diff options
Diffstat (limited to 'iptables/nft.h')
| -rw-r--r-- | iptables/nft.h | 187 |
1 files changed, 187 insertions, 0 deletions
diff --git a/iptables/nft.h b/iptables/nft.h new file mode 100644 index 00000000..41265930 --- /dev/null +++ b/iptables/nft.h @@ -0,0 +1,187 @@ +#ifndef _NFT_H_ +#define _NFT_H_ + +#include "xshared.h" +#include "nft-shared.h" +#include <libiptc/linux_list.h> + +#define FILTER 0 +#define MANGLE 1 +#define RAW 2 +#define SECURITY 3 +#define NAT 4 +#define TABLES_MAX 5 + +struct builtin_chain { + const char *name; + const char *type; + uint32_t prio; + uint32_t hook; +}; + +struct builtin_table { + const char *name; + struct builtin_chain chains[NF_INET_NUMHOOKS]; + bool initialized; +}; + +struct nft_handle { + int family; + struct mnl_socket *nl; + uint32_t portid; + uint32_t seq; + struct list_head obj_list; + int obj_list_num; + struct mnl_nlmsg_batch *batch; + struct nft_family_ops *ops; + struct builtin_table *tables; + struct nftnl_rule_list *rule_cache; + bool restore; + bool batch_support; +}; + +extern struct builtin_table xtables_ipv4[TABLES_MAX]; +extern struct builtin_table xtables_arp[TABLES_MAX]; +extern struct builtin_table xtables_bridge[TABLES_MAX]; + +int mnl_talk(struct nft_handle *h, struct nlmsghdr *nlh, + int (*cb)(const struct nlmsghdr *nlh, void *data), + void *data); +int nft_init(struct nft_handle *h, struct builtin_table *t); +void nft_fini(struct nft_handle *h); + +/* + * Operations with tables. + */ +struct nftnl_table; +struct nftnl_chain_list; + +int nft_table_add(struct nft_handle *h, struct nftnl_table *t, uint16_t flags); +int nft_for_each_table(struct nft_handle *h, int (*func)(struct nft_handle *h, const char *tablename, bool counters), bool counters); +bool nft_table_find(struct nft_handle *h, const char *tablename); +int nft_table_purge_chains(struct nft_handle *h, const char *table, struct nftnl_chain_list *list); + +/* + * Operations with chains. + */ +struct nftnl_chain; + +int nft_chain_add(struct nft_handle *h, struct nftnl_chain *c, uint16_t flags); +int nft_chain_set(struct nft_handle *h, const char *table, const char *chain, const char *policy, const struct xt_counters *counters); +struct nftnl_chain_list *nft_chain_dump(struct nft_handle *h); +struct nftnl_chain *nft_chain_list_find(struct nftnl_chain_list *list, const char *table, const char *chain); +int nft_chain_save(struct nft_handle *h, struct nftnl_chain_list *list, const char *table); +int nft_chain_user_add(struct nft_handle *h, const char *chain, const char *table); +int nft_chain_user_del(struct nft_handle *h, const char *chain, const char *table); +int nft_chain_user_rename(struct nft_handle *h, const char *chain, const char *table, const char *newname); +int nft_chain_zero_counters(struct nft_handle *h, const char *chain, const char *table); + +/* + * Operations with rule-set. + */ +struct nftnl_rule; + +int nft_rule_append(struct nft_handle *h, const char *chain, const char *table, void *data, uint64_t handle, bool verbose); +int nft_rule_insert(struct nft_handle *h, const char *chain, const char *table, void *data, int rulenum, bool verbose); +int nft_rule_check(struct nft_handle *h, const char *chain, const char *table, void *data, bool verbose); +int nft_rule_delete(struct nft_handle *h, const char *chain, const char *table, void *data, bool verbose); +int nft_rule_delete_num(struct nft_handle *h, const char *chain, const char *table, int rulenum, bool verbose); +int nft_rule_replace(struct nft_handle *h, const char *chain, const char *table, void *data, int rulenum, bool verbose); +int nft_rule_list(struct nft_handle *h, const char *chain, const char *table, int rulenum, unsigned int format); +int nft_rule_list_save(struct nft_handle *h, const char *chain, const char *table, int rulenum, int counters); +int nft_rule_save(struct nft_handle *h, const char *table, bool counters); +int nft_rule_flush(struct nft_handle *h, const char *chain, const char *table); +int nft_rule_zero_counters(struct nft_handle *h, const char *chain, const char *table, int rulenum); + +/* + * Operations used in userspace tools + */ +int add_counters(struct nftnl_rule *r, uint64_t packets, uint64_t bytes); +int add_verdict(struct nftnl_rule *r, int verdict); +int add_match(struct nftnl_rule *r, struct xt_entry_match *m); +int add_target(struct nftnl_rule *r, struct xt_entry_target *t); +int add_jumpto(struct nftnl_rule *r, const char *name, int verdict); +int add_action(struct nftnl_rule *r, struct iptables_command_state *cs, bool goto_set); +int add_comment(struct nftnl_rule *r, const char *comment); +char *get_comment(const void *data, uint32_t data_len); + +enum nft_rule_print { + NFT_RULE_APPEND, + NFT_RULE_DEL, +}; + +void nft_rule_print_save(const void *data, + struct nftnl_rule *r, enum nft_rule_print type, + unsigned int format); + +uint32_t nft_invflags2cmp(uint32_t invflags, uint32_t flag); + +/* + * global commit and abort + */ +int nft_commit(struct nft_handle *h); +int nft_abort(struct nft_handle *h); + +/* + * revision compatibility. + */ +int nft_compatible_revision(const char *name, uint8_t rev, int opt); + +/* + * Error reporting. + */ +const char *nft_strerror(int err); + +/* For xtables.c */ +int do_commandx(struct nft_handle *h, int argc, char *argv[], char **table, bool restore); +/* For xtables-arptables.c */ +int do_commandarp(struct nft_handle *h, int argc, char *argv[], char **table); +/* For xtables-eb.c */ +int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table); + +/* + * Parse config for tables and chain helper functions + */ +#define XTABLES_CONFIG_DEFAULT "/etc/xtables.conf" + +struct nftnl_table_list; +struct nftnl_chain_list; + +extern int xtables_config_parse(const char *filename, struct nftnl_table_list *table_list, struct nftnl_chain_list *chain_list); + +enum { + NFT_LOAD_VERBOSE = (1 << 0), +}; + +int nft_xtables_config_load(struct nft_handle *h, const char *filename, uint32_t flags); + +/* + * Translation from iptables to nft + */ +struct xt_buf; + +bool xlate_find_match(const struct iptables_command_state *cs, const char *p_name); +int xlate_matches(const struct iptables_command_state *cs, struct xt_xlate *xl); +int xlate_action(const struct iptables_command_state *cs, bool goto_set, + struct xt_xlate *xl); +void xlate_ifname(struct xt_xlate *xl, const char *nftmeta, const char *ifname, + bool invert); + +/* + * ARP + */ + +struct arpt_entry; + +int nft_arp_rule_append(struct nft_handle *h, const char *chain, + const char *table, struct arpt_entry *fw, + bool verbose); +int nft_arp_rule_insert(struct nft_handle *h, const char *chain, + const char *table, struct arpt_entry *fw, + int rulenum, bool verbose); + +void nft_rule_to_arpt_entry(struct nftnl_rule *r, struct arpt_entry *fw); + +int nft_is_ruleset_compatible(struct nft_handle *h); + +#endif |