nft-shared.h 7.96 KB
Newer Older
1
2
3
4
5
6
7
#ifndef _NFT_SHARED_H_
#define _NFT_SHARED_H_

#include <stdbool.h>

#include <libnftnl/rule.h>
#include <libnftnl/expr.h>
8
#include <libnftnl/chain.h>
9
10

#include <linux/netfilter_arp/arp_tables.h>
11
#include <linux/netfilter/nf_tables.h>
12
13
14

#include "xshared.h"

15
#ifdef DEBUG
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
#define NLDEBUG
#define DEBUG_DEL
#endif

/*
 * iptables print output emulation
 */

#define FMT_NUMERIC	0x0001
#define FMT_NOCOUNTS	0x0002
#define FMT_KILOMEGAGIGA 0x0004
#define FMT_OPTIONS	0x0008
#define FMT_NOTABLE	0x0010
#define FMT_NOTARGET	0x0020
#define FMT_VIA		0x0040
#define FMT_NONEWLINE	0x0080
#define FMT_LINENUMBERS 0x0100

#define FMT_PRINT_RULE (FMT_NOCOUNTS | FMT_OPTIONS | FMT_VIA \
			| FMT_NUMERIC | FMT_NOTABLE)
#define FMT(tab,notab) ((format) & FMT_NOTABLE ? (notab) : (tab))

struct xtables_args;
39
struct nft_handle;
40
struct xt_xlate;
41
42
43
44
45

enum {
	NFT_XT_CTX_PAYLOAD	= (1 << 0),
	NFT_XT_CTX_META		= (1 << 1),
	NFT_XT_CTX_BITWISE	= (1 << 2),
46
	NFT_XT_CTX_IMMEDIATE	= (1 << 3),
47
	NFT_XT_CTX_PREV_PAYLOAD	= (1 << 4),
48
49
50
};

struct nft_xt_ctx {
51
	struct iptables_command_state *cs;
52
	struct nftnl_expr_iter *iter;
53
	struct nft_handle *h;
54
	uint32_t flags;
55
	const char *table;
56
57
58

	uint32_t reg;
	struct {
59
		uint32_t base;
60
61
		uint32_t offset;
		uint32_t len;
62
	} payload, prev_payload;
63
64
65
	struct {
		uint32_t key;
	} meta;
66
67
68
69
	struct {
		uint32_t data[4];
		uint32_t len, reg;
	} immediate;
70
71
72
73
74
75
76
	struct {
		uint32_t mask[4];
		uint32_t xor[4];
	} bitwise;
};

struct nft_family_ops {
77
	int (*add)(struct nft_handle *h, struct nftnl_rule *r, void *data);
78
79
80
81
82
83
84
85
86
87
88
89
	bool (*is_same)(const void *data_a,
			const void *data_b);
	void (*print_payload)(struct nftnl_expr *e,
			      struct nftnl_expr_iter *iter);
	void (*parse_meta)(struct nft_xt_ctx *ctx, struct nftnl_expr *e,
			   void *data);
	void (*parse_payload)(struct nft_xt_ctx *ctx, struct nftnl_expr *e,
			      void *data);
	void (*parse_bitwise)(struct nft_xt_ctx *ctx, struct nftnl_expr *e,
			      void *data);
	void (*parse_cmp)(struct nft_xt_ctx *ctx, struct nftnl_expr *e,
			  void *data);
90
91
	void (*parse_lookup)(struct nft_xt_ctx *ctx, struct nftnl_expr *e,
			     void *data);
92
93
94
95
96
97
	void (*parse_immediate)(const char *jumpto, bool nft_goto, void *data);

	void (*print_table_header)(const char *tablename);
	void (*print_header)(unsigned int format, const char *chain,
			     const char *pol,
			     const struct xt_counters *counters, bool basechain,
98
			     uint32_t refs, uint32_t entries);
99
100
	void (*print_rule)(struct nft_handle *h, struct nftnl_rule *r,
			   unsigned int num, unsigned int format);
101
102
	void (*save_rule)(const void *data, unsigned int format);
	void (*save_chain)(const struct nftnl_chain *c, const char *policy);
103
104
105
106
107
108
	void (*proto_parse)(struct iptables_command_state *cs,
			    struct xtables_args *args);
	void (*post_parse)(int command, struct iptables_command_state *cs,
			   struct xtables_args *args);
	void (*parse_match)(struct xtables_match *m, void *data);
	void (*parse_target)(struct xtables_target *t, void *data);
109
	void (*rule_to_cs)(struct nft_handle *h, const struct nftnl_rule *r,
110
111
			   struct iptables_command_state *cs);
	void (*clear_cs)(struct iptables_command_state *cs);
112
	int (*xlate)(const void *data, struct xt_xlate *xl);
113
114
115
116
};

void add_meta(struct nftnl_rule *r, uint32_t key);
void add_payload(struct nftnl_rule *r, int offset, int len, uint32_t base);
117
void add_bitwise(struct nftnl_rule *r, uint8_t *mask, size_t len);
118
void add_bitwise_u16(struct nftnl_rule *r, uint16_t mask, uint16_t xor);
119
120
121
122
123
124
void add_cmp_ptr(struct nftnl_rule *r, uint32_t op, void *data, size_t len);
void add_cmp_u8(struct nftnl_rule *r, uint8_t val, uint32_t op);
void add_cmp_u16(struct nftnl_rule *r, uint16_t val, uint32_t op);
void add_cmp_u32(struct nftnl_rule *r, uint32_t val, uint32_t op);
void add_iniface(struct nftnl_rule *r, char *iface, uint32_t op);
void add_outiface(struct nftnl_rule *r, char *iface, uint32_t op);
125
void add_addr(struct nftnl_rule *r, enum nft_payload_bases base, int offset,
126
127
128
	      void *data, void *mask, size_t len, uint32_t op);
void add_proto(struct nftnl_rule *r, int offset, size_t len,
	       uint8_t proto, uint32_t op);
129
void add_l4proto(struct nftnl_rule *r, uint8_t proto, uint32_t op);
130
131
132
133
134
135
136
137
138
139
140
141
142
143
void add_compat(struct nftnl_rule *r, uint32_t proto, bool inv);

bool is_same_interfaces(const char *a_iniface, const char *a_outiface,
			unsigned const char *a_iniface_mask,
			unsigned const char *a_outiface_mask,
			const char *b_iniface, const char *b_outiface,
			unsigned const char *b_iniface_mask,
			unsigned const char *b_outiface_mask);

int parse_meta(struct nftnl_expr *e, uint8_t key, char *iniface,
		unsigned char *iniface_mask, char *outiface,
		unsigned char *outiface_mask, uint8_t *invflags);
void print_proto(uint16_t proto, int invert);
void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv);
144
145
void nft_rule_to_iptables_command_state(struct nft_handle *h,
					const struct nftnl_rule *r,
146
					struct iptables_command_state *cs);
147
void nft_clear_iptables_command_state(struct iptables_command_state *cs);
148
149
void print_header(unsigned int format, const char *chain, const char *pol,
		  const struct xt_counters *counters, bool basechain,
150
151
152
153
154
		  uint32_t refs, uint32_t entries);
void print_rule_details(const struct iptables_command_state *cs,
			const char *targname, uint8_t flags,
			uint8_t invflags, uint8_t proto,
			unsigned int num, unsigned int format);
155
156
void print_matches_and_target(struct iptables_command_state *cs,
			      unsigned int format);
157
158
159
160
161
162
163
164
165
166
void save_rule_details(const struct iptables_command_state *cs,
		       uint8_t invflags, uint16_t proto,
		       const char *iniface,
		       unsigned const char *iniface_mask,
		       const char *outiface,
		       unsigned const char *outiface_mask);
void nft_ipv46_save_chain(const struct nftnl_chain *c, const char *policy);
void save_matches_and_target(const struct iptables_command_state *cs,
			     bool goto_flag, const void *fw,
			     unsigned int format);
167
168
169

struct nft_family_ops *nft_family_ops_lookup(int family);

170
void nft_ipv46_parse_target(struct xtables_target *t, void *data);
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202

bool compare_matches(struct xtables_rule_match *mt1, struct xtables_rule_match *mt2);
bool compare_targets(struct xtables_target *tg1, struct xtables_target *tg2);

struct addr_mask {
	union {
		struct in_addr	*v4;
		struct in6_addr *v6;
	} addr;

	unsigned int naddrs;

	union {
		struct in_addr	*v4;
		struct in6_addr *v6;
	} mask;
};

struct xtables_args {
	int		family;
	uint16_t	proto;
	uint8_t		flags;
	uint8_t		invflags;
	char		iniface[IFNAMSIZ], outiface[IFNAMSIZ];
	unsigned char	iniface_mask[IFNAMSIZ], outiface_mask[IFNAMSIZ];
	bool		goto_set;
	const char	*shostnetworkmask, *dhostnetworkmask;
	const char	*pcnt, *bcnt;
	struct addr_mask s, d;
	unsigned long long pcnt_cnt, bcnt_cnt;
};

203
204
205
206
struct nft_xt_cmd_parse {
	unsigned int			command;
	unsigned int			rulenum;
	char				*table;
207
208
209
	const char			*chain;
	const char			*newname;
	const char			*policy;
210
211
	bool				restore;
	int				verbose;
212
	bool				xlate;
213
214
215
216
217
218
219
220
221
222
223
224
225
};

void do_parse(struct nft_handle *h, int argc, char *argv[],
	      struct nft_xt_cmd_parse *p, struct iptables_command_state *cs,
	      struct xtables_args *args);

struct nftnl_chain_list;

struct nft_xt_restore_cb {
	void (*table_new)(struct nft_handle *h, const char *table);
	int (*chain_set)(struct nft_handle *h, const char *table,
			 const char *chain, const char *policy,
			 const struct xt_counters *counters);
226
227
	int (*chain_restore)(struct nft_handle *h, const char *chain,
			     const char *table);
228

229
230
	int (*table_flush)(struct nft_handle *h, const char *table,
			   bool verbose);
231
232
233
234
235
236
237
238

	int (*do_command)(struct nft_handle *h, int argc, char *argv[],
			  char **table, bool restore);

	int (*commit)(struct nft_handle *h);
	int (*abort)(struct nft_handle *h);
};

239
240
241
242
243
244
245
246
struct nft_xt_restore_parse {
	FILE				*in;
	int				testing;
	const char			*tablename;
	bool				commit;
	const struct nft_xt_restore_cb	*cb;
};

247
void xtables_restore_parse(struct nft_handle *h,
248
			   const struct nft_xt_restore_parse *p);
249

250
void nft_check_xt_legacy(int family, bool is_ipt_save);
251
252
253
254

#define min(x, y) ((x) < (y) ? (x) : (y))
#define max(x, y) ((x) > (y) ? (x) : (y))

255
#endif