1 /*
2 * 25-Jul-1998 Major changes to allow for ip chain table
3 *
4 * 3-Jan-2000 Named tables to allow packet selection for different uses.
5 */
6
7 /*
8 * Format of an IP6 firewall descriptor
9 *
10 * src, dst, src_mask, dst_mask are always stored in network byte order.
11 * flags are stored in host byte order (of course).
12 * Port numbers are stored in HOST byte order.
13 */
14
15 #ifndef _IP6_TABLES_H
16 #define _IP6_TABLES_H
17
18 #ifdef __KERNEL__
19 #include <linux/if.h>
20 #include <linux/in6.h>
21 #include <linux/ipv6.h>
22 #include <linux/skbuff.h>
23 #endif
24 #include <linux/types.h>
25 #include <linux/compiler.h>
26 #include <linux/netfilter_ipv6.h>
27
28 #include <linux/netfilter/x_tables.h>
29
30 #define IP6T_FUNCTION_MAXNAMELEN XT_FUNCTION_MAXNAMELEN
31 #define IP6T_TABLE_MAXNAMELEN XT_TABLE_MAXNAMELEN
32
33 #define ip6t_match xt_match
34 #define ip6t_target xt_target
35 #define ip6t_table xt_table
36 #define ip6t_get_revision xt_get_revision
37
38 /* Yes, Virginia, you have to zero the padding. */
39 struct ip6t_ip6 {
40 /* Source and destination IP6 addr */
41 struct in6_addr src, dst;
42 /* Mask for src and dest IP6 addr */
43 struct in6_addr smsk, dmsk;
44 char iniface[IFNAMSIZ], outiface[IFNAMSIZ];
45 unsigned char iniface_mask[IFNAMSIZ], outiface_mask[IFNAMSIZ];
46
47 /* Upper protocol number
48 * - The allowed value is 0 (any) or protocol number of last parsable
49 * header, which is 50 (ESP), 59 (No Next Header), 135 (MH), or
50 * the non IPv6 extension headers.
51 * - The protocol numbers of IPv6 extension headers except of ESP and
52 * MH do not match any packets.
53 * - You also need to set IP6T_FLAGS_PROTO to "flags" to check protocol.
54 */
55 u_int16_t proto;
56 /* TOS to match iff flags & IP6T_F_TOS */
57 u_int8_t tos;
58
59 /* Flags word */
60 u_int8_t flags;
61 /* Inverse flags */
62 u_int8_t invflags;
63 };
64
65 #define ip6t_entry_match xt_entry_match
66 #define ip6t_entry_target xt_entry_target
67 #define ip6t_standard_target xt_standard_target
68
69 #define ip6t_counters xt_counters
70
71 /* Values for "flag" field in struct ip6t_ip6 (general ip6 structure). */
72 #define IP6T_F_PROTO 0x01 /* Set if rule cares about upper
73 protocols */
74 #define IP6T_F_TOS 0x02 /* Match the TOS. */
75 #define IP6T_F_GOTO 0x04 /* Set if jump is a goto */
76 #define IP6T_F_MASK 0x07 /* All possible flag bits mask. */
77
78 /* Values for "inv" field in struct ip6t_ip6. */
79 #define IP6T_INV_VIA_IN 0x01 /* Invert the sense of IN IFACE. */
80 #define IP6T_INV_VIA_OUT 0x02 /* Invert the sense of OUT IFACE */
81 #define IP6T_INV_TOS 0x04 /* Invert the sense of TOS. */
82 #define IP6T_INV_SRCIP 0x08 /* Invert the sense of SRC IP. */
83 #define IP6T_INV_DSTIP 0x10 /* Invert the sense of DST OP. */
84 #define IP6T_INV_FRAG 0x20 /* Invert the sense of FRAG. */
85 #define IP6T_INV_PROTO XT_INV_PROTO
86 #define IP6T_INV_MASK 0x7F /* All possible flag bits mask. */
87
88 /* This structure defines each of the firewall rules. Consists of 3
89 parts which are 1) general IP header stuff 2) match specific
90 stuff 3) the target to perform if the rule matches */
91 struct ip6t_entry
92 {
93 struct ip6t_ip6 ipv6;
94
95 /* Mark with fields that we care about. */
96 unsigned int nfcache;
97
98 /* Size of ipt_entry + matches */
99 u_int16_t target_offset;
100 /* Size of ipt_entry + matches + target */
101 u_int16_t next_offset;
102
103 /* Back pointer */
104 unsigned int comefrom;
105
106 /* Packet and byte counters. */
107 struct xt_counters counters;
108
109 /* The matches (if any), then the target. */
110 unsigned char elems[0];
111 };
112
113 /* Standard entry */
114 struct ip6t_standard
115 {
116 struct ip6t_entry entry;
117 struct ip6t_standard_target target;
118 };
119
120 struct ip6t_error_target
121 {
122 struct ip6t_entry_target target;
123 char errorname[IP6T_FUNCTION_MAXNAMELEN];
124 };
125
126 struct ip6t_error
127 {
128 struct ip6t_entry entry;
129 struct ip6t_error_target target;
130 };
131
132 #define IP6T_ENTRY_INIT(__size) \
133 { \
134 .target_offset = sizeof(struct ip6t_entry), \
135 .next_offset = (__size), \
136 }
137
138 #define IP6T_STANDARD_INIT(__verdict) \
139 { \
140 .entry = IP6T_ENTRY_INIT(sizeof(struct ip6t_standard)), \
141 .target = XT_TARGET_INIT(IP6T_STANDARD_TARGET, \
142 sizeof(struct ip6t_standard_target)), \
143 .target.verdict = -(__verdict) - 1, \
144 }
145
146 #define IP6T_ERROR_INIT \
147 { \
148 .entry = IP6T_ENTRY_INIT(sizeof(struct ip6t_error)), \
149 .target = XT_TARGET_INIT(IP6T_ERROR_TARGET, \
150 sizeof(struct ip6t_error_target)), \
151 .target.errorname = "ERROR", \
152 }
153
154 /*
155 * New IP firewall options for [gs]etsockopt at the RAW IP level.
156 * Unlike BSD Linux inherits IP options so you don't have to use
157 * a raw socket for this. Instead we check rights in the calls.
158 *
159 * ATTENTION: check linux/in6.h before adding new number here.
160 */
161 #define IP6T_BASE_CTL 64
162
163 #define IP6T_SO_SET_REPLACE (IP6T_BASE_CTL)
164 #define IP6T_SO_SET_ADD_COUNTERS (IP6T_BASE_CTL + 1)
165 #define IP6T_SO_SET_MAX IP6T_SO_SET_ADD_COUNTERS
166
167 #define IP6T_SO_GET_INFO (IP6T_BASE_CTL)
168 #define IP6T_SO_GET_ENTRIES (IP6T_BASE_CTL + 1)
169 #define IP6T_SO_GET_REVISION_MATCH (IP6T_BASE_CTL + 4)
170 #define IP6T_SO_GET_REVISION_TARGET (IP6T_BASE_CTL + 5)
171 #define IP6T_SO_GET_MAX IP6T_SO_GET_REVISION_TARGET
172
173 /* CONTINUE verdict for targets */
174 #define IP6T_CONTINUE XT_CONTINUE
175
176 /* For standard target */
177 #define IP6T_RETURN XT_RETURN
178
179 /* TCP/UDP matching stuff */
180 #include <linux/netfilter/xt_tcpudp.h>
181
182 #define ip6t_tcp xt_tcp
183 #define ip6t_udp xt_udp
184
185 /* Values for "inv" field in struct ipt_tcp. */
186 #define IP6T_TCP_INV_SRCPT XT_TCP_INV_SRCPT
187 #define IP6T_TCP_INV_DSTPT XT_TCP_INV_DSTPT
188 #define IP6T_TCP_INV_FLAGS XT_TCP_INV_FLAGS
189 #define IP6T_TCP_INV_OPTION XT_TCP_INV_OPTION
190 #define IP6T_TCP_INV_MASK XT_TCP_INV_MASK
191
192 /* Values for "invflags" field in struct ipt_udp. */
193 #define IP6T_UDP_INV_SRCPT XT_UDP_INV_SRCPT
194 #define IP6T_UDP_INV_DSTPT XT_UDP_INV_DSTPT
195 #define IP6T_UDP_INV_MASK XT_UDP_INV_MASK
196
197 /* ICMP matching stuff */
198 struct ip6t_icmp
199 {
200 u_int8_t type; /* type to match */
201 u_int8_t code[2]; /* range of code */
202 u_int8_t invflags; /* Inverse flags */
203 };
204
205 /* Values for "inv" field for struct ipt_icmp. */
206 #define IP6T_ICMP_INV 0x01 /* Invert the sense of type/code test */
207
208 /* The argument to IP6T_SO_GET_INFO */
209 struct ip6t_getinfo
210 {
211 /* Which table: caller fills this in. */
212 char name[IP6T_TABLE_MAXNAMELEN];
213
214 /* Kernel fills these in. */
215 /* Which hook entry points are valid: bitmask */
216 unsigned int valid_hooks;
217
218 /* Hook entry points: one per netfilter hook. */
219 unsigned int hook_entry[NF_INET_NUMHOOKS];
220
221 /* Underflow points. */
222 unsigned int underflow[NF_INET_NUMHOOKS];
223
224 /* Number of entries */
225 unsigned int num_entries;
226
227 /* Size of entries. */
228 unsigned int size;
229 };
230
231 /* The argument to IP6T_SO_SET_REPLACE. */
232 struct ip6t_replace
233 {
234 /* Which table. */
235 char name[IP6T_TABLE_MAXNAMELEN];
236
237 /* Which hook entry points are valid: bitmask. You can't
238 change this. */
239 unsigned int valid_hooks;
240
241 /* Number of entries */
242 unsigned int num_entries;
243
244 /* Total size of new entries */
245 unsigned int size;
246
247 /* Hook entry points. */
248 unsigned int hook_entry[NF_INET_NUMHOOKS];
249
250 /* Underflow points. */
251 unsigned int underflow[NF_INET_NUMHOOKS];
252
253 /* Information about old entries: */
254 /* Number of counters (must be equal to current number of entries). */
255 unsigned int num_counters;
256 /* The old entries' counters. */
257 struct xt_counters __user *counters;
258
259 /* The entries (hang off end: not really an array). */
260 struct ip6t_entry entries[0];
261 };
262
263 /* The argument to IP6T_SO_ADD_COUNTERS. */
264 #define ip6t_counters_info xt_counters_info
265
266 /* The argument to IP6T_SO_GET_ENTRIES. */
267 struct ip6t_get_entries
268 {
269 /* Which table: user fills this in. */
270 char name[IP6T_TABLE_MAXNAMELEN];
271
272 /* User fills this in: total entry size. */
273 unsigned int size;
274
275 /* The entries. */
276 struct ip6t_entry entrytable[0];
277 };
278
279 /* Standard return verdict, or do jump. */
280 #define IP6T_STANDARD_TARGET XT_STANDARD_TARGET
281 /* Error verdict. */
282 #define IP6T_ERROR_TARGET XT_ERROR_TARGET
283
284 /* Helper functions */
285 static __inline__ struct ip6t_entry_target *
ip6t_get_target(struct ip6t_entry * e)286 ip6t_get_target(struct ip6t_entry *e)
287 {
288 return (void *)e + e->target_offset;
289 }
290
291 /* fn returns 0 to continue iteration */
292 #define IP6T_MATCH_ITERATE(e, fn, args...) \
293 XT_MATCH_ITERATE(struct ip6t_entry, e, fn, ## args)
294
295 /* fn returns 0 to continue iteration */
296 #define IP6T_ENTRY_ITERATE(entries, size, fn, args...) \
297 XT_ENTRY_ITERATE(struct ip6t_entry, entries, size, fn, ## args)
298
299 /*
300 * Main firewall chains definitions and global var's definitions.
301 */
302
303 #ifdef __KERNEL__
304
305 #include <linux/init.h>
306 extern void ip6t_init(void) __init;
307
308 extern struct xt_table *ip6t_register_table(struct net *net,
309 struct xt_table *table,
310 const struct ip6t_replace *repl);
311 extern void ip6t_unregister_table(struct xt_table *table);
312 extern unsigned int ip6t_do_table(struct sk_buff *skb,
313 unsigned int hook,
314 const struct net_device *in,
315 const struct net_device *out,
316 struct xt_table *table);
317
318 /* Check for an extension */
319 extern int ip6t_ext_hdr(u8 nexthdr);
320 /* find specified header and get offset to it */
321 extern int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
322 int target, unsigned short *fragoff);
323
324 extern int ip6_masked_addrcmp(const struct in6_addr *addr1,
325 const struct in6_addr *mask,
326 const struct in6_addr *addr2);
327
328 #define IP6T_ALIGN(s) XT_ALIGN(s)
329
330 #ifdef CONFIG_COMPAT
331 #include <net/compat.h>
332
333 struct compat_ip6t_entry
334 {
335 struct ip6t_ip6 ipv6;
336 compat_uint_t nfcache;
337 u_int16_t target_offset;
338 u_int16_t next_offset;
339 compat_uint_t comefrom;
340 struct compat_xt_counters counters;
341 unsigned char elems[0];
342 };
343
344 static inline struct ip6t_entry_target *
compat_ip6t_get_target(struct compat_ip6t_entry * e)345 compat_ip6t_get_target(struct compat_ip6t_entry *e)
346 {
347 return (void *)e + e->target_offset;
348 }
349
350 #define COMPAT_IP6T_ALIGN(s) COMPAT_XT_ALIGN(s)
351
352 /* fn returns 0 to continue iteration */
353 #define COMPAT_IP6T_MATCH_ITERATE(e, fn, args...) \
354 XT_MATCH_ITERATE(struct compat_ip6t_entry, e, fn, ## args)
355
356 /* fn returns 0 to continue iteration */
357 #define COMPAT_IP6T_ENTRY_ITERATE(entries, size, fn, args...) \
358 XT_ENTRY_ITERATE(struct compat_ip6t_entry, entries, size, fn, ## args)
359
360 #define COMPAT_IP6T_ENTRY_ITERATE_CONTINUE(entries, size, n, fn, args...) \
361 XT_ENTRY_ITERATE_CONTINUE(struct compat_ip6t_entry, entries, size, n, \
362 fn, ## args)
363
364 #endif /* CONFIG_COMPAT */
365 #endif /*__KERNEL__*/
366 #endif /* _IP6_TABLES_H */
367