2 * 25-Jul-1998 Major changes to allow for ip chain table
4 * 3-Jan-2000 Named tables to allow packet selection for different uses.
8 * Format of an IP6 firewall descriptor
10 * src, dst, src_mask, dst_mask are always stored in network byte order.
11 * flags are stored in host byte order (of course).
12 * Port numbers are stored in HOST byte order.
20 #include <linux/in6.h>
21 #include <linux/ipv6.h>
22 #include <linux/skbuff.h>
24 #include <linux/types.h>
25 #include <linux/compiler.h>
26 #include <linux/netfilter_ipv6.h>
28 #include <linux/netfilter/x_tables.h>
30 #define IP6T_FUNCTION_MAXNAMELEN XT_FUNCTION_MAXNAMELEN
31 #define IP6T_TABLE_MAXNAMELEN XT_TABLE_MAXNAMELEN
33 #define ip6t_match xt_match
34 #define ip6t_target xt_target
35 #define ip6t_table xt_table
36 #define ip6t_get_revision xt_get_revision
38 /* Yes, Virginia, you have to zero the padding. */
40 /* Source and destination IP6 addr */
41 struct in6_addr src
, dst
;
42 /* Mask for src and dest IP6 addr */
43 struct in6_addr smsk
, dmsk
;
44 char iniface
[IFNAMSIZ
], outiface
[IFNAMSIZ
];
45 unsigned char iniface_mask
[IFNAMSIZ
], outiface_mask
[IFNAMSIZ
];
47 /* Upper protocol number
48 * - The allowed value is 0 (any) or protocol number of last parsable
49 * header, which is 50 (ESP), 59 (No Next Header), 135 (MH), or
50 * the non IPv6 extension headers.
51 * - The protocol numbers of IPv6 extension headers except of ESP and
52 * MH do not match any packets.
53 * - You also need to set IP6T_FLAGS_PROTO to "flags" to check protocol.
56 /* TOS to match iff flags & IP6T_F_TOS */
65 #define ip6t_entry_match xt_entry_match
66 #define ip6t_entry_target xt_entry_target
67 #define ip6t_standard_target xt_standard_target
69 #define ip6t_counters xt_counters
71 /* Values for "flag" field in struct ip6t_ip6 (general ip6 structure). */
72 #define IP6T_F_PROTO 0x01 /* Set if rule cares about upper
74 #define IP6T_F_TOS 0x02 /* Match the TOS. */
75 #define IP6T_F_GOTO 0x04 /* Set if jump is a goto */
76 #define IP6T_F_MASK 0x07 /* All possible flag bits mask. */
78 /* Values for "inv" field in struct ip6t_ip6. */
79 #define IP6T_INV_VIA_IN 0x01 /* Invert the sense of IN IFACE. */
80 #define IP6T_INV_VIA_OUT 0x02 /* Invert the sense of OUT IFACE */
81 #define IP6T_INV_TOS 0x04 /* Invert the sense of TOS. */
82 #define IP6T_INV_SRCIP 0x08 /* Invert the sense of SRC IP. */
83 #define IP6T_INV_DSTIP 0x10 /* Invert the sense of DST OP. */
84 #define IP6T_INV_FRAG 0x20 /* Invert the sense of FRAG. */
85 #define IP6T_INV_PROTO XT_INV_PROTO
86 #define IP6T_INV_MASK 0x7F /* All possible flag bits mask. */
88 /* This structure defines each of the firewall rules. Consists of 3
89 parts which are 1) general IP header stuff 2) match specific
90 stuff 3) the target to perform if the rule matches */
94 /* Mark with fields that we care about. */
97 /* Size of ipt_entry + matches */
98 u_int16_t target_offset
;
99 /* Size of ipt_entry + matches + target */
100 u_int16_t next_offset
;
103 unsigned int comefrom
;
105 /* Packet and byte counters. */
106 struct xt_counters counters
;
108 /* The matches (if any), then the target. */
109 unsigned char elems
[0];
113 struct ip6t_standard
{
114 struct ip6t_entry entry
;
115 struct ip6t_standard_target target
;
118 struct ip6t_error_target
{
119 struct ip6t_entry_target target
;
120 char errorname
[IP6T_FUNCTION_MAXNAMELEN
];
124 struct ip6t_entry entry
;
125 struct ip6t_error_target target
;
128 #define IP6T_ENTRY_INIT(__size) \
130 .target_offset = sizeof(struct ip6t_entry), \
131 .next_offset = (__size), \
134 #define IP6T_STANDARD_INIT(__verdict) \
136 .entry = IP6T_ENTRY_INIT(sizeof(struct ip6t_standard)), \
137 .target = XT_TARGET_INIT(IP6T_STANDARD_TARGET, \
138 sizeof(struct ip6t_standard_target)), \
139 .target.verdict = -(__verdict) - 1, \
142 #define IP6T_ERROR_INIT \
144 .entry = IP6T_ENTRY_INIT(sizeof(struct ip6t_error)), \
145 .target = XT_TARGET_INIT(IP6T_ERROR_TARGET, \
146 sizeof(struct ip6t_error_target)), \
147 .target.errorname = "ERROR", \
151 * New IP firewall options for [gs]etsockopt at the RAW IP level.
152 * Unlike BSD Linux inherits IP options so you don't have to use
153 * a raw socket for this. Instead we check rights in the calls.
155 * ATTENTION: check linux/in6.h before adding new number here.
157 #define IP6T_BASE_CTL 64
159 #define IP6T_SO_SET_REPLACE (IP6T_BASE_CTL)
160 #define IP6T_SO_SET_ADD_COUNTERS (IP6T_BASE_CTL + 1)
161 #define IP6T_SO_SET_MAX IP6T_SO_SET_ADD_COUNTERS
163 #define IP6T_SO_GET_INFO (IP6T_BASE_CTL)
164 #define IP6T_SO_GET_ENTRIES (IP6T_BASE_CTL + 1)
165 #define IP6T_SO_GET_REVISION_MATCH (IP6T_BASE_CTL + 4)
166 #define IP6T_SO_GET_REVISION_TARGET (IP6T_BASE_CTL + 5)
167 #define IP6T_SO_GET_MAX IP6T_SO_GET_REVISION_TARGET
169 /* CONTINUE verdict for targets */
170 #define IP6T_CONTINUE XT_CONTINUE
172 /* For standard target */
173 #define IP6T_RETURN XT_RETURN
175 /* TCP/UDP matching stuff */
176 #include <linux/netfilter/xt_tcpudp.h>
178 #define ip6t_tcp xt_tcp
179 #define ip6t_udp xt_udp
181 /* Values for "inv" field in struct ipt_tcp. */
182 #define IP6T_TCP_INV_SRCPT XT_TCP_INV_SRCPT
183 #define IP6T_TCP_INV_DSTPT XT_TCP_INV_DSTPT
184 #define IP6T_TCP_INV_FLAGS XT_TCP_INV_FLAGS
185 #define IP6T_TCP_INV_OPTION XT_TCP_INV_OPTION
186 #define IP6T_TCP_INV_MASK XT_TCP_INV_MASK
188 /* Values for "invflags" field in struct ipt_udp. */
189 #define IP6T_UDP_INV_SRCPT XT_UDP_INV_SRCPT
190 #define IP6T_UDP_INV_DSTPT XT_UDP_INV_DSTPT
191 #define IP6T_UDP_INV_MASK XT_UDP_INV_MASK
193 /* ICMP matching stuff */
195 u_int8_t type
; /* type to match */
196 u_int8_t code
[2]; /* range of code */
197 u_int8_t invflags
; /* Inverse flags */
200 /* Values for "inv" field for struct ipt_icmp. */
201 #define IP6T_ICMP_INV 0x01 /* Invert the sense of type/code test */
203 /* The argument to IP6T_SO_GET_INFO */
204 struct ip6t_getinfo
{
205 /* Which table: caller fills this in. */
206 char name
[IP6T_TABLE_MAXNAMELEN
];
208 /* Kernel fills these in. */
209 /* Which hook entry points are valid: bitmask */
210 unsigned int valid_hooks
;
212 /* Hook entry points: one per netfilter hook. */
213 unsigned int hook_entry
[NF_INET_NUMHOOKS
];
215 /* Underflow points. */
216 unsigned int underflow
[NF_INET_NUMHOOKS
];
218 /* Number of entries */
219 unsigned int num_entries
;
221 /* Size of entries. */
225 /* The argument to IP6T_SO_SET_REPLACE. */
226 struct ip6t_replace
{
228 char name
[IP6T_TABLE_MAXNAMELEN
];
230 /* Which hook entry points are valid: bitmask. You can't
232 unsigned int valid_hooks
;
234 /* Number of entries */
235 unsigned int num_entries
;
237 /* Total size of new entries */
240 /* Hook entry points. */
241 unsigned int hook_entry
[NF_INET_NUMHOOKS
];
243 /* Underflow points. */
244 unsigned int underflow
[NF_INET_NUMHOOKS
];
246 /* Information about old entries: */
247 /* Number of counters (must be equal to current number of entries). */
248 unsigned int num_counters
;
249 /* The old entries' counters. */
250 struct xt_counters __user
*counters
;
252 /* The entries (hang off end: not really an array). */
253 struct ip6t_entry entries
[0];
256 /* The argument to IP6T_SO_ADD_COUNTERS. */
257 #define ip6t_counters_info xt_counters_info
259 /* The argument to IP6T_SO_GET_ENTRIES. */
260 struct ip6t_get_entries
{
261 /* Which table: user fills this in. */
262 char name
[IP6T_TABLE_MAXNAMELEN
];
264 /* User fills this in: total entry size. */
268 struct ip6t_entry entrytable
[0];
271 /* Standard return verdict, or do jump. */
272 #define IP6T_STANDARD_TARGET XT_STANDARD_TARGET
274 #define IP6T_ERROR_TARGET XT_ERROR_TARGET
276 /* Helper functions */
277 static __inline__
struct ip6t_entry_target
*
278 ip6t_get_target(struct ip6t_entry
*e
)
280 return (void *)e
+ e
->target_offset
;
283 /* fn returns 0 to continue iteration */
284 #define IP6T_MATCH_ITERATE(e, fn, args...) \
285 XT_MATCH_ITERATE(struct ip6t_entry, e, fn, ## args)
287 /* fn returns 0 to continue iteration */
288 #define IP6T_ENTRY_ITERATE(entries, size, fn, args...) \
289 XT_ENTRY_ITERATE(struct ip6t_entry, entries, size, fn, ## args)
292 * Main firewall chains definitions and global var's definitions.
297 #include <linux/init.h>
298 extern void ip6t_init(void) __init
;
300 extern struct xt_table
*ip6t_register_table(struct net
*net
,
301 const struct xt_table
*table
,
302 const struct ip6t_replace
*repl
);
303 extern void ip6t_unregister_table(struct net
*net
, struct xt_table
*table
);
304 extern unsigned int ip6t_do_table(struct sk_buff
*skb
,
306 const struct net_device
*in
,
307 const struct net_device
*out
,
308 struct xt_table
*table
);
310 /* Check for an extension */
311 extern int ip6t_ext_hdr(u8 nexthdr
);
312 /* find specified header and get offset to it */
313 extern int ipv6_find_hdr(const struct sk_buff
*skb
, unsigned int *offset
,
314 int target
, unsigned short *fragoff
);
316 extern int ip6_masked_addrcmp(const struct in6_addr
*addr1
,
317 const struct in6_addr
*mask
,
318 const struct in6_addr
*addr2
);
320 #define IP6T_ALIGN(s) XT_ALIGN(s)
323 #include <net/compat.h>
325 struct compat_ip6t_entry
{
326 struct ip6t_ip6 ipv6
;
327 compat_uint_t nfcache
;
328 u_int16_t target_offset
;
329 u_int16_t next_offset
;
330 compat_uint_t comefrom
;
331 struct compat_xt_counters counters
;
332 unsigned char elems
[0];
335 static inline struct ip6t_entry_target
*
336 compat_ip6t_get_target(struct compat_ip6t_entry
*e
)
338 return (void *)e
+ e
->target_offset
;
341 #define COMPAT_IP6T_ALIGN(s) COMPAT_XT_ALIGN(s)
343 /* fn returns 0 to continue iteration */
344 #define COMPAT_IP6T_MATCH_ITERATE(e, fn, args...) \
345 XT_MATCH_ITERATE(struct compat_ip6t_entry, e, fn, ## args)
347 /* fn returns 0 to continue iteration */
348 #define COMPAT_IP6T_ENTRY_ITERATE(entries, size, fn, args...) \
349 XT_ENTRY_ITERATE(struct compat_ip6t_entry, entries, size, fn, ## args)
351 #define COMPAT_IP6T_ENTRY_ITERATE_CONTINUE(entries, size, n, fn, args...) \
352 XT_ENTRY_ITERATE_CONTINUE(struct compat_ip6t_entry, entries, size, n, \
355 #endif /* CONFIG_COMPAT */
356 #endif /*__KERNEL__*/
357 #endif /* _IP6_TABLES_H */