Where Online Learning is simpler!

The C and C++ Include Header Files

/usr/include/linux/netfilter_ipv4/ip_tables.h


$ cat -n /usr/include/linux/netfilter_ipv4/ip_tables.h

     1	/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
     2	/*
     3	 * 25-Jul-1998 Major changes to allow for ip chain table
     4	 *
     5	 * 3-Jan-2000 Named tables to allow packet selection for different uses.
     6	 */
     7	
     8	/*
     9	 * 	Format of an IP firewall descriptor
    10	 *
    11	 * 	src, dst, src_mask, dst_mask are always stored in network byte order.
    12	 * 	flags are stored in host byte order (of course).
    13	 * 	Port numbers are stored in HOST byte order.
    14	 */
    15	
    16	#ifndef _IPTABLES_H
    17	#define _IPTABLES_H
    18	
    19	#include <linux/types.h>
    20	
    21	#include <linux/if.h>
    22	#include <linux/netfilter_ipv4.h>
    23	
    24	#include <linux/netfilter/x_tables.h>
    25	
    26	#define IPT_FUNCTION_MAXNAMELEN XT_FUNCTION_MAXNAMELEN
    27	#define IPT_TABLE_MAXNAMELEN XT_TABLE_MAXNAMELEN
    28	#define ipt_match xt_match
    29	#define ipt_target xt_target
    30	#define ipt_table xt_table
    31	#define ipt_get_revision xt_get_revision
    32	#define ipt_entry_match xt_entry_match
    33	#define ipt_entry_target xt_entry_target
    34	#define ipt_standard_target xt_standard_target
    35	#define ipt_error_target xt_error_target
    36	#define ipt_counters xt_counters
    37	#define IPT_CONTINUE XT_CONTINUE
    38	#define IPT_RETURN XT_RETURN
    39	
    40	/* This group is older than old (iptables < v1.4.0-rc1~89) */
    41	#include <linux/netfilter/xt_tcpudp.h>
    42	#define ipt_udp xt_udp
    43	#define ipt_tcp xt_tcp
    44	#define IPT_TCP_INV_SRCPT	XT_TCP_INV_SRCPT
    45	#define IPT_TCP_INV_DSTPT	XT_TCP_INV_DSTPT
    46	#define IPT_TCP_INV_FLAGS	XT_TCP_INV_FLAGS
    47	#define IPT_TCP_INV_OPTION	XT_TCP_INV_OPTION
    48	#define IPT_TCP_INV_MASK	XT_TCP_INV_MASK
    49	#define IPT_UDP_INV_SRCPT	XT_UDP_INV_SRCPT
    50	#define IPT_UDP_INV_DSTPT	XT_UDP_INV_DSTPT
    51	#define IPT_UDP_INV_MASK	XT_UDP_INV_MASK
    52	
    53	/* The argument to IPT_SO_ADD_COUNTERS. */
    54	#define ipt_counters_info xt_counters_info
    55	/* Standard return verdict, or do jump. */
    56	#define IPT_STANDARD_TARGET XT_STANDARD_TARGET
    57	/* Error verdict. */
    58	#define IPT_ERROR_TARGET XT_ERROR_TARGET
    59	
    60	/* fn returns 0 to continue iteration */
    61	#define IPT_MATCH_ITERATE(e, fn, args...) \
    62		XT_MATCH_ITERATE(struct ipt_entry, e, fn, ## args)
    63	
    64	/* fn returns 0 to continue iteration */
    65	#define IPT_ENTRY_ITERATE(entries, size, fn, args...) \
    66		XT_ENTRY_ITERATE(struct ipt_entry, entries, size, fn, ## args)
    67	
    68	/* Yes, Virginia, you have to zero the padding. */
    69	struct ipt_ip {
    70		/* Source and destination IP addr */
    71		struct in_addr src, dst;
    72		/* Mask for src and dest IP addr */
    73		struct in_addr smsk, dmsk;
    74		char iniface[IFNAMSIZ], outiface[IFNAMSIZ];
    75		unsigned char iniface_mask[IFNAMSIZ], outiface_mask[IFNAMSIZ];
    76	
    77		/* Protocol, 0 = ANY */
    78		__u16 proto;
    79	
    80		/* Flags word */
    81		__u8 flags;
    82		/* Inverse flags */
    83		__u8 invflags;
    84	};
    85	
    86	/* Values for "flag" field in struct ipt_ip (general ip structure). */
    87	#define IPT_F_FRAG		0x01	/* Set if rule is a fragment rule */
    88	#define IPT_F_GOTO		0x02	/* Set if jump is a goto */
    89	#define IPT_F_MASK		0x03	/* All possible flag bits mask. */
    90	
    91	/* Values for "inv" field in struct ipt_ip. */
    92	#define IPT_INV_VIA_IN		0x01	/* Invert the sense of IN IFACE. */
    93	#define IPT_INV_VIA_OUT		0x02	/* Invert the sense of OUT IFACE */
    94	#define IPT_INV_TOS		0x04	/* Invert the sense of TOS. */
    95	#define IPT_INV_SRCIP		0x08	/* Invert the sense of SRC IP. */
    96	#define IPT_INV_DSTIP		0x10	/* Invert the sense of DST OP. */
    97	#define IPT_INV_FRAG		0x20	/* Invert the sense of FRAG. */
    98	#define IPT_INV_PROTO		XT_INV_PROTO
    99	#define IPT_INV_MASK		0x7F	/* All possible flag bits mask. */
   100	
   101	/* This structure defines each of the firewall rules.  Consists of 3
   102	   parts which are 1) general IP header stuff 2) match specific
   103	   stuff 3) the target to perform if the rule matches */
   104	struct ipt_entry {
   105		struct ipt_ip ip;
   106	
   107		/* Mark with fields that we care about. */
   108		unsigned int nfcache;
   109	
   110		/* Size of ipt_entry + matches */
   111		__u16 target_offset;
   112		/* Size of ipt_entry + matches + target */
   113		__u16 next_offset;
   114	
   115		/* Back pointer */
   116		unsigned int comefrom;
   117	
   118		/* Packet and byte counters. */
   119		struct xt_counters counters;
   120	
   121		/* The matches (if any), then the target. */
   122		unsigned char elems[];
   123	};
   124	
   125	/*
   126	 * New IP firewall options for [gs]etsockopt at the RAW IP level.
   127	 * Unlike BSD Linux inherits IP options so you don't have to use a raw
   128	 * socket for this. Instead we check rights in the calls.
   129	 *
   130	 * ATTENTION: check linux/in.h before adding new number here.
   131	 */
   132	#define IPT_BASE_CTL		64
   133	
   134	#define IPT_SO_SET_REPLACE	(IPT_BASE_CTL)
   135	#define IPT_SO_SET_ADD_COUNTERS	(IPT_BASE_CTL + 1)
   136	#define IPT_SO_SET_MAX		IPT_SO_SET_ADD_COUNTERS
   137	
   138	#define IPT_SO_GET_INFO			(IPT_BASE_CTL)
   139	#define IPT_SO_GET_ENTRIES		(IPT_BASE_CTL + 1)
   140	#define IPT_SO_GET_REVISION_MATCH	(IPT_BASE_CTL + 2)
   141	#define IPT_SO_GET_REVISION_TARGET	(IPT_BASE_CTL + 3)
   142	#define IPT_SO_GET_MAX			IPT_SO_GET_REVISION_TARGET
   143	
   144	/* ICMP matching stuff */
   145	struct ipt_icmp {
   146		__u8 type;				/* type to match */
   147		__u8 code[2];				/* range of code */
   148		__u8 invflags;				/* Inverse flags */
   149	};
   150	
   151	/* Values for "inv" field for struct ipt_icmp. */
   152	#define IPT_ICMP_INV	0x01	/* Invert the sense of type/code test */
   153	
   154	/* The argument to IPT_SO_GET_INFO */
   155	struct ipt_getinfo {
   156		/* Which table: caller fills this in. */
   157		char name[XT_TABLE_MAXNAMELEN];
   158	
   159		/* Kernel fills these in. */
   160		/* Which hook entry points are valid: bitmask */
   161		unsigned int valid_hooks;
   162	
   163		/* Hook entry points: one per netfilter hook. */
   164		unsigned int hook_entry[NF_INET_NUMHOOKS];
   165	
   166		/* Underflow points. */
   167		unsigned int underflow[NF_INET_NUMHOOKS];
   168	
   169		/* Number of entries */
   170		unsigned int num_entries;
   171	
   172		/* Size of entries. */
   173		unsigned int size;
   174	};
   175	
   176	/* The argument to IPT_SO_SET_REPLACE. */
   177	struct ipt_replace {
   178		/* Which table. */
   179		char name[XT_TABLE_MAXNAMELEN];
   180	
   181		/* Which hook entry points are valid: bitmask.  You can't
   182	           change this. */
   183		unsigned int valid_hooks;
   184	
   185		/* Number of entries */
   186		unsigned int num_entries;
   187	
   188		/* Total size of new entries */
   189		unsigned int size;
   190	
   191		/* Hook entry points. */
   192		unsigned int hook_entry[NF_INET_NUMHOOKS];
   193	
   194		/* Underflow points. */
   195		unsigned int underflow[NF_INET_NUMHOOKS];
   196	
   197		/* Information about old entries: */
   198		/* Number of counters (must be equal to current number of entries). */
   199		unsigned int num_counters;
   200		/* The old entries' counters. */
   201		struct xt_counters *counters;
   202	
   203		/* The entries (hang off end: not really an array). */
   204		struct ipt_entry entries[];
   205	};
   206	
   207	/* The argument to IPT_SO_GET_ENTRIES. */
   208	struct ipt_get_entries {
   209		/* Which table: user fills this in. */
   210		char name[XT_TABLE_MAXNAMELEN];
   211	
   212		/* User fills this in: total entry size. */
   213		unsigned int size;
   214	
   215		/* The entries. */
   216		struct ipt_entry entrytable[];
   217	};
   218	
   219	/* Helper functions */
   220	static __inline__ struct xt_entry_target *
   221	ipt_get_target(struct ipt_entry *e)
   222	{
   223		return (struct xt_entry_target *)((char *)e + e->target_offset);
   224	}
   225	
   226	/*
   227	 *	Main firewall chains definitions and global var's definitions.
   228	 */
   229	#endif /* _IPTABLES_H */