1 /* SPDX-License-Identifier: GPL-2.0 */
6 * Changing any structs/functions may incur a needed change
7 * in libxtables_vcurrent/vage too.
10 #include <sys/socket.h> /* PF_* */
11 #include <sys/types.h>
16 #include <netinet/in.h>
18 #include <linux/types.h>
19 #include <linux/netfilter.h>
20 #include <linux/netfilter/x_tables.h>
23 #define IPPROTO_SCTP 132
26 #define IPPROTO_DCCP 33
29 # define IPPROTO_MH 135
31 #ifndef IPPROTO_UDPLITE
32 #define IPPROTO_UDPLITE 136
35 #include <xtables-version.h>
40 * .size is here so that there is a somewhat reasonable check
41 * against the chosen .type.
43 #define XTOPT_POINTER(stype, member) \
44 .ptroff = offsetof(stype, member), \
45 .size = sizeof(((stype *)NULL)->member)
46 #define XTOPT_TABLEEND {.name = NULL}
49 * Select the format the input has to conform to, as well as the target type
50 * (area pointed to with XTOPT_POINTER). Note that the storing is not always
51 * uniform. @cb->val will be populated with as much as there is space, i.e.
52 * exactly 2 items for ranges, but the target area can receive more values
53 * (e.g. in case of ranges), or less values (e.g. %XTTYPE_HOSTMASK).
55 * %XTTYPE_NONE: option takes no argument
56 * %XTTYPE_UINT*: standard integer
57 * %XTTYPE_UINT*RC: colon-separated range of standard integers
58 * %XTTYPE_DOUBLE: double-precision floating point number
59 * %XTTYPE_STRING: arbitrary string
60 * %XTTYPE_TOSMASK: 8-bit TOS value with optional mask
61 * %XTTYPE_MARKMASK32: 32-bit mark with optional mask
62 * %XTTYPE_SYSLOGLEVEL: syslog level by name or number
63 * %XTTYPE_HOST: one host or address (ptr: union nf_inet_addr)
64 * %XTTYPE_HOSTMASK: one host or address, with an optional prefix length
65 * (ptr: union nf_inet_addr; only host portion is stored)
66 * %XTTYPE_PROTOCOL: protocol number/name from /etc/protocols (ptr: uint8_t)
67 * %XTTYPE_PORT: 16-bit port name or number (supports %XTOPT_NBO)
68 * %XTTYPE_PORTRC: colon-separated port range (names acceptable),
69 * (supports %XTOPT_NBO)
70 * %XTTYPE_PLEN: prefix length
71 * %XTTYPE_PLENMASK: prefix length (ptr: union nf_inet_addr)
72 * %XTTYPE_ETHERMAC: Ethernet MAC address in hex form
100 * %XTOPT_INVERT: option is invertible (usable with !)
101 * %XTOPT_MAND: option is mandatory
102 * %XTOPT_MULTI: option may be specified multiple times
103 * %XTOPT_PUT: store value into memory at @ptroff
104 * %XTOPT_NBO: store value in network-byte order
105 * (only certain XTTYPEs recognize this)
107 enum xt_option_flags
{
108 XTOPT_INVERT
= 1 << 0,
110 XTOPT_MULTI
= 1 << 2,
116 * @name: name of option
117 * @type: type of input and validation method, see %XTTYPE_*
118 * @id: unique number (within extension) for option, 0-31
119 * @excl: bitmask of flags that cannot be used with this option
120 * @also: bitmask of flags that must be used with this option
121 * @flags: bitmask of option flags, see %XTOPT_*
122 * @ptroff: offset into private structure for member
123 * @size: size of the item pointed to by @ptroff; this is a safeguard
124 * @min: lowest allowed value (for singular integral types)
125 * @max: highest allowed value (for singular integral types)
127 struct xt_option_entry
{
129 enum xt_option_type type
;
130 unsigned int id
, excl
, also
, flags
;
133 unsigned int min
, max
;
137 * @arg: input from command line
138 * @ext_name: name of extension currently being processed
139 * @entry: current option being processed
140 * @data: per-extension kernel data block
141 * @xflags: options of the extension that have been used
142 * @invert: whether option was used with !
143 * @nvals: number of results in uXX_multi
144 * @val: parsed result
145 * @udata: per-extension private scratch area
146 * (cf. xtables_{match,target}->udata_size)
148 struct xt_option_call
{
149 const char *arg
, *ext_name
;
150 const struct xt_option_entry
*entry
;
156 uint8_t u8
, u8_range
[2], syslog_level
, protocol
;
157 uint16_t u16
, u16_range
[2], port
, port_range
[2];
158 uint32_t u32
, u32_range
[2];
159 uint64_t u64
, u64_range
[2];
162 union nf_inet_addr haddr
, hmask
;
166 uint8_t tos_value
, tos_mask
;
173 /* Wished for a world where the ones below were gone: */
175 struct xt_entry_match
**match
;
176 struct xt_entry_target
**target
;
183 * @ext_name: name of extension currently being processed
184 * @data: per-extension (kernel) data block
185 * @udata: per-extension private scratch area
186 * (cf. xtables_{match,target}->udata_size)
187 * @xflags: options of the extension that have been used
189 struct xt_fcheck_call
{
190 const char *ext_name
;
196 * A "linear"/linked-list based name<->id map, for files similar to
199 struct xtables_lmap
{
202 struct xtables_lmap
*next
;
205 enum xtables_ext_flags
{
206 XTABLES_EXT_ALIAS
= 1 << 0,
209 #if XTABLES_VERSION_CODE >= 12
212 struct xt_xlate_mt_params
{
214 const struct xt_entry_match
*match
;
219 struct xt_xlate_tg_params
{
221 const struct xt_entry_target
*target
;
227 /* Include file for additions: new matches and targets. */
231 * ABI/API version this module requires. Must be first member,
232 * as the rest of this struct may be subject to ABI changes.
236 struct xtables_match
*next
;
239 const char *real_name
;
241 /* Revision of match (0 by default). */
244 /* Extension flags */
249 /* Size of match data. */
252 /* Size of match data relevant for userspace comparison purposes */
253 size_t userspacesize
;
255 /* Function which prints out usage message. */
258 /* Initialize the match. */
259 void (*init
)(struct xt_entry_match
*m
);
261 /* Function which parses command options; returns true if it
263 /* entry is struct ipt_entry for example */
264 int (*parse
)(int c
, char **argv
, int invert
, unsigned int *flags
,
266 struct xt_entry_match
**match
);
268 /* Final check; exit if not ok. */
269 void (*final_check
)(unsigned int flags
);
271 /* Prints out the match iff non-NULL: put space at end */
272 /* ip is struct ipt_ip * for example */
273 void (*print
)(const void *ip
,
274 const struct xt_entry_match
*match
, int numeric
);
276 /* Saves the match info in parsable form to stdout. */
277 /* ip is struct ipt_ip * for example */
278 void (*save
)(const void *ip
, const struct xt_entry_match
*match
);
280 /* Print match name or alias */
281 const char *(*alias
)(const struct xt_entry_match
*match
);
283 /* Pointer to list of extra command-line options */
284 const struct option
*extra_opts
;
287 void (*x6_parse
)(struct xt_option_call
*);
288 void (*x6_fcheck
)(struct xt_fcheck_call
*);
289 const struct xt_option_entry
*x6_options
;
291 #if XTABLES_VERSION_CODE >= 12
292 /* Translate iptables to nft */
293 int (*xlate
)(struct xt_xlate
*xl
,
294 const struct xt_xlate_mt_params
*params
);
297 /* Size of per-extension instance extra "global" scratch space */
300 /* Ignore these men behind the curtain: */
302 unsigned int option_offset
;
303 struct xt_entry_match
*m
;
305 unsigned int loaded
; /* simulate loading so options are merged properly */
308 struct xtables_target
311 * ABI/API version this module requires. Must be first member,
312 * as the rest of this struct may be subject to ABI changes.
316 struct xtables_target
*next
;
321 /* Real target behind this, if any. */
322 const char *real_name
;
324 /* Revision of target (0 by default). */
327 /* Extension flags */
333 /* Size of target data. */
336 /* Size of target data relevant for userspace comparison purposes */
337 size_t userspacesize
;
339 /* Function which prints out usage message. */
342 /* Initialize the target. */
343 void (*init
)(struct xt_entry_target
*t
);
345 /* Function which parses command options; returns true if it
347 /* entry is struct ipt_entry for example */
348 int (*parse
)(int c
, char **argv
, int invert
, unsigned int *flags
,
350 struct xt_entry_target
**targetinfo
);
352 /* Final check; exit if not ok. */
353 void (*final_check
)(unsigned int flags
);
355 /* Prints out the target iff non-NULL: put space at end */
356 void (*print
)(const void *ip
,
357 const struct xt_entry_target
*target
, int numeric
);
359 /* Saves the targinfo in parsable form to stdout. */
360 void (*save
)(const void *ip
,
361 const struct xt_entry_target
*target
);
363 /* Print target name or alias */
364 const char *(*alias
)(const struct xt_entry_target
*target
);
366 /* Pointer to list of extra command-line options */
367 const struct option
*extra_opts
;
370 void (*x6_parse
)(struct xt_option_call
*);
371 void (*x6_fcheck
)(struct xt_fcheck_call
*);
372 const struct xt_option_entry
*x6_options
;
374 #if XTABLES_VERSION_CODE >= 12
375 /* Translate iptables to nft */
376 int (*xlate
)(struct xt_xlate
*xl
,
377 const struct xt_xlate_tg_params
*params
);
382 /* Ignore these men behind the curtain: */
384 unsigned int option_offset
;
385 struct xt_entry_target
*t
;
388 unsigned int loaded
; /* simulate loading so options are merged properly */
391 struct xtables_rule_match
{
392 struct xtables_rule_match
*next
;
393 struct xtables_match
*match
;
394 /* Multiple matches of the same type: the ones before
395 the current one are completed from parsing point of view */
400 * struct xtables_pprot -
402 * A few hardcoded protocols for 'all' and in case the user has no
405 struct xtables_pprot
{
410 enum xtables_tryload
{
414 XTF_LOAD_MUST_SUCCEED
,
417 enum xtables_exittype
{
428 struct xtables_globals
430 unsigned int option_offset
;
431 const char *program_name
, *program_version
;
432 struct option
*orig_opts
;
434 void (*exit_err
)(enum xtables_exittype status
, const char *msg
, ...) __attribute__((noreturn
, format(printf
,2,3)));
435 int (*compat_rev
)(const char *name
, uint8_t rev
, int opt
);
438 #define XT_GETOPT_TABLEEND {.name = NULL, .has_arg = false}
444 extern const char *xtables_modprobe_program
;
445 extern struct xtables_match
*xtables_matches
;
446 extern struct xtables_target
*xtables_targets
;
448 extern void xtables_init(void);
449 extern void xtables_set_nfproto(uint8_t);
450 extern void *xtables_calloc(size_t, size_t);
451 extern void *xtables_malloc(size_t);
452 extern void *xtables_realloc(void *, size_t);
454 extern int xtables_insmod(const char *, const char *, bool);
455 extern int xtables_load_ko(const char *, bool);
456 extern int xtables_set_params(struct xtables_globals
*xtp
);
457 extern void xtables_free_opts(int reset_offset
);
458 extern struct option
*xtables_merge_options(struct option
*origopts
,
459 struct option
*oldopts
, const struct option
*newopts
,
460 unsigned int *option_offset
);
462 extern int xtables_init_all(struct xtables_globals
*xtp
, uint8_t nfproto
);
463 extern struct xtables_match
*xtables_find_match(const char *name
,
464 enum xtables_tryload
, struct xtables_rule_match
**match
);
465 extern struct xtables_target
*xtables_find_target(const char *name
,
466 enum xtables_tryload
);
467 extern int xtables_compatible_revision(const char *name
, uint8_t revision
,
470 extern void xtables_rule_matches_free(struct xtables_rule_match
**matches
);
472 /* Your shared library should call one of these. */
473 extern void xtables_register_match(struct xtables_match
*me
);
474 extern void xtables_register_matches(struct xtables_match
*, unsigned int);
475 extern void xtables_register_target(struct xtables_target
*me
);
476 extern void xtables_register_targets(struct xtables_target
*, unsigned int);
478 extern bool xtables_strtoul(const char *, char **, uintmax_t *,
479 uintmax_t, uintmax_t);
480 extern bool xtables_strtoui(const char *, char **, unsigned int *,
481 unsigned int, unsigned int);
482 extern int xtables_service_to_port(const char *name
, const char *proto
);
483 extern uint16_t xtables_parse_port(const char *port
, const char *proto
);
485 xtables_parse_interface(const char *arg
, char *vianame
, unsigned char *mask
);
487 /* this is a special 64bit data type that is 8-byte aligned */
488 #define aligned_u64 uint64_t __attribute__((aligned(8)))
490 extern struct xtables_globals
*xt_params
;
491 #define xtables_error (xt_params->exit_err)
493 extern void xtables_param_act(unsigned int, const char *, ...);
495 extern const char *xtables_ipaddr_to_numeric(const struct in_addr
*);
496 extern const char *xtables_ipaddr_to_anyname(const struct in_addr
*);
497 extern const char *xtables_ipmask_to_numeric(const struct in_addr
*);
498 extern struct in_addr
*xtables_numeric_to_ipaddr(const char *);
499 extern struct in_addr
*xtables_numeric_to_ipmask(const char *);
500 extern int xtables_ipmask_to_cidr(const struct in_addr
*);
501 extern void xtables_ipparse_any(const char *, struct in_addr
**,
502 struct in_addr
*, unsigned int *);
503 extern void xtables_ipparse_multiple(const char *, struct in_addr
**,
504 struct in_addr
**, unsigned int *);
506 extern struct in6_addr
*xtables_numeric_to_ip6addr(const char *);
507 extern const char *xtables_ip6addr_to_numeric(const struct in6_addr
*);
508 extern const char *xtables_ip6addr_to_anyname(const struct in6_addr
*);
509 extern const char *xtables_ip6mask_to_numeric(const struct in6_addr
*);
510 extern int xtables_ip6mask_to_cidr(const struct in6_addr
*);
511 extern void xtables_ip6parse_any(const char *, struct in6_addr
**,
512 struct in6_addr
*, unsigned int *);
513 extern void xtables_ip6parse_multiple(const char *, struct in6_addr
**,
514 struct in6_addr
**, unsigned int *);
517 * Print the specified value to standard output, quoting dangerous
518 * characters if required.
520 extern void xtables_save_string(const char *value
);
522 #define FMT_NUMERIC 0x0001
523 #define FMT_NOCOUNTS 0x0002
524 #define FMT_KILOMEGAGIGA 0x0004
525 #define FMT_OPTIONS 0x0008
526 #define FMT_NOTABLE 0x0010
527 #define FMT_NOTARGET 0x0020
528 #define FMT_VIA 0x0040
529 #define FMT_NONEWLINE 0x0080
530 #define FMT_LINENUMBERS 0x0100
532 #define FMT_PRINT_RULE (FMT_NOCOUNTS | FMT_OPTIONS | FMT_VIA \
533 | FMT_NUMERIC | FMT_NOTABLE)
534 #define FMT(tab,notab) ((format) & FMT_NOTABLE ? (notab) : (tab))
536 extern void xtables_print_num(uint64_t number
, unsigned int format
);
538 #if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
543 extern void init_extensions(void);
544 extern void init_extensions4(void);
545 extern void init_extensions6(void);
547 # define _init __attribute__((constructor)) _INIT
550 extern const struct xtables_pprot xtables_chain_protos
[];
551 extern uint16_t xtables_parse_protocol(const char *s
);
553 /* kernel revision handling */
554 extern int kernel_version
;
555 extern void get_kernel_version(void);
556 #define LINUX_VERSION(x,y,z) (0x10000*(x) + 0x100*(y) + z)
557 #define LINUX_VERSION_MAJOR(x) (((x)>>16) & 0xFF)
558 #define LINUX_VERSION_MINOR(x) (((x)>> 8) & 0xFF)
559 #define LINUX_VERSION_PATCH(x) ( (x) & 0xFF)
562 extern void xtables_option_metavalidate(const char *,
563 const struct xt_option_entry
*);
564 extern struct option
*xtables_options_xfrm(struct option
*, struct option
*,
565 const struct xt_option_entry
*,
567 extern void xtables_option_parse(struct xt_option_call
*);
568 extern void xtables_option_tpcall(unsigned int, char **, bool,
569 struct xtables_target
*, void *);
570 extern void xtables_option_mpcall(unsigned int, char **, bool,
571 struct xtables_match
*, void *);
572 extern void xtables_option_tfcall(struct xtables_target
*);
573 extern void xtables_option_mfcall(struct xtables_match
*);
574 extern void xtables_options_fcheck(const char *, unsigned int,
575 const struct xt_option_entry
*);
577 extern struct xtables_lmap
*xtables_lmap_init(const char *);
578 extern void xtables_lmap_free(struct xtables_lmap
*);
579 extern int xtables_lmap_name2id(const struct xtables_lmap
*, const char *);
580 extern const char *xtables_lmap_id2name(const struct xtables_lmap
*, int);
582 #ifdef XTABLES_INTERNAL
584 /* Shipped modules rely on this... */
587 # define ARRAY_SIZE(x) (sizeof(x) / sizeof(*(x)))
590 extern void _init(void);
598 #endif /* _XTABLES_H */