Files
2026-07-30 11:19:44 +05:30

756 lines
19 KiB
C

/* ipfirewall.h - Public API of Wind River Firewall */
/*
******************************************************************************
* INTERPEAK API HEADER FILE
*
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipfirewall.h,v $ $Revision: 1.41 $
* $Source: /home/interpeak/CVSRoot/ipfirewall/include/ipfirewall.h,v $
* $Author: ulf $ $Date: 2010-09-09 08:55:27 $
* $State: Exp $ $Locker: $
*
* INTERPEAK_COPYRIGHT_STRING
* Design and implementation by Markus Carlstedt <markus@interpeak.se>
******************************************************************************
*/
#ifndef IPFIREWALL_H
#define IPFIREWALL_H
/*
****************************************************************************
* 1 DESCRIPTION
****************************************************************************
* Public header file.
*/
/*
DESCRIPTION
This library contains the APIs used for configuration of Wind River Firewall.
*/
/*
****************************************************************************
* 2 CONFIGURATION
****************************************************************************
*/
#include "ipfirewall_config.h"
/*
****************************************************************************
* 3 INCLUDE FILES
****************************************************************************
*/
#include <ipcom_type.h>
#include <ipcom_cstyle.h>
#include <ipcom_sock.h>
#include <ipcom_netif.h>
#ifdef __cplusplus
extern "C" {
#endif
/*
****************************************************************************
* 4 DEFINES
****************************************************************************
*/
/*
*===========================================================================
* release
*===========================================================================
*/
#define IPFIREWALL_RELEASE 60701
/*
*===========================================================================
* IPFIREWALL_USERDEF_ID_SIZE
*===========================================================================
* The maximum length of the user defined function identifier
*
*/
#define IPFIREWALL_USERDEF_ID_SIZE 32
/*
*===========================================================================
* IPFIREWALL_USERDEF_PARAM_SIZE
*===========================================================================
* The maximum length of the user defined function parameter string
*
*/
#define IPFIREWALL_USERDEF_PARAM_SIZE 64
/*
*===========================================================================
* IPFIREWALL_USERDEF_INFO_SIZE
*===========================================================================
* The length of the user defined information buffer size
*
*/
#define IPFIREWALL_USERDEF_INFO_SIZE 256
/*
*===========================================================================
* IPFIREWALL_USERDEF_EXAMPLE_ID
*===========================================================================
* User defined function identifier for the user defined exampl.
*/
#define IPFIREWALL_USERDEF_EXAMPLE_ID "userdef_example"
/*
*===========================================================================
* IPFIREWALL_HTTP_FILTER_ID
*===========================================================================
* User defined function identifier for the HTTP filter.
*/
#define IPFIREWALL_HTTP_FILTER_ID "http_filter"
/*
****************************************************************************
* 5 TYPES
****************************************************************************
*/
/*
*===========================================================================
* Ipfirewall_userdef_match
*===========================================================================
* Description: User defined match function
*
* Parameters: pkt - pointer to the ipcom packet
* cookie - a cookie set at registration.
* info - user defined info buffer
*
* Returns: 1 = rule matched.
* 0 = rule did not match.
*
*/
typedef int (* Ipfirewall_userdef_match) (Ipcom_pkt *pkt, void *cookie, void *info);
/*
*===========================================================================
* Ipfirewall_userdef_check
*===========================================================================
* Description: User defined check function (optional)
*
* cookie - a cookie set at registration.
* info - parameter string specified in the rule syntax
* infolen - length if user defined info buffer
*
* Returns: 1 = rule parameters accepted
* 0 = rule parameters not accepted
*
*/
typedef int (* Ipfirewall_userdef_check) (void *cookie, void *info, unsigned int infolen);
/*
*===========================================================================
* Ipfirewall_userdef_destroy
*===========================================================================
* Description: User defined destroy function (optional)
*
* cookie - a cookie set at registration.
* info - parameter string specified in the rule syntax
* infolen - length if user defined info buffer
*
* Returns:
*
*/
typedef void (* Ipfirewall_userdef_destroy) (void *cookie, void *info, unsigned int infolen);
/*
****************************************************************************
* 6 FUNCTIONS
****************************************************************************
*/
IP_PUBLIC Ip_s32 ipfirewall_mac_input_hook(Ipcom_netif *netif, Ipcom_pkt *pkt);
IP_PUBLIC Ip_s32 ipfirewall_mac_output_hook(Ipcom_netif *netif, Ipcom_pkt *pkt);
IP_PUBLIC Ip_s32 ipfirewall_input_hook(Ipcom_netif *netif, Ipcom_pkt *pkt);
IP_PUBLIC Ip_s32 ipfirewall_output_hook(Ipcom_netif *netif, Ipcom_pkt *pkt);
IP_PUBLIC int ipfirewall_userdef_match(Ipcom_pkt *pkt, void *cookie, void *info);
IP_PUBLIC int ipfirewall_userdef_check(void *cookie, void *info, unsigned int infolen);
IP_PUBLIC void ipfirewall_userdef_destroy(void *cookie, void *info, unsigned int infolen);
IP_PUBLIC Ip_s32 ipfirewall_getsockopt(void *sock, int optname, void *optval, Ip_socklen_t *optlen);
IP_PUBLIC Ip_s32 ipfirewall_setsockopt(void *sock, int optname, IP_CONST void *optval,Ip_socklen_t optlen);
IP_PUBLIC int ipfirewall_http_match(Ipcom_pkt *pkt, void *cookie, void *info);
IP_PUBLIC int ipfirewall_http_check(void *cookie, void *info, unsigned int infolen);
IP_PUBLIC void ipfirewall_http_destroy(void *cookie, void *info, unsigned int infolen);
/*******************************************************************************
*
* ipfirewall_enable - enable firewall
*
* The 'ipfirewall_enable()' routine enables the firewall. When enabled, each
* incoming and outgoing packet is matched against the current ruleset.
*
* RETURNS: \is
* \i 'IPCOM_SUCCESS' or one of the following errors:
* \i 'IPCOM_ERR_ALREADY_OPEN'
* Firewall was already enabled.
* \i 'IPCOM_ERR_FAILED'
* Failed to enable the firewall.
* \i 'IPCOM_ERR_NO_MEMORY'
* Out of memory.
* \ie
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_enable(void);
/*******************************************************************************
*
* ipfirewall_disable - disable firewall
*
* The ipfirewall_disable() routine disables the firewall. When disabled, packet
* matching against the current ruleset is skipped.
*
* RETURNS: \is
* \i 'IPCOM_SUCCESS' or one of the following errors:
* \i 'IPCOM_ERR_ALREADY_CLOSED'
* Firewall was already disabled.
* \i 'IPCOM_ERR_FAILED'
* Failed to disable the firewall.
* \i 'IPCOM_ERR_NO_MEMORY'
* Out of memory.
* \ie
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_disable(void);
/*******************************************************************************
*
* ipfirewall_add_rule - add an IP filter rule
*
* The ipfirewall_add_rule() routine adds an IP filter rule to the current
* ruleset.
*
* Parameters:
* \is
* \i <family>
* The Internet address family that the IP filter rule applies to.
* Set to IP_AF_INET or IP_AF_INET6.
* \i <rule>
* The rule to add.
* \ie
*
* RETURNS: \is
* \i 'IPCOM_SUCCESS' or one of the following errors:
* \i 'IPCOM_ERR_FAILED'
* Failed to add the rule.
* \i 'IPCOM_ERR_NO_MEMORY'
* Out of memory.
* \ie
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_add_rule
(
Ip_s32 family,
const char *rule
);
/*******************************************************************************
*
* ipfirewall_remove_rule - remove an IP filter rule
*
* The ipfirewall_remove_rule() routine removes an IP filer rule from the current
* ruleset
*
* Parameters:
* \is
* \i <family>
* The Internet address family that the IP filter rule applies to.
* Set to IP_AF_INET or IP_AF_INET6.
* \i <rule>
* The rule to remove.
* \ie
*
* RETURNS: \is
* \i 'IPCOM_SUCCESS' or one of the following errors:
* \i 'IPCOM_ERR_FAILED'
* Failed to add the rule.
* \i 'IPCOM_ERR_NO_MEMORY'
* Out of memory.
* \ie
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_remove_rule
(
Ip_s32 family,
const char *rule
);
/*******************************************************************************
*
* ipfirewall_flush_rules - remove all IP filter rules
*
* The ipfirewall_flush_rules() routine flushes all IP filter rules in the
* current ruleset.
*
* RETURNS: \is
* \i 'IPCOM_SUCCESS' or the following error:
* \i 'IPCOM_ERR_FAILED'
* Failed to flush rules.
* \ie
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_flush_rules(void);
/*******************************************************************************
*
* ipfirewall_flush_group - remove all rules in a group
*
* This routine removes all rules in the current <group>.
*
* Parameter:
* \is
* \i <group>
* The group to flush rules in.
* \ie
*
* RETURNS: 'IPCOM_SUCCESS', or the following error:
* \is
* \i 'IPCOM_ERR_FAILED'
* Failed to flush rules in the <group>.
* \ie
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_flush_group
(
Ip_s32 group
);
/*******************************************************************************
*
* ipfirewall_flush_states - remove all active states
*
* The ipfirewall_flush_states() routine removes all active states added by
* stateful IP filter rules.
*
* RETURNS: \is
* \i 'IPCOM_SUCCESS' or the following error:
* \i 'IPCOM_ERR_FAILED'
* Failed to flush states.
* \ie
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_flush_states(void);
/*******************************************************************************
*
* ipfirewall_flush_log - remove all entries in the IP filter log
*
* The ipfirewall_flush_log() routine removes all entries in the IP filter log.
*
* RETURNS: \is
* \i 'IPCOM_SUCCESS' or the following error:
* \i 'IPCOM_ERR_FAILED'
* Failed to flush log.
* \ie
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_flush_log(void);
/*******************************************************************************
*
* ipfirewall_mac_add_rule - add a MAC filter rule
*
* The ipfirewall_mac_add_rule() routine adds a MAC filter rule to the current
* ruleset
*
* Parameters:
* \is
* \i <rule>
* The rule to add.
* \ie
*
* RETURNS: \is
* \i 'IPCOM_SUCCESS' or one of the following errors:
* \i 'IPCOM_ERR_FAILED'
* Failed to add the rule.
* \i 'IPCOM_ERR_NO_MEMORY'
* Out of memory.
* \ie
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_mac_add_rule
(
const char *rule
);
/*******************************************************************************
*
* ipfirewall_mac_remove_rule - remove a MAC filter rule
*
* The ipfirewall_mac_remove_rule() routine removes a MAC filer rule from the
* current ruleset
*
* Parameters:
* \is
* \i <rule>
* The rule to remmove.
* \ie
*
* RETURNS: \is
* \i 'IPCOM_SUCCESS' or one of the following errors:
* \i 'IPCOM_ERR_FAILED'
* Failed to add the rule.
* \i 'IPCOM_ERR_NO_MEMORY'
* Out of memory.
* \ie
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_mac_remove_rule
(
const char *rule
);
/*******************************************************************************
*
* ipfirewall_mac_flush_rules - remove all MAC filter rules
*
* The ipfirewall_mac_flush_rules() routine removes all MAC filter rules in the
* current ruleset.
*
* RETURNS: \is
* \i 'IPCOM_SUCCESS' or the following error:
* \i 'IPCOM_ERR_FAILED'
* Failed to flush rules.
* \ie
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_mac_flush_rules(void);
/*******************************************************************************
*
* ipfirewall_mac_flush_group - remove all MAC filter rules in a group
*
* The ipfirewall_mac_flush_rules() routine removes all MAC filter rules in a
* specified group.
*
* Parameter:
* \is
* \i <group>
* The group from which the MAC filter rules are to be removed.
* \ie
*
* RETURNS: \is
* \i 'IPCOM_SUCCESS' or the following error:
* \i 'IPCOM_ERR_FAILED'
* Failed to flush rules in the group
* \ie
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_mac_flush_group
(
Ip_s32 group
);
/*******************************************************************************
*
* ipfirewall_mac_flush_log - remove all entries in the MAC filter log
*
* The ipfirewall_mac_flush_log() routine removes all entries in the MAC filter
* log.
*
* RETURNS: \is
* \i 'IPCOM_SUCCESS' or the following error:
* \i 'IPCOM_ERR_FAILED'
* Failed to flush log.
* \ie
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_mac_flush_log(void);
/*******************************************************************************
*
* ipfirewall_flush_userdefs - remove all user-defined routines
*
* The ipfirewall_flush_userdefs() routine removes all registered user-defined
* routines.
*
* RETURNS: \is
* \i 'IPCOM_SUCCESS' or the following error:
* \i 'IPCOM_ERR_FAILED'
* Failed to flush user-defined routines.
* \ie
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_flush_userdefs(void);
/*******************************************************************************
*
* ipfirewall_register_userdef - register a user-defined function
*
* This routine registers a user-defined function for use with the <userdef> rule
* parameter. Before a user-defined function can be specified in a rule it must
* be registered with this routine.
*
* Parameters:
* \is
* \i <id>
* An identifier for the user-defined function.
* \i <match>
* A pointer to a user-defined match routine.
* \i <check>
* A pointer to a user-defined check routine (optional).
* \i <destroy>
* A pointer to a user-defined destroy routine (optional).
* \i <cookie>
* A cookie that will be supplied in the calls to the user-defined function's
* match, destroy and check routines.
* \ie
*
* RETURNS: Either 'IPCOM_SUCCESS' or an error code (see 'ipcom_err.h').
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_register_userdef
(
IP_CONST char *id,
Ipfirewall_userdef_match match,
Ipfirewall_userdef_check check,
Ipfirewall_userdef_destroy destroy,
void *cookie
);
/*******************************************************************************
*
* ipfirewall_unregister_userdef - deregister a user-defined function
*
* This routine deregisters a user-defined routine.
*
* Parameter:
* \is
* \i <id>
* Identifier of the user-defined function.
* \ie
*
* RETURNS: Either 'IPCOM_SUCCESS' or an error code (see 'ipcom_err.h').
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_unregister_userdef
(
IP_CONST char *id
);
/*******************************************************************************
*
* ipfirewall_http_add_filter - add an HTTP filter
*
* This routine adds an HTTP filter.
*
* Parameter:
* \is
* \i <id>
* The ID of the HTTP filter to add.
* \ie
*
* RETURNS: Either 'IPCOM_SUCCESS' or an error code (see 'ipcom_err.h').
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_http_add_filter
(
const char *id
);
/*******************************************************************************
*
* ipfirewall_http_remove_filter - remove an HTTP filter
*
* This routine removes an HTTP filter, if there is no IP filter rule that refers
* to the filter. It fails if there is. To remove an IP filter rule, use
* ipfirewall_remove_rule().
*
* Parameter:
* \is
* \i <id>
* The ID of the HTTP filter to remove.
* \ie
*
* RETURNS: Either 'IPCOM_SUCCESS' or an error code (see 'ipcom_err.h').
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_http_remove_filter
(
const char *id
);
/*******************************************************************************
*
* ipfirewall_http_insert_url_filter - add a URL or keyword to an HTTP filter
*
* This routine adds a URL or keyword to an HTTP filter.
*
* Parameters:
* \is
* \i <id>
* The ID of the HTTP filter.
* \i <url>
* The URL path or keyword.
* \i <keyword>
* Set to 'IP_TRUE' for keyword.
* \ie
*
* RETURNS: Either 'IPCOM_SUCCESS' or an error code (see 'ipcom_err.h').
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_http_insert_url_filter
(
const char *id,
const char *url,
Ip_bool keyword
);
/*******************************************************************************
*
* ipfirewall_http_insert_proxy_filter - set proxy filter in an HTTP filter
*
* This routine inserts the proxy filter into an HTTP filter.
*
* Parameter:
* \is
* \i <id>
* The ID of the HTTP filter.
* \ie
*
* RETURNS: Either 'IPCOM_SUCCESS' or an error code (see 'ipcom_err.h').
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_http_insert_proxy_filter
(
const char *id
);
/*******************************************************************************
*
* ipfirewall_http_insert_cookie_filter - set cookie filter in an HTTP filter
*
* This routine inserts the cookie filter into an HTTP filter.
*
* Parameter:
* \is
* \i <id>
* The ID of the HTTP filter.
* \ie
*
* RETURNS: Either 'IPCOM_SUCCESS' or an error code (see 'ipcom_err.h').
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_http_insert_cookie_filter
(
const char *id
);
/*******************************************************************************
*
* ipfirewall_http_insert_java_filter - set Java filter in an HTTP filter
*
* This routine inserts the java filter into an HTTP filter.
*
* Parameter:
* \is
* \i <id>
* The ID of the HTTP filter.
* \ie
*
* RETURNS: Either 'IPCOM_SUCCESS' or an error code (see 'ipcom_err.h').
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_http_insert_java_filter
(
const char *id
);
/*******************************************************************************
*
* ipfirewall_http_insert_activex_filter - set ActiveX filter in an HTTP filter
*
* This routine inserts the ActiveX filter into an HTTP filter.
*
* Parameters
* \is
* \i <id>
* The ID of the HTTP filter.
* \ie
*
* RETURNS: Either 'IPCOM_SUCCESS' or an error code (see 'ipcom_err.h').
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_http_insert_activex_filter
(
const char *id
);
#ifdef __cplusplus
}
#endif
#endif
/*
****************************************************************************
* END OF FILE
****************************************************************************
*/