattr * const nla[]);
378 void (*destroy)(const struct nft_set *set);
379 void (*gc_init)(const struct nft_set *set);
380
381 unsigned int elemsize;
382};
383
384
385
386
387
388
389
390
391
392struct nft_set_type {
393 const struct nft_set_ops ops;
394 struct list_head list;
395 struct module *owner;
396 u32 features;
397};
398#define to_set_type(o) container_of(o, struct nft_set_type, ops)
399
400int nft_register_set(struct nft_set_type *type);
401void nft_unregister_set(struct nft_set_type *type);
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433struct nft_set {
434 struct list_head list;
435 struct list_head bindings;
436 struct nft_table *table;
437 possible_net_t net;
438 char *name;
439 u64 handle;
440 u32 ktype;
441 u32 dtype;
442 u32 objtype;
443 u32 size;
444 u8 field_len[NFT_REG32_COUNT];
445 u8 field_count;
446 u32 use;
447 atomic_t nelems;
448 u32 ndeact;
449 u64 timeout;
450 u32 gc_int;
451 u16 policy;
452 u16 udlen;
453 unsigned char *udata;
454
455 const struct nft_set_ops *ops ____cacheline_aligned;
456 u16 flags:14,
457 genmask:2;
458 u8 klen;
459 u8 dlen;
460 unsigned char data[]
461 __attribute__((aligned(__alignof__(u64))));
462};
463
464static inline bool nft_set_is_anonymous(const struct nft_set *set)
465{
466 return set->flags & NFT_SET_ANONYMOUS;
467}
468
469static inline void *nft_set_priv(const struct nft_set *set)
470{
471 return (void *)set->data;
472}
473
474static inline struct nft_set *nft_set_container_of(const void *priv)
475{
476 return (void *)priv - offsetof(struct nft_set, data);
477}
478
479struct nft_set *nft_set_lookup_global(const struct net *net,
480 const struct nft_table *table,
481 const struct nlattr *nla_set_name,
482 const struct nlattr *nla_set_id,
483 u8 genmask);
484
485static inline unsigned long nft_set_gc_interval(const struct nft_set *set)
486{
487 return set->gc_int ? msecs_to_jiffies(set->gc_int) : HZ;
488}
489
490
491
492
493
494
495
496
497
498
499
500struct nft_set_binding {
501 struct list_head list;
502 const struct nft_chain *chain;
503 u32 flags;
504};
505
506enum nft_trans_phase;
507void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set,
508 struct nft_set_binding *binding,
509 enum nft_trans_phase phase);
510int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
511 struct nft_set_binding *binding);
512void nf_tables_destroy_set(const struct nft_ctx *ctx, struct nft_set *set);
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528enum nft_set_extensions {
529 NFT_SET_EXT_KEY,
530 NFT_SET_EXT_KEY_END,
531 NFT_SET_EXT_DATA,
532 NFT_SET_EXT_FLAGS,
533 NFT_SET_EXT_TIMEOUT,
534 NFT_SET_EXT_EXPIRATION,
535 NFT_SET_EXT_USERDATA,
536 NFT_SET_EXT_EXPR,
537 NFT_SET_EXT_OBJREF,
538 NFT_SET_EXT_NUM
539};
540
541
542
543
544
545
546
547struct nft_set_ext_type {
548 u8 len;
549 u8 align;
550};
551
552extern const struct nft_set_ext_type nft_set_ext_types[];
553
554
555
556
557
558
559
560struct nft_set_ext_tmpl {
561 u16 len;
562 u8 offset[NFT_SET_EXT_NUM];
563};
564
565
566
567
568
569
570
571
572struct nft_set_ext {
573 u8 genmask;
574 u8 offset[NFT_SET_EXT_NUM];
575 char data[0];
576};
577
578static inline void nft_set_ext_prepare(struct nft_set_ext_tmpl *tmpl)
579{
580 memset(tmpl, 0, sizeof(*tmpl));
581 tmpl->len = sizeof(struct nft_set_ext);
582}
583
584static inline void nft_set_ext_add_length(struct nft_set_ext_tmpl *tmpl, u8 id,
585 unsigned int len)
586{
587 tmpl->len = ALIGN(tmpl->len, nft_set_ext_types[id].align);
588 BUG_ON(tmpl->len > U8_MAX);
589 tmpl->offset[id] = tmpl->len;
590 tmpl->len += nft_set_ext_types[id].len + len;
591}
592
593static inline void nft_set_ext_add(struct nft_set_ext_tmpl *tmpl, u8 id)
594{
595 nft_set_ext_add_length(tmpl, id, 0);
596}
597
598static inline void nft_set_ext_init(struct nft_set_ext *ext,
599 const struct nft_set_ext_tmpl *tmpl)
600{
601 memcpy(ext->offset, tmpl->offset, sizeof(ext->offset));
602}
603
604static inline bool __nft_set_ext_exists(const struct nft_set_ext *ext, u8 id)
605{
606 return !!ext->offset[id];
607}
608
609static inline bool nft_set_ext_exists(const struct nft_set_ext *ext, u8 id)
610{
611 return ext && __nft_set_ext_exists(ext, id);
612}
613
614static inline void *nft_set_ext(const struct nft_set_ext *ext, u8 id)
615{
616 return (void *)ext + ext->offset[id];
617}
618
619static inline struct nft_data *nft_set_ext_key(const struct nft_set_ext *ext)
620{
621 return nft_set_ext(ext, NFT_SET_EXT_KEY);
622}
623
624static inline struct nft_data *nft_set_ext_key_end(const struct nft_set_ext *ext)
625{
626 return nft_set_ext(ext, NFT_SET_EXT_KEY_END);
627}
628
629static inline struct nft_data *nft_set_ext_data(const struct nft_set_ext *ext)
630{
631 return nft_set_ext(ext, NFT_SET_EXT_DATA);
632}
633
634static inline u8 *nft_set_ext_flags(const struct nft_set_ext *ext)
635{
636 return nft_set_ext(ext, NFT_SET_EXT_FLAGS);
637}
638
639static inline u64 *nft_set_ext_timeout(const struct nft_set_ext *ext)
640{
641 return nft_set_ext(ext, NFT_SET_EXT_TIMEOUT);
642}
643
644static inline u64 *nft_set_ext_expiration(const struct nft_set_ext *ext)
645{
646 return nft_set_ext(ext, NFT_SET_EXT_EXPIRATION);
647}
648
649static inline struct nft_userdata *nft_set_ext_userdata(const struct nft_set_ext *ext)
650{
651 return nft_set_ext(ext, NFT_SET_EXT_USERDATA);
652}
653
654static inline struct nft_expr *nft_set_ext_expr(const struct nft_set_ext *ext)
655{
656 return nft_set_ext(ext, NFT_SET_EXT_EXPR);
657}
658
659static inline bool nft_set_elem_expired(const struct nft_set_ext *ext)
660{
661 return nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION) &&
662 time_is_before_eq_jiffies64(*nft_set_ext_expiration(ext));
663}
664
665static inline struct nft_set_ext *nft_set_elem_ext(const struct nft_set *set,
666 void *elem)
667{
668 return elem + set->ops->elemsize;
669}
670
671static inline struct nft_object **nft_set_ext_obj(const struct nft_set_ext *ext)
672{
673 return nft_set_ext(ext, NFT_SET_EXT_OBJREF);
674}
675
676void *nft_set_elem_init(const struct nft_set *set,
677 const struct nft_set_ext_tmpl *tmpl,
678 const u32 *key, const u32 *key_end, const u32 *data,
679 u64 timeout, u64 expiration, gfp_t gfp);
680void nft_set_elem_destroy(const struct nft_set *set, void *elem,
681 bool destroy_expr);
682
683
684
685
686
687
688
689
690struct nft_set_gc_batch_head {
691 struct rcu_head rcu;
692 const struct nft_set *set;
693 unsigned int cnt;
694};
695
696#define NFT_SET_GC_BATCH_SIZE ((PAGE_SIZE - \
697 sizeof(struct nft_set_gc_batch_head)) / \
698 sizeof(void *))
699
700
701
702
703
704
705
706struct nft_set_gc_batch {
707 struct nft_set_gc_batch_head head;
708 void *elems[NFT_SET_GC_BATCH_SIZE];
709};
710
711struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set,
712 gfp_t gfp);
713void nft_set_gc_batch_release(struct rcu_head *rcu);
714
715static inline void nft_set_gc_batch_complete(struct nft_set_gc_batch *gcb)
716{
717 if (gcb != NULL)
718 call_rcu(&gcb->head.rcu, nft_set_gc_batch_release);
719}
720
721static inline struct nft_set_gc_batch *
722nft_set_gc_batch_check(const struct nft_set *set, struct nft_set_gc_batch *gcb,
723 gfp_t gfp)
724{
725 if (gcb != NULL) {
726 if (gcb->head.cnt + 1 < ARRAY_SIZE(gcb->elems))
727 return gcb;
728 nft_set_gc_batch_complete(gcb);
729 }
730 return nft_set_gc_batch_alloc(set, gfp);
731}
732
733static inline void nft_set_gc_batch_add(struct nft_set_gc_batch *gcb,
734 void *elem)
735{
736 gcb->elems[gcb->head.cnt++] = elem;
737}
738
739struct nft_expr_ops;
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754struct nft_expr_type {
755 const struct nft_expr_ops *(*select_ops)(const struct nft_ctx *,
756 const struct nlattr * const tb[]);
757 void (*release_ops)(const struct nft_expr_ops *ops);
758 const struct nft_expr_ops *ops;
759 struct list_head list;
760 const char *name;
761 struct module *owner;
762 const struct nla_policy *policy;
763 unsigned int maxattr;
764 u8 family;
765 u8 flags;
766};
767
768#define NFT_EXPR_STATEFUL 0x1
769#define NFT_EXPR_GC 0x2
770
771enum nft_trans_phase {
772 NFT_TRANS_PREPARE,
773 NFT_TRANS_ABORT,
774 NFT_TRANS_COMMIT,
775 NFT_TRANS_RELEASE
776};
777
778struct nft_flow_rule;
779struct nft_offload_ctx;
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795struct nft_expr;
796struct nft_expr_ops {
797 void (*eval)(const struct nft_expr *expr,
798 struct nft_regs *regs,
799 const struct nft_pktinfo *pkt);
800 int (*clone)(struct nft_expr *dst,
801 const struct nft_expr *src);
802 unsigned int size;
803
804 int (*init)(const struct nft_ctx *ctx,
805 const struct nft_expr *expr,
806 const struct nlattr * const tb[]);
807 void (*activate)(const struct nft_ctx *ctx,
808 const struct nft_expr *expr);
809 void (*deactivate)(const struct nft_ctx *ctx,
810 const struct nft_expr *expr,
811 enum nft_trans_phase phase);
812 void (*destroy)(const struct nft_ctx *ctx,
813 const struct nft_expr *expr);
814 void (*destroy_clone)(const struct nft_ctx *ctx,
815 const struct nft_expr *expr);
816 int (*dump)(struct sk_buff *skb,
817 const struct nft_expr *expr);
818 int (*validate)(const struct nft_ctx *ctx,
819 const struct nft_expr *expr,
820 const struct nft_data **data);
821 bool (*gc)(struct net *net,
822 const struct nft_expr *expr);
823 int (*offload)(struct nft_offload_ctx *ctx,
824 struct nft_flow_rule *flow,
825 const struct nft_expr *expr);
826 u32 offload_flags;
827 const struct nft_expr_type *type;
828 void *data;
829};
830
831#define NFT_EXPR_MAXATTR 16
832#define NFT_EXPR_SIZE(size) (sizeof(struct nft_expr) + \
833 ALIGN(size, __alignof__(struct nft_expr)))
834
835
836
837
838
839
840
841struct nft_expr {
842 const struct nft_expr_ops *ops;
843 unsigned char data[]
844 __attribute__((aligned(__alignof__(u64))));
845};
846
847static inline void *nft_expr_priv(const struct nft_expr *expr)
848{
849 return (void *)expr->data;
850}
851
852struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
853 const struct nlattr *nla);
854void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr);
855int nft_expr_dump(struct sk_buff *skb, unsigned int attr,
856 const struct nft_expr *expr);
857
858
859
860
861
862
863
864
865
866
867
868struct nft_rule {
869 struct list_head list;
870 u64 handle:42,
871 genmask:2,
872 dlen:12,
873 udata:1;
874 unsigned char data[]
875 __attribute__((aligned(__alignof__(struct nft_expr))));
876};
877
878static inline struct nft_expr *nft_expr_first(const struct nft_rule *rule)
879{
880 return (struct nft_expr *)&rule->data[0];
881}
882
883static inline struct nft_expr *nft_expr_next(const struct nft_expr *expr)
884{
885 return ((void *)expr) + expr->ops->size;
886}
887
888static inline struct nft_expr *nft_expr_last(const struct nft_rule *rule)
889{
890 return (struct nft_expr *)&rule->data[rule->dlen];
891}
892
893static inline struct nft_userdata *nft_userdata(const struct nft_rule *rule)
894{
895 return (void *)&rule->data[rule->dlen];
896}
897
898
899
900
901
902
903#define nft_rule_for_each_expr(expr, last, rule) \
904 for ((expr) = nft_expr_first(rule), (last) = nft_expr_last(rule); \
905 (expr) != (last); \
906 (expr) = nft_expr_next(expr))
907
908enum nft_chain_flags {
909 NFT_BASE_CHAIN = 0x1,
910 NFT_CHAIN_HW_OFFLOAD = 0x2,
911};
912
913#define NFT_CHAIN_POLICY_UNSET U8_MAX
914
915
916
917
918
919
920
921
922
923
924
925
926
927struct nft_chain {
928 struct nft_rule *__rcu *rules_gen_0;
929 struct nft_rule *__rcu *rules_gen_1;
930 struct list_head rules;
931 struct list_head list;
932 struct rhlist_head rhlhead;
933 struct nft_table *table;
934 u64 handle;
935 u32 use;
936 u8 flags:6,
937 genmask:2;
938 char *name;
939
940
941 struct nft_rule **rules_next;
942};
943
944int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain);
945
946enum nft_chain_types {
947 NFT_CHAIN_T_DEFAULT = 0,
948 NFT_CHAIN_T_ROUTE,
949 NFT_CHAIN_T_NAT,
950 NFT_CHAIN_T_MAX
951};
952
953
954
955
956
957
958
959
960
961
962
963
964
965struct nft_chain_type {
966 const char *name;
967 enum nft_chain_types type;
968 int family;
969 struct module *owner;
970 unsigned int hook_mask;
971 nf_hookfn *hooks[NF_MAX_HOOKS];
972 int (*ops_register)(struct net *net, const struct nf_hook_ops *ops);
973 void (*ops_unregister)(struct net *net, const struct nf_hook_ops *ops);
974};
975
976int nft_chain_validate_dependency(const struct nft_chain *chain,
977 enum nft_chain_types type);
978int nft_chain_validate_hooks(const struct nft_chain *chain,
979 unsigned int hook_flags);
980
981struct nft_stats {
982 u64 bytes;
983 u64 pkts;
984 struct u64_stats_sync syncp;
985};
986
987struct nft_hook {
988 struct list_head list;
989 struct nf_hook_ops ops;
990 struct rcu_head rcu;
991};
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004struct nft_base_chain {
1005 struct nf_hook_ops ops;
1006 struct list_head hook_list;
1007 const struct nft_chain_type *type;
1008 u8 policy;
1009 u8 flags;
1010 struct nft_stats __percpu *stats;
1011 struct nft_chain chain;
1012 struct flow_block flow_block;
1013};
1014
1015static inline struct nft_base_chain *nft_base_chain(const struct nft_chain *chain)
1016{
1017 return container_of(chain, struct nft_base_chain, chain);
1018}
1019
1020static inline bool nft_is_base_chain(const struct nft_chain *chain)
1021{
1022 return chain->flags & NFT_BASE_CHAIN;
1023}
1024
1025int __nft_release_basechain(struct nft_ctx *ctx);
1026
1027unsigned int nft_do_chain(struct nft_pktinfo *pkt, void *priv);
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046struct nft_table {
1047 struct list_head list;
1048 struct rhltable chains_ht;
1049 struct list_head chains;
1050 struct list_head sets;
1051 struct list_head objects;
1052 struct list_head flowtables;
1053 u64 hgenerator;
1054 u64 handle;
1055 u32 use;
1056 u16 family:6,
1057 flags:8,
1058 genmask:2;
1059 char *name;
1060};
1061
1062void nft_register_chain_type(const struct nft_chain_type *);
1063void nft_unregister_chain_type(const struct nft_chain_type *);
1064
1065int nft_register_expr(struct nft_expr_type *);
1066void nft_unregister_expr(struct nft_expr_type *);
1067
1068int nft_verdict_dump(struct sk_buff *skb, int type,
1069 const struct nft_verdict *v);
1070
1071
1072
1073
1074
1075
1076
1077struct nft_object_hash_key {
1078 const char *name;
1079 const struct nft_table *table;
1080};
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094struct nft_object {
1095 struct list_head list;
1096 struct rhlist_head rhlhead;
1097 struct nft_object_hash_key key;
1098 u32 genmask:2,
1099 use:30;
1100 u64 handle;
1101
1102 const struct nft_object_ops *ops ____cacheline_aligned;
1103 unsigned char data[]
1104 __attribute__((aligned(__alignof__(u64))));
1105};
1106
1107static inline void *nft_obj_data(const struct nft_object *obj)
1108{
1109 return (void *)obj->data;
1110}
1111
1112#define nft_expr_obj(expr) *((struct nft_object **)nft_expr_priv(expr))
1113
1114struct nft_object *nft_obj_lookup(const struct net *net,
1115 const struct nft_table *table,
1116 const struct nlattr *nla, u32 objtype,
1117 u8 genmask);
1118
1119void nft_obj_notify(struct net *net, const struct nft_table *table,
1120 struct nft_object *obj, u32 portid, u32 seq,
1121 int event, int family, int report, gfp_t gfp);
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134struct nft_object_type {
1135 const struct nft_object_ops *(*select_ops)(const struct nft_ctx *,
1136 const struct nlattr * const tb[]);
1137 const struct nft_object_ops *ops;
1138 struct list_head list;
1139 u32 type;
1140 unsigned int maxattr;
1141 struct module *owner;
1142 const struct nla_policy *policy;
1143};
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155struct nft_object_ops {
1156 void (*eval)(struct nft_object *obj,
1157 struct nft_regs *regs,
1158 const struct nft_pktinfo *pkt);
1159 unsigned int size;
1160 int (*init)(const struct nft_ctx *ctx,
1161 const struct nlattr *const tb[],
1162 struct nft_object *obj);
1163 void (*destroy)(const struct nft_ctx *ctx,
1164 struct nft_object *obj);
1165 int (*dump)(struct sk_buff *skb,
1166 struct nft_object *obj,
1167 bool reset);
1168 void (*update)(struct nft_object *obj,
1169 struct nft_object *newobj);
1170 const struct nft_object_type *type;
1171};
1172
1173int nft_register_obj(struct nft_object_type *obj_type);
1174void nft_unregister_obj(struct nft_object_type *obj_type);
1175
1176#define NFT_NETDEVICE_MAX 256
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193struct nft_flowtable {
1194 struct list_head list;
1195 struct nft_table *table;
1196 char *name;
1197 int hooknum;
1198 int ops_len;
1199 u32 genmask:2,
1200 use:30;
1201 u64 handle;
1202
1203 struct list_head hook_list ____cacheline_aligned;
1204 struct nf_flowtable data;
1205};
1206
1207struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table,
1208 const struct nlattr *nla,
1209 u8 genmask);
1210
1211void nf_tables_deactivate_flowtable(const struct nft_ctx *ctx,
1212 struct nft_flowtable *flowtable,
1213 enum nft_trans_phase phase);
1214
1215void nft_register_flowtable_type(struct nf_flowtable_type *type);
1216void nft_unregister_flowtable_type(struct nf_flowtable_type *type);
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230struct nft_traceinfo {
1231 const struct nft_pktinfo *pkt;
1232 const struct nft_base_chain *basechain;
1233 const struct nft_chain *chain;
1234 const struct nft_rule *rule;
1235 const struct nft_verdict *verdict;
1236 enum nft_trace_types type;
1237 bool packet_dumped;
1238 bool trace;
1239};
1240
1241void nft_trace_init(struct nft_traceinfo *info, const struct nft_pktinfo *pkt,
1242 const struct nft_verdict *verdict,
1243 const struct nft_chain *basechain);
1244
1245void nft_trace_notify(struct nft_traceinfo *info);
1246
1247#define MODULE_ALIAS_NFT_CHAIN(family, name) \
1248 MODULE_ALIAS("nft-chain-" __stringify(family) "-" name)
1249
1250#define MODULE_ALIAS_NFT_AF_EXPR(family, name) \
1251 MODULE_ALIAS("nft-expr-" __stringify(family) "-" name)
1252
1253#define MODULE_ALIAS_NFT_EXPR(name) \
1254 MODULE_ALIAS("nft-expr-" name)
1255
1256#define MODULE_ALIAS_NFT_SET() \
1257 MODULE_ALIAS("nft-set")
1258
1259#define MODULE_ALIAS_NFT_OBJ(type) \
1260 MODULE_ALIAS("nft-obj-" __stringify(type))
1261
1262#if IS_ENABLED(CONFIG_NF_TABLES)
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276static inline unsigned int nft_gencursor_next(const struct net *net)
1277{
1278 return net->nft.gencursor + 1 == 1 ? 1 : 0;
1279}
1280
1281static inline u8 nft_genmask_next(const struct net *net)
1282{
1283 return 1 << nft_gencursor_next(net);
1284}
1285
1286static inline u8 nft_genmask_cur(const struct net *net)
1287{
1288
1289 return 1 << READ_ONCE(net->nft.gencursor);
1290}
1291
1292#define NFT_GENMASK_ANY ((1 << 0) | (1 << 1))
1293
1294
1295
1296
1297
1298
1299#define nft_is_active(__net, __obj) \
1300 (((__obj)->genmask & nft_genmask_cur(__net)) == 0)
1301
1302
1303#define nft_is_active_next(__net, __obj) \
1304 (((__obj)->genmask & nft_genmask_next(__net)) == 0)
1305
1306
1307#define nft_activate_next(__net, __obj) \
1308 (__obj)->genmask = nft_genmask_cur(__net)
1309
1310
1311#define nft_deactivate_next(__net, __obj) \
1312 (__obj)->genmask = nft_genmask_next(__net)
1313
1314
1315#define nft_clear(__net, __obj) \
1316 (__obj)->genmask &= ~nft_genmask_next(__net)
1317#define nft_active_genmask(__obj, __genmask) \
1318 !((__obj)->genmask & __genmask)
1319
1320
1321
1322
1323
1324static inline bool nft_set_elem_active(const struct nft_set_ext *ext,
1325 u8 genmask)
1326{
1327 return !(ext->genmask & genmask);
1328}
1329
1330static inline void nft_set_elem_change_active(const struct net *net,
1331 const struct nft_set *set,
1332 struct nft_set_ext *ext)
1333{
1334 ext->genmask ^= nft_genmask_next(net);
1335}
1336
1337#endif
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349#define NFT_SET_ELEM_BUSY_MASK (1 << 2)
1350
1351#if defined(__LITTLE_ENDIAN_BITFIELD)
1352#define NFT_SET_ELEM_BUSY_BIT 2
1353#elif defined(__BIG_ENDIAN_BITFIELD)
1354#define NFT_SET_ELEM_BUSY_BIT (BITS_PER_LONG - BITS_PER_BYTE + 2)
1355#else
1356#error
1357#endif
1358
1359static inline int nft_set_elem_mark_busy(struct nft_set_ext *ext)
1360{
1361 unsigned long *word = (unsigned long *)ext;
1362
1363 BUILD_BUG_ON(offsetof(struct nft_set_ext, genmask) != 0);
1364 return test_and_set_bit(NFT_SET_ELEM_BUSY_BIT, word);
1365}
1366
1367static inline void nft_set_elem_clear_busy(struct nft_set_ext *ext)
1368{
1369 unsigned long *word = (unsigned long *)ext;
1370
1371 clear_bit(NFT_SET_ELEM_BUSY_BIT, word);
1372}
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383struct nft_trans {
1384 struct list_head list;
1385 int msg_type;
1386 bool put_net;
1387 struct nft_ctx ctx;
1388 char data[0];
1389};
1390
1391struct nft_trans_rule {
1392 struct nft_rule *rule;
1393 struct nft_flow_rule *flow;
1394 u32 rule_id;
1395};
1396
1397#define nft_trans_rule(trans) \
1398 (((struct nft_trans_rule *)trans->data)->rule)
1399#define nft_trans_flow_rule(trans) \
1400 (((struct nft_trans_rule *)trans->data)->flow)
1401#define nft_trans_rule_id(trans) \
1402 (((struct nft_trans_rule *)trans->data)->rule_id)
1403
1404struct nft_trans_set {
1405 struct nft_set *set;
1406 u32 set_id;
1407 bool bound;
1408};
1409
1410#define nft_trans_set(trans) \
1411 (((struct nft_trans_set *)trans->data)->set)
1412#define nft_trans_set_id(trans) \
1413 (((struct nft_trans_set *)trans->data)->set_id)
1414#define nft_trans_set_bound(trans) \
1415 (((struct nft_trans_set *)trans->data)->bound)
1416
1417struct nft_trans_chain {
1418 bool update;
1419 char *name;
1420 struct nft_stats __percpu *stats;
1421 u8 policy;
1422};
1423
1424#define nft_trans_chain_update(trans) \
1425 (((struct nft_trans_chain *)trans->data)->update)
1426#define nft_trans_chain_name(trans) \
1427 (((struct nft_trans_chain *)trans->data)->name)
1428#define nft_trans_chain_stats(trans) \
1429 (((struct nft_trans_chain *)trans->data)->stats)
1430#define nft_trans_chain_policy(trans) \
1431 (((struct nft_trans_chain *)trans->data)->policy)
1432
1433struct nft_trans_table {
1434 bool update;
1435 bool enable;
1436};
1437
1438#define nft_trans_table_update(trans) \
1439 (((struct nft_trans_table *)trans->data)->update)
1440#define nft_trans_table_enable(trans) \
1441 (((struct nft_trans_table *)trans->data)->enable)
1442
1443struct nft_trans_elem {
1444 struct nft_set *set;
1445 struct nft_set_elem elem;
1446 bool bound;
1447};
1448
1449#define nft_trans_elem_set(trans) \
1450 (((struct nft_trans_elem *)trans->data)->set)
1451#define nft_trans_elem(trans) \
1452 (((struct nft_trans_elem *)trans->data)->elem)
1453#define nft_trans_elem_set_bound(trans) \
1454 (((struct nft_trans_elem *)trans->data)->bound)
1455
1456struct nft_trans_obj {
1457 struct nft_object *obj;
1458 struct nft_object *newobj;
1459 bool update;
1460};
1461
1462#define nft_trans_obj(trans) \
1463 (((struct nft_trans_obj *)trans->data)->obj)
1464#define nft_trans_obj_newobj(trans) \
1465 (((struct nft_trans_obj *)trans->data)->newobj)
1466#define nft_trans_obj_update(trans) \
1467 (((struct nft_trans_obj *)trans->data)->update)
1468
1469struct nft_trans_flowtable {
1470 struct nft_flowtable *flowtable;
1471};
1472
1473#define nft_trans_flowtable(trans) \
1474 (((struct nft_trans_flowtable *)trans->data)->flowtable)
1475
1476int __init nft_chain_filter_init(void);
1477void nft_chain_filter_fini(void);
1478
1479void __init nft_chain_route_init(void);
1480void nft_chain_route_fini(void);
1481#endif
1482