?????????????? ?????????????? ?????????????? ?????????????? ip_tables.h000064400000014767152572266130006707 0ustar00/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ /* * 25-Jul-1998 Major changes to allow for ip chain table * * 3-Jan-2000 Named tables to allow packet selection for different uses. */ /* * Format of an IP firewall descriptor * * src, dst, src_mask, dst_mask are always stored in network byte order. * flags are stored in host byte order (of course). * Port numbers are stored in HOST byte order. */ #ifndef _IPTABLES_H #define _IPTABLES_H #include #include #include #include #define IPT_FUNCTION_MAXNAMELEN XT_FUNCTION_MAXNAMELEN #define IPT_TABLE_MAXNAMELEN XT_TABLE_MAXNAMELEN #define ipt_match xt_match #define ipt_target xt_target #define ipt_table xt_table #define ipt_get_revision xt_get_revision #define ipt_entry_match xt_entry_match #define ipt_entry_target xt_entry_target #define ipt_standard_target xt_standard_target #define ipt_error_target xt_error_target #define ipt_counters xt_counters #define IPT_CONTINUE XT_CONTINUE #define IPT_RETURN XT_RETURN /* This group is older than old (iptables < v1.4.0-rc1~89) */ #include #define ipt_udp xt_udp #define ipt_tcp xt_tcp #define IPT_TCP_INV_SRCPT XT_TCP_INV_SRCPT #define IPT_TCP_INV_DSTPT XT_TCP_INV_DSTPT #define IPT_TCP_INV_FLAGS XT_TCP_INV_FLAGS #define IPT_TCP_INV_OPTION XT_TCP_INV_OPTION #define IPT_TCP_INV_MASK XT_TCP_INV_MASK #define IPT_UDP_INV_SRCPT XT_UDP_INV_SRCPT #define IPT_UDP_INV_DSTPT XT_UDP_INV_DSTPT #define IPT_UDP_INV_MASK XT_UDP_INV_MASK /* The argument to IPT_SO_ADD_COUNTERS. */ #define ipt_counters_info xt_counters_info /* Standard return verdict, or do jump. */ #define IPT_STANDARD_TARGET XT_STANDARD_TARGET /* Error verdict. */ #define IPT_ERROR_TARGET XT_ERROR_TARGET /* fn returns 0 to continue iteration */ #define IPT_MATCH_ITERATE(e, fn, args...) \ XT_MATCH_ITERATE(struct ipt_entry, e, fn, ## args) /* fn returns 0 to continue iteration */ #define IPT_ENTRY_ITERATE(entries, size, fn, args...) \ XT_ENTRY_ITERATE(struct ipt_entry, entries, size, fn, ## args) /* Yes, Virginia, you have to zero the padding. */ struct ipt_ip { /* Source and destination IP addr */ struct in_addr src, dst; /* Mask for src and dest IP addr */ struct in_addr smsk, dmsk; char iniface[IFNAMSIZ], outiface[IFNAMSIZ]; unsigned char iniface_mask[IFNAMSIZ], outiface_mask[IFNAMSIZ]; /* Protocol, 0 = ANY */ __u16 proto; /* Flags word */ __u8 flags; /* Inverse flags */ __u8 invflags; }; /* Values for "flag" field in struct ipt_ip (general ip structure). */ #define IPT_F_FRAG 0x01 /* Set if rule is a fragment rule */ #define IPT_F_GOTO 0x02 /* Set if jump is a goto */ #define IPT_F_MASK 0x03 /* All possible flag bits mask. */ /* Values for "inv" field in struct ipt_ip. */ #define IPT_INV_VIA_IN 0x01 /* Invert the sense of IN IFACE. */ #define IPT_INV_VIA_OUT 0x02 /* Invert the sense of OUT IFACE */ #define IPT_INV_TOS 0x04 /* Invert the sense of TOS. */ #define IPT_INV_SRCIP 0x08 /* Invert the sense of SRC IP. */ #define IPT_INV_DSTIP 0x10 /* Invert the sense of DST OP. */ #define IPT_INV_FRAG 0x20 /* Invert the sense of FRAG. */ #define IPT_INV_PROTO XT_INV_PROTO #define IPT_INV_MASK 0x7F /* All possible flag bits mask. */ /* This structure defines each of the firewall rules. Consists of 3 parts which are 1) general IP header stuff 2) match specific stuff 3) the target to perform if the rule matches */ struct ipt_entry { struct ipt_ip ip; /* Mark with fields that we care about. */ unsigned int nfcache; /* Size of ipt_entry + matches */ __u16 target_offset; /* Size of ipt_entry + matches + target */ __u16 next_offset; /* Back pointer */ unsigned int comefrom; /* Packet and byte counters. */ struct xt_counters counters; /* The matches (if any), then the target. */ unsigned char elems[0]; }; /* * New IP firewall options for [gs]etsockopt at the RAW IP level. * Unlike BSD Linux inherits IP options so you don't have to use a raw * socket for this. Instead we check rights in the calls. * * ATTENTION: check linux/in.h before adding new number here. */ #define IPT_BASE_CTL 64 #define IPT_SO_SET_REPLACE (IPT_BASE_CTL) #define IPT_SO_SET_ADD_COUNTERS (IPT_BASE_CTL + 1) #define IPT_SO_SET_MAX IPT_SO_SET_ADD_COUNTERS #define IPT_SO_GET_INFO (IPT_BASE_CTL) #define IPT_SO_GET_ENTRIES (IPT_BASE_CTL + 1) #define IPT_SO_GET_REVISION_MATCH (IPT_BASE_CTL + 2) #define IPT_SO_GET_REVISION_TARGET (IPT_BASE_CTL + 3) #define IPT_SO_GET_MAX IPT_SO_GET_REVISION_TARGET /* ICMP matching stuff */ struct ipt_icmp { __u8 type; /* type to match */ __u8 code[2]; /* range of code */ __u8 invflags; /* Inverse flags */ }; /* Values for "inv" field for struct ipt_icmp. */ #define IPT_ICMP_INV 0x01 /* Invert the sense of type/code test */ /* The argument to IPT_SO_GET_INFO */ struct ipt_getinfo { /* Which table: caller fills this in. */ char name[XT_TABLE_MAXNAMELEN]; /* Kernel fills these in. */ /* Which hook entry points are valid: bitmask */ unsigned int valid_hooks; /* Hook entry points: one per netfilter hook. */ unsigned int hook_entry[NF_INET_NUMHOOKS]; /* Underflow points. */ unsigned int underflow[NF_INET_NUMHOOKS]; /* Number of entries */ unsigned int num_entries; /* Size of entries. */ unsigned int size; }; /* The argument to IPT_SO_SET_REPLACE. */ struct ipt_replace { /* Which table. */ char name[XT_TABLE_MAXNAMELEN]; /* Which hook entry points are valid: bitmask. You can't change this. */ unsigned int valid_hooks; /* Number of entries */ unsigned int num_entries; /* Total size of new entries */ unsigned int size; /* Hook entry points. */ unsigned int hook_entry[NF_INET_NUMHOOKS]; /* Underflow points. */ unsigned int underflow[NF_INET_NUMHOOKS]; /* Information about old entries: */ /* Number of counters (must be equal to current number of entries). */ unsigned int num_counters; /* The old entries' counters. */ struct xt_counters *counters; /* The entries (hang off end: not really an array). */ struct ipt_entry entries[0]; }; /* The argument to IPT_SO_GET_ENTRIES. */ struct ipt_get_entries { /* Which table: user fills this in. */ char name[XT_TABLE_MAXNAMELEN]; /* User fills this in: total entry size. */ unsigned int size; /* The entries. */ struct ipt_entry entrytable[0]; }; /* Helper functions */ static __inline__ struct xt_entry_target * ipt_get_target(struct ipt_entry *e) { return (void *)e + e->target_offset; } /* * Main firewall chains definitions and global var's definitions. */ #endif /* _IPTABLES_H */ ipt_CLUSTERIP.h000064400000001465152572266130007162 0ustar00/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ #ifndef _IPT_CLUSTERIP_H_target #define _IPT_CLUSTERIP_H_target #include #include enum clusterip_hashmode { CLUSTERIP_HASHMODE_SIP = 0, CLUSTERIP_HASHMODE_SIP_SPT, CLUSTERIP_HASHMODE_SIP_SPT_DPT, }; #define CLUSTERIP_HASHMODE_MAX CLUSTERIP_HASHMODE_SIP_SPT_DPT #define CLUSTERIP_MAX_NODES 16 #define CLUSTERIP_FLAG_NEW 0x00000001 struct clusterip_config; struct ipt_clusterip_tgt_info { __u32 flags; /* only relevant for new ones */ __u8 clustermac[ETH_ALEN]; __u16 num_total_nodes; __u16 num_local_nodes; __u16 local_nodes[CLUSTERIP_MAX_NODES]; __u32 hash_mode; __u32 hash_initval; /* Used internally by the kernel */ struct clusterip_config *config; }; #endif /*_IPT_CLUSTERIP_H_target*/ ipt_ECN.h000064400000001605152572266130006211 0ustar00/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ /* Header file for iptables ipt_ECN target * * (C) 2002 by Harald Welte * * This software is distributed under GNU GPL v2, 1991 * * ipt_ECN.h,v 1.3 2002/05/29 12:17:40 laforge Exp */ #ifndef _IPT_ECN_TARGET_H #define _IPT_ECN_TARGET_H #include #include #define IPT_ECN_IP_MASK (~XT_DSCP_MASK) #define IPT_ECN_OP_SET_IP 0x01 /* set ECN bits of IPv4 header */ #define IPT_ECN_OP_SET_ECE 0x10 /* set ECE bit of TCP header */ #define IPT_ECN_OP_SET_CWR 0x20 /* set CWR bit of TCP header */ #define IPT_ECN_OP_MASK 0xce struct ipt_ECN_info { __u8 operation; /* bitset of operations */ __u8 ip_ect; /* ECT codepoint of IPv4 header, pre-shifted */ union { struct { __u8 ece:1, cwr:1; /* TCP ECT bits */ } tcp; } proto; }; #endif /* _IPT_ECN_TARGET_H */ ipt_LOG.h000064400000001322152572266130006221 0ustar00/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ #ifndef _IPT_LOG_H #define _IPT_LOG_H #warning "Please update iptables, this file will be removed soon!" /* make sure not to change this without changing netfilter.h:NF_LOG_* (!) */ #define IPT_LOG_TCPSEQ 0x01 /* Log TCP sequence numbers */ #define IPT_LOG_TCPOPT 0x02 /* Log TCP options */ #define IPT_LOG_IPOPT 0x04 /* Log IP options */ #define IPT_LOG_UID 0x08 /* Log UID owning local socket */ #define IPT_LOG_NFLOG 0x10 /* Unsupported, don't reuse */ #define IPT_LOG_MACDECODE 0x20 /* Decode MAC header */ #define IPT_LOG_MASK 0x2f struct ipt_log_info { unsigned char level; unsigned char logflags; char prefix[30]; }; #endif /*_IPT_LOG_H*/ ipt_REJECT.h000064400000000724152572266130006561 0ustar00/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ #ifndef _IPT_REJECT_H #define _IPT_REJECT_H enum ipt_reject_with { IPT_ICMP_NET_UNREACHABLE, IPT_ICMP_HOST_UNREACHABLE, IPT_ICMP_PROT_UNREACHABLE, IPT_ICMP_PORT_UNREACHABLE, IPT_ICMP_ECHOREPLY, IPT_ICMP_NET_PROHIBITED, IPT_ICMP_HOST_PROHIBITED, IPT_TCP_RESET, IPT_ICMP_ADMIN_PROHIBITED }; struct ipt_reject_info { enum ipt_reject_with with; /* reject type */ }; #endif /*_IPT_REJECT_H*/ ipt_TTL.h000064400000000567152572266130006255 0ustar00/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ /* TTL modification module for IP tables * (C) 2000 by Harald Welte */ #ifndef _IPT_TTL_H #define _IPT_TTL_H #include enum { IPT_TTL_SET = 0, IPT_TTL_INC, IPT_TTL_DEC }; #define IPT_TTL_MAXMODE IPT_TTL_DEC struct ipt_TTL_info { __u8 mode; __u8 ttl; }; #endif ipt_ah.h000064400000000651152572266130006174 0ustar00/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ #ifndef _IPT_AH_H #define _IPT_AH_H #include struct ipt_ah { __u32 spis[2]; /* Security Parameter Index */ __u8 invflags; /* Inverse flags */ }; /* Values for "invflags" field in struct ipt_ah. */ #define IPT_AH_INV_SPI 0x01 /* Invert the sense of spi. */ #define IPT_AH_INV_MASK 0x01 /* All possible flags. */ #endif /*_IPT_AH_H*/ ipt_ecn.h000064400000000657152572266130006357 0ustar00/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ #ifndef _IPT_ECN_H #define _IPT_ECN_H #include #define ipt_ecn_info xt_ecn_info enum { IPT_ECN_IP_MASK = XT_ECN_IP_MASK, IPT_ECN_OP_MATCH_IP = XT_ECN_OP_MATCH_IP, IPT_ECN_OP_MATCH_ECE = XT_ECN_OP_MATCH_ECE, IPT_ECN_OP_MATCH_CWR = XT_ECN_OP_MATCH_CWR, IPT_ECN_OP_MATCH_MASK = XT_ECN_OP_MATCH_MASK, }; #endif /* IPT_ECN_H */ ipt_ttl.h000064400000000657152572266130006415 0ustar00/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ /* IP tables module for matching the value of the TTL * (C) 2000 by Harald Welte */ #ifndef _IPT_TTL_H #define _IPT_TTL_H #include enum { IPT_TTL_EQ = 0, /* equals */ IPT_TTL_NE, /* not equals */ IPT_TTL_LT, /* less than */ IPT_TTL_GT, /* greater than */ }; struct ipt_ttl_info { __u8 mode; __u8 ttl; }; #endif