History

UAPI: (Scripted) Disintegrate include/linux/netfilter_bridge

David Howells committed 14 years ago

Commit 55c5cd31 parent 892208222 files · +350 −332Browse files

Showing the changes to include/uapi/linux (19 of 22 files). Show all

Unified · Split

19 files
  1. include/uapi/linux/netfilter_bridge/Kbuild +18 −0
  2. include/uapi/linux/netfilter_bridge/ebt_802_3.h +62 −0
  3. include/uapi/linux/netfilter_bridge/ebt_among.h +64 −0
  4. include/uapi/linux/netfilter_bridge/ebt_arp.h +36 −0
  5. include/uapi/linux/netfilter_bridge/ebt_arpreply.h +10 −0
  6. include/uapi/linux/netfilter_bridge/ebt_ip.h +44 −0
  7. include/uapi/linux/netfilter_bridge/ebt_ip6.h +50 −0
  8. include/uapi/linux/netfilter_bridge/ebt_limit.h +24 −0
  9. include/uapi/linux/netfilter_bridge/ebt_log.h +20 −0
  10. include/uapi/linux/netfilter_bridge/ebt_mark_m.h +16 −0
  11. include/uapi/linux/netfilter_bridge/ebt_mark_t.h +23 −0
  12. include/uapi/linux/netfilter_bridge/ebt_nat.h +13 −0
  13. include/uapi/linux/netfilter_bridge/ebt_nflog.h +23 −0
  14. include/uapi/linux/netfilter_bridge/ebt_pkttype.h +12 −0
  15. include/uapi/linux/netfilter_bridge/ebt_redirect.h +10 −0
  16. include/uapi/linux/netfilter_bridge/ebt_stp.h +46 −0
  17. include/uapi/linux/netfilter_bridge/ebt_ulog.h +38 −0
  18. include/uapi/linux/netfilter_bridge/ebt_vlan.h +22 −0
  19. include/uapi/linux/netfilter_bridge/ebtables.h +268 −0
include/uapi/linux/netfilter_bridge/Kbuild+18−0
@@ -1 +1,19 @@
11 # UAPI Header export list
2+header-y += ebt_802_3.h
3+header-y += ebt_among.h
4+header-y += ebt_arp.h
5+header-y += ebt_arpreply.h
6+header-y += ebt_ip.h
7+header-y += ebt_ip6.h
8+header-y += ebt_limit.h
9+header-y += ebt_log.h
10+header-y += ebt_mark_m.h
11+header-y += ebt_mark_t.h
12+header-y += ebt_nat.h
13+header-y += ebt_nflog.h
14+header-y += ebt_pkttype.h
15+header-y += ebt_redirect.h
16+header-y += ebt_stp.h
17+header-y += ebt_ulog.h
18+header-y += ebt_vlan.h
19+header-y += ebtables.h
include/uapi/linux/netfilter_bridge/ebt_802_3.h+62−0
@@ -0,0 +1,62 @@
1+#ifndef _UAPI__LINUX_BRIDGE_EBT_802_3_H
2+#define _UAPI__LINUX_BRIDGE_EBT_802_3_H
3+
4+#include <linux/types.h>
5+
6+#define EBT_802_3_SAP 0x01
7+#define EBT_802_3_TYPE 0x02
8+
9+#define EBT_802_3_MATCH "802_3"
10+
11+/*
12+ * If frame has DSAP/SSAP value 0xaa you must check the SNAP type
13+ * to discover what kind of packet we're carrying.
14+ */
15+#define CHECK_TYPE 0xaa
16+
17+/*
18+ * Control field may be one or two bytes. If the first byte has
19+ * the value 0x03 then the entire length is one byte, otherwise it is two.
20+ * One byte controls are used in Unnumbered Information frames.
21+ * Two byte controls are used in Numbered Information frames.
22+ */
23+#define IS_UI 0x03
24+
25+#define EBT_802_3_MASK (EBT_802_3_SAP | EBT_802_3_TYPE | EBT_802_3)
26+
27+/* ui has one byte ctrl, ni has two */
28+struct hdr_ui {
29+ __u8 dsap;
30+ __u8 ssap;
31+ __u8 ctrl;
32+ __u8 orig[3];
33+ __be16 type;
34+};
35+
36+struct hdr_ni {
37+ __u8 dsap;
38+ __u8 ssap;
39+ __be16 ctrl;
40+ __u8 orig[3];
41+ __be16 type;
42+};
43+
44+struct ebt_802_3_hdr {
45+ __u8 daddr[6];
46+ __u8 saddr[6];
47+ __be16 len;
48+ union {
49+ struct hdr_ui ui;
50+ struct hdr_ni ni;
51+ } llc;
52+};
53+
54+
55+struct ebt_802_3_info {
56+ __u8 sap;
57+ __be16 type;
58+ __u8 bitmask;
59+ __u8 invflags;
60+};
61+
62+#endif /* _UAPI__LINUX_BRIDGE_EBT_802_3_H */
include/uapi/linux/netfilter_bridge/ebt_among.h+64−0
@@ -0,0 +1,64 @@
1+#ifndef __LINUX_BRIDGE_EBT_AMONG_H
2+#define __LINUX_BRIDGE_EBT_AMONG_H
3+
4+#include <linux/types.h>
5+
6+#define EBT_AMONG_DST 0x01
7+#define EBT_AMONG_SRC 0x02
8+
9+/* Grzegorz Borowiak <grzes@gnu.univ.gda.pl> 2003
10+ *
11+ * Write-once-read-many hash table, used for checking if a given
12+ * MAC address belongs to a set or not and possibly for checking
13+ * if it is related with a given IPv4 address.
14+ *
15+ * The hash value of an address is its last byte.
16+ *
17+ * In real-world ethernet addresses, values of the last byte are
18+ * evenly distributed and there is no need to consider other bytes.
19+ * It would only slow the routines down.
20+ *
21+ * For MAC address comparison speedup reasons, we introduce a trick.
22+ * MAC address is mapped onto an array of two 32-bit integers.
23+ * This pair of integers is compared with MAC addresses in the
24+ * hash table, which are stored also in form of pairs of integers
25+ * (in `cmp' array). This is quick as it requires only two elementary
26+ * number comparisons in worst case. Further, we take advantage of
27+ * fact that entropy of 3 last bytes of address is larger than entropy
28+ * of 3 first bytes. So first we compare 4 last bytes of addresses and
29+ * if they are the same we compare 2 first.
30+ *
31+ * Yes, it is a memory overhead, but in 2003 AD, who cares?
32+ */
33+
34+struct ebt_mac_wormhash_tuple {
35+ __u32 cmp[2];
36+ __be32 ip;
37+};
38+
39+struct ebt_mac_wormhash {
40+ int table[257];
41+ int poolsize;
42+ struct ebt_mac_wormhash_tuple pool[0];
43+};
44+
45+#define ebt_mac_wormhash_size(x) ((x) ? sizeof(struct ebt_mac_wormhash) \
46+ + (x)->poolsize * sizeof(struct ebt_mac_wormhash_tuple) : 0)
47+
48+struct ebt_among_info {
49+ int wh_dst_ofs;
50+ int wh_src_ofs;
51+ int bitmask;
52+};
53+
54+#define EBT_AMONG_DST_NEG 0x1
55+#define EBT_AMONG_SRC_NEG 0x2
56+
57+#define ebt_among_wh_dst(x) ((x)->wh_dst_ofs ? \
58+ (struct ebt_mac_wormhash*)((char*)(x) + (x)->wh_dst_ofs) : NULL)
59+#define ebt_among_wh_src(x) ((x)->wh_src_ofs ? \
60+ (struct ebt_mac_wormhash*)((char*)(x) + (x)->wh_src_ofs) : NULL)
61+
62+#define EBT_AMONG_MATCH "among"
63+
64+#endif
include/uapi/linux/netfilter_bridge/ebt_arp.h+36−0
@@ -0,0 +1,36 @@
1+#ifndef __LINUX_BRIDGE_EBT_ARP_H
2+#define __LINUX_BRIDGE_EBT_ARP_H
3+
4+#include <linux/types.h>
5+
6+#define EBT_ARP_OPCODE 0x01
7+#define EBT_ARP_HTYPE 0x02
8+#define EBT_ARP_PTYPE 0x04
9+#define EBT_ARP_SRC_IP 0x08
10+#define EBT_ARP_DST_IP 0x10
11+#define EBT_ARP_SRC_MAC 0x20
12+#define EBT_ARP_DST_MAC 0x40
13+#define EBT_ARP_GRAT 0x80
14+#define EBT_ARP_MASK (EBT_ARP_OPCODE | EBT_ARP_HTYPE | EBT_ARP_PTYPE | \
15+ EBT_ARP_SRC_IP | EBT_ARP_DST_IP | EBT_ARP_SRC_MAC | EBT_ARP_DST_MAC | \
16+ EBT_ARP_GRAT)
17+#define EBT_ARP_MATCH "arp"
18+
19+struct ebt_arp_info
20+{
21+ __be16 htype;
22+ __be16 ptype;
23+ __be16 opcode;
24+ __be32 saddr;
25+ __be32 smsk;
26+ __be32 daddr;
27+ __be32 dmsk;
28+ unsigned char smaddr[ETH_ALEN];
29+ unsigned char smmsk[ETH_ALEN];
30+ unsigned char dmaddr[ETH_ALEN];
31+ unsigned char dmmsk[ETH_ALEN];
32+ __u8 bitmask;
33+ __u8 invflags;
34+};
35+
36+#endif
include/uapi/linux/netfilter_bridge/ebt_arpreply.h+10−0
@@ -0,0 +1,10 @@
1+#ifndef __LINUX_BRIDGE_EBT_ARPREPLY_H
2+#define __LINUX_BRIDGE_EBT_ARPREPLY_H
3+
4+struct ebt_arpreply_info {
5+ unsigned char mac[ETH_ALEN];
6+ int target;
7+};
8+#define EBT_ARPREPLY_TARGET "arpreply"
9+
10+#endif
include/uapi/linux/netfilter_bridge/ebt_ip.h+44−0
@@ -0,0 +1,44 @@
1+/*
2+ * ebt_ip
3+ *
4+ * Authors:
5+ * Bart De Schuymer <bart.de.schuymer@pandora.be>
6+ *
7+ * April, 2002
8+ *
9+ * Changes:
10+ * added ip-sport and ip-dport
11+ * Innominate Security Technologies AG <mhopf@innominate.com>
12+ * September, 2002
13+ */
14+
15+#ifndef __LINUX_BRIDGE_EBT_IP_H
16+#define __LINUX_BRIDGE_EBT_IP_H
17+
18+#include <linux/types.h>
19+
20+#define EBT_IP_SOURCE 0x01
21+#define EBT_IP_DEST 0x02
22+#define EBT_IP_TOS 0x04
23+#define EBT_IP_PROTO 0x08
24+#define EBT_IP_SPORT 0x10
25+#define EBT_IP_DPORT 0x20
26+#define EBT_IP_MASK (EBT_IP_SOURCE | EBT_IP_DEST | EBT_IP_TOS | EBT_IP_PROTO |\
27+ EBT_IP_SPORT | EBT_IP_DPORT )
28+#define EBT_IP_MATCH "ip"
29+
30+/* the same values are used for the invflags */
31+struct ebt_ip_info {
32+ __be32 saddr;
33+ __be32 daddr;
34+ __be32 smsk;
35+ __be32 dmsk;
36+ __u8 tos;
37+ __u8 protocol;
38+ __u8 bitmask;
39+ __u8 invflags;
40+ __u16 sport[2];
41+ __u16 dport[2];
42+};
43+
44+#endif
include/uapi/linux/netfilter_bridge/ebt_ip6.h+50−0
@@ -0,0 +1,50 @@
1+/*
2+ * ebt_ip6
3+ *
4+ * Authors:
5+ * Kuo-Lang Tseng <kuo-lang.tseng@intel.com>
6+ * Manohar Castelino <manohar.r.castelino@intel.com>
7+ *
8+ * Jan 11, 2008
9+ *
10+ */
11+
12+#ifndef __LINUX_BRIDGE_EBT_IP6_H
13+#define __LINUX_BRIDGE_EBT_IP6_H
14+
15+#include <linux/types.h>
16+
17+#define EBT_IP6_SOURCE 0x01
18+#define EBT_IP6_DEST 0x02
19+#define EBT_IP6_TCLASS 0x04
20+#define EBT_IP6_PROTO 0x08
21+#define EBT_IP6_SPORT 0x10
22+#define EBT_IP6_DPORT 0x20
23+#define EBT_IP6_ICMP6 0x40
24+
25+#define EBT_IP6_MASK (EBT_IP6_SOURCE | EBT_IP6_DEST | EBT_IP6_TCLASS |\
26+ EBT_IP6_PROTO | EBT_IP6_SPORT | EBT_IP6_DPORT | \
27+ EBT_IP6_ICMP6)
28+#define EBT_IP6_MATCH "ip6"
29+
30+/* the same values are used for the invflags */
31+struct ebt_ip6_info {
32+ struct in6_addr saddr;
33+ struct in6_addr daddr;
34+ struct in6_addr smsk;
35+ struct in6_addr dmsk;
36+ __u8 tclass;
37+ __u8 protocol;
38+ __u8 bitmask;
39+ __u8 invflags;
40+ union {
41+ __u16 sport[2];
42+ __u8 icmpv6_type[2];
43+ };
44+ union {
45+ __u16 dport[2];
46+ __u8 icmpv6_code[2];
47+ };
48+};
49+
50+#endif
include/uapi/linux/netfilter_bridge/ebt_limit.h+24−0
@@ -0,0 +1,24 @@
1+#ifndef __LINUX_BRIDGE_EBT_LIMIT_H
2+#define __LINUX_BRIDGE_EBT_LIMIT_H
3+
4+#include <linux/types.h>
5+
6+#define EBT_LIMIT_MATCH "limit"
7+
8+/* timings are in milliseconds. */
9+#define EBT_LIMIT_SCALE 10000
10+
11+/* 1/10,000 sec period => max of 10,000/sec. Min rate is then 429490
12+ seconds, or one every 59 hours. */
13+
14+struct ebt_limit_info {
15+ __u32 avg; /* Average secs between packets * scale */
16+ __u32 burst; /* Period multiplier for upper limit. */
17+
18+ /* Used internally by the kernel */
19+ unsigned long prev;
20+ __u32 credit;
21+ __u32 credit_cap, cost;
22+};
23+
24+#endif
include/uapi/linux/netfilter_bridge/ebt_log.h+20−0
@@ -0,0 +1,20 @@
1+#ifndef __LINUX_BRIDGE_EBT_LOG_H
2+#define __LINUX_BRIDGE_EBT_LOG_H
3+
4+#include <linux/types.h>
5+
6+#define EBT_LOG_IP 0x01 /* if the frame is made by ip, log the ip information */
7+#define EBT_LOG_ARP 0x02
8+#define EBT_LOG_NFLOG 0x04
9+#define EBT_LOG_IP6 0x08
10+#define EBT_LOG_MASK (EBT_LOG_IP | EBT_LOG_ARP | EBT_LOG_IP6)
11+#define EBT_LOG_PREFIX_SIZE 30
12+#define EBT_LOG_WATCHER "log"
13+
14+struct ebt_log_info {
15+ __u8 loglevel;
16+ __u8 prefix[EBT_LOG_PREFIX_SIZE];
17+ __u32 bitmask;
18+};
19+
20+#endif
include/uapi/linux/netfilter_bridge/ebt_mark_m.h+16−0
@@ -0,0 +1,16 @@
1+#ifndef __LINUX_BRIDGE_EBT_MARK_M_H
2+#define __LINUX_BRIDGE_EBT_MARK_M_H
3+
4+#include <linux/types.h>
5+
6+#define EBT_MARK_AND 0x01
7+#define EBT_MARK_OR 0x02
8+#define EBT_MARK_MASK (EBT_MARK_AND | EBT_MARK_OR)
9+struct ebt_mark_m_info {
10+ unsigned long mark, mask;
11+ __u8 invert;
12+ __u8 bitmask;
13+};
14+#define EBT_MARK_MATCH "mark_m"
15+
16+#endif
include/uapi/linux/netfilter_bridge/ebt_mark_t.h+23−0
@@ -0,0 +1,23 @@
1+#ifndef __LINUX_BRIDGE_EBT_MARK_T_H
2+#define __LINUX_BRIDGE_EBT_MARK_T_H
3+
4+/* The target member is reused for adding new actions, the
5+ * value of the real target is -1 to -NUM_STANDARD_TARGETS.
6+ * For backward compatibility, the 4 lsb (2 would be enough,
7+ * but let's play it safe) are kept to designate this target.
8+ * The remaining bits designate the action. By making the set
9+ * action 0xfffffff0, the result will look ok for older
10+ * versions. [September 2006] */
11+#define MARK_SET_VALUE (0xfffffff0)
12+#define MARK_OR_VALUE (0xffffffe0)
13+#define MARK_AND_VALUE (0xffffffd0)
14+#define MARK_XOR_VALUE (0xffffffc0)
15+
16+struct ebt_mark_t_info {
17+ unsigned long mark;
18+ /* EBT_ACCEPT, EBT_DROP, EBT_CONTINUE or EBT_RETURN */
19+ int target;
20+};
21+#define EBT_MARK_TARGET "mark"
22+
23+#endif
include/uapi/linux/netfilter_bridge/ebt_nat.h+13−0
@@ -0,0 +1,13 @@
1+#ifndef __LINUX_BRIDGE_EBT_NAT_H
2+#define __LINUX_BRIDGE_EBT_NAT_H
3+
4+#define NAT_ARP_BIT (0x00000010)
5+struct ebt_nat_info {
6+ unsigned char mac[ETH_ALEN];
7+ /* EBT_ACCEPT, EBT_DROP, EBT_CONTINUE or EBT_RETURN */
8+ int target;
9+};
10+#define EBT_SNAT_TARGET "snat"
11+#define EBT_DNAT_TARGET "dnat"
12+
13+#endif
include/uapi/linux/netfilter_bridge/ebt_nflog.h+23−0
@@ -0,0 +1,23 @@
1+#ifndef __LINUX_BRIDGE_EBT_NFLOG_H
2+#define __LINUX_BRIDGE_EBT_NFLOG_H
3+
4+#include <linux/types.h>
5+
6+#define EBT_NFLOG_MASK 0x0
7+
8+#define EBT_NFLOG_PREFIX_SIZE 64
9+#define EBT_NFLOG_WATCHER "nflog"
10+
11+#define EBT_NFLOG_DEFAULT_GROUP 0x1
12+#define EBT_NFLOG_DEFAULT_THRESHOLD 1
13+
14+struct ebt_nflog_info {
15+ __u32 len;
16+ __u16 group;
17+ __u16 threshold;
18+ __u16 flags;
19+ __u16 pad;
20+ char prefix[EBT_NFLOG_PREFIX_SIZE];
21+};
22+
23+#endif /* __LINUX_BRIDGE_EBT_NFLOG_H */
include/uapi/linux/netfilter_bridge/ebt_pkttype.h+12−0
@@ -0,0 +1,12 @@
1+#ifndef __LINUX_BRIDGE_EBT_PKTTYPE_H
2+#define __LINUX_BRIDGE_EBT_PKTTYPE_H
3+
4+#include <linux/types.h>
5+
6+struct ebt_pkttype_info {
7+ __u8 pkt_type;
8+ __u8 invert;
9+};
10+#define EBT_PKTTYPE_MATCH "pkttype"
11+
12+#endif
include/uapi/linux/netfilter_bridge/ebt_redirect.h+10−0
@@ -0,0 +1,10 @@
1+#ifndef __LINUX_BRIDGE_EBT_REDIRECT_H
2+#define __LINUX_BRIDGE_EBT_REDIRECT_H
3+
4+struct ebt_redirect_info {
5+ /* EBT_ACCEPT, EBT_DROP, EBT_CONTINUE or EBT_RETURN */
6+ int target;
7+};
8+#define EBT_REDIRECT_TARGET "redirect"
9+
10+#endif
include/uapi/linux/netfilter_bridge/ebt_stp.h+46−0
@@ -0,0 +1,46 @@
1+#ifndef __LINUX_BRIDGE_EBT_STP_H
2+#define __LINUX_BRIDGE_EBT_STP_H
3+
4+#include <linux/types.h>
5+
6+#define EBT_STP_TYPE 0x0001
7+
8+#define EBT_STP_FLAGS 0x0002
9+#define EBT_STP_ROOTPRIO 0x0004
10+#define EBT_STP_ROOTADDR 0x0008
11+#define EBT_STP_ROOTCOST 0x0010
12+#define EBT_STP_SENDERPRIO 0x0020
13+#define EBT_STP_SENDERADDR 0x0040
14+#define EBT_STP_PORT 0x0080
15+#define EBT_STP_MSGAGE 0x0100
16+#define EBT_STP_MAXAGE 0x0200
17+#define EBT_STP_HELLOTIME 0x0400
18+#define EBT_STP_FWDD 0x0800
19+
20+#define EBT_STP_MASK 0x0fff
21+#define EBT_STP_CONFIG_MASK 0x0ffe
22+
23+#define EBT_STP_MATCH "stp"
24+
25+struct ebt_stp_config_info {
26+ __u8 flags;
27+ __u16 root_priol, root_priou;
28+ char root_addr[6], root_addrmsk[6];
29+ __u32 root_costl, root_costu;
30+ __u16 sender_priol, sender_priou;
31+ char sender_addr[6], sender_addrmsk[6];
32+ __u16 portl, portu;
33+ __u16 msg_agel, msg_ageu;
34+ __u16 max_agel, max_ageu;
35+ __u16 hello_timel, hello_timeu;
36+ __u16 forward_delayl, forward_delayu;
37+};
38+
39+struct ebt_stp_info {
40+ __u8 type;
41+ struct ebt_stp_config_info config;
42+ __u16 bitmask;
43+ __u16 invflags;
44+};
45+
46+#endif
include/uapi/linux/netfilter_bridge/ebt_ulog.h+38−0
@@ -0,0 +1,38 @@
1+#ifndef _EBT_ULOG_H
2+#define _EBT_ULOG_H
3+
4+#include <linux/types.h>
5+
6+#define EBT_ULOG_DEFAULT_NLGROUP 0
7+#define EBT_ULOG_DEFAULT_QTHRESHOLD 1
8+#define EBT_ULOG_MAXNLGROUPS 32 /* hardcoded netlink max */
9+#define EBT_ULOG_PREFIX_LEN 32
10+#define EBT_ULOG_MAX_QLEN 50
11+#define EBT_ULOG_WATCHER "ulog"
12+#define EBT_ULOG_VERSION 1
13+
14+struct ebt_ulog_info {
15+ __u32 nlgroup;
16+ unsigned int cprange;
17+ unsigned int qthreshold;
18+ char prefix[EBT_ULOG_PREFIX_LEN];
19+};
20+
21+typedef struct ebt_ulog_packet_msg {
22+ int version;
23+ char indev[IFNAMSIZ];
24+ char outdev[IFNAMSIZ];
25+ char physindev[IFNAMSIZ];
26+ char physoutdev[IFNAMSIZ];
27+ char prefix[EBT_ULOG_PREFIX_LEN];
28+ struct timeval stamp;
29+ unsigned long mark;
30+ unsigned int hook;
31+ size_t data_len;
32+ /* The complete packet, including Ethernet header and perhaps
33+ * the VLAN header is appended */
34+ unsigned char data[0] __attribute__
35+ ((aligned (__alignof__(struct ebt_ulog_info))));
36+} ebt_ulog_packet_msg_t;
37+
38+#endif /* _EBT_ULOG_H */
include/uapi/linux/netfilter_bridge/ebt_vlan.h+22−0
@@ -0,0 +1,22 @@
1+#ifndef __LINUX_BRIDGE_EBT_VLAN_H
2+#define __LINUX_BRIDGE_EBT_VLAN_H
3+
4+#include <linux/types.h>
5+
6+#define EBT_VLAN_ID 0x01
7+#define EBT_VLAN_PRIO 0x02
8+#define EBT_VLAN_ENCAP 0x04
9+#define EBT_VLAN_MASK (EBT_VLAN_ID | EBT_VLAN_PRIO | EBT_VLAN_ENCAP)
10+#define EBT_VLAN_MATCH "vlan"
11+
12+struct ebt_vlan_info {
13+ __u16 id; /* VLAN ID {1-4095} */
14+ __u8 prio; /* VLAN User Priority {0-7} */
15+ __be16 encap; /* VLAN Encapsulated frame code {0-65535} */
16+ __u8 bitmask; /* Args bitmask bit 1=1 - ID arg,
17+ bit 2=1 User-Priority arg, bit 3=1 encap*/
18+ __u8 invflags; /* Inverse bitmask bit 1=1 - inversed ID arg,
19+ bit 2=1 - inversed Pirority arg */
20+};
21+
22+#endif
include/uapi/linux/netfilter_bridge/ebtables.h+268−0
@@ -0,0 +1,268 @@
1+/*
2+ * ebtables
3+ *
4+ * Authors:
5+ * Bart De Schuymer <bdschuym@pandora.be>
6+ *
7+ * ebtables.c,v 2.0, April, 2002
8+ *
9+ * This code is stongly inspired on the iptables code which is
10+ * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
11+ */
12+
13+#ifndef _UAPI__LINUX_BRIDGE_EFF_H
14+#define _UAPI__LINUX_BRIDGE_EFF_H
15+#include <linux/if.h>
16+#include <linux/netfilter_bridge.h>
17+#include <linux/if_ether.h>
18+
19+#define EBT_TABLE_MAXNAMELEN 32
20+#define EBT_CHAIN_MAXNAMELEN EBT_TABLE_MAXNAMELEN
21+#define EBT_FUNCTION_MAXNAMELEN EBT_TABLE_MAXNAMELEN
22+
23+/* verdicts >0 are "branches" */
24+#define EBT_ACCEPT -1
25+#define EBT_DROP -2
26+#define EBT_CONTINUE -3
27+#define EBT_RETURN -4
28+#define NUM_STANDARD_TARGETS 4
29+/* ebtables target modules store the verdict inside an int. We can
30+ * reclaim a part of this int for backwards compatible extensions.
31+ * The 4 lsb are more than enough to store the verdict. */
32+#define EBT_VERDICT_BITS 0x0000000F
33+
34+struct xt_match;
35+struct xt_target;
36+
37+struct ebt_counter {
38+ uint64_t pcnt;
39+ uint64_t bcnt;
40+};
41+
42+struct ebt_replace {
43+ char name[EBT_TABLE_MAXNAMELEN];
44+ unsigned int valid_hooks;
45+ /* nr of rules in the table */
46+ unsigned int nentries;
47+ /* total size of the entries */
48+ unsigned int entries_size;
49+ /* start of the chains */
50+ struct ebt_entries __user *hook_entry[NF_BR_NUMHOOKS];
51+ /* nr of counters userspace expects back */
52+ unsigned int num_counters;
53+ /* where the kernel will put the old counters */
54+ struct ebt_counter __user *counters;
55+ char __user *entries;
56+};
57+
58+struct ebt_replace_kernel {
59+ char name[EBT_TABLE_MAXNAMELEN];
60+ unsigned int valid_hooks;
61+ /* nr of rules in the table */
62+ unsigned int nentries;
63+ /* total size of the entries */
64+ unsigned int entries_size;
65+ /* start of the chains */
66+ struct ebt_entries *hook_entry[NF_BR_NUMHOOKS];
67+ /* nr of counters userspace expects back */
68+ unsigned int num_counters;
69+ /* where the kernel will put the old counters */
70+ struct ebt_counter *counters;
71+ char *entries;
72+};
73+
74+struct ebt_entries {
75+ /* this field is always set to zero
76+ * See EBT_ENTRY_OR_ENTRIES.
77+ * Must be same size as ebt_entry.bitmask */
78+ unsigned int distinguisher;
79+ /* the chain name */
80+ char name[EBT_CHAIN_MAXNAMELEN];
81+ /* counter offset for this chain */
82+ unsigned int counter_offset;
83+ /* one standard (accept, drop, return) per hook */
84+ int policy;
85+ /* nr. of entries */
86+ unsigned int nentries;
87+ /* entry list */
88+ char data[0] __attribute__ ((aligned (__alignof__(struct ebt_replace))));
89+};
90+
91+/* used for the bitmask of struct ebt_entry */
92+
93+/* This is a hack to make a difference between an ebt_entry struct and an
94+ * ebt_entries struct when traversing the entries from start to end.
95+ * Using this simplifies the code a lot, while still being able to use
96+ * ebt_entries.
97+ * Contrary, iptables doesn't use something like ebt_entries and therefore uses
98+ * different techniques for naming the policy and such. So, iptables doesn't
99+ * need a hack like this.
100+ */
101+#define EBT_ENTRY_OR_ENTRIES 0x01
102+/* these are the normal masks */
103+#define EBT_NOPROTO 0x02
104+#define EBT_802_3 0x04
105+#define EBT_SOURCEMAC 0x08
106+#define EBT_DESTMAC 0x10
107+#define EBT_F_MASK (EBT_NOPROTO | EBT_802_3 | EBT_SOURCEMAC | EBT_DESTMAC \
108+ | EBT_ENTRY_OR_ENTRIES)
109+
110+#define EBT_IPROTO 0x01
111+#define EBT_IIN 0x02
112+#define EBT_IOUT 0x04
113+#define EBT_ISOURCE 0x8
114+#define EBT_IDEST 0x10
115+#define EBT_ILOGICALIN 0x20
116+#define EBT_ILOGICALOUT 0x40
117+#define EBT_INV_MASK (EBT_IPROTO | EBT_IIN | EBT_IOUT | EBT_ILOGICALIN \
118+ | EBT_ILOGICALOUT | EBT_ISOURCE | EBT_IDEST)
119+
120+struct ebt_entry_match {
121+ union {
122+ char name[EBT_FUNCTION_MAXNAMELEN];
123+ struct xt_match *match;
124+ } u;
125+ /* size of data */
126+ unsigned int match_size;
127+ unsigned char data[0] __attribute__ ((aligned (__alignof__(struct ebt_replace))));
128+};
129+
130+struct ebt_entry_watcher {
131+ union {
132+ char name[EBT_FUNCTION_MAXNAMELEN];
133+ struct xt_target *watcher;
134+ } u;
135+ /* size of data */
136+ unsigned int watcher_size;
137+ unsigned char data[0] __attribute__ ((aligned (__alignof__(struct ebt_replace))));
138+};
139+
140+struct ebt_entry_target {
141+ union {
142+ char name[EBT_FUNCTION_MAXNAMELEN];
143+ struct xt_target *target;
144+ } u;
145+ /* size of data */
146+ unsigned int target_size;
147+ unsigned char data[0] __attribute__ ((aligned (__alignof__(struct ebt_replace))));
148+};
149+
150+#define EBT_STANDARD_TARGET "standard"
151+struct ebt_standard_target {
152+ struct ebt_entry_target target;
153+ int verdict;
154+};
155+
156+/* one entry */
157+struct ebt_entry {
158+ /* this needs to be the first field */
159+ unsigned int bitmask;
160+ unsigned int invflags;
161+ __be16 ethproto;
162+ /* the physical in-dev */
163+ char in[IFNAMSIZ];
164+ /* the logical in-dev */
165+ char logical_in[IFNAMSIZ];
166+ /* the physical out-dev */
167+ char out[IFNAMSIZ];
168+ /* the logical out-dev */
169+ char logical_out[IFNAMSIZ];
170+ unsigned char sourcemac[ETH_ALEN];
171+ unsigned char sourcemsk[ETH_ALEN];
172+ unsigned char destmac[ETH_ALEN];
173+ unsigned char destmsk[ETH_ALEN];
174+ /* sizeof ebt_entry + matches */
175+ unsigned int watchers_offset;
176+ /* sizeof ebt_entry + matches + watchers */
177+ unsigned int target_offset;
178+ /* sizeof ebt_entry + matches + watchers + target */
179+ unsigned int next_offset;
180+ unsigned char elems[0] __attribute__ ((aligned (__alignof__(struct ebt_replace))));
181+};
182+
183+/* {g,s}etsockopt numbers */
184+#define EBT_BASE_CTL 128
185+
186+#define EBT_SO_SET_ENTRIES (EBT_BASE_CTL)
187+#define EBT_SO_SET_COUNTERS (EBT_SO_SET_ENTRIES+1)
188+#define EBT_SO_SET_MAX (EBT_SO_SET_COUNTERS+1)
189+
190+#define EBT_SO_GET_INFO (EBT_BASE_CTL)
191+#define EBT_SO_GET_ENTRIES (EBT_SO_GET_INFO+1)
192+#define EBT_SO_GET_INIT_INFO (EBT_SO_GET_ENTRIES+1)
193+#define EBT_SO_GET_INIT_ENTRIES (EBT_SO_GET_INIT_INFO+1)
194+#define EBT_SO_GET_MAX (EBT_SO_GET_INIT_ENTRIES+1)
195+
196+
197+/* blatently stolen from ip_tables.h
198+ * fn returns 0 to continue iteration */
199+#define EBT_MATCH_ITERATE(e, fn, args...) \
200+({ \
201+ unsigned int __i; \
202+ int __ret = 0; \
203+ struct ebt_entry_match *__match; \
204+ \
205+ for (__i = sizeof(struct ebt_entry); \
206+ __i < (e)->watchers_offset; \
207+ __i += __match->match_size + \
208+ sizeof(struct ebt_entry_match)) { \
209+ __match = (void *)(e) + __i; \
210+ \
211+ __ret = fn(__match , ## args); \
212+ if (__ret != 0) \
213+ break; \
214+ } \
215+ if (__ret == 0) { \
216+ if (__i != (e)->watchers_offset) \
217+ __ret = -EINVAL; \
218+ } \
219+ __ret; \
220+})
221+
222+#define EBT_WATCHER_ITERATE(e, fn, args...) \
223+({ \
224+ unsigned int __i; \
225+ int __ret = 0; \
226+ struct ebt_entry_watcher *__watcher; \
227+ \
228+ for (__i = e->watchers_offset; \
229+ __i < (e)->target_offset; \
230+ __i += __watcher->watcher_size + \
231+ sizeof(struct ebt_entry_watcher)) { \
232+ __watcher = (void *)(e) + __i; \
233+ \
234+ __ret = fn(__watcher , ## args); \
235+ if (__ret != 0) \
236+ break; \
237+ } \
238+ if (__ret == 0) { \
239+ if (__i != (e)->target_offset) \
240+ __ret = -EINVAL; \
241+ } \
242+ __ret; \
243+})
244+
245+#define EBT_ENTRY_ITERATE(entries, size, fn, args...) \
246+({ \
247+ unsigned int __i; \
248+ int __ret = 0; \
249+ struct ebt_entry *__entry; \
250+ \
251+ for (__i = 0; __i < (size);) { \
252+ __entry = (void *)(entries) + __i; \
253+ __ret = fn(__entry , ## args); \
254+ if (__ret != 0) \
255+ break; \
256+ if (__entry->bitmask != 0) \
257+ __i += __entry->next_offset; \
258+ else \
259+ __i += sizeof(struct ebt_entries); \
260+ } \
261+ if (__ret == 0) { \
262+ if (__i != (size)) \
263+ __ret = -EINVAL; \
264+ } \
265+ __ret; \
266+})
267+
268+#endif /* _UAPI__LINUX_BRIDGE_EFF_H */