1 /* 2 * ebtables 3 * 4 * Authors: 5 * Bart De Schuymer <bdschuym@pandora.be> 6 * 7 * ebtables.c,v 2.0, April, 2002 8 * 9 * This code is stongly inspired on the iptables code which is 10 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling 11 */ 12 #ifndef __LINUX_BRIDGE_EFF_H 13 #define __LINUX_BRIDGE_EFF_H 14 15 #include <uapi/linux/netfilter_bridge/ebtables.h> 16 17 18 /* return values for match() functions */ 19 #define EBT_MATCH 0 20 #define EBT_NOMATCH 1 21 22 struct ebt_match { 23 struct list_head list; 24 const char name[EBT_FUNCTION_MAXNAMELEN]; 25 bool (*match)(const struct sk_buff *skb, const struct net_device *in, 26 const struct net_device *out, const struct xt_match *match, 27 const void *matchinfo, int offset, unsigned int protoff, 28 bool *hotdrop); 29 bool (*checkentry)(const char *table, const void *entry, 30 const struct xt_match *match, void *matchinfo, 31 unsigned int hook_mask); 32 void (*destroy)(const struct xt_match *match, void *matchinfo); 33 unsigned int matchsize; 34 u_int8_t revision; 35 u_int8_t family; 36 struct module *me; 37 }; 38 39 struct ebt_watcher { 40 struct list_head list; 41 const char name[EBT_FUNCTION_MAXNAMELEN]; 42 unsigned int (*target)(struct sk_buff *skb, 43 const struct net_device *in, const struct net_device *out, 44 unsigned int hook_num, const struct xt_target *target, 45 const void *targinfo); 46 bool (*checkentry)(const char *table, const void *entry, 47 const struct xt_target *target, void *targinfo, 48 unsigned int hook_mask); 49 void (*destroy)(const struct xt_target *target, void *targinfo); 50 unsigned int targetsize; 51 u_int8_t revision; 52 u_int8_t family; 53 struct module *me; 54 }; 55 56 struct ebt_target { 57 struct list_head list; 58 const char name[EBT_FUNCTION_MAXNAMELEN]; 59 /* returns one of the standard EBT_* verdicts */ 60 unsigned int (*target)(struct sk_buff *skb, 61 const struct net_device *in, const struct net_device *out, 62 unsigned int hook_num, const struct xt_target *target, 63 const void *targinfo); 64 bool (*checkentry)(const char *table, const void *entry, 65 const struct xt_target *target, void *targinfo, 66 unsigned int hook_mask); 67 void (*destroy)(const struct xt_target *target, void *targinfo); 68 unsigned int targetsize; 69 u_int8_t revision; 70 u_int8_t family; 71 struct module *me; 72 }; 73 74 /* used for jumping from and into user defined chains (udc) */ 75 struct ebt_chainstack { 76 struct ebt_entries *chaininfo; /* pointer to chain data */ 77 struct ebt_entry *e; /* pointer to entry data */ 78 unsigned int n; /* n'th entry */ 79 }; 80 81 struct ebt_table_info { 82 /* total size of the entries */ 83 unsigned int entries_size; 84 unsigned int nentries; 85 /* pointers to the start of the chains */ 86 struct ebt_entries *hook_entry[NF_BR_NUMHOOKS]; 87 /* room to maintain the stack used for jumping from and into udc */ 88 struct ebt_chainstack **chainstack; 89 char *entries; 90 struct ebt_counter counters[0] ____cacheline_aligned; 91 }; 92 93 struct ebt_table { 94 struct list_head list; 95 char name[EBT_TABLE_MAXNAMELEN]; 96 struct ebt_replace_kernel *table; 97 unsigned int valid_hooks; 98 rwlock_t lock; 99 /* e.g. could be the table explicitly only allows certain 100 * matches, targets, ... 0 == let it in */ 101 int (*check)(const struct ebt_table_info *info, 102 unsigned int valid_hooks); 103 /* the data used by the kernel */ 104 struct ebt_table_info *private; 105 struct module *me; 106 }; 107 108 #define EBT_ALIGN(s) (((s) + (__alignof__(struct _xt_align)-1)) & \ 109 ~(__alignof__(struct _xt_align)-1)) 110 extern struct ebt_table *ebt_register_table(struct net *net, 111 const struct ebt_table *table); 112 extern void ebt_unregister_table(struct net *net, struct ebt_table *table); 113 extern unsigned int ebt_do_table(unsigned int hook, struct sk_buff *skb, 114 const struct net_device *in, const struct net_device *out, 115 struct ebt_table *table); 116 117 /* Used in the kernel match() functions */ 118 #define FWINV(bool,invflg) ((bool) ^ !!(info->invflags & invflg)) 119 /* True if the hook mask denotes that the rule is in a base chain, 120 * used in the check() functions */ 121 #define BASE_CHAIN (par->hook_mask & (1 << NF_BR_NUMHOOKS)) 122 /* Clear the bit in the hook mask that tells if the rule is on a base chain */ 123 #define CLEAR_BASE_CHAIN_BIT (par->hook_mask &= ~(1 << NF_BR_NUMHOOKS)) 124 /* True if the target is not a standard target */ 125 #define INVALID_TARGET (info->target < -NUM_STANDARD_TARGETS || info->target >= 0) 126 127 #endif 128