1/* 2 * ebtables 3 * 4 * Authors: 5 * Bart De Schuymer <bdschuym@pandora.be> 6 * 7 * ebtables.c,v 2.0, April, 2002 8 * 9 * This code is stongly inspired on the iptables code which is 10 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling 11 */ 12#ifndef __LINUX_BRIDGE_EFF_H 13#define __LINUX_BRIDGE_EFF_H 14 15#include <uapi/linux/netfilter_bridge/ebtables.h> 16 17 18/* return values for match() functions */ 19#define EBT_MATCH 0 20#define EBT_NOMATCH 1 21 22struct ebt_match { 23 struct list_head list; 24 const char name[EBT_FUNCTION_MAXNAMELEN]; 25 bool (*match)(const struct sk_buff *skb, const struct net_device *in, 26 const struct net_device *out, const struct xt_match *match, 27 const void *matchinfo, int offset, unsigned int protoff, 28 bool *hotdrop); 29 bool (*checkentry)(const char *table, const void *entry, 30 const struct xt_match *match, void *matchinfo, 31 unsigned int hook_mask); 32 void (*destroy)(const struct xt_match *match, void *matchinfo); 33 unsigned int matchsize; 34 u_int8_t revision; 35 u_int8_t family; 36 struct module *me; 37}; 38 39struct ebt_watcher { 40 struct list_head list; 41 const char name[EBT_FUNCTION_MAXNAMELEN]; 42 unsigned int (*target)(struct sk_buff *skb, 43 const struct net_device *in, const struct net_device *out, 44 unsigned int hook_num, const struct xt_target *target, 45 const void *targinfo); 46 bool (*checkentry)(const char *table, const void *entry, 47 const struct xt_target *target, void *targinfo, 48 unsigned int hook_mask); 49 void (*destroy)(const struct xt_target *target, void *targinfo); 50 unsigned int targetsize; 51 u_int8_t revision; 52 u_int8_t family; 53 struct module *me; 54}; 55 56struct ebt_target { 57 struct list_head list; 58 const char name[EBT_FUNCTION_MAXNAMELEN]; 59 /* returns one of the standard EBT_* verdicts */ 60 unsigned int (*target)(struct sk_buff *skb, 61 const struct net_device *in, const struct net_device *out, 62 unsigned int hook_num, const struct xt_target *target, 63 const void *targinfo); 64 bool (*checkentry)(const char *table, const void *entry, 65 const struct xt_target *target, void *targinfo, 66 unsigned int hook_mask); 67 void (*destroy)(const struct xt_target *target, void *targinfo); 68 unsigned int targetsize; 69 u_int8_t revision; 70 u_int8_t family; 71 struct module *me; 72}; 73 74/* used for jumping from and into user defined chains (udc) */ 75struct ebt_chainstack { 76 struct ebt_entries *chaininfo; /* pointer to chain data */ 77 struct ebt_entry *e; /* pointer to entry data */ 78 unsigned int n; /* n'th entry */ 79}; 80 81struct ebt_table_info { 82 /* total size of the entries */ 83 unsigned int entries_size; 84 unsigned int nentries; 85 /* pointers to the start of the chains */ 86 struct ebt_entries *hook_entry[NF_BR_NUMHOOKS]; 87 /* room to maintain the stack used for jumping from and into udc */ 88 struct ebt_chainstack **chainstack; 89 char *entries; 90 struct ebt_counter counters[0] ____cacheline_aligned; 91}; 92 93struct ebt_table { 94 struct list_head list; 95 char name[EBT_TABLE_MAXNAMELEN]; 96 struct ebt_replace_kernel *table; 97 unsigned int valid_hooks; 98 rwlock_t lock; 99 /* e.g. could be the table explicitly only allows certain 100 * matches, targets, ... 0 == let it in */ 101 int (*check)(const struct ebt_table_info *info, 102 unsigned int valid_hooks); 103 /* the data used by the kernel */ 104 struct ebt_table_info *private; 105 struct module *me; 106}; 107 108#define EBT_ALIGN(s) (((s) + (__alignof__(struct _xt_align)-1)) & \ 109 ~(__alignof__(struct _xt_align)-1)) 110extern struct ebt_table *ebt_register_table(struct net *net, 111 const struct ebt_table *table); 112extern void ebt_unregister_table(struct net *net, struct ebt_table *table); 113extern unsigned int ebt_do_table(unsigned int hook, struct sk_buff *skb, 114 const struct net_device *in, const struct net_device *out, 115 struct ebt_table *table); 116 117/* Used in the kernel match() functions */ 118#define FWINV(bool,invflg) ((bool) ^ !!(info->invflags & invflg)) 119/* True if the hook mask denotes that the rule is in a base chain, 120 * used in the check() functions */ 121#define BASE_CHAIN (par->hook_mask & (1 << NF_BR_NUMHOOKS)) 122/* Clear the bit in the hook mask that tells if the rule is on a base chain */ 123#define CLEAR_BASE_CHAIN_BIT (par->hook_mask &= ~(1 << NF_BR_NUMHOOKS)) 124/* True if the target is not a standard target */ 125#define INVALID_TARGET (info->target < -NUM_STANDARD_TARGETS || info->target >= 0) 126 127#endif 128