2 * Format of an ARP firewall descriptor
4 * src, tgt, src_mask, tgt_mask, arpop, arpop_mask are always stored in
6 * flags are stored in host byte order (of course).
14 #include <linux/types.h>
16 #include <linux/if_arp.h>
17 #include <linux/skbuff.h>
19 #include <linux/compiler.h>
20 #include <linux/netfilter_arp.h>
22 #define ARPT_FUNCTION_MAXNAMELEN 30
23 #define ARPT_TABLE_MAXNAMELEN 32
25 #define ARPT_DEV_ADDR_LEN_MAX 16
27 struct arpt_devaddr_info
{
28 char addr
[ARPT_DEV_ADDR_LEN_MAX
];
29 char mask
[ARPT_DEV_ADDR_LEN_MAX
];
32 /* Yes, Virginia, you have to zero the padding. */
34 /* Source and target IP addr */
35 struct in_addr src
, tgt
;
36 /* Mask for src and target IP addr */
37 struct in_addr smsk
, tmsk
;
39 /* Device hw address length, src+target device addresses */
40 u_int8_t arhln
, arhln_mask
;
41 struct arpt_devaddr_info src_devaddr
;
42 struct arpt_devaddr_info tgt_devaddr
;
44 /* ARP operation code. */
45 u_int16_t arpop
, arpop_mask
;
47 /* ARP hardware address and protocol address format. */
48 u_int16_t arhrd
, arhrd_mask
;
49 u_int16_t arpro
, arpro_mask
;
51 /* The protocol address length is only accepted if it is 4
52 * so there is no use in offering a way to do filtering on it.
55 char iniface
[IFNAMSIZ
], outiface
[IFNAMSIZ
];
56 unsigned char iniface_mask
[IFNAMSIZ
], outiface_mask
[IFNAMSIZ
];
64 struct arpt_entry_target
68 u_int16_t target_size
;
70 /* Used by userspace */
71 char name
[ARPT_FUNCTION_MAXNAMELEN
];
74 u_int16_t target_size
;
76 /* Used inside the kernel */
77 struct arpt_target
*target
;
81 u_int16_t target_size
;
84 unsigned char data
[0];
87 struct arpt_standard_target
89 struct arpt_entry_target target
;
95 u_int64_t pcnt
, bcnt
; /* Packet and byte counters */
98 /* Values for "flag" field in struct arpt_ip (general arp structure).
99 * No flags defined yet.
101 #define ARPT_F_MASK 0x00 /* All possible flag bits mask. */
103 /* Values for "inv" field in struct arpt_arp. */
104 #define ARPT_INV_VIA_IN 0x0001 /* Invert the sense of IN IFACE. */
105 #define ARPT_INV_VIA_OUT 0x0002 /* Invert the sense of OUT IFACE */
106 #define ARPT_INV_SRCIP 0x0004 /* Invert the sense of SRC IP. */
107 #define ARPT_INV_TGTIP 0x0008 /* Invert the sense of TGT IP. */
108 #define ARPT_INV_SRCDEVADDR 0x0010 /* Invert the sense of SRC DEV ADDR. */
109 #define ARPT_INV_TGTDEVADDR 0x0020 /* Invert the sense of TGT DEV ADDR. */
110 #define ARPT_INV_ARPOP 0x0040 /* Invert the sense of ARP OP. */
111 #define ARPT_INV_ARPHRD 0x0080 /* Invert the sense of ARP HRD. */
112 #define ARPT_INV_ARPPRO 0x0100 /* Invert the sense of ARP PRO. */
113 #define ARPT_INV_ARPHLN 0x0200 /* Invert the sense of ARP HLN. */
114 #define ARPT_INV_MASK 0x03FF /* All possible flag bits mask. */
116 /* This structure defines each of the firewall rules. Consists of 3
117 parts which are 1) general ARP header stuff 2) match specific
118 stuff 3) the target to perform if the rule matches */
123 /* Size of arpt_entry + matches */
124 u_int16_t target_offset
;
125 /* Size of arpt_entry + matches + target */
126 u_int16_t next_offset
;
129 unsigned int comefrom
;
131 /* Packet and byte counters. */
132 struct arpt_counters counters
;
134 /* The matches (if any), then the target. */
135 unsigned char elems
[0];
139 * New IP firewall options for [gs]etsockopt at the RAW IP level.
140 * Unlike BSD Linux inherits IP options so you don't have to use a raw
141 * socket for this. Instead we check rights in the calls.
143 #define ARPT_BASE_CTL 96 /* base for firewall socket options */
145 #define ARPT_SO_SET_REPLACE (ARPT_BASE_CTL)
146 #define ARPT_SO_SET_ADD_COUNTERS (ARPT_BASE_CTL + 1)
147 #define ARPT_SO_SET_MAX ARPT_SO_SET_ADD_COUNTERS
149 #define ARPT_SO_GET_INFO (ARPT_BASE_CTL)
150 #define ARPT_SO_GET_ENTRIES (ARPT_BASE_CTL + 1)
151 #define ARPT_SO_GET_MAX ARPT_SO_GET_ENTRIES
153 /* CONTINUE verdict for targets */
154 #define ARPT_CONTINUE 0xFFFFFFFF
156 /* For standard target */
157 #define ARPT_RETURN (-NF_MAX_VERDICT - 1)
159 /* The argument to ARPT_SO_GET_INFO */
162 /* Which table: caller fills this in. */
163 char name
[ARPT_TABLE_MAXNAMELEN
];
165 /* Kernel fills these in. */
166 /* Which hook entry points are valid: bitmask */
167 unsigned int valid_hooks
;
169 /* Hook entry points: one per netfilter hook. */
170 unsigned int hook_entry
[NF_ARP_NUMHOOKS
];
172 /* Underflow points. */
173 unsigned int underflow
[NF_ARP_NUMHOOKS
];
175 /* Number of entries */
176 unsigned int num_entries
;
178 /* Size of entries. */
182 /* The argument to ARPT_SO_SET_REPLACE. */
186 char name
[ARPT_TABLE_MAXNAMELEN
];
188 /* Which hook entry points are valid: bitmask. You can't
190 unsigned int valid_hooks
;
192 /* Number of entries */
193 unsigned int num_entries
;
195 /* Total size of new entries */
198 /* Hook entry points. */
199 unsigned int hook_entry
[NF_ARP_NUMHOOKS
];
201 /* Underflow points. */
202 unsigned int underflow
[NF_ARP_NUMHOOKS
];
204 /* Information about old entries: */
205 /* Number of counters (must be equal to current number of entries). */
206 unsigned int num_counters
;
207 /* The old entries' counters. */
208 struct arpt_counters __user
*counters
;
210 /* The entries (hang off end: not really an array). */
211 struct arpt_entry entries
[0];
214 /* The argument to ARPT_SO_ADD_COUNTERS. */
215 struct arpt_counters_info
218 char name
[ARPT_TABLE_MAXNAMELEN
];
220 unsigned int num_counters
;
222 /* The counters (actually `number' of these). */
223 struct arpt_counters counters
[0];
226 /* The argument to ARPT_SO_GET_ENTRIES. */
227 struct arpt_get_entries
229 /* Which table: user fills this in. */
230 char name
[ARPT_TABLE_MAXNAMELEN
];
232 /* User fills this in: total entry size. */
236 struct arpt_entry entrytable
[0];
239 /* Standard return verdict, or do jump. */
240 #define ARPT_STANDARD_TARGET ""
242 #define ARPT_ERROR_TARGET "ERROR"
244 /* Helper functions */
245 static __inline__
struct arpt_entry_target
*arpt_get_target(struct arpt_entry
*e
)
247 return (void *)e
+ e
->target_offset
;
250 /* fn returns 0 to continue iteration */
251 #define ARPT_ENTRY_ITERATE(entries, size, fn, args...) \
255 struct arpt_entry *__entry; \
257 for (__i = 0; __i < (size); __i += __entry->next_offset) { \
258 __entry = (void *)(entries) + __i; \
260 __ret = fn(__entry , ## args); \
268 * Main firewall chains definitions and global var's definitions.
272 /* Registration hooks for targets. */
275 struct list_head list
;
277 const char name
[ARPT_FUNCTION_MAXNAMELEN
];
279 /* Returns verdict. */
280 unsigned int (*target
)(struct sk_buff
**pskb
,
281 unsigned int hooknum
,
282 const struct net_device
*in
,
283 const struct net_device
*out
,
284 const void *targinfo
,
287 /* Called when user tries to insert an entry of this type:
288 hook_mask is a bitmask of hooks from which it can be
290 /* Should return true or false. */
291 int (*checkentry
)(const char *tablename
,
292 const struct arpt_entry
*e
,
294 unsigned int targinfosize
,
295 unsigned int hook_mask
);
297 /* Called when entry of this type deleted. */
298 void (*destroy
)(void *targinfo
, unsigned int targinfosize
);
300 /* Set this to THIS_MODULE if you are a module, otherwise NULL */
304 extern int arpt_register_target(struct arpt_target
*target
);
305 extern void arpt_unregister_target(struct arpt_target
*target
);
307 /* Furniture shopping... */
310 struct list_head list
;
312 /* A unique name... */
313 char name
[ARPT_TABLE_MAXNAMELEN
];
315 /* Seed table: copied in register_table */
316 struct arpt_replace
*table
;
318 /* What hooks you will enter on */
319 unsigned int valid_hooks
;
321 /* Lock for the curtain */
324 /* Man behind the curtain... */
325 struct arpt_table_info
*private;
327 /* Set this to THIS_MODULE if you are a module, otherwise NULL */
331 extern int arpt_register_table(struct arpt_table
*table
);
332 extern void arpt_unregister_table(struct arpt_table
*table
);
333 extern unsigned int arpt_do_table(struct sk_buff
**pskb
,
335 const struct net_device
*in
,
336 const struct net_device
*out
,
337 struct arpt_table
*table
,
340 #define ARPT_ALIGN(s) (((s) + (__alignof__(struct arpt_entry)-1)) & ~(__alignof__(struct arpt_entry)-1))
341 #endif /*__KERNEL__*/
342 #endif /* _ARPTABLES_H */