1#ifndef _LIBIP6TC_H 2#define _LIBIP6TC_H 3/* Library which manipulates firewall rules. Version 0.2. */ 4 5#include <linux/types.h> 6#include <libiptc/ipt_kernel_headers.h> 7#ifdef __cplusplus 8# include <climits> 9#else 10# include <limits.h> /* INT_MAX in ip6_tables.h */ 11#endif 12#include <linux/netfilter_ipv6/ip6_tables.h> 13 14struct ip6tc_handle; 15 16typedef char ip6t_chainlabel[32]; 17 18#define IP6TC_LABEL_ACCEPT "ACCEPT" 19#define IP6TC_LABEL_DROP "DROP" 20#define IP6TC_LABEL_QUEUE "QUEUE" 21#define IP6TC_LABEL_RETURN "RETURN" 22 23/* Does this chain exist? */ 24int ip6tc_is_chain(const char *chain, struct ip6tc_handle *const handle); 25 26/* Take a snapshot of the rules. Returns NULL on error. */ 27struct ip6tc_handle *ip6tc_init(const char *tablename); 28 29/* Cleanup after ip6tc_init(). */ 30void ip6tc_free(struct ip6tc_handle *h); 31 32/* Iterator functions to run through the chains. Returns NULL at end. */ 33const char *ip6tc_first_chain(struct ip6tc_handle *handle); 34const char *ip6tc_next_chain(struct ip6tc_handle *handle); 35 36/* Get first rule in the given chain: NULL for empty chain. */ 37const struct ip6t_entry *ip6tc_first_rule(const char *chain, 38 struct ip6tc_handle *handle); 39 40/* Returns NULL when rules run out. */ 41const struct ip6t_entry *ip6tc_next_rule(const struct ip6t_entry *prev, 42 struct ip6tc_handle *handle); 43 44/* Returns a pointer to the target name of this position. */ 45const char *ip6tc_get_target(const struct ip6t_entry *e, 46 struct ip6tc_handle *handle); 47 48/* Is this a built-in chain? */ 49int ip6tc_builtin(const char *chain, struct ip6tc_handle *const handle); 50 51/* Get the policy of a given built-in chain */ 52const char *ip6tc_get_policy(const char *chain, 53 struct ip6t_counters *counters, 54 struct ip6tc_handle *handle); 55 56/* These functions return TRUE for OK or 0 and set errno. If errno == 57 0, it means there was a version error (ie. upgrade libiptc). */ 58/* Rule numbers start at 1 for the first rule. */ 59 60/* Insert the entry `fw' in chain `chain' into position `rulenum'. */ 61int ip6tc_insert_entry(const ip6t_chainlabel chain, 62 const struct ip6t_entry *e, 63 unsigned int rulenum, 64 struct ip6tc_handle *handle); 65 66/* Atomically replace rule `rulenum' in `chain' with `fw'. */ 67int ip6tc_replace_entry(const ip6t_chainlabel chain, 68 const struct ip6t_entry *e, 69 unsigned int rulenum, 70 struct ip6tc_handle *handle); 71 72/* Append entry `fw' to chain `chain'. Equivalent to insert with 73 rulenum = length of chain. */ 74int ip6tc_append_entry(const ip6t_chainlabel chain, 75 const struct ip6t_entry *e, 76 struct ip6tc_handle *handle); 77 78/* Check whether a matching rule exists */ 79int ip6tc_check_entry(const ip6t_chainlabel chain, 80 const struct ip6t_entry *origfw, 81 unsigned char *matchmask, 82 struct ip6tc_handle *handle); 83 84/* Delete the first rule in `chain' which matches `fw'. */ 85int ip6tc_delete_entry(const ip6t_chainlabel chain, 86 const struct ip6t_entry *origfw, 87 unsigned char *matchmask, 88 struct ip6tc_handle *handle); 89 90/* Delete the rule in position `rulenum' in `chain'. */ 91int ip6tc_delete_num_entry(const ip6t_chainlabel chain, 92 unsigned int rulenum, 93 struct ip6tc_handle *handle); 94 95/* Check the packet `fw' on chain `chain'. Returns the verdict, or 96 NULL and sets errno. */ 97const char *ip6tc_check_packet(const ip6t_chainlabel chain, 98 struct ip6t_entry *, 99 struct ip6tc_handle *handle); 100 101/* Flushes the entries in the given chain (ie. empties chain). */ 102int ip6tc_flush_entries(const ip6t_chainlabel chain, 103 struct ip6tc_handle *handle); 104 105/* Zeroes the counters in a chain. */ 106int ip6tc_zero_entries(const ip6t_chainlabel chain, 107 struct ip6tc_handle *handle); 108 109/* Creates a new chain. */ 110int ip6tc_create_chain(const ip6t_chainlabel chain, 111 struct ip6tc_handle *handle); 112 113/* Deletes a chain. */ 114int ip6tc_delete_chain(const ip6t_chainlabel chain, 115 struct ip6tc_handle *handle); 116 117/* Renames a chain. */ 118int ip6tc_rename_chain(const ip6t_chainlabel oldname, 119 const ip6t_chainlabel newname, 120 struct ip6tc_handle *handle); 121 122/* Sets the policy on a built-in chain. */ 123int ip6tc_set_policy(const ip6t_chainlabel chain, 124 const ip6t_chainlabel policy, 125 struct ip6t_counters *counters, 126 struct ip6tc_handle *handle); 127 128/* Get the number of references to this chain */ 129int ip6tc_get_references(unsigned int *ref, const ip6t_chainlabel chain, 130 struct ip6tc_handle *handle); 131 132/* read packet and byte counters for a specific rule */ 133struct ip6t_counters *ip6tc_read_counter(const ip6t_chainlabel chain, 134 unsigned int rulenum, 135 struct ip6tc_handle *handle); 136 137/* zero packet and byte counters for a specific rule */ 138int ip6tc_zero_counter(const ip6t_chainlabel chain, 139 unsigned int rulenum, 140 struct ip6tc_handle *handle); 141 142/* set packet and byte counters for a specific rule */ 143int ip6tc_set_counter(const ip6t_chainlabel chain, 144 unsigned int rulenum, 145 struct ip6t_counters *counters, 146 struct ip6tc_handle *handle); 147 148/* Makes the actual changes. */ 149int ip6tc_commit(struct ip6tc_handle *handle); 150 151/* Get raw socket. */ 152int ip6tc_get_raw_socket(void); 153 154/* Translates errno numbers into more human-readable form than strerror. */ 155const char *ip6tc_strerror(int err); 156 157/* Return prefix length, or -1 if not contiguous */ 158int ipv6_prefix_length(const struct in6_addr *a); 159 160extern void dump_entries6(struct ip6tc_handle *const); 161 162#endif /* _LIBIP6TC_H */ 163