aboutsummaryrefslogtreecommitdiffstats
path: root/include/linux/netfilter_ipv4
diff options
context:
space:
mode:
Diffstat (limited to 'include/linux/netfilter_ipv4')
-rw-r--r--include/linux/netfilter_ipv4/Kbuild14
-rw-r--r--include/linux/netfilter_ipv4/ip_queue.h72
-rw-r--r--include/linux/netfilter_ipv4/ipt_CLUSTERIP.h36
-rw-r--r--include/linux/netfilter_ipv4/ipt_ECN.h33
-rw-r--r--include/linux/netfilter_ipv4/ipt_LOG.h19
-rw-r--r--include/linux/netfilter_ipv4/ipt_REJECT.h20
-rw-r--r--include/linux/netfilter_ipv4/ipt_SAME.h20
-rw-r--r--include/linux/netfilter_ipv4/ipt_TTL.h23
-rw-r--r--include/linux/netfilter_ipv4/ipt_ULOG.h49
-rw-r--r--include/linux/netfilter_ipv4/ipt_addrtype.h27
-rw-r--r--include/linux/netfilter_ipv4/ipt_ah.h17
-rw-r--r--include/linux/netfilter_ipv4/ipt_ecn.h35
-rw-r--r--include/linux/netfilter_ipv4/ipt_realm.h7
-rw-r--r--include/linux/netfilter_ipv4/ipt_ttl.h23
14 files changed, 395 insertions, 0 deletions
diff --git a/include/linux/netfilter_ipv4/Kbuild b/include/linux/netfilter_ipv4/Kbuild
new file mode 100644
index 00000000000..f9930c87fff
--- /dev/null
+++ b/include/linux/netfilter_ipv4/Kbuild
@@ -0,0 +1,14 @@
1header-y += ip_queue.h
2header-y += ip_tables.h
3header-y += ipt_CLUSTERIP.h
4header-y += ipt_ECN.h
5header-y += ipt_LOG.h
6header-y += ipt_REJECT.h
7header-y += ipt_SAME.h
8header-y += ipt_TTL.h
9header-y += ipt_ULOG.h
10header-y += ipt_addrtype.h
11header-y += ipt_ah.h
12header-y += ipt_ecn.h
13header-y += ipt_realm.h
14header-y += ipt_ttl.h
diff --git a/include/linux/netfilter_ipv4/ip_queue.h b/include/linux/netfilter_ipv4/ip_queue.h
new file mode 100644
index 00000000000..a03507f465f
--- /dev/null
+++ b/include/linux/netfilter_ipv4/ip_queue.h
@@ -0,0 +1,72 @@
1/*
2 * This is a module which is used for queueing IPv4 packets and
3 * communicating with userspace via netlink.
4 *
5 * (C) 2000 James Morris, this code is GPL.
6 */
7#ifndef _IP_QUEUE_H
8#define _IP_QUEUE_H
9
10#ifdef __KERNEL__
11#ifdef DEBUG_IPQ
12#define QDEBUG(x...) printk(KERN_DEBUG ## x)
13#else
14#define QDEBUG(x...)
15#endif /* DEBUG_IPQ */
16#else
17#include <net/if.h>
18#endif /* ! __KERNEL__ */
19
20/* Messages sent from kernel */
21typedef struct ipq_packet_msg {
22 unsigned long packet_id; /* ID of queued packet */
23 unsigned long mark; /* Netfilter mark value */
24 long timestamp_sec; /* Packet arrival time (seconds) */
25 long timestamp_usec; /* Packet arrvial time (+useconds) */
26 unsigned int hook; /* Netfilter hook we rode in on */
27 char indev_name[IFNAMSIZ]; /* Name of incoming interface */
28 char outdev_name[IFNAMSIZ]; /* Name of outgoing interface */
29 __be16 hw_protocol; /* Hardware protocol (network order) */
30 unsigned short hw_type; /* Hardware type */
31 unsigned char hw_addrlen; /* Hardware address length */
32 unsigned char hw_addr[8]; /* Hardware address */
33 size_t data_len; /* Length of packet data */
34 unsigned char payload[0]; /* Optional packet data */
35} ipq_packet_msg_t;
36
37/* Messages sent from userspace */
38typedef struct ipq_mode_msg {
39 unsigned char value; /* Requested mode */
40 size_t range; /* Optional range of packet requested */
41} ipq_mode_msg_t;
42
43typedef struct ipq_verdict_msg {
44 unsigned int value; /* Verdict to hand to netfilter */
45 unsigned long id; /* Packet ID for this verdict */
46 size_t data_len; /* Length of replacement data */
47 unsigned char payload[0]; /* Optional replacement packet */
48} ipq_verdict_msg_t;
49
50typedef struct ipq_peer_msg {
51 union {
52 ipq_verdict_msg_t verdict;
53 ipq_mode_msg_t mode;
54 } msg;
55} ipq_peer_msg_t;
56
57/* Packet delivery modes */
58enum {
59 IPQ_COPY_NONE, /* Initial mode, packets are dropped */
60 IPQ_COPY_META, /* Copy metadata */
61 IPQ_COPY_PACKET /* Copy metadata + packet (range) */
62};
63#define IPQ_COPY_MAX IPQ_COPY_PACKET
64
65/* Types of messages */
66#define IPQM_BASE 0x10 /* standard netlink messages below this */
67#define IPQM_MODE (IPQM_BASE + 1) /* Mode request from peer */
68#define IPQM_VERDICT (IPQM_BASE + 2) /* Verdict from peer */
69#define IPQM_PACKET (IPQM_BASE + 3) /* Packet from kernel */
70#define IPQM_MAX (IPQM_BASE + 4)
71
72#endif /*_IP_QUEUE_H*/
diff --git a/include/linux/netfilter_ipv4/ipt_CLUSTERIP.h b/include/linux/netfilter_ipv4/ipt_CLUSTERIP.h
new file mode 100644
index 00000000000..c6a204c9704
--- /dev/null
+++ b/include/linux/netfilter_ipv4/ipt_CLUSTERIP.h
@@ -0,0 +1,36 @@
1#ifndef _IPT_CLUSTERIP_H_target
2#define _IPT_CLUSTERIP_H_target
3
4#include <linux/types.h>
5
6enum clusterip_hashmode {
7 CLUSTERIP_HASHMODE_SIP = 0,
8 CLUSTERIP_HASHMODE_SIP_SPT,
9 CLUSTERIP_HASHMODE_SIP_SPT_DPT,
10};
11
12#define CLUSTERIP_HASHMODE_MAX CLUSTERIP_HASHMODE_SIP_SPT_DPT
13
14#define CLUSTERIP_MAX_NODES 16
15
16#define CLUSTERIP_FLAG_NEW 0x00000001
17
18struct clusterip_config;
19
20struct ipt_clusterip_tgt_info {
21
22 __u32 flags;
23
24 /* only relevant for new ones */
25 __u8 clustermac[6];
26 __u16 num_total_nodes;
27 __u16 num_local_nodes;
28 __u16 local_nodes[CLUSTERIP_MAX_NODES];
29 __u32 hash_mode;
30 __u32 hash_initval;
31
32 /* Used internally by the kernel */
33 struct clusterip_config *config;
34};
35
36#endif /*_IPT_CLUSTERIP_H_target*/
diff --git a/include/linux/netfilter_ipv4/ipt_ECN.h b/include/linux/netfilter_ipv4/ipt_ECN.h
new file mode 100644
index 00000000000..bb88d5315a4
--- /dev/null
+++ b/include/linux/netfilter_ipv4/ipt_ECN.h
@@ -0,0 +1,33 @@
1/* Header file for iptables ipt_ECN target
2 *
3 * (C) 2002 by Harald Welte <laforge@gnumonks.org>
4 *
5 * This software is distributed under GNU GPL v2, 1991
6 *
7 * ipt_ECN.h,v 1.3 2002/05/29 12:17:40 laforge Exp
8*/
9#ifndef _IPT_ECN_TARGET_H
10#define _IPT_ECN_TARGET_H
11
12#include <linux/types.h>
13#include <linux/netfilter/xt_DSCP.h>
14
15#define IPT_ECN_IP_MASK (~XT_DSCP_MASK)
16
17#define IPT_ECN_OP_SET_IP 0x01 /* set ECN bits of IPv4 header */
18#define IPT_ECN_OP_SET_ECE 0x10 /* set ECE bit of TCP header */
19#define IPT_ECN_OP_SET_CWR 0x20 /* set CWR bit of TCP header */
20
21#define IPT_ECN_OP_MASK 0xce
22
23struct ipt_ECN_info {
24 __u8 operation; /* bitset of operations */
25 __u8 ip_ect; /* ECT codepoint of IPv4 header, pre-shifted */
26 union {
27 struct {
28 __u8 ece:1, cwr:1; /* TCP ECT bits */
29 } tcp;
30 } proto;
31};
32
33#endif /* _IPT_ECN_TARGET_H */
diff --git a/include/linux/netfilter_ipv4/ipt_LOG.h b/include/linux/netfilter_ipv4/ipt_LOG.h
new file mode 100644
index 00000000000..dcdbadf9fd4
--- /dev/null
+++ b/include/linux/netfilter_ipv4/ipt_LOG.h
@@ -0,0 +1,19 @@
1#ifndef _IPT_LOG_H
2#define _IPT_LOG_H
3
4/* make sure not to change this without changing netfilter.h:NF_LOG_* (!) */
5#define IPT_LOG_TCPSEQ 0x01 /* Log TCP sequence numbers */
6#define IPT_LOG_TCPOPT 0x02 /* Log TCP options */
7#define IPT_LOG_IPOPT 0x04 /* Log IP options */
8#define IPT_LOG_UID 0x08 /* Log UID owning local socket */
9#define IPT_LOG_NFLOG 0x10 /* Unsupported, don't reuse */
10#define IPT_LOG_MACDECODE 0x20 /* Decode MAC header */
11#define IPT_LOG_MASK 0x2f
12
13struct ipt_log_info {
14 unsigned char level;
15 unsigned char logflags;
16 char prefix[30];
17};
18
19#endif /*_IPT_LOG_H*/
diff --git a/include/linux/netfilter_ipv4/ipt_REJECT.h b/include/linux/netfilter_ipv4/ipt_REJECT.h
new file mode 100644
index 00000000000..4293a1ad1b0
--- /dev/null
+++ b/include/linux/netfilter_ipv4/ipt_REJECT.h
@@ -0,0 +1,20 @@
1#ifndef _IPT_REJECT_H
2#define _IPT_REJECT_H
3
4enum ipt_reject_with {
5 IPT_ICMP_NET_UNREACHABLE,
6 IPT_ICMP_HOST_UNREACHABLE,
7 IPT_ICMP_PROT_UNREACHABLE,
8 IPT_ICMP_PORT_UNREACHABLE,
9 IPT_ICMP_ECHOREPLY,
10 IPT_ICMP_NET_PROHIBITED,
11 IPT_ICMP_HOST_PROHIBITED,
12 IPT_TCP_RESET,
13 IPT_ICMP_ADMIN_PROHIBITED
14};
15
16struct ipt_reject_info {
17 enum ipt_reject_with with; /* reject type */
18};
19
20#endif /*_IPT_REJECT_H*/
diff --git a/include/linux/netfilter_ipv4/ipt_SAME.h b/include/linux/netfilter_ipv4/ipt_SAME.h
new file mode 100644
index 00000000000..5bca78267af
--- /dev/null
+++ b/include/linux/netfilter_ipv4/ipt_SAME.h
@@ -0,0 +1,20 @@
1#ifndef _IPT_SAME_H
2#define _IPT_SAME_H
3
4#include <linux/types.h>
5
6#define IPT_SAME_MAX_RANGE 10
7
8#define IPT_SAME_NODST 0x01
9
10struct ipt_same_info {
11 unsigned char info;
12 __u32 rangesize;
13 __u32 ipnum;
14 __u32 *iparray;
15
16 /* hangs off end. */
17 struct nf_nat_range range[IPT_SAME_MAX_RANGE];
18};
19
20#endif /*_IPT_SAME_H*/
diff --git a/include/linux/netfilter_ipv4/ipt_TTL.h b/include/linux/netfilter_ipv4/ipt_TTL.h
new file mode 100644
index 00000000000..f6ac169d92f
--- /dev/null
+++ b/include/linux/netfilter_ipv4/ipt_TTL.h
@@ -0,0 +1,23 @@
1/* TTL modification module for IP tables
2 * (C) 2000 by Harald Welte <laforge@netfilter.org> */
3
4#ifndef _IPT_TTL_H
5#define _IPT_TTL_H
6
7#include <linux/types.h>
8
9enum {
10 IPT_TTL_SET = 0,
11 IPT_TTL_INC,
12 IPT_TTL_DEC
13};
14
15#define IPT_TTL_MAXMODE IPT_TTL_DEC
16
17struct ipt_TTL_info {
18 __u8 mode;
19 __u8 ttl;
20};
21
22
23#endif
diff --git a/include/linux/netfilter_ipv4/ipt_ULOG.h b/include/linux/netfilter_ipv4/ipt_ULOG.h
new file mode 100644
index 00000000000..417aad280bc
--- /dev/null
+++ b/include/linux/netfilter_ipv4/ipt_ULOG.h
@@ -0,0 +1,49 @@
1/* Header file for IP tables userspace logging, Version 1.8
2 *
3 * (C) 2000-2002 by Harald Welte <laforge@gnumonks.org>
4 *
5 * Distributed under the terms of GNU GPL */
6
7#ifndef _IPT_ULOG_H
8#define _IPT_ULOG_H
9
10#ifndef NETLINK_NFLOG
11#define NETLINK_NFLOG 5
12#endif
13
14#define ULOG_DEFAULT_NLGROUP 1
15#define ULOG_DEFAULT_QTHRESHOLD 1
16
17#define ULOG_MAC_LEN 80
18#define ULOG_PREFIX_LEN 32
19
20#define ULOG_MAX_QLEN 50
21/* Why 50? Well... there is a limit imposed by the slab cache 131000
22 * bytes. So the multipart netlink-message has to be < 131000 bytes.
23 * Assuming a standard ethernet-mtu of 1500, we could define this up
24 * to 80... but even 50 seems to be big enough. */
25
26/* private data structure for each rule with a ULOG target */
27struct ipt_ulog_info {
28 unsigned int nl_group;
29 size_t copy_range;
30 size_t qthreshold;
31 char prefix[ULOG_PREFIX_LEN];
32};
33
34/* Format of the ULOG packets passed through netlink */
35typedef struct ulog_packet_msg {
36 unsigned long mark;
37 long timestamp_sec;
38 long timestamp_usec;
39 unsigned int hook;
40 char indev_name[IFNAMSIZ];
41 char outdev_name[IFNAMSIZ];
42 size_t data_len;
43 char prefix[ULOG_PREFIX_LEN];
44 unsigned char mac_len;
45 unsigned char mac[ULOG_MAC_LEN];
46 unsigned char payload[0];
47} ulog_packet_msg_t;
48
49#endif /*_IPT_ULOG_H*/
diff --git a/include/linux/netfilter_ipv4/ipt_addrtype.h b/include/linux/netfilter_ipv4/ipt_addrtype.h
new file mode 100644
index 00000000000..0da42237c8d
--- /dev/null
+++ b/include/linux/netfilter_ipv4/ipt_addrtype.h
@@ -0,0 +1,27 @@
1#ifndef _IPT_ADDRTYPE_H
2#define _IPT_ADDRTYPE_H
3
4#include <linux/types.h>
5
6enum {
7 IPT_ADDRTYPE_INVERT_SOURCE = 0x0001,
8 IPT_ADDRTYPE_INVERT_DEST = 0x0002,
9 IPT_ADDRTYPE_LIMIT_IFACE_IN = 0x0004,
10 IPT_ADDRTYPE_LIMIT_IFACE_OUT = 0x0008,
11};
12
13struct ipt_addrtype_info_v1 {
14 __u16 source; /* source-type mask */
15 __u16 dest; /* dest-type mask */
16 __u32 flags;
17};
18
19/* revision 0 */
20struct ipt_addrtype_info {
21 __u16 source; /* source-type mask */
22 __u16 dest; /* dest-type mask */
23 __u32 invert_source;
24 __u32 invert_dest;
25};
26
27#endif
diff --git a/include/linux/netfilter_ipv4/ipt_ah.h b/include/linux/netfilter_ipv4/ipt_ah.h
new file mode 100644
index 00000000000..4e02bb0119e
--- /dev/null
+++ b/include/linux/netfilter_ipv4/ipt_ah.h
@@ -0,0 +1,17 @@
1#ifndef _IPT_AH_H
2#define _IPT_AH_H
3
4#include <linux/types.h>
5
6struct ipt_ah {
7 __u32 spis[2]; /* Security Parameter Index */
8 __u8 invflags; /* Inverse flags */
9};
10
11
12
13/* Values for "invflags" field in struct ipt_ah. */
14#define IPT_AH_INV_SPI 0x01 /* Invert the sense of spi. */
15#define IPT_AH_INV_MASK 0x01 /* All possible flags. */
16
17#endif /*_IPT_AH_H*/
diff --git a/include/linux/netfilter_ipv4/ipt_ecn.h b/include/linux/netfilter_ipv4/ipt_ecn.h
new file mode 100644
index 00000000000..eabf95fb7d3
--- /dev/null
+++ b/include/linux/netfilter_ipv4/ipt_ecn.h
@@ -0,0 +1,35 @@
1/* iptables module for matching the ECN header in IPv4 and TCP header
2 *
3 * (C) 2002 Harald Welte <laforge@gnumonks.org>
4 *
5 * This software is distributed under GNU GPL v2, 1991
6 *
7 * ipt_ecn.h,v 1.4 2002/08/05 19:39:00 laforge Exp
8*/
9#ifndef _IPT_ECN_H
10#define _IPT_ECN_H
11
12#include <linux/types.h>
13#include <linux/netfilter/xt_dscp.h>
14
15#define IPT_ECN_IP_MASK (~XT_DSCP_MASK)
16
17#define IPT_ECN_OP_MATCH_IP 0x01
18#define IPT_ECN_OP_MATCH_ECE 0x10
19#define IPT_ECN_OP_MATCH_CWR 0x20
20
21#define IPT_ECN_OP_MATCH_MASK 0xce
22
23/* match info */
24struct ipt_ecn_info {
25 __u8 operation;
26 __u8 invert;
27 __u8 ip_ect;
28 union {
29 struct {
30 __u8 ect;
31 } tcp;
32 } proto;
33};
34
35#endif /* _IPT_ECN_H */
diff --git a/include/linux/netfilter_ipv4/ipt_realm.h b/include/linux/netfilter_ipv4/ipt_realm.h
new file mode 100644
index 00000000000..b3996eaa018
--- /dev/null
+++ b/include/linux/netfilter_ipv4/ipt_realm.h
@@ -0,0 +1,7 @@
1#ifndef _IPT_REALM_H
2#define _IPT_REALM_H
3
4#include <linux/netfilter/xt_realm.h>
5#define ipt_realm_info xt_realm_info
6
7#endif /* _IPT_REALM_H */
diff --git a/include/linux/netfilter_ipv4/ipt_ttl.h b/include/linux/netfilter_ipv4/ipt_ttl.h
new file mode 100644
index 00000000000..37bee444248
--- /dev/null
+++ b/include/linux/netfilter_ipv4/ipt_ttl.h
@@ -0,0 +1,23 @@
1/* IP tables module for matching the value of the TTL
2 * (C) 2000 by Harald Welte <laforge@gnumonks.org> */
3
4#ifndef _IPT_TTL_H
5#define _IPT_TTL_H
6
7#include <linux/types.h>
8
9enum {
10 IPT_TTL_EQ = 0, /* equals */
11 IPT_TTL_NE, /* not equals */
12 IPT_TTL_LT, /* less than */
13 IPT_TTL_GT, /* greater than */
14};
15
16
17struct ipt_ttl_info {
18 __u8 mode;
19 __u8 ttl;
20};
21
22
23#endif
generated by cgit v1.2.2 (git 2.25.0) at 2025-04-24 19:11:28 -0400