1 /*
2 * Format of an ARP firewall descriptor
3 *
4 * src, tgt, src_mask, tgt_mask, arpop, arpop_mask are always stored in
5 * network byte order.
6 * flags are stored in host byte order (of course).
7 */
8
9 #ifndef _ARPTABLES_H
10 #define _ARPTABLES_H
11
12 #ifdef __KERNEL__
13 #include <linux/if.h>
14 #include <linux/types.h>
15 #include <linux/in.h>
16 #include <linux/if_arp.h>
17 #include <linux/skbuff.h>
18 #endif
19 #include <linux/compiler.h>
20 #include <linux/netfilter_arp.h>
21
22 #include <linux/netfilter/x_tables.h>
23
24 #define ARPT_FUNCTION_MAXNAMELEN XT_FUNCTION_MAXNAMELEN
25 #define ARPT_TABLE_MAXNAMELEN XT_TABLE_MAXNAMELEN
26 #define arpt_target xt_target
27 #define arpt_table xt_table
28
29 #define ARPT_DEV_ADDR_LEN_MAX 16
30
31 struct arpt_devaddr_info {
32 char addr[ARPT_DEV_ADDR_LEN_MAX];
33 char mask[ARPT_DEV_ADDR_LEN_MAX];
34 };
35
36 /* Yes, Virginia, you have to zero the padding. */
37 struct arpt_arp {
38 /* Source and target IP addr */
39 struct in_addr src, tgt;
40 /* Mask for src and target IP addr */
41 struct in_addr smsk, tmsk;
42
43 /* Device hw address length, src+target device addresses */
44 u_int8_t arhln, arhln_mask;
45 struct arpt_devaddr_info src_devaddr;
46 struct arpt_devaddr_info tgt_devaddr;
47
48 /* ARP operation code. */
49 __be16 arpop, arpop_mask;
50
51 /* ARP hardware address and protocol address format. */
52 __be16 arhrd, arhrd_mask;
53 __be16 arpro, arpro_mask;
54
55 /* The protocol address length is only accepted if it is 4
56 * so there is no use in offering a way to do filtering on it.
57 */
58
59 char iniface[IFNAMSIZ], outiface[IFNAMSIZ];
60 unsigned char iniface_mask[IFNAMSIZ], outiface_mask[IFNAMSIZ];
61
62 /* Flags word */
63 u_int8_t flags;
64 /* Inverse flags */
65 u_int16_t invflags;
66 };
67
68 #define arpt_entry_target xt_entry_target
69 #define arpt_standard_target xt_standard_target
70
71 /* Values for "flag" field in struct arpt_ip (general arp structure).
72 * No flags defined yet.
73 */
74 #define ARPT_F_MASK 0x00 /* All possible flag bits mask. */
75
76 /* Values for "inv" field in struct arpt_arp. */
77 #define ARPT_INV_VIA_IN 0x0001 /* Invert the sense of IN IFACE. */
78 #define ARPT_INV_VIA_OUT 0x0002 /* Invert the sense of OUT IFACE */
79 #define ARPT_INV_SRCIP 0x0004 /* Invert the sense of SRC IP. */
80 #define ARPT_INV_TGTIP 0x0008 /* Invert the sense of TGT IP. */
81 #define ARPT_INV_SRCDEVADDR 0x0010 /* Invert the sense of SRC DEV ADDR. */
82 #define ARPT_INV_TGTDEVADDR 0x0020 /* Invert the sense of TGT DEV ADDR. */
83 #define ARPT_INV_ARPOP 0x0040 /* Invert the sense of ARP OP. */
84 #define ARPT_INV_ARPHRD 0x0080 /* Invert the sense of ARP HRD. */
85 #define ARPT_INV_ARPPRO 0x0100 /* Invert the sense of ARP PRO. */
86 #define ARPT_INV_ARPHLN 0x0200 /* Invert the sense of ARP HLN. */
87 #define ARPT_INV_MASK 0x03FF /* All possible flag bits mask. */
88
89 /* This structure defines each of the firewall rules. Consists of 3
90 parts which are 1) general ARP header stuff 2) match specific
91 stuff 3) the target to perform if the rule matches */
92 struct arpt_entry
93 {
94 struct arpt_arp arp;
95
96 /* Size of arpt_entry + matches */
97 u_int16_t target_offset;
98 /* Size of arpt_entry + matches + target */
99 u_int16_t next_offset;
100
101 /* Back pointer */
102 unsigned int comefrom;
103
104 /* Packet and byte counters. */
105 struct xt_counters counters;
106
107 /* The matches (if any), then the target. */
108 unsigned char elems[0];
109 };
110
111 /*
112 * New IP firewall options for [gs]etsockopt at the RAW IP level.
113 * Unlike BSD Linux inherits IP options so you don't have to use a raw
114 * socket for this. Instead we check rights in the calls.
115 *
116 * ATTENTION: check linux/in.h before adding new number here.
117 */
118 #define ARPT_BASE_CTL 96
119
120 #define ARPT_SO_SET_REPLACE (ARPT_BASE_CTL)
121 #define ARPT_SO_SET_ADD_COUNTERS (ARPT_BASE_CTL + 1)
122 #define ARPT_SO_SET_MAX ARPT_SO_SET_ADD_COUNTERS
123
124 #define ARPT_SO_GET_INFO (ARPT_BASE_CTL)
125 #define ARPT_SO_GET_ENTRIES (ARPT_BASE_CTL + 1)
126 /* #define ARPT_SO_GET_REVISION_MATCH (APRT_BASE_CTL + 2) */
127 #define ARPT_SO_GET_REVISION_TARGET (ARPT_BASE_CTL + 3)
128 #define ARPT_SO_GET_MAX (ARPT_SO_GET_REVISION_TARGET)
129
130 /* CONTINUE verdict for targets */
131 #define ARPT_CONTINUE XT_CONTINUE
132
133 /* For standard target */
134 #define ARPT_RETURN XT_RETURN
135
136 /* The argument to ARPT_SO_GET_INFO */
137 struct arpt_getinfo
138 {
139 /* Which table: caller fills this in. */
140 char name[ARPT_TABLE_MAXNAMELEN];
141
142 /* Kernel fills these in. */
143 /* Which hook entry points are valid: bitmask */
144 unsigned int valid_hooks;
145
146 /* Hook entry points: one per netfilter hook. */
147 unsigned int hook_entry[NF_ARP_NUMHOOKS];
148
149 /* Underflow points. */
150 unsigned int underflow[NF_ARP_NUMHOOKS];
151
152 /* Number of entries */
153 unsigned int num_entries;
154
155 /* Size of entries. */
156 unsigned int size;
157 };
158
159 /* The argument to ARPT_SO_SET_REPLACE. */
160 struct arpt_replace
161 {
162 /* Which table. */
163 char name[ARPT_TABLE_MAXNAMELEN];
164
165 /* Which hook entry points are valid: bitmask. You can't
166 change this. */
167 unsigned int valid_hooks;
168
169 /* Number of entries */
170 unsigned int num_entries;
171
172 /* Total size of new entries */
173 unsigned int size;
174
175 /* Hook entry points. */
176 unsigned int hook_entry[NF_ARP_NUMHOOKS];
177
178 /* Underflow points. */
179 unsigned int underflow[NF_ARP_NUMHOOKS];
180
181 /* Information about old entries: */
182 /* Number of counters (must be equal to current number of entries). */
183 unsigned int num_counters;
184 /* The old entries' counters. */
185 struct xt_counters __user *counters;
186
187 /* The entries (hang off end: not really an array). */
188 struct arpt_entry entries[0];
189 };
190
191 /* The argument to ARPT_SO_ADD_COUNTERS. */
192 #define arpt_counters_info xt_counters_info
193 #define arpt_counters xt_counters
194
195 /* The argument to ARPT_SO_GET_ENTRIES. */
196 struct arpt_get_entries
197 {
198 /* Which table: user fills this in. */
199 char name[ARPT_TABLE_MAXNAMELEN];
200
201 /* User fills this in: total entry size. */
202 unsigned int size;
203
204 /* The entries. */
205 struct arpt_entry entrytable[0];
206 };
207
208 /* Standard return verdict, or do jump. */
209 #define ARPT_STANDARD_TARGET XT_STANDARD_TARGET
210 /* Error verdict. */
211 #define ARPT_ERROR_TARGET XT_ERROR_TARGET
212
213 /* Helper functions */
214 static __inline__ struct arpt_entry_target *arpt_get_target(struct arpt_entry *e)
215 {
216 return (void *)e + e->target_offset;
217 }
218
219 /* fn returns 0 to continue iteration */
220 #define ARPT_ENTRY_ITERATE(entries, size, fn, args...) \
221 XT_ENTRY_ITERATE(struct arpt_entry, entries, size, fn, ## args)
222
223 /*
224 * Main firewall chains definitions and global var's definitions.
225 */
226 #ifdef __KERNEL__
227
228 /* Standard entry. */
229 struct arpt_standard
230 {
231 struct arpt_entry entry;
232 struct arpt_standard_target target;
233 };
234
235 struct arpt_error_target
236 {
237 struct arpt_entry_target target;
238 char errorname[ARPT_FUNCTION_MAXNAMELEN];
239 };
240
241 struct arpt_error
242 {
243 struct arpt_entry entry;
244 struct arpt_error_target target;
245 };
246
247 #define ARPT_ENTRY_INIT(__size) \
248 { \
249 .target_offset = sizeof(struct arpt_entry), \
250 .next_offset = (__size), \
251 }
252
253 #define ARPT_STANDARD_INIT(__verdict) \
254 { \
255 .entry = ARPT_ENTRY_INIT(sizeof(struct arpt_standard)), \
256 .target = XT_TARGET_INIT(ARPT_STANDARD_TARGET, \
257 sizeof(struct arpt_standard_target)), \
258 .target.verdict = -(__verdict) - 1, \
259 }
260
261 #define ARPT_ERROR_INIT \
262 { \
263 .entry = ARPT_ENTRY_INIT(sizeof(struct arpt_error)), \
264 .target = XT_TARGET_INIT(ARPT_ERROR_TARGET, \
265 sizeof(struct arpt_error_target)), \
266 .target.errorname = "ERROR", \
267 }
268
269 #define arpt_register_target(tgt) \
270 ({ (tgt)->family = NF_ARP; \
271 xt_register_target(tgt); })
272 #define arpt_unregister_target(tgt) xt_unregister_target(tgt)
273
274 extern struct arpt_table *arpt_register_table(struct net *net,
275 struct arpt_table *table,
276 const struct arpt_replace *repl);
277 extern void arpt_unregister_table(struct arpt_table *table);
278 extern unsigned int arpt_do_table(struct sk_buff *skb,
279 unsigned int hook,
280 const struct net_device *in,
281 const struct net_device *out,
282 struct arpt_table *table);
283
284 #define ARPT_ALIGN(s) XT_ALIGN(s)
285
286 #ifdef CONFIG_COMPAT
287 #include <net/compat.h>
288
289 struct compat_arpt_entry
290 {
291 struct arpt_arp arp;
292 u_int16_t target_offset;
293 u_int16_t next_offset;
294 compat_uint_t comefrom;
295 struct compat_xt_counters counters;
296 unsigned char elems[0];
297 };
298
299 static inline struct arpt_entry_target *
300 compat_arpt_get_target(struct compat_arpt_entry *e)
301 {
302 return (void *)e + e->target_offset;
303 }
304
305 #define COMPAT_ARPT_ALIGN(s) COMPAT_XT_ALIGN(s)
306
307 /* fn returns 0 to continue iteration */
308 #define COMPAT_ARPT_ENTRY_ITERATE(entries, size, fn, args...) \
309 XT_ENTRY_ITERATE(struct compat_arpt_entry, entries, size, fn, ## args)
310
311 #define COMPAT_ARPT_ENTRY_ITERATE_CONTINUE(entries, size, n, fn, args...) \
312 XT_ENTRY_ITERATE_CONTINUE(struct compat_arpt_entry, entries, size, n, \
313 fn, ## args)
314
315 #endif /* CONFIG_COMPAT */
316 #endif /*__KERNEL__*/
317 #endif /* _ARPTABLES_H */
318
|
This page was automatically generated by the
LXR engine.
|