1dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat#ifndef _LIBIP6TC_H 2dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat#define _LIBIP6TC_H 3dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* Library which manipulates firewall rules. Version 0.2. */ 4dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 5dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat#include <libiptc/ipt_kernel_headers.h> 6dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat#include <linux/netfilter_ipv6/ip6_tables.h> 7dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 8dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat#ifndef IP6T_MIN_ALIGN 9dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat#define IP6T_MIN_ALIGN (__alignof__(struct ip6t_entry)) 10dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat#endif 11dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat#define IP6T_ALIGN(s) (((s) + (IP6T_MIN_ALIGN-1)) & ~(IP6T_MIN_ALIGN-1)) 12dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 13dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehattypedef char ip6t_chainlabel[32]; 14dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 15dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat#define IP6TC_LABEL_ACCEPT "ACCEPT" 16dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat#define IP6TC_LABEL_DROP "DROP" 17dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat#define IP6TC_LABEL_QUEUE "QUEUE" 18dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat#define IP6TC_LABEL_RETURN "RETURN" 19dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 20dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* Transparent handle type. */ 21dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehattypedef struct ip6tc_handle *ip6tc_handle_t; 22dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 23dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* Does this chain exist? */ 24dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehatint ip6tc_is_chain(const char *chain, const ip6tc_handle_t handle); 25dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 26dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* Take a snapshot of the rules. Returns NULL on error. */ 27dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehatip6tc_handle_t ip6tc_init(const char *tablename); 28dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 29dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* Cleanup after ip6tc_init(). */ 30dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehatvoid ip6tc_free(ip6tc_handle_t *h); 31dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 32dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* Iterator functions to run through the chains. Returns NULL at end. */ 33dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehatconst char *ip6tc_first_chain(ip6tc_handle_t *handle); 34dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehatconst char *ip6tc_next_chain(ip6tc_handle_t *handle); 35dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 36dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* Get first rule in the given chain: NULL for empty chain. */ 37dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehatconst struct ip6t_entry *ip6tc_first_rule(const char *chain, 38dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat ip6tc_handle_t *handle); 39dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 40dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* Returns NULL when rules run out. */ 41dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehatconst struct ip6t_entry *ip6tc_next_rule(const struct ip6t_entry *prev, 42dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat ip6tc_handle_t *handle); 43dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 44dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* Returns a pointer to the target name of this position. */ 45dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehatconst char *ip6tc_get_target(const struct ip6t_entry *e, 46dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat ip6tc_handle_t *handle); 47dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 48dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* Is this a built-in chain? */ 49dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehatint ip6tc_builtin(const char *chain, const ip6tc_handle_t handle); 50dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 51dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* Get the policy of a given built-in chain */ 52dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehatconst char *ip6tc_get_policy(const char *chain, 53dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat struct ip6t_counters *counters, 54dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat ip6tc_handle_t *handle); 55dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 56dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* These functions return TRUE for OK or 0 and set errno. If errno == 57dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 0, it means there was a version error (ie. upgrade libiptc). */ 58dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* Rule numbers start at 1 for the first rule. */ 59dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 60dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* Insert the entry `fw' in chain `chain' into position `rulenum'. */ 61dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehatint ip6tc_insert_entry(const ip6t_chainlabel chain, 62dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat const struct ip6t_entry *e, 63dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat unsigned int rulenum, 64dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat ip6tc_handle_t *handle); 65dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 66dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* Atomically replace rule `rulenum' in `chain' with `fw'. */ 67dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehatint ip6tc_replace_entry(const ip6t_chainlabel chain, 68dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat const struct ip6t_entry *e, 69dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat unsigned int rulenum, 70dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat ip6tc_handle_t *handle); 71dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 72dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* Append entry `fw' to chain `chain'. Equivalent to insert with 73dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat rulenum = length of chain. */ 74dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehatint ip6tc_append_entry(const ip6t_chainlabel chain, 75dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat const struct ip6t_entry *e, 76dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat ip6tc_handle_t *handle); 77dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 78dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* Delete the first rule in `chain' which matches `fw'. */ 79dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehatint ip6tc_delete_entry(const ip6t_chainlabel chain, 80dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat const struct ip6t_entry *origfw, 81dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat unsigned char *matchmask, 82dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat ip6tc_handle_t *handle); 83dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 84dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* Delete the rule in position `rulenum' in `chain'. */ 85dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehatint ip6tc_delete_num_entry(const ip6t_chainlabel chain, 86dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat unsigned int rulenum, 87dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat ip6tc_handle_t *handle); 88dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 89dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* Check the packet `fw' on chain `chain'. Returns the verdict, or 90dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat NULL and sets errno. */ 91dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehatconst char *ip6tc_check_packet(const ip6t_chainlabel chain, 92dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat struct ip6t_entry *, 93dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat ip6tc_handle_t *handle); 94dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 95dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* Flushes the entries in the given chain (ie. empties chain). */ 96dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehatint ip6tc_flush_entries(const ip6t_chainlabel chain, 97dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat ip6tc_handle_t *handle); 98dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 99dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* Zeroes the counters in a chain. */ 100dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehatint ip6tc_zero_entries(const ip6t_chainlabel chain, 101dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat ip6tc_handle_t *handle); 102dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 103dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* Creates a new chain. */ 104dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehatint ip6tc_create_chain(const ip6t_chainlabel chain, 105dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat ip6tc_handle_t *handle); 106dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 107dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* Deletes a chain. */ 108dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehatint ip6tc_delete_chain(const ip6t_chainlabel chain, 109dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat ip6tc_handle_t *handle); 110dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 111dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* Renames a chain. */ 112dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehatint ip6tc_rename_chain(const ip6t_chainlabel oldname, 113dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat const ip6t_chainlabel newname, 114dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat ip6tc_handle_t *handle); 115dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 116dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* Sets the policy on a built-in chain. */ 117dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehatint ip6tc_set_policy(const ip6t_chainlabel chain, 118dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat const ip6t_chainlabel policy, 119dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat struct ip6t_counters *counters, 120dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat ip6tc_handle_t *handle); 121dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 122dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* Get the number of references to this chain */ 123dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehatint ip6tc_get_references(unsigned int *ref, const ip6t_chainlabel chain, 124dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat ip6tc_handle_t *handle); 125dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 126dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* read packet and byte counters for a specific rule */ 127dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehatstruct ip6t_counters *ip6tc_read_counter(const ip6t_chainlabel chain, 128dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat unsigned int rulenum, 129dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat ip6tc_handle_t *handle); 130dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 131dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* zero packet and byte counters for a specific rule */ 132dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehatint ip6tc_zero_counter(const ip6t_chainlabel chain, 133dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat unsigned int rulenum, 134dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat ip6tc_handle_t *handle); 135dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 136dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* set packet and byte counters for a specific rule */ 137dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehatint ip6tc_set_counter(const ip6t_chainlabel chain, 138dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat unsigned int rulenum, 139dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat struct ip6t_counters *counters, 140dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat ip6tc_handle_t *handle); 141dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 142dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* Makes the actual changes. */ 143dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehatint ip6tc_commit(ip6tc_handle_t *handle); 144dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 145dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* Get raw socket. */ 146dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehatint ip6tc_get_raw_socket(); 147dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 148dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* Translates errno numbers into more human-readable form than strerror. */ 149dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehatconst char *ip6tc_strerror(int err); 150dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 151dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat/* Return prefix length, or -1 if not contiguous */ 152dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehatint ipv6_prefix_length(const struct in6_addr *a); 153dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat 154dcfb7a77f8709125e97c313cb8ab6ec4d87468f4San Mehat#endif /* _LIBIP6TC_H */ 155