Home | History | Annotate | Download | only in include
      1 #ifndef _XTABLES_H
      2 #define _XTABLES_H
      3 
      4 /*
      5  * Changing any structs/functions may incur a needed change
      6  * in libxtables_vcurrent/vage too.
      7  */
      8 
      9 #include <sys/socket.h> /* PF_* */
     10 #include <sys/types.h>
     11 #include <limits.h>
     12 #include <stdbool.h>
     13 #include <stddef.h>
     14 #include <stdint.h>
     15 #include <netinet/in.h>
     16 #include <net/if.h>
     17 #include <linux/types.h>
     18 #include <linux/netfilter.h>
     19 #include <linux/netfilter/x_tables.h>
     20 
     21 #ifndef IPPROTO_SCTP
     22 #define IPPROTO_SCTP 132
     23 #endif
     24 #ifndef IPPROTO_DCCP
     25 #define IPPROTO_DCCP 33
     26 #endif
     27 #ifndef IPPROTO_MH
     28 #	define IPPROTO_MH 135
     29 #endif
     30 #ifndef IPPROTO_UDPLITE
     31 #define IPPROTO_UDPLITE	136
     32 #endif
     33 
     34 #define XTABLES_VERSION "libxtables.so.@libxtables_vmajor@"
     35 #define XTABLES_VERSION_CODE @libxtables_vmajor@
     36 
     37 struct in_addr;
     38 
     39 /*
     40  * .size is here so that there is a somewhat reasonable check
     41  * against the chosen .type.
     42  */
     43 #define XTOPT_POINTER(stype, member) \
     44 	.ptroff = offsetof(stype, member), \
     45 	.size = sizeof(((stype *)NULL)->member)
     46 #define XTOPT_TABLEEND {.name = NULL}
     47 
     48 /**
     49  * Select the format the input has to conform to, as well as the target type
     50  * (area pointed to with XTOPT_POINTER). Note that the storing is not always
     51  * uniform. @cb->val will be populated with as much as there is space, i.e.
     52  * exactly 2 items for ranges, but the target area can receive more values
     53  * (e.g. in case of ranges), or less values (e.g. %XTTYPE_HOSTMASK).
     54  *
     55  * %XTTYPE_NONE:	option takes no argument
     56  * %XTTYPE_UINT*:	standard integer
     57  * %XTTYPE_UINT*RC:	colon-separated range of standard integers
     58  * %XTTYPE_DOUBLE:	double-precision floating point number
     59  * %XTTYPE_STRING:	arbitrary string
     60  * %XTTYPE_TOSMASK:	8-bit TOS value with optional mask
     61  * %XTTYPE_MARKMASK32:	32-bit mark with optional mask
     62  * %XTTYPE_SYSLOGLEVEL:	syslog level by name or number
     63  * %XTTYPE_HOST:	one host or address (ptr: union nf_inet_addr)
     64  * %XTTYPE_HOSTMASK:	one host or address, with an optional prefix length
     65  * 			(ptr: union nf_inet_addr; only host portion is stored)
     66  * %XTTYPE_PROTOCOL:	protocol number/name from /etc/protocols (ptr: uint8_t)
     67  * %XTTYPE_PORT:	16-bit port name or number (supports %XTOPT_NBO)
     68  * %XTTYPE_PORTRC:	colon-separated port range (names acceptable),
     69  * 			(supports %XTOPT_NBO)
     70  * %XTTYPE_PLEN:	prefix length
     71  * %XTTYPE_PLENMASK:	prefix length (ptr: union nf_inet_addr)
     72  * %XTTYPE_ETHERMAC:	Ethernet MAC address in hex form
     73  */
     74 enum xt_option_type {
     75 	XTTYPE_NONE,
     76 	XTTYPE_UINT8,
     77 	XTTYPE_UINT16,
     78 	XTTYPE_UINT32,
     79 	XTTYPE_UINT64,
     80 	XTTYPE_UINT8RC,
     81 	XTTYPE_UINT16RC,
     82 	XTTYPE_UINT32RC,
     83 	XTTYPE_UINT64RC,
     84 	XTTYPE_DOUBLE,
     85 	XTTYPE_STRING,
     86 	XTTYPE_TOSMASK,
     87 	XTTYPE_MARKMASK32,
     88 	XTTYPE_SYSLOGLEVEL,
     89 	XTTYPE_HOST,
     90 	XTTYPE_HOSTMASK,
     91 	XTTYPE_PROTOCOL,
     92 	XTTYPE_PORT,
     93 	XTTYPE_PORTRC,
     94 	XTTYPE_PLEN,
     95 	XTTYPE_PLENMASK,
     96 	XTTYPE_ETHERMAC,
     97 };
     98 
     99 /**
    100  * %XTOPT_INVERT:	option is invertible (usable with !)
    101  * %XTOPT_MAND:		option is mandatory
    102  * %XTOPT_MULTI:	option may be specified multiple times
    103  * %XTOPT_PUT:		store value into memory at @ptroff
    104  * %XTOPT_NBO:		store value in network-byte order
    105  * 			(only certain XTTYPEs recognize this)
    106  */
    107 enum xt_option_flags {
    108 	XTOPT_INVERT = 1 << 0,
    109 	XTOPT_MAND   = 1 << 1,
    110 	XTOPT_MULTI  = 1 << 2,
    111 	XTOPT_PUT    = 1 << 3,
    112 	XTOPT_NBO    = 1 << 4,
    113 };
    114 
    115 /**
    116  * @name:	name of option
    117  * @type:	type of input and validation method, see %XTTYPE_*
    118  * @id:		unique number (within extension) for option, 0-31
    119  * @excl:	bitmask of flags that cannot be used with this option
    120  * @also:	bitmask of flags that must be used with this option
    121  * @flags:	bitmask of option flags, see %XTOPT_*
    122  * @ptroff:	offset into private structure for member
    123  * @size:	size of the item pointed to by @ptroff; this is a safeguard
    124  * @min:	lowest allowed value (for singular integral types)
    125  * @max:	highest allowed value (for singular integral types)
    126  */
    127 struct xt_option_entry {
    128 	const char *name;
    129 	enum xt_option_type type;
    130 	unsigned int id, excl, also, flags;
    131 	unsigned int ptroff;
    132 	size_t size;
    133 	unsigned int min, max;
    134 };
    135 
    136 /**
    137  * @arg:	input from command line
    138  * @ext_name:	name of extension currently being processed
    139  * @entry:	current option being processed
    140  * @data:	per-extension data block
    141  * @xflags:	options of the extension that have been used
    142  * @invert:	whether option was used with !
    143  * @nvals:	number of results in uXX_multi
    144  * @val:	parsed result
    145  */
    146 struct xt_option_call {
    147 	const char *arg, *ext_name;
    148 	const struct xt_option_entry *entry;
    149 	void *data;
    150 	unsigned int xflags;
    151 	bool invert;
    152 	uint8_t nvals;
    153 	union {
    154 		uint8_t u8, u8_range[2], syslog_level, protocol;
    155 		uint16_t u16, u16_range[2], port, port_range[2];
    156 		uint32_t u32, u32_range[2];
    157 		uint64_t u64, u64_range[2];
    158 		double dbl;
    159 		struct {
    160 			union nf_inet_addr haddr, hmask;
    161 			uint8_t hlen;
    162 		};
    163 		struct {
    164 			uint8_t tos_value, tos_mask;
    165 		};
    166 		struct {
    167 			uint32_t mark, mask;
    168 		};
    169 		uint8_t ethermac[6];
    170 	} val;
    171 	/* Wished for a world where the ones below were gone: */
    172 	union {
    173 		struct xt_entry_match **match;
    174 		struct xt_entry_target **target;
    175 	};
    176 	void *xt_entry;
    177 };
    178 
    179 /**
    180  * @ext_name:	name of extension currently being processed
    181  * @data:	per-extension data block
    182  * @xflags:	options of the extension that have been used
    183  */
    184 struct xt_fcheck_call {
    185 	const char *ext_name;
    186 	void *data;
    187 	unsigned int xflags;
    188 };
    189 
    190 /**
    191  * A "linear"/linked-list based name<->id map, for files similar to
    192  * /etc/iproute2/.
    193  */
    194 struct xtables_lmap {
    195 	char *name;
    196 	int id;
    197 	struct xtables_lmap *next;
    198 };
    199 
    200 /* Include file for additions: new matches and targets. */
    201 struct xtables_match
    202 {
    203 	/*
    204 	 * ABI/API version this module requires. Must be first member,
    205 	 * as the rest of this struct may be subject to ABI changes.
    206 	 */
    207 	const char *version;
    208 
    209 	struct xtables_match *next;
    210 
    211 	const char *name;
    212 
    213 	/* Revision of match (0 by default). */
    214 	u_int8_t revision;
    215 
    216 	u_int16_t family;
    217 
    218 	/* Size of match data. */
    219 	size_t size;
    220 
    221 	/* Size of match data relevent for userspace comparison purposes */
    222 	size_t userspacesize;
    223 
    224 	/* Function which prints out usage message. */
    225 	void (*help)(void);
    226 
    227 	/* Initialize the match. */
    228 	void (*init)(struct xt_entry_match *m);
    229 
    230 	/* Function which parses command options; returns true if it
    231            ate an option */
    232 	/* entry is struct ipt_entry for example */
    233 	int (*parse)(int c, char **argv, int invert, unsigned int *flags,
    234 		     const void *entry,
    235 		     struct xt_entry_match **match);
    236 
    237 	/* Final check; exit if not ok. */
    238 	void (*final_check)(unsigned int flags);
    239 
    240 	/* Prints out the match iff non-NULL: put space at end */
    241 	/* ip is struct ipt_ip * for example */
    242 	void (*print)(const void *ip,
    243 		      const struct xt_entry_match *match, int numeric);
    244 
    245 	/* Saves the match info in parsable form to stdout. */
    246 	/* ip is struct ipt_ip * for example */
    247 	void (*save)(const void *ip, const struct xt_entry_match *match);
    248 
    249 	/* Pointer to list of extra command-line options */
    250 	const struct option *extra_opts;
    251 
    252 	/* New parser */
    253 	void (*x6_parse)(struct xt_option_call *);
    254 	void (*x6_fcheck)(struct xt_fcheck_call *);
    255 	const struct xt_option_entry *x6_options;
    256 
    257 	/* Ignore these men behind the curtain: */
    258 	unsigned int option_offset;
    259 	struct xt_entry_match *m;
    260 	unsigned int mflags;
    261 	unsigned int loaded; /* simulate loading so options are merged properly */
    262 };
    263 
    264 struct xtables_target
    265 {
    266 	/*
    267 	 * ABI/API version this module requires. Must be first member,
    268 	 * as the rest of this struct may be subject to ABI changes.
    269 	 */
    270 	const char *version;
    271 
    272 	struct xtables_target *next;
    273 
    274 
    275 	const char *name;
    276 
    277 	/* Revision of target (0 by default). */
    278 	u_int8_t revision;
    279 
    280 	u_int16_t family;
    281 
    282 
    283 	/* Size of target data. */
    284 	size_t size;
    285 
    286 	/* Size of target data relevent for userspace comparison purposes */
    287 	size_t userspacesize;
    288 
    289 	/* Function which prints out usage message. */
    290 	void (*help)(void);
    291 
    292 	/* Initialize the target. */
    293 	void (*init)(struct xt_entry_target *t);
    294 
    295 	/* Function which parses command options; returns true if it
    296            ate an option */
    297 	/* entry is struct ipt_entry for example */
    298 	int (*parse)(int c, char **argv, int invert, unsigned int *flags,
    299 		     const void *entry,
    300 		     struct xt_entry_target **targetinfo);
    301 
    302 	/* Final check; exit if not ok. */
    303 	void (*final_check)(unsigned int flags);
    304 
    305 	/* Prints out the target iff non-NULL: put space at end */
    306 	void (*print)(const void *ip,
    307 		      const struct xt_entry_target *target, int numeric);
    308 
    309 	/* Saves the targinfo in parsable form to stdout. */
    310 	void (*save)(const void *ip,
    311 		     const struct xt_entry_target *target);
    312 
    313 	/* Pointer to list of extra command-line options */
    314 	const struct option *extra_opts;
    315 
    316 	/* New parser */
    317 	void (*x6_parse)(struct xt_option_call *);
    318 	void (*x6_fcheck)(struct xt_fcheck_call *);
    319 	const struct xt_option_entry *x6_options;
    320 
    321 	/* Ignore these men behind the curtain: */
    322 	unsigned int option_offset;
    323 	struct xt_entry_target *t;
    324 	unsigned int tflags;
    325 	unsigned int used;
    326 	unsigned int loaded; /* simulate loading so options are merged properly */
    327 };
    328 
    329 struct xtables_rule_match {
    330 	struct xtables_rule_match *next;
    331 	struct xtables_match *match;
    332 	/* Multiple matches of the same type: the ones before
    333 	   the current one are completed from parsing point of view */
    334 	bool completed;
    335 };
    336 
    337 /**
    338  * struct xtables_pprot -
    339  *
    340  * A few hardcoded protocols for 'all' and in case the user has no
    341  * /etc/protocols.
    342  */
    343 struct xtables_pprot {
    344 	const char *name;
    345 	u_int8_t num;
    346 };
    347 
    348 enum xtables_tryload {
    349 	XTF_DONT_LOAD,
    350 	XTF_DURING_LOAD,
    351 	XTF_TRY_LOAD,
    352 	XTF_LOAD_MUST_SUCCEED,
    353 };
    354 
    355 enum xtables_exittype {
    356 	OTHER_PROBLEM = 1,
    357 	PARAMETER_PROBLEM,
    358 	VERSION_PROBLEM,
    359 	RESOURCE_PROBLEM,
    360 	XTF_ONLY_ONCE,
    361 	XTF_NO_INVERT,
    362 	XTF_BAD_VALUE,
    363 	XTF_ONE_ACTION,
    364 };
    365 
    366 struct xtables_globals
    367 {
    368 	unsigned int option_offset;
    369 	const char *program_name, *program_version;
    370 	struct option *orig_opts;
    371 	struct option *opts;
    372 	void (*exit_err)(enum xtables_exittype status, const char *msg, ...) __attribute__((noreturn, format(printf,2,3)));
    373 };
    374 
    375 #define XT_GETOPT_TABLEEND {.name = NULL, .has_arg = false}
    376 
    377 #ifdef __cplusplus
    378 extern "C" {
    379 #endif
    380 
    381 extern const char *xtables_modprobe_program;
    382 extern struct xtables_match *xtables_matches;
    383 extern struct xtables_target *xtables_targets;
    384 
    385 extern void xtables_init(void);
    386 extern void xtables_set_nfproto(uint8_t);
    387 extern void *xtables_calloc(size_t, size_t);
    388 extern void *xtables_malloc(size_t);
    389 extern void *xtables_realloc(void *, size_t);
    390 
    391 extern int xtables_insmod(const char *, const char *, bool);
    392 extern int xtables_load_ko(const char *, bool);
    393 extern int xtables_set_params(struct xtables_globals *xtp);
    394 extern void xtables_free_opts(int reset_offset);
    395 extern struct option *xtables_merge_options(struct option *origopts,
    396 	struct option *oldopts, const struct option *newopts,
    397 	unsigned int *option_offset);
    398 
    399 extern int xtables_init_all(struct xtables_globals *xtp, uint8_t nfproto);
    400 extern struct xtables_match *xtables_find_match(const char *name,
    401 	enum xtables_tryload, struct xtables_rule_match **match);
    402 extern struct xtables_target *xtables_find_target(const char *name,
    403 	enum xtables_tryload);
    404 
    405 /* Your shared library should call one of these. */
    406 extern void xtables_register_match(struct xtables_match *me);
    407 extern void xtables_register_matches(struct xtables_match *, unsigned int);
    408 extern void xtables_register_target(struct xtables_target *me);
    409 extern void xtables_register_targets(struct xtables_target *, unsigned int);
    410 
    411 extern bool xtables_strtoul(const char *, char **, uintmax_t *,
    412 	uintmax_t, uintmax_t);
    413 extern bool xtables_strtoui(const char *, char **, unsigned int *,
    414 	unsigned int, unsigned int);
    415 extern int xtables_service_to_port(const char *name, const char *proto);
    416 extern u_int16_t xtables_parse_port(const char *port, const char *proto);
    417 extern void
    418 xtables_parse_interface(const char *arg, char *vianame, unsigned char *mask);
    419 
    420 /* this is a special 64bit data type that is 8-byte aligned */
    421 #define aligned_u64 u_int64_t __attribute__((aligned(8)))
    422 
    423 int xtables_check_inverse(const char option[], int *invert,
    424 	int *my_optind, int argc, char **argv);
    425 extern struct xtables_globals *xt_params;
    426 #define xtables_error (xt_params->exit_err)
    427 
    428 extern void xtables_param_act(unsigned int, const char *, ...);
    429 
    430 extern const char *xtables_ipaddr_to_numeric(const struct in_addr *);
    431 extern const char *xtables_ipaddr_to_anyname(const struct in_addr *);
    432 extern const char *xtables_ipmask_to_numeric(const struct in_addr *);
    433 extern struct in_addr *xtables_numeric_to_ipaddr(const char *);
    434 extern struct in_addr *xtables_numeric_to_ipmask(const char *);
    435 extern void xtables_ipparse_any(const char *, struct in_addr **,
    436 	struct in_addr *, unsigned int *);
    437 extern void xtables_ipparse_multiple(const char *, struct in_addr **,
    438 	struct in_addr **, unsigned int *);
    439 
    440 extern struct in6_addr *xtables_numeric_to_ip6addr(const char *);
    441 extern const char *xtables_ip6addr_to_numeric(const struct in6_addr *);
    442 extern const char *xtables_ip6addr_to_anyname(const struct in6_addr *);
    443 extern const char *xtables_ip6mask_to_numeric(const struct in6_addr *);
    444 extern void xtables_ip6parse_any(const char *, struct in6_addr **,
    445 	struct in6_addr *, unsigned int *);
    446 extern void xtables_ip6parse_multiple(const char *, struct in6_addr **,
    447 	struct in6_addr **, unsigned int *);
    448 
    449 /**
    450  * Print the specified value to standard output, quoting dangerous
    451  * characters if required.
    452  */
    453 extern void xtables_save_string(const char *value);
    454 
    455 #if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
    456 #	ifdef _INIT
    457 #		undef _init
    458 #		define _init _INIT
    459 #	endif
    460 	extern void init_extensions(void);
    461 	extern void init_extensions4(void);
    462 	extern void init_extensions6(void);
    463 #else
    464 #	define _init __attribute__((constructor)) _INIT
    465 #endif
    466 
    467 extern const struct xtables_pprot xtables_chain_protos[];
    468 extern u_int16_t xtables_parse_protocol(const char *s);
    469 
    470 /* xtoptions.c */
    471 extern void xtables_option_metavalidate(const char *,
    472 					const struct xt_option_entry *);
    473 extern struct option *xtables_options_xfrm(struct option *, struct option *,
    474 					   const struct xt_option_entry *,
    475 					   unsigned int *);
    476 extern void xtables_option_parse(struct xt_option_call *);
    477 extern void xtables_option_tpcall(unsigned int, char **, bool,
    478 				  struct xtables_target *, void *);
    479 extern void xtables_option_mpcall(unsigned int, char **, bool,
    480 				  struct xtables_match *, void *);
    481 extern void xtables_option_tfcall(struct xtables_target *);
    482 extern void xtables_option_mfcall(struct xtables_match *);
    483 extern void xtables_options_fcheck(const char *, unsigned int,
    484 				   const struct xt_option_entry *);
    485 
    486 extern struct xtables_lmap *xtables_lmap_init(const char *);
    487 extern void xtables_lmap_free(struct xtables_lmap *);
    488 extern int xtables_lmap_name2id(const struct xtables_lmap *, const char *);
    489 extern const char *xtables_lmap_id2name(const struct xtables_lmap *, int);
    490 
    491 #ifdef XTABLES_INTERNAL
    492 
    493 /* Shipped modules rely on this... */
    494 
    495 #	ifndef ARRAY_SIZE
    496 #		define ARRAY_SIZE(x) (sizeof(x) / sizeof(*(x)))
    497 #	endif
    498 
    499 extern void _init(void);
    500 
    501 #endif
    502 
    503 #ifdef __cplusplus
    504 } /* extern "C" */
    505 #endif
    506 
    507 #endif /* _XTABLES_H */
    508