Skip to content

I
iproute2
Commit 5cd1adba authored by Stephen Hemminger's avatar Stephen Hemminger
Browse files
Options

Update to current iptables headers 

Keep in sync with current iptables upstream
parent c13b6b09
Expand all Hide whitespace changes
Inline Side-by-side
Showing with 794 additions and 434 deletions
include/ip6tables.h
View file @ 5cd1adba
#ifndef _IP6TABLES_USER_H #ifndef _IP6TABLES_USER_H
#define _IP6TABLES_USER_H #define _IP6TABLES_USER_H
#include "iptables_common.h" #include <netinet/ip.h>
#include "libiptc/libip6tc.h" #include <xtables.h>
#include <libiptc/libip6tc.h>
struct ip6tables_rule_match #include <iptables/internal.h>
{
struct ip6tables_rule_match *next;
struct ip6tables_match *match;
};
/* Include file for additions: new matches and targets. */
struct ip6tables_match
{
struct ip6tables_match *next;
ip6t_chainlabel name;
const char *version;
/* Size of match data. */
size_t size;
/* Size of match data relevent for userspace comparison purposes */
size_t userspacesize;
/* Function which prints out usage message. */
void (*help)(void);
/* Initialize the match. */
void (*init)(struct ip6t_entry_match *m, unsigned int *nfcache);
/* Function which parses command options; returns true if it
ate an option */
int (*parse)(int c, char **argv, int invert, unsigned int *flags,
const struct ip6t_entry *entry,
unsigned int *nfcache,
struct ip6t_entry_match **match);
/* Final check; exit if not ok. */
void (*final_check)(unsigned int flags);
/* Prints out the match iff non-NULL: put space at end */
void (*print)(const struct ip6t_ip6 *ip,
const struct ip6t_entry_match *match, int numeric);
/* Saves the union ipt_matchinfo in parsable form to stdout. */
void (*save)(const struct ip6t_ip6 *ip,
const struct ip6t_entry_match *match);
/* Pointer to list of extra command-line options */
const struct option *extra_opts;
/* Ignore these men behind the curtain: */
unsigned int option_offset;
struct ip6t_entry_match *m;
unsigned int mflags;
#ifdef NO_SHARED_LIBS
unsigned int loaded; /* simulate loading so options are merged properly */
#endif
};
struct ip6tables_target
{
struct ip6tables_target *next;
ip6t_chainlabel name;
const char *version;
/* Size of target data. */
size_t size;
/* Size of target data relevent for userspace comparison purposes */
size_t userspacesize;
/* Function which prints out usage message. */
void (*help)(void);
/* Initialize the target. */
void (*init)(struct ip6t_entry_target *t, unsigned int *nfcache);
/* Function which parses command options; returns true if it
ate an option */
int (*parse)(int c, char **argv, int invert, unsigned int *flags,
const struct ip6t_entry *entry,
struct ip6t_entry_target **target);
/* Final check; exit if not ok. */
void (*final_check)(unsigned int flags);
/* Prints out the target iff non-NULL: put space at end */
void (*print)(const struct ip6t_ip6 *ip,
const struct ip6t_entry_target *target, int numeric);
/* Saves the targinfo in parsable form to stdout. */
void (*save)(const struct ip6t_ip6 *ip,
const struct ip6t_entry_target *target);
/* Pointer to list of extra command-line options */
struct option *extra_opts;
/* Ignore these men behind the curtain: */
unsigned int option_offset;
struct ip6t_entry_target *t;
unsigned int tflags;
unsigned int used;
#ifdef NO_SHARED_LIBS
unsigned int loaded; /* simulate loading so options are merged properly */
#endif
};
extern int line;
/* Your shared library should call one of these. */ /* Your shared library should call one of these. */
extern void register_match6(struct ip6tables_match *me);
extern void register_target6(struct ip6tables_target *me);
extern int do_command6(int argc, char *argv[], char **table, extern int do_command6(int argc, char *argv[], char **table,
ip6tc_handle_t *handle); struct xtc_handle **handle, bool restore);
/* Keeping track of external matches and targets: linked lists. */
extern struct ip6tables_match *ip6tables_matches;
extern struct ip6tables_target *ip6tables_targets;
enum ip6t_tryload {
DONT_LOAD,
TRY_LOAD,
LOAD_MUST_SUCCEED
};
extern struct ip6tables_target *find_target(const char *name, enum ip6t_tryload); extern int for_each_chain6(int (*fn)(const xt_chainlabel, int, struct xtc_handle *), int verbose, int builtinstoo, struct xtc_handle *handle);
extern struct ip6tables_match *find_match(const char *name, enum ip6t_tryload, struct ip6tables_rule_match **match); extern int flush_entries6(const xt_chainlabel chain, int verbose, struct xtc_handle *handle);
extern int delete_chain6(const xt_chainlabel chain, int verbose, struct xtc_handle *handle);
void print_rule6(const struct ip6t_entry *e, struct xtc_handle *h, const char *chain, int counters);
extern int for_each_chain(int (*fn)(const ip6t_chainlabel, int, ip6tc_handle_t *), int verbose, int builtinstoo, ip6tc_handle_t *handle); extern struct xtables_globals ip6tables_globals;
extern int flush_entries(const ip6t_chainlabel chain, int verbose, ip6tc_handle_t *handle);
extern int delete_chain(const ip6t_chainlabel chain, int verbose, ip6tc_handle_t *handle);
extern int ip6tables_insmod(const char *modname, const char *modprobe);
#endif /*_IP6TABLES_USER_H*/ #endif /*_IP6TABLES_USER_H*/
include/iptables.h
View file @ 5cd1adba
#ifndef _IPTABLES_USER_H #ifndef _IPTABLES_USER_H
#define _IPTABLES_USER_H #define _IPTABLES_USER_H
#include "iptables_common.h" #include <netinet/ip.h>
#include "libiptc/libiptc.h" #include <xtables.h>
#include <libiptc/libiptc.h>
#ifndef IPT_LIB_DIR #include <iptables/internal.h>
#define IPT_LIB_DIR "/usr/local/lib/iptables"
#endif
#ifndef IPPROTO_SCTP
#define IPPROTO_SCTP 132
#endif
#ifndef IPT_SO_GET_REVISION_MATCH /* Old kernel source. */
#define IPT_SO_GET_REVISION_MATCH (IPT_BASE_CTL + 2)
#define IPT_SO_GET_REVISION_TARGET (IPT_BASE_CTL + 3)
struct ipt_get_revision
{
char name[IPT_FUNCTION_MAXNAMELEN-1];
u_int8_t revision;
};
#endif /* IPT_SO_GET_REVISION_MATCH Old kernel source */
struct iptables_rule_match
{
struct iptables_rule_match *next;
struct iptables_match *match;
};
/* Include file for additions: new matches and targets. */
struct iptables_match
{
struct iptables_match *next;
ipt_chainlabel name;
/* Revision of match (0 by default). */
u_int8_t revision;
const char *version;
/* Size of match data. */
size_t size;
/* Size of match data relevent for userspace comparison purposes */
size_t userspacesize;
/* Function which prints out usage message. */
void (*help)(void);
/* Initialize the match. */
void (*init)(struct ipt_entry_match *m, unsigned int *nfcache);
/* Function which parses command options; returns true if it
ate an option */
int (*parse)(int c, char **argv, int invert, unsigned int *flags,
const struct ipt_entry *entry,
unsigned int *nfcache,
struct ipt_entry_match **match);
/* Final check; exit if not ok. */
void (*final_check)(unsigned int flags);
/* Prints out the match iff non-NULL: put space at end */
void (*print)(const struct ipt_ip *ip,
const struct ipt_entry_match *match, int numeric);
/* Saves the match info in parsable form to stdout. */
void (*save)(const struct ipt_ip *ip,
const struct ipt_entry_match *match);
/* Pointer to list of extra command-line options */
const struct option *extra_opts;
/* Ignore these men behind the curtain: */
unsigned int option_offset;
struct ipt_entry_match *m;
unsigned int mflags;
#ifdef NO_SHARED_LIBS
unsigned int loaded; /* simulate loading so options are merged properly */
#endif
};
struct iptables_target
{
struct iptables_target *next;
ipt_chainlabel name;
/* Revision of target (0 by default). */
u_int8_t revision;
const char *version;
/* Size of target data. */
size_t size;
/* Size of target data relevent for userspace comparison purposes */
size_t userspacesize;
/* Function which prints out usage message. */
void (*help)(void);
/* Initialize the target. */
void (*init)(struct ipt_entry_target *t, unsigned int *nfcache);
/* Function which parses command options; returns true if it
ate an option */
int (*parse)(int c, char **argv, int invert, unsigned int *flags,
const struct ipt_entry *entry,
struct ipt_entry_target **target);
/* Final check; exit if not ok. */
void (*final_check)(unsigned int flags);
/* Prints out the target iff non-NULL: put space at end */
void (*print)(const struct ipt_ip *ip,
const struct ipt_entry_target *target, int numeric);
/* Saves the targinfo in parsable form to stdout. */
void (*save)(const struct ipt_ip *ip,
const struct ipt_entry_target *target);
/* Pointer to list of extra command-line options */
struct option *extra_opts;
/* Ignore these men behind the curtain: */
unsigned int option_offset;
struct ipt_entry_target *t;
unsigned int tflags;
unsigned int used;
#ifdef NO_SHARED_LIBS
unsigned int loaded; /* simulate loading so options are merged properly */
#endif
};
extern int line;
/* Your shared library should call one of these. */ /* Your shared library should call one of these. */
extern void register_match(struct iptables_match *me); extern int do_command4(int argc, char *argv[], char **table,
extern void register_target(struct iptables_target *me); struct xtc_handle **handle, bool restore);
extern void xtables_register_target(struct iptables_target *me); extern int delete_chain4(const xt_chainlabel chain, int verbose,
extern int build_st(struct iptables_target *target, struct ipt_entry_target *t); struct xtc_handle *handle);
extern int flush_entries4(const xt_chainlabel chain, int verbose,
extern struct in_addr *dotted_to_addr(const char *dotted); struct xtc_handle *handle);
extern char *addr_to_dotted(const struct in_addr *addrp); extern int for_each_chain4(int (*fn)(const xt_chainlabel, int, struct xtc_handle *),
extern char *addr_to_anyname(const struct in_addr *addr); int verbose, int builtinstoo, struct xtc_handle *handle);
extern char *mask_to_dotted(const struct in_addr *mask); extern void print_rule4(const struct ipt_entry *e,
struct xtc_handle *handle, const char *chain, int counters);
extern void parse_hostnetworkmask(const char *name, struct in_addr **addrpp,
struct in_addr *maskp, unsigned int *naddrs);
extern u_int16_t parse_protocol(const char *s);
extern int do_command(int argc, char *argv[], char **table,
iptc_handle_t *handle);
/* Keeping track of external matches and targets: linked lists. */
extern struct iptables_match *iptables_matches;
extern struct iptables_target *iptables_targets;
enum ipt_tryload { extern struct xtables_globals iptables_globals;
DONT_LOAD,
TRY_LOAD,
LOAD_MUST_SUCCEED
};
extern struct iptables_target *find_target(const char *name, enum ipt_tryload); extern struct xtables_globals xtables_globals;
extern struct iptables_match *find_match(const char *name, enum ipt_tryload, struct iptables_rule_match **match);
extern int delete_chain(const ipt_chainlabel chain, int verbose,
iptc_handle_t *handle);
extern int flush_entries(const ipt_chainlabel chain, int verbose,
iptc_handle_t *handle);
extern int for_each_chain(int (*fn)(const ipt_chainlabel, int, iptc_handle_t *),
int verbose, int builtinstoo, iptc_handle_t *handle);
#endif /*_IPTABLES_USER_H*/ #endif /*_IPTABLES_USER_H*/
include/iptables/internal.h 0 → 100644
View file @ 5cd1adba
#ifndef IPTABLES_INTERNAL_H
#define IPTABLES_INTERNAL_H 1
#define IPTABLES_VERSION "1.6.0"
/**
* Program's own name and version.
*/
extern const char *program_name, *program_version;
extern int line;
#endif /* IPTABLES_INTERNAL_H */
include/libiptc/ipt_kernel_headers.h
View file @ 5cd1adba
...@@ -5,22 +5,11 @@ ...@@ -5,22 +5,11 @@
#include <limits.h> #include <limits.h>
#if defined(__GLIBC__) && __GLIBC__ == 2
#include <netinet/ip.h> #include <netinet/ip.h>
#include <netinet/in.h> #include <netinet/in.h>
#include <netinet/ip_icmp.h> #include <netinet/ip_icmp.h>
#include <netinet/tcp.h> #include <netinet/tcp.h>
#include <netinet/udp.h> #include <netinet/udp.h>
#include <net/if.h>
#include <sys/types.h> #include <sys/types.h>
#else /* libc5 */
#include <sys/socket.h>
#include <linux/ip.h>
#include <linux/in.h>
#include <linux/if.h>
#include <linux/icmp.h>
#include <linux/tcp.h>
#include <linux/udp.h>
#include <linux/types.h>
#include <linux/in6.h>
#endif
#endif #endif
include/libiptc/libip6tc.h
View file @ 5cd1adba
...@@ -2,153 +2,160 @@ ...@@ -2,153 +2,160 @@
#define _LIBIP6TC_H #define _LIBIP6TC_H
/* Library which manipulates firewall rules. Version 0.2. */ /* Library which manipulates firewall rules. Version 0.2. */
#include <linux/types.h>
#include <libiptc/ipt_kernel_headers.h> #include <libiptc/ipt_kernel_headers.h>
#include <linux/netfilter_ipv6/ip6_tables.h> #ifdef __cplusplus
# include <climits>
#ifndef IP6T_MIN_ALIGN #else
#define IP6T_MIN_ALIGN (__alignof__(struct ip6t_entry)) # include <limits.h> /* INT_MAX in ip6_tables.h */
#endif #endif
#define IP6T_ALIGN(s) (((s) + (IP6T_MIN_ALIGN-1)) & ~(IP6T_MIN_ALIGN-1)) #include <linux/netfilter_ipv6/ip6_tables.h>
#include <libiptc/xtcshared.h>
typedef char ip6t_chainlabel[32]; #define ip6tc_handle xtc_handle
#define ip6t_chainlabel xt_chainlabel
#define IP6TC_LABEL_ACCEPT "ACCEPT" #define IP6TC_LABEL_ACCEPT "ACCEPT"
#define IP6TC_LABEL_DROP "DROP" #define IP6TC_LABEL_DROP "DROP"
#define IP6TC_LABEL_QUEUE "QUEUE" #define IP6TC_LABEL_QUEUE "QUEUE"
#define IP6TC_LABEL_RETURN "RETURN" #define IP6TC_LABEL_RETURN "RETURN"
/* Transparent handle type. */
typedef struct ip6tc_handle *ip6tc_handle_t;
/* Does this chain exist? */ /* Does this chain exist? */
int ip6tc_is_chain(const char *chain, const ip6tc_handle_t handle); int ip6tc_is_chain(const char *chain, struct xtc_handle *const handle);
/* Take a snapshot of the rules. Returns NULL on error. */ /* Take a snapshot of the rules. Returns NULL on error. */
ip6tc_handle_t ip6tc_init(const char *tablename); struct xtc_handle *ip6tc_init(const char *tablename);
/* Cleanup after ip6tc_init(). */ /* Cleanup after ip6tc_init(). */
void ip6tc_free(ip6tc_handle_t *h); void ip6tc_free(struct xtc_handle *h);
/* Iterator functions to run through the chains. Returns NULL at end. */ /* Iterator functions to run through the chains. Returns NULL at end. */
const char *ip6tc_first_chain(ip6tc_handle_t *handle); const char *ip6tc_first_chain(struct xtc_handle *handle);
const char *ip6tc_next_chain(ip6tc_handle_t *handle); const char *ip6tc_next_chain(struct xtc_handle *handle);
/* Get first rule in the given chain: NULL for empty chain. */ /* Get first rule in the given chain: NULL for empty chain. */
const struct ip6t_entry *ip6tc_first_rule(const char *chain, const struct ip6t_entry *ip6tc_first_rule(const char *chain,
ip6tc_handle_t *handle); struct xtc_handle *handle);
/* Returns NULL when rules run out. */ /* Returns NULL when rules run out. */
const struct ip6t_entry *ip6tc_next_rule(const struct ip6t_entry *prev, const struct ip6t_entry *ip6tc_next_rule(const struct ip6t_entry *prev,
ip6tc_handle_t *handle); struct xtc_handle *handle);
/* Returns a pointer to the target name of this position. */ /* Returns a pointer to the target name of this position. */
const char *ip6tc_get_target(const struct ip6t_entry *e, const char *ip6tc_get_target(const struct ip6t_entry *e,
ip6tc_handle_t *handle); struct xtc_handle *handle);
/* Is this a built-in chain? */ /* Is this a built-in chain? */
int ip6tc_builtin(const char *chain, const ip6tc_handle_t handle); int ip6tc_builtin(const char *chain, struct xtc_handle *const handle);
/* Get the policy of a given built-in chain */ /* Get the policy of a given built-in chain */
const char *ip6tc_get_policy(const char *chain, const char *ip6tc_get_policy(const char *chain,
struct ip6t_counters *counters, struct xt_counters *counters,
ip6tc_handle_t *handle); struct xtc_handle *handle);
/* These functions return TRUE for OK or 0 and set errno. If errno == /* These functions return TRUE for OK or 0 and set errno. If errno ==
0, it means there was a version error (ie. upgrade libiptc). */ 0, it means there was a version error (ie. upgrade libiptc). */
/* Rule numbers start at 1 for the first rule. */ /* Rule numbers start at 1 for the first rule. */
/* Insert the entry `fw' in chain `chain' into position `rulenum'. */ /* Insert the entry `fw' in chain `chain' into position `rulenum'. */
int ip6tc_insert_entry(const ip6t_chainlabel chain, int ip6tc_insert_entry(const xt_chainlabel chain,
const struct ip6t_entry *e, const struct ip6t_entry *e,
unsigned int rulenum, unsigned int rulenum,
ip6tc_handle_t *handle); struct xtc_handle *handle);
/* Atomically replace rule `rulenum' in `chain' with `fw'. */ /* Atomically replace rule `rulenum' in `chain' with `fw'. */
int ip6tc_replace_entry(const ip6t_chainlabel chain, int ip6tc_replace_entry(const xt_chainlabel chain,
const struct ip6t_entry *e, const struct ip6t_entry *e,
unsigned int rulenum, unsigned int rulenum,
ip6tc_handle_t *handle); struct xtc_handle *handle);
/* Append entry `fw' to chain `chain'. Equivalent to insert with /* Append entry `fw' to chain `chain'. Equivalent to insert with
rulenum = length of chain. */ rulenum = length of chain. */
int ip6tc_append_entry(const ip6t_chainlabel chain, int ip6tc_append_entry(const xt_chainlabel chain,
const struct ip6t_entry *e, const struct ip6t_entry *e,
ip6tc_handle_t *handle); struct xtc_handle *handle);
/* Check whether a matching rule exists */
int ip6tc_check_entry(const xt_chainlabel chain,
const struct ip6t_entry *origfw,
unsigned char *matchmask,
struct xtc_handle *handle);
/* Delete the first rule in `chain' which matches `fw'. */ /* Delete the first rule in `chain' which matches `fw'. */
int ip6tc_delete_entry(const ip6t_chainlabel chain, int ip6tc_delete_entry(const xt_chainlabel chain,
const struct ip6t_entry *origfw, const struct ip6t_entry *origfw,
unsigned char *matchmask, unsigned char *matchmask,
ip6tc_handle_t *handle); struct xtc_handle *handle);
/* Delete the rule in position `rulenum' in `chain'. */ /* Delete the rule in position `rulenum' in `chain'. */
int ip6tc_delete_num_entry(const ip6t_chainlabel chain, int ip6tc_delete_num_entry(const xt_chainlabel chain,
unsigned int rulenum, unsigned int rulenum,
ip6tc_handle_t *handle); struct xtc_handle *handle);
/* Check the packet `fw' on chain `chain'. Returns the verdict, or /* Check the packet `fw' on chain `chain'. Returns the verdict, or
NULL and sets errno. */ NULL and sets errno. */
const char *ip6tc_check_packet(const ip6t_chainlabel chain, const char *ip6tc_check_packet(const xt_chainlabel chain,
struct ip6t_entry *, struct ip6t_entry *,
ip6tc_handle_t *handle); struct xtc_handle *handle);
/* Flushes the entries in the given chain (ie. empties chain). */ /* Flushes the entries in the given chain (ie. empties chain). */
int ip6tc_flush_entries(const ip6t_chainlabel chain, int ip6tc_flush_entries(const xt_chainlabel chain,
ip6tc_handle_t *handle); struct xtc_handle *handle);
/* Zeroes the counters in a chain. */ /* Zeroes the counters in a chain. */
int ip6tc_zero_entries(const ip6t_chainlabel chain, int ip6tc_zero_entries(const xt_chainlabel chain,
ip6tc_handle_t *handle); struct xtc_handle *handle);
/* Creates a new chain. */ /* Creates a new chain. */
int ip6tc_create_chain(const ip6t_chainlabel chain, int ip6tc_create_chain(const xt_chainlabel chain,
ip6tc_handle_t *handle); struct xtc_handle *handle);
/* Deletes a chain. */ /* Deletes a chain. */
int ip6tc_delete_chain(const ip6t_chainlabel chain, int ip6tc_delete_chain(const xt_chainlabel chain,
ip6tc_handle_t *handle); struct xtc_handle *handle);
/* Renames a chain. */ /* Renames a chain. */
int ip6tc_rename_chain(const ip6t_chainlabel oldname, int ip6tc_rename_chain(const xt_chainlabel oldname,
const ip6t_chainlabel newname, const xt_chainlabel newname,
ip6tc_handle_t *handle); struct xtc_handle *handle);
/* Sets the policy on a built-in chain. */ /* Sets the policy on a built-in chain. */
int ip6tc_set_policy(const ip6t_chainlabel chain, int ip6tc_set_policy(const xt_chainlabel chain,
const ip6t_chainlabel policy, const xt_chainlabel policy,
struct ip6t_counters *counters, struct xt_counters *counters,
ip6tc_handle_t *handle); struct xtc_handle *handle);
/* Get the number of references to this chain */ /* Get the number of references to this chain */
int ip6tc_get_references(unsigned int *ref, const ip6t_chainlabel chain, int ip6tc_get_references(unsigned int *ref, const xt_chainlabel chain,
ip6tc_handle_t *handle); struct xtc_handle *handle);
/* read packet and byte counters for a specific rule */ /* read packet and byte counters for a specific rule */
struct ip6t_counters *ip6tc_read_counter(const ip6t_chainlabel chain, struct xt_counters *ip6tc_read_counter(const xt_chainlabel chain,
unsigned int rulenum, unsigned int rulenum,
ip6tc_handle_t *handle); struct xtc_handle *handle);
/* zero packet and byte counters for a specific rule */ /* zero packet and byte counters for a specific rule */
int ip6tc_zero_counter(const ip6t_chainlabel chain, int ip6tc_zero_counter(const xt_chainlabel chain,
unsigned int rulenum, unsigned int rulenum,
ip6tc_handle_t *handle); struct xtc_handle *handle);
/* set packet and byte counters for a specific rule */ /* set packet and byte counters for a specific rule */
int ip6tc_set_counter(const ip6t_chainlabel chain, int ip6tc_set_counter(const xt_chainlabel chain,
unsigned int rulenum, unsigned int rulenum,
struct ip6t_counters *counters, struct xt_counters *counters,
ip6tc_handle_t *handle); struct xtc_handle *handle);
/* Makes the actual changes. */ /* Makes the actual changes. */
int ip6tc_commit(ip6tc_handle_t *handle); int ip6tc_commit(struct xtc_handle *handle);
/* Get raw socket. */ /* Get raw socket. */
int ip6tc_get_raw_socket(); int ip6tc_get_raw_socket(void);
/* Translates errno numbers into more human-readable form than strerror. */ /* Translates errno numbers into more human-readable form than strerror. */
const char *ip6tc_strerror(int err); const char *ip6tc_strerror(int err);
/* Return prefix length, or -1 if not contiguous */ extern void dump_entries6(struct xtc_handle *const);
int ipv6_prefix_length(const struct in6_addr *a);
extern const struct xtc_ops ip6tc_ops;
#endif /* _LIBIP6TC_H */ #endif /* _LIBIP6TC_H */
include/libiptc/libiptc.h
View file @ 5cd1adba
...@@ -2,155 +2,157 @@ ...@@ -2,155 +2,157 @@
#define _LIBIPTC_H #define _LIBIPTC_H
/* Library which manipulates filtering rules. */ /* Library which manipulates filtering rules. */
#include <linux/types.h>
#include <libiptc/ipt_kernel_headers.h> #include <libiptc/ipt_kernel_headers.h>
#ifdef __cplusplus
# include <climits>
#else
# include <limits.h> /* INT_MAX in ip_tables.h */
#endif
#include <linux/netfilter_ipv4/ip_tables.h> #include <linux/netfilter_ipv4/ip_tables.h>
#include <libiptc/xtcshared.h>
#ifdef __cplusplus #ifdef __cplusplus
extern "C" { extern "C" {
#endif #endif
#ifndef IPT_MIN_ALIGN #define iptc_handle xtc_handle
/* ipt_entry has pointers and u_int64_t's in it, so if you align to #define ipt_chainlabel xt_chainlabel
it, you'll also align to any crazy matches and targets someone
might write */
#define IPT_MIN_ALIGN (__alignof__(struct ipt_entry))
#endif
#define IPT_ALIGN(s) (((s) + ((IPT_MIN_ALIGN)-1)) & ~((IPT_MIN_ALIGN)-1))
typedef char ipt_chainlabel[32];
#define IPTC_LABEL_ACCEPT "ACCEPT" #define IPTC_LABEL_ACCEPT "ACCEPT"
#define IPTC_LABEL_DROP "DROP" #define IPTC_LABEL_DROP "DROP"
#define IPTC_LABEL_QUEUE "QUEUE" #define IPTC_LABEL_QUEUE "QUEUE"
#define IPTC_LABEL_RETURN "RETURN" #define IPTC_LABEL_RETURN "RETURN"
/* Transparent handle type. */
typedef struct iptc_handle *iptc_handle_t;
/* Does this chain exist? */ /* Does this chain exist? */
int iptc_is_chain(const char *chain, const iptc_handle_t handle); int iptc_is_chain(const char *chain, struct xtc_handle *const handle);
/* Take a snapshot of the rules. Returns NULL on error. */ /* Take a snapshot of the rules. Returns NULL on error. */
iptc_handle_t iptc_init(const char *tablename); struct xtc_handle *iptc_init(const char *tablename);
/* Cleanup after iptc_init(). */ /* Cleanup after iptc_init(). */
void iptc_free(iptc_handle_t *h); void iptc_free(struct xtc_handle *h);
/* Iterator functions to run through the chains. Returns NULL at end. */ /* Iterator functions to run through the chains. Returns NULL at end. */
const char *iptc_first_chain(iptc_handle_t *handle); const char *iptc_first_chain(struct xtc_handle *handle);
const char *iptc_next_chain(iptc_handle_t *handle); const char *iptc_next_chain(struct xtc_handle *handle);
/* Get first rule in the given chain: NULL for empty chain. */ /* Get first rule in the given chain: NULL for empty chain. */
const struct ipt_entry *iptc_first_rule(const char *chain, const struct ipt_entry *iptc_first_rule(const char *chain,
iptc_handle_t *handle); struct xtc_handle *handle);
/* Returns NULL when rules run out. */ /* Returns NULL when rules run out. */
const struct ipt_entry *iptc_next_rule(const struct ipt_entry *prev, const struct ipt_entry *iptc_next_rule(const struct ipt_entry *prev,
iptc_handle_t *handle); struct xtc_handle *handle);
/* Returns a pointer to the target name of this entry. */ /* Returns a pointer to the target name of this entry. */
const char *iptc_get_target(const struct ipt_entry *e, const char *iptc_get_target(const struct ipt_entry *e,
iptc_handle_t *handle); struct xtc_handle *handle);
/* Is this a built-in chain? */ /* Is this a built-in chain? */
int iptc_builtin(const char *chain, const iptc_handle_t handle); int iptc_builtin(const char *chain, struct xtc_handle *const handle);
/* Get the policy of a given built-in chain */ /* Get the policy of a given built-in chain */
const char *iptc_get_policy(const char *chain, const char *iptc_get_policy(const char *chain,
struct ipt_counters *counter, struct xt_counters *counter,
iptc_handle_t *handle); struct xtc_handle *handle);
/* These functions return TRUE for OK or 0 and set errno. If errno == /* These functions return TRUE for OK or 0 and set errno. If errno ==
0, it means there was a version error (ie. upgrade libiptc). */ 0, it means there was a version error (ie. upgrade libiptc). */
/* Rule numbers start at 1 for the first rule. */ /* Rule numbers start at 1 for the first rule. */
/* Insert the entry `e' in chain `chain' into position `rulenum'. */ /* Insert the entry `e' in chain `chain' into position `rulenum'. */
int iptc_insert_entry(const ipt_chainlabel chain, int iptc_insert_entry(const xt_chainlabel chain,
const struct ipt_entry *e, const struct ipt_entry *e,
unsigned int rulenum, unsigned int rulenum,
iptc_handle_t *handle); struct xtc_handle *handle);
/* Atomically replace rule `rulenum' in `chain' with `e'. */ /* Atomically replace rule `rulenum' in `chain' with `e'. */
int iptc_replace_entry(const ipt_chainlabel chain, int iptc_replace_entry(const xt_chainlabel chain,
const struct ipt_entry *e, const struct ipt_entry *e,
unsigned int rulenum, unsigned int rulenum,
iptc_handle_t *handle); struct xtc_handle *handle);
/* Append entry `e' to chain `chain'. Equivalent to insert with /* Append entry `e' to chain `chain'. Equivalent to insert with
rulenum = length of chain. */ rulenum = length of chain. */
int iptc_append_entry(const ipt_chainlabel chain, int iptc_append_entry(const xt_chainlabel chain,
const struct ipt_entry *e, const struct ipt_entry *e,
iptc_handle_t *handle); struct xtc_handle *handle);
/* Check whether a mathching rule exists */
int iptc_check_entry(const xt_chainlabel chain,
const struct ipt_entry *origfw,
unsigned char *matchmask,
struct xtc_handle *handle);
/* Delete the first rule in `chain' which matches `e', subject to /* Delete the first rule in `chain' which matches `e', subject to
matchmask (array of length == origfw) */ matchmask (array of length == origfw) */
int iptc_delete_entry(const ipt_chainlabel chain, int iptc_delete_entry(const xt_chainlabel chain,
const struct ipt_entry *origfw, const struct ipt_entry *origfw,
unsigned char *matchmask, unsigned char *matchmask,
iptc_handle_t *handle); struct xtc_handle *handle);
/* Delete the rule in position `rulenum' in `chain'. */ /* Delete the rule in position `rulenum' in `chain'. */
int iptc_delete_num_entry(const ipt_chainlabel chain, int iptc_delete_num_entry(const xt_chainlabel chain,
unsigned int rulenum, unsigned int rulenum,
iptc_handle_t *handle); struct xtc_handle *handle);
/* Check the packet `e' on chain `chain'. Returns the verdict, or /* Check the packet `e' on chain `chain'. Returns the verdict, or
NULL and sets errno. */ NULL and sets errno. */
const char *iptc_check_packet(const ipt_chainlabel chain, const char *iptc_check_packet(const xt_chainlabel chain,
struct ipt_entry *entry, struct ipt_entry *entry,
iptc_handle_t *handle); struct xtc_handle *handle);
/* Flushes the entries in the given chain (ie. empties chain). */ /* Flushes the entries in the given chain (ie. empties chain). */
int iptc_flush_entries(const ipt_chainlabel chain, int iptc_flush_entries(const xt_chainlabel chain,
iptc_handle_t *handle); struct xtc_handle *handle);
/* Zeroes the counters in a chain. */ /* Zeroes the counters in a chain. */
int iptc_zero_entries(const ipt_chainlabel chain, int iptc_zero_entries(const xt_chainlabel chain,
iptc_handle_t *handle); struct xtc_handle *handle);
/* Creates a new chain. */ /* Creates a new chain. */
int iptc_create_chain(const ipt_chainlabel chain, int iptc_create_chain(const xt_chainlabel chain,
iptc_handle_t *handle); struct xtc_handle *handle);
/* Deletes a chain. */ /* Deletes a chain. */
int iptc_delete_chain(const ipt_chainlabel chain, int iptc_delete_chain(const xt_chainlabel chain,
iptc_handle_t *handle); struct xtc_handle *handle);
/* Renames a chain. */ /* Renames a chain. */
int iptc_rename_chain(const ipt_chainlabel oldname, int iptc_rename_chain(const xt_chainlabel oldname,
const ipt_chainlabel newname, const xt_chainlabel newname,
iptc_handle_t *handle); struct xtc_handle *handle);
/* Sets the policy on a built-in chain. */ /* Sets the policy on a built-in chain. */
int iptc_set_policy(const ipt_chainlabel chain, int iptc_set_policy(const xt_chainlabel chain,
const ipt_chainlabel policy, const xt_chainlabel policy,
struct ipt_counters *counters, struct xt_counters *counters,
iptc_handle_t *handle); struct xtc_handle *handle);
/* Get the number of references to this chain */ /* Get the number of references to this chain */
int iptc_get_references(unsigned int *ref, int iptc_get_references(unsigned int *ref,
const ipt_chainlabel chain, const xt_chainlabel chain,
iptc_handle_t *handle); struct xtc_handle *handle);
/* read packet and byte counters for a specific rule */ /* read packet and byte counters for a specific rule */
struct ipt_counters *iptc_read_counter(const ipt_chainlabel chain, struct xt_counters *iptc_read_counter(const xt_chainlabel chain,
unsigned int rulenum, unsigned int rulenum,
iptc_handle_t *handle); struct xtc_handle *handle);
/* zero packet and byte counters for a specific rule */ /* zero packet and byte counters for a specific rule */
int iptc_zero_counter(const ipt_chainlabel chain, int iptc_zero_counter(const xt_chainlabel chain,
unsigned int rulenum, unsigned int rulenum,
iptc_handle_t *handle); struct xtc_handle *handle);
/* set packet and byte counters for a specific rule */ /* set packet and byte counters for a specific rule */
int iptc_set_counter(const ipt_chainlabel chain, int iptc_set_counter(const xt_chainlabel chain,
unsigned int rulenum, unsigned int rulenum,
struct ipt_counters *counters, struct xt_counters *counters,
iptc_handle_t *handle); struct xtc_handle *handle);
/* Makes the actual changes. */ /* Makes the actual changes. */
int iptc_commit(iptc_handle_t *handle); int iptc_commit(struct xtc_handle *handle);
/* Get raw socket. */ /* Get raw socket. */
int iptc_get_raw_socket(void); int iptc_get_raw_socket(void);
...@@ -158,6 +160,10 @@ int iptc_get_raw_socket(void); ...@@ -158,6 +160,10 @@ int iptc_get_raw_socket(void);
/* Translates errno numbers into more human-readable form than strerror. */ /* Translates errno numbers into more human-readable form than strerror. */
const char *iptc_strerror(int err); const char *iptc_strerror(int err);
extern void dump_entries(struct xtc_handle *const);
extern const struct xtc_ops iptc_ops;
#ifdef __cplusplus #ifdef __cplusplus
} }
#endif #endif
......
include/libiptc/libxtc.h 0 → 100644
View file @ 5cd1adba
#ifndef _LIBXTC_H
#define _LIBXTC_H
/* Library which manipulates filtering rules. */
#include <libiptc/ipt_kernel_headers.h>
#include <linux/netfilter/x_tables.h>
#ifdef __cplusplus
extern "C" {
#endif
#ifndef XT_MIN_ALIGN
/* xt_entry has pointers and u_int64_t's in it, so if you align to
it, you'll also align to any crazy matches and targets someone
might write */
#define XT_MIN_ALIGN (__alignof__(struct xt_entry))
#endif
#ifndef XT_ALIGN
#define XT_ALIGN(s) (((s) + ((XT_MIN_ALIGN)-1)) & ~((XT_MIN_ALIGN)-1))
#endif
#define XTC_LABEL_ACCEPT "ACCEPT"
#define XTC_LABEL_DROP "DROP"
#define XTC_LABEL_QUEUE "QUEUE"
#define XTC_LABEL_RETURN "RETURN"
#ifdef __cplusplus
}
#endif
#endif /* _LIBXTC_H */
include/libiptc/xtcshared.h 0 → 100644
View file @ 5cd1adba
#ifndef _LIBXTC_SHARED_H
#define _LIBXTC_SHARED_H 1
typedef char xt_chainlabel[32];
struct xtc_handle;
struct xt_counters;
struct xtc_ops {
int (*commit)(struct xtc_handle *);
void (*free)(struct xtc_handle *);
int (*builtin)(const char *, struct xtc_handle *const);
int (*is_chain)(const char *, struct xtc_handle *const);
int (*flush_entries)(const xt_chainlabel, struct xtc_handle *);
int (*create_chain)(const xt_chainlabel, struct xtc_handle *);
int (*set_policy)(const xt_chainlabel, const xt_chainlabel,
struct xt_counters *, struct xtc_handle *);
const char *(*strerror)(int);
};
#endif /* _LIBXTC_SHARED_H */
include/xtables.h 0 → 100644
View file @ 5cd1adba
This diff is collapsed.
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7