1 #ifndef _LIBIP6TC_H 2 #define _LIBIP6TC_H 3 /* Library which manipulates firewall rules. Version 0.2. */ 4 5 #include <libiptc/ipt_kernel_headers.h> 6 #include <linux/netfilter_ipv6/ip6_tables.h> 7 8 #ifndef IP6T_MIN_ALIGN 9 #define IP6T_MIN_ALIGN (__alignof__(struct ip6t_entry)) 10 #endif 11 #define IP6T_ALIGN(s) (((s) + (IP6T_MIN_ALIGN-1)) & ~(IP6T_MIN_ALIGN-1)) 12 13 typedef char ip6t_chainlabel[32]; 14 15 #define IP6TC_LABEL_ACCEPT "ACCEPT" 16 #define IP6TC_LABEL_DROP "DROP" 17 #define IP6TC_LABEL_QUEUE "QUEUE" 18 #define IP6TC_LABEL_RETURN "RETURN" 19 20 /* Transparent handle type. */ 21 typedef struct ip6tc_handle *ip6tc_handle_t; 22 23 /* Does this chain exist? */ 24 int ip6tc_is_chain(const char *chain, const ip6tc_handle_t handle); 25 26 /* Take a snapshot of the rules. Returns NULL on error. */ 27 ip6tc_handle_t ip6tc_init(const char *tablename); 28 29 /* Cleanup after ip6tc_init(). */ 30 void ip6tc_free(ip6tc_handle_t *h); 31 32 /* Iterator functions to run through the chains. Returns NULL at end. */ 33 const char *ip6tc_first_chain(ip6tc_handle_t *handle); 34 const char *ip6tc_next_chain(ip6tc_handle_t *handle); 35 36 /* Get first rule in the given chain: NULL for empty chain. */ 37 const struct ip6t_entry *ip6tc_first_rule(const char *chain, 38 ip6tc_handle_t *handle); 39 40 /* Returns NULL when rules run out. */ 41 const struct ip6t_entry *ip6tc_next_rule(const struct ip6t_entry *prev, 42 ip6tc_handle_t *handle); 43 44 /* Returns a pointer to the target name of this position. */ 45 const char *ip6tc_get_target(const struct ip6t_entry *e, 46 ip6tc_handle_t *handle); 47 48 /* Is this a built-in chain? */ 49 int ip6tc_builtin(const char *chain, const ip6tc_handle_t handle); 50 51 /* Get the policy of a given built-in chain */ 52 const char *ip6tc_get_policy(const char *chain, 53 struct ip6t_counters *counters, 54 ip6tc_handle_t *handle); 55 56 /* These functions return TRUE for OK or 0 and set errno. If errno == 57 0, it means there was a version error (ie. upgrade libiptc). */ 58 /* Rule numbers start at 1 for the first rule. */ 59 60 /* Insert the entry `fw' in chain `chain' into position `rulenum'. */ 61 int ip6tc_insert_entry(const ip6t_chainlabel chain, 62 const struct ip6t_entry *e, 63 unsigned int rulenum, 64 ip6tc_handle_t *handle); 65 66 /* Atomically replace rule `rulenum' in `chain' with `fw'. */ 67 int ip6tc_replace_entry(const ip6t_chainlabel chain, 68 const struct ip6t_entry *e, 69 unsigned int rulenum, 70 ip6tc_handle_t *handle); 71 72 /* Append entry `fw' to chain `chain'. Equivalent to insert with 73 rulenum = length of chain. */ 74 int ip6tc_append_entry(const ip6t_chainlabel chain, 75 const struct ip6t_entry *e, 76 ip6tc_handle_t *handle); 77 78 /* Delete the first rule in `chain' which matches `fw'. */ 79 int ip6tc_delete_entry(const ip6t_chainlabel chain, 80 const struct ip6t_entry *origfw, 81 unsigned char *matchmask, 82 ip6tc_handle_t *handle); 83 84 /* Delete the rule in position `rulenum' in `chain'. */ 85 int ip6tc_delete_num_entry(const ip6t_chainlabel chain, 86 unsigned int rulenum, 87 ip6tc_handle_t *handle); 88 89 /* Check the packet `fw' on chain `chain'. Returns the verdict, or 90 NULL and sets errno. */ 91 const char *ip6tc_check_packet(const ip6t_chainlabel chain, 92 struct ip6t_entry *, 93 ip6tc_handle_t *handle); 94 95 /* Flushes the entries in the given chain (ie. empties chain). */ 96 int ip6tc_flush_entries(const ip6t_chainlabel chain, 97 ip6tc_handle_t *handle); 98 99 /* Zeroes the counters in a chain. */ 100 int ip6tc_zero_entries(const ip6t_chainlabel chain, 101 ip6tc_handle_t *handle); 102 103 /* Creates a new chain. */ 104 int ip6tc_create_chain(const ip6t_chainlabel chain, 105 ip6tc_handle_t *handle); 106 107 /* Deletes a chain. */ 108 int ip6tc_delete_chain(const ip6t_chainlabel chain, 109 ip6tc_handle_t *handle); 110 111 /* Renames a chain. */ 112 int ip6tc_rename_chain(const ip6t_chainlabel oldname, 113 const ip6t_chainlabel newname, 114 ip6tc_handle_t *handle); 115 116 /* Sets the policy on a built-in chain. */ 117 int ip6tc_set_policy(const ip6t_chainlabel chain, 118 const ip6t_chainlabel policy, 119 struct ip6t_counters *counters, 120 ip6tc_handle_t *handle); 121 122 /* Get the number of references to this chain */ 123 int ip6tc_get_references(unsigned int *ref, const ip6t_chainlabel chain, 124 ip6tc_handle_t *handle); 125 126 /* read packet and byte counters for a specific rule */ 127 struct ip6t_counters *ip6tc_read_counter(const ip6t_chainlabel chain, 128 unsigned int rulenum, 129 ip6tc_handle_t *handle); 130 131 /* zero packet and byte counters for a specific rule */ 132 int ip6tc_zero_counter(const ip6t_chainlabel chain, 133 unsigned int rulenum, 134 ip6tc_handle_t *handle); 135 136 /* set packet and byte counters for a specific rule */ 137 int ip6tc_set_counter(const ip6t_chainlabel chain, 138 unsigned int rulenum, 139 struct ip6t_counters *counters, 140 ip6tc_handle_t *handle); 141 142 /* Makes the actual changes. */ 143 int ip6tc_commit(ip6tc_handle_t *handle); 144 145 /* Get raw socket. */ 146 int ip6tc_get_raw_socket(); 147 148 /* Translates errno numbers into more human-readable form than strerror. */ 149 const char *ip6tc_strerror(int err); 150 151 /* Return prefix length, or -1 if not contiguous */ 152 int ipv6_prefix_length(const struct in6_addr *a); 153 154 #endif /* _LIBIP6TC_H */ 155