1 /*
2 * Format of an ARP firewall descriptor
3 *
4 * src, tgt, src_mask, tgt_mask, arpop, arpop_mask are always stored in
5 * network byte order.
6 * flags are stored in host byte order (of course).
7 */
8
9 #ifndef _ARPTABLES_H
10 #define _ARPTABLES_H
11
12 #include <linux/types.h>
13 #include <linux/netfilter_arp.h>
14
15 #include <linux/netfilter/x_tables.h>
16
17 #define ARPT_FUNCTION_MAXNAMELEN XT_FUNCTION_MAXNAMELEN
18 #define ARPT_TABLE_MAXNAMELEN XT_TABLE_MAXNAMELEN
19
20 #define ARPT_DEV_ADDR_LEN_MAX 16
21
22 struct arpt_devaddr_info {
23 char addr[ARPT_DEV_ADDR_LEN_MAX];
24 char mask[ARPT_DEV_ADDR_LEN_MAX];
25 };
26
27 /* Yes, Virginia, you have to zero the padding. */
28 struct arpt_arp {
29 /* Source and target IP addr */
30 struct in_addr src, tgt;
31 /* Mask for src and target IP addr */
32 struct in_addr smsk, tmsk;
33
34 /* Device hw address length, src+target device addresses */
35 u_int8_t arhln, arhln_mask;
36 struct arpt_devaddr_info src_devaddr;
37 struct arpt_devaddr_info tgt_devaddr;
38
39 /* ARP operation code. */
40 __be16 arpop, arpop_mask;
41
42 /* ARP hardware address and protocol address format. */
43 __be16 arhrd, arhrd_mask;
44 __be16 arpro, arpro_mask;
45
46 /* The protocol address length is only accepted if it is 4
47 * so there is no use in offering a way to do filtering on it.
48 */
49
50 char iniface[IFNAMSIZ], outiface[IFNAMSIZ];
51 unsigned char iniface_mask[IFNAMSIZ], outiface_mask[IFNAMSIZ];
52
53 /* Flags word */
54 u_int8_t flags;
55 /* Inverse flags */
56 u_int16_t invflags;
57 };
58
59 #define arpt_entry_target xt_entry_target
60 #define arpt_standard_target xt_standard_target
61
62 /* Values for "flag" field in struct arpt_ip (general arp structure).
63 * No flags defined yet.
64 */
65 #define ARPT_F_MASK 0x00 /* All possible flag bits mask. */
66
67 /* Values for "inv" field in struct arpt_arp. */
68 #define ARPT_INV_VIA_IN 0x0001 /* Invert the sense of IN IFACE. */
69 #define ARPT_INV_VIA_OUT 0x0002 /* Invert the sense of OUT IFACE */
70 #define ARPT_INV_SRCIP 0x0004 /* Invert the sense of SRC IP. */
71 #define ARPT_INV_TGTIP 0x0008 /* Invert the sense of TGT IP. */
72 #define ARPT_INV_SRCDEVADDR 0x0010 /* Invert the sense of SRC DEV ADDR. */
73 #define ARPT_INV_TGTDEVADDR 0x0020 /* Invert the sense of TGT DEV ADDR. */
74 #define ARPT_INV_ARPOP 0x0040 /* Invert the sense of ARP OP. */
75 #define ARPT_INV_ARPHRD 0x0080 /* Invert the sense of ARP HRD. */
76 #define ARPT_INV_ARPPRO 0x0100 /* Invert the sense of ARP PRO. */
77 #define ARPT_INV_ARPHLN 0x0200 /* Invert the sense of ARP HLN. */
78 #define ARPT_INV_MASK 0x03FF /* All possible flag bits mask. */
79
80 /* This structure defines each of the firewall rules. Consists of 3
81 parts which are 1) general ARP header stuff 2) match specific
82 stuff 3) the target to perform if the rule matches */
83 struct arpt_entry
84 {
85 struct arpt_arp arp;
86
87 /* Size of arpt_entry + matches */
88 u_int16_t target_offset;
89 /* Size of arpt_entry + matches + target */
90 u_int16_t next_offset;
91
92 /* Back pointer */
93 unsigned int comefrom;
94
95 /* Packet and byte counters. */
96 struct xt_counters counters;
97
98 /* The matches (if any), then the target. */
99 unsigned char elems[0];
100 };
101
102 /*
103 * New IP firewall options for [gs]etsockopt at the RAW IP level.
104 * Unlike BSD Linux inherits IP options so you don't have to use a raw
105 * socket for this. Instead we check rights in the calls.
106 *
107 * ATTENTION: check linux/in.h before adding new number here.
108 */
109 #define ARPT_BASE_CTL 96
110
111 #define ARPT_SO_SET_REPLACE (ARPT_BASE_CTL)
112 #define ARPT_SO_SET_ADD_COUNTERS (ARPT_BASE_CTL + 1)
113 #define ARPT_SO_SET_MAX ARPT_SO_SET_ADD_COUNTERS
114
115 #define ARPT_SO_GET_INFO (ARPT_BASE_CTL)
116 #define ARPT_SO_GET_ENTRIES (ARPT_BASE_CTL + 1)
117 /* #define ARPT_SO_GET_REVISION_MATCH (APRT_BASE_CTL + 2) */
118 #define ARPT_SO_GET_REVISION_TARGET (ARPT_BASE_CTL + 3)
119 #define ARPT_SO_GET_MAX (ARPT_SO_GET_REVISION_TARGET)
120
121 /* CONTINUE verdict for targets */
122 #define ARPT_CONTINUE XT_CONTINUE
123
124 /* For standard target */
125 #define ARPT_RETURN XT_RETURN
126
127 /* The argument to ARPT_SO_GET_INFO */
128 struct arpt_getinfo
129 {
130 /* Which table: caller fills this in. */
131 char name[ARPT_TABLE_MAXNAMELEN];
132
133 /* Kernel fills these in. */
134 /* Which hook entry points are valid: bitmask */
135 unsigned int valid_hooks;
136
137 /* Hook entry points: one per netfilter hook. */
138 unsigned int hook_entry[NF_ARP_NUMHOOKS];
139
140 /* Underflow points. */
141 unsigned int underflow[NF_ARP_NUMHOOKS];
142
143 /* Number of entries */
144 unsigned int num_entries;
145
146 /* Size of entries. */
147 unsigned int size;
148 };
149
150 /* The argument to ARPT_SO_SET_REPLACE. */
151 struct arpt_replace
152 {
153 /* Which table. */
154 char name[ARPT_TABLE_MAXNAMELEN];
155
156 /* Which hook entry points are valid: bitmask. You can't
157 change this. */
158 unsigned int valid_hooks;
159
160 /* Number of entries */
161 unsigned int num_entries;
162
163 /* Total size of new entries */
164 unsigned int size;
165
166 /* Hook entry points. */
167 unsigned int hook_entry[NF_ARP_NUMHOOKS];
168
169 /* Underflow points. */
170 unsigned int underflow[NF_ARP_NUMHOOKS];
171
172 /* Information about old entries: */
173 /* Number of counters (must be equal to current number of entries). */
174 unsigned int num_counters;
175 /* The old entries' counters. */
176 struct xt_counters *counters;
177
178 /* The entries (hang off end: not really an array). */
179 struct arpt_entry entries[0];
180 };
181
182 /* The argument to ARPT_SO_ADD_COUNTERS. */
183 #define arpt_counters_info xt_counters_info
184 #define arpt_counters xt_counters
185
186 /* The argument to ARPT_SO_GET_ENTRIES. */
187 struct arpt_get_entries
188 {
189 /* Which table: user fills this in. */
190 char name[ARPT_TABLE_MAXNAMELEN];
191
192 /* User fills this in: total entry size. */
193 unsigned int size;
194
195 /* The entries. */
196 struct arpt_entry entrytable[0];
197 };
198
199 /* Standard return verdict, or do jump. */
200 #define ARPT_STANDARD_TARGET XT_STANDARD_TARGET
201 /* Error verdict. */
202 #define ARPT_ERROR_TARGET XT_ERROR_TARGET
203
204 /* Helper functions */
arpt_get_target(struct arpt_entry * e)205 static __inline__ struct arpt_entry_target *arpt_get_target(struct arpt_entry *e)
206 {
207 return (void *)e + e->target_offset;
208 }
209
210 /* fn returns 0 to continue iteration */
211 #define ARPT_ENTRY_ITERATE(entries, size, fn, args...) \
212 XT_ENTRY_ITERATE(struct arpt_entry, entries, size, fn, ## args)
213
214 /*
215 * Main firewall chains definitions and global var's definitions.
216 */
217 #endif /* _ARPTABLES_H */
218