tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
UAPI: (Scripted) Disintegrate include/linux/netfilter
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Michael Kerrisk <mtk.manpages@gmail.com>
Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Acked-by: Dave Jones <davej@redhat.com>
+636
-607
-77
include/linux/netfilter/Kbuild
-77
include/linux/netfilter/Kbuild
···
1
1
header-y += ipset/
2
-
3
-
header-y += nf_conntrack_common.h
4
-
header-y += nf_conntrack_ftp.h
5
-
header-y += nf_conntrack_sctp.h
6
-
header-y += nf_conntrack_tcp.h
7
-
header-y += nf_conntrack_tuple_common.h
8
-
header-y += nf_nat.h
9
-
header-y += nfnetlink.h
10
-
header-y += nfnetlink_acct.h
11
-
header-y += nfnetlink_compat.h
12
-
header-y += nfnetlink_conntrack.h
13
-
header-y += nfnetlink_cthelper.h
14
-
header-y += nfnetlink_cttimeout.h
15
-
header-y += nfnetlink_log.h
16
-
header-y += nfnetlink_queue.h
17
-
header-y += x_tables.h
18
-
header-y += xt_AUDIT.h
19
-
header-y += xt_CHECKSUM.h
20
-
header-y += xt_CLASSIFY.h
21
-
header-y += xt_CONNMARK.h
22
-
header-y += xt_CONNSECMARK.h
23
-
header-y += xt_CT.h
24
-
header-y += xt_DSCP.h
25
-
header-y += xt_IDLETIMER.h
26
-
header-y += xt_LED.h
27
-
header-y += xt_LOG.h
28
-
header-y += xt_MARK.h
29
-
header-y += xt_nfacct.h
30
-
header-y += xt_NFLOG.h
31
-
header-y += xt_NFQUEUE.h
32
-
header-y += xt_RATEEST.h
33
-
header-y += xt_SECMARK.h
34
-
header-y += xt_TCPMSS.h
35
-
header-y += xt_TCPOPTSTRIP.h
36
-
header-y += xt_TEE.h
37
-
header-y += xt_TPROXY.h
38
-
header-y += xt_addrtype.h
39
-
header-y += xt_cluster.h
40
-
header-y += xt_comment.h
41
-
header-y += xt_connbytes.h
42
-
header-y += xt_connlimit.h
43
-
header-y += xt_connmark.h
44
-
header-y += xt_conntrack.h
45
-
header-y += xt_cpu.h
46
-
header-y += xt_dccp.h
47
-
header-y += xt_devgroup.h
48
-
header-y += xt_dscp.h
49
-
header-y += xt_ecn.h
50
-
header-y += xt_esp.h
51
-
header-y += xt_hashlimit.h
52
-
header-y += xt_helper.h
53
-
header-y += xt_iprange.h
54
-
header-y += xt_ipvs.h
55
-
header-y += xt_length.h
56
-
header-y += xt_limit.h
57
-
header-y += xt_mac.h
58
-
header-y += xt_mark.h
59
-
header-y += xt_multiport.h
60
-
header-y += xt_osf.h
61
-
header-y += xt_owner.h
62
-
header-y += xt_physdev.h
63
-
header-y += xt_pkttype.h
64
-
header-y += xt_policy.h
65
-
header-y += xt_quota.h
66
-
header-y += xt_rateest.h
67
-
header-y += xt_realm.h
68
-
header-y += xt_recent.h
69
-
header-y += xt_set.h
70
-
header-y += xt_sctp.h
71
-
header-y += xt_socket.h
72
-
header-y += xt_state.h
73
-
header-y += xt_statistic.h
74
-
header-y += xt_string.h
75
-
header-y += xt_tcpmss.h
76
-
header-y += xt_tcpudp.h
77
-
header-y += xt_time.h
78
-
header-y += xt_u32.h
+1
-114
include/linux/netfilter/nf_conntrack_common.h
+1
-114
include/linux/netfilter/nf_conntrack_common.h
···
1
1
#ifndef _NF_CONNTRACK_COMMON_H
2
2
#define _NF_CONNTRACK_COMMON_H
3
-
/* Connection state tracking for netfilter. This is separated from,
4
-
but required by, the NAT layer; it can also be used by an iptables
5
-
extension. */
6
-
enum ip_conntrack_info {
7
-
/* Part of an established connection (either direction). */
8
-
IP_CT_ESTABLISHED,
9
3
10
-
/* Like NEW, but related to an existing connection, or ICMP error
11
-
(in either direction). */
12
-
IP_CT_RELATED,
4
+
#include <uapi/linux/netfilter/nf_conntrack_common.h>
13
5
14
-
/* Started a new connection to track (only
15
-
IP_CT_DIR_ORIGINAL); may be a retransmission. */
16
-
IP_CT_NEW,
17
-
18
-
/* >= this indicates reply direction */
19
-
IP_CT_IS_REPLY,
20
-
21
-
IP_CT_ESTABLISHED_REPLY = IP_CT_ESTABLISHED + IP_CT_IS_REPLY,
22
-
IP_CT_RELATED_REPLY = IP_CT_RELATED + IP_CT_IS_REPLY,
23
-
IP_CT_NEW_REPLY = IP_CT_NEW + IP_CT_IS_REPLY,
24
-
/* Number of distinct IP_CT types (no NEW in reply dirn). */
25
-
IP_CT_NUMBER = IP_CT_IS_REPLY * 2 - 1
26
-
};
27
-
28
-
/* Bitset representing status of connection. */
29
-
enum ip_conntrack_status {
30
-
/* It's an expected connection: bit 0 set. This bit never changed */
31
-
IPS_EXPECTED_BIT = 0,
32
-
IPS_EXPECTED = (1 << IPS_EXPECTED_BIT),
33
-
34
-
/* We've seen packets both ways: bit 1 set. Can be set, not unset. */
35
-
IPS_SEEN_REPLY_BIT = 1,
36
-
IPS_SEEN_REPLY = (1 << IPS_SEEN_REPLY_BIT),
37
-
38
-
/* Conntrack should never be early-expired. */
39
-
IPS_ASSURED_BIT = 2,
40
-
IPS_ASSURED = (1 << IPS_ASSURED_BIT),
41
-
42
-
/* Connection is confirmed: originating packet has left box */
43
-
IPS_CONFIRMED_BIT = 3,
44
-
IPS_CONFIRMED = (1 << IPS_CONFIRMED_BIT),
45
-
46
-
/* Connection needs src nat in orig dir. This bit never changed. */
47
-
IPS_SRC_NAT_BIT = 4,
48
-
IPS_SRC_NAT = (1 << IPS_SRC_NAT_BIT),
49
-
50
-
/* Connection needs dst nat in orig dir. This bit never changed. */
51
-
IPS_DST_NAT_BIT = 5,
52
-
IPS_DST_NAT = (1 << IPS_DST_NAT_BIT),
53
-
54
-
/* Both together. */
55
-
IPS_NAT_MASK = (IPS_DST_NAT | IPS_SRC_NAT),
56
-
57
-
/* Connection needs TCP sequence adjusted. */
58
-
IPS_SEQ_ADJUST_BIT = 6,
59
-
IPS_SEQ_ADJUST = (1 << IPS_SEQ_ADJUST_BIT),
60
-
61
-
/* NAT initialization bits. */
62
-
IPS_SRC_NAT_DONE_BIT = 7,
63
-
IPS_SRC_NAT_DONE = (1 << IPS_SRC_NAT_DONE_BIT),
64
-
65
-
IPS_DST_NAT_DONE_BIT = 8,
66
-
IPS_DST_NAT_DONE = (1 << IPS_DST_NAT_DONE_BIT),
67
-
68
-
/* Both together */
69
-
IPS_NAT_DONE_MASK = (IPS_DST_NAT_DONE | IPS_SRC_NAT_DONE),
70
-
71
-
/* Connection is dying (removed from lists), can not be unset. */
72
-
IPS_DYING_BIT = 9,
73
-
IPS_DYING = (1 << IPS_DYING_BIT),
74
-
75
-
/* Connection has fixed timeout. */
76
-
IPS_FIXED_TIMEOUT_BIT = 10,
77
-
IPS_FIXED_TIMEOUT = (1 << IPS_FIXED_TIMEOUT_BIT),
78
-
79
-
/* Conntrack is a template */
80
-
IPS_TEMPLATE_BIT = 11,
81
-
IPS_TEMPLATE = (1 << IPS_TEMPLATE_BIT),
82
-
83
-
/* Conntrack is a fake untracked entry */
84
-
IPS_UNTRACKED_BIT = 12,
85
-
IPS_UNTRACKED = (1 << IPS_UNTRACKED_BIT),
86
-
87
-
/* Conntrack got a helper explicitly attached via CT target. */
88
-
IPS_HELPER_BIT = 13,
89
-
IPS_HELPER = (1 << IPS_HELPER_BIT),
90
-
};
91
-
92
-
/* Connection tracking event types */
93
-
enum ip_conntrack_events {
94
-
IPCT_NEW, /* new conntrack */
95
-
IPCT_RELATED, /* related conntrack */
96
-
IPCT_DESTROY, /* destroyed conntrack */
97
-
IPCT_REPLY, /* connection has seen two-way traffic */
98
-
IPCT_ASSURED, /* connection status has changed to assured */
99
-
IPCT_PROTOINFO, /* protocol information has changed */
100
-
IPCT_HELPER, /* new helper has been set */
101
-
IPCT_MARK, /* new mark has been set */
102
-
IPCT_NATSEQADJ, /* NAT is doing sequence adjustment */
103
-
IPCT_SECMARK, /* new security mark has been set */
104
-
};
105
-
106
-
enum ip_conntrack_expect_events {
107
-
IPEXP_NEW, /* new expectation */
108
-
IPEXP_DESTROY, /* destroyed expectation */
109
-
};
110
-
111
-
/* expectation flags */
112
-
#define NF_CT_EXPECT_PERMANENT 0x1
113
-
#define NF_CT_EXPECT_INACTIVE 0x2
114
-
#define NF_CT_EXPECT_USERSPACE 0x4
115
-
116
-
#ifdef __KERNEL__
117
6
struct ip_conntrack_stat {
118
7
unsigned int searched;
119
8
unsigned int found;
···
24
135
25
136
/* call to create an explicit dependency on nf_conntrack. */
26
137
extern void need_conntrack(void);
27
-
28
-
#endif /* __KERNEL__ */
29
138
30
139
#endif /* _NF_CONNTRACK_COMMON_H */
+1
-15
include/linux/netfilter/nf_conntrack_ftp.h
+1
-15
include/linux/netfilter/nf_conntrack_ftp.h
···
1
1
#ifndef _NF_CONNTRACK_FTP_H
2
2
#define _NF_CONNTRACK_FTP_H
3
-
/* FTP tracking. */
4
3
5
-
/* This enum is exposed to userspace */
6
-
enum nf_ct_ftp_type {
7
-
/* PORT command from client */
8
-
NF_CT_FTP_PORT,
9
-
/* PASV response from server */
10
-
NF_CT_FTP_PASV,
11
-
/* EPRT command from client */
12
-
NF_CT_FTP_EPRT,
13
-
/* EPSV response from server */
14
-
NF_CT_FTP_EPSV,
15
-
};
4
+
#include <uapi/linux/netfilter/nf_conntrack_ftp.h>
16
5
17
-
#ifdef __KERNEL__
18
6
19
7
#define FTP_PORT 21
20
8
···
30
42
unsigned int matchoff,
31
43
unsigned int matchlen,
32
44
struct nf_conntrack_expect *exp);
33
-
#endif /* __KERNEL__ */
34
-
35
45
#endif /* _NF_CONNTRACK_FTP_H */
include/linux/netfilter/nf_conntrack_sctp.h
include/uapi/linux/netfilter/nf_conntrack_sctp.h
include/linux/netfilter/nf_conntrack_sctp.h
include/uapi/linux/netfilter/nf_conntrack_sctp.h
+1
-48
include/linux/netfilter/nf_conntrack_tcp.h
+1
-48
include/linux/netfilter/nf_conntrack_tcp.h
···
1
1
#ifndef _NF_CONNTRACK_TCP_H
2
2
#define _NF_CONNTRACK_TCP_H
3
-
/* TCP tracking. */
4
3
5
-
#include <linux/types.h>
4
+
#include <uapi/linux/netfilter/nf_conntrack_tcp.h>
6
5
7
-
/* This is exposed to userspace (ctnetlink) */
8
-
enum tcp_conntrack {
9
-
TCP_CONNTRACK_NONE,
10
-
TCP_CONNTRACK_SYN_SENT,
11
-
TCP_CONNTRACK_SYN_RECV,
12
-
TCP_CONNTRACK_ESTABLISHED,
13
-
TCP_CONNTRACK_FIN_WAIT,
14
-
TCP_CONNTRACK_CLOSE_WAIT,
15
-
TCP_CONNTRACK_LAST_ACK,
16
-
TCP_CONNTRACK_TIME_WAIT,
17
-
TCP_CONNTRACK_CLOSE,
18
-
TCP_CONNTRACK_LISTEN, /* obsolete */
19
-
#define TCP_CONNTRACK_SYN_SENT2 TCP_CONNTRACK_LISTEN
20
-
TCP_CONNTRACK_MAX,
21
-
TCP_CONNTRACK_IGNORE,
22
-
TCP_CONNTRACK_RETRANS,
23
-
TCP_CONNTRACK_UNACK,
24
-
TCP_CONNTRACK_TIMEOUT_MAX
25
-
};
26
-
27
-
/* Window scaling is advertised by the sender */
28
-
#define IP_CT_TCP_FLAG_WINDOW_SCALE 0x01
29
-
30
-
/* SACK is permitted by the sender */
31
-
#define IP_CT_TCP_FLAG_SACK_PERM 0x02
32
-
33
-
/* This sender sent FIN first */
34
-
#define IP_CT_TCP_FLAG_CLOSE_INIT 0x04
35
-
36
-
/* Be liberal in window checking */
37
-
#define IP_CT_TCP_FLAG_BE_LIBERAL 0x08
38
-
39
-
/* Has unacknowledged data */
40
-
#define IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED 0x10
41
-
42
-
/* The field td_maxack has been set */
43
-
#define IP_CT_TCP_FLAG_MAXACK_SET 0x20
44
-
45
-
struct nf_ct_tcp_flags {
46
-
__u8 flags;
47
-
__u8 mask;
48
-
};
49
-
50
-
#ifdef __KERNEL__
51
6
52
7
struct ip_ct_tcp_state {
53
8
u_int32_t td_end; /* max of seq + len */
···
28
73
u_int8_t last_wscale; /* Last window scaling factor seen */
29
74
u_int8_t last_flags; /* Last flags set */
30
75
};
31
-
32
-
#endif /* __KERNEL__ */
33
76
34
77
#endif /* _NF_CONNTRACK_TCP_H */
include/linux/netfilter/nf_conntrack_tuple_common.h
include/uapi/linux/netfilter/nf_conntrack_tuple_common.h
include/linux/netfilter/nf_conntrack_tuple_common.h
include/uapi/linux/netfilter/nf_conntrack_tuple_common.h
include/linux/netfilter/nf_nat.h
include/uapi/linux/netfilter/nf_nat.h
include/linux/netfilter/nf_nat.h
include/uapi/linux/netfilter/nf_nat.h
+1
-54
include/linux/netfilter/nfnetlink.h
+1
-54
include/linux/netfilter/nfnetlink.h
···
1
1
#ifndef _NFNETLINK_H
2
2
#define _NFNETLINK_H
3
-
#include <linux/types.h>
4
-
#include <linux/netfilter/nfnetlink_compat.h>
5
3
6
-
enum nfnetlink_groups {
7
-
NFNLGRP_NONE,
8
-
#define NFNLGRP_NONE NFNLGRP_NONE
9
-
NFNLGRP_CONNTRACK_NEW,
10
-
#define NFNLGRP_CONNTRACK_NEW NFNLGRP_CONNTRACK_NEW
11
-
NFNLGRP_CONNTRACK_UPDATE,
12
-
#define NFNLGRP_CONNTRACK_UPDATE NFNLGRP_CONNTRACK_UPDATE
13
-
NFNLGRP_CONNTRACK_DESTROY,
14
-
#define NFNLGRP_CONNTRACK_DESTROY NFNLGRP_CONNTRACK_DESTROY
15
-
NFNLGRP_CONNTRACK_EXP_NEW,
16
-
#define NFNLGRP_CONNTRACK_EXP_NEW NFNLGRP_CONNTRACK_EXP_NEW
17
-
NFNLGRP_CONNTRACK_EXP_UPDATE,
18
-
#define NFNLGRP_CONNTRACK_EXP_UPDATE NFNLGRP_CONNTRACK_EXP_UPDATE
19
-
NFNLGRP_CONNTRACK_EXP_DESTROY,
20
-
#define NFNLGRP_CONNTRACK_EXP_DESTROY NFNLGRP_CONNTRACK_EXP_DESTROY
21
-
__NFNLGRP_MAX,
22
-
};
23
-
#define NFNLGRP_MAX (__NFNLGRP_MAX - 1)
24
-
25
-
/* General form of address family dependent message.
26
-
*/
27
-
struct nfgenmsg {
28
-
__u8 nfgen_family; /* AF_xxx */
29
-
__u8 version; /* nfnetlink version */
30
-
__be16 res_id; /* resource id */
31
-
};
32
-
33
-
#define NFNETLINK_V0 0
34
-
35
-
/* netfilter netlink message types are split in two pieces:
36
-
* 8 bit subsystem, 8bit operation.
37
-
*/
38
-
39
-
#define NFNL_SUBSYS_ID(x) ((x & 0xff00) >> 8)
40
-
#define NFNL_MSG_TYPE(x) (x & 0x00ff)
41
-
42
-
/* No enum here, otherwise __stringify() trick of MODULE_ALIAS_NFNL_SUBSYS()
43
-
* won't work anymore */
44
-
#define NFNL_SUBSYS_NONE 0
45
-
#define NFNL_SUBSYS_CTNETLINK 1
46
-
#define NFNL_SUBSYS_CTNETLINK_EXP 2
47
-
#define NFNL_SUBSYS_QUEUE 3
48
-
#define NFNL_SUBSYS_ULOG 4
49
-
#define NFNL_SUBSYS_OSF 5
50
-
#define NFNL_SUBSYS_IPSET 6
51
-
#define NFNL_SUBSYS_ACCT 7
52
-
#define NFNL_SUBSYS_CTNETLINK_TIMEOUT 8
53
-
#define NFNL_SUBSYS_CTHELPER 9
54
-
#define NFNL_SUBSYS_COUNT 10
55
-
56
-
#ifdef __KERNEL__
57
4
58
5
#include <linux/netlink.h>
59
6
#include <linux/capability.h>
60
7
#include <net/netlink.h>
8
+
#include <uapi/linux/netfilter/nfnetlink.h>
61
9
62
10
struct nfnl_callback {
63
11
int (*call)(struct sock *nl, struct sk_buff *skb,
···
40
92
#define MODULE_ALIAS_NFNL_SUBSYS(subsys) \
41
93
MODULE_ALIAS("nfnetlink-subsys-" __stringify(subsys))
42
94
43
-
#endif /* __KERNEL__ */
44
95
#endif /* _NFNETLINK_H */
+1
-24
include/linux/netfilter/nfnetlink_acct.h
+1
-24
include/linux/netfilter/nfnetlink_acct.h
···
1
1
#ifndef _NFNL_ACCT_H_
2
2
#define _NFNL_ACCT_H_
3
3
4
-
#ifndef NFACCT_NAME_MAX
5
-
#define NFACCT_NAME_MAX 32
6
-
#endif
4
+
#include <uapi/linux/netfilter/nfnetlink_acct.h>
7
5
8
-
enum nfnl_acct_msg_types {
9
-
NFNL_MSG_ACCT_NEW,
10
-
NFNL_MSG_ACCT_GET,
11
-
NFNL_MSG_ACCT_GET_CTRZERO,
12
-
NFNL_MSG_ACCT_DEL,
13
-
NFNL_MSG_ACCT_MAX
14
-
};
15
-
16
-
enum nfnl_acct_type {
17
-
NFACCT_UNSPEC,
18
-
NFACCT_NAME,
19
-
NFACCT_PKTS,
20
-
NFACCT_BYTES,
21
-
NFACCT_USE,
22
-
__NFACCT_MAX
23
-
};
24
-
#define NFACCT_MAX (__NFACCT_MAX - 1)
25
-
26
-
#ifdef __KERNEL__
27
6
28
7
struct nf_acct;
29
8
30
9
extern struct nf_acct *nfnl_acct_find_get(const char *filter_name);
31
10
extern void nfnl_acct_put(struct nf_acct *acct);
32
11
extern void nfnl_acct_update(const struct sk_buff *skb, struct nf_acct *nfacct);
33
-
34
-
#endif /* __KERNEL__ */
35
12
36
13
#endif /* _NFNL_ACCT_H */
include/linux/netfilter/nfnetlink_compat.h
include/uapi/linux/netfilter/nfnetlink_compat.h
include/linux/netfilter/nfnetlink_compat.h
include/uapi/linux/netfilter/nfnetlink_compat.h
include/linux/netfilter/nfnetlink_conntrack.h
include/uapi/linux/netfilter/nfnetlink_conntrack.h
include/linux/netfilter/nfnetlink_conntrack.h
include/uapi/linux/netfilter/nfnetlink_conntrack.h
include/linux/netfilter/nfnetlink_cthelper.h
include/uapi/linux/netfilter/nfnetlink_cthelper.h
include/linux/netfilter/nfnetlink_cthelper.h
include/uapi/linux/netfilter/nfnetlink_cthelper.h
include/linux/netfilter/nfnetlink_cttimeout.h
include/uapi/linux/netfilter/nfnetlink_cttimeout.h
include/linux/netfilter/nfnetlink_cttimeout.h
include/uapi/linux/netfilter/nfnetlink_cttimeout.h
include/linux/netfilter/nfnetlink_log.h
include/uapi/linux/netfilter/nfnetlink_log.h
include/linux/netfilter/nfnetlink_log.h
include/uapi/linux/netfilter/nfnetlink_log.h
include/linux/netfilter/nfnetlink_queue.h
include/uapi/linux/netfilter/nfnetlink_queue.h
include/linux/netfilter/nfnetlink_queue.h
include/uapi/linux/netfilter/nfnetlink_queue.h
+1
-185
include/linux/netfilter/x_tables.h
+1
-185
include/linux/netfilter/x_tables.h
···
1
1
#ifndef _X_TABLES_H
2
2
#define _X_TABLES_H
3
-
#include <linux/kernel.h>
4
-
#include <linux/types.h>
5
3
6
-
#define XT_FUNCTION_MAXNAMELEN 30
7
-
#define XT_EXTENSION_MAXNAMELEN 29
8
-
#define XT_TABLE_MAXNAMELEN 32
9
-
10
-
struct xt_entry_match {
11
-
union {
12
-
struct {
13
-
__u16 match_size;
14
-
15
-
/* Used by userspace */
16
-
char name[XT_EXTENSION_MAXNAMELEN];
17
-
__u8 revision;
18
-
} user;
19
-
struct {
20
-
__u16 match_size;
21
-
22
-
/* Used inside the kernel */
23
-
struct xt_match *match;
24
-
} kernel;
25
-
26
-
/* Total length */
27
-
__u16 match_size;
28
-
} u;
29
-
30
-
unsigned char data[0];
31
-
};
32
-
33
-
struct xt_entry_target {
34
-
union {
35
-
struct {
36
-
__u16 target_size;
37
-
38
-
/* Used by userspace */
39
-
char name[XT_EXTENSION_MAXNAMELEN];
40
-
__u8 revision;
41
-
} user;
42
-
struct {
43
-
__u16 target_size;
44
-
45
-
/* Used inside the kernel */
46
-
struct xt_target *target;
47
-
} kernel;
48
-
49
-
/* Total length */
50
-
__u16 target_size;
51
-
} u;
52
-
53
-
unsigned char data[0];
54
-
};
55
-
56
-
#define XT_TARGET_INIT(__name, __size) \
57
-
{ \
58
-
.target.u.user = { \
59
-
.target_size = XT_ALIGN(__size), \
60
-
.name = __name, \
61
-
}, \
62
-
}
63
-
64
-
struct xt_standard_target {
65
-
struct xt_entry_target target;
66
-
int verdict;
67
-
};
68
-
69
-
struct xt_error_target {
70
-
struct xt_entry_target target;
71
-
char errorname[XT_FUNCTION_MAXNAMELEN];
72
-
};
73
-
74
-
/* The argument to IPT_SO_GET_REVISION_*. Returns highest revision
75
-
* kernel supports, if >= revision. */
76
-
struct xt_get_revision {
77
-
char name[XT_EXTENSION_MAXNAMELEN];
78
-
__u8 revision;
79
-
};
80
-
81
-
/* CONTINUE verdict for targets */
82
-
#define XT_CONTINUE 0xFFFFFFFF
83
-
84
-
/* For standard target */
85
-
#define XT_RETURN (-NF_REPEAT - 1)
86
-
87
-
/* this is a dummy structure to find out the alignment requirement for a struct
88
-
* containing all the fundamental data types that are used in ipt_entry,
89
-
* ip6t_entry and arpt_entry. This sucks, and it is a hack. It will be my
90
-
* personal pleasure to remove it -HW
91
-
*/
92
-
struct _xt_align {
93
-
__u8 u8;
94
-
__u16 u16;
95
-
__u32 u32;
96
-
__u64 u64;
97
-
};
98
-
99
-
#define XT_ALIGN(s) __ALIGN_KERNEL((s), __alignof__(struct _xt_align))
100
-
101
-
/* Standard return verdict, or do jump. */
102
-
#define XT_STANDARD_TARGET ""
103
-
/* Error verdict. */
104
-
#define XT_ERROR_TARGET "ERROR"
105
-
106
-
#define SET_COUNTER(c,b,p) do { (c).bcnt = (b); (c).pcnt = (p); } while(0)
107
-
#define ADD_COUNTER(c,b,p) do { (c).bcnt += (b); (c).pcnt += (p); } while(0)
108
-
109
-
struct xt_counters {
110
-
__u64 pcnt, bcnt; /* Packet and byte counters */
111
-
};
112
-
113
-
/* The argument to IPT_SO_ADD_COUNTERS. */
114
-
struct xt_counters_info {
115
-
/* Which table. */
116
-
char name[XT_TABLE_MAXNAMELEN];
117
-
118
-
unsigned int num_counters;
119
-
120
-
/* The counters (actually `number' of these). */
121
-
struct xt_counters counters[0];
122
-
};
123
-
124
-
#define XT_INV_PROTO 0x40 /* Invert the sense of PROTO. */
125
-
126
-
#ifndef __KERNEL__
127
-
/* fn returns 0 to continue iteration */
128
-
#define XT_MATCH_ITERATE(type, e, fn, args...) \
129
-
({ \
130
-
unsigned int __i; \
131
-
int __ret = 0; \
132
-
struct xt_entry_match *__m; \
133
-
\
134
-
for (__i = sizeof(type); \
135
-
__i < (e)->target_offset; \
136
-
__i += __m->u.match_size) { \
137
-
__m = (void *)e + __i; \
138
-
\
139
-
__ret = fn(__m , ## args); \
140
-
if (__ret != 0) \
141
-
break; \
142
-
} \
143
-
__ret; \
144
-
})
145
-
146
-
/* fn returns 0 to continue iteration */
147
-
#define XT_ENTRY_ITERATE_CONTINUE(type, entries, size, n, fn, args...) \
148
-
({ \
149
-
unsigned int __i, __n; \
150
-
int __ret = 0; \
151
-
type *__entry; \
152
-
\
153
-
for (__i = 0, __n = 0; __i < (size); \
154
-
__i += __entry->next_offset, __n++) { \
155
-
__entry = (void *)(entries) + __i; \
156
-
if (__n < n) \
157
-
continue; \
158
-
\
159
-
__ret = fn(__entry , ## args); \
160
-
if (__ret != 0) \
161
-
break; \
162
-
} \
163
-
__ret; \
164
-
})
165
-
166
-
/* fn returns 0 to continue iteration */
167
-
#define XT_ENTRY_ITERATE(type, entries, size, fn, args...) \
168
-
XT_ENTRY_ITERATE_CONTINUE(type, entries, size, 0, fn, args)
169
-
170
-
#endif /* !__KERNEL__ */
171
-
172
-
/* pos is normally a struct ipt_entry/ip6t_entry/etc. */
173
-
#define xt_entry_foreach(pos, ehead, esize) \
174
-
for ((pos) = (typeof(pos))(ehead); \
175
-
(pos) < (typeof(pos))((char *)(ehead) + (esize)); \
176
-
(pos) = (typeof(pos))((char *)(pos) + (pos)->next_offset))
177
-
178
-
/* can only be xt_entry_match, so no use of typeof here */
179
-
#define xt_ematch_foreach(pos, entry) \
180
-
for ((pos) = (struct xt_entry_match *)entry->elems; \
181
-
(pos) < (struct xt_entry_match *)((char *)(entry) + \
182
-
(entry)->target_offset); \
183
-
(pos) = (struct xt_entry_match *)((char *)(pos) + \
184
-
(pos)->u.match_size))
185
-
186
-
#ifdef __KERNEL__
187
4
188
5
#include <linux/netdevice.h>
6
+
#include <uapi/linux/netfilter/x_tables.h>
189
7
190
8
/**
191
9
* struct xt_action_param - parameters for matches/targets
···
435
617
void __user **dstptr, unsigned int *size);
436
618
437
619
#endif /* CONFIG_COMPAT */
438
-
#endif /* __KERNEL__ */
439
-
440
620
#endif /* _X_TABLES_H */
include/linux/netfilter/xt_AUDIT.h
include/uapi/linux/netfilter/xt_AUDIT.h
include/linux/netfilter/xt_AUDIT.h
include/uapi/linux/netfilter/xt_AUDIT.h
include/linux/netfilter/xt_CHECKSUM.h
include/uapi/linux/netfilter/xt_CHECKSUM.h
include/linux/netfilter/xt_CHECKSUM.h
include/uapi/linux/netfilter/xt_CHECKSUM.h
include/linux/netfilter/xt_CLASSIFY.h
include/uapi/linux/netfilter/xt_CLASSIFY.h
include/linux/netfilter/xt_CLASSIFY.h
include/uapi/linux/netfilter/xt_CLASSIFY.h
include/linux/netfilter/xt_CONNMARK.h
include/uapi/linux/netfilter/xt_CONNMARK.h
include/linux/netfilter/xt_CONNMARK.h
include/uapi/linux/netfilter/xt_CONNMARK.h
include/linux/netfilter/xt_CONNSECMARK.h
include/uapi/linux/netfilter/xt_CONNSECMARK.h
include/linux/netfilter/xt_CONNSECMARK.h
include/uapi/linux/netfilter/xt_CONNSECMARK.h
include/linux/netfilter/xt_CT.h
include/uapi/linux/netfilter/xt_CT.h
include/linux/netfilter/xt_CT.h
include/uapi/linux/netfilter/xt_CT.h
include/linux/netfilter/xt_DSCP.h
include/uapi/linux/netfilter/xt_DSCP.h
include/linux/netfilter/xt_DSCP.h
include/uapi/linux/netfilter/xt_DSCP.h
include/linux/netfilter/xt_IDLETIMER.h
include/uapi/linux/netfilter/xt_IDLETIMER.h
include/linux/netfilter/xt_IDLETIMER.h
include/uapi/linux/netfilter/xt_IDLETIMER.h
include/linux/netfilter/xt_LED.h
include/uapi/linux/netfilter/xt_LED.h
include/linux/netfilter/xt_LED.h
include/uapi/linux/netfilter/xt_LED.h
include/linux/netfilter/xt_LOG.h
include/uapi/linux/netfilter/xt_LOG.h
include/linux/netfilter/xt_LOG.h
include/uapi/linux/netfilter/xt_LOG.h
include/linux/netfilter/xt_MARK.h
include/uapi/linux/netfilter/xt_MARK.h
include/linux/netfilter/xt_MARK.h
include/uapi/linux/netfilter/xt_MARK.h
include/linux/netfilter/xt_NFLOG.h
include/uapi/linux/netfilter/xt_NFLOG.h
include/linux/netfilter/xt_NFLOG.h
include/uapi/linux/netfilter/xt_NFLOG.h
include/linux/netfilter/xt_NFQUEUE.h
include/uapi/linux/netfilter/xt_NFQUEUE.h
include/linux/netfilter/xt_NFQUEUE.h
include/uapi/linux/netfilter/xt_NFQUEUE.h
include/linux/netfilter/xt_RATEEST.h
include/uapi/linux/netfilter/xt_RATEEST.h
include/linux/netfilter/xt_RATEEST.h
include/uapi/linux/netfilter/xt_RATEEST.h
include/linux/netfilter/xt_SECMARK.h
include/uapi/linux/netfilter/xt_SECMARK.h
include/linux/netfilter/xt_SECMARK.h
include/uapi/linux/netfilter/xt_SECMARK.h
include/linux/netfilter/xt_TCPMSS.h
include/uapi/linux/netfilter/xt_TCPMSS.h
include/linux/netfilter/xt_TCPMSS.h
include/uapi/linux/netfilter/xt_TCPMSS.h
include/linux/netfilter/xt_TCPOPTSTRIP.h
include/uapi/linux/netfilter/xt_TCPOPTSTRIP.h
include/linux/netfilter/xt_TCPOPTSTRIP.h
include/uapi/linux/netfilter/xt_TCPOPTSTRIP.h
include/linux/netfilter/xt_TEE.h
include/uapi/linux/netfilter/xt_TEE.h
include/linux/netfilter/xt_TEE.h
include/uapi/linux/netfilter/xt_TEE.h
include/linux/netfilter/xt_TPROXY.h
include/uapi/linux/netfilter/xt_TPROXY.h
include/linux/netfilter/xt_TPROXY.h
include/uapi/linux/netfilter/xt_TPROXY.h
include/linux/netfilter/xt_addrtype.h
include/uapi/linux/netfilter/xt_addrtype.h
include/linux/netfilter/xt_addrtype.h
include/uapi/linux/netfilter/xt_addrtype.h
include/linux/netfilter/xt_cluster.h
include/uapi/linux/netfilter/xt_cluster.h
include/linux/netfilter/xt_cluster.h
include/uapi/linux/netfilter/xt_cluster.h
include/linux/netfilter/xt_comment.h
include/uapi/linux/netfilter/xt_comment.h
include/linux/netfilter/xt_comment.h
include/uapi/linux/netfilter/xt_comment.h
include/linux/netfilter/xt_connbytes.h
include/uapi/linux/netfilter/xt_connbytes.h
include/linux/netfilter/xt_connbytes.h
include/uapi/linux/netfilter/xt_connbytes.h
include/linux/netfilter/xt_connlimit.h
include/uapi/linux/netfilter/xt_connlimit.h
include/linux/netfilter/xt_connlimit.h
include/uapi/linux/netfilter/xt_connlimit.h
include/linux/netfilter/xt_connmark.h
include/uapi/linux/netfilter/xt_connmark.h
include/linux/netfilter/xt_connmark.h
include/uapi/linux/netfilter/xt_connmark.h
include/linux/netfilter/xt_conntrack.h
include/uapi/linux/netfilter/xt_conntrack.h
include/linux/netfilter/xt_conntrack.h
include/uapi/linux/netfilter/xt_conntrack.h
include/linux/netfilter/xt_cpu.h
include/uapi/linux/netfilter/xt_cpu.h
include/linux/netfilter/xt_cpu.h
include/uapi/linux/netfilter/xt_cpu.h
include/linux/netfilter/xt_dccp.h
include/uapi/linux/netfilter/xt_dccp.h
include/linux/netfilter/xt_dccp.h
include/uapi/linux/netfilter/xt_dccp.h
include/linux/netfilter/xt_devgroup.h
include/uapi/linux/netfilter/xt_devgroup.h
include/linux/netfilter/xt_devgroup.h
include/uapi/linux/netfilter/xt_devgroup.h
include/linux/netfilter/xt_dscp.h
include/uapi/linux/netfilter/xt_dscp.h
include/linux/netfilter/xt_dscp.h
include/uapi/linux/netfilter/xt_dscp.h
include/linux/netfilter/xt_ecn.h
include/uapi/linux/netfilter/xt_ecn.h
include/linux/netfilter/xt_ecn.h
include/uapi/linux/netfilter/xt_ecn.h
include/linux/netfilter/xt_esp.h
include/uapi/linux/netfilter/xt_esp.h
include/linux/netfilter/xt_esp.h
include/uapi/linux/netfilter/xt_esp.h
+1
-70
include/linux/netfilter/xt_hashlimit.h
+1
-70
include/linux/netfilter/xt_hashlimit.h
···
1
1
#ifndef _XT_HASHLIMIT_H
2
2
#define _XT_HASHLIMIT_H
3
3
4
-
#include <linux/types.h>
4
+
#include <uapi/linux/netfilter/xt_hashlimit.h>
5
5
6
-
/* timings are in milliseconds. */
7
-
#define XT_HASHLIMIT_SCALE 10000
8
-
/* 1/10,000 sec period => max of 10,000/sec. Min rate is then 429490
9
-
* seconds, or one packet every 59 hours.
10
-
*/
11
-
12
-
/* packet length accounting is done in 16-byte steps */
13
-
#define XT_HASHLIMIT_BYTE_SHIFT 4
14
-
15
-
/* details of this structure hidden by the implementation */
16
-
struct xt_hashlimit_htable;
17
-
18
-
enum {
19
-
XT_HASHLIMIT_HASH_DIP = 1 << 0,
20
-
XT_HASHLIMIT_HASH_DPT = 1 << 1,
21
-
XT_HASHLIMIT_HASH_SIP = 1 << 2,
22
-
XT_HASHLIMIT_HASH_SPT = 1 << 3,
23
-
XT_HASHLIMIT_INVERT = 1 << 4,
24
-
XT_HASHLIMIT_BYTES = 1 << 5,
25
-
};
26
-
#ifdef __KERNEL__
27
6
#define XT_HASHLIMIT_ALL (XT_HASHLIMIT_HASH_DIP | XT_HASHLIMIT_HASH_DPT | \
28
7
XT_HASHLIMIT_HASH_SIP | XT_HASHLIMIT_HASH_SPT | \
29
8
XT_HASHLIMIT_INVERT | XT_HASHLIMIT_BYTES)
30
-
#endif
31
-
32
-
struct hashlimit_cfg {
33
-
__u32 mode; /* bitmask of XT_HASHLIMIT_HASH_* */
34
-
__u32 avg; /* Average secs between packets * scale */
35
-
__u32 burst; /* Period multiplier for upper limit. */
36
-
37
-
/* user specified */
38
-
__u32 size; /* how many buckets */
39
-
__u32 max; /* max number of entries */
40
-
__u32 gc_interval; /* gc interval */
41
-
__u32 expire; /* when do entries expire? */
42
-
};
43
-
44
-
struct xt_hashlimit_info {
45
-
char name [IFNAMSIZ]; /* name */
46
-
struct hashlimit_cfg cfg;
47
-
48
-
/* Used internally by the kernel */
49
-
struct xt_hashlimit_htable *hinfo;
50
-
union {
51
-
void *ptr;
52
-
struct xt_hashlimit_info *master;
53
-
} u;
54
-
};
55
-
56
-
struct hashlimit_cfg1 {
57
-
__u32 mode; /* bitmask of XT_HASHLIMIT_HASH_* */
58
-
__u32 avg; /* Average secs between packets * scale */
59
-
__u32 burst; /* Period multiplier for upper limit. */
60
-
61
-
/* user specified */
62
-
__u32 size; /* how many buckets */
63
-
__u32 max; /* max number of entries */
64
-
__u32 gc_interval; /* gc interval */
65
-
__u32 expire; /* when do entries expire? */
66
-
67
-
__u8 srcmask, dstmask;
68
-
};
69
-
70
-
struct xt_hashlimit_mtinfo1 {
71
-
char name[IFNAMSIZ];
72
-
struct hashlimit_cfg1 cfg;
73
-
74
-
/* Used internally by the kernel */
75
-
struct xt_hashlimit_htable *hinfo __attribute__((aligned(8)));
76
-
};
77
-
78
9
#endif /*_XT_HASHLIMIT_H*/
include/linux/netfilter/xt_helper.h
include/uapi/linux/netfilter/xt_helper.h
include/linux/netfilter/xt_helper.h
include/uapi/linux/netfilter/xt_helper.h
include/linux/netfilter/xt_iprange.h
include/uapi/linux/netfilter/xt_iprange.h
include/linux/netfilter/xt_iprange.h
include/uapi/linux/netfilter/xt_iprange.h
include/linux/netfilter/xt_ipvs.h
include/uapi/linux/netfilter/xt_ipvs.h
include/linux/netfilter/xt_ipvs.h
include/uapi/linux/netfilter/xt_ipvs.h
include/linux/netfilter/xt_length.h
include/uapi/linux/netfilter/xt_length.h
include/linux/netfilter/xt_length.h
include/uapi/linux/netfilter/xt_length.h
include/linux/netfilter/xt_limit.h
include/uapi/linux/netfilter/xt_limit.h
include/linux/netfilter/xt_limit.h
include/uapi/linux/netfilter/xt_limit.h
include/linux/netfilter/xt_mac.h
include/uapi/linux/netfilter/xt_mac.h
include/linux/netfilter/xt_mac.h
include/uapi/linux/netfilter/xt_mac.h
include/linux/netfilter/xt_mark.h
include/uapi/linux/netfilter/xt_mark.h
include/linux/netfilter/xt_mark.h
include/uapi/linux/netfilter/xt_mark.h
include/linux/netfilter/xt_multiport.h
include/uapi/linux/netfilter/xt_multiport.h
include/linux/netfilter/xt_multiport.h
include/uapi/linux/netfilter/xt_multiport.h
include/linux/netfilter/xt_nfacct.h
include/uapi/linux/netfilter/xt_nfacct.h
include/linux/netfilter/xt_nfacct.h
include/uapi/linux/netfilter/xt_nfacct.h
include/linux/netfilter/xt_osf.h
include/uapi/linux/netfilter/xt_osf.h
include/linux/netfilter/xt_osf.h
include/uapi/linux/netfilter/xt_osf.h
include/linux/netfilter/xt_owner.h
include/uapi/linux/netfilter/xt_owner.h
include/linux/netfilter/xt_owner.h
include/uapi/linux/netfilter/xt_owner.h
+1
-20
include/linux/netfilter/xt_physdev.h
+1
-20
include/linux/netfilter/xt_physdev.h
···
1
1
#ifndef _XT_PHYSDEV_H
2
2
#define _XT_PHYSDEV_H
3
3
4
-
#include <linux/types.h>
5
-
6
-
#ifdef __KERNEL__
7
4
#include <linux/if.h>
8
-
#endif
9
-
10
-
#define XT_PHYSDEV_OP_IN 0x01
11
-
#define XT_PHYSDEV_OP_OUT 0x02
12
-
#define XT_PHYSDEV_OP_BRIDGED 0x04
13
-
#define XT_PHYSDEV_OP_ISIN 0x08
14
-
#define XT_PHYSDEV_OP_ISOUT 0x10
15
-
#define XT_PHYSDEV_OP_MASK (0x20 - 1)
16
-
17
-
struct xt_physdev_info {
18
-
char physindev[IFNAMSIZ];
19
-
char in_mask[IFNAMSIZ];
20
-
char physoutdev[IFNAMSIZ];
21
-
char out_mask[IFNAMSIZ];
22
-
__u8 invert;
23
-
__u8 bitmask;
24
-
};
5
+
#include <uapi/linux/netfilter/xt_physdev.h>
25
6
26
7
#endif /*_XT_PHYSDEV_H*/
include/linux/netfilter/xt_pkttype.h
include/uapi/linux/netfilter/xt_pkttype.h
include/linux/netfilter/xt_pkttype.h
include/uapi/linux/netfilter/xt_pkttype.h
include/linux/netfilter/xt_policy.h
include/uapi/linux/netfilter/xt_policy.h
include/linux/netfilter/xt_policy.h
include/uapi/linux/netfilter/xt_policy.h
include/linux/netfilter/xt_quota.h
include/uapi/linux/netfilter/xt_quota.h
include/linux/netfilter/xt_quota.h
include/uapi/linux/netfilter/xt_quota.h
include/linux/netfilter/xt_rateest.h
include/uapi/linux/netfilter/xt_rateest.h
include/linux/netfilter/xt_rateest.h
include/uapi/linux/netfilter/xt_rateest.h
include/linux/netfilter/xt_realm.h
include/uapi/linux/netfilter/xt_realm.h
include/linux/netfilter/xt_realm.h
include/uapi/linux/netfilter/xt_realm.h
include/linux/netfilter/xt_recent.h
include/uapi/linux/netfilter/xt_recent.h
include/linux/netfilter/xt_recent.h
include/uapi/linux/netfilter/xt_recent.h
include/linux/netfilter/xt_sctp.h
include/uapi/linux/netfilter/xt_sctp.h
include/linux/netfilter/xt_sctp.h
include/uapi/linux/netfilter/xt_sctp.h
include/linux/netfilter/xt_set.h
include/uapi/linux/netfilter/xt_set.h
include/linux/netfilter/xt_set.h
include/uapi/linux/netfilter/xt_set.h
include/linux/netfilter/xt_socket.h
include/uapi/linux/netfilter/xt_socket.h
include/linux/netfilter/xt_socket.h
include/uapi/linux/netfilter/xt_socket.h
include/linux/netfilter/xt_state.h
include/uapi/linux/netfilter/xt_state.h
include/linux/netfilter/xt_state.h
include/uapi/linux/netfilter/xt_state.h
include/linux/netfilter/xt_statistic.h
include/uapi/linux/netfilter/xt_statistic.h
include/linux/netfilter/xt_statistic.h
include/uapi/linux/netfilter/xt_statistic.h
include/linux/netfilter/xt_string.h
include/uapi/linux/netfilter/xt_string.h
include/linux/netfilter/xt_string.h
include/uapi/linux/netfilter/xt_string.h
include/linux/netfilter/xt_tcpmss.h
include/uapi/linux/netfilter/xt_tcpmss.h
include/linux/netfilter/xt_tcpmss.h
include/uapi/linux/netfilter/xt_tcpmss.h
include/linux/netfilter/xt_tcpudp.h
include/uapi/linux/netfilter/xt_tcpudp.h
include/linux/netfilter/xt_tcpudp.h
include/uapi/linux/netfilter/xt_tcpudp.h
include/linux/netfilter/xt_time.h
include/uapi/linux/netfilter/xt_time.h
include/linux/netfilter/xt_time.h
include/uapi/linux/netfilter/xt_time.h
include/linux/netfilter/xt_u32.h
include/uapi/linux/netfilter/xt_u32.h
include/linux/netfilter/xt_u32.h
include/uapi/linux/netfilter/xt_u32.h
+76
include/uapi/linux/netfilter/Kbuild
+76
include/uapi/linux/netfilter/Kbuild
···
1
1
# UAPI Header export list
2
2
header-y += ipset/
3
+
header-y += nf_conntrack_common.h
4
+
header-y += nf_conntrack_ftp.h
5
+
header-y += nf_conntrack_sctp.h
6
+
header-y += nf_conntrack_tcp.h
7
+
header-y += nf_conntrack_tuple_common.h
8
+
header-y += nf_nat.h
9
+
header-y += nfnetlink.h
10
+
header-y += nfnetlink_acct.h
11
+
header-y += nfnetlink_compat.h
12
+
header-y += nfnetlink_conntrack.h
13
+
header-y += nfnetlink_cthelper.h
14
+
header-y += nfnetlink_cttimeout.h
15
+
header-y += nfnetlink_log.h
16
+
header-y += nfnetlink_queue.h
17
+
header-y += x_tables.h
18
+
header-y += xt_AUDIT.h
19
+
header-y += xt_CHECKSUM.h
20
+
header-y += xt_CLASSIFY.h
21
+
header-y += xt_CONNMARK.h
22
+
header-y += xt_CONNSECMARK.h
23
+
header-y += xt_CT.h
24
+
header-y += xt_DSCP.h
25
+
header-y += xt_IDLETIMER.h
26
+
header-y += xt_LED.h
27
+
header-y += xt_LOG.h
28
+
header-y += xt_MARK.h
29
+
header-y += xt_NFLOG.h
30
+
header-y += xt_NFQUEUE.h
31
+
header-y += xt_RATEEST.h
32
+
header-y += xt_SECMARK.h
33
+
header-y += xt_TCPMSS.h
34
+
header-y += xt_TCPOPTSTRIP.h
35
+
header-y += xt_TEE.h
36
+
header-y += xt_TPROXY.h
37
+
header-y += xt_addrtype.h
38
+
header-y += xt_cluster.h
39
+
header-y += xt_comment.h
40
+
header-y += xt_connbytes.h
41
+
header-y += xt_connlimit.h
42
+
header-y += xt_connmark.h
43
+
header-y += xt_conntrack.h
44
+
header-y += xt_cpu.h
45
+
header-y += xt_dccp.h
46
+
header-y += xt_devgroup.h
47
+
header-y += xt_dscp.h
48
+
header-y += xt_ecn.h
49
+
header-y += xt_esp.h
50
+
header-y += xt_hashlimit.h
51
+
header-y += xt_helper.h
52
+
header-y += xt_iprange.h
53
+
header-y += xt_ipvs.h
54
+
header-y += xt_length.h
55
+
header-y += xt_limit.h
56
+
header-y += xt_mac.h
57
+
header-y += xt_mark.h
58
+
header-y += xt_multiport.h
59
+
header-y += xt_nfacct.h
60
+
header-y += xt_osf.h
61
+
header-y += xt_owner.h
62
+
header-y += xt_physdev.h
63
+
header-y += xt_pkttype.h
64
+
header-y += xt_policy.h
65
+
header-y += xt_quota.h
66
+
header-y += xt_rateest.h
67
+
header-y += xt_realm.h
68
+
header-y += xt_recent.h
69
+
header-y += xt_sctp.h
70
+
header-y += xt_set.h
71
+
header-y += xt_socket.h
72
+
header-y += xt_state.h
73
+
header-y += xt_statistic.h
74
+
header-y += xt_string.h
75
+
header-y += xt_tcpmss.h
76
+
header-y += xt_tcpudp.h
77
+
header-y += xt_time.h
78
+
header-y += xt_u32.h
+117
include/uapi/linux/netfilter/nf_conntrack_common.h
+117
include/uapi/linux/netfilter/nf_conntrack_common.h
···
1
+
#ifndef _UAPI_NF_CONNTRACK_COMMON_H
2
+
#define _UAPI_NF_CONNTRACK_COMMON_H
3
+
/* Connection state tracking for netfilter. This is separated from,
4
+
but required by, the NAT layer; it can also be used by an iptables
5
+
extension. */
6
+
enum ip_conntrack_info {
7
+
/* Part of an established connection (either direction). */
8
+
IP_CT_ESTABLISHED,
9
+
10
+
/* Like NEW, but related to an existing connection, or ICMP error
11
+
(in either direction). */
12
+
IP_CT_RELATED,
13
+
14
+
/* Started a new connection to track (only
15
+
IP_CT_DIR_ORIGINAL); may be a retransmission. */
16
+
IP_CT_NEW,
17
+
18
+
/* >= this indicates reply direction */
19
+
IP_CT_IS_REPLY,
20
+
21
+
IP_CT_ESTABLISHED_REPLY = IP_CT_ESTABLISHED + IP_CT_IS_REPLY,
22
+
IP_CT_RELATED_REPLY = IP_CT_RELATED + IP_CT_IS_REPLY,
23
+
IP_CT_NEW_REPLY = IP_CT_NEW + IP_CT_IS_REPLY,
24
+
/* Number of distinct IP_CT types (no NEW in reply dirn). */
25
+
IP_CT_NUMBER = IP_CT_IS_REPLY * 2 - 1
26
+
};
27
+
28
+
/* Bitset representing status of connection. */
29
+
enum ip_conntrack_status {
30
+
/* It's an expected connection: bit 0 set. This bit never changed */
31
+
IPS_EXPECTED_BIT = 0,
32
+
IPS_EXPECTED = (1 << IPS_EXPECTED_BIT),
33
+
34
+
/* We've seen packets both ways: bit 1 set. Can be set, not unset. */
35
+
IPS_SEEN_REPLY_BIT = 1,
36
+
IPS_SEEN_REPLY = (1 << IPS_SEEN_REPLY_BIT),
37
+
38
+
/* Conntrack should never be early-expired. */
39
+
IPS_ASSURED_BIT = 2,
40
+
IPS_ASSURED = (1 << IPS_ASSURED_BIT),
41
+
42
+
/* Connection is confirmed: originating packet has left box */
43
+
IPS_CONFIRMED_BIT = 3,
44
+
IPS_CONFIRMED = (1 << IPS_CONFIRMED_BIT),
45
+
46
+
/* Connection needs src nat in orig dir. This bit never changed. */
47
+
IPS_SRC_NAT_BIT = 4,
48
+
IPS_SRC_NAT = (1 << IPS_SRC_NAT_BIT),
49
+
50
+
/* Connection needs dst nat in orig dir. This bit never changed. */
51
+
IPS_DST_NAT_BIT = 5,
52
+
IPS_DST_NAT = (1 << IPS_DST_NAT_BIT),
53
+
54
+
/* Both together. */
55
+
IPS_NAT_MASK = (IPS_DST_NAT | IPS_SRC_NAT),
56
+
57
+
/* Connection needs TCP sequence adjusted. */
58
+
IPS_SEQ_ADJUST_BIT = 6,
59
+
IPS_SEQ_ADJUST = (1 << IPS_SEQ_ADJUST_BIT),
60
+
61
+
/* NAT initialization bits. */
62
+
IPS_SRC_NAT_DONE_BIT = 7,
63
+
IPS_SRC_NAT_DONE = (1 << IPS_SRC_NAT_DONE_BIT),
64
+
65
+
IPS_DST_NAT_DONE_BIT = 8,
66
+
IPS_DST_NAT_DONE = (1 << IPS_DST_NAT_DONE_BIT),
67
+
68
+
/* Both together */
69
+
IPS_NAT_DONE_MASK = (IPS_DST_NAT_DONE | IPS_SRC_NAT_DONE),
70
+
71
+
/* Connection is dying (removed from lists), can not be unset. */
72
+
IPS_DYING_BIT = 9,
73
+
IPS_DYING = (1 << IPS_DYING_BIT),
74
+
75
+
/* Connection has fixed timeout. */
76
+
IPS_FIXED_TIMEOUT_BIT = 10,
77
+
IPS_FIXED_TIMEOUT = (1 << IPS_FIXED_TIMEOUT_BIT),
78
+
79
+
/* Conntrack is a template */
80
+
IPS_TEMPLATE_BIT = 11,
81
+
IPS_TEMPLATE = (1 << IPS_TEMPLATE_BIT),
82
+
83
+
/* Conntrack is a fake untracked entry */
84
+
IPS_UNTRACKED_BIT = 12,
85
+
IPS_UNTRACKED = (1 << IPS_UNTRACKED_BIT),
86
+
87
+
/* Conntrack got a helper explicitly attached via CT target. */
88
+
IPS_HELPER_BIT = 13,
89
+
IPS_HELPER = (1 << IPS_HELPER_BIT),
90
+
};
91
+
92
+
/* Connection tracking event types */
93
+
enum ip_conntrack_events {
94
+
IPCT_NEW, /* new conntrack */
95
+
IPCT_RELATED, /* related conntrack */
96
+
IPCT_DESTROY, /* destroyed conntrack */
97
+
IPCT_REPLY, /* connection has seen two-way traffic */
98
+
IPCT_ASSURED, /* connection status has changed to assured */
99
+
IPCT_PROTOINFO, /* protocol information has changed */
100
+
IPCT_HELPER, /* new helper has been set */
101
+
IPCT_MARK, /* new mark has been set */
102
+
IPCT_NATSEQADJ, /* NAT is doing sequence adjustment */
103
+
IPCT_SECMARK, /* new security mark has been set */
104
+
};
105
+
106
+
enum ip_conntrack_expect_events {
107
+
IPEXP_NEW, /* new expectation */
108
+
IPEXP_DESTROY, /* destroyed expectation */
109
+
};
110
+
111
+
/* expectation flags */
112
+
#define NF_CT_EXPECT_PERMANENT 0x1
113
+
#define NF_CT_EXPECT_INACTIVE 0x2
114
+
#define NF_CT_EXPECT_USERSPACE 0x4
115
+
116
+
117
+
#endif /* _UAPI_NF_CONNTRACK_COMMON_H */
+18
include/uapi/linux/netfilter/nf_conntrack_ftp.h
+18
include/uapi/linux/netfilter/nf_conntrack_ftp.h
···
1
+
#ifndef _UAPI_NF_CONNTRACK_FTP_H
2
+
#define _UAPI_NF_CONNTRACK_FTP_H
3
+
/* FTP tracking. */
4
+
5
+
/* This enum is exposed to userspace */
6
+
enum nf_ct_ftp_type {
7
+
/* PORT command from client */
8
+
NF_CT_FTP_PORT,
9
+
/* PASV response from server */
10
+
NF_CT_FTP_PASV,
11
+
/* EPRT command from client */
12
+
NF_CT_FTP_EPRT,
13
+
/* EPSV response from server */
14
+
NF_CT_FTP_EPSV,
15
+
};
16
+
17
+
18
+
#endif /* _UAPI_NF_CONNTRACK_FTP_H */
+51
include/uapi/linux/netfilter/nf_conntrack_tcp.h
+51
include/uapi/linux/netfilter/nf_conntrack_tcp.h
···
1
+
#ifndef _UAPI_NF_CONNTRACK_TCP_H
2
+
#define _UAPI_NF_CONNTRACK_TCP_H
3
+
/* TCP tracking. */
4
+
5
+
#include <linux/types.h>
6
+
7
+
/* This is exposed to userspace (ctnetlink) */
8
+
enum tcp_conntrack {
9
+
TCP_CONNTRACK_NONE,
10
+
TCP_CONNTRACK_SYN_SENT,
11
+
TCP_CONNTRACK_SYN_RECV,
12
+
TCP_CONNTRACK_ESTABLISHED,
13
+
TCP_CONNTRACK_FIN_WAIT,
14
+
TCP_CONNTRACK_CLOSE_WAIT,
15
+
TCP_CONNTRACK_LAST_ACK,
16
+
TCP_CONNTRACK_TIME_WAIT,
17
+
TCP_CONNTRACK_CLOSE,
18
+
TCP_CONNTRACK_LISTEN, /* obsolete */
19
+
#define TCP_CONNTRACK_SYN_SENT2 TCP_CONNTRACK_LISTEN
20
+
TCP_CONNTRACK_MAX,
21
+
TCP_CONNTRACK_IGNORE,
22
+
TCP_CONNTRACK_RETRANS,
23
+
TCP_CONNTRACK_UNACK,
24
+
TCP_CONNTRACK_TIMEOUT_MAX
25
+
};
26
+
27
+
/* Window scaling is advertised by the sender */
28
+
#define IP_CT_TCP_FLAG_WINDOW_SCALE 0x01
29
+
30
+
/* SACK is permitted by the sender */
31
+
#define IP_CT_TCP_FLAG_SACK_PERM 0x02
32
+
33
+
/* This sender sent FIN first */
34
+
#define IP_CT_TCP_FLAG_CLOSE_INIT 0x04
35
+
36
+
/* Be liberal in window checking */
37
+
#define IP_CT_TCP_FLAG_BE_LIBERAL 0x08
38
+
39
+
/* Has unacknowledged data */
40
+
#define IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED 0x10
41
+
42
+
/* The field td_maxack has been set */
43
+
#define IP_CT_TCP_FLAG_MAXACK_SET 0x20
44
+
45
+
struct nf_ct_tcp_flags {
46
+
__u8 flags;
47
+
__u8 mask;
48
+
};
49
+
50
+
51
+
#endif /* _UAPI_NF_CONNTRACK_TCP_H */
+56
include/uapi/linux/netfilter/nfnetlink.h
+56
include/uapi/linux/netfilter/nfnetlink.h
···
1
+
#ifndef _UAPI_NFNETLINK_H
2
+
#define _UAPI_NFNETLINK_H
3
+
#include <linux/types.h>
4
+
#include <linux/netfilter/nfnetlink_compat.h>
5
+
6
+
enum nfnetlink_groups {
7
+
NFNLGRP_NONE,
8
+
#define NFNLGRP_NONE NFNLGRP_NONE
9
+
NFNLGRP_CONNTRACK_NEW,
10
+
#define NFNLGRP_CONNTRACK_NEW NFNLGRP_CONNTRACK_NEW
11
+
NFNLGRP_CONNTRACK_UPDATE,
12
+
#define NFNLGRP_CONNTRACK_UPDATE NFNLGRP_CONNTRACK_UPDATE
13
+
NFNLGRP_CONNTRACK_DESTROY,
14
+
#define NFNLGRP_CONNTRACK_DESTROY NFNLGRP_CONNTRACK_DESTROY
15
+
NFNLGRP_CONNTRACK_EXP_NEW,
16
+
#define NFNLGRP_CONNTRACK_EXP_NEW NFNLGRP_CONNTRACK_EXP_NEW
17
+
NFNLGRP_CONNTRACK_EXP_UPDATE,
18
+
#define NFNLGRP_CONNTRACK_EXP_UPDATE NFNLGRP_CONNTRACK_EXP_UPDATE
19
+
NFNLGRP_CONNTRACK_EXP_DESTROY,
20
+
#define NFNLGRP_CONNTRACK_EXP_DESTROY NFNLGRP_CONNTRACK_EXP_DESTROY
21
+
__NFNLGRP_MAX,
22
+
};
23
+
#define NFNLGRP_MAX (__NFNLGRP_MAX - 1)
24
+
25
+
/* General form of address family dependent message.
26
+
*/
27
+
struct nfgenmsg {
28
+
__u8 nfgen_family; /* AF_xxx */
29
+
__u8 version; /* nfnetlink version */
30
+
__be16 res_id; /* resource id */
31
+
};
32
+
33
+
#define NFNETLINK_V0 0
34
+
35
+
/* netfilter netlink message types are split in two pieces:
36
+
* 8 bit subsystem, 8bit operation.
37
+
*/
38
+
39
+
#define NFNL_SUBSYS_ID(x) ((x & 0xff00) >> 8)
40
+
#define NFNL_MSG_TYPE(x) (x & 0x00ff)
41
+
42
+
/* No enum here, otherwise __stringify() trick of MODULE_ALIAS_NFNL_SUBSYS()
43
+
* won't work anymore */
44
+
#define NFNL_SUBSYS_NONE 0
45
+
#define NFNL_SUBSYS_CTNETLINK 1
46
+
#define NFNL_SUBSYS_CTNETLINK_EXP 2
47
+
#define NFNL_SUBSYS_QUEUE 3
48
+
#define NFNL_SUBSYS_ULOG 4
49
+
#define NFNL_SUBSYS_OSF 5
50
+
#define NFNL_SUBSYS_IPSET 6
51
+
#define NFNL_SUBSYS_ACCT 7
52
+
#define NFNL_SUBSYS_CTNETLINK_TIMEOUT 8
53
+
#define NFNL_SUBSYS_CTHELPER 9
54
+
#define NFNL_SUBSYS_COUNT 10
55
+
56
+
#endif /* _UAPI_NFNETLINK_H */
+27
include/uapi/linux/netfilter/nfnetlink_acct.h
+27
include/uapi/linux/netfilter/nfnetlink_acct.h
···
1
+
#ifndef _UAPI_NFNL_ACCT_H_
2
+
#define _UAPI_NFNL_ACCT_H_
3
+
4
+
#ifndef NFACCT_NAME_MAX
5
+
#define NFACCT_NAME_MAX 32
6
+
#endif
7
+
8
+
enum nfnl_acct_msg_types {
9
+
NFNL_MSG_ACCT_NEW,
10
+
NFNL_MSG_ACCT_GET,
11
+
NFNL_MSG_ACCT_GET_CTRZERO,
12
+
NFNL_MSG_ACCT_DEL,
13
+
NFNL_MSG_ACCT_MAX
14
+
};
15
+
16
+
enum nfnl_acct_type {
17
+
NFACCT_UNSPEC,
18
+
NFACCT_NAME,
19
+
NFACCT_PKTS,
20
+
NFACCT_BYTES,
21
+
NFACCT_USE,
22
+
__NFACCT_MAX
23
+
};
24
+
#define NFACCT_MAX (__NFACCT_MAX - 1)
25
+
26
+
27
+
#endif /* _UAPI_NFNL_ACCT_H_ */
+187
include/uapi/linux/netfilter/x_tables.h
+187
include/uapi/linux/netfilter/x_tables.h
···
1
+
#ifndef _UAPI_X_TABLES_H
2
+
#define _UAPI_X_TABLES_H
3
+
#include <linux/kernel.h>
4
+
#include <linux/types.h>
5
+
6
+
#define XT_FUNCTION_MAXNAMELEN 30
7
+
#define XT_EXTENSION_MAXNAMELEN 29
8
+
#define XT_TABLE_MAXNAMELEN 32
9
+
10
+
struct xt_entry_match {
11
+
union {
12
+
struct {
13
+
__u16 match_size;
14
+
15
+
/* Used by userspace */
16
+
char name[XT_EXTENSION_MAXNAMELEN];
17
+
__u8 revision;
18
+
} user;
19
+
struct {
20
+
__u16 match_size;
21
+
22
+
/* Used inside the kernel */
23
+
struct xt_match *match;
24
+
} kernel;
25
+
26
+
/* Total length */
27
+
__u16 match_size;
28
+
} u;
29
+
30
+
unsigned char data[0];
31
+
};
32
+
33
+
struct xt_entry_target {
34
+
union {
35
+
struct {
36
+
__u16 target_size;
37
+
38
+
/* Used by userspace */
39
+
char name[XT_EXTENSION_MAXNAMELEN];
40
+
__u8 revision;
41
+
} user;
42
+
struct {
43
+
__u16 target_size;
44
+
45
+
/* Used inside the kernel */
46
+
struct xt_target *target;
47
+
} kernel;
48
+
49
+
/* Total length */
50
+
__u16 target_size;
51
+
} u;
52
+
53
+
unsigned char data[0];
54
+
};
55
+
56
+
#define XT_TARGET_INIT(__name, __size) \
57
+
{ \
58
+
.target.u.user = { \
59
+
.target_size = XT_ALIGN(__size), \
60
+
.name = __name, \
61
+
}, \
62
+
}
63
+
64
+
struct xt_standard_target {
65
+
struct xt_entry_target target;
66
+
int verdict;
67
+
};
68
+
69
+
struct xt_error_target {
70
+
struct xt_entry_target target;
71
+
char errorname[XT_FUNCTION_MAXNAMELEN];
72
+
};
73
+
74
+
/* The argument to IPT_SO_GET_REVISION_*. Returns highest revision
75
+
* kernel supports, if >= revision. */
76
+
struct xt_get_revision {
77
+
char name[XT_EXTENSION_MAXNAMELEN];
78
+
__u8 revision;
79
+
};
80
+
81
+
/* CONTINUE verdict for targets */
82
+
#define XT_CONTINUE 0xFFFFFFFF
83
+
84
+
/* For standard target */
85
+
#define XT_RETURN (-NF_REPEAT - 1)
86
+
87
+
/* this is a dummy structure to find out the alignment requirement for a struct
88
+
* containing all the fundamental data types that are used in ipt_entry,
89
+
* ip6t_entry and arpt_entry. This sucks, and it is a hack. It will be my
90
+
* personal pleasure to remove it -HW
91
+
*/
92
+
struct _xt_align {
93
+
__u8 u8;
94
+
__u16 u16;
95
+
__u32 u32;
96
+
__u64 u64;
97
+
};
98
+
99
+
#define XT_ALIGN(s) __ALIGN_KERNEL((s), __alignof__(struct _xt_align))
100
+
101
+
/* Standard return verdict, or do jump. */
102
+
#define XT_STANDARD_TARGET ""
103
+
/* Error verdict. */
104
+
#define XT_ERROR_TARGET "ERROR"
105
+
106
+
#define SET_COUNTER(c,b,p) do { (c).bcnt = (b); (c).pcnt = (p); } while(0)
107
+
#define ADD_COUNTER(c,b,p) do { (c).bcnt += (b); (c).pcnt += (p); } while(0)
108
+
109
+
struct xt_counters {
110
+
__u64 pcnt, bcnt; /* Packet and byte counters */
111
+
};
112
+
113
+
/* The argument to IPT_SO_ADD_COUNTERS. */
114
+
struct xt_counters_info {
115
+
/* Which table. */
116
+
char name[XT_TABLE_MAXNAMELEN];
117
+
118
+
unsigned int num_counters;
119
+
120
+
/* The counters (actually `number' of these). */
121
+
struct xt_counters counters[0];
122
+
};
123
+
124
+
#define XT_INV_PROTO 0x40 /* Invert the sense of PROTO. */
125
+
126
+
#ifndef __KERNEL__
127
+
/* fn returns 0 to continue iteration */
128
+
#define XT_MATCH_ITERATE(type, e, fn, args...) \
129
+
({ \
130
+
unsigned int __i; \
131
+
int __ret = 0; \
132
+
struct xt_entry_match *__m; \
133
+
\
134
+
for (__i = sizeof(type); \
135
+
__i < (e)->target_offset; \
136
+
__i += __m->u.match_size) { \
137
+
__m = (void *)e + __i; \
138
+
\
139
+
__ret = fn(__m , ## args); \
140
+
if (__ret != 0) \
141
+
break; \
142
+
} \
143
+
__ret; \
144
+
})
145
+
146
+
/* fn returns 0 to continue iteration */
147
+
#define XT_ENTRY_ITERATE_CONTINUE(type, entries, size, n, fn, args...) \
148
+
({ \
149
+
unsigned int __i, __n; \
150
+
int __ret = 0; \
151
+
type *__entry; \
152
+
\
153
+
for (__i = 0, __n = 0; __i < (size); \
154
+
__i += __entry->next_offset, __n++) { \
155
+
__entry = (void *)(entries) + __i; \
156
+
if (__n < n) \
157
+
continue; \
158
+
\
159
+
__ret = fn(__entry , ## args); \
160
+
if (__ret != 0) \
161
+
break; \
162
+
} \
163
+
__ret; \
164
+
})
165
+
166
+
/* fn returns 0 to continue iteration */
167
+
#define XT_ENTRY_ITERATE(type, entries, size, fn, args...) \
168
+
XT_ENTRY_ITERATE_CONTINUE(type, entries, size, 0, fn, args)
169
+
170
+
#endif /* !__KERNEL__ */
171
+
172
+
/* pos is normally a struct ipt_entry/ip6t_entry/etc. */
173
+
#define xt_entry_foreach(pos, ehead, esize) \
174
+
for ((pos) = (typeof(pos))(ehead); \
175
+
(pos) < (typeof(pos))((char *)(ehead) + (esize)); \
176
+
(pos) = (typeof(pos))((char *)(pos) + (pos)->next_offset))
177
+
178
+
/* can only be xt_entry_match, so no use of typeof here */
179
+
#define xt_ematch_foreach(pos, entry) \
180
+
for ((pos) = (struct xt_entry_match *)entry->elems; \
181
+
(pos) < (struct xt_entry_match *)((char *)(entry) + \
182
+
(entry)->target_offset); \
183
+
(pos) = (struct xt_entry_match *)((char *)(pos) + \
184
+
(pos)->u.match_size))
185
+
186
+
187
+
#endif /* _UAPI_X_TABLES_H */
+73
include/uapi/linux/netfilter/xt_hashlimit.h
+73
include/uapi/linux/netfilter/xt_hashlimit.h
···
1
+
#ifndef _UAPI_XT_HASHLIMIT_H
2
+
#define _UAPI_XT_HASHLIMIT_H
3
+
4
+
#include <linux/types.h>
5
+
6
+
/* timings are in milliseconds. */
7
+
#define XT_HASHLIMIT_SCALE 10000
8
+
/* 1/10,000 sec period => max of 10,000/sec. Min rate is then 429490
9
+
* seconds, or one packet every 59 hours.
10
+
*/
11
+
12
+
/* packet length accounting is done in 16-byte steps */
13
+
#define XT_HASHLIMIT_BYTE_SHIFT 4
14
+
15
+
/* details of this structure hidden by the implementation */
16
+
struct xt_hashlimit_htable;
17
+
18
+
enum {
19
+
XT_HASHLIMIT_HASH_DIP = 1 << 0,
20
+
XT_HASHLIMIT_HASH_DPT = 1 << 1,
21
+
XT_HASHLIMIT_HASH_SIP = 1 << 2,
22
+
XT_HASHLIMIT_HASH_SPT = 1 << 3,
23
+
XT_HASHLIMIT_INVERT = 1 << 4,
24
+
XT_HASHLIMIT_BYTES = 1 << 5,
25
+
};
26
+
27
+
struct hashlimit_cfg {
28
+
__u32 mode; /* bitmask of XT_HASHLIMIT_HASH_* */
29
+
__u32 avg; /* Average secs between packets * scale */
30
+
__u32 burst; /* Period multiplier for upper limit. */
31
+
32
+
/* user specified */
33
+
__u32 size; /* how many buckets */
34
+
__u32 max; /* max number of entries */
35
+
__u32 gc_interval; /* gc interval */
36
+
__u32 expire; /* when do entries expire? */
37
+
};
38
+
39
+
struct xt_hashlimit_info {
40
+
char name [IFNAMSIZ]; /* name */
41
+
struct hashlimit_cfg cfg;
42
+
43
+
/* Used internally by the kernel */
44
+
struct xt_hashlimit_htable *hinfo;
45
+
union {
46
+
void *ptr;
47
+
struct xt_hashlimit_info *master;
48
+
} u;
49
+
};
50
+
51
+
struct hashlimit_cfg1 {
52
+
__u32 mode; /* bitmask of XT_HASHLIMIT_HASH_* */
53
+
__u32 avg; /* Average secs between packets * scale */
54
+
__u32 burst; /* Period multiplier for upper limit. */
55
+
56
+
/* user specified */
57
+
__u32 size; /* how many buckets */
58
+
__u32 max; /* max number of entries */
59
+
__u32 gc_interval; /* gc interval */
60
+
__u32 expire; /* when do entries expire? */
61
+
62
+
__u8 srcmask, dstmask;
63
+
};
64
+
65
+
struct xt_hashlimit_mtinfo1 {
66
+
char name[IFNAMSIZ];
67
+
struct hashlimit_cfg1 cfg;
68
+
69
+
/* Used internally by the kernel */
70
+
struct xt_hashlimit_htable *hinfo __attribute__((aligned(8)));
71
+
};
72
+
73
+
#endif /* _UAPI_XT_HASHLIMIT_H */
+23
include/uapi/linux/netfilter/xt_physdev.h
+23
include/uapi/linux/netfilter/xt_physdev.h
···
1
+
#ifndef _UAPI_XT_PHYSDEV_H
2
+
#define _UAPI_XT_PHYSDEV_H
3
+
4
+
#include <linux/types.h>
5
+
6
+
7
+
#define XT_PHYSDEV_OP_IN 0x01
8
+
#define XT_PHYSDEV_OP_OUT 0x02
9
+
#define XT_PHYSDEV_OP_BRIDGED 0x04
10
+
#define XT_PHYSDEV_OP_ISIN 0x08
11
+
#define XT_PHYSDEV_OP_ISOUT 0x10
12
+
#define XT_PHYSDEV_OP_MASK (0x20 - 1)
13
+
14
+
struct xt_physdev_info {
15
+
char physindev[IFNAMSIZ];
16
+
char in_mask[IFNAMSIZ];
17
+
char physoutdev[IFNAMSIZ];
18
+
char out_mask[IFNAMSIZ];
19
+
__u8 invert;
20
+
__u8 bitmask;
21
+
};
22
+
23
+
#endif /* _UAPI_XT_PHYSDEV_H */