aboutsummaryrefslogtreecommitdiffstats
path: root/include/uapi
diff options
context:
space:
mode:
authorDavid Howells <dhowells@redhat.com>2012-10-09 04:48:58 -0400
committerDavid Howells <dhowells@redhat.com>2012-10-09 04:48:58 -0400
commit55c5cd3cc179eb87faa9cc2d9741047dd1642aaf (patch)
tree1f63053791d51ce418359f2f83dafcac195671ec /include/uapi
parent8922082ae6cd2783789e83ae9c67ffcbe5a2f4e1 (diff)
UAPI: (Scripted) Disintegrate include/linux/netfilter_bridge
Signed-off-by: David Howells <dhowells@redhat.com> Acked-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Thomas Gleixner <tglx@linutronix.de> Acked-by: Michael Kerrisk <mtk.manpages@gmail.com> Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Acked-by: Dave Jones <davej@redhat.com>
Diffstat (limited to 'include/uapi')
-rw-r--r--include/uapi/linux/netfilter_bridge/Kbuild18
-rw-r--r--include/uapi/linux/netfilter_bridge/ebt_802_3.h62
-rw-r--r--include/uapi/linux/netfilter_bridge/ebt_among.h64
-rw-r--r--include/uapi/linux/netfilter_bridge/ebt_arp.h36
-rw-r--r--include/uapi/linux/netfilter_bridge/ebt_arpreply.h10
-rw-r--r--include/uapi/linux/netfilter_bridge/ebt_ip.h44
-rw-r--r--include/uapi/linux/netfilter_bridge/ebt_ip6.h50
-rw-r--r--include/uapi/linux/netfilter_bridge/ebt_limit.h24
-rw-r--r--include/uapi/linux/netfilter_bridge/ebt_log.h20
-rw-r--r--include/uapi/linux/netfilter_bridge/ebt_mark_m.h16
-rw-r--r--include/uapi/linux/netfilter_bridge/ebt_mark_t.h23
-rw-r--r--include/uapi/linux/netfilter_bridge/ebt_nat.h13
-rw-r--r--include/uapi/linux/netfilter_bridge/ebt_nflog.h23
-rw-r--r--include/uapi/linux/netfilter_bridge/ebt_pkttype.h12
-rw-r--r--include/uapi/linux/netfilter_bridge/ebt_redirect.h10
-rw-r--r--include/uapi/linux/netfilter_bridge/ebt_stp.h46
-rw-r--r--include/uapi/linux/netfilter_bridge/ebt_ulog.h38
-rw-r--r--include/uapi/linux/netfilter_bridge/ebt_vlan.h22
-rw-r--r--include/uapi/linux/netfilter_bridge/ebtables.h268
19 files changed, 799 insertions, 0 deletions
diff --git a/include/uapi/linux/netfilter_bridge/Kbuild b/include/uapi/linux/netfilter_bridge/Kbuild
index aafaa5aa54d4..348717c3a22f 100644
--- a/include/uapi/linux/netfilter_bridge/Kbuild
+++ b/include/uapi/linux/netfilter_bridge/Kbuild
@@ -1 +1,19 @@
1# UAPI Header export list 1# UAPI Header export list
2header-y += ebt_802_3.h
3header-y += ebt_among.h
4header-y += ebt_arp.h
5header-y += ebt_arpreply.h
6header-y += ebt_ip.h
7header-y += ebt_ip6.h
8header-y += ebt_limit.h
9header-y += ebt_log.h
10header-y += ebt_mark_m.h
11header-y += ebt_mark_t.h
12header-y += ebt_nat.h
13header-y += ebt_nflog.h
14header-y += ebt_pkttype.h
15header-y += ebt_redirect.h
16header-y += ebt_stp.h
17header-y += ebt_ulog.h
18header-y += ebt_vlan.h
19header-y += ebtables.h
diff --git a/include/uapi/linux/netfilter_bridge/ebt_802_3.h b/include/uapi/linux/netfilter_bridge/ebt_802_3.h
new file mode 100644
index 000000000000..5bf84912a082
--- /dev/null
+++ b/include/uapi/linux/netfilter_bridge/ebt_802_3.h
@@ -0,0 +1,62 @@
1#ifndef _UAPI__LINUX_BRIDGE_EBT_802_3_H
2#define _UAPI__LINUX_BRIDGE_EBT_802_3_H
3
4#include <linux/types.h>
5
6#define EBT_802_3_SAP 0x01
7#define EBT_802_3_TYPE 0x02
8
9#define EBT_802_3_MATCH "802_3"
10
11/*
12 * If frame has DSAP/SSAP value 0xaa you must check the SNAP type
13 * to discover what kind of packet we're carrying.
14 */
15#define CHECK_TYPE 0xaa
16
17/*
18 * Control field may be one or two bytes. If the first byte has
19 * the value 0x03 then the entire length is one byte, otherwise it is two.
20 * One byte controls are used in Unnumbered Information frames.
21 * Two byte controls are used in Numbered Information frames.
22 */
23#define IS_UI 0x03
24
25#define EBT_802_3_MASK (EBT_802_3_SAP | EBT_802_3_TYPE | EBT_802_3)
26
27/* ui has one byte ctrl, ni has two */
28struct hdr_ui {
29 __u8 dsap;
30 __u8 ssap;
31 __u8 ctrl;
32 __u8 orig[3];
33 __be16 type;
34};
35
36struct hdr_ni {
37 __u8 dsap;
38 __u8 ssap;
39 __be16 ctrl;
40 __u8 orig[3];
41 __be16 type;
42};
43
44struct ebt_802_3_hdr {
45 __u8 daddr[6];
46 __u8 saddr[6];
47 __be16 len;
48 union {
49 struct hdr_ui ui;
50 struct hdr_ni ni;
51 } llc;
52};
53
54
55struct ebt_802_3_info {
56 __u8 sap;
57 __be16 type;
58 __u8 bitmask;
59 __u8 invflags;
60};
61
62#endif /* _UAPI__LINUX_BRIDGE_EBT_802_3_H */
diff --git a/include/uapi/linux/netfilter_bridge/ebt_among.h b/include/uapi/linux/netfilter_bridge/ebt_among.h
new file mode 100644
index 000000000000..bd4e3ad0b706
--- /dev/null
+++ b/include/uapi/linux/netfilter_bridge/ebt_among.h
@@ -0,0 +1,64 @@
1#ifndef __LINUX_BRIDGE_EBT_AMONG_H
2#define __LINUX_BRIDGE_EBT_AMONG_H
3
4#include <linux/types.h>
5
6#define EBT_AMONG_DST 0x01
7#define EBT_AMONG_SRC 0x02
8
9/* Grzegorz Borowiak <grzes@gnu.univ.gda.pl> 2003
10 *
11 * Write-once-read-many hash table, used for checking if a given
12 * MAC address belongs to a set or not and possibly for checking
13 * if it is related with a given IPv4 address.
14 *
15 * The hash value of an address is its last byte.
16 *
17 * In real-world ethernet addresses, values of the last byte are
18 * evenly distributed and there is no need to consider other bytes.
19 * It would only slow the routines down.
20 *
21 * For MAC address comparison speedup reasons, we introduce a trick.
22 * MAC address is mapped onto an array of two 32-bit integers.
23 * This pair of integers is compared with MAC addresses in the
24 * hash table, which are stored also in form of pairs of integers
25 * (in `cmp' array). This is quick as it requires only two elementary
26 * number comparisons in worst case. Further, we take advantage of
27 * fact that entropy of 3 last bytes of address is larger than entropy
28 * of 3 first bytes. So first we compare 4 last bytes of addresses and
29 * if they are the same we compare 2 first.
30 *
31 * Yes, it is a memory overhead, but in 2003 AD, who cares?
32 */
33
34struct ebt_mac_wormhash_tuple {
35 __u32 cmp[2];
36 __be32 ip;
37};
38
39struct ebt_mac_wormhash {
40 int table[257];
41 int poolsize;
42 struct ebt_mac_wormhash_tuple pool[0];
43};
44
45#define ebt_mac_wormhash_size(x) ((x) ? sizeof(struct ebt_mac_wormhash) \
46 + (x)->poolsize * sizeof(struct ebt_mac_wormhash_tuple) : 0)
47
48struct ebt_among_info {
49 int wh_dst_ofs;
50 int wh_src_ofs;
51 int bitmask;
52};
53
54#define EBT_AMONG_DST_NEG 0x1
55#define EBT_AMONG_SRC_NEG 0x2
56
57#define ebt_among_wh_dst(x) ((x)->wh_dst_ofs ? \
58 (struct ebt_mac_wormhash*)((char*)(x) + (x)->wh_dst_ofs) : NULL)
59#define ebt_among_wh_src(x) ((x)->wh_src_ofs ? \
60 (struct ebt_mac_wormhash*)((char*)(x) + (x)->wh_src_ofs) : NULL)
61
62#define EBT_AMONG_MATCH "among"
63
64#endif
diff --git a/include/uapi/linux/netfilter_bridge/ebt_arp.h b/include/uapi/linux/netfilter_bridge/ebt_arp.h
new file mode 100644
index 000000000000..522f3e427f49
--- /dev/null
+++ b/include/uapi/linux/netfilter_bridge/ebt_arp.h
@@ -0,0 +1,36 @@
1#ifndef __LINUX_BRIDGE_EBT_ARP_H
2#define __LINUX_BRIDGE_EBT_ARP_H
3
4#include <linux/types.h>
5
6#define EBT_ARP_OPCODE 0x01
7#define EBT_ARP_HTYPE 0x02
8#define EBT_ARP_PTYPE 0x04
9#define EBT_ARP_SRC_IP 0x08
10#define EBT_ARP_DST_IP 0x10
11#define EBT_ARP_SRC_MAC 0x20
12#define EBT_ARP_DST_MAC 0x40
13#define EBT_ARP_GRAT 0x80
14#define EBT_ARP_MASK (EBT_ARP_OPCODE | EBT_ARP_HTYPE | EBT_ARP_PTYPE | \
15 EBT_ARP_SRC_IP | EBT_ARP_DST_IP | EBT_ARP_SRC_MAC | EBT_ARP_DST_MAC | \
16 EBT_ARP_GRAT)
17#define EBT_ARP_MATCH "arp"
18
19struct ebt_arp_info
20{
21 __be16 htype;
22 __be16 ptype;
23 __be16 opcode;
24 __be32 saddr;
25 __be32 smsk;
26 __be32 daddr;
27 __be32 dmsk;
28 unsigned char smaddr[ETH_ALEN];
29 unsigned char smmsk[ETH_ALEN];
30 unsigned char dmaddr[ETH_ALEN];
31 unsigned char dmmsk[ETH_ALEN];
32 __u8 bitmask;
33 __u8 invflags;
34};
35
36#endif
diff --git a/include/uapi/linux/netfilter_bridge/ebt_arpreply.h b/include/uapi/linux/netfilter_bridge/ebt_arpreply.h
new file mode 100644
index 000000000000..7e77896e1fbf
--- /dev/null
+++ b/include/uapi/linux/netfilter_bridge/ebt_arpreply.h
@@ -0,0 +1,10 @@
1#ifndef __LINUX_BRIDGE_EBT_ARPREPLY_H
2#define __LINUX_BRIDGE_EBT_ARPREPLY_H
3
4struct ebt_arpreply_info {
5 unsigned char mac[ETH_ALEN];
6 int target;
7};
8#define EBT_ARPREPLY_TARGET "arpreply"
9
10#endif
diff --git a/include/uapi/linux/netfilter_bridge/ebt_ip.h b/include/uapi/linux/netfilter_bridge/ebt_ip.h
new file mode 100644
index 000000000000..c4bbc41b0ea4
--- /dev/null
+++ b/include/uapi/linux/netfilter_bridge/ebt_ip.h
@@ -0,0 +1,44 @@
1/*
2 * ebt_ip
3 *
4 * Authors:
5 * Bart De Schuymer <bart.de.schuymer@pandora.be>
6 *
7 * April, 2002
8 *
9 * Changes:
10 * added ip-sport and ip-dport
11 * Innominate Security Technologies AG <mhopf@innominate.com>
12 * September, 2002
13 */
14
15#ifndef __LINUX_BRIDGE_EBT_IP_H
16#define __LINUX_BRIDGE_EBT_IP_H
17
18#include <linux/types.h>
19
20#define EBT_IP_SOURCE 0x01
21#define EBT_IP_DEST 0x02
22#define EBT_IP_TOS 0x04
23#define EBT_IP_PROTO 0x08
24#define EBT_IP_SPORT 0x10
25#define EBT_IP_DPORT 0x20
26#define EBT_IP_MASK (EBT_IP_SOURCE | EBT_IP_DEST | EBT_IP_TOS | EBT_IP_PROTO |\
27 EBT_IP_SPORT | EBT_IP_DPORT )
28#define EBT_IP_MATCH "ip"
29
30/* the same values are used for the invflags */
31struct ebt_ip_info {
32 __be32 saddr;
33 __be32 daddr;
34 __be32 smsk;
35 __be32 dmsk;
36 __u8 tos;
37 __u8 protocol;
38 __u8 bitmask;
39 __u8 invflags;
40 __u16 sport[2];
41 __u16 dport[2];
42};
43
44#endif
diff --git a/include/uapi/linux/netfilter_bridge/ebt_ip6.h b/include/uapi/linux/netfilter_bridge/ebt_ip6.h
new file mode 100644
index 000000000000..42b889682721
--- /dev/null
+++ b/include/uapi/linux/netfilter_bridge/ebt_ip6.h
@@ -0,0 +1,50 @@
1/*
2 * ebt_ip6
3 *
4 * Authors:
5 * Kuo-Lang Tseng <kuo-lang.tseng@intel.com>
6 * Manohar Castelino <manohar.r.castelino@intel.com>
7 *
8 * Jan 11, 2008
9 *
10 */
11
12#ifndef __LINUX_BRIDGE_EBT_IP6_H
13#define __LINUX_BRIDGE_EBT_IP6_H
14
15#include <linux/types.h>
16
17#define EBT_IP6_SOURCE 0x01
18#define EBT_IP6_DEST 0x02
19#define EBT_IP6_TCLASS 0x04
20#define EBT_IP6_PROTO 0x08
21#define EBT_IP6_SPORT 0x10
22#define EBT_IP6_DPORT 0x20
23#define EBT_IP6_ICMP6 0x40
24
25#define EBT_IP6_MASK (EBT_IP6_SOURCE | EBT_IP6_DEST | EBT_IP6_TCLASS |\
26 EBT_IP6_PROTO | EBT_IP6_SPORT | EBT_IP6_DPORT | \
27 EBT_IP6_ICMP6)
28#define EBT_IP6_MATCH "ip6"
29
30/* the same values are used for the invflags */
31struct ebt_ip6_info {
32 struct in6_addr saddr;
33 struct in6_addr daddr;
34 struct in6_addr smsk;
35 struct in6_addr dmsk;
36 __u8 tclass;
37 __u8 protocol;
38 __u8 bitmask;
39 __u8 invflags;
40 union {
41 __u16 sport[2];
42 __u8 icmpv6_type[2];
43 };
44 union {
45 __u16 dport[2];
46 __u8 icmpv6_code[2];
47 };
48};
49
50#endif
diff --git a/include/uapi/linux/netfilter_bridge/ebt_limit.h b/include/uapi/linux/netfilter_bridge/ebt_limit.h
new file mode 100644
index 000000000000..66d80b30ba0e
--- /dev/null
+++ b/include/uapi/linux/netfilter_bridge/ebt_limit.h
@@ -0,0 +1,24 @@
1#ifndef __LINUX_BRIDGE_EBT_LIMIT_H
2#define __LINUX_BRIDGE_EBT_LIMIT_H
3
4#include <linux/types.h>
5
6#define EBT_LIMIT_MATCH "limit"
7
8/* timings are in milliseconds. */
9#define EBT_LIMIT_SCALE 10000
10
11/* 1/10,000 sec period => max of 10,000/sec. Min rate is then 429490
12 seconds, or one every 59 hours. */
13
14struct ebt_limit_info {
15 __u32 avg; /* Average secs between packets * scale */
16 __u32 burst; /* Period multiplier for upper limit. */
17
18 /* Used internally by the kernel */
19 unsigned long prev;
20 __u32 credit;
21 __u32 credit_cap, cost;
22};
23
24#endif
diff --git a/include/uapi/linux/netfilter_bridge/ebt_log.h b/include/uapi/linux/netfilter_bridge/ebt_log.h
new file mode 100644
index 000000000000..7e7f1d1fe494
--- /dev/null
+++ b/include/uapi/linux/netfilter_bridge/ebt_log.h
@@ -0,0 +1,20 @@
1#ifndef __LINUX_BRIDGE_EBT_LOG_H
2#define __LINUX_BRIDGE_EBT_LOG_H
3
4#include <linux/types.h>
5
6#define EBT_LOG_IP 0x01 /* if the frame is made by ip, log the ip information */
7#define EBT_LOG_ARP 0x02
8#define EBT_LOG_NFLOG 0x04
9#define EBT_LOG_IP6 0x08
10#define EBT_LOG_MASK (EBT_LOG_IP | EBT_LOG_ARP | EBT_LOG_IP6)
11#define EBT_LOG_PREFIX_SIZE 30
12#define EBT_LOG_WATCHER "log"
13
14struct ebt_log_info {
15 __u8 loglevel;
16 __u8 prefix[EBT_LOG_PREFIX_SIZE];
17 __u32 bitmask;
18};
19
20#endif
diff --git a/include/uapi/linux/netfilter_bridge/ebt_mark_m.h b/include/uapi/linux/netfilter_bridge/ebt_mark_m.h
new file mode 100644
index 000000000000..410f9e5a71d4
--- /dev/null
+++ b/include/uapi/linux/netfilter_bridge/ebt_mark_m.h
@@ -0,0 +1,16 @@
1#ifndef __LINUX_BRIDGE_EBT_MARK_M_H
2#define __LINUX_BRIDGE_EBT_MARK_M_H
3
4#include <linux/types.h>
5
6#define EBT_MARK_AND 0x01
7#define EBT_MARK_OR 0x02
8#define EBT_MARK_MASK (EBT_MARK_AND | EBT_MARK_OR)
9struct ebt_mark_m_info {
10 unsigned long mark, mask;
11 __u8 invert;
12 __u8 bitmask;
13};
14#define EBT_MARK_MATCH "mark_m"
15
16#endif
diff --git a/include/uapi/linux/netfilter_bridge/ebt_mark_t.h b/include/uapi/linux/netfilter_bridge/ebt_mark_t.h
new file mode 100644
index 000000000000..7d5a268a4311
--- /dev/null
+++ b/include/uapi/linux/netfilter_bridge/ebt_mark_t.h
@@ -0,0 +1,23 @@
1#ifndef __LINUX_BRIDGE_EBT_MARK_T_H
2#define __LINUX_BRIDGE_EBT_MARK_T_H
3
4/* The target member is reused for adding new actions, the
5 * value of the real target is -1 to -NUM_STANDARD_TARGETS.
6 * For backward compatibility, the 4 lsb (2 would be enough,
7 * but let's play it safe) are kept to designate this target.
8 * The remaining bits designate the action. By making the set
9 * action 0xfffffff0, the result will look ok for older
10 * versions. [September 2006] */
11#define MARK_SET_VALUE (0xfffffff0)
12#define MARK_OR_VALUE (0xffffffe0)
13#define MARK_AND_VALUE (0xffffffd0)
14#define MARK_XOR_VALUE (0xffffffc0)
15
16struct ebt_mark_t_info {
17 unsigned long mark;
18 /* EBT_ACCEPT, EBT_DROP, EBT_CONTINUE or EBT_RETURN */
19 int target;
20};
21#define EBT_MARK_TARGET "mark"
22
23#endif
diff --git a/include/uapi/linux/netfilter_bridge/ebt_nat.h b/include/uapi/linux/netfilter_bridge/ebt_nat.h
new file mode 100644
index 000000000000..5e74e3b03bd6
--- /dev/null
+++ b/include/uapi/linux/netfilter_bridge/ebt_nat.h
@@ -0,0 +1,13 @@
1#ifndef __LINUX_BRIDGE_EBT_NAT_H
2#define __LINUX_BRIDGE_EBT_NAT_H
3
4#define NAT_ARP_BIT (0x00000010)
5struct ebt_nat_info {
6 unsigned char mac[ETH_ALEN];
7 /* EBT_ACCEPT, EBT_DROP, EBT_CONTINUE or EBT_RETURN */
8 int target;
9};
10#define EBT_SNAT_TARGET "snat"
11#define EBT_DNAT_TARGET "dnat"
12
13#endif
diff --git a/include/uapi/linux/netfilter_bridge/ebt_nflog.h b/include/uapi/linux/netfilter_bridge/ebt_nflog.h
new file mode 100644
index 000000000000..df829fce9125
--- /dev/null
+++ b/include/uapi/linux/netfilter_bridge/ebt_nflog.h
@@ -0,0 +1,23 @@
1#ifndef __LINUX_BRIDGE_EBT_NFLOG_H
2#define __LINUX_BRIDGE_EBT_NFLOG_H
3
4#include <linux/types.h>
5
6#define EBT_NFLOG_MASK 0x0
7
8#define EBT_NFLOG_PREFIX_SIZE 64
9#define EBT_NFLOG_WATCHER "nflog"
10
11#define EBT_NFLOG_DEFAULT_GROUP 0x1
12#define EBT_NFLOG_DEFAULT_THRESHOLD 1
13
14struct ebt_nflog_info {
15 __u32 len;
16 __u16 group;
17 __u16 threshold;
18 __u16 flags;
19 __u16 pad;
20 char prefix[EBT_NFLOG_PREFIX_SIZE];
21};
22
23#endif /* __LINUX_BRIDGE_EBT_NFLOG_H */
diff --git a/include/uapi/linux/netfilter_bridge/ebt_pkttype.h b/include/uapi/linux/netfilter_bridge/ebt_pkttype.h
new file mode 100644
index 000000000000..c241badcd036
--- /dev/null
+++ b/include/uapi/linux/netfilter_bridge/ebt_pkttype.h
@@ -0,0 +1,12 @@
1#ifndef __LINUX_BRIDGE_EBT_PKTTYPE_H
2#define __LINUX_BRIDGE_EBT_PKTTYPE_H
3
4#include <linux/types.h>
5
6struct ebt_pkttype_info {
7 __u8 pkt_type;
8 __u8 invert;
9};
10#define EBT_PKTTYPE_MATCH "pkttype"
11
12#endif
diff --git a/include/uapi/linux/netfilter_bridge/ebt_redirect.h b/include/uapi/linux/netfilter_bridge/ebt_redirect.h
new file mode 100644
index 000000000000..dd9622ce8488
--- /dev/null
+++ b/include/uapi/linux/netfilter_bridge/ebt_redirect.h
@@ -0,0 +1,10 @@
1#ifndef __LINUX_BRIDGE_EBT_REDIRECT_H
2#define __LINUX_BRIDGE_EBT_REDIRECT_H
3
4struct ebt_redirect_info {
5 /* EBT_ACCEPT, EBT_DROP, EBT_CONTINUE or EBT_RETURN */
6 int target;
7};
8#define EBT_REDIRECT_TARGET "redirect"
9
10#endif
diff --git a/include/uapi/linux/netfilter_bridge/ebt_stp.h b/include/uapi/linux/netfilter_bridge/ebt_stp.h
new file mode 100644
index 000000000000..1025b9f5fb7d
--- /dev/null
+++ b/include/uapi/linux/netfilter_bridge/ebt_stp.h
@@ -0,0 +1,46 @@
1#ifndef __LINUX_BRIDGE_EBT_STP_H
2#define __LINUX_BRIDGE_EBT_STP_H
3
4#include <linux/types.h>
5
6#define EBT_STP_TYPE 0x0001
7
8#define EBT_STP_FLAGS 0x0002
9#define EBT_STP_ROOTPRIO 0x0004
10#define EBT_STP_ROOTADDR 0x0008
11#define EBT_STP_ROOTCOST 0x0010
12#define EBT_STP_SENDERPRIO 0x0020
13#define EBT_STP_SENDERADDR 0x0040
14#define EBT_STP_PORT 0x0080
15#define EBT_STP_MSGAGE 0x0100
16#define EBT_STP_MAXAGE 0x0200
17#define EBT_STP_HELLOTIME 0x0400
18#define EBT_STP_FWDD 0x0800
19
20#define EBT_STP_MASK 0x0fff
21#define EBT_STP_CONFIG_MASK 0x0ffe
22
23#define EBT_STP_MATCH "stp"
24
25struct ebt_stp_config_info {
26 __u8 flags;
27 __u16 root_priol, root_priou;
28 char root_addr[6], root_addrmsk[6];
29 __u32 root_costl, root_costu;
30 __u16 sender_priol, sender_priou;
31 char sender_addr[6], sender_addrmsk[6];
32 __u16 portl, portu;
33 __u16 msg_agel, msg_ageu;
34 __u16 max_agel, max_ageu;
35 __u16 hello_timel, hello_timeu;
36 __u16 forward_delayl, forward_delayu;
37};
38
39struct ebt_stp_info {
40 __u8 type;
41 struct ebt_stp_config_info config;
42 __u16 bitmask;
43 __u16 invflags;
44};
45
46#endif
diff --git a/include/uapi/linux/netfilter_bridge/ebt_ulog.h b/include/uapi/linux/netfilter_bridge/ebt_ulog.h
new file mode 100644
index 000000000000..89a6becb5269
--- /dev/null
+++ b/include/uapi/linux/netfilter_bridge/ebt_ulog.h
@@ -0,0 +1,38 @@
1#ifndef _EBT_ULOG_H
2#define _EBT_ULOG_H
3
4#include <linux/types.h>
5
6#define EBT_ULOG_DEFAULT_NLGROUP 0
7#define EBT_ULOG_DEFAULT_QTHRESHOLD 1
8#define EBT_ULOG_MAXNLGROUPS 32 /* hardcoded netlink max */
9#define EBT_ULOG_PREFIX_LEN 32
10#define EBT_ULOG_MAX_QLEN 50
11#define EBT_ULOG_WATCHER "ulog"
12#define EBT_ULOG_VERSION 1
13
14struct ebt_ulog_info {
15 __u32 nlgroup;
16 unsigned int cprange;
17 unsigned int qthreshold;
18 char prefix[EBT_ULOG_PREFIX_LEN];
19};
20
21typedef struct ebt_ulog_packet_msg {
22 int version;
23 char indev[IFNAMSIZ];
24 char outdev[IFNAMSIZ];
25 char physindev[IFNAMSIZ];
26 char physoutdev[IFNAMSIZ];
27 char prefix[EBT_ULOG_PREFIX_LEN];
28 struct timeval stamp;
29 unsigned long mark;
30 unsigned int hook;
31 size_t data_len;
32 /* The complete packet, including Ethernet header and perhaps
33 * the VLAN header is appended */
34 unsigned char data[0] __attribute__
35 ((aligned (__alignof__(struct ebt_ulog_info))));
36} ebt_ulog_packet_msg_t;
37
38#endif /* _EBT_ULOG_H */
diff --git a/include/uapi/linux/netfilter_bridge/ebt_vlan.h b/include/uapi/linux/netfilter_bridge/ebt_vlan.h
new file mode 100644
index 000000000000..967d1d5cf98d
--- /dev/null
+++ b/include/uapi/linux/netfilter_bridge/ebt_vlan.h
@@ -0,0 +1,22 @@
1#ifndef __LINUX_BRIDGE_EBT_VLAN_H
2#define __LINUX_BRIDGE_EBT_VLAN_H
3
4#include <linux/types.h>
5
6#define EBT_VLAN_ID 0x01
7#define EBT_VLAN_PRIO 0x02
8#define EBT_VLAN_ENCAP 0x04
9#define EBT_VLAN_MASK (EBT_VLAN_ID | EBT_VLAN_PRIO | EBT_VLAN_ENCAP)
10#define EBT_VLAN_MATCH "vlan"
11
12struct ebt_vlan_info {
13 __u16 id; /* VLAN ID {1-4095} */
14 __u8 prio; /* VLAN User Priority {0-7} */
15 __be16 encap; /* VLAN Encapsulated frame code {0-65535} */
16 __u8 bitmask; /* Args bitmask bit 1=1 - ID arg,
17 bit 2=1 User-Priority arg, bit 3=1 encap*/
18 __u8 invflags; /* Inverse bitmask bit 1=1 - inversed ID arg,
19 bit 2=1 - inversed Pirority arg */
20};
21
22#endif
diff --git a/include/uapi/linux/netfilter_bridge/ebtables.h b/include/uapi/linux/netfilter_bridge/ebtables.h
new file mode 100644
index 000000000000..ba993360dbe9
--- /dev/null
+++ b/include/uapi/linux/netfilter_bridge/ebtables.h
@@ -0,0 +1,268 @@
1/*
2 * ebtables
3 *
4 * Authors:
5 * Bart De Schuymer <bdschuym@pandora.be>
6 *
7 * ebtables.c,v 2.0, April, 2002
8 *
9 * This code is stongly inspired on the iptables code which is
10 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
11 */
12
13#ifndef _UAPI__LINUX_BRIDGE_EFF_H
14#define _UAPI__LINUX_BRIDGE_EFF_H
15#include <linux/if.h>
16#include <linux/netfilter_bridge.h>
17#include <linux/if_ether.h>
18
19#define EBT_TABLE_MAXNAMELEN 32
20#define EBT_CHAIN_MAXNAMELEN EBT_TABLE_MAXNAMELEN
21#define EBT_FUNCTION_MAXNAMELEN EBT_TABLE_MAXNAMELEN
22
23/* verdicts >0 are "branches" */
24#define EBT_ACCEPT -1
25#define EBT_DROP -2
26#define EBT_CONTINUE -3
27#define EBT_RETURN -4
28#define NUM_STANDARD_TARGETS 4
29/* ebtables target modules store the verdict inside an int. We can
30 * reclaim a part of this int for backwards compatible extensions.
31 * The 4 lsb are more than enough to store the verdict. */
32#define EBT_VERDICT_BITS 0x0000000F
33
34struct xt_match;
35struct xt_target;
36
37struct ebt_counter {
38 uint64_t pcnt;
39 uint64_t bcnt;
40};
41
42struct ebt_replace {
43 char name[EBT_TABLE_MAXNAMELEN];
44 unsigned int valid_hooks;
45 /* nr of rules in the table */
46 unsigned int nentries;
47 /* total size of the entries */
48 unsigned int entries_size;
49 /* start of the chains */
50 struct ebt_entries __user *hook_entry[NF_BR_NUMHOOKS];
51 /* nr of counters userspace expects back */
52 unsigned int num_counters;
53 /* where the kernel will put the old counters */
54 struct ebt_counter __user *counters;
55 char __user *entries;
56};
57
58struct ebt_replace_kernel {
59 char name[EBT_TABLE_MAXNAMELEN];
60 unsigned int valid_hooks;
61 /* nr of rules in the table */
62 unsigned int nentries;
63 /* total size of the entries */
64 unsigned int entries_size;
65 /* start of the chains */
66 struct ebt_entries *hook_entry[NF_BR_NUMHOOKS];
67 /* nr of counters userspace expects back */
68 unsigned int num_counters;
69 /* where the kernel will put the old counters */
70 struct ebt_counter *counters;
71 char *entries;
72};
73
74struct ebt_entries {
75 /* this field is always set to zero
76 * See EBT_ENTRY_OR_ENTRIES.
77 * Must be same size as ebt_entry.bitmask */
78 unsigned int distinguisher;
79 /* the chain name */
80 char name[EBT_CHAIN_MAXNAMELEN];
81 /* counter offset for this chain */
82 unsigned int counter_offset;
83 /* one standard (accept, drop, return) per hook */
84 int policy;
85 /* nr. of entries */
86 unsigned int nentries;
87 /* entry list */
88 char data[0] __attribute__ ((aligned (__alignof__(struct ebt_replace))));
89};
90
91/* used for the bitmask of struct ebt_entry */
92
93/* This is a hack to make a difference between an ebt_entry struct and an
94 * ebt_entries struct when traversing the entries from start to end.
95 * Using this simplifies the code a lot, while still being able to use
96 * ebt_entries.
97 * Contrary, iptables doesn't use something like ebt_entries and therefore uses
98 * different techniques for naming the policy and such. So, iptables doesn't
99 * need a hack like this.
100 */
101#define EBT_ENTRY_OR_ENTRIES 0x01
102/* these are the normal masks */
103#define EBT_NOPROTO 0x02
104#define EBT_802_3 0x04
105#define EBT_SOURCEMAC 0x08
106#define EBT_DESTMAC 0x10
107#define EBT_F_MASK (EBT_NOPROTO | EBT_802_3 | EBT_SOURCEMAC | EBT_DESTMAC \
108 | EBT_ENTRY_OR_ENTRIES)
109
110#define EBT_IPROTO 0x01
111#define EBT_IIN 0x02
112#define EBT_IOUT 0x04
113#define EBT_ISOURCE 0x8
114#define EBT_IDEST 0x10
115#define EBT_ILOGICALIN 0x20
116#define EBT_ILOGICALOUT 0x40
117#define EBT_INV_MASK (EBT_IPROTO | EBT_IIN | EBT_IOUT | EBT_ILOGICALIN \
118 | EBT_ILOGICALOUT | EBT_ISOURCE | EBT_IDEST)
119
120struct ebt_entry_match {
121 union {
122 char name[EBT_FUNCTION_MAXNAMELEN];
123 struct xt_match *match;
124 } u;
125 /* size of data */
126 unsigned int match_size;
127 unsigned char data[0] __attribute__ ((aligned (__alignof__(struct ebt_replace))));
128};
129
130struct ebt_entry_watcher {
131 union {
132 char name[EBT_FUNCTION_MAXNAMELEN];
133 struct xt_target *watcher;
134 } u;
135 /* size of data */
136 unsigned int watcher_size;
137 unsigned char data[0] __attribute__ ((aligned (__alignof__(struct ebt_replace))));
138};
139
140struct ebt_entry_target {
141 union {
142 char name[EBT_FUNCTION_MAXNAMELEN];
143 struct xt_target *target;
144 } u;
145 /* size of data */
146 unsigned int target_size;
147 unsigned char data[0] __attribute__ ((aligned (__alignof__(struct ebt_replace))));
148};
149
150#define EBT_STANDARD_TARGET "standard"
151struct ebt_standard_target {
152 struct ebt_entry_target target;
153 int verdict;
154};
155
156/* one entry */
157struct ebt_entry {
158 /* this needs to be the first field */
159 unsigned int bitmask;
160 unsigned int invflags;
161 __be16 ethproto;
162 /* the physical in-dev */
163 char in[IFNAMSIZ];
164 /* the logical in-dev */
165 char logical_in[IFNAMSIZ];
166 /* the physical out-dev */
167 char out[IFNAMSIZ];
168 /* the logical out-dev */
169 char logical_out[IFNAMSIZ];
170 unsigned char sourcemac[ETH_ALEN];
171 unsigned char sourcemsk[ETH_ALEN];
172 unsigned char destmac[ETH_ALEN];
173 unsigned char destmsk[ETH_ALEN];
174 /* sizeof ebt_entry + matches */
175 unsigned int watchers_offset;
176 /* sizeof ebt_entry + matches + watchers */
177 unsigned int target_offset;
178 /* sizeof ebt_entry + matches + watchers + target */
179 unsigned int next_offset;
180 unsigned char elems[0] __attribute__ ((aligned (__alignof__(struct ebt_replace))));
181};
182
183/* {g,s}etsockopt numbers */
184#define EBT_BASE_CTL 128
185
186#define EBT_SO_SET_ENTRIES (EBT_BASE_CTL)
187#define EBT_SO_SET_COUNTERS (EBT_SO_SET_ENTRIES+1)
188#define EBT_SO_SET_MAX (EBT_SO_SET_COUNTERS+1)
189
190#define EBT_SO_GET_INFO (EBT_BASE_CTL)
191#define EBT_SO_GET_ENTRIES (EBT_SO_GET_INFO+1)
192#define EBT_SO_GET_INIT_INFO (EBT_SO_GET_ENTRIES+1)
193#define EBT_SO_GET_INIT_ENTRIES (EBT_SO_GET_INIT_INFO+1)
194#define EBT_SO_GET_MAX (EBT_SO_GET_INIT_ENTRIES+1)
195
196
197/* blatently stolen from ip_tables.h
198 * fn returns 0 to continue iteration */
199#define EBT_MATCH_ITERATE(e, fn, args...) \
200({ \
201 unsigned int __i; \
202 int __ret = 0; \
203 struct ebt_entry_match *__match; \
204 \
205 for (__i = sizeof(struct ebt_entry); \
206 __i < (e)->watchers_offset; \
207 __i += __match->match_size + \
208 sizeof(struct ebt_entry_match)) { \
209 __match = (void *)(e) + __i; \
210 \
211 __ret = fn(__match , ## args); \
212 if (__ret != 0) \
213 break; \
214 } \
215 if (__ret == 0) { \
216 if (__i != (e)->watchers_offset) \
217 __ret = -EINVAL; \
218 } \
219 __ret; \
220})
221
222#define EBT_WATCHER_ITERATE(e, fn, args...) \
223({ \
224 unsigned int __i; \
225 int __ret = 0; \
226 struct ebt_entry_watcher *__watcher; \
227 \
228 for (__i = e->watchers_offset; \
229 __i < (e)->target_offset; \
230 __i += __watcher->watcher_size + \
231 sizeof(struct ebt_entry_watcher)) { \
232 __watcher = (void *)(e) + __i; \
233 \
234 __ret = fn(__watcher , ## args); \
235 if (__ret != 0) \
236 break; \
237 } \
238 if (__ret == 0) { \
239 if (__i != (e)->target_offset) \
240 __ret = -EINVAL; \
241 } \
242 __ret; \
243})
244
245#define EBT_ENTRY_ITERATE(entries, size, fn, args...) \
246({ \
247 unsigned int __i; \
248 int __ret = 0; \
249 struct ebt_entry *__entry; \
250 \
251 for (__i = 0; __i < (size);) { \
252 __entry = (void *)(entries) + __i; \
253 __ret = fn(__entry , ## args); \
254 if (__ret != 0) \
255 break; \
256 if (__entry->bitmask != 0) \
257 __i += __entry->next_offset; \
258 else \
259 __i += sizeof(struct ebt_entries); \
260 } \
261 if (__ret == 0) { \
262 if (__i != (size)) \
263 __ret = -EINVAL; \
264 } \
265 __ret; \
266})
267
268#endif /* _UAPI__LINUX_BRIDGE_EFF_H */
generated by cgit v1.2.2 (git 2.25.0) at 2026-01-20 06:42:42 -0500