1*a71a9546SAutomerger Merge Worker #ifndef _LIBIP6TC_H 2*a71a9546SAutomerger Merge Worker #define _LIBIP6TC_H 3*a71a9546SAutomerger Merge Worker /* Library which manipulates firewall rules. Version 0.2. */ 4*a71a9546SAutomerger Merge Worker 5*a71a9546SAutomerger Merge Worker #include <linux/types.h> 6*a71a9546SAutomerger Merge Worker #include <libiptc/ipt_kernel_headers.h> 7*a71a9546SAutomerger Merge Worker #ifdef __cplusplus 8*a71a9546SAutomerger Merge Worker # include <climits> 9*a71a9546SAutomerger Merge Worker #else 10*a71a9546SAutomerger Merge Worker # include <limits.h> /* INT_MAX in ip6_tables.h */ 11*a71a9546SAutomerger Merge Worker #endif 12*a71a9546SAutomerger Merge Worker #include <linux/netfilter_ipv6/ip6_tables.h> 13*a71a9546SAutomerger Merge Worker #include <libiptc/xtcshared.h> 14*a71a9546SAutomerger Merge Worker 15*a71a9546SAutomerger Merge Worker #define ip6tc_handle xtc_handle 16*a71a9546SAutomerger Merge Worker #define ip6t_chainlabel xt_chainlabel 17*a71a9546SAutomerger Merge Worker 18*a71a9546SAutomerger Merge Worker #define IP6TC_LABEL_ACCEPT "ACCEPT" 19*a71a9546SAutomerger Merge Worker #define IP6TC_LABEL_DROP "DROP" 20*a71a9546SAutomerger Merge Worker #define IP6TC_LABEL_QUEUE "QUEUE" 21*a71a9546SAutomerger Merge Worker #define IP6TC_LABEL_RETURN "RETURN" 22*a71a9546SAutomerger Merge Worker 23*a71a9546SAutomerger Merge Worker /* Does this chain exist? */ 24*a71a9546SAutomerger Merge Worker int ip6tc_is_chain(const char *chain, struct xtc_handle *const handle); 25*a71a9546SAutomerger Merge Worker 26*a71a9546SAutomerger Merge Worker /* Take a snapshot of the rules. Returns NULL on error. */ 27*a71a9546SAutomerger Merge Worker struct xtc_handle *ip6tc_init(const char *tablename); 28*a71a9546SAutomerger Merge Worker 29*a71a9546SAutomerger Merge Worker /* Cleanup after ip6tc_init(). */ 30*a71a9546SAutomerger Merge Worker void ip6tc_free(struct xtc_handle *h); 31*a71a9546SAutomerger Merge Worker 32*a71a9546SAutomerger Merge Worker /* Iterator functions to run through the chains. Returns NULL at end. */ 33*a71a9546SAutomerger Merge Worker const char *ip6tc_first_chain(struct xtc_handle *handle); 34*a71a9546SAutomerger Merge Worker const char *ip6tc_next_chain(struct xtc_handle *handle); 35*a71a9546SAutomerger Merge Worker 36*a71a9546SAutomerger Merge Worker /* Get first rule in the given chain: NULL for empty chain. */ 37*a71a9546SAutomerger Merge Worker const struct ip6t_entry *ip6tc_first_rule(const char *chain, 38*a71a9546SAutomerger Merge Worker struct xtc_handle *handle); 39*a71a9546SAutomerger Merge Worker 40*a71a9546SAutomerger Merge Worker /* Returns NULL when rules run out. */ 41*a71a9546SAutomerger Merge Worker const struct ip6t_entry *ip6tc_next_rule(const struct ip6t_entry *prev, 42*a71a9546SAutomerger Merge Worker struct xtc_handle *handle); 43*a71a9546SAutomerger Merge Worker 44*a71a9546SAutomerger Merge Worker /* Returns a pointer to the target name of this position. */ 45*a71a9546SAutomerger Merge Worker const char *ip6tc_get_target(const struct ip6t_entry *e, 46*a71a9546SAutomerger Merge Worker struct xtc_handle *handle); 47*a71a9546SAutomerger Merge Worker 48*a71a9546SAutomerger Merge Worker /* Is this a built-in chain? */ 49*a71a9546SAutomerger Merge Worker int ip6tc_builtin(const char *chain, struct xtc_handle *const handle); 50*a71a9546SAutomerger Merge Worker 51*a71a9546SAutomerger Merge Worker /* Get the policy of a given built-in chain */ 52*a71a9546SAutomerger Merge Worker const char *ip6tc_get_policy(const char *chain, 53*a71a9546SAutomerger Merge Worker struct xt_counters *counters, 54*a71a9546SAutomerger Merge Worker struct xtc_handle *handle); 55*a71a9546SAutomerger Merge Worker 56*a71a9546SAutomerger Merge Worker /* These functions return TRUE for OK or 0 and set errno. If errno == 57*a71a9546SAutomerger Merge Worker 0, it means there was a version error (ie. upgrade libiptc). */ 58*a71a9546SAutomerger Merge Worker /* Rule numbers start at 1 for the first rule. */ 59*a71a9546SAutomerger Merge Worker 60*a71a9546SAutomerger Merge Worker /* Insert the entry `fw' in chain `chain' into position `rulenum'. */ 61*a71a9546SAutomerger Merge Worker int ip6tc_insert_entry(const xt_chainlabel chain, 62*a71a9546SAutomerger Merge Worker const struct ip6t_entry *e, 63*a71a9546SAutomerger Merge Worker unsigned int rulenum, 64*a71a9546SAutomerger Merge Worker struct xtc_handle *handle); 65*a71a9546SAutomerger Merge Worker 66*a71a9546SAutomerger Merge Worker /* Atomically replace rule `rulenum' in `chain' with `fw'. */ 67*a71a9546SAutomerger Merge Worker int ip6tc_replace_entry(const xt_chainlabel chain, 68*a71a9546SAutomerger Merge Worker const struct ip6t_entry *e, 69*a71a9546SAutomerger Merge Worker unsigned int rulenum, 70*a71a9546SAutomerger Merge Worker struct xtc_handle *handle); 71*a71a9546SAutomerger Merge Worker 72*a71a9546SAutomerger Merge Worker /* Append entry `fw' to chain `chain'. Equivalent to insert with 73*a71a9546SAutomerger Merge Worker rulenum = length of chain. */ 74*a71a9546SAutomerger Merge Worker int ip6tc_append_entry(const xt_chainlabel chain, 75*a71a9546SAutomerger Merge Worker const struct ip6t_entry *e, 76*a71a9546SAutomerger Merge Worker struct xtc_handle *handle); 77*a71a9546SAutomerger Merge Worker 78*a71a9546SAutomerger Merge Worker /* Check whether a matching rule exists */ 79*a71a9546SAutomerger Merge Worker int ip6tc_check_entry(const xt_chainlabel chain, 80*a71a9546SAutomerger Merge Worker const struct ip6t_entry *origfw, 81*a71a9546SAutomerger Merge Worker unsigned char *matchmask, 82*a71a9546SAutomerger Merge Worker struct xtc_handle *handle); 83*a71a9546SAutomerger Merge Worker 84*a71a9546SAutomerger Merge Worker /* Delete the first rule in `chain' which matches `fw'. */ 85*a71a9546SAutomerger Merge Worker int ip6tc_delete_entry(const xt_chainlabel chain, 86*a71a9546SAutomerger Merge Worker const struct ip6t_entry *origfw, 87*a71a9546SAutomerger Merge Worker unsigned char *matchmask, 88*a71a9546SAutomerger Merge Worker struct xtc_handle *handle); 89*a71a9546SAutomerger Merge Worker 90*a71a9546SAutomerger Merge Worker /* Delete the rule in position `rulenum' in `chain'. */ 91*a71a9546SAutomerger Merge Worker int ip6tc_delete_num_entry(const xt_chainlabel chain, 92*a71a9546SAutomerger Merge Worker unsigned int rulenum, 93*a71a9546SAutomerger Merge Worker struct xtc_handle *handle); 94*a71a9546SAutomerger Merge Worker 95*a71a9546SAutomerger Merge Worker /* Check the packet `fw' on chain `chain'. Returns the verdict, or 96*a71a9546SAutomerger Merge Worker NULL and sets errno. */ 97*a71a9546SAutomerger Merge Worker const char *ip6tc_check_packet(const xt_chainlabel chain, 98*a71a9546SAutomerger Merge Worker struct ip6t_entry *, 99*a71a9546SAutomerger Merge Worker struct xtc_handle *handle); 100*a71a9546SAutomerger Merge Worker 101*a71a9546SAutomerger Merge Worker /* Flushes the entries in the given chain (ie. empties chain). */ 102*a71a9546SAutomerger Merge Worker int ip6tc_flush_entries(const xt_chainlabel chain, 103*a71a9546SAutomerger Merge Worker struct xtc_handle *handle); 104*a71a9546SAutomerger Merge Worker 105*a71a9546SAutomerger Merge Worker /* Zeroes the counters in a chain. */ 106*a71a9546SAutomerger Merge Worker int ip6tc_zero_entries(const xt_chainlabel chain, 107*a71a9546SAutomerger Merge Worker struct xtc_handle *handle); 108*a71a9546SAutomerger Merge Worker 109*a71a9546SAutomerger Merge Worker /* Creates a new chain. */ 110*a71a9546SAutomerger Merge Worker int ip6tc_create_chain(const xt_chainlabel chain, 111*a71a9546SAutomerger Merge Worker struct xtc_handle *handle); 112*a71a9546SAutomerger Merge Worker 113*a71a9546SAutomerger Merge Worker /* Deletes a chain. */ 114*a71a9546SAutomerger Merge Worker int ip6tc_delete_chain(const xt_chainlabel chain, 115*a71a9546SAutomerger Merge Worker struct xtc_handle *handle); 116*a71a9546SAutomerger Merge Worker 117*a71a9546SAutomerger Merge Worker /* Renames a chain. */ 118*a71a9546SAutomerger Merge Worker int ip6tc_rename_chain(const xt_chainlabel oldname, 119*a71a9546SAutomerger Merge Worker const xt_chainlabel newname, 120*a71a9546SAutomerger Merge Worker struct xtc_handle *handle); 121*a71a9546SAutomerger Merge Worker 122*a71a9546SAutomerger Merge Worker /* Sets the policy on a built-in chain. */ 123*a71a9546SAutomerger Merge Worker int ip6tc_set_policy(const xt_chainlabel chain, 124*a71a9546SAutomerger Merge Worker const xt_chainlabel policy, 125*a71a9546SAutomerger Merge Worker struct xt_counters *counters, 126*a71a9546SAutomerger Merge Worker struct xtc_handle *handle); 127*a71a9546SAutomerger Merge Worker 128*a71a9546SAutomerger Merge Worker /* Get the number of references to this chain */ 129*a71a9546SAutomerger Merge Worker int ip6tc_get_references(unsigned int *ref, const xt_chainlabel chain, 130*a71a9546SAutomerger Merge Worker struct xtc_handle *handle); 131*a71a9546SAutomerger Merge Worker 132*a71a9546SAutomerger Merge Worker /* read packet and byte counters for a specific rule */ 133*a71a9546SAutomerger Merge Worker struct xt_counters *ip6tc_read_counter(const xt_chainlabel chain, 134*a71a9546SAutomerger Merge Worker unsigned int rulenum, 135*a71a9546SAutomerger Merge Worker struct xtc_handle *handle); 136*a71a9546SAutomerger Merge Worker 137*a71a9546SAutomerger Merge Worker /* zero packet and byte counters for a specific rule */ 138*a71a9546SAutomerger Merge Worker int ip6tc_zero_counter(const xt_chainlabel chain, 139*a71a9546SAutomerger Merge Worker unsigned int rulenum, 140*a71a9546SAutomerger Merge Worker struct xtc_handle *handle); 141*a71a9546SAutomerger Merge Worker 142*a71a9546SAutomerger Merge Worker /* set packet and byte counters for a specific rule */ 143*a71a9546SAutomerger Merge Worker int ip6tc_set_counter(const xt_chainlabel chain, 144*a71a9546SAutomerger Merge Worker unsigned int rulenum, 145*a71a9546SAutomerger Merge Worker struct xt_counters *counters, 146*a71a9546SAutomerger Merge Worker struct xtc_handle *handle); 147*a71a9546SAutomerger Merge Worker 148*a71a9546SAutomerger Merge Worker /* Makes the actual changes. */ 149*a71a9546SAutomerger Merge Worker int ip6tc_commit(struct xtc_handle *handle); 150*a71a9546SAutomerger Merge Worker 151*a71a9546SAutomerger Merge Worker /* Get raw socket. */ 152*a71a9546SAutomerger Merge Worker int ip6tc_get_raw_socket(void); 153*a71a9546SAutomerger Merge Worker 154*a71a9546SAutomerger Merge Worker /* Translates errno numbers into more human-readable form than strerror. */ 155*a71a9546SAutomerger Merge Worker const char *ip6tc_strerror(int err); 156*a71a9546SAutomerger Merge Worker 157*a71a9546SAutomerger Merge Worker extern void dump_entries6(struct xtc_handle *const); 158*a71a9546SAutomerger Merge Worker 159*a71a9546SAutomerger Merge Worker extern const struct xtc_ops ip6tc_ops; 160*a71a9546SAutomerger Merge Worker 161*a71a9546SAutomerger Merge Worker #endif /* _LIBIP6TC_H */ 162