include/linux/netfilter.h

   1 #ifndef __LINUX_NETFILTER_H
   2 #define __LINUX_NETFILTER_H
   3
   4 #ifdef __KERNEL__
   5 #include <linux/init.h>
   6 #include <linux/types.h>
   7 #include <linux/skbuff.h>
   8 #include <linux/net.h>
   9 #include <linux/wait.h>
  10 #include <linux/list.h>
  11 #endif
  12
  13 /* Responses from hook functions. */
  14 #define NF_DROP 0
  15 #define NF_ACCEPT 1
  16 #define NF_STOLEN 2
  17 #define NF_QUEUE 3
  18 #define NF_MAX_VERDICT NF_QUEUE
  19
  20 /* Generic cache responses from hook functions. */
  21 #define NFC_ALTERED 0x8000
  22 #define NFC_UNKNOWN 0x4000
  23
  24 #ifdef __KERNEL__
  25 #include <linux/config.h>
  26 #ifdef CONFIG_NETFILTER
  27
  28 extern void netfilter_init(void);
  29
  30 /* Largest hook number + 1 */
  31 #define NF_MAX_HOOKS 5
  32
  33 struct sk_buff;
  34 struct net_device;
  35
  36 typedef unsigned int nf_hookfn(unsigned int hooknum,
  37                                struct sk_buff **skb,
  38                                const struct net_device *in,
  39                                const struct net_device *out);
  40
  41 typedef unsigned int nf_cacheflushfn(const void *packet,
  42                                      const struct net_device *in,
  43                                      const struct net_device *out,
  44                                      u_int32_t packetcount,
  45                                      u_int32_t bytecount);
  46
  47 struct nf_hook_ops
  48 {
  49         struct list_head list;
  50
  51         /* User fills in from here down. */
  52         nf_hookfn *hook;
  53         nf_cacheflushfn *flush;
  54         int pf;
  55         int hooknum;
  56         /* Hooks are ordered in ascending priority. */
  57         int priority;
  58 };
  59
  60 struct nf_sockopt_ops
  61 {
  62         struct list_head list;
  63
  64         int pf;
  65
  66         /* Non-inclusive ranges: use 0/0/NULL to never get called. */
  67         int set_optmin;
  68         int set_optmax;
  69         int (*set)(struct sock *sk, int optval, void *user, unsigned int len);
  70
  71         int get_optmin;
  72         int get_optmax;
  73         int (*get)(struct sock *sk, int optval, void *user, int *len);
  74 };
  75
  76 /* Function to register/unregister hook points. */
  77 int nf_register_hook(struct nf_hook_ops *reg);
  78 void nf_unregister_hook(struct nf_hook_ops *reg);
  79
  80 /* Functions to register get/setsockopt ranges (non-inclusive).  You
  81    need to check permissions yourself! */
  82 int nf_register_sockopt(struct nf_sockopt_ops *reg);
  83 void nf_unregister_sockopt(struct nf_sockopt_ops *reg);
  84
  85 extern struct list_head nf_hooks[NPROTO][NF_MAX_HOOKS];
  86
  87 /* Activate hook/flush; either okfn or kfree_skb called, unless a hook
  88    returns NF_STOLEN (in which case, it's up to the hook to deal with
  89    the consequences).
  90
  91    Returns -ERRNO if packet dropped.  Zero means queued, stolen or
  92    accepted.
  93 */
  94
  95 /* RR:
  96    > I don't want nf_hook to return anything because people might forget
  97    > about async and trust the return value to mean "packet was ok".
  98
  99    AK:
 100    Just document it clearly, then you can expect some sense from kernel
 101    coders :)
 102 */
 103
 104 /* This is gross, but inline doesn't cut it for avoiding the function
 105    call in fast path: gcc doesn't inline (needs value tracking?). --RR */
 106 #ifdef CONFIG_NETFILTER_DEBUG
 107 #define NF_HOOK nf_hook_slow
 108 #else
 109 #define NF_HOOK(pf, hook, skb, indev, outdev, okfn)                     \
 110 (list_empty(&nf_hooks[(pf)][(hook)])                                    \
 111  ? (okfn)(skb)                                                          \
 112  : nf_hook_slow((pf), (hook), (skb), (indev), (outdev), (okfn)))
 113 #endif
 114
 115 int nf_hook_slow(int pf, unsigned int hook, struct sk_buff *skb,
 116                  struct net_device *indev, struct net_device *outdev,
 117                  int (*okfn)(struct sk_buff *));
 118
 119 void nf_cacheflush(int pf, unsigned int hook, const void *packet,
 120                    const struct net_device *indev, const struct net_device *outdev,
 121                    __u32 packetcount, __u32 bytecount);
 122
 123 /* Call setsockopt() */
 124 int nf_setsockopt(struct sock *sk, int pf, int optval, char *opt,
 125                   int len);
 126 int nf_getsockopt(struct sock *sk, int pf, int optval, char *opt,
 127                   int *len);
 128
 129 struct nf_wakeme
 130 {
 131         wait_queue_head_t sleep;
 132         struct sk_buff_head skbq;
 133 };
 134
 135 /* For netfilter device. */
 136 struct nf_interest
 137 {
 138         struct list_head list;
 139
 140         int pf;
 141         /* Bitmask of hook numbers to match (1 << hooknum). */
 142         unsigned int hookmask;
 143         /* If non-zero, only catch packets with this mark. */
 144         unsigned int mark;
 145         /* If non-zero, only catch packets of this reason. */
 146         unsigned int reason;
 147
 148         struct nf_wakeme *wake;
 149 };
 150
 151 /* For asynchronous packet handling. */
 152 extern void nf_register_interest(struct nf_interest *interest);
 153 extern void nf_unregister_interest(struct nf_interest *interest);
 154 extern void nf_getinfo(const struct sk_buff *skb,
 155                        struct net_device **indev,
 156                        struct net_device **outdev,
 157                        unsigned long *mark);
 158 extern void nf_reinject(struct sk_buff *skb,
 159                         unsigned long mark,
 160                         unsigned int verdict);
 161
 162 #ifdef CONFIG_NETFILTER_DEBUG
 163 extern void nf_dump_skb(int pf, struct sk_buff *skb);
 164 #endif
 165
 166 /* FIXME: Before cache is ever used, this must be implemented for real. */
 167 extern void nf_invalidate_cache(int pf);
 168
 169 #else /* !CONFIG_NETFILTER */
 170 #define NF_HOOK(pf, hook, skb, indev, outdev, okfn) (okfn)(skb)
 171 #endif /*CONFIG_NETFILTER*/
 172
 173 /* From arch/i386/kernel/smp.c:
 174  *
 175  *      Why isn't this somewhere standard ??
 176  *
 177  * Maybe because this procedure is horribly buggy, and does
 178  * not deserve to live.  Think about signedness issues for five
 179  * seconds to see why.          - Linus
 180  */
 181
 182 /* Two signed, return a signed. */
 183 #define SMAX(a,b) ((ssize_t)(a)>(ssize_t)(b) ? (ssize_t)(a) : (ssize_t)(b))
 184 #define SMIN(a,b) ((ssize_t)(a)<(ssize_t)(b) ? (ssize_t)(a) : (ssize_t)(b))
 185
 186 /* Two unsigned, return an unsigned. */
 187 #define UMAX(a,b) ((size_t)(a)>(size_t)(b) ? (size_t)(a) : (size_t)(b))
 188 #define UMIN(a,b) ((size_t)(a)<(size_t)(b) ? (size_t)(a) : (size_t)(b))
 189
 190 /* Two unsigned, return a signed. */
 191 #define SUMAX(a,b) ((size_t)(a)>(size_t)(b) ? (ssize_t)(a) : (ssize_t)(b))
 192 #define SUMIN(a,b) ((size_t)(a)<(size_t)(b) ? (ssize_t)(a) : (ssize_t)(b))
 193 #endif /*__KERNEL__*/
 194
 195 enum nf_reason {
 196         /* Do not, NOT, reorder these.  Add at end. */
 197         NF_REASON_NONE,
 198         NF_REASON_SET_BY_IPCHAINS,
 199         NF_REASON_FOR_ROUTING,
 200         NF_REASON_FOR_CLS_FW,
 201         NF_REASON_MIN_RESERVED_FOR_CONNTRACK = 1024,
 202 };
 203
 204 #endif /*__LINUX_NETFILTER_H*/