Warning: This file is not a C or C++ file. It does not have highlighting.
1 | /* SPDX-License-Identifier: GPL-2.0 */ |
---|---|
2 | #ifndef _NET_NF_TABLES_H |
3 | #define _NET_NF_TABLES_H |
4 | |
5 | #include <asm/unaligned.h> |
6 | #include <linux/list.h> |
7 | #include <linux/netfilter.h> |
8 | #include <linux/netfilter/nfnetlink.h> |
9 | #include <linux/netfilter/x_tables.h> |
10 | #include <linux/netfilter/nf_tables.h> |
11 | #include <linux/u64_stats_sync.h> |
12 | #include <linux/rhashtable.h> |
13 | #include <net/netfilter/nf_flow_table.h> |
14 | #include <net/netlink.h> |
15 | #include <net/flow_offload.h> |
16 | #include <net/netns/generic.h> |
17 | |
18 | #define NFT_MAX_HOOKS (NF_INET_INGRESS + 1) |
19 | |
20 | struct module; |
21 | |
22 | #define NFT_JUMP_STACK_SIZE 16 |
23 | |
24 | enum { |
25 | NFT_PKTINFO_L4PROTO = (1 << 0), |
26 | NFT_PKTINFO_INNER = (1 << 1), |
27 | NFT_PKTINFO_INNER_FULL = (1 << 2), |
28 | }; |
29 | |
30 | struct nft_pktinfo { |
31 | struct sk_buff *skb; |
32 | const struct nf_hook_state *state; |
33 | u8 flags; |
34 | u8 tprot; |
35 | u16 fragoff; |
36 | u16 thoff; |
37 | u16 inneroff; |
38 | }; |
39 | |
40 | static inline struct sock *nft_sk(const struct nft_pktinfo *pkt) |
41 | { |
42 | return pkt->state->sk; |
43 | } |
44 | |
45 | static inline unsigned int nft_thoff(const struct nft_pktinfo *pkt) |
46 | { |
47 | return pkt->thoff; |
48 | } |
49 | |
50 | static inline struct net *nft_net(const struct nft_pktinfo *pkt) |
51 | { |
52 | return pkt->state->net; |
53 | } |
54 | |
55 | static inline unsigned int nft_hook(const struct nft_pktinfo *pkt) |
56 | { |
57 | return pkt->state->hook; |
58 | } |
59 | |
60 | static inline u8 nft_pf(const struct nft_pktinfo *pkt) |
61 | { |
62 | return pkt->state->pf; |
63 | } |
64 | |
65 | static inline const struct net_device *nft_in(const struct nft_pktinfo *pkt) |
66 | { |
67 | return pkt->state->in; |
68 | } |
69 | |
70 | static inline const struct net_device *nft_out(const struct nft_pktinfo *pkt) |
71 | { |
72 | return pkt->state->out; |
73 | } |
74 | |
75 | static inline void nft_set_pktinfo(struct nft_pktinfo *pkt, |
76 | struct sk_buff *skb, |
77 | const struct nf_hook_state *state) |
78 | { |
79 | pkt->skb = skb; |
80 | pkt->state = state; |
81 | } |
82 | |
83 | static inline void nft_set_pktinfo_unspec(struct nft_pktinfo *pkt) |
84 | { |
85 | pkt->flags = 0; |
86 | pkt->tprot = 0; |
87 | pkt->thoff = 0; |
88 | pkt->fragoff = 0; |
89 | } |
90 | |
91 | /** |
92 | * struct nft_verdict - nf_tables verdict |
93 | * |
94 | * @code: nf_tables/netfilter verdict code |
95 | * @chain: destination chain for NFT_JUMP/NFT_GOTO |
96 | */ |
97 | struct nft_verdict { |
98 | u32 code; |
99 | struct nft_chain *chain; |
100 | }; |
101 | |
102 | struct nft_data { |
103 | union { |
104 | u32 data[4]; |
105 | struct nft_verdict verdict; |
106 | }; |
107 | } __attribute__((aligned(__alignof__(u64)))); |
108 | |
109 | #define NFT_REG32_NUM 20 |
110 | |
111 | /** |
112 | * struct nft_regs - nf_tables register set |
113 | * |
114 | * @data: data registers |
115 | * @verdict: verdict register |
116 | * |
117 | * The first four data registers alias to the verdict register. |
118 | */ |
119 | struct nft_regs { |
120 | union { |
121 | u32 data[NFT_REG32_NUM]; |
122 | struct nft_verdict verdict; |
123 | }; |
124 | }; |
125 | |
126 | struct nft_regs_track { |
127 | struct { |
128 | const struct nft_expr *selector; |
129 | const struct nft_expr *bitwise; |
130 | u8 num_reg; |
131 | } regs[NFT_REG32_NUM]; |
132 | |
133 | const struct nft_expr *cur; |
134 | const struct nft_expr *last; |
135 | }; |
136 | |
137 | /* Store/load an u8, u16 or u64 integer to/from the u32 data register. |
138 | * |
139 | * Note, when using concatenations, register allocation happens at 32-bit |
140 | * level. So for store instruction, pad the rest part with zero to avoid |
141 | * garbage values. |
142 | */ |
143 | |
144 | static inline void nft_reg_store8(u32 *dreg, u8 val) |
145 | { |
146 | *dreg = 0; |
147 | *(u8 *)dreg = val; |
148 | } |
149 | |
150 | static inline u8 nft_reg_load8(const u32 *sreg) |
151 | { |
152 | return *(u8 *)sreg; |
153 | } |
154 | |
155 | static inline void nft_reg_store16(u32 *dreg, u16 val) |
156 | { |
157 | *dreg = 0; |
158 | *(u16 *)dreg = val; |
159 | } |
160 | |
161 | static inline void nft_reg_store_be16(u32 *dreg, __be16 val) |
162 | { |
163 | nft_reg_store16(dreg, (__force __u16)val); |
164 | } |
165 | |
166 | static inline u16 nft_reg_load16(const u32 *sreg) |
167 | { |
168 | return *(u16 *)sreg; |
169 | } |
170 | |
171 | static inline __be16 nft_reg_load_be16(const u32 *sreg) |
172 | { |
173 | return (__force __be16)nft_reg_load16(sreg); |
174 | } |
175 | |
176 | static inline __be32 nft_reg_load_be32(const u32 *sreg) |
177 | { |
178 | return *(__force __be32 *)sreg; |
179 | } |
180 | |
181 | static inline void nft_reg_store64(u64 *dreg, u64 val) |
182 | { |
183 | put_unaligned(val, dreg); |
184 | } |
185 | |
186 | static inline u64 nft_reg_load64(const u32 *sreg) |
187 | { |
188 | return get_unaligned((u64 *)sreg); |
189 | } |
190 | |
191 | static inline void nft_data_copy(u32 *dst, const struct nft_data *src, |
192 | unsigned int len) |
193 | { |
194 | if (len % NFT_REG32_SIZE) |
195 | dst[len / NFT_REG32_SIZE] = 0; |
196 | memcpy(dst, src, len); |
197 | } |
198 | |
199 | /** |
200 | * struct nft_ctx - nf_tables rule/set context |
201 | * |
202 | * @net: net namespace |
203 | * @table: the table the chain is contained in |
204 | * @chain: the chain the rule is contained in |
205 | * @nla: netlink attributes |
206 | * @portid: netlink portID of the original message |
207 | * @seq: netlink sequence number |
208 | * @flags: modifiers to new request |
209 | * @family: protocol family |
210 | * @level: depth of the chains |
211 | * @report: notify via unicast netlink message |
212 | */ |
213 | struct nft_ctx { |
214 | struct net *net; |
215 | struct nft_table *table; |
216 | struct nft_chain *chain; |
217 | const struct nlattr * const *nla; |
218 | u32 portid; |
219 | u32 seq; |
220 | u16 flags; |
221 | u8 family; |
222 | u8 level; |
223 | bool report; |
224 | }; |
225 | |
226 | enum nft_data_desc_flags { |
227 | NFT_DATA_DESC_SETELEM = (1 << 0), |
228 | }; |
229 | |
230 | struct nft_data_desc { |
231 | enum nft_data_types type; |
232 | unsigned int size; |
233 | unsigned int len; |
234 | unsigned int flags; |
235 | }; |
236 | |
237 | int nft_data_init(const struct nft_ctx *ctx, struct nft_data *data, |
238 | struct nft_data_desc *desc, const struct nlattr *nla); |
239 | void nft_data_hold(const struct nft_data *data, enum nft_data_types type); |
240 | void nft_data_release(const struct nft_data *data, enum nft_data_types type); |
241 | int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data, |
242 | enum nft_data_types type, unsigned int len); |
243 | |
244 | static inline enum nft_data_types nft_dreg_to_type(enum nft_registers reg) |
245 | { |
246 | return reg == NFT_REG_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE; |
247 | } |
248 | |
249 | static inline enum nft_registers nft_type_to_reg(enum nft_data_types type) |
250 | { |
251 | return type == NFT_DATA_VERDICT ? NFT_REG_VERDICT : NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE; |
252 | } |
253 | |
254 | int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest); |
255 | int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg); |
256 | |
257 | int nft_parse_register_load(const struct nlattr *attr, u8 *sreg, u32 len); |
258 | int nft_parse_register_store(const struct nft_ctx *ctx, |
259 | const struct nlattr *attr, u8 *dreg, |
260 | const struct nft_data *data, |
261 | enum nft_data_types type, unsigned int len); |
262 | |
263 | /** |
264 | * struct nft_userdata - user defined data associated with an object |
265 | * |
266 | * @len: length of the data |
267 | * @data: content |
268 | * |
269 | * The presence of user data is indicated in an object specific fashion, |
270 | * so a length of zero can't occur and the value "len" indicates data |
271 | * of length len + 1. |
272 | */ |
273 | struct nft_userdata { |
274 | u8 len; |
275 | unsigned char data[]; |
276 | }; |
277 | |
278 | /* placeholder structure for opaque set element backend representation. */ |
279 | struct nft_elem_priv { }; |
280 | |
281 | /** |
282 | * struct nft_set_elem - generic representation of set elements |
283 | * |
284 | * @key: element key |
285 | * @key_end: closing element key |
286 | * @data: element data |
287 | * @priv: element private data and extensions |
288 | */ |
289 | struct nft_set_elem { |
290 | union { |
291 | u32 buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)]; |
292 | struct nft_data val; |
293 | } key; |
294 | union { |
295 | u32 buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)]; |
296 | struct nft_data val; |
297 | } key_end; |
298 | union { |
299 | u32 buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)]; |
300 | struct nft_data val; |
301 | } data; |
302 | struct nft_elem_priv *priv; |
303 | }; |
304 | |
305 | static inline void *nft_elem_priv_cast(const struct nft_elem_priv *priv) |
306 | { |
307 | return (void *)priv; |
308 | } |
309 | |
310 | |
311 | /** |
312 | * enum nft_iter_type - nftables set iterator type |
313 | * |
314 | * @NFT_ITER_READ: read-only iteration over set elements |
315 | * @NFT_ITER_UPDATE: iteration under mutex to update set element state |
316 | */ |
317 | enum nft_iter_type { |
318 | NFT_ITER_UNSPEC, |
319 | NFT_ITER_READ, |
320 | NFT_ITER_UPDATE, |
321 | }; |
322 | |
323 | struct nft_set; |
324 | struct nft_set_iter { |
325 | u8 genmask; |
326 | enum nft_iter_type type:8; |
327 | unsigned int count; |
328 | unsigned int skip; |
329 | int err; |
330 | int (*fn)(const struct nft_ctx *ctx, |
331 | struct nft_set *set, |
332 | const struct nft_set_iter *iter, |
333 | struct nft_elem_priv *elem_priv); |
334 | }; |
335 | |
336 | /** |
337 | * struct nft_set_desc - description of set elements |
338 | * |
339 | * @ktype: key type |
340 | * @klen: key length |
341 | * @dtype: data type |
342 | * @dlen: data length |
343 | * @objtype: object type |
344 | * @size: number of set elements |
345 | * @policy: set policy |
346 | * @gc_int: garbage collector interval |
347 | * @timeout: element timeout |
348 | * @field_len: length of each field in concatenation, bytes |
349 | * @field_count: number of concatenated fields in element |
350 | * @expr: set must support for expressions |
351 | */ |
352 | struct nft_set_desc { |
353 | u32 ktype; |
354 | unsigned int klen; |
355 | u32 dtype; |
356 | unsigned int dlen; |
357 | u32 objtype; |
358 | unsigned int size; |
359 | u32 policy; |
360 | u32 gc_int; |
361 | u64 timeout; |
362 | u8 field_len[NFT_REG32_COUNT]; |
363 | u8 field_count; |
364 | bool expr; |
365 | }; |
366 | |
367 | /** |
368 | * enum nft_set_class - performance class |
369 | * |
370 | * @NFT_SET_CLASS_O_1: constant, O(1) |
371 | * @NFT_SET_CLASS_O_LOG_N: logarithmic, O(log N) |
372 | * @NFT_SET_CLASS_O_N: linear, O(N) |
373 | */ |
374 | enum nft_set_class { |
375 | NFT_SET_CLASS_O_1, |
376 | NFT_SET_CLASS_O_LOG_N, |
377 | NFT_SET_CLASS_O_N, |
378 | }; |
379 | |
380 | /** |
381 | * struct nft_set_estimate - estimation of memory and performance |
382 | * characteristics |
383 | * |
384 | * @size: required memory |
385 | * @lookup: lookup performance class |
386 | * @space: memory class |
387 | */ |
388 | struct nft_set_estimate { |
389 | u64 size; |
390 | enum nft_set_class lookup; |
391 | enum nft_set_class space; |
392 | }; |
393 | |
394 | #define NFT_EXPR_MAXATTR 16 |
395 | #define NFT_EXPR_SIZE(size) (sizeof(struct nft_expr) + \ |
396 | ALIGN(size, __alignof__(struct nft_expr))) |
397 | |
398 | /** |
399 | * struct nft_expr - nf_tables expression |
400 | * |
401 | * @ops: expression ops |
402 | * @data: expression private data |
403 | */ |
404 | struct nft_expr { |
405 | const struct nft_expr_ops *ops; |
406 | unsigned char data[] |
407 | __attribute__((aligned(__alignof__(u64)))); |
408 | }; |
409 | |
410 | static inline void *nft_expr_priv(const struct nft_expr *expr) |
411 | { |
412 | return (void *)expr->data; |
413 | } |
414 | |
415 | struct nft_expr_info; |
416 | |
417 | int nft_expr_inner_parse(const struct nft_ctx *ctx, const struct nlattr *nla, |
418 | struct nft_expr_info *info); |
419 | int nft_expr_clone(struct nft_expr *dst, struct nft_expr *src); |
420 | void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr); |
421 | int nft_expr_dump(struct sk_buff *skb, unsigned int attr, |
422 | const struct nft_expr *expr, bool reset); |
423 | bool nft_expr_reduce_bitwise(struct nft_regs_track *track, |
424 | const struct nft_expr *expr); |
425 | |
426 | struct nft_set_ext; |
427 | |
428 | /** |
429 | * struct nft_set_ops - nf_tables set operations |
430 | * |
431 | * @lookup: look up an element within the set |
432 | * @update: update an element if exists, add it if doesn't exist |
433 | * @delete: delete an element |
434 | * @insert: insert new element into set |
435 | * @activate: activate new element in the next generation |
436 | * @deactivate: lookup for element and deactivate it in the next generation |
437 | * @flush: deactivate element in the next generation |
438 | * @remove: remove element from set |
439 | * @walk: iterate over all set elements |
440 | * @get: get set elements |
441 | * @commit: commit set elements |
442 | * @abort: abort set elements |
443 | * @privsize: function to return size of set private data |
444 | * @estimate: estimate the required memory size and the lookup complexity class |
445 | * @init: initialize private data of new set instance |
446 | * @destroy: destroy private data of set instance |
447 | * @gc_init: initialize garbage collection |
448 | * @elemsize: element private size |
449 | * |
450 | * Operations lookup, update and delete have simpler interfaces, are faster |
451 | * and currently only used in the packet path. All the rest are slower, |
452 | * control plane functions. |
453 | */ |
454 | struct nft_set_ops { |
455 | bool (*lookup)(const struct net *net, |
456 | const struct nft_set *set, |
457 | const u32 *key, |
458 | const struct nft_set_ext **ext); |
459 | bool (*update)(struct nft_set *set, |
460 | const u32 *key, |
461 | struct nft_elem_priv * |
462 | (*new)(struct nft_set *, |
463 | const struct nft_expr *, |
464 | struct nft_regs *), |
465 | const struct nft_expr *expr, |
466 | struct nft_regs *regs, |
467 | const struct nft_set_ext **ext); |
468 | bool (*delete)(const struct nft_set *set, |
469 | const u32 *key); |
470 | |
471 | int (*insert)(const struct net *net, |
472 | const struct nft_set *set, |
473 | const struct nft_set_elem *elem, |
474 | struct nft_elem_priv **priv); |
475 | void (*activate)(const struct net *net, |
476 | const struct nft_set *set, |
477 | struct nft_elem_priv *elem_priv); |
478 | struct nft_elem_priv * (*deactivate)(const struct net *net, |
479 | const struct nft_set *set, |
480 | const struct nft_set_elem *elem); |
481 | void (*flush)(const struct net *net, |
482 | const struct nft_set *set, |
483 | struct nft_elem_priv *priv); |
484 | void (*remove)(const struct net *net, |
485 | const struct nft_set *set, |
486 | struct nft_elem_priv *elem_priv); |
487 | void (*walk)(const struct nft_ctx *ctx, |
488 | struct nft_set *set, |
489 | struct nft_set_iter *iter); |
490 | struct nft_elem_priv * (*get)(const struct net *net, |
491 | const struct nft_set *set, |
492 | const struct nft_set_elem *elem, |
493 | unsigned int flags); |
494 | void (*commit)(struct nft_set *set); |
495 | void (*abort)(const struct nft_set *set); |
496 | u64 (*privsize)(const struct nlattr * const nla[], |
497 | const struct nft_set_desc *desc); |
498 | bool (*estimate)(const struct nft_set_desc *desc, |
499 | u32 features, |
500 | struct nft_set_estimate *est); |
501 | int (*init)(const struct nft_set *set, |
502 | const struct nft_set_desc *desc, |
503 | const struct nlattr * const nla[]); |
504 | void (*destroy)(const struct nft_ctx *ctx, |
505 | const struct nft_set *set); |
506 | void (*gc_init)(const struct nft_set *set); |
507 | |
508 | unsigned int elemsize; |
509 | }; |
510 | |
511 | /** |
512 | * struct nft_set_type - nf_tables set type |
513 | * |
514 | * @ops: set ops for this type |
515 | * @features: features supported by the implementation |
516 | */ |
517 | struct nft_set_type { |
518 | const struct nft_set_ops ops; |
519 | u32 features; |
520 | }; |
521 | #define to_set_type(o) container_of(o, struct nft_set_type, ops) |
522 | |
523 | struct nft_set_elem_expr { |
524 | u8 size; |
525 | unsigned char data[] |
526 | __attribute__((aligned(__alignof__(struct nft_expr)))); |
527 | }; |
528 | |
529 | #define nft_setelem_expr_at(__elem_expr, __offset) \ |
530 | ((struct nft_expr *)&__elem_expr->data[__offset]) |
531 | |
532 | #define nft_setelem_expr_foreach(__expr, __elem_expr, __size) \ |
533 | for (__expr = nft_setelem_expr_at(__elem_expr, 0), __size = 0; \ |
534 | __size < (__elem_expr)->size; \ |
535 | __size += (__expr)->ops->size, __expr = ((void *)(__expr)) + (__expr)->ops->size) |
536 | |
537 | #define NFT_SET_EXPR_MAX 2 |
538 | |
539 | /** |
540 | * struct nft_set - nf_tables set instance |
541 | * |
542 | * @list: table set list node |
543 | * @bindings: list of set bindings |
544 | * @refs: internal refcounting for async set destruction |
545 | * @table: table this set belongs to |
546 | * @net: netnamespace this set belongs to |
547 | * @name: name of the set |
548 | * @handle: unique handle of the set |
549 | * @ktype: key type (numeric type defined by userspace, not used in the kernel) |
550 | * @dtype: data type (verdict or numeric type defined by userspace) |
551 | * @objtype: object type (see NFT_OBJECT_* definitions) |
552 | * @size: maximum set size |
553 | * @field_len: length of each field in concatenation, bytes |
554 | * @field_count: number of concatenated fields in element |
555 | * @use: number of rules references to this set |
556 | * @nelems: number of elements |
557 | * @ndeact: number of deactivated elements queued for removal |
558 | * @timeout: default timeout value in jiffies |
559 | * @gc_int: garbage collection interval in msecs |
560 | * @policy: set parameterization (see enum nft_set_policies) |
561 | * @udlen: user data length |
562 | * @udata: user data |
563 | * @pending_update: list of pending update set element |
564 | * @ops: set ops |
565 | * @flags: set flags |
566 | * @dead: set will be freed, never cleared |
567 | * @genmask: generation mask |
568 | * @klen: key length |
569 | * @dlen: data length |
570 | * @num_exprs: numbers of exprs |
571 | * @exprs: stateful expression |
572 | * @catchall_list: list of catch-all set element |
573 | * @data: private set data |
574 | */ |
575 | struct nft_set { |
576 | struct list_head list; |
577 | struct list_head bindings; |
578 | refcount_t refs; |
579 | struct nft_table *table; |
580 | possible_net_t net; |
581 | char *name; |
582 | u64 handle; |
583 | u32 ktype; |
584 | u32 dtype; |
585 | u32 objtype; |
586 | u32 size; |
587 | u8 field_len[NFT_REG32_COUNT]; |
588 | u8 field_count; |
589 | u32 use; |
590 | atomic_t nelems; |
591 | u32 ndeact; |
592 | u64 timeout; |
593 | u32 gc_int; |
594 | u16 policy; |
595 | u16 udlen; |
596 | unsigned char *udata; |
597 | struct list_head pending_update; |
598 | /* runtime data below here */ |
599 | const struct nft_set_ops *ops ____cacheline_aligned; |
600 | u16 flags:13, |
601 | dead:1, |
602 | genmask:2; |
603 | u8 klen; |
604 | u8 dlen; |
605 | u8 num_exprs; |
606 | struct nft_expr *exprs[NFT_SET_EXPR_MAX]; |
607 | struct list_head catchall_list; |
608 | unsigned char data[] |
609 | __attribute__((aligned(__alignof__(u64)))); |
610 | }; |
611 | |
612 | static inline bool nft_set_is_anonymous(const struct nft_set *set) |
613 | { |
614 | return set->flags & NFT_SET_ANONYMOUS; |
615 | } |
616 | |
617 | static inline void *nft_set_priv(const struct nft_set *set) |
618 | { |
619 | return (void *)set->data; |
620 | } |
621 | |
622 | static inline bool nft_set_gc_is_pending(const struct nft_set *s) |
623 | { |
624 | return refcount_read(&s->refs) != 1; |
625 | } |
626 | |
627 | static inline struct nft_set *nft_set_container_of(const void *priv) |
628 | { |
629 | return (void *)priv - offsetof(struct nft_set, data); |
630 | } |
631 | |
632 | struct nft_set *nft_set_lookup_global(const struct net *net, |
633 | const struct nft_table *table, |
634 | const struct nlattr *nla_set_name, |
635 | const struct nlattr *nla_set_id, |
636 | u8 genmask); |
637 | |
638 | struct nft_set_ext *nft_set_catchall_lookup(const struct net *net, |
639 | const struct nft_set *set); |
640 | |
641 | static inline unsigned long nft_set_gc_interval(const struct nft_set *set) |
642 | { |
643 | u32 gc_int = READ_ONCE(set->gc_int); |
644 | |
645 | return gc_int ? msecs_to_jiffies(gc_int) : HZ; |
646 | } |
647 | |
648 | /** |
649 | * struct nft_set_binding - nf_tables set binding |
650 | * |
651 | * @list: set bindings list node |
652 | * @chain: chain containing the rule bound to the set |
653 | * @flags: set action flags |
654 | * |
655 | * A set binding contains all information necessary for validation |
656 | * of new elements added to a bound set. |
657 | */ |
658 | struct nft_set_binding { |
659 | struct list_head list; |
660 | const struct nft_chain *chain; |
661 | u32 flags; |
662 | }; |
663 | |
664 | enum nft_trans_phase; |
665 | void nf_tables_activate_set(const struct nft_ctx *ctx, struct nft_set *set); |
666 | void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set, |
667 | struct nft_set_binding *binding, |
668 | enum nft_trans_phase phase); |
669 | int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set, |
670 | struct nft_set_binding *binding); |
671 | void nf_tables_destroy_set(const struct nft_ctx *ctx, struct nft_set *set); |
672 | |
673 | /** |
674 | * enum nft_set_extensions - set extension type IDs |
675 | * |
676 | * @NFT_SET_EXT_KEY: element key |
677 | * @NFT_SET_EXT_KEY_END: upper bound element key, for ranges |
678 | * @NFT_SET_EXT_DATA: mapping data |
679 | * @NFT_SET_EXT_FLAGS: element flags |
680 | * @NFT_SET_EXT_TIMEOUT: element timeout |
681 | * @NFT_SET_EXT_EXPIRATION: element expiration time |
682 | * @NFT_SET_EXT_USERDATA: user data associated with the element |
683 | * @NFT_SET_EXT_EXPRESSIONS: expressions assiciated with the element |
684 | * @NFT_SET_EXT_OBJREF: stateful object reference associated with element |
685 | * @NFT_SET_EXT_NUM: number of extension types |
686 | */ |
687 | enum nft_set_extensions { |
688 | NFT_SET_EXT_KEY, |
689 | NFT_SET_EXT_KEY_END, |
690 | NFT_SET_EXT_DATA, |
691 | NFT_SET_EXT_FLAGS, |
692 | NFT_SET_EXT_TIMEOUT, |
693 | NFT_SET_EXT_EXPIRATION, |
694 | NFT_SET_EXT_USERDATA, |
695 | NFT_SET_EXT_EXPRESSIONS, |
696 | NFT_SET_EXT_OBJREF, |
697 | NFT_SET_EXT_NUM |
698 | }; |
699 | |
700 | /** |
701 | * struct nft_set_ext_type - set extension type |
702 | * |
703 | * @len: fixed part length of the extension |
704 | * @align: alignment requirements of the extension |
705 | */ |
706 | struct nft_set_ext_type { |
707 | u8 len; |
708 | u8 align; |
709 | }; |
710 | |
711 | extern const struct nft_set_ext_type nft_set_ext_types[]; |
712 | |
713 | /** |
714 | * struct nft_set_ext_tmpl - set extension template |
715 | * |
716 | * @len: length of extension area |
717 | * @offset: offsets of individual extension types |
718 | * @ext_len: length of the expected extension(used to sanity check) |
719 | */ |
720 | struct nft_set_ext_tmpl { |
721 | u16 len; |
722 | u8 offset[NFT_SET_EXT_NUM]; |
723 | u8 ext_len[NFT_SET_EXT_NUM]; |
724 | }; |
725 | |
726 | /** |
727 | * struct nft_set_ext - set extensions |
728 | * |
729 | * @genmask: generation mask |
730 | * @offset: offsets of individual extension types |
731 | * @data: beginning of extension data |
732 | */ |
733 | struct nft_set_ext { |
734 | u8 genmask; |
735 | u8 offset[NFT_SET_EXT_NUM]; |
736 | char data[]; |
737 | }; |
738 | |
739 | static inline void nft_set_ext_prepare(struct nft_set_ext_tmpl *tmpl) |
740 | { |
741 | memset(tmpl, 0, sizeof(*tmpl)); |
742 | tmpl->len = sizeof(struct nft_set_ext); |
743 | } |
744 | |
745 | static inline int nft_set_ext_add_length(struct nft_set_ext_tmpl *tmpl, u8 id, |
746 | unsigned int len) |
747 | { |
748 | tmpl->len = ALIGN(tmpl->len, nft_set_ext_types[id].align); |
749 | if (tmpl->len > U8_MAX) |
750 | return -EINVAL; |
751 | |
752 | tmpl->offset[id] = tmpl->len; |
753 | tmpl->ext_len[id] = nft_set_ext_types[id].len + len; |
754 | tmpl->len += tmpl->ext_len[id]; |
755 | |
756 | return 0; |
757 | } |
758 | |
759 | static inline int nft_set_ext_add(struct nft_set_ext_tmpl *tmpl, u8 id) |
760 | { |
761 | return nft_set_ext_add_length(tmpl, id, 0); |
762 | } |
763 | |
764 | static inline void nft_set_ext_init(struct nft_set_ext *ext, |
765 | const struct nft_set_ext_tmpl *tmpl) |
766 | { |
767 | memcpy(ext->offset, tmpl->offset, sizeof(ext->offset)); |
768 | } |
769 | |
770 | static inline bool __nft_set_ext_exists(const struct nft_set_ext *ext, u8 id) |
771 | { |
772 | return !!ext->offset[id]; |
773 | } |
774 | |
775 | static inline bool nft_set_ext_exists(const struct nft_set_ext *ext, u8 id) |
776 | { |
777 | return ext && __nft_set_ext_exists(ext, id); |
778 | } |
779 | |
780 | static inline void *nft_set_ext(const struct nft_set_ext *ext, u8 id) |
781 | { |
782 | return (void *)ext + ext->offset[id]; |
783 | } |
784 | |
785 | static inline struct nft_data *nft_set_ext_key(const struct nft_set_ext *ext) |
786 | { |
787 | return nft_set_ext(ext, NFT_SET_EXT_KEY); |
788 | } |
789 | |
790 | static inline struct nft_data *nft_set_ext_key_end(const struct nft_set_ext *ext) |
791 | { |
792 | return nft_set_ext(ext, NFT_SET_EXT_KEY_END); |
793 | } |
794 | |
795 | static inline struct nft_data *nft_set_ext_data(const struct nft_set_ext *ext) |
796 | { |
797 | return nft_set_ext(ext, NFT_SET_EXT_DATA); |
798 | } |
799 | |
800 | static inline u8 *nft_set_ext_flags(const struct nft_set_ext *ext) |
801 | { |
802 | return nft_set_ext(ext, NFT_SET_EXT_FLAGS); |
803 | } |
804 | |
805 | static inline u64 *nft_set_ext_timeout(const struct nft_set_ext *ext) |
806 | { |
807 | return nft_set_ext(ext, NFT_SET_EXT_TIMEOUT); |
808 | } |
809 | |
810 | static inline u64 *nft_set_ext_expiration(const struct nft_set_ext *ext) |
811 | { |
812 | return nft_set_ext(ext, NFT_SET_EXT_EXPIRATION); |
813 | } |
814 | |
815 | static inline struct nft_userdata *nft_set_ext_userdata(const struct nft_set_ext *ext) |
816 | { |
817 | return nft_set_ext(ext, NFT_SET_EXT_USERDATA); |
818 | } |
819 | |
820 | static inline struct nft_set_elem_expr *nft_set_ext_expr(const struct nft_set_ext *ext) |
821 | { |
822 | return nft_set_ext(ext, NFT_SET_EXT_EXPRESSIONS); |
823 | } |
824 | |
825 | static inline bool __nft_set_elem_expired(const struct nft_set_ext *ext, |
826 | u64 tstamp) |
827 | { |
828 | return nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION) && |
829 | time_after_eq64(tstamp, *nft_set_ext_expiration(ext)); |
830 | } |
831 | |
832 | static inline bool nft_set_elem_expired(const struct nft_set_ext *ext) |
833 | { |
834 | return __nft_set_elem_expired(ext, get_jiffies_64()); |
835 | } |
836 | |
837 | static inline struct nft_set_ext *nft_set_elem_ext(const struct nft_set *set, |
838 | const struct nft_elem_priv *elem_priv) |
839 | { |
840 | return (void *)elem_priv + set->ops->elemsize; |
841 | } |
842 | |
843 | static inline struct nft_object **nft_set_ext_obj(const struct nft_set_ext *ext) |
844 | { |
845 | return nft_set_ext(ext, NFT_SET_EXT_OBJREF); |
846 | } |
847 | |
848 | struct nft_expr *nft_set_elem_expr_alloc(const struct nft_ctx *ctx, |
849 | const struct nft_set *set, |
850 | const struct nlattr *attr); |
851 | |
852 | struct nft_elem_priv *nft_set_elem_init(const struct nft_set *set, |
853 | const struct nft_set_ext_tmpl *tmpl, |
854 | const u32 *key, const u32 *key_end, |
855 | const u32 *data, |
856 | u64 timeout, u64 expiration, gfp_t gfp); |
857 | int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set, |
858 | struct nft_expr *expr_array[]); |
859 | void nft_set_elem_destroy(const struct nft_set *set, |
860 | const struct nft_elem_priv *elem_priv, |
861 | bool destroy_expr); |
862 | void nf_tables_set_elem_destroy(const struct nft_ctx *ctx, |
863 | const struct nft_set *set, |
864 | const struct nft_elem_priv *elem_priv); |
865 | |
866 | struct nft_expr_ops; |
867 | /** |
868 | * struct nft_expr_type - nf_tables expression type |
869 | * |
870 | * @select_ops: function to select nft_expr_ops |
871 | * @release_ops: release nft_expr_ops |
872 | * @ops: default ops, used when no select_ops functions is present |
873 | * @inner_ops: inner ops, used for inner packet operation |
874 | * @list: used internally |
875 | * @name: Identifier |
876 | * @owner: module reference |
877 | * @policy: netlink attribute policy |
878 | * @maxattr: highest netlink attribute number |
879 | * @family: address family for AF-specific types |
880 | * @flags: expression type flags |
881 | */ |
882 | struct nft_expr_type { |
883 | const struct nft_expr_ops *(*select_ops)(const struct nft_ctx *, |
884 | const struct nlattr * const tb[]); |
885 | void (*release_ops)(const struct nft_expr_ops *ops); |
886 | const struct nft_expr_ops *ops; |
887 | const struct nft_expr_ops *inner_ops; |
888 | struct list_head list; |
889 | const char *name; |
890 | struct module *owner; |
891 | const struct nla_policy *policy; |
892 | unsigned int maxattr; |
893 | u8 family; |
894 | u8 flags; |
895 | }; |
896 | |
897 | #define NFT_EXPR_STATEFUL 0x1 |
898 | #define NFT_EXPR_GC 0x2 |
899 | |
900 | enum nft_trans_phase { |
901 | NFT_TRANS_PREPARE, |
902 | NFT_TRANS_PREPARE_ERROR, |
903 | NFT_TRANS_ABORT, |
904 | NFT_TRANS_COMMIT, |
905 | NFT_TRANS_RELEASE |
906 | }; |
907 | |
908 | struct nft_flow_rule; |
909 | struct nft_offload_ctx; |
910 | |
911 | /** |
912 | * struct nft_expr_ops - nf_tables expression operations |
913 | * |
914 | * @eval: Expression evaluation function |
915 | * @clone: Expression clone function |
916 | * @size: full expression size, including private data size |
917 | * @init: initialization function |
918 | * @activate: activate expression in the next generation |
919 | * @deactivate: deactivate expression in next generation |
920 | * @destroy: destruction function, called after synchronize_rcu |
921 | * @destroy_clone: destruction clone function |
922 | * @dump: function to dump parameters |
923 | * @validate: validate expression, called during loop detection |
924 | * @reduce: reduce expression |
925 | * @gc: garbage collection expression |
926 | * @offload: hardware offload expression |
927 | * @offload_action: function to report true/false to allocate one slot or not in the flow |
928 | * offload array |
929 | * @offload_stats: function to synchronize hardware stats via updating the counter expression |
930 | * @type: expression type |
931 | * @data: extra data to attach to this expression operation |
932 | */ |
933 | struct nft_expr_ops { |
934 | void (*eval)(const struct nft_expr *expr, |
935 | struct nft_regs *regs, |
936 | const struct nft_pktinfo *pkt); |
937 | int (*clone)(struct nft_expr *dst, |
938 | const struct nft_expr *src); |
939 | unsigned int size; |
940 | |
941 | int (*init)(const struct nft_ctx *ctx, |
942 | const struct nft_expr *expr, |
943 | const struct nlattr * const tb[]); |
944 | void (*activate)(const struct nft_ctx *ctx, |
945 | const struct nft_expr *expr); |
946 | void (*deactivate)(const struct nft_ctx *ctx, |
947 | const struct nft_expr *expr, |
948 | enum nft_trans_phase phase); |
949 | void (*destroy)(const struct nft_ctx *ctx, |
950 | const struct nft_expr *expr); |
951 | void (*destroy_clone)(const struct nft_ctx *ctx, |
952 | const struct nft_expr *expr); |
953 | int (*dump)(struct sk_buff *skb, |
954 | const struct nft_expr *expr, |
955 | bool reset); |
956 | int (*validate)(const struct nft_ctx *ctx, |
957 | const struct nft_expr *expr, |
958 | const struct nft_data **data); |
959 | bool (*reduce)(struct nft_regs_track *track, |
960 | const struct nft_expr *expr); |
961 | bool (*gc)(struct net *net, |
962 | const struct nft_expr *expr); |
963 | int (*offload)(struct nft_offload_ctx *ctx, |
964 | struct nft_flow_rule *flow, |
965 | const struct nft_expr *expr); |
966 | bool (*offload_action)(const struct nft_expr *expr); |
967 | void (*offload_stats)(struct nft_expr *expr, |
968 | const struct flow_stats *stats); |
969 | const struct nft_expr_type *type; |
970 | void *data; |
971 | }; |
972 | |
973 | /** |
974 | * struct nft_rule - nf_tables rule |
975 | * |
976 | * @list: used internally |
977 | * @handle: rule handle |
978 | * @genmask: generation mask |
979 | * @dlen: length of expression data |
980 | * @udata: user data is appended to the rule |
981 | * @data: expression data |
982 | */ |
983 | struct nft_rule { |
984 | struct list_head list; |
985 | u64 handle:42, |
986 | genmask:2, |
987 | dlen:12, |
988 | udata:1; |
989 | unsigned char data[] |
990 | __attribute__((aligned(__alignof__(struct nft_expr)))); |
991 | }; |
992 | |
993 | static inline struct nft_expr *nft_expr_first(const struct nft_rule *rule) |
994 | { |
995 | return (struct nft_expr *)&rule->data[0]; |
996 | } |
997 | |
998 | static inline struct nft_expr *nft_expr_next(const struct nft_expr *expr) |
999 | { |
1000 | return ((void *)expr) + expr->ops->size; |
1001 | } |
1002 | |
1003 | static inline struct nft_expr *nft_expr_last(const struct nft_rule *rule) |
1004 | { |
1005 | return (struct nft_expr *)&rule->data[rule->dlen]; |
1006 | } |
1007 | |
1008 | static inline bool nft_expr_more(const struct nft_rule *rule, |
1009 | const struct nft_expr *expr) |
1010 | { |
1011 | return expr != nft_expr_last(rule) && expr->ops; |
1012 | } |
1013 | |
1014 | static inline struct nft_userdata *nft_userdata(const struct nft_rule *rule) |
1015 | { |
1016 | return (void *)&rule->data[rule->dlen]; |
1017 | } |
1018 | |
1019 | void nft_rule_expr_activate(const struct nft_ctx *ctx, struct nft_rule *rule); |
1020 | void nft_rule_expr_deactivate(const struct nft_ctx *ctx, struct nft_rule *rule, |
1021 | enum nft_trans_phase phase); |
1022 | void nf_tables_rule_destroy(const struct nft_ctx *ctx, struct nft_rule *rule); |
1023 | |
1024 | static inline void nft_set_elem_update_expr(const struct nft_set_ext *ext, |
1025 | struct nft_regs *regs, |
1026 | const struct nft_pktinfo *pkt) |
1027 | { |
1028 | struct nft_set_elem_expr *elem_expr; |
1029 | struct nft_expr *expr; |
1030 | u32 size; |
1031 | |
1032 | if (__nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS)) { |
1033 | elem_expr = nft_set_ext_expr(ext); |
1034 | nft_setelem_expr_foreach(expr, elem_expr, size) { |
1035 | expr->ops->eval(expr, regs, pkt); |
1036 | if (regs->verdict.code == NFT_BREAK) |
1037 | return; |
1038 | } |
1039 | } |
1040 | } |
1041 | |
1042 | /* |
1043 | * The last pointer isn't really necessary, but the compiler isn't able to |
1044 | * determine that the result of nft_expr_last() is always the same since it |
1045 | * can't assume that the dlen value wasn't changed within calls in the loop. |
1046 | */ |
1047 | #define nft_rule_for_each_expr(expr, last, rule) \ |
1048 | for ((expr) = nft_expr_first(rule), (last) = nft_expr_last(rule); \ |
1049 | (expr) != (last); \ |
1050 | (expr) = nft_expr_next(expr)) |
1051 | |
1052 | #define NFT_CHAIN_POLICY_UNSET U8_MAX |
1053 | |
1054 | struct nft_rule_dp { |
1055 | u64 is_last:1, |
1056 | dlen:12, |
1057 | handle:42; /* for tracing */ |
1058 | unsigned char data[] |
1059 | __attribute__((aligned(__alignof__(struct nft_expr)))); |
1060 | }; |
1061 | |
1062 | struct nft_rule_dp_last { |
1063 | struct nft_rule_dp end; /* end of nft_rule_blob marker */ |
1064 | struct rcu_head h; /* call_rcu head */ |
1065 | struct nft_rule_blob *blob; /* ptr to free via call_rcu */ |
1066 | const struct nft_chain *chain; /* for nftables tracing */ |
1067 | }; |
1068 | |
1069 | static inline const struct nft_rule_dp *nft_rule_next(const struct nft_rule_dp *rule) |
1070 | { |
1071 | return (void *)rule + sizeof(*rule) + rule->dlen; |
1072 | } |
1073 | |
1074 | struct nft_rule_blob { |
1075 | unsigned long size; |
1076 | unsigned char data[] |
1077 | __attribute__((aligned(__alignof__(struct nft_rule_dp)))); |
1078 | }; |
1079 | |
1080 | /** |
1081 | * struct nft_chain - nf_tables chain |
1082 | * |
1083 | * @blob_gen_0: rule blob pointer to the current generation |
1084 | * @blob_gen_1: rule blob pointer to the future generation |
1085 | * @rules: list of rules in the chain |
1086 | * @list: used internally |
1087 | * @rhlhead: used internally |
1088 | * @table: table that this chain belongs to |
1089 | * @handle: chain handle |
1090 | * @use: number of jump references to this chain |
1091 | * @flags: bitmask of enum NFTA_CHAIN_FLAGS |
1092 | * @bound: bind or not |
1093 | * @genmask: generation mask |
1094 | * @name: name of the chain |
1095 | * @udlen: user data length |
1096 | * @udata: user data in the chain |
1097 | * @blob_next: rule blob pointer to the next in the chain |
1098 | */ |
1099 | struct nft_chain { |
1100 | struct nft_rule_blob __rcu *blob_gen_0; |
1101 | struct nft_rule_blob __rcu *blob_gen_1; |
1102 | struct list_head rules; |
1103 | struct list_head list; |
1104 | struct rhlist_head rhlhead; |
1105 | struct nft_table *table; |
1106 | u64 handle; |
1107 | u32 use; |
1108 | u8 flags:5, |
1109 | bound:1, |
1110 | genmask:2; |
1111 | char *name; |
1112 | u16 udlen; |
1113 | u8 *udata; |
1114 | |
1115 | /* Only used during control plane commit phase: */ |
1116 | struct nft_rule_blob *blob_next; |
1117 | }; |
1118 | |
1119 | int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain); |
1120 | int nft_setelem_validate(const struct nft_ctx *ctx, struct nft_set *set, |
1121 | const struct nft_set_iter *iter, |
1122 | struct nft_elem_priv *elem_priv); |
1123 | int nft_set_catchall_validate(const struct nft_ctx *ctx, struct nft_set *set); |
1124 | int nf_tables_bind_chain(const struct nft_ctx *ctx, struct nft_chain *chain); |
1125 | void nf_tables_unbind_chain(const struct nft_ctx *ctx, struct nft_chain *chain); |
1126 | |
1127 | enum nft_chain_types { |
1128 | NFT_CHAIN_T_DEFAULT = 0, |
1129 | NFT_CHAIN_T_ROUTE, |
1130 | NFT_CHAIN_T_NAT, |
1131 | NFT_CHAIN_T_MAX |
1132 | }; |
1133 | |
1134 | /** |
1135 | * struct nft_chain_type - nf_tables chain type info |
1136 | * |
1137 | * @name: name of the type |
1138 | * @type: numeric identifier |
1139 | * @family: address family |
1140 | * @owner: module owner |
1141 | * @hook_mask: mask of valid hooks |
1142 | * @hooks: array of hook functions |
1143 | * @ops_register: base chain register function |
1144 | * @ops_unregister: base chain unregister function |
1145 | */ |
1146 | struct nft_chain_type { |
1147 | const char *name; |
1148 | enum nft_chain_types type; |
1149 | int family; |
1150 | struct module *owner; |
1151 | unsigned int hook_mask; |
1152 | nf_hookfn *hooks[NFT_MAX_HOOKS]; |
1153 | int (*ops_register)(struct net *net, const struct nf_hook_ops *ops); |
1154 | void (*ops_unregister)(struct net *net, const struct nf_hook_ops *ops); |
1155 | }; |
1156 | |
1157 | int nft_chain_validate_dependency(const struct nft_chain *chain, |
1158 | enum nft_chain_types type); |
1159 | int nft_chain_validate_hooks(const struct nft_chain *chain, |
1160 | unsigned int hook_flags); |
1161 | |
1162 | static inline bool nft_chain_binding(const struct nft_chain *chain) |
1163 | { |
1164 | return chain->flags & NFT_CHAIN_BINDING; |
1165 | } |
1166 | |
1167 | static inline bool nft_chain_is_bound(struct nft_chain *chain) |
1168 | { |
1169 | return (chain->flags & NFT_CHAIN_BINDING) && chain->bound; |
1170 | } |
1171 | |
1172 | int nft_chain_add(struct nft_table *table, struct nft_chain *chain); |
1173 | void nft_chain_del(struct nft_chain *chain); |
1174 | void nf_tables_chain_destroy(struct nft_ctx *ctx); |
1175 | |
1176 | struct nft_stats { |
1177 | u64 bytes; |
1178 | u64 pkts; |
1179 | struct u64_stats_sync syncp; |
1180 | }; |
1181 | |
1182 | struct nft_hook { |
1183 | struct list_head list; |
1184 | struct nf_hook_ops ops; |
1185 | struct rcu_head rcu; |
1186 | }; |
1187 | |
1188 | /** |
1189 | * struct nft_base_chain - nf_tables base chain |
1190 | * |
1191 | * @ops: netfilter hook ops |
1192 | * @hook_list: list of netfilter hooks (for NFPROTO_NETDEV family) |
1193 | * @type: chain type |
1194 | * @policy: default policy |
1195 | * @flags: indicate the base chain disabled or not |
1196 | * @stats: per-cpu chain stats |
1197 | * @chain: the chain |
1198 | * @flow_block: flow block (for hardware offload) |
1199 | */ |
1200 | struct nft_base_chain { |
1201 | struct nf_hook_ops ops; |
1202 | struct list_head hook_list; |
1203 | const struct nft_chain_type *type; |
1204 | u8 policy; |
1205 | u8 flags; |
1206 | struct nft_stats __percpu *stats; |
1207 | struct nft_chain chain; |
1208 | struct flow_block flow_block; |
1209 | }; |
1210 | |
1211 | static inline struct nft_base_chain *nft_base_chain(const struct nft_chain *chain) |
1212 | { |
1213 | return container_of(chain, struct nft_base_chain, chain); |
1214 | } |
1215 | |
1216 | static inline bool nft_is_base_chain(const struct nft_chain *chain) |
1217 | { |
1218 | return chain->flags & NFT_CHAIN_BASE; |
1219 | } |
1220 | |
1221 | int __nft_release_basechain(struct nft_ctx *ctx); |
1222 | |
1223 | unsigned int nft_do_chain(struct nft_pktinfo *pkt, void *priv); |
1224 | |
1225 | static inline bool nft_use_inc(u32 *use) |
1226 | { |
1227 | if (*use == UINT_MAX) |
1228 | return false; |
1229 | |
1230 | (*use)++; |
1231 | |
1232 | return true; |
1233 | } |
1234 | |
1235 | static inline void nft_use_dec(u32 *use) |
1236 | { |
1237 | WARN_ON_ONCE((*use)-- == 0); |
1238 | } |
1239 | |
1240 | /* For error and abort path: restore use counter to previous state. */ |
1241 | static inline void nft_use_inc_restore(u32 *use) |
1242 | { |
1243 | WARN_ON_ONCE(!nft_use_inc(use)); |
1244 | } |
1245 | |
1246 | #define nft_use_dec_restore nft_use_dec |
1247 | |
1248 | /** |
1249 | * struct nft_table - nf_tables table |
1250 | * |
1251 | * @list: used internally |
1252 | * @chains_ht: chains in the table |
1253 | * @chains: same, for stable walks |
1254 | * @sets: sets in the table |
1255 | * @objects: stateful objects in the table |
1256 | * @flowtables: flow tables in the table |
1257 | * @hgenerator: handle generator state |
1258 | * @handle: table handle |
1259 | * @use: number of chain references to this table |
1260 | * @family:address family |
1261 | * @flags: table flag (see enum nft_table_flags) |
1262 | * @genmask: generation mask |
1263 | * @nlpid: netlink port ID |
1264 | * @name: name of the table |
1265 | * @udlen: length of the user data |
1266 | * @udata: user data |
1267 | * @validate_state: internal, set when transaction adds jumps |
1268 | */ |
1269 | struct nft_table { |
1270 | struct list_head list; |
1271 | struct rhltable chains_ht; |
1272 | struct list_head chains; |
1273 | struct list_head sets; |
1274 | struct list_head objects; |
1275 | struct list_head flowtables; |
1276 | u64 hgenerator; |
1277 | u64 handle; |
1278 | u32 use; |
1279 | u16 family:6, |
1280 | flags:8, |
1281 | genmask:2; |
1282 | u32 nlpid; |
1283 | char *name; |
1284 | u16 udlen; |
1285 | u8 *udata; |
1286 | u8 validate_state; |
1287 | }; |
1288 | |
1289 | static inline bool nft_table_has_owner(const struct nft_table *table) |
1290 | { |
1291 | return table->flags & NFT_TABLE_F_OWNER; |
1292 | } |
1293 | |
1294 | static inline bool nft_table_is_orphan(const struct nft_table *table) |
1295 | { |
1296 | return (table->flags & (NFT_TABLE_F_OWNER | NFT_TABLE_F_PERSIST)) == |
1297 | NFT_TABLE_F_PERSIST; |
1298 | } |
1299 | |
1300 | static inline bool nft_base_chain_netdev(int family, u32 hooknum) |
1301 | { |
1302 | return family == NFPROTO_NETDEV || |
1303 | (family == NFPROTO_INET && hooknum == NF_INET_INGRESS); |
1304 | } |
1305 | |
1306 | void nft_register_chain_type(const struct nft_chain_type *); |
1307 | void nft_unregister_chain_type(const struct nft_chain_type *); |
1308 | |
1309 | int nft_register_expr(struct nft_expr_type *); |
1310 | void nft_unregister_expr(struct nft_expr_type *); |
1311 | |
1312 | int nft_verdict_dump(struct sk_buff *skb, int type, |
1313 | const struct nft_verdict *v); |
1314 | |
1315 | /** |
1316 | * struct nft_object_hash_key - key to lookup nft_object |
1317 | * |
1318 | * @name: name of the stateful object to look up |
1319 | * @table: table the object belongs to |
1320 | */ |
1321 | struct nft_object_hash_key { |
1322 | const char *name; |
1323 | const struct nft_table *table; |
1324 | }; |
1325 | |
1326 | /** |
1327 | * struct nft_object - nf_tables stateful object |
1328 | * |
1329 | * @list: table stateful object list node |
1330 | * @rhlhead: nft_objname_ht node |
1331 | * @key: keys that identify this object |
1332 | * @genmask: generation mask |
1333 | * @use: number of references to this stateful object |
1334 | * @handle: unique object handle |
1335 | * @udlen: length of user data |
1336 | * @udata: user data |
1337 | * @ops: object operations |
1338 | * @data: object data, layout depends on type |
1339 | */ |
1340 | struct nft_object { |
1341 | struct list_head list; |
1342 | struct rhlist_head rhlhead; |
1343 | struct nft_object_hash_key key; |
1344 | u32 genmask:2; |
1345 | u32 use; |
1346 | u64 handle; |
1347 | u16 udlen; |
1348 | u8 *udata; |
1349 | /* runtime data below here */ |
1350 | const struct nft_object_ops *ops ____cacheline_aligned; |
1351 | unsigned char data[] |
1352 | __attribute__((aligned(__alignof__(u64)))); |
1353 | }; |
1354 | |
1355 | static inline void *nft_obj_data(const struct nft_object *obj) |
1356 | { |
1357 | return (void *)obj->data; |
1358 | } |
1359 | |
1360 | #define nft_expr_obj(expr) *((struct nft_object **)nft_expr_priv(expr)) |
1361 | |
1362 | struct nft_object *nft_obj_lookup(const struct net *net, |
1363 | const struct nft_table *table, |
1364 | const struct nlattr *nla, u32 objtype, |
1365 | u8 genmask); |
1366 | |
1367 | void nft_obj_notify(struct net *net, const struct nft_table *table, |
1368 | struct nft_object *obj, u32 portid, u32 seq, |
1369 | int event, u16 flags, int family, int report, gfp_t gfp); |
1370 | |
1371 | /** |
1372 | * struct nft_object_type - stateful object type |
1373 | * |
1374 | * @select_ops: function to select nft_object_ops |
1375 | * @ops: default ops, used when no select_ops functions is present |
1376 | * @list: list node in list of object types |
1377 | * @type: stateful object numeric type |
1378 | * @owner: module owner |
1379 | * @maxattr: maximum netlink attribute |
1380 | * @family: address family for AF-specific object types |
1381 | * @policy: netlink attribute policy |
1382 | */ |
1383 | struct nft_object_type { |
1384 | const struct nft_object_ops *(*select_ops)(const struct nft_ctx *, |
1385 | const struct nlattr * const tb[]); |
1386 | const struct nft_object_ops *ops; |
1387 | struct list_head list; |
1388 | u32 type; |
1389 | unsigned int maxattr; |
1390 | u8 family; |
1391 | struct module *owner; |
1392 | const struct nla_policy *policy; |
1393 | }; |
1394 | |
1395 | /** |
1396 | * struct nft_object_ops - stateful object operations |
1397 | * |
1398 | * @eval: stateful object evaluation function |
1399 | * @size: stateful object size |
1400 | * @init: initialize object from netlink attributes |
1401 | * @destroy: release existing stateful object |
1402 | * @dump: netlink dump stateful object |
1403 | * @update: update stateful object |
1404 | * @type: pointer to object type |
1405 | */ |
1406 | struct nft_object_ops { |
1407 | void (*eval)(struct nft_object *obj, |
1408 | struct nft_regs *regs, |
1409 | const struct nft_pktinfo *pkt); |
1410 | unsigned int size; |
1411 | int (*init)(const struct nft_ctx *ctx, |
1412 | const struct nlattr *const tb[], |
1413 | struct nft_object *obj); |
1414 | void (*destroy)(const struct nft_ctx *ctx, |
1415 | struct nft_object *obj); |
1416 | int (*dump)(struct sk_buff *skb, |
1417 | struct nft_object *obj, |
1418 | bool reset); |
1419 | void (*update)(struct nft_object *obj, |
1420 | struct nft_object *newobj); |
1421 | const struct nft_object_type *type; |
1422 | }; |
1423 | |
1424 | int nft_register_obj(struct nft_object_type *obj_type); |
1425 | void nft_unregister_obj(struct nft_object_type *obj_type); |
1426 | |
1427 | #define NFT_NETDEVICE_MAX 256 |
1428 | |
1429 | /** |
1430 | * struct nft_flowtable - nf_tables flow table |
1431 | * |
1432 | * @list: flow table list node in table list |
1433 | * @table: the table the flow table is contained in |
1434 | * @name: name of this flow table |
1435 | * @hooknum: hook number |
1436 | * @ops_len: number of hooks in array |
1437 | * @genmask: generation mask |
1438 | * @use: number of references to this flow table |
1439 | * @handle: unique object handle |
1440 | * @hook_list: hook list for hooks per net_device in flowtables |
1441 | * @data: rhashtable and garbage collector |
1442 | */ |
1443 | struct nft_flowtable { |
1444 | struct list_head list; |
1445 | struct nft_table *table; |
1446 | char *name; |
1447 | int hooknum; |
1448 | int ops_len; |
1449 | u32 genmask:2; |
1450 | u32 use; |
1451 | u64 handle; |
1452 | /* runtime data below here */ |
1453 | struct list_head hook_list ____cacheline_aligned; |
1454 | struct nf_flowtable data; |
1455 | }; |
1456 | |
1457 | struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table, |
1458 | const struct nlattr *nla, |
1459 | u8 genmask); |
1460 | |
1461 | void nf_tables_deactivate_flowtable(const struct nft_ctx *ctx, |
1462 | struct nft_flowtable *flowtable, |
1463 | enum nft_trans_phase phase); |
1464 | |
1465 | void nft_register_flowtable_type(struct nf_flowtable_type *type); |
1466 | void nft_unregister_flowtable_type(struct nf_flowtable_type *type); |
1467 | |
1468 | /** |
1469 | * struct nft_traceinfo - nft tracing information and state |
1470 | * |
1471 | * @trace: other struct members are initialised |
1472 | * @nf_trace: copy of skb->nf_trace before rule evaluation |
1473 | * @type: event type (enum nft_trace_types) |
1474 | * @skbid: hash of skb to be used as trace id |
1475 | * @packet_dumped: packet headers sent in a previous traceinfo message |
1476 | * @basechain: base chain currently processed |
1477 | */ |
1478 | struct nft_traceinfo { |
1479 | bool trace; |
1480 | bool nf_trace; |
1481 | bool packet_dumped; |
1482 | enum nft_trace_types type:8; |
1483 | u32 skbid; |
1484 | const struct nft_base_chain *basechain; |
1485 | }; |
1486 | |
1487 | void nft_trace_init(struct nft_traceinfo *info, const struct nft_pktinfo *pkt, |
1488 | const struct nft_chain *basechain); |
1489 | |
1490 | void nft_trace_notify(const struct nft_pktinfo *pkt, |
1491 | const struct nft_verdict *verdict, |
1492 | const struct nft_rule_dp *rule, |
1493 | struct nft_traceinfo *info); |
1494 | |
1495 | #define MODULE_ALIAS_NFT_CHAIN(family, name) \ |
1496 | MODULE_ALIAS("nft-chain-" __stringify(family) "-" name) |
1497 | |
1498 | #define MODULE_ALIAS_NFT_AF_EXPR(family, name) \ |
1499 | MODULE_ALIAS("nft-expr-" __stringify(family) "-" name) |
1500 | |
1501 | #define MODULE_ALIAS_NFT_EXPR(name) \ |
1502 | MODULE_ALIAS("nft-expr-" name) |
1503 | |
1504 | #define MODULE_ALIAS_NFT_OBJ(type) \ |
1505 | MODULE_ALIAS("nft-obj-" __stringify(type)) |
1506 | |
1507 | #if IS_ENABLED(CONFIG_NF_TABLES) |
1508 | |
1509 | /* |
1510 | * The gencursor defines two generations, the currently active and the |
1511 | * next one. Objects contain a bitmask of 2 bits specifying the generations |
1512 | * they're active in. A set bit means they're inactive in the generation |
1513 | * represented by that bit. |
1514 | * |
1515 | * New objects start out as inactive in the current and active in the |
1516 | * next generation. When committing the ruleset the bitmask is cleared, |
1517 | * meaning they're active in all generations. When removing an object, |
1518 | * it is set inactive in the next generation. After committing the ruleset, |
1519 | * the objects are removed. |
1520 | */ |
1521 | static inline unsigned int nft_gencursor_next(const struct net *net) |
1522 | { |
1523 | return net->nft.gencursor + 1 == 1 ? 1 : 0; |
1524 | } |
1525 | |
1526 | static inline u8 nft_genmask_next(const struct net *net) |
1527 | { |
1528 | return 1 << nft_gencursor_next(net); |
1529 | } |
1530 | |
1531 | static inline u8 nft_genmask_cur(const struct net *net) |
1532 | { |
1533 | /* Use READ_ONCE() to prevent refetching the value for atomicity */ |
1534 | return 1 << READ_ONCE(net->nft.gencursor); |
1535 | } |
1536 | |
1537 | #define NFT_GENMASK_ANY ((1 << 0) | (1 << 1)) |
1538 | |
1539 | /* |
1540 | * Generic transaction helpers |
1541 | */ |
1542 | |
1543 | /* Check if this object is currently active. */ |
1544 | #define nft_is_active(__net, __obj) \ |
1545 | (((__obj)->genmask & nft_genmask_cur(__net)) == 0) |
1546 | |
1547 | /* Check if this object is active in the next generation. */ |
1548 | #define nft_is_active_next(__net, __obj) \ |
1549 | (((__obj)->genmask & nft_genmask_next(__net)) == 0) |
1550 | |
1551 | /* This object becomes active in the next generation. */ |
1552 | #define nft_activate_next(__net, __obj) \ |
1553 | (__obj)->genmask = nft_genmask_cur(__net) |
1554 | |
1555 | /* This object becomes inactive in the next generation. */ |
1556 | #define nft_deactivate_next(__net, __obj) \ |
1557 | (__obj)->genmask = nft_genmask_next(__net) |
1558 | |
1559 | /* After committing the ruleset, clear the stale generation bit. */ |
1560 | #define nft_clear(__net, __obj) \ |
1561 | (__obj)->genmask &= ~nft_genmask_next(__net) |
1562 | #define nft_active_genmask(__obj, __genmask) \ |
1563 | !((__obj)->genmask & __genmask) |
1564 | |
1565 | /* |
1566 | * Set element transaction helpers |
1567 | */ |
1568 | |
1569 | static inline bool nft_set_elem_active(const struct nft_set_ext *ext, |
1570 | u8 genmask) |
1571 | { |
1572 | return !(ext->genmask & genmask); |
1573 | } |
1574 | |
1575 | static inline void nft_set_elem_change_active(const struct net *net, |
1576 | const struct nft_set *set, |
1577 | struct nft_set_ext *ext) |
1578 | { |
1579 | ext->genmask ^= nft_genmask_next(net); |
1580 | } |
1581 | |
1582 | #endif /* IS_ENABLED(CONFIG_NF_TABLES) */ |
1583 | |
1584 | #define NFT_SET_ELEM_DEAD_MASK (1 << 2) |
1585 | |
1586 | #if defined(__LITTLE_ENDIAN_BITFIELD) |
1587 | #define NFT_SET_ELEM_DEAD_BIT 2 |
1588 | #elif defined(__BIG_ENDIAN_BITFIELD) |
1589 | #define NFT_SET_ELEM_DEAD_BIT (BITS_PER_LONG - BITS_PER_BYTE + 2) |
1590 | #else |
1591 | #error |
1592 | #endif |
1593 | |
1594 | static inline void nft_set_elem_dead(struct nft_set_ext *ext) |
1595 | { |
1596 | unsigned long *word = (unsigned long *)ext; |
1597 | |
1598 | BUILD_BUG_ON(offsetof(struct nft_set_ext, genmask) != 0); |
1599 | set_bit(NFT_SET_ELEM_DEAD_BIT, word); |
1600 | } |
1601 | |
1602 | static inline int nft_set_elem_is_dead(const struct nft_set_ext *ext) |
1603 | { |
1604 | unsigned long *word = (unsigned long *)ext; |
1605 | |
1606 | BUILD_BUG_ON(offsetof(struct nft_set_ext, genmask) != 0); |
1607 | return test_bit(NFT_SET_ELEM_DEAD_BIT, word); |
1608 | } |
1609 | |
1610 | /** |
1611 | * struct nft_trans - nf_tables object update in transaction |
1612 | * |
1613 | * @list: used internally |
1614 | * @binding_list: list of objects with possible bindings |
1615 | * @msg_type: message type |
1616 | * @put_net: ctx->net needs to be put |
1617 | * @ctx: transaction context |
1618 | * @data: internal information related to the transaction |
1619 | */ |
1620 | struct nft_trans { |
1621 | struct list_head list; |
1622 | struct list_head binding_list; |
1623 | int msg_type; |
1624 | bool put_net; |
1625 | struct nft_ctx ctx; |
1626 | char data[]; |
1627 | }; |
1628 | |
1629 | struct nft_trans_rule { |
1630 | struct nft_rule *rule; |
1631 | struct nft_flow_rule *flow; |
1632 | u32 rule_id; |
1633 | bool bound; |
1634 | }; |
1635 | |
1636 | #define nft_trans_rule(trans) \ |
1637 | (((struct nft_trans_rule *)trans->data)->rule) |
1638 | #define nft_trans_flow_rule(trans) \ |
1639 | (((struct nft_trans_rule *)trans->data)->flow) |
1640 | #define nft_trans_rule_id(trans) \ |
1641 | (((struct nft_trans_rule *)trans->data)->rule_id) |
1642 | #define nft_trans_rule_bound(trans) \ |
1643 | (((struct nft_trans_rule *)trans->data)->bound) |
1644 | |
1645 | struct nft_trans_set { |
1646 | struct nft_set *set; |
1647 | u32 set_id; |
1648 | u32 gc_int; |
1649 | u64 timeout; |
1650 | bool update; |
1651 | bool bound; |
1652 | u32 size; |
1653 | }; |
1654 | |
1655 | #define nft_trans_set(trans) \ |
1656 | (((struct nft_trans_set *)trans->data)->set) |
1657 | #define nft_trans_set_id(trans) \ |
1658 | (((struct nft_trans_set *)trans->data)->set_id) |
1659 | #define nft_trans_set_bound(trans) \ |
1660 | (((struct nft_trans_set *)trans->data)->bound) |
1661 | #define nft_trans_set_update(trans) \ |
1662 | (((struct nft_trans_set *)trans->data)->update) |
1663 | #define nft_trans_set_timeout(trans) \ |
1664 | (((struct nft_trans_set *)trans->data)->timeout) |
1665 | #define nft_trans_set_gc_int(trans) \ |
1666 | (((struct nft_trans_set *)trans->data)->gc_int) |
1667 | #define nft_trans_set_size(trans) \ |
1668 | (((struct nft_trans_set *)trans->data)->size) |
1669 | |
1670 | struct nft_trans_chain { |
1671 | struct nft_chain *chain; |
1672 | bool update; |
1673 | char *name; |
1674 | struct nft_stats __percpu *stats; |
1675 | u8 policy; |
1676 | bool bound; |
1677 | u32 chain_id; |
1678 | struct nft_base_chain *basechain; |
1679 | struct list_head hook_list; |
1680 | }; |
1681 | |
1682 | #define nft_trans_chain(trans) \ |
1683 | (((struct nft_trans_chain *)trans->data)->chain) |
1684 | #define nft_trans_chain_update(trans) \ |
1685 | (((struct nft_trans_chain *)trans->data)->update) |
1686 | #define nft_trans_chain_name(trans) \ |
1687 | (((struct nft_trans_chain *)trans->data)->name) |
1688 | #define nft_trans_chain_stats(trans) \ |
1689 | (((struct nft_trans_chain *)trans->data)->stats) |
1690 | #define nft_trans_chain_policy(trans) \ |
1691 | (((struct nft_trans_chain *)trans->data)->policy) |
1692 | #define nft_trans_chain_bound(trans) \ |
1693 | (((struct nft_trans_chain *)trans->data)->bound) |
1694 | #define nft_trans_chain_id(trans) \ |
1695 | (((struct nft_trans_chain *)trans->data)->chain_id) |
1696 | #define nft_trans_basechain(trans) \ |
1697 | (((struct nft_trans_chain *)trans->data)->basechain) |
1698 | #define nft_trans_chain_hooks(trans) \ |
1699 | (((struct nft_trans_chain *)trans->data)->hook_list) |
1700 | |
1701 | struct nft_trans_table { |
1702 | bool update; |
1703 | }; |
1704 | |
1705 | #define nft_trans_table_update(trans) \ |
1706 | (((struct nft_trans_table *)trans->data)->update) |
1707 | |
1708 | struct nft_trans_elem { |
1709 | struct nft_set *set; |
1710 | struct nft_elem_priv *elem_priv; |
1711 | bool bound; |
1712 | }; |
1713 | |
1714 | #define nft_trans_elem_set(trans) \ |
1715 | (((struct nft_trans_elem *)trans->data)->set) |
1716 | #define nft_trans_elem_priv(trans) \ |
1717 | (((struct nft_trans_elem *)trans->data)->elem_priv) |
1718 | #define nft_trans_elem_set_bound(trans) \ |
1719 | (((struct nft_trans_elem *)trans->data)->bound) |
1720 | |
1721 | struct nft_trans_obj { |
1722 | struct nft_object *obj; |
1723 | struct nft_object *newobj; |
1724 | bool update; |
1725 | }; |
1726 | |
1727 | #define nft_trans_obj(trans) \ |
1728 | (((struct nft_trans_obj *)trans->data)->obj) |
1729 | #define nft_trans_obj_newobj(trans) \ |
1730 | (((struct nft_trans_obj *)trans->data)->newobj) |
1731 | #define nft_trans_obj_update(trans) \ |
1732 | (((struct nft_trans_obj *)trans->data)->update) |
1733 | |
1734 | struct nft_trans_flowtable { |
1735 | struct nft_flowtable *flowtable; |
1736 | bool update; |
1737 | struct list_head hook_list; |
1738 | u32 flags; |
1739 | }; |
1740 | |
1741 | #define nft_trans_flowtable(trans) \ |
1742 | (((struct nft_trans_flowtable *)trans->data)->flowtable) |
1743 | #define nft_trans_flowtable_update(trans) \ |
1744 | (((struct nft_trans_flowtable *)trans->data)->update) |
1745 | #define nft_trans_flowtable_hooks(trans) \ |
1746 | (((struct nft_trans_flowtable *)trans->data)->hook_list) |
1747 | #define nft_trans_flowtable_flags(trans) \ |
1748 | (((struct nft_trans_flowtable *)trans->data)->flags) |
1749 | |
1750 | #define NFT_TRANS_GC_BATCHCOUNT 256 |
1751 | |
1752 | struct nft_trans_gc { |
1753 | struct list_head list; |
1754 | struct net *net; |
1755 | struct nft_set *set; |
1756 | u32 seq; |
1757 | u16 count; |
1758 | struct nft_elem_priv *priv[NFT_TRANS_GC_BATCHCOUNT]; |
1759 | struct rcu_head rcu; |
1760 | }; |
1761 | |
1762 | struct nft_trans_gc *nft_trans_gc_alloc(struct nft_set *set, |
1763 | unsigned int gc_seq, gfp_t gfp); |
1764 | void nft_trans_gc_destroy(struct nft_trans_gc *trans); |
1765 | |
1766 | struct nft_trans_gc *nft_trans_gc_queue_async(struct nft_trans_gc *gc, |
1767 | unsigned int gc_seq, gfp_t gfp); |
1768 | void nft_trans_gc_queue_async_done(struct nft_trans_gc *gc); |
1769 | |
1770 | struct nft_trans_gc *nft_trans_gc_queue_sync(struct nft_trans_gc *gc, gfp_t gfp); |
1771 | void nft_trans_gc_queue_sync_done(struct nft_trans_gc *trans); |
1772 | |
1773 | void nft_trans_gc_elem_add(struct nft_trans_gc *gc, void *priv); |
1774 | |
1775 | struct nft_trans_gc *nft_trans_gc_catchall_async(struct nft_trans_gc *gc, |
1776 | unsigned int gc_seq); |
1777 | struct nft_trans_gc *nft_trans_gc_catchall_sync(struct nft_trans_gc *gc); |
1778 | |
1779 | void nft_setelem_data_deactivate(const struct net *net, |
1780 | const struct nft_set *set, |
1781 | struct nft_elem_priv *elem_priv); |
1782 | |
1783 | int __init nft_chain_filter_init(void); |
1784 | void nft_chain_filter_fini(void); |
1785 | |
1786 | void __init nft_chain_route_init(void); |
1787 | void nft_chain_route_fini(void); |
1788 | |
1789 | void nf_tables_trans_destroy_flush_work(void); |
1790 | |
1791 | int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result); |
1792 | __be64 nf_jiffies64_to_msecs(u64 input); |
1793 | |
1794 | #ifdef CONFIG_MODULES |
1795 | __printf(2, 3) int nft_request_module(struct net *net, const char *fmt, ...); |
1796 | #else |
1797 | static inline int nft_request_module(struct net *net, const char *fmt, ...) { return -ENOENT; } |
1798 | #endif |
1799 | |
1800 | struct nftables_pernet { |
1801 | struct list_head tables; |
1802 | struct list_head commit_list; |
1803 | struct list_head binding_list; |
1804 | struct list_head module_list; |
1805 | struct list_head notify_list; |
1806 | struct mutex commit_mutex; |
1807 | u64 table_handle; |
1808 | u64 tstamp; |
1809 | unsigned int base_seq; |
1810 | unsigned int gc_seq; |
1811 | u8 validate_state; |
1812 | }; |
1813 | |
1814 | extern unsigned int nf_tables_net_id; |
1815 | |
1816 | static inline struct nftables_pernet *nft_pernet(const struct net *net) |
1817 | { |
1818 | return net_generic(net, nf_tables_net_id); |
1819 | } |
1820 | |
1821 | static inline u64 nft_net_tstamp(const struct net *net) |
1822 | { |
1823 | return nft_pernet(net)->tstamp; |
1824 | } |
1825 | |
1826 | #define __NFT_REDUCE_READONLY 1UL |
1827 | #define NFT_REDUCE_READONLY (void *)__NFT_REDUCE_READONLY |
1828 | |
1829 | static inline bool nft_reduce_is_readonly(const struct nft_expr *expr) |
1830 | { |
1831 | return expr->ops->reduce == NFT_REDUCE_READONLY; |
1832 | } |
1833 | |
1834 | void nft_reg_track_update(struct nft_regs_track *track, |
1835 | const struct nft_expr *expr, u8 dreg, u8 len); |
1836 | void nft_reg_track_cancel(struct nft_regs_track *track, u8 dreg, u8 len); |
1837 | void __nft_reg_track_cancel(struct nft_regs_track *track, u8 dreg); |
1838 | |
1839 | static inline bool nft_reg_track_cmp(struct nft_regs_track *track, |
1840 | const struct nft_expr *expr, u8 dreg) |
1841 | { |
1842 | return track->regs[dreg].selector && |
1843 | track->regs[dreg].selector->ops == expr->ops && |
1844 | track->regs[dreg].num_reg == 0; |
1845 | } |
1846 | |
1847 | #endif /* _NET_NF_TABLES_H */ |
1848 |
Warning: This file is not a C or C++ file. It does not have highlighting.