History

UAPI: (Scripted) Disintegrate include/linux/netfilter

David Howells committed 14 years ago

Commit 94d0ec51 parent 27a3aad86 files · +636 −607Browse files

Unified · Split

86 files
  1. include/linux/netfilter/Kbuild +0 −77
  2. include/linux/netfilter/nf_conntrack_common.h +1 −114
  3. include/linux/netfilter/nf_conntrack_ftp.h +1 −15
  4. include/linux/netfilter/nf_conntrack_tcp.h +1 −48
  5. include/linux/netfilter/nfnetlink.h +1 −54
  6. include/linux/netfilter/nfnetlink_acct.h +1 −24
  7. include/linux/netfilter/x_tables.h +1 −185
  8. include/linux/netfilter/xt_hashlimit.h +1 −70
  9. include/linux/netfilter/xt_physdev.h +1 −20
  10. include/uapi/linux/netfilter/Kbuild +76 −0
  11. include/uapi/linux/netfilter/nf_conntrack_common.h +117 −0
  12. include/uapi/linux/netfilter/nf_conntrack_ftp.h +18 −0
  13. include/uapi/linux/netfilter/nf_conntrack_sctp.h +0 −0
  14. include/uapi/linux/netfilter/nf_conntrack_tcp.h +51 −0
  15. include/uapi/linux/netfilter/nf_conntrack_tuple_common.h +0 −0
  16. include/uapi/linux/netfilter/nf_nat.h +0 −0
  17. include/uapi/linux/netfilter/nfnetlink.h +56 −0
  18. include/uapi/linux/netfilter/nfnetlink_acct.h +27 −0
  19. include/uapi/linux/netfilter/nfnetlink_compat.h +0 −0
  20. include/uapi/linux/netfilter/nfnetlink_conntrack.h +0 −0
  21. include/uapi/linux/netfilter/nfnetlink_cthelper.h +0 −0
  22. include/uapi/linux/netfilter/nfnetlink_cttimeout.h +0 −0
  23. include/uapi/linux/netfilter/nfnetlink_log.h +0 −0
  24. include/uapi/linux/netfilter/nfnetlink_queue.h +0 −0
  25. include/uapi/linux/netfilter/x_tables.h +187 −0
  26. include/uapi/linux/netfilter/xt_AUDIT.h +0 −0
  27. include/uapi/linux/netfilter/xt_CHECKSUM.h +0 −0
  28. include/uapi/linux/netfilter/xt_CLASSIFY.h +0 −0
  29. include/uapi/linux/netfilter/xt_CONNMARK.h +0 −0
  30. include/uapi/linux/netfilter/xt_CONNSECMARK.h +0 −0
  31. include/uapi/linux/netfilter/xt_CT.h +0 −0
  32. include/uapi/linux/netfilter/xt_DSCP.h +0 −0
  33. include/uapi/linux/netfilter/xt_IDLETIMER.h +0 −0
  34. include/uapi/linux/netfilter/xt_LED.h +0 −0
  35. include/uapi/linux/netfilter/xt_LOG.h +0 −0
  36. include/uapi/linux/netfilter/xt_MARK.h +0 −0
  37. include/uapi/linux/netfilter/xt_NFLOG.h +0 −0
  38. include/uapi/linux/netfilter/xt_NFQUEUE.h +0 −0
  39. include/uapi/linux/netfilter/xt_RATEEST.h +0 −0
  40. include/uapi/linux/netfilter/xt_SECMARK.h +0 −0
  41. include/uapi/linux/netfilter/xt_TCPMSS.h +0 −0
  42. include/uapi/linux/netfilter/xt_TCPOPTSTRIP.h +0 −0
  43. include/uapi/linux/netfilter/xt_TEE.h +0 −0
  44. include/uapi/linux/netfilter/xt_TPROXY.h +0 −0
  45. include/uapi/linux/netfilter/xt_addrtype.h +0 −0
  46. include/uapi/linux/netfilter/xt_cluster.h +0 −0
  47. include/uapi/linux/netfilter/xt_comment.h +0 −0
  48. include/uapi/linux/netfilter/xt_connbytes.h +0 −0
  49. include/uapi/linux/netfilter/xt_connlimit.h +0 −0
  50. include/uapi/linux/netfilter/xt_connmark.h +0 −0
  51. include/uapi/linux/netfilter/xt_conntrack.h +0 −0
  52. include/uapi/linux/netfilter/xt_cpu.h +0 −0
  53. include/uapi/linux/netfilter/xt_dccp.h +0 −0
  54. include/uapi/linux/netfilter/xt_devgroup.h +0 −0
  55. include/uapi/linux/netfilter/xt_dscp.h +0 −0
  56. include/uapi/linux/netfilter/xt_ecn.h +0 −0
  57. include/uapi/linux/netfilter/xt_esp.h +0 −0
  58. include/uapi/linux/netfilter/xt_hashlimit.h +73 −0
  59. include/uapi/linux/netfilter/xt_helper.h +0 −0
  60. include/uapi/linux/netfilter/xt_iprange.h +0 −0
  61. include/uapi/linux/netfilter/xt_ipvs.h +0 −0
  62. include/uapi/linux/netfilter/xt_length.h +0 −0
  63. include/uapi/linux/netfilter/xt_limit.h +0 −0
  64. include/uapi/linux/netfilter/xt_mac.h +0 −0
  65. include/uapi/linux/netfilter/xt_mark.h +0 −0
  66. include/uapi/linux/netfilter/xt_multiport.h +0 −0
  67. include/uapi/linux/netfilter/xt_nfacct.h +0 −0
  68. include/uapi/linux/netfilter/xt_osf.h +0 −0
  69. include/uapi/linux/netfilter/xt_owner.h +0 −0
  70. include/uapi/linux/netfilter/xt_physdev.h +23 −0
  71. include/uapi/linux/netfilter/xt_pkttype.h +0 −0
  72. include/uapi/linux/netfilter/xt_policy.h +0 −0
  73. include/uapi/linux/netfilter/xt_quota.h +0 −0
  74. include/uapi/linux/netfilter/xt_rateest.h +0 −0
  75. include/uapi/linux/netfilter/xt_realm.h +0 −0
  76. include/uapi/linux/netfilter/xt_recent.h +0 −0
  77. include/uapi/linux/netfilter/xt_sctp.h +0 −0
  78. include/uapi/linux/netfilter/xt_set.h +0 −0
  79. include/uapi/linux/netfilter/xt_socket.h +0 −0
  80. include/uapi/linux/netfilter/xt_state.h +0 −0
  81. include/uapi/linux/netfilter/xt_statistic.h +0 −0
  82. include/uapi/linux/netfilter/xt_string.h +0 −0
  83. include/uapi/linux/netfilter/xt_tcpmss.h +0 −0
  84. include/uapi/linux/netfilter/xt_tcpudp.h +0 −0
  85. include/uapi/linux/netfilter/xt_time.h +0 −0
  86. include/uapi/linux/netfilter/xt_u32.h +0 −0
include/linux/netfilter/Kbuild+0−77
@@ -1,78 +1 @@
11 header-y += ipset/
2−
3−header-y += nf_conntrack_common.h
4−header-y += nf_conntrack_ftp.h
5−header-y += nf_conntrack_sctp.h
6−header-y += nf_conntrack_tcp.h
7−header-y += nf_conntrack_tuple_common.h
8−header-y += nf_nat.h
9−header-y += nfnetlink.h
10−header-y += nfnetlink_acct.h
11−header-y += nfnetlink_compat.h
12−header-y += nfnetlink_conntrack.h
13−header-y += nfnetlink_cthelper.h
14−header-y += nfnetlink_cttimeout.h
15−header-y += nfnetlink_log.h
16−header-y += nfnetlink_queue.h
17−header-y += x_tables.h
18−header-y += xt_AUDIT.h
19−header-y += xt_CHECKSUM.h
20−header-y += xt_CLASSIFY.h
21−header-y += xt_CONNMARK.h
22−header-y += xt_CONNSECMARK.h
23−header-y += xt_CT.h
24−header-y += xt_DSCP.h
25−header-y += xt_IDLETIMER.h
26−header-y += xt_LED.h
27−header-y += xt_LOG.h
28−header-y += xt_MARK.h
29−header-y += xt_nfacct.h
30−header-y += xt_NFLOG.h
31−header-y += xt_NFQUEUE.h
32−header-y += xt_RATEEST.h
33−header-y += xt_SECMARK.h
34−header-y += xt_TCPMSS.h
35−header-y += xt_TCPOPTSTRIP.h
36−header-y += xt_TEE.h
37−header-y += xt_TPROXY.h
38−header-y += xt_addrtype.h
39−header-y += xt_cluster.h
40−header-y += xt_comment.h
41−header-y += xt_connbytes.h
42−header-y += xt_connlimit.h
43−header-y += xt_connmark.h
44−header-y += xt_conntrack.h
45−header-y += xt_cpu.h
46−header-y += xt_dccp.h
47−header-y += xt_devgroup.h
48−header-y += xt_dscp.h
49−header-y += xt_ecn.h
50−header-y += xt_esp.h
51−header-y += xt_hashlimit.h
52−header-y += xt_helper.h
53−header-y += xt_iprange.h
54−header-y += xt_ipvs.h
55−header-y += xt_length.h
56−header-y += xt_limit.h
57−header-y += xt_mac.h
58−header-y += xt_mark.h
59−header-y += xt_multiport.h
60−header-y += xt_osf.h
61−header-y += xt_owner.h
62−header-y += xt_physdev.h
63−header-y += xt_pkttype.h
64−header-y += xt_policy.h
65−header-y += xt_quota.h
66−header-y += xt_rateest.h
67−header-y += xt_realm.h
68−header-y += xt_recent.h
69−header-y += xt_set.h
70−header-y += xt_sctp.h
71−header-y += xt_socket.h
72−header-y += xt_state.h
73−header-y += xt_statistic.h
74−header-y += xt_string.h
75−header-y += xt_tcpmss.h
76−header-y += xt_tcpudp.h
77−header-y += xt_time.h
78−header-y += xt_u32.h
include/linux/netfilter/nf_conntrack_common.h+1−114
@@ -1,119 +1,8 @@
11 #ifndef _NF_CONNTRACK_COMMON_H
22 #define _NF_CONNTRACK_COMMON_H
3−/* Connection state tracking for netfilter. This is separated from,
4− but required by, the NAT layer; it can also be used by an iptables
5− extension. */
6−enum ip_conntrack_info {
7− /* Part of an established connection (either direction). */
8− IP_CT_ESTABLISHED,
93
10− /* Like NEW, but related to an existing connection, or ICMP error
11− (in either direction). */
12− IP_CT_RELATED,
4+#include <uapi/linux/netfilter/nf_conntrack_common.h>
135
14− /* Started a new connection to track (only
15− IP_CT_DIR_ORIGINAL); may be a retransmission. */
16− IP_CT_NEW,
17−
18− /* >= this indicates reply direction */
19− IP_CT_IS_REPLY,
20−
21− IP_CT_ESTABLISHED_REPLY = IP_CT_ESTABLISHED + IP_CT_IS_REPLY,
22− IP_CT_RELATED_REPLY = IP_CT_RELATED + IP_CT_IS_REPLY,
23− IP_CT_NEW_REPLY = IP_CT_NEW + IP_CT_IS_REPLY,
24− /* Number of distinct IP_CT types (no NEW in reply dirn). */
25− IP_CT_NUMBER = IP_CT_IS_REPLY * 2 - 1
26−};
27−
28−/* Bitset representing status of connection. */
29−enum ip_conntrack_status {
30− /* It's an expected connection: bit 0 set. This bit never changed */
31− IPS_EXPECTED_BIT = 0,
32− IPS_EXPECTED = (1 << IPS_EXPECTED_BIT),
33−
34− /* We've seen packets both ways: bit 1 set. Can be set, not unset. */
35− IPS_SEEN_REPLY_BIT = 1,
36− IPS_SEEN_REPLY = (1 << IPS_SEEN_REPLY_BIT),
37−
38− /* Conntrack should never be early-expired. */
39− IPS_ASSURED_BIT = 2,
40− IPS_ASSURED = (1 << IPS_ASSURED_BIT),
41−
42− /* Connection is confirmed: originating packet has left box */
43− IPS_CONFIRMED_BIT = 3,
44− IPS_CONFIRMED = (1 << IPS_CONFIRMED_BIT),
45−
46− /* Connection needs src nat in orig dir. This bit never changed. */
47− IPS_SRC_NAT_BIT = 4,
48− IPS_SRC_NAT = (1 << IPS_SRC_NAT_BIT),
49−
50− /* Connection needs dst nat in orig dir. This bit never changed. */
51− IPS_DST_NAT_BIT = 5,
52− IPS_DST_NAT = (1 << IPS_DST_NAT_BIT),
53−
54− /* Both together. */
55− IPS_NAT_MASK = (IPS_DST_NAT | IPS_SRC_NAT),
56−
57− /* Connection needs TCP sequence adjusted. */
58− IPS_SEQ_ADJUST_BIT = 6,
59− IPS_SEQ_ADJUST = (1 << IPS_SEQ_ADJUST_BIT),
60−
61− /* NAT initialization bits. */
62− IPS_SRC_NAT_DONE_BIT = 7,
63− IPS_SRC_NAT_DONE = (1 << IPS_SRC_NAT_DONE_BIT),
64−
65− IPS_DST_NAT_DONE_BIT = 8,
66− IPS_DST_NAT_DONE = (1 << IPS_DST_NAT_DONE_BIT),
67−
68− /* Both together */
69− IPS_NAT_DONE_MASK = (IPS_DST_NAT_DONE | IPS_SRC_NAT_DONE),
70−
71− /* Connection is dying (removed from lists), can not be unset. */
72− IPS_DYING_BIT = 9,
73− IPS_DYING = (1 << IPS_DYING_BIT),
74−
75− /* Connection has fixed timeout. */
76− IPS_FIXED_TIMEOUT_BIT = 10,
77− IPS_FIXED_TIMEOUT = (1 << IPS_FIXED_TIMEOUT_BIT),
78−
79− /* Conntrack is a template */
80− IPS_TEMPLATE_BIT = 11,
81− IPS_TEMPLATE = (1 << IPS_TEMPLATE_BIT),
82−
83− /* Conntrack is a fake untracked entry */
84− IPS_UNTRACKED_BIT = 12,
85− IPS_UNTRACKED = (1 << IPS_UNTRACKED_BIT),
86−
87− /* Conntrack got a helper explicitly attached via CT target. */
88− IPS_HELPER_BIT = 13,
89− IPS_HELPER = (1 << IPS_HELPER_BIT),
90−};
91−
92−/* Connection tracking event types */
93−enum ip_conntrack_events {
94− IPCT_NEW, /* new conntrack */
95− IPCT_RELATED, /* related conntrack */
96− IPCT_DESTROY, /* destroyed conntrack */
97− IPCT_REPLY, /* connection has seen two-way traffic */
98− IPCT_ASSURED, /* connection status has changed to assured */
99− IPCT_PROTOINFO, /* protocol information has changed */
100− IPCT_HELPER, /* new helper has been set */
101− IPCT_MARK, /* new mark has been set */
102− IPCT_NATSEQADJ, /* NAT is doing sequence adjustment */
103− IPCT_SECMARK, /* new security mark has been set */
104−};
105−
106−enum ip_conntrack_expect_events {
107− IPEXP_NEW, /* new expectation */
108− IPEXP_DESTROY, /* destroyed expectation */
109−};
110−
111−/* expectation flags */
112−#define NF_CT_EXPECT_PERMANENT 0x1
113−#define NF_CT_EXPECT_INACTIVE 0x2
114−#define NF_CT_EXPECT_USERSPACE 0x4
115−
116−#ifdef __KERNEL__
1176 struct ip_conntrack_stat {
1187 unsigned int searched;
1198 unsigned int found;
@@ -136,6 +25,4 @@ struct ip_conntrack_stat { · 16 unmodified lines
13625 /* call to create an explicit dependency on nf_conntrack. */
13726 extern void need_conntrack(void);
13827
139−#endif /* __KERNEL__ */
140−
14128 #endif /* _NF_CONNTRACK_COMMON_H */
include/linux/netfilter/nf_conntrack_ftp.h+1−15
@@ -1,20 +1,8 @@
11 #ifndef _NF_CONNTRACK_FTP_H
22 #define _NF_CONNTRACK_FTP_H
3−/* FTP tracking. */
43
5−/* This enum is exposed to userspace */
6−enum nf_ct_ftp_type {
7− /* PORT command from client */
8− NF_CT_FTP_PORT,
9− /* PASV response from server */
10− NF_CT_FTP_PASV,
11− /* EPRT command from client */
12− NF_CT_FTP_EPRT,
13− /* EPSV response from server */
14− NF_CT_FTP_EPSV,
15−};
4+#include <uapi/linux/netfilter/nf_conntrack_ftp.h>
165
17−#ifdef __KERNEL__
186
197 #define FTP_PORT 21
208
@@ -42,6 +30,4 @@ extern unsigned int (*nf_nat_ftp_hook)(struct sk_buff *skb, · 21 unmodified lines
4230 unsigned int matchoff,
4331 unsigned int matchlen,
4432 struct nf_conntrack_expect *exp);
45−#endif /* __KERNEL__ */
46−
4733 #endif /* _NF_CONNTRACK_FTP_H */
include/linux/netfilter/nf_conntrack_tcp.h+1−48
@@ -1,53 +1,8 @@
11 #ifndef _NF_CONNTRACK_TCP_H
22 #define _NF_CONNTRACK_TCP_H
3−/* TCP tracking. */
43
5−#include <linux/types.h>
4+#include <uapi/linux/netfilter/nf_conntrack_tcp.h>
65
7−/* This is exposed to userspace (ctnetlink) */
8−enum tcp_conntrack {
9− TCP_CONNTRACK_NONE,
10− TCP_CONNTRACK_SYN_SENT,
11− TCP_CONNTRACK_SYN_RECV,
12− TCP_CONNTRACK_ESTABLISHED,
13− TCP_CONNTRACK_FIN_WAIT,
14− TCP_CONNTRACK_CLOSE_WAIT,
15− TCP_CONNTRACK_LAST_ACK,
16− TCP_CONNTRACK_TIME_WAIT,
17− TCP_CONNTRACK_CLOSE,
18− TCP_CONNTRACK_LISTEN, /* obsolete */
19−#define TCP_CONNTRACK_SYN_SENT2 TCP_CONNTRACK_LISTEN
20− TCP_CONNTRACK_MAX,
21− TCP_CONNTRACK_IGNORE,
22− TCP_CONNTRACK_RETRANS,
23− TCP_CONNTRACK_UNACK,
24− TCP_CONNTRACK_TIMEOUT_MAX
25−};
26−
27−/* Window scaling is advertised by the sender */
28−#define IP_CT_TCP_FLAG_WINDOW_SCALE 0x01
29−
30−/* SACK is permitted by the sender */
31−#define IP_CT_TCP_FLAG_SACK_PERM 0x02
32−
33−/* This sender sent FIN first */
34−#define IP_CT_TCP_FLAG_CLOSE_INIT 0x04
35−
36−/* Be liberal in window checking */
37−#define IP_CT_TCP_FLAG_BE_LIBERAL 0x08
38−
39−/* Has unacknowledged data */
40−#define IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED 0x10
41−
42−/* The field td_maxack has been set */
43−#define IP_CT_TCP_FLAG_MAXACK_SET 0x20
44−
45−struct nf_ct_tcp_flags {
46− __u8 flags;
47− __u8 mask;
48−};
49−
50−#ifdef __KERNEL__
516
527 struct ip_ct_tcp_state {
538 u_int32_t td_end; /* max of seq + len */
@@ -74,6 +29,4 @@ struct ip_ct_tcp { · 20 unmodified lines
7429 u_int8_t last_flags; /* Last flags set */
7530 };
7631
77−#endif /* __KERNEL__ */
78−
7932 #endif /* _NF_CONNTRACK_TCP_H */
include/linux/netfilter/nfnetlink.h+1−54
@@ -1,63 +1,11 @@
11 #ifndef _NFNETLINK_H
22 #define _NFNETLINK_H
3−#include <linux/types.h>
4−#include <linux/netfilter/nfnetlink_compat.h>
53
6−enum nfnetlink_groups {
7− NFNLGRP_NONE,
8−#define NFNLGRP_NONE NFNLGRP_NONE
9− NFNLGRP_CONNTRACK_NEW,
10−#define NFNLGRP_CONNTRACK_NEW NFNLGRP_CONNTRACK_NEW
11− NFNLGRP_CONNTRACK_UPDATE,
12−#define NFNLGRP_CONNTRACK_UPDATE NFNLGRP_CONNTRACK_UPDATE
13− NFNLGRP_CONNTRACK_DESTROY,
14−#define NFNLGRP_CONNTRACK_DESTROY NFNLGRP_CONNTRACK_DESTROY
15− NFNLGRP_CONNTRACK_EXP_NEW,
16−#define NFNLGRP_CONNTRACK_EXP_NEW NFNLGRP_CONNTRACK_EXP_NEW
17− NFNLGRP_CONNTRACK_EXP_UPDATE,
18−#define NFNLGRP_CONNTRACK_EXP_UPDATE NFNLGRP_CONNTRACK_EXP_UPDATE
19− NFNLGRP_CONNTRACK_EXP_DESTROY,
20−#define NFNLGRP_CONNTRACK_EXP_DESTROY NFNLGRP_CONNTRACK_EXP_DESTROY
21− __NFNLGRP_MAX,
22−};
23−#define NFNLGRP_MAX (__NFNLGRP_MAX - 1)
24−
25−/* General form of address family dependent message.
26− */
27−struct nfgenmsg {
28− __u8 nfgen_family; /* AF_xxx */
29− __u8 version; /* nfnetlink version */
30− __be16 res_id; /* resource id */
31−};
32−
33−#define NFNETLINK_V0 0
34−
35−/* netfilter netlink message types are split in two pieces:
36− * 8 bit subsystem, 8bit operation.
37− */
38−
39−#define NFNL_SUBSYS_ID(x) ((x & 0xff00) >> 8)
40−#define NFNL_MSG_TYPE(x) (x & 0x00ff)
41−
42−/* No enum here, otherwise __stringify() trick of MODULE_ALIAS_NFNL_SUBSYS()
43− * won't work anymore */
44−#define NFNL_SUBSYS_NONE 0
45−#define NFNL_SUBSYS_CTNETLINK 1
46−#define NFNL_SUBSYS_CTNETLINK_EXP 2
47−#define NFNL_SUBSYS_QUEUE 3
48−#define NFNL_SUBSYS_ULOG 4
49−#define NFNL_SUBSYS_OSF 5
50−#define NFNL_SUBSYS_IPSET 6
51−#define NFNL_SUBSYS_ACCT 7
52−#define NFNL_SUBSYS_CTNETLINK_TIMEOUT 8
53−#define NFNL_SUBSYS_CTHELPER 9
54−#define NFNL_SUBSYS_COUNT 10
55−
56−#ifdef __KERNEL__
574
585 #include <linux/netlink.h>
596 #include <linux/capability.h>
607 #include <net/netlink.h>
8+#include <uapi/linux/netfilter/nfnetlink.h>
619
6210 struct nfnl_callback {
6311 int (*call)(struct sock *nl, struct sk_buff *skb,
@@ -92,5 +40,4 @@ extern void nfnl_unlock(void); · 28 unmodified lines
9240 #define MODULE_ALIAS_NFNL_SUBSYS(subsys) \
9341 MODULE_ALIAS("nfnetlink-subsys-" __stringify(subsys))
9442
95−#endif /* __KERNEL__ */
9643 #endif /* _NFNETLINK_H */
include/linux/netfilter/nfnetlink_acct.h+1−24
@@ -1,29 +1,8 @@
11 #ifndef _NFNL_ACCT_H_
22 #define _NFNL_ACCT_H_
33
4−#ifndef NFACCT_NAME_MAX
5−#define NFACCT_NAME_MAX 32
6−#endif
4+#include <uapi/linux/netfilter/nfnetlink_acct.h>
75
8−enum nfnl_acct_msg_types {
9− NFNL_MSG_ACCT_NEW,
10− NFNL_MSG_ACCT_GET,
11− NFNL_MSG_ACCT_GET_CTRZERO,
12− NFNL_MSG_ACCT_DEL,
13− NFNL_MSG_ACCT_MAX
14−};
15−
16−enum nfnl_acct_type {
17− NFACCT_UNSPEC,
18− NFACCT_NAME,
19− NFACCT_PKTS,
20− NFACCT_BYTES,
21− NFACCT_USE,
22− __NFACCT_MAX
23−};
24−#define NFACCT_MAX (__NFACCT_MAX - 1)
25−
26−#ifdef __KERNEL__
276
287 struct nf_acct;
298
@@ -31,6 +10,4 @@ extern struct nf_acct *nfnl_acct_find_get(const char *filter_name); · 1 unmodified line
3110 extern void nfnl_acct_put(struct nf_acct *acct);
3211 extern void nfnl_acct_update(const struct sk_buff *skb, struct nf_acct *nfacct);
3312
34−#endif /* __KERNEL__ */
35−
3613 #endif /* _NFNL_ACCT_H */
include/linux/netfilter/x_tables.h+1−185
@@ -1,191 +1,9 @@
11 #ifndef _X_TABLES_H
22 #define _X_TABLES_H
3−#include <linux/kernel.h>
4−#include <linux/types.h>
53
6−#define XT_FUNCTION_MAXNAMELEN 30
7−#define XT_EXTENSION_MAXNAMELEN 29
8−#define XT_TABLE_MAXNAMELEN 32
9−
10−struct xt_entry_match {
11− union {
12− struct {
13− __u16 match_size;
14−
15− /* Used by userspace */
16− char name[XT_EXTENSION_MAXNAMELEN];
17− __u8 revision;
18− } user;
19− struct {
20− __u16 match_size;
21−
22− /* Used inside the kernel */
23− struct xt_match *match;
24− } kernel;
25−
26− /* Total length */
27− __u16 match_size;
28− } u;
29−
30− unsigned char data[0];
31−};
32−
33−struct xt_entry_target {
34− union {
35− struct {
36− __u16 target_size;
37−
38− /* Used by userspace */
39− char name[XT_EXTENSION_MAXNAMELEN];
40− __u8 revision;
41− } user;
42− struct {
43− __u16 target_size;
44−
45− /* Used inside the kernel */
46− struct xt_target *target;
47− } kernel;
48−
49− /* Total length */
50− __u16 target_size;
51− } u;
52−
53− unsigned char data[0];
54−};
55−
56−#define XT_TARGET_INIT(__name, __size) \
57−{ \
58− .target.u.user = { \
59− .target_size = XT_ALIGN(__size), \
60− .name = __name, \
61− }, \
62−}
63−
64−struct xt_standard_target {
65− struct xt_entry_target target;
66− int verdict;
67−};
68−
69−struct xt_error_target {
70− struct xt_entry_target target;
71− char errorname[XT_FUNCTION_MAXNAMELEN];
72−};
73−
74−/* The argument to IPT_SO_GET_REVISION_*. Returns highest revision
75− * kernel supports, if >= revision. */
76−struct xt_get_revision {
77− char name[XT_EXTENSION_MAXNAMELEN];
78− __u8 revision;
79−};
80−
81−/* CONTINUE verdict for targets */
82−#define XT_CONTINUE 0xFFFFFFFF
83−
84−/* For standard target */
85−#define XT_RETURN (-NF_REPEAT - 1)
86−
87−/* this is a dummy structure to find out the alignment requirement for a struct
88− * containing all the fundamental data types that are used in ipt_entry,
89− * ip6t_entry and arpt_entry. This sucks, and it is a hack. It will be my
90− * personal pleasure to remove it -HW
91− */
92−struct _xt_align {
93− __u8 u8;
94− __u16 u16;
95− __u32 u32;
96− __u64 u64;
97−};
98−
99−#define XT_ALIGN(s) __ALIGN_KERNEL((s), __alignof__(struct _xt_align))
100−
101−/* Standard return verdict, or do jump. */
102−#define XT_STANDARD_TARGET ""
103−/* Error verdict. */
104−#define XT_ERROR_TARGET "ERROR"
105−
106−#define SET_COUNTER(c,b,p) do { (c).bcnt = (b); (c).pcnt = (p); } while(0)
107−#define ADD_COUNTER(c,b,p) do { (c).bcnt += (b); (c).pcnt += (p); } while(0)
108−
109−struct xt_counters {
110− __u64 pcnt, bcnt; /* Packet and byte counters */
111−};
112−
113−/* The argument to IPT_SO_ADD_COUNTERS. */
114−struct xt_counters_info {
115− /* Which table. */
116− char name[XT_TABLE_MAXNAMELEN];
117−
118− unsigned int num_counters;
119−
120− /* The counters (actually `number' of these). */
121− struct xt_counters counters[0];
122−};
123−
124−#define XT_INV_PROTO 0x40 /* Invert the sense of PROTO. */
125−
126−#ifndef __KERNEL__
127−/* fn returns 0 to continue iteration */
128−#define XT_MATCH_ITERATE(type, e, fn, args...) \
129−({ \
130− unsigned int __i; \
131− int __ret = 0; \
132− struct xt_entry_match *__m; \
133− \
134− for (__i = sizeof(type); \
135− __i < (e)->target_offset; \
136− __i += __m->u.match_size) { \
137− __m = (void *)e + __i; \
138− \
139− __ret = fn(__m , ## args); \
140− if (__ret != 0) \
141− break; \
142− } \
143− __ret; \
144−})
145−
146−/* fn returns 0 to continue iteration */
147−#define XT_ENTRY_ITERATE_CONTINUE(type, entries, size, n, fn, args...) \
148−({ \
149− unsigned int __i, __n; \
150− int __ret = 0; \
151− type *__entry; \
152− \
153− for (__i = 0, __n = 0; __i < (size); \
154− __i += __entry->next_offset, __n++) { \
155− __entry = (void *)(entries) + __i; \
156− if (__n < n) \
157− continue; \
158− \
159− __ret = fn(__entry , ## args); \
160− if (__ret != 0) \
161− break; \
162− } \
163− __ret; \
164−})
165−
166−/* fn returns 0 to continue iteration */
167−#define XT_ENTRY_ITERATE(type, entries, size, fn, args...) \
168− XT_ENTRY_ITERATE_CONTINUE(type, entries, size, 0, fn, args)
169−
170−#endif /* !__KERNEL__ */
171−
172−/* pos is normally a struct ipt_entry/ip6t_entry/etc. */
173−#define xt_entry_foreach(pos, ehead, esize) \
174− for ((pos) = (typeof(pos))(ehead); \
175− (pos) < (typeof(pos))((char *)(ehead) + (esize)); \
176− (pos) = (typeof(pos))((char *)(pos) + (pos)->next_offset))
177−
178−/* can only be xt_entry_match, so no use of typeof here */
179−#define xt_ematch_foreach(pos, entry) \
180− for ((pos) = (struct xt_entry_match *)entry->elems; \
181− (pos) < (struct xt_entry_match *)((char *)(entry) + \
182− (entry)->target_offset); \
183− (pos) = (struct xt_entry_match *)((char *)(pos) + \
184− (pos)->u.match_size))
185−
186−#ifdef __KERNEL__
1874
1885 #include <linux/netdevice.h>
6+#include <uapi/linux/netfilter/x_tables.h>
1897
1908 /**
1919 * struct xt_action_param - parameters for matches/targets
@@ -617,6 +435,4 @@ extern int xt_compat_target_to_user(const struct xt_entry_target *t, · 425 unmodified lines
617435 void __user **dstptr, unsigned int *size);
618436
619437 #endif /* CONFIG_COMPAT */
620−#endif /* __KERNEL__ */
621−
622438 #endif /* _X_TABLES_H */
include/linux/netfilter/xt_hashlimit.h+1−70
@@ -1,78 +1,9 @@
11 #ifndef _XT_HASHLIMIT_H
22 #define _XT_HASHLIMIT_H
33
4−#include <linux/types.h>
4+#include <uapi/linux/netfilter/xt_hashlimit.h>
55
6−/* timings are in milliseconds. */
7−#define XT_HASHLIMIT_SCALE 10000
8−/* 1/10,000 sec period => max of 10,000/sec. Min rate is then 429490
9− * seconds, or one packet every 59 hours.
10− */
11−
12−/* packet length accounting is done in 16-byte steps */
13−#define XT_HASHLIMIT_BYTE_SHIFT 4
14−
15−/* details of this structure hidden by the implementation */
16−struct xt_hashlimit_htable;
17−
18−enum {
19− XT_HASHLIMIT_HASH_DIP = 1 << 0,
20− XT_HASHLIMIT_HASH_DPT = 1 << 1,
21− XT_HASHLIMIT_HASH_SIP = 1 << 2,
22− XT_HASHLIMIT_HASH_SPT = 1 << 3,
23− XT_HASHLIMIT_INVERT = 1 << 4,
24− XT_HASHLIMIT_BYTES = 1 << 5,
25−};
26−#ifdef __KERNEL__
276 #define XT_HASHLIMIT_ALL (XT_HASHLIMIT_HASH_DIP | XT_HASHLIMIT_HASH_DPT | \
287 XT_HASHLIMIT_HASH_SIP | XT_HASHLIMIT_HASH_SPT | \
298 XT_HASHLIMIT_INVERT | XT_HASHLIMIT_BYTES)
30−#endif
31−
32−struct hashlimit_cfg {
33− __u32 mode; /* bitmask of XT_HASHLIMIT_HASH_* */
34− __u32 avg; /* Average secs between packets * scale */
35− __u32 burst; /* Period multiplier for upper limit. */
36−
37− /* user specified */
38− __u32 size; /* how many buckets */
39− __u32 max; /* max number of entries */
40− __u32 gc_interval; /* gc interval */
41− __u32 expire; /* when do entries expire? */
42−};
43−
44−struct xt_hashlimit_info {
45− char name [IFNAMSIZ]; /* name */
46− struct hashlimit_cfg cfg;
47−
48− /* Used internally by the kernel */
49− struct xt_hashlimit_htable *hinfo;
50− union {
51− void *ptr;
52− struct xt_hashlimit_info *master;
53− } u;
54−};
55−
56−struct hashlimit_cfg1 {
57− __u32 mode; /* bitmask of XT_HASHLIMIT_HASH_* */
58− __u32 avg; /* Average secs between packets * scale */
59− __u32 burst; /* Period multiplier for upper limit. */
60−
61− /* user specified */
62− __u32 size; /* how many buckets */
63− __u32 max; /* max number of entries */
64− __u32 gc_interval; /* gc interval */
65− __u32 expire; /* when do entries expire? */
66−
67− __u8 srcmask, dstmask;
68−};
69−
70−struct xt_hashlimit_mtinfo1 {
71− char name[IFNAMSIZ];
72− struct hashlimit_cfg1 cfg;
73−
74− /* Used internally by the kernel */
75− struct xt_hashlimit_htable *hinfo __attribute__((aligned(8)));
76−};
77−
789 #endif /*_XT_HASHLIMIT_H*/
include/linux/netfilter/xt_physdev.h+1−20
@@ -1,26 +1,7 @@
11 #ifndef _XT_PHYSDEV_H
22 #define _XT_PHYSDEV_H
33
4−#include <linux/types.h>
5−
6−#ifdef __KERNEL__
74 #include <linux/if.h>
8−#endif
9−
10−#define XT_PHYSDEV_OP_IN 0x01
11−#define XT_PHYSDEV_OP_OUT 0x02
12−#define XT_PHYSDEV_OP_BRIDGED 0x04
13−#define XT_PHYSDEV_OP_ISIN 0x08
14−#define XT_PHYSDEV_OP_ISOUT 0x10
15−#define XT_PHYSDEV_OP_MASK (0x20 - 1)
16−
17−struct xt_physdev_info {
18− char physindev[IFNAMSIZ];
19− char in_mask[IFNAMSIZ];
20− char physoutdev[IFNAMSIZ];
21− char out_mask[IFNAMSIZ];
22− __u8 invert;
23− __u8 bitmask;
24−};
5+#include <uapi/linux/netfilter/xt_physdev.h>
256
267 #endif /*_XT_PHYSDEV_H*/
include/uapi/linux/netfilter/Kbuild+76−0
@@ -1,2 +1,78 @@
11 # UAPI Header export list
22 header-y += ipset/
3+header-y += nf_conntrack_common.h
4+header-y += nf_conntrack_ftp.h
5+header-y += nf_conntrack_sctp.h
6+header-y += nf_conntrack_tcp.h
7+header-y += nf_conntrack_tuple_common.h
8+header-y += nf_nat.h
9+header-y += nfnetlink.h
10+header-y += nfnetlink_acct.h
11+header-y += nfnetlink_compat.h
12+header-y += nfnetlink_conntrack.h
13+header-y += nfnetlink_cthelper.h
14+header-y += nfnetlink_cttimeout.h
15+header-y += nfnetlink_log.h
16+header-y += nfnetlink_queue.h
17+header-y += x_tables.h
18+header-y += xt_AUDIT.h
19+header-y += xt_CHECKSUM.h
20+header-y += xt_CLASSIFY.h
21+header-y += xt_CONNMARK.h
22+header-y += xt_CONNSECMARK.h
23+header-y += xt_CT.h
24+header-y += xt_DSCP.h
25+header-y += xt_IDLETIMER.h
26+header-y += xt_LED.h
27+header-y += xt_LOG.h
28+header-y += xt_MARK.h
29+header-y += xt_NFLOG.h
30+header-y += xt_NFQUEUE.h
31+header-y += xt_RATEEST.h
32+header-y += xt_SECMARK.h
33+header-y += xt_TCPMSS.h
34+header-y += xt_TCPOPTSTRIP.h
35+header-y += xt_TEE.h
36+header-y += xt_TPROXY.h
37+header-y += xt_addrtype.h
38+header-y += xt_cluster.h
39+header-y += xt_comment.h
40+header-y += xt_connbytes.h
41+header-y += xt_connlimit.h
42+header-y += xt_connmark.h
43+header-y += xt_conntrack.h
44+header-y += xt_cpu.h
45+header-y += xt_dccp.h
46+header-y += xt_devgroup.h
47+header-y += xt_dscp.h
48+header-y += xt_ecn.h
49+header-y += xt_esp.h
50+header-y += xt_hashlimit.h
51+header-y += xt_helper.h
52+header-y += xt_iprange.h
53+header-y += xt_ipvs.h
54+header-y += xt_length.h
55+header-y += xt_limit.h
56+header-y += xt_mac.h
57+header-y += xt_mark.h
58+header-y += xt_multiport.h
59+header-y += xt_nfacct.h
60+header-y += xt_osf.h
61+header-y += xt_owner.h
62+header-y += xt_physdev.h
63+header-y += xt_pkttype.h
64+header-y += xt_policy.h
65+header-y += xt_quota.h
66+header-y += xt_rateest.h
67+header-y += xt_realm.h
68+header-y += xt_recent.h
69+header-y += xt_sctp.h
70+header-y += xt_set.h
71+header-y += xt_socket.h
72+header-y += xt_state.h
73+header-y += xt_statistic.h
74+header-y += xt_string.h
75+header-y += xt_tcpmss.h
76+header-y += xt_tcpudp.h
77+header-y += xt_time.h
78+header-y += xt_u32.h
include/uapi/linux/netfilter/nf_conntrack_common.h+117−0
@@ -0,0 +1,117 @@
1+#ifndef _UAPI_NF_CONNTRACK_COMMON_H
2+#define _UAPI_NF_CONNTRACK_COMMON_H
3+/* Connection state tracking for netfilter. This is separated from,
4+ but required by, the NAT layer; it can also be used by an iptables
5+ extension. */
6+enum ip_conntrack_info {
7+ /* Part of an established connection (either direction). */
8+ IP_CT_ESTABLISHED,
9+
10+ /* Like NEW, but related to an existing connection, or ICMP error
11+ (in either direction). */
12+ IP_CT_RELATED,
13+
14+ /* Started a new connection to track (only
15+ IP_CT_DIR_ORIGINAL); may be a retransmission. */
16+ IP_CT_NEW,
17+
18+ /* >= this indicates reply direction */
19+ IP_CT_IS_REPLY,
20+
21+ IP_CT_ESTABLISHED_REPLY = IP_CT_ESTABLISHED + IP_CT_IS_REPLY,
22+ IP_CT_RELATED_REPLY = IP_CT_RELATED + IP_CT_IS_REPLY,
23+ IP_CT_NEW_REPLY = IP_CT_NEW + IP_CT_IS_REPLY,
24+ /* Number of distinct IP_CT types (no NEW in reply dirn). */
25+ IP_CT_NUMBER = IP_CT_IS_REPLY * 2 - 1
26+};
27+
28+/* Bitset representing status of connection. */
29+enum ip_conntrack_status {
30+ /* It's an expected connection: bit 0 set. This bit never changed */
31+ IPS_EXPECTED_BIT = 0,
32+ IPS_EXPECTED = (1 << IPS_EXPECTED_BIT),
33+
34+ /* We've seen packets both ways: bit 1 set. Can be set, not unset. */
35+ IPS_SEEN_REPLY_BIT = 1,
36+ IPS_SEEN_REPLY = (1 << IPS_SEEN_REPLY_BIT),
37+
38+ /* Conntrack should never be early-expired. */
39+ IPS_ASSURED_BIT = 2,
40+ IPS_ASSURED = (1 << IPS_ASSURED_BIT),
41+
42+ /* Connection is confirmed: originating packet has left box */
43+ IPS_CONFIRMED_BIT = 3,
44+ IPS_CONFIRMED = (1 << IPS_CONFIRMED_BIT),
45+
46+ /* Connection needs src nat in orig dir. This bit never changed. */
47+ IPS_SRC_NAT_BIT = 4,
48+ IPS_SRC_NAT = (1 << IPS_SRC_NAT_BIT),
49+
50+ /* Connection needs dst nat in orig dir. This bit never changed. */
51+ IPS_DST_NAT_BIT = 5,
52+ IPS_DST_NAT = (1 << IPS_DST_NAT_BIT),
53+
54+ /* Both together. */
55+ IPS_NAT_MASK = (IPS_DST_NAT | IPS_SRC_NAT),
56+
57+ /* Connection needs TCP sequence adjusted. */
58+ IPS_SEQ_ADJUST_BIT = 6,
59+ IPS_SEQ_ADJUST = (1 << IPS_SEQ_ADJUST_BIT),
60+
61+ /* NAT initialization bits. */
62+ IPS_SRC_NAT_DONE_BIT = 7,
63+ IPS_SRC_NAT_DONE = (1 << IPS_SRC_NAT_DONE_BIT),
64+
65+ IPS_DST_NAT_DONE_BIT = 8,
66+ IPS_DST_NAT_DONE = (1 << IPS_DST_NAT_DONE_BIT),
67+
68+ /* Both together */
69+ IPS_NAT_DONE_MASK = (IPS_DST_NAT_DONE | IPS_SRC_NAT_DONE),
70+
71+ /* Connection is dying (removed from lists), can not be unset. */
72+ IPS_DYING_BIT = 9,
73+ IPS_DYING = (1 << IPS_DYING_BIT),
74+
75+ /* Connection has fixed timeout. */
76+ IPS_FIXED_TIMEOUT_BIT = 10,
77+ IPS_FIXED_TIMEOUT = (1 << IPS_FIXED_TIMEOUT_BIT),
78+
79+ /* Conntrack is a template */
80+ IPS_TEMPLATE_BIT = 11,
81+ IPS_TEMPLATE = (1 << IPS_TEMPLATE_BIT),
82+
83+ /* Conntrack is a fake untracked entry */
84+ IPS_UNTRACKED_BIT = 12,
85+ IPS_UNTRACKED = (1 << IPS_UNTRACKED_BIT),
86+
87+ /* Conntrack got a helper explicitly attached via CT target. */
88+ IPS_HELPER_BIT = 13,
89+ IPS_HELPER = (1 << IPS_HELPER_BIT),
90+};
91+
92+/* Connection tracking event types */
93+enum ip_conntrack_events {
94+ IPCT_NEW, /* new conntrack */
95+ IPCT_RELATED, /* related conntrack */
96+ IPCT_DESTROY, /* destroyed conntrack */
97+ IPCT_REPLY, /* connection has seen two-way traffic */
98+ IPCT_ASSURED, /* connection status has changed to assured */
99+ IPCT_PROTOINFO, /* protocol information has changed */
100+ IPCT_HELPER, /* new helper has been set */
101+ IPCT_MARK, /* new mark has been set */
102+ IPCT_NATSEQADJ, /* NAT is doing sequence adjustment */
103+ IPCT_SECMARK, /* new security mark has been set */
104+};
105+
106+enum ip_conntrack_expect_events {
107+ IPEXP_NEW, /* new expectation */
108+ IPEXP_DESTROY, /* destroyed expectation */
109+};
110+
111+/* expectation flags */
112+#define NF_CT_EXPECT_PERMANENT 0x1
113+#define NF_CT_EXPECT_INACTIVE 0x2
114+#define NF_CT_EXPECT_USERSPACE 0x4
115+
116+
117+#endif /* _UAPI_NF_CONNTRACK_COMMON_H */
include/uapi/linux/netfilter/nf_conntrack_ftp.h+18−0
@@ -0,0 +1,18 @@
1+#ifndef _UAPI_NF_CONNTRACK_FTP_H
2+#define _UAPI_NF_CONNTRACK_FTP_H
3+/* FTP tracking. */
4+
5+/* This enum is exposed to userspace */
6+enum nf_ct_ftp_type {
7+ /* PORT command from client */
8+ NF_CT_FTP_PORT,
9+ /* PASV response from server */
10+ NF_CT_FTP_PASV,
11+ /* EPRT command from client */
12+ NF_CT_FTP_EPRT,
13+ /* EPSV response from server */
14+ NF_CT_FTP_EPSV,
15+};
16+
17+
18+#endif /* _UAPI_NF_CONNTRACK_FTP_H */
include/uapi/linux/netfilter/nf_conntrack_sctp.hrenamed from include/linux/netfilter/nf_conntrack_sctp.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/nf_conntrack_tcp.h+51−0
@@ -0,0 +1,51 @@
1+#ifndef _UAPI_NF_CONNTRACK_TCP_H
2+#define _UAPI_NF_CONNTRACK_TCP_H
3+/* TCP tracking. */
4+
5+#include <linux/types.h>
6+
7+/* This is exposed to userspace (ctnetlink) */
8+enum tcp_conntrack {
9+ TCP_CONNTRACK_NONE,
10+ TCP_CONNTRACK_SYN_SENT,
11+ TCP_CONNTRACK_SYN_RECV,
12+ TCP_CONNTRACK_ESTABLISHED,
13+ TCP_CONNTRACK_FIN_WAIT,
14+ TCP_CONNTRACK_CLOSE_WAIT,
15+ TCP_CONNTRACK_LAST_ACK,
16+ TCP_CONNTRACK_TIME_WAIT,
17+ TCP_CONNTRACK_CLOSE,
18+ TCP_CONNTRACK_LISTEN, /* obsolete */
19+#define TCP_CONNTRACK_SYN_SENT2 TCP_CONNTRACK_LISTEN
20+ TCP_CONNTRACK_MAX,
21+ TCP_CONNTRACK_IGNORE,
22+ TCP_CONNTRACK_RETRANS,
23+ TCP_CONNTRACK_UNACK,
24+ TCP_CONNTRACK_TIMEOUT_MAX
25+};
26+
27+/* Window scaling is advertised by the sender */
28+#define IP_CT_TCP_FLAG_WINDOW_SCALE 0x01
29+
30+/* SACK is permitted by the sender */
31+#define IP_CT_TCP_FLAG_SACK_PERM 0x02
32+
33+/* This sender sent FIN first */
34+#define IP_CT_TCP_FLAG_CLOSE_INIT 0x04
35+
36+/* Be liberal in window checking */
37+#define IP_CT_TCP_FLAG_BE_LIBERAL 0x08
38+
39+/* Has unacknowledged data */
40+#define IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED 0x10
41+
42+/* The field td_maxack has been set */
43+#define IP_CT_TCP_FLAG_MAXACK_SET 0x20
44+
45+struct nf_ct_tcp_flags {
46+ __u8 flags;
47+ __u8 mask;
48+};
49+
50+
51+#endif /* _UAPI_NF_CONNTRACK_TCP_H */
include/uapi/linux/netfilter/nf_conntrack_tuple_common.hrenamed from include/linux/netfilter/nf_conntrack_tuple_common.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/nf_nat.hrenamed from include/linux/netfilter/nf_nat.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/nfnetlink.h+56−0
@@ -0,0 +1,56 @@
1+#ifndef _UAPI_NFNETLINK_H
2+#define _UAPI_NFNETLINK_H
3+#include <linux/types.h>
4+#include <linux/netfilter/nfnetlink_compat.h>
5+
6+enum nfnetlink_groups {
7+ NFNLGRP_NONE,
8+#define NFNLGRP_NONE NFNLGRP_NONE
9+ NFNLGRP_CONNTRACK_NEW,
10+#define NFNLGRP_CONNTRACK_NEW NFNLGRP_CONNTRACK_NEW
11+ NFNLGRP_CONNTRACK_UPDATE,
12+#define NFNLGRP_CONNTRACK_UPDATE NFNLGRP_CONNTRACK_UPDATE
13+ NFNLGRP_CONNTRACK_DESTROY,
14+#define NFNLGRP_CONNTRACK_DESTROY NFNLGRP_CONNTRACK_DESTROY
15+ NFNLGRP_CONNTRACK_EXP_NEW,
16+#define NFNLGRP_CONNTRACK_EXP_NEW NFNLGRP_CONNTRACK_EXP_NEW
17+ NFNLGRP_CONNTRACK_EXP_UPDATE,
18+#define NFNLGRP_CONNTRACK_EXP_UPDATE NFNLGRP_CONNTRACK_EXP_UPDATE
19+ NFNLGRP_CONNTRACK_EXP_DESTROY,
20+#define NFNLGRP_CONNTRACK_EXP_DESTROY NFNLGRP_CONNTRACK_EXP_DESTROY
21+ __NFNLGRP_MAX,
22+};
23+#define NFNLGRP_MAX (__NFNLGRP_MAX - 1)
24+
25+/* General form of address family dependent message.
26+ */
27+struct nfgenmsg {
28+ __u8 nfgen_family; /* AF_xxx */
29+ __u8 version; /* nfnetlink version */
30+ __be16 res_id; /* resource id */
31+};
32+
33+#define NFNETLINK_V0 0
34+
35+/* netfilter netlink message types are split in two pieces:
36+ * 8 bit subsystem, 8bit operation.
37+ */
38+
39+#define NFNL_SUBSYS_ID(x) ((x & 0xff00) >> 8)
40+#define NFNL_MSG_TYPE(x) (x & 0x00ff)
41+
42+/* No enum here, otherwise __stringify() trick of MODULE_ALIAS_NFNL_SUBSYS()
43+ * won't work anymore */
44+#define NFNL_SUBSYS_NONE 0
45+#define NFNL_SUBSYS_CTNETLINK 1
46+#define NFNL_SUBSYS_CTNETLINK_EXP 2
47+#define NFNL_SUBSYS_QUEUE 3
48+#define NFNL_SUBSYS_ULOG 4
49+#define NFNL_SUBSYS_OSF 5
50+#define NFNL_SUBSYS_IPSET 6
51+#define NFNL_SUBSYS_ACCT 7
52+#define NFNL_SUBSYS_CTNETLINK_TIMEOUT 8
53+#define NFNL_SUBSYS_CTHELPER 9
54+#define NFNL_SUBSYS_COUNT 10
55+
56+#endif /* _UAPI_NFNETLINK_H */
include/uapi/linux/netfilter/nfnetlink_acct.h+27−0
@@ -0,0 +1,27 @@
1+#ifndef _UAPI_NFNL_ACCT_H_
2+#define _UAPI_NFNL_ACCT_H_
3+
4+#ifndef NFACCT_NAME_MAX
5+#define NFACCT_NAME_MAX 32
6+#endif
7+
8+enum nfnl_acct_msg_types {
9+ NFNL_MSG_ACCT_NEW,
10+ NFNL_MSG_ACCT_GET,
11+ NFNL_MSG_ACCT_GET_CTRZERO,
12+ NFNL_MSG_ACCT_DEL,
13+ NFNL_MSG_ACCT_MAX
14+};
15+
16+enum nfnl_acct_type {
17+ NFACCT_UNSPEC,
18+ NFACCT_NAME,
19+ NFACCT_PKTS,
20+ NFACCT_BYTES,
21+ NFACCT_USE,
22+ __NFACCT_MAX
23+};
24+#define NFACCT_MAX (__NFACCT_MAX - 1)
25+
26+
27+#endif /* _UAPI_NFNL_ACCT_H_ */
include/uapi/linux/netfilter/nfnetlink_compat.hrenamed from include/linux/netfilter/nfnetlink_compat.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/nfnetlink_conntrack.hrenamed from include/linux/netfilter/nfnetlink_conntrack.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/nfnetlink_cthelper.hrenamed from include/linux/netfilter/nfnetlink_cthelper.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/nfnetlink_cttimeout.hrenamed from include/linux/netfilter/nfnetlink_cttimeout.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/nfnetlink_log.hrenamed from include/linux/netfilter/nfnetlink_log.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/nfnetlink_queue.hrenamed from include/linux/netfilter/nfnetlink_queue.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/x_tables.h+187−0
@@ -0,0 +1,187 @@
1+#ifndef _UAPI_X_TABLES_H
2+#define _UAPI_X_TABLES_H
3+#include <linux/kernel.h>
4+#include <linux/types.h>
5+
6+#define XT_FUNCTION_MAXNAMELEN 30
7+#define XT_EXTENSION_MAXNAMELEN 29
8+#define XT_TABLE_MAXNAMELEN 32
9+
10+struct xt_entry_match {
11+ union {
12+ struct {
13+ __u16 match_size;
14+
15+ /* Used by userspace */
16+ char name[XT_EXTENSION_MAXNAMELEN];
17+ __u8 revision;
18+ } user;
19+ struct {
20+ __u16 match_size;
21+
22+ /* Used inside the kernel */
23+ struct xt_match *match;
24+ } kernel;
25+
26+ /* Total length */
27+ __u16 match_size;
28+ } u;
29+
30+ unsigned char data[0];
31+};
32+
33+struct xt_entry_target {
34+ union {
35+ struct {
36+ __u16 target_size;
37+
38+ /* Used by userspace */
39+ char name[XT_EXTENSION_MAXNAMELEN];
40+ __u8 revision;
41+ } user;
42+ struct {
43+ __u16 target_size;
44+
45+ /* Used inside the kernel */
46+ struct xt_target *target;
47+ } kernel;
48+
49+ /* Total length */
50+ __u16 target_size;
51+ } u;
52+
53+ unsigned char data[0];
54+};
55+
56+#define XT_TARGET_INIT(__name, __size) \
57+{ \
58+ .target.u.user = { \
59+ .target_size = XT_ALIGN(__size), \
60+ .name = __name, \
61+ }, \
62+}
63+
64+struct xt_standard_target {
65+ struct xt_entry_target target;
66+ int verdict;
67+};
68+
69+struct xt_error_target {
70+ struct xt_entry_target target;
71+ char errorname[XT_FUNCTION_MAXNAMELEN];
72+};
73+
74+/* The argument to IPT_SO_GET_REVISION_*. Returns highest revision
75+ * kernel supports, if >= revision. */
76+struct xt_get_revision {
77+ char name[XT_EXTENSION_MAXNAMELEN];
78+ __u8 revision;
79+};
80+
81+/* CONTINUE verdict for targets */
82+#define XT_CONTINUE 0xFFFFFFFF
83+
84+/* For standard target */
85+#define XT_RETURN (-NF_REPEAT - 1)
86+
87+/* this is a dummy structure to find out the alignment requirement for a struct
88+ * containing all the fundamental data types that are used in ipt_entry,
89+ * ip6t_entry and arpt_entry. This sucks, and it is a hack. It will be my
90+ * personal pleasure to remove it -HW
91+ */
92+struct _xt_align {
93+ __u8 u8;
94+ __u16 u16;
95+ __u32 u32;
96+ __u64 u64;
97+};
98+
99+#define XT_ALIGN(s) __ALIGN_KERNEL((s), __alignof__(struct _xt_align))
100+
101+/* Standard return verdict, or do jump. */
102+#define XT_STANDARD_TARGET ""
103+/* Error verdict. */
104+#define XT_ERROR_TARGET "ERROR"
105+
106+#define SET_COUNTER(c,b,p) do { (c).bcnt = (b); (c).pcnt = (p); } while(0)
107+#define ADD_COUNTER(c,b,p) do { (c).bcnt += (b); (c).pcnt += (p); } while(0)
108+
109+struct xt_counters {
110+ __u64 pcnt, bcnt; /* Packet and byte counters */
111+};
112+
113+/* The argument to IPT_SO_ADD_COUNTERS. */
114+struct xt_counters_info {
115+ /* Which table. */
116+ char name[XT_TABLE_MAXNAMELEN];
117+
118+ unsigned int num_counters;
119+
120+ /* The counters (actually `number' of these). */
121+ struct xt_counters counters[0];
122+};
123+
124+#define XT_INV_PROTO 0x40 /* Invert the sense of PROTO. */
125+
126+#ifndef __KERNEL__
127+/* fn returns 0 to continue iteration */
128+#define XT_MATCH_ITERATE(type, e, fn, args...) \
129+({ \
130+ unsigned int __i; \
131+ int __ret = 0; \
132+ struct xt_entry_match *__m; \
133+ \
134+ for (__i = sizeof(type); \
135+ __i < (e)->target_offset; \
136+ __i += __m->u.match_size) { \
137+ __m = (void *)e + __i; \
138+ \
139+ __ret = fn(__m , ## args); \
140+ if (__ret != 0) \
141+ break; \
142+ } \
143+ __ret; \
144+})
145+
146+/* fn returns 0 to continue iteration */
147+#define XT_ENTRY_ITERATE_CONTINUE(type, entries, size, n, fn, args...) \
148+({ \
149+ unsigned int __i, __n; \
150+ int __ret = 0; \
151+ type *__entry; \
152+ \
153+ for (__i = 0, __n = 0; __i < (size); \
154+ __i += __entry->next_offset, __n++) { \
155+ __entry = (void *)(entries) + __i; \
156+ if (__n < n) \
157+ continue; \
158+ \
159+ __ret = fn(__entry , ## args); \
160+ if (__ret != 0) \
161+ break; \
162+ } \
163+ __ret; \
164+})
165+
166+/* fn returns 0 to continue iteration */
167+#define XT_ENTRY_ITERATE(type, entries, size, fn, args...) \
168+ XT_ENTRY_ITERATE_CONTINUE(type, entries, size, 0, fn, args)
169+
170+#endif /* !__KERNEL__ */
171+
172+/* pos is normally a struct ipt_entry/ip6t_entry/etc. */
173+#define xt_entry_foreach(pos, ehead, esize) \
174+ for ((pos) = (typeof(pos))(ehead); \
175+ (pos) < (typeof(pos))((char *)(ehead) + (esize)); \
176+ (pos) = (typeof(pos))((char *)(pos) + (pos)->next_offset))
177+
178+/* can only be xt_entry_match, so no use of typeof here */
179+#define xt_ematch_foreach(pos, entry) \
180+ for ((pos) = (struct xt_entry_match *)entry->elems; \
181+ (pos) < (struct xt_entry_match *)((char *)(entry) + \
182+ (entry)->target_offset); \
183+ (pos) = (struct xt_entry_match *)((char *)(pos) + \
184+ (pos)->u.match_size))
185+
186+
187+#endif /* _UAPI_X_TABLES_H */
include/uapi/linux/netfilter/xt_AUDIT.hrenamed from include/linux/netfilter/xt_AUDIT.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_CHECKSUM.hrenamed from include/linux/netfilter/xt_CHECKSUM.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_CLASSIFY.hrenamed from include/linux/netfilter/xt_CLASSIFY.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_CONNMARK.hrenamed from include/linux/netfilter/xt_CONNMARK.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_CONNSECMARK.hrenamed from include/linux/netfilter/xt_CONNSECMARK.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_CT.hrenamed from include/linux/netfilter/xt_CT.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_DSCP.hrenamed from include/linux/netfilter/xt_DSCP.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_IDLETIMER.hrenamed from include/linux/netfilter/xt_IDLETIMER.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_LED.hrenamed from include/linux/netfilter/xt_LED.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_LOG.hrenamed from include/linux/netfilter/xt_LOG.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_MARK.hrenamed from include/linux/netfilter/xt_MARK.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_NFLOG.hrenamed from include/linux/netfilter/xt_NFLOG.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_NFQUEUE.hrenamed from include/linux/netfilter/xt_NFQUEUE.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_RATEEST.hrenamed from include/linux/netfilter/xt_RATEEST.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_SECMARK.hrenamed from include/linux/netfilter/xt_SECMARK.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_TCPMSS.hrenamed from include/linux/netfilter/xt_TCPMSS.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_TCPOPTSTRIP.hrenamed from include/linux/netfilter/xt_TCPOPTSTRIP.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_TEE.hrenamed from include/linux/netfilter/xt_TEE.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_TPROXY.hrenamed from include/linux/netfilter/xt_TPROXY.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_addrtype.hrenamed from include/linux/netfilter/xt_addrtype.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_cluster.hrenamed from include/linux/netfilter/xt_cluster.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_comment.hrenamed from include/linux/netfilter/xt_comment.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_connbytes.hrenamed from include/linux/netfilter/xt_connbytes.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_connlimit.hrenamed from include/linux/netfilter/xt_connlimit.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_connmark.hrenamed from include/linux/netfilter/xt_connmark.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_conntrack.hrenamed from include/linux/netfilter/xt_conntrack.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_cpu.hrenamed from include/linux/netfilter/xt_cpu.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_dccp.hrenamed from include/linux/netfilter/xt_dccp.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_devgroup.hrenamed from include/linux/netfilter/xt_devgroup.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_dscp.hrenamed from include/linux/netfilter/xt_dscp.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_ecn.hrenamed from include/linux/netfilter/xt_ecn.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_esp.hrenamed from include/linux/netfilter/xt_esp.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_hashlimit.h+73−0
@@ -0,0 +1,73 @@
1+#ifndef _UAPI_XT_HASHLIMIT_H
2+#define _UAPI_XT_HASHLIMIT_H
3+
4+#include <linux/types.h>
5+
6+/* timings are in milliseconds. */
7+#define XT_HASHLIMIT_SCALE 10000
8+/* 1/10,000 sec period => max of 10,000/sec. Min rate is then 429490
9+ * seconds, or one packet every 59 hours.
10+ */
11+
12+/* packet length accounting is done in 16-byte steps */
13+#define XT_HASHLIMIT_BYTE_SHIFT 4
14+
15+/* details of this structure hidden by the implementation */
16+struct xt_hashlimit_htable;
17+
18+enum {
19+ XT_HASHLIMIT_HASH_DIP = 1 << 0,
20+ XT_HASHLIMIT_HASH_DPT = 1 << 1,
21+ XT_HASHLIMIT_HASH_SIP = 1 << 2,
22+ XT_HASHLIMIT_HASH_SPT = 1 << 3,
23+ XT_HASHLIMIT_INVERT = 1 << 4,
24+ XT_HASHLIMIT_BYTES = 1 << 5,
25+};
26+
27+struct hashlimit_cfg {
28+ __u32 mode; /* bitmask of XT_HASHLIMIT_HASH_* */
29+ __u32 avg; /* Average secs between packets * scale */
30+ __u32 burst; /* Period multiplier for upper limit. */
31+
32+ /* user specified */
33+ __u32 size; /* how many buckets */
34+ __u32 max; /* max number of entries */
35+ __u32 gc_interval; /* gc interval */
36+ __u32 expire; /* when do entries expire? */
37+};
38+
39+struct xt_hashlimit_info {
40+ char name [IFNAMSIZ]; /* name */
41+ struct hashlimit_cfg cfg;
42+
43+ /* Used internally by the kernel */
44+ struct xt_hashlimit_htable *hinfo;
45+ union {
46+ void *ptr;
47+ struct xt_hashlimit_info *master;
48+ } u;
49+};
50+
51+struct hashlimit_cfg1 {
52+ __u32 mode; /* bitmask of XT_HASHLIMIT_HASH_* */
53+ __u32 avg; /* Average secs between packets * scale */
54+ __u32 burst; /* Period multiplier for upper limit. */
55+
56+ /* user specified */
57+ __u32 size; /* how many buckets */
58+ __u32 max; /* max number of entries */
59+ __u32 gc_interval; /* gc interval */
60+ __u32 expire; /* when do entries expire? */
61+
62+ __u8 srcmask, dstmask;
63+};
64+
65+struct xt_hashlimit_mtinfo1 {
66+ char name[IFNAMSIZ];
67+ struct hashlimit_cfg1 cfg;
68+
69+ /* Used internally by the kernel */
70+ struct xt_hashlimit_htable *hinfo __attribute__((aligned(8)));
71+};
72+
73+#endif /* _UAPI_XT_HASHLIMIT_H */
include/uapi/linux/netfilter/xt_helper.hrenamed from include/linux/netfilter/xt_helper.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_iprange.hrenamed from include/linux/netfilter/xt_iprange.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_ipvs.hrenamed from include/linux/netfilter/xt_ipvs.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_length.hrenamed from include/linux/netfilter/xt_length.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_limit.hrenamed from include/linux/netfilter/xt_limit.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_mac.hrenamed from include/linux/netfilter/xt_mac.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_mark.hrenamed from include/linux/netfilter/xt_mark.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_multiport.hrenamed from include/linux/netfilter/xt_multiport.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_nfacct.hrenamed from include/linux/netfilter/xt_nfacct.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_osf.hrenamed from include/linux/netfilter/xt_osf.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_owner.hrenamed from include/linux/netfilter/xt_owner.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_physdev.h+23−0
@@ -0,0 +1,23 @@
1+#ifndef _UAPI_XT_PHYSDEV_H
2+#define _UAPI_XT_PHYSDEV_H
3+
4+#include <linux/types.h>
5+
6+
7+#define XT_PHYSDEV_OP_IN 0x01
8+#define XT_PHYSDEV_OP_OUT 0x02
9+#define XT_PHYSDEV_OP_BRIDGED 0x04
10+#define XT_PHYSDEV_OP_ISIN 0x08
11+#define XT_PHYSDEV_OP_ISOUT 0x10
12+#define XT_PHYSDEV_OP_MASK (0x20 - 1)
13+
14+struct xt_physdev_info {
15+ char physindev[IFNAMSIZ];
16+ char in_mask[IFNAMSIZ];
17+ char physoutdev[IFNAMSIZ];
18+ char out_mask[IFNAMSIZ];
19+ __u8 invert;
20+ __u8 bitmask;
21+};
22+
23+#endif /* _UAPI_XT_PHYSDEV_H */
include/uapi/linux/netfilter/xt_pkttype.hrenamed from include/linux/netfilter/xt_pkttype.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_policy.hrenamed from include/linux/netfilter/xt_policy.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_quota.hrenamed from include/linux/netfilter/xt_quota.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_rateest.hrenamed from include/linux/netfilter/xt_rateest.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_realm.hrenamed from include/linux/netfilter/xt_realm.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_recent.hrenamed from include/linux/netfilter/xt_recent.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_sctp.hrenamed from include/linux/netfilter/xt_sctp.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_set.hrenamed from include/linux/netfilter/xt_set.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_socket.hrenamed from include/linux/netfilter/xt_socket.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_state.hrenamed from include/linux/netfilter/xt_state.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_statistic.hrenamed from include/linux/netfilter/xt_statistic.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_string.hrenamed from include/linux/netfilter/xt_string.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_tcpmss.hrenamed from include/linux/netfilter/xt_tcpmss.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_tcpudp.hrenamed from include/linux/netfilter/xt_tcpudp.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_time.hrenamed from include/linux/netfilter/xt_time.h+0−0

File renamed without changes.

include/uapi/linux/netfilter/xt_u32.hrenamed from include/linux/netfilter/xt_u32.h+0−0

File renamed without changes.