2 * This code is heavily based on the code in ip_fw.h; see that file for
3 * copyrights and attributions. This code is basically GPL.
5 * 15-Feb-1997: Major changes to allow graphs for firewall rules.
6 * Paul Russell <Paul.Russell@rustcorp.com.au> and
7 * Michael Neuling <Michael.Neuling@rustcorp.com.au>
8 * 2-Nov-1997: Changed types to __u16, etc.
9 * Removed IP_FW_F_TCPACK & IP_FW_F_BIDIR.
10 * Added inverse flags field.
11 * Removed multiple port specs.
15 * Format of an IP firewall descriptor
17 * src, dst, src_mask, dst_mask are always stored in network byte order.
18 * flags are stored in host byte order (of course).
19 * Port numbers are stored in HOST byte order.
22 #ifndef _IP_FWCHAINS_H
23 #define _IP_FWCHAINS_H
26 #include <linux/icmp.h>
29 #include <linux/tcp.h>
30 #include <linux/udp.h>
31 #endif /* __KERNEL__ */
32 #define IP_FW_MAX_LABEL_LENGTH 8
33 typedef char ip_chainlabel[IP_FW_MAX_LABEL_LENGTH+1];
37 struct in_addr fw_src, fw_dst; /* Source and destination IP addr */
38 struct in_addr fw_smsk, fw_dmsk; /* Mask for src and dest IP addr */
39 __u32 fw_mark; /* ID to stamp on packet */
40 __u16 fw_proto; /* Protocol, 0 = ANY */
41 __u16 fw_flg; /* Flags word */
42 __u16 fw_invflg; /* Inverse flags */
43 __u16 fw_spts[2]; /* Source port range. */
44 __u16 fw_dpts[2]; /* Destination port range. */
45 __u16 fw_redirpt; /* Port to redirect to. */
46 __u16 fw_outputsize; /* Max amount to output to
48 char fw_vianame[IFNAMSIZ]; /* name of interface "via" */
49 __u8 fw_tosand, fw_tosxor; /* Revised packet priority */
58 /* Values for "fw_flg" field . */
59 #define IP_FW_F_PRN 0x0001 /* Print packet if it matches */
60 #define IP_FW_F_TCPSYN 0x0002 /* For tcp packets-check SYN only */
61 #define IP_FW_F_FRAG 0x0004 /* Set if rule is a fragment rule */
62 #define IP_FW_F_MARKABS 0x0008 /* Set the mark to fw_mark, not add. */
63 #define IP_FW_F_WILDIF 0x0010 /* Need only match start of interface name. */
64 #define IP_FW_F_NETLINK 0x0020 /* Redirect to netlink: 2.1.x only */
65 #define IP_FW_F_MASK 0x003F /* All possible flag bits mask */
67 /* Values for "fw_invflg" field. */
68 #define IP_FW_INV_SRCIP 0x0001 /* Invert the sense of fw_src. */
69 #define IP_FW_INV_DSTIP 0x0002 /* Invert the sense of fw_dst. */
70 #define IP_FW_INV_PROTO 0x0004 /* Invert the sense of fw_proto. */
71 #define IP_FW_INV_SRCPT 0x0008 /* Invert the sense of source ports. */
72 #define IP_FW_INV_DSTPT 0x0010 /* Invert the sense of destination ports. */
73 #define IP_FW_INV_VIA 0x0020 /* Invert the sense of fw_vianame. */
74 #define IP_FW_INV_SYN 0x0040 /* Invert the sense of IP_FW_F_TCPSYN. */
75 #define IP_FW_INV_FRAG 0x0080 /* Invert the sense of IP_FW_F_FRAG. */
78 * New IP firewall options for [gs]etsockopt at the RAW IP level.
79 * Unlike BSD Linux inherits IP options so you don't have to use
80 * a raw socket for this. Instead we check rights in the calls. */
82 #define IP_FW_BASE_CTL 64 /* base for firewall socket options */
84 #define IP_FW_APPEND (IP_FW_BASE_CTL) /* Takes ip_fwchange */
85 #define IP_FW_REPLACE (IP_FW_BASE_CTL+1) /* Takes ip_fwnew */
86 #define IP_FW_DELETE_NUM (IP_FW_BASE_CTL+2) /* Takes ip_fwdelnum */
87 #define IP_FW_DELETE (IP_FW_BASE_CTL+3) /* Takes ip_fwchange */
88 #define IP_FW_INSERT (IP_FW_BASE_CTL+4) /* Takes ip_fwnew */
89 #define IP_FW_FLUSH (IP_FW_BASE_CTL+5) /* Takes ip_chainlabel */
90 #define IP_FW_ZERO (IP_FW_BASE_CTL+6) /* Takes ip_chainlabel */
91 #define IP_FW_CHECK (IP_FW_BASE_CTL+7) /* Takes ip_fwtest */
92 #define IP_FW_MASQ_TIMEOUTS (IP_FW_BASE_CTL+8) /* Takes 3 ints */
93 #define IP_FW_CREATECHAIN (IP_FW_BASE_CTL+9) /* Takes ip_chainlabel */
94 #define IP_FW_DELETECHAIN (IP_FW_BASE_CTL+10) /* Takes ip_chainlabel */
95 #define IP_FW_POLICY (IP_FW_BASE_CTL+11) /* Takes ip_fwpolicy */
96 /* Masquerade control, only 1 optname */
98 #define IP_FW_MASQ_CTL (IP_FW_BASE_CTL+12) /* General ip_masq ctl */
100 /* Builtin chain labels */
101 #define IP_FW_LABEL_FORWARD "forward"
102 #define IP_FW_LABEL_INPUT "input"
103 #define IP_FW_LABEL_OUTPUT "output"
105 /* Special targets */
106 #define IP_FW_LABEL_MASQUERADE "MASQ"
107 #define IP_FW_LABEL_REDIRECT "REDIRECT"
108 #define IP_FW_LABEL_ACCEPT "ACCEPT"
109 #define IP_FW_LABEL_BLOCK "DENY"
110 #define IP_FW_LABEL_REJECT "REJECT"
111 #define IP_FW_LABEL_RETURN "RETURN"
112 #define IP_FW_LABEL_QUEUE "QUEUE"
114 /* Files in /proc/net */
115 #define IP_FW_PROC_CHAINS "ip_fwchains"
116 #define IP_FW_PROC_CHAIN_NAMES "ip_fwnames"
121 struct iphdr fwp_iph; /* IP header */
123 struct tcphdr fwp_tcph; /* TCP header or */
124 struct udphdr fwp_udph; /* UDP header */
125 struct icmphdr fwp_icmph; /* ICMP header */
127 struct in_addr fwp_via; /* interface address */
128 char fwp_vianame[IFNAMSIZ]; /* interface name */
131 /* The argument to IP_FW_DELETE and IP_FW_APPEND */
134 struct ip_fwuser fwc_rule;
135 ip_chainlabel fwc_label;
138 /* The argument to IP_FW_CHECK. */
141 struct ip_fwpkt fwt_packet; /* Packet to be tested */
142 ip_chainlabel fwt_label; /* Block to start test in */
145 /* The argument to IP_FW_DELETE_NUM */
149 ip_chainlabel fwd_label;
152 /* The argument to IP_FW_REPLACE and IP_FW_INSERT */
156 struct ip_fwuser fwn_rule;
157 ip_chainlabel fwn_label;
160 /* The argument to IP_FW_POLICY */
163 ip_chainlabel fwp_policy;
164 ip_chainlabel fwp_label;
167 * timeouts for ip masquerading
170 extern int ip_fw_masq_timeouts(void *, int);
174 * Main firewall chains definitions and global var's definitions.
179 #include <linux/config.h>
180 #include <linux/version.h>
181 #include <linux/init.h>
182 extern void ip_fw_init(void) __init;
183 extern int ip_fw_ctl(int, void *, int);
184 #ifdef CONFIG_IP_MASQUERADE
185 extern int ip_masq_uctl(int, char *, int);
189 #endif /* _IP_FWCHAINS_H */