| # Copyright 2018 syzkaller project authors. All rights reserved. |
| # Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file. |
| |
| include <linux/socket.h> |
| include <uapi/linux/netfilter_ipv6/ip6_tables.h> |
| include <uapi/linux/netfilter_ipv6/ip6t_rt.h> |
| include <uapi/linux/netfilter_ipv6/ip6t_mh.h> |
| include <uapi/linux/netfilter_ipv6/ip6t_opts.h> |
| include <uapi/linux/netfilter_ipv6/ip6t_frag.h> |
| include <uapi/linux/netfilter_ipv6/ip6t_ipv6header.h> |
| include <uapi/linux/netfilter_ipv6/ip6t_ah.h> |
| include <uapi/linux/netfilter_ipv6/ip6t_srh.h> |
| include <uapi/linux/netfilter_ipv6/ip6t_REJECT.h> |
| include <uapi/linux/netfilter_ipv6/ip6t_NPT.h> |
| include <uapi/linux/netfilter_ipv6/ip6t_HL.h> |
| |
| setsockopt$IP6T_SO_SET_REPLACE(fd sock_in6, level const[SOL_IPV6], opt const[IP6T_SO_SET_REPLACE], val ptr[in, ip6t_replace], len len[val]) |
| setsockopt$IP6T_SO_SET_ADD_COUNTERS(fd sock_in6, level const[SOL_IPV6], opt const[IP6T_SO_SET_ADD_COUNTERS], val ptr[in, ipt_counters_info], len len[val]) |
| getsockopt$IP6T_SO_GET_INFO(fd sock_in6, level const[SOL_IPV6], opt const[IP6T_SO_GET_INFO], val ptr[in, ipt_getinfo], len ptr[in, len[val, int32]]) |
| getsockopt$IP6T_SO_GET_ENTRIES(fd sock_in6, level const[SOL_IPV6], opt const[IP6T_SO_GET_ENTRIES], val ptr[in, ipt_get_entries], len ptr[in, len[val, int32]]) |
| getsockopt$IP6T_SO_GET_REVISION_MATCH(fd sock_in6, level const[SOL_IPV6], opt const[IP6T_SO_GET_REVISION_MATCH], val ptr[in, xt_get_revision], len ptr[in, len[val, int32]]) |
| getsockopt$IP6T_SO_GET_REVISION_TARGET(fd sock_in6, level const[SOL_IPV6], opt const[IP6T_SO_GET_REVISION_TARGET], val ptr[in, xt_get_revision], len ptr[in, len[val, int32]]) |
| |
| ip6t_replace [ |
| filter ip6t_replace_t["filter", 3, 4, IPT_FILTER_VALID_HOOKS, ip6t_filter_matches, ip6t_filter_targets, ipt_unused, ipt_hook, ipt_hook, ipt_hook, ipt_unused, ipt_unused, ipt_hook, ipt_hook, ipt_hook, ipt_unused] |
| nat ip6t_replace_t["nat", 4, 5, IPT_NAT_VALID_HOOKS, ip6t_nat_matches, ip6t_nat_targets, ipt_hook, ipt_hook, ipt_unused, ipt_hook, ipt_hook, ipt_hook, ipt_hook, ipt_unused, ipt_hook, ipt_hook] |
| mangle ip6t_replace_t["mangle", 5, 6, IPT_MANGLE_VALID_HOOKS, ip6t_mangle_matches, ip6t_mangle_targets, ipt_hook, ipt_hook, ipt_hook, ipt_hook, ipt_hook, ipt_hook, ipt_hook, ipt_hook, ipt_hook, ipt_hook] |
| raw ip6t_replace_t["raw", 2, 3, IPT_RAW_VALID_HOOKS, ip6t_raw_matches, ip6t_raw_targets, ipt_hook, ipt_unused, ipt_unused, ipt_hook, ipt_unused, ipt_hook, ipt_unused, ipt_unused, ipt_hook, ipt_unused] |
| security ip6t_replace_t["security", 3, 4, IPT_SECURITY_VALID_HOOKS, ip6t_security_matches, ip6t_security_targets, ipt_unused, ipt_hook, ipt_hook, ipt_hook, ipt_unused, ipt_unused, ipt_hook, ipt_hook, ipt_hook, ipt_unused] |
| ] [varlen] |
| |
| type ip6t_replace_t[NAME, NENTRIES, NHOOKS, HOOKS, MATCHES, TARGETS, H0, H1, H2, H3, H4, U0, U1, U2, U3, U4] { |
| name string[NAME, XT_TABLE_MAXNAMELEN] |
| valid_hooks const[HOOKS, int32] |
| num_entries const[NHOOKS, int32] |
| size bytesize[entries, int32] |
| hook_pre_routing H0 |
| hook_local_in H1 |
| hook_forward H2 |
| hook_local_out H3 |
| hook_post_routing H4 |
| underflow_pre_routing U0 |
| underflow_local_in U1 |
| underflow_forward U2 |
| underflow_local_out U3 |
| underflow_post_routing U4 |
| num_counters const[NHOOKS, int32] |
| counters ptr[out, array[xt_counters, NHOOKS]] |
| entries ip6t_replace_entries[NENTRIES, MATCHES, TARGETS] |
| } |
| |
| type ip6t_replace_entries[NENTRIES, MATCHES, TARGETS] { |
| entries array[ip6t_entry[MATCHES, TARGETS], NENTRIES] |
| underflow ip6t_entry_underflow |
| } [packed, align_ptr] |
| |
| type ip6t_entry[MATCHES, TARGETS] { |
| matches ip6t_entry_matches[MATCHES] |
| target TARGETS |
| } [packed, align_ptr] |
| |
| type ip6t_entry_matches[MATCHES] { |
| ipv6 ip6t_ip6_or_uncond |
| nfcache const[0, int32] |
| target_offset len[parent, int16] |
| next_offset len[ip6t_entry, int16] |
| comefrom const[0, int32] |
| counters xt_counters |
| matches array[MATCHES, 0:2] |
| } [align_ptr] |
| |
| ip6t_entry_underflow { |
| matches ip6t_entry_underflow_matches |
| target xt_target_t["", const[NF_ACCEPT_VERDICT, int32], 0] |
| } [align_ptr] |
| |
| ip6t_entry_underflow_matches { |
| ipv6 ip6t_ip6_uncond |
| nfcache const[0, int32] |
| target_offset len[parent, int16] |
| next_offset len[ip6t_entry_underflow, int16] |
| comefrom const[0, int32] |
| counters xt_counters |
| } |
| |
| ip6t_ip6_or_uncond [ |
| ipv6 ip6t_ip6 |
| uncond ip6t_ip6_uncond |
| ] |
| |
| type ip6t_ip6_uncond array[const[0, int8], IP6T_IP6_SIZE] |
| define IP6T_IP6_SIZE sizeof(struct ip6t_ip6) |
| |
| ip6t_ip6 { |
| src ipv6_addr |
| dst ipv6_addr |
| smsk ipv6_addr_mask |
| dmsk ipv6_addr_mask |
| iniface devname |
| outiface devname |
| iniface_mask devname_mask |
| outiface_mask devname_mask |
| proto flags[ipv6_types, int16] |
| tos int8 |
| flags flags[ip6t_ip6_flags, int8] |
| invflags flags[ip6t_ip6_invflags, int8] |
| } |
| |
| ip6t_ip6_flags = IP6T_F_PROTO, IP6T_F_TOS, IP6T_F_GOTO |
| ip6t_ip6_invflags = IP6T_INV_VIA_IN, IP6T_INV_VIA_OUT, IP6T_INV_TOS, IP6T_INV_SRCIP, IP6T_INV_DSTIP, IP6T_INV_FRAG, IP6T_INV_PROTO |
| |
| # MATCHES: |
| |
| ipt6_matches [ |
| unspec xt_unspec_matches |
| inet xt_inet_matches |
| icmp6 xt_entry_match["icmp6", ip6t_icmp, 0] |
| rt xt_entry_match["rt", ip6t_rt, 0] |
| mh xt_entry_match["mh", ip6t_mh, 0] |
| hbh xt_entry_match["hbh", ip6t_opts, 0] |
| dst xt_entry_match["dst", ip6t_opts, 0] |
| frag xt_entry_match["frag", ip6t_frag, 0] |
| eui64 xt_entry_match["eui64", const[0, int32], 0] |
| ah xt_entry_match["ah", ip6t_ah, 0] |
| ipv6header xt_entry_match["ipv6header", ip6t_ipv6header_info, 0] |
| hl xt_entry_match["hl", ipt_ttl_info, 0] |
| srh xt_entry_match["srh", ip6t_srh, 0] |
| srh1 xt_entry_match["srh", ip6t_srh1, 1] |
| ] [varlen] |
| |
| ip6t_filter_matches [ |
| common ipt6_matches |
| ] [varlen] |
| |
| ip6t_nat_matches [ |
| common ipt6_matches |
| ] [varlen] |
| |
| ip6t_mangle_matches [ |
| common ipt6_matches |
| inet xt_inet_mangle_matches |
| ] [varlen] |
| |
| ip6t_raw_matches [ |
| common ipt6_matches |
| inet xt_inet_raw_matches |
| ] [varlen] |
| |
| ip6t_security_matches [ |
| common ipt6_matches |
| ] [varlen] |
| |
| ip6t_icmp { |
| type flags[icmp_types, int8] |
| code_min int8 |
| code_max int8 |
| invflags bool8 |
| } |
| |
| ip6t_rt { |
| rt_type int32 |
| segsleft_min int32 |
| segsleft_max int32 |
| hdrlen int32 |
| flags flags[ip6t_rt_flags, int8] |
| invflags flags[ip6t_rt_invflags, int8] |
| addrs array[ipv6_addr, IP6T_RT_HOPS] |
| addrnr int8[0:IP6T_RT_HOPS] |
| } |
| |
| ip6t_rt_flags = IP6T_RT_TYP, IP6T_RT_SGS, IP6T_RT_LEN, IP6T_RT_RES, IP6T_RT_FST_MASK, IP6T_RT_FST, IP6T_RT_FST_NSTRICT |
| ip6t_rt_invflags = IP6T_RT_INV_TYP, IP6T_RT_INV_SGS, IP6T_RT_INV_LEN |
| |
| ip6t_mh { |
| types_min int8 |
| types_max int8 |
| invflags bool8 |
| } |
| |
| ip6t_opts { |
| hdrlen int32 |
| flags flags[ip6t_opts_flags, int8] |
| invflags flags[ip6t_opts_invflags, int8] |
| opts array[int16, IP6T_OPTS_OPTSNR] |
| optsnr int8[0:IP6T_OPTS_OPTSNR] |
| } |
| |
| ip6t_opts_flags = IP6T_OPTS_LEN, IP6T_OPTS_OPTS, IP6T_OPTS_NSTRICT |
| ip6t_opts_invflags = IP6T_OPTS_INV_LEN |
| |
| ip6t_frag { |
| ids_min int32 |
| ids_max int32 |
| hdrlen int32 |
| flags flags[ip6t_frag_flags, int8] |
| invflags flags[ip6t_frag_invflags, int8] |
| } |
| |
| ip6t_frag_flags = IP6T_FRAG_IDS, IP6T_FRAG_LEN, IP6T_FRAG_RES, IP6T_FRAG_FST, IP6T_FRAG_MF, IP6T_FRAG_NMF |
| ip6t_frag_invflags = IP6T_FRAG_INV_IDS, IP6T_FRAG_INV_LEN |
| |
| ip6t_ipv6header_info { |
| matchflags flags[ip6t_ipv6header_flags, int8] |
| invflags flags[ip6t_ipv6header_flags, int8] |
| modeflag bool8 |
| } |
| |
| ip6t_ipv6header_flags = MASK_HOPOPTS, MASK_DSTOPTS, MASK_ROUTING, MASK_FRAGMENT, MASK_AH, MASK_ESP, MASK_NONE, MASK_PROTO |
| |
| ip6t_ah { |
| spis_min xfrm_spi |
| spis_max xfrm_spi |
| hdrlen int32 |
| hdrres int8 |
| invflags flags[ip6t_ah_flags, int8] |
| } |
| |
| ip6t_ah_flags = IP6T_AH_INV_SPI, IP6T_AH_INV_LEN |
| |
| ip6t_srh { |
| next_hdr flags[ipv6_types, int8] |
| hdr_len int8 |
| segs_left int8 |
| last_entry int8 |
| tag int16 |
| mt_flags flags[ip6t_srh_flags, int16] |
| mt_invflags flags[ip6t_srh_flags, int16] |
| } |
| |
| ip6t_srh1 { |
| next_hdr flags[ipv6_types, int8] |
| hdr_len int8 |
| segs_left int8 |
| last_entry int8 |
| tag int16 |
| psid_addr ipv6_addr |
| nsid_addr ipv6_addr |
| lsid_addr ipv6_addr |
| psid_msk ipv6_addr_mask |
| nsid_msk ipv6_addr_mask |
| lsid_msk ipv6_addr_mask |
| mt_flags flags[ip6t_srh_flags, int16] |
| mt_invflags flags[ip6t_srh_flags, int16] |
| } |
| |
| ip6t_srh_flags = IP6T_SRH_NEXTHDR, IP6T_SRH_LEN_EQ, IP6T_SRH_LEN_GT, IP6T_SRH_LEN_LT, IP6T_SRH_SEGS_EQ, IP6T_SRH_SEGS_GT, IP6T_SRH_SEGS_LT, IP6T_SRH_LAST_EQ, IP6T_SRH_LAST_GT, IP6T_SRH_LAST_LT, IP6T_SRH_TAG, IP6T_SRH_PSID, IP6T_SRH_NSID, IP6T_SRH_LSID |
| |
| # TARGETS: |
| |
| ip6t_targets [ |
| unspec xt_unspec_targets |
| inet xt_inet_targets |
| ] [varlen] |
| |
| ip6t_filter_targets [ |
| common ip6t_targets |
| REJECT xt_target_t["REJECT", ip6t_reject_info, 0] |
| ] [varlen] |
| |
| ip6t_nat_targets [ |
| common ip6t_targets |
| unspec xt_unspec_nat_targets |
| NETMAP xt_target_t["NETMAP", nf_nat_range, 0] |
| REDIRECT xt_target_t["REDIRECT", nf_nat_range, 0] |
| MASQUERADE xt_target_t["MASQUERADE", nf_nat_range, 0] |
| ] [varlen] |
| |
| ip6t_mangle_targets [ |
| common ip6t_targets |
| unspec xt_unspec_mangle_targets |
| inet xt_inet_mangle_targets |
| SNPT xt_target_t["SNPT", ip6t_npt_tginfo, 0] |
| DNPT xt_target_t["DNPT", ip6t_npt_tginfo, 0] |
| HL xt_target_t["HL", ipt_TTL_info, 0] |
| ] [varlen] |
| |
| ip6t_raw_targets [ |
| common ip6t_targets |
| unspec xt_unspec_raw_targets |
| ] [varlen] |
| |
| ip6t_security_targets [ |
| common ip6t_targets |
| ] [varlen] |
| |
| ip6t_reject_info { |
| with flags[ip6t_reject_with, int32] |
| } |
| |
| ip6t_reject_with = IP6T_ICMP6_NO_ROUTE, IP6T_ICMP6_ADM_PROHIBITED, IP6T_ICMP6_NOT_NEIGHBOUR, IP6T_ICMP6_ADDR_UNREACH, IP6T_ICMP6_PORT_UNREACH, IP6T_ICMP6_ECHOREPLY, IP6T_TCP_RESET, IP6T_ICMP6_POLICY_FAIL, IP6T_ICMP6_REJECT_ROUTE |
| |
| ip6t_npt_tginfo { |
| src_pfx nf_inet_addr |
| dst_pfx nf_inet_addr |
| src_pfx_len int8[0:64] |
| dst_pfx_len int8[0:64] |
| adjustment int16 |
| } |