libiptc.h revision b5166476721dd0b663f52bd220ef008ca269c0dc
1e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#ifndef _LIBIPTC_H 2e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define _LIBIPTC_H 3e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Library which manipulates filtering rules. */ 4e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 5e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#include <libiptc/ipt_kernel_headers.h> 6e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#include <linux/netfilter_ipv4/ip_tables.h> 7e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 8b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte#ifdef __cplusplus 9b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welteextern "C" { 10b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte#endif 11b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte 12e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#ifndef IPT_MIN_ALIGN 13228e98dd6303af11925235af4cf3c3ec450f3f41Rusty Russell/* ipt_entry has pointers and u_int64_t's in it, so if you align to 14228e98dd6303af11925235af4cf3c3ec450f3f41Rusty Russell it, you'll also align to any crazy matches and targets someone 15228e98dd6303af11925235af4cf3c3ec450f3f41Rusty Russell might write */ 16228e98dd6303af11925235af4cf3c3ec450f3f41Rusty Russell#define IPT_MIN_ALIGN (__alignof__(struct ipt_entry)) 17e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#endif 18228e98dd6303af11925235af4cf3c3ec450f3f41Rusty Russell 19228e98dd6303af11925235af4cf3c3ec450f3f41Rusty Russell#define IPT_ALIGN(s) (((s) + ((IPT_MIN_ALIGN)-1)) & ~((IPT_MIN_ALIGN)-1)) 20e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 21e6869a8f59d779ff4d5a0984c86d80db7078496Marc Bouchertypedef char ipt_chainlabel[32]; 22e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 23e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define IPTC_LABEL_ACCEPT "ACCEPT" 24e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define IPTC_LABEL_DROP "DROP" 25e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define IPTC_LABEL_QUEUE "QUEUE" 26e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define IPTC_LABEL_RETURN "RETURN" 27e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 28e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Transparent handle type. */ 29e6869a8f59d779ff4d5a0984c86d80db7078496Marc Bouchertypedef struct iptc_handle *iptc_handle_t; 30e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 31e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Does this chain exist? */ 32e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_is_chain(const char *chain, const iptc_handle_t handle); 33e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 34e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Take a snapshot of the rules. Returns NULL on error. */ 35e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucheriptc_handle_t iptc_init(const char *tablename); 36e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 37849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russell/* Iterator functions to run through the chains. Returns NULL at end. */ 38849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russellconst char *iptc_first_chain(iptc_handle_t *handle); 39849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russellconst char *iptc_next_chain(iptc_handle_t *handle); 40e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 41849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russell/* Get first rule in the given chain: NULL for empty chain. */ 42849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russellconst struct ipt_entry *iptc_first_rule(const char *chain, 43849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russell iptc_handle_t *handle); 44e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 45849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russell/* Returns NULL when rules run out. */ 46849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russellconst struct ipt_entry *iptc_next_rule(const struct ipt_entry *prev, 47849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russell iptc_handle_t *handle); 48e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 49849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russell/* Returns a pointer to the target name of this entry. */ 50849779c4adf8dd65c83fffb65e6b7898df2a55c6Rusty Russellconst char *iptc_get_target(const struct ipt_entry *e, 51e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iptc_handle_t *handle); 52e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 53e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Is this a built-in chain? */ 54e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_builtin(const char *chain, const iptc_handle_t handle); 55e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 56e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Get the policy of a given built-in chain */ 57e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherconst char *iptc_get_policy(const char *chain, 58e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher struct ipt_counters *counter, 59e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iptc_handle_t *handle); 60e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 61e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* These functions return TRUE for OK or 0 and set errno. If errno == 62e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 0, it means there was a version error (ie. upgrade libiptc). */ 63e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Rule numbers start at 1 for the first rule. */ 64e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 65e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Insert the entry `e' in chain `chain' into position `rulenum'. */ 66e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_insert_entry(const ipt_chainlabel chain, 67e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const struct ipt_entry *e, 68e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int rulenum, 69e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iptc_handle_t *handle); 70e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 71e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Atomically replace rule `rulenum' in `chain' with `e'. */ 72e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_replace_entry(const ipt_chainlabel chain, 73e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const struct ipt_entry *e, 74e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int rulenum, 75e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iptc_handle_t *handle); 76e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 77e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Append entry `e' to chain `chain'. Equivalent to insert with 78e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher rulenum = length of chain. */ 79e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_append_entry(const ipt_chainlabel chain, 80e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const struct ipt_entry *e, 81e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iptc_handle_t *handle); 82e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 83edf14cf4b5edb148d7473f067d95e7bd1316900bRusty Russell/* Delete the first rule in `chain' which matches `e', subject to 84edf14cf4b5edb148d7473f067d95e7bd1316900bRusty Russell matchmask (array of length == origfw) */ 85e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_delete_entry(const ipt_chainlabel chain, 86e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const struct ipt_entry *origfw, 87edf14cf4b5edb148d7473f067d95e7bd1316900bRusty Russell unsigned char *matchmask, 88e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iptc_handle_t *handle); 89e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 90e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Delete the rule in position `rulenum' in `chain'. */ 91e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_delete_num_entry(const ipt_chainlabel chain, 92e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int rulenum, 93e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iptc_handle_t *handle); 94e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 95e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Check the packet `e' on chain `chain'. Returns the verdict, or 96e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher NULL and sets errno. */ 97e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherconst char *iptc_check_packet(const ipt_chainlabel chain, 98e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher struct ipt_entry *entry, 99e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iptc_handle_t *handle); 100e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 101e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Flushes the entries in the given chain (ie. empties chain). */ 102e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_flush_entries(const ipt_chainlabel chain, 103e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iptc_handle_t *handle); 104e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 105e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Zeroes the counters in a chain. */ 106e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_zero_entries(const ipt_chainlabel chain, 107e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iptc_handle_t *handle); 108e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 109e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Creates a new chain. */ 110e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_create_chain(const ipt_chainlabel chain, 111e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iptc_handle_t *handle); 112e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 113e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Deletes a chain. */ 114e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_delete_chain(const ipt_chainlabel chain, 115e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iptc_handle_t *handle); 116e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 117e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Renames a chain. */ 118e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_rename_chain(const ipt_chainlabel oldname, 119e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const ipt_chainlabel newname, 120e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iptc_handle_t *handle); 121e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 122e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Sets the policy on a built-in chain. */ 123e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_set_policy(const ipt_chainlabel chain, 124e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const ipt_chainlabel policy, 1250fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte struct ipt_counters *counters, 126e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iptc_handle_t *handle); 127e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 128e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Get the number of references to this chain */ 129e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_get_references(unsigned int *ref, 130e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const ipt_chainlabel chain, 131e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iptc_handle_t *handle); 132e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1330fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte/* read packet and byte counters for a specific rule */ 1340fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Weltestruct ipt_counters *iptc_read_counter(const ipt_chainlabel chain, 1350fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte unsigned int rulenum, 1360fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte iptc_handle_t *handle); 1370fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte 1380fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte/* zero packet and byte counters for a specific rule */ 1390fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welteint iptc_zero_counter(const ipt_chainlabel chain, 1400fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte unsigned int rulenum, 1410fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte iptc_handle_t *handle); 1420fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte 1430fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte/* set packet and byte counters for a specific rule */ 1440fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welteint iptc_set_counter(const ipt_chainlabel chain, 1450fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte unsigned int rulenum, 1460fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte struct ipt_counters *counters, 1470fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte iptc_handle_t *handle); 1480fbf055c9e320a89dd8a5ad0edbeae3d8c1de4afHarald Welte 149e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Makes the actual changes. */ 150e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_commit(iptc_handle_t *handle); 151e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 152e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Get raw socket. */ 153e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherint iptc_get_raw_socket(); 154e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 155e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Translates errno numbers into more human-readable form than strerror. */ 156e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherconst char *iptc_strerror(int err); 157b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte 158b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte#ifdef __cplusplus 159b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte} 160b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte#endif 161b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte 162b5166476721dd0b663f52bd220ef008ca269c0dcHarald Welte 163e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#endif /* _LIBIPTC_H */ 164