History

UAPI: (Scripted) Disintegrate include/linux/netfilter

David Howells committed 14 years ago

Commit 94d0ec51 parent 27a3aad86 files · +636 −607Browse files

Showing the changes to include/linux/netfilter (77 of 86 files). Show all

Unified · Split

77 files
  1. include/linux/netfilter/Kbuild +0 −77
  2. include/linux/netfilter/nf_conntrack_common.h +1 −114
  3. include/linux/netfilter/nf_conntrack_ftp.h +1 −15
  4. include/linux/netfilter/nf_conntrack_sctp.h +0 −25
  5. include/linux/netfilter/nf_conntrack_tcp.h +1 −48
  6. include/linux/netfilter/nf_conntrack_tuple_common.h +0 −39
  7. include/linux/netfilter/nf_nat.h +0 −33
  8. include/linux/netfilter/nfnetlink.h +1 −54
  9. include/linux/netfilter/nfnetlink_acct.h +1 −24
  10. include/linux/netfilter/nfnetlink_compat.h +0 −63
  11. include/linux/netfilter/nfnetlink_conntrack.h +0 −248
  12. include/linux/netfilter/nfnetlink_cthelper.h +0 −55
  13. include/linux/netfilter/nfnetlink_cttimeout.h +0 −114
  14. include/linux/netfilter/nfnetlink_log.h +0 −97
  15. include/linux/netfilter/nfnetlink_queue.h +0 −101
  16. include/linux/netfilter/x_tables.h +1 −185
  17. include/linux/netfilter/xt_AUDIT.h +0 −30
  18. include/linux/netfilter/xt_CHECKSUM.h +0 −20
  19. include/linux/netfilter/xt_CLASSIFY.h +0 −10
  20. include/linux/netfilter/xt_CONNMARK.h +0 −6
  21. include/linux/netfilter/xt_CONNSECMARK.h +0 −15
  22. include/linux/netfilter/xt_CT.h +0 −31
  23. include/linux/netfilter/xt_DSCP.h +0 −26
  24. include/linux/netfilter/xt_IDLETIMER.h +0 −45
  25. include/linux/netfilter/xt_LED.h +0 −15
  26. include/linux/netfilter/xt_LOG.h +0 −19
  27. include/linux/netfilter/xt_MARK.h +0 −6
  28. include/linux/netfilter/xt_NFLOG.h +0 −20
  29. include/linux/netfilter/xt_NFQUEUE.h +0 −29
  30. include/linux/netfilter/xt_RATEEST.h +0 −15
  31. include/linux/netfilter/xt_SECMARK.h +0 −22
  32. include/linux/netfilter/xt_TCPMSS.h +0 −12
  33. include/linux/netfilter/xt_TCPOPTSTRIP.h +0 −15
  34. include/linux/netfilter/xt_TEE.h +0 −12
  35. include/linux/netfilter/xt_TPROXY.h +0 −23
  36. include/linux/netfilter/xt_addrtype.h +0 −44
  37. include/linux/netfilter/xt_cluster.h +0 −19
  38. include/linux/netfilter/xt_comment.h +0 −10
  39. include/linux/netfilter/xt_connbytes.h +0 −26
  40. include/linux/netfilter/xt_connlimit.h +0 −32
  41. include/linux/netfilter/xt_connmark.h +0 −31
  42. include/linux/netfilter/xt_conntrack.h +0 −77
  43. include/linux/netfilter/xt_cpu.h +0 −11
  44. include/linux/netfilter/xt_dccp.h +0 −25
  45. include/linux/netfilter/xt_devgroup.h +0 −21
  46. include/linux/netfilter/xt_dscp.h +0 −31
  47. include/linux/netfilter/xt_ecn.h +0 −35
  48. include/linux/netfilter/xt_esp.h +0 −15
  49. include/linux/netfilter/xt_hashlimit.h +1 −70
  50. include/linux/netfilter/xt_helper.h +0 −8
  51. include/linux/netfilter/xt_iprange.h +0 −20
  52. include/linux/netfilter/xt_ipvs.h +0 −29
  53. include/linux/netfilter/xt_length.h +0 −11
  54. include/linux/netfilter/xt_limit.h +0 −24
  55. include/linux/netfilter/xt_mac.h +0 −8
  56. include/linux/netfilter/xt_mark.h +0 −15
  57. include/linux/netfilter/xt_multiport.h +0 −29
  58. include/linux/netfilter/xt_nfacct.h +0 −13
  59. include/linux/netfilter/xt_osf.h +0 −135
  60. include/linux/netfilter/xt_owner.h +0 −18
  61. include/linux/netfilter/xt_physdev.h +1 −20
  62. include/linux/netfilter/xt_pkttype.h +0 −8
  63. include/linux/netfilter/xt_policy.h +0 −69
  64. include/linux/netfilter/xt_quota.h +0 −22
  65. include/linux/netfilter/xt_rateest.h +0 −37
  66. include/linux/netfilter/xt_realm.h +0 −12
  67. include/linux/netfilter/xt_recent.h +0 −45
  68. include/linux/netfilter/xt_sctp.h +0 −92
  69. include/linux/netfilter/xt_set.h +0 −65
  70. include/linux/netfilter/xt_socket.h +0 −14
  71. include/linux/netfilter/xt_state.h +0 −12
  72. include/linux/netfilter/xt_statistic.h +0 −36
  73. include/linux/netfilter/xt_string.h +0 −34
  74. include/linux/netfilter/xt_tcpmss.h +0 −11
  75. include/linux/netfilter/xt_tcpudp.h +0 −36
  76. include/linux/netfilter/xt_time.h +0 −32
  77. include/linux/netfilter/xt_u32.h +0 −42
include/linux/netfilter/Kbuild+0−77
@@ -1,78 +1 @@
11 header-y += ipset/
2−
3−header-y += nf_conntrack_common.h
4−header-y += nf_conntrack_ftp.h
5−header-y += nf_conntrack_sctp.h
6−header-y += nf_conntrack_tcp.h
7−header-y += nf_conntrack_tuple_common.h
8−header-y += nf_nat.h
9−header-y += nfnetlink.h
10−header-y += nfnetlink_acct.h
11−header-y += nfnetlink_compat.h
12−header-y += nfnetlink_conntrack.h
13−header-y += nfnetlink_cthelper.h
14−header-y += nfnetlink_cttimeout.h
15−header-y += nfnetlink_log.h
16−header-y += nfnetlink_queue.h
17−header-y += x_tables.h
18−header-y += xt_AUDIT.h
19−header-y += xt_CHECKSUM.h
20−header-y += xt_CLASSIFY.h
21−header-y += xt_CONNMARK.h
22−header-y += xt_CONNSECMARK.h
23−header-y += xt_CT.h
24−header-y += xt_DSCP.h
25−header-y += xt_IDLETIMER.h
26−header-y += xt_LED.h
27−header-y += xt_LOG.h
28−header-y += xt_MARK.h
29−header-y += xt_nfacct.h
30−header-y += xt_NFLOG.h
31−header-y += xt_NFQUEUE.h
32−header-y += xt_RATEEST.h
33−header-y += xt_SECMARK.h
34−header-y += xt_TCPMSS.h
35−header-y += xt_TCPOPTSTRIP.h
36−header-y += xt_TEE.h
37−header-y += xt_TPROXY.h
38−header-y += xt_addrtype.h
39−header-y += xt_cluster.h
40−header-y += xt_comment.h
41−header-y += xt_connbytes.h
42−header-y += xt_connlimit.h
43−header-y += xt_connmark.h
44−header-y += xt_conntrack.h
45−header-y += xt_cpu.h
46−header-y += xt_dccp.h
47−header-y += xt_devgroup.h
48−header-y += xt_dscp.h
49−header-y += xt_ecn.h
50−header-y += xt_esp.h
51−header-y += xt_hashlimit.h
52−header-y += xt_helper.h
53−header-y += xt_iprange.h
54−header-y += xt_ipvs.h
55−header-y += xt_length.h
56−header-y += xt_limit.h
57−header-y += xt_mac.h
58−header-y += xt_mark.h
59−header-y += xt_multiport.h
60−header-y += xt_osf.h
61−header-y += xt_owner.h
62−header-y += xt_physdev.h
63−header-y += xt_pkttype.h
64−header-y += xt_policy.h
65−header-y += xt_quota.h
66−header-y += xt_rateest.h
67−header-y += xt_realm.h
68−header-y += xt_recent.h
69−header-y += xt_set.h
70−header-y += xt_sctp.h
71−header-y += xt_socket.h
72−header-y += xt_state.h
73−header-y += xt_statistic.h
74−header-y += xt_string.h
75−header-y += xt_tcpmss.h
76−header-y += xt_tcpudp.h
77−header-y += xt_time.h
78−header-y += xt_u32.h
include/linux/netfilter/nf_conntrack_common.h+1−114
@@ -1,119 +1,8 @@
11 #ifndef _NF_CONNTRACK_COMMON_H
22 #define _NF_CONNTRACK_COMMON_H
3−/* Connection state tracking for netfilter. This is separated from,
4− but required by, the NAT layer; it can also be used by an iptables
5− extension. */
6−enum ip_conntrack_info {
7− /* Part of an established connection (either direction). */
8− IP_CT_ESTABLISHED,
93
10− /* Like NEW, but related to an existing connection, or ICMP error
11− (in either direction). */
12− IP_CT_RELATED,
4+#include <uapi/linux/netfilter/nf_conntrack_common.h>
135
14− /* Started a new connection to track (only
15− IP_CT_DIR_ORIGINAL); may be a retransmission. */
16− IP_CT_NEW,
17−
18− /* >= this indicates reply direction */
19− IP_CT_IS_REPLY,
20−
21− IP_CT_ESTABLISHED_REPLY = IP_CT_ESTABLISHED + IP_CT_IS_REPLY,
22− IP_CT_RELATED_REPLY = IP_CT_RELATED + IP_CT_IS_REPLY,
23− IP_CT_NEW_REPLY = IP_CT_NEW + IP_CT_IS_REPLY,
24− /* Number of distinct IP_CT types (no NEW in reply dirn). */
25− IP_CT_NUMBER = IP_CT_IS_REPLY * 2 - 1
26−};
27−
28−/* Bitset representing status of connection. */
29−enum ip_conntrack_status {
30− /* It's an expected connection: bit 0 set. This bit never changed */
31− IPS_EXPECTED_BIT = 0,
32− IPS_EXPECTED = (1 << IPS_EXPECTED_BIT),
33−
34− /* We've seen packets both ways: bit 1 set. Can be set, not unset. */
35− IPS_SEEN_REPLY_BIT = 1,
36− IPS_SEEN_REPLY = (1 << IPS_SEEN_REPLY_BIT),
37−
38− /* Conntrack should never be early-expired. */
39− IPS_ASSURED_BIT = 2,
40− IPS_ASSURED = (1 << IPS_ASSURED_BIT),
41−
42− /* Connection is confirmed: originating packet has left box */
43− IPS_CONFIRMED_BIT = 3,
44− IPS_CONFIRMED = (1 << IPS_CONFIRMED_BIT),
45−
46− /* Connection needs src nat in orig dir. This bit never changed. */
47− IPS_SRC_NAT_BIT = 4,
48− IPS_SRC_NAT = (1 << IPS_SRC_NAT_BIT),
49−
50− /* Connection needs dst nat in orig dir. This bit never changed. */
51− IPS_DST_NAT_BIT = 5,
52− IPS_DST_NAT = (1 << IPS_DST_NAT_BIT),
53−
54− /* Both together. */
55− IPS_NAT_MASK = (IPS_DST_NAT | IPS_SRC_NAT),
56−
57− /* Connection needs TCP sequence adjusted. */
58− IPS_SEQ_ADJUST_BIT = 6,
59− IPS_SEQ_ADJUST = (1 << IPS_SEQ_ADJUST_BIT),
60−
61− /* NAT initialization bits. */
62− IPS_SRC_NAT_DONE_BIT = 7,
63− IPS_SRC_NAT_DONE = (1 << IPS_SRC_NAT_DONE_BIT),
64−
65− IPS_DST_NAT_DONE_BIT = 8,
66− IPS_DST_NAT_DONE = (1 << IPS_DST_NAT_DONE_BIT),
67−
68− /* Both together */
69− IPS_NAT_DONE_MASK = (IPS_DST_NAT_DONE | IPS_SRC_NAT_DONE),
70−
71− /* Connection is dying (removed from lists), can not be unset. */
72− IPS_DYING_BIT = 9,
73− IPS_DYING = (1 << IPS_DYING_BIT),
74−
75− /* Connection has fixed timeout. */
76− IPS_FIXED_TIMEOUT_BIT = 10,
77− IPS_FIXED_TIMEOUT = (1 << IPS_FIXED_TIMEOUT_BIT),
78−
79− /* Conntrack is a template */
80− IPS_TEMPLATE_BIT = 11,
81− IPS_TEMPLATE = (1 << IPS_TEMPLATE_BIT),
82−
83− /* Conntrack is a fake untracked entry */
84− IPS_UNTRACKED_BIT = 12,
85− IPS_UNTRACKED = (1 << IPS_UNTRACKED_BIT),
86−
87− /* Conntrack got a helper explicitly attached via CT target. */
88− IPS_HELPER_BIT = 13,
89− IPS_HELPER = (1 << IPS_HELPER_BIT),
90−};
91−
92−/* Connection tracking event types */
93−enum ip_conntrack_events {
94− IPCT_NEW, /* new conntrack */
95− IPCT_RELATED, /* related conntrack */
96− IPCT_DESTROY, /* destroyed conntrack */
97− IPCT_REPLY, /* connection has seen two-way traffic */
98− IPCT_ASSURED, /* connection status has changed to assured */
99− IPCT_PROTOINFO, /* protocol information has changed */
100− IPCT_HELPER, /* new helper has been set */
101− IPCT_MARK, /* new mark has been set */
102− IPCT_NATSEQADJ, /* NAT is doing sequence adjustment */
103− IPCT_SECMARK, /* new security mark has been set */
104−};
105−
106−enum ip_conntrack_expect_events {
107− IPEXP_NEW, /* new expectation */
108− IPEXP_DESTROY, /* destroyed expectation */
109−};
110−
111−/* expectation flags */
112−#define NF_CT_EXPECT_PERMANENT 0x1
113−#define NF_CT_EXPECT_INACTIVE 0x2
114−#define NF_CT_EXPECT_USERSPACE 0x4
115−
116−#ifdef __KERNEL__
1176 struct ip_conntrack_stat {
1187 unsigned int searched;
1198 unsigned int found;
@@ -136,6 +25,4 @@ struct ip_conntrack_stat { · 16 unmodified lines
13625 /* call to create an explicit dependency on nf_conntrack. */
13726 extern void need_conntrack(void);
13827
139−#endif /* __KERNEL__ */
140−
14128 #endif /* _NF_CONNTRACK_COMMON_H */
include/linux/netfilter/nf_conntrack_ftp.h+1−15
@@ -1,20 +1,8 @@
11 #ifndef _NF_CONNTRACK_FTP_H
22 #define _NF_CONNTRACK_FTP_H
3−/* FTP tracking. */
43
5−/* This enum is exposed to userspace */
6−enum nf_ct_ftp_type {
7− /* PORT command from client */
8− NF_CT_FTP_PORT,
9− /* PASV response from server */
10− NF_CT_FTP_PASV,
11− /* EPRT command from client */
12− NF_CT_FTP_EPRT,
13− /* EPSV response from server */
14− NF_CT_FTP_EPSV,
15−};
4+#include <uapi/linux/netfilter/nf_conntrack_ftp.h>
165
17−#ifdef __KERNEL__
186
197 #define FTP_PORT 21
208
@@ -42,6 +30,4 @@ extern unsigned int (*nf_nat_ftp_hook)(struct sk_buff *skb, · 21 unmodified lines
4230 unsigned int matchoff,
4331 unsigned int matchlen,
4432 struct nf_conntrack_expect *exp);
45−#endif /* __KERNEL__ */
46−
4733 #endif /* _NF_CONNTRACK_FTP_H */
include/linux/netfilter/nf_conntrack_sctp.h+0−25
@@ -1,25 +0,0 @@
1−#ifndef _NF_CONNTRACK_SCTP_H
2−#define _NF_CONNTRACK_SCTP_H
3−/* SCTP tracking. */
4−
5−#include <linux/netfilter/nf_conntrack_tuple_common.h>
6−
7−enum sctp_conntrack {
8− SCTP_CONNTRACK_NONE,
9− SCTP_CONNTRACK_CLOSED,
10− SCTP_CONNTRACK_COOKIE_WAIT,
11− SCTP_CONNTRACK_COOKIE_ECHOED,
12− SCTP_CONNTRACK_ESTABLISHED,
13− SCTP_CONNTRACK_SHUTDOWN_SENT,
14− SCTP_CONNTRACK_SHUTDOWN_RECD,
15− SCTP_CONNTRACK_SHUTDOWN_ACK_SENT,
16− SCTP_CONNTRACK_MAX
17−};
18−
19−struct ip_ct_sctp {
20− enum sctp_conntrack state;
21−
22− __be32 vtag[IP_CT_DIR_MAX];
23−};
24−
25−#endif /* _NF_CONNTRACK_SCTP_H */
include/linux/netfilter/nf_conntrack_tcp.h+1−48
@@ -1,53 +1,8 @@
11 #ifndef _NF_CONNTRACK_TCP_H
22 #define _NF_CONNTRACK_TCP_H
3−/* TCP tracking. */
43
5−#include <linux/types.h>
4+#include <uapi/linux/netfilter/nf_conntrack_tcp.h>
65
7−/* This is exposed to userspace (ctnetlink) */
8−enum tcp_conntrack {
9− TCP_CONNTRACK_NONE,
10− TCP_CONNTRACK_SYN_SENT,
11− TCP_CONNTRACK_SYN_RECV,
12− TCP_CONNTRACK_ESTABLISHED,
13− TCP_CONNTRACK_FIN_WAIT,
14− TCP_CONNTRACK_CLOSE_WAIT,
15− TCP_CONNTRACK_LAST_ACK,
16− TCP_CONNTRACK_TIME_WAIT,
17− TCP_CONNTRACK_CLOSE,
18− TCP_CONNTRACK_LISTEN, /* obsolete */
19−#define TCP_CONNTRACK_SYN_SENT2 TCP_CONNTRACK_LISTEN
20− TCP_CONNTRACK_MAX,
21− TCP_CONNTRACK_IGNORE,
22− TCP_CONNTRACK_RETRANS,
23− TCP_CONNTRACK_UNACK,
24− TCP_CONNTRACK_TIMEOUT_MAX
25−};
26−
27−/* Window scaling is advertised by the sender */
28−#define IP_CT_TCP_FLAG_WINDOW_SCALE 0x01
29−
30−/* SACK is permitted by the sender */
31−#define IP_CT_TCP_FLAG_SACK_PERM 0x02
32−
33−/* This sender sent FIN first */
34−#define IP_CT_TCP_FLAG_CLOSE_INIT 0x04
35−
36−/* Be liberal in window checking */
37−#define IP_CT_TCP_FLAG_BE_LIBERAL 0x08
38−
39−/* Has unacknowledged data */
40−#define IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED 0x10
41−
42−/* The field td_maxack has been set */
43−#define IP_CT_TCP_FLAG_MAXACK_SET 0x20
44−
45−struct nf_ct_tcp_flags {
46− __u8 flags;
47− __u8 mask;
48−};
49−
50−#ifdef __KERNEL__
516
527 struct ip_ct_tcp_state {
538 u_int32_t td_end; /* max of seq + len */
@@ -74,6 +29,4 @@ struct ip_ct_tcp { · 20 unmodified lines
7429 u_int8_t last_flags; /* Last flags set */
7530 };
7631
77−#endif /* __KERNEL__ */
78−
7932 #endif /* _NF_CONNTRACK_TCP_H */
include/linux/netfilter/nf_conntrack_tuple_common.h+0−39
@@ -1,39 +0,0 @@
1−#ifndef _NF_CONNTRACK_TUPLE_COMMON_H
2−#define _NF_CONNTRACK_TUPLE_COMMON_H
3−
4−enum ip_conntrack_dir {
5− IP_CT_DIR_ORIGINAL,
6− IP_CT_DIR_REPLY,
7− IP_CT_DIR_MAX
8−};
9−
10−/* The protocol-specific manipulable parts of the tuple: always in
11− * network order
12− */
13−union nf_conntrack_man_proto {
14− /* Add other protocols here. */
15− __be16 all;
16−
17− struct {
18− __be16 port;
19− } tcp;
20− struct {
21− __be16 port;
22− } udp;
23− struct {
24− __be16 id;
25− } icmp;
26− struct {
27− __be16 port;
28− } dccp;
29− struct {
30− __be16 port;
31− } sctp;
32− struct {
33− __be16 key; /* GRE key is 32bit, PPtP only uses 16bit */
34− } gre;
35−};
36−
37−#define CTINFO2DIR(ctinfo) ((ctinfo) >= IP_CT_IS_REPLY ? IP_CT_DIR_REPLY : IP_CT_DIR_ORIGINAL)
38−
39−#endif /* _NF_CONNTRACK_TUPLE_COMMON_H */
include/linux/netfilter/nf_nat.h+0−33
@@ -1,33 +0,0 @@
1−#ifndef _NETFILTER_NF_NAT_H
2−#define _NETFILTER_NF_NAT_H
3−
4−#include <linux/netfilter.h>
5−#include <linux/netfilter/nf_conntrack_tuple_common.h>
6−
7−#define NF_NAT_RANGE_MAP_IPS 1
8−#define NF_NAT_RANGE_PROTO_SPECIFIED 2
9−#define NF_NAT_RANGE_PROTO_RANDOM 4
10−#define NF_NAT_RANGE_PERSISTENT 8
11−
12−struct nf_nat_ipv4_range {
13− unsigned int flags;
14− __be32 min_ip;
15− __be32 max_ip;
16− union nf_conntrack_man_proto min;
17− union nf_conntrack_man_proto max;
18−};
19−
20−struct nf_nat_ipv4_multi_range_compat {
21− unsigned int rangesize;
22− struct nf_nat_ipv4_range range[1];
23−};
24−
25−struct nf_nat_range {
26− unsigned int flags;
27− union nf_inet_addr min_addr;
28− union nf_inet_addr max_addr;
29− union nf_conntrack_man_proto min_proto;
30− union nf_conntrack_man_proto max_proto;
31−};
32−
33−#endif /* _NETFILTER_NF_NAT_H */
include/linux/netfilter/nfnetlink.h+1−54
@@ -1,63 +1,11 @@
11 #ifndef _NFNETLINK_H
22 #define _NFNETLINK_H
3−#include <linux/types.h>
4−#include <linux/netfilter/nfnetlink_compat.h>
53
6−enum nfnetlink_groups {
7− NFNLGRP_NONE,
8−#define NFNLGRP_NONE NFNLGRP_NONE
9− NFNLGRP_CONNTRACK_NEW,
10−#define NFNLGRP_CONNTRACK_NEW NFNLGRP_CONNTRACK_NEW
11− NFNLGRP_CONNTRACK_UPDATE,
12−#define NFNLGRP_CONNTRACK_UPDATE NFNLGRP_CONNTRACK_UPDATE
13− NFNLGRP_CONNTRACK_DESTROY,
14−#define NFNLGRP_CONNTRACK_DESTROY NFNLGRP_CONNTRACK_DESTROY
15− NFNLGRP_CONNTRACK_EXP_NEW,
16−#define NFNLGRP_CONNTRACK_EXP_NEW NFNLGRP_CONNTRACK_EXP_NEW
17− NFNLGRP_CONNTRACK_EXP_UPDATE,
18−#define NFNLGRP_CONNTRACK_EXP_UPDATE NFNLGRP_CONNTRACK_EXP_UPDATE
19− NFNLGRP_CONNTRACK_EXP_DESTROY,
20−#define NFNLGRP_CONNTRACK_EXP_DESTROY NFNLGRP_CONNTRACK_EXP_DESTROY
21− __NFNLGRP_MAX,
22−};
23−#define NFNLGRP_MAX (__NFNLGRP_MAX - 1)
24−
25−/* General form of address family dependent message.
26− */
27−struct nfgenmsg {
28− __u8 nfgen_family; /* AF_xxx */
29− __u8 version; /* nfnetlink version */
30− __be16 res_id; /* resource id */
31−};
32−
33−#define NFNETLINK_V0 0
34−
35−/* netfilter netlink message types are split in two pieces:
36− * 8 bit subsystem, 8bit operation.
37− */
38−
39−#define NFNL_SUBSYS_ID(x) ((x & 0xff00) >> 8)
40−#define NFNL_MSG_TYPE(x) (x & 0x00ff)
41−
42−/* No enum here, otherwise __stringify() trick of MODULE_ALIAS_NFNL_SUBSYS()
43− * won't work anymore */
44−#define NFNL_SUBSYS_NONE 0
45−#define NFNL_SUBSYS_CTNETLINK 1
46−#define NFNL_SUBSYS_CTNETLINK_EXP 2
47−#define NFNL_SUBSYS_QUEUE 3
48−#define NFNL_SUBSYS_ULOG 4
49−#define NFNL_SUBSYS_OSF 5
50−#define NFNL_SUBSYS_IPSET 6
51−#define NFNL_SUBSYS_ACCT 7
52−#define NFNL_SUBSYS_CTNETLINK_TIMEOUT 8
53−#define NFNL_SUBSYS_CTHELPER 9
54−#define NFNL_SUBSYS_COUNT 10
55−
56−#ifdef __KERNEL__
574
585 #include <linux/netlink.h>
596 #include <linux/capability.h>
607 #include <net/netlink.h>
8+#include <uapi/linux/netfilter/nfnetlink.h>
619
6210 struct nfnl_callback {
6311 int (*call)(struct sock *nl, struct sk_buff *skb,
@@ -92,5 +40,4 @@ extern void nfnl_unlock(void); · 28 unmodified lines
9240 #define MODULE_ALIAS_NFNL_SUBSYS(subsys) \
9341 MODULE_ALIAS("nfnetlink-subsys-" __stringify(subsys))
9442
95−#endif /* __KERNEL__ */
9643 #endif /* _NFNETLINK_H */
include/linux/netfilter/nfnetlink_acct.h+1−24
@@ -1,29 +1,8 @@
11 #ifndef _NFNL_ACCT_H_
22 #define _NFNL_ACCT_H_
33
4−#ifndef NFACCT_NAME_MAX
5−#define NFACCT_NAME_MAX 32
6−#endif
4+#include <uapi/linux/netfilter/nfnetlink_acct.h>
75
8−enum nfnl_acct_msg_types {
9− NFNL_MSG_ACCT_NEW,
10− NFNL_MSG_ACCT_GET,
11− NFNL_MSG_ACCT_GET_CTRZERO,
12− NFNL_MSG_ACCT_DEL,
13− NFNL_MSG_ACCT_MAX
14−};
15−
16−enum nfnl_acct_type {
17− NFACCT_UNSPEC,
18− NFACCT_NAME,
19− NFACCT_PKTS,
20− NFACCT_BYTES,
21− NFACCT_USE,
22− __NFACCT_MAX
23−};
24−#define NFACCT_MAX (__NFACCT_MAX - 1)
25−
26−#ifdef __KERNEL__
276
287 struct nf_acct;
298
@@ -31,6 +10,4 @@ extern struct nf_acct *nfnl_acct_find_get(const char *filter_name); · 1 unmodified line
3110 extern void nfnl_acct_put(struct nf_acct *acct);
3211 extern void nfnl_acct_update(const struct sk_buff *skb, struct nf_acct *nfacct);
3312
34−#endif /* __KERNEL__ */
35−
3613 #endif /* _NFNL_ACCT_H */
include/linux/netfilter/nfnetlink_compat.h+0−63
@@ -1,63 +0,0 @@
1−#ifndef _NFNETLINK_COMPAT_H
2−#define _NFNETLINK_COMPAT_H
3−
4−#include <linux/types.h>
5−
6−#ifndef __KERNEL__
7−/* Old nfnetlink macros for userspace */
8−
9−/* nfnetlink groups: Up to 32 maximum */
10−#define NF_NETLINK_CONNTRACK_NEW 0x00000001
11−#define NF_NETLINK_CONNTRACK_UPDATE 0x00000002
12−#define NF_NETLINK_CONNTRACK_DESTROY 0x00000004
13−#define NF_NETLINK_CONNTRACK_EXP_NEW 0x00000008
14−#define NF_NETLINK_CONNTRACK_EXP_UPDATE 0x00000010
15−#define NF_NETLINK_CONNTRACK_EXP_DESTROY 0x00000020
16−
17−/* Generic structure for encapsulation optional netfilter information.
18− * It is reminiscent of sockaddr, but with sa_family replaced
19− * with attribute type.
20− * ! This should someday be put somewhere generic as now rtnetlink and
21− * ! nfnetlink use the same attributes methods. - J. Schulist.
22− */
23−
24−struct nfattr {
25− __u16 nfa_len;
26− __u16 nfa_type; /* we use 15 bits for the type, and the highest
27− * bit to indicate whether the payload is nested */
28−};
29−
30−/* FIXME: Apart from NFNL_NFA_NESTED shamelessly copy and pasted from
31− * rtnetlink.h, it's time to put this in a generic file */
32−
33−#define NFNL_NFA_NEST 0x8000
34−#define NFA_TYPE(attr) ((attr)->nfa_type & 0x7fff)
35−
36−#define NFA_ALIGNTO 4
37−#define NFA_ALIGN(len) (((len) + NFA_ALIGNTO - 1) & ~(NFA_ALIGNTO - 1))
38−#define NFA_OK(nfa,len) ((len) > 0 && (nfa)->nfa_len >= sizeof(struct nfattr) \
39− && (nfa)->nfa_len <= (len))
40−#define NFA_NEXT(nfa,attrlen) ((attrlen) -= NFA_ALIGN((nfa)->nfa_len), \
41− (struct nfattr *)(((char *)(nfa)) + NFA_ALIGN((nfa)->nfa_len)))
42−#define NFA_LENGTH(len) (NFA_ALIGN(sizeof(struct nfattr)) + (len))
43−#define NFA_SPACE(len) NFA_ALIGN(NFA_LENGTH(len))
44−#define NFA_DATA(nfa) ((void *)(((char *)(nfa)) + NFA_LENGTH(0)))
45−#define NFA_PAYLOAD(nfa) ((int)((nfa)->nfa_len) - NFA_LENGTH(0))
46−#define NFA_NEST(skb, type) \
47−({ struct nfattr *__start = (struct nfattr *)skb_tail_pointer(skb); \
48− NFA_PUT(skb, (NFNL_NFA_NEST | type), 0, NULL); \
49− __start; })
50−#define NFA_NEST_END(skb, start) \
51−({ (start)->nfa_len = skb_tail_pointer(skb) - (unsigned char *)(start); \
52− (skb)->len; })
53−#define NFA_NEST_CANCEL(skb, start) \
54−({ if (start) \
55− skb_trim(skb, (unsigned char *) (start) - (skb)->data); \
56− -1; })
57−
58−#define NFM_NFA(n) ((struct nfattr *)(((char *)(n)) \
59− + NLMSG_ALIGN(sizeof(struct nfgenmsg))))
60−#define NFM_PAYLOAD(n) NLMSG_PAYLOAD(n, sizeof(struct nfgenmsg))
61−
62−#endif /* ! __KERNEL__ */
63−#endif /* _NFNETLINK_COMPAT_H */
include/linux/netfilter/nfnetlink_conntrack.h+0−248
@@ -1,248 +0,0 @@
1−#ifndef _IPCONNTRACK_NETLINK_H
2−#define _IPCONNTRACK_NETLINK_H
3−#include <linux/netfilter/nfnetlink.h>
4−
5−enum cntl_msg_types {
6− IPCTNL_MSG_CT_NEW,
7− IPCTNL_MSG_CT_GET,
8− IPCTNL_MSG_CT_DELETE,
9− IPCTNL_MSG_CT_GET_CTRZERO,
10− IPCTNL_MSG_CT_GET_STATS_CPU,
11− IPCTNL_MSG_CT_GET_STATS,
12−
13− IPCTNL_MSG_MAX
14−};
15−
16−enum ctnl_exp_msg_types {
17− IPCTNL_MSG_EXP_NEW,
18− IPCTNL_MSG_EXP_GET,
19− IPCTNL_MSG_EXP_DELETE,
20− IPCTNL_MSG_EXP_GET_STATS_CPU,
21−
22− IPCTNL_MSG_EXP_MAX
23−};
24−
25−
26−enum ctattr_type {
27− CTA_UNSPEC,
28− CTA_TUPLE_ORIG,
29− CTA_TUPLE_REPLY,
30− CTA_STATUS,
31− CTA_PROTOINFO,
32− CTA_HELP,
33− CTA_NAT_SRC,
34−#define CTA_NAT CTA_NAT_SRC /* backwards compatibility */
35− CTA_TIMEOUT,
36− CTA_MARK,
37− CTA_COUNTERS_ORIG,
38− CTA_COUNTERS_REPLY,
39− CTA_USE,
40− CTA_ID,
41− CTA_NAT_DST,
42− CTA_TUPLE_MASTER,
43− CTA_NAT_SEQ_ADJ_ORIG,
44− CTA_NAT_SEQ_ADJ_REPLY,
45− CTA_SECMARK, /* obsolete */
46− CTA_ZONE,
47− CTA_SECCTX,
48− CTA_TIMESTAMP,
49− CTA_MARK_MASK,
50− __CTA_MAX
51−};
52−#define CTA_MAX (__CTA_MAX - 1)
53−
54−enum ctattr_tuple {
55− CTA_TUPLE_UNSPEC,
56− CTA_TUPLE_IP,
57− CTA_TUPLE_PROTO,
58− __CTA_TUPLE_MAX
59−};
60−#define CTA_TUPLE_MAX (__CTA_TUPLE_MAX - 1)
61−
62−enum ctattr_ip {
63− CTA_IP_UNSPEC,
64− CTA_IP_V4_SRC,
65− CTA_IP_V4_DST,
66− CTA_IP_V6_SRC,
67− CTA_IP_V6_DST,
68− __CTA_IP_MAX
69−};
70−#define CTA_IP_MAX (__CTA_IP_MAX - 1)
71−
72−enum ctattr_l4proto {
73− CTA_PROTO_UNSPEC,
74− CTA_PROTO_NUM,
75− CTA_PROTO_SRC_PORT,
76− CTA_PROTO_DST_PORT,
77− CTA_PROTO_ICMP_ID,
78− CTA_PROTO_ICMP_TYPE,
79− CTA_PROTO_ICMP_CODE,
80− CTA_PROTO_ICMPV6_ID,
81− CTA_PROTO_ICMPV6_TYPE,
82− CTA_PROTO_ICMPV6_CODE,
83− __CTA_PROTO_MAX
84−};
85−#define CTA_PROTO_MAX (__CTA_PROTO_MAX - 1)
86−
87−enum ctattr_protoinfo {
88− CTA_PROTOINFO_UNSPEC,
89− CTA_PROTOINFO_TCP,
90− CTA_PROTOINFO_DCCP,
91− CTA_PROTOINFO_SCTP,
92− __CTA_PROTOINFO_MAX
93−};
94−#define CTA_PROTOINFO_MAX (__CTA_PROTOINFO_MAX - 1)
95−
96−enum ctattr_protoinfo_tcp {
97− CTA_PROTOINFO_TCP_UNSPEC,
98− CTA_PROTOINFO_TCP_STATE,
99− CTA_PROTOINFO_TCP_WSCALE_ORIGINAL,
100− CTA_PROTOINFO_TCP_WSCALE_REPLY,
101− CTA_PROTOINFO_TCP_FLAGS_ORIGINAL,
102− CTA_PROTOINFO_TCP_FLAGS_REPLY,
103− __CTA_PROTOINFO_TCP_MAX
104−};
105−#define CTA_PROTOINFO_TCP_MAX (__CTA_PROTOINFO_TCP_MAX - 1)
106−
107−enum ctattr_protoinfo_dccp {
108− CTA_PROTOINFO_DCCP_UNSPEC,
109− CTA_PROTOINFO_DCCP_STATE,
110− CTA_PROTOINFO_DCCP_ROLE,
111− CTA_PROTOINFO_DCCP_HANDSHAKE_SEQ,
112− __CTA_PROTOINFO_DCCP_MAX,
113−};
114−#define CTA_PROTOINFO_DCCP_MAX (__CTA_PROTOINFO_DCCP_MAX - 1)
115−
116−enum ctattr_protoinfo_sctp {
117− CTA_PROTOINFO_SCTP_UNSPEC,
118− CTA_PROTOINFO_SCTP_STATE,
119− CTA_PROTOINFO_SCTP_VTAG_ORIGINAL,
120− CTA_PROTOINFO_SCTP_VTAG_REPLY,
121− __CTA_PROTOINFO_SCTP_MAX
122−};
123−#define CTA_PROTOINFO_SCTP_MAX (__CTA_PROTOINFO_SCTP_MAX - 1)
124−
125−enum ctattr_counters {
126− CTA_COUNTERS_UNSPEC,
127− CTA_COUNTERS_PACKETS, /* 64bit counters */
128− CTA_COUNTERS_BYTES, /* 64bit counters */
129− CTA_COUNTERS32_PACKETS, /* old 32bit counters, unused */
130− CTA_COUNTERS32_BYTES, /* old 32bit counters, unused */
131− __CTA_COUNTERS_MAX
132−};
133−#define CTA_COUNTERS_MAX (__CTA_COUNTERS_MAX - 1)
134−
135−enum ctattr_tstamp {
136− CTA_TIMESTAMP_UNSPEC,
137− CTA_TIMESTAMP_START,
138− CTA_TIMESTAMP_STOP,
139− __CTA_TIMESTAMP_MAX
140−};
141−#define CTA_TIMESTAMP_MAX (__CTA_TIMESTAMP_MAX - 1)
142−
143−enum ctattr_nat {
144− CTA_NAT_UNSPEC,
145− CTA_NAT_V4_MINIP,
146−#define CTA_NAT_MINIP CTA_NAT_V4_MINIP
147− CTA_NAT_V4_MAXIP,
148−#define CTA_NAT_MAXIP CTA_NAT_V4_MAXIP
149− CTA_NAT_PROTO,
150− CTA_NAT_V6_MINIP,
151− CTA_NAT_V6_MAXIP,
152− __CTA_NAT_MAX
153−};
154−#define CTA_NAT_MAX (__CTA_NAT_MAX - 1)
155−
156−enum ctattr_protonat {
157− CTA_PROTONAT_UNSPEC,
158− CTA_PROTONAT_PORT_MIN,
159− CTA_PROTONAT_PORT_MAX,
160− __CTA_PROTONAT_MAX
161−};
162−#define CTA_PROTONAT_MAX (__CTA_PROTONAT_MAX - 1)
163−
164−enum ctattr_natseq {
165− CTA_NAT_SEQ_UNSPEC,
166− CTA_NAT_SEQ_CORRECTION_POS,
167− CTA_NAT_SEQ_OFFSET_BEFORE,
168− CTA_NAT_SEQ_OFFSET_AFTER,
169− __CTA_NAT_SEQ_MAX
170−};
171−#define CTA_NAT_SEQ_MAX (__CTA_NAT_SEQ_MAX - 1)
172−
173−enum ctattr_expect {
174− CTA_EXPECT_UNSPEC,
175− CTA_EXPECT_MASTER,
176− CTA_EXPECT_TUPLE,
177− CTA_EXPECT_MASK,
178− CTA_EXPECT_TIMEOUT,
179− CTA_EXPECT_ID,
180− CTA_EXPECT_HELP_NAME,
181− CTA_EXPECT_ZONE,
182− CTA_EXPECT_FLAGS,
183− CTA_EXPECT_CLASS,
184− CTA_EXPECT_NAT,
185− CTA_EXPECT_FN,
186− __CTA_EXPECT_MAX
187−};
188−#define CTA_EXPECT_MAX (__CTA_EXPECT_MAX - 1)
189−
190−enum ctattr_expect_nat {
191− CTA_EXPECT_NAT_UNSPEC,
192− CTA_EXPECT_NAT_DIR,
193− CTA_EXPECT_NAT_TUPLE,
194− __CTA_EXPECT_NAT_MAX
195−};
196−#define CTA_EXPECT_NAT_MAX (__CTA_EXPECT_NAT_MAX - 1)
197−
198−enum ctattr_help {
199− CTA_HELP_UNSPEC,
200− CTA_HELP_NAME,
201− CTA_HELP_INFO,
202− __CTA_HELP_MAX
203−};
204−#define CTA_HELP_MAX (__CTA_HELP_MAX - 1)
205−
206−enum ctattr_secctx {
207− CTA_SECCTX_UNSPEC,
208− CTA_SECCTX_NAME,
209− __CTA_SECCTX_MAX
210−};
211−#define CTA_SECCTX_MAX (__CTA_SECCTX_MAX - 1)
212−
213−enum ctattr_stats_cpu {
214− CTA_STATS_UNSPEC,
215− CTA_STATS_SEARCHED,
216− CTA_STATS_FOUND,
217− CTA_STATS_NEW,
218− CTA_STATS_INVALID,
219− CTA_STATS_IGNORE,
220− CTA_STATS_DELETE,
221− CTA_STATS_DELETE_LIST,
222− CTA_STATS_INSERT,
223− CTA_STATS_INSERT_FAILED,
224− CTA_STATS_DROP,
225− CTA_STATS_EARLY_DROP,
226− CTA_STATS_ERROR,
227− CTA_STATS_SEARCH_RESTART,
228− __CTA_STATS_MAX,
229−};
230−#define CTA_STATS_MAX (__CTA_STATS_MAX - 1)
231−
232−enum ctattr_stats_global {
233− CTA_STATS_GLOBAL_UNSPEC,
234− CTA_STATS_GLOBAL_ENTRIES,
235− __CTA_STATS_GLOBAL_MAX,
236−};
237−#define CTA_STATS_GLOBAL_MAX (__CTA_STATS_GLOBAL_MAX - 1)
238−
239−enum ctattr_expect_stats {
240− CTA_STATS_EXP_UNSPEC,
241− CTA_STATS_EXP_NEW,
242− CTA_STATS_EXP_CREATE,
243− CTA_STATS_EXP_DELETE,
244− __CTA_STATS_EXP_MAX,
245−};
246−#define CTA_STATS_EXP_MAX (__CTA_STATS_EXP_MAX - 1)
247−
248−#endif /* _IPCONNTRACK_NETLINK_H */
include/linux/netfilter/nfnetlink_cthelper.h+0−55
@@ -1,55 +0,0 @@
1−#ifndef _NFNL_CTHELPER_H_
2−#define _NFNL_CTHELPER_H_
3−
4−#define NFCT_HELPER_STATUS_DISABLED 0
5−#define NFCT_HELPER_STATUS_ENABLED 1
6−
7−enum nfnl_acct_msg_types {
8− NFNL_MSG_CTHELPER_NEW,
9− NFNL_MSG_CTHELPER_GET,
10− NFNL_MSG_CTHELPER_DEL,
11− NFNL_MSG_CTHELPER_MAX
12−};
13−
14−enum nfnl_cthelper_type {
15− NFCTH_UNSPEC,
16− NFCTH_NAME,
17− NFCTH_TUPLE,
18− NFCTH_QUEUE_NUM,
19− NFCTH_POLICY,
20− NFCTH_PRIV_DATA_LEN,
21− NFCTH_STATUS,
22− __NFCTH_MAX
23−};
24−#define NFCTH_MAX (__NFCTH_MAX - 1)
25−
26−enum nfnl_cthelper_policy_type {
27− NFCTH_POLICY_SET_UNSPEC,
28− NFCTH_POLICY_SET_NUM,
29− NFCTH_POLICY_SET,
30− NFCTH_POLICY_SET1 = NFCTH_POLICY_SET,
31− NFCTH_POLICY_SET2,
32− NFCTH_POLICY_SET3,
33− NFCTH_POLICY_SET4,
34− __NFCTH_POLICY_SET_MAX
35−};
36−#define NFCTH_POLICY_SET_MAX (__NFCTH_POLICY_SET_MAX - 1)
37−
38−enum nfnl_cthelper_pol_type {
39− NFCTH_POLICY_UNSPEC,
40− NFCTH_POLICY_NAME,
41− NFCTH_POLICY_EXPECT_MAX,
42− NFCTH_POLICY_EXPECT_TIMEOUT,
43− __NFCTH_POLICY_MAX
44−};
45−#define NFCTH_POLICY_MAX (__NFCTH_POLICY_MAX - 1)
46−
47−enum nfnl_cthelper_tuple_type {
48− NFCTH_TUPLE_UNSPEC,
49− NFCTH_TUPLE_L3PROTONUM,
50− NFCTH_TUPLE_L4PROTONUM,
51− __NFCTH_TUPLE_MAX,
52−};
53−#define NFCTH_TUPLE_MAX (__NFCTH_TUPLE_MAX - 1)
54−
55−#endif /* _NFNL_CTHELPER_H */
include/linux/netfilter/nfnetlink_cttimeout.h+0−114
@@ -1,114 +0,0 @@
1−#ifndef _CTTIMEOUT_NETLINK_H
2−#define _CTTIMEOUT_NETLINK_H
3−#include <linux/netfilter/nfnetlink.h>
4−
5−enum ctnl_timeout_msg_types {
6− IPCTNL_MSG_TIMEOUT_NEW,
7− IPCTNL_MSG_TIMEOUT_GET,
8− IPCTNL_MSG_TIMEOUT_DELETE,
9−
10− IPCTNL_MSG_TIMEOUT_MAX
11−};
12−
13−enum ctattr_timeout {
14− CTA_TIMEOUT_UNSPEC,
15− CTA_TIMEOUT_NAME,
16− CTA_TIMEOUT_L3PROTO,
17− CTA_TIMEOUT_L4PROTO,
18− CTA_TIMEOUT_DATA,
19− CTA_TIMEOUT_USE,
20− __CTA_TIMEOUT_MAX
21−};
22−#define CTA_TIMEOUT_MAX (__CTA_TIMEOUT_MAX - 1)
23−
24−enum ctattr_timeout_generic {
25− CTA_TIMEOUT_GENERIC_UNSPEC,
26− CTA_TIMEOUT_GENERIC_TIMEOUT,
27− __CTA_TIMEOUT_GENERIC_MAX
28−};
29−#define CTA_TIMEOUT_GENERIC_MAX (__CTA_TIMEOUT_GENERIC_MAX - 1)
30−
31−enum ctattr_timeout_tcp {
32− CTA_TIMEOUT_TCP_UNSPEC,
33− CTA_TIMEOUT_TCP_SYN_SENT,
34− CTA_TIMEOUT_TCP_SYN_RECV,
35− CTA_TIMEOUT_TCP_ESTABLISHED,
36− CTA_TIMEOUT_TCP_FIN_WAIT,
37− CTA_TIMEOUT_TCP_CLOSE_WAIT,
38− CTA_TIMEOUT_TCP_LAST_ACK,
39− CTA_TIMEOUT_TCP_TIME_WAIT,
40− CTA_TIMEOUT_TCP_CLOSE,
41− CTA_TIMEOUT_TCP_SYN_SENT2,
42− CTA_TIMEOUT_TCP_RETRANS,
43− CTA_TIMEOUT_TCP_UNACK,
44− __CTA_TIMEOUT_TCP_MAX
45−};
46−#define CTA_TIMEOUT_TCP_MAX (__CTA_TIMEOUT_TCP_MAX - 1)
47−
48−enum ctattr_timeout_udp {
49− CTA_TIMEOUT_UDP_UNSPEC,
50− CTA_TIMEOUT_UDP_UNREPLIED,
51− CTA_TIMEOUT_UDP_REPLIED,
52− __CTA_TIMEOUT_UDP_MAX
53−};
54−#define CTA_TIMEOUT_UDP_MAX (__CTA_TIMEOUT_UDP_MAX - 1)
55−
56−enum ctattr_timeout_udplite {
57− CTA_TIMEOUT_UDPLITE_UNSPEC,
58− CTA_TIMEOUT_UDPLITE_UNREPLIED,
59− CTA_TIMEOUT_UDPLITE_REPLIED,
60− __CTA_TIMEOUT_UDPLITE_MAX
61−};
62−#define CTA_TIMEOUT_UDPLITE_MAX (__CTA_TIMEOUT_UDPLITE_MAX - 1)
63−
64−enum ctattr_timeout_icmp {
65− CTA_TIMEOUT_ICMP_UNSPEC,
66− CTA_TIMEOUT_ICMP_TIMEOUT,
67− __CTA_TIMEOUT_ICMP_MAX
68−};
69−#define CTA_TIMEOUT_ICMP_MAX (__CTA_TIMEOUT_ICMP_MAX - 1)
70−
71−enum ctattr_timeout_dccp {
72− CTA_TIMEOUT_DCCP_UNSPEC,
73− CTA_TIMEOUT_DCCP_REQUEST,
74− CTA_TIMEOUT_DCCP_RESPOND,
75− CTA_TIMEOUT_DCCP_PARTOPEN,
76− CTA_TIMEOUT_DCCP_OPEN,
77− CTA_TIMEOUT_DCCP_CLOSEREQ,
78− CTA_TIMEOUT_DCCP_CLOSING,
79− CTA_TIMEOUT_DCCP_TIMEWAIT,
80− __CTA_TIMEOUT_DCCP_MAX
81−};
82−#define CTA_TIMEOUT_DCCP_MAX (__CTA_TIMEOUT_DCCP_MAX - 1)
83−
84−enum ctattr_timeout_sctp {
85− CTA_TIMEOUT_SCTP_UNSPEC,
86− CTA_TIMEOUT_SCTP_CLOSED,
87− CTA_TIMEOUT_SCTP_COOKIE_WAIT,
88− CTA_TIMEOUT_SCTP_COOKIE_ECHOED,
89− CTA_TIMEOUT_SCTP_ESTABLISHED,
90− CTA_TIMEOUT_SCTP_SHUTDOWN_SENT,
91− CTA_TIMEOUT_SCTP_SHUTDOWN_RECD,
92− CTA_TIMEOUT_SCTP_SHUTDOWN_ACK_SENT,
93− __CTA_TIMEOUT_SCTP_MAX
94−};
95−#define CTA_TIMEOUT_SCTP_MAX (__CTA_TIMEOUT_SCTP_MAX - 1)
96−
97−enum ctattr_timeout_icmpv6 {
98− CTA_TIMEOUT_ICMPV6_UNSPEC,
99− CTA_TIMEOUT_ICMPV6_TIMEOUT,
100− __CTA_TIMEOUT_ICMPV6_MAX
101−};
102−#define CTA_TIMEOUT_ICMPV6_MAX (__CTA_TIMEOUT_ICMPV6_MAX - 1)
103−
104−enum ctattr_timeout_gre {
105− CTA_TIMEOUT_GRE_UNSPEC,
106− CTA_TIMEOUT_GRE_UNREPLIED,
107− CTA_TIMEOUT_GRE_REPLIED,
108− __CTA_TIMEOUT_GRE_MAX
109−};
110−#define CTA_TIMEOUT_GRE_MAX (__CTA_TIMEOUT_GRE_MAX - 1)
111−
112−#define CTNL_TIMEOUT_NAME_MAX 32
113−
114−#endif
include/linux/netfilter/nfnetlink_log.h+0−97
@@ -1,97 +0,0 @@
1−#ifndef _NFNETLINK_LOG_H
2−#define _NFNETLINK_LOG_H
3−
4−/* This file describes the netlink messages (i.e. 'protocol packets'),
5− * and not any kind of function definitions. It is shared between kernel and
6− * userspace. Don't put kernel specific stuff in here */
7−
8−#include <linux/types.h>
9−#include <linux/netfilter/nfnetlink.h>
10−
11−enum nfulnl_msg_types {
12− NFULNL_MSG_PACKET, /* packet from kernel to userspace */
13− NFULNL_MSG_CONFIG, /* connect to a particular queue */
14−
15− NFULNL_MSG_MAX
16−};
17−
18−struct nfulnl_msg_packet_hdr {
19− __be16 hw_protocol; /* hw protocol (network order) */
20− __u8 hook; /* netfilter hook */
21− __u8 _pad;
22−};
23−
24−struct nfulnl_msg_packet_hw {
25− __be16 hw_addrlen;
26− __u16 _pad;
27− __u8 hw_addr[8];
28−};
29−
30−struct nfulnl_msg_packet_timestamp {
31− __aligned_be64 sec;
32− __aligned_be64 usec;
33−};
34−
35−enum nfulnl_attr_type {
36− NFULA_UNSPEC,
37− NFULA_PACKET_HDR,
38− NFULA_MARK, /* __u32 nfmark */
39− NFULA_TIMESTAMP, /* nfulnl_msg_packet_timestamp */
40− NFULA_IFINDEX_INDEV, /* __u32 ifindex */
41− NFULA_IFINDEX_OUTDEV, /* __u32 ifindex */
42− NFULA_IFINDEX_PHYSINDEV, /* __u32 ifindex */
43− NFULA_IFINDEX_PHYSOUTDEV, /* __u32 ifindex */
44− NFULA_HWADDR, /* nfulnl_msg_packet_hw */
45− NFULA_PAYLOAD, /* opaque data payload */
46− NFULA_PREFIX, /* string prefix */
47− NFULA_UID, /* user id of socket */
48− NFULA_SEQ, /* instance-local sequence number */
49− NFULA_SEQ_GLOBAL, /* global sequence number */
50− NFULA_GID, /* group id of socket */
51− NFULA_HWTYPE, /* hardware type */
52− NFULA_HWHEADER, /* hardware header */
53− NFULA_HWLEN, /* hardware header length */
54−
55− __NFULA_MAX
56−};
57−#define NFULA_MAX (__NFULA_MAX - 1)
58−
59−enum nfulnl_msg_config_cmds {
60− NFULNL_CFG_CMD_NONE,
61− NFULNL_CFG_CMD_BIND,
62− NFULNL_CFG_CMD_UNBIND,
63− NFULNL_CFG_CMD_PF_BIND,
64− NFULNL_CFG_CMD_PF_UNBIND,
65−};
66−
67−struct nfulnl_msg_config_cmd {
68− __u8 command; /* nfulnl_msg_config_cmds */
69−} __attribute__ ((packed));
70−
71−struct nfulnl_msg_config_mode {
72− __be32 copy_range;
73− __u8 copy_mode;
74− __u8 _pad;
75−} __attribute__ ((packed));
76−
77−enum nfulnl_attr_config {
78− NFULA_CFG_UNSPEC,
79− NFULA_CFG_CMD, /* nfulnl_msg_config_cmd */
80− NFULA_CFG_MODE, /* nfulnl_msg_config_mode */
81− NFULA_CFG_NLBUFSIZ, /* __u32 buffer size */
82− NFULA_CFG_TIMEOUT, /* __u32 in 1/100 s */
83− NFULA_CFG_QTHRESH, /* __u32 */
84− NFULA_CFG_FLAGS, /* __u16 */
85− __NFULA_CFG_MAX
86−};
87−#define NFULA_CFG_MAX (__NFULA_CFG_MAX -1)
88−
89−#define NFULNL_COPY_NONE 0x00
90−#define NFULNL_COPY_META 0x01
91−#define NFULNL_COPY_PACKET 0x02
92−/* 0xff is reserved, don't use it for new copy modes. */
93−
94−#define NFULNL_CFG_F_SEQ 0x0001
95−#define NFULNL_CFG_F_SEQ_GLOBAL 0x0002
96−
97−#endif /* _NFNETLINK_LOG_H */
include/linux/netfilter/nfnetlink_queue.h+0−101
@@ -1,101 +0,0 @@
1−#ifndef _NFNETLINK_QUEUE_H
2−#define _NFNETLINK_QUEUE_H
3−
4−#include <linux/types.h>
5−#include <linux/netfilter/nfnetlink.h>
6−
7−enum nfqnl_msg_types {
8− NFQNL_MSG_PACKET, /* packet from kernel to userspace */
9− NFQNL_MSG_VERDICT, /* verdict from userspace to kernel */
10− NFQNL_MSG_CONFIG, /* connect to a particular queue */
11− NFQNL_MSG_VERDICT_BATCH, /* batchv from userspace to kernel */
12−
13− NFQNL_MSG_MAX
14−};
15−
16−struct nfqnl_msg_packet_hdr {
17− __be32 packet_id; /* unique ID of packet in queue */
18− __be16 hw_protocol; /* hw protocol (network order) */
19− __u8 hook; /* netfilter hook */
20−} __attribute__ ((packed));
21−
22−struct nfqnl_msg_packet_hw {
23− __be16 hw_addrlen;
24− __u16 _pad;
25− __u8 hw_addr[8];
26−};
27−
28−struct nfqnl_msg_packet_timestamp {
29− __aligned_be64 sec;
30− __aligned_be64 usec;
31−};
32−
33−enum nfqnl_attr_type {
34− NFQA_UNSPEC,
35− NFQA_PACKET_HDR,
36− NFQA_VERDICT_HDR, /* nfqnl_msg_verdict_hrd */
37− NFQA_MARK, /* __u32 nfmark */
38− NFQA_TIMESTAMP, /* nfqnl_msg_packet_timestamp */
39− NFQA_IFINDEX_INDEV, /* __u32 ifindex */
40− NFQA_IFINDEX_OUTDEV, /* __u32 ifindex */
41− NFQA_IFINDEX_PHYSINDEV, /* __u32 ifindex */
42− NFQA_IFINDEX_PHYSOUTDEV, /* __u32 ifindex */
43− NFQA_HWADDR, /* nfqnl_msg_packet_hw */
44− NFQA_PAYLOAD, /* opaque data payload */
45− NFQA_CT, /* nf_conntrack_netlink.h */
46− NFQA_CT_INFO, /* enum ip_conntrack_info */
47− NFQA_CAP_LEN, /* __u32 length of captured packet */
48−
49− __NFQA_MAX
50−};
51−#define NFQA_MAX (__NFQA_MAX - 1)
52−
53−struct nfqnl_msg_verdict_hdr {
54− __be32 verdict;
55− __be32 id;
56−};
57−
58−
59−enum nfqnl_msg_config_cmds {
60− NFQNL_CFG_CMD_NONE,
61− NFQNL_CFG_CMD_BIND,
62− NFQNL_CFG_CMD_UNBIND,
63− NFQNL_CFG_CMD_PF_BIND,
64− NFQNL_CFG_CMD_PF_UNBIND,
65−};
66−
67−struct nfqnl_msg_config_cmd {
68− __u8 command; /* nfqnl_msg_config_cmds */
69− __u8 _pad;
70− __be16 pf; /* AF_xxx for PF_[UN]BIND */
71−};
72−
73−enum nfqnl_config_mode {
74− NFQNL_COPY_NONE,
75− NFQNL_COPY_META,
76− NFQNL_COPY_PACKET,
77−};
78−
79−struct nfqnl_msg_config_params {
80− __be32 copy_range;
81− __u8 copy_mode; /* enum nfqnl_config_mode */
82−} __attribute__ ((packed));
83−
84−
85−enum nfqnl_attr_config {
86− NFQA_CFG_UNSPEC,
87− NFQA_CFG_CMD, /* nfqnl_msg_config_cmd */
88− NFQA_CFG_PARAMS, /* nfqnl_msg_config_params */
89− NFQA_CFG_QUEUE_MAXLEN, /* __u32 */
90− NFQA_CFG_MASK, /* identify which flags to change */
91− NFQA_CFG_FLAGS, /* value of these flags (__u32) */
92− __NFQA_CFG_MAX
93−};
94−#define NFQA_CFG_MAX (__NFQA_CFG_MAX-1)
95−
96−/* Flags for NFQA_CFG_FLAGS */
97−#define NFQA_CFG_F_FAIL_OPEN (1 << 0)
98−#define NFQA_CFG_F_CONNTRACK (1 << 1)
99−#define NFQA_CFG_F_MAX (1 << 2)
100−
101−#endif /* _NFNETLINK_QUEUE_H */
include/linux/netfilter/x_tables.h+1−185
@@ -1,191 +1,9 @@
11 #ifndef _X_TABLES_H
22 #define _X_TABLES_H
3−#include <linux/kernel.h>
4−#include <linux/types.h>
53
6−#define XT_FUNCTION_MAXNAMELEN 30
7−#define XT_EXTENSION_MAXNAMELEN 29
8−#define XT_TABLE_MAXNAMELEN 32
9−
10−struct xt_entry_match {
11− union {
12− struct {
13− __u16 match_size;
14−
15− /* Used by userspace */
16− char name[XT_EXTENSION_MAXNAMELEN];
17− __u8 revision;
18− } user;
19− struct {
20− __u16 match_size;
21−
22− /* Used inside the kernel */
23− struct xt_match *match;
24− } kernel;
25−
26− /* Total length */
27− __u16 match_size;
28− } u;
29−
30− unsigned char data[0];
31−};
32−
33−struct xt_entry_target {
34− union {
35− struct {
36− __u16 target_size;
37−
38− /* Used by userspace */
39− char name[XT_EXTENSION_MAXNAMELEN];
40− __u8 revision;
41− } user;
42− struct {
43− __u16 target_size;
44−
45− /* Used inside the kernel */
46− struct xt_target *target;
47− } kernel;
48−
49− /* Total length */
50− __u16 target_size;
51− } u;
52−
53− unsigned char data[0];
54−};
55−
56−#define XT_TARGET_INIT(__name, __size) \
57−{ \
58− .target.u.user = { \
59− .target_size = XT_ALIGN(__size), \
60− .name = __name, \
61− }, \
62−}
63−
64−struct xt_standard_target {
65− struct xt_entry_target target;
66− int verdict;
67−};
68−
69−struct xt_error_target {
70− struct xt_entry_target target;
71− char errorname[XT_FUNCTION_MAXNAMELEN];
72−};
73−
74−/* The argument to IPT_SO_GET_REVISION_*. Returns highest revision
75− * kernel supports, if >= revision. */
76−struct xt_get_revision {
77− char name[XT_EXTENSION_MAXNAMELEN];
78− __u8 revision;
79−};
80−
81−/* CONTINUE verdict for targets */
82−#define XT_CONTINUE 0xFFFFFFFF
83−
84−/* For standard target */
85−#define XT_RETURN (-NF_REPEAT - 1)
86−
87−/* this is a dummy structure to find out the alignment requirement for a struct
88− * containing all the fundamental data types that are used in ipt_entry,
89− * ip6t_entry and arpt_entry. This sucks, and it is a hack. It will be my
90− * personal pleasure to remove it -HW
91− */
92−struct _xt_align {
93− __u8 u8;
94− __u16 u16;
95− __u32 u32;
96− __u64 u64;
97−};
98−
99−#define XT_ALIGN(s) __ALIGN_KERNEL((s), __alignof__(struct _xt_align))
100−
101−/* Standard return verdict, or do jump. */
102−#define XT_STANDARD_TARGET ""
103−/* Error verdict. */
104−#define XT_ERROR_TARGET "ERROR"
105−
106−#define SET_COUNTER(c,b,p) do { (c).bcnt = (b); (c).pcnt = (p); } while(0)
107−#define ADD_COUNTER(c,b,p) do { (c).bcnt += (b); (c).pcnt += (p); } while(0)
108−
109−struct xt_counters {
110− __u64 pcnt, bcnt; /* Packet and byte counters */
111−};
112−
113−/* The argument to IPT_SO_ADD_COUNTERS. */
114−struct xt_counters_info {
115− /* Which table. */
116− char name[XT_TABLE_MAXNAMELEN];
117−
118− unsigned int num_counters;
119−
120− /* The counters (actually `number' of these). */
121− struct xt_counters counters[0];
122−};
123−
124−#define XT_INV_PROTO 0x40 /* Invert the sense of PROTO. */
125−
126−#ifndef __KERNEL__
127−/* fn returns 0 to continue iteration */
128−#define XT_MATCH_ITERATE(type, e, fn, args...) \
129−({ \
130− unsigned int __i; \
131− int __ret = 0; \
132− struct xt_entry_match *__m; \
133− \
134− for (__i = sizeof(type); \
135− __i < (e)->target_offset; \
136− __i += __m->u.match_size) { \
137− __m = (void *)e + __i; \
138− \
139− __ret = fn(__m , ## args); \
140− if (__ret != 0) \
141− break; \
142− } \
143− __ret; \
144−})
145−
146−/* fn returns 0 to continue iteration */
147−#define XT_ENTRY_ITERATE_CONTINUE(type, entries, size, n, fn, args...) \
148−({ \
149− unsigned int __i, __n; \
150− int __ret = 0; \
151− type *__entry; \
152− \
153− for (__i = 0, __n = 0; __i < (size); \
154− __i += __entry->next_offset, __n++) { \
155− __entry = (void *)(entries) + __i; \
156− if (__n < n) \
157− continue; \
158− \
159− __ret = fn(__entry , ## args); \
160− if (__ret != 0) \
161− break; \
162− } \
163− __ret; \
164−})
165−
166−/* fn returns 0 to continue iteration */
167−#define XT_ENTRY_ITERATE(type, entries, size, fn, args...) \
168− XT_ENTRY_ITERATE_CONTINUE(type, entries, size, 0, fn, args)
169−
170−#endif /* !__KERNEL__ */
171−
172−/* pos is normally a struct ipt_entry/ip6t_entry/etc. */
173−#define xt_entry_foreach(pos, ehead, esize) \
174− for ((pos) = (typeof(pos))(ehead); \
175− (pos) < (typeof(pos))((char *)(ehead) + (esize)); \
176− (pos) = (typeof(pos))((char *)(pos) + (pos)->next_offset))
177−
178−/* can only be xt_entry_match, so no use of typeof here */
179−#define xt_ematch_foreach(pos, entry) \
180− for ((pos) = (struct xt_entry_match *)entry->elems; \
181− (pos) < (struct xt_entry_match *)((char *)(entry) + \
182− (entry)->target_offset); \
183− (pos) = (struct xt_entry_match *)((char *)(pos) + \
184− (pos)->u.match_size))
185−
186−#ifdef __KERNEL__
1874
1885 #include <linux/netdevice.h>
6+#include <uapi/linux/netfilter/x_tables.h>
1897
1908 /**
1919 * struct xt_action_param - parameters for matches/targets
@@ -617,6 +435,4 @@ extern int xt_compat_target_to_user(const struct xt_entry_target *t, · 425 unmodified lines
617435 void __user **dstptr, unsigned int *size);
618436
619437 #endif /* CONFIG_COMPAT */
620−#endif /* __KERNEL__ */
621−
622438 #endif /* _X_TABLES_H */
include/linux/netfilter/xt_AUDIT.h+0−30
@@ -1,30 +0,0 @@
1−/*
2− * Header file for iptables xt_AUDIT target
3− *
4− * (C) 2010-2011 Thomas Graf <tgraf@redhat.com>
5− * (C) 2010-2011 Red Hat, Inc.
6− *
7− * This program is free software; you can redistribute it and/or modify
8− * it under the terms of the GNU General Public License version 2 as
9− * published by the Free Software Foundation.
10− */
11−
12−#ifndef _XT_AUDIT_TARGET_H
13−#define _XT_AUDIT_TARGET_H
14−
15−#include <linux/types.h>
16−
17−enum {
18− XT_AUDIT_TYPE_ACCEPT = 0,
19− XT_AUDIT_TYPE_DROP,
20− XT_AUDIT_TYPE_REJECT,
21− __XT_AUDIT_TYPE_MAX,
22−};
23−
24−#define XT_AUDIT_TYPE_MAX (__XT_AUDIT_TYPE_MAX - 1)
25−
26−struct xt_audit_info {
27− __u8 type; /* XT_AUDIT_TYPE_* */
28−};
29−
30−#endif /* _XT_AUDIT_TARGET_H */
include/linux/netfilter/xt_CHECKSUM.h+0−20
@@ -1,20 +0,0 @@
1−/* Header file for iptables ipt_CHECKSUM target
2− *
3− * (C) 2002 by Harald Welte <laforge@gnumonks.org>
4− * (C) 2010 Red Hat Inc
5− * Author: Michael S. Tsirkin <mst@redhat.com>
6− *
7− * This software is distributed under GNU GPL v2, 1991
8−*/
9−#ifndef _XT_CHECKSUM_TARGET_H
10−#define _XT_CHECKSUM_TARGET_H
11−
12−#include <linux/types.h>
13−
14−#define XT_CHECKSUM_OP_FILL 0x01 /* fill in checksum in IP header */
15−
16−struct xt_CHECKSUM_info {
17− __u8 operation; /* bitset of operations */
18−};
19−
20−#endif /* _XT_CHECKSUM_TARGET_H */
include/linux/netfilter/xt_CLASSIFY.h+0−10
@@ -1,10 +0,0 @@
1−#ifndef _XT_CLASSIFY_H
2−#define _XT_CLASSIFY_H
3−
4−#include <linux/types.h>
5−
6−struct xt_classify_target_info {
7− __u32 priority;
8−};
9−
10−#endif /*_XT_CLASSIFY_H */
include/linux/netfilter/xt_CONNMARK.h+0−6
@@ -1,6 +0,0 @@
1−#ifndef _XT_CONNMARK_H_target
2−#define _XT_CONNMARK_H_target
3−
4−#include <linux/netfilter/xt_connmark.h>
5−
6−#endif /*_XT_CONNMARK_H_target*/
include/linux/netfilter/xt_CONNSECMARK.h+0−15
@@ -1,15 +0,0 @@
1−#ifndef _XT_CONNSECMARK_H_target
2−#define _XT_CONNSECMARK_H_target
3−
4−#include <linux/types.h>
5−
6−enum {
7− CONNSECMARK_SAVE = 1,
8− CONNSECMARK_RESTORE,
9−};
10−
11−struct xt_connsecmark_target_info {
12− __u8 mode;
13−};
14−
15−#endif /*_XT_CONNSECMARK_H_target */
include/linux/netfilter/xt_CT.h+0−31
@@ -1,31 +0,0 @@
1−#ifndef _XT_CT_H
2−#define _XT_CT_H
3−
4−#include <linux/types.h>
5−
6−#define XT_CT_NOTRACK 0x1
7−
8−struct xt_ct_target_info {
9− __u16 flags;
10− __u16 zone;
11− __u32 ct_events;
12− __u32 exp_events;
13− char helper[16];
14−
15− /* Used internally by the kernel */
16− struct nf_conn *ct __attribute__((aligned(8)));
17−};
18−
19−struct xt_ct_target_info_v1 {
20− __u16 flags;
21− __u16 zone;
22− __u32 ct_events;
23− __u32 exp_events;
24− char helper[16];
25− char timeout[32];
26−
27− /* Used internally by the kernel */
28− struct nf_conn *ct __attribute__((aligned(8)));
29−};
30−
31−#endif /* _XT_CT_H */
include/linux/netfilter/xt_DSCP.h+0−26
@@ -1,26 +0,0 @@
1−/* x_tables module for setting the IPv4/IPv6 DSCP field
2− *
3− * (C) 2002 Harald Welte <laforge@gnumonks.org>
4− * based on ipt_FTOS.c (C) 2000 by Matthew G. Marsh <mgm@paktronix.com>
5− * This software is distributed under GNU GPL v2, 1991
6− *
7− * See RFC2474 for a description of the DSCP field within the IP Header.
8− *
9− * xt_DSCP.h,v 1.7 2002/03/14 12:03:13 laforge Exp
10−*/
11−#ifndef _XT_DSCP_TARGET_H
12−#define _XT_DSCP_TARGET_H
13−#include <linux/netfilter/xt_dscp.h>
14−#include <linux/types.h>
15−
16−/* target info */
17−struct xt_DSCP_info {
18− __u8 dscp;
19−};
20−
21−struct xt_tos_target_info {
22− __u8 tos_value;
23− __u8 tos_mask;
24−};
25−
26−#endif /* _XT_DSCP_TARGET_H */
include/linux/netfilter/xt_IDLETIMER.h+0−45
@@ -1,45 +0,0 @@
1−/*
2− * linux/include/linux/netfilter/xt_IDLETIMER.h
3− *
4− * Header file for Xtables timer target module.
5− *
6− * Copyright (C) 2004, 2010 Nokia Corporation
7− * Written by Timo Teras <ext-timo.teras@nokia.com>
8− *
9− * Converted to x_tables and forward-ported to 2.6.34
10− * by Luciano Coelho <luciano.coelho@nokia.com>
11− *
12− * Contact: Luciano Coelho <luciano.coelho@nokia.com>
13− *
14− * This program is free software; you can redistribute it and/or
15− * modify it under the terms of the GNU General Public License
16− * version 2 as published by the Free Software Foundation.
17− *
18− * This program is distributed in the hope that it will be useful, but
19− * WITHOUT ANY WARRANTY; without even the implied warranty of
20− * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
21− * General Public License for more details.
22− *
23− * You should have received a copy of the GNU General Public License
24− * along with this program; if not, write to the Free Software
25− * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
26− * 02110-1301 USA
27− */
28−
29−#ifndef _XT_IDLETIMER_H
30−#define _XT_IDLETIMER_H
31−
32−#include <linux/types.h>
33−
34−#define MAX_IDLETIMER_LABEL_SIZE 28
35−
36−struct idletimer_tg_info {
37− __u32 timeout;
38−
39− char label[MAX_IDLETIMER_LABEL_SIZE];
40−
41− /* for kernel module internal use only */
42− struct idletimer_tg *timer __attribute__((aligned(8)));
43−};
44−
45−#endif
include/linux/netfilter/xt_LED.h+0−15
@@ -1,15 +0,0 @@
1−#ifndef _XT_LED_H
2−#define _XT_LED_H
3−
4−#include <linux/types.h>
5−
6−struct xt_led_info {
7− char id[27]; /* Unique ID for this trigger in the LED class */
8− __u8 always_blink; /* Blink even if the LED is already on */
9− __u32 delay; /* Delay until LED is switched off after trigger */
10−
11− /* Kernel data used in the module */
12− void *internal_data __attribute__((aligned(8)));
13−};
14−
15−#endif /* _XT_LED_H */
include/linux/netfilter/xt_LOG.h+0−19
@@ -1,19 +0,0 @@
1−#ifndef _XT_LOG_H
2−#define _XT_LOG_H
3−
4−/* make sure not to change this without changing nf_log.h:NF_LOG_* (!) */
5−#define XT_LOG_TCPSEQ 0x01 /* Log TCP sequence numbers */
6−#define XT_LOG_TCPOPT 0x02 /* Log TCP options */
7−#define XT_LOG_IPOPT 0x04 /* Log IP options */
8−#define XT_LOG_UID 0x08 /* Log UID owning local socket */
9−#define XT_LOG_NFLOG 0x10 /* Unsupported, don't reuse */
10−#define XT_LOG_MACDECODE 0x20 /* Decode MAC header */
11−#define XT_LOG_MASK 0x2f
12−
13−struct xt_log_info {
14− unsigned char level;
15− unsigned char logflags;
16− char prefix[30];
17−};
18−
19−#endif /* _XT_LOG_H */
include/linux/netfilter/xt_MARK.h+0−6
@@ -1,6 +0,0 @@
1−#ifndef _XT_MARK_H_target
2−#define _XT_MARK_H_target
3−
4−#include <linux/netfilter/xt_mark.h>
5−
6−#endif /*_XT_MARK_H_target */
include/linux/netfilter/xt_NFLOG.h+0−20
@@ -1,20 +0,0 @@
1−#ifndef _XT_NFLOG_TARGET
2−#define _XT_NFLOG_TARGET
3−
4−#include <linux/types.h>
5−
6−#define XT_NFLOG_DEFAULT_GROUP 0x1
7−#define XT_NFLOG_DEFAULT_THRESHOLD 0
8−
9−#define XT_NFLOG_MASK 0x0
10−
11−struct xt_nflog_info {
12− __u32 len;
13− __u16 group;
14− __u16 threshold;
15− __u16 flags;
16− __u16 pad;
17− char prefix[64];
18−};
19−
20−#endif /* _XT_NFLOG_TARGET */
include/linux/netfilter/xt_NFQUEUE.h+0−29
@@ -1,29 +0,0 @@
1−/* iptables module for using NFQUEUE mechanism
2− *
3− * (C) 2005 Harald Welte <laforge@netfilter.org>
4− *
5− * This software is distributed under GNU GPL v2, 1991
6− *
7−*/
8−#ifndef _XT_NFQ_TARGET_H
9−#define _XT_NFQ_TARGET_H
10−
11−#include <linux/types.h>
12−
13−/* target info */
14−struct xt_NFQ_info {
15− __u16 queuenum;
16−};
17−
18−struct xt_NFQ_info_v1 {
19− __u16 queuenum;
20− __u16 queues_total;
21−};
22−
23−struct xt_NFQ_info_v2 {
24− __u16 queuenum;
25− __u16 queues_total;
26− __u16 bypass;
27−};
28−
29−#endif /* _XT_NFQ_TARGET_H */
include/linux/netfilter/xt_RATEEST.h+0−15
@@ -1,15 +0,0 @@
1−#ifndef _XT_RATEEST_TARGET_H
2−#define _XT_RATEEST_TARGET_H
3−
4−#include <linux/types.h>
5−
6−struct xt_rateest_target_info {
7− char name[IFNAMSIZ];
8− __s8 interval;
9− __u8 ewma_log;
10−
11− /* Used internally by the kernel */
12− struct xt_rateest *est __attribute__((aligned(8)));
13−};
14−
15−#endif /* _XT_RATEEST_TARGET_H */
include/linux/netfilter/xt_SECMARK.h+0−22
@@ -1,22 +0,0 @@
1−#ifndef _XT_SECMARK_H_target
2−#define _XT_SECMARK_H_target
3−
4−#include <linux/types.h>
5−
6−/*
7− * This is intended for use by various security subsystems (but not
8− * at the same time).
9− *
10− * 'mode' refers to the specific security subsystem which the
11− * packets are being marked for.
12− */
13−#define SECMARK_MODE_SEL 0x01 /* SELinux */
14−#define SECMARK_SECCTX_MAX 256
15−
16−struct xt_secmark_target_info {
17− __u8 mode;
18− __u32 secid;
19− char secctx[SECMARK_SECCTX_MAX];
20−};
21−
22−#endif /*_XT_SECMARK_H_target */
include/linux/netfilter/xt_TCPMSS.h+0−12
@@ -1,12 +0,0 @@
1−#ifndef _XT_TCPMSS_H
2−#define _XT_TCPMSS_H
3−
4−#include <linux/types.h>
5−
6−struct xt_tcpmss_info {
7− __u16 mss;
8−};
9−
10−#define XT_TCPMSS_CLAMP_PMTU 0xffff
11−
12−#endif /* _XT_TCPMSS_H */
include/linux/netfilter/xt_TCPOPTSTRIP.h+0−15
@@ -1,15 +0,0 @@
1−#ifndef _XT_TCPOPTSTRIP_H
2−#define _XT_TCPOPTSTRIP_H
3−
4−#include <linux/types.h>
5−
6−#define tcpoptstrip_set_bit(bmap, idx) \
7− (bmap[(idx) >> 5] |= 1U << (idx & 31))
8−#define tcpoptstrip_test_bit(bmap, idx) \
9− (((1U << (idx & 31)) & bmap[(idx) >> 5]) != 0)
10−
11−struct xt_tcpoptstrip_target_info {
12− __u32 strip_bmap[8];
13−};
14−
15−#endif /* _XT_TCPOPTSTRIP_H */
include/linux/netfilter/xt_TEE.h+0−12
@@ -1,12 +0,0 @@
1−#ifndef _XT_TEE_TARGET_H
2−#define _XT_TEE_TARGET_H
3−
4−struct xt_tee_tginfo {
5− union nf_inet_addr gw;
6− char oif[16];
7−
8− /* used internally by the kernel */
9− struct xt_tee_priv *priv __attribute__((aligned(8)));
10−};
11−
12−#endif /* _XT_TEE_TARGET_H */
include/linux/netfilter/xt_TPROXY.h+0−23
@@ -1,23 +0,0 @@
1−#ifndef _XT_TPROXY_H
2−#define _XT_TPROXY_H
3−
4−#include <linux/types.h>
5−
6−/* TPROXY target is capable of marking the packet to perform
7− * redirection. We can get rid of that whenever we get support for
8− * mutliple targets in the same rule. */
9−struct xt_tproxy_target_info {
10− __u32 mark_mask;
11− __u32 mark_value;
12− __be32 laddr;
13− __be16 lport;
14−};
15−
16−struct xt_tproxy_target_info_v1 {
17− __u32 mark_mask;
18− __u32 mark_value;
19− union nf_inet_addr laddr;
20− __be16 lport;
21−};
22−
23−#endif /* _XT_TPROXY_H */
include/linux/netfilter/xt_addrtype.h+0−44
@@ -1,44 +0,0 @@
1−#ifndef _XT_ADDRTYPE_H
2−#define _XT_ADDRTYPE_H
3−
4−#include <linux/types.h>
5−
6−enum {
7− XT_ADDRTYPE_INVERT_SOURCE = 0x0001,
8− XT_ADDRTYPE_INVERT_DEST = 0x0002,
9− XT_ADDRTYPE_LIMIT_IFACE_IN = 0x0004,
10− XT_ADDRTYPE_LIMIT_IFACE_OUT = 0x0008,
11−};
12−
13−
14−/* rtn_type enum values from rtnetlink.h, but shifted */
15−enum {
16− XT_ADDRTYPE_UNSPEC = 1 << 0,
17− XT_ADDRTYPE_UNICAST = 1 << 1, /* 1 << RTN_UNICAST */
18− XT_ADDRTYPE_LOCAL = 1 << 2, /* 1 << RTN_LOCAL, etc */
19− XT_ADDRTYPE_BROADCAST = 1 << 3,
20− XT_ADDRTYPE_ANYCAST = 1 << 4,
21− XT_ADDRTYPE_MULTICAST = 1 << 5,
22− XT_ADDRTYPE_BLACKHOLE = 1 << 6,
23− XT_ADDRTYPE_UNREACHABLE = 1 << 7,
24− XT_ADDRTYPE_PROHIBIT = 1 << 8,
25− XT_ADDRTYPE_THROW = 1 << 9,
26− XT_ADDRTYPE_NAT = 1 << 10,
27− XT_ADDRTYPE_XRESOLVE = 1 << 11,
28−};
29−
30−struct xt_addrtype_info_v1 {
31− __u16 source; /* source-type mask */
32− __u16 dest; /* dest-type mask */
33− __u32 flags;
34−};
35−
36−/* revision 0 */
37−struct xt_addrtype_info {
38− __u16 source; /* source-type mask */
39− __u16 dest; /* dest-type mask */
40− __u32 invert_source;
41− __u32 invert_dest;
42−};
43−
44−#endif
include/linux/netfilter/xt_cluster.h+0−19
@@ -1,19 +0,0 @@
1−#ifndef _XT_CLUSTER_MATCH_H
2−#define _XT_CLUSTER_MATCH_H
3−
4−#include <linux/types.h>
5−
6−enum xt_cluster_flags {
7− XT_CLUSTER_F_INV = (1 << 0)
8−};
9−
10−struct xt_cluster_match_info {
11− __u32 total_nodes;
12− __u32 node_mask;
13− __u32 hash_seed;
14− __u32 flags;
15−};
16−
17−#define XT_CLUSTER_NODES_MAX 32
18−
19−#endif /* _XT_CLUSTER_MATCH_H */
include/linux/netfilter/xt_comment.h+0−10
@@ -1,10 +0,0 @@
1−#ifndef _XT_COMMENT_H
2−#define _XT_COMMENT_H
3−
4−#define XT_MAX_COMMENT_LEN 256
5−
6−struct xt_comment_info {
7− char comment[XT_MAX_COMMENT_LEN];
8−};
9−
10−#endif /* XT_COMMENT_H */
include/linux/netfilter/xt_connbytes.h+0−26
@@ -1,26 +0,0 @@
1−#ifndef _XT_CONNBYTES_H
2−#define _XT_CONNBYTES_H
3−
4−#include <linux/types.h>
5−
6−enum xt_connbytes_what {
7− XT_CONNBYTES_PKTS,
8− XT_CONNBYTES_BYTES,
9− XT_CONNBYTES_AVGPKT,
10−};
11−
12−enum xt_connbytes_direction {
13− XT_CONNBYTES_DIR_ORIGINAL,
14− XT_CONNBYTES_DIR_REPLY,
15− XT_CONNBYTES_DIR_BOTH,
16−};
17−
18−struct xt_connbytes_info {
19− struct {
20− __aligned_u64 from; /* count to be matched */
21− __aligned_u64 to; /* count to be matched */
22− } count;
23− __u8 what; /* ipt_connbytes_what */
24− __u8 direction; /* ipt_connbytes_direction */
25−};
26−#endif
include/linux/netfilter/xt_connlimit.h+0−32
@@ -1,32 +0,0 @@
1−#ifndef _XT_CONNLIMIT_H
2−#define _XT_CONNLIMIT_H
3−
4−#include <linux/types.h>
5−#include <linux/netfilter.h>
6−
7−struct xt_connlimit_data;
8−
9−enum {
10− XT_CONNLIMIT_INVERT = 1 << 0,
11− XT_CONNLIMIT_DADDR = 1 << 1,
12−};
13−
14−struct xt_connlimit_info {
15− union {
16− union nf_inet_addr mask;
17−#ifndef __KERNEL__
18− union {
19− __be32 v4_mask;
20− __be32 v6_mask[4];
21− };
22−#endif
23− };
24− unsigned int limit;
25− /* revision 1 */
26− __u32 flags;
27−
28− /* Used internally by the kernel */
29− struct xt_connlimit_data *data __attribute__((aligned(8)));
30−};
31−
32−#endif /* _XT_CONNLIMIT_H */
include/linux/netfilter/xt_connmark.h+0−31
@@ -1,31 +0,0 @@
1−#ifndef _XT_CONNMARK_H
2−#define _XT_CONNMARK_H
3−
4−#include <linux/types.h>
5−
6−/* Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>
7− * by Henrik Nordstrom <hno@marasystems.com>
8− *
9− * This program is free software; you can redistribute it and/or modify
10− * it under the terms of the GNU General Public License as published by
11− * the Free Software Foundation; either version 2 of the License, or
12− * (at your option) any later version.
13− */
14−
15−enum {
16− XT_CONNMARK_SET = 0,
17− XT_CONNMARK_SAVE,
18− XT_CONNMARK_RESTORE
19−};
20−
21−struct xt_connmark_tginfo1 {
22− __u32 ctmark, ctmask, nfmask;
23− __u8 mode;
24−};
25−
26−struct xt_connmark_mtinfo1 {
27− __u32 mark, mask;
28− __u8 invert;
29−};
30−
31−#endif /*_XT_CONNMARK_H*/
include/linux/netfilter/xt_conntrack.h+0−77
@@ -1,77 +0,0 @@
1−/* Header file for kernel module to match connection tracking information.
2− * GPL (C) 2001 Marc Boucher (marc@mbsi.ca).
3− */
4−
5−#ifndef _XT_CONNTRACK_H
6−#define _XT_CONNTRACK_H
7−
8−#include <linux/types.h>
9−#include <linux/netfilter.h>
10−#include <linux/netfilter/nf_conntrack_tuple_common.h>
11−
12−#define XT_CONNTRACK_STATE_BIT(ctinfo) (1 << ((ctinfo)%IP_CT_IS_REPLY+1))
13−#define XT_CONNTRACK_STATE_INVALID (1 << 0)
14−
15−#define XT_CONNTRACK_STATE_SNAT (1 << (IP_CT_NUMBER + 1))
16−#define XT_CONNTRACK_STATE_DNAT (1 << (IP_CT_NUMBER + 2))
17−#define XT_CONNTRACK_STATE_UNTRACKED (1 << (IP_CT_NUMBER + 3))
18−
19−/* flags, invflags: */
20−enum {
21− XT_CONNTRACK_STATE = 1 << 0,
22− XT_CONNTRACK_PROTO = 1 << 1,
23− XT_CONNTRACK_ORIGSRC = 1 << 2,
24− XT_CONNTRACK_ORIGDST = 1 << 3,
25− XT_CONNTRACK_REPLSRC = 1 << 4,
26− XT_CONNTRACK_REPLDST = 1 << 5,
27− XT_CONNTRACK_STATUS = 1 << 6,
28− XT_CONNTRACK_EXPIRES = 1 << 7,
29− XT_CONNTRACK_ORIGSRC_PORT = 1 << 8,
30− XT_CONNTRACK_ORIGDST_PORT = 1 << 9,
31− XT_CONNTRACK_REPLSRC_PORT = 1 << 10,
32− XT_CONNTRACK_REPLDST_PORT = 1 << 11,
33− XT_CONNTRACK_DIRECTION = 1 << 12,
34−};
35−
36−struct xt_conntrack_mtinfo1 {
37− union nf_inet_addr origsrc_addr, origsrc_mask;
38− union nf_inet_addr origdst_addr, origdst_mask;
39− union nf_inet_addr replsrc_addr, replsrc_mask;
40− union nf_inet_addr repldst_addr, repldst_mask;
41− __u32 expires_min, expires_max;
42− __u16 l4proto;
43− __be16 origsrc_port, origdst_port;
44− __be16 replsrc_port, repldst_port;
45− __u16 match_flags, invert_flags;
46− __u8 state_mask, status_mask;
47−};
48−
49−struct xt_conntrack_mtinfo2 {
50− union nf_inet_addr origsrc_addr, origsrc_mask;
51− union nf_inet_addr origdst_addr, origdst_mask;
52− union nf_inet_addr replsrc_addr, replsrc_mask;
53− union nf_inet_addr repldst_addr, repldst_mask;
54− __u32 expires_min, expires_max;
55− __u16 l4proto;
56− __be16 origsrc_port, origdst_port;
57− __be16 replsrc_port, repldst_port;
58− __u16 match_flags, invert_flags;
59− __u16 state_mask, status_mask;
60−};
61−
62−struct xt_conntrack_mtinfo3 {
63− union nf_inet_addr origsrc_addr, origsrc_mask;
64− union nf_inet_addr origdst_addr, origdst_mask;
65− union nf_inet_addr replsrc_addr, replsrc_mask;
66− union nf_inet_addr repldst_addr, repldst_mask;
67− __u32 expires_min, expires_max;
68− __u16 l4proto;
69− __u16 origsrc_port, origdst_port;
70− __u16 replsrc_port, repldst_port;
71− __u16 match_flags, invert_flags;
72− __u16 state_mask, status_mask;
73− __u16 origsrc_port_high, origdst_port_high;
74− __u16 replsrc_port_high, repldst_port_high;
75−};
76−
77−#endif /*_XT_CONNTRACK_H*/
include/linux/netfilter/xt_cpu.h+0−11
@@ -1,11 +0,0 @@
1−#ifndef _XT_CPU_H
2−#define _XT_CPU_H
3−
4−#include <linux/types.h>
5−
6−struct xt_cpu_info {
7− __u32 cpu;
8− __u32 invert;
9−};
10−
11−#endif /*_XT_CPU_H*/
include/linux/netfilter/xt_dccp.h+0−25
@@ -1,25 +0,0 @@
1−#ifndef _XT_DCCP_H_
2−#define _XT_DCCP_H_
3−
4−#include <linux/types.h>
5−
6−#define XT_DCCP_SRC_PORTS 0x01
7−#define XT_DCCP_DEST_PORTS 0x02
8−#define XT_DCCP_TYPE 0x04
9−#define XT_DCCP_OPTION 0x08
10−
11−#define XT_DCCP_VALID_FLAGS 0x0f
12−
13−struct xt_dccp_info {
14− __u16 dpts[2]; /* Min, Max */
15− __u16 spts[2]; /* Min, Max */
16−
17− __u16 flags;
18− __u16 invflags;
19−
20− __u16 typemask;
21− __u8 option;
22−};
23−
24−#endif /* _XT_DCCP_H_ */
25−
include/linux/netfilter/xt_devgroup.h+0−21
@@ -1,21 +0,0 @@
1−#ifndef _XT_DEVGROUP_H
2−#define _XT_DEVGROUP_H
3−
4−#include <linux/types.h>
5−
6−enum xt_devgroup_flags {
7− XT_DEVGROUP_MATCH_SRC = 0x1,
8− XT_DEVGROUP_INVERT_SRC = 0x2,
9− XT_DEVGROUP_MATCH_DST = 0x4,
10− XT_DEVGROUP_INVERT_DST = 0x8,
11−};
12−
13−struct xt_devgroup_info {
14− __u32 flags;
15− __u32 src_group;
16− __u32 src_mask;
17− __u32 dst_group;
18− __u32 dst_mask;
19−};
20−
21−#endif /* _XT_DEVGROUP_H */
include/linux/netfilter/xt_dscp.h+0−31
@@ -1,31 +0,0 @@
1−/* x_tables module for matching the IPv4/IPv6 DSCP field
2− *
3− * (C) 2002 Harald Welte <laforge@gnumonks.org>
4− * This software is distributed under GNU GPL v2, 1991
5− *
6− * See RFC2474 for a description of the DSCP field within the IP Header.
7− *
8− * xt_dscp.h,v 1.3 2002/08/05 19:00:21 laforge Exp
9−*/
10−#ifndef _XT_DSCP_H
11−#define _XT_DSCP_H
12−
13−#include <linux/types.h>
14−
15−#define XT_DSCP_MASK 0xfc /* 11111100 */
16−#define XT_DSCP_SHIFT 2
17−#define XT_DSCP_MAX 0x3f /* 00111111 */
18−
19−/* match info */
20−struct xt_dscp_info {
21− __u8 dscp;
22− __u8 invert;
23−};
24−
25−struct xt_tos_match_info {
26− __u8 tos_mask;
27− __u8 tos_value;
28− __u8 invert;
29−};
30−
31−#endif /* _XT_DSCP_H */
include/linux/netfilter/xt_ecn.h+0−35
@@ -1,35 +0,0 @@
1−/* iptables module for matching the ECN header in IPv4 and TCP header
2− *
3− * (C) 2002 Harald Welte <laforge@gnumonks.org>
4− *
5− * This software is distributed under GNU GPL v2, 1991
6− *
7− * ipt_ecn.h,v 1.4 2002/08/05 19:39:00 laforge Exp
8−*/
9−#ifndef _XT_ECN_H
10−#define _XT_ECN_H
11−
12−#include <linux/types.h>
13−#include <linux/netfilter/xt_dscp.h>
14−
15−#define XT_ECN_IP_MASK (~XT_DSCP_MASK)
16−
17−#define XT_ECN_OP_MATCH_IP 0x01
18−#define XT_ECN_OP_MATCH_ECE 0x10
19−#define XT_ECN_OP_MATCH_CWR 0x20
20−
21−#define XT_ECN_OP_MATCH_MASK 0xce
22−
23−/* match info */
24−struct xt_ecn_info {
25− __u8 operation;
26− __u8 invert;
27− __u8 ip_ect;
28− union {
29− struct {
30− __u8 ect;
31− } tcp;
32− } proto;
33−};
34−
35−#endif /* _XT_ECN_H */
include/linux/netfilter/xt_esp.h+0−15
@@ -1,15 +0,0 @@
1−#ifndef _XT_ESP_H
2−#define _XT_ESP_H
3−
4−#include <linux/types.h>
5−
6−struct xt_esp {
7− __u32 spis[2]; /* Security Parameter Index */
8− __u8 invflags; /* Inverse flags */
9−};
10−
11−/* Values for "invflags" field in struct xt_esp. */
12−#define XT_ESP_INV_SPI 0x01 /* Invert the sense of spi. */
13−#define XT_ESP_INV_MASK 0x01 /* All possible flags. */
14−
15−#endif /*_XT_ESP_H*/
include/linux/netfilter/xt_hashlimit.h+1−70
@@ -1,78 +1,9 @@
11 #ifndef _XT_HASHLIMIT_H
22 #define _XT_HASHLIMIT_H
33
4−#include <linux/types.h>
4+#include <uapi/linux/netfilter/xt_hashlimit.h>
55
6−/* timings are in milliseconds. */
7−#define XT_HASHLIMIT_SCALE 10000
8−/* 1/10,000 sec period => max of 10,000/sec. Min rate is then 429490
9− * seconds, or one packet every 59 hours.
10− */
11−
12−/* packet length accounting is done in 16-byte steps */
13−#define XT_HASHLIMIT_BYTE_SHIFT 4
14−
15−/* details of this structure hidden by the implementation */
16−struct xt_hashlimit_htable;
17−
18−enum {
19− XT_HASHLIMIT_HASH_DIP = 1 << 0,
20− XT_HASHLIMIT_HASH_DPT = 1 << 1,
21− XT_HASHLIMIT_HASH_SIP = 1 << 2,
22− XT_HASHLIMIT_HASH_SPT = 1 << 3,
23− XT_HASHLIMIT_INVERT = 1 << 4,
24− XT_HASHLIMIT_BYTES = 1 << 5,
25−};
26−#ifdef __KERNEL__
276 #define XT_HASHLIMIT_ALL (XT_HASHLIMIT_HASH_DIP | XT_HASHLIMIT_HASH_DPT | \
287 XT_HASHLIMIT_HASH_SIP | XT_HASHLIMIT_HASH_SPT | \
298 XT_HASHLIMIT_INVERT | XT_HASHLIMIT_BYTES)
30−#endif
31−
32−struct hashlimit_cfg {
33− __u32 mode; /* bitmask of XT_HASHLIMIT_HASH_* */
34− __u32 avg; /* Average secs between packets * scale */
35− __u32 burst; /* Period multiplier for upper limit. */
36−
37− /* user specified */
38− __u32 size; /* how many buckets */
39− __u32 max; /* max number of entries */
40− __u32 gc_interval; /* gc interval */
41− __u32 expire; /* when do entries expire? */
42−};
43−
44−struct xt_hashlimit_info {
45− char name [IFNAMSIZ]; /* name */
46− struct hashlimit_cfg cfg;
47−
48− /* Used internally by the kernel */
49− struct xt_hashlimit_htable *hinfo;
50− union {
51− void *ptr;
52− struct xt_hashlimit_info *master;
53− } u;
54−};
55−
56−struct hashlimit_cfg1 {
57− __u32 mode; /* bitmask of XT_HASHLIMIT_HASH_* */
58− __u32 avg; /* Average secs between packets * scale */
59− __u32 burst; /* Period multiplier for upper limit. */
60−
61− /* user specified */
62− __u32 size; /* how many buckets */
63− __u32 max; /* max number of entries */
64− __u32 gc_interval; /* gc interval */
65− __u32 expire; /* when do entries expire? */
66−
67− __u8 srcmask, dstmask;
68−};
69−
70−struct xt_hashlimit_mtinfo1 {
71− char name[IFNAMSIZ];
72− struct hashlimit_cfg1 cfg;
73−
74− /* Used internally by the kernel */
75− struct xt_hashlimit_htable *hinfo __attribute__((aligned(8)));
76−};
77−
789 #endif /*_XT_HASHLIMIT_H*/
include/linux/netfilter/xt_helper.h+0−8
@@ -1,8 +0,0 @@
1−#ifndef _XT_HELPER_H
2−#define _XT_HELPER_H
3−
4−struct xt_helper_info {
5− int invert;
6− char name[30];
7−};
8−#endif /* _XT_HELPER_H */
include/linux/netfilter/xt_iprange.h+0−20
@@ -1,20 +0,0 @@
1−#ifndef _LINUX_NETFILTER_XT_IPRANGE_H
2−#define _LINUX_NETFILTER_XT_IPRANGE_H 1
3−
4−#include <linux/types.h>
5−#include <linux/netfilter.h>
6−
7−enum {
8− IPRANGE_SRC = 1 << 0, /* match source IP address */
9− IPRANGE_DST = 1 << 1, /* match destination IP address */
10− IPRANGE_SRC_INV = 1 << 4, /* negate the condition */
11− IPRANGE_DST_INV = 1 << 5, /* -"- */
12−};
13−
14−struct xt_iprange_mtinfo {
15− union nf_inet_addr src_min, src_max;
16− union nf_inet_addr dst_min, dst_max;
17− __u8 flags;
18−};
19−
20−#endif /* _LINUX_NETFILTER_XT_IPRANGE_H */
include/linux/netfilter/xt_ipvs.h+0−29
@@ -1,29 +0,0 @@
1−#ifndef _XT_IPVS_H
2−#define _XT_IPVS_H
3−
4−#include <linux/types.h>
5−
6−enum {
7− XT_IPVS_IPVS_PROPERTY = 1 << 0, /* all other options imply this one */
8− XT_IPVS_PROTO = 1 << 1,
9− XT_IPVS_VADDR = 1 << 2,
10− XT_IPVS_VPORT = 1 << 3,
11− XT_IPVS_DIR = 1 << 4,
12− XT_IPVS_METHOD = 1 << 5,
13− XT_IPVS_VPORTCTL = 1 << 6,
14− XT_IPVS_MASK = (1 << 7) - 1,
15− XT_IPVS_ONCE_MASK = XT_IPVS_MASK & ~XT_IPVS_IPVS_PROPERTY
16−};
17−
18−struct xt_ipvs_mtinfo {
19− union nf_inet_addr vaddr, vmask;
20− __be16 vport;
21− __u8 l4proto;
22− __u8 fwd_method;
23− __be16 vportctl;
24−
25− __u8 invert;
26− __u8 bitmask;
27−};
28−
29−#endif /* _XT_IPVS_H */
include/linux/netfilter/xt_length.h+0−11
@@ -1,11 +0,0 @@
1−#ifndef _XT_LENGTH_H
2−#define _XT_LENGTH_H
3−
4−#include <linux/types.h>
5−
6−struct xt_length_info {
7− __u16 min, max;
8− __u8 invert;
9−};
10−
11−#endif /*_XT_LENGTH_H*/
include/linux/netfilter/xt_limit.h+0−24
@@ -1,24 +0,0 @@
1−#ifndef _XT_RATE_H
2−#define _XT_RATE_H
3−
4−#include <linux/types.h>
5−
6−/* timings are in milliseconds. */
7−#define XT_LIMIT_SCALE 10000
8−
9−struct xt_limit_priv;
10−
11−/* 1/10,000 sec period => max of 10,000/sec. Min rate is then 429490
12− seconds, or one every 59 hours. */
13−struct xt_rateinfo {
14− __u32 avg; /* Average secs between packets * scale */
15− __u32 burst; /* Period multiplier for upper limit. */
16−
17− /* Used internally by the kernel */
18− unsigned long prev; /* moved to xt_limit_priv */
19− __u32 credit; /* moved to xt_limit_priv */
20− __u32 credit_cap, cost;
21−
22− struct xt_limit_priv *master;
23−};
24−#endif /*_XT_RATE_H*/
include/linux/netfilter/xt_mac.h+0−8
@@ -1,8 +0,0 @@
1−#ifndef _XT_MAC_H
2−#define _XT_MAC_H
3−
4−struct xt_mac_info {
5− unsigned char srcaddr[ETH_ALEN];
6− int invert;
7−};
8−#endif /*_XT_MAC_H*/
include/linux/netfilter/xt_mark.h+0−15
@@ -1,15 +0,0 @@
1−#ifndef _XT_MARK_H
2−#define _XT_MARK_H
3−
4−#include <linux/types.h>
5−
6−struct xt_mark_tginfo2 {
7− __u32 mark, mask;
8−};
9−
10−struct xt_mark_mtinfo1 {
11− __u32 mark, mask;
12− __u8 invert;
13−};
14−
15−#endif /*_XT_MARK_H*/
include/linux/netfilter/xt_multiport.h+0−29
@@ -1,29 +0,0 @@
1−#ifndef _XT_MULTIPORT_H
2−#define _XT_MULTIPORT_H
3−
4−#include <linux/types.h>
5−
6−enum xt_multiport_flags {
7− XT_MULTIPORT_SOURCE,
8− XT_MULTIPORT_DESTINATION,
9− XT_MULTIPORT_EITHER
10−};
11−
12−#define XT_MULTI_PORTS 15
13−
14−/* Must fit inside union xt_matchinfo: 16 bytes */
15−struct xt_multiport {
16− __u8 flags; /* Type of comparison */
17− __u8 count; /* Number of ports */
18− __u16 ports[XT_MULTI_PORTS]; /* Ports */
19−};
20−
21−struct xt_multiport_v1 {
22− __u8 flags; /* Type of comparison */
23− __u8 count; /* Number of ports */
24− __u16 ports[XT_MULTI_PORTS]; /* Ports */
25− __u8 pflags[XT_MULTI_PORTS]; /* Port flags */
26− __u8 invert; /* Invert flag */
27−};
28−
29−#endif /*_XT_MULTIPORT_H*/
include/linux/netfilter/xt_nfacct.h+0−13
@@ -1,13 +0,0 @@
1−#ifndef _XT_NFACCT_MATCH_H
2−#define _XT_NFACCT_MATCH_H
3−
4−#include <linux/netfilter/nfnetlink_acct.h>
5−
6−struct nf_acct;
7−
8−struct xt_nfacct_match_info {
9− char name[NFACCT_NAME_MAX];
10− struct nf_acct *nfacct;
11−};
12−
13−#endif /* _XT_NFACCT_MATCH_H */
include/linux/netfilter/xt_osf.h+0−135
@@ -1,135 +0,0 @@
1−/*
2− * Copyright (c) 2003+ Evgeniy Polyakov <johnpol@2ka.mxt.ru>
3− *
4− *
5− * This program is free software; you can redistribute it and/or modify
6− * it under the terms of the GNU General Public License as published by
7− * the Free Software Foundation; either version 2 of the License, or
8− * (at your option) any later version.
9− *
10− * This program is distributed in the hope that it will be useful,
11− * but WITHOUT ANY WARRANTY; without even the implied warranty of
12− * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13− * GNU General Public License for more details.
14− *
15− * You should have received a copy of the GNU General Public License
16− * along with this program; if not, write to the Free Software
17− * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
18− */
19−
20−#ifndef _XT_OSF_H
21−#define _XT_OSF_H
22−
23−#include <linux/types.h>
24−
25−#define MAXGENRELEN 32
26−
27−#define XT_OSF_GENRE (1<<0)
28−#define XT_OSF_TTL (1<<1)
29−#define XT_OSF_LOG (1<<2)
30−#define XT_OSF_INVERT (1<<3)
31−
32−#define XT_OSF_LOGLEVEL_ALL 0 /* log all matched fingerprints */
33−#define XT_OSF_LOGLEVEL_FIRST 1 /* log only the first matced fingerprint */
34−#define XT_OSF_LOGLEVEL_ALL_KNOWN 2 /* do not log unknown packets */
35−
36−#define XT_OSF_TTL_TRUE 0 /* True ip and fingerprint TTL comparison */
37−#define XT_OSF_TTL_LESS 1 /* Check if ip TTL is less than fingerprint one */
38−#define XT_OSF_TTL_NOCHECK 2 /* Do not compare ip and fingerprint TTL at all */
39−
40−struct xt_osf_info {
41− char genre[MAXGENRELEN];
42− __u32 len;
43− __u32 flags;
44− __u32 loglevel;
45− __u32 ttl;
46−};
47−
48−/*
49− * Wildcard MSS (kind of).
50− * It is used to implement a state machine for the different wildcard values
51− * of the MSS and window sizes.
52− */
53−struct xt_osf_wc {
54− __u32 wc;
55− __u32 val;
56−};
57−
58−/*
59− * This struct represents IANA options
60− * http://www.iana.org/assignments/tcp-parameters
61− */
62−struct xt_osf_opt {
63− __u16 kind, length;
64− struct xt_osf_wc wc;
65−};
66−
67−struct xt_osf_user_finger {
68− struct xt_osf_wc wss;
69−
70− __u8 ttl, df;
71− __u16 ss, mss;
72− __u16 opt_num;
73−
74− char genre[MAXGENRELEN];
75− char version[MAXGENRELEN];
76− char subtype[MAXGENRELEN];
77−
78− /* MAX_IPOPTLEN is maximum if all options are NOPs or EOLs */
79− struct xt_osf_opt opt[MAX_IPOPTLEN];
80−};
81−
82−struct xt_osf_nlmsg {
83− struct xt_osf_user_finger f;
84− struct iphdr ip;
85− struct tcphdr tcp;
86−};
87−
88−/* Defines for IANA option kinds */
89−
90−enum iana_options {
91− OSFOPT_EOL = 0, /* End of options */
92− OSFOPT_NOP, /* NOP */
93− OSFOPT_MSS, /* Maximum segment size */
94− OSFOPT_WSO, /* Window scale option */
95− OSFOPT_SACKP, /* SACK permitted */
96− OSFOPT_SACK, /* SACK */
97− OSFOPT_ECHO,
98− OSFOPT_ECHOREPLY,
99− OSFOPT_TS, /* Timestamp option */
100− OSFOPT_POCP, /* Partial Order Connection Permitted */
101− OSFOPT_POSP, /* Partial Order Service Profile */
102−
103− /* Others are not used in the current OSF */
104− OSFOPT_EMPTY = 255,
105−};
106−
107−/*
108− * Initial window size option state machine: multiple of mss, mtu or
109− * plain numeric value. Can also be made as plain numeric value which
110− * is not a multiple of specified value.
111− */
112−enum xt_osf_window_size_options {
113− OSF_WSS_PLAIN = 0,
114− OSF_WSS_MSS,
115− OSF_WSS_MTU,
116− OSF_WSS_MODULO,
117− OSF_WSS_MAX,
118−};
119−
120−/*
121− * Add/remove fingerprint from the kernel.
122− */
123−enum xt_osf_msg_types {
124− OSF_MSG_ADD,
125− OSF_MSG_REMOVE,
126− OSF_MSG_MAX,
127−};
128−
129−enum xt_osf_attr_type {
130− OSF_ATTR_UNSPEC,
131− OSF_ATTR_FINGER,
132− OSF_ATTR_MAX,
133−};
134−
135−#endif /* _XT_OSF_H */
include/linux/netfilter/xt_owner.h+0−18
@@ -1,18 +0,0 @@
1−#ifndef _XT_OWNER_MATCH_H
2−#define _XT_OWNER_MATCH_H
3−
4−#include <linux/types.h>
5−
6−enum {
7− XT_OWNER_UID = 1 << 0,
8− XT_OWNER_GID = 1 << 1,
9− XT_OWNER_SOCKET = 1 << 2,
10−};
11−
12−struct xt_owner_match_info {
13− __u32 uid_min, uid_max;
14− __u32 gid_min, gid_max;
15− __u8 match, invert;
16−};
17−
18−#endif /* _XT_OWNER_MATCH_H */
include/linux/netfilter/xt_physdev.h+1−20
@@ -1,26 +1,7 @@
11 #ifndef _XT_PHYSDEV_H
22 #define _XT_PHYSDEV_H
33
4−#include <linux/types.h>
5−
6−#ifdef __KERNEL__
74 #include <linux/if.h>
8−#endif
9−
10−#define XT_PHYSDEV_OP_IN 0x01
11−#define XT_PHYSDEV_OP_OUT 0x02
12−#define XT_PHYSDEV_OP_BRIDGED 0x04
13−#define XT_PHYSDEV_OP_ISIN 0x08
14−#define XT_PHYSDEV_OP_ISOUT 0x10
15−#define XT_PHYSDEV_OP_MASK (0x20 - 1)
16−
17−struct xt_physdev_info {
18− char physindev[IFNAMSIZ];
19− char in_mask[IFNAMSIZ];
20− char physoutdev[IFNAMSIZ];
21− char out_mask[IFNAMSIZ];
22− __u8 invert;
23− __u8 bitmask;
24−};
5+#include <uapi/linux/netfilter/xt_physdev.h>
256
267 #endif /*_XT_PHYSDEV_H*/
include/linux/netfilter/xt_pkttype.h+0−8
@@ -1,8 +0,0 @@
1−#ifndef _XT_PKTTYPE_H
2−#define _XT_PKTTYPE_H
3−
4−struct xt_pkttype_info {
5− int pkttype;
6− int invert;
7−};
8−#endif /*_XT_PKTTYPE_H*/
include/linux/netfilter/xt_policy.h+0−69
@@ -1,69 +0,0 @@
1−#ifndef _XT_POLICY_H
2−#define _XT_POLICY_H
3−
4−#include <linux/types.h>
5−
6−#define XT_POLICY_MAX_ELEM 4
7−
8−enum xt_policy_flags {
9− XT_POLICY_MATCH_IN = 0x1,
10− XT_POLICY_MATCH_OUT = 0x2,
11− XT_POLICY_MATCH_NONE = 0x4,
12− XT_POLICY_MATCH_STRICT = 0x8,
13−};
14−
15−enum xt_policy_modes {
16− XT_POLICY_MODE_TRANSPORT,
17− XT_POLICY_MODE_TUNNEL
18−};
19−
20−struct xt_policy_spec {
21− __u8 saddr:1,
22− daddr:1,
23− proto:1,
24− mode:1,
25− spi:1,
26− reqid:1;
27−};
28−
29−#ifndef __KERNEL__
30−union xt_policy_addr {
31− struct in_addr a4;
32− struct in6_addr a6;
33−};
34−#endif
35−
36−struct xt_policy_elem {
37− union {
38−#ifdef __KERNEL__
39− struct {
40− union nf_inet_addr saddr;
41− union nf_inet_addr smask;
42− union nf_inet_addr daddr;
43− union nf_inet_addr dmask;
44− };
45−#else
46− struct {
47− union xt_policy_addr saddr;
48− union xt_policy_addr smask;
49− union xt_policy_addr daddr;
50− union xt_policy_addr dmask;
51− };
52−#endif
53− };
54− __be32 spi;
55− __u32 reqid;
56− __u8 proto;
57− __u8 mode;
58−
59− struct xt_policy_spec match;
60− struct xt_policy_spec invert;
61−};
62−
63−struct xt_policy_info {
64− struct xt_policy_elem pol[XT_POLICY_MAX_ELEM];
65− __u16 flags;
66− __u16 len;
67−};
68−
69−#endif /* _XT_POLICY_H */
include/linux/netfilter/xt_quota.h+0−22
@@ -1,22 +0,0 @@
1−#ifndef _XT_QUOTA_H
2−#define _XT_QUOTA_H
3−
4−#include <linux/types.h>
5−
6−enum xt_quota_flags {
7− XT_QUOTA_INVERT = 0x1,
8−};
9−#define XT_QUOTA_MASK 0x1
10−
11−struct xt_quota_priv;
12−
13−struct xt_quota_info {
14− __u32 flags;
15− __u32 pad;
16− __aligned_u64 quota;
17−
18− /* Used internally by the kernel */
19− struct xt_quota_priv *master;
20−};
21−
22−#endif /* _XT_QUOTA_H */
include/linux/netfilter/xt_rateest.h+0−37
@@ -1,37 +0,0 @@
1−#ifndef _XT_RATEEST_MATCH_H
2−#define _XT_RATEEST_MATCH_H
3−
4−#include <linux/types.h>
5−
6−enum xt_rateest_match_flags {
7− XT_RATEEST_MATCH_INVERT = 1<<0,
8− XT_RATEEST_MATCH_ABS = 1<<1,
9− XT_RATEEST_MATCH_REL = 1<<2,
10− XT_RATEEST_MATCH_DELTA = 1<<3,
11− XT_RATEEST_MATCH_BPS = 1<<4,
12− XT_RATEEST_MATCH_PPS = 1<<5,
13−};
14−
15−enum xt_rateest_match_mode {
16− XT_RATEEST_MATCH_NONE,
17− XT_RATEEST_MATCH_EQ,
18− XT_RATEEST_MATCH_LT,
19− XT_RATEEST_MATCH_GT,
20−};
21−
22−struct xt_rateest_match_info {
23− char name1[IFNAMSIZ];
24− char name2[IFNAMSIZ];
25− __u16 flags;
26− __u16 mode;
27− __u32 bps1;
28− __u32 pps1;
29− __u32 bps2;
30− __u32 pps2;
31−
32− /* Used internally by the kernel */
33− struct xt_rateest *est1 __attribute__((aligned(8)));
34− struct xt_rateest *est2 __attribute__((aligned(8)));
35−};
36−
37−#endif /* _XT_RATEEST_MATCH_H */
include/linux/netfilter/xt_realm.h+0−12
@@ -1,12 +0,0 @@
1−#ifndef _XT_REALM_H
2−#define _XT_REALM_H
3−
4−#include <linux/types.h>
5−
6−struct xt_realm_info {
7− __u32 id;
8− __u32 mask;
9− __u8 invert;
10−};
11−
12−#endif /* _XT_REALM_H */
include/linux/netfilter/xt_recent.h+0−45
@@ -1,45 +0,0 @@
1−#ifndef _LINUX_NETFILTER_XT_RECENT_H
2−#define _LINUX_NETFILTER_XT_RECENT_H 1
3−
4−#include <linux/types.h>
5−
6−enum {
7− XT_RECENT_CHECK = 1 << 0,
8− XT_RECENT_SET = 1 << 1,
9− XT_RECENT_UPDATE = 1 << 2,
10− XT_RECENT_REMOVE = 1 << 3,
11− XT_RECENT_TTL = 1 << 4,
12− XT_RECENT_REAP = 1 << 5,
13−
14− XT_RECENT_SOURCE = 0,
15− XT_RECENT_DEST = 1,
16−
17− XT_RECENT_NAME_LEN = 200,
18−};
19−
20−/* Only allowed with --rcheck and --update */
21−#define XT_RECENT_MODIFIERS (XT_RECENT_TTL|XT_RECENT_REAP)
22−
23−#define XT_RECENT_VALID_FLAGS (XT_RECENT_CHECK|XT_RECENT_SET|XT_RECENT_UPDATE|\
24− XT_RECENT_REMOVE|XT_RECENT_TTL|XT_RECENT_REAP)
25−
26−struct xt_recent_mtinfo {
27− __u32 seconds;
28− __u32 hit_count;
29− __u8 check_set;
30− __u8 invert;
31− char name[XT_RECENT_NAME_LEN];
32− __u8 side;
33−};
34−
35−struct xt_recent_mtinfo_v1 {
36− __u32 seconds;
37− __u32 hit_count;
38− __u8 check_set;
39− __u8 invert;
40− char name[XT_RECENT_NAME_LEN];
41− __u8 side;
42− union nf_inet_addr mask;
43−};
44−
45−#endif /* _LINUX_NETFILTER_XT_RECENT_H */
include/linux/netfilter/xt_sctp.h+0−92
@@ -1,92 +0,0 @@
1−#ifndef _XT_SCTP_H_
2−#define _XT_SCTP_H_
3−
4−#include <linux/types.h>
5−
6−#define XT_SCTP_SRC_PORTS 0x01
7−#define XT_SCTP_DEST_PORTS 0x02
8−#define XT_SCTP_CHUNK_TYPES 0x04
9−
10−#define XT_SCTP_VALID_FLAGS 0x07
11−
12−struct xt_sctp_flag_info {
13− __u8 chunktype;
14− __u8 flag;
15− __u8 flag_mask;
16−};
17−
18−#define XT_NUM_SCTP_FLAGS 4
19−
20−struct xt_sctp_info {
21− __u16 dpts[2]; /* Min, Max */
22− __u16 spts[2]; /* Min, Max */
23−
24− __u32 chunkmap[256 / sizeof (__u32)]; /* Bit mask of chunks to be matched according to RFC 2960 */
25−
26−#define SCTP_CHUNK_MATCH_ANY 0x01 /* Match if any of the chunk types are present */
27−#define SCTP_CHUNK_MATCH_ALL 0x02 /* Match if all of the chunk types are present */
28−#define SCTP_CHUNK_MATCH_ONLY 0x04 /* Match if these are the only chunk types present */
29−
30− __u32 chunk_match_type;
31− struct xt_sctp_flag_info flag_info[XT_NUM_SCTP_FLAGS];
32− int flag_count;
33−
34− __u32 flags;
35− __u32 invflags;
36−};
37−
38−#define bytes(type) (sizeof(type) * 8)
39−
40−#define SCTP_CHUNKMAP_SET(chunkmap, type) \
41− do { \
42− (chunkmap)[type / bytes(__u32)] |= \
43− 1 << (type % bytes(__u32)); \
44− } while (0)
45−
46−#define SCTP_CHUNKMAP_CLEAR(chunkmap, type) \
47− do { \
48− (chunkmap)[type / bytes(__u32)] &= \
49− ~(1 << (type % bytes(__u32))); \
50− } while (0)
51−
52−#define SCTP_CHUNKMAP_IS_SET(chunkmap, type) \
53−({ \
54− ((chunkmap)[type / bytes (__u32)] & \
55− (1 << (type % bytes (__u32)))) ? 1: 0; \
56−})
57−
58−#define SCTP_CHUNKMAP_RESET(chunkmap) \
59− memset((chunkmap), 0, sizeof(chunkmap))
60−
61−#define SCTP_CHUNKMAP_SET_ALL(chunkmap) \
62− memset((chunkmap), ~0U, sizeof(chunkmap))
63−
64−#define SCTP_CHUNKMAP_COPY(destmap, srcmap) \
65− memcpy((destmap), (srcmap), sizeof(srcmap))
66−
67−#define SCTP_CHUNKMAP_IS_CLEAR(chunkmap) \
68− __sctp_chunkmap_is_clear((chunkmap), ARRAY_SIZE(chunkmap))
69−static inline bool
70−__sctp_chunkmap_is_clear(const __u32 *chunkmap, unsigned int n)
71−{
72− unsigned int i;
73− for (i = 0; i < n; ++i)
74− if (chunkmap[i])
75− return false;
76− return true;
77−}
78−
79−#define SCTP_CHUNKMAP_IS_ALL_SET(chunkmap) \
80− __sctp_chunkmap_is_all_set((chunkmap), ARRAY_SIZE(chunkmap))
81−static inline bool
82−__sctp_chunkmap_is_all_set(const __u32 *chunkmap, unsigned int n)
83−{
84− unsigned int i;
85− for (i = 0; i < n; ++i)
86− if (chunkmap[i] != ~0U)
87− return false;
88− return true;
89−}
90−
91−#endif /* _XT_SCTP_H_ */
92−
include/linux/netfilter/xt_set.h+0−65
@@ -1,65 +0,0 @@
1−#ifndef _XT_SET_H
2−#define _XT_SET_H
3−
4−#include <linux/types.h>
5−#include <linux/netfilter/ipset/ip_set.h>
6−
7−/* Revision 0 interface: backward compatible with netfilter/iptables */
8−
9−/*
10− * Option flags for kernel operations (xt_set_info_v0)
11− */
12−#define IPSET_SRC 0x01 /* Source match/add */
13−#define IPSET_DST 0x02 /* Destination match/add */
14−#define IPSET_MATCH_INV 0x04 /* Inverse matching */
15−
16−struct xt_set_info_v0 {
17− ip_set_id_t index;
18− union {
19− __u32 flags[IPSET_DIM_MAX + 1];
20− struct {
21− __u32 __flags[IPSET_DIM_MAX];
22− __u8 dim;
23− __u8 flags;
24− } compat;
25− } u;
26−};
27−
28−/* match and target infos */
29−struct xt_set_info_match_v0 {
30− struct xt_set_info_v0 match_set;
31−};
32−
33−struct xt_set_info_target_v0 {
34− struct xt_set_info_v0 add_set;
35− struct xt_set_info_v0 del_set;
36−};
37−
38−/* Revision 1 match and target */
39−
40−struct xt_set_info {
41− ip_set_id_t index;
42− __u8 dim;
43− __u8 flags;
44−};
45−
46−/* match and target infos */
47−struct xt_set_info_match_v1 {
48− struct xt_set_info match_set;
49−};
50−
51−struct xt_set_info_target_v1 {
52− struct xt_set_info add_set;
53− struct xt_set_info del_set;
54−};
55−
56−/* Revision 2 target */
57−
58−struct xt_set_info_target_v2 {
59− struct xt_set_info add_set;
60− struct xt_set_info del_set;
61− __u32 flags;
62− __u32 timeout;
63−};
64−
65−#endif /*_XT_SET_H*/
include/linux/netfilter/xt_socket.h+0−14
@@ -1,14 +0,0 @@
1−#ifndef _XT_SOCKET_H
2−#define _XT_SOCKET_H
3−
4−#include <linux/types.h>
5−
6−enum {
7− XT_SOCKET_TRANSPARENT = 1 << 0,
8−};
9−
10−struct xt_socket_mtinfo1 {
11− __u8 flags;
12−};
13−
14−#endif /* _XT_SOCKET_H */
include/linux/netfilter/xt_state.h+0−12
@@ -1,12 +0,0 @@
1−#ifndef _XT_STATE_H
2−#define _XT_STATE_H
3−
4−#define XT_STATE_BIT(ctinfo) (1 << ((ctinfo)%IP_CT_IS_REPLY+1))
5−#define XT_STATE_INVALID (1 << 0)
6−
7−#define XT_STATE_UNTRACKED (1 << (IP_CT_NUMBER + 1))
8−
9−struct xt_state_info {
10− unsigned int statemask;
11−};
12−#endif /*_XT_STATE_H*/
include/linux/netfilter/xt_statistic.h+0−36
@@ -1,36 +0,0 @@
1−#ifndef _XT_STATISTIC_H
2−#define _XT_STATISTIC_H
3−
4−#include <linux/types.h>
5−
6−enum xt_statistic_mode {
7− XT_STATISTIC_MODE_RANDOM,
8− XT_STATISTIC_MODE_NTH,
9− __XT_STATISTIC_MODE_MAX
10−};
11−#define XT_STATISTIC_MODE_MAX (__XT_STATISTIC_MODE_MAX - 1)
12−
13−enum xt_statistic_flags {
14− XT_STATISTIC_INVERT = 0x1,
15−};
16−#define XT_STATISTIC_MASK 0x1
17−
18−struct xt_statistic_priv;
19−
20−struct xt_statistic_info {
21− __u16 mode;
22− __u16 flags;
23− union {
24− struct {
25− __u32 probability;
26− } random;
27− struct {
28− __u32 every;
29− __u32 packet;
30− __u32 count; /* unused */
31− } nth;
32− } u;
33− struct xt_statistic_priv *master __attribute__((aligned(8)));
34−};
35−
36−#endif /* _XT_STATISTIC_H */
include/linux/netfilter/xt_string.h+0−34
@@ -1,34 +0,0 @@
1−#ifndef _XT_STRING_H
2−#define _XT_STRING_H
3−
4−#include <linux/types.h>
5−
6−#define XT_STRING_MAX_PATTERN_SIZE 128
7−#define XT_STRING_MAX_ALGO_NAME_SIZE 16
8−
9−enum {
10− XT_STRING_FLAG_INVERT = 0x01,
11− XT_STRING_FLAG_IGNORECASE = 0x02
12−};
13−
14−struct xt_string_info {
15− __u16 from_offset;
16− __u16 to_offset;
17− char algo[XT_STRING_MAX_ALGO_NAME_SIZE];
18− char pattern[XT_STRING_MAX_PATTERN_SIZE];
19− __u8 patlen;
20− union {
21− struct {
22− __u8 invert;
23− } v0;
24−
25− struct {
26− __u8 flags;
27− } v1;
28− } u;
29−
30− /* Used internally by the kernel */
31− struct ts_config __attribute__((aligned(8))) *config;
32−};
33−
34−#endif /*_XT_STRING_H*/
include/linux/netfilter/xt_tcpmss.h+0−11
@@ -1,11 +0,0 @@
1−#ifndef _XT_TCPMSS_MATCH_H
2−#define _XT_TCPMSS_MATCH_H
3−
4−#include <linux/types.h>
5−
6−struct xt_tcpmss_match_info {
7− __u16 mss_min, mss_max;
8− __u8 invert;
9−};
10−
11−#endif /*_XT_TCPMSS_MATCH_H*/
include/linux/netfilter/xt_tcpudp.h+0−36
@@ -1,36 +0,0 @@
1−#ifndef _XT_TCPUDP_H
2−#define _XT_TCPUDP_H
3−
4−#include <linux/types.h>
5−
6−/* TCP matching stuff */
7−struct xt_tcp {
8− __u16 spts[2]; /* Source port range. */
9− __u16 dpts[2]; /* Destination port range. */
10− __u8 option; /* TCP Option iff non-zero*/
11− __u8 flg_mask; /* TCP flags mask byte */
12− __u8 flg_cmp; /* TCP flags compare byte */
13− __u8 invflags; /* Inverse flags */
14−};
15−
16−/* Values for "inv" field in struct ipt_tcp. */
17−#define XT_TCP_INV_SRCPT 0x01 /* Invert the sense of source ports. */
18−#define XT_TCP_INV_DSTPT 0x02 /* Invert the sense of dest ports. */
19−#define XT_TCP_INV_FLAGS 0x04 /* Invert the sense of TCP flags. */
20−#define XT_TCP_INV_OPTION 0x08 /* Invert the sense of option test. */
21−#define XT_TCP_INV_MASK 0x0F /* All possible flags. */
22−
23−/* UDP matching stuff */
24−struct xt_udp {
25− __u16 spts[2]; /* Source port range. */
26− __u16 dpts[2]; /* Destination port range. */
27− __u8 invflags; /* Inverse flags */
28−};
29−
30−/* Values for "invflags" field in struct ipt_udp. */
31−#define XT_UDP_INV_SRCPT 0x01 /* Invert the sense of source ports. */
32−#define XT_UDP_INV_DSTPT 0x02 /* Invert the sense of dest ports. */
33−#define XT_UDP_INV_MASK 0x03 /* All possible flags. */
34−
35−
36−#endif
include/linux/netfilter/xt_time.h+0−32
@@ -1,32 +0,0 @@
1−#ifndef _XT_TIME_H
2−#define _XT_TIME_H 1
3−
4−#include <linux/types.h>
5−
6−struct xt_time_info {
7− __u32 date_start;
8− __u32 date_stop;
9− __u32 daytime_start;
10− __u32 daytime_stop;
11− __u32 monthdays_match;
12− __u8 weekdays_match;
13− __u8 flags;
14−};
15−
16−enum {
17− /* Match against local time (instead of UTC) */
18− XT_TIME_LOCAL_TZ = 1 << 0,
19−
20− /* treat timestart > timestop (e.g. 23:00-01:00) as single period */
21− XT_TIME_CONTIGUOUS = 1 << 1,
22−
23− /* Shortcuts */
24− XT_TIME_ALL_MONTHDAYS = 0xFFFFFFFE,
25− XT_TIME_ALL_WEEKDAYS = 0xFE,
26− XT_TIME_MIN_DAYTIME = 0,
27− XT_TIME_MAX_DAYTIME = 24 * 60 * 60 - 1,
28−};
29−
30−#define XT_TIME_ALL_FLAGS (XT_TIME_LOCAL_TZ|XT_TIME_CONTIGUOUS)
31−
32−#endif /* _XT_TIME_H */
include/linux/netfilter/xt_u32.h+0−42
@@ -1,42 +0,0 @@
1−#ifndef _XT_U32_H
2−#define _XT_U32_H 1
3−
4−#include <linux/types.h>
5−
6−enum xt_u32_ops {
7− XT_U32_AND,
8− XT_U32_LEFTSH,
9− XT_U32_RIGHTSH,
10− XT_U32_AT,
11−};
12−
13−struct xt_u32_location_element {
14− __u32 number;
15− __u8 nextop;
16−};
17−
18−struct xt_u32_value_element {
19− __u32 min;
20− __u32 max;
21−};
22−
23−/*
24− * Any way to allow for an arbitrary number of elements?
25− * For now, I settle with a limit of 10 each.
26− */
27−#define XT_U32_MAXSIZE 10
28−
29−struct xt_u32_test {
30− struct xt_u32_location_element location[XT_U32_MAXSIZE+1];
31− struct xt_u32_value_element value[XT_U32_MAXSIZE+1];
32− __u8 nnums;
33− __u8 nvalues;
34−};
35−
36−struct xt_u32 {
37− struct xt_u32_test tests[XT_U32_MAXSIZE+1];
38− __u8 ntests;
39− __u8 invert;
40−};
41−
42−#endif /* _XT_U32_H */

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t