1/* SPDX-License-Identifier: GPL-2.0 */
2#ifndef _X_TABLES_H
3#define _X_TABLES_H
4
5
6#include <linux/netdevice.h>
7#include <linux/static_key.h>
8#include <linux/netfilter.h>
9#include <uapi/linux/netfilter/x_tables.h>
10
11/* Test a struct->invflags and a boolean for inequality */
12#define NF_INVF(ptr, flag, boolean) \
13 ((boolean) ^ !!((ptr)->invflags & (flag)))
14
15/**
16 * struct xt_action_param - parameters for matches/targets
17 *
18 * @match: the match extension
19 * @target: the target extension
20 * @matchinfo: per-match data
21 * @targetinfo: per-target data
22 * @state: pointer to hook state this packet came from
23 * @fragoff: packet is a fragment, this is the data offset
24 * @thoff: position of transport header relative to skb->data
25 *
26 * Fields written to by extensions:
27 *
28 * @hotdrop: drop packet if we had inspection problems
29 */
30struct xt_action_param {
31 union {
32 const struct xt_match *match;
33 const struct xt_target *target;
34 };
35 union {
36 const void *matchinfo, *targinfo;
37 };
38 const struct nf_hook_state *state;
39 unsigned int thoff;
40 u16 fragoff;
41 bool hotdrop;
42};
43
44static inline struct net *xt_net(const struct xt_action_param *par)
45{
46 return par->state->net;
47}
48
49static inline struct net_device *xt_in(const struct xt_action_param *par)
50{
51 return par->state->in;
52}
53
54static inline struct net_device *xt_out(const struct xt_action_param *par)
55{
56 return par->state->out;
57}
58
59static inline unsigned int xt_hooknum(const struct xt_action_param *par)
60{
61 return par->state->hook;
62}
63
64static inline u_int8_t xt_family(const struct xt_action_param *par)
65{
66 return par->state->pf;
67}
68
69/**
70 * struct xt_mtchk_param - parameters for match extensions'
71 * checkentry functions
72 *
73 * @net: network namespace through which the check was invoked
74 * @table: table the rule is tried to be inserted into
75 * @entryinfo: the family-specific rule data
76 * (struct ipt_ip, ip6t_ip, arpt_arp or (note) ebt_entry)
77 * @match: struct xt_match through which this function was invoked
78 * @matchinfo: per-match data
79 * @hook_mask: via which hooks the new rule is reachable
80 * Other fields as above.
81 */
82struct xt_mtchk_param {
83 struct net *net;
84 const char *table;
85 const void *entryinfo;
86 const struct xt_match *match;
87 void *matchinfo;
88 unsigned int hook_mask;
89 u_int8_t family;
90 bool nft_compat;
91};
92
93/**
94 * struct xt_mdtor_param - match destructor parameters
95 * Fields as above.
96 */
97struct xt_mtdtor_param {
98 struct net *net;
99 const struct xt_match *match;
100 void *matchinfo;
101 u_int8_t family;
102};
103
104/**
105 * struct xt_tgchk_param - parameters for target extensions'
106 * checkentry functions
107 *
108 * @entryinfo: the family-specific rule data
109 * (struct ipt_entry, ip6t_entry, arpt_entry, ebt_entry)
110 *
111 * Other fields see above.
112 */
113struct xt_tgchk_param {
114 struct net *net;
115 const char *table;
116 const void *entryinfo;
117 const struct xt_target *target;
118 void *targinfo;
119 unsigned int hook_mask;
120 u_int8_t family;
121 bool nft_compat;
122};
123
124/* Target destructor parameters */
125struct xt_tgdtor_param {
126 struct net *net;
127 const struct xt_target *target;
128 void *targinfo;
129 u_int8_t family;
130};
131
132struct xt_match {
133 struct list_head list;
134
135 const char name[XT_EXTENSION_MAXNAMELEN];
136 u_int8_t revision;
137
138 /* Return true or false: return FALSE and set *hotdrop = 1 to
139 force immediate packet drop. */
140 /* Arguments changed since 2.6.9, as this must now handle
141 non-linear skb, using skb_header_pointer and
142 skb_ip_make_writable. */
143 bool (*match)(const struct sk_buff *skb,
144 struct xt_action_param *);
145
146 /* Called when user tries to insert an entry of this type. */
147 int (*checkentry)(const struct xt_mtchk_param *);
148
149 /* Called when entry of this type deleted. */
150 void (*destroy)(const struct xt_mtdtor_param *);
151#ifdef CONFIG_NETFILTER_XTABLES_COMPAT
152 /* Called when userspace align differs from kernel space one */
153 void (*compat_from_user)(void *dst, const void *src);
154 int (*compat_to_user)(void __user *dst, const void *src);
155#endif
156 /* Set this to THIS_MODULE if you are a module, otherwise NULL */
157 struct module *me;
158
159 const char *table;
160 unsigned int matchsize;
161 unsigned int usersize;
162#ifdef CONFIG_NETFILTER_XTABLES_COMPAT
163 unsigned int compatsize;
164#endif
165 unsigned int hooks;
166 unsigned short proto;
167
168 unsigned short family;
169};
170
171/* Registration hooks for targets. */
172struct xt_target {
173 struct list_head list;
174
175 const char name[XT_EXTENSION_MAXNAMELEN];
176 u_int8_t revision;
177
178 /* Returns verdict. Argument order changed since 2.6.9, as this
179 must now handle non-linear skbs, using skb_copy_bits and
180 skb_ip_make_writable. */
181 unsigned int (*target)(struct sk_buff *skb,
182 const struct xt_action_param *);
183
184 /* Called when user tries to insert an entry of this type:
185 hook_mask is a bitmask of hooks from which it can be
186 called. */
187 /* Should return 0 on success or an error code otherwise (-Exxxx). */
188 int (*checkentry)(const struct xt_tgchk_param *);
189
190 /* Called when entry of this type deleted. */
191 void (*destroy)(const struct xt_tgdtor_param *);
192#ifdef CONFIG_NETFILTER_XTABLES_COMPAT
193 /* Called when userspace align differs from kernel space one */
194 void (*compat_from_user)(void *dst, const void *src);
195 int (*compat_to_user)(void __user *dst, const void *src);
196#endif
197 /* Set this to THIS_MODULE if you are a module, otherwise NULL */
198 struct module *me;
199
200 const char *table;
201 unsigned int targetsize;
202 unsigned int usersize;
203#ifdef CONFIG_NETFILTER_XTABLES_COMPAT
204 unsigned int compatsize;
205#endif
206 unsigned int hooks;
207 unsigned short proto;
208
209 unsigned short family;
210};
211
212/* Furniture shopping... */
213struct xt_table {
214 struct list_head list;
215
216 /* What hooks you will enter on */
217 unsigned int valid_hooks;
218
219 /* Man behind the curtain... */
220 struct xt_table_info *private;
221
222 /* hook ops that register the table with the netfilter core */
223 struct nf_hook_ops *ops;
224
225 /* Set this to THIS_MODULE if you are a module, otherwise NULL */
226 struct module *me;
227
228 u_int8_t af; /* address/protocol family */
229 int priority; /* hook order */
230
231 /* A unique name... */
232 const char name[XT_TABLE_MAXNAMELEN];
233};
234
235#include <linux/netfilter_ipv4.h>
236
237/* The table itself */
238struct xt_table_info {
239 /* Size per table */
240 unsigned int size;
241 /* Number of entries: FIXME. --RR */
242 unsigned int number;
243 /* Initial number of entries. Needed for module usage count */
244 unsigned int initial_entries;
245
246 /* Entry points and underflows */
247 unsigned int hook_entry[NF_INET_NUMHOOKS];
248 unsigned int underflow[NF_INET_NUMHOOKS];
249
250 /*
251 * Number of user chains. Since tables cannot have loops, at most
252 * @stacksize jumps (number of user chains) can possibly be made.
253 */
254 unsigned int stacksize;
255 void ***jumpstack;
256
257 unsigned char entries[] __aligned(8);
258};
259
260int xt_register_target(struct xt_target *target);
261void xt_unregister_target(struct xt_target *target);
262int xt_register_targets(struct xt_target *target, unsigned int n);
263void xt_unregister_targets(struct xt_target *target, unsigned int n);
264
265int xt_register_match(struct xt_match *target);
266void xt_unregister_match(struct xt_match *target);
267int xt_register_matches(struct xt_match *match, unsigned int n);
268void xt_unregister_matches(struct xt_match *match, unsigned int n);
269
270int xt_check_entry_offsets(const void *base, const char *elems,
271 unsigned int target_offset,
272 unsigned int next_offset);
273
274int xt_check_table_hooks(const struct xt_table_info *info, unsigned int valid_hooks);
275
276unsigned int *xt_alloc_entry_offsets(unsigned int size);
277bool xt_find_jump_offset(const unsigned int *offsets,
278 unsigned int target, unsigned int size);
279
280int xt_check_proc_name(const char *name, unsigned int size);
281
282int xt_check_match(struct xt_mtchk_param *, unsigned int size, u16 proto,
283 bool inv_proto);
284int xt_check_target(struct xt_tgchk_param *, unsigned int size, u16 proto,
285 bool inv_proto);
286
287int xt_match_to_user(const struct xt_entry_match *m,
288 struct xt_entry_match __user *u);
289int xt_target_to_user(const struct xt_entry_target *t,
290 struct xt_entry_target __user *u);
291int xt_data_to_user(void __user *dst, const void *src,
292 int usersize, int size, int aligned_size);
293
294void *xt_copy_counters(sockptr_t arg, unsigned int len,
295 struct xt_counters_info *info);
296struct xt_counters *xt_counters_alloc(unsigned int counters);
297
298struct xt_table *xt_register_table(struct net *net,
299 const struct xt_table *table,
300 struct xt_table_info *bootstrap,
301 struct xt_table_info *newinfo);
302void *xt_unregister_table(struct xt_table *table);
303
304struct xt_table_info *xt_replace_table(struct xt_table *table,
305 unsigned int num_counters,
306 struct xt_table_info *newinfo,
307 int *error);
308
309struct xt_match *xt_find_match(u8 af, const char *name, u8 revision);
310struct xt_match *xt_request_find_match(u8 af, const char *name, u8 revision);
311struct xt_target *xt_request_find_target(u8 af, const char *name, u8 revision);
312int xt_find_revision(u8 af, const char *name, u8 revision, int target,
313 int *err);
314
315struct xt_table *xt_find_table(struct net *net, u8 af, const char *name);
316struct xt_table *xt_find_table_lock(struct net *net, u_int8_t af,
317 const char *name);
318struct xt_table *xt_request_find_table_lock(struct net *net, u_int8_t af,
319 const char *name);
320void xt_table_unlock(struct xt_table *t);
321
322int xt_proto_init(struct net *net, u_int8_t af);
323void xt_proto_fini(struct net *net, u_int8_t af);
324
325struct xt_table_info *xt_alloc_table_info(unsigned int size);
326void xt_free_table_info(struct xt_table_info *info);
327
328/**
329 * xt_recseq - recursive seqcount for netfilter use
330 *
331 * Packet processing changes the seqcount only if no recursion happened
332 * get_counters() can use read_seqcount_begin()/read_seqcount_retry(),
333 * because we use the normal seqcount convention :
334 * Low order bit set to 1 if a writer is active.
335 */
336DECLARE_PER_CPU(seqcount_t, xt_recseq);
337
338/* xt_tee_enabled - true if x_tables needs to handle reentrancy
339 *
340 * Enabled if current ip(6)tables ruleset has at least one -j TEE rule.
341 */
342extern struct static_key xt_tee_enabled;
343
344/**
345 * xt_write_recseq_begin - start of a write section
346 *
347 * Begin packet processing : all readers must wait the end
348 * 1) Must be called with preemption disabled
349 * 2) softirqs must be disabled too (or we should use this_cpu_add())
350 * Returns:
351 * 1 if no recursion on this cpu
352 * 0 if recursion detected
353 */
354static inline unsigned int xt_write_recseq_begin(void)
355{
356 unsigned int addend;
357
358 /*
359 * Low order bit of sequence is set if we already
360 * called xt_write_recseq_begin().
361 */
362 addend = (__this_cpu_read(xt_recseq.sequence) + 1) & 1;
363
364 /*
365 * This is kind of a write_seqcount_begin(), but addend is 0 or 1
366 * We dont check addend value to avoid a test and conditional jump,
367 * since addend is most likely 1
368 */
369 __this_cpu_add(xt_recseq.sequence, addend);
370 smp_mb();
371
372 return addend;
373}
374
375/**
376 * xt_write_recseq_end - end of a write section
377 * @addend: return value from previous xt_write_recseq_begin()
378 *
379 * End packet processing : all readers can proceed
380 * 1) Must be called with preemption disabled
381 * 2) softirqs must be disabled too (or we should use this_cpu_add())
382 */
383static inline void xt_write_recseq_end(unsigned int addend)
384{
385 /* this is kind of a write_seqcount_end(), but addend is 0 or 1 */
386 smp_wmb();
387 __this_cpu_add(xt_recseq.sequence, addend);
388}
389
390/*
391 * This helper is performance critical and must be inlined
392 */
393static inline unsigned long ifname_compare_aligned(const char *_a,
394 const char *_b,
395 const char *_mask)
396{
397 const unsigned long *a = (const unsigned long *)_a;
398 const unsigned long *b = (const unsigned long *)_b;
399 const unsigned long *mask = (const unsigned long *)_mask;
400 unsigned long ret;
401
402 ret = (a[0] ^ b[0]) & mask[0];
403 if (IFNAMSIZ > sizeof(unsigned long))
404 ret |= (a[1] ^ b[1]) & mask[1];
405 if (IFNAMSIZ > 2 * sizeof(unsigned long))
406 ret |= (a[2] ^ b[2]) & mask[2];
407 if (IFNAMSIZ > 3 * sizeof(unsigned long))
408 ret |= (a[3] ^ b[3]) & mask[3];
409 BUILD_BUG_ON(IFNAMSIZ > 4 * sizeof(unsigned long));
410 return ret;
411}
412
413struct xt_percpu_counter_alloc_state {
414 unsigned int off;
415 const char __percpu *mem;
416};
417
418bool xt_percpu_counter_alloc(struct xt_percpu_counter_alloc_state *state,
419 struct xt_counters *counter);
420void xt_percpu_counter_free(struct xt_counters *cnt);
421
422static inline struct xt_counters *
423xt_get_this_cpu_counter(struct xt_counters *cnt)
424{
425 if (nr_cpu_ids > 1)
426 return this_cpu_ptr((void __percpu *) (unsigned long) cnt->pcnt);
427
428 return cnt;
429}
430
431static inline struct xt_counters *
432xt_get_per_cpu_counter(struct xt_counters *cnt, unsigned int cpu)
433{
434 if (nr_cpu_ids > 1)
435 return per_cpu_ptr((void __percpu *) (unsigned long) cnt->pcnt, cpu);
436
437 return cnt;
438}
439
440struct nf_hook_ops *xt_hook_ops_alloc(const struct xt_table *, nf_hookfn *);
441
442int xt_register_template(const struct xt_table *t, int(*table_init)(struct net *net));
443void xt_unregister_template(const struct xt_table *t);
444
445#ifdef CONFIG_NETFILTER_XTABLES_COMPAT
446#include <net/compat.h>
447
448struct compat_xt_entry_match {
449 union {
450 struct {
451 u_int16_t match_size;
452 char name[XT_FUNCTION_MAXNAMELEN - 1];
453 u_int8_t revision;
454 } user;
455 struct {
456 u_int16_t match_size;
457 compat_uptr_t match;
458 } kernel;
459 u_int16_t match_size;
460 } u;
461 unsigned char data[];
462};
463
464struct compat_xt_entry_target {
465 union {
466 struct {
467 u_int16_t target_size;
468 char name[XT_FUNCTION_MAXNAMELEN - 1];
469 u_int8_t revision;
470 } user;
471 struct {
472 u_int16_t target_size;
473 compat_uptr_t target;
474 } kernel;
475 u_int16_t target_size;
476 } u;
477 unsigned char data[];
478};
479
480/* FIXME: this works only on 32 bit tasks
481 * need to change whole approach in order to calculate align as function of
482 * current task alignment */
483
484struct compat_xt_counters {
485 compat_u64 pcnt, bcnt; /* Packet and byte counters */
486};
487
488struct compat_xt_counters_info {
489 char name[XT_TABLE_MAXNAMELEN];
490 compat_uint_t num_counters;
491 struct compat_xt_counters counters[];
492};
493
494struct _compat_xt_align {
495 __u8 u8;
496 __u16 u16;
497 __u32 u32;
498 compat_u64 u64;
499};
500
501#define COMPAT_XT_ALIGN(s) __ALIGN_KERNEL((s), __alignof__(struct _compat_xt_align))
502
503void xt_compat_lock(u_int8_t af);
504void xt_compat_unlock(u_int8_t af);
505
506int xt_compat_add_offset(u_int8_t af, unsigned int offset, int delta);
507void xt_compat_flush_offsets(u_int8_t af);
508int xt_compat_init_offsets(u8 af, unsigned int number);
509int xt_compat_calc_jump(u_int8_t af, unsigned int offset);
510
511int xt_compat_match_offset(const struct xt_match *match);
512void xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr,
513 unsigned int *size);
514int xt_compat_match_to_user(const struct xt_entry_match *m,
515 void __user **dstptr, unsigned int *size);
516
517int xt_compat_target_offset(const struct xt_target *target);
518void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr,
519 unsigned int *size);
520int xt_compat_target_to_user(const struct xt_entry_target *t,
521 void __user **dstptr, unsigned int *size);
522int xt_compat_check_entry_offsets(const void *base, const char *elems,
523 unsigned int target_offset,
524 unsigned int next_offset);
525
526#endif /* CONFIG_NETFILTER_XTABLES_COMPAT */
527#endif /* _X_TABLES_H */
528