[GitHub/mt8127/android_kernel_alcatel_ttab.git] / include / linux / netfilter.h

#ifndef __LINUX_NETFILTER_H
#define __LINUX_NETFILTER_H

#ifdef __KERNEL__
#include <linux/init.h>
#include <linux/types.h>
#include <linux/skbuff.h>
#include <linux/net.h>
#include <linux/if.h>
#include <linux/wait.h>
#include <linux/list.h>
#endif
#include <linux/compiler.h>

/* Responses from hook functions. */
#define NF_DROP 0
#define NF_ACCEPT 1
#define NF_STOLEN 2
#define NF_QUEUE 3
#define NF_REPEAT 4
#define NF_STOP 5
#define NF_MAX_VERDICT NF_STOP

/* we overload the higher bits for encoding auxiliary data such as the queue
 * number. Not nice, but better than additional function arguments. */
#define NF_VERDICT_MASK 0x0000ffff
#define NF_VERDICT_BITS 16

#define NF_VERDICT_QMASK 0xffff0000
#define NF_VERDICT_QBITS 16

#define NF_QUEUE_NR(x) (((x << NF_VERDICT_QBITS) & NF_VERDICT_QMASK) | NF_QUEUE)

/* only for userspace compatibility */
#ifndef __KERNEL__
/* Generic cache responses from hook functions.
   <= 0x2000 is used for protocol-flags. */
#define NFC_UNKNOWN 0x4000
#define NFC_ALTERED 0x8000
#endif

#ifdef __KERNEL__
#include <linux/config.h>
#ifdef CONFIG_NETFILTER

extern void netfilter_init(void);

/* Largest hook number + 1 */
#define NF_MAX_HOOKS 8

struct sk_buff;
struct net_device;

typedef unsigned int nf_hookfn(unsigned int hooknum,
			       struct sk_buff **skb,
			       const struct net_device *in,
			       const struct net_device *out,
			       int (*okfn)(struct sk_buff *));

struct nf_hook_ops
{
	struct list_head list;

	/* User fills in from here down. */
	nf_hookfn *hook;
	struct module *owner;
	int pf;
	int hooknum;
	/* Hooks are ordered in ascending priority. */
	int priority;
};

struct nf_sockopt_ops
{
	struct list_head list;

	int pf;

	/* Non-inclusive ranges: use 0/0/NULL to never get called. */
	int set_optmin;
	int set_optmax;
	int (*set)(struct sock *sk, int optval, void __user *user, unsigned int len);

	int get_optmin;
	int get_optmax;
	int (*get)(struct sock *sk, int optval, void __user *user, int *len);

	/* Number of users inside set() or get(). */
	unsigned int use;
	struct task_struct *cleanup_task;
};

/* Each queued (to userspace) skbuff has one of these. */
struct nf_info
{
	/* The ops struct which sent us to userspace. */
	struct nf_hook_ops *elem;
	
	/* If we're sent to userspace, this keeps housekeeping info */
	int pf;
	unsigned int hook;
	struct net_device *indev, *outdev;
	int (*okfn)(struct sk_buff *);
};
                                                                                
/* Function to register/unregister hook points. */
int nf_register_hook(struct nf_hook_ops *reg);
void nf_unregister_hook(struct nf_hook_ops *reg);

/* Functions to register get/setsockopt ranges (non-inclusive).  You
   need to check permissions yourself! */
int nf_register_sockopt(struct nf_sockopt_ops *reg);
void nf_unregister_sockopt(struct nf_sockopt_ops *reg);

extern struct list_head nf_hooks[NPROTO][NF_MAX_HOOKS];

/* those NF_LOG_* defines and struct nf_loginfo are legacy definitios that will
 * disappear once iptables is replaced with pkttables.  Please DO NOT use them
 * for any new code! */
#define NF_LOG_TCPSEQ		0x01	/* Log TCP sequence numbers */
#define NF_LOG_TCPOPT		0x02	/* Log TCP options */
#define NF_LOG_IPOPT		0x04	/* Log IP options */
#define NF_LOG_UID		0x08	/* Log UID owning local socket */
#define NF_LOG_MASK		0x0f

#define NF_LOG_TYPE_LOG		0x01
#define NF_LOG_TYPE_ULOG	0x02

struct nf_loginfo {
	u_int8_t type;
	union {
		struct {
			u_int32_t copy_len;
			u_int16_t group;
			u_int16_t qthreshold;
		} ulog;
		struct {
			u_int8_t level;
			u_int8_t logflags;
		} log;
	} u;
};

typedef void nf_logfn(unsigned int pf,
		      unsigned int hooknum,
		      const struct sk_buff *skb,
		      const struct net_device *in,
		      const struct net_device *out,
		      const struct nf_loginfo *li,
		      const char *prefix);

struct nf_logger {
	struct module	*me;
	nf_logfn 	*logfn;
	char		*name;
};

/* Function to register/unregister log function. */
int nf_log_register(int pf, struct nf_logger *logger);
int nf_log_unregister_pf(int pf);
void nf_log_unregister_logger(struct nf_logger *logger);

/* Calls the registered backend logging function */
void nf_log_packet(int pf,
		   unsigned int hooknum,
		   const struct sk_buff *skb,
		   const struct net_device *in,
		   const struct net_device *out,
		   struct nf_loginfo *li,
		   const char *fmt, ...);
                   
/* Activate hook; either okfn or kfree_skb called, unless a hook
   returns NF_STOLEN (in which case, it's up to the hook to deal with
   the consequences).

   Returns -ERRNO if packet dropped.  Zero means queued, stolen or
   accepted.
*/

/* RR:
   > I don't want nf_hook to return anything because people might forget
   > about async and trust the return value to mean "packet was ok".

   AK:
   Just document it clearly, then you can expect some sense from kernel
   coders :)
*/

/* This is gross, but inline doesn't cut it for avoiding the function
   call in fast path: gcc doesn't inline (needs value tracking?). --RR */
#ifdef CONFIG_NETFILTER_DEBUG
#define NF_HOOK(pf, hook, skb, indev, outdev, okfn)			       \
({int __ret;								       \
if ((__ret=nf_hook_slow(pf, hook, &(skb), indev, outdev, okfn, INT_MIN)) == 1) \
	__ret = (okfn)(skb);						       \
__ret;})
#define NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, thresh)	       \
({int __ret;								       \
if ((__ret=nf_hook_slow(pf, hook, &(skb), indev, outdev, okfn, thresh)) == 1)  \
	__ret = (okfn)(skb);						       \
__ret;})
#else
#define NF_HOOK(pf, hook, skb, indev, outdev, okfn)			       \
({int __ret;								       \
if (list_empty(&nf_hooks[pf][hook]) ||					       \
    (__ret=nf_hook_slow(pf, hook, &(skb), indev, outdev, okfn, INT_MIN)) == 1) \
	__ret = (okfn)(skb);						       \
__ret;})
#define NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, thresh)	       \
({int __ret;								       \
if (list_empty(&nf_hooks[pf][hook]) ||					       \
    (__ret=nf_hook_slow(pf, hook, &(skb), indev, outdev, okfn, thresh)) == 1)  \
	__ret = (okfn)(skb);						       \
__ret;})
#endif

int nf_hook_slow(int pf, unsigned int hook, struct sk_buff **pskb,
		 struct net_device *indev, struct net_device *outdev,
		 int (*okfn)(struct sk_buff *), int thresh);

/* Call setsockopt() */
int nf_setsockopt(struct sock *sk, int pf, int optval, char __user *opt, 
		  int len);
int nf_getsockopt(struct sock *sk, int pf, int optval, char __user *opt,
		  int *len);

/* Packet queuing */
struct nf_queue_handler {
	int (*outfn)(struct sk_buff *skb, struct nf_info *info,
		     unsigned int queuenum, void *data);
	void *data;
	char *name;
};
extern int nf_register_queue_handler(int pf, 
                                     struct nf_queue_handler *qh);
extern int nf_unregister_queue_handler(int pf);
extern void nf_unregister_queue_handlers(struct nf_queue_handler *qh);
extern void nf_reinject(struct sk_buff *skb,
			struct nf_info *info,
			unsigned int verdict);

extern void (*ip_ct_attach)(struct sk_buff *, struct sk_buff *);
extern void nf_ct_attach(struct sk_buff *, struct sk_buff *);

/* FIXME: Before cache is ever used, this must be implemented for real. */
extern void nf_invalidate_cache(int pf);

/* Call this before modifying an existing packet: ensures it is
   modifiable and linear to the point you care about (writable_len).
   Returns true or false. */
extern int skb_make_writable(struct sk_buff **pskb, unsigned int writable_len);

struct nf_queue_rerouter {
	void (*save)(const struct sk_buff *skb, struct nf_info *info);
	int (*reroute)(struct sk_buff **skb, const struct nf_info *info);
	int rer_size;
};

#define nf_info_reroute(x) ((void *)x + sizeof(struct nf_info))

extern int nf_register_queue_rerouter(int pf, struct nf_queue_rerouter *rer);
extern int nf_unregister_queue_rerouter(int pf);

#ifdef CONFIG_PROC_FS
#include <linux/proc_fs.h>
extern struct proc_dir_entry *proc_net_netfilter;
#endif

#else /* !CONFIG_NETFILTER */
#define NF_HOOK(pf, hook, skb, indev, outdev, okfn) (okfn)(skb)
static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {}
#endif /*CONFIG_NETFILTER*/

#endif /*__KERNEL__*/
#endif /*__LINUX_NETFILTER_H*/
Commit	Line	Data
1da177e4 LT	1	#ifndef __LINUX_NETFILTER_H
	2	#define __LINUX_NETFILTER_H
	3
	4	#ifdef __KERNEL__
	5	#include <linux/init.h>
	6	#include <linux/types.h>
	7	#include <linux/skbuff.h>
	8	#include <linux/net.h>
	9	#include <linux/if.h>
	10	#include <linux/wait.h>
	11	#include <linux/list.h>
	12	#endif
	13	#include <linux/compiler.h>
	14
	15	/* Responses from hook functions. */
	16	#define NF_DROP 0
	17	#define NF_ACCEPT 1
	18	#define NF_STOLEN 2
	19	#define NF_QUEUE 3
	20	#define NF_REPEAT 4
	21	#define NF_STOP 5
	22	#define NF_MAX_VERDICT NF_STOP
	23
0ab43f84 HW	24	/* we overload the higher bits for encoding auxiliary data such as the queue
	25	* number. Not nice, but better than additional function arguments. */
	26	#define NF_VERDICT_MASK 0x0000ffff
	27	#define NF_VERDICT_BITS 16
	28
	29	#define NF_VERDICT_QMASK 0xffff0000
	30	#define NF_VERDICT_QBITS 16
	31
b766b305	32	#define NF_QUEUE_NR(x) (((x << NF_VERDICT_QBITS) & NF_VERDICT_QMASK) \| NF_QUEUE)
0ab43f84	33
6869c4d8 HW	34	/* only for userspace compatibility */
6869c4d8 HW	35	#ifndef __KERNEL__
1da177e4 LT	36	/* Generic cache responses from hook functions.
	37	<= 0x2000 is used for protocol-flags. */
	38	#define NFC_UNKNOWN 0x4000
	39	#define NFC_ALTERED 0x8000
6869c4d8	40	#endif
1da177e4 LT	41
	42	#ifdef __KERNEL__
	43	#include <linux/config.h>
	44	#ifdef CONFIG_NETFILTER
	45
	46	extern void netfilter_init(void);
	47
	48	/* Largest hook number + 1 */
	49	#define NF_MAX_HOOKS 8
	50
	51	struct sk_buff;
	52	struct net_device;
	53
	54	typedef unsigned int nf_hookfn(unsigned int hooknum,
	55	struct sk_buff **skb,
	56	const struct net_device *in,
	57	const struct net_device *out,
	58	int (okfn)(struct sk_buff ));
	59
	60	struct nf_hook_ops
	61	{
	62	struct list_head list;
	63
	64	/* User fills in from here down. */
	65	nf_hookfn *hook;
	66	struct module *owner;
	67	int pf;
	68	int hooknum;
	69	/* Hooks are ordered in ascending priority. */
	70	int priority;
	71	};
	72
	73	struct nf_sockopt_ops
	74	{
	75	struct list_head list;
	76
	77	int pf;
	78
	79	/* Non-inclusive ranges: use 0/0/NULL to never get called. */
	80	int set_optmin;
	81	int set_optmax;
	82	int (set)(struct sock sk, int optval, void __user *user, unsigned int len);
	83
	84	int get_optmin;
	85	int get_optmax;
	86	int (get)(struct sock sk, int optval, void __user user, int len);
	87
	88	/* Number of users inside set() or get(). */
	89	unsigned int use;
	90	struct task_struct *cleanup_task;
	91	};
	92
	93	/* Each queued (to userspace) skbuff has one of these. */
	94	struct nf_info
	95	{
	96	/* The ops struct which sent us to userspace. */
	97	struct nf_hook_ops *elem;
	98
	99	/* If we're sent to userspace, this keeps housekeeping info */
	100	int pf;
	101	unsigned int hook;
	102	struct net_device indev, outdev;
	103	int (okfn)(struct sk_buff );
	104	};
105
106	/* Function to register/unregister hook points. */
107	int nf_register_hook(struct nf_hook_ops *reg);
108	void nf_unregister_hook(struct nf_hook_ops *reg);
109
110	/* Functions to register get/setsockopt ranges (non-inclusive). You
111	need to check permissions yourself! */
112	int nf_register_sockopt(struct nf_sockopt_ops *reg);
113	void nf_unregister_sockopt(struct nf_sockopt_ops *reg);
114
115	extern struct list_head nf_hooks[NPROTO][NF_MAX_HOOKS];
116
608c8e4f HW	117	/* those NF_LOG_* defines and struct nf_loginfo are legacy definitios that will
	118	* disappear once iptables is replaced with pkttables. Please DO NOT use them
	119	* for any new code! */
	120	#define NF_LOG_TCPSEQ 0x01 /* Log TCP sequence numbers */
	121	#define NF_LOG_TCPOPT 0x02 /* Log TCP options */
	122	#define NF_LOG_IPOPT 0x04 /* Log IP options */
	123	#define NF_LOG_UID 0x08 /* Log UID owning local socket */
	124	#define NF_LOG_MASK 0x0f
	125
	126	#define NF_LOG_TYPE_LOG 0x01
	127	#define NF_LOG_TYPE_ULOG 0x02
	128
	129	struct nf_loginfo {
	130	u_int8_t type;
	131	union {
	132	struct {
	133	u_int32_t copy_len;
	134	u_int16_t group;
	135	u_int16_t qthreshold;
	136	} ulog;
	137	struct {
	138	u_int8_t level;
	139	u_int8_t logflags;
	140	} log;
	141	} u;
	142	};
	143
	144	typedef void nf_logfn(unsigned int pf,
	145	unsigned int hooknum,
1da177e4 LT	146	const struct sk_buff *skb,
	147	const struct net_device *in,
	148	const struct net_device *out,
608c8e4f	149	const struct nf_loginfo *li,
1da177e4 LT	150	const char *prefix);
1da177e4 LT	151
608c8e4f HW	152	struct nf_logger {
	153	struct module *me;
	154	nf_logfn *logfn;
	155	char *name;
	156	};
	157
1da177e4	158	/* Function to register/unregister log function. */
608c8e4f	159	int nf_log_register(int pf, struct nf_logger *logger);
8a61fadb	160	int nf_log_unregister_pf(int pf);
608c8e4f	161	void nf_log_unregister_logger(struct nf_logger *logger);
1da177e4 LT	162
	163	/* Calls the registered backend logging function */
	164	void nf_log_packet(int pf,
	165	unsigned int hooknum,
	166	const struct sk_buff *skb,
	167	const struct net_device *in,
	168	const struct net_device *out,
608c8e4f	169	struct nf_loginfo *li,
1da177e4 LT	170	const char *fmt, ...);
	171
	172	/* Activate hook; either okfn or kfree_skb called, unless a hook
	173	returns NF_STOLEN (in which case, it's up to the hook to deal with
	174	the consequences).
	175
	176	Returns -ERRNO if packet dropped. Zero means queued, stolen or
	177	accepted.
	178	*/
	179
	180	/* RR:
	181	> I don't want nf_hook to return anything because people might forget
	182	> about async and trust the return value to mean "packet was ok".
	183
	184	AK:
	185	Just document it clearly, then you can expect some sense from kernel
	186	coders :)
	187	*/
	188
	189	/* This is gross, but inline doesn't cut it for avoiding the function
	190	call in fast path: gcc doesn't inline (needs value tracking?). --RR */
	191	#ifdef CONFIG_NETFILTER_DEBUG
	192	#define NF_HOOK(pf, hook, skb, indev, outdev, okfn) \
	193	({int __ret; \
	194	if ((__ret=nf_hook_slow(pf, hook, &(skb), indev, outdev, okfn, INT_MIN)) == 1) \
	195	__ret = (okfn)(skb); \
	196	__ret;})
	197	#define NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, thresh) \
	198	({int __ret; \
	199	if ((__ret=nf_hook_slow(pf, hook, &(skb), indev, outdev, okfn, thresh)) == 1) \
	200	__ret = (okfn)(skb); \
	201	__ret;})
	202	#else
	203	#define NF_HOOK(pf, hook, skb, indev, outdev, okfn) \
	204	({int __ret; \
	205	if (list_empty(&nf_hooks[pf][hook]) \|\| \
	206	(__ret=nf_hook_slow(pf, hook, &(skb), indev, outdev, okfn, INT_MIN)) == 1) \
	207	__ret = (okfn)(skb); \
	208	__ret;})
	209	#define NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, thresh) \
	210	({int __ret; \
	211	if (list_empty(&nf_hooks[pf][hook]) \|\| \
	212	(__ret=nf_hook_slow(pf, hook, &(skb), indev, outdev, okfn, thresh)) == 1) \
	213	__ret = (okfn)(skb); \
	214	__ret;})
	215	#endif
	216
	217	int nf_hook_slow(int pf, unsigned int hook, struct sk_buff **pskb,
	218	struct net_device indev, struct net_device outdev,
	219	int (okfn)(struct sk_buff ), int thresh);
	220
	221	/* Call setsockopt() */
	222	int nf_setsockopt(struct sock sk, int pf, int optval, char __user opt,
	223	int len);
	224	int nf_getsockopt(struct sock sk, int pf, int optval, char __user opt,
	225	int *len);
	226
	227	/* Packet queuing */
bbd86b9f HW	228	struct nf_queue_handler {
	229	int (outfn)(struct sk_buff skb, struct nf_info *info,
	230	unsigned int queuenum, void *data);
	231	void *data;
	232	char *name;
	233	};
1da177e4	234	extern int nf_register_queue_handler(int pf,
bbd86b9f	235	struct nf_queue_handler *qh);
1da177e4	236	extern int nf_unregister_queue_handler(int pf);
bbd86b9f	237	extern void nf_unregister_queue_handlers(struct nf_queue_handler *qh);
1da177e4 LT	238	extern void nf_reinject(struct sk_buff *skb,
	239	struct nf_info *info,
	240	unsigned int verdict);
	241
	242	extern void (ip_ct_attach)(struct sk_buff , struct sk_buff *);
	243	extern void nf_ct_attach(struct sk_buff , struct sk_buff );
	244
	245	/* FIXME: Before cache is ever used, this must be implemented for real. */
	246	extern void nf_invalidate_cache(int pf);
	247
089af26c HW	248	/* Call this before modifying an existing packet: ensures it is
	249	modifiable and linear to the point you care about (writable_len).
	250	Returns true or false. */
	251	extern int skb_make_writable(struct sk_buff **pskb, unsigned int writable_len);
	252
2cc7d573 HW	253	struct nf_queue_rerouter {
	254	void (save)(const struct sk_buff skb, struct nf_info *info);
	255	int (reroute)(struct sk_buff skb, const struct nf_info info);
	256	int rer_size;
	257	};
	258
	259	#define nf_info_reroute(x) ((void *)x + sizeof(struct nf_info))
	260
	261	extern int nf_register_queue_rerouter(int pf, struct nf_queue_rerouter *rer);
	262	extern int nf_unregister_queue_rerouter(int pf);
	263
608c8e4f HW	264	#ifdef CONFIG_PROC_FS
	265	#include <linux/proc_fs.h>
	266	extern struct proc_dir_entry *proc_net_netfilter;
	267	#endif
	268
1da177e4 LT	269	#else /* !CONFIG_NETFILTER */
	270	#define NF_HOOK(pf, hook, skb, indev, outdev, okfn) (okfn)(skb)
	271	static inline void nf_ct_attach(struct sk_buff new, struct sk_buff skb) {}
	272	#endif /CONFIG_NETFILTER/
	273
	274	#endif /__KERNEL__/
	275	#endif /__LINUX_NETFILTER_H/