1 /* SPDX-License-Identifier: GPL-2.0 */
2 #ifndef __LINUX_NETFILTER_H
3 #define __LINUX_NETFILTER_H
4
5 #include <linux/init.h>
6 #include <linux/skbuff.h>
7 #include <linux/net.h>
8 #include <linux/if.h>
9 #include <linux/in.h>
10 #include <linux/in6.h>
11 #include <linux/wait.h>
12 #include <linux/list.h>
13 #include <linux/static_key.h>
14 #include <linux/netfilter_defs.h>
15 #include <linux/netdevice.h>
16 #include <linux/sockptr.h>
17 #include <linux/android_kabi.h>
18 #include <net/net_namespace.h>
19
NF_DROP_GETERR(int verdict)20 static inline int NF_DROP_GETERR(int verdict)
21 {
22 return -(verdict >> NF_VERDICT_QBITS);
23 }
24
nf_inet_addr_cmp(const union nf_inet_addr * a1,const union nf_inet_addr * a2)25 static inline int nf_inet_addr_cmp(const union nf_inet_addr *a1,
26 const union nf_inet_addr *a2)
27 {
28 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && BITS_PER_LONG == 64
29 const unsigned long *ul1 = (const unsigned long *)a1;
30 const unsigned long *ul2 = (const unsigned long *)a2;
31
32 return ((ul1[0] ^ ul2[0]) | (ul1[1] ^ ul2[1])) == 0UL;
33 #else
34 return a1->all[0] == a2->all[0] &&
35 a1->all[1] == a2->all[1] &&
36 a1->all[2] == a2->all[2] &&
37 a1->all[3] == a2->all[3];
38 #endif
39 }
40
nf_inet_addr_mask(const union nf_inet_addr * a1,union nf_inet_addr * result,const union nf_inet_addr * mask)41 static inline void nf_inet_addr_mask(const union nf_inet_addr *a1,
42 union nf_inet_addr *result,
43 const union nf_inet_addr *mask)
44 {
45 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && BITS_PER_LONG == 64
46 const unsigned long *ua = (const unsigned long *)a1;
47 unsigned long *ur = (unsigned long *)result;
48 const unsigned long *um = (const unsigned long *)mask;
49
50 ur[0] = ua[0] & um[0];
51 ur[1] = ua[1] & um[1];
52 #else
53 result->all[0] = a1->all[0] & mask->all[0];
54 result->all[1] = a1->all[1] & mask->all[1];
55 result->all[2] = a1->all[2] & mask->all[2];
56 result->all[3] = a1->all[3] & mask->all[3];
57 #endif
58 }
59
60 int netfilter_init(void);
61
62 struct sk_buff;
63
64 struct nf_hook_ops;
65
66 struct sock;
67
68 struct nf_hook_state {
69 u8 hook;
70 u8 pf;
71 struct net_device *in;
72 struct net_device *out;
73 struct sock *sk;
74 struct net *net;
75 int (*okfn)(struct net *, struct sock *, struct sk_buff *);
76 };
77
78 typedef unsigned int nf_hookfn(void *priv,
79 struct sk_buff *skb,
80 const struct nf_hook_state *state);
81 enum nf_hook_ops_type {
82 NF_HOOK_OP_UNDEFINED,
83 NF_HOOK_OP_NF_TABLES,
84 };
85
86 struct nf_hook_ops {
87 /* User fills in from here down. */
88 nf_hookfn *hook;
89 struct net_device *dev;
90 void *priv;
91 u8 pf;
92 enum nf_hook_ops_type hook_ops_type:8;
93 unsigned int hooknum;
94 /* Hooks are ordered in ascending priority. */
95 int priority;
96 };
97
98 struct nf_hook_entry {
99 nf_hookfn *hook;
100 void *priv;
101 };
102
103 struct nf_hook_entries_rcu_head {
104 struct rcu_head head;
105 void *allocation;
106 };
107
108 struct nf_hook_entries {
109 u16 num_hook_entries;
110 /* padding */
111 struct nf_hook_entry hooks[];
112
113 /* trailer: pointers to original orig_ops of each hook,
114 * followed by rcu_head and scratch space used for freeing
115 * the structure via call_rcu.
116 *
117 * This is not part of struct nf_hook_entry since its only
118 * needed in slow path (hook register/unregister):
119 * const struct nf_hook_ops *orig_ops[]
120 *
121 * For the same reason, we store this at end -- its
122 * only needed when a hook is deleted, not during
123 * packet path processing:
124 * struct nf_hook_entries_rcu_head head
125 */
126 };
127
128 #ifdef CONFIG_NETFILTER
nf_hook_entries_get_hook_ops(const struct nf_hook_entries * e)129 static inline struct nf_hook_ops **nf_hook_entries_get_hook_ops(const struct nf_hook_entries *e)
130 {
131 unsigned int n = e->num_hook_entries;
132 const void *hook_end;
133
134 hook_end = &e->hooks[n]; /* this is *past* ->hooks[]! */
135
136 return (struct nf_hook_ops **)hook_end;
137 }
138
139 static inline int
nf_hook_entry_hookfn(const struct nf_hook_entry * entry,struct sk_buff * skb,struct nf_hook_state * state)140 nf_hook_entry_hookfn(const struct nf_hook_entry *entry, struct sk_buff *skb,
141 struct nf_hook_state *state)
142 {
143 return entry->hook(entry->priv, skb, state);
144 }
145
nf_hook_state_init(struct nf_hook_state * p,unsigned int hook,u_int8_t pf,struct net_device * indev,struct net_device * outdev,struct sock * sk,struct net * net,int (* okfn)(struct net *,struct sock *,struct sk_buff *))146 static inline void nf_hook_state_init(struct nf_hook_state *p,
147 unsigned int hook,
148 u_int8_t pf,
149 struct net_device *indev,
150 struct net_device *outdev,
151 struct sock *sk,
152 struct net *net,
153 int (*okfn)(struct net *, struct sock *, struct sk_buff *))
154 {
155 p->hook = hook;
156 p->pf = pf;
157 p->in = indev;
158 p->out = outdev;
159 p->sk = sk;
160 p->net = net;
161 p->okfn = okfn;
162 }
163
164
165
166 struct nf_sockopt_ops {
167 struct list_head list;
168
169 u_int8_t pf;
170
171 /* Non-inclusive ranges: use 0/0/NULL to never get called. */
172 int set_optmin;
173 int set_optmax;
174 int (*set)(struct sock *sk, int optval, sockptr_t arg,
175 unsigned int len);
176 int get_optmin;
177 int get_optmax;
178 int (*get)(struct sock *sk, int optval, void __user *user, int *len);
179 /* Use the module struct to lock set/get code in place */
180 struct module *owner;
181
182 ANDROID_KABI_RESERVE(1);
183 };
184
185 /* Function to register/unregister hook points. */
186 int nf_register_net_hook(struct net *net, const struct nf_hook_ops *ops);
187 void nf_unregister_net_hook(struct net *net, const struct nf_hook_ops *ops);
188 int nf_register_net_hooks(struct net *net, const struct nf_hook_ops *reg,
189 unsigned int n);
190 void nf_unregister_net_hooks(struct net *net, const struct nf_hook_ops *reg,
191 unsigned int n);
192
193 /* Functions to register get/setsockopt ranges (non-inclusive). You
194 need to check permissions yourself! */
195 int nf_register_sockopt(struct nf_sockopt_ops *reg);
196 void nf_unregister_sockopt(struct nf_sockopt_ops *reg);
197
198 #ifdef CONFIG_JUMP_LABEL
199 extern struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
200 #endif
201
202 int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state,
203 const struct nf_hook_entries *e, unsigned int i);
204
205 void nf_hook_slow_list(struct list_head *head, struct nf_hook_state *state,
206 const struct nf_hook_entries *e);
207 /**
208 * nf_hook - call a netfilter hook
209 *
210 * Returns 1 if the hook has allowed the packet to pass. The function
211 * okfn must be invoked by the caller in this case. Any other return
212 * value indicates the packet has been consumed by the hook.
213 */
nf_hook(u_int8_t pf,unsigned int hook,struct net * net,struct sock * sk,struct sk_buff * skb,struct net_device * indev,struct net_device * outdev,int (* okfn)(struct net *,struct sock *,struct sk_buff *))214 static inline int nf_hook(u_int8_t pf, unsigned int hook, struct net *net,
215 struct sock *sk, struct sk_buff *skb,
216 struct net_device *indev, struct net_device *outdev,
217 int (*okfn)(struct net *, struct sock *, struct sk_buff *))
218 {
219 struct nf_hook_entries *hook_head = NULL;
220 int ret = 1;
221
222 #ifdef CONFIG_JUMP_LABEL
223 if (__builtin_constant_p(pf) &&
224 __builtin_constant_p(hook) &&
225 !static_key_false(&nf_hooks_needed[pf][hook]))
226 return 1;
227 #endif
228
229 rcu_read_lock();
230 switch (pf) {
231 case NFPROTO_IPV4:
232 hook_head = rcu_dereference(net->nf.hooks_ipv4[hook]);
233 break;
234 case NFPROTO_IPV6:
235 hook_head = rcu_dereference(net->nf.hooks_ipv6[hook]);
236 break;
237 case NFPROTO_ARP:
238 #ifdef CONFIG_NETFILTER_FAMILY_ARP
239 if (WARN_ON_ONCE(hook >= ARRAY_SIZE(net->nf.hooks_arp)))
240 break;
241 hook_head = rcu_dereference(net->nf.hooks_arp[hook]);
242 #endif
243 break;
244 case NFPROTO_BRIDGE:
245 #ifdef CONFIG_NETFILTER_FAMILY_BRIDGE
246 hook_head = rcu_dereference(get_nf_hooks_bridge(net)[hook]);
247 #endif
248 break;
249 default:
250 WARN_ON_ONCE(1);
251 break;
252 }
253
254 if (hook_head) {
255 struct nf_hook_state state;
256
257 nf_hook_state_init(&state, hook, pf, indev, outdev,
258 sk, net, okfn);
259
260 ret = nf_hook_slow(skb, &state, hook_head, 0);
261 }
262 rcu_read_unlock();
263
264 return ret;
265 }
266
267 /* Activate hook; either okfn or kfree_skb called, unless a hook
268 returns NF_STOLEN (in which case, it's up to the hook to deal with
269 the consequences).
270
271 Returns -ERRNO if packet dropped. Zero means queued, stolen or
272 accepted.
273 */
274
275 /* RR:
276 > I don't want nf_hook to return anything because people might forget
277 > about async and trust the return value to mean "packet was ok".
278
279 AK:
280 Just document it clearly, then you can expect some sense from kernel
281 coders :)
282 */
283
284 static inline int
NF_HOOK_COND(uint8_t pf,unsigned int hook,struct net * net,struct sock * sk,struct sk_buff * skb,struct net_device * in,struct net_device * out,int (* okfn)(struct net *,struct sock *,struct sk_buff *),bool cond)285 NF_HOOK_COND(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk,
286 struct sk_buff *skb, struct net_device *in, struct net_device *out,
287 int (*okfn)(struct net *, struct sock *, struct sk_buff *),
288 bool cond)
289 {
290 int ret;
291
292 if (!cond ||
293 ((ret = nf_hook(pf, hook, net, sk, skb, in, out, okfn)) == 1))
294 ret = okfn(net, sk, skb);
295 return ret;
296 }
297
298 static inline int
NF_HOOK(uint8_t pf,unsigned int hook,struct net * net,struct sock * sk,struct sk_buff * skb,struct net_device * in,struct net_device * out,int (* okfn)(struct net *,struct sock *,struct sk_buff *))299 NF_HOOK(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk, struct sk_buff *skb,
300 struct net_device *in, struct net_device *out,
301 int (*okfn)(struct net *, struct sock *, struct sk_buff *))
302 {
303 int ret = nf_hook(pf, hook, net, sk, skb, in, out, okfn);
304 if (ret == 1)
305 ret = okfn(net, sk, skb);
306 return ret;
307 }
308
309 static inline void
NF_HOOK_LIST(uint8_t pf,unsigned int hook,struct net * net,struct sock * sk,struct list_head * head,struct net_device * in,struct net_device * out,int (* okfn)(struct net *,struct sock *,struct sk_buff *))310 NF_HOOK_LIST(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk,
311 struct list_head *head, struct net_device *in, struct net_device *out,
312 int (*okfn)(struct net *, struct sock *, struct sk_buff *))
313 {
314 struct nf_hook_entries *hook_head = NULL;
315
316 #ifdef CONFIG_JUMP_LABEL
317 if (__builtin_constant_p(pf) &&
318 __builtin_constant_p(hook) &&
319 !static_key_false(&nf_hooks_needed[pf][hook]))
320 return;
321 #endif
322
323 rcu_read_lock();
324 switch (pf) {
325 case NFPROTO_IPV4:
326 hook_head = rcu_dereference(net->nf.hooks_ipv4[hook]);
327 break;
328 case NFPROTO_IPV6:
329 hook_head = rcu_dereference(net->nf.hooks_ipv6[hook]);
330 break;
331 default:
332 WARN_ON_ONCE(1);
333 break;
334 }
335
336 if (hook_head) {
337 struct nf_hook_state state;
338
339 nf_hook_state_init(&state, hook, pf, in, out, sk, net, okfn);
340
341 nf_hook_slow_list(head, &state, hook_head);
342 }
343 rcu_read_unlock();
344 }
345
346 /* Call setsockopt() */
347 int nf_setsockopt(struct sock *sk, u_int8_t pf, int optval, sockptr_t opt,
348 unsigned int len);
349 int nf_getsockopt(struct sock *sk, u_int8_t pf, int optval, char __user *opt,
350 int *len);
351
352 struct flowi;
353 struct nf_queue_entry;
354
355 __sum16 nf_checksum(struct sk_buff *skb, unsigned int hook,
356 unsigned int dataoff, u_int8_t protocol,
357 unsigned short family);
358
359 __sum16 nf_checksum_partial(struct sk_buff *skb, unsigned int hook,
360 unsigned int dataoff, unsigned int len,
361 u_int8_t protocol, unsigned short family);
362 int nf_route(struct net *net, struct dst_entry **dst, struct flowi *fl,
363 bool strict, unsigned short family);
364 int nf_reroute(struct sk_buff *skb, struct nf_queue_entry *entry);
365
366 #include <net/flow.h>
367
368 struct nf_conn;
369 enum nf_nat_manip_type;
370 struct nlattr;
371 enum ip_conntrack_dir;
372
373 struct nf_nat_hook {
374 int (*parse_nat_setup)(struct nf_conn *ct, enum nf_nat_manip_type manip,
375 const struct nlattr *attr);
376 void (*decode_session)(struct sk_buff *skb, struct flowi *fl);
377 unsigned int (*manip_pkt)(struct sk_buff *skb, struct nf_conn *ct,
378 enum nf_nat_manip_type mtype,
379 enum ip_conntrack_dir dir);
380 void (*remove_nat_bysrc)(struct nf_conn *ct);
381
382 ANDROID_KABI_RESERVE(1);
383 };
384
385 extern const struct nf_nat_hook __rcu *nf_nat_hook;
386
387 static inline void
nf_nat_decode_session(struct sk_buff * skb,struct flowi * fl,u_int8_t family)388 nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family)
389 {
390 #if IS_ENABLED(CONFIG_NF_NAT)
391 const struct nf_nat_hook *nat_hook;
392
393 rcu_read_lock();
394 nat_hook = rcu_dereference(nf_nat_hook);
395 if (nat_hook && nat_hook->decode_session)
396 nat_hook->decode_session(skb, fl);
397 rcu_read_unlock();
398 #endif
399 }
400
401 #else /* !CONFIG_NETFILTER */
402 static inline int
NF_HOOK_COND(uint8_t pf,unsigned int hook,struct net * net,struct sock * sk,struct sk_buff * skb,struct net_device * in,struct net_device * out,int (* okfn)(struct net *,struct sock *,struct sk_buff *),bool cond)403 NF_HOOK_COND(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk,
404 struct sk_buff *skb, struct net_device *in, struct net_device *out,
405 int (*okfn)(struct net *, struct sock *, struct sk_buff *),
406 bool cond)
407 {
408 return okfn(net, sk, skb);
409 }
410
411 static inline int
NF_HOOK(uint8_t pf,unsigned int hook,struct net * net,struct sock * sk,struct sk_buff * skb,struct net_device * in,struct net_device * out,int (* okfn)(struct net *,struct sock *,struct sk_buff *))412 NF_HOOK(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk,
413 struct sk_buff *skb, struct net_device *in, struct net_device *out,
414 int (*okfn)(struct net *, struct sock *, struct sk_buff *))
415 {
416 return okfn(net, sk, skb);
417 }
418
419 static inline void
NF_HOOK_LIST(uint8_t pf,unsigned int hook,struct net * net,struct sock * sk,struct list_head * head,struct net_device * in,struct net_device * out,int (* okfn)(struct net *,struct sock *,struct sk_buff *))420 NF_HOOK_LIST(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk,
421 struct list_head *head, struct net_device *in, struct net_device *out,
422 int (*okfn)(struct net *, struct sock *, struct sk_buff *))
423 {
424 /* nothing to do */
425 }
426
nf_hook(u_int8_t pf,unsigned int hook,struct net * net,struct sock * sk,struct sk_buff * skb,struct net_device * indev,struct net_device * outdev,int (* okfn)(struct net *,struct sock *,struct sk_buff *))427 static inline int nf_hook(u_int8_t pf, unsigned int hook, struct net *net,
428 struct sock *sk, struct sk_buff *skb,
429 struct net_device *indev, struct net_device *outdev,
430 int (*okfn)(struct net *, struct sock *, struct sk_buff *))
431 {
432 return 1;
433 }
434 struct flowi;
435 static inline void
nf_nat_decode_session(struct sk_buff * skb,struct flowi * fl,u_int8_t family)436 nf_nat_decode_session(struct sk_buff *skb, struct flowi *fl, u_int8_t family)
437 {
438 }
439 #endif /*CONFIG_NETFILTER*/
440
441 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
442 #include <linux/netfilter/nf_conntrack_zones_common.h>
443
444 void nf_ct_attach(struct sk_buff *, const struct sk_buff *);
445 struct nf_conntrack_tuple;
446 bool nf_ct_get_tuple_skb(struct nf_conntrack_tuple *dst_tuple,
447 const struct sk_buff *skb);
448 #else
nf_ct_attach(struct sk_buff * new,struct sk_buff * skb)449 static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {}
450 struct nf_conntrack_tuple;
nf_ct_get_tuple_skb(struct nf_conntrack_tuple * dst_tuple,const struct sk_buff * skb)451 static inline bool nf_ct_get_tuple_skb(struct nf_conntrack_tuple *dst_tuple,
452 const struct sk_buff *skb)
453 {
454 return false;
455 }
456 #endif
457
458 struct nf_conn;
459 enum ip_conntrack_info;
460
461 struct nf_ct_hook {
462 int (*update)(struct net *net, struct sk_buff *skb);
463 void (*destroy)(struct nf_conntrack *);
464 bool (*get_tuple_skb)(struct nf_conntrack_tuple *,
465 const struct sk_buff *);
466 void (*attach)(struct sk_buff *nskb, const struct sk_buff *skb);
467
468 ANDROID_KABI_RESERVE(1);
469 };
470 extern const struct nf_ct_hook __rcu *nf_ct_hook;
471
472 struct nlattr;
473
474 struct nfnl_ct_hook {
475 size_t (*build_size)(const struct nf_conn *ct);
476 int (*build)(struct sk_buff *skb, struct nf_conn *ct,
477 enum ip_conntrack_info ctinfo,
478 u_int16_t ct_attr, u_int16_t ct_info_attr);
479 int (*parse)(const struct nlattr *attr, struct nf_conn *ct);
480 int (*attach_expect)(const struct nlattr *attr, struct nf_conn *ct,
481 u32 portid, u32 report);
482 void (*seq_adjust)(struct sk_buff *skb, struct nf_conn *ct,
483 enum ip_conntrack_info ctinfo, s32 off);
484
485 ANDROID_KABI_RESERVE(1);
486 };
487 extern const struct nfnl_ct_hook __rcu *nfnl_ct_hook;
488
489 /**
490 * nf_skb_duplicated - TEE target has sent a packet
491 *
492 * When a xtables target sends a packet, the OUTPUT and POSTROUTING
493 * hooks are traversed again, i.e. nft and xtables are invoked recursively.
494 *
495 * This is used by xtables TEE target to prevent the duplicated skb from
496 * being duplicated again.
497 */
498 DECLARE_PER_CPU(bool, nf_skb_duplicated);
499
500 /**
501 * Contains bitmask of ctnetlink event subscribers, if any.
502 * Can't be pernet due to NETLINK_LISTEN_ALL_NSID setsockopt flag.
503 */
504 extern u8 nf_ctnetlink_has_listener;
505 #endif /*__LINUX_NETFILTER_H*/
506