1e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#ifndef _LIBIPTC_H 2e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define _LIBIPTC_H 3e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Library which manipulates filtering rules. */ 4e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 55e9eaed23d0cf1cfdd49c88e68beb43e611f0191Jan Engelhardt#include <linux/types.h> 6e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#include <libiptc/ipt_kernel_headers.h> 74e41854423b529d3107c23b85434d50a75d08057Jan Engelhardt#ifdef __cplusplus 84e41854423b529d3107c23b85434d50a75d08057Jan Engelhardt# include <climits> 94e41854423b529d3107c23b85434d50a75d08057Jan Engelhardt#else 104e41854423b529d3107c23b85434d50a75d08057Jan Engelhardt# include <limits.h> /* INT_MAX in ip_tables.h */ 114e41854423b529d3107c23b85434d50a75d08057Jan Engelhardt#endif 12e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#include <linux/netfilter_ipv4/ip_tables.h> 13e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 14b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte#ifdef __cplusplus 15b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welteextern "C" { 16b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte#endif 17b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte 18fd1873110f8e57be578df17fc9d03536b10f4f73Jan Engelhardtstruct iptc_handle; 19fd1873110f8e57be578df17fc9d03536b10f4f73Jan Engelhardt 20e6869a8f59d779ff4d5a0984c86d80db7078496Marc Bouchertypedef char ipt_chainlabel[32]; 21e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 22e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define IPTC_LABEL_ACCEPT "ACCEPT" 23e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define IPTC_LABEL_DROP "DROP" 24e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define IPTC_LABEL_QUEUE "QUEUE" 25e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define IPTC_LABEL_RETURN "RETURN" 26e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 27e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Does this chain exist? */ 28fd1873110f8e57be578df17fc9d03536b10f4f73Jan Engelhardtint iptc_is_chain(const char *chain, struct iptc_handle *const handle); 29e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 30e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Take a snapshot of the rules. Returns NULL on error. */ 31fd1873110f8e57be578df17fc9d03536b10f4f73Jan Engelhardtstruct iptc_handle *iptc_init(const char *tablename); 32e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 33841e4aed2349046eb2c0b1375139c06569a93bd0Martin Josefsson/* Cleanup after iptc_init(). */ 341c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardtvoid iptc_free(struct iptc_handle *h); 35841e4aed2349046eb2c0b1375139c06569a93bd0Martin Josefsson 36849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russell/* Iterator functions to run through the chains. Returns NULL at end. */ 371c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardtconst char *iptc_first_chain(struct iptc_handle *handle); 381c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardtconst char *iptc_next_chain(struct iptc_handle *handle); 39e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 40849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russell/* Get first rule in the given chain: NULL for empty chain. */ 41849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russellconst struct ipt_entry *iptc_first_rule(const char *chain, 421c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 43e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 44849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russell/* Returns NULL when rules run out. */ 45849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russellconst struct ipt_entry *iptc_next_rule(const struct ipt_entry *prev, 461c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 47e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 48849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russell/* Returns a pointer to the target name of this entry. */ 49849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russellconst char *iptc_get_target(const struct ipt_entry *e, 501c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 51e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 52e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Is this a built-in chain? */ 53fd1873110f8e57be578df17fc9d03536b10f4f73Jan Engelhardtint iptc_builtin(const char *chain, struct iptc_handle *const handle); 54e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 55e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Get the policy of a given built-in chain */ 56e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherconst char *iptc_get_policy(const char *chain, 57e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher struct ipt_counters *counter, 581c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 59e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 60e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* These functions return TRUE for OK or 0 and set errno. If errno == 61e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 0, it means there was a version error (ie. upgrade libiptc). */ 62e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Rule numbers start at 1 for the first rule. */ 63e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 64e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Insert the entry `e' in chain `chain' into position `rulenum'. */ 65e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_insert_entry(const ipt_chainlabel chain, 66e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const struct ipt_entry *e, 67e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int rulenum, 681c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 69e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 70e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Atomically replace rule `rulenum' in `chain' with `e'. */ 71e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_replace_entry(const ipt_chainlabel chain, 72e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const struct ipt_entry *e, 73e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int rulenum, 741c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 75e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 76e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Append entry `e' to chain `chain'. Equivalent to insert with 77e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher rulenum = length of chain. */ 78e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_append_entry(const ipt_chainlabel chain, 79e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const struct ipt_entry *e, 801c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 81e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 82d59b9db031abee37a9aa9776662dd15370faabf4Stefan Tomanek/* Check whether a mathching rule exists */ 83d59b9db031abee37a9aa9776662dd15370faabf4Stefan Tomanekint iptc_check_entry(const ipt_chainlabel chain, 84d59b9db031abee37a9aa9776662dd15370faabf4Stefan Tomanek const struct ipt_entry *origfw, 85d59b9db031abee37a9aa9776662dd15370faabf4Stefan Tomanek unsigned char *matchmask, 86d59b9db031abee37a9aa9776662dd15370faabf4Stefan Tomanek struct iptc_handle *handle); 87d59b9db031abee37a9aa9776662dd15370faabf4Stefan Tomanek 88edf14cf4b5edb148d7473f067d95e7bd1316900bRusty Russell/* Delete the first rule in `chain' which matches `e', subject to 89edf14cf4b5edb148d7473f067d95e7bd1316900bRusty Russell matchmask (array of length == origfw) */ 90e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_delete_entry(const ipt_chainlabel chain, 91e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const struct ipt_entry *origfw, 92edf14cf4b5edb148d7473f067d95e7bd1316900bRusty Russell unsigned char *matchmask, 931c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 94e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 95e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Delete the rule in position `rulenum' in `chain'. */ 96e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_delete_num_entry(const ipt_chainlabel chain, 97e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int rulenum, 981c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 99e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 100e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Check the packet `e' on chain `chain'. Returns the verdict, or 101e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher NULL and sets errno. */ 102e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherconst char *iptc_check_packet(const ipt_chainlabel chain, 103e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher struct ipt_entry *entry, 1041c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 105e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 106e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Flushes the entries in the given chain (ie. empties chain). */ 107e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_flush_entries(const ipt_chainlabel chain, 1081c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 109e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 110e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Zeroes the counters in a chain. */ 111e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_zero_entries(const ipt_chainlabel chain, 1121c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 113e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 114e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Creates a new chain. */ 115e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_create_chain(const ipt_chainlabel chain, 1161c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 117e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 118e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Deletes a chain. */ 119e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_delete_chain(const ipt_chainlabel chain, 1201c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 121e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 122e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Renames a chain. */ 123e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_rename_chain(const ipt_chainlabel oldname, 124e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const ipt_chainlabel newname, 1251c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 126e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 127e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Sets the policy on a built-in chain. */ 128e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_set_policy(const ipt_chainlabel chain, 129e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const ipt_chainlabel policy, 1300fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte struct ipt_counters *counters, 1311c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 132e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 133e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Get the number of references to this chain */ 134e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_get_references(unsigned int *ref, 135e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const ipt_chainlabel chain, 1361c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 137e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1380fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte/* read packet and byte counters for a specific rule */ 1390fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Weltestruct ipt_counters *iptc_read_counter(const ipt_chainlabel chain, 1400fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte unsigned int rulenum, 1411c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 1420fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte 1430fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte/* zero packet and byte counters for a specific rule */ 1440fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welteint iptc_zero_counter(const ipt_chainlabel chain, 1450fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte unsigned int rulenum, 1461c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 1470fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte 1480fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte/* set packet and byte counters for a specific rule */ 1490fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welteint iptc_set_counter(const ipt_chainlabel chain, 1500fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte unsigned int rulenum, 1510fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte struct ipt_counters *counters, 1521c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 1530fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte 154e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Makes the actual changes. */ 1551c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardtint iptc_commit(struct iptc_handle *handle); 156e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 157e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Get raw socket. */ 1589ee386a1b6d7704b259460152c959ab0e79e02aaMax Kellermannint iptc_get_raw_socket(void); 159e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 160e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Translates errno numbers into more human-readable form than strerror. */ 161e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherconst char *iptc_strerror(int err); 162b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte 163fd1873110f8e57be578df17fc9d03536b10f4f73Jan Engelhardtextern void dump_entries(struct iptc_handle *const); 16433690a1aec0b6309ff90066ca56285b6e43013f2Jan Engelhardt 165b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte#ifdef __cplusplus 166b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte} 167b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte#endif 168b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte 169b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte 170e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#endif /* _LIBIPTC_H */ 171