1#ifndef _LIBIP6TC_H 2#define _LIBIP6TC_H 3/* Library which manipulates firewall rules. Version 0.2. */ 4 5#include <libiptc/ipt_kernel_headers.h> 6#include <linux/netfilter_ipv6/ip6_tables.h> 7 8#ifndef IP6T_MIN_ALIGN 9#define IP6T_MIN_ALIGN (__alignof__(struct ip6t_entry)) 10#endif 11#define IP6T_ALIGN(s) (((s) + (IP6T_MIN_ALIGN-1)) & ~(IP6T_MIN_ALIGN-1)) 12 13typedef char ip6t_chainlabel[32]; 14 15#define IP6TC_LABEL_ACCEPT "ACCEPT" 16#define IP6TC_LABEL_DROP "DROP" 17#define IP6TC_LABEL_QUEUE "QUEUE" 18#define IP6TC_LABEL_RETURN "RETURN" 19 20/* Transparent handle type. */ 21typedef struct ip6tc_handle *ip6tc_handle_t; 22 23/* Does this chain exist? */ 24int ip6tc_is_chain(const char *chain, const ip6tc_handle_t handle); 25 26/* Take a snapshot of the rules. Returns NULL on error. */ 27ip6tc_handle_t ip6tc_init(const char *tablename); 28 29/* Cleanup after ip6tc_init(). */ 30void ip6tc_free(ip6tc_handle_t *h); 31 32/* Iterator functions to run through the chains. Returns NULL at end. */ 33const char *ip6tc_first_chain(ip6tc_handle_t *handle); 34const char *ip6tc_next_chain(ip6tc_handle_t *handle); 35 36/* Get first rule in the given chain: NULL for empty chain. */ 37const struct ip6t_entry *ip6tc_first_rule(const char *chain, 38 ip6tc_handle_t *handle); 39 40/* Returns NULL when rules run out. */ 41const struct ip6t_entry *ip6tc_next_rule(const struct ip6t_entry *prev, 42 ip6tc_handle_t *handle); 43 44/* Returns a pointer to the target name of this position. */ 45const char *ip6tc_get_target(const struct ip6t_entry *e, 46 ip6tc_handle_t *handle); 47 48/* Is this a built-in chain? */ 49int ip6tc_builtin(const char *chain, const ip6tc_handle_t handle); 50 51/* Get the policy of a given built-in chain */ 52const char *ip6tc_get_policy(const char *chain, 53 struct ip6t_counters *counters, 54 ip6tc_handle_t *handle); 55 56/* These functions return TRUE for OK or 0 and set errno. If errno == 57 0, it means there was a version error (ie. upgrade libiptc). */ 58/* Rule numbers start at 1 for the first rule. */ 59 60/* Insert the entry `fw' in chain `chain' into position `rulenum'. */ 61int ip6tc_insert_entry(const ip6t_chainlabel chain, 62 const struct ip6t_entry *e, 63 unsigned int rulenum, 64 ip6tc_handle_t *handle); 65 66/* Atomically replace rule `rulenum' in `chain' with `fw'. */ 67int ip6tc_replace_entry(const ip6t_chainlabel chain, 68 const struct ip6t_entry *e, 69 unsigned int rulenum, 70 ip6tc_handle_t *handle); 71 72/* Append entry `fw' to chain `chain'. Equivalent to insert with 73 rulenum = length of chain. */ 74int ip6tc_append_entry(const ip6t_chainlabel chain, 75 const struct ip6t_entry *e, 76 ip6tc_handle_t *handle); 77 78/* Delete the first rule in `chain' which matches `fw'. */ 79int ip6tc_delete_entry(const ip6t_chainlabel chain, 80 const struct ip6t_entry *origfw, 81 unsigned char *matchmask, 82 ip6tc_handle_t *handle); 83 84/* Delete the rule in position `rulenum' in `chain'. */ 85int ip6tc_delete_num_entry(const ip6t_chainlabel chain, 86 unsigned int rulenum, 87 ip6tc_handle_t *handle); 88 89/* Check the packet `fw' on chain `chain'. Returns the verdict, or 90 NULL and sets errno. */ 91const char *ip6tc_check_packet(const ip6t_chainlabel chain, 92 struct ip6t_entry *, 93 ip6tc_handle_t *handle); 94 95/* Flushes the entries in the given chain (ie. empties chain). */ 96int ip6tc_flush_entries(const ip6t_chainlabel chain, 97 ip6tc_handle_t *handle); 98 99/* Zeroes the counters in a chain. */ 100int ip6tc_zero_entries(const ip6t_chainlabel chain, 101 ip6tc_handle_t *handle); 102 103/* Creates a new chain. */ 104int ip6tc_create_chain(const ip6t_chainlabel chain, 105 ip6tc_handle_t *handle); 106 107/* Deletes a chain. */ 108int ip6tc_delete_chain(const ip6t_chainlabel chain, 109 ip6tc_handle_t *handle); 110 111/* Renames a chain. */ 112int ip6tc_rename_chain(const ip6t_chainlabel oldname, 113 const ip6t_chainlabel newname, 114 ip6tc_handle_t *handle); 115 116/* Sets the policy on a built-in chain. */ 117int ip6tc_set_policy(const ip6t_chainlabel chain, 118 const ip6t_chainlabel policy, 119 struct ip6t_counters *counters, 120 ip6tc_handle_t *handle); 121 122/* Get the number of references to this chain */ 123int ip6tc_get_references(unsigned int *ref, const ip6t_chainlabel chain, 124 ip6tc_handle_t *handle); 125 126/* read packet and byte counters for a specific rule */ 127struct ip6t_counters *ip6tc_read_counter(const ip6t_chainlabel chain, 128 unsigned int rulenum, 129 ip6tc_handle_t *handle); 130 131/* zero packet and byte counters for a specific rule */ 132int ip6tc_zero_counter(const ip6t_chainlabel chain, 133 unsigned int rulenum, 134 ip6tc_handle_t *handle); 135 136/* set packet and byte counters for a specific rule */ 137int ip6tc_set_counter(const ip6t_chainlabel chain, 138 unsigned int rulenum, 139 struct ip6t_counters *counters, 140 ip6tc_handle_t *handle); 141 142/* Makes the actual changes. */ 143int ip6tc_commit(ip6tc_handle_t *handle); 144 145/* Get raw socket. */ 146int ip6tc_get_raw_socket(); 147 148/* Translates errno numbers into more human-readable form than strerror. */ 149const char *ip6tc_strerror(int err); 150 151/* Return prefix length, or -1 if not contiguous */ 152int ipv6_prefix_length(const struct in6_addr *a); 153 154#endif /* _LIBIP6TC_H */ 155