[deliverable/linux.git] / include / linux / netfilter_ipv6 / ip6_tables.h

/*
 * 25-Jul-1998 Major changes to allow for ip chain table
 *
 * 3-Jan-2000 Named tables to allow packet selection for different uses.
 */

/*
 * 	Format of an IP6 firewall descriptor
 *
 * 	src, dst, src_mask, dst_mask are always stored in network byte order.
 * 	flags are stored in host byte order (of course).
 * 	Port numbers are stored in HOST byte order.
 */

#ifndef _IP6_TABLES_H
#define _IP6_TABLES_H

#ifdef __KERNEL__
#include <linux/if.h>
#include <linux/types.h>
#include <linux/in6.h>
#include <linux/ipv6.h>
#include <linux/skbuff.h>
#endif
#include <linux/compiler.h>
#include <linux/netfilter_ipv6.h>

#include <linux/netfilter/x_tables.h>

#define IP6T_FUNCTION_MAXNAMELEN XT_FUNCTION_MAXNAMELEN
#define IP6T_TABLE_MAXNAMELEN XT_TABLE_MAXNAMELEN

#define ip6t_match xt_match
#define ip6t_target xt_target
#define ip6t_table xt_table
#define ip6t_get_revision xt_get_revision

/* Yes, Virginia, you have to zero the padding. */
struct ip6t_ip6 {
	/* Source and destination IP6 addr */
	struct in6_addr src, dst;		
	/* Mask for src and dest IP6 addr */
	struct in6_addr smsk, dmsk;
	char iniface[IFNAMSIZ], outiface[IFNAMSIZ];
	unsigned char iniface_mask[IFNAMSIZ], outiface_mask[IFNAMSIZ];

	/* ARGH, HopByHop uses 0, so can't do 0 = ANY,
	   instead IP6T_F_NOPROTO must be set */
	u_int16_t proto;
	/* TOS to match iff flags & IP6T_F_TOS */
	u_int8_t tos;

	/* Flags word */
	u_int8_t flags;
	/* Inverse flags */
	u_int8_t invflags;
};

#define ip6t_entry_match xt_entry_match
#define ip6t_entry_target xt_entry_target
#define ip6t_standard_target xt_standard_target

#define ip6t_counters	xt_counters

/* Values for "flag" field in struct ip6t_ip6 (general ip6 structure). */
#define IP6T_F_PROTO		0x01	/* Set if rule cares about upper 
					   protocols */
#define IP6T_F_TOS		0x02	/* Match the TOS. */
#define IP6T_F_GOTO		0x04	/* Set if jump is a goto */
#define IP6T_F_MASK		0x07	/* All possible flag bits mask. */

/* Values for "inv" field in struct ip6t_ip6. */
#define IP6T_INV_VIA_IN		0x01	/* Invert the sense of IN IFACE. */
#define IP6T_INV_VIA_OUT		0x02	/* Invert the sense of OUT IFACE */
#define IP6T_INV_TOS		0x04	/* Invert the sense of TOS. */
#define IP6T_INV_SRCIP		0x08	/* Invert the sense of SRC IP. */
#define IP6T_INV_DSTIP		0x10	/* Invert the sense of DST OP. */
#define IP6T_INV_FRAG		0x20	/* Invert the sense of FRAG. */
#define IP6T_INV_PROTO		XT_INV_PROTO
#define IP6T_INV_MASK		0x7F	/* All possible flag bits mask. */

/* This structure defines each of the firewall rules.  Consists of 3
   parts which are 1) general IP header stuff 2) match specific
   stuff 3) the target to perform if the rule matches */
struct ip6t_entry
{
	struct ip6t_ip6 ipv6;

	/* Mark with fields that we care about. */
	unsigned int nfcache;

	/* Size of ipt_entry + matches */
	u_int16_t target_offset;
	/* Size of ipt_entry + matches + target */
	u_int16_t next_offset;

	/* Back pointer */
	unsigned int comefrom;

	/* Packet and byte counters. */
	struct xt_counters counters;

	/* The matches (if any), then the target. */
	unsigned char elems[0];
};

/*
 * New IP firewall options for [gs]etsockopt at the RAW IP level.
 * Unlike BSD Linux inherits IP options so you don't have to use
 * a raw socket for this. Instead we check rights in the calls.
 *
 * ATTENTION: check linux/in6.h before adding new number here.
 */
#define IP6T_BASE_CTL			64

#define IP6T_SO_SET_REPLACE		(IP6T_BASE_CTL)
#define IP6T_SO_SET_ADD_COUNTERS	(IP6T_BASE_CTL + 1)
#define IP6T_SO_SET_MAX			IP6T_SO_SET_ADD_COUNTERS

#define IP6T_SO_GET_INFO		(IP6T_BASE_CTL)
#define IP6T_SO_GET_ENTRIES		(IP6T_BASE_CTL + 1)
#define IP6T_SO_GET_REVISION_MATCH	(IP6T_BASE_CTL + 4)
#define IP6T_SO_GET_REVISION_TARGET	(IP6T_BASE_CTL + 5)
#define IP6T_SO_GET_MAX			IP6T_SO_GET_REVISION_TARGET

/* CONTINUE verdict for targets */
#define IP6T_CONTINUE XT_CONTINUE

/* For standard target */
#define IP6T_RETURN XT_RETURN

/* TCP/UDP matching stuff */
#include <linux/netfilter/xt_tcpudp.h>

#define ip6t_tcp xt_tcp
#define ip6t_udp xt_udp

/* Values for "inv" field in struct ipt_tcp. */
#define IP6T_TCP_INV_SRCPT	XT_TCP_INV_SRCPT
#define IP6T_TCP_INV_DSTPT	XT_TCP_INV_DSTPT
#define IP6T_TCP_INV_FLAGS	XT_TCP_INV_FLAGS
#define IP6T_TCP_INV_OPTION	XT_TCP_INV_OPTION
#define IP6T_TCP_INV_MASK	XT_TCP_INV_MASK

/* Values for "invflags" field in struct ipt_udp. */
#define IP6T_UDP_INV_SRCPT	XT_UDP_INV_SRCPT
#define IP6T_UDP_INV_DSTPT	XT_UDP_INV_DSTPT
#define IP6T_UDP_INV_MASK	XT_UDP_INV_MASK

/* ICMP matching stuff */
struct ip6t_icmp
{
	u_int8_t type;				/* type to match */
	u_int8_t code[2];			/* range of code */
	u_int8_t invflags;			/* Inverse flags */
};

/* Values for "inv" field for struct ipt_icmp. */
#define IP6T_ICMP_INV	0x01	/* Invert the sense of type/code test */

/* The argument to IP6T_SO_GET_INFO */
struct ip6t_getinfo
{
	/* Which table: caller fills this in. */
	char name[IP6T_TABLE_MAXNAMELEN];

	/* Kernel fills these in. */
	/* Which hook entry points are valid: bitmask */
	unsigned int valid_hooks;

	/* Hook entry points: one per netfilter hook. */
	unsigned int hook_entry[NF_IP6_NUMHOOKS];

	/* Underflow points. */
	unsigned int underflow[NF_IP6_NUMHOOKS];

	/* Number of entries */
	unsigned int num_entries;

	/* Size of entries. */
	unsigned int size;
};

/* The argument to IP6T_SO_SET_REPLACE. */
struct ip6t_replace
{
	/* Which table. */
	char name[IP6T_TABLE_MAXNAMELEN];

	/* Which hook entry points are valid: bitmask.  You can't
           change this. */
	unsigned int valid_hooks;

	/* Number of entries */
	unsigned int num_entries;

	/* Total size of new entries */
	unsigned int size;

	/* Hook entry points. */
	unsigned int hook_entry[NF_IP6_NUMHOOKS];

	/* Underflow points. */
	unsigned int underflow[NF_IP6_NUMHOOKS];

	/* Information about old entries: */
	/* Number of counters (must be equal to current number of entries). */
	unsigned int num_counters;
	/* The old entries' counters. */
	struct xt_counters __user *counters;

	/* The entries (hang off end: not really an array). */
	struct ip6t_entry entries[0];
};

/* The argument to IP6T_SO_ADD_COUNTERS. */
#define ip6t_counters_info xt_counters_info

/* The argument to IP6T_SO_GET_ENTRIES. */
struct ip6t_get_entries
{
	/* Which table: user fills this in. */
	char name[IP6T_TABLE_MAXNAMELEN];

	/* User fills this in: total entry size. */
	unsigned int size;

	/* The entries. */
	struct ip6t_entry entrytable[0];
};

/* Standard return verdict, or do jump. */
#define IP6T_STANDARD_TARGET XT_STANDARD_TARGET
/* Error verdict. */
#define IP6T_ERROR_TARGET XT_ERROR_TARGET

/* Helper functions */
static __inline__ struct ip6t_entry_target *
ip6t_get_target(struct ip6t_entry *e)
{
	return (void *)e + e->target_offset;
}

/* fn returns 0 to continue iteration */
#define IP6T_MATCH_ITERATE(e, fn, args...)	\
({						\
	unsigned int __i;			\
	int __ret = 0;				\
	struct ip6t_entry_match *__m;		\
						\
	for (__i = sizeof(struct ip6t_entry);	\
	     __i < (e)->target_offset;		\
	     __i += __m->u.match_size) {	\
		__m = (void *)(e) + __i;	\
						\
		__ret = fn(__m , ## args);	\
		if (__ret != 0)			\
			break;			\
	}					\
	__ret;					\
})

/* fn returns 0 to continue iteration */
#define IP6T_ENTRY_ITERATE(entries, size, fn, args...)		\
({								\
	unsigned int __i;					\
	int __ret = 0;						\
	struct ip6t_entry *__e;					\
								\
	for (__i = 0; __i < (size); __i += __e->next_offset) {	\
		__e = (void *)(entries) + __i;			\
								\
		__ret = fn(__e , ## args);			\
		if (__ret != 0)					\
			break;					\
	}							\
	__ret;							\
})

/*
 *	Main firewall chains definitions and global var's definitions.
 */

#ifdef __KERNEL__

#include <linux/init.h>
extern void ip6t_init(void) __init;

extern int ip6t_register_table(struct ip6t_table *table,
			       const struct ip6t_replace *repl);
extern void ip6t_unregister_table(struct ip6t_table *table);
extern unsigned int ip6t_do_table(struct sk_buff **pskb,
				  unsigned int hook,
				  const struct net_device *in,
				  const struct net_device *out,
				  struct ip6t_table *table);

/* Check for an extension */
extern int ip6t_ext_hdr(u8 nexthdr);
/* find specified header and get offset to it */
extern int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
			 int target, unsigned short *fragoff);

extern int ip6_masked_addrcmp(const struct in6_addr *addr1,
			      const struct in6_addr *mask,
			      const struct in6_addr *addr2);

#define IP6T_ALIGN(s) (((s) + (__alignof__(struct ip6t_entry)-1)) & ~(__alignof__(struct ip6t_entry)-1))

#endif /*__KERNEL__*/
#endif /* _IP6_TABLES_H */
Commit	Line	Data
1da177e4 LT	1	/*
	2	* 25-Jul-1998 Major changes to allow for ip chain table
	3	*
	4	* 3-Jan-2000 Named tables to allow packet selection for different uses.
	5	*/
	6
	7	/*
	8	* Format of an IP6 firewall descriptor
	9	*
	10	* src, dst, src_mask, dst_mask are always stored in network byte order.
	11	* flags are stored in host byte order (of course).
	12	* Port numbers are stored in HOST byte order.
	13	*/
	14
	15	#ifndef _IP6_TABLES_H
	16	#define _IP6_TABLES_H
	17
	18	#ifdef __KERNEL__
	19	#include <linux/if.h>
	20	#include <linux/types.h>
	21	#include <linux/in6.h>
	22	#include <linux/ipv6.h>
	23	#include <linux/skbuff.h>
	24	#endif
	25	#include <linux/compiler.h>
	26	#include <linux/netfilter_ipv6.h>
	27
2e4e6a17 HW	28	#include <linux/netfilter/x_tables.h>
	29
	30	#define IP6T_FUNCTION_MAXNAMELEN XT_FUNCTION_MAXNAMELEN
	31	#define IP6T_TABLE_MAXNAMELEN XT_TABLE_MAXNAMELEN
	32
	33	#define ip6t_match xt_match
	34	#define ip6t_target xt_target
	35	#define ip6t_table xt_table
	36	#define ip6t_get_revision xt_get_revision
1da177e4 LT	37
	38	/* Yes, Virginia, you have to zero the padding. */
	39	struct ip6t_ip6 {
	40	/* Source and destination IP6 addr */
	41	struct in6_addr src, dst;
	42	/* Mask for src and dest IP6 addr */
	43	struct in6_addr smsk, dmsk;
	44	char iniface[IFNAMSIZ], outiface[IFNAMSIZ];
	45	unsigned char iniface_mask[IFNAMSIZ], outiface_mask[IFNAMSIZ];
	46
	47	/* ARGH, HopByHop uses 0, so can't do 0 = ANY,
	48	instead IP6T_F_NOPROTO must be set */
	49	u_int16_t proto;
	50	/* TOS to match iff flags & IP6T_F_TOS */
	51	u_int8_t tos;
	52
	53	/* Flags word */
	54	u_int8_t flags;
	55	/* Inverse flags */
	56	u_int8_t invflags;
	57	};
	58
1e30a014 DM	59	#define ip6t_entry_match xt_entry_match
	60	#define ip6t_entry_target xt_entry_target
	61	#define ip6t_standard_target xt_standard_target
1da177e4	62
2e4e6a17	63	#define ip6t_counters xt_counters
1da177e4 LT	64
	65	/* Values for "flag" field in struct ip6t_ip6 (general ip6 structure). */
	66	#define IP6T_F_PROTO 0x01 /* Set if rule cares about upper
	67	protocols */
	68	#define IP6T_F_TOS 0x02 /* Match the TOS. */
05465343 PM	69	#define IP6T_F_GOTO 0x04 /* Set if jump is a goto */
05465343 PM	70	#define IP6T_F_MASK 0x07 /* All possible flag bits mask. */
1da177e4 LT	71
	72	/* Values for "inv" field in struct ip6t_ip6. */
	73	#define IP6T_INV_VIA_IN 0x01 /* Invert the sense of IN IFACE. */
	74	#define IP6T_INV_VIA_OUT 0x02 /* Invert the sense of OUT IFACE */
	75	#define IP6T_INV_TOS 0x04 /* Invert the sense of TOS. */
	76	#define IP6T_INV_SRCIP 0x08 /* Invert the sense of SRC IP. */
	77	#define IP6T_INV_DSTIP 0x10 /* Invert the sense of DST OP. */
	78	#define IP6T_INV_FRAG 0x20 /* Invert the sense of FRAG. */
2e4e6a17	79	#define IP6T_INV_PROTO XT_INV_PROTO
1da177e4 LT	80	#define IP6T_INV_MASK 0x7F /* All possible flag bits mask. */
	81
	82	/* This structure defines each of the firewall rules. Consists of 3
	83	parts which are 1) general IP header stuff 2) match specific
	84	stuff 3) the target to perform if the rule matches */
	85	struct ip6t_entry
	86	{
	87	struct ip6t_ip6 ipv6;
	88
	89	/* Mark with fields that we care about. */
	90	unsigned int nfcache;
	91
	92	/* Size of ipt_entry + matches */
	93	u_int16_t target_offset;
	94	/* Size of ipt_entry + matches + target */
	95	u_int16_t next_offset;
	96
	97	/* Back pointer */
	98	unsigned int comefrom;
	99
	100	/* Packet and byte counters. */
2e4e6a17	101	struct xt_counters counters;
1da177e4 LT	102
	103	/* The matches (if any), then the target. */
	104	unsigned char elems[0];
	105	};
	106
	107	/*
	108	* New IP firewall options for [gs]etsockopt at the RAW IP level.
	109	* Unlike BSD Linux inherits IP options so you don't have to use
b96e7ecb YK	110	* a raw socket for this. Instead we check rights in the calls.
	111	*
	112	* ATTENTION: check linux/in6.h before adding new number here.
	113	*/
	114	#define IP6T_BASE_CTL 64
	115
	116	#define IP6T_SO_SET_REPLACE (IP6T_BASE_CTL)
	117	#define IP6T_SO_SET_ADD_COUNTERS (IP6T_BASE_CTL + 1)
	118	#define IP6T_SO_SET_MAX IP6T_SO_SET_ADD_COUNTERS
	119
	120	#define IP6T_SO_GET_INFO (IP6T_BASE_CTL)
	121	#define IP6T_SO_GET_ENTRIES (IP6T_BASE_CTL + 1)
	122	#define IP6T_SO_GET_REVISION_MATCH (IP6T_BASE_CTL + 4)
	123	#define IP6T_SO_GET_REVISION_TARGET (IP6T_BASE_CTL + 5)
	124	#define IP6T_SO_GET_MAX IP6T_SO_GET_REVISION_TARGET
1da177e4 LT	125
1da177e4 LT	126	/* CONTINUE verdict for targets */
2e4e6a17	127	#define IP6T_CONTINUE XT_CONTINUE
1da177e4 LT	128
1da177e4 LT	129	/* For standard target */
2e4e6a17	130	#define IP6T_RETURN XT_RETURN
1da177e4	131
2e4e6a17 HW	132	/* TCP/UDP matching stuff */
	133	#include <linux/netfilter/xt_tcpudp.h>
	134
	135	#define ip6t_tcp xt_tcp
	136	#define ip6t_udp xt_udp
1da177e4 LT	137
1da177e4 LT	138	/* Values for "inv" field in struct ipt_tcp. */
2e4e6a17 HW	139	#define IP6T_TCP_INV_SRCPT XT_TCP_INV_SRCPT
	140	#define IP6T_TCP_INV_DSTPT XT_TCP_INV_DSTPT
	141	#define IP6T_TCP_INV_FLAGS XT_TCP_INV_FLAGS
	142	#define IP6T_TCP_INV_OPTION XT_TCP_INV_OPTION
	143	#define IP6T_TCP_INV_MASK XT_TCP_INV_MASK
1da177e4 LT	144
1da177e4 LT	145	/* Values for "invflags" field in struct ipt_udp. */
2e4e6a17 HW	146	#define IP6T_UDP_INV_SRCPT XT_UDP_INV_SRCPT
	147	#define IP6T_UDP_INV_DSTPT XT_UDP_INV_DSTPT
	148	#define IP6T_UDP_INV_MASK XT_UDP_INV_MASK
1da177e4 LT	149
	150	/* ICMP matching stuff */
	151	struct ip6t_icmp
	152	{
	153	u_int8_t type; /* type to match */
	154	u_int8_t code[2]; /* range of code */
	155	u_int8_t invflags; /* Inverse flags */
	156	};
	157
	158	/* Values for "inv" field for struct ipt_icmp. */
	159	#define IP6T_ICMP_INV 0x01 /* Invert the sense of type/code test */
	160
	161	/* The argument to IP6T_SO_GET_INFO */
	162	struct ip6t_getinfo
	163	{
	164	/* Which table: caller fills this in. */
	165	char name[IP6T_TABLE_MAXNAMELEN];
	166
	167	/* Kernel fills these in. */
	168	/* Which hook entry points are valid: bitmask */
	169	unsigned int valid_hooks;
	170
	171	/* Hook entry points: one per netfilter hook. */
	172	unsigned int hook_entry[NF_IP6_NUMHOOKS];
	173
	174	/* Underflow points. */
	175	unsigned int underflow[NF_IP6_NUMHOOKS];
	176
	177	/* Number of entries */
	178	unsigned int num_entries;
	179
	180	/* Size of entries. */
	181	unsigned int size;
	182	};
	183
	184	/* The argument to IP6T_SO_SET_REPLACE. */
	185	struct ip6t_replace
	186	{
	187	/* Which table. */
	188	char name[IP6T_TABLE_MAXNAMELEN];
	189
	190	/* Which hook entry points are valid: bitmask. You can't
	191	change this. */
	192	unsigned int valid_hooks;
	193
	194	/* Number of entries */
	195	unsigned int num_entries;
	196
	197	/* Total size of new entries */
	198	unsigned int size;
	199
	200	/* Hook entry points. */
	201	unsigned int hook_entry[NF_IP6_NUMHOOKS];
	202
	203	/* Underflow points. */
	204	unsigned int underflow[NF_IP6_NUMHOOKS];
	205
	206	/* Information about old entries: */
	207	/* Number of counters (must be equal to current number of entries). */
	208	unsigned int num_counters;
	209	/* The old entries' counters. */
2e4e6a17	210	struct xt_counters __user *counters;
1da177e4 LT	211
	212	/* The entries (hang off end: not really an array). */
	213	struct ip6t_entry entries[0];
	214	};
	215
	216	/* The argument to IP6T_SO_ADD_COUNTERS. */
2e4e6a17	217	#define ip6t_counters_info xt_counters_info
1da177e4 LT	218
	219	/* The argument to IP6T_SO_GET_ENTRIES. */
	220	struct ip6t_get_entries
	221	{
	222	/* Which table: user fills this in. */
	223	char name[IP6T_TABLE_MAXNAMELEN];
	224
	225	/* User fills this in: total entry size. */
	226	unsigned int size;
	227
	228	/* The entries. */
	229	struct ip6t_entry entrytable[0];
	230	};
	231
	232	/* Standard return verdict, or do jump. */
2e4e6a17	233	#define IP6T_STANDARD_TARGET XT_STANDARD_TARGET
1da177e4	234	/* Error verdict. */
2e4e6a17	235	#define IP6T_ERROR_TARGET XT_ERROR_TARGET
1da177e4 LT	236
	237	/* Helper functions */
	238	static __inline__ struct ip6t_entry_target *
	239	ip6t_get_target(struct ip6t_entry *e)
	240	{
	241	return (void *)e + e->target_offset;
	242	}
	243
	244	/* fn returns 0 to continue iteration */
	245	#define IP6T_MATCH_ITERATE(e, fn, args...) \
	246	({ \
	247	unsigned int __i; \
	248	int __ret = 0; \
	249	struct ip6t_entry_match *__m; \
	250	\
	251	for (__i = sizeof(struct ip6t_entry); \
	252	__i < (e)->target_offset; \
	253	__i += __m->u.match_size) { \
	254	__m = (void *)(e) + __i; \
	255	\
	256	__ret = fn(__m , ## args); \
	257	if (__ret != 0) \
	258	break; \
	259	} \
	260	__ret; \
	261	})
	262
	263	/* fn returns 0 to continue iteration */
	264	#define IP6T_ENTRY_ITERATE(entries, size, fn, args...) \
	265	({ \
	266	unsigned int __i; \
	267	int __ret = 0; \
	268	struct ip6t_entry *__e; \
	269	\
	270	for (__i = 0; __i < (size); __i += __e->next_offset) { \
	271	__e = (void *)(entries) + __i; \
	272	\
	273	__ret = fn(__e , ## args); \
	274	if (__ret != 0) \
	275	break; \
	276	} \
	277	__ret; \
	278	})
	279
	280	/*
	281	* Main firewall chains definitions and global var's definitions.
	282	*/
	283
	284	#ifdef __KERNEL__
	285
	286	#include <linux/init.h>
	287	extern void ip6t_init(void) __init;
	288
1da177e4 LT	289	extern int ip6t_register_table(struct ip6t_table *table,
	290	const struct ip6t_replace *repl);
	291	extern void ip6t_unregister_table(struct ip6t_table *table);
	292	extern unsigned int ip6t_do_table(struct sk_buff **pskb,
	293	unsigned int hook,
	294	const struct net_device *in,
	295	const struct net_device *out,
fe1cb108	296	struct ip6t_table *table);
1da177e4 LT	297
	298	/* Check for an extension */
	299	extern int ip6t_ext_hdr(u8 nexthdr);
e674d0f3 YK	300	/* find specified header and get offset to it */
e674d0f3 YK	301	extern int ipv6_find_hdr(const struct sk_buff skb, unsigned int offset,
b777e0ce	302	int target, unsigned short *fragoff);
1da177e4	303
22dea562 PM	304	extern int ip6_masked_addrcmp(const struct in6_addr *addr1,
	305	const struct in6_addr *mask,
	306	const struct in6_addr *addr2);
	307
1da177e4 LT	308	#define IP6T_ALIGN(s) (((s) + (__alignof__(struct ip6t_entry)-1)) & ~(__alignof__(struct ip6t_entry)-1))
	309
	310	#endif /__KERNEL__/
	311	#endif /* _IP6_TABLES_H */