Skip to content

GitLab

Commit dab1e98e authored by Arturo Borrero Gonzalez's avatar Arturo Borrero Gonzalez
Browse files

New upstream version 1.8.1

parent f1f129da
Hide whitespace changes
Inline Side-by-side
extensions/libxt_quota.txlate 0 → 100644
View file @ dab1e98e
iptables-translate -A OUTPUT -m quota --quota 111
nft add rule ip filter OUTPUT quota 111 bytes counter
iptables-translate -A OUTPUT -m quota ! --quota 111
nft add rule ip filter OUTPUT quota over 111 bytes counter
extensions/libxt_recent.c
View file @ dab1e98e
...@@ -199,7 +199,7 @@ static void recent_print(const void *ip, const struct xt_entry_match *match, ...@@ -199,7 +199,7 @@ static void recent_print(const void *ip, const struct xt_entry_match *match,
if(info->hit_count) printf(" hit_count: %d", info->hit_count); if(info->hit_count) printf(" hit_count: %d", info->hit_count);
if (info->check_set & XT_RECENT_TTL) if (info->check_set & XT_RECENT_TTL)
printf(" TTL-Match"); printf(" TTL-Match");
if(info->name) printf(" name: %s", info->name); printf(" name: %s", info->name);
if (info->side == XT_RECENT_SOURCE) if (info->side == XT_RECENT_SOURCE)
printf(" side: source"); printf(" side: source");
if (info->side == XT_RECENT_DEST) if (info->side == XT_RECENT_DEST)
...@@ -239,7 +239,7 @@ static void recent_save(const void *ip, const struct xt_entry_match *match, ...@@ -239,7 +239,7 @@ static void recent_save(const void *ip, const struct xt_entry_match *match,
if(info->hit_count) printf(" --hitcount %d", info->hit_count); if(info->hit_count) printf(" --hitcount %d", info->hit_count);
if (info->check_set & XT_RECENT_TTL) if (info->check_set & XT_RECENT_TTL)
printf(" --rttl"); printf(" --rttl");
if(info->name) printf(" --name %s",info->name); printf(" --name %s",info->name);
switch(family) { switch(family) {
case NFPROTO_IPV4: case NFPROTO_IPV4:
......
extensions/libxt_rpfilter.txlate 0 → 100644
View file @ dab1e98e
iptables-translate -t mangle -A PREROUTING -m rpfilter
nft add rule ip mangle PREROUTING fib saddr . iif oif != 0 counter
iptables-translate -t mangle -A PREROUTING -m rpfilter --validmark --loose
nft add rule ip mangle PREROUTING fib saddr . mark oif != 0 counter
ip6tables-translate -t mangle -A PREROUTING -m rpfilter --validmark --invert
nft add rule ip6 mangle PREROUTING fib saddr . mark . iif oif 0 counter
extensions/libxt_sctp.c
View file @ dab1e98e
...@@ -370,7 +370,7 @@ print_chunk(uint32_t chunknum, int numeric) ...@@ -370,7 +370,7 @@ print_chunk(uint32_t chunknum, int numeric)
for (i = 0; i < ARRAY_SIZE(sctp_chunk_names); ++i) for (i = 0; i < ARRAY_SIZE(sctp_chunk_names); ++i)
if (sctp_chunk_names[i].chunk_type == chunknum) if (sctp_chunk_names[i].chunk_type == chunknum)
printf("%s", sctp_chunk_names[chunknum].name); printf("%s", sctp_chunk_names[i].name);
} }
} }
......
extensions/libxt_sctp.txlate 0 → 100644
View file @ dab1e98e
iptables-translate -A INPUT -p sctp --dport 80 -j DROP
nft add rule ip filter INPUT sctp dport 80 counter drop
iptables-translate -A INPUT -p sctp --sport 50 -j DROP
nft add rule ip filter INPUT sctp sport 50 counter drop
iptables-translate -A INPUT -p sctp ! --dport 80 -j DROP
nft add rule ip filter INPUT sctp dport != 80 counter drop
iptables-translate -A INPUT -p sctp ! --sport 50 -j DROP
nft add rule ip filter INPUT sctp sport != 50 counter drop
iptables-translate -A INPUT -p sctp --sport 80:100 -j ACCEPT
nft add rule ip filter INPUT sctp sport 80-100 counter accept
iptables-translate -A INPUT -p sctp --dport 50:56 -j ACCEPT
nft add rule ip filter INPUT sctp dport 50-56 counter accept
iptables-translate -A INPUT -p sctp ! --sport 80:100 -j ACCEPT
nft add rule ip filter INPUT sctp sport != 80-100 counter accept
iptables-translate -A INPUT -p sctp ! --dport 50:56 -j ACCEPT
nft add rule ip filter INPUT sctp dport != 50-56 counter accept
iptables-translate -A INPUT -p sctp --dport 80 --sport 50 -j ACCEPT
nft add rule ip filter INPUT sctp sport 50 dport 80 counter accept
iptables-translate -A INPUT -p sctp --dport 80:100 --sport 50 -j ACCEPT
nft add rule ip filter INPUT sctp sport 50 dport 80-100 counter accept
iptables-translate -A INPUT -p sctp --dport 80 --sport 50:55 -j ACCEPT
nft add rule ip filter INPUT sctp sport 50-55 dport 80 counter accept
iptables-translate -A INPUT -p sctp ! --dport 80:100 --sport 50 -j ACCEPT
nft add rule ip filter INPUT sctp sport 50 dport != 80-100 counter accept
iptables-translate -A INPUT -p sctp --dport 80 ! --sport 50:55 -j ACCEPT
nft add rule ip filter INPUT sctp sport != 50-55 dport 80 counter accept
extensions/libxt_set.c
View file @ dab1e98e
...@@ -60,6 +60,7 @@ set_parse_v0(int c, char **argv, int invert, unsigned int *flags, ...@@ -60,6 +60,7 @@ set_parse_v0(int c, char **argv, int invert, unsigned int *flags,
case '2': case '2':
fprintf(stderr, fprintf(stderr,
"--set option deprecated, please use --match-set\n"); "--set option deprecated, please use --match-set\n");
/* fall through */
case '1': /* --match-set <set> <flag>[,<flag> */ case '1': /* --match-set <set> <flag>[,<flag> */
if (info->u.flags[0]) if (info->u.flags[0])
xtables_error(PARAMETER_PROBLEM, xtables_error(PARAMETER_PROBLEM,
...@@ -140,6 +141,7 @@ set_parse_v1(int c, char **argv, int invert, unsigned int *flags, ...@@ -140,6 +141,7 @@ set_parse_v1(int c, char **argv, int invert, unsigned int *flags,
case '2': case '2':
fprintf(stderr, fprintf(stderr,
"--set option deprecated, please use --match-set\n"); "--set option deprecated, please use --match-set\n");
/* fall through */
case '1': /* --match-set <set> <flag>[,<flag> */ case '1': /* --match-set <set> <flag>[,<flag> */
if (info->dim) if (info->dim)
xtables_error(PARAMETER_PROBLEM, xtables_error(PARAMETER_PROBLEM,
...@@ -238,6 +240,7 @@ set_parse_v2(int c, char **argv, int invert, unsigned int *flags, ...@@ -238,6 +240,7 @@ set_parse_v2(int c, char **argv, int invert, unsigned int *flags,
case '2': case '2':
fprintf(stderr, fprintf(stderr,
"--set option deprecated, please use --match-set\n"); "--set option deprecated, please use --match-set\n");
/* fall through */
case '1': /* --match-set <set> <flag>[,<flag> */ case '1': /* --match-set <set> <flag>[,<flag> */
if (info->dim) if (info->dim)
xtables_error(PARAMETER_PROBLEM, xtables_error(PARAMETER_PROBLEM,
...@@ -415,6 +418,7 @@ set_parse_v3(int c, char **argv, int invert, unsigned int *flags, ...@@ -415,6 +418,7 @@ set_parse_v3(int c, char **argv, int invert, unsigned int *flags,
case '2': case '2':
fprintf(stderr, fprintf(stderr,
"--set option deprecated, please use --match-set\n"); "--set option deprecated, please use --match-set\n");
/* fall through */
case '1': /* --match-set <set> <flag>[,<flag> */ case '1': /* --match-set <set> <flag>[,<flag> */
if (info->match_set.dim) if (info->match_set.dim)
xtables_error(PARAMETER_PROBLEM, xtables_error(PARAMETER_PROBLEM,
...@@ -583,6 +587,7 @@ set_parse_v4(int c, char **argv, int invert, unsigned int *flags, ...@@ -583,6 +587,7 @@ set_parse_v4(int c, char **argv, int invert, unsigned int *flags,
case '2': case '2':
fprintf(stderr, fprintf(stderr,
"--set option deprecated, please use --match-set\n"); "--set option deprecated, please use --match-set\n");
/* fall through */
case '1': /* --match-set <set> <flag>[,<flag> */ case '1': /* --match-set <set> <flag>[,<flag> */
if (info->match_set.dim) if (info->match_set.dim)
xtables_error(PARAMETER_PROBLEM, xtables_error(PARAMETER_PROBLEM,
......
extensions/libxt_set.h
View file @ dab1e98e
...@@ -8,12 +8,6 @@ ...@@ -8,12 +8,6 @@
#include <errno.h> #include <errno.h>
#include "../iptables/xshared.h" #include "../iptables/xshared.h"
#ifdef DEBUG
#define DEBUGP(x, args...) fprintf(stderr, x , ## args)
#else
#define DEBUGP(x, args...)
#endif
static int static int
get_version(unsigned *version) get_version(unsigned *version)
{ {
......
extensions/libxt_statistic.txlate 0 → 100644
View file @ dab1e98e
iptables-translate -A OUTPUT -m statistic --mode nth --every 10 --packet 1
nft add rule ip filter OUTPUT numgen inc mod 10 1 counter
iptables-translate -A OUTPUT -m statistic --mode nth ! --every 10 --packet 5
nft add rule ip filter OUTPUT numgen inc mod 10 != 5 counter
iptables-translate -A OUTPUT -m statistic --mode random --probability 0.1
nft # -A OUTPUT -m statistic --mode random --probability 0.1
extensions/libxt_string.c
View file @ dab1e98e
...@@ -103,6 +103,9 @@ parse_hex_string(const char *s, struct xt_string_info *info) ...@@ -103,6 +103,9 @@ parse_hex_string(const char *s, struct xt_string_info *info)
} }
while (i < slen) { while (i < slen) {
if (sindex >= XT_STRING_MAX_PATTERN_SIZE)
xtables_error(PARAMETER_PROBLEM,
"STRING too long \"%s\"", s);
if (s[i] == '\\' && !hex_f) { if (s[i] == '\\' && !hex_f) {
literal_f = 1; literal_f = 1;
} else if (s[i] == '\\') { } else if (s[i] == '\\') {
...@@ -159,8 +162,6 @@ parse_hex_string(const char *s, struct xt_string_info *info) ...@@ -159,8 +162,6 @@ parse_hex_string(const char *s, struct xt_string_info *info)
info->pattern[sindex] = s[i]; info->pattern[sindex] = s[i];
i++; i++;
} }
if (sindex > XT_STRING_MAX_PATTERN_SIZE)
xtables_error(PARAMETER_PROBLEM, "STRING too long \"%s\"", s);
sindex++; sindex++;
} }
info->patlen = sindex; info->patlen = sindex;
......
extensions/libxt_tcp.txlate 0 → 100644
View file @ dab1e98e
iptables-translate -A INPUT -p tcp -i eth0 --sport 53 -j ACCEPT
nft add rule ip filter INPUT iifname "eth0" tcp sport 53 counter accept
iptables-translate -A OUTPUT -p tcp -o eth0 --dport 53:66 -j DROP
nft add rule ip filter OUTPUT oifname "eth0" tcp dport 53-66 counter drop
iptables-translate -I OUTPUT -p tcp -d 8.8.8.8 -j ACCEPT
nft insert rule ip filter OUTPUT ip protocol tcp ip daddr 8.8.8.8 counter accept
iptables-translate -I OUTPUT -p tcp --dport 1020:1023 --sport 53 -j ACCEPT
nft insert rule ip filter OUTPUT tcp sport 53 tcp dport 1020-1023 counter accept
iptables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP
nft add rule ip filter INPUT tcp flags & fin|ack == fin counter drop
iptables-translate -A INPUT -p tcp --syn -j ACCEPT
nft add rule ip filter INPUT tcp flags & (fin|syn|rst|ack) == syn counter accept
iptables-translate -A INPUT -p tcp --syn --dport 80 -j ACCEPT
nft add rule ip filter INPUT tcp dport 80 tcp flags & (fin|syn|rst|ack) == syn counter accept
iptables-translate -A INPUT -f -p tcp
nft add rule ip filter INPUT ip frag-off & 0x1fff != 0 ip protocol tcp counter
iptables-translate -A INPUT ! -f -p tcp --dport 22
nft add rule ip filter INPUT ip frag-off & 0x1fff 0 tcp dport 22 counter
extensions/libxt_tcpmss.c
View file @ dab1e98e
...@@ -27,8 +27,12 @@ static void tcpmss_parse(struct xt_option_call *cb) ...@@ -27,8 +27,12 @@ static void tcpmss_parse(struct xt_option_call *cb)
xtables_option_parse(cb); xtables_option_parse(cb);
mssinfo->mss_min = cb->val.u16_range[0]; mssinfo->mss_min = cb->val.u16_range[0];
mssinfo->mss_max = mssinfo->mss_min; mssinfo->mss_max = mssinfo->mss_min;
if (cb->nvals == 2) if (cb->nvals == 2) {
mssinfo->mss_max = cb->val.u16_range[1]; mssinfo->mss_max = cb->val.u16_range[1];
if (mssinfo->mss_max < mssinfo->mss_min)
xtables_error(PARAMETER_PROBLEM,
"tcpmss: invalid range given");
}
if (cb->invert) if (cb->invert)
mssinfo->invert = 1; mssinfo->invert = 1;
} }
......
extensions/libxt_tcpmss.man
View file @ dab1e98e
This matches the TCP MSS (maximum segment size) field of the TCP header. You can only use this on TCP SYN or SYN/ACK packets, since the MSS is only negotiated during the TCP handshake at connection startup time. This matches the TCP MSS (maximum segment size) field of the TCP header. You can only use this on TCP SYN or SYN/ACK packets, since the MSS is only negotiated during the TCP handshake at connection startup time.
.TP .TP
[\fB!\fP] \fB\-\-mss\fP \fIvalue\fP[\fB:\fP\fIvalue\fP] [\fB!\fP] \fB\-\-mss\fP \fIvalue\fP[\fB:\fP\fIvalue\fP]
Match a given TCP MSS value or range. Match a given TCP MSS value or range. If a range is given, the second \fIvalue\fP must be greater than or equal to the first \fIvalue\fP.
extensions/libxt_time.c
View file @ dab1e98e
...@@ -88,10 +88,10 @@ static void time_init(struct xt_entry_match *m) ...@@ -88,10 +88,10 @@ static void time_init(struct xt_entry_match *m)
info->date_stop = INT_MAX; info->date_stop = INT_MAX;
} }
static time_t time_parse_date(const char *s, bool end) static time_t time_parse_date(const char *s)
{ {
unsigned int month = 1, day = 1, hour = 0, minute = 0, second = 0; unsigned int month = 1, day = 1, hour = 0, minute = 0, second = 0;
unsigned int year = end ? 2038 : 1970; unsigned int year;
const char *os = s; const char *os = s;
struct tm tm; struct tm tm;
time_t ret; time_t ret;
...@@ -265,10 +265,10 @@ static void time_parse(struct xt_option_call *cb) ...@@ -265,10 +265,10 @@ static void time_parse(struct xt_option_call *cb)
xtables_option_parse(cb); xtables_option_parse(cb);
switch (cb->entry->id) { switch (cb->entry->id) {
case O_DATE_START: case O_DATE_START:
info->date_start = time_parse_date(cb->arg, false); info->date_start = time_parse_date(cb->arg);
break; break;
case O_DATE_STOP: case O_DATE_STOP:
info->date_stop = time_parse_date(cb->arg, true); info->date_stop = time_parse_date(cb->arg);
break; break;
case O_TIME_START: case O_TIME_START:
info->daytime_start = time_parse_minutes(cb->arg); info->daytime_start = time_parse_minutes(cb->arg);
......
extensions/libxt_u32.man
View file @ dab1e98e
...@@ -40,18 +40,23 @@ A is of type \fBchar *\fP, initially the address of the IP header ...@@ -40,18 +40,23 @@ A is of type \fBchar *\fP, initially the address of the IP header
B and C are unsigned 32 bit integers, initially zero B and C are unsigned 32 bit integers, initially zero
.PP .PP
The instructions are: The instructions are:
.IP .TP
number B = number; .B number
B = number;
.IP .IP
C = (*(A+B)<<24) + (*(A+B+1)<<16) + (*(A+B+2)<<8) + *(A+B+3) C = (*(A+B)<<24) + (*(A+B+1)<<16) + (*(A+B+2)<<8) + *(A+B+3)
.IP .TP
&number C = C & number .B &number
.IP C = C & number
<< number C = C << number .TP
.IP .B << number
>> number C = C >> number C = C << number
.IP .TP
@number A = A + C; then do the instruction number .B >> number
C = C >> number
.TP
.B @number
A = A + C; then do the instruction number
.PP .PP
Any access of memory outside [skb\->data,skb\->end] causes the match to fail. Any access of memory outside [skb\->data,skb\->end] causes the match to fail.
Otherwise the result of the computation is the final value of C. Otherwise the result of the computation is the final value of C.
......
extensions/libxt_udp.txlate 0 → 100644
View file @ dab1e98e
iptables-translate -A INPUT -p udp -i eth0 --sport 53 -j ACCEPT
nft add rule ip filter INPUT iifname "eth0" udp sport 53 counter accept
iptables-translate -A OUTPUT -p udp -o eth0 --dport 53:66 -j DROP
nft add rule ip filter OUTPUT oifname "eth0" udp dport 53-66 counter drop
iptables-translate -I OUTPUT -p udp -d 8.8.8.8 -j ACCEPT
nft insert rule ip filter OUTPUT ip protocol udp ip daddr 8.8.8.8 counter accept
iptables-translate -I OUTPUT -p udp --dport 1020:1023 --sport 53 -j ACCEPT
nft insert rule ip filter OUTPUT udp sport 53 udp dport 1020-1023 counter accept
include/Makefile.in
View file @ dab1e98e
# Makefile.in generated by automake 1.14.1 from Makefile.am. # Makefile.in generated by automake 1.15 from Makefile.am.
# @configure_input@ # @configure_input@
# Copyright (C) 1994-2013 Free Software Foundation, Inc. # Copyright (C) 1994-2014 Free Software Foundation, Inc.
# This Makefile.in is free software; the Free Software Foundation # This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it, # gives unlimited permission to copy and/or distribute it,
...@@ -17,7 +17,17 @@ ...@@ -17,7 +17,17 @@
# -*- Makefile -*- # -*- Makefile -*-
VPATH = @srcdir@ VPATH = @srcdir@
am__is_gnu_make = test -n '$(MAKEFILE_LIST)' && test -n '$(MAKELEVEL)' am__is_gnu_make = { \
if test -z '$(MAKELEVEL)'; then \
false; \
elif test -n '$(MAKE_HOST)'; then \
true; \
elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
true; \
else \
false; \
fi; \
}
am__make_running_with_option = \ am__make_running_with_option = \
case $${target_option-} in \ case $${target_option-} in \
?) ;; \ ?) ;; \
...@@ -81,9 +91,6 @@ build_triplet = @build@ ...@@ -81,9 +91,6 @@ build_triplet = @build@
host_triplet = @host@ host_triplet = @host@
@ENABLE_LIBIPQ_TRUE@am__append_1 = libipq/libipq.h @ENABLE_LIBIPQ_TRUE@am__append_1 = libipq/libipq.h
subdir = include subdir = include
DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/Makefile.am \
$(srcdir)/xtables-version.h.in $(am__include_HEADERS_DIST) \
$(nobase_include_HEADERS)
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
am__aclocal_m4_deps = $(top_srcdir)/m4/ax_check_linker_flags.m4 \ am__aclocal_m4_deps = $(top_srcdir)/m4/ax_check_linker_flags.m4 \
$(top_srcdir)/m4/libtool.m4 $(top_srcdir)/m4/ltoptions.m4 \ $(top_srcdir)/m4/libtool.m4 $(top_srcdir)/m4/ltoptions.m4 \
...@@ -91,6 +98,8 @@ am__aclocal_m4_deps = $(top_srcdir)/m4/ax_check_linker_flags.m4 \ ...@@ -91,6 +98,8 @@ am__aclocal_m4_deps = $(top_srcdir)/m4/ax_check_linker_flags.m4 \
$(top_srcdir)/m4/lt~obsolete.m4 $(top_srcdir)/configure.ac $(top_srcdir)/m4/lt~obsolete.m4 $(top_srcdir)/configure.ac
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4) $(ACLOCAL_M4)
DIST_COMMON = $(srcdir)/Makefile.am $(am__include_HEADERS_DIST) \
$(nobase_include_HEADERS) $(am__DIST_COMMON)
mkinstalldirs = $(install_sh) -d mkinstalldirs = $(install_sh) -d
CONFIG_HEADER = $(top_builddir)/config.h CONFIG_HEADER = $(top_builddir)/config.h
CONFIG_CLEAN_FILES = xtables-version.h CONFIG_CLEAN_FILES = xtables-version.h
...@@ -163,6 +172,7 @@ am__define_uniq_tagged_files = \ ...@@ -163,6 +172,7 @@ am__define_uniq_tagged_files = \
done | $(am__uniquify_input)` done | $(am__uniquify_input)`
ETAGS = etags ETAGS = etags
CTAGS = ctags CTAGS = ctags
am__DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/xtables-version.h.in
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
pkgdatadir = @pkgdatadir@ pkgdatadir = @pkgdatadir@
ACLOCAL = @ACLOCAL@ ACLOCAL = @ACLOCAL@
...@@ -207,6 +217,7 @@ LIBTOOL = @LIBTOOL@ ...@@ -207,6 +217,7 @@ LIBTOOL = @LIBTOOL@
LIPO = @LIPO@ LIPO = @LIPO@
LN_S = @LN_S@ LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@ LTLIBOBJS = @LTLIBOBJS@
LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
MAKEINFO = @MAKEINFO@ MAKEINFO = @MAKEINFO@
MANIFEST_TOOL = @MANIFEST_TOOL@ MANIFEST_TOOL = @MANIFEST_TOOL@
MKDIR_P = @MKDIR_P@ MKDIR_P = @MKDIR_P@
...@@ -304,6 +315,7 @@ program_transform_name = @program_transform_name@ ...@@ -304,6 +315,7 @@ program_transform_name = @program_transform_name@
psdir = @psdir@ psdir = @psdir@
regular_CFLAGS = @regular_CFLAGS@ regular_CFLAGS = @regular_CFLAGS@
regular_CPPFLAGS = @regular_CPPFLAGS@ regular_CPPFLAGS = @regular_CPPFLAGS@
runstatedir = @runstatedir@
sbindir = @sbindir@ sbindir = @sbindir@
sharedstatedir = @sharedstatedir@ sharedstatedir = @sharedstatedir@
srcdir = @srcdir@ srcdir = @srcdir@
...@@ -332,7 +344,6 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps) ...@@ -332,7 +344,6 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu include/Makefile'; \ echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu include/Makefile'; \
$(am__cd) $(top_srcdir) && \ $(am__cd) $(top_srcdir) && \
$(AUTOMAKE) --gnu include/Makefile $(AUTOMAKE) --gnu include/Makefile
.PRECIOUS: Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \ @case '$?' in \
*config.status*) \ *config.status*) \
...@@ -606,6 +617,8 @@ uninstall-am: uninstall-includeHEADERS uninstall-nobase_includeHEADERS ...@@ -606,6 +617,8 @@ uninstall-am: uninstall-includeHEADERS uninstall-nobase_includeHEADERS
uninstall-am uninstall-includeHEADERS \ uninstall-am uninstall-includeHEADERS \
uninstall-nobase_includeHEADERS uninstall-nobase_includeHEADERS
.PRECIOUS: Makefile
# Tell versions [3.59,3.63) of GNU make to not export all variables. # Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded. # Otherwise a system limit (for SysV at least) may be exceeded.
......
include/ebtables/ethernetdb.h deleted 100644 → 0
View file @ f1f129da
/*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
/* All data returned by the network data base library are supplied in
host order and returned in network order (suitable for use in
system calls). */
#ifndef _ETHERNETDB_H
#define _ETHERNETDB_H 1
#include <features.h>
#include <netinet/in.h>
#include <stdint.h>
/* Absolute file name for network data base files. */
#ifndef _PATH_ETHERTYPES
#define _PATH_ETHERTYPES "/etc/ethertypes"
#endif /* _PATH_ETHERTYPES */
struct ethertypeent {
char *e_name; /* Official ethernet type name. */
char **e_aliases; /* Alias list. */
int e_ethertype; /* Ethernet type number. */
};
/* Open ethertype data base files and mark them as staying open even
after a later search if STAY_OPEN is non-zero. */
extern void setethertypeent(int __stay_open);
/* Close ethertype data base files and clear `stay open' flag. */
extern void endethertypeent(void);
/* Get next entry from ethertype data base file. Open data base if
necessary. */
extern struct ethertypeent *getethertypeent(void);
/* Return entry from ethertype data base for network with NAME. */
extern struct ethertypeent *getethertypebyname(__const char *__name);
/* Return entry from ethertype data base which number is PROTO. */
extern struct ethertypeent *getethertypebynumber(int __ethertype);
#endif /* ethernetdb.h */
include/linux/netfilter.h
View file @ dab1e98e
...@@ -3,7 +3,9 @@ ...@@ -3,7 +3,9 @@
#include <linux/types.h> #include <linux/types.h>
#include <linux/sysctl.h> #include <linux/in.h>
#include <linux/in6.h>
#include <limits.h>
/* Responses from hook functions. */ /* Responses from hook functions. */
#define NF_DROP 0 #define NF_DROP 0
...@@ -11,7 +13,7 @@ ...@@ -11,7 +13,7 @@
#define NF_STOLEN 2 #define NF_STOLEN 2
#define NF_QUEUE 3 #define NF_QUEUE 3
#define NF_REPEAT 4 #define NF_REPEAT 4
#define NF_STOP 5 #define NF_STOP 5 /* Deprecated, for userspace nf_queue compatibility. */
#define NF_MAX_VERDICT NF_STOP #define NF_MAX_VERDICT NF_STOP
/* we overload the higher bits for encoding auxiliary data such as the queue /* we overload the higher bits for encoding auxiliary data such as the queue
...@@ -48,10 +50,17 @@ enum nf_inet_hooks { ...@@ -48,10 +50,17 @@ enum nf_inet_hooks {
NF_INET_NUMHOOKS NF_INET_NUMHOOKS
}; };
enum nf_dev_hooks {
NF_NETDEV_INGRESS,
NF_NETDEV_NUMHOOKS
};
enum { enum {
NFPROTO_UNSPEC = 0, NFPROTO_UNSPEC = 0,
NFPROTO_INET = 1,
NFPROTO_IPV4 = 2, NFPROTO_IPV4 = 2,
NFPROTO_ARP = 3, NFPROTO_ARP = 3,
NFPROTO_NETDEV = 5,
NFPROTO_BRIDGE = 7, NFPROTO_BRIDGE = 7,
NFPROTO_IPV6 = 10, NFPROTO_IPV6 = 10,
NFPROTO_DECNET = 12, NFPROTO_DECNET = 12,
...@@ -66,4 +75,4 @@ union nf_inet_addr { ...@@ -66,4 +75,4 @@ union nf_inet_addr {
struct in6_addr in6; struct in6_addr in6;
}; };
#endif /*__LINUX_NETFILTER_H*/ #endif /* __LINUX_NETFILTER_H */
include/linux/netfilter/nf_nat.h
View file @ dab1e98e
...@@ -9,10 +9,16 @@ ...@@ -9,10 +9,16 @@
#define NF_NAT_RANGE_PROTO_RANDOM (1 << 2) #define NF_NAT_RANGE_PROTO_RANDOM (1 << 2)
#define NF_NAT_RANGE_PERSISTENT (1 << 3) #define NF_NAT_RANGE_PERSISTENT (1 << 3)
#define NF_NAT_RANGE_PROTO_RANDOM_FULLY (1 << 4) #define NF_NAT_RANGE_PROTO_RANDOM_FULLY (1 << 4)
#define NF_NAT_RANGE_PROTO_OFFSET (1 << 5)
#define NF_NAT_RANGE_PROTO_RANDOM_ALL \ #define NF_NAT_RANGE_PROTO_RANDOM_ALL \
(NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PROTO_RANDOM_FULLY) (NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PROTO_RANDOM_FULLY)
#define NF_NAT_RANGE_MASK \
(NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED | \
NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PERSISTENT | \
NF_NAT_RANGE_PROTO_RANDOM_FULLY | NF_NAT_RANGE_PROTO_OFFSET)
struct nf_nat_ipv4_range { struct nf_nat_ipv4_range {
unsigned int flags; unsigned int flags;
__be32 min_ip; __be32 min_ip;
...@@ -34,4 +40,13 @@ struct nf_nat_range { ...@@ -34,4 +40,13 @@ struct nf_nat_range {
union nf_conntrack_man_proto max_proto; union nf_conntrack_man_proto max_proto;
}; };
struct nf_nat_range2 {
unsigned int flags;
union nf_inet_addr min_addr;
union nf_inet_addr max_addr;
union nf_conntrack_man_proto min_proto;
union nf_conntrack_man_proto max_proto;
union nf_conntrack_man_proto base_proto;
};
#endif /* _NETFILTER_NF_NAT_H */ #endif /* _NETFILTER_NF_NAT_H */
include/linux/netfilter/nf_tables.h
View file @ dab1e98e
/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
#ifndef _LINUX_NF_TABLES_H #ifndef _LINUX_NF_TABLES_H
#define _LINUX_NF_TABLES_H #define _LINUX_NF_TABLES_H
#define NFT_CHAIN_MAXNAMELEN 32 #define NFT_NAME_MAXLEN 256
#define NFT_TABLE_MAXNAMELEN NFT_NAME_MAXLEN
#define NFT_CHAIN_MAXNAMELEN NFT_NAME_MAXLEN
#define NFT_SET_MAXNAMELEN NFT_NAME_MAXLEN
#define NFT_OBJ_MAXNAMELEN NFT_NAME_MAXLEN
#define NFT_USERDATA_MAXLEN 256 #define NFT_USERDATA_MAXLEN 256
/**
* enum nft_registers - nf_tables registers
*
* nf_tables used to have five registers: a verdict register and four data
* registers of size 16. The data registers have been changed to 16 registers
* of size 4. For compatibility reasons, the NFT_REG_[1-4] registers still
* map to areas of size 16, the 4 byte registers are addressed using
* NFT_REG32_00 - NFT_REG32_15.
*/
enum nft_registers { enum nft_registers {
NFT_REG_VERDICT, NFT_REG_VERDICT,
NFT_REG_1, NFT_REG_1,
NFT_REG_2, NFT_REG_2,
NFT_REG_3, NFT_REG_3,
NFT_REG_4, NFT_REG_4,
__NFT_REG_MAX __NFT_REG_MAX,
NFT_REG32_00 = 8,
NFT_REG32_01,
NFT_REG32_02,
NFT_REG32_03,
NFT_REG32_04,
NFT_REG32_05,
NFT_REG32_06,
NFT_REG32_07,
NFT_REG32_08,
NFT_REG32_09,
NFT_REG32_10,
NFT_REG32_11,
NFT_REG32_12,
NFT_REG32_13,
NFT_REG32_14,
NFT_REG32_15,
}; };
#define NFT_REG_MAX (__NFT_REG_MAX - 1) #define NFT_REG_MAX (__NFT_REG_MAX - 1)
#define NFT_REG_SIZE 16
#define NFT_REG32_SIZE 4
/** /**
* enum nft_verdicts - nf_tables internal verdicts * enum nft_verdicts - nf_tables internal verdicts
* *
...@@ -51,6 +85,16 @@ enum nft_verdicts { ...@@ -51,6 +85,16 @@ enum nft_verdicts {
* @NFT_MSG_NEWSETELEM: create a new set element (enum nft_set_elem_attributes) * @NFT_MSG_NEWSETELEM: create a new set element (enum nft_set_elem_attributes)
* @NFT_MSG_GETSETELEM: get a set element (enum nft_set_elem_attributes) * @NFT_MSG_GETSETELEM: get a set element (enum nft_set_elem_attributes)
* @NFT_MSG_DELSETELEM: delete a set element (enum nft_set_elem_attributes) * @NFT_MSG_DELSETELEM: delete a set element (enum nft_set_elem_attributes)
* @NFT_MSG_NEWGEN: announce a new generation, only for events (enum nft_gen_attributes)
* @NFT_MSG_GETGEN: get the rule-set generation (enum nft_gen_attributes)
* @NFT_MSG_TRACE: trace event (enum nft_trace_attributes)
* @NFT_MSG_NEWOBJ: create a stateful object (enum nft_obj_attributes)
* @NFT_MSG_GETOBJ: get a stateful object (enum nft_obj_attributes)
* @NFT_MSG_DELOBJ: delete a stateful object (enum nft_obj_attributes)
* @NFT_MSG_GETOBJ_RESET: get and reset a stateful object (enum nft_obj_attributes)
* @NFT_MSG_NEWFLOWTABLE: add new flow table (enum nft_flowtable_attributes)
* @NFT_MSG_GETFLOWTABLE: get flow table (enum nft_flowtable_attributes)
* @NFT_MSG_DELFLOWTABLE: delete flow table (enum nft_flowtable_attributes)
*/ */
enum nf_tables_msg_types { enum nf_tables_msg_types {
NFT_MSG_NEWTABLE, NFT_MSG_NEWTABLE,
...@@ -68,6 +112,16 @@ enum nf_tables_msg_types { ...@@ -68,6 +112,16 @@ enum nf_tables_msg_types {
NFT_MSG_NEWSETELEM, NFT_MSG_NEWSETELEM,
NFT_MSG_GETSETELEM, NFT_MSG_GETSETELEM,
NFT_MSG_DELSETELEM, NFT_MSG_DELSETELEM,
NFT_MSG_NEWGEN,
NFT_MSG_GETGEN,
NFT_MSG_TRACE,
NFT_MSG_NEWOBJ,
NFT_MSG_GETOBJ,
NFT_MSG_DELOBJ,
NFT_MSG_GETOBJ_RESET,
NFT_MSG_NEWFLOWTABLE,
NFT_MSG_GETFLOWTABLE,
NFT_MSG_DELFLOWTABLE,
NFT_MSG_MAX, NFT_MSG_MAX,
}; };
...@@ -88,11 +142,13 @@ enum nft_list_attributes { ...@@ -88,11 +142,13 @@ enum nft_list_attributes {
* *
* @NFTA_HOOK_HOOKNUM: netfilter hook number (NLA_U32) * @NFTA_HOOK_HOOKNUM: netfilter hook number (NLA_U32)
* @NFTA_HOOK_PRIORITY: netfilter hook priority (NLA_U32) * @NFTA_HOOK_PRIORITY: netfilter hook priority (NLA_U32)
* @NFTA_HOOK_DEV: netdevice name (NLA_STRING)
*/ */
enum nft_hook_attributes { enum nft_hook_attributes {
NFTA_HOOK_UNSPEC, NFTA_HOOK_UNSPEC,
NFTA_HOOK_HOOKNUM, NFTA_HOOK_HOOKNUM,
NFTA_HOOK_PRIORITY, NFTA_HOOK_PRIORITY,
NFTA_HOOK_DEV,
__NFTA_HOOK_MAX __NFTA_HOOK_MAX
}; };
#define NFTA_HOOK_MAX (__NFTA_HOOK_MAX - 1) #define NFTA_HOOK_MAX (__NFTA_HOOK_MAX - 1)
...@@ -118,6 +174,8 @@ enum nft_table_attributes { ...@@ -118,6 +174,8 @@ enum nft_table_attributes {
NFTA_TABLE_NAME, NFTA_TABLE_NAME,
NFTA_TABLE_FLAGS, NFTA_TABLE_FLAGS,
NFTA_TABLE_USE, NFTA_TABLE_USE,
NFTA_TABLE_HANDLE,
NFTA_TABLE_PAD,
__NFTA_TABLE_MAX __NFTA_TABLE_MAX
}; };
#define NFTA_TABLE_MAX (__NFTA_TABLE_MAX - 1) #define NFTA_TABLE_MAX (__NFTA_TABLE_MAX - 1)
...@@ -144,6 +202,7 @@ enum nft_chain_attributes { ...@@ -144,6 +202,7 @@ enum nft_chain_attributes {
NFTA_CHAIN_USE, NFTA_CHAIN_USE,
NFTA_CHAIN_TYPE, NFTA_CHAIN_TYPE,
NFTA_CHAIN_COUNTERS, NFTA_CHAIN_COUNTERS,
NFTA_CHAIN_PAD,
__NFTA_CHAIN_MAX __NFTA_CHAIN_MAX
}; };
#define NFTA_CHAIN_MAX (__NFTA_CHAIN_MAX - 1) #define NFTA_CHAIN_MAX (__NFTA_CHAIN_MAX - 1)
...@@ -158,6 +217,7 @@ enum nft_chain_attributes { ...@@ -158,6 +217,7 @@ enum nft_chain_attributes {
* @NFTA_RULE_COMPAT: compatibility specifications of the rule (NLA_NESTED: nft_rule_compat_attributes) * @NFTA_RULE_COMPAT: compatibility specifications of the rule (NLA_NESTED: nft_rule_compat_attributes)
* @NFTA_RULE_POSITION: numeric handle of the previous rule (NLA_U64) * @NFTA_RULE_POSITION: numeric handle of the previous rule (NLA_U64)
* @NFTA_RULE_USERDATA: user data (NLA_BINARY, NFT_USERDATA_MAXLEN) * @NFTA_RULE_USERDATA: user data (NLA_BINARY, NFT_USERDATA_MAXLEN)
* @NFTA_RULE_ID: uniquely identifies a rule in a transaction (NLA_U32)
*/ */
enum nft_rule_attributes { enum nft_rule_attributes {
NFTA_RULE_UNSPEC, NFTA_RULE_UNSPEC,
...@@ -168,6 +228,8 @@ enum nft_rule_attributes { ...@@ -168,6 +228,8 @@ enum nft_rule_attributes {
NFTA_RULE_COMPAT, NFTA_RULE_COMPAT,
NFTA_RULE_POSITION, NFTA_RULE_POSITION,
NFTA_RULE_USERDATA, NFTA_RULE_USERDATA,
NFTA_RULE_PAD,
NFTA_RULE_ID,
__NFTA_RULE_MAX __NFTA_RULE_MAX
}; };
#define NFTA_RULE_MAX (__NFTA_RULE_MAX - 1) #define NFTA_RULE_MAX (__NFTA_RULE_MAX - 1)
...@@ -185,7 +247,7 @@ enum nft_rule_compat_flags { ...@@ -185,7 +247,7 @@ enum nft_rule_compat_flags {
/** /**
* enum nft_rule_compat_attributes - nf_tables rule compat attributes * enum nft_rule_compat_attributes - nf_tables rule compat attributes
* *
* @NFTA_RULE_COMPAT_PROTO: numerice value of handled protocol (NLA_U32) * @NFTA_RULE_COMPAT_PROTO: numeric value of handled protocol (NLA_U32)
* @NFTA_RULE_COMPAT_FLAGS: bitmask of enum nft_rule_compat_flags (NLA_U32) * @NFTA_RULE_COMPAT_FLAGS: bitmask of enum nft_rule_compat_flags (NLA_U32)
*/ */
enum nft_rule_compat_attributes { enum nft_rule_compat_attributes {
...@@ -203,12 +265,18 @@ enum nft_rule_compat_attributes { ...@@ -203,12 +265,18 @@ enum nft_rule_compat_attributes {
* @NFT_SET_CONSTANT: set contents may not change while bound * @NFT_SET_CONSTANT: set contents may not change while bound
* @NFT_SET_INTERVAL: set contains intervals * @NFT_SET_INTERVAL: set contains intervals
* @NFT_SET_MAP: set is used as a dictionary * @NFT_SET_MAP: set is used as a dictionary
* @NFT_SET_TIMEOUT: set uses timeouts
* @NFT_SET_EVAL: set contains expressions for evaluation
* @NFT_SET_OBJECT: set contains stateful objects
*/ */
enum nft_set_flags { enum nft_set_flags {
NFT_SET_ANONYMOUS = 0x1, NFT_SET_ANONYMOUS = 0x1,
NFT_SET_CONSTANT = 0x2, NFT_SET_CONSTANT = 0x2,
NFT_SET_INTERVAL = 0x4, NFT_SET_INTERVAL = 0x4,
NFT_SET_MAP = 0x8, NFT_SET_MAP = 0x8,
NFT_SET_TIMEOUT = 0x10,
NFT_SET_EVAL = 0x20,
NFT_SET_OBJECT = 0x40,
}; };
/** /**
...@@ -247,6 +315,11 @@ enum nft_set_desc_attributes { ...@@ -247,6 +315,11 @@ enum nft_set_desc_attributes {
* @NFTA_SET_POLICY: selection policy (NLA_U32) * @NFTA_SET_POLICY: selection policy (NLA_U32)
* @NFTA_SET_DESC: set description (NLA_NESTED) * @NFTA_SET_DESC: set description (NLA_NESTED)
* @NFTA_SET_ID: uniquely identifies a set in a transaction (NLA_U32) * @NFTA_SET_ID: uniquely identifies a set in a transaction (NLA_U32)
* @NFTA_SET_TIMEOUT: default timeout value (NLA_U64)
* @NFTA_SET_GC_INTERVAL: garbage collection interval (NLA_U32)
* @NFTA_SET_USERDATA: user data (NLA_BINARY)
* @NFTA_SET_OBJ_TYPE: stateful object type (NLA_U32: NFT_OBJECT_*)
* @NFTA_SET_HANDLE: set handle (NLA_U64)
*/ */
enum nft_set_attributes { enum nft_set_attributes {
NFTA_SET_UNSPEC, NFTA_SET_UNSPEC,
...@@ -260,6 +333,12 @@ enum nft_set_attributes { ...@@ -260,6 +333,12 @@ enum nft_set_attributes {
NFTA_SET_POLICY, NFTA_SET_POLICY,
NFTA_SET_DESC, NFTA_SET_DESC,
NFTA_SET_ID, NFTA_SET_ID,
NFTA_SET_TIMEOUT,
NFTA_SET_GC_INTERVAL,
NFTA_SET_USERDATA,
NFTA_SET_PAD,
NFTA_SET_OBJ_TYPE,
NFTA_SET_HANDLE,
__NFTA_SET_MAX __NFTA_SET_MAX
}; };
#define NFTA_SET_MAX (__NFTA_SET_MAX - 1) #define NFTA_SET_MAX (__NFTA_SET_MAX - 1)
...@@ -279,12 +358,23 @@ enum nft_set_elem_flags { ...@@ -279,12 +358,23 @@ enum nft_set_elem_flags {
* @NFTA_SET_ELEM_KEY: key value (NLA_NESTED: nft_data) * @NFTA_SET_ELEM_KEY: key value (NLA_NESTED: nft_data)
* @NFTA_SET_ELEM_DATA: data value of mapping (NLA_NESTED: nft_data_attributes) * @NFTA_SET_ELEM_DATA: data value of mapping (NLA_NESTED: nft_data_attributes)
* @NFTA_SET_ELEM_FLAGS: bitmask of nft_set_elem_flags (NLA_U32) * @NFTA_SET_ELEM_FLAGS: bitmask of nft_set_elem_flags (NLA_U32)
* @NFTA_SET_ELEM_TIMEOUT: timeout value (NLA_U64)
* @NFTA_SET_ELEM_EXPIRATION: expiration time (NLA_U64)
* @NFTA_SET_ELEM_USERDATA: user data (NLA_BINARY)
* @NFTA_SET_ELEM_EXPR: expression (NLA_NESTED: nft_expr_attributes)
* @NFTA_SET_ELEM_OBJREF: stateful object reference (NLA_STRING)
*/ */
enum nft_set_elem_attributes { enum nft_set_elem_attributes {
NFTA_SET_ELEM_UNSPEC, NFTA_SET_ELEM_UNSPEC,
NFTA_SET_ELEM_KEY, NFTA_SET_ELEM_KEY,
NFTA_SET_ELEM_DATA, NFTA_SET_ELEM_DATA,
NFTA_SET_ELEM_FLAGS, NFTA_SET_ELEM_FLAGS,
NFTA_SET_ELEM_TIMEOUT,
NFTA_SET_ELEM_EXPIRATION,
NFTA_SET_ELEM_USERDATA,
NFTA_SET_ELEM_EXPR,
NFTA_SET_ELEM_PAD,
NFTA_SET_ELEM_OBJREF,
__NFTA_SET_ELEM_MAX __NFTA_SET_ELEM_MAX
}; };
#define NFTA_SET_ELEM_MAX (__NFTA_SET_ELEM_MAX - 1) #define NFTA_SET_ELEM_MAX (__NFTA_SET_ELEM_MAX - 1)
...@@ -342,6 +432,9 @@ enum nft_data_attributes { ...@@ -342,6 +432,9 @@ enum nft_data_attributes {
}; };
#define NFTA_DATA_MAX (__NFTA_DATA_MAX - 1) #define NFTA_DATA_MAX (__NFTA_DATA_MAX - 1)
/* Maximum length of a value */
#define NFT_DATA_VALUE_MAXLEN 64
/** /**
* enum nft_verdict_attributes - nf_tables verdict netlink attributes * enum nft_verdict_attributes - nf_tables verdict netlink attributes
* *
...@@ -420,7 +513,7 @@ enum nft_bitwise_attributes { ...@@ -420,7 +513,7 @@ enum nft_bitwise_attributes {
* enum nft_byteorder_ops - nf_tables byteorder operators * enum nft_byteorder_ops - nf_tables byteorder operators
* *
* @NFT_BYTEORDER_NTOH: network to host operator * @NFT_BYTEORDER_NTOH: network to host operator
* @NFT_BYTEORDER_HTON: host to network opertaor * @NFT_BYTEORDER_HTON: host to network operator
*/ */
enum nft_byteorder_ops { enum nft_byteorder_ops {
NFT_BYTEORDER_NTOH, NFT_BYTEORDER_NTOH,
...@@ -482,6 +575,39 @@ enum nft_cmp_attributes { ...@@ -482,6 +575,39 @@ enum nft_cmp_attributes {
}; };
#define NFTA_CMP_MAX (__NFTA_CMP_MAX - 1) #define NFTA_CMP_MAX (__NFTA_CMP_MAX - 1)
/**
* enum nft_range_ops - nf_tables range operator
*
* @NFT_RANGE_EQ: equal
* @NFT_RANGE_NEQ: not equal
*/
enum nft_range_ops {
NFT_RANGE_EQ,
NFT_RANGE_NEQ,
};
/**
* enum nft_range_attributes - nf_tables range expression netlink attributes
*
* @NFTA_RANGE_SREG: source register of data to compare (NLA_U32: nft_registers)
* @NFTA_RANGE_OP: cmp operation (NLA_U32: nft_cmp_ops)
* @NFTA_RANGE_FROM_DATA: data range from (NLA_NESTED: nft_data_attributes)
* @NFTA_RANGE_TO_DATA: data range to (NLA_NESTED: nft_data_attributes)
*/
enum nft_range_attributes {
NFTA_RANGE_UNSPEC,
NFTA_RANGE_SREG,
NFTA_RANGE_OP,
NFTA_RANGE_FROM_DATA,
NFTA_RANGE_TO_DATA,
__NFTA_RANGE_MAX
};
#define NFTA_RANGE_MAX (__NFTA_RANGE_MAX - 1)
enum nft_lookup_flags {
NFT_LOOKUP_F_INV = (1 << 0),
};
/** /**
* enum nft_lookup_attributes - nf_tables set lookup expression netlink attributes * enum nft_lookup_attributes - nf_tables set lookup expression netlink attributes
* *
...@@ -489,6 +615,7 @@ enum nft_cmp_attributes { ...@@ -489,6 +615,7 @@ enum nft_cmp_attributes {
* @NFTA_LOOKUP_SREG: source register of the data to look for (NLA_U32: nft_registers) * @NFTA_LOOKUP_SREG: source register of the data to look for (NLA_U32: nft_registers)
* @NFTA_LOOKUP_DREG: destination register (NLA_U32: nft_registers) * @NFTA_LOOKUP_DREG: destination register (NLA_U32: nft_registers)
* @NFTA_LOOKUP_SET_ID: uniquely identifies a set in a transaction (NLA_U32) * @NFTA_LOOKUP_SET_ID: uniquely identifies a set in a transaction (NLA_U32)
* @NFTA_LOOKUP_FLAGS: flags (NLA_U32: enum nft_lookup_flags)
*/ */
enum nft_lookup_attributes { enum nft_lookup_attributes {
NFTA_LOOKUP_UNSPEC, NFTA_LOOKUP_UNSPEC,
...@@ -496,10 +623,47 @@ enum nft_lookup_attributes { ...@@ -496,10 +623,47 @@ enum nft_lookup_attributes {
NFTA_LOOKUP_SREG, NFTA_LOOKUP_SREG,
NFTA_LOOKUP_DREG, NFTA_LOOKUP_DREG,
NFTA_LOOKUP_SET_ID, NFTA_LOOKUP_SET_ID,
NFTA_LOOKUP_FLAGS,
__NFTA_LOOKUP_MAX __NFTA_LOOKUP_MAX
}; };
#define NFTA_LOOKUP_MAX (__NFTA_LOOKUP_MAX - 1) #define NFTA_LOOKUP_MAX (__NFTA_LOOKUP_MAX - 1)
enum nft_dynset_ops {
NFT_DYNSET_OP_ADD,
NFT_DYNSET_OP_UPDATE,
};
enum nft_dynset_flags {
NFT_DYNSET_F_INV = (1 << 0),
};
/**
* enum nft_dynset_attributes - dynset expression attributes
*
* @NFTA_DYNSET_SET_NAME: name of set the to add data to (NLA_STRING)
* @NFTA_DYNSET_SET_ID: uniquely identifier of the set in the transaction (NLA_U32)
* @NFTA_DYNSET_OP: operation (NLA_U32)
* @NFTA_DYNSET_SREG_KEY: source register of the key (NLA_U32)
* @NFTA_DYNSET_SREG_DATA: source register of the data (NLA_U32)
* @NFTA_DYNSET_TIMEOUT: timeout value for the new element (NLA_U64)
* @NFTA_DYNSET_EXPR: expression (NLA_NESTED: nft_expr_attributes)
* @NFTA_DYNSET_FLAGS: flags (NLA_U32)
*/
enum nft_dynset_attributes {
NFTA_DYNSET_UNSPEC,
NFTA_DYNSET_SET_NAME,
NFTA_DYNSET_SET_ID,
NFTA_DYNSET_OP,
NFTA_DYNSET_SREG_KEY,
NFTA_DYNSET_SREG_DATA,
NFTA_DYNSET_TIMEOUT,
NFTA_DYNSET_EXPR,
NFTA_DYNSET_PAD,
NFTA_DYNSET_FLAGS,
__NFTA_DYNSET_MAX,
};
#define NFTA_DYNSET_MAX (__NFTA_DYNSET_MAX - 1)
/** /**
* enum nft_payload_bases - nf_tables payload expression offset bases * enum nft_payload_bases - nf_tables payload expression offset bases
* *
...@@ -513,6 +677,21 @@ enum nft_payload_bases { ...@@ -513,6 +677,21 @@ enum nft_payload_bases {
NFT_PAYLOAD_TRANSPORT_HEADER, NFT_PAYLOAD_TRANSPORT_HEADER,
}; };
/**
* enum nft_payload_csum_types - nf_tables payload expression checksum types
*
* @NFT_PAYLOAD_CSUM_NONE: no checksumming
* @NFT_PAYLOAD_CSUM_INET: internet checksum (RFC 791)
*/
enum nft_payload_csum_types {
NFT_PAYLOAD_CSUM_NONE,
NFT_PAYLOAD_CSUM_INET,
};
enum nft_payload_csum_flags {
NFT_PAYLOAD_L4CSUM_PSEUDOHDR = (1 << 0),
};
/** /**
* enum nft_payload_attributes - nf_tables payload expression netlink attributes * enum nft_payload_attributes - nf_tables payload expression netlink attributes
* *
...@@ -520,6 +699,10 @@ enum nft_payload_bases { ...@@ -520,6 +699,10 @@ enum nft_payload_bases {
* @NFTA_PAYLOAD_BASE: payload base (NLA_U32: nft_payload_bases) * @NFTA_PAYLOAD_BASE: payload base (NLA_U32: nft_payload_bases)
* @NFTA_PAYLOAD_OFFSET: payload offset relative to base (NLA_U32) * @NFTA_PAYLOAD_OFFSET: payload offset relative to base (NLA_U32)
* @NFTA_PAYLOAD_LEN: payload length (NLA_U32) * @NFTA_PAYLOAD_LEN: payload length (NLA_U32)
* @NFTA_PAYLOAD_SREG: source register to load data from (NLA_U32: nft_registers)
* @NFTA_PAYLOAD_CSUM_TYPE: checksum type (NLA_U32)
* @NFTA_PAYLOAD_CSUM_OFFSET: checksum offset relative to base (NLA_U32)
* @NFTA_PAYLOAD_CSUM_FLAGS: checksum flags (NLA_U32)
*/ */
enum nft_payload_attributes { enum nft_payload_attributes {
NFTA_PAYLOAD_UNSPEC, NFTA_PAYLOAD_UNSPEC,
...@@ -527,17 +710,41 @@ enum nft_payload_attributes { ...@@ -527,17 +710,41 @@ enum nft_payload_attributes {
NFTA_PAYLOAD_BASE, NFTA_PAYLOAD_BASE,
NFTA_PAYLOAD_OFFSET, NFTA_PAYLOAD_OFFSET,
NFTA_PAYLOAD_LEN, NFTA_PAYLOAD_LEN,
NFTA_PAYLOAD_SREG,
NFTA_PAYLOAD_CSUM_TYPE,
NFTA_PAYLOAD_CSUM_OFFSET,
NFTA_PAYLOAD_CSUM_FLAGS,
__NFTA_PAYLOAD_MAX __NFTA_PAYLOAD_MAX
}; };
#define NFTA_PAYLOAD_MAX (__NFTA_PAYLOAD_MAX - 1) #define NFTA_PAYLOAD_MAX (__NFTA_PAYLOAD_MAX - 1)
enum nft_exthdr_flags {
NFT_EXTHDR_F_PRESENT = (1 << 0),
};
/**
* enum nft_exthdr_op - nf_tables match options
*
* @NFT_EXTHDR_OP_IPV6: match against ipv6 extension headers
* @NFT_EXTHDR_OP_TCP: match against tcp options
*/
enum nft_exthdr_op {
NFT_EXTHDR_OP_IPV6,
NFT_EXTHDR_OP_TCPOPT,
__NFT_EXTHDR_OP_MAX
};
#define NFT_EXTHDR_OP_MAX (__NFT_EXTHDR_OP_MAX - 1)
/** /**
* enum nft_exthdr_attributes - nf_tables IPv6 extension header expression netlink attributes * enum nft_exthdr_attributes - nf_tables extension header expression netlink attributes
* *
* @NFTA_EXTHDR_DREG: destination register (NLA_U32: nft_registers) * @NFTA_EXTHDR_DREG: destination register (NLA_U32: nft_registers)
* @NFTA_EXTHDR_TYPE: extension header type (NLA_U8) * @NFTA_EXTHDR_TYPE: extension header type (NLA_U8)
* @NFTA_EXTHDR_OFFSET: extension header offset (NLA_U32) * @NFTA_EXTHDR_OFFSET: extension header offset (NLA_U32)
* @NFTA_EXTHDR_LEN: extension header length (NLA_U32) * @NFTA_EXTHDR_LEN: extension header length (NLA_U32)
* @NFTA_EXTHDR_FLAGS: extension header flags (NLA_U32)
* @NFTA_EXTHDR_OP: option match type (NLA_U32)
* @NFTA_EXTHDR_SREG: option match type (NLA_U32)
*/ */
enum nft_exthdr_attributes { enum nft_exthdr_attributes {
NFTA_EXTHDR_UNSPEC, NFTA_EXTHDR_UNSPEC,
...@@ -545,6 +752,9 @@ enum nft_exthdr_attributes { ...@@ -545,6 +752,9 @@ enum nft_exthdr_attributes {
NFTA_EXTHDR_TYPE, NFTA_EXTHDR_TYPE,
NFTA_EXTHDR_OFFSET, NFTA_EXTHDR_OFFSET,
NFTA_EXTHDR_LEN, NFTA_EXTHDR_LEN,
NFTA_EXTHDR_FLAGS,
NFTA_EXTHDR_OP,
NFTA_EXTHDR_SREG,
__NFTA_EXTHDR_MAX __NFTA_EXTHDR_MAX
}; };
#define NFTA_EXTHDR_MAX (__NFTA_EXTHDR_MAX - 1) #define NFTA_EXTHDR_MAX (__NFTA_EXTHDR_MAX - 1)
...@@ -571,6 +781,13 @@ enum nft_exthdr_attributes { ...@@ -571,6 +781,13 @@ enum nft_exthdr_attributes {
* @NFT_META_L4PROTO: layer 4 protocol number * @NFT_META_L4PROTO: layer 4 protocol number
* @NFT_META_BRI_IIFNAME: packet input bridge interface name * @NFT_META_BRI_IIFNAME: packet input bridge interface name
* @NFT_META_BRI_OIFNAME: packet output bridge interface name * @NFT_META_BRI_OIFNAME: packet output bridge interface name
* @NFT_META_PKTTYPE: packet type (skb->pkt_type), special handling for loopback
* @NFT_META_CPU: cpu id through smp_processor_id()
* @NFT_META_IIFGROUP: packet input interface group
* @NFT_META_OIFGROUP: packet output interface group
* @NFT_META_CGROUP: socket control group (skb->sk->sk_classid)
* @NFT_META_PRANDOM: a 32bit pseudo-random number
* @NFT_META_SECPATH: boolean, secpath_exists (!!skb->sp)
*/ */
enum nft_meta_keys { enum nft_meta_keys {
NFT_META_LEN, NFT_META_LEN,
...@@ -592,7 +809,64 @@ enum nft_meta_keys { ...@@ -592,7 +809,64 @@ enum nft_meta_keys {
NFT_META_L4PROTO, NFT_META_L4PROTO,
NFT_META_BRI_IIFNAME, NFT_META_BRI_IIFNAME,
NFT_META_BRI_OIFNAME, NFT_META_BRI_OIFNAME,
NFT_META_PKTTYPE,
NFT_META_CPU,
NFT_META_IIFGROUP,
NFT_META_OIFGROUP,
NFT_META_CGROUP,
NFT_META_PRANDOM,
NFT_META_SECPATH,
};
/**
* enum nft_rt_keys - nf_tables routing expression keys
*
* @NFT_RT_CLASSID: realm value of packet's route (skb->dst->tclassid)
* @NFT_RT_NEXTHOP4: routing nexthop for IPv4
* @NFT_RT_NEXTHOP6: routing nexthop for IPv6
* @NFT_RT_TCPMSS: fetch current path tcp mss
*/
enum nft_rt_keys {
NFT_RT_CLASSID,
NFT_RT_NEXTHOP4,
NFT_RT_NEXTHOP6,
NFT_RT_TCPMSS,
};
/**
* enum nft_hash_types - nf_tables hash expression types
*
* @NFT_HASH_JENKINS: Jenkins Hash
* @NFT_HASH_SYM: Symmetric Hash
*/
enum nft_hash_types {
NFT_HASH_JENKINS,
NFT_HASH_SYM,
};
/**
* enum nft_hash_attributes - nf_tables hash expression netlink attributes
*
* @NFTA_HASH_SREG: source register (NLA_U32)
* @NFTA_HASH_DREG: destination register (NLA_U32)
* @NFTA_HASH_LEN: source data length (NLA_U32)
* @NFTA_HASH_MODULUS: modulus value (NLA_U32)
* @NFTA_HASH_SEED: seed value (NLA_U32)
* @NFTA_HASH_OFFSET: add this offset value to hash result (NLA_U32)
* @NFTA_HASH_TYPE: hash operation (NLA_U32: nft_hash_types)
*/
enum nft_hash_attributes {
NFTA_HASH_UNSPEC,
NFTA_HASH_SREG,
NFTA_HASH_DREG,
NFTA_HASH_LEN,
NFTA_HASH_MODULUS,
NFTA_HASH_SEED,
NFTA_HASH_OFFSET,
NFTA_HASH_TYPE,
__NFTA_HASH_MAX,
}; };
#define NFTA_HASH_MAX (__NFTA_HASH_MAX - 1)
/** /**
* enum nft_meta_attributes - nf_tables meta expression netlink attributes * enum nft_meta_attributes - nf_tables meta expression netlink attributes
...@@ -610,6 +884,20 @@ enum nft_meta_attributes { ...@@ -610,6 +884,20 @@ enum nft_meta_attributes {
}; };
#define NFTA_META_MAX (__NFTA_META_MAX - 1) #define NFTA_META_MAX (__NFTA_META_MAX - 1)
/**
* enum nft_rt_attributes - nf_tables routing expression netlink attributes
*
* @NFTA_RT_DREG: destination register (NLA_U32)
* @NFTA_RT_KEY: routing data item to load (NLA_U32: nft_rt_keys)
*/
enum nft_rt_attributes {
NFTA_RT_UNSPEC,
NFTA_RT_DREG,
NFTA_RT_KEY,
__NFTA_RT_MAX
};
#define NFTA_RT_MAX (__NFTA_RT_MAX - 1)
/** /**
* enum nft_ct_keys - nf_tables ct expression keys * enum nft_ct_keys - nf_tables ct expression keys
* *
...@@ -626,6 +914,12 @@ enum nft_meta_attributes { ...@@ -626,6 +914,12 @@ enum nft_meta_attributes {
* @NFT_CT_PROTOCOL: conntrack layer 4 protocol * @NFT_CT_PROTOCOL: conntrack layer 4 protocol
* @NFT_CT_PROTO_SRC: conntrack layer 4 protocol source * @NFT_CT_PROTO_SRC: conntrack layer 4 protocol source
* @NFT_CT_PROTO_DST: conntrack layer 4 protocol destination * @NFT_CT_PROTO_DST: conntrack layer 4 protocol destination
* @NFT_CT_LABELS: conntrack labels
* @NFT_CT_PKTS: conntrack packets
* @NFT_CT_BYTES: conntrack bytes
* @NFT_CT_AVGPKT: conntrack average bytes per packet
* @NFT_CT_ZONE: conntrack zone
* @NFT_CT_EVENTMASK: ctnetlink events to be generated for this conntrack
*/ */
enum nft_ct_keys { enum nft_ct_keys {
NFT_CT_STATE, NFT_CT_STATE,
...@@ -642,6 +936,11 @@ enum nft_ct_keys { ...@@ -642,6 +936,11 @@ enum nft_ct_keys {
NFT_CT_PROTO_SRC, NFT_CT_PROTO_SRC,
NFT_CT_PROTO_DST, NFT_CT_PROTO_DST,
NFT_CT_LABELS, NFT_CT_LABELS,
NFT_CT_PKTS,
NFT_CT_BYTES,
NFT_CT_AVGPKT,
NFT_CT_ZONE,
NFT_CT_EVENTMASK,
}; };
/** /**
...@@ -662,16 +961,43 @@ enum nft_ct_attributes { ...@@ -662,16 +961,43 @@ enum nft_ct_attributes {
}; };
#define NFTA_CT_MAX (__NFTA_CT_MAX - 1) #define NFTA_CT_MAX (__NFTA_CT_MAX - 1)
/**
* enum nft_flow_attributes - ct offload expression attributes
* @NFTA_FLOW_TABLE_NAME: flow table name (NLA_STRING)
*/
enum nft_offload_attributes {
NFTA_FLOW_UNSPEC,
NFTA_FLOW_TABLE_NAME,
__NFTA_FLOW_MAX,
};
#define NFTA_FLOW_MAX (__NFTA_FLOW_MAX - 1)
enum nft_limit_type {
NFT_LIMIT_PKTS,
NFT_LIMIT_PKT_BYTES
};
enum nft_limit_flags {
NFT_LIMIT_F_INV = (1 << 0),
};
/** /**
* enum nft_limit_attributes - nf_tables limit expression netlink attributes * enum nft_limit_attributes - nf_tables limit expression netlink attributes
* *
* @NFTA_LIMIT_RATE: refill rate (NLA_U64) * @NFTA_LIMIT_RATE: refill rate (NLA_U64)
* @NFTA_LIMIT_UNIT: refill unit (NLA_U64) * @NFTA_LIMIT_UNIT: refill unit (NLA_U64)
* @NFTA_LIMIT_BURST: burst (NLA_U32)
* @NFTA_LIMIT_TYPE: type of limit (NLA_U32: enum nft_limit_type)
* @NFTA_LIMIT_FLAGS: flags (NLA_U32: enum nft_limit_flags)
*/ */
enum nft_limit_attributes { enum nft_limit_attributes {
NFTA_LIMIT_UNSPEC, NFTA_LIMIT_UNSPEC,
NFTA_LIMIT_RATE, NFTA_LIMIT_RATE,
NFTA_LIMIT_UNIT, NFTA_LIMIT_UNIT,
NFTA_LIMIT_BURST,
NFTA_LIMIT_TYPE,
NFTA_LIMIT_FLAGS,
NFTA_LIMIT_PAD,
__NFTA_LIMIT_MAX __NFTA_LIMIT_MAX
}; };
#define NFTA_LIMIT_MAX (__NFTA_LIMIT_MAX - 1) #define NFTA_LIMIT_MAX (__NFTA_LIMIT_MAX - 1)
...@@ -686,6 +1012,7 @@ enum nft_counter_attributes { ...@@ -686,6 +1012,7 @@ enum nft_counter_attributes {
NFTA_COUNTER_UNSPEC, NFTA_COUNTER_UNSPEC,
NFTA_COUNTER_BYTES, NFTA_COUNTER_BYTES,
NFTA_COUNTER_PACKETS, NFTA_COUNTER_PACKETS,
NFTA_COUNTER_PAD,
__NFTA_COUNTER_MAX __NFTA_COUNTER_MAX
}; };
#define NFTA_COUNTER_MAX (__NFTA_COUNTER_MAX - 1) #define NFTA_COUNTER_MAX (__NFTA_COUNTER_MAX - 1)
...@@ -718,12 +1045,14 @@ enum nft_log_attributes { ...@@ -718,12 +1045,14 @@ enum nft_log_attributes {
* @NFTA_QUEUE_NUM: netlink queue to send messages to (NLA_U16) * @NFTA_QUEUE_NUM: netlink queue to send messages to (NLA_U16)
* @NFTA_QUEUE_TOTAL: number of queues to load balance packets on (NLA_U16) * @NFTA_QUEUE_TOTAL: number of queues to load balance packets on (NLA_U16)
* @NFTA_QUEUE_FLAGS: various flags (NLA_U16) * @NFTA_QUEUE_FLAGS: various flags (NLA_U16)
* @NFTA_QUEUE_SREG_QNUM: source register of queue number (NLA_U32: nft_registers)
*/ */
enum nft_queue_attributes { enum nft_queue_attributes {
NFTA_QUEUE_UNSPEC, NFTA_QUEUE_UNSPEC,
NFTA_QUEUE_NUM, NFTA_QUEUE_NUM,
NFTA_QUEUE_TOTAL, NFTA_QUEUE_TOTAL,
NFTA_QUEUE_FLAGS, NFTA_QUEUE_FLAGS,
NFTA_QUEUE_SREG_QNUM,
__NFTA_QUEUE_MAX __NFTA_QUEUE_MAX
}; };
#define NFTA_QUEUE_MAX (__NFTA_QUEUE_MAX - 1) #define NFTA_QUEUE_MAX (__NFTA_QUEUE_MAX - 1)
...@@ -732,17 +1061,60 @@ enum nft_queue_attributes { ...@@ -732,17 +1061,60 @@ enum nft_queue_attributes {
#define NFT_QUEUE_FLAG_CPU_FANOUT 0x02 /* use current CPU (no hashing) */ #define NFT_QUEUE_FLAG_CPU_FANOUT 0x02 /* use current CPU (no hashing) */
#define NFT_QUEUE_FLAG_MASK 0x03 #define NFT_QUEUE_FLAG_MASK 0x03
enum nft_quota_flags {
NFT_QUOTA_F_INV = (1 << 0),
NFT_QUOTA_F_DEPLETED = (1 << 1),
};
/**
* enum nft_quota_attributes - nf_tables quota expression netlink attributes
*
* @NFTA_QUOTA_BYTES: quota in bytes (NLA_U16)
* @NFTA_QUOTA_FLAGS: flags (NLA_U32)
* @NFTA_QUOTA_CONSUMED: quota already consumed in bytes (NLA_U64)
*/
enum nft_quota_attributes {
NFTA_QUOTA_UNSPEC,
NFTA_QUOTA_BYTES,
NFTA_QUOTA_FLAGS,
NFTA_QUOTA_PAD,
NFTA_QUOTA_CONSUMED,
__NFTA_QUOTA_MAX
};
#define NFTA_QUOTA_MAX (__NFTA_QUOTA_MAX - 1)
/** /**
* enum nft_reject_types - nf_tables reject expression reject types * enum nft_reject_types - nf_tables reject expression reject types
* *
* @NFT_REJECT_ICMP_UNREACH: reject using ICMP unreachable * @NFT_REJECT_ICMP_UNREACH: reject using ICMP unreachable
* @NFT_REJECT_TCP_RST: reject using TCP RST * @NFT_REJECT_TCP_RST: reject using TCP RST
* @NFT_REJECT_ICMPX_UNREACH: abstracted ICMP unreachable for bridge and inet
*/ */
enum nft_reject_types { enum nft_reject_types {
NFT_REJECT_ICMP_UNREACH, NFT_REJECT_ICMP_UNREACH,
NFT_REJECT_TCP_RST, NFT_REJECT_TCP_RST,
NFT_REJECT_ICMPX_UNREACH,
}; };
/**
* enum nft_reject_code - Generic reject codes for IPv4/IPv6
*
* @NFT_REJECT_ICMPX_NO_ROUTE: no route to host / network unreachable
* @NFT_REJECT_ICMPX_PORT_UNREACH: port unreachable
* @NFT_REJECT_ICMPX_HOST_UNREACH: host unreachable
* @NFT_REJECT_ICMPX_ADMIN_PROHIBITED: administratively prohibited
*
* These codes are mapped to real ICMP and ICMPv6 codes.
*/
enum nft_reject_inet_code {
NFT_REJECT_ICMPX_NO_ROUTE = 0,
NFT_REJECT_ICMPX_PORT_UNREACH,
NFT_REJECT_ICMPX_HOST_UNREACH,
NFT_REJECT_ICMPX_ADMIN_PROHIBITED,
__NFT_REJECT_ICMPX_MAX
};
#define NFT_REJECT_ICMPX_MAX (__NFT_REJECT_ICMPX_MAX - 1)
/** /**
* enum nft_reject_attributes - nf_tables reject expression netlink attributes * enum nft_reject_attributes - nf_tables reject expression netlink attributes
* *
...@@ -777,6 +1149,7 @@ enum nft_nat_types { ...@@ -777,6 +1149,7 @@ enum nft_nat_types {
* @NFTA_NAT_REG_ADDR_MAX: source register of address range end (NLA_U32: nft_registers) * @NFTA_NAT_REG_ADDR_MAX: source register of address range end (NLA_U32: nft_registers)
* @NFTA_NAT_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers) * @NFTA_NAT_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
* @NFTA_NAT_REG_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers) * @NFTA_NAT_REG_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers)
* @NFTA_NAT_FLAGS: NAT flags (see NF_NAT_RANGE_* in linux/netfilter/nf_nat.h) (NLA_U32)
*/ */
enum nft_nat_attributes { enum nft_nat_attributes {
NFTA_NAT_UNSPEC, NFTA_NAT_UNSPEC,
...@@ -786,8 +1159,305 @@ enum nft_nat_attributes { ...@@ -786,8 +1159,305 @@ enum nft_nat_attributes {
NFTA_NAT_REG_ADDR_MAX, NFTA_NAT_REG_ADDR_MAX,
NFTA_NAT_REG_PROTO_MIN, NFTA_NAT_REG_PROTO_MIN,
NFTA_NAT_REG_PROTO_MAX, NFTA_NAT_REG_PROTO_MAX,
NFTA_NAT_FLAGS,
__NFTA_NAT_MAX __NFTA_NAT_MAX
}; };
#define NFTA_NAT_MAX (__NFTA_NAT_MAX - 1) #define NFTA_NAT_MAX (__NFTA_NAT_MAX - 1)
/**
* enum nft_masq_attributes - nf_tables masquerade expression attributes
*
* @NFTA_MASQ_FLAGS: NAT flags (see NF_NAT_RANGE_* in linux/netfilter/nf_nat.h) (NLA_U32)
* @NFTA_MASQ_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
* @NFTA_MASQ_REG_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers)
*/
enum nft_masq_attributes {
NFTA_MASQ_UNSPEC,
NFTA_MASQ_FLAGS,
NFTA_MASQ_REG_PROTO_MIN,
NFTA_MASQ_REG_PROTO_MAX,
__NFTA_MASQ_MAX
};
#define NFTA_MASQ_MAX (__NFTA_MASQ_MAX - 1)
/**
* enum nft_redir_attributes - nf_tables redirect expression netlink attributes
*
* @NFTA_REDIR_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
* @NFTA_REDIR_REG_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers)
* @NFTA_REDIR_FLAGS: NAT flags (see NF_NAT_RANGE_* in linux/netfilter/nf_nat.h) (NLA_U32)
*/
enum nft_redir_attributes {
NFTA_REDIR_UNSPEC,
NFTA_REDIR_REG_PROTO_MIN,
NFTA_REDIR_REG_PROTO_MAX,
NFTA_REDIR_FLAGS,
__NFTA_REDIR_MAX
};
#define NFTA_REDIR_MAX (__NFTA_REDIR_MAX - 1)
/**
* enum nft_dup_attributes - nf_tables dup expression netlink attributes
*
* @NFTA_DUP_SREG_ADDR: source register of address (NLA_U32: nft_registers)
* @NFTA_DUP_SREG_DEV: source register of output interface (NLA_U32: nft_register)
*/
enum nft_dup_attributes {
NFTA_DUP_UNSPEC,
NFTA_DUP_SREG_ADDR,
NFTA_DUP_SREG_DEV,
__NFTA_DUP_MAX
};
#define NFTA_DUP_MAX (__NFTA_DUP_MAX - 1)
/**
* enum nft_fwd_attributes - nf_tables fwd expression netlink attributes
*
* @NFTA_FWD_SREG_DEV: source register of output interface (NLA_U32: nft_register)
*/
enum nft_fwd_attributes {
NFTA_FWD_UNSPEC,
NFTA_FWD_SREG_DEV,
__NFTA_FWD_MAX
};
#define NFTA_FWD_MAX (__NFTA_FWD_MAX - 1)
/**
* enum nft_objref_attributes - nf_tables stateful object expression netlink attributes
*
* @NFTA_OBJREF_IMM_TYPE: object type for immediate reference (NLA_U32: nft_register)
* @NFTA_OBJREF_IMM_NAME: object name for immediate reference (NLA_STRING)
* @NFTA_OBJREF_SET_SREG: source register of the data to look for (NLA_U32: nft_registers)
* @NFTA_OBJREF_SET_NAME: name of the set where to look for (NLA_STRING)
* @NFTA_OBJREF_SET_ID: id of the set where to look for in this transaction (NLA_U32)
*/
enum nft_objref_attributes {
NFTA_OBJREF_UNSPEC,
NFTA_OBJREF_IMM_TYPE,
NFTA_OBJREF_IMM_NAME,
NFTA_OBJREF_SET_SREG,
NFTA_OBJREF_SET_NAME,
NFTA_OBJREF_SET_ID,
__NFTA_OBJREF_MAX
};
#define NFTA_OBJREF_MAX (__NFTA_OBJREF_MAX - 1)
/**
* enum nft_gen_attributes - nf_tables ruleset generation attributes
*
* @NFTA_GEN_ID: Ruleset generation ID (NLA_U32)
*/
enum nft_gen_attributes {
NFTA_GEN_UNSPEC,
NFTA_GEN_ID,
NFTA_GEN_PROC_PID,
NFTA_GEN_PROC_NAME,
__NFTA_GEN_MAX
};
#define NFTA_GEN_MAX (__NFTA_GEN_MAX - 1)
/*
* enum nft_fib_attributes - nf_tables fib expression netlink attributes
*
* @NFTA_FIB_DREG: destination register (NLA_U32)
* @NFTA_FIB_RESULT: desired result (NLA_U32)
* @NFTA_FIB_FLAGS: flowi fields to initialize when querying the FIB (NLA_U32)
*
* The FIB expression performs a route lookup according
* to the packet data.
*/
enum nft_fib_attributes {
NFTA_FIB_UNSPEC,
NFTA_FIB_DREG,
NFTA_FIB_RESULT,
NFTA_FIB_FLAGS,
__NFTA_FIB_MAX
};
#define NFTA_FIB_MAX (__NFTA_FIB_MAX - 1)
enum nft_fib_result {
NFT_FIB_RESULT_UNSPEC,
NFT_FIB_RESULT_OIF,
NFT_FIB_RESULT_OIFNAME,
NFT_FIB_RESULT_ADDRTYPE,
__NFT_FIB_RESULT_MAX
};
#define NFT_FIB_RESULT_MAX (__NFT_FIB_RESULT_MAX - 1)
enum nft_fib_flags {
NFTA_FIB_F_SADDR = 1 << 0, /* look up src */
NFTA_FIB_F_DADDR = 1 << 1, /* look up dst */
NFTA_FIB_F_MARK = 1 << 2, /* use skb->mark */
NFTA_FIB_F_IIF = 1 << 3, /* restrict to iif */
NFTA_FIB_F_OIF = 1 << 4, /* restrict to oif */
NFTA_FIB_F_PRESENT = 1 << 5, /* check existence only */
};
enum nft_ct_helper_attributes {
NFTA_CT_HELPER_UNSPEC,
NFTA_CT_HELPER_NAME,
NFTA_CT_HELPER_L3PROTO,
NFTA_CT_HELPER_L4PROTO,
__NFTA_CT_HELPER_MAX,
};
#define NFTA_CT_HELPER_MAX (__NFTA_CT_HELPER_MAX - 1)
#define NFT_OBJECT_UNSPEC 0
#define NFT_OBJECT_COUNTER 1
#define NFT_OBJECT_QUOTA 2
#define NFT_OBJECT_CT_HELPER 3
#define NFT_OBJECT_LIMIT 4
#define __NFT_OBJECT_MAX 5
#define NFT_OBJECT_MAX (__NFT_OBJECT_MAX - 1)
/**
* enum nft_object_attributes - nf_tables stateful object netlink attributes
*
* @NFTA_OBJ_TABLE: name of the table containing the expression (NLA_STRING)
* @NFTA_OBJ_NAME: name of this expression type (NLA_STRING)
* @NFTA_OBJ_TYPE: stateful object type (NLA_U32)
* @NFTA_OBJ_DATA: stateful object data (NLA_NESTED)
* @NFTA_OBJ_USE: number of references to this expression (NLA_U32)
* @NFTA_OBJ_HANDLE: object handle (NLA_U64)
*/
enum nft_object_attributes {
NFTA_OBJ_UNSPEC,
NFTA_OBJ_TABLE,
NFTA_OBJ_NAME,
NFTA_OBJ_TYPE,
NFTA_OBJ_DATA,
NFTA_OBJ_USE,
NFTA_OBJ_HANDLE,
NFTA_OBJ_PAD,
__NFTA_OBJ_MAX
};
#define NFTA_OBJ_MAX (__NFTA_OBJ_MAX - 1)
/**
* enum nft_flowtable_attributes - nf_tables flow table netlink attributes
*
* @NFTA_FLOWTABLE_TABLE: name of the table containing the expression (NLA_STRING)
* @NFTA_FLOWTABLE_NAME: name of this flow table (NLA_STRING)
* @NFTA_FLOWTABLE_HOOK: netfilter hook configuration(NLA_U32)
* @NFTA_FLOWTABLE_USE: number of references to this flow table (NLA_U32)
* @NFTA_FLOWTABLE_HANDLE: object handle (NLA_U64)
*/
enum nft_flowtable_attributes {
NFTA_FLOWTABLE_UNSPEC,
NFTA_FLOWTABLE_TABLE,
NFTA_FLOWTABLE_NAME,
NFTA_FLOWTABLE_HOOK,
NFTA_FLOWTABLE_USE,
NFTA_FLOWTABLE_HANDLE,
NFTA_FLOWTABLE_PAD,
__NFTA_FLOWTABLE_MAX
};
#define NFTA_FLOWTABLE_MAX (__NFTA_FLOWTABLE_MAX - 1)
/**
* enum nft_flowtable_hook_attributes - nf_tables flow table hook netlink attributes
*
* @NFTA_FLOWTABLE_HOOK_NUM: netfilter hook number (NLA_U32)
* @NFTA_FLOWTABLE_HOOK_PRIORITY: netfilter hook priority (NLA_U32)
* @NFTA_FLOWTABLE_HOOK_DEVS: input devices this flow table is bound to (NLA_NESTED)
*/
enum nft_flowtable_hook_attributes {
NFTA_FLOWTABLE_HOOK_UNSPEC,
NFTA_FLOWTABLE_HOOK_NUM,
NFTA_FLOWTABLE_HOOK_PRIORITY,
NFTA_FLOWTABLE_HOOK_DEVS,
__NFTA_FLOWTABLE_HOOK_MAX
};
#define NFTA_FLOWTABLE_HOOK_MAX (__NFTA_FLOWTABLE_HOOK_MAX - 1)
/**
* enum nft_device_attributes - nf_tables device netlink attributes
*
* @NFTA_DEVICE_NAME: name of this device (NLA_STRING)
*/
enum nft_devices_attributes {
NFTA_DEVICE_UNSPEC,
NFTA_DEVICE_NAME,
__NFTA_DEVICE_MAX
};
#define NFTA_DEVICE_MAX (__NFTA_DEVICE_MAX - 1)
/**
* enum nft_trace_attributes - nf_tables trace netlink attributes
*
* @NFTA_TRACE_TABLE: name of the table (NLA_STRING)
* @NFTA_TRACE_CHAIN: name of the chain (NLA_STRING)
* @NFTA_TRACE_RULE_HANDLE: numeric handle of the rule (NLA_U64)
* @NFTA_TRACE_TYPE: type of the event (NLA_U32: nft_trace_types)
* @NFTA_TRACE_VERDICT: verdict returned by hook (NLA_NESTED: nft_verdicts)
* @NFTA_TRACE_ID: pseudo-id, same for each skb traced (NLA_U32)
* @NFTA_TRACE_LL_HEADER: linklayer header (NLA_BINARY)
* @NFTA_TRACE_NETWORK_HEADER: network header (NLA_BINARY)
* @NFTA_TRACE_TRANSPORT_HEADER: transport header (NLA_BINARY)
* @NFTA_TRACE_IIF: indev ifindex (NLA_U32)
* @NFTA_TRACE_IIFTYPE: netdev->type of indev (NLA_U16)
* @NFTA_TRACE_OIF: outdev ifindex (NLA_U32)
* @NFTA_TRACE_OIFTYPE: netdev->type of outdev (NLA_U16)
* @NFTA_TRACE_MARK: nfmark (NLA_U32)
* @NFTA_TRACE_NFPROTO: nf protocol processed (NLA_U32)
* @NFTA_TRACE_POLICY: policy that decided fate of packet (NLA_U32)
*/
enum nft_trace_attributes {
NFTA_TRACE_UNSPEC,
NFTA_TRACE_TABLE,
NFTA_TRACE_CHAIN,
NFTA_TRACE_RULE_HANDLE,
NFTA_TRACE_TYPE,
NFTA_TRACE_VERDICT,
NFTA_TRACE_ID,
NFTA_TRACE_LL_HEADER,
NFTA_TRACE_NETWORK_HEADER,
NFTA_TRACE_TRANSPORT_HEADER,
NFTA_TRACE_IIF,
NFTA_TRACE_IIFTYPE,
NFTA_TRACE_OIF,
NFTA_TRACE_OIFTYPE,
NFTA_TRACE_MARK,
NFTA_TRACE_NFPROTO,
NFTA_TRACE_POLICY,
NFTA_TRACE_PAD,
__NFTA_TRACE_MAX
};
#define NFTA_TRACE_MAX (__NFTA_TRACE_MAX - 1)
enum nft_trace_types {
NFT_TRACETYPE_UNSPEC,
NFT_TRACETYPE_POLICY,
NFT_TRACETYPE_RETURN,
NFT_TRACETYPE_RULE,
__NFT_TRACETYPE_MAX
};
#define NFT_TRACETYPE_MAX (__NFT_TRACETYPE_MAX - 1)
/**
* enum nft_ng_attributes - nf_tables number generator expression netlink attributes
*
* @NFTA_NG_DREG: destination register (NLA_U32)
* @NFTA_NG_MODULUS: maximum counter value (NLA_U32)
* @NFTA_NG_TYPE: operation type (NLA_U32)
* @NFTA_NG_OFFSET: offset to be added to the counter (NLA_U32)
*/
enum nft_ng_attributes {
NFTA_NG_UNSPEC,
NFTA_NG_DREG,
NFTA_NG_MODULUS,
NFTA_NG_TYPE,
NFTA_NG_OFFSET,
__NFTA_NG_MAX
};
#define NFTA_NG_MAX (__NFTA_NG_MAX - 1)
enum nft_ng_types {
NFT_NG_INCREMENTAL,
NFT_NG_RANDOM,
__NFT_NG_MAX
};
#define NFT_NG_MAX (__NFT_NG_MAX - 1)
#endif /* _LINUX_NF_TABLES_H */ #endif /* _LINUX_NF_TABLES_H */
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment