libiptc.h revision 4e41854423b529d3107c23b85434d50a75d08057
1e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#ifndef _LIBIPTC_H 2e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define _LIBIPTC_H 3e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Library which manipulates filtering rules. */ 4e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 55e9eaed23d0cf1cfdd49c88e68beb43e611f0191Jan Engelhardt#include <linux/types.h> 6e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#include <libiptc/ipt_kernel_headers.h> 74e41854423b529d3107c23b85434d50a75d08057Jan Engelhardt#ifdef __cplusplus 84e41854423b529d3107c23b85434d50a75d08057Jan Engelhardt# include <climits> 94e41854423b529d3107c23b85434d50a75d08057Jan Engelhardt#else 104e41854423b529d3107c23b85434d50a75d08057Jan Engelhardt# include <limits.h> /* INT_MAX in ip_tables.h */ 114e41854423b529d3107c23b85434d50a75d08057Jan Engelhardt#endif 12e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#include <linux/netfilter_ipv4/ip_tables.h> 13e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 14b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte#ifdef __cplusplus 15b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welteextern "C" { 16b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte#endif 17b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte 18e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#ifndef IPT_MIN_ALIGN 19228e98dd6303af11925235af4cf3c3ec450f3f41Rusty Russell/* ipt_entry has pointers and u_int64_t's in it, so if you align to 20228e98dd6303af11925235af4cf3c3ec450f3f41Rusty Russell it, you'll also align to any crazy matches and targets someone 21228e98dd6303af11925235af4cf3c3ec450f3f41Rusty Russell might write */ 22228e98dd6303af11925235af4cf3c3ec450f3f41Rusty Russell#define IPT_MIN_ALIGN (__alignof__(struct ipt_entry)) 23e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#endif 24228e98dd6303af11925235af4cf3c3ec450f3f41Rusty Russell 25228e98dd6303af11925235af4cf3c3ec450f3f41Rusty Russell#define IPT_ALIGN(s) (((s) + ((IPT_MIN_ALIGN)-1)) & ~((IPT_MIN_ALIGN)-1)) 26e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 27fd1873110f8e57be578df17fc9d03536b10f4f73Jan Engelhardtstruct iptc_handle; 28fd1873110f8e57be578df17fc9d03536b10f4f73Jan Engelhardt 29e6869a8f59d779ff4d5a0984c86d80db7078496Marc Bouchertypedef char ipt_chainlabel[32]; 30e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 31e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define IPTC_LABEL_ACCEPT "ACCEPT" 32e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define IPTC_LABEL_DROP "DROP" 33e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define IPTC_LABEL_QUEUE "QUEUE" 34e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define IPTC_LABEL_RETURN "RETURN" 35e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 36e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Does this chain exist? */ 37fd1873110f8e57be578df17fc9d03536b10f4f73Jan Engelhardtint iptc_is_chain(const char *chain, struct iptc_handle *const handle); 38e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 39e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Take a snapshot of the rules. Returns NULL on error. */ 40fd1873110f8e57be578df17fc9d03536b10f4f73Jan Engelhardtstruct iptc_handle *iptc_init(const char *tablename); 41e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 42841e4aed2349046eb2c0b1375139c06569a93bd0Martin Josefsson/* Cleanup after iptc_init(). */ 431c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardtvoid iptc_free(struct iptc_handle *h); 44841e4aed2349046eb2c0b1375139c06569a93bd0Martin Josefsson 45849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russell/* Iterator functions to run through the chains. Returns NULL at end. */ 461c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardtconst char *iptc_first_chain(struct iptc_handle *handle); 471c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardtconst char *iptc_next_chain(struct iptc_handle *handle); 48e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 49849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russell/* Get first rule in the given chain: NULL for empty chain. */ 50849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russellconst struct ipt_entry *iptc_first_rule(const char *chain, 511c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 52e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 53849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russell/* Returns NULL when rules run out. */ 54849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russellconst struct ipt_entry *iptc_next_rule(const struct ipt_entry *prev, 551c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 56e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 57849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russell/* Returns a pointer to the target name of this entry. */ 58849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russellconst char *iptc_get_target(const struct ipt_entry *e, 591c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 60e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 61e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Is this a built-in chain? */ 62fd1873110f8e57be578df17fc9d03536b10f4f73Jan Engelhardtint iptc_builtin(const char *chain, struct iptc_handle *const handle); 63e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 64e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Get the policy of a given built-in chain */ 65e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherconst char *iptc_get_policy(const char *chain, 66e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher struct ipt_counters *counter, 671c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 68e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 69e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* These functions return TRUE for OK or 0 and set errno. If errno == 70e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 0, it means there was a version error (ie. upgrade libiptc). */ 71e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Rule numbers start at 1 for the first rule. */ 72e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 73e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Insert the entry `e' in chain `chain' into position `rulenum'. */ 74e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_insert_entry(const ipt_chainlabel chain, 75e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const struct ipt_entry *e, 76e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int rulenum, 771c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 78e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 79e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Atomically replace rule `rulenum' in `chain' with `e'. */ 80e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_replace_entry(const ipt_chainlabel chain, 81e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const struct ipt_entry *e, 82e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int rulenum, 831c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 84e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 85e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Append entry `e' to chain `chain'. Equivalent to insert with 86e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher rulenum = length of chain. */ 87e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_append_entry(const ipt_chainlabel chain, 88e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const struct ipt_entry *e, 891c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 90e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 91edf14cf4b5edb148d7473f067d95e7bd1316900bRusty Russell/* Delete the first rule in `chain' which matches `e', subject to 92edf14cf4b5edb148d7473f067d95e7bd1316900bRusty Russell matchmask (array of length == origfw) */ 93e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_delete_entry(const ipt_chainlabel chain, 94e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const struct ipt_entry *origfw, 95edf14cf4b5edb148d7473f067d95e7bd1316900bRusty Russell unsigned char *matchmask, 961c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 97e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 98e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Delete the rule in position `rulenum' in `chain'. */ 99e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_delete_num_entry(const ipt_chainlabel chain, 100e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int rulenum, 1011c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 102e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 103e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Check the packet `e' on chain `chain'. Returns the verdict, or 104e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher NULL and sets errno. */ 105e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherconst char *iptc_check_packet(const ipt_chainlabel chain, 106e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher struct ipt_entry *entry, 1071c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 108e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 109e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Flushes the entries in the given chain (ie. empties chain). */ 110e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_flush_entries(const ipt_chainlabel chain, 1111c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 112e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 113e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Zeroes the counters in a chain. */ 114e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_zero_entries(const ipt_chainlabel chain, 1151c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 116e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 117e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Creates a new chain. */ 118e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_create_chain(const ipt_chainlabel chain, 1191c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 120e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 121e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Deletes a chain. */ 122e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_delete_chain(const ipt_chainlabel chain, 1231c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 124e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 125e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Renames a chain. */ 126e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_rename_chain(const ipt_chainlabel oldname, 127e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const ipt_chainlabel newname, 1281c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 129e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 130e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Sets the policy on a built-in chain. */ 131e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_set_policy(const ipt_chainlabel chain, 132e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const ipt_chainlabel policy, 1330fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte struct ipt_counters *counters, 1341c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 135e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 136e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Get the number of references to this chain */ 137e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_get_references(unsigned int *ref, 138e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const ipt_chainlabel chain, 1391c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 140e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1410fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte/* read packet and byte counters for a specific rule */ 1420fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Weltestruct ipt_counters *iptc_read_counter(const ipt_chainlabel chain, 1430fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte unsigned int rulenum, 1441c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 1450fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte 1460fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte/* zero packet and byte counters for a specific rule */ 1470fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welteint iptc_zero_counter(const ipt_chainlabel chain, 1480fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte unsigned int rulenum, 1491c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 1500fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte 1510fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte/* set packet and byte counters for a specific rule */ 1520fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welteint iptc_set_counter(const ipt_chainlabel chain, 1530fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte unsigned int rulenum, 1540fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte struct ipt_counters *counters, 1551c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle); 1560fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte 157e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Makes the actual changes. */ 1581c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardtint iptc_commit(struct iptc_handle *handle); 159e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 160e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Get raw socket. */ 1619ee386a1b6d7704b259460152c959ab0e79e02aaMax Kellermannint iptc_get_raw_socket(void); 162e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 163e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Translates errno numbers into more human-readable form than strerror. */ 164e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherconst char *iptc_strerror(int err); 165b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte 166fd1873110f8e57be578df17fc9d03536b10f4f73Jan Engelhardtextern void dump_entries(struct iptc_handle *const); 16733690a1aec0b6309ff90066ca56285b6e43013f2Jan Engelhardt 168b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte#ifdef __cplusplus 169b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte} 170b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte#endif 171b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte 172b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte 173e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#endif /* _LIBIPTC_H */ 174