1 #ifndef _LIBIP6TC_H 2 #define _LIBIP6TC_H 3 /* Library which manipulates firewall rules. Version 0.2. */ 4 5 #include <linux/types.h> 6 #include <libiptc/ipt_kernel_headers.h> 7 #ifdef __cplusplus 8 # include <climits> 9 #else 10 # include <limits.h> /* INT_MAX in ip6_tables.h */ 11 #endif 12 #include <linux/netfilter_ipv6/ip6_tables.h> 13 #include <libiptc/xtcshared.h> 14 15 #define ip6tc_handle xtc_handle 16 #define ip6t_chainlabel xt_chainlabel 17 18 #define IP6TC_LABEL_ACCEPT "ACCEPT" 19 #define IP6TC_LABEL_DROP "DROP" 20 #define IP6TC_LABEL_QUEUE "QUEUE" 21 #define IP6TC_LABEL_RETURN "RETURN" 22 23 /* Does this chain exist? */ 24 int ip6tc_is_chain(const char *chain, struct xtc_handle *const handle); 25 26 /* Take a snapshot of the rules. Returns NULL on error. */ 27 struct xtc_handle *ip6tc_init(const char *tablename); 28 29 /* Cleanup after ip6tc_init(). */ 30 void ip6tc_free(struct xtc_handle *h); 31 32 /* Iterator functions to run through the chains. Returns NULL at end. */ 33 const char *ip6tc_first_chain(struct xtc_handle *handle); 34 const char *ip6tc_next_chain(struct xtc_handle *handle); 35 36 /* Get first rule in the given chain: NULL for empty chain. */ 37 const struct ip6t_entry *ip6tc_first_rule(const char *chain, 38 struct xtc_handle *handle); 39 40 /* Returns NULL when rules run out. */ 41 const struct ip6t_entry *ip6tc_next_rule(const struct ip6t_entry *prev, 42 struct xtc_handle *handle); 43 44 /* Returns a pointer to the target name of this position. */ 45 const char *ip6tc_get_target(const struct ip6t_entry *e, 46 struct xtc_handle *handle); 47 48 /* Is this a built-in chain? */ 49 int ip6tc_builtin(const char *chain, struct xtc_handle *const handle); 50 51 /* Get the policy of a given built-in chain */ 52 const char *ip6tc_get_policy(const char *chain, 53 struct xt_counters *counters, 54 struct xtc_handle *handle); 55 56 /* These functions return TRUE for OK or 0 and set errno. If errno == 57 0, it means there was a version error (ie. upgrade libiptc). */ 58 /* Rule numbers start at 1 for the first rule. */ 59 60 /* Insert the entry `fw' in chain `chain' into position `rulenum'. */ 61 int ip6tc_insert_entry(const xt_chainlabel chain, 62 const struct ip6t_entry *e, 63 unsigned int rulenum, 64 struct xtc_handle *handle); 65 66 /* Atomically replace rule `rulenum' in `chain' with `fw'. */ 67 int ip6tc_replace_entry(const xt_chainlabel chain, 68 const struct ip6t_entry *e, 69 unsigned int rulenum, 70 struct xtc_handle *handle); 71 72 /* Append entry `fw' to chain `chain'. Equivalent to insert with 73 rulenum = length of chain. */ 74 int ip6tc_append_entry(const xt_chainlabel chain, 75 const struct ip6t_entry *e, 76 struct xtc_handle *handle); 77 78 /* Check whether a matching rule exists */ 79 int ip6tc_check_entry(const xt_chainlabel chain, 80 const struct ip6t_entry *origfw, 81 unsigned char *matchmask, 82 struct xtc_handle *handle); 83 84 /* Delete the first rule in `chain' which matches `fw'. */ 85 int ip6tc_delete_entry(const xt_chainlabel chain, 86 const struct ip6t_entry *origfw, 87 unsigned char *matchmask, 88 struct xtc_handle *handle); 89 90 /* Delete the rule in position `rulenum' in `chain'. */ 91 int ip6tc_delete_num_entry(const xt_chainlabel chain, 92 unsigned int rulenum, 93 struct xtc_handle *handle); 94 95 /* Check the packet `fw' on chain `chain'. Returns the verdict, or 96 NULL and sets errno. */ 97 const char *ip6tc_check_packet(const xt_chainlabel chain, 98 struct ip6t_entry *, 99 struct xtc_handle *handle); 100 101 /* Flushes the entries in the given chain (ie. empties chain). */ 102 int ip6tc_flush_entries(const xt_chainlabel chain, 103 struct xtc_handle *handle); 104 105 /* Zeroes the counters in a chain. */ 106 int ip6tc_zero_entries(const xt_chainlabel chain, 107 struct xtc_handle *handle); 108 109 /* Creates a new chain. */ 110 int ip6tc_create_chain(const xt_chainlabel chain, 111 struct xtc_handle *handle); 112 113 /* Deletes a chain. */ 114 int ip6tc_delete_chain(const xt_chainlabel chain, 115 struct xtc_handle *handle); 116 117 /* Renames a chain. */ 118 int ip6tc_rename_chain(const xt_chainlabel oldname, 119 const xt_chainlabel newname, 120 struct xtc_handle *handle); 121 122 /* Sets the policy on a built-in chain. */ 123 int ip6tc_set_policy(const xt_chainlabel chain, 124 const xt_chainlabel policy, 125 struct xt_counters *counters, 126 struct xtc_handle *handle); 127 128 /* Get the number of references to this chain */ 129 int ip6tc_get_references(unsigned int *ref, const xt_chainlabel chain, 130 struct xtc_handle *handle); 131 132 /* read packet and byte counters for a specific rule */ 133 struct xt_counters *ip6tc_read_counter(const xt_chainlabel chain, 134 unsigned int rulenum, 135 struct xtc_handle *handle); 136 137 /* zero packet and byte counters for a specific rule */ 138 int ip6tc_zero_counter(const xt_chainlabel chain, 139 unsigned int rulenum, 140 struct xtc_handle *handle); 141 142 /* set packet and byte counters for a specific rule */ 143 int ip6tc_set_counter(const xt_chainlabel chain, 144 unsigned int rulenum, 145 struct xt_counters *counters, 146 struct xtc_handle *handle); 147 148 /* Makes the actual changes. */ 149 int ip6tc_commit(struct xtc_handle *handle); 150 151 /* Get raw socket. */ 152 int ip6tc_get_raw_socket(void); 153 154 /* Translates errno numbers into more human-readable form than strerror. */ 155 const char *ip6tc_strerror(int err); 156 157 extern void dump_entries6(struct xtc_handle *const); 158 159 extern const struct xtc_ops ip6tc_ops; 160 161 #endif /* _LIBIP6TC_H */ 162