summaryrefslogtreecommitdiffstats
path: root/include/linux/netfilter_ipv4
diff options
context:
space:
mode:
authorPablo Neira Ayuso <pablo@netfilter.org>2011-10-01 13:51:29 -0400
committerPablo Neira Ayuso <pablo@netfilter.org>2011-11-01 09:19:52 +0100
commit8d83f63b19d45ba0898b97824afcc8e0b5c954cb (patch)
treeaf5a9d67a06321c324d2c7a043c49cc487091b9b /include/linux/netfilter_ipv4
parent0a9ee81349d90c6c85831f38118bf569c60a4d51 (diff)
downloadlinux-stable-8d83f63b19d45ba0898b97824afcc8e0b5c954cb.tar.gz
linux-stable-8d83f63b19d45ba0898b97824afcc8e0b5c954cb.tar.bz2
linux-stable-8d83f63b19d45ba0898b97824afcc8e0b5c954cb.zip
netfilter: export NAT definitions through linux/netfilter_ipv4/nf_nat.h
This patch exports several definitions that used to live under include/net/netfilter/nf_nat.h. These definitions, although not exported, have been used by iptables and other userspace applications like miniupnpd since long time. Basically, these userspace tools included some internal definition of the required structures and they assume no changes in the binary representation (which is OK indeed). To resolve this situation, this patch makes public the required structure and install them in INSTALL_HDR_PATH. See: https://bugs.gentoo.org/376873, for more information. This patch is heavily based on the initial patch sent by: Anthony G. Basile <blueness@gentoo.org> Which was entitled: netfilter: export sanitized nf_nat.h to INSTALL_HDR_PATH Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'include/linux/netfilter_ipv4')
-rw-r--r--include/linux/netfilter_ipv4/Kbuild1
-rw-r--r--include/linux/netfilter_ipv4/nf_nat.h58
2 files changed, 59 insertions, 0 deletions
diff --git a/include/linux/netfilter_ipv4/Kbuild b/include/linux/netfilter_ipv4/Kbuild
index f9930c87fff3..c3b45480ecf7 100644
--- a/include/linux/netfilter_ipv4/Kbuild
+++ b/include/linux/netfilter_ipv4/Kbuild
@@ -12,3 +12,4 @@ header-y += ipt_ah.h
header-y += ipt_ecn.h
header-y += ipt_realm.h
header-y += ipt_ttl.h
+header-y += nf_nat.h
diff --git a/include/linux/netfilter_ipv4/nf_nat.h b/include/linux/netfilter_ipv4/nf_nat.h
new file mode 100644
index 000000000000..7a861d09fc86
--- /dev/null
+++ b/include/linux/netfilter_ipv4/nf_nat.h
@@ -0,0 +1,58 @@
+#ifndef _LINUX_NF_NAT_H
+#define _LINUX_NF_NAT_H
+
+#include <linux/types.h>
+
+#define IP_NAT_RANGE_MAP_IPS 1
+#define IP_NAT_RANGE_PROTO_SPECIFIED 2
+#define IP_NAT_RANGE_PROTO_RANDOM 4
+#define IP_NAT_RANGE_PERSISTENT 8
+
+/* The protocol-specific manipulable parts of the tuple. */
+union nf_conntrack_man_proto {
+ /* Add other protocols here. */
+ __be16 all;
+
+ struct {
+ __be16 port;
+ } tcp;
+ struct {
+ __be16 port;
+ } udp;
+ struct {
+ __be16 id;
+ } icmp;
+ struct {
+ __be16 port;
+ } dccp;
+ struct {
+ __be16 port;
+ } sctp;
+ struct {
+ __be16 key; /* GRE key is 32bit, PPtP only uses 16bit */
+ } gre;
+};
+
+/* Single range specification. */
+struct nf_nat_range {
+ /* Set to OR of flags above. */
+ unsigned int flags;
+
+ /* Inclusive: network order. */
+ __be32 min_ip, max_ip;
+
+ /* Inclusive: network order */
+ union nf_conntrack_man_proto min, max;
+};
+
+/* For backwards compat: don't use in modern code. */
+struct nf_nat_multi_range_compat {
+ unsigned int rangesize; /* Must be 1. */
+
+ /* hangs off end. */
+ struct nf_nat_range range[1];
+};
+
+#define nf_nat_multi_range nf_nat_multi_range_compat
+
+#endif