1 /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ 2 /* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu> 3 * Patrick Schaaf <bof@bof.de> 4 * Martin Josefsson <gandalf@wlug.westbo.se> 5 * Copyright (C) 2003-2011 Jozsef Kadlecsik <kadlec@netfilter.org> 6 */ 7 #ifndef _UAPI_IP_SET_H 8 #define _UAPI_IP_SET_H 9 10 #include <linux/types.h> 11 12 /* The protocol versions */ 13 #define IPSET_PROTOCOL 7 14 #define IPSET_PROTOCOL_MIN 6 15 16 /* The max length of strings including NUL: set and type identifiers */ 17 #define IPSET_MAXNAMELEN 32 18 19 /* The maximum permissible comment length we will accept over netlink */ 20 #define IPSET_MAX_COMMENT_SIZE 255 21 22 /* Message types and commands */ 23 enum ipset_cmd { 24 IPSET_CMD_NONE, 25 IPSET_CMD_PROTOCOL, /* 1: Return protocol version */ 26 IPSET_CMD_CREATE, /* 2: Create a new (empty) set */ 27 IPSET_CMD_DESTROY, /* 3: Destroy a (empty) set */ 28 IPSET_CMD_FLUSH, /* 4: Remove all elements from a set */ 29 IPSET_CMD_RENAME, /* 5: Rename a set */ 30 IPSET_CMD_SWAP, /* 6: Swap two sets */ 31 IPSET_CMD_LIST, /* 7: List sets */ 32 IPSET_CMD_SAVE, /* 8: Save sets */ 33 IPSET_CMD_ADD, /* 9: Add an element to a set */ 34 IPSET_CMD_DEL, /* 10: Delete an element from a set */ 35 IPSET_CMD_TEST, /* 11: Test an element in a set */ 36 IPSET_CMD_HEADER, /* 12: Get set header data only */ 37 IPSET_CMD_TYPE, /* 13: Get set type */ 38 IPSET_CMD_GET_BYNAME, /* 14: Get set index by name */ 39 IPSET_CMD_GET_BYINDEX, /* 15: Get set name by index */ 40 IPSET_MSG_MAX, /* Netlink message commands */ 41 42 /* Commands in userspace: */ 43 IPSET_CMD_RESTORE = IPSET_MSG_MAX, /* 16: Enter restore mode */ 44 IPSET_CMD_HELP, /* 17: Get help */ 45 IPSET_CMD_VERSION, /* 18: Get program version */ 46 IPSET_CMD_QUIT, /* 19: Quit from interactive mode */ 47 48 IPSET_CMD_MAX, 49 50 IPSET_CMD_COMMIT = IPSET_CMD_MAX, /* 20: Commit buffered commands */ 51 }; 52 53 /* Attributes at command level */ 54 enum { 55 IPSET_ATTR_UNSPEC, 56 IPSET_ATTR_PROTOCOL, /* 1: Protocol version */ 57 IPSET_ATTR_SETNAME, /* 2: Name of the set */ 58 IPSET_ATTR_TYPENAME, /* 3: Typename */ 59 IPSET_ATTR_SETNAME2 = IPSET_ATTR_TYPENAME, /* Setname at rename/swap */ 60 IPSET_ATTR_REVISION, /* 4: Settype revision */ 61 IPSET_ATTR_FAMILY, /* 5: Settype family */ 62 IPSET_ATTR_FLAGS, /* 6: Flags at command level */ 63 IPSET_ATTR_DATA, /* 7: Nested attributes */ 64 IPSET_ATTR_ADT, /* 8: Multiple data containers */ 65 IPSET_ATTR_LINENO, /* 9: Restore lineno */ 66 IPSET_ATTR_PROTOCOL_MIN, /* 10: Minimal supported version number */ 67 IPSET_ATTR_REVISION_MIN = IPSET_ATTR_PROTOCOL_MIN, /* type rev min */ 68 IPSET_ATTR_INDEX, /* 11: Kernel index of set */ 69 __IPSET_ATTR_CMD_MAX, 70 }; 71 #define IPSET_ATTR_CMD_MAX (__IPSET_ATTR_CMD_MAX - 1) 72 73 /* CADT specific attributes */ 74 enum { 75 IPSET_ATTR_IP = IPSET_ATTR_UNSPEC + 1, 76 IPSET_ATTR_IP_FROM = IPSET_ATTR_IP, 77 IPSET_ATTR_IP_TO, /* 2 */ 78 IPSET_ATTR_CIDR, /* 3 */ 79 IPSET_ATTR_PORT, /* 4 */ 80 IPSET_ATTR_PORT_FROM = IPSET_ATTR_PORT, 81 IPSET_ATTR_PORT_TO, /* 5 */ 82 IPSET_ATTR_TIMEOUT, /* 6 */ 83 IPSET_ATTR_PROTO, /* 7 */ 84 IPSET_ATTR_CADT_FLAGS, /* 8 */ 85 IPSET_ATTR_CADT_LINENO = IPSET_ATTR_LINENO, /* 9 */ 86 IPSET_ATTR_MARK, /* 10 */ 87 IPSET_ATTR_MARKMASK, /* 11 */ 88 IPSET_ATTR_BITMASK, /* 12 */ 89 /* Reserve empty slots */ 90 IPSET_ATTR_CADT_MAX = 16, 91 /* Create-only specific attributes */ 92 IPSET_ATTR_INITVAL, /* was unused IPSET_ATTR_GC */ 93 IPSET_ATTR_HASHSIZE, 94 IPSET_ATTR_MAXELEM, 95 IPSET_ATTR_NETMASK, 96 IPSET_ATTR_BUCKETSIZE, /* was unused IPSET_ATTR_PROBES */ 97 IPSET_ATTR_RESIZE, 98 IPSET_ATTR_SIZE, 99 /* Kernel-only */ 100 IPSET_ATTR_ELEMENTS, 101 IPSET_ATTR_REFERENCES, 102 IPSET_ATTR_MEMSIZE, 103 104 __IPSET_ATTR_CREATE_MAX, 105 }; 106 #define IPSET_ATTR_CREATE_MAX (__IPSET_ATTR_CREATE_MAX - 1) 107 108 /* ADT specific attributes */ 109 enum { 110 IPSET_ATTR_ETHER = IPSET_ATTR_CADT_MAX + 1, 111 IPSET_ATTR_NAME, 112 IPSET_ATTR_NAMEREF, 113 IPSET_ATTR_IP2, 114 IPSET_ATTR_CIDR2, 115 IPSET_ATTR_IP2_TO, 116 IPSET_ATTR_IFACE, 117 IPSET_ATTR_BYTES, 118 IPSET_ATTR_PACKETS, 119 IPSET_ATTR_COMMENT, 120 IPSET_ATTR_SKBMARK, 121 IPSET_ATTR_SKBPRIO, 122 IPSET_ATTR_SKBQUEUE, 123 IPSET_ATTR_PAD, 124 __IPSET_ATTR_ADT_MAX, 125 }; 126 #define IPSET_ATTR_ADT_MAX (__IPSET_ATTR_ADT_MAX - 1) 127 128 /* IP specific attributes */ 129 enum { 130 IPSET_ATTR_IPADDR_IPV4 = IPSET_ATTR_UNSPEC + 1, 131 IPSET_ATTR_IPADDR_IPV6, 132 __IPSET_ATTR_IPADDR_MAX, 133 }; 134 #define IPSET_ATTR_IPADDR_MAX (__IPSET_ATTR_IPADDR_MAX - 1) 135 136 /* Error codes */ 137 enum ipset_errno { 138 IPSET_ERR_PRIVATE = 4096, 139 IPSET_ERR_PROTOCOL, 140 IPSET_ERR_FIND_TYPE, 141 IPSET_ERR_MAX_SETS, 142 IPSET_ERR_BUSY, 143 IPSET_ERR_EXIST_SETNAME2, 144 IPSET_ERR_TYPE_MISMATCH, 145 IPSET_ERR_EXIST, 146 IPSET_ERR_INVALID_CIDR, 147 IPSET_ERR_INVALID_NETMASK, 148 IPSET_ERR_INVALID_FAMILY, 149 IPSET_ERR_TIMEOUT, 150 IPSET_ERR_REFERENCED, 151 IPSET_ERR_IPADDR_IPV4, 152 IPSET_ERR_IPADDR_IPV6, 153 IPSET_ERR_COUNTER, 154 IPSET_ERR_COMMENT, 155 IPSET_ERR_INVALID_MARKMASK, 156 IPSET_ERR_SKBINFO, 157 IPSET_ERR_BITMASK_NETMASK_EXCL, 158 159 /* Type specific error codes */ 160 IPSET_ERR_TYPE_SPECIFIC = 4352, 161 }; 162 163 /* Flags at command level or match/target flags, lower half of cmdattrs*/ 164 enum ipset_cmd_flags { 165 IPSET_FLAG_BIT_EXIST = 0, 166 IPSET_FLAG_EXIST = (1 << IPSET_FLAG_BIT_EXIST), 167 IPSET_FLAG_BIT_LIST_SETNAME = 1, 168 IPSET_FLAG_LIST_SETNAME = (1 << IPSET_FLAG_BIT_LIST_SETNAME), 169 IPSET_FLAG_BIT_LIST_HEADER = 2, 170 IPSET_FLAG_LIST_HEADER = (1 << IPSET_FLAG_BIT_LIST_HEADER), 171 IPSET_FLAG_BIT_SKIP_COUNTER_UPDATE = 3, 172 IPSET_FLAG_SKIP_COUNTER_UPDATE = 173 (1 << IPSET_FLAG_BIT_SKIP_COUNTER_UPDATE), 174 IPSET_FLAG_BIT_SKIP_SUBCOUNTER_UPDATE = 4, 175 IPSET_FLAG_SKIP_SUBCOUNTER_UPDATE = 176 (1 << IPSET_FLAG_BIT_SKIP_SUBCOUNTER_UPDATE), 177 IPSET_FLAG_BIT_MATCH_COUNTERS = 5, 178 IPSET_FLAG_MATCH_COUNTERS = (1 << IPSET_FLAG_BIT_MATCH_COUNTERS), 179 IPSET_FLAG_BIT_RETURN_NOMATCH = 7, 180 IPSET_FLAG_RETURN_NOMATCH = (1 << IPSET_FLAG_BIT_RETURN_NOMATCH), 181 IPSET_FLAG_BIT_MAP_SKBMARK = 8, 182 IPSET_FLAG_MAP_SKBMARK = (1 << IPSET_FLAG_BIT_MAP_SKBMARK), 183 IPSET_FLAG_BIT_MAP_SKBPRIO = 9, 184 IPSET_FLAG_MAP_SKBPRIO = (1 << IPSET_FLAG_BIT_MAP_SKBPRIO), 185 IPSET_FLAG_BIT_MAP_SKBQUEUE = 10, 186 IPSET_FLAG_MAP_SKBQUEUE = (1 << IPSET_FLAG_BIT_MAP_SKBQUEUE), 187 IPSET_FLAG_CMD_MAX = 15, 188 }; 189 190 /* Flags at CADT attribute level, upper half of cmdattrs */ 191 enum ipset_cadt_flags { 192 IPSET_FLAG_BIT_BEFORE = 0, 193 IPSET_FLAG_BEFORE = (1 << IPSET_FLAG_BIT_BEFORE), 194 IPSET_FLAG_BIT_PHYSDEV = 1, 195 IPSET_FLAG_PHYSDEV = (1 << IPSET_FLAG_BIT_PHYSDEV), 196 IPSET_FLAG_BIT_NOMATCH = 2, 197 IPSET_FLAG_NOMATCH = (1 << IPSET_FLAG_BIT_NOMATCH), 198 IPSET_FLAG_BIT_WITH_COUNTERS = 3, 199 IPSET_FLAG_WITH_COUNTERS = (1 << IPSET_FLAG_BIT_WITH_COUNTERS), 200 IPSET_FLAG_BIT_WITH_COMMENT = 4, 201 IPSET_FLAG_WITH_COMMENT = (1 << IPSET_FLAG_BIT_WITH_COMMENT), 202 IPSET_FLAG_BIT_WITH_FORCEADD = 5, 203 IPSET_FLAG_WITH_FORCEADD = (1 << IPSET_FLAG_BIT_WITH_FORCEADD), 204 IPSET_FLAG_BIT_WITH_SKBINFO = 6, 205 IPSET_FLAG_WITH_SKBINFO = (1 << IPSET_FLAG_BIT_WITH_SKBINFO), 206 IPSET_FLAG_BIT_IFACE_WILDCARD = 7, 207 IPSET_FLAG_IFACE_WILDCARD = (1 << IPSET_FLAG_BIT_IFACE_WILDCARD), 208 IPSET_FLAG_CADT_MAX = 15, 209 }; 210 211 /* The flag bits which correspond to the non-extension create flags */ 212 enum ipset_create_flags { 213 IPSET_CREATE_FLAG_BIT_FORCEADD = 0, 214 IPSET_CREATE_FLAG_FORCEADD = (1 << IPSET_CREATE_FLAG_BIT_FORCEADD), 215 IPSET_CREATE_FLAG_BIT_BUCKETSIZE = 1, 216 IPSET_CREATE_FLAG_BUCKETSIZE = (1 << IPSET_CREATE_FLAG_BIT_BUCKETSIZE), 217 IPSET_CREATE_FLAG_BIT_MAX = 7, 218 }; 219 220 /* Commands with settype-specific attributes */ 221 enum ipset_adt { 222 IPSET_ADD, 223 IPSET_DEL, 224 IPSET_TEST, 225 IPSET_ADT_MAX, 226 IPSET_CREATE = IPSET_ADT_MAX, 227 IPSET_CADT_MAX, 228 }; 229 230 /* Sets are identified by an index in kernel space. Tweak with ip_set_id_t 231 * and IPSET_INVALID_ID if you want to increase the max number of sets. 232 * Also, IPSET_ATTR_INDEX must be changed. 233 */ 234 typedef __u16 ip_set_id_t; 235 236 #define IPSET_INVALID_ID 65535 237 238 enum ip_set_dim { 239 IPSET_DIM_ZERO = 0, 240 IPSET_DIM_ONE, 241 IPSET_DIM_TWO, 242 IPSET_DIM_THREE, 243 /* Max dimension in elements. 244 * If changed, new revision of iptables match/target is required. 245 */ 246 IPSET_DIM_MAX = 6, 247 /* Backward compatibility: set match revision 2 */ 248 IPSET_BIT_RETURN_NOMATCH = 7, 249 }; 250 251 /* Option flags for kernel operations */ 252 enum ip_set_kopt { 253 IPSET_INV_MATCH = (1 << IPSET_DIM_ZERO), 254 IPSET_DIM_ONE_SRC = (1 << IPSET_DIM_ONE), 255 IPSET_DIM_TWO_SRC = (1 << IPSET_DIM_TWO), 256 IPSET_DIM_THREE_SRC = (1 << IPSET_DIM_THREE), 257 IPSET_RETURN_NOMATCH = (1 << IPSET_BIT_RETURN_NOMATCH), 258 }; 259 260 enum { 261 IPSET_COUNTER_NONE = 0, 262 IPSET_COUNTER_EQ, 263 IPSET_COUNTER_NE, 264 IPSET_COUNTER_LT, 265 IPSET_COUNTER_GT, 266 }; 267 268 /* Backward compatibility for set match v3 */ 269 struct ip_set_counter_match0 { 270 __u8 op; 271 __u64 value; 272 }; 273 274 struct ip_set_counter_match { 275 __aligned_u64 value; 276 __u8 op; 277 }; 278 279 /* Interface to iptables/ip6tables */ 280 281 #define SO_IP_SET 83 282 283 union ip_set_name_index { 284 char name[IPSET_MAXNAMELEN]; 285 ip_set_id_t index; 286 }; 287 288 #define IP_SET_OP_GET_BYNAME 0x00000006 /* Get set index by name */ 289 struct ip_set_req_get_set { 290 unsigned int op; 291 unsigned int version; 292 union ip_set_name_index set; 293 }; 294 295 #define IP_SET_OP_GET_BYINDEX 0x00000007 /* Get set name by index */ 296 /* Uses ip_set_req_get_set */ 297 298 #define IP_SET_OP_GET_FNAME 0x00000008 /* Get set index and family */ 299 struct ip_set_req_get_set_family { 300 unsigned int op; 301 unsigned int version; 302 unsigned int family; 303 union ip_set_name_index set; 304 }; 305 306 #define IP_SET_OP_VERSION 0x00000100 /* Ask kernel version */ 307 struct ip_set_req_version { 308 unsigned int op; 309 unsigned int version; 310 }; 311 312 #endif /* _UAPI_IP_SET_H */ 313