Gitiles
Code Review Sign In
review.blissroms.org / platform_external_ebtables / f31964812b6fe41a45b7712f10976babdc90d4a8 / . / include / ebtables.h
blob: 30e8441f2c33c2f7b45ef7576300d1af3eff8bb4 [file] [log] [blame]
Bart De Schuymerca755892003-07-23 21:07:58 +0000[diff] [blame]1/*
2 * ebtables
3 *
4 * Authors:
5 * Bart De Schuymer <bdschuym@pandora.be>
6 *
7 * ebtables.c,v 2.0, April, 2002
8 *
9 * This code is stongly inspired on the iptables code which is
10 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
11 */
12
13/* Local copy of the kernel file, needed for Sparc64 support */
14#ifndef __LINUX_BRIDGE_EFF_H
15#define __LINUX_BRIDGE_EFF_H
16#include <linux/if.h>
17#include <linux/netfilter_bridge.h>
18#include <linux/if_ether.h>
19
20#define EBT_TABLE_MAXNAMELEN 32
21#define EBT_CHAIN_MAXNAMELEN EBT_TABLE_MAXNAMELEN
22#define EBT_FUNCTION_MAXNAMELEN EBT_TABLE_MAXNAMELEN
23
24/* verdicts >0 are "branches" */
25#define EBT_ACCEPT -1
26#define EBT_DROP -2
27#define EBT_CONTINUE -3
28#define EBT_RETURN -4
29#define NUM_STANDARD_TARGETS 4
30
31struct ebt_counter
32{
33 uint64_t pcnt;
34 uint64_t bcnt;
35};
36
37struct ebt_entries {
38 /* this field is always set to zero
39 * See EBT_ENTRY_OR_ENTRIES.
40 * Must be same size as ebt_entry.bitmask */
41 unsigned int distinguisher;
42 /* the chain name */
43 char name[EBT_CHAIN_MAXNAMELEN];
44 /* counter offset for this chain */
45 unsigned int counter_offset;
46 /* one standard (accept, drop, return) per hook */
47 int policy;
48 /* nr. of entries */
49 unsigned int nentries;
50 /* entry list */
51 char data[0];
52};
53
54/* used for the bitmask of struct ebt_entry */
55
56/* This is a hack to make a difference between an ebt_entry struct and an
57 * ebt_entries struct when traversing the entries from start to end.
58 * Using this simplifies the code alot, while still being able to use
59 * ebt_entries.
60 * Contrary, iptables doesn't use something like ebt_entries and therefore uses
61 * different techniques for naming the policy and such. So, iptables doesn't
62 * need a hack like this.
63 */
64#define EBT_ENTRY_OR_ENTRIES 0x01
65/* these are the normal masks */
66#define EBT_NOPROTO 0x02
67#define EBT_802_3 0x04
68#define EBT_SOURCEMAC 0x08
69#define EBT_DESTMAC 0x10
70#define EBT_F_MASK (EBT_NOPROTO | EBT_802_3 | EBT_SOURCEMAC | EBT_DESTMAC \
71 | EBT_ENTRY_OR_ENTRIES)
72
73#define EBT_IPROTO 0x01
74#define EBT_IIN 0x02
75#define EBT_IOUT 0x04
76#define EBT_ISOURCE 0x8
77#define EBT_IDEST 0x10
78#define EBT_ILOGICALIN 0x20
79#define EBT_ILOGICALOUT 0x40
80#define EBT_INV_MASK (EBT_IPROTO | EBT_IIN | EBT_IOUT | EBT_ILOGICALIN \
81 | EBT_ILOGICALOUT | EBT_ISOURCE | EBT_IDEST)
82
83struct ebt_entry_match
84{
85 union {
86 char name[EBT_FUNCTION_MAXNAMELEN];
87 struct ebt_match *match;
88 } u;
89 /* size of data */
90 unsigned int match_size;
91#ifdef KERNEL_64_USERSPACE_32
92 unsigned int pad;
93#endif
94 unsigned char data[0];
95};
96
97struct ebt_entry_watcher
98{
99 union {
100 char name[EBT_FUNCTION_MAXNAMELEN];
101 struct ebt_watcher *watcher;
102 } u;
103 /* size of data */
104 unsigned int watcher_size;
105#ifdef KERNEL_64_USERSPACE_32
106 unsigned int pad;
107#endif
108 unsigned char data[0];
109};
110
111struct ebt_entry_target
112{
113 union {
114 char name[EBT_FUNCTION_MAXNAMELEN];
115 struct ebt_target *target;
116 } u;
117 /* size of data */
118 unsigned int target_size;
119#ifdef KERNEL_64_USERSPACE_32
120 unsigned int pad;
121#endif
122 unsigned char data[0];
123};
124
125#define EBT_STANDARD_TARGET "standard"
126struct ebt_standard_target
127{
128 struct ebt_entry_target target;
129 int verdict;
130#ifdef KERNEL_64_USERSPACE_32
131 unsigned int pad;
132#endif
133};
134
135/* one entry */
136struct ebt_entry {
137 /* this needs to be the first field */
138 unsigned int bitmask;
139 unsigned int invflags;
140 uint16_t ethproto;
141 /* the physical in-dev */
142 char in[IFNAMSIZ];
143 /* the logical in-dev */
144 char logical_in[IFNAMSIZ];
145 /* the physical out-dev */
146 char out[IFNAMSIZ];
147 /* the logical out-dev */
148 char logical_out[IFNAMSIZ];
149 unsigned char sourcemac[ETH_ALEN];
150 unsigned char sourcemsk[ETH_ALEN];
151 unsigned char destmac[ETH_ALEN];
152 unsigned char destmsk[ETH_ALEN];
153 /* sizeof ebt_entry + matches */
154 unsigned int watchers_offset;
155 /* sizeof ebt_entry + matches + watchers */
156 unsigned int target_offset;
157 /* sizeof ebt_entry + matches + watchers + target */
158 unsigned int next_offset;
Bart De Schuymerca755892003-07-23 21:07:58 +0000[diff] [blame]159 unsigned char elems[0];
160};
161
162struct ebt_replace
163{
164 char name[EBT_TABLE_MAXNAMELEN];
165 unsigned int valid_hooks;
166 /* nr of rules in the table */
167 unsigned int nentries;
168 /* total size of the entries */
169 unsigned int entries_size;
170 /* start of the chains */
171#ifdef KERNEL_64_USERSPACE_32
172 uint64_t hook_entry[NF_BR_NUMHOOKS];
173#else
174 struct ebt_entries *hook_entry[NF_BR_NUMHOOKS];
175#endif
176 /* nr of counters userspace expects back */
177 unsigned int num_counters;
178 /* where the kernel will put the old counters */
179#ifdef KERNEL_64_USERSPACE_32
180 uint64_t counters;
181 uint64_t entries;
182#else
183 struct ebt_counter *counters;
184 char *entries;
185#endif
186};
187
188/* {g,s}etsockopt numbers */
189#define EBT_BASE_CTL 128
190
191#define EBT_SO_SET_ENTRIES (EBT_BASE_CTL)
192#define EBT_SO_SET_COUNTERS (EBT_SO_SET_ENTRIES+1)
193#define EBT_SO_SET_MAX (EBT_SO_SET_COUNTERS+1)
194
195#define EBT_SO_GET_INFO (EBT_BASE_CTL)
196#define EBT_SO_GET_ENTRIES (EBT_SO_GET_INFO+1)
197#define EBT_SO_GET_INIT_INFO (EBT_SO_GET_ENTRIES+1)
198#define EBT_SO_GET_INIT_ENTRIES (EBT_SO_GET_INIT_INFO+1)
199#define EBT_SO_GET_MAX (EBT_SO_GET_INIT_ENTRIES+1)
200
201/* blatently stolen from ip_tables.h
202 * fn returns 0 to continue iteration */
203#define EBT_MATCH_ITERATE(e, fn, args...) \
204({ \
205 unsigned int __i; \
206 int __ret = 0; \
207 struct ebt_entry_match *__match; \
208 \
209 for (__i = sizeof(struct ebt_entry); \
210 __i < (e)->watchers_offset; \
211 __i += __match->match_size + \
212 sizeof(struct ebt_entry_match)) { \
213 __match = (void *)(e) + __i; \
214 \
215 __ret = fn(__match , ## args); \
216 if (__ret != 0) \
217 break; \
218 } \
219 if (__ret == 0) { \
220 if (__i != (e)->watchers_offset) \
221 __ret = -EINVAL; \
222 } \
223 __ret; \
224})
225
226#define EBT_WATCHER_ITERATE(e, fn, args...) \
227({ \
228 unsigned int __i; \
229 int __ret = 0; \
230 struct ebt_entry_watcher *__watcher; \
231 \
232 for (__i = e->watchers_offset; \
233 __i < (e)->target_offset; \
234 __i += __watcher->watcher_size + \
235 sizeof(struct ebt_entry_watcher)) { \
236 __watcher = (void *)(e) + __i; \
237 \
238 __ret = fn(__watcher , ## args); \
239 if (__ret != 0) \
240 break; \
241 } \
242 if (__ret == 0) { \
243 if (__i != (e)->target_offset) \
244 __ret = -EINVAL; \
245 } \
246 __ret; \
247})
248
249#define EBT_ENTRY_ITERATE(entries, size, fn, args...) \
250({ \
251 unsigned int __i; \
252 int __ret = 0; \
253 struct ebt_entry *__entry; \
254 \
255 for (__i = 0; __i < (size);) { \
256 __entry = (void *)(entries) + __i; \
257 __ret = fn(__entry , ## args); \
258 if (__ret != 0) \
259 break; \
260 if (__entry->bitmask != 0) \
261 __i += __entry->next_offset; \
262 else \
263 __i += sizeof(struct ebt_entries); \
264 } \
265 if (__ret == 0) { \
266 if (__i != (size)) \
267 __ret = -EINVAL; \
268 } \
269 __ret; \
270})
271
272#endif