1
2
3
4
5
6
7
8
9
10
11
12
13
14
15#ifndef _IP6_TABLES_H
16#define _IP6_TABLES_H
17
18#ifdef __KERNEL__
19#include <linux/if.h>
20#include <linux/in6.h>
21#include <linux/ipv6.h>
22#include <linux/skbuff.h>
23#endif
24#include <linux/types.h>
25#include <linux/compiler.h>
26#include <linux/netfilter_ipv6.h>
27
28#include <linux/netfilter/x_tables.h>
29
30#ifndef __KERNEL__
31#define IP6T_FUNCTION_MAXNAMELEN XT_FUNCTION_MAXNAMELEN
32#define IP6T_TABLE_MAXNAMELEN XT_TABLE_MAXNAMELEN
33#define ip6t_match xt_match
34#define ip6t_target xt_target
35#define ip6t_table xt_table
36#define ip6t_get_revision xt_get_revision
37#define ip6t_entry_match xt_entry_match
38#define ip6t_entry_target xt_entry_target
39#define ip6t_standard_target xt_standard_target
40#define ip6t_error_target xt_error_target
41#define ip6t_counters xt_counters
42#define IP6T_CONTINUE XT_CONTINUE
43#define IP6T_RETURN XT_RETURN
44
45
46#include <linux/netfilter/xt_tcpudp.h>
47#define ip6t_tcp xt_tcp
48#define ip6t_udp xt_udp
49#define IP6T_TCP_INV_SRCPT XT_TCP_INV_SRCPT
50#define IP6T_TCP_INV_DSTPT XT_TCP_INV_DSTPT
51#define IP6T_TCP_INV_FLAGS XT_TCP_INV_FLAGS
52#define IP6T_TCP_INV_OPTION XT_TCP_INV_OPTION
53#define IP6T_TCP_INV_MASK XT_TCP_INV_MASK
54#define IP6T_UDP_INV_SRCPT XT_UDP_INV_SRCPT
55#define IP6T_UDP_INV_DSTPT XT_UDP_INV_DSTPT
56#define IP6T_UDP_INV_MASK XT_UDP_INV_MASK
57
58#define ip6t_counters_info xt_counters_info
59#define IP6T_STANDARD_TARGET XT_STANDARD_TARGET
60#define IP6T_ERROR_TARGET XT_ERROR_TARGET
61#define IP6T_MATCH_ITERATE(e, fn, args...) \
62 XT_MATCH_ITERATE(struct ip6t_entry, e, fn, ## args)
63#define IP6T_ENTRY_ITERATE(entries, size, fn, args...) \
64 XT_ENTRY_ITERATE(struct ip6t_entry, entries, size, fn, ## args)
65#endif
66
67
68struct ip6t_ip6 {
69
70 struct in6_addr src, dst;
71
72 struct in6_addr smsk, dmsk;
73 char iniface[IFNAMSIZ], outiface[IFNAMSIZ];
74 unsigned char iniface_mask[IFNAMSIZ], outiface_mask[IFNAMSIZ];
75
76
77
78
79
80
81
82
83
84 u_int16_t proto;
85
86 u_int8_t tos;
87
88
89 u_int8_t flags;
90
91 u_int8_t invflags;
92};
93
94
95#define IP6T_F_PROTO 0x01
96
97#define IP6T_F_TOS 0x02
98#define IP6T_F_GOTO 0x04
99#define IP6T_F_MASK 0x07
100
101
102#define IP6T_INV_VIA_IN 0x01
103#define IP6T_INV_VIA_OUT 0x02
104#define IP6T_INV_TOS 0x04
105#define IP6T_INV_SRCIP 0x08
106#define IP6T_INV_DSTIP 0x10
107#define IP6T_INV_FRAG 0x20
108#define IP6T_INV_PROTO XT_INV_PROTO
109#define IP6T_INV_MASK 0x7F
110
111
112
113
114struct ip6t_entry {
115 struct ip6t_ip6 ipv6;
116
117
118 unsigned int nfcache;
119
120
121 u_int16_t target_offset;
122
123 u_int16_t next_offset;
124
125
126 unsigned int comefrom;
127
128
129 struct xt_counters counters;
130
131
132 unsigned char elems[0];
133};
134
135
136struct ip6t_standard {
137 struct ip6t_entry entry;
138 struct xt_standard_target target;
139};
140
141struct ip6t_error {
142 struct ip6t_entry entry;
143 struct xt_error_target target;
144};
145
146#define IP6T_ENTRY_INIT(__size) \
147{ \
148 .target_offset = sizeof(struct ip6t_entry), \
149 .next_offset = (__size), \
150}
151
152#define IP6T_STANDARD_INIT(__verdict) \
153{ \
154 .entry = IP6T_ENTRY_INIT(sizeof(struct ip6t_standard)), \
155 .target = XT_TARGET_INIT(XT_STANDARD_TARGET, \
156 sizeof(struct xt_standard_target)), \
157 .target.verdict = -(__verdict) - 1, \
158}
159
160#define IP6T_ERROR_INIT \
161{ \
162 .entry = IP6T_ENTRY_INIT(sizeof(struct ip6t_error)), \
163 .target = XT_TARGET_INIT(XT_ERROR_TARGET, \
164 sizeof(struct xt_error_target)), \
165 .target.errorname = "ERROR", \
166}
167
168
169
170
171
172
173
174
175#define IP6T_BASE_CTL 64
176
177#define IP6T_SO_SET_REPLACE (IP6T_BASE_CTL)
178#define IP6T_SO_SET_ADD_COUNTERS (IP6T_BASE_CTL + 1)
179#define IP6T_SO_SET_MAX IP6T_SO_SET_ADD_COUNTERS
180
181#define IP6T_SO_GET_INFO (IP6T_BASE_CTL)
182#define IP6T_SO_GET_ENTRIES (IP6T_BASE_CTL + 1)
183#define IP6T_SO_GET_REVISION_MATCH (IP6T_BASE_CTL + 4)
184#define IP6T_SO_GET_REVISION_TARGET (IP6T_BASE_CTL + 5)
185#define IP6T_SO_GET_MAX IP6T_SO_GET_REVISION_TARGET
186
187
188struct ip6t_icmp {
189 u_int8_t type;
190 u_int8_t code[2];
191 u_int8_t invflags;
192};
193
194
195#define IP6T_ICMP_INV 0x01
196
197
198struct ip6t_getinfo {
199
200 char name[XT_TABLE_MAXNAMELEN];
201
202
203
204 unsigned int valid_hooks;
205
206
207 unsigned int hook_entry[NF_INET_NUMHOOKS];
208
209
210 unsigned int underflow[NF_INET_NUMHOOKS];
211
212
213 unsigned int num_entries;
214
215
216 unsigned int size;
217};
218
219
220struct ip6t_replace {
221
222 char name[XT_TABLE_MAXNAMELEN];
223
224
225
226 unsigned int valid_hooks;
227
228
229 unsigned int num_entries;
230
231
232 unsigned int size;
233
234
235 unsigned int hook_entry[NF_INET_NUMHOOKS];
236
237
238 unsigned int underflow[NF_INET_NUMHOOKS];
239
240
241
242 unsigned int num_counters;
243
244 struct xt_counters __user *counters;
245
246
247 struct ip6t_entry entries[0];
248};
249
250
251struct ip6t_get_entries {
252
253 char name[XT_TABLE_MAXNAMELEN];
254
255
256 unsigned int size;
257
258
259 struct ip6t_entry entrytable[0];
260};
261
262
263static __inline__ struct xt_entry_target *
264ip6t_get_target(struct ip6t_entry *e)
265{
266 return (void *)e + e->target_offset;
267}
268
269
270
271
272
273#ifdef __KERNEL__
274
275#include <linux/init.h>
276extern void ip6t_init(void) __init;
277
278extern void *ip6t_alloc_initial_table(const struct xt_table *);
279extern struct xt_table *ip6t_register_table(struct net *net,
280 const struct xt_table *table,
281 const struct ip6t_replace *repl);
282extern void ip6t_unregister_table(struct net *net, struct xt_table *table);
283extern unsigned int ip6t_do_table(struct sk_buff *skb,
284 unsigned int hook,
285 const struct net_device *in,
286 const struct net_device *out,
287 struct xt_table *table);
288
289
290extern int ip6t_ext_hdr(u8 nexthdr);
291
292extern int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
293 int target, unsigned short *fragoff);
294
295#ifdef CONFIG_COMPAT
296#include <net/compat.h>
297
298struct compat_ip6t_entry {
299 struct ip6t_ip6 ipv6;
300 compat_uint_t nfcache;
301 u_int16_t target_offset;
302 u_int16_t next_offset;
303 compat_uint_t comefrom;
304 struct compat_xt_counters counters;
305 unsigned char elems[0];
306};
307
308static inline struct xt_entry_target *
309compat_ip6t_get_target(struct compat_ip6t_entry *e)
310{
311 return (void *)e + e->target_offset;
312}
313
314#endif
315#endif
316#endif
317