ip_tables.h

Revision 12400, 9.4 kB (checked in by BrainSlayer, 5 months ago)
more flexible EOC5610 partition layout, small performance increase by module remapping, lzma decoder speed improvements

Line
1	/*
2	* 25-Jul-1998 Major changes to allow for ip chain table
3	*
4	* 3-Jan-2000 Named tables to allow packet selection for different uses.
5	*/
6
7	/*
8	* Format of an IP firewall descriptor
9	*
10	* src, dst, src_mask, dst_mask are always stored in network byte order.
11	* flags are stored in host byte order (of course).
12	* Port numbers are stored in HOST byte order.
13	*/
14
15	#ifndef _IPTABLES_H
16	#define _IPTABLES_H
17
18	#ifdef __KERNEL__
19	#include <linux/if.h>
20	#include <linux/types.h>
21	#include <linux/in.h>
22	#include <linux/ip.h>
23	#include <linux/skbuff.h>
24	#endif
25	#include <linux/compiler.h>
26	#include <linux/netfilter_ipv4.h>
27
28	#include <linux/netfilter/x_tables.h>
29
30	#define IPT_FUNCTION_MAXNAMELEN XT_FUNCTION_MAXNAMELEN
31	#define IPT_TABLE_MAXNAMELEN XT_TABLE_MAXNAMELEN
32	#define ipt_match xt_match
33	#define ipt_target xt_target
34	#define ipt_table xt_table
35	#define ipt_get_revision xt_get_revision
36
37	/* Yes, Virginia, you have to zero the padding. */
38	struct ipt_ip {
39	/* Source and destination IP addr */
40	struct in_addr src, dst;
41	/* Mask for src and dest IP addr */
42	struct in_addr smsk, dmsk;
43	char iniface[IFNAMSIZ], outiface[IFNAMSIZ];
44	unsigned char iniface_mask[IFNAMSIZ], outiface_mask[IFNAMSIZ];
45
46	/* Protocol, 0 = ANY */
47	u_int16_t proto;
48
49	/* Flags word */
50	u_int8_t flags;
51	/* Inverse flags */
52	u_int8_t invflags;
53	};
54
55	#define ipt_entry_match xt_entry_match
56	#define ipt_entry_target xt_entry_target
57	#define ipt_standard_target xt_standard_target
58
59	#define ipt_counters xt_counters
60
61	/* Values for "flag" field in struct ipt_ip (general ip structure). */
62	#define IPT_F_FRAG 0x01 /* Set if rule is a fragment rule */
63	#define IPT_F_GOTO 0x02 /* Set if jump is a goto */
64	#define IPT_F_MASK 0x03 /* All possible flag bits mask. */
65	#define IPT_F_NO_DEF_MATCH 0x80 /* Internal: no default match rules present */
66
67	/* Values for "inv" field in struct ipt_ip. */
68	#define IPT_INV_VIA_IN 0x01 /* Invert the sense of IN IFACE. */
69	#define IPT_INV_VIA_OUT 0x02 /* Invert the sense of OUT IFACE */
70	#define IPT_INV_TOS 0x04 /* Invert the sense of TOS. */
71	#define IPT_INV_SRCIP 0x08 /* Invert the sense of SRC IP. */
72	#define IPT_INV_DSTIP 0x10 /* Invert the sense of DST OP. */
73	#define IPT_INV_FRAG 0x20 /* Invert the sense of FRAG. */
74	#define IPT_INV_PROTO XT_INV_PROTO
75	#define IPT_INV_MASK 0x7F /* All possible flag bits mask. */
76
77	/* This structure defines each of the firewall rules. Consists of 3
78	parts which are 1) general IP header stuff 2) match specific
79	stuff 3) the target to perform if the rule matches */
80	struct ipt_entry
81	{
82	struct ipt_ip ip;
83
84	/* Mark with fields that we care about. */
85	unsigned int nfcache;
86
87	/* Size of ipt_entry + matches */
88	u_int16_t target_offset;
89	/* Size of ipt_entry + matches + target */
90	u_int16_t next_offset;
91
92	/* Back pointer */
93	unsigned int comefrom;
94
95	/* Packet and byte counters. */
96	struct xt_counters counters;
97
98	/* The matches (if any), then the target. */
99	unsigned char elems[0];
100	};
101
102	/*
103	* New IP firewall options for [gs]etsockopt at the RAW IP level.
104	* Unlike BSD Linux inherits IP options so you don't have to use a raw
105	* socket for this. Instead we check rights in the calls.
106	*
107	* ATTENTION: check linux/in.h before adding new number here.
108	*/
109	#define IPT_BASE_CTL 64
110
111	#define IPT_SO_SET_REPLACE (IPT_BASE_CTL)
112	#define IPT_SO_SET_ADD_COUNTERS (IPT_BASE_CTL + 1)
113	#define IPT_SO_SET_MAX IPT_SO_SET_ADD_COUNTERS
114
115	#define IPT_SO_GET_INFO (IPT_BASE_CTL)
116	#define IPT_SO_GET_ENTRIES (IPT_BASE_CTL + 1)
117	#define IPT_SO_GET_REVISION_MATCH (IPT_BASE_CTL + 2)
118	#define IPT_SO_GET_REVISION_TARGET (IPT_BASE_CTL + 3)
119	#define IPT_SO_GET_MAX IPT_SO_GET_REVISION_TARGET
120
121	#define IPT_CONTINUE XT_CONTINUE
122	#define IPT_RETURN XT_RETURN
123
124	#include <linux/netfilter/xt_tcpudp.h>
125	#define ipt_udp xt_udp
126	#define ipt_tcp xt_tcp
127
128	#define IPT_TCP_INV_SRCPT XT_TCP_INV_SRCPT
129	#define IPT_TCP_INV_DSTPT XT_TCP_INV_DSTPT
130	#define IPT_TCP_INV_FLAGS XT_TCP_INV_FLAGS
131	#define IPT_TCP_INV_OPTION XT_TCP_INV_OPTION
132	#define IPT_TCP_INV_MASK XT_TCP_INV_MASK
133
134	#define IPT_UDP_INV_SRCPT XT_UDP_INV_SRCPT
135	#define IPT_UDP_INV_DSTPT XT_UDP_INV_DSTPT
136	#define IPT_UDP_INV_MASK XT_UDP_INV_MASK
137
138	/* ICMP matching stuff */
139	struct ipt_icmp
140	{
141	u_int8_t type; /* type to match */
142	u_int8_t code[2]; /* range of code */
143	u_int8_t invflags; /* Inverse flags */
144	};
145
146	/* Values for "inv" field for struct ipt_icmp. */
147	#define IPT_ICMP_INV 0x01 /* Invert the sense of type/code test */
148
149	/* The argument to IPT_SO_GET_INFO */
150	struct ipt_getinfo
151	{
152	/* Which table: caller fills this in. */
153	char name[IPT_TABLE_MAXNAMELEN];
154
155	/* Kernel fills these in. */
156	/* Which hook entry points are valid: bitmask */
157	unsigned int valid_hooks;
158
159	/* Hook entry points: one per netfilter hook. */
160	unsigned int hook_entry[NF_IP_NUMHOOKS];
161
162	/* Underflow points. */
163	unsigned int underflow[NF_IP_NUMHOOKS];
164
165	/* Number of entries */
166	unsigned int num_entries;
167
168	/* Size of entries. */
169	unsigned int size;
170	};
171
172	/* The argument to IPT_SO_SET_REPLACE. */
173	struct ipt_replace
174	{
175	/* Which table. */
176	char name[IPT_TABLE_MAXNAMELEN];
177
178	/* Which hook entry points are valid: bitmask. You can't
179	change this. */
180	unsigned int valid_hooks;
181
182	/* Number of entries */
183	unsigned int num_entries;
184
185	/* Total size of new entries */
186	unsigned int size;
187
188	/* Hook entry points. */
189	unsigned int hook_entry[NF_IP_NUMHOOKS];
190
191	/* Underflow points. */
192	unsigned int underflow[NF_IP_NUMHOOKS];
193
194	/* Information about old entries: */
195	/* Number of counters (must be equal to current number of entries). */
196	unsigned int num_counters;
197	/* The old entries' counters. */
198	struct xt_counters __user *counters;
199
200	/* The entries (hang off end: not really an array). */
201	struct ipt_entry entries[0];
202	};
203
204	/* The argument to IPT_SO_ADD_COUNTERS. */
205	#define ipt_counters_info xt_counters_info
206
207	/* The argument to IPT_SO_GET_ENTRIES. */
208	struct ipt_get_entries
209	{
210	/* Which table: user fills this in. */
211	char name[IPT_TABLE_MAXNAMELEN];
212
213	/* User fills this in: total entry size. */
214	unsigned int size;
215
216	/* The entries. */
217	struct ipt_entry entrytable[0];
218	};
219
220	/* Standard return verdict, or do jump. */
221	#define IPT_STANDARD_TARGET XT_STANDARD_TARGET
222	/* Error verdict. */
223	#define IPT_ERROR_TARGET XT_ERROR_TARGET
224
225	/* Helper functions */
226	static __inline__ struct ipt_entry_target *
227	ipt_get_target(struct ipt_entry *e)
228	{
229	return (void *)e + e->target_offset;
230	}
231
232	/* fn returns 0 to continue iteration */
233	#define IPT_MATCH_ITERATE(e, fn, args...) \
234	({ \
235	unsigned int __i; \
236	int __ret = 0; \
237	struct ipt_entry_match *__match; \
238	\
239	for (__i = sizeof(struct ipt_entry); \
240	__i < (e)->target_offset; \
241	__i += __match->u.match_size) { \
242	__match = (void *)(e) + __i; \
243	\
244	__ret = fn(__match , ## args); \
245	if (__ret != 0) \
246	break; \
247	} \
248	__ret; \
249	})
250
251	/* fn returns 0 to continue iteration */
252	#define IPT_ENTRY_ITERATE(entries, size, fn, args...) \
253	({ \
254	unsigned int __i; \
255	int __ret = 0; \
256	struct ipt_entry *__entry; \
257	\
258	for (__i = 0; __i < (size); __i += __entry->next_offset) { \
259	__entry = (void *)(entries) + __i; \
260	\
261	__ret = fn(__entry , ## args); \
262	if (__ret != 0) \
263	break; \
264	} \
265	__ret; \
266	})
267
268	/* fn returns 0 to continue iteration */
269	#define IPT_ENTRY_ITERATE_CONTINUE(entries, size, n, fn, args...) \
270	({ \
271	unsigned int __i, __n; \
272	int __ret = 0; \
273	struct ipt_entry *__entry; \
274	\
275	for (__i = 0, __n = 0; __i < (size); \
276	__i += __entry->next_offset, __n++) { \
277	__entry = (void *)(entries) + __i; \
278	if (__n < n) \
279	continue; \
280	\
281	__ret = fn(__entry , ## args); \
282	if (__ret != 0) \
283	break; \
284	} \
285	__ret; \
286	})
287
288	/*
289	* Main firewall chains definitions and global var's definitions.
290	*/
291	#ifdef __KERNEL__
292
293	#include <linux/init.h>
294	extern void ipt_init(void) __init;
295
296	extern int ipt_register_table(struct xt_table *table,
297	const struct ipt_replace *repl);
298	extern void ipt_unregister_table(struct xt_table *table);
299
300	/* Standard entry. */
301	struct ipt_standard
302	{
303	struct ipt_entry entry;
304	struct ipt_standard_target target;
305	};
306
307	struct ipt_error_target
308	{
309	struct ipt_entry_target target;
310	char errorname[IPT_FUNCTION_MAXNAMELEN];
311	};
312
313	struct ipt_error
314	{
315	struct ipt_entry entry;
316	struct ipt_error_target target;
317	};
318
319	#define IPT_ENTRY_INIT(__size) \
320	{ \
321	.target_offset = sizeof(struct ipt_entry), \
322	.next_offset = (__size), \
323	}
324
325	#define IPT_STANDARD_INIT(__verdict) \
326	{ \
327	.entry = IPT_ENTRY_INIT(sizeof(struct ipt_standard)), \
328	.target = XT_TARGET_INIT(IPT_STANDARD_TARGET, \
329	sizeof(struct xt_standard_target)), \
330	.target.verdict = -(__verdict) - 1, \
331	}
332
333	#define IPT_ERROR_INIT \
334	{ \
335	.entry = IPT_ENTRY_INIT(sizeof(struct ipt_error)), \
336	.target = XT_TARGET_INIT(IPT_ERROR_TARGET, \
337	sizeof(struct ipt_error_target)), \
338	.target.errorname = "ERROR", \
339	}
340
341	extern unsigned int ipt_do_table(struct sk_buff **pskb,
342	unsigned int hook,
343	const struct net_device *in,
344	const struct net_device *out,
345	struct xt_table *table);
346
347	#define IPT_ALIGN(s) XT_ALIGN(s)
348
349	#ifdef CONFIG_COMPAT
350	#include <net/compat.h>
351
352	struct compat_ipt_entry
353	{
354	struct ipt_ip ip;
355	compat_uint_t nfcache;
356	u_int16_t target_offset;
357	u_int16_t next_offset;
358	compat_uint_t comefrom;
359	struct compat_xt_counters counters;
360	unsigned char elems[0];
361	};
362
363	#define COMPAT_IPT_ALIGN(s) COMPAT_XT_ALIGN(s)
364
365	#endif /* CONFIG_COMPAT */
366	#endif /__KERNEL__/
367	#endif /* _IPTABLES_H */

Note: See TracBrowser for help on using the browser.

root/src/linux/ar531x/linux-2.6.23/include/linux/netfilter_ipv4/ip_tables.h

Download in other formats: