Details | Last modification | View Log | RSS feed
Rev | Author | Line No. | Line |
---|---|---|---|
423 | giacomo | 1 | /* |
2 | * This code is heavily based on the code in ip_fw.h; see that file for |
||
3 | * copyrights and attributions. This code is basically GPL. |
||
4 | * |
||
5 | * 15-Feb-1997: Major changes to allow graphs for firewall rules. |
||
6 | * Paul Russell <Paul.Russell@rustcorp.com.au> and |
||
7 | * Michael Neuling <Michael.Neuling@rustcorp.com.au> |
||
8 | * 2-Nov-1997: Changed types to __u16, etc. |
||
9 | * Removed IP_FW_F_TCPACK & IP_FW_F_BIDIR. |
||
10 | * Added inverse flags field. |
||
11 | * Removed multiple port specs. |
||
12 | */ |
||
13 | |||
14 | /* |
||
15 | * Format of an IP firewall descriptor |
||
16 | * |
||
17 | * src, dst, src_mask, dst_mask are always stored in network byte order. |
||
18 | * flags are stored in host byte order (of course). |
||
19 | * Port numbers are stored in HOST byte order. |
||
20 | */ |
||
21 | |||
22 | #ifndef _IP_FWCHAINS_H |
||
23 | #define _IP_FWCHAINS_H |
||
24 | |||
25 | #ifdef __KERNEL__ |
||
26 | #include <linux/icmp.h> |
||
27 | #include <linux/in.h> |
||
28 | #include <linux/ip.h> |
||
29 | #include <linux/tcp.h> |
||
30 | #include <linux/udp.h> |
||
31 | #endif /* __KERNEL__ */ |
||
32 | #define IP_FW_MAX_LABEL_LENGTH 8 |
||
33 | typedef char ip_chainlabel[IP_FW_MAX_LABEL_LENGTH+1]; |
||
34 | |||
35 | struct ip_fw |
||
36 | { |
||
37 | struct in_addr fw_src, fw_dst; /* Source and destination IP addr */ |
||
38 | struct in_addr fw_smsk, fw_dmsk; /* Mask for src and dest IP addr */ |
||
39 | __u32 fw_mark; /* ID to stamp on packet */ |
||
40 | __u16 fw_proto; /* Protocol, 0 = ANY */ |
||
41 | __u16 fw_flg; /* Flags word */ |
||
42 | __u16 fw_invflg; /* Inverse flags */ |
||
43 | __u16 fw_spts[2]; /* Source port range. */ |
||
44 | __u16 fw_dpts[2]; /* Destination port range. */ |
||
45 | __u16 fw_redirpt; /* Port to redirect to. */ |
||
46 | __u16 fw_outputsize; /* Max amount to output to |
||
47 | NETLINK */ |
||
48 | char fw_vianame[IFNAMSIZ]; /* name of interface "via" */ |
||
49 | __u8 fw_tosand, fw_tosxor; /* Revised packet priority */ |
||
50 | }; |
||
51 | |||
52 | struct ip_fwuser |
||
53 | { |
||
54 | struct ip_fw ipfw; |
||
55 | ip_chainlabel label; |
||
56 | }; |
||
57 | |||
58 | /* Values for "fw_flg" field . */ |
||
59 | #define IP_FW_F_PRN 0x0001 /* Print packet if it matches */ |
||
60 | #define IP_FW_F_TCPSYN 0x0002 /* For tcp packets-check SYN only */ |
||
61 | #define IP_FW_F_FRAG 0x0004 /* Set if rule is a fragment rule */ |
||
62 | #define IP_FW_F_MARKABS 0x0008 /* Set the mark to fw_mark, not add. */ |
||
63 | #define IP_FW_F_WILDIF 0x0010 /* Need only match start of interface name. */ |
||
64 | #define IP_FW_F_NETLINK 0x0020 /* Redirect to netlink: 2.1.x only */ |
||
65 | #define IP_FW_F_MASK 0x003F /* All possible flag bits mask */ |
||
66 | |||
67 | /* Values for "fw_invflg" field. */ |
||
68 | #define IP_FW_INV_SRCIP 0x0001 /* Invert the sense of fw_src. */ |
||
69 | #define IP_FW_INV_DSTIP 0x0002 /* Invert the sense of fw_dst. */ |
||
70 | #define IP_FW_INV_PROTO 0x0004 /* Invert the sense of fw_proto. */ |
||
71 | #define IP_FW_INV_SRCPT 0x0008 /* Invert the sense of source ports. */ |
||
72 | #define IP_FW_INV_DSTPT 0x0010 /* Invert the sense of destination ports. */ |
||
73 | #define IP_FW_INV_VIA 0x0020 /* Invert the sense of fw_vianame. */ |
||
74 | #define IP_FW_INV_SYN 0x0040 /* Invert the sense of IP_FW_F_TCPSYN. */ |
||
75 | #define IP_FW_INV_FRAG 0x0080 /* Invert the sense of IP_FW_F_FRAG. */ |
||
76 | |||
77 | /* |
||
78 | * New IP firewall options for [gs]etsockopt at the RAW IP level. |
||
79 | * Unlike BSD Linux inherits IP options so you don't have to use |
||
80 | * a raw socket for this. Instead we check rights in the calls. */ |
||
81 | |||
82 | #define IP_FW_BASE_CTL 64 /* base for firewall socket options */ |
||
83 | |||
84 | #define IP_FW_APPEND (IP_FW_BASE_CTL) /* Takes ip_fwchange */ |
||
85 | #define IP_FW_REPLACE (IP_FW_BASE_CTL+1) /* Takes ip_fwnew */ |
||
86 | #define IP_FW_DELETE_NUM (IP_FW_BASE_CTL+2) /* Takes ip_fwdelnum */ |
||
87 | #define IP_FW_DELETE (IP_FW_BASE_CTL+3) /* Takes ip_fwchange */ |
||
88 | #define IP_FW_INSERT (IP_FW_BASE_CTL+4) /* Takes ip_fwnew */ |
||
89 | #define IP_FW_FLUSH (IP_FW_BASE_CTL+5) /* Takes ip_chainlabel */ |
||
90 | #define IP_FW_ZERO (IP_FW_BASE_CTL+6) /* Takes ip_chainlabel */ |
||
91 | #define IP_FW_CHECK (IP_FW_BASE_CTL+7) /* Takes ip_fwtest */ |
||
92 | #define IP_FW_MASQ_TIMEOUTS (IP_FW_BASE_CTL+8) /* Takes 3 ints */ |
||
93 | #define IP_FW_CREATECHAIN (IP_FW_BASE_CTL+9) /* Takes ip_chainlabel */ |
||
94 | #define IP_FW_DELETECHAIN (IP_FW_BASE_CTL+10) /* Takes ip_chainlabel */ |
||
95 | #define IP_FW_POLICY (IP_FW_BASE_CTL+11) /* Takes ip_fwpolicy */ |
||
96 | /* Masquerade control, only 1 optname */ |
||
97 | |||
98 | #define IP_FW_MASQ_CTL (IP_FW_BASE_CTL+12) /* General ip_masq ctl */ |
||
99 | |||
100 | /* Builtin chain labels */ |
||
101 | #define IP_FW_LABEL_FORWARD "forward" |
||
102 | #define IP_FW_LABEL_INPUT "input" |
||
103 | #define IP_FW_LABEL_OUTPUT "output" |
||
104 | |||
105 | /* Special targets */ |
||
106 | #define IP_FW_LABEL_MASQUERADE "MASQ" |
||
107 | #define IP_FW_LABEL_REDIRECT "REDIRECT" |
||
108 | #define IP_FW_LABEL_ACCEPT "ACCEPT" |
||
109 | #define IP_FW_LABEL_BLOCK "DENY" |
||
110 | #define IP_FW_LABEL_REJECT "REJECT" |
||
111 | #define IP_FW_LABEL_RETURN "RETURN" |
||
112 | #define IP_FW_LABEL_QUEUE "QUEUE" |
||
113 | |||
114 | /* Files in /proc/net */ |
||
115 | #define IP_FW_PROC_CHAINS "ip_fwchains" |
||
116 | #define IP_FW_PROC_CHAIN_NAMES "ip_fwnames" |
||
117 | |||
118 | |||
119 | struct ip_fwpkt |
||
120 | { |
||
121 | struct iphdr fwp_iph; /* IP header */ |
||
122 | union { |
||
123 | struct tcphdr fwp_tcph; /* TCP header or */ |
||
124 | struct udphdr fwp_udph; /* UDP header */ |
||
125 | struct icmphdr fwp_icmph; /* ICMP header */ |
||
126 | } fwp_protoh; |
||
127 | struct in_addr fwp_via; /* interface address */ |
||
128 | char fwp_vianame[IFNAMSIZ]; /* interface name */ |
||
129 | }; |
||
130 | |||
131 | /* The argument to IP_FW_DELETE and IP_FW_APPEND */ |
||
132 | struct ip_fwchange |
||
133 | { |
||
134 | struct ip_fwuser fwc_rule; |
||
135 | ip_chainlabel fwc_label; |
||
136 | }; |
||
137 | |||
138 | /* The argument to IP_FW_CHECK. */ |
||
139 | struct ip_fwtest |
||
140 | { |
||
141 | struct ip_fwpkt fwt_packet; /* Packet to be tested */ |
||
142 | ip_chainlabel fwt_label; /* Block to start test in */ |
||
143 | }; |
||
144 | |||
145 | /* The argument to IP_FW_DELETE_NUM */ |
||
146 | struct ip_fwdelnum |
||
147 | { |
||
148 | __u32 fwd_rulenum; |
||
149 | ip_chainlabel fwd_label; |
||
150 | }; |
||
151 | |||
152 | /* The argument to IP_FW_REPLACE and IP_FW_INSERT */ |
||
153 | struct ip_fwnew |
||
154 | { |
||
155 | __u32 fwn_rulenum; |
||
156 | struct ip_fwuser fwn_rule; |
||
157 | ip_chainlabel fwn_label; |
||
158 | }; |
||
159 | |||
160 | /* The argument to IP_FW_POLICY */ |
||
161 | struct ip_fwpolicy |
||
162 | { |
||
163 | ip_chainlabel fwp_policy; |
||
164 | ip_chainlabel fwp_label; |
||
165 | }; |
||
166 | /* |
||
167 | * timeouts for ip masquerading |
||
168 | */ |
||
169 | |||
170 | extern int ip_fw_masq_timeouts(void *, int); |
||
171 | |||
172 | |||
173 | /* |
||
174 | * Main firewall chains definitions and global var's definitions. |
||
175 | */ |
||
176 | |||
177 | #ifdef __KERNEL__ |
||
178 | |||
179 | #include <linux/config.h> |
||
180 | #include <linux/version.h> |
||
181 | #include <linux/init.h> |
||
182 | extern void ip_fw_init(void) __init; |
||
183 | extern int ip_fw_ctl(int, void *, int); |
||
184 | #ifdef CONFIG_IP_MASQUERADE |
||
185 | extern int ip_masq_uctl(int, char *, int); |
||
186 | #endif |
||
187 | #endif /* KERNEL */ |
||
188 | |||
189 | #endif /* _IP_FWCHAINS_H */ |