1 /*
2  *  ebtables
3  *
4  *	Authors:
5  *	Bart De Schuymer		<bdschuym@pandora.be>
6  *
7  *  ebtables.c,v 2.0, April, 2002
8  *
9  *  This code is strongly inspired by the iptables code which is
10  *  Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
11  */
12 #ifndef __LINUX_BRIDGE_EFF_H
13 #define __LINUX_BRIDGE_EFF_H
14 
15 #include <linux/if.h>
16 #include <linux/if_ether.h>
17 #include <uapi/linux/netfilter_bridge/ebtables.h>
18 
19 /* return values for match() functions */
20 #define EBT_MATCH 0
21 #define EBT_NOMATCH 1
22 
23 struct ebt_match {
24 	struct list_head list;
25 	const char name[EBT_FUNCTION_MAXNAMELEN];
26 	bool (*match)(const struct sk_buff *skb, const struct net_device *in,
27 		const struct net_device *out, const struct xt_match *match,
28 		const void *matchinfo, int offset, unsigned int protoff,
29 		bool *hotdrop);
30 	bool (*checkentry)(const char *table, const void *entry,
31 		const struct xt_match *match, void *matchinfo,
32 		unsigned int hook_mask);
33 	void (*destroy)(const struct xt_match *match, void *matchinfo);
34 	unsigned int matchsize;
35 	u_int8_t revision;
36 	u_int8_t family;
37 	struct module *me;
38 };
39 
40 struct ebt_watcher {
41 	struct list_head list;
42 	const char name[EBT_FUNCTION_MAXNAMELEN];
43 	unsigned int (*target)(struct sk_buff *skb,
44 		const struct net_device *in, const struct net_device *out,
45 		unsigned int hook_num, const struct xt_target *target,
46 		const void *targinfo);
47 	bool (*checkentry)(const char *table, const void *entry,
48 		const struct xt_target *target, void *targinfo,
49 		unsigned int hook_mask);
50 	void (*destroy)(const struct xt_target *target, void *targinfo);
51 	unsigned int targetsize;
52 	u_int8_t revision;
53 	u_int8_t family;
54 	struct module *me;
55 };
56 
57 struct ebt_target {
58 	struct list_head list;
59 	const char name[EBT_FUNCTION_MAXNAMELEN];
60 	/* returns one of the standard EBT_* verdicts */
61 	unsigned int (*target)(struct sk_buff *skb,
62 		const struct net_device *in, const struct net_device *out,
63 		unsigned int hook_num, const struct xt_target *target,
64 		const void *targinfo);
65 	bool (*checkentry)(const char *table, const void *entry,
66 		const struct xt_target *target, void *targinfo,
67 		unsigned int hook_mask);
68 	void (*destroy)(const struct xt_target *target, void *targinfo);
69 	unsigned int targetsize;
70 	u_int8_t revision;
71 	u_int8_t family;
72 	struct module *me;
73 };
74 
75 /* used for jumping from and into user defined chains (udc) */
76 struct ebt_chainstack {
77 	struct ebt_entries *chaininfo; /* pointer to chain data */
78 	struct ebt_entry *e; /* pointer to entry data */
79 	unsigned int n; /* n'th entry */
80 };
81 
82 struct ebt_table_info {
83 	/* total size of the entries */
84 	unsigned int entries_size;
85 	unsigned int nentries;
86 	/* pointers to the start of the chains */
87 	struct ebt_entries *hook_entry[NF_BR_NUMHOOKS];
88 	/* room to maintain the stack used for jumping from and into udc */
89 	struct ebt_chainstack **chainstack;
90 	char *entries;
91 	struct ebt_counter counters[0] ____cacheline_aligned;
92 };
93 
94 struct ebt_table {
95 	struct list_head list;
96 	char name[EBT_TABLE_MAXNAMELEN];
97 	struct ebt_replace_kernel *table;
98 	unsigned int valid_hooks;
99 	rwlock_t lock;
100 	/* e.g. could be the table explicitly only allows certain
101 	 * matches, targets, ... 0 == let it in */
102 	int (*check)(const struct ebt_table_info *info,
103 	   unsigned int valid_hooks);
104 	/* the data used by the kernel */
105 	struct ebt_table_info *private;
106 	struct module *me;
107 };
108 
109 #define EBT_ALIGN(s) (((s) + (__alignof__(struct _xt_align)-1)) & \
110 		     ~(__alignof__(struct _xt_align)-1))
111 extern struct ebt_table *ebt_register_table(struct net *net,
112 					    const struct ebt_table *table);
113 extern void ebt_unregister_table(struct net *net, struct ebt_table *table);
114 extern unsigned int ebt_do_table(struct sk_buff *skb,
115 				 const struct nf_hook_state *state,
116 				 struct ebt_table *table);
117 
118 /* Used in the kernel match() functions */
119 #define FWINV(bool,invflg) ((bool) ^ !!(info->invflags & invflg))
120 /* True if the hook mask denotes that the rule is in a base chain,
121  * used in the check() functions */
122 #define BASE_CHAIN (par->hook_mask & (1 << NF_BR_NUMHOOKS))
123 /* Clear the bit in the hook mask that tells if the rule is on a base chain */
124 #define CLEAR_BASE_CHAIN_BIT (par->hook_mask &= ~(1 << NF_BR_NUMHOOKS))
125 /* True if the target is not a standard target */
126 #define INVALID_TARGET (info->target < -NUM_STANDARD_TARGETS || info->target >= 0)
127 
128 #endif
129