]>
git.proxmox.com Git - mirror_ubuntu-zesty-kernel.git/blob - include/linux/netfilter_bridge/ebtables.h
5 * Bart De Schuymer <bdschuym@pandora.be>
7 * ebtables.c,v 2.0, April, 2002
9 * This code is stongly inspired on the iptables code which is
10 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
13 #ifndef __LINUX_BRIDGE_EFF_H
14 #define __LINUX_BRIDGE_EFF_H
16 #include <linux/netfilter_bridge.h>
17 #include <linux/if_ether.h>
19 #define EBT_TABLE_MAXNAMELEN 32
20 #define EBT_CHAIN_MAXNAMELEN EBT_TABLE_MAXNAMELEN
21 #define EBT_FUNCTION_MAXNAMELEN EBT_TABLE_MAXNAMELEN
23 /* verdicts >0 are "branches" */
26 #define EBT_CONTINUE -3
28 #define NUM_STANDARD_TARGETS 4
29 /* ebtables target modules store the verdict inside an int. We can
30 * reclaim a part of this int for backwards compatible extensions.
31 * The 4 lsb are more than enough to store the verdict. */
32 #define EBT_VERDICT_BITS 0x0000000F
43 char name
[EBT_TABLE_MAXNAMELEN
];
44 unsigned int valid_hooks
;
45 /* nr of rules in the table */
46 unsigned int nentries
;
47 /* total size of the entries */
48 unsigned int entries_size
;
49 /* start of the chains */
50 struct ebt_entries __user
*hook_entry
[NF_BR_NUMHOOKS
];
51 /* nr of counters userspace expects back */
52 unsigned int num_counters
;
53 /* where the kernel will put the old counters */
54 struct ebt_counter __user
*counters
;
58 struct ebt_replace_kernel
{
59 char name
[EBT_TABLE_MAXNAMELEN
];
60 unsigned int valid_hooks
;
61 /* nr of rules in the table */
62 unsigned int nentries
;
63 /* total size of the entries */
64 unsigned int entries_size
;
65 /* start of the chains */
66 struct ebt_entries
*hook_entry
[NF_BR_NUMHOOKS
];
67 /* nr of counters userspace expects back */
68 unsigned int num_counters
;
69 /* where the kernel will put the old counters */
70 struct ebt_counter
*counters
;
75 /* this field is always set to zero
76 * See EBT_ENTRY_OR_ENTRIES.
77 * Must be same size as ebt_entry.bitmask */
78 unsigned int distinguisher
;
80 char name
[EBT_CHAIN_MAXNAMELEN
];
81 /* counter offset for this chain */
82 unsigned int counter_offset
;
83 /* one standard (accept, drop, return) per hook */
86 unsigned int nentries
;
88 char data
[0] __attribute__ ((aligned (__alignof__(struct ebt_replace
))));
91 /* used for the bitmask of struct ebt_entry */
93 /* This is a hack to make a difference between an ebt_entry struct and an
94 * ebt_entries struct when traversing the entries from start to end.
95 * Using this simplifies the code a lot, while still being able to use
97 * Contrary, iptables doesn't use something like ebt_entries and therefore uses
98 * different techniques for naming the policy and such. So, iptables doesn't
99 * need a hack like this.
101 #define EBT_ENTRY_OR_ENTRIES 0x01
102 /* these are the normal masks */
103 #define EBT_NOPROTO 0x02
104 #define EBT_802_3 0x04
105 #define EBT_SOURCEMAC 0x08
106 #define EBT_DESTMAC 0x10
107 #define EBT_F_MASK (EBT_NOPROTO | EBT_802_3 | EBT_SOURCEMAC | EBT_DESTMAC \
108 | EBT_ENTRY_OR_ENTRIES)
110 #define EBT_IPROTO 0x01
112 #define EBT_IOUT 0x04
113 #define EBT_ISOURCE 0x8
114 #define EBT_IDEST 0x10
115 #define EBT_ILOGICALIN 0x20
116 #define EBT_ILOGICALOUT 0x40
117 #define EBT_INV_MASK (EBT_IPROTO | EBT_IIN | EBT_IOUT | EBT_ILOGICALIN \
118 | EBT_ILOGICALOUT | EBT_ISOURCE | EBT_IDEST)
120 struct ebt_entry_match
{
122 char name
[EBT_FUNCTION_MAXNAMELEN
];
123 struct xt_match
*match
;
126 unsigned int match_size
;
127 unsigned char data
[0] __attribute__ ((aligned (__alignof__(struct ebt_replace
))));
130 struct ebt_entry_watcher
{
132 char name
[EBT_FUNCTION_MAXNAMELEN
];
133 struct xt_target
*watcher
;
136 unsigned int watcher_size
;
137 unsigned char data
[0] __attribute__ ((aligned (__alignof__(struct ebt_replace
))));
140 struct ebt_entry_target
{
142 char name
[EBT_FUNCTION_MAXNAMELEN
];
143 struct xt_target
*target
;
146 unsigned int target_size
;
147 unsigned char data
[0] __attribute__ ((aligned (__alignof__(struct ebt_replace
))));
150 #define EBT_STANDARD_TARGET "standard"
151 struct ebt_standard_target
{
152 struct ebt_entry_target target
;
158 /* this needs to be the first field */
159 unsigned int bitmask
;
160 unsigned int invflags
;
162 /* the physical in-dev */
164 /* the logical in-dev */
165 char logical_in
[IFNAMSIZ
];
166 /* the physical out-dev */
168 /* the logical out-dev */
169 char logical_out
[IFNAMSIZ
];
170 unsigned char sourcemac
[ETH_ALEN
];
171 unsigned char sourcemsk
[ETH_ALEN
];
172 unsigned char destmac
[ETH_ALEN
];
173 unsigned char destmsk
[ETH_ALEN
];
174 /* sizeof ebt_entry + matches */
175 unsigned int watchers_offset
;
176 /* sizeof ebt_entry + matches + watchers */
177 unsigned int target_offset
;
178 /* sizeof ebt_entry + matches + watchers + target */
179 unsigned int next_offset
;
180 unsigned char elems
[0] __attribute__ ((aligned (__alignof__(struct ebt_replace
))));
183 /* {g,s}etsockopt numbers */
184 #define EBT_BASE_CTL 128
186 #define EBT_SO_SET_ENTRIES (EBT_BASE_CTL)
187 #define EBT_SO_SET_COUNTERS (EBT_SO_SET_ENTRIES+1)
188 #define EBT_SO_SET_MAX (EBT_SO_SET_COUNTERS+1)
190 #define EBT_SO_GET_INFO (EBT_BASE_CTL)
191 #define EBT_SO_GET_ENTRIES (EBT_SO_GET_INFO+1)
192 #define EBT_SO_GET_INIT_INFO (EBT_SO_GET_ENTRIES+1)
193 #define EBT_SO_GET_INIT_ENTRIES (EBT_SO_GET_INIT_INFO+1)
194 #define EBT_SO_GET_MAX (EBT_SO_GET_INIT_ENTRIES+1)
198 /* return values for match() functions */
200 #define EBT_NOMATCH 1
203 struct list_head list
;
204 const char name
[EBT_FUNCTION_MAXNAMELEN
];
205 bool (*match
)(const struct sk_buff
*skb
, const struct net_device
*in
,
206 const struct net_device
*out
, const struct xt_match
*match
,
207 const void *matchinfo
, int offset
, unsigned int protoff
,
209 bool (*checkentry
)(const char *table
, const void *entry
,
210 const struct xt_match
*match
, void *matchinfo
,
211 unsigned int hook_mask
);
212 void (*destroy
)(const struct xt_match
*match
, void *matchinfo
);
213 unsigned int matchsize
;
220 struct list_head list
;
221 const char name
[EBT_FUNCTION_MAXNAMELEN
];
222 unsigned int (*target
)(struct sk_buff
*skb
,
223 const struct net_device
*in
, const struct net_device
*out
,
224 unsigned int hook_num
, const struct xt_target
*target
,
225 const void *targinfo
);
226 bool (*checkentry
)(const char *table
, const void *entry
,
227 const struct xt_target
*target
, void *targinfo
,
228 unsigned int hook_mask
);
229 void (*destroy
)(const struct xt_target
*target
, void *targinfo
);
230 unsigned int targetsize
;
237 struct list_head list
;
238 const char name
[EBT_FUNCTION_MAXNAMELEN
];
239 /* returns one of the standard EBT_* verdicts */
240 unsigned int (*target
)(struct sk_buff
*skb
,
241 const struct net_device
*in
, const struct net_device
*out
,
242 unsigned int hook_num
, const struct xt_target
*target
,
243 const void *targinfo
);
244 bool (*checkentry
)(const char *table
, const void *entry
,
245 const struct xt_target
*target
, void *targinfo
,
246 unsigned int hook_mask
);
247 void (*destroy
)(const struct xt_target
*target
, void *targinfo
);
248 unsigned int targetsize
;
254 /* used for jumping from and into user defined chains (udc) */
255 struct ebt_chainstack
{
256 struct ebt_entries
*chaininfo
; /* pointer to chain data */
257 struct ebt_entry
*e
; /* pointer to entry data */
258 unsigned int n
; /* n'th entry */
261 struct ebt_table_info
{
262 /* total size of the entries */
263 unsigned int entries_size
;
264 unsigned int nentries
;
265 /* pointers to the start of the chains */
266 struct ebt_entries
*hook_entry
[NF_BR_NUMHOOKS
];
267 /* room to maintain the stack used for jumping from and into udc */
268 struct ebt_chainstack
**chainstack
;
270 struct ebt_counter counters
[0] ____cacheline_aligned
;
274 struct list_head list
;
275 char name
[EBT_TABLE_MAXNAMELEN
];
276 struct ebt_replace_kernel
*table
;
277 unsigned int valid_hooks
;
279 /* e.g. could be the table explicitly only allows certain
280 * matches, targets, ... 0 == let it in */
281 int (*check
)(const struct ebt_table_info
*info
,
282 unsigned int valid_hooks
);
283 /* the data used by the kernel */
284 struct ebt_table_info
*private;
288 #define EBT_ALIGN(s) (((s) + (__alignof__(struct ebt_replace)-1)) & \
289 ~(__alignof__(struct ebt_replace)-1))
290 extern struct ebt_table
*ebt_register_table(struct net
*net
,
291 const struct ebt_table
*table
);
292 extern void ebt_unregister_table(struct net
*net
, struct ebt_table
*table
);
293 extern unsigned int ebt_do_table(unsigned int hook
, struct sk_buff
*skb
,
294 const struct net_device
*in
, const struct net_device
*out
,
295 struct ebt_table
*table
);
297 /* Used in the kernel match() functions */
298 #define FWINV(bool,invflg) ((bool) ^ !!(info->invflags & invflg))
299 /* True if the hook mask denotes that the rule is in a base chain,
300 * used in the check() functions */
301 #define BASE_CHAIN (par->hook_mask & (1 << NF_BR_NUMHOOKS))
302 /* Clear the bit in the hook mask that tells if the rule is on a base chain */
303 #define CLEAR_BASE_CHAIN_BIT (par->hook_mask &= ~(1 << NF_BR_NUMHOOKS))
304 /* True if the target is not a standard target */
305 #define INVALID_TARGET (info->target < -NUM_STANDARD_TARGETS || info->target >= 0)
307 #endif /* __KERNEL__ */
309 /* blatently stolen from ip_tables.h
310 * fn returns 0 to continue iteration */
311 #define EBT_MATCH_ITERATE(e, fn, args...) \
315 struct ebt_entry_match *__match; \
317 for (__i = sizeof(struct ebt_entry); \
318 __i < (e)->watchers_offset; \
319 __i += __match->match_size + \
320 sizeof(struct ebt_entry_match)) { \
321 __match = (void *)(e) + __i; \
323 __ret = fn(__match , ## args); \
328 if (__i != (e)->watchers_offset) \
334 #define EBT_WATCHER_ITERATE(e, fn, args...) \
338 struct ebt_entry_watcher *__watcher; \
340 for (__i = e->watchers_offset; \
341 __i < (e)->target_offset; \
342 __i += __watcher->watcher_size + \
343 sizeof(struct ebt_entry_watcher)) { \
344 __watcher = (void *)(e) + __i; \
346 __ret = fn(__watcher , ## args); \
351 if (__i != (e)->target_offset) \
357 #define EBT_ENTRY_ITERATE(entries, size, fn, args...) \
361 struct ebt_entry *__entry; \
363 for (__i = 0; __i < (size);) { \
364 __entry = (void *)(entries) + __i; \
365 __ret = fn(__entry , ## args); \
368 if (__entry->bitmask != 0) \
369 __i += __entry->next_offset; \
371 __i += sizeof(struct ebt_entries); \