Skip to content

Commit 94d0ec5

Browse files
dhowellsdhowells
committed
UAPI: (Scripted) Disintegrate include/linux/netfilter
Signed-off-by: David Howells <dhowells@redhat.com> Acked-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Thomas Gleixner <tglx@linutronix.de> Acked-by: Michael Kerrisk <mtk.manpages@gmail.com> Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Acked-by: Dave Jones <davej@redhat.com>
1 parent 27a3aad commit 94d0ec5

86 files changed

Lines changed: 636 additions & 607 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎include/linux/netfilter/Kbuild‎

Lines changed: 0 additions & 77 deletions
Original file line numberDiff line numberDiff line change
@@ -1,78 +1 @@
11
header-y += ipset/
2-
3-
header-y += nf_conntrack_common.h
4-
header-y += nf_conntrack_ftp.h
5-
header-y += nf_conntrack_sctp.h
6-
header-y += nf_conntrack_tcp.h
7-
header-y += nf_conntrack_tuple_common.h
8-
header-y += nf_nat.h
9-
header-y += nfnetlink.h
10-
header-y += nfnetlink_acct.h
11-
header-y += nfnetlink_compat.h
12-
header-y += nfnetlink_conntrack.h
13-
header-y += nfnetlink_cthelper.h
14-
header-y += nfnetlink_cttimeout.h
15-
header-y += nfnetlink_log.h
16-
header-y += nfnetlink_queue.h
17-
header-y += x_tables.h
18-
header-y += xt_AUDIT.h
19-
header-y += xt_CHECKSUM.h
20-
header-y += xt_CLASSIFY.h
21-
header-y += xt_CONNMARK.h
22-
header-y += xt_CONNSECMARK.h
23-
header-y += xt_CT.h
24-
header-y += xt_DSCP.h
25-
header-y += xt_IDLETIMER.h
26-
header-y += xt_LED.h
27-
header-y += xt_LOG.h
28-
header-y += xt_MARK.h
29-
header-y += xt_nfacct.h
30-
header-y += xt_NFLOG.h
31-
header-y += xt_NFQUEUE.h
32-
header-y += xt_RATEEST.h
33-
header-y += xt_SECMARK.h
34-
header-y += xt_TCPMSS.h
35-
header-y += xt_TCPOPTSTRIP.h
36-
header-y += xt_TEE.h
37-
header-y += xt_TPROXY.h
38-
header-y += xt_addrtype.h
39-
header-y += xt_cluster.h
40-
header-y += xt_comment.h
41-
header-y += xt_connbytes.h
42-
header-y += xt_connlimit.h
43-
header-y += xt_connmark.h
44-
header-y += xt_conntrack.h
45-
header-y += xt_cpu.h
46-
header-y += xt_dccp.h
47-
header-y += xt_devgroup.h
48-
header-y += xt_dscp.h
49-
header-y += xt_ecn.h
50-
header-y += xt_esp.h
51-
header-y += xt_hashlimit.h
52-
header-y += xt_helper.h
53-
header-y += xt_iprange.h
54-
header-y += xt_ipvs.h
55-
header-y += xt_length.h
56-
header-y += xt_limit.h
57-
header-y += xt_mac.h
58-
header-y += xt_mark.h
59-
header-y += xt_multiport.h
60-
header-y += xt_osf.h
61-
header-y += xt_owner.h
62-
header-y += xt_physdev.h
63-
header-y += xt_pkttype.h
64-
header-y += xt_policy.h
65-
header-y += xt_quota.h
66-
header-y += xt_rateest.h
67-
header-y += xt_realm.h
68-
header-y += xt_recent.h
69-
header-y += xt_set.h
70-
header-y += xt_sctp.h
71-
header-y += xt_socket.h
72-
header-y += xt_state.h
73-
header-y += xt_statistic.h
74-
header-y += xt_string.h
75-
header-y += xt_tcpmss.h
76-
header-y += xt_tcpudp.h
77-
header-y += xt_time.h
78-
header-y += xt_u32.h

‎include/linux/netfilter/nf_conntrack_common.h‎

Lines changed: 1 addition & 114 deletions
Original file line numberDiff line numberDiff line change
@@ -1,119 +1,8 @@
11
#ifndef _NF_CONNTRACK_COMMON_H
22
#define _NF_CONNTRACK_COMMON_H
3-
/* Connection state tracking for netfilter. This is separated from,
4-
but required by, the NAT layer; it can also be used by an iptables
5-
extension. */
6-
enum ip_conntrack_info {
7-
/* Part of an established connection (either direction). */
8-
IP_CT_ESTABLISHED,
93

10-
/* Like NEW, but related to an existing connection, or ICMP error
11-
(in either direction). */
12-
IP_CT_RELATED,
4+
#include <uapi/linux/netfilter/nf_conntrack_common.h>
135

14-
/* Started a new connection to track (only
15-
IP_CT_DIR_ORIGINAL); may be a retransmission. */
16-
IP_CT_NEW,
17-
18-
/* >= this indicates reply direction */
19-
IP_CT_IS_REPLY,
20-
21-
IP_CT_ESTABLISHED_REPLY = IP_CT_ESTABLISHED + IP_CT_IS_REPLY,
22-
IP_CT_RELATED_REPLY = IP_CT_RELATED + IP_CT_IS_REPLY,
23-
IP_CT_NEW_REPLY = IP_CT_NEW + IP_CT_IS_REPLY,
24-
/* Number of distinct IP_CT types (no NEW in reply dirn). */
25-
IP_CT_NUMBER = IP_CT_IS_REPLY * 2 - 1
26-
};
27-
28-
/* Bitset representing status of connection. */
29-
enum ip_conntrack_status {
30-
/* It's an expected connection: bit 0 set. This bit never changed */
31-
IPS_EXPECTED_BIT = 0,
32-
IPS_EXPECTED = (1 << IPS_EXPECTED_BIT),
33-
34-
/* We've seen packets both ways: bit 1 set. Can be set, not unset. */
35-
IPS_SEEN_REPLY_BIT = 1,
36-
IPS_SEEN_REPLY = (1 << IPS_SEEN_REPLY_BIT),
37-
38-
/* Conntrack should never be early-expired. */
39-
IPS_ASSURED_BIT = 2,
40-
IPS_ASSURED = (1 << IPS_ASSURED_BIT),
41-
42-
/* Connection is confirmed: originating packet has left box */
43-
IPS_CONFIRMED_BIT = 3,
44-
IPS_CONFIRMED = (1 << IPS_CONFIRMED_BIT),
45-
46-
/* Connection needs src nat in orig dir. This bit never changed. */
47-
IPS_SRC_NAT_BIT = 4,
48-
IPS_SRC_NAT = (1 << IPS_SRC_NAT_BIT),
49-
50-
/* Connection needs dst nat in orig dir. This bit never changed. */
51-
IPS_DST_NAT_BIT = 5,
52-
IPS_DST_NAT = (1 << IPS_DST_NAT_BIT),
53-
54-
/* Both together. */
55-
IPS_NAT_MASK = (IPS_DST_NAT | IPS_SRC_NAT),
56-
57-
/* Connection needs TCP sequence adjusted. */
58-
IPS_SEQ_ADJUST_BIT = 6,
59-
IPS_SEQ_ADJUST = (1 << IPS_SEQ_ADJUST_BIT),
60-
61-
/* NAT initialization bits. */
62-
IPS_SRC_NAT_DONE_BIT = 7,
63-
IPS_SRC_NAT_DONE = (1 << IPS_SRC_NAT_DONE_BIT),
64-
65-
IPS_DST_NAT_DONE_BIT = 8,
66-
IPS_DST_NAT_DONE = (1 << IPS_DST_NAT_DONE_BIT),
67-
68-
/* Both together */
69-
IPS_NAT_DONE_MASK = (IPS_DST_NAT_DONE | IPS_SRC_NAT_DONE),
70-
71-
/* Connection is dying (removed from lists), can not be unset. */
72-
IPS_DYING_BIT = 9,
73-
IPS_DYING = (1 << IPS_DYING_BIT),
74-
75-
/* Connection has fixed timeout. */
76-
IPS_FIXED_TIMEOUT_BIT = 10,
77-
IPS_FIXED_TIMEOUT = (1 << IPS_FIXED_TIMEOUT_BIT),
78-
79-
/* Conntrack is a template */
80-
IPS_TEMPLATE_BIT = 11,
81-
IPS_TEMPLATE = (1 << IPS_TEMPLATE_BIT),
82-
83-
/* Conntrack is a fake untracked entry */
84-
IPS_UNTRACKED_BIT = 12,
85-
IPS_UNTRACKED = (1 << IPS_UNTRACKED_BIT),
86-
87-
/* Conntrack got a helper explicitly attached via CT target. */
88-
IPS_HELPER_BIT = 13,
89-
IPS_HELPER = (1 << IPS_HELPER_BIT),
90-
};
91-
92-
/* Connection tracking event types */
93-
enum ip_conntrack_events {
94-
IPCT_NEW, /* new conntrack */
95-
IPCT_RELATED, /* related conntrack */
96-
IPCT_DESTROY, /* destroyed conntrack */
97-
IPCT_REPLY, /* connection has seen two-way traffic */
98-
IPCT_ASSURED, /* connection status has changed to assured */
99-
IPCT_PROTOINFO, /* protocol information has changed */
100-
IPCT_HELPER, /* new helper has been set */
101-
IPCT_MARK, /* new mark has been set */
102-
IPCT_NATSEQADJ, /* NAT is doing sequence adjustment */
103-
IPCT_SECMARK, /* new security mark has been set */
104-
};
105-
106-
enum ip_conntrack_expect_events {
107-
IPEXP_NEW, /* new expectation */
108-
IPEXP_DESTROY, /* destroyed expectation */
109-
};
110-
111-
/* expectation flags */
112-
#define NF_CT_EXPECT_PERMANENT 0x1
113-
#define NF_CT_EXPECT_INACTIVE 0x2
114-
#define NF_CT_EXPECT_USERSPACE 0x4
115-
116-
#ifdef __KERNEL__
1176
struct ip_conntrack_stat {
1187
unsigned int searched;
1198
unsigned int found;
@@ -136,6 +25,4 @@ struct ip_conntrack_stat {
13625
/* call to create an explicit dependency on nf_conntrack. */
13726
extern void need_conntrack(void);
13827

139-
#endif /* __KERNEL__ */
140-
14128
#endif /* _NF_CONNTRACK_COMMON_H */

‎include/linux/netfilter/nf_conntrack_ftp.h‎

Lines changed: 1 addition & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,8 @@
11
#ifndef _NF_CONNTRACK_FTP_H
22
#define _NF_CONNTRACK_FTP_H
3-
/* FTP tracking. */
43

5-
/* This enum is exposed to userspace */
6-
enum nf_ct_ftp_type {
7-
/* PORT command from client */
8-
NF_CT_FTP_PORT,
9-
/* PASV response from server */
10-
NF_CT_FTP_PASV,
11-
/* EPRT command from client */
12-
NF_CT_FTP_EPRT,
13-
/* EPSV response from server */
14-
NF_CT_FTP_EPSV,
15-
};
4+
#include <uapi/linux/netfilter/nf_conntrack_ftp.h>
165

17-
#ifdef __KERNEL__
186

197
#define FTP_PORT 21
208

@@ -42,6 +30,4 @@ extern unsigned int (*nf_nat_ftp_hook)(struct sk_buff *skb,
4230
unsigned int matchoff,
4331
unsigned int matchlen,
4432
struct nf_conntrack_expect *exp);
45-
#endif /* __KERNEL__ */
46-
4733
#endif /* _NF_CONNTRACK_FTP_H */

‎include/linux/netfilter/nf_conntrack_tcp.h‎

Lines changed: 1 addition & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -1,53 +1,8 @@
11
#ifndef _NF_CONNTRACK_TCP_H
22
#define _NF_CONNTRACK_TCP_H
3-
/* TCP tracking. */
43

5-
#include <linux/types.h>
4+
#include <uapi/linux/netfilter/nf_conntrack_tcp.h>
65

7-
/* This is exposed to userspace (ctnetlink) */
8-
enum tcp_conntrack {
9-
TCP_CONNTRACK_NONE,
10-
TCP_CONNTRACK_SYN_SENT,
11-
TCP_CONNTRACK_SYN_RECV,
12-
TCP_CONNTRACK_ESTABLISHED,
13-
TCP_CONNTRACK_FIN_WAIT,
14-
TCP_CONNTRACK_CLOSE_WAIT,
15-
TCP_CONNTRACK_LAST_ACK,
16-
TCP_CONNTRACK_TIME_WAIT,
17-
TCP_CONNTRACK_CLOSE,
18-
TCP_CONNTRACK_LISTEN, /* obsolete */
19-
#define TCP_CONNTRACK_SYN_SENT2 TCP_CONNTRACK_LISTEN
20-
TCP_CONNTRACK_MAX,
21-
TCP_CONNTRACK_IGNORE,
22-
TCP_CONNTRACK_RETRANS,
23-
TCP_CONNTRACK_UNACK,
24-
TCP_CONNTRACK_TIMEOUT_MAX
25-
};
26-
27-
/* Window scaling is advertised by the sender */
28-
#define IP_CT_TCP_FLAG_WINDOW_SCALE 0x01
29-
30-
/* SACK is permitted by the sender */
31-
#define IP_CT_TCP_FLAG_SACK_PERM 0x02
32-
33-
/* This sender sent FIN first */
34-
#define IP_CT_TCP_FLAG_CLOSE_INIT 0x04
35-
36-
/* Be liberal in window checking */
37-
#define IP_CT_TCP_FLAG_BE_LIBERAL 0x08
38-
39-
/* Has unacknowledged data */
40-
#define IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED 0x10
41-
42-
/* The field td_maxack has been set */
43-
#define IP_CT_TCP_FLAG_MAXACK_SET 0x20
44-
45-
struct nf_ct_tcp_flags {
46-
__u8 flags;
47-
__u8 mask;
48-
};
49-
50-
#ifdef __KERNEL__
516

527
struct ip_ct_tcp_state {
538
u_int32_t td_end; /* max of seq + len */
@@ -74,6 +29,4 @@ struct ip_ct_tcp {
7429
u_int8_t last_flags; /* Last flags set */
7530
};
7631

77-
#endif /* __KERNEL__ */
78-
7932
#endif /* _NF_CONNTRACK_TCP_H */

‎include/linux/netfilter/nfnetlink.h‎

Lines changed: 1 addition & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -1,63 +1,11 @@
11
#ifndef _NFNETLINK_H
22
#define _NFNETLINK_H
3-
#include <linux/types.h>
4-
#include <linux/netfilter/nfnetlink_compat.h>
53

6-
enum nfnetlink_groups {
7-
NFNLGRP_NONE,
8-
#define NFNLGRP_NONE NFNLGRP_NONE
9-
NFNLGRP_CONNTRACK_NEW,
10-
#define NFNLGRP_CONNTRACK_NEW NFNLGRP_CONNTRACK_NEW
11-
NFNLGRP_CONNTRACK_UPDATE,
12-
#define NFNLGRP_CONNTRACK_UPDATE NFNLGRP_CONNTRACK_UPDATE
13-
NFNLGRP_CONNTRACK_DESTROY,
14-
#define NFNLGRP_CONNTRACK_DESTROY NFNLGRP_CONNTRACK_DESTROY
15-
NFNLGRP_CONNTRACK_EXP_NEW,
16-
#define NFNLGRP_CONNTRACK_EXP_NEW NFNLGRP_CONNTRACK_EXP_NEW
17-
NFNLGRP_CONNTRACK_EXP_UPDATE,
18-
#define NFNLGRP_CONNTRACK_EXP_UPDATE NFNLGRP_CONNTRACK_EXP_UPDATE
19-
NFNLGRP_CONNTRACK_EXP_DESTROY,
20-
#define NFNLGRP_CONNTRACK_EXP_DESTROY NFNLGRP_CONNTRACK_EXP_DESTROY
21-
__NFNLGRP_MAX,
22-
};
23-
#define NFNLGRP_MAX (__NFNLGRP_MAX - 1)
24-
25-
/* General form of address family dependent message.
26-
*/
27-
struct nfgenmsg {
28-
__u8 nfgen_family; /* AF_xxx */
29-
__u8 version; /* nfnetlink version */
30-
__be16 res_id; /* resource id */
31-
};
32-
33-
#define NFNETLINK_V0 0
34-
35-
/* netfilter netlink message types are split in two pieces:
36-
* 8 bit subsystem, 8bit operation.
37-
*/
38-
39-
#define NFNL_SUBSYS_ID(x) ((x & 0xff00) >> 8)
40-
#define NFNL_MSG_TYPE(x) (x & 0x00ff)
41-
42-
/* No enum here, otherwise __stringify() trick of MODULE_ALIAS_NFNL_SUBSYS()
43-
* won't work anymore */
44-
#define NFNL_SUBSYS_NONE 0
45-
#define NFNL_SUBSYS_CTNETLINK 1
46-
#define NFNL_SUBSYS_CTNETLINK_EXP 2
47-
#define NFNL_SUBSYS_QUEUE 3
48-
#define NFNL_SUBSYS_ULOG 4
49-
#define NFNL_SUBSYS_OSF 5
50-
#define NFNL_SUBSYS_IPSET 6
51-
#define NFNL_SUBSYS_ACCT 7
52-
#define NFNL_SUBSYS_CTNETLINK_TIMEOUT 8
53-
#define NFNL_SUBSYS_CTHELPER 9
54-
#define NFNL_SUBSYS_COUNT 10
55-
56-
#ifdef __KERNEL__
574

585
#include <linux/netlink.h>
596
#include <linux/capability.h>
607
#include <net/netlink.h>
8+
#include <uapi/linux/netfilter/nfnetlink.h>
619

6210
struct nfnl_callback {
6311
int (*call)(struct sock *nl, struct sk_buff *skb,
@@ -92,5 +40,4 @@ extern void nfnl_unlock(void);
9240
#define MODULE_ALIAS_NFNL_SUBSYS(subsys) \
9341
MODULE_ALIAS("nfnetlink-subsys-" __stringify(subsys))
9442

95-
#endif /* __KERNEL__ */
9643
#endif /* _NFNETLINK_H */

0 commit comments

Comments
 (0)