#ifndef _NFT_BRIDGE_H_
|
#define _NFT_BRIDGE_H_
|
|
#include <netinet/in.h>
|
//#include <linux/netfilter_bridge/ebtables.h>
|
#include <linux/netfilter/x_tables.h>
|
#include <linux/netfilter/nf_tables.h>
|
#include <net/ethernet.h>
|
#include <libiptc/libxtc.h>
|
|
/* We use replace->flags, so we can't use the following values:
|
* 0x01 == OPT_COMMAND, 0x02 == OPT_TABLE, 0x100 == OPT_ZERO */
|
#define LIST_N 0x04
|
#define LIST_C 0x08
|
#define LIST_X 0x10
|
#define LIST_MAC2 0x20
|
|
/* Be backwards compatible, so don't use '+' in kernel */
|
#define IF_WILDCARD 1
|
|
extern unsigned char eb_mac_type_unicast[ETH_ALEN];
|
extern unsigned char eb_msk_type_unicast[ETH_ALEN];
|
extern unsigned char eb_mac_type_multicast[ETH_ALEN];
|
extern unsigned char eb_msk_type_multicast[ETH_ALEN];
|
extern unsigned char eb_mac_type_broadcast[ETH_ALEN];
|
extern unsigned char eb_msk_type_broadcast[ETH_ALEN];
|
extern unsigned char eb_mac_type_bridge_group[ETH_ALEN];
|
extern unsigned char eb_msk_type_bridge_group[ETH_ALEN];
|
|
int ebt_get_mac_and_mask(const char *from, unsigned char *to, unsigned char *mask);
|
|
/* From: include/linux/netfilter_bridge/ebtables.h
|
*
|
* Adapted for the need of the ebtables-compat.
|
*/
|
|
#define EBT_TABLE_MAXNAMELEN 32
|
#define EBT_CHAIN_MAXNAMELEN EBT_TABLE_MAXNAMELEN
|
#define EBT_FUNCTION_MAXNAMELEN EBT_TABLE_MAXNAMELEN
|
|
/* verdicts >0 are "branches" */
|
#define EBT_ACCEPT -1
|
#define EBT_DROP -2
|
#define EBT_CONTINUE -3
|
#define EBT_RETURN -4
|
#define NUM_STANDARD_TARGETS 4
|
|
#define EBT_ENTRY_OR_ENTRIES 0x01
|
/* these are the normal masks */
|
#define EBT_NOPROTO 0x02
|
#define EBT_802_3 0x04
|
#define EBT_SOURCEMAC 0x08
|
#define EBT_DESTMAC 0x10
|
#define EBT_F_MASK (EBT_NOPROTO | EBT_802_3 | EBT_SOURCEMAC | EBT_DESTMAC \
|
| EBT_ENTRY_OR_ENTRIES)
|
|
#define EBT_IPROTO 0x01
|
#define EBT_IIN 0x02
|
#define EBT_IOUT 0x04
|
#define EBT_ISOURCE 0x8
|
#define EBT_IDEST 0x10
|
#define EBT_ILOGICALIN 0x20
|
#define EBT_ILOGICALOUT 0x40
|
#define EBT_INV_MASK (EBT_IPROTO | EBT_IIN | EBT_IOUT | EBT_ILOGICALIN \
|
| EBT_ILOGICALOUT | EBT_ISOURCE | EBT_IDEST)
|
|
/* ebtables target modules store the verdict inside an int. We can
|
* reclaim a part of this int for backwards compatible extensions.
|
* The 4 lsb are more than enough to store the verdict.
|
*/
|
#define EBT_VERDICT_BITS 0x0000000F
|
|
/* Fake ebt_entry */
|
struct ebt_entry {
|
/* this needs to be the first field */
|
unsigned int bitmask;
|
unsigned int invflags;
|
uint16_t ethproto;
|
/* the physical in-dev */
|
char in[IFNAMSIZ];
|
/* the logical in-dev */
|
char logical_in[IFNAMSIZ];
|
/* the physical out-dev */
|
char out[IFNAMSIZ];
|
/* the logical out-dev */
|
char logical_out[IFNAMSIZ];
|
unsigned char sourcemac[ETH_ALEN];
|
unsigned char sourcemsk[ETH_ALEN];
|
unsigned char destmac[ETH_ALEN];
|
unsigned char destmsk[ETH_ALEN];
|
|
unsigned char in_mask[IFNAMSIZ];
|
unsigned char out_mask[IFNAMSIZ];
|
};
|
|
/* trick for ebtables-compat, since watchers are targets */
|
struct ebt_match {
|
struct ebt_match *next;
|
union {
|
struct xtables_match *match;
|
struct xtables_target *watcher;
|
} u;
|
bool ismatch;
|
};
|
|
struct ebtables_command_state {
|
struct ebt_entry fw;
|
struct xtables_target *target;
|
struct xtables_rule_match *matches;
|
struct ebt_match *match_list;
|
const char *jumpto;
|
struct xt_counters counters;
|
int invert;
|
int c;
|
char **argv;
|
int proto_used;
|
char *protocol;
|
unsigned int options;
|
};
|
|
void nft_rule_to_ebtables_command_state(struct nftnl_rule *r,
|
struct ebtables_command_state *cs);
|
|
static const char *ebt_standard_targets[NUM_STANDARD_TARGETS] = {
|
"ACCEPT",
|
"DROP",
|
"CONTINUE",
|
"RETURN",
|
};
|
|
static inline const char *nft_ebt_standard_target(unsigned int num)
|
{
|
if (num > NUM_STANDARD_TARGETS)
|
return NULL;
|
|
return ebt_standard_targets[num];
|
}
|
|
static inline int ebt_fill_target(const char *str, unsigned int *verdict)
|
{
|
int i, ret = 0;
|
|
for (i = 0; i < NUM_STANDARD_TARGETS; i++) {
|
if (!strcmp(str, nft_ebt_standard_target(i))) {
|
*verdict = -i - 1;
|
break;
|
}
|
}
|
|
if (i == NUM_STANDARD_TARGETS)
|
ret = 1;
|
|
return ret;
|
}
|
|
static inline const char *ebt_target_name(unsigned int verdict)
|
{
|
return nft_ebt_standard_target(-verdict - 1);
|
}
|
|
#define EBT_CHECK_OPTION(flags, mask) ({ \
|
if (*flags & mask) \
|
xtables_error(PARAMETER_PROBLEM, \
|
"Multiple use of same " \
|
"option not allowed"); \
|
*flags |= mask; \
|
}) \
|
|
void ebt_cs_clean(struct ebtables_command_state *cs);
|
|
#endif
|
