net_pkt_filter.h

Go to the documentation of this file.

 
/*
 * Copyright (c) 2021 BayLibre SAS
 *
 * SPDX-License-Identifier: Apache-2.0
 */
 
#ifndef ZEPHYR_INCLUDE_NET_PKT_FILTER_H_
#define ZEPHYR_INCLUDE_NET_PKT_FILTER_H_
 
#include <limits.h>
#include <stdbool.h>
#include <zephyr/sys/slist.h>
#include <zephyr/net/net_core.h>
#include <zephyr/net/ethernet.h>
 
#ifdef __cplusplus
extern "C" {
#endif
 
struct npf_test;
 
typedef bool (npf_test_fn_t)(struct npf_test *test, struct net_pkt *pkt);
 
struct npf_test {
        npf_test_fn_t *fn;      
};
 
struct npf_rule {
        sys_snode_t node;               
        enum net_verdict result;        
        uint32_t nb_tests;              
        struct npf_test *tests[];       
};
 
extern struct npf_rule npf_default_ok;
extern struct npf_rule npf_default_drop;
 
struct npf_rule_list {
        sys_slist_t rule_head;   
        struct k_spinlock lock;  
};
 
extern struct npf_rule_list npf_send_rules;
extern struct npf_rule_list npf_recv_rules;
extern struct npf_rule_list npf_local_in_recv_rules;
extern struct npf_rule_list npf_ipv4_recv_rules;
extern struct npf_rule_list npf_ipv6_recv_rules;
 
void npf_insert_rule(struct npf_rule_list *rules, struct npf_rule *rule);
 
void npf_append_rule(struct npf_rule_list *rules, struct npf_rule *rule);
 
bool npf_remove_rule(struct npf_rule_list *rules, struct npf_rule *rule);
 
bool npf_remove_all_rules(struct npf_rule_list *rules);
 
/* convenience shortcuts */
#define npf_insert_send_rule(rule) npf_insert_rule(&npf_send_rules, rule)
#define npf_insert_recv_rule(rule) npf_insert_rule(&npf_recv_rules, rule)
#define npf_append_send_rule(rule) npf_append_rule(&npf_send_rules, rule)
#define npf_append_recv_rule(rule) npf_append_rule(&npf_recv_rules, rule)
#define npf_remove_send_rule(rule) npf_remove_rule(&npf_send_rules, rule)
#define npf_remove_recv_rule(rule) npf_remove_rule(&npf_recv_rules, rule)
#define npf_remove_all_send_rules() npf_remove_all_rules(&npf_send_rules)
#define npf_remove_all_recv_rules() npf_remove_all_rules(&npf_recv_rules)
 
#ifdef CONFIG_NET_PKT_FILTER_LOCAL_IN_HOOK
#define npf_insert_local_in_recv_rule(rule) npf_insert_rule(&npf_local_in_recv_rules, rule)
#define npf_append_local_in_recv_rule(rule) npf_append_rule(&npf_local_in_recv_rules, rule)
#define npf_remove_local_in_recv_rule(rule) npf_remove_rule(&npf_local_in_recv_rules, rule)
#define npf_remove_all_local_in_recv_rules() npf_remove_all_rules(&npf_local_in_recv_rules)
#endif /* CONFIG_NET_PKT_FILTER_LOCAL_IN_HOOK */
 
#ifdef CONFIG_NET_PKT_FILTER_IPV4_HOOK
#define npf_insert_ipv4_recv_rule(rule) npf_insert_rule(&npf_ipv4_recv_rules, rule)
#define npf_append_ipv4_recv_rule(rule) npf_append_rule(&npf_ipv4_recv_rules, rule)
#define npf_remove_ipv4_recv_rule(rule) npf_remove_rule(&npf_ipv4_recv_rules, rule)
#define npf_remove_all_ipv4_recv_rules() npf_remove_all_rules(&npf_ipv4_recv_rules)
#endif /* CONFIG_NET_PKT_FILTER_IPV4_HOOK */
 
#ifdef CONFIG_NET_PKT_FILTER_IPV6_HOOK
#define npf_insert_ipv6_recv_rule(rule) npf_insert_rule(&npf_ipv6_recv_rules, rule)
#define npf_append_ipv6_recv_rule(rule) npf_append_rule(&npf_ipv6_recv_rules, rule)
#define npf_remove_ipv6_recv_rule(rule) npf_remove_rule(&npf_ipv6_recv_rules, rule)
#define npf_remove_all_ipv6_recv_rules() npf_remove_all_rules(&npf_ipv6_recv_rules)
#endif /* CONFIG_NET_PKT_FILTER_IPV6_HOOK */
 
#define NPF_RULE(_name, _result, ...) \
        struct npf_rule _name = { \
                .result = (_result), \
                .nb_tests = NUM_VA_ARGS_LESS_1(__VA_ARGS__) + 1, \
                .tests = { FOR_EACH(Z_NPF_TEST_ADDR, (,), __VA_ARGS__) }, \
        }
 
#define Z_NPF_TEST_ADDR(arg) &arg.test
 
struct npf_test_iface {
        struct npf_test test;
        struct net_if *iface;
};
 
extern npf_test_fn_t npf_iface_match;
extern npf_test_fn_t npf_iface_unmatch;
extern npf_test_fn_t npf_orig_iface_match;
extern npf_test_fn_t npf_orig_iface_unmatch;
 
#define NPF_IFACE_MATCH(_name, _iface) \
        struct npf_test_iface _name = { \
                .iface = (_iface), \
                .test.fn = npf_iface_match, \
        }
 
#define NPF_IFACE_UNMATCH(_name, _iface) \
        struct npf_test_iface _name = { \
                .iface = (_iface), \
                .test.fn = npf_iface_unmatch, \
        }
 
#define NPF_ORIG_IFACE_MATCH(_name, _iface) \
        struct npf_test_iface _name = { \
                .iface = (_iface), \
                .test.fn = npf_orig_iface_match, \
        }
 
#define NPF_ORIG_IFACE_UNMATCH(_name, _iface) \
        struct npf_test_iface _name = { \
                .iface = (_iface), \
                .test.fn = npf_orig_iface_unmatch, \
        }
 
struct npf_test_size_bounds {
        struct npf_test test;
        size_t min;
        size_t max;
};
 
extern npf_test_fn_t npf_size_inbounds;
 
#define NPF_SIZE_MIN(_name, _size) \
        struct npf_test_size_bounds _name = { \
                .min = (_size), \
                .max = SIZE_MAX, \
                .test.fn = npf_size_inbounds, \
        }
 
#define NPF_SIZE_MAX(_name, _size) \
        struct npf_test_size_bounds _name = { \
                .min = 0, \
                .max = (_size), \
                .test.fn = npf_size_inbounds, \
        }
 
#define NPF_SIZE_BOUNDS(_name, _min_size, _max_size) \
        struct npf_test_size_bounds _name = { \
                .min = (_min_size), \
                .max = (_max_size), \
                .test.fn = npf_size_inbounds, \
        }
 
struct npf_test_ip {
        struct npf_test test;
        uint8_t addr_family;
        void *ipaddr;
        uint32_t ipaddr_num;
};
 
extern npf_test_fn_t npf_ip_src_addr_match;
extern npf_test_fn_t npf_ip_src_addr_unmatch;
 
#define NPF_IP_SRC_ADDR_ALLOWLIST(_name, _ip_addr_array, _ip_addr_num, _af) \
        struct npf_test_ip _name = { \
                .addr_family = _af, \
                .ipaddr = (_ip_addr_array), \
                .ipaddr_num = _ip_addr_num, \
                .test.fn = npf_ip_src_addr_match, \
        }
 
#define NPF_IP_SRC_ADDR_BLOCKLIST(_name, _ip_addr_array, _ip_addr_num, _af) \
        struct npf_test_ip _name = { \
                .addr_family = _af, \
                .ipaddr = (_ip_addr_array), \
                .ipaddr_num = _ip_addr_num, \
                .test.fn = npf_ip_src_addr_unmatch, \
        }
 
struct npf_test_eth_addr {
        struct npf_test test;
        unsigned int nb_addresses;
        struct net_eth_addr *addresses;
        struct net_eth_addr mask;
};
 
extern npf_test_fn_t npf_eth_src_addr_match;
extern npf_test_fn_t npf_eth_src_addr_unmatch;
extern npf_test_fn_t npf_eth_dst_addr_match;
extern npf_test_fn_t npf_eth_dst_addr_unmatch;
 
#define NPF_ETH_SRC_ADDR_MATCH(_name, _addr_array) \
        struct npf_test_eth_addr _name = { \
                .addresses = (_addr_array), \
                .nb_addresses = ARRAY_SIZE(_addr_array), \
                .test.fn = npf_eth_src_addr_match, \
                .mask.addr = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }, \
        }
 
#define NPF_ETH_SRC_ADDR_UNMATCH(_name, _addr_array) \
        struct npf_test_eth_addr _name = { \
                .addresses = (_addr_array), \
                .nb_addresses = ARRAY_SIZE(_addr_array), \
                .test.fn = npf_eth_src_addr_unmatch, \
                .mask.addr = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }, \
        }
 
#define NPF_ETH_DST_ADDR_MATCH(_name, _addr_array) \
        struct npf_test_eth_addr _name = { \
                .addresses = (_addr_array), \
                .nb_addresses = ARRAY_SIZE(_addr_array), \
                .test.fn = npf_eth_dst_addr_match, \
                .mask.addr = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }, \
        }
 
#define NPF_ETH_DST_ADDR_UNMATCH(_name, _addr_array) \
        struct npf_test_eth_addr _name = { \
                .addresses = (_addr_array), \
                .nb_addresses = ARRAY_SIZE(_addr_array), \
                .test.fn = npf_eth_dst_addr_unmatch, \
                .mask.addr = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }, \
        }
 
#define NPF_ETH_SRC_ADDR_MASK_MATCH(_name, _addr_array, ...) \
        struct npf_test_eth_addr _name = { \
                .addresses = (_addr_array), \
                .nb_addresses = ARRAY_SIZE(_addr_array), \
                .mask.addr = { __VA_ARGS__ }, \
                .test.fn = npf_eth_src_addr_match, \
        }
 
#define NPF_ETH_DST_ADDR_MASK_MATCH(_name, _addr_array, ...) \
        struct npf_test_eth_addr _name = { \
                .addresses = (_addr_array), \
                .nb_addresses = ARRAY_SIZE(_addr_array), \
                .mask.addr = { __VA_ARGS__ }, \
                .test.fn = npf_eth_dst_addr_match, \
        }
 
struct npf_test_eth_type {
        struct npf_test test;
        uint16_t type;                  /* type in network order */
};
 
extern npf_test_fn_t npf_eth_type_match;
extern npf_test_fn_t npf_eth_type_unmatch;
 
#define NPF_ETH_TYPE_MATCH(_name, _type) \
        struct npf_test_eth_type _name = { \
                .type = htons(_type), \
                .test.fn = npf_eth_type_match, \
        }
 
#define NPF_ETH_TYPE_UNMATCH(_name, _type) \
        struct npf_test_eth_type _name = { \
                .type = htons(_type), \
                .test.fn = npf_eth_type_unmatch, \
        }
 
#ifdef __cplusplus
}
#endif
 
#endif /* ZEPHYR_INCLUDE_NET_PKT_FILTER_H_ */