1 /* SPDX-License-Identifier: GPL-2.0 */
6 * Changing any structs/functions may incur a needed change
7 * in libxtables_vcurrent/vage too.
10 #include <sys/socket.h> /* PF_* */
11 #include <sys/types.h>
16 #include <netinet/in.h>
18 #include <linux/types.h>
19 #include <linux/netfilter.h>
20 #include <linux/netfilter/x_tables.h>
23 #define IPPROTO_SCTP 132
26 #define IPPROTO_DCCP 33
29 # define IPPROTO_MH 135
31 #ifndef IPPROTO_UDPLITE
32 #define IPPROTO_UDPLITE 136
35 #include <xtables-version.h>
40 * .size is here so that there is a somewhat reasonable check
41 * against the chosen .type.
43 #define XTOPT_POINTER(stype, member) \
44 .ptroff = offsetof(stype, member), \
45 .size = sizeof(((stype *)NULL)->member)
46 #define XTOPT_TABLEEND {.name = NULL}
49 * Select the format the input has to conform to, as well as the target type
50 * (area pointed to with XTOPT_POINTER). Note that the storing is not always
51 * uniform. @cb->val will be populated with as much as there is space, i.e.
52 * exactly 2 items for ranges, but the target area can receive more values
53 * (e.g. in case of ranges), or less values (e.g. %XTTYPE_HOSTMASK).
55 * %XTTYPE_NONE: option takes no argument
56 * %XTTYPE_UINT*: standard integer
57 * %XTTYPE_UINT*RC: colon-separated range of standard integers
58 * %XTTYPE_DOUBLE: double-precision floating point number
59 * %XTTYPE_STRING: arbitrary string
60 * %XTTYPE_TOSMASK: 8-bit TOS value with optional mask
61 * %XTTYPE_MARKMASK32: 32-bit mark with optional mask
62 * %XTTYPE_SYSLOGLEVEL: syslog level by name or number
63 * %XTTYPE_HOST: one host or address (ptr: union nf_inet_addr)
64 * %XTTYPE_HOSTMASK: one host or address, with an optional prefix length
65 * (ptr: union nf_inet_addr; only host portion is stored)
66 * %XTTYPE_PROTOCOL: protocol number/name from /etc/protocols (ptr: uint8_t)
67 * %XTTYPE_PORT: 16-bit port name or number (supports %XTOPT_NBO)
68 * %XTTYPE_PORTRC: colon-separated port range (names acceptable),
69 * (supports %XTOPT_NBO)
70 * %XTTYPE_PLEN: prefix length
71 * %XTTYPE_PLENMASK: prefix length (ptr: union nf_inet_addr)
72 * %XTTYPE_ETHERMAC: Ethernet MAC address in hex form
100 * %XTOPT_INVERT: option is invertible (usable with !)
101 * %XTOPT_MAND: option is mandatory
102 * %XTOPT_MULTI: option may be specified multiple times
103 * %XTOPT_PUT: store value into memory at @ptroff
104 * %XTOPT_NBO: store value in network-byte order
105 * (only certain XTTYPEs recognize this)
107 enum xt_option_flags
{
108 XTOPT_INVERT
= 1 << 0,
110 XTOPT_MULTI
= 1 << 2,
116 * @name: name of option
117 * @type: type of input and validation method, see %XTTYPE_*
118 * @id: unique number (within extension) for option, 0-31
119 * @excl: bitmask of flags that cannot be used with this option
120 * @also: bitmask of flags that must be used with this option
121 * @flags: bitmask of option flags, see %XTOPT_*
122 * @ptroff: offset into private structure for member
123 * @size: size of the item pointed to by @ptroff; this is a safeguard
124 * @min: lowest allowed value (for singular integral types)
125 * @max: highest allowed value (for singular integral types)
127 struct xt_option_entry
{
129 enum xt_option_type type
;
130 unsigned int id
, excl
, also
, flags
;
133 unsigned int min
, max
;
137 * @arg: input from command line
138 * @ext_name: name of extension currently being processed
139 * @entry: current option being processed
140 * @data: per-extension kernel data block
141 * @xflags: options of the extension that have been used
142 * @invert: whether option was used with !
143 * @nvals: number of results in uXX_multi
144 * @val: parsed result
145 * @udata: per-extension private scratch area
146 * (cf. xtables_{match,target}->udata_size)
148 struct xt_option_call
{
149 const char *arg
, *ext_name
;
150 const struct xt_option_entry
*entry
;
156 uint8_t u8
, u8_range
[2], syslog_level
, protocol
;
157 uint16_t u16
, u16_range
[2], port
, port_range
[2];
158 uint32_t u32
, u32_range
[2];
159 uint64_t u64
, u64_range
[2];
162 union nf_inet_addr haddr
, hmask
;
166 uint8_t tos_value
, tos_mask
;
173 /* Wished for a world where the ones below were gone: */
175 struct xt_entry_match
**match
;
176 struct xt_entry_target
**target
;
183 * @ext_name: name of extension currently being processed
184 * @data: per-extension (kernel) data block
185 * @udata: per-extension private scratch area
186 * (cf. xtables_{match,target}->udata_size)
187 * @xflags: options of the extension that have been used
189 struct xt_fcheck_call
{
190 const char *ext_name
;
196 * A "linear"/linked-list based name<->id map, for files similar to
199 struct xtables_lmap
{
202 struct xtables_lmap
*next
;
205 enum xtables_ext_flags
{
206 XTABLES_EXT_ALIAS
= 1 << 0,
209 /* Include file for additions: new matches and targets. */
213 * ABI/API version this module requires. Must be first member,
214 * as the rest of this struct may be subject to ABI changes.
218 struct xtables_match
*next
;
221 const char *real_name
;
223 /* Revision of match (0 by default). */
226 /* Extension flags */
231 /* Size of match data. */
234 /* Size of match data relevant for userspace comparison purposes */
235 size_t userspacesize
;
237 /* Function which prints out usage message. */
240 /* Initialize the match. */
241 void (*init
)(struct xt_entry_match
*m
);
243 /* Function which parses command options; returns true if it
245 /* entry is struct ipt_entry for example */
246 int (*parse
)(int c
, char **argv
, int invert
, unsigned int *flags
,
248 struct xt_entry_match
**match
);
250 /* Final check; exit if not ok. */
251 void (*final_check
)(unsigned int flags
);
253 /* Prints out the match iff non-NULL: put space at end */
254 /* ip is struct ipt_ip * for example */
255 void (*print
)(const void *ip
,
256 const struct xt_entry_match
*match
, int numeric
);
258 /* Saves the match info in parsable form to stdout. */
259 /* ip is struct ipt_ip * for example */
260 void (*save
)(const void *ip
, const struct xt_entry_match
*match
);
262 /* Print match name or alias */
263 const char *(*alias
)(const struct xt_entry_match
*match
);
265 /* Pointer to list of extra command-line options */
266 const struct option
*extra_opts
;
269 void (*x6_parse
)(struct xt_option_call
*);
270 void (*x6_fcheck
)(struct xt_fcheck_call
*);
271 const struct xt_option_entry
*x6_options
;
273 /* Size of per-extension instance extra "global" scratch space */
276 /* Ignore these men behind the curtain: */
278 unsigned int option_offset
;
279 struct xt_entry_match
*m
;
281 unsigned int loaded
; /* simulate loading so options are merged properly */
284 struct xtables_target
287 * ABI/API version this module requires. Must be first member,
288 * as the rest of this struct may be subject to ABI changes.
292 struct xtables_target
*next
;
297 /* Real target behind this, if any. */
298 const char *real_name
;
300 /* Revision of target (0 by default). */
303 /* Extension flags */
309 /* Size of target data. */
312 /* Size of target data relevant for userspace comparison purposes */
313 size_t userspacesize
;
315 /* Function which prints out usage message. */
318 /* Initialize the target. */
319 void (*init
)(struct xt_entry_target
*t
);
321 /* Function which parses command options; returns true if it
323 /* entry is struct ipt_entry for example */
324 int (*parse
)(int c
, char **argv
, int invert
, unsigned int *flags
,
326 struct xt_entry_target
**targetinfo
);
328 /* Final check; exit if not ok. */
329 void (*final_check
)(unsigned int flags
);
331 /* Prints out the target iff non-NULL: put space at end */
332 void (*print
)(const void *ip
,
333 const struct xt_entry_target
*target
, int numeric
);
335 /* Saves the targinfo in parsable form to stdout. */
336 void (*save
)(const void *ip
,
337 const struct xt_entry_target
*target
);
339 /* Print target name or alias */
340 const char *(*alias
)(const struct xt_entry_target
*target
);
342 /* Pointer to list of extra command-line options */
343 const struct option
*extra_opts
;
346 void (*x6_parse
)(struct xt_option_call
*);
347 void (*x6_fcheck
)(struct xt_fcheck_call
*);
348 const struct xt_option_entry
*x6_options
;
352 /* Ignore these men behind the curtain: */
354 unsigned int option_offset
;
355 struct xt_entry_target
*t
;
358 unsigned int loaded
; /* simulate loading so options are merged properly */
361 struct xtables_rule_match
{
362 struct xtables_rule_match
*next
;
363 struct xtables_match
*match
;
364 /* Multiple matches of the same type: the ones before
365 the current one are completed from parsing point of view */
370 * struct xtables_pprot -
372 * A few hardcoded protocols for 'all' and in case the user has no
375 struct xtables_pprot
{
380 enum xtables_tryload
{
384 XTF_LOAD_MUST_SUCCEED
,
387 enum xtables_exittype
{
398 struct xtables_globals
400 unsigned int option_offset
;
401 const char *program_name
, *program_version
;
402 struct option
*orig_opts
;
404 void (*exit_err
)(enum xtables_exittype status
, const char *msg
, ...) __attribute__((noreturn
, format(printf
,2,3)));
405 int (*compat_rev
)(const char *name
, uint8_t rev
, int opt
);
408 #define XT_GETOPT_TABLEEND {.name = NULL, .has_arg = false}
414 extern const char *xtables_modprobe_program
;
415 extern struct xtables_match
*xtables_matches
;
416 extern struct xtables_target
*xtables_targets
;
418 extern void xtables_init(void);
419 extern void xtables_set_nfproto(uint8_t);
420 extern void *xtables_calloc(size_t, size_t);
421 extern void *xtables_malloc(size_t);
422 extern void *xtables_realloc(void *, size_t);
424 extern int xtables_insmod(const char *, const char *, bool);
425 extern int xtables_load_ko(const char *, bool);
426 extern int xtables_set_params(struct xtables_globals
*xtp
);
427 extern void xtables_free_opts(int reset_offset
);
428 extern struct option
*xtables_merge_options(struct option
*origopts
,
429 struct option
*oldopts
, const struct option
*newopts
,
430 unsigned int *option_offset
);
432 extern int xtables_init_all(struct xtables_globals
*xtp
, uint8_t nfproto
);
433 extern struct xtables_match
*xtables_find_match(const char *name
,
434 enum xtables_tryload
, struct xtables_rule_match
**match
);
435 extern struct xtables_target
*xtables_find_target(const char *name
,
436 enum xtables_tryload
);
437 extern int xtables_compatible_revision(const char *name
, uint8_t revision
,
440 extern void xtables_rule_matches_free(struct xtables_rule_match
**matches
);
442 /* Your shared library should call one of these. */
443 extern void xtables_register_match(struct xtables_match
*me
);
444 extern void xtables_register_matches(struct xtables_match
*, unsigned int);
445 extern void xtables_register_target(struct xtables_target
*me
);
446 extern void xtables_register_targets(struct xtables_target
*, unsigned int);
448 extern bool xtables_strtoul(const char *, char **, uintmax_t *,
449 uintmax_t, uintmax_t);
450 extern bool xtables_strtoui(const char *, char **, unsigned int *,
451 unsigned int, unsigned int);
452 extern int xtables_service_to_port(const char *name
, const char *proto
);
453 extern uint16_t xtables_parse_port(const char *port
, const char *proto
);
455 xtables_parse_interface(const char *arg
, char *vianame
, unsigned char *mask
);
457 /* this is a special 64bit data type that is 8-byte aligned */
458 #define aligned_u64 uint64_t __attribute__((aligned(8)))
460 extern struct xtables_globals
*xt_params
;
461 #define xtables_error (xt_params->exit_err)
463 extern void xtables_param_act(unsigned int, const char *, ...);
465 extern const char *xtables_ipaddr_to_numeric(const struct in_addr
*);
466 extern const char *xtables_ipaddr_to_anyname(const struct in_addr
*);
467 extern const char *xtables_ipmask_to_numeric(const struct in_addr
*);
468 extern struct in_addr
*xtables_numeric_to_ipaddr(const char *);
469 extern struct in_addr
*xtables_numeric_to_ipmask(const char *);
470 extern int xtables_ipmask_to_cidr(const struct in_addr
*);
471 extern void xtables_ipparse_any(const char *, struct in_addr
**,
472 struct in_addr
*, unsigned int *);
473 extern void xtables_ipparse_multiple(const char *, struct in_addr
**,
474 struct in_addr
**, unsigned int *);
476 extern struct in6_addr
*xtables_numeric_to_ip6addr(const char *);
477 extern const char *xtables_ip6addr_to_numeric(const struct in6_addr
*);
478 extern const char *xtables_ip6addr_to_anyname(const struct in6_addr
*);
479 extern const char *xtables_ip6mask_to_numeric(const struct in6_addr
*);
480 extern int xtables_ip6mask_to_cidr(const struct in6_addr
*);
481 extern void xtables_ip6parse_any(const char *, struct in6_addr
**,
482 struct in6_addr
*, unsigned int *);
483 extern void xtables_ip6parse_multiple(const char *, struct in6_addr
**,
484 struct in6_addr
**, unsigned int *);
487 * Print the specified value to standard output, quoting dangerous
488 * characters if required.
490 extern void xtables_save_string(const char *value
);
492 #define FMT_NUMERIC 0x0001
493 #define FMT_NOCOUNTS 0x0002
494 #define FMT_KILOMEGAGIGA 0x0004
495 #define FMT_OPTIONS 0x0008
496 #define FMT_NOTABLE 0x0010
497 #define FMT_NOTARGET 0x0020
498 #define FMT_VIA 0x0040
499 #define FMT_NONEWLINE 0x0080
500 #define FMT_LINENUMBERS 0x0100
502 #define FMT_PRINT_RULE (FMT_NOCOUNTS | FMT_OPTIONS | FMT_VIA \
503 | FMT_NUMERIC | FMT_NOTABLE)
504 #define FMT(tab,notab) ((format) & FMT_NOTABLE ? (notab) : (tab))
506 extern void xtables_print_num(uint64_t number
, unsigned int format
);
508 #if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
513 extern void init_extensions(void);
514 extern void init_extensions4(void);
515 extern void init_extensions6(void);
517 # define _init __attribute__((constructor)) _INIT
520 extern const struct xtables_pprot xtables_chain_protos
[];
521 extern uint16_t xtables_parse_protocol(const char *s
);
523 /* kernel revision handling */
524 extern int kernel_version
;
525 extern void get_kernel_version(void);
526 #define LINUX_VERSION(x,y,z) (0x10000*(x) + 0x100*(y) + z)
527 #define LINUX_VERSION_MAJOR(x) (((x)>>16) & 0xFF)
528 #define LINUX_VERSION_MINOR(x) (((x)>> 8) & 0xFF)
529 #define LINUX_VERSION_PATCH(x) ( (x) & 0xFF)
532 extern void xtables_option_metavalidate(const char *,
533 const struct xt_option_entry
*);
534 extern struct option
*xtables_options_xfrm(struct option
*, struct option
*,
535 const struct xt_option_entry
*,
537 extern void xtables_option_parse(struct xt_option_call
*);
538 extern void xtables_option_tpcall(unsigned int, char **, bool,
539 struct xtables_target
*, void *);
540 extern void xtables_option_mpcall(unsigned int, char **, bool,
541 struct xtables_match
*, void *);
542 extern void xtables_option_tfcall(struct xtables_target
*);
543 extern void xtables_option_mfcall(struct xtables_match
*);
544 extern void xtables_options_fcheck(const char *, unsigned int,
545 const struct xt_option_entry
*);
547 extern struct xtables_lmap
*xtables_lmap_init(const char *);
548 extern void xtables_lmap_free(struct xtables_lmap
*);
549 extern int xtables_lmap_name2id(const struct xtables_lmap
*, const char *);
550 extern const char *xtables_lmap_id2name(const struct xtables_lmap
*, int);
552 #ifdef XTABLES_INTERNAL
554 /* Shipped modules rely on this... */
557 # define ARRAY_SIZE(x) (sizeof(x) / sizeof(*(x)))
560 extern void _init(void);
568 #endif /* _XTABLES_H */