1 /* 2 * 25-Jul-1998 Major changes to allow for ip chain table 3 * 4 * 3-Jan-2000 Named tables to allow packet selection for different uses. 5 */ 6 7 /* 8 * Format of an IP firewall descriptor 9 * 10 * src, dst, src_mask, dst_mask are always stored in network byte order. 11 * flags are stored in host byte order (of course). 12 * Port numbers are stored in HOST byte order. 13 */ 14 15 #ifndef _IPTABLES_H 16 #define _IPTABLES_H 17 18 #ifdef __KERNEL__ 19 #include <linux/if.h> 20 #include <linux/types.h> 21 #include <linux/in.h> 22 #include <linux/ip.h> 23 #include <linux/skbuff.h> 24 #endif 25 #include <linux/compiler.h> 26 #include <linux/netfilter_ipv4.h> 27 28 #include <linux/netfilter/x_tables.h> 29 30 #define IPT_FUNCTION_MAXNAMELEN XT_FUNCTION_MAXNAMELEN 31 #define IPT_TABLE_MAXNAMELEN XT_TABLE_MAXNAMELEN 32 #define ipt_match xt_match 33 #define ipt_target xt_target 34 #define ipt_table xt_table 35 #define ipt_get_revision xt_get_revision 36 37 /* Yes, Virginia, you have to zero the padding. */ 38 struct ipt_ip { 39 /* Source and destination IP addr */ 40 struct in_addr src, dst; 41 /* Mask for src and dest IP addr */ 42 struct in_addr smsk, dmsk; 43 char iniface[IFNAMSIZ], outiface[IFNAMSIZ]; 44 unsigned char iniface_mask[IFNAMSIZ], outiface_mask[IFNAMSIZ]; 45 46 /* Protocol, 0 = ANY */ 47 u_int16_t proto; 48 49 /* Flags word */ 50 u_int8_t flags; 51 /* Inverse flags */ 52 u_int8_t invflags; 53 }; 54 55 #define ipt_entry_match xt_entry_match 56 #define ipt_entry_target xt_entry_target 57 #define ipt_standard_target xt_standard_target 58 59 #define ipt_counters xt_counters 60 61 /* Values for "flag" field in struct ipt_ip (general ip structure). */ 62 #define IPT_F_FRAG 0x01 /* Set if rule is a fragment rule */ 63 #define IPT_F_GOTO 0x02 /* Set if jump is a goto */ 64 #define IPT_F_MASK 0x03 /* All possible flag bits mask. */ 65 66 /* Values for "inv" field in struct ipt_ip. */ 67 #define IPT_INV_VIA_IN 0x01 /* Invert the sense of IN IFACE. */ 68 #define IPT_INV_VIA_OUT 0x02 /* Invert the sense of OUT IFACE */ 69 #define IPT_INV_TOS 0x04 /* Invert the sense of TOS. */ 70 #define IPT_INV_SRCIP 0x08 /* Invert the sense of SRC IP. */ 71 #define IPT_INV_DSTIP 0x10 /* Invert the sense of DST OP. */ 72 #define IPT_INV_FRAG 0x20 /* Invert the sense of FRAG. */ 73 #define IPT_INV_PROTO XT_INV_PROTO 74 #define IPT_INV_MASK 0x7F /* All possible flag bits mask. */ 75 76 /* This structure defines each of the firewall rules. Consists of 3 77 parts which are 1) general IP header stuff 2) match specific 78 stuff 3) the target to perform if the rule matches */ 79 struct ipt_entry 80 { 81 struct ipt_ip ip; 82 83 /* Mark with fields that we care about. */ 84 unsigned int nfcache; 85 86 /* Size of ipt_entry + matches */ 87 u_int16_t target_offset; 88 /* Size of ipt_entry + matches + target */ 89 u_int16_t next_offset; 90 91 /* Back pointer */ 92 unsigned int comefrom; 93 94 /* Packet and byte counters. */ 95 struct xt_counters counters; 96 97 /* The matches (if any), then the target. */ 98 unsigned char elems[0]; 99 }; 100 101 /* 102 * New IP firewall options for [gs]etsockopt at the RAW IP level. 103 * Unlike BSD Linux inherits IP options so you don't have to use a raw 104 * socket for this. Instead we check rights in the calls. */ 105 #define IPT_BASE_CTL XT_BASE_CTL 106 107 #define IPT_SO_SET_REPLACE XT_SO_SET_REPLACE 108 #define IPT_SO_SET_ADD_COUNTERS XT_SO_SET_ADD_COUNTERS 109 #define IPT_SO_SET_MAX XT_SO_SET_MAX 110 111 #define IPT_SO_GET_INFO XT_SO_GET_INFO 112 #define IPT_SO_GET_ENTRIES XT_SO_GET_ENTRIES 113 #define IPT_SO_GET_REVISION_MATCH XT_SO_GET_REVISION_MATCH 114 #define IPT_SO_GET_REVISION_TARGET XT_SO_GET_REVISION_TARGET 115 #define IPT_SO_GET_MAX XT_SO_GET_REVISION_TARGET 116 117 #define IPT_CONTINUE XT_CONTINUE 118 #define IPT_RETURN XT_RETURN 119 120 #include <linux/netfilter/xt_tcpudp.h> 121 #define ipt_udp xt_udp 122 #define ipt_tcp xt_tcp 123 124 #define IPT_TCP_INV_SRCPT XT_TCP_INV_SRCPT 125 #define IPT_TCP_INV_DSTPT XT_TCP_INV_DSTPT 126 #define IPT_TCP_INV_FLAGS XT_TCP_INV_FLAGS 127 #define IPT_TCP_INV_OPTION XT_TCP_INV_OPTION 128 #define IPT_TCP_INV_MASK XT_TCP_INV_MASK 129 130 #define IPT_UDP_INV_SRCPT XT_UDP_INV_SRCPT 131 #define IPT_UDP_INV_DSTPT XT_UDP_INV_DSTPT 132 #define IPT_UDP_INV_MASK XT_UDP_INV_MASK 133 134 /* ICMP matching stuff */ 135 struct ipt_icmp 136 { 137 u_int8_t type; /* type to match */ 138 u_int8_t code[2]; /* range of code */ 139 u_int8_t invflags; /* Inverse flags */ 140 }; 141 142 /* Values for "inv" field for struct ipt_icmp. */ 143 #define IPT_ICMP_INV 0x01 /* Invert the sense of type/code test */ 144 145 /* The argument to IPT_SO_GET_INFO */ 146 struct ipt_getinfo 147 { 148 /* Which table: caller fills this in. */ 149 char name[IPT_TABLE_MAXNAMELEN]; 150 151 /* Kernel fills these in. */ 152 /* Which hook entry points are valid: bitmask */ 153 unsigned int valid_hooks; 154 155 /* Hook entry points: one per netfilter hook. */ 156 unsigned int hook_entry[NF_IP_NUMHOOKS]; 157 158 /* Underflow points. */ 159 unsigned int underflow[NF_IP_NUMHOOKS]; 160 161 /* Number of entries */ 162 unsigned int num_entries; 163 164 /* Size of entries. */ 165 unsigned int size; 166 }; 167 168 /* The argument to IPT_SO_SET_REPLACE. */ 169 struct ipt_replace 170 { 171 /* Which table. */ 172 char name[IPT_TABLE_MAXNAMELEN]; 173 174 /* Which hook entry points are valid: bitmask. You can't 175 change this. */ 176 unsigned int valid_hooks; 177 178 /* Number of entries */ 179 unsigned int num_entries; 180 181 /* Total size of new entries */ 182 unsigned int size; 183 184 /* Hook entry points. */ 185 unsigned int hook_entry[NF_IP_NUMHOOKS]; 186 187 /* Underflow points. */ 188 unsigned int underflow[NF_IP_NUMHOOKS]; 189 190 /* Information about old entries: */ 191 /* Number of counters (must be equal to current number of entries). */ 192 unsigned int num_counters; 193 /* The old entries' counters. */ 194 struct xt_counters __user *counters; 195 196 /* The entries (hang off end: not really an array). */ 197 struct ipt_entry entries[0]; 198 }; 199 200 /* The argument to IPT_SO_ADD_COUNTERS. */ 201 #define ipt_counters_info xt_counters_info 202 203 /* The argument to IPT_SO_GET_ENTRIES. */ 204 struct ipt_get_entries 205 { 206 /* Which table: user fills this in. */ 207 char name[IPT_TABLE_MAXNAMELEN]; 208 209 /* User fills this in: total entry size. */ 210 unsigned int size; 211 212 /* The entries. */ 213 struct ipt_entry entrytable[0]; 214 }; 215 216 /* Standard return verdict, or do jump. */ 217 #define IPT_STANDARD_TARGET XT_STANDARD_TARGET 218 /* Error verdict. */ 219 #define IPT_ERROR_TARGET XT_ERROR_TARGET 220 221 /* Helper functions */ 222 static __inline__ struct ipt_entry_target * 223 ipt_get_target(struct ipt_entry *e) 224 { 225 return (void *)e + e->target_offset; 226 } 227 228 /* fn returns 0 to continue iteration */ 229 #define IPT_MATCH_ITERATE(e, fn, args...) \ 230 ({ \ 231 unsigned int __i; \ 232 int __ret = 0; \ 233 struct ipt_entry_match *__match; \ 234 \ 235 for (__i = sizeof(struct ipt_entry); \ 236 __i < (e)->target_offset; \ 237 __i += __match->u.match_size) { \ 238 __match = (void *)(e) + __i; \ 239 \ 240 __ret = fn(__match , ## args); \ 241 if (__ret != 0) \ 242 break; \ 243 } \ 244 __ret; \ 245 }) 246 247 /* fn returns 0 to continue iteration */ 248 #define IPT_ENTRY_ITERATE(entries, size, fn, args...) \ 249 ({ \ 250 unsigned int __i; \ 251 int __ret = 0; \ 252 struct ipt_entry *__entry; \ 253 \ 254 for (__i = 0; __i < (size); __i += __entry->next_offset) { \ 255 __entry = (void *)(entries) + __i; \ 256 \ 257 __ret = fn(__entry , ## args); \ 258 if (__ret != 0) \ 259 break; \ 260 } \ 261 __ret; \ 262 }) 263 264 /* 265 * Main firewall chains definitions and global var's definitions. 266 */ 267 #ifdef __KERNEL__ 268 269 #include <linux/init.h> 270 extern void ipt_init(void) __init; 271 272 #define ipt_register_target(tgt) \ 273 ({ (tgt)->family = AF_INET; \ 274 xt_register_target(tgt); }) 275 #define ipt_unregister_target(tgt) xt_unregister_target(tgt) 276 277 #define ipt_register_match(mtch) \ 278 ({ (mtch)->family = AF_INET; \ 279 xt_register_match(mtch); }) 280 #define ipt_unregister_match(mtch) xt_unregister_match(mtch) 281 282 //#define ipt_register_table(tbl, repl) xt_register_table(AF_INET, tbl, repl) 283 //#define ipt_unregister_table(tbl) xt_unregister_table(AF_INET, tbl) 284 285 extern int ipt_register_table(struct ipt_table *table, 286 const struct ipt_replace *repl); 287 extern void ipt_unregister_table(struct ipt_table *table); 288 289 /* net/sched/ipt.c: Gimme access to your targets! Gets target->me. */ 290 extern struct ipt_target *ipt_find_target(const char *name, u8 revision); 291 292 /* Standard entry. */ 293 struct ipt_standard 294 { 295 struct ipt_entry entry; 296 struct ipt_standard_target target; 297 }; 298 299 struct ipt_error_target 300 { 301 struct ipt_entry_target target; 302 char errorname[IPT_FUNCTION_MAXNAMELEN]; 303 }; 304 305 struct ipt_error 306 { 307 struct ipt_entry entry; 308 struct ipt_error_target target; 309 }; 310 311 extern unsigned int ipt_do_table(struct sk_buff **pskb, 312 unsigned int hook, 313 const struct net_device *in, 314 const struct net_device *out, 315 struct ipt_table *table, 316 void *userdata); 317 318 #define IPT_ALIGN(s) XT_ALIGN(s) 319 320 #ifdef CONFIG_COMPAT 321 #include <net/compat.h> 322 323 struct compat_ipt_entry 324 { 325 struct ipt_ip ip; 326 compat_uint_t nfcache; 327 u_int16_t target_offset; 328 u_int16_t next_offset; 329 compat_uint_t comefrom; 330 struct compat_xt_counters counters; 331 unsigned char elems[0]; 332 }; 333 334 #define COMPAT_IPT_ALIGN(s) COMPAT_XT_ALIGN(s) 335 336 #endif /* CONFIG_COMPAT */ 337 #endif /*__KERNEL__*/ 338 #endif /* _IPTABLES_H */ 339
