#ifndef _NET_NF_TABLES_H
#define _NET_NF_TABLES_H
#include <linux/module.h>
#include <linux/list.h>
#include <linux/netfilter.h>
#include <linux/netfilter/nfnetlink.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/nf_tables.h>
#include <linux/u64_stats_sync.h>
#include <net/netlink.h>
#define NFT_JUMP_STACK_SIZE 16
struct nft_pktinfo {
struct sk_buff *skb;
struct net *net;
const struct net_device *in;
const struct net_device *out;
u8 pf;
u8 hook;
u8 tprot;
/* for x_tables compatibility */
struct xt_action_param xt;
};
static inline void nft_set_pktinfo(struct nft_pktinfo *pkt,
struct sk_buff *skb,
const struct nf_hook_state *state)
{
pkt->skb = skb;
pkt->net = pkt->xt.net = state->net;
pkt->in = pkt->xt.in = state->in;
pkt->out = pkt->xt.out = state->out;
pkt->hook = pkt->xt.hooknum = state->hook;
pkt->pf = pkt->xt.family = state->pf;
}
/**
* struct nft_verdict - nf_tables verdict
*
* @code: nf_tables/netfilter verdict code
* @chain: destination chain for NFT_JUMP/NFT_GOTO
*/
struct nft_verdict {
u32 code;
struct nft_chain *chain;
};
struct nft_data {
union {
u32 data[4];
struct nft_verdict verdict;
};
} __attribute__((aligned(__alignof__(u64))));
/**
* struct nft_regs - nf_tables register set
*
* @data: data registers
* @verdict: verdict register
*
* The first four data registers alias to the verdict register.
*/
struct nft_regs {
union {
u32 data[20];
struct nft_verdict verdict;
};
};
static inline void nft_data_copy(u32 *dst, const struct nft_data *src,
unsigned int len)
{
memcpy(dst, src, len);
}
static inline void nft_data_debug(const struct nft_data *data)
{
pr_debug("data[0]=%x data[1]=%x data[2]=%x data[3]=%x\n",
data->data[0], data->data[1],
data->data[2], data->data[3]);
}
/**
* struct nft_ctx - nf_tables rule/set context
*
* @net: net namespace
* @afi: address family info
* @table: the table the chain is contained in
* @chain: the chain the rule is contained in
* @nla: netlink attributes
* @portid: netlink portID of the original message
* @seq: netlink sequence number
* @report: notify via unicast netlink message
*/
struct nft_ctx {
struct net *net;
struct nft_af_info *afi;
struct nft_table *table;
struct nft_chain *chain;
const struct nlattr * const *nla;
u32 portid;
u32 seq;
bool report;
};
struct nft_data_desc {
enum nft_data_types type;
unsigned int len;
};
int nft_data_init(const struct nft_ctx *ctx,
struct nft_data *data, unsigned int size,
struct nft_data_desc *desc, const struct nlattr *nla);
void nft_data_uninit(const struct nft_data *data, enum nft_data_types type);
int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
enum nft_data_types type, unsigned int len);
static inline enum nft_data_types nft_dreg_to_type(enum nft_registers reg)
{
return reg == NFT_REG_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE;
}
static inline enum nft_registers nft_type_to_reg(enum nft_data_types type)
{
return type == NFT_DATA_VERDICT ? NFT_REG_VERDICT : NFT_REG_1 *