Gitiles
Code Review Sign In
review.blissroms.org / platform_external_ebtables / ca75589f2c5b55f7944a396b46a1a0140ea44d1b / . / include / ebtables.h
blob: f026f04ff8ba78aca6a538a0d9a4ea1c9d78eeb1 [file] [log] [blame]
Bart De Schuymerca755892003-07-23 21:07:58 +0000[diff] [blame^]1/*
2 * ebtables
3 *
4 * Authors:
5 * Bart De Schuymer <bdschuym@pandora.be>
6 *
7 * ebtables.c,v 2.0, April, 2002
8 *
9 * This code is stongly inspired on the iptables code which is
10 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
11 */
12
13/* Local copy of the kernel file, needed for Sparc64 support */
14#ifndef __LINUX_BRIDGE_EFF_H
15#define __LINUX_BRIDGE_EFF_H
16#include <linux/if.h>
17#include <linux/netfilter_bridge.h>
18#include <linux/if_ether.h>
19
20#define EBT_TABLE_MAXNAMELEN 32
21#define EBT_CHAIN_MAXNAMELEN EBT_TABLE_MAXNAMELEN
22#define EBT_FUNCTION_MAXNAMELEN EBT_TABLE_MAXNAMELEN
23
24/* verdicts >0 are "branches" */
25#define EBT_ACCEPT -1
26#define EBT_DROP -2
27#define EBT_CONTINUE -3
28#define EBT_RETURN -4
29#define NUM_STANDARD_TARGETS 4
30
31struct ebt_counter
32{
33 uint64_t pcnt;
34 uint64_t bcnt;
35};
36
37struct ebt_entries {
38 /* this field is always set to zero
39 * See EBT_ENTRY_OR_ENTRIES.
40 * Must be same size as ebt_entry.bitmask */
41 unsigned int distinguisher;
42 /* the chain name */
43 char name[EBT_CHAIN_MAXNAMELEN];
44 /* counter offset for this chain */
45 unsigned int counter_offset;
46 /* one standard (accept, drop, return) per hook */
47 int policy;
48 /* nr. of entries */
49 unsigned int nentries;
50 /* entry list */
51 char data[0];
52};
53
54/* used for the bitmask of struct ebt_entry */
55
56/* This is a hack to make a difference between an ebt_entry struct and an
57 * ebt_entries struct when traversing the entries from start to end.
58 * Using this simplifies the code alot, while still being able to use
59 * ebt_entries.
60 * Contrary, iptables doesn't use something like ebt_entries and therefore uses
61 * different techniques for naming the policy and such. So, iptables doesn't
62 * need a hack like this.
63 */
64#define EBT_ENTRY_OR_ENTRIES 0x01
65/* these are the normal masks */
66#define EBT_NOPROTO 0x02
67#define EBT_802_3 0x04
68#define EBT_SOURCEMAC 0x08
69#define EBT_DESTMAC 0x10
70#define EBT_F_MASK (EBT_NOPROTO | EBT_802_3 | EBT_SOURCEMAC | EBT_DESTMAC \
71 | EBT_ENTRY_OR_ENTRIES)
72
73#define EBT_IPROTO 0x01
74#define EBT_IIN 0x02
75#define EBT_IOUT 0x04
76#define EBT_ISOURCE 0x8
77#define EBT_IDEST 0x10
78#define EBT_ILOGICALIN 0x20
79#define EBT_ILOGICALOUT 0x40
80#define EBT_INV_MASK (EBT_IPROTO | EBT_IIN | EBT_IOUT | EBT_ILOGICALIN \
81 | EBT_ILOGICALOUT | EBT_ISOURCE | EBT_IDEST)
82
83struct ebt_entry_match
84{
85 union {
86 char name[EBT_FUNCTION_MAXNAMELEN];
87 struct ebt_match *match;
88 } u;
89 /* size of data */
90 unsigned int match_size;
91#ifdef KERNEL_64_USERSPACE_32
92 unsigned int pad;
93#endif
94 unsigned char data[0];
95};
96
97struct ebt_entry_watcher
98{
99 union {
100 char name[EBT_FUNCTION_MAXNAMELEN];
101 struct ebt_watcher *watcher;
102 } u;
103 /* size of data */
104 unsigned int watcher_size;
105#ifdef KERNEL_64_USERSPACE_32
106 unsigned int pad;
107#endif
108 unsigned char data[0];
109};
110
111struct ebt_entry_target
112{
113 union {
114 char name[EBT_FUNCTION_MAXNAMELEN];
115 struct ebt_target *target;
116 } u;
117 /* size of data */
118 unsigned int target_size;
119#ifdef KERNEL_64_USERSPACE_32
120 unsigned int pad;
121#endif
122 unsigned char data[0];
123};
124
125#define EBT_STANDARD_TARGET "standard"
126struct ebt_standard_target
127{
128 struct ebt_entry_target target;
129 int verdict;
130#ifdef KERNEL_64_USERSPACE_32
131 unsigned int pad;
132#endif
133};
134
135/* one entry */
136struct ebt_entry {
137 /* this needs to be the first field */
138 unsigned int bitmask;
139 unsigned int invflags;
140 uint16_t ethproto;
141 /* the physical in-dev */
142 char in[IFNAMSIZ];
143 /* the logical in-dev */
144 char logical_in[IFNAMSIZ];
145 /* the physical out-dev */
146 char out[IFNAMSIZ];
147 /* the logical out-dev */
148 char logical_out[IFNAMSIZ];
149 unsigned char sourcemac[ETH_ALEN];
150 unsigned char sourcemsk[ETH_ALEN];
151 unsigned char destmac[ETH_ALEN];
152 unsigned char destmsk[ETH_ALEN];
153 /* sizeof ebt_entry + matches */
154 unsigned int watchers_offset;
155 /* sizeof ebt_entry + matches + watchers */
156 unsigned int target_offset;
157 /* sizeof ebt_entry + matches + watchers + target */
158 unsigned int next_offset;
159#ifdef KERNEL_64_USERSPACE_32
160 unsigned int pad[2];
161#endif
162 unsigned char elems[0];
163};
164
165struct ebt_replace
166{
167 char name[EBT_TABLE_MAXNAMELEN];
168 unsigned int valid_hooks;
169 /* nr of rules in the table */
170 unsigned int nentries;
171 /* total size of the entries */
172 unsigned int entries_size;
173 /* start of the chains */
174#ifdef KERNEL_64_USERSPACE_32
175 uint64_t hook_entry[NF_BR_NUMHOOKS];
176#else
177 struct ebt_entries *hook_entry[NF_BR_NUMHOOKS];
178#endif
179 /* nr of counters userspace expects back */
180 unsigned int num_counters;
181 /* where the kernel will put the old counters */
182#ifdef KERNEL_64_USERSPACE_32
183 uint64_t counters;
184 uint64_t entries;
185#else
186 struct ebt_counter *counters;
187 char *entries;
188#endif
189};
190
191/* {g,s}etsockopt numbers */
192#define EBT_BASE_CTL 128
193
194#define EBT_SO_SET_ENTRIES (EBT_BASE_CTL)
195#define EBT_SO_SET_COUNTERS (EBT_SO_SET_ENTRIES+1)
196#define EBT_SO_SET_MAX (EBT_SO_SET_COUNTERS+1)
197
198#define EBT_SO_GET_INFO (EBT_BASE_CTL)
199#define EBT_SO_GET_ENTRIES (EBT_SO_GET_INFO+1)
200#define EBT_SO_GET_INIT_INFO (EBT_SO_GET_ENTRIES+1)
201#define EBT_SO_GET_INIT_ENTRIES (EBT_SO_GET_INIT_INFO+1)
202#define EBT_SO_GET_MAX (EBT_SO_GET_INIT_ENTRIES+1)
203
204/* blatently stolen from ip_tables.h
205 * fn returns 0 to continue iteration */
206#define EBT_MATCH_ITERATE(e, fn, args...) \
207({ \
208 unsigned int __i; \
209 int __ret = 0; \
210 struct ebt_entry_match *__match; \
211 \
212 for (__i = sizeof(struct ebt_entry); \
213 __i < (e)->watchers_offset; \
214 __i += __match->match_size + \
215 sizeof(struct ebt_entry_match)) { \
216 __match = (void *)(e) + __i; \
217 \
218 __ret = fn(__match , ## args); \
219 if (__ret != 0) \
220 break; \
221 } \
222 if (__ret == 0) { \
223 if (__i != (e)->watchers_offset) \
224 __ret = -EINVAL; \
225 } \
226 __ret; \
227})
228
229#define EBT_WATCHER_ITERATE(e, fn, args...) \
230({ \
231 unsigned int __i; \
232 int __ret = 0; \
233 struct ebt_entry_watcher *__watcher; \
234 \
235 for (__i = e->watchers_offset; \
236 __i < (e)->target_offset; \
237 __i += __watcher->watcher_size + \
238 sizeof(struct ebt_entry_watcher)) { \
239 __watcher = (void *)(e) + __i; \
240 \
241 __ret = fn(__watcher , ## args); \
242 if (__ret != 0) \
243 break; \
244 } \
245 if (__ret == 0) { \
246 if (__i != (e)->target_offset) \
247 __ret = -EINVAL; \
248 } \
249 __ret; \
250})
251
252#define EBT_ENTRY_ITERATE(entries, size, fn, args...) \
253({ \
254 unsigned int __i; \
255 int __ret = 0; \
256 struct ebt_entry *__entry; \
257 \
258 for (__i = 0; __i < (size);) { \
259 __entry = (void *)(entries) + __i; \
260 __ret = fn(__entry , ## args); \
261 if (__ret != 0) \
262 break; \
263 if (__entry->bitmask != 0) \
264 __i += __entry->next_offset; \
265 else \
266 __i += sizeof(struct ebt_entries); \
267 } \
268 if (__ret == 0) { \
269 if (__i != (size)) \
270 __ret = -EINVAL; \
271 } \
272 __ret; \
273})
274
275#endif