1 #ifndef _XTABLES_H 2 #define _XTABLES_H 3 4 /* 5 * Changing any structs/functions may incur a needed change 6 * in libxtables_vcurrent/vage too. 7 */ 8 9 #include <sys/socket.h> /* PF_* */ 10 #include <sys/types.h> 11 #include <limits.h> 12 #include <stdbool.h> 13 #include <stddef.h> 14 #include <stdint.h> 15 #include <netinet/in.h> 16 #include <net/if.h> 17 #include <linux/types.h> 18 #include <linux/netfilter.h> 19 #include <linux/netfilter/x_tables.h> 20 21 #ifndef IPPROTO_SCTP 22 #define IPPROTO_SCTP 132 23 #endif 24 #ifndef IPPROTO_DCCP 25 #define IPPROTO_DCCP 33 26 #endif 27 #ifndef IPPROTO_MH 28 # define IPPROTO_MH 135 29 #endif 30 #ifndef IPPROTO_UDPLITE 31 #define IPPROTO_UDPLITE 136 32 #endif 33 34 #define XTABLES_VERSION "libxtables.so.@libxtables_vmajor@" 35 #define XTABLES_VERSION_CODE @libxtables_vmajor@ 36 37 struct in_addr; 38 39 /* 40 * .size is here so that there is a somewhat reasonable check 41 * against the chosen .type. 42 */ 43 #define XTOPT_POINTER(stype, member) \ 44 .ptroff = offsetof(stype, member), \ 45 .size = sizeof(((stype *)NULL)->member) 46 #define XTOPT_TABLEEND {.name = NULL} 47 48 /** 49 * Select the format the input has to conform to, as well as the target type 50 * (area pointed to with XTOPT_POINTER). Note that the storing is not always 51 * uniform. @cb->val will be populated with as much as there is space, i.e. 52 * exactly 2 items for ranges, but the target area can receive more values 53 * (e.g. in case of ranges), or less values (e.g. %XTTYPE_HOSTMASK). 54 * 55 * %XTTYPE_NONE: option takes no argument 56 * %XTTYPE_UINT*: standard integer 57 * %XTTYPE_UINT*RC: colon-separated range of standard integers 58 * %XTTYPE_DOUBLE: double-precision floating point number 59 * %XTTYPE_STRING: arbitrary string 60 * %XTTYPE_TOSMASK: 8-bit TOS value with optional mask 61 * %XTTYPE_MARKMASK32: 32-bit mark with optional mask 62 * %XTTYPE_SYSLOGLEVEL: syslog level by name or number 63 * %XTTYPE_HOST: one host or address (ptr: union nf_inet_addr) 64 * %XTTYPE_HOSTMASK: one host or address, with an optional prefix length 65 * (ptr: union nf_inet_addr; only host portion is stored) 66 * %XTTYPE_PROTOCOL: protocol number/name from /etc/protocols (ptr: uint8_t) 67 * %XTTYPE_PORT: 16-bit port name or number (supports %XTOPT_NBO) 68 * %XTTYPE_PORTRC: colon-separated port range (names acceptable), 69 * (supports %XTOPT_NBO) 70 * %XTTYPE_PLEN: prefix length 71 * %XTTYPE_PLENMASK: prefix length (ptr: union nf_inet_addr) 72 * %XTTYPE_ETHERMAC: Ethernet MAC address in hex form 73 */ 74 enum xt_option_type { 75 XTTYPE_NONE, 76 XTTYPE_UINT8, 77 XTTYPE_UINT16, 78 XTTYPE_UINT32, 79 XTTYPE_UINT64, 80 XTTYPE_UINT8RC, 81 XTTYPE_UINT16RC, 82 XTTYPE_UINT32RC, 83 XTTYPE_UINT64RC, 84 XTTYPE_DOUBLE, 85 XTTYPE_STRING, 86 XTTYPE_TOSMASK, 87 XTTYPE_MARKMASK32, 88 XTTYPE_SYSLOGLEVEL, 89 XTTYPE_HOST, 90 XTTYPE_HOSTMASK, 91 XTTYPE_PROTOCOL, 92 XTTYPE_PORT, 93 XTTYPE_PORTRC, 94 XTTYPE_PLEN, 95 XTTYPE_PLENMASK, 96 XTTYPE_ETHERMAC, 97 }; 98 99 /** 100 * %XTOPT_INVERT: option is invertible (usable with !) 101 * %XTOPT_MAND: option is mandatory 102 * %XTOPT_MULTI: option may be specified multiple times 103 * %XTOPT_PUT: store value into memory at @ptroff 104 * %XTOPT_NBO: store value in network-byte order 105 * (only certain XTTYPEs recognize this) 106 */ 107 enum xt_option_flags { 108 XTOPT_INVERT = 1 << 0, 109 XTOPT_MAND = 1 << 1, 110 XTOPT_MULTI = 1 << 2, 111 XTOPT_PUT = 1 << 3, 112 XTOPT_NBO = 1 << 4, 113 }; 114 115 /** 116 * @name: name of option 117 * @type: type of input and validation method, see %XTTYPE_* 118 * @id: unique number (within extension) for option, 0-31 119 * @excl: bitmask of flags that cannot be used with this option 120 * @also: bitmask of flags that must be used with this option 121 * @flags: bitmask of option flags, see %XTOPT_* 122 * @ptroff: offset into private structure for member 123 * @size: size of the item pointed to by @ptroff; this is a safeguard 124 * @min: lowest allowed value (for singular integral types) 125 * @max: highest allowed value (for singular integral types) 126 */ 127 struct xt_option_entry { 128 const char *name; 129 enum xt_option_type type; 130 unsigned int id, excl, also, flags; 131 unsigned int ptroff; 132 size_t size; 133 unsigned int min, max; 134 }; 135 136 /** 137 * @arg: input from command line 138 * @ext_name: name of extension currently being processed 139 * @entry: current option being processed 140 * @data: per-extension data block 141 * @xflags: options of the extension that have been used 142 * @invert: whether option was used with ! 143 * @nvals: number of results in uXX_multi 144 * @val: parsed result 145 */ 146 struct xt_option_call { 147 const char *arg, *ext_name; 148 const struct xt_option_entry *entry; 149 void *data; 150 unsigned int xflags; 151 bool invert; 152 uint8_t nvals; 153 union { 154 uint8_t u8, u8_range[2], syslog_level, protocol; 155 uint16_t u16, u16_range[2], port, port_range[2]; 156 uint32_t u32, u32_range[2]; 157 uint64_t u64, u64_range[2]; 158 double dbl; 159 struct { 160 union nf_inet_addr haddr, hmask; 161 uint8_t hlen; 162 }; 163 struct { 164 uint8_t tos_value, tos_mask; 165 }; 166 struct { 167 uint32_t mark, mask; 168 }; 169 uint8_t ethermac[6]; 170 } val; 171 /* Wished for a world where the ones below were gone: */ 172 union { 173 struct xt_entry_match **match; 174 struct xt_entry_target **target; 175 }; 176 void *xt_entry; 177 }; 178 179 /** 180 * @ext_name: name of extension currently being processed 181 * @data: per-extension data block 182 * @xflags: options of the extension that have been used 183 */ 184 struct xt_fcheck_call { 185 const char *ext_name; 186 void *data; 187 unsigned int xflags; 188 }; 189 190 /** 191 * A "linear"/linked-list based name<->id map, for files similar to 192 * /etc/iproute2/. 193 */ 194 struct xtables_lmap { 195 char *name; 196 int id; 197 struct xtables_lmap *next; 198 }; 199 200 /* Include file for additions: new matches and targets. */ 201 struct xtables_match 202 { 203 /* 204 * ABI/API version this module requires. Must be first member, 205 * as the rest of this struct may be subject to ABI changes. 206 */ 207 const char *version; 208 209 struct xtables_match *next; 210 211 const char *name; 212 213 /* Revision of match (0 by default). */ 214 u_int8_t revision; 215 216 u_int16_t family; 217 218 /* Size of match data. */ 219 size_t size; 220 221 /* Size of match data relevent for userspace comparison purposes */ 222 size_t userspacesize; 223 224 /* Function which prints out usage message. */ 225 void (*help)(void); 226 227 /* Initialize the match. */ 228 void (*init)(struct xt_entry_match *m); 229 230 /* Function which parses command options; returns true if it 231 ate an option */ 232 /* entry is struct ipt_entry for example */ 233 int (*parse)(int c, char **argv, int invert, unsigned int *flags, 234 const void *entry, 235 struct xt_entry_match **match); 236 237 /* Final check; exit if not ok. */ 238 void (*final_check)(unsigned int flags); 239 240 /* Prints out the match iff non-NULL: put space at end */ 241 /* ip is struct ipt_ip * for example */ 242 void (*print)(const void *ip, 243 const struct xt_entry_match *match, int numeric); 244 245 /* Saves the match info in parsable form to stdout. */ 246 /* ip is struct ipt_ip * for example */ 247 void (*save)(const void *ip, const struct xt_entry_match *match); 248 249 /* Pointer to list of extra command-line options */ 250 const struct option *extra_opts; 251 252 /* New parser */ 253 void (*x6_parse)(struct xt_option_call *); 254 void (*x6_fcheck)(struct xt_fcheck_call *); 255 const struct xt_option_entry *x6_options; 256 257 /* Ignore these men behind the curtain: */ 258 unsigned int option_offset; 259 struct xt_entry_match *m; 260 unsigned int mflags; 261 unsigned int loaded; /* simulate loading so options are merged properly */ 262 }; 263 264 struct xtables_target 265 { 266 /* 267 * ABI/API version this module requires. Must be first member, 268 * as the rest of this struct may be subject to ABI changes. 269 */ 270 const char *version; 271 272 struct xtables_target *next; 273 274 275 const char *name; 276 277 /* Revision of target (0 by default). */ 278 u_int8_t revision; 279 280 u_int16_t family; 281 282 283 /* Size of target data. */ 284 size_t size; 285 286 /* Size of target data relevent for userspace comparison purposes */ 287 size_t userspacesize; 288 289 /* Function which prints out usage message. */ 290 void (*help)(void); 291 292 /* Initialize the target. */ 293 void (*init)(struct xt_entry_target *t); 294 295 /* Function which parses command options; returns true if it 296 ate an option */ 297 /* entry is struct ipt_entry for example */ 298 int (*parse)(int c, char **argv, int invert, unsigned int *flags, 299 const void *entry, 300 struct xt_entry_target **targetinfo); 301 302 /* Final check; exit if not ok. */ 303 void (*final_check)(unsigned int flags); 304 305 /* Prints out the target iff non-NULL: put space at end */ 306 void (*print)(const void *ip, 307 const struct xt_entry_target *target, int numeric); 308 309 /* Saves the targinfo in parsable form to stdout. */ 310 void (*save)(const void *ip, 311 const struct xt_entry_target *target); 312 313 /* Pointer to list of extra command-line options */ 314 const struct option *extra_opts; 315 316 /* New parser */ 317 void (*x6_parse)(struct xt_option_call *); 318 void (*x6_fcheck)(struct xt_fcheck_call *); 319 const struct xt_option_entry *x6_options; 320 321 /* Ignore these men behind the curtain: */ 322 unsigned int option_offset; 323 struct xt_entry_target *t; 324 unsigned int tflags; 325 unsigned int used; 326 unsigned int loaded; /* simulate loading so options are merged properly */ 327 }; 328 329 struct xtables_rule_match { 330 struct xtables_rule_match *next; 331 struct xtables_match *match; 332 /* Multiple matches of the same type: the ones before 333 the current one are completed from parsing point of view */ 334 bool completed; 335 }; 336 337 /** 338 * struct xtables_pprot - 339 * 340 * A few hardcoded protocols for 'all' and in case the user has no 341 * /etc/protocols. 342 */ 343 struct xtables_pprot { 344 const char *name; 345 u_int8_t num; 346 }; 347 348 enum xtables_tryload { 349 XTF_DONT_LOAD, 350 XTF_DURING_LOAD, 351 XTF_TRY_LOAD, 352 XTF_LOAD_MUST_SUCCEED, 353 }; 354 355 enum xtables_exittype { 356 OTHER_PROBLEM = 1, 357 PARAMETER_PROBLEM, 358 VERSION_PROBLEM, 359 RESOURCE_PROBLEM, 360 XTF_ONLY_ONCE, 361 XTF_NO_INVERT, 362 XTF_BAD_VALUE, 363 XTF_ONE_ACTION, 364 }; 365 366 struct xtables_globals 367 { 368 unsigned int option_offset; 369 const char *program_name, *program_version; 370 struct option *orig_opts; 371 struct option *opts; 372 void (*exit_err)(enum xtables_exittype status, const char *msg, ...) __attribute__((noreturn, format(printf,2,3))); 373 }; 374 375 #define XT_GETOPT_TABLEEND {.name = NULL, .has_arg = false} 376 377 #ifdef __cplusplus 378 extern "C" { 379 #endif 380 381 extern const char *xtables_modprobe_program; 382 extern struct xtables_match *xtables_matches; 383 extern struct xtables_target *xtables_targets; 384 385 extern void xtables_init(void); 386 extern void xtables_set_nfproto(uint8_t); 387 extern void *xtables_calloc(size_t, size_t); 388 extern void *xtables_malloc(size_t); 389 extern void *xtables_realloc(void *, size_t); 390 391 extern int xtables_insmod(const char *, const char *, bool); 392 extern int xtables_load_ko(const char *, bool); 393 extern int xtables_set_params(struct xtables_globals *xtp); 394 extern void xtables_free_opts(int reset_offset); 395 extern struct option *xtables_merge_options(struct option *origopts, 396 struct option *oldopts, const struct option *newopts, 397 unsigned int *option_offset); 398 399 extern int xtables_init_all(struct xtables_globals *xtp, uint8_t nfproto); 400 extern struct xtables_match *xtables_find_match(const char *name, 401 enum xtables_tryload, struct xtables_rule_match **match); 402 extern struct xtables_target *xtables_find_target(const char *name, 403 enum xtables_tryload); 404 405 /* Your shared library should call one of these. */ 406 extern void xtables_register_match(struct xtables_match *me); 407 extern void xtables_register_matches(struct xtables_match *, unsigned int); 408 extern void xtables_register_target(struct xtables_target *me); 409 extern void xtables_register_targets(struct xtables_target *, unsigned int); 410 411 extern bool xtables_strtoul(const char *, char **, uintmax_t *, 412 uintmax_t, uintmax_t); 413 extern bool xtables_strtoui(const char *, char **, unsigned int *, 414 unsigned int, unsigned int); 415 extern int xtables_service_to_port(const char *name, const char *proto); 416 extern u_int16_t xtables_parse_port(const char *port, const char *proto); 417 extern void 418 xtables_parse_interface(const char *arg, char *vianame, unsigned char *mask); 419 420 /* this is a special 64bit data type that is 8-byte aligned */ 421 #define aligned_u64 u_int64_t __attribute__((aligned(8))) 422 423 int xtables_check_inverse(const char option[], int *invert, 424 int *my_optind, int argc, char **argv); 425 extern struct xtables_globals *xt_params; 426 #define xtables_error (xt_params->exit_err) 427 428 extern void xtables_param_act(unsigned int, const char *, ...); 429 430 extern const char *xtables_ipaddr_to_numeric(const struct in_addr *); 431 extern const char *xtables_ipaddr_to_anyname(const struct in_addr *); 432 extern const char *xtables_ipmask_to_numeric(const struct in_addr *); 433 extern struct in_addr *xtables_numeric_to_ipaddr(const char *); 434 extern struct in_addr *xtables_numeric_to_ipmask(const char *); 435 extern void xtables_ipparse_any(const char *, struct in_addr **, 436 struct in_addr *, unsigned int *); 437 extern void xtables_ipparse_multiple(const char *, struct in_addr **, 438 struct in_addr **, unsigned int *); 439 440 extern struct in6_addr *xtables_numeric_to_ip6addr(const char *); 441 extern const char *xtables_ip6addr_to_numeric(const struct in6_addr *); 442 extern const char *xtables_ip6addr_to_anyname(const struct in6_addr *); 443 extern const char *xtables_ip6mask_to_numeric(const struct in6_addr *); 444 extern void xtables_ip6parse_any(const char *, struct in6_addr **, 445 struct in6_addr *, unsigned int *); 446 extern void xtables_ip6parse_multiple(const char *, struct in6_addr **, 447 struct in6_addr **, unsigned int *); 448 449 /** 450 * Print the specified value to standard output, quoting dangerous 451 * characters if required. 452 */ 453 extern void xtables_save_string(const char *value); 454 455 #if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS) 456 # ifdef _INIT 457 # undef _init 458 # define _init _INIT 459 # endif 460 extern void init_extensions(void); 461 extern void init_extensions4(void); 462 extern void init_extensions6(void); 463 #else 464 # define _init __attribute__((constructor)) _INIT 465 #endif 466 467 extern const struct xtables_pprot xtables_chain_protos[]; 468 extern u_int16_t xtables_parse_protocol(const char *s); 469 470 /* xtoptions.c */ 471 extern void xtables_option_metavalidate(const char *, 472 const struct xt_option_entry *); 473 extern struct option *xtables_options_xfrm(struct option *, struct option *, 474 const struct xt_option_entry *, 475 unsigned int *); 476 extern void xtables_option_parse(struct xt_option_call *); 477 extern void xtables_option_tpcall(unsigned int, char **, bool, 478 struct xtables_target *, void *); 479 extern void xtables_option_mpcall(unsigned int, char **, bool, 480 struct xtables_match *, void *); 481 extern void xtables_option_tfcall(struct xtables_target *); 482 extern void xtables_option_mfcall(struct xtables_match *); 483 extern void xtables_options_fcheck(const char *, unsigned int, 484 const struct xt_option_entry *); 485 486 extern struct xtables_lmap *xtables_lmap_init(const char *); 487 extern void xtables_lmap_free(struct xtables_lmap *); 488 extern int xtables_lmap_name2id(const struct xtables_lmap *, const char *); 489 extern const char *xtables_lmap_id2name(const struct xtables_lmap *, int); 490 491 #ifdef XTABLES_INTERNAL 492 493 /* Shipped modules rely on this... */ 494 495 # ifndef ARRAY_SIZE 496 # define ARRAY_SIZE(x) (sizeof(x) / sizeof(*(x))) 497 # endif 498 499 extern void _init(void); 500 501 #endif 502 503 #ifdef __cplusplus 504 } /* extern "C" */ 505 #endif 506 507 #endif /* _XTABLES_H */ 508
