1#ifndef _IPTABLES_USER_H 2#define _IPTABLES_USER_H 3 4#include "iptables_common.h" 5#include "libiptc/libiptc.h" 6 7#ifndef IPT_LIB_DIR 8#define IPT_LIB_DIR "/usr/local/lib/iptables" 9#endif 10 11#ifndef IPPROTO_SCTP 12#define IPPROTO_SCTP 132 13#endif 14#ifndef IPPROTO_DCCP 15#define IPPROTO_DCCP 33 16#endif 17#ifndef IPPROTO_UDPLITE 18#define IPPROTO_UDPLITE 136 19#endif 20 21#ifndef IPT_SO_GET_REVISION_MATCH /* Old kernel source. */ 22#define IPT_SO_GET_REVISION_MATCH (IPT_BASE_CTL + 2) 23#define IPT_SO_GET_REVISION_TARGET (IPT_BASE_CTL + 3) 24 25struct ipt_get_revision 26{ 27 char name[IPT_FUNCTION_MAXNAMELEN-1]; 28 29 u_int8_t revision; 30}; 31#endif /* IPT_SO_GET_REVISION_MATCH Old kernel source */ 32 33struct iptables_rule_match 34{ 35 struct iptables_rule_match *next; 36 37 struct iptables_match *match; 38 39 /* Multiple matches of the same type: the ones before 40 the current one are completed from parsing point of view */ 41 unsigned int completed; 42}; 43 44/* Include file for additions: new matches and targets. */ 45struct iptables_match 46{ 47 struct iptables_match *next; 48 49 ipt_chainlabel name; 50 51 /* Revision of match (0 by default). */ 52 u_int8_t revision; 53 54 const char *version; 55 56 /* Size of match data. */ 57 size_t size; 58 59 /* Size of match data relevent for userspace comparison purposes */ 60 size_t userspacesize; 61 62 /* Function which prints out usage message. */ 63 void (*help)(void); 64 65 /* Initialize the match. */ 66 void (*init)(struct ipt_entry_match *m, unsigned int *nfcache); 67 68 /* Function which parses command options; returns true if it 69 ate an option */ 70 int (*parse)(int c, char **argv, int invert, unsigned int *flags, 71 const struct ipt_entry *entry, 72 unsigned int *nfcache, 73 struct ipt_entry_match **match); 74 75 /* Final check; exit if not ok. */ 76 void (*final_check)(unsigned int flags); 77 78 /* Prints out the match iff non-NULL: put space at end */ 79 void (*print)(const struct ipt_ip *ip, 80 const struct ipt_entry_match *match, int numeric); 81 82 /* Saves the match info in parsable form to stdout. */ 83 void (*save)(const struct ipt_ip *ip, 84 const struct ipt_entry_match *match); 85 86 /* Pointer to list of extra command-line options */ 87 const struct option *extra_opts; 88 89 /* Ignore these men behind the curtain: */ 90 unsigned int option_offset; 91 struct ipt_entry_match *m; 92 unsigned int mflags; 93#ifdef NO_SHARED_LIBS 94 unsigned int loaded; /* simulate loading so options are merged properly */ 95#endif 96}; 97 98struct iptables_target 99{ 100 struct iptables_target *next; 101 102 ipt_chainlabel name; 103 104 /* Revision of target (0 by default). */ 105 u_int8_t revision; 106 107 const char *version; 108 109 /* Size of target data. */ 110 size_t size; 111 112 /* Size of target data relevent for userspace comparison purposes */ 113 size_t userspacesize; 114 115 /* Function which prints out usage message. */ 116 void (*help)(void); 117 118 /* Initialize the target. */ 119 void (*init)(struct ipt_entry_target *t, unsigned int *nfcache); 120 121 /* Function which parses command options; returns true if it 122 ate an option */ 123 int (*parse)(int c, char **argv, int invert, unsigned int *flags, 124 const struct ipt_entry *entry, 125 struct ipt_entry_target **target); 126 127 /* Final check; exit if not ok. */ 128 void (*final_check)(unsigned int flags); 129 130 /* Prints out the target iff non-NULL: put space at end */ 131 void (*print)(const struct ipt_ip *ip, 132 const struct ipt_entry_target *target, int numeric); 133 134 /* Saves the targinfo in parsable form to stdout. */ 135 void (*save)(const struct ipt_ip *ip, 136 const struct ipt_entry_target *target); 137 138 /* Pointer to list of extra command-line options */ 139 struct option *extra_opts; 140 141 /* Ignore these men behind the curtain: */ 142 unsigned int option_offset; 143 struct ipt_entry_target *t; 144 unsigned int tflags; 145 unsigned int used; 146#ifdef NO_SHARED_LIBS 147 unsigned int loaded; /* simulate loading so options are merged properly */ 148#endif 149}; 150 151extern int line; 152 153/* Your shared library should call one of these. */ 154extern void register_match(struct iptables_match *me); 155extern void register_target(struct iptables_target *me); 156 157extern int service_to_port(const char *name, const char *proto); 158extern u_int16_t parse_port(const char *port, const char *proto); 159extern struct in_addr *dotted_to_addr(const char *dotted); 160extern struct in_addr *dotted_to_mask(const char *dotted); 161extern char *addr_to_dotted(const struct in_addr *addrp); 162extern char *addr_to_anyname(const struct in_addr *addr); 163extern char *mask_to_dotted(const struct in_addr *mask); 164 165extern void parse_hostnetworkmask(const char *name, struct in_addr **addrpp, 166 struct in_addr *maskp, unsigned int *naddrs); 167extern u_int16_t parse_protocol(const char *s); 168extern void parse_interface(const char *arg, char *vianame, unsigned char *mask); 169 170extern int do_command(int argc, char *argv[], char **table, 171 iptc_handle_t *handle); 172/* Keeping track of external matches and targets: linked lists. */ 173extern struct iptables_match *iptables_matches; 174extern struct iptables_target *iptables_targets; 175 176enum ipt_tryload { 177 DONT_LOAD, 178 DURING_LOAD, 179 TRY_LOAD, 180 LOAD_MUST_SUCCEED 181}; 182 183extern struct iptables_target *find_target(const char *name, enum ipt_tryload); 184extern struct iptables_match *find_match(const char *name, enum ipt_tryload, struct iptables_rule_match **match); 185 186extern int delete_chain(const ipt_chainlabel chain, int verbose, 187 iptc_handle_t *handle); 188extern int flush_entries(const ipt_chainlabel chain, int verbose, 189 iptc_handle_t *handle); 190extern int for_each_chain(int (*fn)(const ipt_chainlabel, int, iptc_handle_t *), 191 int verbose, int builtinstoo, iptc_handle_t *handle); 192 193/* kernel revision handling */ 194extern int kernel_version; 195extern void get_kernel_version(void); 196#define LINUX_VERSION(x,y,z) (0x10000*(x) + 0x100*(y) + z) 197#define LINUX_VERSION_MAJOR(x) (((x)>>16) & 0xFF) 198#define LINUX_VERSION_MINOR(x) (((x)>> 8) & 0xFF) 199#define LINUX_VERSION_PATCH(x) ( (x) & 0xFF) 200 201#endif /*_IPTABLES_USER_H*/ 202