1 #ifndef _NFT_SHARED_H_ 2 #define _NFT_SHARED_H_ 3 4 #include <stdbool.h> 5 6 #include <libnftnl/rule.h> 7 #include <libnftnl/expr.h> 8 #include <libnftnl/chain.h> 9 10 #include <linux/netfilter_arp/arp_tables.h> 11 #include <linux/netfilter/nf_tables.h> 12 13 #include "xshared.h" 14 15 #ifdef DEBUG 16 #define NLDEBUG 17 #define DEBUG_DEL 18 #endif 19 20 /* 21 * iptables print output emulation 22 */ 23 24 #define FMT_NUMERIC 0x0001 25 #define FMT_NOCOUNTS 0x0002 26 #define FMT_KILOMEGAGIGA 0x0004 27 #define FMT_OPTIONS 0x0008 28 #define FMT_NOTABLE 0x0010 29 #define FMT_NOTARGET 0x0020 30 #define FMT_VIA 0x0040 31 #define FMT_NONEWLINE 0x0080 32 #define FMT_LINENUMBERS 0x0100 33 34 #define FMT_PRINT_RULE (FMT_NOCOUNTS | FMT_OPTIONS | FMT_VIA \ 35 | FMT_NUMERIC | FMT_NOTABLE) 36 #define FMT(tab,notab) ((format) & FMT_NOTABLE ? (notab) : (tab)) 37 38 struct xtables_args; 39 struct nft_handle; 40 struct xt_xlate; 41 42 enum { 43 NFT_XT_CTX_PAYLOAD = (1 << 0), 44 NFT_XT_CTX_META = (1 << 1), 45 NFT_XT_CTX_BITWISE = (1 << 2), 46 NFT_XT_CTX_IMMEDIATE = (1 << 3), 47 NFT_XT_CTX_PREV_PAYLOAD = (1 << 4), 48 }; 49 50 struct nft_xt_ctx { 51 struct iptables_command_state *cs; 52 struct nftnl_expr_iter *iter; 53 struct nft_handle *h; 54 uint32_t flags; 55 const char *table; 56 57 uint32_t reg; 58 struct { 59 uint32_t base; 60 uint32_t offset; 61 uint32_t len; 62 } payload, prev_payload; 63 struct { 64 uint32_t key; 65 } meta; 66 struct { 67 uint32_t data[4]; 68 uint32_t len, reg; 69 } immediate; 70 struct { 71 uint32_t mask[4]; 72 uint32_t xor[4]; 73 } bitwise; 74 }; 75 76 struct nft_family_ops { 77 int (*add)(struct nft_handle *h, struct nftnl_rule *r, void *data); 78 bool (*is_same)(const void *data_a, 79 const void *data_b); 80 void (*print_payload)(struct nftnl_expr *e, 81 struct nftnl_expr_iter *iter); 82 void (*parse_meta)(struct nft_xt_ctx *ctx, struct nftnl_expr *e, 83 void *data); 84 void (*parse_payload)(struct nft_xt_ctx *ctx, struct nftnl_expr *e, 85 void *data); 86 void (*parse_bitwise)(struct nft_xt_ctx *ctx, struct nftnl_expr *e, 87 void *data); 88 void (*parse_cmp)(struct nft_xt_ctx *ctx, struct nftnl_expr *e, 89 void *data); 90 void (*parse_lookup)(struct nft_xt_ctx *ctx, struct nftnl_expr *e, 91 void *data); 92 void (*parse_immediate)(const char *jumpto, bool nft_goto, void *data); 93 94 void (*print_table_header)(const char *tablename); 95 void (*print_header)(unsigned int format, const char *chain, 96 const char *pol, 97 const struct xt_counters *counters, bool basechain, 98 uint32_t refs, uint32_t entries); 99 void (*print_rule)(struct nft_handle *h, struct nftnl_rule *r, 100 unsigned int num, unsigned int format); 101 void (*save_rule)(const void *data, unsigned int format); 102 void (*save_chain)(const struct nftnl_chain *c, const char *policy); 103 void (*proto_parse)(struct iptables_command_state *cs, 104 struct xtables_args *args); 105 void (*post_parse)(int command, struct iptables_command_state *cs, 106 struct xtables_args *args); 107 void (*parse_match)(struct xtables_match *m, void *data); 108 void (*parse_target)(struct xtables_target *t, void *data); 109 void (*rule_to_cs)(struct nft_handle *h, const struct nftnl_rule *r, 110 struct iptables_command_state *cs); 111 void (*clear_cs)(struct iptables_command_state *cs); 112 int (*xlate)(const void *data, struct xt_xlate *xl); 113 }; 114 115 void add_meta(struct nftnl_rule *r, uint32_t key); 116 void add_payload(struct nftnl_rule *r, int offset, int len, uint32_t base); 117 void add_bitwise(struct nftnl_rule *r, uint8_t *mask, size_t len); 118 void add_bitwise_u16(struct nftnl_rule *r, uint16_t mask, uint16_t xor); 119 void add_cmp_ptr(struct nftnl_rule *r, uint32_t op, void *data, size_t len); 120 void add_cmp_u8(struct nftnl_rule *r, uint8_t val, uint32_t op); 121 void add_cmp_u16(struct nftnl_rule *r, uint16_t val, uint32_t op); 122 void add_cmp_u32(struct nftnl_rule *r, uint32_t val, uint32_t op); 123 void add_iniface(struct nftnl_rule *r, char *iface, uint32_t op); 124 void add_outiface(struct nftnl_rule *r, char *iface, uint32_t op); 125 void add_addr(struct nftnl_rule *r, enum nft_payload_bases base, int offset, 126 void *data, void *mask, size_t len, uint32_t op); 127 void add_proto(struct nftnl_rule *r, int offset, size_t len, 128 uint8_t proto, uint32_t op); 129 void add_l4proto(struct nftnl_rule *r, uint8_t proto, uint32_t op); 130 void add_compat(struct nftnl_rule *r, uint32_t proto, bool inv); 131 132 bool is_same_interfaces(const char *a_iniface, const char *a_outiface, 133 unsigned const char *a_iniface_mask, 134 unsigned const char *a_outiface_mask, 135 const char *b_iniface, const char *b_outiface, 136 unsigned const char *b_iniface_mask, 137 unsigned const char *b_outiface_mask); 138 139 int parse_meta(struct nftnl_expr *e, uint8_t key, char *iniface, 140 unsigned char *iniface_mask, char *outiface, 141 unsigned char *outiface_mask, uint8_t *invflags); 142 void print_proto(uint16_t proto, int invert); 143 void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv); 144 void nft_rule_to_iptables_command_state(struct nft_handle *h, 145 const struct nftnl_rule *r, 146 struct iptables_command_state *cs); 147 void nft_clear_iptables_command_state(struct iptables_command_state *cs); 148 void print_header(unsigned int format, const char *chain, const char *pol, 149 const struct xt_counters *counters, bool basechain, 150 uint32_t refs, uint32_t entries); 151 void print_rule_details(const struct iptables_command_state *cs, 152 const char *targname, uint8_t flags, 153 uint8_t invflags, uint8_t proto, 154 unsigned int num, unsigned int format); 155 void print_matches_and_target(struct iptables_command_state *cs, 156 unsigned int format); 157 void save_rule_details(const struct iptables_command_state *cs, 158 uint8_t invflags, uint16_t proto, 159 const char *iniface, 160 unsigned const char *iniface_mask, 161 const char *outiface, 162 unsigned const char *outiface_mask); 163 void nft_ipv46_save_chain(const struct nftnl_chain *c, const char *policy); 164 void save_matches_and_target(const struct iptables_command_state *cs, 165 bool goto_flag, const void *fw, 166 unsigned int format); 167 168 struct nft_family_ops *nft_family_ops_lookup(int family); 169 170 void nft_ipv46_parse_target(struct xtables_target *t, void *data); 171 172 bool compare_matches(struct xtables_rule_match *mt1, struct xtables_rule_match *mt2); 173 bool compare_targets(struct xtables_target *tg1, struct xtables_target *tg2); 174 175 struct addr_mask { 176 union { 177 struct in_addr *v4; 178 struct in6_addr *v6; 179 } addr; 180 181 unsigned int naddrs; 182 183 union { 184 struct in_addr *v4; 185 struct in6_addr *v6; 186 } mask; 187 }; 188 189 struct xtables_args { 190 int family; 191 uint16_t proto; 192 uint8_t flags; 193 uint8_t invflags; 194 char iniface[IFNAMSIZ], outiface[IFNAMSIZ]; 195 unsigned char iniface_mask[IFNAMSIZ], outiface_mask[IFNAMSIZ]; 196 bool goto_set; 197 const char *shostnetworkmask, *dhostnetworkmask; 198 const char *pcnt, *bcnt; 199 struct addr_mask s, d; 200 unsigned long long pcnt_cnt, bcnt_cnt; 201 }; 202 203 struct nft_xt_cmd_parse { 204 unsigned int command; 205 unsigned int rulenum; 206 char *table; 207 const char *chain; 208 const char *newname; 209 const char *policy; 210 bool restore; 211 int verbose; 212 bool xlate; 213 }; 214 215 void do_parse(struct nft_handle *h, int argc, char *argv[], 216 struct nft_xt_cmd_parse *p, struct iptables_command_state *cs, 217 struct xtables_args *args); 218 219 struct nftnl_chain_list; 220 221 struct nft_xt_restore_cb { 222 void (*table_new)(struct nft_handle *h, const char *table); 223 int (*chain_set)(struct nft_handle *h, const char *table, 224 const char *chain, const char *policy, 225 const struct xt_counters *counters); 226 int (*chain_restore)(struct nft_handle *h, const char *chain, 227 const char *table); 228 229 int (*table_flush)(struct nft_handle *h, const char *table, 230 bool verbose); 231 232 int (*do_command)(struct nft_handle *h, int argc, char *argv[], 233 char **table, bool restore); 234 235 int (*commit)(struct nft_handle *h); 236 int (*abort)(struct nft_handle *h); 237 }; 238 239 struct nft_xt_restore_parse { 240 FILE *in; 241 int testing; 242 const char *tablename; 243 bool commit; 244 const struct nft_xt_restore_cb *cb; 245 }; 246 247 void xtables_restore_parse(struct nft_handle *h, 248 const struct nft_xt_restore_parse *p); 249 250 void nft_check_xt_legacy(int family, bool is_ipt_save); 251 252 #define min(x, y) ((x) < (y) ? (x) : (y)) 253 #define max(x, y) ((x) > (y) ? (x) : (y)) 254 255 #endif 256