Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 1 | #ifndef _NET_NF_TABLES_H |
| 2 | #define _NET_NF_TABLES_H |
| 3 | |
| 4 | #include <linux/list.h> |
| 5 | #include <linux/netfilter.h> |
Pablo Neira Ayuso | 0ca743a | 2013-10-14 00:06:06 +0200 | [diff] [blame] | 6 | #include <linux/netfilter/x_tables.h> |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 7 | #include <linux/netfilter/nf_tables.h> |
| 8 | #include <net/netlink.h> |
| 9 | |
Patrick McHardy | 20a6934 | 2013-10-11 12:06:22 +0200 | [diff] [blame] | 10 | #define NFT_JUMP_STACK_SIZE 16 |
| 11 | |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 12 | struct nft_pktinfo { |
| 13 | struct sk_buff *skb; |
| 14 | const struct net_device *in; |
| 15 | const struct net_device *out; |
Patrick McHardy | c948487 | 2014-01-03 12:16:14 +0000 | [diff] [blame] | 16 | const struct nf_hook_ops *ops; |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 17 | u8 nhoff; |
| 18 | u8 thoff; |
Patrick McHardy | 4566bf2 | 2014-01-03 12:16:18 +0000 | [diff] [blame] | 19 | u8 tprot; |
Pablo Neira Ayuso | 0ca743a | 2013-10-14 00:06:06 +0200 | [diff] [blame] | 20 | /* for x_tables compatibility */ |
| 21 | struct xt_action_param xt; |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 22 | }; |
| 23 | |
Pablo Neira Ayuso | 0ca743a | 2013-10-14 00:06:06 +0200 | [diff] [blame] | 24 | static inline void nft_set_pktinfo(struct nft_pktinfo *pkt, |
| 25 | const struct nf_hook_ops *ops, |
| 26 | struct sk_buff *skb, |
| 27 | const struct net_device *in, |
| 28 | const struct net_device *out) |
| 29 | { |
| 30 | pkt->skb = skb; |
| 31 | pkt->in = pkt->xt.in = in; |
| 32 | pkt->out = pkt->xt.out = out; |
Patrick McHardy | c948487 | 2014-01-03 12:16:14 +0000 | [diff] [blame] | 33 | pkt->ops = ops; |
| 34 | pkt->xt.hooknum = ops->hooknum; |
Pablo Neira Ayuso | 0ca743a | 2013-10-14 00:06:06 +0200 | [diff] [blame] | 35 | pkt->xt.family = ops->pf; |
| 36 | } |
| 37 | |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 38 | struct nft_data { |
| 39 | union { |
| 40 | u32 data[4]; |
| 41 | struct { |
| 42 | u32 verdict; |
| 43 | struct nft_chain *chain; |
| 44 | }; |
| 45 | }; |
| 46 | } __attribute__((aligned(__alignof__(u64)))); |
| 47 | |
| 48 | static inline int nft_data_cmp(const struct nft_data *d1, |
| 49 | const struct nft_data *d2, |
| 50 | unsigned int len) |
| 51 | { |
| 52 | return memcmp(d1->data, d2->data, len); |
| 53 | } |
| 54 | |
| 55 | static inline void nft_data_copy(struct nft_data *dst, |
| 56 | const struct nft_data *src) |
| 57 | { |
| 58 | BUILD_BUG_ON(__alignof__(*dst) != __alignof__(u64)); |
| 59 | *(u64 *)&dst->data[0] = *(u64 *)&src->data[0]; |
| 60 | *(u64 *)&dst->data[2] = *(u64 *)&src->data[2]; |
| 61 | } |
| 62 | |
| 63 | static inline void nft_data_debug(const struct nft_data *data) |
| 64 | { |
| 65 | pr_debug("data[0]=%x data[1]=%x data[2]=%x data[3]=%x\n", |
| 66 | data->data[0], data->data[1], |
| 67 | data->data[2], data->data[3]); |
| 68 | } |
| 69 | |
| 70 | /** |
Patrick McHardy | 20a6934 | 2013-10-11 12:06:22 +0200 | [diff] [blame] | 71 | * struct nft_ctx - nf_tables rule/set context |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 72 | * |
Pablo Neira Ayuso | 99633ab | 2013-10-10 23:28:33 +0200 | [diff] [blame] | 73 | * @net: net namespace |
Patrick McHardy | 20a6934 | 2013-10-11 12:06:22 +0200 | [diff] [blame] | 74 | * @skb: netlink skb |
| 75 | * @nlh: netlink message header |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 76 | * @afi: address family info |
| 77 | * @table: the table the chain is contained in |
| 78 | * @chain: the chain the rule is contained in |
Pablo Neira Ayuso | 0ca743a | 2013-10-14 00:06:06 +0200 | [diff] [blame] | 79 | * @nla: netlink attributes |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 80 | */ |
| 81 | struct nft_ctx { |
Pablo Neira Ayuso | 99633ab | 2013-10-10 23:28:33 +0200 | [diff] [blame] | 82 | struct net *net; |
Patrick McHardy | 20a6934 | 2013-10-11 12:06:22 +0200 | [diff] [blame] | 83 | const struct sk_buff *skb; |
| 84 | const struct nlmsghdr *nlh; |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 85 | const struct nft_af_info *afi; |
| 86 | const struct nft_table *table; |
| 87 | const struct nft_chain *chain; |
Pablo Neira Ayuso | 0ca743a | 2013-10-14 00:06:06 +0200 | [diff] [blame] | 88 | const struct nlattr * const *nla; |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 89 | }; |
| 90 | |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 91 | struct nft_data_desc { |
| 92 | enum nft_data_types type; |
| 93 | unsigned int len; |
| 94 | }; |
| 95 | |
Joe Perches | 5eccdfa | 2013-10-19 22:05:31 -0700 | [diff] [blame] | 96 | int nft_data_init(const struct nft_ctx *ctx, struct nft_data *data, |
| 97 | struct nft_data_desc *desc, const struct nlattr *nla); |
| 98 | void nft_data_uninit(const struct nft_data *data, enum nft_data_types type); |
| 99 | int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data, |
| 100 | enum nft_data_types type, unsigned int len); |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 101 | |
| 102 | static inline enum nft_data_types nft_dreg_to_type(enum nft_registers reg) |
| 103 | { |
| 104 | return reg == NFT_REG_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE; |
| 105 | } |
| 106 | |
Patrick McHardy | 20a6934 | 2013-10-11 12:06:22 +0200 | [diff] [blame] | 107 | static inline enum nft_registers nft_type_to_reg(enum nft_data_types type) |
| 108 | { |
| 109 | return type == NFT_DATA_VERDICT ? NFT_REG_VERDICT : NFT_REG_1; |
| 110 | } |
| 111 | |
Joe Perches | 5eccdfa | 2013-10-19 22:05:31 -0700 | [diff] [blame] | 112 | int nft_validate_input_register(enum nft_registers reg); |
| 113 | int nft_validate_output_register(enum nft_registers reg); |
| 114 | int nft_validate_data_load(const struct nft_ctx *ctx, enum nft_registers reg, |
| 115 | const struct nft_data *data, |
| 116 | enum nft_data_types type); |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 117 | |
| 118 | /** |
Patrick McHardy | 20a6934 | 2013-10-11 12:06:22 +0200 | [diff] [blame] | 119 | * struct nft_set_elem - generic representation of set elements |
| 120 | * |
| 121 | * @cookie: implementation specific element cookie |
| 122 | * @key: element key |
| 123 | * @data: element data (maps only) |
| 124 | * @flags: element flags (end of interval) |
| 125 | * |
| 126 | * The cookie can be used to store a handle to the element for subsequent |
| 127 | * removal. |
| 128 | */ |
| 129 | struct nft_set_elem { |
| 130 | void *cookie; |
| 131 | struct nft_data key; |
| 132 | struct nft_data data; |
| 133 | u32 flags; |
| 134 | }; |
| 135 | |
| 136 | struct nft_set; |
| 137 | struct nft_set_iter { |
| 138 | unsigned int count; |
| 139 | unsigned int skip; |
| 140 | int err; |
| 141 | int (*fn)(const struct nft_ctx *ctx, |
| 142 | const struct nft_set *set, |
| 143 | const struct nft_set_iter *iter, |
| 144 | const struct nft_set_elem *elem); |
| 145 | }; |
| 146 | |
| 147 | /** |
| 148 | * struct nft_set_ops - nf_tables set operations |
| 149 | * |
| 150 | * @lookup: look up an element within the set |
| 151 | * @insert: insert new element into set |
| 152 | * @remove: remove element from set |
| 153 | * @walk: iterate over all set elemeennts |
| 154 | * @privsize: function to return size of set private data |
| 155 | * @init: initialize private data of new set instance |
| 156 | * @destroy: destroy private data of set instance |
| 157 | * @list: nf_tables_set_ops list node |
| 158 | * @owner: module reference |
| 159 | * @features: features supported by the implementation |
| 160 | */ |
| 161 | struct nft_set_ops { |
| 162 | bool (*lookup)(const struct nft_set *set, |
| 163 | const struct nft_data *key, |
| 164 | struct nft_data *data); |
| 165 | int (*get)(const struct nft_set *set, |
| 166 | struct nft_set_elem *elem); |
| 167 | int (*insert)(const struct nft_set *set, |
| 168 | const struct nft_set_elem *elem); |
| 169 | void (*remove)(const struct nft_set *set, |
| 170 | const struct nft_set_elem *elem); |
| 171 | void (*walk)(const struct nft_ctx *ctx, |
| 172 | const struct nft_set *set, |
| 173 | struct nft_set_iter *iter); |
| 174 | |
| 175 | unsigned int (*privsize)(const struct nlattr * const nla[]); |
| 176 | int (*init)(const struct nft_set *set, |
| 177 | const struct nlattr * const nla[]); |
| 178 | void (*destroy)(const struct nft_set *set); |
| 179 | |
| 180 | struct list_head list; |
| 181 | struct module *owner; |
| 182 | u32 features; |
| 183 | }; |
| 184 | |
Joe Perches | 5eccdfa | 2013-10-19 22:05:31 -0700 | [diff] [blame] | 185 | int nft_register_set(struct nft_set_ops *ops); |
| 186 | void nft_unregister_set(struct nft_set_ops *ops); |
Patrick McHardy | 20a6934 | 2013-10-11 12:06:22 +0200 | [diff] [blame] | 187 | |
| 188 | /** |
| 189 | * struct nft_set - nf_tables set instance |
| 190 | * |
| 191 | * @list: table set list node |
| 192 | * @bindings: list of set bindings |
| 193 | * @name: name of the set |
| 194 | * @ktype: key type (numeric type defined by userspace, not used in the kernel) |
| 195 | * @dtype: data type (verdict or numeric type defined by userspace) |
| 196 | * @ops: set ops |
| 197 | * @flags: set flags |
| 198 | * @klen: key length |
| 199 | * @dlen: data length |
| 200 | * @data: private set data |
| 201 | */ |
| 202 | struct nft_set { |
| 203 | struct list_head list; |
| 204 | struct list_head bindings; |
| 205 | char name[IFNAMSIZ]; |
| 206 | u32 ktype; |
| 207 | u32 dtype; |
| 208 | /* runtime data below here */ |
| 209 | const struct nft_set_ops *ops ____cacheline_aligned; |
| 210 | u16 flags; |
| 211 | u8 klen; |
| 212 | u8 dlen; |
| 213 | unsigned char data[] |
| 214 | __attribute__((aligned(__alignof__(u64)))); |
| 215 | }; |
| 216 | |
| 217 | static inline void *nft_set_priv(const struct nft_set *set) |
| 218 | { |
| 219 | return (void *)set->data; |
| 220 | } |
| 221 | |
Joe Perches | 5eccdfa | 2013-10-19 22:05:31 -0700 | [diff] [blame] | 222 | struct nft_set *nf_tables_set_lookup(const struct nft_table *table, |
| 223 | const struct nlattr *nla); |
Patrick McHardy | 20a6934 | 2013-10-11 12:06:22 +0200 | [diff] [blame] | 224 | |
| 225 | /** |
| 226 | * struct nft_set_binding - nf_tables set binding |
| 227 | * |
| 228 | * @list: set bindings list node |
| 229 | * @chain: chain containing the rule bound to the set |
| 230 | * |
| 231 | * A set binding contains all information necessary for validation |
| 232 | * of new elements added to a bound set. |
| 233 | */ |
| 234 | struct nft_set_binding { |
| 235 | struct list_head list; |
| 236 | const struct nft_chain *chain; |
| 237 | }; |
| 238 | |
Joe Perches | 5eccdfa | 2013-10-19 22:05:31 -0700 | [diff] [blame] | 239 | int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set, |
| 240 | struct nft_set_binding *binding); |
| 241 | void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set, |
| 242 | struct nft_set_binding *binding); |
Patrick McHardy | 20a6934 | 2013-10-11 12:06:22 +0200 | [diff] [blame] | 243 | |
Patrick McHardy | ef1f7df | 2013-10-10 11:41:20 +0200 | [diff] [blame] | 244 | |
Patrick McHardy | 20a6934 | 2013-10-11 12:06:22 +0200 | [diff] [blame] | 245 | /** |
Patrick McHardy | ef1f7df | 2013-10-10 11:41:20 +0200 | [diff] [blame] | 246 | * struct nft_expr_type - nf_tables expression type |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 247 | * |
Patrick McHardy | ef1f7df | 2013-10-10 11:41:20 +0200 | [diff] [blame] | 248 | * @select_ops: function to select nft_expr_ops |
| 249 | * @ops: default ops, used when no select_ops functions is present |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 250 | * @list: used internally |
| 251 | * @name: Identifier |
| 252 | * @owner: module reference |
| 253 | * @policy: netlink attribute policy |
| 254 | * @maxattr: highest netlink attribute number |
Patrick McHardy | 64d4680 | 2014-02-05 15:03:37 +0000 | [diff] [blame] | 255 | * @family: address family for AF-specific types |
Patrick McHardy | ef1f7df | 2013-10-10 11:41:20 +0200 | [diff] [blame] | 256 | */ |
| 257 | struct nft_expr_type { |
Pablo Neira Ayuso | 0ca743a | 2013-10-14 00:06:06 +0200 | [diff] [blame] | 258 | const struct nft_expr_ops *(*select_ops)(const struct nft_ctx *, |
| 259 | const struct nlattr * const tb[]); |
Patrick McHardy | ef1f7df | 2013-10-10 11:41:20 +0200 | [diff] [blame] | 260 | const struct nft_expr_ops *ops; |
| 261 | struct list_head list; |
| 262 | const char *name; |
| 263 | struct module *owner; |
| 264 | const struct nla_policy *policy; |
| 265 | unsigned int maxattr; |
Patrick McHardy | 64d4680 | 2014-02-05 15:03:37 +0000 | [diff] [blame] | 266 | u8 family; |
Patrick McHardy | ef1f7df | 2013-10-10 11:41:20 +0200 | [diff] [blame] | 267 | }; |
| 268 | |
| 269 | /** |
| 270 | * struct nft_expr_ops - nf_tables expression operations |
| 271 | * |
| 272 | * @eval: Expression evaluation function |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 273 | * @size: full expression size, including private data size |
Patrick McHardy | ef1f7df | 2013-10-10 11:41:20 +0200 | [diff] [blame] | 274 | * @init: initialization function |
| 275 | * @destroy: destruction function |
| 276 | * @dump: function to dump parameters |
| 277 | * @type: expression type |
Pablo Neira Ayuso | 0ca743a | 2013-10-14 00:06:06 +0200 | [diff] [blame] | 278 | * @validate: validate expression, called during loop detection |
| 279 | * @data: extra data to attach to this expression operation |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 280 | */ |
| 281 | struct nft_expr; |
| 282 | struct nft_expr_ops { |
| 283 | void (*eval)(const struct nft_expr *expr, |
| 284 | struct nft_data data[NFT_REG_MAX + 1], |
| 285 | const struct nft_pktinfo *pkt); |
Patrick McHardy | ef1f7df | 2013-10-10 11:41:20 +0200 | [diff] [blame] | 286 | unsigned int size; |
| 287 | |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 288 | int (*init)(const struct nft_ctx *ctx, |
| 289 | const struct nft_expr *expr, |
| 290 | const struct nlattr * const tb[]); |
| 291 | void (*destroy)(const struct nft_expr *expr); |
| 292 | int (*dump)(struct sk_buff *skb, |
| 293 | const struct nft_expr *expr); |
Pablo Neira Ayuso | 0ca743a | 2013-10-14 00:06:06 +0200 | [diff] [blame] | 294 | int (*validate)(const struct nft_ctx *ctx, |
| 295 | const struct nft_expr *expr, |
| 296 | const struct nft_data **data); |
Patrick McHardy | ef1f7df | 2013-10-10 11:41:20 +0200 | [diff] [blame] | 297 | const struct nft_expr_type *type; |
Pablo Neira Ayuso | 0ca743a | 2013-10-14 00:06:06 +0200 | [diff] [blame] | 298 | void *data; |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 299 | }; |
| 300 | |
Patrick McHardy | ef1f7df | 2013-10-10 11:41:20 +0200 | [diff] [blame] | 301 | #define NFT_EXPR_MAXATTR 16 |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 302 | #define NFT_EXPR_SIZE(size) (sizeof(struct nft_expr) + \ |
| 303 | ALIGN(size, __alignof__(struct nft_expr))) |
| 304 | |
| 305 | /** |
| 306 | * struct nft_expr - nf_tables expression |
| 307 | * |
| 308 | * @ops: expression ops |
| 309 | * @data: expression private data |
| 310 | */ |
| 311 | struct nft_expr { |
| 312 | const struct nft_expr_ops *ops; |
| 313 | unsigned char data[]; |
| 314 | }; |
| 315 | |
| 316 | static inline void *nft_expr_priv(const struct nft_expr *expr) |
| 317 | { |
| 318 | return (void *)expr->data; |
| 319 | } |
| 320 | |
| 321 | /** |
| 322 | * struct nft_rule - nf_tables rule |
| 323 | * |
| 324 | * @list: used internally |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 325 | * @handle: rule handle |
Pablo Neira Ayuso | 0628b12 | 2013-10-14 11:05:33 +0200 | [diff] [blame] | 326 | * @genmask: generation mask |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 327 | * @dlen: length of expression data |
| 328 | * @data: expression data |
| 329 | */ |
| 330 | struct nft_rule { |
| 331 | struct list_head list; |
Pablo Neira Ayuso | 0628b12 | 2013-10-14 11:05:33 +0200 | [diff] [blame] | 332 | u64 handle:46, |
| 333 | genmask:2, |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 334 | dlen:16; |
| 335 | unsigned char data[] |
| 336 | __attribute__((aligned(__alignof__(struct nft_expr)))); |
| 337 | }; |
| 338 | |
Pablo Neira Ayuso | 0628b12 | 2013-10-14 11:05:33 +0200 | [diff] [blame] | 339 | /** |
| 340 | * struct nft_rule_trans - nf_tables rule update in transaction |
| 341 | * |
| 342 | * @list: used internally |
| 343 | * @rule: rule that needs to be updated |
| 344 | * @chain: chain that this rule belongs to |
| 345 | * @table: table for which this chain applies |
| 346 | * @nlh: netlink header of the message that contain this update |
| 347 | * @family: family expressesed as AF_* |
| 348 | */ |
| 349 | struct nft_rule_trans { |
| 350 | struct list_head list; |
| 351 | struct nft_rule *rule; |
| 352 | const struct nft_chain *chain; |
| 353 | const struct nft_table *table; |
| 354 | const struct nlmsghdr *nlh; |
| 355 | u8 family; |
| 356 | }; |
| 357 | |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 358 | static inline struct nft_expr *nft_expr_first(const struct nft_rule *rule) |
| 359 | { |
| 360 | return (struct nft_expr *)&rule->data[0]; |
| 361 | } |
| 362 | |
| 363 | static inline struct nft_expr *nft_expr_next(const struct nft_expr *expr) |
| 364 | { |
| 365 | return ((void *)expr) + expr->ops->size; |
| 366 | } |
| 367 | |
| 368 | static inline struct nft_expr *nft_expr_last(const struct nft_rule *rule) |
| 369 | { |
| 370 | return (struct nft_expr *)&rule->data[rule->dlen]; |
| 371 | } |
| 372 | |
| 373 | /* |
| 374 | * The last pointer isn't really necessary, but the compiler isn't able to |
| 375 | * determine that the result of nft_expr_last() is always the same since it |
| 376 | * can't assume that the dlen value wasn't changed within calls in the loop. |
| 377 | */ |
| 378 | #define nft_rule_for_each_expr(expr, last, rule) \ |
| 379 | for ((expr) = nft_expr_first(rule), (last) = nft_expr_last(rule); \ |
| 380 | (expr) != (last); \ |
| 381 | (expr) = nft_expr_next(expr)) |
| 382 | |
| 383 | enum nft_chain_flags { |
| 384 | NFT_BASE_CHAIN = 0x1, |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 385 | }; |
| 386 | |
| 387 | /** |
| 388 | * struct nft_chain - nf_tables chain |
| 389 | * |
| 390 | * @rules: list of rules in the chain |
| 391 | * @list: used internally |
Pablo Neira Ayuso | 0628b12 | 2013-10-14 11:05:33 +0200 | [diff] [blame] | 392 | * @net: net namespace that this chain belongs to |
Pablo Neira Ayuso | b5bc89b | 2013-10-10 16:49:19 +0200 | [diff] [blame] | 393 | * @table: table that this chain belongs to |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 394 | * @handle: chain handle |
| 395 | * @flags: bitmask of enum nft_chain_flags |
| 396 | * @use: number of jump references to this chain |
| 397 | * @level: length of longest path to this chain |
| 398 | * @name: name of the chain |
| 399 | */ |
| 400 | struct nft_chain { |
| 401 | struct list_head rules; |
| 402 | struct list_head list; |
Pablo Neira Ayuso | 0628b12 | 2013-10-14 11:05:33 +0200 | [diff] [blame] | 403 | struct net *net; |
Pablo Neira Ayuso | b5bc89b | 2013-10-10 16:49:19 +0200 | [diff] [blame] | 404 | struct nft_table *table; |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 405 | u64 handle; |
| 406 | u8 flags; |
| 407 | u16 use; |
| 408 | u16 level; |
| 409 | char name[NFT_CHAIN_MAXNAMELEN]; |
| 410 | }; |
| 411 | |
Pablo Neira Ayuso | 9370761 | 2013-10-10 23:21:26 +0200 | [diff] [blame] | 412 | enum nft_chain_type { |
| 413 | NFT_CHAIN_T_DEFAULT = 0, |
| 414 | NFT_CHAIN_T_ROUTE, |
| 415 | NFT_CHAIN_T_NAT, |
| 416 | NFT_CHAIN_T_MAX |
| 417 | }; |
| 418 | |
Pablo Neira Ayuso | 0ca743a | 2013-10-14 00:06:06 +0200 | [diff] [blame] | 419 | struct nft_stats { |
| 420 | u64 bytes; |
| 421 | u64 pkts; |
| 422 | }; |
| 423 | |
Patrick McHardy | 115a60b | 2014-01-03 12:16:15 +0000 | [diff] [blame] | 424 | #define NFT_HOOK_OPS_MAX 2 |
| 425 | |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 426 | /** |
| 427 | * struct nft_base_chain - nf_tables base chain |
| 428 | * |
| 429 | * @ops: netfilter hook ops |
Pablo Neira Ayuso | 9370761 | 2013-10-10 23:21:26 +0200 | [diff] [blame] | 430 | * @type: chain type |
Pablo Neira Ayuso | 0ca743a | 2013-10-14 00:06:06 +0200 | [diff] [blame] | 431 | * @policy: default policy |
| 432 | * @stats: per-cpu chain stats |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 433 | * @chain: the chain |
| 434 | */ |
| 435 | struct nft_base_chain { |
Patrick McHardy | 115a60b | 2014-01-03 12:16:15 +0000 | [diff] [blame] | 436 | struct nf_hook_ops ops[NFT_HOOK_OPS_MAX]; |
Patrick McHardy | 2a37d75 | 2014-01-09 18:42:37 +0000 | [diff] [blame] | 437 | const struct nf_chain_type *type; |
Pablo Neira Ayuso | 0ca743a | 2013-10-14 00:06:06 +0200 | [diff] [blame] | 438 | u8 policy; |
| 439 | struct nft_stats __percpu *stats; |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 440 | struct nft_chain chain; |
| 441 | }; |
| 442 | |
| 443 | static inline struct nft_base_chain *nft_base_chain(const struct nft_chain *chain) |
| 444 | { |
| 445 | return container_of(chain, struct nft_base_chain, chain); |
| 446 | } |
| 447 | |
Patrick McHardy | 3876d22 | 2014-01-09 18:42:43 +0000 | [diff] [blame] | 448 | unsigned int nft_do_chain(struct nft_pktinfo *pkt, |
| 449 | const struct nf_hook_ops *ops); |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 450 | |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 451 | /** |
| 452 | * struct nft_table - nf_tables table |
| 453 | * |
| 454 | * @list: used internally |
| 455 | * @chains: chains in the table |
| 456 | * @sets: sets in the table |
| 457 | * @hgenerator: handle generator state |
| 458 | * @use: number of chain references to this table |
| 459 | * @flags: table flag (see enum nft_table_flags) |
| 460 | * @name: name of the table |
| 461 | */ |
| 462 | struct nft_table { |
| 463 | struct list_head list; |
| 464 | struct list_head chains; |
| 465 | struct list_head sets; |
| 466 | u64 hgenerator; |
| 467 | u32 use; |
| 468 | u16 flags; |
| 469 | char name[]; |
| 470 | }; |
| 471 | |
| 472 | /** |
| 473 | * struct nft_af_info - nf_tables address family info |
| 474 | * |
| 475 | * @list: used internally |
| 476 | * @family: address family |
| 477 | * @nhooks: number of hooks in this family |
| 478 | * @owner: module owner |
| 479 | * @tables: used internally |
Patrick McHardy | 115a60b | 2014-01-03 12:16:15 +0000 | [diff] [blame] | 480 | * @nops: number of hook ops in this family |
| 481 | * @hook_ops_init: initialization function for chain hook ops |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 482 | * @hooks: hookfn overrides for packet validation |
| 483 | */ |
| 484 | struct nft_af_info { |
| 485 | struct list_head list; |
| 486 | int family; |
| 487 | unsigned int nhooks; |
| 488 | struct module *owner; |
| 489 | struct list_head tables; |
Patrick McHardy | 115a60b | 2014-01-03 12:16:15 +0000 | [diff] [blame] | 490 | unsigned int nops; |
| 491 | void (*hook_ops_init)(struct nf_hook_ops *, |
| 492 | unsigned int); |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 493 | nf_hookfn *hooks[NF_MAX_HOOKS]; |
| 494 | }; |
| 495 | |
Joe Perches | 5eccdfa | 2013-10-19 22:05:31 -0700 | [diff] [blame] | 496 | int nft_register_afinfo(struct net *, struct nft_af_info *); |
| 497 | void nft_unregister_afinfo(struct nft_af_info *); |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 498 | |
Patrick McHardy | fa2c1de | 2014-01-09 18:42:38 +0000 | [diff] [blame] | 499 | /** |
| 500 | * struct nf_chain_type - nf_tables chain type info |
| 501 | * |
| 502 | * @name: name of the type |
| 503 | * @type: numeric identifier |
| 504 | * @family: address family |
| 505 | * @owner: module owner |
| 506 | * @hook_mask: mask of valid hooks |
| 507 | * @hooks: hookfn overrides |
| 508 | */ |
Pablo Neira Ayuso | 9370761 | 2013-10-10 23:21:26 +0200 | [diff] [blame] | 509 | struct nf_chain_type { |
Patrick McHardy | fa2c1de | 2014-01-09 18:42:38 +0000 | [diff] [blame] | 510 | const char *name; |
| 511 | enum nft_chain_type type; |
| 512 | int family; |
| 513 | struct module *owner; |
| 514 | unsigned int hook_mask; |
| 515 | nf_hookfn *hooks[NF_MAX_HOOKS]; |
Pablo Neira Ayuso | 9370761 | 2013-10-10 23:21:26 +0200 | [diff] [blame] | 516 | }; |
| 517 | |
Patrick McHardy | 2a37d75 | 2014-01-09 18:42:37 +0000 | [diff] [blame] | 518 | int nft_register_chain_type(const struct nf_chain_type *); |
| 519 | void nft_unregister_chain_type(const struct nf_chain_type *); |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 520 | |
Joe Perches | 5eccdfa | 2013-10-19 22:05:31 -0700 | [diff] [blame] | 521 | int nft_register_expr(struct nft_expr_type *); |
| 522 | void nft_unregister_expr(struct nft_expr_type *); |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 523 | |
| 524 | #define MODULE_ALIAS_NFT_FAMILY(family) \ |
| 525 | MODULE_ALIAS("nft-afinfo-" __stringify(family)) |
| 526 | |
Pablo Neira Ayuso | 9370761 | 2013-10-10 23:21:26 +0200 | [diff] [blame] | 527 | #define MODULE_ALIAS_NFT_CHAIN(family, name) \ |
| 528 | MODULE_ALIAS("nft-chain-" __stringify(family) "-" name) |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 529 | |
Patrick McHardy | 64d4680 | 2014-02-05 15:03:37 +0000 | [diff] [blame] | 530 | #define MODULE_ALIAS_NFT_AF_EXPR(family, name) \ |
| 531 | MODULE_ALIAS("nft-expr-" __stringify(family) "-" name) |
| 532 | |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 533 | #define MODULE_ALIAS_NFT_EXPR(name) \ |
| 534 | MODULE_ALIAS("nft-expr-" name) |
| 535 | |
Patrick McHardy | 20a6934 | 2013-10-11 12:06:22 +0200 | [diff] [blame] | 536 | #define MODULE_ALIAS_NFT_SET() \ |
| 537 | MODULE_ALIAS("nft-set") |
| 538 | |
Patrick McHardy | 9651851 | 2013-10-14 11:00:02 +0200 | [diff] [blame] | 539 | #endif /* _NET_NF_TABLES_H */ |