Merge branch 'master' of ssh://master.kernel.org/pub/scm/linux/kernel/git/mchehab...

[linux-2.6-omap-h63xx.git] / include / linux / netfilter_ipv6 / ip6_tables.h

diff --git a/include/linux/netfilter_ipv6/ip6_tables.h b/include/linux/netfilter_ipv6/ip6_tables.h
index 4aed340401dbca0368049dff8fdbddf4f5a399ad..9a720f05888f09e5e5438b363b720981672acb00 100644 (file)
--- a/include/linux/netfilter_ipv6/ip6_tables.h
+++ b/include/linux/netfilter_ipv6/ip6_tables.h
@@ -44,8 +44,14 @@ struct ip6t_ip6 {
        char iniface[IFNAMSIZ], outiface[IFNAMSIZ];
        unsigned char iniface_mask[IFNAMSIZ], outiface_mask[IFNAMSIZ];
 
-       /* ARGH, HopByHop uses 0, so can't do 0 = ANY,
-          instead IP6T_F_NOPROTO must be set */
+       /* Upper protocol number
+        * - The allowed value is 0 (any) or protocol number of last parsable
+        *   header, which is 50 (ESP), 59 (No Next Header), 135 (MH), or
+        *   the non IPv6 extension headers.
+        * - The protocol numbers of IPv6 extension headers except of ESP and
+        *   MH do not match any packets.
+        * - You also need to set IP6T_FLAGS_PROTO to "flags" to check protocol.
+        */
        u_int16_t proto;
        /* TOS to match iff flags & IP6T_F_TOS */
        u_int8_t tos;
@@ -104,6 +110,47 @@ struct ip6t_entry
        unsigned char elems[0];
 };
 
+/* Standard entry */
+struct ip6t_standard
+{
+       struct ip6t_entry entry;
+       struct ip6t_standard_target target;
+};
+
+struct ip6t_error_target
+{
+       struct ip6t_entry_target target;
+       char errorname[IP6T_FUNCTION_MAXNAMELEN];
+};
+
+struct ip6t_error
+{
+       struct ip6t_entry entry;
+       struct ip6t_error_target target;
+};
+
+#define IP6T_ENTRY_INIT(__size)                                                       \
+{                                                                             \
+       .target_offset  = sizeof(struct ip6t_entry),                           \
+       .next_offset    = (__size),                                            \
+}
+
+#define IP6T_STANDARD_INIT(__verdict)                                         \
+{                                                                             \
+       .entry          = IP6T_ENTRY_INIT(sizeof(struct ip6t_standard)),       \
+       .target         = XT_TARGET_INIT(IP6T_STANDARD_TARGET,                 \
+                                        sizeof(struct ip6t_standard_target)), \
+       .target.verdict = -(__verdict) - 1,                                    \
+}
+
+#define IP6T_ERROR_INIT                                                               \
+{                                                                             \
+       .entry          = IP6T_ENTRY_INIT(sizeof(struct ip6t_error)),          \
+       .target         = XT_TARGET_INIT(IP6T_ERROR_TARGET,                    \
+                                        sizeof(struct ip6t_error_target)),    \
+       .target.errorname = "ERROR",                                           \
+}
+
 /*
  * New IP firewall options for [gs]etsockopt at the RAW IP level.
  * Unlike BSD Linux inherits IP options so you don't have to use
@@ -286,24 +333,14 @@ ip6t_get_target(struct ip6t_entry *e)
 #include <linux/init.h>
 extern void ip6t_init(void) __init;
 
-#define ip6t_register_target(tgt)              \
-({     (tgt)->family = AF_INET6;               \
-       xt_register_target(tgt); })
-#define ip6t_unregister_target(tgt) xt_unregister_target(tgt)
-
-#define ip6t_register_match(match)             \
-({     (match)->family = AF_INET6;             \
-       xt_register_match(match); })
-#define ip6t_unregister_match(match) xt_unregister_match(match)
-
-extern int ip6t_register_table(struct ip6t_table *table,
+extern int ip6t_register_table(struct xt_table *table,
                               const struct ip6t_replace *repl);
-extern void ip6t_unregister_table(struct ip6t_table *table);
+extern void ip6t_unregister_table(struct xt_table *table);
 extern unsigned int ip6t_do_table(struct sk_buff **pskb,
                                  unsigned int hook,
                                  const struct net_device *in,
                                  const struct net_device *out,
-                                 struct ip6t_table *table);
+                                 struct xt_table *table);
 
 /* Check for an extension */
 extern int ip6t_ext_hdr(u8 nexthdr);