2 * Format of an ARP firewall descriptor
4 * src, tgt, src_mask, tgt_mask, arpop, arpop_mask are always stored in
6 * flags are stored in host byte order (of course).
14 #include <linux/types.h>
16 #include <linux/if_arp.h>
17 #include <linux/skbuff.h>
19 #include <linux/compiler.h>
20 #include <linux/netfilter_arp.h>
22 #define ARPT_FUNCTION_MAXNAMELEN 30
23 #define ARPT_TABLE_MAXNAMELEN 32
25 #define ARPT_DEV_ADDR_LEN_MAX 16
27 struct arpt_devaddr_info {
28 char addr[ARPT_DEV_ADDR_LEN_MAX];
29 char mask[ARPT_DEV_ADDR_LEN_MAX];
32 /* Yes, Virginia, you have to zero the padding. */
34 /* Source and target IP addr */
35 struct in_addr src, tgt;
36 /* Mask for src and target IP addr */
37 struct in_addr smsk, tmsk;
39 /* Device hw address length, src+target device addresses */
40 u_int8_t arhln, arhln_mask;
41 struct arpt_devaddr_info src_devaddr;
42 struct arpt_devaddr_info tgt_devaddr;
44 /* ARP operation code. */
45 u_int16_t arpop, arpop_mask;
47 /* ARP hardware address and protocol address format. */
48 u_int16_t arhrd, arhrd_mask;
49 u_int16_t arpro, arpro_mask;
51 /* The protocol address length is only accepted if it is 4
52 * so there is no use in offering a way to do filtering on it.
55 char iniface[IFNAMSIZ], outiface[IFNAMSIZ];
56 unsigned char iniface_mask[IFNAMSIZ], outiface_mask[IFNAMSIZ];
64 struct arpt_entry_target
68 u_int16_t target_size;
70 /* Used by userspace */
71 char name[ARPT_FUNCTION_MAXNAMELEN-1];
75 u_int16_t target_size;
77 /* Used inside the kernel */
78 struct arpt_target *target;
82 u_int16_t target_size;
85 unsigned char data[0];
88 struct arpt_standard_target
90 struct arpt_entry_target target;
96 u_int64_t pcnt, bcnt; /* Packet and byte counters */
99 /* Values for "flag" field in struct arpt_ip (general arp structure).
100 * No flags defined yet.
102 #define ARPT_F_MASK 0x00 /* All possible flag bits mask. */
104 /* Values for "inv" field in struct arpt_arp. */
105 #define ARPT_INV_VIA_IN 0x0001 /* Invert the sense of IN IFACE. */
106 #define ARPT_INV_VIA_OUT 0x0002 /* Invert the sense of OUT IFACE */
107 #define ARPT_INV_SRCIP 0x0004 /* Invert the sense of SRC IP. */
108 #define ARPT_INV_TGTIP 0x0008 /* Invert the sense of TGT IP. */
109 #define ARPT_INV_SRCDEVADDR 0x0010 /* Invert the sense of SRC DEV ADDR. */
110 #define ARPT_INV_TGTDEVADDR 0x0020 /* Invert the sense of TGT DEV ADDR. */
111 #define ARPT_INV_ARPOP 0x0040 /* Invert the sense of ARP OP. */
112 #define ARPT_INV_ARPHRD 0x0080 /* Invert the sense of ARP HRD. */
113 #define ARPT_INV_ARPPRO 0x0100 /* Invert the sense of ARP PRO. */
114 #define ARPT_INV_ARPHLN 0x0200 /* Invert the sense of ARP HLN. */
115 #define ARPT_INV_MASK 0x03FF /* All possible flag bits mask. */
117 /* This structure defines each of the firewall rules. Consists of 3
118 parts which are 1) general ARP header stuff 2) match specific
119 stuff 3) the target to perform if the rule matches */
124 /* Size of arpt_entry + matches */
125 u_int16_t target_offset;
126 /* Size of arpt_entry + matches + target */
127 u_int16_t next_offset;
130 unsigned int comefrom;
132 /* Packet and byte counters. */
133 struct arpt_counters counters;
135 /* The matches (if any), then the target. */
136 unsigned char elems[0];
140 * New IP firewall options for [gs]etsockopt at the RAW IP level.
141 * Unlike BSD Linux inherits IP options so you don't have to use a raw
142 * socket for this. Instead we check rights in the calls.
144 #define ARPT_BASE_CTL 96 /* base for firewall socket options */
146 #define ARPT_SO_SET_REPLACE (ARPT_BASE_CTL)
147 #define ARPT_SO_SET_ADD_COUNTERS (ARPT_BASE_CTL + 1)
148 #define ARPT_SO_SET_MAX ARPT_SO_SET_ADD_COUNTERS
150 #define ARPT_SO_GET_INFO (ARPT_BASE_CTL)
151 #define ARPT_SO_GET_ENTRIES (ARPT_BASE_CTL + 1)
152 /* #define ARPT_SO_GET_REVISION_MATCH (ARPT_BASE_CTL + 2)*/
153 #define ARPT_SO_GET_REVISION_TARGET (ARPT_BASE_CTL + 3)
154 #define ARPT_SO_GET_MAX ARPT_SO_GET_REVISION_TARGET
156 /* CONTINUE verdict for targets */
157 #define ARPT_CONTINUE 0xFFFFFFFF
159 /* For standard target */
160 #define ARPT_RETURN (-NF_REPEAT - 1)
162 /* The argument to ARPT_SO_GET_INFO */
165 /* Which table: caller fills this in. */
166 char name[ARPT_TABLE_MAXNAMELEN];
168 /* Kernel fills these in. */
169 /* Which hook entry points are valid: bitmask */
170 unsigned int valid_hooks;
172 /* Hook entry points: one per netfilter hook. */
173 unsigned int hook_entry[NF_ARP_NUMHOOKS];
175 /* Underflow points. */
176 unsigned int underflow[NF_ARP_NUMHOOKS];
178 /* Number of entries */
179 unsigned int num_entries;
181 /* Size of entries. */
185 /* The argument to ARPT_SO_SET_REPLACE. */
189 char name[ARPT_TABLE_MAXNAMELEN];
191 /* Which hook entry points are valid: bitmask. You can't
193 unsigned int valid_hooks;
195 /* Number of entries */
196 unsigned int num_entries;
198 /* Total size of new entries */
201 /* Hook entry points. */
202 unsigned int hook_entry[NF_ARP_NUMHOOKS];
204 /* Underflow points. */
205 unsigned int underflow[NF_ARP_NUMHOOKS];
207 /* Information about old entries: */
208 /* Number of counters (must be equal to current number of entries). */
209 unsigned int num_counters;
210 /* The old entries' counters. */
211 struct arpt_counters __user *counters;
213 /* The entries (hang off end: not really an array). */
214 struct arpt_entry entries[0];
217 /* The argument to ARPT_SO_ADD_COUNTERS. */
218 struct arpt_counters_info
221 char name[ARPT_TABLE_MAXNAMELEN];
223 unsigned int num_counters;
225 /* The counters (actually `number' of these). */
226 struct arpt_counters counters[0];
229 /* The argument to ARPT_SO_GET_ENTRIES. */
230 struct arpt_get_entries
232 /* Which table: user fills this in. */
233 char name[ARPT_TABLE_MAXNAMELEN];
235 /* User fills this in: total entry size. */
239 struct arpt_entry entrytable[0];
242 /* The argument to ARPT_SO_GET_REVISION_*. Returns highest revision
243 * kernel supports, if >= revision. */
244 struct arpt_get_revision
246 char name[ARPT_FUNCTION_MAXNAMELEN-1];
251 /* Standard return verdict, or do jump. */
252 #define ARPT_STANDARD_TARGET ""
254 #define ARPT_ERROR_TARGET "ERROR"
256 /* Helper functions */
257 static __inline__ struct arpt_entry_target *arpt_get_target(struct arpt_entry *e)
259 return (void *)e + e->target_offset;
262 /* fn returns 0 to continue iteration */
263 #define ARPT_ENTRY_ITERATE(entries, size, fn, args...) \
267 struct arpt_entry *__entry; \
269 for (__i = 0; __i < (size); __i += __entry->next_offset) { \
270 __entry = (void *)(entries) + __i; \
272 __ret = fn(__entry , ## args); \
280 * Main firewall chains definitions and global var's definitions.
284 /* Registration hooks for targets. */
287 struct list_head list;
289 const char name[ARPT_FUNCTION_MAXNAMELEN-1];
293 /* Returns verdict. */
294 unsigned int (*target)(struct sk_buff **pskb,
295 unsigned int hooknum,
296 const struct net_device *in,
297 const struct net_device *out,
298 const void *targinfo,
301 /* Called when user tries to insert an entry of this type:
302 hook_mask is a bitmask of hooks from which it can be
304 /* Should return true or false. */
305 int (*checkentry)(const char *tablename,
306 const struct arpt_entry *e,
308 unsigned int targinfosize,
309 unsigned int hook_mask);
311 /* Called when entry of this type deleted. */
312 void (*destroy)(void *targinfo, unsigned int targinfosize);
314 /* Set this to THIS_MODULE if you are a module, otherwise NULL */
318 extern int arpt_register_target(struct arpt_target *target);
319 extern void arpt_unregister_target(struct arpt_target *target);
321 /* Furniture shopping... */
324 struct list_head list;
326 /* A unique name... */
327 char name[ARPT_TABLE_MAXNAMELEN];
329 /* What hooks you will enter on */
330 unsigned int valid_hooks;
332 /* Lock for the curtain */
335 /* Man behind the curtain... */
336 struct arpt_table_info *private;
338 /* Set this to THIS_MODULE if you are a module, otherwise NULL */
342 extern int arpt_register_table(struct arpt_table *table,
343 const struct arpt_replace *repl);
344 extern void arpt_unregister_table(struct arpt_table *table);
345 extern unsigned int arpt_do_table(struct sk_buff **pskb,
347 const struct net_device *in,
348 const struct net_device *out,
349 struct arpt_table *table,
352 #define ARPT_ALIGN(s) (((s) + (__alignof__(struct arpt_entry)-1)) & ~(__alignof__(struct arpt_entry)-1))
353 #endif /*__KERNEL__*/
354 #endif /* _ARPTABLES_H */