libiptc.h revision 33690a1aec0b6309ff90066ca56285b6e43013f2
1e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#ifndef _LIBIPTC_H 2e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define _LIBIPTC_H 3e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Library which manipulates filtering rules. */ 4e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 55e9eaed23d0cf1cfdd49c88e68beb43e611f0191Jan Engelhardt#include <linux/types.h> 6e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#include <libiptc/ipt_kernel_headers.h> 7e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#include <linux/netfilter_ipv4/ip_tables.h> 8e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 9b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte#ifdef __cplusplus 10b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welteextern "C" { 11b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte#endif 12b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte 13e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#ifndef IPT_MIN_ALIGN 14228e98dd6303af11925235af4cf3c3ec450f3f41Rusty Russell/* ipt_entry has pointers and u_int64_t's in it, so if you align to 15228e98dd6303af11925235af4cf3c3ec450f3f41Rusty Russell it, you'll also align to any crazy matches and targets someone 16228e98dd6303af11925235af4cf3c3ec450f3f41Rusty Russell might write */ 17228e98dd6303af11925235af4cf3c3ec450f3f41Rusty Russell#define IPT_MIN_ALIGN (__alignof__(struct ipt_entry)) 18e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#endif 19228e98dd6303af11925235af4cf3c3ec450f3f41Rusty Russell 20228e98dd6303af11925235af4cf3c3ec450f3f41Rusty Russell#define IPT_ALIGN(s) (((s) + ((IPT_MIN_ALIGN)-1)) & ~((IPT_MIN_ALIGN)-1)) 21e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 22e6869a8f59d779ff4d5a0984c86d80db7078496Marc Bouchertypedef char ipt_chainlabel[32]; 23e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 24e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define IPTC_LABEL_ACCEPT "ACCEPT" 25e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define IPTC_LABEL_DROP "DROP" 26e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define IPTC_LABEL_QUEUE "QUEUE" 27e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define IPTC_LABEL_RETURN "RETURN" 28e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 29e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Transparent handle type. */ 30e6869a8f59d779ff4d5a0984c86d80db7078496Marc Bouchertypedef struct iptc_handle *iptc_handle_t; 31e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 32e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Does this chain exist? */ 33e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_is_chain(const char *chain, const iptc_handle_t handle); 34e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 35e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Take a snapshot of the rules. Returns NULL on error. */ 36e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucheriptc_handle_t iptc_init(const char *tablename); 37e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 38841e4aed2349046eb2c0b1375139c06569a93bd0Martin Josefsson/* Cleanup after iptc_init(). */ 39841e4aed2349046eb2c0b1375139c06569a93bd0Martin Josefssonvoid iptc_free(iptc_handle_t *h); 40841e4aed2349046eb2c0b1375139c06569a93bd0Martin Josefsson 41849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russell/* Iterator functions to run through the chains. Returns NULL at end. */ 42849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russellconst char *iptc_first_chain(iptc_handle_t *handle); 43849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russellconst char *iptc_next_chain(iptc_handle_t *handle); 44e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 45849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russell/* Get first rule in the given chain: NULL for empty chain. */ 46849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russellconst struct ipt_entry *iptc_first_rule(const char *chain, 47849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russell iptc_handle_t *handle); 48e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 49849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russell/* Returns NULL when rules run out. */ 50849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russellconst struct ipt_entry *iptc_next_rule(const struct ipt_entry *prev, 51849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russell iptc_handle_t *handle); 52e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 53849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russell/* Returns a pointer to the target name of this entry. */ 54849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russellconst char *iptc_get_target(const struct ipt_entry *e, 55e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iptc_handle_t *handle); 56e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 57e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Is this a built-in chain? */ 58e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_builtin(const char *chain, const iptc_handle_t handle); 59e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 60e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Get the policy of a given built-in chain */ 61e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherconst char *iptc_get_policy(const char *chain, 62e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher struct ipt_counters *counter, 63e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iptc_handle_t *handle); 64e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 65e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* These functions return TRUE for OK or 0 and set errno. If errno == 66e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 0, it means there was a version error (ie. upgrade libiptc). */ 67e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Rule numbers start at 1 for the first rule. */ 68e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 69e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Insert the entry `e' in chain `chain' into position `rulenum'. */ 70e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_insert_entry(const ipt_chainlabel chain, 71e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const struct ipt_entry *e, 72e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int rulenum, 73e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iptc_handle_t *handle); 74e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 75e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Atomically replace rule `rulenum' in `chain' with `e'. */ 76e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_replace_entry(const ipt_chainlabel chain, 77e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const struct ipt_entry *e, 78e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int rulenum, 79e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iptc_handle_t *handle); 80e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 81e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Append entry `e' to chain `chain'. Equivalent to insert with 82e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher rulenum = length of chain. */ 83e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_append_entry(const ipt_chainlabel chain, 84e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const struct ipt_entry *e, 85e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iptc_handle_t *handle); 86e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 87edf14cf4b5edb148d7473f067d95e7bd1316900bRusty Russell/* Delete the first rule in `chain' which matches `e', subject to 88edf14cf4b5edb148d7473f067d95e7bd1316900bRusty Russell matchmask (array of length == origfw) */ 89e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_delete_entry(const ipt_chainlabel chain, 90e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const struct ipt_entry *origfw, 91edf14cf4b5edb148d7473f067d95e7bd1316900bRusty Russell unsigned char *matchmask, 92e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iptc_handle_t *handle); 93e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 94e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Delete the rule in position `rulenum' in `chain'. */ 95e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_delete_num_entry(const ipt_chainlabel chain, 96e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int rulenum, 97e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iptc_handle_t *handle); 98e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 99e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Check the packet `e' on chain `chain'. Returns the verdict, or 100e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher NULL and sets errno. */ 101e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherconst char *iptc_check_packet(const ipt_chainlabel chain, 102e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher struct ipt_entry *entry, 103e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iptc_handle_t *handle); 104e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 105e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Flushes the entries in the given chain (ie. empties chain). */ 106e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_flush_entries(const ipt_chainlabel chain, 107e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iptc_handle_t *handle); 108e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 109e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Zeroes the counters in a chain. */ 110e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_zero_entries(const ipt_chainlabel chain, 111e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iptc_handle_t *handle); 112e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 113e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Creates a new chain. */ 114e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_create_chain(const ipt_chainlabel chain, 115e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iptc_handle_t *handle); 116e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 117e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Deletes a chain. */ 118e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_delete_chain(const ipt_chainlabel chain, 119e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iptc_handle_t *handle); 120e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 121e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Renames a chain. */ 122e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_rename_chain(const ipt_chainlabel oldname, 123e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const ipt_chainlabel newname, 124e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iptc_handle_t *handle); 125e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 126e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Sets the policy on a built-in chain. */ 127e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_set_policy(const ipt_chainlabel chain, 128e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const ipt_chainlabel policy, 1290fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte struct ipt_counters *counters, 130e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iptc_handle_t *handle); 131e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 132e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Get the number of references to this chain */ 133e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_get_references(unsigned int *ref, 134e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const ipt_chainlabel chain, 135e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iptc_handle_t *handle); 136e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1370fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte/* read packet and byte counters for a specific rule */ 1380fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Weltestruct ipt_counters *iptc_read_counter(const ipt_chainlabel chain, 1390fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte unsigned int rulenum, 1400fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte iptc_handle_t *handle); 1410fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte 1420fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte/* zero packet and byte counters for a specific rule */ 1430fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welteint iptc_zero_counter(const ipt_chainlabel chain, 1440fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte unsigned int rulenum, 1450fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte iptc_handle_t *handle); 1460fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte 1470fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte/* set packet and byte counters for a specific rule */ 1480fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welteint iptc_set_counter(const ipt_chainlabel chain, 1490fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte unsigned int rulenum, 1500fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte struct ipt_counters *counters, 1510fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte iptc_handle_t *handle); 1520fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte 153e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Makes the actual changes. */ 154e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_commit(iptc_handle_t *handle); 155e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 156e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Get raw socket. */ 1579ee386a1b6d7704b259460152c959ab0e79e02aaMax Kellermannint iptc_get_raw_socket(void); 158e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 159e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Translates errno numbers into more human-readable form than strerror. */ 160e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherconst char *iptc_strerror(int err); 161b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte 16233690a1aec0b6309ff90066ca56285b6e43013f2Jan Engelhardtextern void dump_entries(const iptc_handle_t); 16333690a1aec0b6309ff90066ca56285b6e43013f2Jan Engelhardt 164b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte#ifdef __cplusplus 165b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte} 166b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte#endif 167b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte 168b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte 169e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#endif /* _LIBIPTC_H */ 170