Skip to content

GitLab

Commit 615f9fca authored by Arturo Borrero Gonzalez's avatar Arturo Borrero Gonzalez
Browse files

Imported Upstream version 1.6.0

parent 7e95a8db
Show whitespace changes
Inline Side-by-side
extensions/libxt_ipcomp.c.man 0 → 100644
View file @ 615f9fca
This module matches the parameters in IPcomp header of IPsec packets.
.TP
[\fB!\fP] \fB\-\-ipcompspi\fP \fIspi\fP[\fB:\fP\fIspi\fP]
Matches IPcomp header CPI value.
.TP
\fB\-\-compres\fP
Matches if the reserved field is filled with zero.
extensions/libxt_mangle.c 0 → 100644
View file @ 615f9fca
/*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published
* by the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* Authors:
* Libarptc code from: Bart De Schuymer <bdschuym@pandora.be>
* Port to libxtables: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
*/
#include <stdio.h>
#include <netdb.h>
#include <string.h>
#include <stdlib.h>
#include <limits.h>
#include <getopt.h>
#include <errno.h>
#include <netinet/ether.h>
#include <xtables.h>
#include <linux/netfilter_arp/arpt_mangle.h>
static void mangle_help(void)
{
printf(
"mangle target options:\n"
"--mangle-ip-s IP address\n"
"--mangle-ip-d IP address\n"
"--mangle-mac-s MAC address\n"
"--mangle-mac-d MAC address\n"
"--mangle-target target (DROP, CONTINUE or ACCEPT -- default is ACCEPT)\n"
);
}
enum {
MANGLE_IPS = 0,
MANGLE_IPT = 1,
MANGLE_DEVS = 2,
MANGLE_DEVT = 3,
MANGLE_TARGET = 4,
};
static const struct xt_option_entry mangle_opts[] = {
{ .name = "mangle-ip-s", .id = MANGLE_IPS, .type = XTTYPE_STRING },
{ .name = "mangle-ip-d", .id = MANGLE_IPT, .type = XTTYPE_STRING },
{ .name = "mangle-mac-s", .id = MANGLE_DEVS, .type = XTTYPE_STRING },
{ .name = "mangle-mac-d", .id = MANGLE_DEVT, .type = XTTYPE_STRING },
{ .name = "mangle-target", .id = MANGLE_TARGET,
.type = XTTYPE_STRING },
XTOPT_TABLEEND,
};
static struct in_addr *network_to_addr(const char *name)
{
struct netent *net;
static struct in_addr addr;
if ((net = getnetbyname(name)) != NULL) {
if (net->n_addrtype != AF_INET)
return (struct in_addr *) NULL;
addr.s_addr = htonl((unsigned long) net->n_net);
return &addr;
}
return (struct in_addr *) NULL;
}
static void inaddrcpy(struct in_addr *dst, struct in_addr *src)
{
dst->s_addr = src->s_addr;
}
static struct in_addr *host_to_addr(const char *name, unsigned int *naddr)
{
struct hostent *host;
struct in_addr *addr;
unsigned int i;
*naddr = 0;
if ((host = gethostbyname(name)) != NULL) {
if (host->h_addrtype != AF_INET ||
host->h_length != sizeof(struct in_addr))
return (struct in_addr *) NULL;
while (host->h_addr_list[*naddr] != (char *) NULL)
(*naddr)++;
addr = xtables_calloc(*naddr, sizeof(struct in_addr));
for (i = 0; i < *naddr; i++)
inaddrcpy(&(addr[i]),
(struct in_addr *) host->h_addr_list[i]);
return addr;
}
return (struct in_addr *) NULL;
}
static int string_to_number(const char *s, unsigned int min,
unsigned int max, unsigned int *ret)
{
long number;
char *end;
/* Handle hex, octal, etc. */
errno = 0;
number = strtol(s, &end, 0);
if (*end == '\0' && end != s) {
/* we parsed a number, let's see if we want this */
if (errno != ERANGE && min <= number && number <= max) {
*ret = number;
return 0;
}
}
return -1;
}
static struct in_addr *dotted_to_addr(const char *dotted)
{
static struct in_addr addr;
unsigned char *addrp;
char *p, *q;
unsigned int onebyte;
int i;
char buf[20];
/* copy dotted string, because we need to modify it */
strncpy(buf, dotted, sizeof(buf) - 1);
addrp = (unsigned char *) &(addr.s_addr);
p = buf;
for (i = 0; i < 3; i++) {
if ((q = strchr(p, '.')) == NULL)
return (struct in_addr *) NULL;
*q = '\0';
if (string_to_number(p, 0, 255, &onebyte) == -1)
return (struct in_addr *) NULL;
addrp[i] = (unsigned char) onebyte;
p = q + 1;
}
/* we've checked 3 bytes, now we check the last one */
if (string_to_number(p, 0, 255, &onebyte) == -1)
return (struct in_addr *) NULL;
addrp[3] = (unsigned char) onebyte;
return &addr;
}
static struct in_addr *parse_hostnetwork(const char *name,
unsigned int *naddrs)
{
struct in_addr *addrp, *addrptmp;
if ((addrptmp = dotted_to_addr(name)) != NULL ||
(addrptmp = network_to_addr(name)) != NULL) {
addrp = xtables_malloc(sizeof(struct in_addr));
inaddrcpy(addrp, addrptmp);
*naddrs = 1;
return addrp;
}
if ((addrp = host_to_addr(name, naddrs)) != NULL)
return addrp;
xtables_error(PARAMETER_PROBLEM, "host/network `%s' not found", name);
}
static void mangle_parse(struct xt_option_call *cb)
{
const struct arpt_entry *e = cb->xt_entry;
struct arpt_mangle *mangle = cb->data;
struct in_addr *ipaddr;
struct ether_addr *macaddr;
/* mangle target is by default "ACCEPT". Setting it here,
* since original arpt_mangle.c init() no longer exists*/
mangle->target = NF_ACCEPT;
xtables_option_parse(cb);
switch (cb->entry->id) {
case MANGLE_IPS:
/*
if (e->arp.arpln_mask == 0)
xtables_error(PARAMETER_PROBLEM, "no pln defined");
if (e->arp.invflags & ARPT_INV_ARPPLN)
xtables_error(PARAMETER_PROBLEM,
"! pln not allowed for --mangle-ip-s");
*/
/*
if (e->arp.arpln != 4)
xtables_error(PARAMETER_PROBLEM, "only pln=4 supported");
*/
{
unsigned int nr;
ipaddr = parse_hostnetwork(cb->arg, &nr);
}
mangle->u_s.src_ip.s_addr = ipaddr->s_addr;
free(ipaddr);
mangle->flags |= ARPT_MANGLE_SIP;
break;
case MANGLE_IPT:
/*
if (e->arp.arpln_mask == 0)
xtables_error(PARAMETER_PROBLEM, "no pln defined");
if (e->arp.invflags & ARPT_INV_ARPPLN)
xtables_error(PARAMETER_PROBLEM,
"! pln not allowed for --mangle-ip-d");
*/
/*
if (e->arp.arpln != 4)
xtables_error(PARAMETER_PROBLEM, "only pln=4 supported");
*/
{
unsigned int nr;
ipaddr = parse_hostnetwork(cb->arg, &nr);
}
mangle->u_t.tgt_ip.s_addr = ipaddr->s_addr;
free(ipaddr);
mangle->flags |= ARPT_MANGLE_TIP;
break;
case MANGLE_DEVS:
if (e->arp.arhln_mask == 0)
xtables_error(PARAMETER_PROBLEM,
"no --h-length defined");
if (e->arp.invflags & ARPT_INV_ARPHLN)
xtables_error(PARAMETER_PROBLEM,
"! --h-length not allowed for "
"--mangle-mac-s");
if (e->arp.arhln != 6)
xtables_error(PARAMETER_PROBLEM,
"only --h-length 6 supported");
macaddr = ether_aton(cb->arg);
if (macaddr == NULL)
xtables_error(PARAMETER_PROBLEM, "invalid source MAC");
memcpy(mangle->src_devaddr, macaddr, e->arp.arhln);
mangle->flags |= ARPT_MANGLE_SDEV;
break;
case MANGLE_DEVT:
if (e->arp.arhln_mask == 0)
xtables_error(PARAMETER_PROBLEM,
"no --h-length defined");
if (e->arp.invflags & ARPT_INV_ARPHLN)
xtables_error(PARAMETER_PROBLEM,
"! hln not allowed for --mangle-mac-d");
if (e->arp.arhln != 6)
xtables_error(PARAMETER_PROBLEM,
"only --h-length 6 supported");
macaddr = ether_aton(cb->arg);
if (macaddr == NULL)
xtables_error(PARAMETER_PROBLEM, "invalid target MAC");
memcpy(mangle->tgt_devaddr, macaddr, e->arp.arhln);
mangle->flags |= ARPT_MANGLE_TDEV;
break;
case MANGLE_TARGET:
if (!strcmp(cb->arg, "DROP"))
mangle->target = NF_DROP;
else if (!strcmp(cb->arg, "ACCEPT"))
mangle->target = NF_ACCEPT;
else if (!strcmp(cb->arg, "CONTINUE"))
mangle->target = ARPT_CONTINUE;
else
xtables_error(PARAMETER_PROBLEM,
"bad target for --mangle-target");
break;
}
}
static void mangle_fcheck(struct xt_fcheck_call *cb)
{
}
static char *addr_to_dotted(const struct in_addr *addrp)
{
static char buf[20];
const unsigned char *bytep;
bytep = (const unsigned char *) &(addrp->s_addr);
sprintf(buf, "%d.%d.%d.%d", bytep[0], bytep[1], bytep[2], bytep[3]);
return buf;
}
static char *addr_to_host(const struct in_addr *addr)
{
struct hostent *host;
if ((host = gethostbyaddr((char *) addr,
sizeof(struct in_addr), AF_INET)) != NULL)
return (char *) host->h_name;
return (char *) NULL;
}
static char *addr_to_network(const struct in_addr *addr)
{
struct netent *net;
if ((net = getnetbyaddr((long) ntohl(addr->s_addr), AF_INET)) != NULL)
return (char *) net->n_name;
return (char *) NULL;
}
static char *addr_to_anyname(const struct in_addr *addr)
{
char *name;
if ((name = addr_to_host(addr)) != NULL ||
(name = addr_to_network(addr)) != NULL)
return name;
return addr_to_dotted(addr);
}
static void print_mac(const unsigned char *mac, int l)
{
int j;
for (j = 0; j < l; j++)
printf("%02x%s", mac[j],
(j==l-1) ? "" : ":");
}
static void mangle_print(const void *ip, const struct xt_entry_target *target,
int numeric)
{
const struct arpt_mangle *m = (const void *)target;
char buf[100];
if (m->flags & ARPT_MANGLE_SIP) {
if (numeric)
sprintf(buf, "%s", addr_to_dotted(&(m->u_s.src_ip)));
else
sprintf(buf, "%s", addr_to_anyname(&(m->u_s.src_ip)));
printf("--mangle-ip-s %s ", buf);
}
if (m->flags & ARPT_MANGLE_SDEV) {
printf("--mangle-mac-s ");
print_mac((unsigned char *)m->src_devaddr, 6);
printf(" ");
}
if (m->flags & ARPT_MANGLE_TIP) {
if (numeric)
sprintf(buf, "%s", addr_to_dotted(&(m->u_t.tgt_ip)));
else
sprintf(buf, "%s", addr_to_anyname(&(m->u_t.tgt_ip)));
printf("--mangle-ip-d %s ", buf);
}
if (m->flags & ARPT_MANGLE_TDEV) {
printf("--mangle-mac-d ");
print_mac((unsigned char *)m->tgt_devaddr, 6);
printf(" ");
}
if (m->target != NF_ACCEPT) {
printf("--mangle-target ");
if (m->target == NF_DROP)
printf("DROP ");
else
printf("CONTINUE ");
}
}
static void mangle_save(const void *ip, const struct xt_entry_target *target)
{
}
static struct xtables_target mangle_tg_reg = {
.family = NFPROTO_ARP,
.name = "mangle",
.version = XTABLES_VERSION,
.size = XT_ALIGN(sizeof(struct arpt_mangle)),
.userspacesize = XT_ALIGN(sizeof(struct arpt_mangle)),
.help = mangle_help,
.x6_parse = mangle_parse,
.x6_fcheck = mangle_fcheck,
.print = mangle_print,
.save = mangle_save,
.x6_options = mangle_opts,
};
void _init(void)
{
xtables_register_target(&mangle_tg_reg);
}
extensions/libxt_osf.c
View file @ 615f9fca
......@@ -14,7 +14,7 @@
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
/*
......
extensions/libxt_physdev.man
View file @ 615f9fca
......@@ -15,21 +15,13 @@ interface which begins with this name will match. If the packet didn't arrive
through a bridge device, this packet won't match this option, unless '!' is used.
.TP
[\fB!\fP] \fB\-\-physdev\-out\fP \fIname\fP
Name of a bridge port via which a packet is going to be sent (for packets
Name of a bridge port via which a packet is going to be sent (for bridged packets
entering the
.BR FORWARD ,
.B OUTPUT
.BR FORWARD
and
.B POSTROUTING
chains). If the interface name ends in a "+", then any
interface which begins with this name will match. Note that in the
.BR nat " and " mangle
.B OUTPUT
chains one cannot match on the bridge output port, however one can in the
.B "filter OUTPUT"
chain. If the packet won't leave by a bridge device or if it is yet unknown what
the output device will be, then the packet won't match this option,
unless '!' is used.
interface which begins with this name will match.
.TP
[\fB!\fP] \fB\-\-physdev\-is\-in\fP
Matches if the packet has entered through a bridge interface.
......
extensions/libxt_quota.c
View file @ 615f9fca
......@@ -37,7 +37,7 @@ quota_save(const void *ip, const struct xt_entry_match *match)
const struct xt_quota_info *q = (const void *)match->data;
if (q->flags & XT_QUOTA_INVERT)
printf("! ");
printf(" !");
printf(" --quota %llu", (unsigned long long) q->quota);
}
......
extensions/libxt_set.c
View file @ 615f9fca
......@@ -446,7 +446,7 @@ set_parse_v3(int c, char **argv, int invert, unsigned int *flags,
}
static void
set_printv3_counter(const struct ip_set_counter_match *c, const char *name,
set_printv3_counter(const struct ip_set_counter_match0 *c, const char *name,
const char *sep)
{
switch (c->op) {
......@@ -497,6 +497,174 @@ set_save_v3(const void *ip, const struct xt_entry_match *match)
set_print_v3_matchinfo(info, "--match-set", "--");
}
/* Revision 4 */
static int
set_parse_v4(int c, char **argv, int invert, unsigned int *flags,
const void *entry, struct xt_entry_match **match)
{
struct xt_set_info_match_v4 *info =
(struct xt_set_info_match_v4 *) (*match)->data;
switch (c) {
case 'a':
if (invert)
info->flags |= IPSET_FLAG_SKIP_SUBCOUNTER_UPDATE;
break;
case '0':
if (info->bytes.op != IPSET_COUNTER_NONE)
xtables_error(PARAMETER_PROBLEM,
"only one of the --bytes-[eq|lt|gt]"
" is allowed\n");
if (invert)
xtables_error(PARAMETER_PROBLEM,
"--bytes-gt option cannot be inverted\n");
info->bytes.op = IPSET_COUNTER_GT;
info->bytes.value = parse_counter(optarg);
break;
case '9':
if (info->bytes.op != IPSET_COUNTER_NONE)
xtables_error(PARAMETER_PROBLEM,
"only one of the --bytes-[eq|lt|gt]"
" is allowed\n");
if (invert)
xtables_error(PARAMETER_PROBLEM,
"--bytes-lt option cannot be inverted\n");
info->bytes.op = IPSET_COUNTER_LT;
info->bytes.value = parse_counter(optarg);
break;
case '8':
if (info->bytes.op != IPSET_COUNTER_NONE)
xtables_error(PARAMETER_PROBLEM,
"only one of the --bytes-[eq|lt|gt]"
" is allowed\n");
info->bytes.op = invert ? IPSET_COUNTER_NE : IPSET_COUNTER_EQ;
info->bytes.value = parse_counter(optarg);
break;
case '7':
if (info->packets.op != IPSET_COUNTER_NONE)
xtables_error(PARAMETER_PROBLEM,
"only one of the --packets-[eq|lt|gt]"
" is allowed\n");
if (invert)
xtables_error(PARAMETER_PROBLEM,
"--packets-gt option cannot be inverted\n");
info->packets.op = IPSET_COUNTER_GT;
info->packets.value = parse_counter(optarg);
break;
case '6':
if (info->packets.op != IPSET_COUNTER_NONE)
xtables_error(PARAMETER_PROBLEM,
"only one of the --packets-[eq|lt|gt]"
" is allowed\n");
if (invert)
xtables_error(PARAMETER_PROBLEM,
"--packets-lt option cannot be inverted\n");
info->packets.op = IPSET_COUNTER_LT;
info->packets.value = parse_counter(optarg);
break;
case '5':
if (info->packets.op != IPSET_COUNTER_NONE)
xtables_error(PARAMETER_PROBLEM,
"only one of the --packets-[eq|lt|gt]"
" is allowed\n");
info->packets.op = invert ? IPSET_COUNTER_NE : IPSET_COUNTER_EQ;
info->packets.value = parse_counter(optarg);
break;
case '4':
if (invert)
info->flags |= IPSET_FLAG_SKIP_COUNTER_UPDATE;
break;
case '3':
if (invert)
xtables_error(PARAMETER_PROBLEM,
"--return-nomatch flag cannot be inverted\n");
info->flags |= IPSET_FLAG_RETURN_NOMATCH;
break;
case '2':
fprintf(stderr,
"--set option deprecated, please use --match-set\n");
case '1': /* --match-set <set> <flag>[,<flag> */
if (info->match_set.dim)
xtables_error(PARAMETER_PROBLEM,
"--match-set can be specified only once");
if (invert)
info->match_set.flags |= IPSET_INV_MATCH;
if (!argv[optind]
|| argv[optind][0] == '-'
|| argv[optind][0] == '!')
xtables_error(PARAMETER_PROBLEM,
"--match-set requires two args.");
if (strlen(optarg) > IPSET_MAXNAMELEN - 1)
xtables_error(PARAMETER_PROBLEM,
"setname `%s' too long, max %d characters.",
optarg, IPSET_MAXNAMELEN - 1);
get_set_byname(optarg, &info->match_set);
parse_dirs(argv[optind], &info->match_set);
DEBUGP("parse: set index %u\n", info->match_set.index);
optind++;
*flags = 1;
break;
}
return 1;
}
static void
set_printv4_counter(const struct ip_set_counter_match *c, const char *name,
const char *sep)
{
switch (c->op) {
case IPSET_COUNTER_EQ:
printf(" %s%s-eq %llu", sep, name, c->value);
break;
case IPSET_COUNTER_NE:
printf(" ! %s%s-eq %llu", sep, name, c->value);
break;
case IPSET_COUNTER_LT:
printf(" %s%s-lt %llu", sep, name, c->value);
break;
case IPSET_COUNTER_GT:
printf(" %s%s-gt %llu", sep, name, c->value);
break;
}
}
static void
set_print_v4_matchinfo(const struct xt_set_info_match_v4 *info,
const char *opt, const char *sep)
{
print_match(opt, &info->match_set);
if (info->flags & IPSET_FLAG_RETURN_NOMATCH)
printf(" %sreturn-nomatch", sep);
if ((info->flags & IPSET_FLAG_SKIP_COUNTER_UPDATE))
printf(" ! %supdate-counters", sep);
if ((info->flags & IPSET_FLAG_SKIP_SUBCOUNTER_UPDATE))
printf(" ! %supdate-subcounters", sep);
set_printv4_counter(&info->packets, "packets", sep);
set_printv4_counter(&info->bytes, "bytes", sep);
}
/* Prints out the matchinfo. */
static void
set_print_v4(const void *ip, const struct xt_entry_match *match, int numeric)
{
const struct xt_set_info_match_v4 *info = (const void *)match->data;
set_print_v4_matchinfo(info, "match-set", "");
}
static void
set_save_v4(const void *ip, const struct xt_entry_match *match)
{
const struct xt_set_info_match_v4 *info = (const void *)match->data;
set_print_v4_matchinfo(info, "--match-set", "--");
}
static struct xtables_match set_mt_reg[] = {
{
.name = "set",
......@@ -554,6 +722,20 @@ static struct xtables_match set_mt_reg[] = {
.save = set_save_v3,
.extra_opts = set_opts_v3,
},
{
.name = "set",
.revision = 4,
.version = XTABLES_VERSION,
.family = NFPROTO_UNSPEC,
.size = XT_ALIGN(sizeof(struct xt_set_info_match_v4)),
.userspacesize = XT_ALIGN(sizeof(struct xt_set_info_match_v4)),
.help = set_help_v3,
.parse = set_parse_v4,
.final_check = set_check_v0,
.print = set_print_v4,
.save = set_save_v4,
.extra_opts = set_opts_v3,
},
};
void _init(void)
......
extensions/libxt_set.man
View file @ 615f9fca
......@@ -43,7 +43,7 @@ packet counter of the element is less than the given value as well.
If the packet is matched an element in the set, match only if the
packet counter of the element is greater than the given value as well.
.TP
[\fB!\fP] \fB\-bytes\-eq\fP \fIvalue\fP
[\fB!\fP] \fB\-\-bytes\-eq\fP \fIvalue\fP
If the packet is matched an element in the set, match only if the
byte counter of the element matches the given value too.
.TP
......
extensions/libxt_socket.c
View file @ 615f9fca
......@@ -10,6 +10,7 @@
enum {
O_TRANSPARENT = 0,
O_NOWILDCARD = 1,
O_RESTORESKMARK = 2,
};
static const struct xt_option_entry socket_mt_opts[] = {
......@@ -23,6 +24,13 @@ static const struct xt_option_entry socket_mt_opts_v2[] = {
XTOPT_TABLEEND,
};
static const struct xt_option_entry socket_mt_opts_v3[] = {
{.name = "transparent", .id = O_TRANSPARENT, .type = XTTYPE_NONE},
{.name = "nowildcard", .id = O_NOWILDCARD, .type = XTTYPE_NONE},
{.name = "restore-skmark", .id = O_RESTORESKMARK, .type = XTTYPE_NONE},
XTOPT_TABLEEND,
};
static void socket_mt_help(void)
{
printf(
......@@ -38,6 +46,17 @@ static void socket_mt_help_v2(void)
" --transparent Ignore non-transparent sockets\n\n");
}
static void socket_mt_help_v3(void)
{
printf(
"socket match options:\n"
" --nowildcard Do not ignore LISTEN sockets bound on INADDR_ANY\n"
" --transparent Ignore non-transparent sockets\n"
" --restore-skmark Set the packet mark to the socket mark if\n"
" the socket matches and transparent / \n"
" nowildcard conditions are satisfied\n\n");
}
static void socket_mt_parse(struct xt_option_call *cb)
{
struct xt_socket_mtinfo1 *info = cb->data;
......@@ -65,6 +84,24 @@ static void socket_mt_parse_v2(struct xt_option_call *cb)
}
}
static void socket_mt_parse_v3(struct xt_option_call *cb)
{
struct xt_socket_mtinfo2 *info = cb->data;
xtables_option_parse(cb);
switch (cb->entry->id) {
case O_TRANSPARENT:
info->flags |= XT_SOCKET_TRANSPARENT;
break;
case O_NOWILDCARD:
info->flags |= XT_SOCKET_NOWILDCARD;
break;
case O_RESTORESKMARK:
info->flags |= XT_SOCKET_RESTORESKMARK;
break;
}
}
static void
socket_mt_save(const void *ip, const struct xt_entry_match *match)
{
......@@ -101,6 +138,27 @@ socket_mt_print_v2(const void *ip, const struct xt_entry_match *match,
socket_mt_save_v2(ip, match);
}
static void
socket_mt_save_v3(const void *ip, const struct xt_entry_match *match)
{
const struct xt_socket_mtinfo3 *info = (const void *)match->data;
if (info->flags & XT_SOCKET_TRANSPARENT)
printf(" --transparent");
if (info->flags & XT_SOCKET_NOWILDCARD)
printf(" --nowildcard");
if (info->flags & XT_SOCKET_RESTORESKMARK)
printf(" --restore-skmark");
}
static void
socket_mt_print_v3(const void *ip, const struct xt_entry_match *match,
int numeric)
{
printf(" socket");
socket_mt_save_v3(ip, match);
}
static struct xtables_match socket_mt_reg[] = {
{
.name = "socket",
......@@ -136,6 +194,19 @@ static struct xtables_match socket_mt_reg[] = {
.x6_parse = socket_mt_parse_v2,
.x6_options = socket_mt_opts_v2,
},
{
.name = "socket",
.revision = 3,
.family = NFPROTO_UNSPEC,
.version = XTABLES_VERSION,
.size = XT_ALIGN(sizeof(struct xt_socket_mtinfo2)),
.userspacesize = XT_ALIGN(sizeof(struct xt_socket_mtinfo2)),
.help = socket_mt_help_v3,
.print = socket_mt_print_v3,
.save = socket_mt_save_v3,
.x6_parse = socket_mt_parse_v3,
.x6_options = socket_mt_opts_v3,
},
};
void _init(void)
......
extensions/libxt_socket.man
View file @ 615f9fca
......@@ -20,3 +20,17 @@ option instead.
Example (assuming packets with mark 1 are delivered locally):
.IP
\-t mangle \-A PREROUTING \-m socket \-\-transparent \-j MARK \-\-set\-mark 1
.TP
\fB\-\-restore\-skmark\fP
Set the packet mark to the matching socket's mark. Can be combined with the
\fB\-\-transparent\fP and \fB\-\-nowildcard\fP options to restrict the sockets
to be matched when restoring the packet mark.
.PP
Example: An application opens 2 transparent (\fBIP_TRANSPARENT\fP) sockets and
sets a mark on them with \fBSO_MARK\fP socket option. We can filter matching packets:
.IP
\-t mangle \-I PREROUTING \-m socket \-\-transparent \-\-restore-skmark \-j action
.IP
\-t mangle \-A action \-m mark \-\-mark 10 \-j action2
.IP
\-t mangle \-A action \-m mark \-\-mark 11 \-j action3
extensions/libxt_string.man
View file @ 615f9fca
......@@ -17,6 +17,9 @@ Matches the given pattern.
[\fB!\fP] \fB\-\-hex\-string\fP \fIpattern\fP
Matches the given pattern in hex notation.
.TP
\fB\-\-icase\fP
Ignore case when searching.
.TP
Examples:
.IP
# The string pattern can be used for simple text characters.
......
extensions/libxt_tcp.man
View file @ 615f9fca
......@@ -7,7 +7,6 @@ name or a port number. An inclusive range can also be specified,
using the format \fIfirst\fP\fB:\fP\fIlast\fP.
If the first port is omitted, "0" is assumed; if the last is omitted,
"65535" is assumed.
If the first port is greater than the second one they will be swapped.
The flag
\fB\-\-sport\fP
is a convenient alias for this option.
......
include/Makefile.in
View file @ 615f9fca
# Makefile.in generated by automake 1.11.6 from Makefile.am.
# Makefile.in generated by automake 1.14.1 from Makefile.am.
# @configure_input@
# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
# 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Free Software
# Foundation, Inc.
# Copyright (C) 1994-2013 Free Software Foundation, Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
......@@ -18,23 +17,51 @@
# -*- Makefile -*-
VPATH = @srcdir@
am__make_dryrun = \
{ \
am__dry=no; \
am__is_gnu_make = test -n '$(MAKEFILE_LIST)' && test -n '$(MAKELEVEL)'
am__make_running_with_option = \
case $${target_option-} in \
?) ;; \
*) echo "am__make_running_with_option: internal error: invalid" \
"target option '$${target_option-}' specified" >&2; \
exit 1;; \
esac; \
has_opt=no; \
sane_makeflags=$$MAKEFLAGS; \
if $(am__is_gnu_make); then \
sane_makeflags=$$MFLAGS; \
else \
case $$MAKEFLAGS in \
*\\[\ \ ]*) \
echo 'am--echo: ; @echo "AM" OK' | $(MAKE) -f - 2>/dev/null \
| grep '^AM OK$$' >/dev/null || am__dry=yes;; \
*) \
for am__flg in $$MAKEFLAGS; do \
case $$am__flg in \
*=*|--*) ;; \
*n*) am__dry=yes; break;; \
bs=\\; \
sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
| sed "s/$$bs$$bs[$$bs $$bs ]*//g"`;; \
esac; \
done;; \
fi; \
skip_next=no; \
strip_trailopt () \
{ \
flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
}; \
for flg in $$sane_makeflags; do \
test $$skip_next = yes && { skip_next=no; continue; }; \
case $$flg in \
*=*|--*) continue;; \
-*I) strip_trailopt 'I'; skip_next=yes;; \
-*I?*) strip_trailopt 'I';; \
-*O) strip_trailopt 'O'; skip_next=yes;; \
-*O?*) strip_trailopt 'O';; \
-*l) strip_trailopt 'l'; skip_next=yes;; \
-*l?*) strip_trailopt 'l';; \
-[dEDm]) skip_next=yes;; \
-[JT]) skip_next=yes;; \
esac; \
test $$am__dry = yes; \
}
case $$flg in \
*$$target_option*) has_opt=yes; break;; \
esac; \
done; \
test $$has_opt = yes
am__make_dryrun = (target_option=n; $(am__make_running_with_option))
am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
pkgincludedir = $(includedir)/@PACKAGE@
pkglibdir = $(libdir)/@PACKAGE@
pkglibexecdir = $(libexecdir)/@PACKAGE@
......@@ -54,9 +81,9 @@ build_triplet = @build@
host_triplet = @host@
@ENABLE_LIBIPQ_TRUE@am__append_1 = libipq/libipq.h
subdir = include
DIST_COMMON = $(am__include_HEADERS_DIST) $(nobase_include_HEADERS) \
$(srcdir)/Makefile.am $(srcdir)/Makefile.in \
$(srcdir)/xtables-version.h.in
DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/Makefile.am \
$(srcdir)/xtables-version.h.in $(am__include_HEADERS_DIST) \
$(nobase_include_HEADERS)
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
am__aclocal_m4_deps = $(top_srcdir)/m4/ax_check_linker_flags.m4 \
$(top_srcdir)/m4/libtool.m4 $(top_srcdir)/m4/ltoptions.m4 \
......@@ -68,6 +95,18 @@ mkinstalldirs = $(install_sh) -d
CONFIG_HEADER = $(top_builddir)/config.h
CONFIG_CLEAN_FILES = xtables-version.h
CONFIG_CLEAN_VPATH_FILES =
AM_V_P = $(am__v_P_@AM_V@)
am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
am__v_P_0 = false
am__v_P_1 = :
AM_V_GEN = $(am__v_GEN_@AM_V@)
am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@)
am__v_GEN_0 = @echo " GEN " $@;
am__v_GEN_1 =
AM_V_at = $(am__v_at_@AM_V@)
am__v_at_ = $(am__v_at_@AM_DEFAULT_V@)
am__v_at_0 = @
am__v_at_1 =
SOURCES =
DIST_SOURCES =
am__can_run_installinfo = \
......@@ -105,12 +144,30 @@ am__uninstall_files_from_dir = { \
}
am__installdirs = "$(DESTDIR)$(includedir)" "$(DESTDIR)$(includedir)"
HEADERS = $(include_HEADERS) $(nobase_include_HEADERS)
am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
# Read a list of newline-separated strings from the standard input,
# and print each of them once, without duplicates. Input order is
# *not* preserved.
am__uniquify_input = $(AWK) '\
BEGIN { nonempty = 0; } \
{ items[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in items) print i; }; } \
'
# Make sure the list of sources is unique. This is necessary because,
# e.g., the same source file might be shared among _SOURCES variables
# for different programs/libraries.
am__define_uniq_tagged_files = \
list='$(am__tagged_files)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | $(am__uniquify_input)`
ETAGS = etags
CTAGS = ctags
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
pkgdatadir = @pkgdatadir@
ACLOCAL = @ACLOCAL@
AMTAR = @AMTAR@
AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
AR = @AR@
AUTOCONF = @AUTOCONF@
AUTOHEADER = @AUTOHEADER@
......@@ -141,6 +198,9 @@ INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
LD = @LD@
LDFLAGS = @LDFLAGS@
LEX = @LEX@
LEXLIB = @LEXLIB@
LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
......@@ -173,6 +233,8 @@ SET_MAKE = @SET_MAKE@
SHELL = @SHELL@
STRIP = @STRIP@
VERSION = @VERSION@
YACC = @YACC@
YFLAGS = @YFLAGS@
abs_builddir = @abs_builddir@
abs_srcdir = @abs_srcdir@
abs_top_builddir = @abs_top_builddir@
......@@ -186,7 +248,12 @@ am__quote = @am__quote@
am__tar = @am__tar@
am__untar = @am__untar@
bindir = @bindir@
blacklist_4_modules = @blacklist_4_modules@
blacklist_6_modules = @blacklist_6_modules@
blacklist_a_modules = @blacklist_a_modules@
blacklist_b_modules = @blacklist_b_modules@
blacklist_modules = @blacklist_modules@
blacklist_x_modules = @blacklist_x_modules@
build = @build@
build_alias = @build_alias@
build_cpu = @build_cpu@
......@@ -213,10 +280,14 @@ ksourcedir = @ksourcedir@
libdir = @libdir@
libexecdir = @libexecdir@
libiptc_LDFLAGS2 = @libiptc_LDFLAGS2@
libmnl_CFLAGS = @libmnl_CFLAGS@
libmnl_LIBS = @libmnl_LIBS@
libnetfilter_conntrack_CFLAGS = @libnetfilter_conntrack_CFLAGS@
libnetfilter_conntrack_LIBS = @libnetfilter_conntrack_LIBS@
libnfnetlink_CFLAGS = @libnfnetlink_CFLAGS@
libnfnetlink_LIBS = @libnfnetlink_LIBS@
libnftnl_CFLAGS = @libnftnl_CFLAGS@
libnftnl_LIBS = @libnftnl_LIBS@
libxtables_vage = @libxtables_vage@
libxtables_vcurrent = @libxtables_vcurrent@
libxtables_vmajor = @libxtables_vmajor@
......@@ -333,26 +404,15 @@ uninstall-nobase_includeHEADERS:
$(am__nobase_strip_setup); files=`$(am__nobase_strip)`; \
dir='$(DESTDIR)$(includedir)'; $(am__uninstall_files_from_dir)
ID: $(HEADERS) $(SOURCES) $(LISP) $(TAGS_FILES)
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
mkid -fID $$unique
tags: TAGS
TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
ID: $(am__tagged_files)
$(am__define_uniq_tagged_files); mkid -fID $$unique
tags: tags-am
TAGS: tags
tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
set x; \
here=`pwd`; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
$(am__define_uniq_tagged_files); \
shift; \
if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
test -n "$$unique" || unique=$$empty_fix; \
......@@ -364,15 +424,11 @@ TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$$unique; \
fi; \
fi
ctags: CTAGS
CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
ctags: ctags-am
CTAGS: ctags
ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
$(am__define_uniq_tagged_files); \
test -z "$(CTAGS_ARGS)$$unique" \
|| $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
$$unique
......@@ -381,6 +437,21 @@ GTAGS:
here=`$(am__cd) $(top_builddir) && pwd` \
&& $(am__cd) $(top_srcdir) \
&& gtags -i $(GTAGS_ARGS) "$$here"
cscopelist: cscopelist-am
cscopelist-am: $(am__tagged_files)
list='$(am__tagged_files)'; \
case "$(srcdir)" in \
[\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \
*) sdir=$(subdir)/$(srcdir) ;; \
esac; \
for i in $$list; do \
if test -f "$$i"; then \
echo "$(subdir)/$$i"; \
else \
echo "$$sdir/$$i"; \
fi; \
done >> $(top_builddir)/cscope.files
distclean-tags:
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
......@@ -520,18 +591,18 @@ uninstall-am: uninstall-includeHEADERS uninstall-nobase_includeHEADERS
.MAKE: install-am install-strip
.PHONY: CTAGS GTAGS all all-am check check-am clean clean-generic \
clean-libtool ctags distclean distclean-generic \
distclean-libtool distclean-tags distdir dvi dvi-am html \
html-am info info-am install install-am install-data \
install-data-am install-dvi install-dvi-am install-exec \
install-exec-am install-html install-html-am \
.PHONY: CTAGS GTAGS TAGS all all-am check check-am clean clean-generic \
clean-libtool cscopelist-am ctags ctags-am distclean \
distclean-generic distclean-libtool distclean-tags distdir dvi \
dvi-am html html-am info info-am install install-am \
install-data install-data-am install-dvi install-dvi-am \
install-exec install-exec-am install-html install-html-am \
install-includeHEADERS install-info install-info-am \
install-man install-nobase_includeHEADERS install-pdf \
install-pdf-am install-ps install-ps-am install-strip \
installcheck installcheck-am installdirs maintainer-clean \
maintainer-clean-generic mostlyclean mostlyclean-generic \
mostlyclean-libtool pdf pdf-am ps ps-am tags uninstall \
mostlyclean-libtool pdf pdf-am ps ps-am tags tags-am uninstall \
uninstall-am uninstall-includeHEADERS \
uninstall-nobase_includeHEADERS
......
include/ebtables/ethernetdb.h 0 → 100644
View file @ 615f9fca
/*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
/* All data returned by the network data base library are supplied in
host order and returned in network order (suitable for use in
system calls). */
#ifndef _ETHERNETDB_H
#define _ETHERNETDB_H 1
#include <features.h>
#include <netinet/in.h>
#include <stdint.h>
/* Absolute file name for network data base files. */
#ifndef _PATH_ETHERTYPES
#define _PATH_ETHERTYPES "/etc/ethertypes"
#endif /* _PATH_ETHERTYPES */
struct ethertypeent {
char *e_name; /* Official ethernet type name. */
char **e_aliases; /* Alias list. */
int e_ethertype; /* Ethernet type number. */
};
/* Open ethertype data base files and mark them as staying open even
after a later search if STAY_OPEN is non-zero. */
extern void setethertypeent(int __stay_open);
/* Close ethertype data base files and clear `stay open' flag. */
extern void endethertypeent(void);
/* Get next entry from ethertype data base file. Open data base if
necessary. */
extern struct ethertypeent *getethertypeent(void);
/* Return entry from ethertype data base for network with NAME. */
extern struct ethertypeent *getethertypebyname(__const char *__name);
/* Return entry from ethertype data base which number is PROTO. */
extern struct ethertypeent *getethertypebynumber(int __ethertype);
#endif /* ethernetdb.h */
include/iptables.h
View file @ 615f9fca
......@@ -20,4 +20,6 @@ extern void print_rule4(const struct ipt_entry *e,
extern struct xtables_globals iptables_globals;
extern struct xtables_globals xtables_globals;
#endif /*_IPTABLES_USER_H*/
include/libiptc/ipt_kernel_headers.h
View file @ 615f9fca
......@@ -5,7 +5,6 @@
#include <limits.h>
#if defined(__GLIBC__) && __GLIBC__ == 2
#include <netinet/ip.h>
#include <netinet/in.h>
#include <netinet/ip_icmp.h>
......@@ -13,15 +12,4 @@
#include <netinet/udp.h>
#include <net/if.h>
#include <sys/types.h>
#else /* libc5 */
#include <sys/socket.h>
#include <linux/ip.h>
#include <linux/in.h>
#include <linux/if.h>
#include <linux/icmp.h>
#include <linux/tcp.h>
#include <linux/udp.h>
#include <linux/types.h>
#include <linux/in6.h>
#endif
#endif
include/linux/filter.h 0 → 100644
View file @ 615f9fca
/*
* Linux Socket Filter Data Structures
*/
#ifndef __LINUX_FILTER_H__
#define __LINUX_FILTER_H__
#include <linux/types.h>
/*
* Current version of the filter code architecture.
*/
#define BPF_MAJOR_VERSION 1
#define BPF_MINOR_VERSION 1
/*
* Try and keep these values and structures similar to BSD, especially
* the BPF code definitions which need to match so you can share filters
*/
struct sock_filter { /* Filter block */
__u16 code; /* Actual filter code */
__u8 jt; /* Jump true */
__u8 jf; /* Jump false */
__u32 k; /* Generic multiuse field */
};
struct sock_fprog { /* Required for SO_ATTACH_FILTER. */
unsigned short len; /* Number of filter blocks */
struct sock_filter *filter;
};
/*
* Instruction classes
*/
#define BPF_CLASS(code) ((code) & 0x07)
#define BPF_LD 0x00
#define BPF_LDX 0x01
#define BPF_ST 0x02
#define BPF_STX 0x03
#define BPF_ALU 0x04
#define BPF_JMP 0x05
#define BPF_RET 0x06
#define BPF_MISC 0x07
/* ld/ldx fields */
#define BPF_SIZE(code) ((code) & 0x18)
#define BPF_W 0x00
#define BPF_H 0x08
#define BPF_B 0x10
#define BPF_MODE(code) ((code) & 0xe0)
#define BPF_IMM 0x00
#define BPF_ABS 0x20
#define BPF_IND 0x40
#define BPF_MEM 0x60
#define BPF_LEN 0x80
#define BPF_MSH 0xa0
/* alu/jmp fields */
#define BPF_OP(code) ((code) & 0xf0)
#define BPF_ADD 0x00
#define BPF_SUB 0x10
#define BPF_MUL 0x20
#define BPF_DIV 0x30
#define BPF_OR 0x40
#define BPF_AND 0x50
#define BPF_LSH 0x60
#define BPF_RSH 0x70
#define BPF_NEG 0x80
#define BPF_MOD 0x90
#define BPF_XOR 0xa0
#define BPF_JA 0x00
#define BPF_JEQ 0x10
#define BPF_JGT 0x20
#define BPF_JGE 0x30
#define BPF_JSET 0x40
#define BPF_SRC(code) ((code) & 0x08)
#define BPF_K 0x00
#define BPF_X 0x08
/* ret - BPF_K and BPF_X also apply */
#define BPF_RVAL(code) ((code) & 0x18)
#define BPF_A 0x10
/* misc */
#define BPF_MISCOP(code) ((code) & 0xf8)
#define BPF_TAX 0x00
#define BPF_TXA 0x80
#ifndef BPF_MAXINSNS
#define BPF_MAXINSNS 4096
#endif
/*
* Macros for filter block array initializers.
*/
#ifndef BPF_STMT
#define BPF_STMT(code, k) { (unsigned short)(code), 0, 0, k }
#endif
#ifndef BPF_JUMP
#define BPF_JUMP(code, k, jt, jf) { (unsigned short)(code), jt, jf, k }
#endif
/*
* Number of scratch memory words for: BPF_ST and BPF_STX
*/
#define BPF_MEMWORDS 16
/* RATIONALE. Negative offsets are invalid in BPF.
We use them to reference ancillary data.
Unlike introduction new instructions, it does not break
existing compilers/optimizers.
*/
#define SKF_AD_OFF (-0x1000)
#define SKF_AD_PROTOCOL 0
#define SKF_AD_PKTTYPE 4
#define SKF_AD_IFINDEX 8
#define SKF_AD_NLATTR 12
#define SKF_AD_NLATTR_NEST 16
#define SKF_AD_MARK 20
#define SKF_AD_QUEUE 24
#define SKF_AD_HATYPE 28
#define SKF_AD_RXHASH 32
#define SKF_AD_CPU 36
#define SKF_AD_ALU_XOR_X 40
#define SKF_AD_VLAN_TAG 44
#define SKF_AD_VLAN_TAG_PRESENT 48
#define SKF_AD_PAY_OFFSET 52
#define SKF_AD_RANDOM 56
#define SKF_AD_MAX 60
#define SKF_NET_OFF (-0x100000)
#define SKF_LL_OFF (-0x200000)
#endif /* __LINUX_FILTER_H__ */
include/linux/netfilter/ipset/ip_set.h
View file @ 615f9fca
......@@ -110,6 +110,9 @@ enum {
IPSET_ATTR_IFACE,
IPSET_ATTR_BYTES,
IPSET_ATTR_PACKETS,
IPSET_ATTR_SKBMARK,
IPSET_ATTR_SKBPRIO,
IPSET_ATTR_SKBQUEUE,
__IPSET_ATTR_ADT_MAX,
};
#define IPSET_ATTR_ADT_MAX (__IPSET_ATTR_ADT_MAX - 1)
......@@ -140,6 +143,7 @@ enum ipset_errno {
IPSET_ERR_IPADDR_IPV4,
IPSET_ERR_IPADDR_IPV6,
IPSET_ERR_COUNTER,
IPSET_ERR_SKBINFO,
/* Type specific error codes */
IPSET_ERR_TYPE_SPECIFIC = 4352,
......@@ -163,6 +167,12 @@ enum ipset_cmd_flags {
IPSET_FLAG_MATCH_COUNTERS = (1 << IPSET_FLAG_BIT_MATCH_COUNTERS),
IPSET_FLAG_BIT_RETURN_NOMATCH = 7,
IPSET_FLAG_RETURN_NOMATCH = (1 << IPSET_FLAG_BIT_RETURN_NOMATCH),
IPSET_FLAG_BIT_MAP_SKBMARK = 8,
IPSET_FLAG_MAP_SKBMARK = (1 << IPSET_FLAG_BIT_MAP_SKBMARK),
IPSET_FLAG_BIT_MAP_SKBPRIO = 9,
IPSET_FLAG_MAP_SKBPRIO = (1 << IPSET_FLAG_BIT_MAP_SKBPRIO),
IPSET_FLAG_BIT_MAP_SKBQUEUE = 10,
IPSET_FLAG_MAP_SKBQUEUE = (1 << IPSET_FLAG_BIT_MAP_SKBQUEUE),
IPSET_FLAG_CMD_MAX = 15,
};
......@@ -226,11 +236,17 @@ enum {
IPSET_COUNTER_GT,
};
struct ip_set_counter_match {
/* Backward compatibility for set match v3 */
struct ip_set_counter_match0 {
__u8 op;
__u64 value;
};
struct ip_set_counter_match {
__aligned_u64 value;
__u8 op;
};
/* Interface to iptables/ip6tables */
#define SO_IP_SET 83
......
include/linux/netfilter/nf_nat.h
View file @ 615f9fca
......@@ -4,10 +4,14 @@
#include <linux/netfilter.h>
#include <linux/netfilter/nf_conntrack_tuple_common.h>
#define NF_NAT_RANGE_MAP_IPS 1
#define NF_NAT_RANGE_PROTO_SPECIFIED 2
#define NF_NAT_RANGE_PROTO_RANDOM 4
#define NF_NAT_RANGE_PERSISTENT 8
#define NF_NAT_RANGE_MAP_IPS (1 << 0)
#define NF_NAT_RANGE_PROTO_SPECIFIED (1 << 1)
#define NF_NAT_RANGE_PROTO_RANDOM (1 << 2)
#define NF_NAT_RANGE_PERSISTENT (1 << 3)
#define NF_NAT_RANGE_PROTO_RANDOM_FULLY (1 << 4)
#define NF_NAT_RANGE_PROTO_RANDOM_ALL \
(NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PROTO_RANDOM_FULLY)
struct nf_nat_ipv4_range {
unsigned int flags;
......
include/linux/netfilter/nf_tables.h 0 → 100644
View file @ 615f9fca
#ifndef _LINUX_NF_TABLES_H
#define _LINUX_NF_TABLES_H
#define NFT_CHAIN_MAXNAMELEN 32
#define NFT_USERDATA_MAXLEN 256
enum nft_registers {
NFT_REG_VERDICT,
NFT_REG_1,
NFT_REG_2,
NFT_REG_3,
NFT_REG_4,
__NFT_REG_MAX
};
#define NFT_REG_MAX (__NFT_REG_MAX - 1)
/**
* enum nft_verdicts - nf_tables internal verdicts
*
* @NFT_CONTINUE: continue evaluation of the current rule
* @NFT_BREAK: terminate evaluation of the current rule
* @NFT_JUMP: push the current chain on the jump stack and jump to a chain
* @NFT_GOTO: jump to a chain without pushing the current chain on the jump stack
* @NFT_RETURN: return to the topmost chain on the jump stack
*
* The nf_tables verdicts share their numeric space with the netfilter verdicts.
*/
enum nft_verdicts {
NFT_CONTINUE = -1,
NFT_BREAK = -2,
NFT_JUMP = -3,
NFT_GOTO = -4,
NFT_RETURN = -5,
};
/**
* enum nf_tables_msg_types - nf_tables netlink message types
*
* @NFT_MSG_NEWTABLE: create a new table (enum nft_table_attributes)
* @NFT_MSG_GETTABLE: get a table (enum nft_table_attributes)
* @NFT_MSG_DELTABLE: delete a table (enum nft_table_attributes)
* @NFT_MSG_NEWCHAIN: create a new chain (enum nft_chain_attributes)
* @NFT_MSG_GETCHAIN: get a chain (enum nft_chain_attributes)
* @NFT_MSG_DELCHAIN: delete a chain (enum nft_chain_attributes)
* @NFT_MSG_NEWRULE: create a new rule (enum nft_rule_attributes)
* @NFT_MSG_GETRULE: get a rule (enum nft_rule_attributes)
* @NFT_MSG_DELRULE: delete a rule (enum nft_rule_attributes)
* @NFT_MSG_NEWSET: create a new set (enum nft_set_attributes)
* @NFT_MSG_GETSET: get a set (enum nft_set_attributes)
* @NFT_MSG_DELSET: delete a set (enum nft_set_attributes)
* @NFT_MSG_NEWSETELEM: create a new set element (enum nft_set_elem_attributes)
* @NFT_MSG_GETSETELEM: get a set element (enum nft_set_elem_attributes)
* @NFT_MSG_DELSETELEM: delete a set element (enum nft_set_elem_attributes)
*/
enum nf_tables_msg_types {
NFT_MSG_NEWTABLE,
NFT_MSG_GETTABLE,
NFT_MSG_DELTABLE,
NFT_MSG_NEWCHAIN,
NFT_MSG_GETCHAIN,
NFT_MSG_DELCHAIN,
NFT_MSG_NEWRULE,
NFT_MSG_GETRULE,
NFT_MSG_DELRULE,
NFT_MSG_NEWSET,
NFT_MSG_GETSET,
NFT_MSG_DELSET,
NFT_MSG_NEWSETELEM,
NFT_MSG_GETSETELEM,
NFT_MSG_DELSETELEM,
NFT_MSG_MAX,
};
/**
* enum nft_list_attributes - nf_tables generic list netlink attributes
*
* @NFTA_LIST_ELEM: list element (NLA_NESTED)
*/
enum nft_list_attributes {
NFTA_LIST_UNPEC,
NFTA_LIST_ELEM,
__NFTA_LIST_MAX
};
#define NFTA_LIST_MAX (__NFTA_LIST_MAX - 1)
/**
* enum nft_hook_attributes - nf_tables netfilter hook netlink attributes
*
* @NFTA_HOOK_HOOKNUM: netfilter hook number (NLA_U32)
* @NFTA_HOOK_PRIORITY: netfilter hook priority (NLA_U32)
*/
enum nft_hook_attributes {
NFTA_HOOK_UNSPEC,
NFTA_HOOK_HOOKNUM,
NFTA_HOOK_PRIORITY,
__NFTA_HOOK_MAX
};
#define NFTA_HOOK_MAX (__NFTA_HOOK_MAX - 1)
/**
* enum nft_table_flags - nf_tables table flags
*
* @NFT_TABLE_F_DORMANT: this table is not active
*/
enum nft_table_flags {
NFT_TABLE_F_DORMANT = 0x1,
};
/**
* enum nft_table_attributes - nf_tables table netlink attributes
*
* @NFTA_TABLE_NAME: name of the table (NLA_STRING)
* @NFTA_TABLE_FLAGS: bitmask of enum nft_table_flags (NLA_U32)
* @NFTA_TABLE_USE: number of chains in this table (NLA_U32)
*/
enum nft_table_attributes {
NFTA_TABLE_UNSPEC,
NFTA_TABLE_NAME,
NFTA_TABLE_FLAGS,
NFTA_TABLE_USE,
__NFTA_TABLE_MAX
};
#define NFTA_TABLE_MAX (__NFTA_TABLE_MAX - 1)
/**
* enum nft_chain_attributes - nf_tables chain netlink attributes
*
* @NFTA_CHAIN_TABLE: name of the table containing the chain (NLA_STRING)
* @NFTA_CHAIN_HANDLE: numeric handle of the chain (NLA_U64)
* @NFTA_CHAIN_NAME: name of the chain (NLA_STRING)
* @NFTA_CHAIN_HOOK: hook specification for basechains (NLA_NESTED: nft_hook_attributes)
* @NFTA_CHAIN_POLICY: numeric policy of the chain (NLA_U32)
* @NFTA_CHAIN_USE: number of references to this chain (NLA_U32)
* @NFTA_CHAIN_TYPE: type name of the string (NLA_NUL_STRING)
* @NFTA_CHAIN_COUNTERS: counter specification of the chain (NLA_NESTED: nft_counter_attributes)
*/
enum nft_chain_attributes {
NFTA_CHAIN_UNSPEC,
NFTA_CHAIN_TABLE,
NFTA_CHAIN_HANDLE,
NFTA_CHAIN_NAME,
NFTA_CHAIN_HOOK,
NFTA_CHAIN_POLICY,
NFTA_CHAIN_USE,
NFTA_CHAIN_TYPE,
NFTA_CHAIN_COUNTERS,
__NFTA_CHAIN_MAX
};
#define NFTA_CHAIN_MAX (__NFTA_CHAIN_MAX - 1)
/**
* enum nft_rule_attributes - nf_tables rule netlink attributes
*
* @NFTA_RULE_TABLE: name of the table containing the rule (NLA_STRING)
* @NFTA_RULE_CHAIN: name of the chain containing the rule (NLA_STRING)
* @NFTA_RULE_HANDLE: numeric handle of the rule (NLA_U64)
* @NFTA_RULE_EXPRESSIONS: list of expressions (NLA_NESTED: nft_expr_attributes)
* @NFTA_RULE_COMPAT: compatibility specifications of the rule (NLA_NESTED: nft_rule_compat_attributes)
* @NFTA_RULE_POSITION: numeric handle of the previous rule (NLA_U64)
* @NFTA_RULE_USERDATA: user data (NLA_BINARY, NFT_USERDATA_MAXLEN)
*/
enum nft_rule_attributes {
NFTA_RULE_UNSPEC,
NFTA_RULE_TABLE,
NFTA_RULE_CHAIN,
NFTA_RULE_HANDLE,
NFTA_RULE_EXPRESSIONS,
NFTA_RULE_COMPAT,
NFTA_RULE_POSITION,
NFTA_RULE_USERDATA,
__NFTA_RULE_MAX
};
#define NFTA_RULE_MAX (__NFTA_RULE_MAX - 1)
/**
* enum nft_rule_compat_flags - nf_tables rule compat flags
*
* @NFT_RULE_COMPAT_F_INV: invert the check result
*/
enum nft_rule_compat_flags {
NFT_RULE_COMPAT_F_INV = (1 << 1),
NFT_RULE_COMPAT_F_MASK = NFT_RULE_COMPAT_F_INV,
};
/**
* enum nft_rule_compat_attributes - nf_tables rule compat attributes
*
* @NFTA_RULE_COMPAT_PROTO: numerice value of handled protocol (NLA_U32)
* @NFTA_RULE_COMPAT_FLAGS: bitmask of enum nft_rule_compat_flags (NLA_U32)
*/
enum nft_rule_compat_attributes {
NFTA_RULE_COMPAT_UNSPEC,
NFTA_RULE_COMPAT_PROTO,
NFTA_RULE_COMPAT_FLAGS,
__NFTA_RULE_COMPAT_MAX
};
#define NFTA_RULE_COMPAT_MAX (__NFTA_RULE_COMPAT_MAX - 1)
/**
* enum nft_set_flags - nf_tables set flags
*
* @NFT_SET_ANONYMOUS: name allocation, automatic cleanup on unlink
* @NFT_SET_CONSTANT: set contents may not change while bound
* @NFT_SET_INTERVAL: set contains intervals
* @NFT_SET_MAP: set is used as a dictionary
*/
enum nft_set_flags {
NFT_SET_ANONYMOUS = 0x1,
NFT_SET_CONSTANT = 0x2,
NFT_SET_INTERVAL = 0x4,
NFT_SET_MAP = 0x8,
};
/**
* enum nft_set_policies - set selection policy
*
* @NFT_SET_POL_PERFORMANCE: prefer high performance over low memory use
* @NFT_SET_POL_MEMORY: prefer low memory use over high performance
*/
enum nft_set_policies {
NFT_SET_POL_PERFORMANCE,
NFT_SET_POL_MEMORY,
};
/**
* enum nft_set_desc_attributes - set element description
*
* @NFTA_SET_DESC_SIZE: number of elements in set (NLA_U32)
*/
enum nft_set_desc_attributes {
NFTA_SET_DESC_UNSPEC,
NFTA_SET_DESC_SIZE,
__NFTA_SET_DESC_MAX
};
#define NFTA_SET_DESC_MAX (__NFTA_SET_DESC_MAX - 1)
/**
* enum nft_set_attributes - nf_tables set netlink attributes
*
* @NFTA_SET_TABLE: table name (NLA_STRING)
* @NFTA_SET_NAME: set name (NLA_STRING)
* @NFTA_SET_FLAGS: bitmask of enum nft_set_flags (NLA_U32)
* @NFTA_SET_KEY_TYPE: key data type, informational purpose only (NLA_U32)
* @NFTA_SET_KEY_LEN: key data length (NLA_U32)
* @NFTA_SET_DATA_TYPE: mapping data type (NLA_U32)
* @NFTA_SET_DATA_LEN: mapping data length (NLA_U32)
* @NFTA_SET_POLICY: selection policy (NLA_U32)
* @NFTA_SET_DESC: set description (NLA_NESTED)
* @NFTA_SET_ID: uniquely identifies a set in a transaction (NLA_U32)
*/
enum nft_set_attributes {
NFTA_SET_UNSPEC,
NFTA_SET_TABLE,
NFTA_SET_NAME,
NFTA_SET_FLAGS,
NFTA_SET_KEY_TYPE,
NFTA_SET_KEY_LEN,
NFTA_SET_DATA_TYPE,
NFTA_SET_DATA_LEN,
NFTA_SET_POLICY,
NFTA_SET_DESC,
NFTA_SET_ID,
__NFTA_SET_MAX
};
#define NFTA_SET_MAX (__NFTA_SET_MAX - 1)
/**
* enum nft_set_elem_flags - nf_tables set element flags
*
* @NFT_SET_ELEM_INTERVAL_END: element ends the previous interval
*/
enum nft_set_elem_flags {
NFT_SET_ELEM_INTERVAL_END = 0x1,
};
/**
* enum nft_set_elem_attributes - nf_tables set element netlink attributes
*
* @NFTA_SET_ELEM_KEY: key value (NLA_NESTED: nft_data)
* @NFTA_SET_ELEM_DATA: data value of mapping (NLA_NESTED: nft_data_attributes)
* @NFTA_SET_ELEM_FLAGS: bitmask of nft_set_elem_flags (NLA_U32)
*/
enum nft_set_elem_attributes {
NFTA_SET_ELEM_UNSPEC,
NFTA_SET_ELEM_KEY,
NFTA_SET_ELEM_DATA,
NFTA_SET_ELEM_FLAGS,
__NFTA_SET_ELEM_MAX
};
#define NFTA_SET_ELEM_MAX (__NFTA_SET_ELEM_MAX - 1)
/**
* enum nft_set_elem_list_attributes - nf_tables set element list netlink attributes
*
* @NFTA_SET_ELEM_LIST_TABLE: table of the set to be changed (NLA_STRING)
* @NFTA_SET_ELEM_LIST_SET: name of the set to be changed (NLA_STRING)
* @NFTA_SET_ELEM_LIST_ELEMENTS: list of set elements (NLA_NESTED: nft_set_elem_attributes)
* @NFTA_SET_ELEM_LIST_SET_ID: uniquely identifies a set in a transaction (NLA_U32)
*/
enum nft_set_elem_list_attributes {
NFTA_SET_ELEM_LIST_UNSPEC,
NFTA_SET_ELEM_LIST_TABLE,
NFTA_SET_ELEM_LIST_SET,
NFTA_SET_ELEM_LIST_ELEMENTS,
NFTA_SET_ELEM_LIST_SET_ID,
__NFTA_SET_ELEM_LIST_MAX
};
#define NFTA_SET_ELEM_LIST_MAX (__NFTA_SET_ELEM_LIST_MAX - 1)
/**
* enum nft_data_types - nf_tables data types
*
* @NFT_DATA_VALUE: generic data
* @NFT_DATA_VERDICT: netfilter verdict
*
* The type of data is usually determined by the kernel directly and is not
* explicitly specified by userspace. The only difference are sets, where
* userspace specifies the key and mapping data types.
*
* The values 0xffffff00-0xffffffff are reserved for internally used types.
* The remaining range can be freely used by userspace to encode types, all
* values are equivalent to NFT_DATA_VALUE.
*/
enum nft_data_types {
NFT_DATA_VALUE,
NFT_DATA_VERDICT = 0xffffff00U,
};
#define NFT_DATA_RESERVED_MASK 0xffffff00U
/**
* enum nft_data_attributes - nf_tables data netlink attributes
*
* @NFTA_DATA_VALUE: generic data (NLA_BINARY)
* @NFTA_DATA_VERDICT: nf_tables verdict (NLA_NESTED: nft_verdict_attributes)
*/
enum nft_data_attributes {
NFTA_DATA_UNSPEC,
NFTA_DATA_VALUE,
NFTA_DATA_VERDICT,
__NFTA_DATA_MAX
};
#define NFTA_DATA_MAX (__NFTA_DATA_MAX - 1)
/**
* enum nft_verdict_attributes - nf_tables verdict netlink attributes
*
* @NFTA_VERDICT_CODE: nf_tables verdict (NLA_U32: enum nft_verdicts)
* @NFTA_VERDICT_CHAIN: jump target chain name (NLA_STRING)
*/
enum nft_verdict_attributes {
NFTA_VERDICT_UNSPEC,
NFTA_VERDICT_CODE,
NFTA_VERDICT_CHAIN,
__NFTA_VERDICT_MAX
};
#define NFTA_VERDICT_MAX (__NFTA_VERDICT_MAX - 1)
/**
* enum nft_expr_attributes - nf_tables expression netlink attributes
*
* @NFTA_EXPR_NAME: name of the expression type (NLA_STRING)
* @NFTA_EXPR_DATA: type specific data (NLA_NESTED)
*/
enum nft_expr_attributes {
NFTA_EXPR_UNSPEC,
NFTA_EXPR_NAME,
NFTA_EXPR_DATA,
__NFTA_EXPR_MAX
};
#define NFTA_EXPR_MAX (__NFTA_EXPR_MAX - 1)
/**
* enum nft_immediate_attributes - nf_tables immediate expression netlink attributes
*
* @NFTA_IMMEDIATE_DREG: destination register to load data into (NLA_U32)
* @NFTA_IMMEDIATE_DATA: data to load (NLA_NESTED: nft_data_attributes)
*/
enum nft_immediate_attributes {
NFTA_IMMEDIATE_UNSPEC,
NFTA_IMMEDIATE_DREG,
NFTA_IMMEDIATE_DATA,
__NFTA_IMMEDIATE_MAX
};
#define NFTA_IMMEDIATE_MAX (__NFTA_IMMEDIATE_MAX - 1)
/**
* enum nft_bitwise_attributes - nf_tables bitwise expression netlink attributes
*
* @NFTA_BITWISE_SREG: source register (NLA_U32: nft_registers)
* @NFTA_BITWISE_DREG: destination register (NLA_U32: nft_registers)
* @NFTA_BITWISE_LEN: length of operands (NLA_U32)
* @NFTA_BITWISE_MASK: mask value (NLA_NESTED: nft_data_attributes)
* @NFTA_BITWISE_XOR: xor value (NLA_NESTED: nft_data_attributes)
*
* The bitwise expression performs the following operation:
*
* dreg = (sreg & mask) ^ xor
*
* which allow to express all bitwise operations:
*
* mask xor
* NOT: 1 1
* OR: 0 x
* XOR: 1 x
* AND: x 0
*/
enum nft_bitwise_attributes {
NFTA_BITWISE_UNSPEC,
NFTA_BITWISE_SREG,
NFTA_BITWISE_DREG,
NFTA_BITWISE_LEN,
NFTA_BITWISE_MASK,
NFTA_BITWISE_XOR,
__NFTA_BITWISE_MAX
};
#define NFTA_BITWISE_MAX (__NFTA_BITWISE_MAX - 1)
/**
* enum nft_byteorder_ops - nf_tables byteorder operators
*
* @NFT_BYTEORDER_NTOH: network to host operator
* @NFT_BYTEORDER_HTON: host to network opertaor
*/
enum nft_byteorder_ops {
NFT_BYTEORDER_NTOH,
NFT_BYTEORDER_HTON,
};
/**
* enum nft_byteorder_attributes - nf_tables byteorder expression netlink attributes
*
* @NFTA_BYTEORDER_SREG: source register (NLA_U32: nft_registers)
* @NFTA_BYTEORDER_DREG: destination register (NLA_U32: nft_registers)
* @NFTA_BYTEORDER_OP: operator (NLA_U32: enum nft_byteorder_ops)
* @NFTA_BYTEORDER_LEN: length of the data (NLA_U32)
* @NFTA_BYTEORDER_SIZE: data size in bytes (NLA_U32: 2 or 4)
*/
enum nft_byteorder_attributes {
NFTA_BYTEORDER_UNSPEC,
NFTA_BYTEORDER_SREG,
NFTA_BYTEORDER_DREG,
NFTA_BYTEORDER_OP,
NFTA_BYTEORDER_LEN,
NFTA_BYTEORDER_SIZE,
__NFTA_BYTEORDER_MAX
};
#define NFTA_BYTEORDER_MAX (__NFTA_BYTEORDER_MAX - 1)
/**
* enum nft_cmp_ops - nf_tables relational operator
*
* @NFT_CMP_EQ: equal
* @NFT_CMP_NEQ: not equal
* @NFT_CMP_LT: less than
* @NFT_CMP_LTE: less than or equal to
* @NFT_CMP_GT: greater than
* @NFT_CMP_GTE: greater than or equal to
*/
enum nft_cmp_ops {
NFT_CMP_EQ,
NFT_CMP_NEQ,
NFT_CMP_LT,
NFT_CMP_LTE,
NFT_CMP_GT,
NFT_CMP_GTE,
};
/**
* enum nft_cmp_attributes - nf_tables cmp expression netlink attributes
*
* @NFTA_CMP_SREG: source register of data to compare (NLA_U32: nft_registers)
* @NFTA_CMP_OP: cmp operation (NLA_U32: nft_cmp_ops)
* @NFTA_CMP_DATA: data to compare against (NLA_NESTED: nft_data_attributes)
*/
enum nft_cmp_attributes {
NFTA_CMP_UNSPEC,
NFTA_CMP_SREG,
NFTA_CMP_OP,
NFTA_CMP_DATA,
__NFTA_CMP_MAX
};
#define NFTA_CMP_MAX (__NFTA_CMP_MAX - 1)
/**
* enum nft_lookup_attributes - nf_tables set lookup expression netlink attributes
*
* @NFTA_LOOKUP_SET: name of the set where to look for (NLA_STRING)
* @NFTA_LOOKUP_SREG: source register of the data to look for (NLA_U32: nft_registers)
* @NFTA_LOOKUP_DREG: destination register (NLA_U32: nft_registers)
* @NFTA_LOOKUP_SET_ID: uniquely identifies a set in a transaction (NLA_U32)
*/
enum nft_lookup_attributes {
NFTA_LOOKUP_UNSPEC,
NFTA_LOOKUP_SET,
NFTA_LOOKUP_SREG,
NFTA_LOOKUP_DREG,
NFTA_LOOKUP_SET_ID,
__NFTA_LOOKUP_MAX
};
#define NFTA_LOOKUP_MAX (__NFTA_LOOKUP_MAX - 1)
/**
* enum nft_payload_bases - nf_tables payload expression offset bases
*
* @NFT_PAYLOAD_LL_HEADER: link layer header
* @NFT_PAYLOAD_NETWORK_HEADER: network header
* @NFT_PAYLOAD_TRANSPORT_HEADER: transport header
*/
enum nft_payload_bases {
NFT_PAYLOAD_LL_HEADER,
NFT_PAYLOAD_NETWORK_HEADER,
NFT_PAYLOAD_TRANSPORT_HEADER,
};
/**
* enum nft_payload_attributes - nf_tables payload expression netlink attributes
*
* @NFTA_PAYLOAD_DREG: destination register to load data into (NLA_U32: nft_registers)
* @NFTA_PAYLOAD_BASE: payload base (NLA_U32: nft_payload_bases)
* @NFTA_PAYLOAD_OFFSET: payload offset relative to base (NLA_U32)
* @NFTA_PAYLOAD_LEN: payload length (NLA_U32)
*/
enum nft_payload_attributes {
NFTA_PAYLOAD_UNSPEC,
NFTA_PAYLOAD_DREG,
NFTA_PAYLOAD_BASE,
NFTA_PAYLOAD_OFFSET,
NFTA_PAYLOAD_LEN,
__NFTA_PAYLOAD_MAX
};
#define NFTA_PAYLOAD_MAX (__NFTA_PAYLOAD_MAX - 1)
/**
* enum nft_exthdr_attributes - nf_tables IPv6 extension header expression netlink attributes
*
* @NFTA_EXTHDR_DREG: destination register (NLA_U32: nft_registers)
* @NFTA_EXTHDR_TYPE: extension header type (NLA_U8)
* @NFTA_EXTHDR_OFFSET: extension header offset (NLA_U32)
* @NFTA_EXTHDR_LEN: extension header length (NLA_U32)
*/
enum nft_exthdr_attributes {
NFTA_EXTHDR_UNSPEC,
NFTA_EXTHDR_DREG,
NFTA_EXTHDR_TYPE,
NFTA_EXTHDR_OFFSET,
NFTA_EXTHDR_LEN,
__NFTA_EXTHDR_MAX
};
#define NFTA_EXTHDR_MAX (__NFTA_EXTHDR_MAX - 1)
/**
* enum nft_meta_keys - nf_tables meta expression keys
*
* @NFT_META_LEN: packet length (skb->len)
* @NFT_META_PROTOCOL: packet ethertype protocol (skb->protocol), invalid in OUTPUT
* @NFT_META_PRIORITY: packet priority (skb->priority)
* @NFT_META_MARK: packet mark (skb->mark)
* @NFT_META_IIF: packet input interface index (dev->ifindex)
* @NFT_META_OIF: packet output interface index (dev->ifindex)
* @NFT_META_IIFNAME: packet input interface name (dev->name)
* @NFT_META_OIFNAME: packet output interface name (dev->name)
* @NFT_META_IIFTYPE: packet input interface type (dev->type)
* @NFT_META_OIFTYPE: packet output interface type (dev->type)
* @NFT_META_SKUID: originating socket UID (fsuid)
* @NFT_META_SKGID: originating socket GID (fsgid)
* @NFT_META_NFTRACE: packet nftrace bit
* @NFT_META_RTCLASSID: realm value of packet's route (skb->dst->tclassid)
* @NFT_META_SECMARK: packet secmark (skb->secmark)
* @NFT_META_NFPROTO: netfilter protocol
* @NFT_META_L4PROTO: layer 4 protocol number
* @NFT_META_BRI_IIFNAME: packet input bridge interface name
* @NFT_META_BRI_OIFNAME: packet output bridge interface name
*/
enum nft_meta_keys {
NFT_META_LEN,
NFT_META_PROTOCOL,
NFT_META_PRIORITY,
NFT_META_MARK,
NFT_META_IIF,
NFT_META_OIF,
NFT_META_IIFNAME,
NFT_META_OIFNAME,
NFT_META_IIFTYPE,
NFT_META_OIFTYPE,
NFT_META_SKUID,
NFT_META_SKGID,
NFT_META_NFTRACE,
NFT_META_RTCLASSID,
NFT_META_SECMARK,
NFT_META_NFPROTO,
NFT_META_L4PROTO,
NFT_META_BRI_IIFNAME,
NFT_META_BRI_OIFNAME,
};
/**
* enum nft_meta_attributes - nf_tables meta expression netlink attributes
*
* @NFTA_META_DREG: destination register (NLA_U32)
* @NFTA_META_KEY: meta data item to load (NLA_U32: nft_meta_keys)
* @NFTA_META_SREG: source register (NLA_U32)
*/
enum nft_meta_attributes {
NFTA_META_UNSPEC,
NFTA_META_DREG,
NFTA_META_KEY,
NFTA_META_SREG,
__NFTA_META_MAX
};
#define NFTA_META_MAX (__NFTA_META_MAX - 1)
/**
* enum nft_ct_keys - nf_tables ct expression keys
*
* @NFT_CT_STATE: conntrack state (bitmask of enum ip_conntrack_info)
* @NFT_CT_DIRECTION: conntrack direction (enum ip_conntrack_dir)
* @NFT_CT_STATUS: conntrack status (bitmask of enum ip_conntrack_status)
* @NFT_CT_MARK: conntrack mark value
* @NFT_CT_SECMARK: conntrack secmark value
* @NFT_CT_EXPIRATION: relative conntrack expiration time in ms
* @NFT_CT_HELPER: connection tracking helper assigned to conntrack
* @NFT_CT_L3PROTOCOL: conntrack layer 3 protocol
* @NFT_CT_SRC: conntrack layer 3 protocol source (IPv4/IPv6 address)
* @NFT_CT_DST: conntrack layer 3 protocol destination (IPv4/IPv6 address)
* @NFT_CT_PROTOCOL: conntrack layer 4 protocol
* @NFT_CT_PROTO_SRC: conntrack layer 4 protocol source
* @NFT_CT_PROTO_DST: conntrack layer 4 protocol destination
*/
enum nft_ct_keys {
NFT_CT_STATE,
NFT_CT_DIRECTION,
NFT_CT_STATUS,
NFT_CT_MARK,
NFT_CT_SECMARK,
NFT_CT_EXPIRATION,
NFT_CT_HELPER,
NFT_CT_L3PROTOCOL,
NFT_CT_SRC,
NFT_CT_DST,
NFT_CT_PROTOCOL,
NFT_CT_PROTO_SRC,
NFT_CT_PROTO_DST,
NFT_CT_LABELS,
};
/**
* enum nft_ct_attributes - nf_tables ct expression netlink attributes
*
* @NFTA_CT_DREG: destination register (NLA_U32)
* @NFTA_CT_KEY: conntrack data item to load (NLA_U32: nft_ct_keys)
* @NFTA_CT_DIRECTION: direction in case of directional keys (NLA_U8)
* @NFTA_CT_SREG: source register (NLA_U32)
*/
enum nft_ct_attributes {
NFTA_CT_UNSPEC,
NFTA_CT_DREG,
NFTA_CT_KEY,
NFTA_CT_DIRECTION,
NFTA_CT_SREG,
__NFTA_CT_MAX
};
#define NFTA_CT_MAX (__NFTA_CT_MAX - 1)
/**
* enum nft_limit_attributes - nf_tables limit expression netlink attributes
*
* @NFTA_LIMIT_RATE: refill rate (NLA_U64)
* @NFTA_LIMIT_UNIT: refill unit (NLA_U64)
*/
enum nft_limit_attributes {
NFTA_LIMIT_UNSPEC,
NFTA_LIMIT_RATE,
NFTA_LIMIT_UNIT,
__NFTA_LIMIT_MAX
};
#define NFTA_LIMIT_MAX (__NFTA_LIMIT_MAX - 1)
/**
* enum nft_counter_attributes - nf_tables counter expression netlink attributes
*
* @NFTA_COUNTER_BYTES: number of bytes (NLA_U64)
* @NFTA_COUNTER_PACKETS: number of packets (NLA_U64)
*/
enum nft_counter_attributes {
NFTA_COUNTER_UNSPEC,
NFTA_COUNTER_BYTES,
NFTA_COUNTER_PACKETS,
__NFTA_COUNTER_MAX
};
#define NFTA_COUNTER_MAX (__NFTA_COUNTER_MAX - 1)
/**
* enum nft_log_attributes - nf_tables log expression netlink attributes
*
* @NFTA_LOG_GROUP: netlink group to send messages to (NLA_U32)
* @NFTA_LOG_PREFIX: prefix to prepend to log messages (NLA_STRING)
* @NFTA_LOG_SNAPLEN: length of payload to include in netlink message (NLA_U32)
* @NFTA_LOG_QTHRESHOLD: queue threshold (NLA_U32)
* @NFTA_LOG_LEVEL: log level (NLA_U32)
* @NFTA_LOG_FLAGS: logging flags (NLA_U32)
*/
enum nft_log_attributes {
NFTA_LOG_UNSPEC,
NFTA_LOG_GROUP,
NFTA_LOG_PREFIX,
NFTA_LOG_SNAPLEN,
NFTA_LOG_QTHRESHOLD,
NFTA_LOG_LEVEL,
NFTA_LOG_FLAGS,
__NFTA_LOG_MAX
};
#define NFTA_LOG_MAX (__NFTA_LOG_MAX - 1)
/**
* enum nft_queue_attributes - nf_tables queue expression netlink attributes
*
* @NFTA_QUEUE_NUM: netlink queue to send messages to (NLA_U16)
* @NFTA_QUEUE_TOTAL: number of queues to load balance packets on (NLA_U16)
* @NFTA_QUEUE_FLAGS: various flags (NLA_U16)
*/
enum nft_queue_attributes {
NFTA_QUEUE_UNSPEC,
NFTA_QUEUE_NUM,
NFTA_QUEUE_TOTAL,
NFTA_QUEUE_FLAGS,
__NFTA_QUEUE_MAX
};
#define NFTA_QUEUE_MAX (__NFTA_QUEUE_MAX - 1)
#define NFT_QUEUE_FLAG_BYPASS 0x01 /* for compatibility with v2 */
#define NFT_QUEUE_FLAG_CPU_FANOUT 0x02 /* use current CPU (no hashing) */
#define NFT_QUEUE_FLAG_MASK 0x03
/**
* enum nft_reject_types - nf_tables reject expression reject types
*
* @NFT_REJECT_ICMP_UNREACH: reject using ICMP unreachable
* @NFT_REJECT_TCP_RST: reject using TCP RST
*/
enum nft_reject_types {
NFT_REJECT_ICMP_UNREACH,
NFT_REJECT_TCP_RST,
};
/**
* enum nft_reject_attributes - nf_tables reject expression netlink attributes
*
* @NFTA_REJECT_TYPE: packet type to use (NLA_U32: nft_reject_types)
* @NFTA_REJECT_ICMP_CODE: ICMP code to use (NLA_U8)
*/
enum nft_reject_attributes {
NFTA_REJECT_UNSPEC,
NFTA_REJECT_TYPE,
NFTA_REJECT_ICMP_CODE,
__NFTA_REJECT_MAX
};
#define NFTA_REJECT_MAX (__NFTA_REJECT_MAX - 1)
/**
* enum nft_nat_types - nf_tables nat expression NAT types
*
* @NFT_NAT_SNAT: source NAT
* @NFT_NAT_DNAT: destination NAT
*/
enum nft_nat_types {
NFT_NAT_SNAT,
NFT_NAT_DNAT,
};
/**
* enum nft_nat_attributes - nf_tables nat expression netlink attributes
*
* @NFTA_NAT_TYPE: NAT type (NLA_U32: nft_nat_types)
* @NFTA_NAT_FAMILY: NAT family (NLA_U32)
* @NFTA_NAT_REG_ADDR_MIN: source register of address range start (NLA_U32: nft_registers)
* @NFTA_NAT_REG_ADDR_MAX: source register of address range end (NLA_U32: nft_registers)
* @NFTA_NAT_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
* @NFTA_NAT_REG_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers)
*/
enum nft_nat_attributes {
NFTA_NAT_UNSPEC,
NFTA_NAT_TYPE,
NFTA_NAT_FAMILY,
NFTA_NAT_REG_ADDR_MIN,
NFTA_NAT_REG_ADDR_MAX,
NFTA_NAT_REG_PROTO_MIN,
NFTA_NAT_REG_PROTO_MAX,
__NFTA_NAT_MAX
};
#define NFTA_NAT_MAX (__NFTA_NAT_MAX - 1)
#endif /* _LINUX_NF_TABLES_H */
include/linux/netfilter/nf_tables_compat.h 0 → 100644
View file @ 615f9fca
#ifndef _NFT_COMPAT_NFNETLINK_H_
#define _NFT_COMPAT_NFNETLINK_H_
#define NFT_COMPAT_NAME_MAX 32
enum {
NFNL_MSG_COMPAT_GET,
NFNL_MSG_COMPAT_MAX
};
enum {
NFTA_COMPAT_UNSPEC = 0,
NFTA_COMPAT_NAME,
NFTA_COMPAT_REV,
NFTA_COMPAT_TYPE,
__NFTA_COMPAT_MAX,
};
#define NFTA_COMPAT_MAX (__NFTA_COMPAT_MAX - 1)
#endif
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment