1 #ifndef _XTABLES_H 2 #define _XTABLES_H 3 4 /* 5 * Changing any structs/functions may incur a needed change 6 * in libxtables_vcurrent/vage too. 7 */ 8 9 #include <sys/socket.h> /* PF_* */ 10 #include <sys/types.h> 11 #include <limits.h> 12 #include <stdbool.h> 13 #include <stddef.h> 14 #include <stdint.h> 15 #include <netinet/in.h> 16 #include <net/if.h> 17 #include <linux/types.h> 18 #include <linux/netfilter.h> 19 #include <linux/netfilter/x_tables.h> 20 21 #ifndef IPPROTO_SCTP 22 #define IPPROTO_SCTP 132 23 #endif 24 #ifndef IPPROTO_DCCP 25 #define IPPROTO_DCCP 33 26 #endif 27 #ifndef IPPROTO_MH 28 # define IPPROTO_MH 135 29 #endif 30 #ifndef IPPROTO_UDPLITE 31 #define IPPROTO_UDPLITE 136 32 #endif 33 34 #include <xtables-version.h> 35 36 struct in_addr; 37 38 /* 39 * .size is here so that there is a somewhat reasonable check 40 * against the chosen .type. 41 */ 42 #define XTOPT_POINTER(stype, member) \ 43 .ptroff = offsetof(stype, member), \ 44 .size = sizeof(((stype *)NULL)->member) 45 #define XTOPT_TABLEEND {.name = NULL} 46 47 /** 48 * Select the format the input has to conform to, as well as the target type 49 * (area pointed to with XTOPT_POINTER). Note that the storing is not always 50 * uniform. @cb->val will be populated with as much as there is space, i.e. 51 * exactly 2 items for ranges, but the target area can receive more values 52 * (e.g. in case of ranges), or less values (e.g. %XTTYPE_HOSTMASK). 53 * 54 * %XTTYPE_NONE: option takes no argument 55 * %XTTYPE_UINT*: standard integer 56 * %XTTYPE_UINT*RC: colon-separated range of standard integers 57 * %XTTYPE_DOUBLE: double-precision floating point number 58 * %XTTYPE_STRING: arbitrary string 59 * %XTTYPE_TOSMASK: 8-bit TOS value with optional mask 60 * %XTTYPE_MARKMASK32: 32-bit mark with optional mask 61 * %XTTYPE_SYSLOGLEVEL: syslog level by name or number 62 * %XTTYPE_HOST: one host or address (ptr: union nf_inet_addr) 63 * %XTTYPE_HOSTMASK: one host or address, with an optional prefix length 64 * (ptr: union nf_inet_addr; only host portion is stored) 65 * %XTTYPE_PROTOCOL: protocol number/name from /etc/protocols (ptr: uint8_t) 66 * %XTTYPE_PORT: 16-bit port name or number (supports %XTOPT_NBO) 67 * %XTTYPE_PORTRC: colon-separated port range (names acceptable), 68 * (supports %XTOPT_NBO) 69 * %XTTYPE_PLEN: prefix length 70 * %XTTYPE_PLENMASK: prefix length (ptr: union nf_inet_addr) 71 * %XTTYPE_ETHERMAC: Ethernet MAC address in hex form 72 */ 73 enum xt_option_type { 74 XTTYPE_NONE, 75 XTTYPE_UINT8, 76 XTTYPE_UINT16, 77 XTTYPE_UINT32, 78 XTTYPE_UINT64, 79 XTTYPE_UINT8RC, 80 XTTYPE_UINT16RC, 81 XTTYPE_UINT32RC, 82 XTTYPE_UINT64RC, 83 XTTYPE_DOUBLE, 84 XTTYPE_STRING, 85 XTTYPE_TOSMASK, 86 XTTYPE_MARKMASK32, 87 XTTYPE_SYSLOGLEVEL, 88 XTTYPE_HOST, 89 XTTYPE_HOSTMASK, 90 XTTYPE_PROTOCOL, 91 XTTYPE_PORT, 92 XTTYPE_PORTRC, 93 XTTYPE_PLEN, 94 XTTYPE_PLENMASK, 95 XTTYPE_ETHERMAC, 96 }; 97 98 /** 99 * %XTOPT_INVERT: option is invertible (usable with !) 100 * %XTOPT_MAND: option is mandatory 101 * %XTOPT_MULTI: option may be specified multiple times 102 * %XTOPT_PUT: store value into memory at @ptroff 103 * %XTOPT_NBO: store value in network-byte order 104 * (only certain XTTYPEs recognize this) 105 */ 106 enum xt_option_flags { 107 XTOPT_INVERT = 1 << 0, 108 XTOPT_MAND = 1 << 1, 109 XTOPT_MULTI = 1 << 2, 110 XTOPT_PUT = 1 << 3, 111 XTOPT_NBO = 1 << 4, 112 }; 113 114 /** 115 * @name: name of option 116 * @type: type of input and validation method, see %XTTYPE_* 117 * @id: unique number (within extension) for option, 0-31 118 * @excl: bitmask of flags that cannot be used with this option 119 * @also: bitmask of flags that must be used with this option 120 * @flags: bitmask of option flags, see %XTOPT_* 121 * @ptroff: offset into private structure for member 122 * @size: size of the item pointed to by @ptroff; this is a safeguard 123 * @min: lowest allowed value (for singular integral types) 124 * @max: highest allowed value (for singular integral types) 125 */ 126 struct xt_option_entry { 127 const char *name; 128 enum xt_option_type type; 129 unsigned int id, excl, also, flags; 130 unsigned int ptroff; 131 size_t size; 132 unsigned int min, max; 133 }; 134 135 /** 136 * @arg: input from command line 137 * @ext_name: name of extension currently being processed 138 * @entry: current option being processed 139 * @data: per-extension kernel data block 140 * @xflags: options of the extension that have been used 141 * @invert: whether option was used with ! 142 * @nvals: number of results in uXX_multi 143 * @val: parsed result 144 * @udata: per-extension private scratch area 145 * (cf. xtables_{match,target}->udata_size) 146 */ 147 struct xt_option_call { 148 const char *arg, *ext_name; 149 const struct xt_option_entry *entry; 150 void *data; 151 unsigned int xflags; 152 bool invert; 153 uint8_t nvals; 154 union { 155 uint8_t u8, u8_range[2], syslog_level, protocol; 156 uint16_t u16, u16_range[2], port, port_range[2]; 157 uint32_t u32, u32_range[2]; 158 uint64_t u64, u64_range[2]; 159 double dbl; 160 struct { 161 union nf_inet_addr haddr, hmask; 162 uint8_t hlen; 163 }; 164 struct { 165 uint8_t tos_value, tos_mask; 166 }; 167 struct { 168 uint32_t mark, mask; 169 }; 170 uint8_t ethermac[6]; 171 } val; 172 /* Wished for a world where the ones below were gone: */ 173 union { 174 struct xt_entry_match **match; 175 struct xt_entry_target **target; 176 }; 177 void *xt_entry; 178 void *udata; 179 }; 180 181 /** 182 * @ext_name: name of extension currently being processed 183 * @data: per-extension (kernel) data block 184 * @udata: per-extension private scratch area 185 * (cf. xtables_{match,target}->udata_size) 186 * @xflags: options of the extension that have been used 187 */ 188 struct xt_fcheck_call { 189 const char *ext_name; 190 void *data, *udata; 191 unsigned int xflags; 192 }; 193 194 /** 195 * A "linear"/linked-list based name<->id map, for files similar to 196 * /etc/iproute2/. 197 */ 198 struct xtables_lmap { 199 char *name; 200 int id; 201 struct xtables_lmap *next; 202 }; 203 204 enum xtables_ext_flags { 205 XTABLES_EXT_ALIAS = 1 << 0, 206 }; 207 208 struct xt_xlate; 209 210 struct xt_xlate_mt_params { 211 const void *ip; 212 const struct xt_entry_match *match; 213 int numeric; 214 bool escape_quotes; 215 }; 216 217 struct xt_xlate_tg_params { 218 const void *ip; 219 const struct xt_entry_target *target; 220 int numeric; 221 bool escape_quotes; 222 }; 223 224 /* Include file for additions: new matches and targets. */ 225 struct xtables_match { 226 /* 227 * ABI/API version this module requires. Must be first member, 228 * as the rest of this struct may be subject to ABI changes. 229 */ 230 const char *version; 231 232 struct xtables_match *next; 233 234 const char *name; 235 const char *real_name; 236 237 /* Revision of match (0 by default). */ 238 uint8_t revision; 239 240 /* Extension flags */ 241 uint8_t ext_flags; 242 243 uint16_t family; 244 245 /* Size of match data. */ 246 size_t size; 247 248 /* Size of match data relevant for userspace comparison purposes */ 249 size_t userspacesize; 250 251 /* Function which prints out usage message. */ 252 void (*help)(void); 253 254 /* Initialize the match. */ 255 void (*init)(struct xt_entry_match *m); 256 257 /* Function which parses command options; returns true if it 258 ate an option */ 259 /* entry is struct ipt_entry for example */ 260 int (*parse)(int c, char **argv, int invert, unsigned int *flags, 261 const void *entry, 262 struct xt_entry_match **match); 263 264 /* Final check; exit if not ok. */ 265 void (*final_check)(unsigned int flags); 266 267 /* Prints out the match iff non-NULL: put space at end */ 268 /* ip is struct ipt_ip * for example */ 269 void (*print)(const void *ip, 270 const struct xt_entry_match *match, int numeric); 271 272 /* Saves the match info in parsable form to stdout. */ 273 /* ip is struct ipt_ip * for example */ 274 void (*save)(const void *ip, const struct xt_entry_match *match); 275 276 /* Print match name or alias */ 277 const char *(*alias)(const struct xt_entry_match *match); 278 279 /* Pointer to list of extra command-line options */ 280 const struct option *extra_opts; 281 282 /* New parser */ 283 void (*x6_parse)(struct xt_option_call *); 284 void (*x6_fcheck)(struct xt_fcheck_call *); 285 const struct xt_option_entry *x6_options; 286 287 /* Translate iptables to nft */ 288 int (*xlate)(struct xt_xlate *xl, 289 const struct xt_xlate_mt_params *params); 290 291 /* Size of per-extension instance extra "global" scratch space */ 292 size_t udata_size; 293 294 /* Ignore these men behind the curtain: */ 295 void *udata; 296 unsigned int option_offset; 297 struct xt_entry_match *m; 298 unsigned int mflags; 299 unsigned int loaded; /* simulate loading so options are merged properly */ 300 }; 301 302 struct xtables_target { 303 /* 304 * ABI/API version this module requires. Must be first member, 305 * as the rest of this struct may be subject to ABI changes. 306 */ 307 const char *version; 308 309 struct xtables_target *next; 310 311 312 const char *name; 313 314 /* Real target behind this, if any. */ 315 const char *real_name; 316 317 /* Revision of target (0 by default). */ 318 uint8_t revision; 319 320 /* Extension flags */ 321 uint8_t ext_flags; 322 323 uint16_t family; 324 325 326 /* Size of target data. */ 327 size_t size; 328 329 /* Size of target data relevant for userspace comparison purposes */ 330 size_t userspacesize; 331 332 /* Function which prints out usage message. */ 333 void (*help)(void); 334 335 /* Initialize the target. */ 336 void (*init)(struct xt_entry_target *t); 337 338 /* Function which parses command options; returns true if it 339 ate an option */ 340 /* entry is struct ipt_entry for example */ 341 int (*parse)(int c, char **argv, int invert, unsigned int *flags, 342 const void *entry, 343 struct xt_entry_target **targetinfo); 344 345 /* Final check; exit if not ok. */ 346 void (*final_check)(unsigned int flags); 347 348 /* Prints out the target iff non-NULL: put space at end */ 349 void (*print)(const void *ip, 350 const struct xt_entry_target *target, int numeric); 351 352 /* Saves the targinfo in parsable form to stdout. */ 353 void (*save)(const void *ip, 354 const struct xt_entry_target *target); 355 356 /* Print target name or alias */ 357 const char *(*alias)(const struct xt_entry_target *target); 358 359 /* Pointer to list of extra command-line options */ 360 const struct option *extra_opts; 361 362 /* New parser */ 363 void (*x6_parse)(struct xt_option_call *); 364 void (*x6_fcheck)(struct xt_fcheck_call *); 365 const struct xt_option_entry *x6_options; 366 367 /* Translate iptables to nft */ 368 int (*xlate)(struct xt_xlate *xl, 369 const struct xt_xlate_tg_params *params); 370 371 size_t udata_size; 372 373 /* Ignore these men behind the curtain: */ 374 void *udata; 375 unsigned int option_offset; 376 struct xt_entry_target *t; 377 unsigned int tflags; 378 unsigned int used; 379 unsigned int loaded; /* simulate loading so options are merged properly */ 380 }; 381 382 struct xtables_rule_match { 383 struct xtables_rule_match *next; 384 struct xtables_match *match; 385 /* Multiple matches of the same type: the ones before 386 the current one are completed from parsing point of view */ 387 bool completed; 388 }; 389 390 /** 391 * struct xtables_pprot - 392 * 393 * A few hardcoded protocols for 'all' and in case the user has no 394 * /etc/protocols. 395 */ 396 struct xtables_pprot { 397 const char *name; 398 uint8_t num; 399 }; 400 401 enum xtables_tryload { 402 XTF_DONT_LOAD, 403 XTF_DURING_LOAD, 404 XTF_TRY_LOAD, 405 XTF_LOAD_MUST_SUCCEED, 406 }; 407 408 enum xtables_exittype { 409 OTHER_PROBLEM = 1, 410 PARAMETER_PROBLEM, 411 VERSION_PROBLEM, 412 RESOURCE_PROBLEM, 413 XTF_ONLY_ONCE, 414 XTF_NO_INVERT, 415 XTF_BAD_VALUE, 416 XTF_ONE_ACTION, 417 }; 418 419 struct xtables_globals 420 { 421 unsigned int option_offset; 422 const char *program_name, *program_version; 423 struct option *orig_opts; 424 struct option *opts; 425 void (*exit_err)(enum xtables_exittype status, const char *msg, ...) __attribute__((noreturn, format(printf,2,3))); 426 int (*compat_rev)(const char *name, uint8_t rev, int opt); 427 }; 428 429 #define XT_GETOPT_TABLEEND {.name = NULL, .has_arg = false} 430 431 /* 432 * enum op- 433 * 434 * For writing clean nftables translations code 435 */ 436 enum xt_op { 437 XT_OP_EQ, 438 XT_OP_NEQ, 439 XT_OP_MAX, 440 }; 441 442 #ifdef __cplusplus 443 extern "C" { 444 #endif 445 446 extern const char *xtables_modprobe_program; 447 extern struct xtables_match *xtables_matches; 448 extern struct xtables_target *xtables_targets; 449 450 extern void xtables_init(void); 451 extern void xtables_set_nfproto(uint8_t); 452 extern void *xtables_calloc(size_t, size_t); 453 extern void *xtables_malloc(size_t); 454 extern void *xtables_realloc(void *, size_t); 455 456 extern int xtables_insmod(const char *, const char *, bool); 457 extern int xtables_load_ko(const char *, bool); 458 extern int xtables_set_params(struct xtables_globals *xtp); 459 extern void xtables_free_opts(int reset_offset); 460 extern struct option *xtables_merge_options(struct option *origopts, 461 struct option *oldopts, const struct option *newopts, 462 unsigned int *option_offset); 463 464 extern int xtables_init_all(struct xtables_globals *xtp, uint8_t nfproto); 465 extern struct xtables_match *xtables_find_match(const char *name, 466 enum xtables_tryload, struct xtables_rule_match **match); 467 extern struct xtables_target *xtables_find_target(const char *name, 468 enum xtables_tryload); 469 extern int xtables_compatible_revision(const char *name, uint8_t revision, 470 int opt); 471 472 extern void xtables_rule_matches_free(struct xtables_rule_match **matches); 473 474 /* Your shared library should call one of these. */ 475 extern void xtables_register_match(struct xtables_match *me); 476 extern void xtables_register_matches(struct xtables_match *, unsigned int); 477 extern void xtables_register_target(struct xtables_target *me); 478 extern void xtables_register_targets(struct xtables_target *, unsigned int); 479 480 extern bool xtables_strtoul(const char *, char **, uintmax_t *, 481 uintmax_t, uintmax_t); 482 extern bool xtables_strtoui(const char *, char **, unsigned int *, 483 unsigned int, unsigned int); 484 extern int xtables_service_to_port(const char *name, const char *proto); 485 extern uint16_t xtables_parse_port(const char *port, const char *proto); 486 extern void 487 xtables_parse_interface(const char *arg, char *vianame, unsigned char *mask); 488 489 /* this is a special 64bit data type that is 8-byte aligned */ 490 #define aligned_u64 uint64_t __attribute__((aligned(8))) 491 492 extern struct xtables_globals *xt_params; 493 #define xtables_error (xt_params->exit_err) 494 495 extern void xtables_param_act(unsigned int, const char *, ...); 496 497 extern const char *xtables_ipaddr_to_numeric(const struct in_addr *); 498 extern const char *xtables_ipaddr_to_anyname(const struct in_addr *); 499 extern const char *xtables_ipmask_to_numeric(const struct in_addr *); 500 extern struct in_addr *xtables_numeric_to_ipaddr(const char *); 501 extern struct in_addr *xtables_numeric_to_ipmask(const char *); 502 extern int xtables_ipmask_to_cidr(const struct in_addr *); 503 extern void xtables_ipparse_any(const char *, struct in_addr **, 504 struct in_addr *, unsigned int *); 505 extern void xtables_ipparse_multiple(const char *, struct in_addr **, 506 struct in_addr **, unsigned int *); 507 508 extern struct in6_addr *xtables_numeric_to_ip6addr(const char *); 509 extern const char *xtables_ip6addr_to_numeric(const struct in6_addr *); 510 extern const char *xtables_ip6addr_to_anyname(const struct in6_addr *); 511 extern const char *xtables_ip6mask_to_numeric(const struct in6_addr *); 512 extern int xtables_ip6mask_to_cidr(const struct in6_addr *); 513 extern void xtables_ip6parse_any(const char *, struct in6_addr **, 514 struct in6_addr *, unsigned int *); 515 extern void xtables_ip6parse_multiple(const char *, struct in6_addr **, 516 struct in6_addr **, unsigned int *); 517 518 /** 519 * Print the specified value to standard output, quoting dangerous 520 * characters if required. 521 */ 522 extern void xtables_save_string(const char *value); 523 524 #define FMT_NUMERIC 0x0001 525 #define FMT_NOCOUNTS 0x0002 526 #define FMT_KILOMEGAGIGA 0x0004 527 #define FMT_OPTIONS 0x0008 528 #define FMT_NOTABLE 0x0010 529 #define FMT_NOTARGET 0x0020 530 #define FMT_VIA 0x0040 531 #define FMT_NONEWLINE 0x0080 532 #define FMT_LINENUMBERS 0x0100 533 534 #define FMT_PRINT_RULE (FMT_NOCOUNTS | FMT_OPTIONS | FMT_VIA \ 535 | FMT_NUMERIC | FMT_NOTABLE) 536 #define FMT(tab,notab) ((format) & FMT_NOTABLE ? (notab) : (tab)) 537 538 extern void xtables_print_num(uint64_t number, unsigned int format); 539 540 #if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS) 541 # ifdef _INIT 542 # undef _init 543 # define _init _INIT 544 # endif 545 extern void init_extensions(void); 546 extern void init_extensions4(void); 547 extern void init_extensions6(void); 548 #else 549 # define _init __attribute__((constructor)) _INIT 550 #endif 551 552 extern const struct xtables_pprot xtables_chain_protos[]; 553 extern uint16_t xtables_parse_protocol(const char *s); 554 555 /* kernel revision handling */ 556 extern int kernel_version; 557 extern void get_kernel_version(void); 558 #define LINUX_VERSION(x,y,z) (0x10000*(x) + 0x100*(y) + z) 559 #define LINUX_VERSION_MAJOR(x) (((x)>>16) & 0xFF) 560 #define LINUX_VERSION_MINOR(x) (((x)>> 8) & 0xFF) 561 #define LINUX_VERSION_PATCH(x) ( (x) & 0xFF) 562 563 /* xtoptions.c */ 564 extern void xtables_option_metavalidate(const char *, 565 const struct xt_option_entry *); 566 extern struct option *xtables_options_xfrm(struct option *, struct option *, 567 const struct xt_option_entry *, 568 unsigned int *); 569 extern void xtables_option_parse(struct xt_option_call *); 570 extern void xtables_option_tpcall(unsigned int, char **, bool, 571 struct xtables_target *, void *); 572 extern void xtables_option_mpcall(unsigned int, char **, bool, 573 struct xtables_match *, void *); 574 extern void xtables_option_tfcall(struct xtables_target *); 575 extern void xtables_option_mfcall(struct xtables_match *); 576 extern void xtables_options_fcheck(const char *, unsigned int, 577 const struct xt_option_entry *); 578 579 extern struct xtables_lmap *xtables_lmap_init(const char *); 580 extern void xtables_lmap_free(struct xtables_lmap *); 581 extern int xtables_lmap_name2id(const struct xtables_lmap *, const char *); 582 extern const char *xtables_lmap_id2name(const struct xtables_lmap *, int); 583 584 /* xlate infrastructure */ 585 struct xt_xlate *xt_xlate_alloc(int size); 586 void xt_xlate_free(struct xt_xlate *xl); 587 void xt_xlate_add(struct xt_xlate *xl, const char *fmt, ...); 588 void xt_xlate_add_comment(struct xt_xlate *xl, const char *comment); 589 const char *xt_xlate_get_comment(struct xt_xlate *xl); 590 const char *xt_xlate_get(struct xt_xlate *xl); 591 592 #ifdef XTABLES_INTERNAL 593 594 /* Shipped modules rely on this... */ 595 596 # ifndef ARRAY_SIZE 597 # define ARRAY_SIZE(x) (sizeof(x) / sizeof(*(x))) 598 # endif 599 600 extern void _init(void); 601 602 #endif 603 604 #ifdef __cplusplus 605 } /* extern "C" */ 606 #endif 607 608 #endif /* _XTABLES_H */ 609
