]>
git.proxmox.com Git - mirror_ubuntu-zesty-kernel.git/blob - include/uapi/linux/netfilter_bridge/ebtables.h
5 * Bart De Schuymer <bdschuym@pandora.be>
7 * ebtables.c,v 2.0, April, 2002
9 * This code is strongly inspired by the iptables code which is
10 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
13 #ifndef _UAPI__LINUX_BRIDGE_EFF_H
14 #define _UAPI__LINUX_BRIDGE_EFF_H
16 #include <linux/netfilter_bridge.h>
17 #include <linux/if_ether.h>
19 #define EBT_TABLE_MAXNAMELEN 32
20 #define EBT_CHAIN_MAXNAMELEN EBT_TABLE_MAXNAMELEN
21 #define EBT_FUNCTION_MAXNAMELEN EBT_TABLE_MAXNAMELEN
23 /* verdicts >0 are "branches" */
26 #define EBT_CONTINUE -3
28 #define NUM_STANDARD_TARGETS 4
29 /* ebtables target modules store the verdict inside an int. We can
30 * reclaim a part of this int for backwards compatible extensions.
31 * The 4 lsb are more than enough to store the verdict. */
32 #define EBT_VERDICT_BITS 0x0000000F
43 char name
[EBT_TABLE_MAXNAMELEN
];
44 unsigned int valid_hooks
;
45 /* nr of rules in the table */
46 unsigned int nentries
;
47 /* total size of the entries */
48 unsigned int entries_size
;
49 /* start of the chains */
50 struct ebt_entries __user
*hook_entry
[NF_BR_NUMHOOKS
];
51 /* nr of counters userspace expects back */
52 unsigned int num_counters
;
53 /* where the kernel will put the old counters */
54 struct ebt_counter __user
*counters
;
58 struct ebt_replace_kernel
{
59 char name
[EBT_TABLE_MAXNAMELEN
];
60 unsigned int valid_hooks
;
61 /* nr of rules in the table */
62 unsigned int nentries
;
63 /* total size of the entries */
64 unsigned int entries_size
;
65 /* start of the chains */
66 struct ebt_entries
*hook_entry
[NF_BR_NUMHOOKS
];
67 /* nr of counters userspace expects back */
68 unsigned int num_counters
;
69 /* where the kernel will put the old counters */
70 struct ebt_counter
*counters
;
75 /* this field is always set to zero
76 * See EBT_ENTRY_OR_ENTRIES.
77 * Must be same size as ebt_entry.bitmask */
78 unsigned int distinguisher
;
80 char name
[EBT_CHAIN_MAXNAMELEN
];
81 /* counter offset for this chain */
82 unsigned int counter_offset
;
83 /* one standard (accept, drop, return) per hook */
86 unsigned int nentries
;
88 char data
[0] __attribute__ ((aligned (__alignof__(struct ebt_replace
))));
91 /* used for the bitmask of struct ebt_entry */
93 /* This is a hack to make a difference between an ebt_entry struct and an
94 * ebt_entries struct when traversing the entries from start to end.
95 * Using this simplifies the code a lot, while still being able to use
97 * Contrary, iptables doesn't use something like ebt_entries and therefore uses
98 * different techniques for naming the policy and such. So, iptables doesn't
99 * need a hack like this.
101 #define EBT_ENTRY_OR_ENTRIES 0x01
102 /* these are the normal masks */
103 #define EBT_NOPROTO 0x02
104 #define EBT_802_3 0x04
105 #define EBT_SOURCEMAC 0x08
106 #define EBT_DESTMAC 0x10
107 #define EBT_F_MASK (EBT_NOPROTO | EBT_802_3 | EBT_SOURCEMAC | EBT_DESTMAC \
108 | EBT_ENTRY_OR_ENTRIES)
110 #define EBT_IPROTO 0x01
112 #define EBT_IOUT 0x04
113 #define EBT_ISOURCE 0x8
114 #define EBT_IDEST 0x10
115 #define EBT_ILOGICALIN 0x20
116 #define EBT_ILOGICALOUT 0x40
117 #define EBT_INV_MASK (EBT_IPROTO | EBT_IIN | EBT_IOUT | EBT_ILOGICALIN \
118 | EBT_ILOGICALOUT | EBT_ISOURCE | EBT_IDEST)
120 struct ebt_entry_match
{
122 char name
[EBT_FUNCTION_MAXNAMELEN
];
123 struct xt_match
*match
;
126 unsigned int match_size
;
127 unsigned char data
[0] __attribute__ ((aligned (__alignof__(struct ebt_replace
))));
130 struct ebt_entry_watcher
{
132 char name
[EBT_FUNCTION_MAXNAMELEN
];
133 struct xt_target
*watcher
;
136 unsigned int watcher_size
;
137 unsigned char data
[0] __attribute__ ((aligned (__alignof__(struct ebt_replace
))));
140 struct ebt_entry_target
{
142 char name
[EBT_FUNCTION_MAXNAMELEN
];
143 struct xt_target
*target
;
146 unsigned int target_size
;
147 unsigned char data
[0] __attribute__ ((aligned (__alignof__(struct ebt_replace
))));
150 #define EBT_STANDARD_TARGET "standard"
151 struct ebt_standard_target
{
152 struct ebt_entry_target target
;
158 /* this needs to be the first field */
159 unsigned int bitmask
;
160 unsigned int invflags
;
162 /* the physical in-dev */
164 /* the logical in-dev */
165 char logical_in
[IFNAMSIZ
];
166 /* the physical out-dev */
168 /* the logical out-dev */
169 char logical_out
[IFNAMSIZ
];
170 unsigned char sourcemac
[ETH_ALEN
];
171 unsigned char sourcemsk
[ETH_ALEN
];
172 unsigned char destmac
[ETH_ALEN
];
173 unsigned char destmsk
[ETH_ALEN
];
174 /* sizeof ebt_entry + matches */
175 unsigned int watchers_offset
;
176 /* sizeof ebt_entry + matches + watchers */
177 unsigned int target_offset
;
178 /* sizeof ebt_entry + matches + watchers + target */
179 unsigned int next_offset
;
180 unsigned char elems
[0] __attribute__ ((aligned (__alignof__(struct ebt_replace
))));
183 /* {g,s}etsockopt numbers */
184 #define EBT_BASE_CTL 128
186 #define EBT_SO_SET_ENTRIES (EBT_BASE_CTL)
187 #define EBT_SO_SET_COUNTERS (EBT_SO_SET_ENTRIES+1)
188 #define EBT_SO_SET_MAX (EBT_SO_SET_COUNTERS+1)
190 #define EBT_SO_GET_INFO (EBT_BASE_CTL)
191 #define EBT_SO_GET_ENTRIES (EBT_SO_GET_INFO+1)
192 #define EBT_SO_GET_INIT_INFO (EBT_SO_GET_ENTRIES+1)
193 #define EBT_SO_GET_INIT_ENTRIES (EBT_SO_GET_INIT_INFO+1)
194 #define EBT_SO_GET_MAX (EBT_SO_GET_INIT_ENTRIES+1)
197 /* blatently stolen from ip_tables.h
198 * fn returns 0 to continue iteration */
199 #define EBT_MATCH_ITERATE(e, fn, args...) \
203 struct ebt_entry_match *__match; \
205 for (__i = sizeof(struct ebt_entry); \
206 __i < (e)->watchers_offset; \
207 __i += __match->match_size + \
208 sizeof(struct ebt_entry_match)) { \
209 __match = (void *)(e) + __i; \
211 __ret = fn(__match , ## args); \
216 if (__i != (e)->watchers_offset) \
222 #define EBT_WATCHER_ITERATE(e, fn, args...) \
226 struct ebt_entry_watcher *__watcher; \
228 for (__i = e->watchers_offset; \
229 __i < (e)->target_offset; \
230 __i += __watcher->watcher_size + \
231 sizeof(struct ebt_entry_watcher)) { \
232 __watcher = (void *)(e) + __i; \
234 __ret = fn(__watcher , ## args); \
239 if (__i != (e)->target_offset) \
245 #define EBT_ENTRY_ITERATE(entries, size, fn, args...) \
249 struct ebt_entry *__entry; \
251 for (__i = 0; __i < (size);) { \
252 __entry = (void *)(entries) + __i; \
253 __ret = fn(__entry , ## args); \
256 if (__entry->bitmask != 0) \
257 __i += __entry->next_offset; \
259 __i += sizeof(struct ebt_entries); \
268 #endif /* _UAPI__LINUX_BRIDGE_EFF_H */