sysdeps/unix/sysv/linux/netinet/ip_fw.h

   1 /* Copyright (C) 1991, 92, 93, 95, 96, 97 Free Software Foundation, Inc.
   2    This file is part of the GNU C Library.
   3
   4    The GNU C Library is free software; you can redistribute it and/or
   5    modify it under the terms of the GNU Library General Public License as
   6    published by the Free Software Foundation; either version 2 of the
   7    License, or (at your option) any later version.
   8
   9    The GNU C Library is distributed in the hope that it will be useful,
  10    but WITHOUT ANY WARRANTY; without even the implied warranty of
  11    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12    Library General Public License for more details.
  13
  14    You should have received a copy of the GNU Library General Public
  15    License along with the GNU C Library; see the file COPYING.LIB.  If not,
  16    write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
  17    Boston, MA 02111-1307, USA.  */
  18
  19 /* This header file was taken from linux (2.1.26) sources and modified
  20  * to work under GNU LIBC 2.0.
  21  */
  22
  23 /*
  24  * Copyright (c) 1993 Daniel Boulet
  25  * Copyright (c) 1994 Ugen J.S.Antsilevich
  26  *
  27  * Redistribution and use in source forms, with and without modification,
  28  * are permitted provided that this entire comment appears intact.
  29  *
  30  * Redistribution in binary form may occur without any restrictions.
  31  * Obviously, it would be nice if you gave credit where credit is due
  32  * but requiring it would be too onerous.
  33  *
  34  * This software is provided ``AS IS'' without any warranties of any kind.
  35  */
  36
  37 /*
  38  *      Format of an IP firewall descriptor
  39  *
  40  *      src, dst, src_mask, dst_mask are always stored in network byte order.
  41  *      flags and num_*_ports are stored in host byte order (of course).
  42  *      Port numbers are stored in HOST byte order.
  43  */
  44
  45 #ifndef _NETINET_FW_H
  46 #define _NETINET_FW_H
  47
  48 #include <sys/cdefs.h>
  49 #include <sys/types.h>
  50
  51 #include <netinet/ip_icmp.h>
  52 #include <netinet/in.h>
  53 #include <netinet/ip.h>
  54 #include <netinet/tcp.h>
  55 #include <netinet/udp.h>
  56
  57 __BEGIN_DECLS
  58
  59 struct ip_fw {
  60   struct ip_fw  *fw_next;               /* Next firewall on chain */
  61   struct in_addr fw_src, fw_dst;        /* Source and destination IP addr */
  62   struct in_addr fw_smsk, fw_dmsk;      /* Mask for src and dest IP addr */
  63   struct in_addr fw_via;                /* IP address of interface "via" */
  64   void *fw_viadev;                      /* device of interface "via" */
  65   u_int16_t fw_flg;                     /* Flags word */
  66   u_int16_t fw_nsp, fw_ndp;             /* N'of src ports and # of dst ports */
  67                                         /* in ports array (dst ports follow */
  68                                         /* src ports; max of 10 ports in all;*/
  69                                         /* count of 0 means match all ports) */
  70 #define IP_FW_MAX_PORTS 10              /* A reasonable maximum */
  71   u_int16_t fw_pts[IP_FW_MAX_PORTS];    /* Array of port numbers to match */
  72   u_int32_t fw_pcnt, fw_bcnt;           /* Packet and byte counters */
  73   u_int8_t fw_tosand, fw_tosxor;        /* Revised packet priority */
  74   char fw_vianame[IFNAMSIZ];            /* name of interface "via" */
  75 };
  76
  77 /*
  78  *      Values for "flags" field .
  79  */
  80
  81 #define IP_FW_F_ALL     0x0000  /* This is a universal packet firewall*/
  82 #define IP_FW_F_TCP     0x0001  /* This is a TCP packet firewall      */
  83 #define IP_FW_F_UDP     0x0002  /* This is a UDP packet firewall      */
  84 #define IP_FW_F_ICMP    0x0003  /* This is a ICMP packet firewall     */
  85 #define IP_FW_F_KIND    0x0003  /* Mask to isolate firewall kind      */
  86 #define IP_FW_F_ACCEPT  0x0004  /* This is an accept firewall (as     *
  87                                  *         opposed to a deny firewall)*
  88                                  *                                    */
  89 #define IP_FW_F_SRNG    0x0008  /* The first two src ports are a min  *
  90                                  * and max range (stored in host byte *
  91                                  * order).                            *
  92                                  *                                    */
  93 #define IP_FW_F_DRNG    0x0010  /* The first two dst ports are a min  *
  94                                  * and max range (stored in host byte *
  95                                  * order).                            *
  96                                  * (ports[0] <= port <= ports[1])     *
  97                                  *                                    */
  98 #define IP_FW_F_PRN     0x0020  /* In verbose mode print this firewall*/
  99 #define IP_FW_F_BIDIR   0x0040  /* For bidirectional firewalls        */
 100 #define IP_FW_F_TCPSYN  0x0080  /* For tcp packets-check SYN only     */
 101 #define IP_FW_F_ICMPRPL 0x0100  /* Send back icmp unreachable packet  */
 102 #define IP_FW_F_MASQ    0x0200  /* Masquerading                       */
 103 #define IP_FW_F_TCPACK  0x0400  /* For tcp-packets match if ACK is set*/
 104 #define IP_FW_F_REDIR   0x0800  /* Redirect to local port fw_pts[n]   */
 105 #define IP_FW_F_ACCTIN  0x1000  /* Account incoming packets only.     */
 106 #define IP_FW_F_ACCTOUT 0x2000  /* Account outgoing packets only.     */
 107
 108 #define IP_FW_F_MASK    0x3FFF  /* All possible flag bits mask        */
 109
 110 /*
 111  *      New IP firewall options for [gs]etsockopt at the RAW IP level.
 112  *      Unlike BSD Linux inherits IP options so you don't have to use
 113  *      a raw socket for this. Instead we check rights in the calls.
 114  */
 115
 116 #define IP_FW_BASE_CTL          64      /* base for firewall socket options */
 117
 118 #define IP_FW_COMMAND           0x00FF  /* mask for command without chain */
 119 #define IP_FW_TYPE              0x0300  /* mask for type (chain) */
 120 #define IP_FW_SHIFT             8       /* shift count for type (chain) */
 121
 122 #define IP_FW_FWD               0
 123 #define IP_FW_IN                1
 124 #define IP_FW_OUT               2
 125 #define IP_FW_ACCT              3
 126 #define IP_FW_CHAINS            4       /* total number of ip_fw chains */
 127
 128 #define IP_FW_INSERT            (IP_FW_BASE_CTL)
 129 #define IP_FW_APPEND            (IP_FW_BASE_CTL+1)
 130 #define IP_FW_DELETE            (IP_FW_BASE_CTL+2)
 131 #define IP_FW_FLUSH             (IP_FW_BASE_CTL+3)
 132 #define IP_FW_ZERO              (IP_FW_BASE_CTL+4)
 133 #define IP_FW_POLICY            (IP_FW_BASE_CTL+5)
 134 #define IP_FW_CHECK             (IP_FW_BASE_CTL+6)
 135 #define IP_FW_MASQ_TIMEOUTS     (IP_FW_BASE_CTL+7)
 136
 137 #define IP_FW_INSERT_FWD        (IP_FW_INSERT | (IP_FW_FWD << IP_FW_SHIFT))
 138 #define IP_FW_APPEND_FWD        (IP_FW_APPEND | (IP_FW_FWD << IP_FW_SHIFT))
 139 #define IP_FW_DELETE_FWD        (IP_FW_DELETE | (IP_FW_FWD << IP_FW_SHIFT))
 140 #define IP_FW_FLUSH_FWD         (IP_FW_FLUSH  | (IP_FW_FWD << IP_FW_SHIFT))
 141 #define IP_FW_ZERO_FWD          (IP_FW_ZERO   | (IP_FW_FWD << IP_FW_SHIFT))
 142 #define IP_FW_POLICY_FWD        (IP_FW_POLICY | (IP_FW_FWD << IP_FW_SHIFT))
 143 #define IP_FW_CHECK_FWD         (IP_FW_CHECK  | (IP_FW_FWD << IP_FW_SHIFT))
 144
 145 #define IP_FW_INSERT_IN         (IP_FW_INSERT | (IP_FW_IN << IP_FW_SHIFT))
 146 #define IP_FW_APPEND_IN         (IP_FW_APPEND | (IP_FW_IN << IP_FW_SHIFT))
 147 #define IP_FW_DELETE_IN         (IP_FW_DELETE | (IP_FW_IN << IP_FW_SHIFT))
 148 #define IP_FW_FLUSH_IN          (IP_FW_FLUSH  | (IP_FW_IN << IP_FW_SHIFT))
 149 #define IP_FW_ZERO_IN           (IP_FW_ZERO   | (IP_FW_IN << IP_FW_SHIFT))
 150 #define IP_FW_POLICY_IN         (IP_FW_POLICY | (IP_FW_IN << IP_FW_SHIFT))
 151 #define IP_FW_CHECK_IN          (IP_FW_CHECK  | (IP_FW_IN << IP_FW_SHIFT))
 152
 153 #define IP_FW_INSERT_OUT        (IP_FW_INSERT | (IP_FW_OUT << IP_FW_SHIFT))
 154 #define IP_FW_APPEND_OUT        (IP_FW_APPEND | (IP_FW_OUT << IP_FW_SHIFT))
 155 #define IP_FW_DELETE_OUT        (IP_FW_DELETE | (IP_FW_OUT << IP_FW_SHIFT))
 156 #define IP_FW_FLUSH_OUT         (IP_FW_FLUSH  | (IP_FW_OUT << IP_FW_SHIFT))
 157 #define IP_FW_ZERO_OUT          (IP_FW_ZERO   | (IP_FW_OUT << IP_FW_SHIFT))
 158 #define IP_FW_POLICY_OUT        (IP_FW_POLICY | (IP_FW_OUT << IP_FW_SHIFT))
 159 #define IP_FW_CHECK_OUT         (IP_FW_CHECK  | (IP_FW_OUT << IP_FW_SHIFT))
 160
 161 #define IP_ACCT_INSERT          (IP_FW_INSERT | (IP_FW_ACCT << IP_FW_SHIFT))
 162 #define IP_ACCT_APPEND          (IP_FW_APPEND | (IP_FW_ACCT << IP_FW_SHIFT))
 163 #define IP_ACCT_DELETE          (IP_FW_DELETE | (IP_FW_ACCT << IP_FW_SHIFT))
 164 #define IP_ACCT_FLUSH           (IP_FW_FLUSH  | (IP_FW_ACCT << IP_FW_SHIFT))
 165 #define IP_ACCT_ZERO            (IP_FW_ZERO   | (IP_FW_ACCT << IP_FW_SHIFT))
 166
 167 struct ip_fwpkt
 168 {
 169   struct iphdr fwp_iph;                 /* IP header */
 170   union {
 171     struct tcphdr fwp_tcph;             /* TCP header or */
 172     struct udphdr fwp_udph;             /* UDP header */
 173     struct icmphdr fwp_icmph;           /* ICMP header */
 174   } fwp_protoh;
 175   struct in_addr fwp_via;               /* interface address */
 176   char fwp_vianame[IFNAMSIZ];           /* interface name */
 177 };
 178
 179 /*
 180  * timeouts for ip masquerading
 181  */
 182
 183 struct ip_fw_masq;
 184
 185 __END_DECLS
 186
 187 #endif /* _NETINET_IP_FW_H */