1
2#ifndef _XTABLES_H
3#define _XTABLES_H
4
5
6
7
8
9
10#include <sys/socket.h>
11#include <sys/types.h>
12#include <limits.h>
13#include <stdbool.h>
14#include <stddef.h>
15#include <stdint.h>
16#include <netinet/in.h>
17#include <net/if.h>
18#include <linux/types.h>
19#include <linux/netfilter.h>
20#include <linux/netfilter/x_tables.h>
21
22#ifndef IPPROTO_SCTP
23#define IPPROTO_SCTP 132
24#endif
25#ifndef IPPROTO_DCCP
26#define IPPROTO_DCCP 33
27#endif
28#ifndef IPPROTO_MH
29# define IPPROTO_MH 135
30#endif
31#ifndef IPPROTO_UDPLITE
32#define IPPROTO_UDPLITE 136
33#endif
34
35#include <xtables-version.h>
36
37struct in_addr;
38
39
40
41
42
43#define XTOPT_POINTER(stype, member) \
44 .ptroff = offsetof(stype, member), \
45 .size = sizeof(((stype *)NULL)->member)
46#define XTOPT_TABLEEND {.name = NULL}
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74enum xt_option_type {
75 XTTYPE_NONE,
76 XTTYPE_UINT8,
77 XTTYPE_UINT16,
78 XTTYPE_UINT32,
79 XTTYPE_UINT64,
80 XTTYPE_UINT8RC,
81 XTTYPE_UINT16RC,
82 XTTYPE_UINT32RC,
83 XTTYPE_UINT64RC,
84 XTTYPE_DOUBLE,
85 XTTYPE_STRING,
86 XTTYPE_TOSMASK,
87 XTTYPE_MARKMASK32,
88 XTTYPE_SYSLOGLEVEL,
89 XTTYPE_HOST,
90 XTTYPE_HOSTMASK,
91 XTTYPE_PROTOCOL,
92 XTTYPE_PORT,
93 XTTYPE_PORTRC,
94 XTTYPE_PLEN,
95 XTTYPE_PLENMASK,
96 XTTYPE_ETHERMAC,
97};
98
99
100
101
102
103
104
105
106
107enum xt_option_flags {
108 XTOPT_INVERT = 1 << 0,
109 XTOPT_MAND = 1 << 1,
110 XTOPT_MULTI = 1 << 2,
111 XTOPT_PUT = 1 << 3,
112 XTOPT_NBO = 1 << 4,
113};
114
115
116
117
118
119
120
121
122
123
124
125
126
127struct xt_option_entry {
128 const char *name;
129 enum xt_option_type type;
130 unsigned int id, excl, also, flags;
131 unsigned int ptroff;
132 size_t size;
133 unsigned int min, max;
134};
135
136
137
138
139
140
141
142
143
144
145
146
147
148struct xt_option_call {
149 const char *arg, *ext_name;
150 const struct xt_option_entry *entry;
151 void *data;
152 unsigned int xflags;
153 bool invert;
154 uint8_t nvals;
155 union {
156 uint8_t u8, u8_range[2], syslog_level, protocol;
157 uint16_t u16, u16_range[2], port, port_range[2];
158 uint32_t u32, u32_range[2];
159 uint64_t u64, u64_range[2];
160 double dbl;
161 struct {
162 union nf_inet_addr haddr, hmask;
163 uint8_t hlen;
164 };
165 struct {
166 uint8_t tos_value, tos_mask;
167 };
168 struct {
169 uint32_t mark, mask;
170 };
171 uint8_t ethermac[6];
172 } val;
173
174 union {
175 struct xt_entry_match **match;
176 struct xt_entry_target **target;
177 };
178 void *xt_entry;
179 void *udata;
180};
181
182
183
184
185
186
187
188
189struct xt_fcheck_call {
190 const char *ext_name;
191 void *data, *udata;
192 unsigned int xflags;
193};
194
195
196
197
198
199struct xtables_lmap {
200 char *name;
201 int id;
202 struct xtables_lmap *next;
203};
204
205enum xtables_ext_flags {
206 XTABLES_EXT_ALIAS = 1 << 0,
207};
208
209#if XTABLES_VERSION_CODE >= 12
210struct xt_xlate;
211
212struct xt_xlate_mt_params {
213 const void *ip;
214 const struct xt_entry_match *match;
215 int numeric;
216 bool escape_quotes;
217};
218
219struct xt_xlate_tg_params {
220 const void *ip;
221 const struct xt_entry_target *target;
222 int numeric;
223 bool escape_quotes;
224};
225#endif
226
227
228struct xtables_match
229{
230
231
232
233
234 const char *version;
235
236 struct xtables_match *next;
237
238 const char *name;
239 const char *real_name;
240
241
242 uint8_t revision;
243
244
245 uint8_t ext_flags;
246
247 uint16_t family;
248
249
250 size_t size;
251
252
253 size_t userspacesize;
254
255
256 void (*help)(void);
257
258
259 void (*init)(struct xt_entry_match *m);
260
261
262
263
264 int (*parse)(int c, char **argv, int invert, unsigned int *flags,
265 const void *entry,
266 struct xt_entry_match **match);
267
268
269 void (*final_check)(unsigned int flags);
270
271
272
273 void (*print)(const void *ip,
274 const struct xt_entry_match *match, int numeric);
275
276
277
278 void (*save)(const void *ip, const struct xt_entry_match *match);
279
280
281 const char *(*alias)(const struct xt_entry_match *match);
282
283
284 const struct option *extra_opts;
285
286
287 void (*x6_parse)(struct xt_option_call *);
288 void (*x6_fcheck)(struct xt_fcheck_call *);
289 const struct xt_option_entry *x6_options;
290
291#if XTABLES_VERSION_CODE >= 12
292
293 int (*xlate)(struct xt_xlate *xl,
294 const struct xt_xlate_mt_params *params);
295#endif
296
297
298 size_t udata_size;
299
300
301 void *udata;
302 unsigned int option_offset;
303 struct xt_entry_match *m;
304 unsigned int mflags;
305 unsigned int loaded;
306};
307
308struct xtables_target
309{
310
311
312
313
314 const char *version;
315
316 struct xtables_target *next;
317
318
319 const char *name;
320
321
322 const char *real_name;
323
324
325 uint8_t revision;
326
327
328 uint8_t ext_flags;
329
330 uint16_t family;
331
332
333
334 size_t size;
335
336
337 size_t userspacesize;
338
339
340 void (*help)(void);
341
342
343 void (*init)(struct xt_entry_target *t);
344
345
346
347
348 int (*parse)(int c, char **argv, int invert, unsigned int *flags,
349 const void *entry,
350 struct xt_entry_target **targetinfo);
351
352
353 void (*final_check)(unsigned int flags);
354
355
356 void (*print)(const void *ip,
357 const struct xt_entry_target *target, int numeric);
358
359
360 void (*save)(const void *ip,
361 const struct xt_entry_target *target);
362
363
364 const char *(*alias)(const struct xt_entry_target *target);
365
366
367 const struct option *extra_opts;
368
369
370 void (*x6_parse)(struct xt_option_call *);
371 void (*x6_fcheck)(struct xt_fcheck_call *);
372 const struct xt_option_entry *x6_options;
373
374#if XTABLES_VERSION_CODE >= 12
375
376 int (*xlate)(struct xt_xlate *xl,
377 const struct xt_xlate_tg_params *params);
378#endif
379
380 size_t udata_size;
381
382
383 void *udata;
384 unsigned int option_offset;
385 struct xt_entry_target *t;
386 unsigned int tflags;
387 unsigned int used;
388 unsigned int loaded;
389};
390
391struct xtables_rule_match {
392 struct xtables_rule_match *next;
393 struct xtables_match *match;
394
395
396 bool completed;
397};
398
399
400
401
402
403
404
405struct xtables_pprot {
406 const char *name;
407 uint8_t num;
408};
409
410enum xtables_tryload {
411 XTF_DONT_LOAD,
412 XTF_DURING_LOAD,
413 XTF_TRY_LOAD,
414 XTF_LOAD_MUST_SUCCEED,
415};
416
417enum xtables_exittype {
418 OTHER_PROBLEM = 1,
419 PARAMETER_PROBLEM,
420 VERSION_PROBLEM,
421 RESOURCE_PROBLEM,
422 XTF_ONLY_ONCE,
423 XTF_NO_INVERT,
424 XTF_BAD_VALUE,
425 XTF_ONE_ACTION,
426};
427
428struct xtables_globals
429{
430 unsigned int option_offset;
431 const char *program_name, *program_version;
432 struct option *orig_opts;
433 struct option *opts;
434 void (*exit_err)(enum xtables_exittype status, const char *msg, ...) __attribute__((noreturn, format(printf,2,3)));
435 int (*compat_rev)(const char *name, uint8_t rev, int opt);
436};
437
438#define XT_GETOPT_TABLEEND {.name = NULL, .has_arg = false}
439
440#ifdef __cplusplus
441extern "C" {
442#endif
443
444extern const char *xtables_modprobe_program;
445extern struct xtables_match *xtables_matches;
446extern struct xtables_target *xtables_targets;
447
448extern void xtables_init(void);
449extern void xtables_set_nfproto(uint8_t);
450extern void *xtables_calloc(size_t, size_t);
451extern void *xtables_malloc(size_t);
452extern void *xtables_realloc(void *, size_t);
453
454extern int xtables_insmod(const char *, const char *, bool);
455extern int xtables_load_ko(const char *, bool);
456extern int xtables_set_params(struct xtables_globals *xtp);
457extern void xtables_free_opts(int reset_offset);
458extern struct option *xtables_merge_options(struct option *origopts,
459 struct option *oldopts, const struct option *newopts,
460 unsigned int *option_offset);
461
462extern int xtables_init_all(struct xtables_globals *xtp, uint8_t nfproto);
463extern struct xtables_match *xtables_find_match(const char *name,
464 enum xtables_tryload, struct xtables_rule_match **match);
465extern struct xtables_target *xtables_find_target(const char *name,
466 enum xtables_tryload);
467extern int xtables_compatible_revision(const char *name, uint8_t revision,
468 int opt);
469
470extern void xtables_rule_matches_free(struct xtables_rule_match **matches);
471
472
473extern void xtables_register_match(struct xtables_match *me);
474extern void xtables_register_matches(struct xtables_match *, unsigned int);
475extern void xtables_register_target(struct xtables_target *me);
476extern void xtables_register_targets(struct xtables_target *, unsigned int);
477
478extern bool xtables_strtoul(const char *, char **, uintmax_t *,
479 uintmax_t, uintmax_t);
480extern bool xtables_strtoui(const char *, char **, unsigned int *,
481 unsigned int, unsigned int);
482extern int xtables_service_to_port(const char *name, const char *proto);
483extern uint16_t xtables_parse_port(const char *port, const char *proto);
484extern void
485xtables_parse_interface(const char *arg, char *vianame, unsigned char *mask);
486
487
488#define aligned_u64 uint64_t __attribute__((aligned(8)))
489
490extern struct xtables_globals *xt_params;
491#define xtables_error (xt_params->exit_err)
492
493extern void xtables_param_act(unsigned int, const char *, ...);
494
495extern const char *xtables_ipaddr_to_numeric(const struct in_addr *);
496extern const char *xtables_ipaddr_to_anyname(const struct in_addr *);
497extern const char *xtables_ipmask_to_numeric(const struct in_addr *);
498extern struct in_addr *xtables_numeric_to_ipaddr(const char *);
499extern struct in_addr *xtables_numeric_to_ipmask(const char *);
500extern int xtables_ipmask_to_cidr(const struct in_addr *);
501extern void xtables_ipparse_any(const char *, struct in_addr **,
502 struct in_addr *, unsigned int *);
503extern void xtables_ipparse_multiple(const char *, struct in_addr **,
504 struct in_addr **, unsigned int *);
505
506extern struct in6_addr *xtables_numeric_to_ip6addr(const char *);
507extern const char *xtables_ip6addr_to_numeric(const struct in6_addr *);
508extern const char *xtables_ip6addr_to_anyname(const struct in6_addr *);
509extern const char *xtables_ip6mask_to_numeric(const struct in6_addr *);
510extern int xtables_ip6mask_to_cidr(const struct in6_addr *);
511extern void xtables_ip6parse_any(const char *, struct in6_addr **,
512 struct in6_addr *, unsigned int *);
513extern void xtables_ip6parse_multiple(const char *, struct in6_addr **,
514 struct in6_addr **, unsigned int *);
515
516
517
518
519
520extern void xtables_save_string(const char *value);
521
522#define FMT_NUMERIC 0x0001
523#define FMT_NOCOUNTS 0x0002
524#define FMT_KILOMEGAGIGA 0x0004
525#define FMT_OPTIONS 0x0008
526#define FMT_NOTABLE 0x0010
527#define FMT_NOTARGET 0x0020
528#define FMT_VIA 0x0040
529#define FMT_NONEWLINE 0x0080
530#define FMT_LINENUMBERS 0x0100
531
532#define FMT_PRINT_RULE (FMT_NOCOUNTS | FMT_OPTIONS | FMT_VIA \
533 | FMT_NUMERIC | FMT_NOTABLE)
534#define FMT(tab,notab) ((format) & FMT_NOTABLE ? (notab) : (tab))
535
536extern void xtables_print_num(uint64_t number, unsigned int format);
537
538#if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
539# ifdef _INIT
540# undef _init
541# define _init _INIT
542# endif
543 extern void init_extensions(void);
544 extern void init_extensions4(void);
545 extern void init_extensions6(void);
546#else
547# define _init __attribute__((constructor)) _INIT
548#endif
549
550extern const struct xtables_pprot xtables_chain_protos[];
551extern uint16_t xtables_parse_protocol(const char *s);
552
553
554extern int kernel_version;
555extern void get_kernel_version(void);
556#define LINUX_VERSION(x,y,z) (0x10000*(x) + 0x100*(y) + z)
557#define LINUX_VERSION_MAJOR(x) (((x)>>16) & 0xFF)
558#define LINUX_VERSION_MINOR(x) (((x)>> 8) & 0xFF)
559#define LINUX_VERSION_PATCH(x) ( (x) & 0xFF)
560
561
562extern void xtables_option_metavalidate(const char *,
563 const struct xt_option_entry *);
564extern struct option *xtables_options_xfrm(struct option *, struct option *,
565 const struct xt_option_entry *,
566 unsigned int *);
567extern void xtables_option_parse(struct xt_option_call *);
568extern void xtables_option_tpcall(unsigned int, char **, bool,
569 struct xtables_target *, void *);
570extern void xtables_option_mpcall(unsigned int, char **, bool,
571 struct xtables_match *, void *);
572extern void xtables_option_tfcall(struct xtables_target *);
573extern void xtables_option_mfcall(struct xtables_match *);
574extern void xtables_options_fcheck(const char *, unsigned int,
575 const struct xt_option_entry *);
576
577extern struct xtables_lmap *xtables_lmap_init(const char *);
578extern void xtables_lmap_free(struct xtables_lmap *);
579extern int xtables_lmap_name2id(const struct xtables_lmap *, const char *);
580extern const char *xtables_lmap_id2name(const struct xtables_lmap *, int);
581
582#ifdef XTABLES_INTERNAL
583
584
585
586# ifndef ARRAY_SIZE
587# define ARRAY_SIZE(x) (sizeof(x) / sizeof(*(x)))
588# endif
589
590extern void _init(void);
591
592#endif
593
594#ifdef __cplusplus
595}
596#endif
597
598#endif
599