iptables.h revision 8cf65913bb6353bf0e92eab0669d1c4c53b43623
1e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#ifndef _IPTABLES_USER_H 2e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define _IPTABLES_USER_H 3e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 479dee0702b18c8ea1d1f7a2b1f6b29349466986bRusty Russell#include "iptables_common.h" 5e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#include "libiptc/libiptc.h" 6e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 7357d59dcfcbd125e2aa8c07b30cea9635efec2a7Martin Josefsson#ifndef IPT_LIB_DIR 8357d59dcfcbd125e2aa8c07b30cea9635efec2a7Martin Josefsson#define IPT_LIB_DIR "/usr/local/lib/iptables" 9357d59dcfcbd125e2aa8c07b30cea9635efec2a7Martin Josefsson#endif 10357d59dcfcbd125e2aa8c07b30cea9635efec2a7Martin Josefsson 11db0422f80d353e7040f18344ca3e74bb0ba10e31Harald Welte#ifndef IPPROTO_SCTP 12db0422f80d353e7040f18344ca3e74bb0ba10e31Harald Welte#define IPPROTO_SCTP 132 13db0422f80d353e7040f18344ca3e74bb0ba10e31Harald Welte#endif 14db0422f80d353e7040f18344ca3e74bb0ba10e31Harald Welte 153aef54dce4f9bbe0b466478fd33a1d3131efbbb8Rusty Russell#ifndef IPT_SO_GET_REVISION_MATCH /* Old kernel source. */ 163aef54dce4f9bbe0b466478fd33a1d3131efbbb8Rusty Russell#define IPT_SO_GET_REVISION_MATCH (IPT_BASE_CTL + 2) 173aef54dce4f9bbe0b466478fd33a1d3131efbbb8Rusty Russell#define IPT_SO_GET_REVISION_TARGET (IPT_BASE_CTL + 3) 183aef54dce4f9bbe0b466478fd33a1d3131efbbb8Rusty Russell 193aef54dce4f9bbe0b466478fd33a1d3131efbbb8Rusty Russellstruct ipt_get_revision 203aef54dce4f9bbe0b466478fd33a1d3131efbbb8Rusty Russell{ 213aef54dce4f9bbe0b466478fd33a1d3131efbbb8Rusty Russell char name[IPT_FUNCTION_MAXNAMELEN-1]; 223aef54dce4f9bbe0b466478fd33a1d3131efbbb8Rusty Russell 233aef54dce4f9bbe0b466478fd33a1d3131efbbb8Rusty Russell u_int8_t revision; 243aef54dce4f9bbe0b466478fd33a1d3131efbbb8Rusty Russell}; 253aef54dce4f9bbe0b466478fd33a1d3131efbbb8Rusty Russell#endif /* IPT_SO_GET_REVISION_MATCH Old kernel source */ 263aef54dce4f9bbe0b466478fd33a1d3131efbbb8Rusty Russell 2778cafdaf474a333fa39efab4aa4c9aed88ab9518Martin Josefssonstruct iptables_rule_match 2878cafdaf474a333fa39efab4aa4c9aed88ab9518Martin Josefsson{ 2978cafdaf474a333fa39efab4aa4c9aed88ab9518Martin Josefsson struct iptables_rule_match *next; 3078cafdaf474a333fa39efab4aa4c9aed88ab9518Martin Josefsson 3178cafdaf474a333fa39efab4aa4c9aed88ab9518Martin Josefsson struct iptables_match *match; 3278cafdaf474a333fa39efab4aa4c9aed88ab9518Martin Josefsson}; 3378cafdaf474a333fa39efab4aa4c9aed88ab9518Martin Josefsson 34e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Include file for additions: new matches and targets. */ 35e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherstruct iptables_match 36e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher{ 37e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher struct iptables_match *next; 38e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 39e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher ipt_chainlabel name; 40e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 413aef54dce4f9bbe0b466478fd33a1d3131efbbb8Rusty Russell /* Revision of match (0 by default). */ 423aef54dce4f9bbe0b466478fd33a1d3131efbbb8Rusty Russell u_int8_t revision; 433aef54dce4f9bbe0b466478fd33a1d3131efbbb8Rusty Russell 44e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const char *version; 45e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 46e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher /* Size of match data. */ 47e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher size_t size; 48e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 49edf14cf4b5edb148d7473f067d95e7bd1316900bRusty Russell /* Size of match data relevent for userspace comparison purposes */ 50edf14cf4b5edb148d7473f067d95e7bd1316900bRusty Russell size_t userspacesize; 51edf14cf4b5edb148d7473f067d95e7bd1316900bRusty Russell 52e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher /* Function which prints out usage message. */ 53e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher void (*help)(void); 54e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 55e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher /* Initialize the match. */ 56e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher void (*init)(struct ipt_entry_match *m, unsigned int *nfcache); 57e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 58e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher /* Function which parses command options; returns true if it 59e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher ate an option */ 60e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher int (*parse)(int c, char **argv, int invert, unsigned int *flags, 61e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const struct ipt_entry *entry, 62e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int *nfcache, 63e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher struct ipt_entry_match **match); 64e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 65e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher /* Final check; exit if not ok. */ 66e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher void (*final_check)(unsigned int flags); 67e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 68e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher /* Prints out the match iff non-NULL: put space at end */ 69e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher void (*print)(const struct ipt_ip *ip, 70e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const struct ipt_entry_match *match, int numeric); 71e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 7279dee0702b18c8ea1d1f7a2b1f6b29349466986bRusty Russell /* Saves the match info in parsable form to stdout. */ 73e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher void (*save)(const struct ipt_ip *ip, 74e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const struct ipt_entry_match *match); 75e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 76e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher /* Pointer to list of extra command-line options */ 77b6db33196870d3ec401a7ca87234dd2bc379c413Jan Echternach const struct option *extra_opts; 78e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 79e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher /* Ignore these men behind the curtain: */ 80e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int option_offset; 81e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher struct ipt_entry_match *m; 82e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int mflags; 833efb6ead2e51fe1eca55bcb2b06afb4dc4b8cb7cHarald Welte#ifdef NO_SHARED_LIBS 843efb6ead2e51fe1eca55bcb2b06afb4dc4b8cb7cHarald Welte unsigned int loaded; /* simulate loading so options are merged properly */ 853efb6ead2e51fe1eca55bcb2b06afb4dc4b8cb7cHarald Welte#endif 86e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher}; 87e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 88e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherstruct iptables_target 89e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher{ 90e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher struct iptables_target *next; 91e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 92e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher ipt_chainlabel name; 93e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 943aef54dce4f9bbe0b466478fd33a1d3131efbbb8Rusty Russell /* Revision of target (0 by default). */ 953aef54dce4f9bbe0b466478fd33a1d3131efbbb8Rusty Russell u_int8_t revision; 963aef54dce4f9bbe0b466478fd33a1d3131efbbb8Rusty Russell 97e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const char *version; 98e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 99e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher /* Size of target data. */ 100e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher size_t size; 101e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 102edf14cf4b5edb148d7473f067d95e7bd1316900bRusty Russell /* Size of target data relevent for userspace comparison purposes */ 103edf14cf4b5edb148d7473f067d95e7bd1316900bRusty Russell size_t userspacesize; 104edf14cf4b5edb148d7473f067d95e7bd1316900bRusty Russell 105e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher /* Function which prints out usage message. */ 106e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher void (*help)(void); 107e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 108e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher /* Initialize the target. */ 109e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher void (*init)(struct ipt_entry_target *t, unsigned int *nfcache); 110e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 111e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher /* Function which parses command options; returns true if it 112e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher ate an option */ 113e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher int (*parse)(int c, char **argv, int invert, unsigned int *flags, 114e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const struct ipt_entry *entry, 115e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher struct ipt_entry_target **target); 116e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 117e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher /* Final check; exit if not ok. */ 118e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher void (*final_check)(unsigned int flags); 119e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 120e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher /* Prints out the target iff non-NULL: put space at end */ 121e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher void (*print)(const struct ipt_ip *ip, 122e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const struct ipt_entry_target *target, int numeric); 123e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 124e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher /* Saves the targinfo in parsable form to stdout. */ 125e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher void (*save)(const struct ipt_ip *ip, 126e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const struct ipt_entry_target *target); 127e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 128e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher /* Pointer to list of extra command-line options */ 129e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher struct option *extra_opts; 130e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 131e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher /* Ignore these men behind the curtain: */ 132e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int option_offset; 133e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher struct ipt_entry_target *t; 134e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int tflags; 135a114e9e8be802ab744d442449b3ec7de03c58621Harald Welte unsigned int used; 1363efb6ead2e51fe1eca55bcb2b06afb4dc4b8cb7cHarald Welte#ifdef NO_SHARED_LIBS 1373efb6ead2e51fe1eca55bcb2b06afb4dc4b8cb7cHarald Welte unsigned int loaded; /* simulate loading so options are merged properly */ 1383efb6ead2e51fe1eca55bcb2b06afb4dc4b8cb7cHarald Welte#endif 139e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher}; 140e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 14163e9063a660809385fd17edb94da044c7c884e02Illes Marciextern int line; 14263e9063a660809385fd17edb94da044c7c884e02Illes Marci 143e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Your shared library should call one of these. */ 144e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherextern void register_match(struct iptables_match *me); 145e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherextern void register_target(struct iptables_target *me); 146e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 14779dee0702b18c8ea1d1f7a2b1f6b29349466986bRusty Russellextern struct in_addr *dotted_to_addr(const char *dotted); 148e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherextern char *addr_to_dotted(const struct in_addr *addrp); 149b93c79862b47f227ac908430a2c9f16b4ecc0631Marc Boucherextern char *addr_to_anyname(const struct in_addr *addr); 150b93c79862b47f227ac908430a2c9f16b4ecc0631Marc Boucherextern char *mask_to_dotted(const struct in_addr *mask); 151b93c79862b47f227ac908430a2c9f16b4ecc0631Marc Boucher 152b93c79862b47f227ac908430a2c9f16b4ecc0631Marc Boucherextern void parse_hostnetworkmask(const char *name, struct in_addr **addrpp, 153b93c79862b47f227ac908430a2c9f16b4ecc0631Marc Boucher struct in_addr *maskp, unsigned int *naddrs); 154b93c79862b47f227ac908430a2c9f16b4ecc0631Marc Boucherextern u_int16_t parse_protocol(const char *s); 1559867e814492275cabfbccd6b30375b0e23eb10cbYasuyuki KOZAKAIextern void parse_interface(const char *arg, char *vianame, unsigned char *mask); 156e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 157e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherextern int do_command(int argc, char *argv[], char **table, 158e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iptc_handle_t *handle); 159e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Keeping track of external matches and targets: linked lists. */ 160e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherextern struct iptables_match *iptables_matches; 161e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherextern struct iptables_target *iptables_targets; 162e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 16379dee0702b18c8ea1d1f7a2b1f6b29349466986bRusty Russellenum ipt_tryload { 16479dee0702b18c8ea1d1f7a2b1f6b29349466986bRusty Russell DONT_LOAD, 16579dee0702b18c8ea1d1f7a2b1f6b29349466986bRusty Russell TRY_LOAD, 16679dee0702b18c8ea1d1f7a2b1f6b29349466986bRusty Russell LOAD_MUST_SUCCEED 16779dee0702b18c8ea1d1f7a2b1f6b29349466986bRusty Russell}; 16879dee0702b18c8ea1d1f7a2b1f6b29349466986bRusty Russell 16979dee0702b18c8ea1d1f7a2b1f6b29349466986bRusty Russellextern struct iptables_target *find_target(const char *name, enum ipt_tryload); 17078cafdaf474a333fa39efab4aa4c9aed88ab9518Martin Josefssonextern struct iptables_match *find_match(const char *name, enum ipt_tryload, struct iptables_rule_match **match); 171a114e9e8be802ab744d442449b3ec7de03c58621Harald Welte 172a114e9e8be802ab744d442449b3ec7de03c58621Harald Welteextern int delete_chain(const ipt_chainlabel chain, int verbose, 173a114e9e8be802ab744d442449b3ec7de03c58621Harald Welte iptc_handle_t *handle); 174a114e9e8be802ab744d442449b3ec7de03c58621Harald Welteextern int flush_entries(const ipt_chainlabel chain, int verbose, 175a114e9e8be802ab744d442449b3ec7de03c58621Harald Welte iptc_handle_t *handle); 176a114e9e8be802ab744d442449b3ec7de03c58621Harald Welteextern int for_each_chain(int (*fn)(const ipt_chainlabel, int, iptc_handle_t *), 177a114e9e8be802ab744d442449b3ec7de03c58621Harald Welte int verbose, int builtinstoo, iptc_handle_t *handle); 1788cf65913bb6353bf0e92eab0669d1c4c53b43623Phil Oester 1798cf65913bb6353bf0e92eab0669d1c4c53b43623Phil Oester/* kernel revision handling */ 1808cf65913bb6353bf0e92eab0669d1c4c53b43623Phil Oesterextern int kernel_version; 1818cf65913bb6353bf0e92eab0669d1c4c53b43623Phil Oesterextern void get_kernel_version(void); 1828cf65913bb6353bf0e92eab0669d1c4c53b43623Phil Oester#define LINUX_VERSION(x,y,z) (0x10000*(x) + 0x100*(y) + z) 1838cf65913bb6353bf0e92eab0669d1c4c53b43623Phil Oester#define LINUX_VERSION_MAJOR(x) (((x)>>16) & 0xFF) 1848cf65913bb6353bf0e92eab0669d1c4c53b43623Phil Oester#define LINUX_VERSION_MINOR(x) (((x)>> 8) & 0xFF) 1858cf65913bb6353bf0e92eab0669d1c4c53b43623Phil Oester#define LINUX_VERSION_PATCH(x) ( (x) & 0xFF) 1868cf65913bb6353bf0e92eab0669d1c4c53b43623Phil Oester 187e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#endif /*_IPTABLES_USER_H*/ 188