root / lab4 / .minix-src / include / net / pfvar.h @ 14
History | View | Annotate | Download (52.5 KB)
| 1 |
/* $NetBSD: pfvar.h,v 1.22 2014/06/05 23:48:16 rmind Exp $ */
|
|---|---|
| 2 |
/* $OpenBSD: pfvar.h,v 1.254 2007/07/13 09:17:48 markus Exp $ */
|
| 3 |
|
| 4 |
/*
|
| 5 |
* Copyright (c) 2001 Daniel Hartmeier
|
| 6 |
* All rights reserved.
|
| 7 |
*
|
| 8 |
* Redistribution and use in source and binary forms, with or without
|
| 9 |
* modification, are permitted provided that the following conditions
|
| 10 |
* are met:
|
| 11 |
*
|
| 12 |
* - Redistributions of source code must retain the above copyright
|
| 13 |
* notice, this list of conditions and the following disclaimer.
|
| 14 |
* - Redistributions in binary form must reproduce the above
|
| 15 |
* copyright notice, this list of conditions and the following
|
| 16 |
* disclaimer in the documentation and/or other materials provided
|
| 17 |
* with the distribution.
|
| 18 |
*
|
| 19 |
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
| 20 |
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
| 21 |
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
| 22 |
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
| 23 |
* COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
|
| 24 |
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
|
| 25 |
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
| 26 |
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
|
| 27 |
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
| 28 |
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
|
| 29 |
* ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
| 30 |
* POSSIBILITY OF SUCH DAMAGE.
|
| 31 |
*
|
| 32 |
*/
|
| 33 |
|
| 34 |
#ifndef _NET_PFVAR_H_
|
| 35 |
#define _NET_PFVAR_H_
|
| 36 |
|
| 37 |
#include <sys/param.h> |
| 38 |
#include <sys/types.h> |
| 39 |
#include <sys/queue.h> |
| 40 |
#include <sys/tree.h> |
| 41 |
#include <sys/rwlock.h> |
| 42 |
|
| 43 |
#include <net/radix.h> |
| 44 |
#if !defined(__NetBSD__) && !defined(__minix)
|
| 45 |
#include <net/route.h> |
| 46 |
#include <netinet/ip_ipsp.h> |
| 47 |
#else /* __NetBSD__ || __minix */ |
| 48 |
/* files above include netinet/in.h so include it too for compatibility */
|
| 49 |
#include <netinet/in.h> |
| 50 |
#endif /* __NetBSD__ || __minix */ |
| 51 |
#include <netinet/tcp_fsm.h> |
| 52 |
|
| 53 |
#if defined(__NetBSD__) && defined(_KERNEL)
|
| 54 |
#include <net/if_compat.h> |
| 55 |
#include <net/pf_mtag.h> |
| 56 |
#endif /* __NetBSD__ && _KERNEL */ |
| 57 |
|
| 58 |
struct ip;
|
| 59 |
struct ip6_hdr;
|
| 60 |
|
| 61 |
#define PF_TCPS_PROXY_SRC ((TCP_NSTATES)+0) |
| 62 |
#define PF_TCPS_PROXY_DST ((TCP_NSTATES)+1) |
| 63 |
|
| 64 |
#define PF_MD5_DIGEST_LENGTH 16 |
| 65 |
#ifdef MD5_DIGEST_LENGTH
|
| 66 |
#if PF_MD5_DIGEST_LENGTH != MD5_DIGEST_LENGTH
|
| 67 |
#error
|
| 68 |
#endif
|
| 69 |
#endif
|
| 70 |
|
| 71 |
enum { PF_INOUT, PF_IN, PF_OUT };
|
| 72 |
enum { PF_LAN_EXT, PF_EXT_GWY, PF_ID };
|
| 73 |
enum { PF_PASS, PF_DROP, PF_SCRUB, PF_NOSCRUB, PF_NAT, PF_NONAT,
|
| 74 |
PF_BINAT, PF_NOBINAT, PF_RDR, PF_NORDR, PF_SYNPROXY_DROP }; |
| 75 |
enum { PF_RULESET_SCRUB, PF_RULESET_FILTER, PF_RULESET_NAT,
|
| 76 |
PF_RULESET_BINAT, PF_RULESET_RDR, PF_RULESET_MAX }; |
| 77 |
enum { PF_OP_NONE, PF_OP_IRG, PF_OP_EQ, PF_OP_NE, PF_OP_LT,
|
| 78 |
PF_OP_LE, PF_OP_GT, PF_OP_GE, PF_OP_XRG, PF_OP_RRG }; |
| 79 |
enum { PF_DEBUG_NONE, PF_DEBUG_URGENT, PF_DEBUG_MISC, PF_DEBUG_NOISY };
|
| 80 |
enum { PF_CHANGE_NONE, PF_CHANGE_ADD_HEAD, PF_CHANGE_ADD_TAIL,
|
| 81 |
PF_CHANGE_ADD_BEFORE, PF_CHANGE_ADD_AFTER, |
| 82 |
PF_CHANGE_REMOVE, PF_CHANGE_GET_TICKET }; |
| 83 |
enum { PF_GET_NONE, PF_GET_CLR_CNTR };
|
| 84 |
|
| 85 |
/*
|
| 86 |
* Note about PFTM_*: real indices into pf_rule.timeout[] come before
|
| 87 |
* PFTM_MAX, special cases afterwards. See pf_state_expires().
|
| 88 |
*/
|
| 89 |
enum { PFTM_TCP_FIRST_PACKET, PFTM_TCP_OPENING, PFTM_TCP_ESTABLISHED,
|
| 90 |
PFTM_TCP_CLOSING, PFTM_TCP_FIN_WAIT, PFTM_TCP_CLOSED, |
| 91 |
PFTM_UDP_FIRST_PACKET, PFTM_UDP_SINGLE, PFTM_UDP_MULTIPLE, |
| 92 |
PFTM_ICMP_FIRST_PACKET, PFTM_ICMP_ERROR_REPLY, |
| 93 |
PFTM_OTHER_FIRST_PACKET, PFTM_OTHER_SINGLE, |
| 94 |
PFTM_OTHER_MULTIPLE, PFTM_FRAG, PFTM_INTERVAL, |
| 95 |
PFTM_ADAPTIVE_START, PFTM_ADAPTIVE_END, PFTM_SRC_NODE, |
| 96 |
PFTM_TS_DIFF, PFTM_MAX, PFTM_PURGE, PFTM_UNLINKED, |
| 97 |
PFTM_UNTIL_PACKET }; |
| 98 |
|
| 99 |
/* PFTM default values */
|
| 100 |
#define PFTM_TCP_FIRST_PACKET_VAL 120 /* First TCP packet */ |
| 101 |
#define PFTM_TCP_OPENING_VAL 30 /* No response yet */ |
| 102 |
#define PFTM_TCP_ESTABLISHED_VAL 24*60*60/* Established */ |
| 103 |
#define PFTM_TCP_CLOSING_VAL 15 * 60 /* Half closed */ |
| 104 |
#define PFTM_TCP_FIN_WAIT_VAL 45 /* Got both FINs */ |
| 105 |
#define PFTM_TCP_CLOSED_VAL 90 /* Got a RST */ |
| 106 |
#define PFTM_UDP_FIRST_PACKET_VAL 60 /* First UDP packet */ |
| 107 |
#define PFTM_UDP_SINGLE_VAL 30 /* Unidirectional */ |
| 108 |
#define PFTM_UDP_MULTIPLE_VAL 60 /* Bidirectional */ |
| 109 |
#define PFTM_ICMP_FIRST_PACKET_VAL 20 /* First ICMP packet */ |
| 110 |
#define PFTM_ICMP_ERROR_REPLY_VAL 10 /* Got error response */ |
| 111 |
#define PFTM_OTHER_FIRST_PACKET_VAL 60 /* First packet */ |
| 112 |
#define PFTM_OTHER_SINGLE_VAL 30 /* Unidirectional */ |
| 113 |
#define PFTM_OTHER_MULTIPLE_VAL 60 /* Bidirectional */ |
| 114 |
#define PFTM_FRAG_VAL 30 /* Fragment expire */ |
| 115 |
#define PFTM_INTERVAL_VAL 10 /* Expire interval */ |
| 116 |
#define PFTM_SRC_NODE_VAL 0 /* Source tracking */ |
| 117 |
#define PFTM_TS_DIFF_VAL 30 /* Allowed TS diff */ |
| 118 |
|
| 119 |
enum { PF_NOPFROUTE, PF_FASTROUTE, PF_ROUTETO, PF_DUPTO, PF_REPLYTO };
|
| 120 |
enum { PF_LIMIT_STATES, PF_LIMIT_SRC_NODES, PF_LIMIT_FRAGS,
|
| 121 |
PF_LIMIT_TABLES, PF_LIMIT_TABLE_ENTRIES, PF_LIMIT_MAX }; |
| 122 |
#define PF_POOL_IDMASK 0x0f |
| 123 |
enum { PF_POOL_NONE, PF_POOL_BITMASK, PF_POOL_RANDOM,
|
| 124 |
PF_POOL_SRCHASH, PF_POOL_ROUNDROBIN }; |
| 125 |
enum { PF_ADDR_ADDRMASK, PF_ADDR_NOROUTE, PF_ADDR_DYNIFTL,
|
| 126 |
PF_ADDR_TABLE, PF_ADDR_RTLABEL, PF_ADDR_URPFFAILED }; |
| 127 |
#define PF_POOL_TYPEMASK 0x0f |
| 128 |
#define PF_POOL_STICKYADDR 0x20 |
| 129 |
#define PF_WSCALE_FLAG 0x80 |
| 130 |
#define PF_WSCALE_MASK 0x0f |
| 131 |
|
| 132 |
#define PF_LOG 0x01 |
| 133 |
#define PF_LOG_ALL 0x02 |
| 134 |
#define PF_LOG_SOCKET_LOOKUP 0x04 |
| 135 |
|
| 136 |
struct pf_addr {
|
| 137 |
union {
|
| 138 |
struct in_addr v4;
|
| 139 |
struct in6_addr v6;
|
| 140 |
u_int8_t addr8[16];
|
| 141 |
u_int16_t addr16[8];
|
| 142 |
u_int32_t addr32[4];
|
| 143 |
} pfa; /* 128-bit address */
|
| 144 |
#define v4 pfa.v4
|
| 145 |
#define v6 pfa.v6
|
| 146 |
#define addr8 pfa.addr8
|
| 147 |
#define addr16 pfa.addr16
|
| 148 |
#define addr32 pfa.addr32
|
| 149 |
}; |
| 150 |
|
| 151 |
#define PF_TABLE_NAME_SIZE 32 |
| 152 |
|
| 153 |
#define PFI_AFLAG_NETWORK 0x01 |
| 154 |
#define PFI_AFLAG_BROADCAST 0x02 |
| 155 |
#define PFI_AFLAG_PEER 0x04 |
| 156 |
#define PFI_AFLAG_MODEMASK 0x07 |
| 157 |
#define PFI_AFLAG_NOALIAS 0x08 |
| 158 |
|
| 159 |
#ifndef RTLABEL_LEN
|
| 160 |
#define RTLABEL_LEN 32 |
| 161 |
#endif
|
| 162 |
|
| 163 |
struct pf_addr_wrap {
|
| 164 |
union {
|
| 165 |
struct {
|
| 166 |
struct pf_addr addr;
|
| 167 |
struct pf_addr mask;
|
| 168 |
} a; |
| 169 |
char ifname[IFNAMSIZ];
|
| 170 |
char tblname[PF_TABLE_NAME_SIZE];
|
| 171 |
char rtlabelname[RTLABEL_LEN];
|
| 172 |
u_int32_t rtlabel; |
| 173 |
} v; |
| 174 |
union {
|
| 175 |
struct pfi_dynaddr *dyn;
|
| 176 |
struct pfr_ktable *tbl;
|
| 177 |
int dyncnt;
|
| 178 |
int tblcnt;
|
| 179 |
} p; |
| 180 |
u_int8_t type; /* PF_ADDR_* */
|
| 181 |
u_int8_t iflags; /* PFI_AFLAG_* */
|
| 182 |
}; |
| 183 |
|
| 184 |
#ifdef _KERNEL
|
| 185 |
|
| 186 |
struct pfi_dynaddr {
|
| 187 |
TAILQ_ENTRY(pfi_dynaddr) entry; |
| 188 |
struct pf_addr pfid_addr4;
|
| 189 |
struct pf_addr pfid_mask4;
|
| 190 |
struct pf_addr pfid_addr6;
|
| 191 |
struct pf_addr pfid_mask6;
|
| 192 |
struct pfr_ktable *pfid_kt;
|
| 193 |
struct pfi_kif *pfid_kif;
|
| 194 |
void *pfid_hook_cookie;
|
| 195 |
int pfid_net; /* mask or 128 */ |
| 196 |
int pfid_acnt4; /* address count IPv4 */ |
| 197 |
int pfid_acnt6; /* address count IPv6 */ |
| 198 |
sa_family_t pfid_af; /* rule af */
|
| 199 |
u_int8_t pfid_iflags; /* PFI_AFLAG_* */
|
| 200 |
}; |
| 201 |
|
| 202 |
/*
|
| 203 |
* Address manipulation macros
|
| 204 |
*/
|
| 205 |
|
| 206 |
#ifdef INET
|
| 207 |
#ifndef INET6
|
| 208 |
#define PF_INET_ONLY
|
| 209 |
#endif /* ! INET6 */ |
| 210 |
#endif /* INET */ |
| 211 |
|
| 212 |
#ifdef INET6
|
| 213 |
#ifndef INET
|
| 214 |
#define PF_INET6_ONLY
|
| 215 |
#endif /* ! INET */ |
| 216 |
#endif /* INET6 */ |
| 217 |
|
| 218 |
#ifdef INET
|
| 219 |
#ifdef INET6
|
| 220 |
#define PF_INET_INET6
|
| 221 |
#endif /* INET6 */ |
| 222 |
#endif /* INET */ |
| 223 |
|
| 224 |
#else
|
| 225 |
|
| 226 |
#define PF_INET_INET6
|
| 227 |
|
| 228 |
#endif /* _KERNEL */ |
| 229 |
|
| 230 |
/* Both IPv4 and IPv6 */
|
| 231 |
#ifdef PF_INET_INET6
|
| 232 |
|
| 233 |
#define PF_AEQ(a, b, c) \
|
| 234 |
((c == AF_INET && (a)->addr32[0] == (b)->addr32[0]) || \ |
| 235 |
((a)->addr32[3] == (b)->addr32[3] && \ |
| 236 |
(a)->addr32[2] == (b)->addr32[2] && \ |
| 237 |
(a)->addr32[1] == (b)->addr32[1] && \ |
| 238 |
(a)->addr32[0] == (b)->addr32[0])) \ |
| 239 |
|
| 240 |
#define PF_ANEQ(a, b, c) \
|
| 241 |
((c == AF_INET && (a)->addr32[0] != (b)->addr32[0]) || \ |
| 242 |
((a)->addr32[3] != (b)->addr32[3] || \ |
| 243 |
(a)->addr32[2] != (b)->addr32[2] || \ |
| 244 |
(a)->addr32[1] != (b)->addr32[1] || \ |
| 245 |
(a)->addr32[0] != (b)->addr32[0])) \ |
| 246 |
|
| 247 |
#define PF_AZERO(a, c) \
|
| 248 |
((c == AF_INET && !(a)->addr32[0]) || \
|
| 249 |
(!(a)->addr32[0] && !(a)->addr32[1] && \ |
| 250 |
!(a)->addr32[2] && !(a)->addr32[3] )) \ |
| 251 |
|
| 252 |
#define PF_MATCHA(n, a, m, b, f) \
|
| 253 |
pf_match_addr(n, a, m, b, f) |
| 254 |
|
| 255 |
#define PF_ACPY(a, b, f) \
|
| 256 |
pf_addrcpy(a, b, f) |
| 257 |
|
| 258 |
#define PF_AINC(a, f) \
|
| 259 |
pf_addr_inc(a, f) |
| 260 |
|
| 261 |
#define PF_POOLMASK(a, b, c, d, f) \
|
| 262 |
pf_poolmask(a, b, c, d, f) |
| 263 |
|
| 264 |
#else
|
| 265 |
|
| 266 |
/* Just IPv6 */
|
| 267 |
|
| 268 |
#ifdef PF_INET6_ONLY
|
| 269 |
|
| 270 |
#define PF_AEQ(a, b, c) \
|
| 271 |
((a)->addr32[3] == (b)->addr32[3] && \ |
| 272 |
(a)->addr32[2] == (b)->addr32[2] && \ |
| 273 |
(a)->addr32[1] == (b)->addr32[1] && \ |
| 274 |
(a)->addr32[0] == (b)->addr32[0]) \ |
| 275 |
|
| 276 |
#define PF_ANEQ(a, b, c) \
|
| 277 |
((a)->addr32[3] != (b)->addr32[3] || \ |
| 278 |
(a)->addr32[2] != (b)->addr32[2] || \ |
| 279 |
(a)->addr32[1] != (b)->addr32[1] || \ |
| 280 |
(a)->addr32[0] != (b)->addr32[0]) \ |
| 281 |
|
| 282 |
#define PF_AZERO(a, c) \
|
| 283 |
(!(a)->addr32[0] && \
|
| 284 |
!(a)->addr32[1] && \
|
| 285 |
!(a)->addr32[2] && \
|
| 286 |
!(a)->addr32[3] ) \
|
| 287 |
|
| 288 |
#define PF_MATCHA(n, a, m, b, f) \
|
| 289 |
pf_match_addr(n, a, m, b, f) |
| 290 |
|
| 291 |
#define PF_ACPY(a, b, f) \
|
| 292 |
pf_addrcpy(a, b, f) |
| 293 |
|
| 294 |
#define PF_AINC(a, f) \
|
| 295 |
pf_addr_inc(a, f) |
| 296 |
|
| 297 |
#define PF_POOLMASK(a, b, c, d, f) \
|
| 298 |
pf_poolmask(a, b, c, d, f) |
| 299 |
|
| 300 |
#else
|
| 301 |
|
| 302 |
/* Just IPv4 */
|
| 303 |
#ifdef PF_INET_ONLY
|
| 304 |
|
| 305 |
#define PF_AEQ(a, b, c) \
|
| 306 |
((a)->addr32[0] == (b)->addr32[0]) |
| 307 |
|
| 308 |
#define PF_ANEQ(a, b, c) \
|
| 309 |
((a)->addr32[0] != (b)->addr32[0]) |
| 310 |
|
| 311 |
#define PF_AZERO(a, c) \
|
| 312 |
(!(a)->addr32[0])
|
| 313 |
|
| 314 |
#define PF_MATCHA(n, a, m, b, f) \
|
| 315 |
pf_match_addr(n, a, m, b, f) |
| 316 |
|
| 317 |
#define PF_ACPY(a, b, f) \
|
| 318 |
(a)->v4.s_addr = (b)->v4.s_addr |
| 319 |
|
| 320 |
#define PF_AINC(a, f) \
|
| 321 |
do { \
|
| 322 |
(a)->addr32[0] = htonl(ntohl((a)->addr32[0]) + 1); \ |
| 323 |
} while (0) |
| 324 |
|
| 325 |
#define PF_POOLMASK(a, b, c, d, f) \
|
| 326 |
do { \
|
| 327 |
(a)->addr32[0] = ((b)->addr32[0] & (c)->addr32[0]) | \ |
| 328 |
(((c)->addr32[0] ^ 0xffffffff ) & (d)->addr32[0]); \ |
| 329 |
} while (0) |
| 330 |
|
| 331 |
#endif /* PF_INET_ONLY */ |
| 332 |
#endif /* PF_INET6_ONLY */ |
| 333 |
#endif /* PF_INET_INET6 */ |
| 334 |
|
| 335 |
#define PF_MISMATCHAW(aw, x, af, neg, ifp) \
|
| 336 |
( \ |
| 337 |
(((aw)->type == PF_ADDR_NOROUTE && \ |
| 338 |
pf_routable((x), (af), NULL)) || \
|
| 339 |
(((aw)->type == PF_ADDR_URPFFAILED && (ifp) != NULL && \
|
| 340 |
pf_routable((x), (af), (ifp))) || \ |
| 341 |
((aw)->type == PF_ADDR_RTLABEL && \ |
| 342 |
!pf_rtlabel_match((x), (af), (aw))) || \ |
| 343 |
((aw)->type == PF_ADDR_TABLE && \ |
| 344 |
!pfr_match_addr((aw)->p.tbl, (x), (af))) || \ |
| 345 |
((aw)->type == PF_ADDR_DYNIFTL && \ |
| 346 |
!pfi_match_addr((aw)->p.dyn, (x), (af))) || \ |
| 347 |
((aw)->type == PF_ADDR_ADDRMASK && \ |
| 348 |
!PF_AZERO(&(aw)->v.a.mask, (af)) && \ |
| 349 |
!PF_MATCHA(0, &(aw)->v.a.addr, \
|
| 350 |
&(aw)->v.a.mask, (x), (af))))) != \ |
| 351 |
(neg) \ |
| 352 |
) |
| 353 |
|
| 354 |
|
| 355 |
struct pf_rule_uid {
|
| 356 |
uid_t uid[2];
|
| 357 |
u_int8_t op; |
| 358 |
}; |
| 359 |
|
| 360 |
struct pf_rule_gid {
|
| 361 |
uid_t gid[2];
|
| 362 |
u_int8_t op; |
| 363 |
}; |
| 364 |
|
| 365 |
struct pf_rule_addr {
|
| 366 |
struct pf_addr_wrap addr;
|
| 367 |
u_int16_t port[2];
|
| 368 |
u_int8_t neg; |
| 369 |
u_int8_t port_op; |
| 370 |
}; |
| 371 |
|
| 372 |
struct pf_pooladdr {
|
| 373 |
struct pf_addr_wrap addr;
|
| 374 |
TAILQ_ENTRY(pf_pooladdr) entries; |
| 375 |
char ifname[IFNAMSIZ];
|
| 376 |
struct pfi_kif *kif;
|
| 377 |
}; |
| 378 |
|
| 379 |
TAILQ_HEAD(pf_palist, pf_pooladdr); |
| 380 |
|
| 381 |
struct pf_poolhashkey {
|
| 382 |
union {
|
| 383 |
u_int8_t key8[16];
|
| 384 |
u_int16_t key16[8];
|
| 385 |
u_int32_t key32[4];
|
| 386 |
} pfk; /* 128-bit hash key */
|
| 387 |
#define key8 pfk.key8
|
| 388 |
#define key16 pfk.key16
|
| 389 |
#define key32 pfk.key32
|
| 390 |
}; |
| 391 |
|
| 392 |
struct pf_pool {
|
| 393 |
struct pf_palist list;
|
| 394 |
struct pf_pooladdr *cur;
|
| 395 |
struct pf_poolhashkey key;
|
| 396 |
struct pf_addr counter;
|
| 397 |
int tblidx;
|
| 398 |
u_int16_t proxy_port[2];
|
| 399 |
u_int8_t port_op; |
| 400 |
u_int8_t opts; |
| 401 |
}; |
| 402 |
|
| 403 |
|
| 404 |
/* A packed Operating System description for fingerprinting */
|
| 405 |
typedef u_int32_t pf_osfp_t;
|
| 406 |
#define PF_OSFP_ANY ((pf_osfp_t)0) |
| 407 |
#define PF_OSFP_UNKNOWN ((pf_osfp_t)-1) |
| 408 |
#define PF_OSFP_NOMATCH ((pf_osfp_t)-2) |
| 409 |
|
| 410 |
struct pf_osfp_entry {
|
| 411 |
SLIST_ENTRY(pf_osfp_entry) fp_entry; |
| 412 |
pf_osfp_t fp_os; |
| 413 |
int fp_enflags;
|
| 414 |
#define PF_OSFP_EXPANDED 0x001 /* expanded entry */ |
| 415 |
#define PF_OSFP_GENERIC 0x002 /* generic signature */ |
| 416 |
#define PF_OSFP_NODETAIL 0x004 /* no p0f details */ |
| 417 |
#define PF_OSFP_LEN 32 |
| 418 |
char fp_class_nm[PF_OSFP_LEN];
|
| 419 |
char fp_version_nm[PF_OSFP_LEN];
|
| 420 |
char fp_subtype_nm[PF_OSFP_LEN];
|
| 421 |
}; |
| 422 |
#define PF_OSFP_ENTRY_EQ(a, b) \
|
| 423 |
((a)->fp_os == (b)->fp_os && \ |
| 424 |
memcmp((a)->fp_class_nm, (b)->fp_class_nm, PF_OSFP_LEN) == 0 && \
|
| 425 |
memcmp((a)->fp_version_nm, (b)->fp_version_nm, PF_OSFP_LEN) == 0 && \
|
| 426 |
memcmp((a)->fp_subtype_nm, (b)->fp_subtype_nm, PF_OSFP_LEN) == 0)
|
| 427 |
|
| 428 |
/* handle pf_osfp_t packing */
|
| 429 |
#define _FP_RESERVED_BIT 1 /* For the special negative #defines */ |
| 430 |
#define _FP_UNUSED_BITS 1 |
| 431 |
#define _FP_CLASS_BITS 10 /* OS Class (Windows, Linux) */ |
| 432 |
#define _FP_VERSION_BITS 10 /* OS version (95, 98, NT, 2.4.54, 3.2) */ |
| 433 |
#define _FP_SUBTYPE_BITS 10 /* patch level (NT SP4, SP3, ECN patch) */ |
| 434 |
#define PF_OSFP_UNPACK(osfp, class, version, subtype) do { \ |
| 435 |
(class) = ((osfp) >> (_FP_VERSION_BITS+_FP_SUBTYPE_BITS)) & \ |
| 436 |
((1 << _FP_CLASS_BITS) - 1); \ |
| 437 |
(version) = ((osfp) >> _FP_SUBTYPE_BITS) & \ |
| 438 |
((1 << _FP_VERSION_BITS) - 1);\ |
| 439 |
(subtype) = (osfp) & ((1 << _FP_SUBTYPE_BITS) - 1); \ |
| 440 |
} while(0) |
| 441 |
#define PF_OSFP_PACK(osfp, class, version, subtype) do { \ |
| 442 |
(osfp) = ((class) & ((1 << _FP_CLASS_BITS) - 1)) << (_FP_VERSION_BITS \ |
| 443 |
+ _FP_SUBTYPE_BITS); \ |
| 444 |
(osfp) |= ((version) & ((1 << _FP_VERSION_BITS) - 1)) << \ |
| 445 |
_FP_SUBTYPE_BITS; \ |
| 446 |
(osfp) |= (subtype) & ((1 << _FP_SUBTYPE_BITS) - 1); \ |
| 447 |
} while(0) |
| 448 |
|
| 449 |
/* the fingerprint of an OSes TCP SYN packet */
|
| 450 |
typedef u_int64_t pf_tcpopts_t;
|
| 451 |
struct pf_os_fingerprint {
|
| 452 |
SLIST_HEAD(pf_osfp_enlist, pf_osfp_entry) fp_oses; /* list of matches */
|
| 453 |
pf_tcpopts_t fp_tcpopts; /* packed TCP options */
|
| 454 |
u_int16_t fp_wsize; /* TCP window size */
|
| 455 |
u_int16_t fp_psize; /* ip->ip_len */
|
| 456 |
u_int16_t fp_mss; /* TCP MSS */
|
| 457 |
u_int16_t fp_flags; |
| 458 |
#define PF_OSFP_WSIZE_MOD 0x0001 /* Window modulus */ |
| 459 |
#define PF_OSFP_WSIZE_DC 0x0002 /* Window don't care */ |
| 460 |
#define PF_OSFP_WSIZE_MSS 0x0004 /* Window multiple of MSS */ |
| 461 |
#define PF_OSFP_WSIZE_MTU 0x0008 /* Window multiple of MTU */ |
| 462 |
#define PF_OSFP_PSIZE_MOD 0x0010 /* packet size modulus */ |
| 463 |
#define PF_OSFP_PSIZE_DC 0x0020 /* packet size don't care */ |
| 464 |
#define PF_OSFP_WSCALE 0x0040 /* TCP window scaling */ |
| 465 |
#define PF_OSFP_WSCALE_MOD 0x0080 /* TCP window scale modulus */ |
| 466 |
#define PF_OSFP_WSCALE_DC 0x0100 /* TCP window scale dont-care */ |
| 467 |
#define PF_OSFP_MSS 0x0200 /* TCP MSS */ |
| 468 |
#define PF_OSFP_MSS_MOD 0x0400 /* TCP MSS modulus */ |
| 469 |
#define PF_OSFP_MSS_DC 0x0800 /* TCP MSS dont-care */ |
| 470 |
#define PF_OSFP_DF 0x1000 /* IPv4 don't fragment bit */ |
| 471 |
#define PF_OSFP_TS0 0x2000 /* Zero timestamp */ |
| 472 |
#define PF_OSFP_INET6 0x4000 /* IPv6 */ |
| 473 |
u_int8_t fp_optcnt; /* TCP option count */
|
| 474 |
u_int8_t fp_wscale; /* TCP window scaling */
|
| 475 |
u_int8_t fp_ttl; /* IPv4 TTL */
|
| 476 |
#define PF_OSFP_MAXTTL_OFFSET 40 |
| 477 |
/* TCP options packing */
|
| 478 |
#define PF_OSFP_TCPOPT_NOP 0x0 /* TCP NOP option */ |
| 479 |
#define PF_OSFP_TCPOPT_WSCALE 0x1 /* TCP window scaling option */ |
| 480 |
#define PF_OSFP_TCPOPT_MSS 0x2 /* TCP max segment size opt */ |
| 481 |
#define PF_OSFP_TCPOPT_SACK 0x3 /* TCP SACK OK option */ |
| 482 |
#define PF_OSFP_TCPOPT_TS 0x4 /* TCP timestamp option */ |
| 483 |
#define PF_OSFP_TCPOPT_BITS 3 /* bits used by each option */ |
| 484 |
#define PF_OSFP_MAX_OPTS \
|
| 485 |
(sizeof(((struct pf_os_fingerprint *)0)->fp_tcpopts) * 8) \ |
| 486 |
/ PF_OSFP_TCPOPT_BITS |
| 487 |
|
| 488 |
SLIST_ENTRY(pf_os_fingerprint) fp_next; |
| 489 |
}; |
| 490 |
|
| 491 |
struct pf_osfp_ioctl {
|
| 492 |
struct pf_osfp_entry fp_os;
|
| 493 |
pf_tcpopts_t fp_tcpopts; /* packed TCP options */
|
| 494 |
u_int16_t fp_wsize; /* TCP window size */
|
| 495 |
u_int16_t fp_psize; /* ip->ip_len */
|
| 496 |
u_int16_t fp_mss; /* TCP MSS */
|
| 497 |
u_int16_t fp_flags; |
| 498 |
u_int8_t fp_optcnt; /* TCP option count */
|
| 499 |
u_int8_t fp_wscale; /* TCP window scaling */
|
| 500 |
u_int8_t fp_ttl; /* IPv4 TTL */
|
| 501 |
|
| 502 |
int fp_getnum; /* DIOCOSFPGET number */ |
| 503 |
}; |
| 504 |
|
| 505 |
|
| 506 |
union pf_rule_ptr {
|
| 507 |
struct pf_rule *ptr;
|
| 508 |
u_int32_t nr; |
| 509 |
}; |
| 510 |
|
| 511 |
#define PF_ANCHOR_NAME_SIZE 64 |
| 512 |
|
| 513 |
struct pf_rule {
|
| 514 |
struct pf_rule_addr src;
|
| 515 |
struct pf_rule_addr dst;
|
| 516 |
#define PF_SKIP_IFP 0 |
| 517 |
#define PF_SKIP_DIR 1 |
| 518 |
#define PF_SKIP_AF 2 |
| 519 |
#define PF_SKIP_PROTO 3 |
| 520 |
#define PF_SKIP_SRC_ADDR 4 |
| 521 |
#define PF_SKIP_SRC_PORT 5 |
| 522 |
#define PF_SKIP_DST_ADDR 6 |
| 523 |
#define PF_SKIP_DST_PORT 7 |
| 524 |
#define PF_SKIP_COUNT 8 |
| 525 |
union pf_rule_ptr skip[PF_SKIP_COUNT];
|
| 526 |
#define PF_RULE_LABEL_SIZE 64 |
| 527 |
char label[PF_RULE_LABEL_SIZE];
|
| 528 |
#define PF_QNAME_SIZE 64 |
| 529 |
char ifname[IFNAMSIZ];
|
| 530 |
char qname[PF_QNAME_SIZE];
|
| 531 |
char pqname[PF_QNAME_SIZE];
|
| 532 |
#define PF_TAG_NAME_SIZE 64 |
| 533 |
char tagname[PF_TAG_NAME_SIZE];
|
| 534 |
char match_tagname[PF_TAG_NAME_SIZE];
|
| 535 |
|
| 536 |
char overload_tblname[PF_TABLE_NAME_SIZE];
|
| 537 |
|
| 538 |
TAILQ_ENTRY(pf_rule) entries; |
| 539 |
struct pf_pool rpool;
|
| 540 |
|
| 541 |
u_int64_t evaluations; |
| 542 |
u_int64_t packets[2];
|
| 543 |
u_int64_t bytes[2];
|
| 544 |
|
| 545 |
struct pfi_kif *kif;
|
| 546 |
struct pf_anchor *anchor;
|
| 547 |
struct pfr_ktable *overload_tbl;
|
| 548 |
|
| 549 |
pf_osfp_t os_fingerprint; |
| 550 |
|
| 551 |
int rtableid;
|
| 552 |
u_int32_t timeout[PFTM_MAX]; |
| 553 |
u_int32_t states; |
| 554 |
u_int32_t max_states; |
| 555 |
u_int32_t src_nodes; |
| 556 |
u_int32_t max_src_nodes; |
| 557 |
u_int32_t max_src_states; |
| 558 |
u_int32_t max_src_conn; |
| 559 |
struct {
|
| 560 |
u_int32_t limit; |
| 561 |
u_int32_t seconds; |
| 562 |
} max_src_conn_rate; |
| 563 |
u_int32_t qid; |
| 564 |
u_int32_t pqid; |
| 565 |
u_int32_t rt_listid; |
| 566 |
u_int32_t nr; |
| 567 |
u_int32_t prob; |
| 568 |
uid_t cuid; |
| 569 |
pid_t cpid; |
| 570 |
|
| 571 |
u_int16_t return_icmp; |
| 572 |
u_int16_t return_icmp6; |
| 573 |
u_int16_t max_mss; |
| 574 |
u_int16_t tag; |
| 575 |
u_int16_t match_tag; |
| 576 |
|
| 577 |
struct pf_rule_uid uid;
|
| 578 |
struct pf_rule_gid gid;
|
| 579 |
|
| 580 |
u_int32_t rule_flag; |
| 581 |
u_int8_t action; |
| 582 |
u_int8_t direction; |
| 583 |
u_int8_t log; |
| 584 |
u_int8_t logif; |
| 585 |
u_int8_t quick; |
| 586 |
u_int8_t ifnot; |
| 587 |
u_int8_t match_tag_not; |
| 588 |
u_int8_t natpass; |
| 589 |
|
| 590 |
#define PF_STATE_NORMAL 0x1 |
| 591 |
#define PF_STATE_MODULATE 0x2 |
| 592 |
#define PF_STATE_SYNPROXY 0x3 |
| 593 |
u_int8_t keep_state; |
| 594 |
sa_family_t af; |
| 595 |
u_int8_t proto; |
| 596 |
u_int8_t type; |
| 597 |
u_int8_t code; |
| 598 |
u_int8_t flags; |
| 599 |
u_int8_t flagset; |
| 600 |
u_int8_t min_ttl; |
| 601 |
u_int8_t allow_opts; |
| 602 |
u_int8_t rt; |
| 603 |
u_int8_t return_ttl; |
| 604 |
u_int8_t tos; |
| 605 |
u_int8_t anchor_relative; |
| 606 |
u_int8_t anchor_wildcard; |
| 607 |
|
| 608 |
#define PF_FLUSH 0x01 |
| 609 |
#define PF_FLUSH_GLOBAL 0x02 |
| 610 |
u_int8_t flush; |
| 611 |
}; |
| 612 |
|
| 613 |
/* rule flags */
|
| 614 |
#define PFRULE_DROP 0x0000 |
| 615 |
#define PFRULE_RETURNRST 0x0001 |
| 616 |
#define PFRULE_FRAGMENT 0x0002 |
| 617 |
#define PFRULE_RETURNICMP 0x0004 |
| 618 |
#define PFRULE_RETURN 0x0008 |
| 619 |
#define PFRULE_NOSYNC 0x0010 |
| 620 |
#define PFRULE_SRCTRACK 0x0020 /* track source states */ |
| 621 |
#define PFRULE_RULESRCTRACK 0x0040 /* per rule */ |
| 622 |
|
| 623 |
/* scrub flags */
|
| 624 |
#define PFRULE_NODF 0x0100 |
| 625 |
#define PFRULE_FRAGCROP 0x0200 /* non-buffering frag cache */ |
| 626 |
#define PFRULE_FRAGDROP 0x0400 /* drop funny fragments */ |
| 627 |
#define PFRULE_RANDOMID 0x0800 |
| 628 |
#define PFRULE_REASSEMBLE_TCP 0x1000 |
| 629 |
|
| 630 |
/* rule flags again */
|
| 631 |
#define PFRULE_IFBOUND 0x00010000 /* if-bound */ |
| 632 |
|
| 633 |
#define PFSTATE_HIWAT 10000 /* default state table size */ |
| 634 |
#define PFSTATE_ADAPT_START 6000 /* default adaptive timeout start */ |
| 635 |
#define PFSTATE_ADAPT_END 12000 /* default adaptive timeout end */ |
| 636 |
|
| 637 |
|
| 638 |
struct pf_threshold {
|
| 639 |
u_int32_t limit; |
| 640 |
#define PF_THRESHOLD_MULT 1000 |
| 641 |
#define PF_THRESHOLD_MAX 0xffffffff / PF_THRESHOLD_MULT |
| 642 |
u_int32_t seconds; |
| 643 |
u_int32_t count; |
| 644 |
u_int32_t last; |
| 645 |
}; |
| 646 |
|
| 647 |
struct pf_src_node {
|
| 648 |
RB_ENTRY(pf_src_node) entry; |
| 649 |
struct pf_addr addr;
|
| 650 |
struct pf_addr raddr;
|
| 651 |
union pf_rule_ptr rule;
|
| 652 |
struct pfi_kif *kif;
|
| 653 |
u_int64_t bytes[2];
|
| 654 |
u_int64_t packets[2];
|
| 655 |
u_int32_t states; |
| 656 |
u_int32_t conn; |
| 657 |
struct pf_threshold conn_rate;
|
| 658 |
u_int32_t creation; |
| 659 |
u_int32_t expire; |
| 660 |
sa_family_t af; |
| 661 |
u_int8_t ruletype; |
| 662 |
}; |
| 663 |
|
| 664 |
#define PFSNODE_HIWAT 10000 /* default source node table size */ |
| 665 |
|
| 666 |
struct pf_state_scrub {
|
| 667 |
struct timeval pfss_last; /* time received last packet */ |
| 668 |
u_int32_t pfss_tsecr; /* last echoed timestamp */
|
| 669 |
u_int32_t pfss_tsval; /* largest timestamp */
|
| 670 |
u_int32_t pfss_tsval0; /* original timestamp */
|
| 671 |
u_int16_t pfss_flags; |
| 672 |
#define PFSS_TIMESTAMP 0x0001 /* modulate timestamp */ |
| 673 |
#define PFSS_PAWS 0x0010 /* stricter PAWS checks */ |
| 674 |
#define PFSS_PAWS_IDLED 0x0020 /* was idle too long. no PAWS */ |
| 675 |
#define PFSS_DATA_TS 0x0040 /* timestamp on data packets */ |
| 676 |
#define PFSS_DATA_NOTS 0x0080 /* no timestamp on data packets */ |
| 677 |
u_int8_t pfss_ttl; /* stashed TTL */
|
| 678 |
u_int8_t pad; |
| 679 |
u_int32_t pfss_ts_mod; /* timestamp modulation */
|
| 680 |
}; |
| 681 |
|
| 682 |
struct pf_state_host {
|
| 683 |
struct pf_addr addr;
|
| 684 |
u_int16_t port; |
| 685 |
u_int16_t pad; |
| 686 |
}; |
| 687 |
|
| 688 |
struct pf_state_peer {
|
| 689 |
u_int32_t seqlo; /* Max sequence number sent */
|
| 690 |
u_int32_t seqhi; /* Max the other end ACKd + win */
|
| 691 |
u_int32_t seqdiff; /* Sequence number modulator */
|
| 692 |
u_int16_t max_win; /* largest window (pre scaling) */
|
| 693 |
u_int8_t state; /* active state level */
|
| 694 |
u_int8_t wscale; /* window scaling factor */
|
| 695 |
u_int16_t mss; /* Maximum segment size option */
|
| 696 |
u_int8_t tcp_est; /* Did we reach TCPS_ESTABLISHED */
|
| 697 |
struct pf_state_scrub *scrub; /* state is scrubbed */ |
| 698 |
u_int8_t pad[3];
|
| 699 |
}; |
| 700 |
|
| 701 |
TAILQ_HEAD(pf_state_queue, pf_state); |
| 702 |
|
| 703 |
/* keep synced with struct pf_state_key, used in RB_FIND */
|
| 704 |
struct pf_state_key_cmp {
|
| 705 |
struct pf_state_host lan;
|
| 706 |
struct pf_state_host gwy;
|
| 707 |
struct pf_state_host ext;
|
| 708 |
sa_family_t af; |
| 709 |
u_int8_t proto; |
| 710 |
u_int8_t direction; |
| 711 |
u_int8_t pad; |
| 712 |
}; |
| 713 |
|
| 714 |
TAILQ_HEAD(pf_statelist, pf_state); |
| 715 |
|
| 716 |
struct pf_state_key {
|
| 717 |
struct pf_state_host lan;
|
| 718 |
struct pf_state_host gwy;
|
| 719 |
struct pf_state_host ext;
|
| 720 |
sa_family_t af; |
| 721 |
u_int8_t proto; |
| 722 |
u_int8_t direction; |
| 723 |
u_int8_t pad; |
| 724 |
|
| 725 |
RB_ENTRY(pf_state_key) entry_lan_ext; |
| 726 |
RB_ENTRY(pf_state_key) entry_ext_gwy; |
| 727 |
struct pf_statelist states;
|
| 728 |
u_short refcnt; /* same size as if_index */
|
| 729 |
}; |
| 730 |
|
| 731 |
|
| 732 |
/* keep synced with struct pf_state, used in RB_FIND */
|
| 733 |
struct pf_state_cmp {
|
| 734 |
u_int64_t id; |
| 735 |
u_int32_t creatorid; |
| 736 |
u_int32_t pad; |
| 737 |
}; |
| 738 |
|
| 739 |
struct pf_state {
|
| 740 |
u_int64_t id; |
| 741 |
u_int32_t creatorid; |
| 742 |
u_int32_t pad; |
| 743 |
|
| 744 |
TAILQ_ENTRY(pf_state) entry_list; |
| 745 |
TAILQ_ENTRY(pf_state) next; |
| 746 |
RB_ENTRY(pf_state) entry_id; |
| 747 |
struct pf_state_peer src;
|
| 748 |
struct pf_state_peer dst;
|
| 749 |
union pf_rule_ptr rule;
|
| 750 |
union pf_rule_ptr anchor;
|
| 751 |
union pf_rule_ptr nat_rule;
|
| 752 |
struct pf_addr rt_addr;
|
| 753 |
struct pf_state_key *state_key;
|
| 754 |
struct pfi_kif *kif;
|
| 755 |
struct pfi_kif *rt_kif;
|
| 756 |
struct pf_src_node *src_node;
|
| 757 |
struct pf_src_node *nat_src_node;
|
| 758 |
u_int64_t packets[2];
|
| 759 |
u_int64_t bytes[2];
|
| 760 |
u_int32_t creation; |
| 761 |
u_int32_t expire; |
| 762 |
u_int32_t pfsync_time; |
| 763 |
u_int16_t tag; |
| 764 |
u_int8_t log; |
| 765 |
u_int8_t allow_opts; |
| 766 |
u_int8_t timeout; |
| 767 |
u_int8_t sync_flags; |
| 768 |
#define PFSTATE_NOSYNC 0x01 |
| 769 |
#define PFSTATE_FROMSYNC 0x02 |
| 770 |
#define PFSTATE_STALE 0x04 |
| 771 |
}; |
| 772 |
|
| 773 |
/*
|
| 774 |
* Unified state structures for pulling states out of the kernel
|
| 775 |
* used by pfsync(4) and the pf(4) ioctl.
|
| 776 |
*/
|
| 777 |
struct pfsync_state_scrub {
|
| 778 |
u_int16_t pfss_flags; |
| 779 |
u_int8_t pfss_ttl; /* stashed TTL */
|
| 780 |
#define PFSYNC_SCRUB_FLAG_VALID 0x01 |
| 781 |
u_int8_t scrub_flag; |
| 782 |
u_int32_t pfss_ts_mod; /* timestamp modulation */
|
| 783 |
} __packed; |
| 784 |
|
| 785 |
struct pfsync_state_host {
|
| 786 |
struct pf_addr addr;
|
| 787 |
u_int16_t port; |
| 788 |
u_int16_t pad[3];
|
| 789 |
} __packed; |
| 790 |
|
| 791 |
struct pfsync_state_peer {
|
| 792 |
struct pfsync_state_scrub scrub; /* state is scrubbed */ |
| 793 |
u_int32_t seqlo; /* Max sequence number sent */
|
| 794 |
u_int32_t seqhi; /* Max the other end ACKd + win */
|
| 795 |
u_int32_t seqdiff; /* Sequence number modulator */
|
| 796 |
u_int16_t max_win; /* largest window (pre scaling) */
|
| 797 |
u_int16_t mss; /* Maximum segment size option */
|
| 798 |
u_int8_t state; /* active state level */
|
| 799 |
u_int8_t wscale; /* window scaling factor */
|
| 800 |
u_int8_t pad[6];
|
| 801 |
} __packed; |
| 802 |
|
| 803 |
struct pfsync_state {
|
| 804 |
u_int32_t id[2];
|
| 805 |
char ifname[IFNAMSIZ];
|
| 806 |
struct pfsync_state_host lan;
|
| 807 |
struct pfsync_state_host gwy;
|
| 808 |
struct pfsync_state_host ext;
|
| 809 |
struct pfsync_state_peer src;
|
| 810 |
struct pfsync_state_peer dst;
|
| 811 |
struct pf_addr rt_addr;
|
| 812 |
u_int32_t rule; |
| 813 |
u_int32_t anchor; |
| 814 |
u_int32_t nat_rule; |
| 815 |
u_int32_t creation; |
| 816 |
u_int32_t expire; |
| 817 |
u_int32_t packets[2][2]; |
| 818 |
u_int32_t bytes[2][2]; |
| 819 |
u_int32_t creatorid; |
| 820 |
sa_family_t af; |
| 821 |
u_int8_t proto; |
| 822 |
u_int8_t direction; |
| 823 |
u_int8_t log; |
| 824 |
u_int8_t allow_opts; |
| 825 |
u_int8_t timeout; |
| 826 |
u_int8_t sync_flags; |
| 827 |
u_int8_t updates; |
| 828 |
} __packed; |
| 829 |
|
| 830 |
#define PFSYNC_FLAG_COMPRESS 0x01 |
| 831 |
#define PFSYNC_FLAG_STALE 0x02 |
| 832 |
#define PFSYNC_FLAG_SRCNODE 0x04 |
| 833 |
#define PFSYNC_FLAG_NATSRCNODE 0x08 |
| 834 |
|
| 835 |
/* for copies to/from userland via pf_ioctl() */
|
| 836 |
#define pf_state_peer_to_pfsync(s,d) do { \ |
| 837 |
(d)->seqlo = (s)->seqlo; \ |
| 838 |
(d)->seqhi = (s)->seqhi; \ |
| 839 |
(d)->seqdiff = (s)->seqdiff; \ |
| 840 |
(d)->max_win = (s)->max_win; \ |
| 841 |
(d)->mss = (s)->mss; \ |
| 842 |
(d)->state = (s)->state; \ |
| 843 |
(d)->wscale = (s)->wscale; \ |
| 844 |
if ((s)->scrub) { \
|
| 845 |
(d)->scrub.pfss_flags = \ |
| 846 |
(s)->scrub->pfss_flags & PFSS_TIMESTAMP; \ |
| 847 |
(d)->scrub.pfss_ttl = (s)->scrub->pfss_ttl; \ |
| 848 |
(d)->scrub.pfss_ts_mod = (s)->scrub->pfss_ts_mod; \ |
| 849 |
(d)->scrub.scrub_flag = PFSYNC_SCRUB_FLAG_VALID; \ |
| 850 |
} \ |
| 851 |
} while (0) |
| 852 |
|
| 853 |
#define pf_state_peer_from_pfsync(s,d) do { \ |
| 854 |
(d)->seqlo = (s)->seqlo; \ |
| 855 |
(d)->seqhi = (s)->seqhi; \ |
| 856 |
(d)->seqdiff = (s)->seqdiff; \ |
| 857 |
(d)->max_win = (s)->max_win; \ |
| 858 |
(d)->mss = ntohs((s)->mss); \ |
| 859 |
(d)->state = (s)->state; \ |
| 860 |
(d)->wscale = (s)->wscale; \ |
| 861 |
if ((s)->scrub.scrub_flag == PFSYNC_SCRUB_FLAG_VALID && \
|
| 862 |
(d)->scrub != NULL) { \
|
| 863 |
(d)->scrub->pfss_flags = \ |
| 864 |
ntohs((s)->scrub.pfss_flags) & PFSS_TIMESTAMP; \ |
| 865 |
(d)->scrub->pfss_ttl = (s)->scrub.pfss_ttl; \ |
| 866 |
(d)->scrub->pfss_ts_mod = (s)->scrub.pfss_ts_mod; \ |
| 867 |
} \ |
| 868 |
} while (0) |
| 869 |
|
| 870 |
#define pf_state_counter_to_pfsync(s,d) do { \ |
| 871 |
d[0] = (s>>32)&0xffffffff; \ |
| 872 |
d[1] = s&0xffffffff; \ |
| 873 |
} while (0) |
| 874 |
|
| 875 |
#define pf_state_counter_from_pfsync(s) \
|
| 876 |
(((u_int64_t)(s[0])<<32) | (u_int64_t)(s[1])) |
| 877 |
|
| 878 |
|
| 879 |
|
| 880 |
TAILQ_HEAD(pf_rulequeue, pf_rule); |
| 881 |
|
| 882 |
struct pf_anchor;
|
| 883 |
|
| 884 |
struct pf_ruleset {
|
| 885 |
struct {
|
| 886 |
struct pf_rulequeue queues[2]; |
| 887 |
struct {
|
| 888 |
struct pf_rulequeue *ptr;
|
| 889 |
struct pf_rule **ptr_array;
|
| 890 |
u_int32_t rcount; |
| 891 |
u_int32_t ticket; |
| 892 |
int open;
|
| 893 |
} active, inactive; |
| 894 |
} rules[PF_RULESET_MAX]; |
| 895 |
struct pf_anchor *anchor;
|
| 896 |
u_int32_t tticket; |
| 897 |
int tables;
|
| 898 |
int topen;
|
| 899 |
}; |
| 900 |
|
| 901 |
RB_HEAD(pf_anchor_global, pf_anchor); |
| 902 |
RB_HEAD(pf_anchor_node, pf_anchor); |
| 903 |
struct pf_anchor {
|
| 904 |
RB_ENTRY(pf_anchor) entry_global; |
| 905 |
RB_ENTRY(pf_anchor) entry_node; |
| 906 |
struct pf_anchor *parent;
|
| 907 |
struct pf_anchor_node children;
|
| 908 |
char name[PF_ANCHOR_NAME_SIZE];
|
| 909 |
char path[MAXPATHLEN];
|
| 910 |
struct pf_ruleset ruleset;
|
| 911 |
int refcnt; /* anchor rules */ |
| 912 |
int match;
|
| 913 |
}; |
| 914 |
RB_PROTOTYPE(pf_anchor_global, pf_anchor, entry_global, pf_anchor_compare); |
| 915 |
RB_PROTOTYPE(pf_anchor_node, pf_anchor, entry_node, pf_anchor_compare); |
| 916 |
|
| 917 |
#define PF_RESERVED_ANCHOR "_pf" |
| 918 |
|
| 919 |
#define PFR_TFLAG_PERSIST 0x00000001 |
| 920 |
#define PFR_TFLAG_CONST 0x00000002 |
| 921 |
#define PFR_TFLAG_ACTIVE 0x00000004 |
| 922 |
#define PFR_TFLAG_INACTIVE 0x00000008 |
| 923 |
#define PFR_TFLAG_REFERENCED 0x00000010 |
| 924 |
#define PFR_TFLAG_REFDANCHOR 0x00000020 |
| 925 |
#define PFR_TFLAG_USRMASK 0x00000003 |
| 926 |
#define PFR_TFLAG_SETMASK 0x0000003C |
| 927 |
#define PFR_TFLAG_ALLMASK 0x0000003F |
| 928 |
|
| 929 |
struct pfr_table {
|
| 930 |
char pfrt_anchor[MAXPATHLEN];
|
| 931 |
char pfrt_name[PF_TABLE_NAME_SIZE];
|
| 932 |
u_int32_t pfrt_flags; |
| 933 |
u_int8_t pfrt_fback; |
| 934 |
}; |
| 935 |
|
| 936 |
enum { PFR_FB_NONE, PFR_FB_MATCH, PFR_FB_ADDED, PFR_FB_DELETED,
|
| 937 |
PFR_FB_CHANGED, PFR_FB_CLEARED, PFR_FB_DUPLICATE, |
| 938 |
PFR_FB_NOTMATCH, PFR_FB_CONFLICT, PFR_FB_MAX }; |
| 939 |
|
| 940 |
struct pfr_addr {
|
| 941 |
union {
|
| 942 |
struct in_addr _pfra_ip4addr;
|
| 943 |
struct in6_addr _pfra_ip6addr;
|
| 944 |
} pfra_u; |
| 945 |
u_int8_t pfra_af; |
| 946 |
u_int8_t pfra_net; |
| 947 |
u_int8_t pfra_not; |
| 948 |
u_int8_t pfra_fback; |
| 949 |
}; |
| 950 |
#define pfra_ip4addr pfra_u._pfra_ip4addr
|
| 951 |
#define pfra_ip6addr pfra_u._pfra_ip6addr
|
| 952 |
|
| 953 |
enum { PFR_DIR_IN, PFR_DIR_OUT, PFR_DIR_MAX };
|
| 954 |
enum { PFR_OP_BLOCK, PFR_OP_PASS, PFR_OP_ADDR_MAX, PFR_OP_TABLE_MAX };
|
| 955 |
#define PFR_OP_XPASS PFR_OP_ADDR_MAX
|
| 956 |
|
| 957 |
struct pfr_astats {
|
| 958 |
struct pfr_addr pfras_a;
|
| 959 |
u_int64_t pfras_packets[PFR_DIR_MAX][PFR_OP_ADDR_MAX]; |
| 960 |
u_int64_t pfras_bytes[PFR_DIR_MAX][PFR_OP_ADDR_MAX]; |
| 961 |
long pfras_tzero;
|
| 962 |
}; |
| 963 |
|
| 964 |
enum { PFR_REFCNT_RULE, PFR_REFCNT_ANCHOR, PFR_REFCNT_MAX };
|
| 965 |
|
| 966 |
struct pfr_tstats {
|
| 967 |
struct pfr_table pfrts_t;
|
| 968 |
u_int64_t pfrts_packets[PFR_DIR_MAX][PFR_OP_TABLE_MAX]; |
| 969 |
u_int64_t pfrts_bytes[PFR_DIR_MAX][PFR_OP_TABLE_MAX]; |
| 970 |
u_int64_t pfrts_match; |
| 971 |
u_int64_t pfrts_nomatch; |
| 972 |
long pfrts_tzero;
|
| 973 |
int pfrts_cnt;
|
| 974 |
int pfrts_refcnt[PFR_REFCNT_MAX];
|
| 975 |
}; |
| 976 |
#define pfrts_name pfrts_t.pfrt_name
|
| 977 |
#define pfrts_flags pfrts_t.pfrt_flags
|
| 978 |
|
| 979 |
#ifndef _SOCKADDR_UNION_DEFINED
|
| 980 |
#define _SOCKADDR_UNION_DEFINED
|
| 981 |
union sockaddr_union {
|
| 982 |
struct sockaddr sa;
|
| 983 |
struct sockaddr_in sin;
|
| 984 |
struct sockaddr_in6 sin6;
|
| 985 |
}; |
| 986 |
#endif /* _SOCKADDR_UNION_DEFINED */ |
| 987 |
|
| 988 |
SLIST_HEAD(pfr_kentryworkq, pfr_kentry); |
| 989 |
struct pfr_kentry {
|
| 990 |
struct radix_node pfrke_node[2]; |
| 991 |
union sockaddr_union pfrke_sa;
|
| 992 |
u_int64_t pfrke_packets[PFR_DIR_MAX][PFR_OP_ADDR_MAX]; |
| 993 |
u_int64_t pfrke_bytes[PFR_DIR_MAX][PFR_OP_ADDR_MAX]; |
| 994 |
SLIST_ENTRY(pfr_kentry) pfrke_workq; |
| 995 |
long pfrke_tzero;
|
| 996 |
u_int8_t pfrke_af; |
| 997 |
u_int8_t pfrke_net; |
| 998 |
u_int8_t pfrke_not; |
| 999 |
u_int8_t pfrke_mark; |
| 1000 |
u_int8_t pfrke_intrpool; |
| 1001 |
}; |
| 1002 |
|
| 1003 |
SLIST_HEAD(pfr_ktableworkq, pfr_ktable); |
| 1004 |
RB_HEAD(pfr_ktablehead, pfr_ktable); |
| 1005 |
struct pfr_ktable {
|
| 1006 |
struct pfr_tstats pfrkt_ts;
|
| 1007 |
RB_ENTRY(pfr_ktable) pfrkt_tree; |
| 1008 |
SLIST_ENTRY(pfr_ktable) pfrkt_workq; |
| 1009 |
struct radix_node_head *pfrkt_ip4;
|
| 1010 |
struct radix_node_head *pfrkt_ip6;
|
| 1011 |
struct pfr_ktable *pfrkt_shadow;
|
| 1012 |
struct pfr_ktable *pfrkt_root;
|
| 1013 |
struct pf_ruleset *pfrkt_rs;
|
| 1014 |
long pfrkt_larg;
|
| 1015 |
int pfrkt_nflags;
|
| 1016 |
}; |
| 1017 |
#define pfrkt_t pfrkt_ts.pfrts_t
|
| 1018 |
#define pfrkt_name pfrkt_t.pfrt_name
|
| 1019 |
#define pfrkt_anchor pfrkt_t.pfrt_anchor
|
| 1020 |
#define pfrkt_ruleset pfrkt_t.pfrt_ruleset
|
| 1021 |
#define pfrkt_flags pfrkt_t.pfrt_flags
|
| 1022 |
#define pfrkt_cnt pfrkt_ts.pfrts_cnt
|
| 1023 |
#define pfrkt_refcnt pfrkt_ts.pfrts_refcnt
|
| 1024 |
#define pfrkt_packets pfrkt_ts.pfrts_packets
|
| 1025 |
#define pfrkt_bytes pfrkt_ts.pfrts_bytes
|
| 1026 |
#define pfrkt_match pfrkt_ts.pfrts_match
|
| 1027 |
#define pfrkt_nomatch pfrkt_ts.pfrts_nomatch
|
| 1028 |
#define pfrkt_tzero pfrkt_ts.pfrts_tzero
|
| 1029 |
|
| 1030 |
RB_HEAD(pf_state_tree_lan_ext, pf_state_key); |
| 1031 |
RB_PROTOTYPE(pf_state_tree_lan_ext, pf_state_key, |
| 1032 |
entry_lan_ext, pf_state_compare_lan_ext); |
| 1033 |
|
| 1034 |
RB_HEAD(pf_state_tree_ext_gwy, pf_state_key); |
| 1035 |
RB_PROTOTYPE(pf_state_tree_ext_gwy, pf_state_key, |
| 1036 |
entry_ext_gwy, pf_state_compare_ext_gwy); |
| 1037 |
|
| 1038 |
RB_HEAD(pfi_ifhead, pfi_kif); |
| 1039 |
|
| 1040 |
/* state tables */
|
| 1041 |
extern struct pf_state_tree_lan_ext pf_statetbl_lan_ext; |
| 1042 |
extern struct pf_state_tree_ext_gwy pf_statetbl_ext_gwy; |
| 1043 |
|
| 1044 |
/* keep synced with pfi_kif, used in RB_FIND */
|
| 1045 |
struct pfi_kif_cmp {
|
| 1046 |
char pfik_name[IFNAMSIZ];
|
| 1047 |
}; |
| 1048 |
|
| 1049 |
struct pfi_kif {
|
| 1050 |
char pfik_name[IFNAMSIZ];
|
| 1051 |
RB_ENTRY(pfi_kif) pfik_tree; |
| 1052 |
u_int64_t pfik_packets[2][2][2]; |
| 1053 |
u_int64_t pfik_bytes[2][2][2]; |
| 1054 |
u_int32_t pfik_tzero; |
| 1055 |
int pfik_flags;
|
| 1056 |
void *pfik_ah_cookie;
|
| 1057 |
struct ifnet *pfik_ifp;
|
| 1058 |
struct ifg_group *pfik_group;
|
| 1059 |
int pfik_states;
|
| 1060 |
int pfik_rules;
|
| 1061 |
TAILQ_HEAD(, pfi_dynaddr) pfik_dynaddrs; |
| 1062 |
}; |
| 1063 |
|
| 1064 |
enum pfi_kif_refs {
|
| 1065 |
PFI_KIF_REF_NONE, |
| 1066 |
PFI_KIF_REF_STATE, |
| 1067 |
PFI_KIF_REF_RULE |
| 1068 |
}; |
| 1069 |
|
| 1070 |
#define PFI_IFLAG_SKIP 0x0100 /* skip filtering on interface */ |
| 1071 |
|
| 1072 |
struct pf_pdesc {
|
| 1073 |
struct {
|
| 1074 |
int done;
|
| 1075 |
uid_t uid; |
| 1076 |
gid_t gid; |
| 1077 |
pid_t pid; |
| 1078 |
} lookup; |
| 1079 |
u_int64_t tot_len; /* Make Mickey money */
|
| 1080 |
union {
|
| 1081 |
struct tcphdr *tcp;
|
| 1082 |
struct udphdr *udp;
|
| 1083 |
struct icmp *icmp;
|
| 1084 |
#ifdef INET6
|
| 1085 |
struct icmp6_hdr *icmp6;
|
| 1086 |
#endif /* INET6 */ |
| 1087 |
void *any;
|
| 1088 |
} hdr; |
| 1089 |
struct pf_addr baddr; /* address before translation */ |
| 1090 |
struct pf_addr naddr; /* address after translation */ |
| 1091 |
struct pf_rule *nat_rule; /* nat/rdr rule applied to packet */ |
| 1092 |
struct pf_addr *src;
|
| 1093 |
struct pf_addr *dst;
|
| 1094 |
struct ether_header
|
| 1095 |
*eh; |
| 1096 |
u_int16_t *ip_sum; |
| 1097 |
u_int32_t p_len; /* total length of payload */
|
| 1098 |
u_int16_t flags; /* Let SCRUB trigger behavior in
|
| 1099 |
* state code. Easier than tags */
|
| 1100 |
#define PFDESC_TCP_NORM 0x0001 /* TCP shall be statefully scrubbed */ |
| 1101 |
#define PFDESC_IP_REAS 0x0002 /* IP frags would've been reassembled */ |
| 1102 |
sa_family_t af; |
| 1103 |
u_int8_t proto; |
| 1104 |
u_int8_t tos; |
| 1105 |
}; |
| 1106 |
|
| 1107 |
/* flags for RDR options */
|
| 1108 |
#define PF_DPORT_RANGE 0x01 /* Dest port uses range */ |
| 1109 |
#define PF_RPORT_RANGE 0x02 /* RDR'ed port uses range */ |
| 1110 |
|
| 1111 |
/* Reasons code for passing/dropping a packet */
|
| 1112 |
#define PFRES_MATCH 0 /* Explicit match of a rule */ |
| 1113 |
#define PFRES_BADOFF 1 /* Bad offset for pull_hdr */ |
| 1114 |
#define PFRES_FRAG 2 /* Dropping following fragment */ |
| 1115 |
#define PFRES_SHORT 3 /* Dropping short packet */ |
| 1116 |
#define PFRES_NORM 4 /* Dropping by normalizer */ |
| 1117 |
#define PFRES_MEMORY 5 /* Dropped due to lacking mem */ |
| 1118 |
#define PFRES_TS 6 /* Bad TCP Timestamp (RFC1323) */ |
| 1119 |
#define PFRES_CONGEST 7 /* Congestion (of IP queue) */ |
| 1120 |
#define PFRES_IPOPTIONS 8 /* IP option */ |
| 1121 |
#define PFRES_PROTCKSUM 9 /* Protocol checksum invalid */ |
| 1122 |
#define PFRES_BADSTATE 10 /* State mismatch */ |
| 1123 |
#define PFRES_STATEINS 11 /* State insertion failure */ |
| 1124 |
#define PFRES_MAXSTATES 12 /* State limit */ |
| 1125 |
#define PFRES_SRCLIMIT 13 /* Source node/conn limit */ |
| 1126 |
#define PFRES_SYNPROXY 14 /* SYN proxy */ |
| 1127 |
#define PFRES_STATELOCKED 15 /* state table locked */ |
| 1128 |
#define PFRES_MAX 16 /* total+1 */ |
| 1129 |
|
| 1130 |
#define PFRES_NAMES { \
|
| 1131 |
"match", \
|
| 1132 |
"bad-offset", \
|
| 1133 |
"fragment", \
|
| 1134 |
"short", \
|
| 1135 |
"normalize", \
|
| 1136 |
"memory", \
|
| 1137 |
"bad-timestamp", \
|
| 1138 |
"congestion", \
|
| 1139 |
"ip-option", \
|
| 1140 |
"proto-cksum", \
|
| 1141 |
"state-mismatch", \
|
| 1142 |
"state-insert", \
|
| 1143 |
"state-limit", \
|
| 1144 |
"src-limit", \
|
| 1145 |
"synproxy", \
|
| 1146 |
"state-locked", \
|
| 1147 |
NULL \
|
| 1148 |
} |
| 1149 |
|
| 1150 |
/* Counters for other things we want to keep track of */
|
| 1151 |
#define LCNT_STATES 0 /* states */ |
| 1152 |
#define LCNT_SRCSTATES 1 /* max-src-states */ |
| 1153 |
#define LCNT_SRCNODES 2 /* max-src-nodes */ |
| 1154 |
#define LCNT_SRCCONN 3 /* max-src-conn */ |
| 1155 |
#define LCNT_SRCCONNRATE 4 /* max-src-conn-rate */ |
| 1156 |
#define LCNT_OVERLOAD_TABLE 5 /* entry added to overload table */ |
| 1157 |
#define LCNT_OVERLOAD_FLUSH 6 /* state entries flushed */ |
| 1158 |
#define LCNT_MAX 7 /* total+1 */ |
| 1159 |
|
| 1160 |
#define LCNT_NAMES { \
|
| 1161 |
"max states per rule", \
|
| 1162 |
"max-src-states", \
|
| 1163 |
"max-src-nodes", \
|
| 1164 |
"max-src-conn", \
|
| 1165 |
"max-src-conn-rate", \
|
| 1166 |
"overload table insertion", \
|
| 1167 |
"overload flush states", \
|
| 1168 |
NULL \
|
| 1169 |
} |
| 1170 |
|
| 1171 |
/* UDP state enumeration */
|
| 1172 |
#define PFUDPS_NO_TRAFFIC 0 |
| 1173 |
#define PFUDPS_SINGLE 1 |
| 1174 |
#define PFUDPS_MULTIPLE 2 |
| 1175 |
|
| 1176 |
#define PFUDPS_NSTATES 3 /* number of state levels */ |
| 1177 |
|
| 1178 |
#define PFUDPS_NAMES { \
|
| 1179 |
"NO_TRAFFIC", \
|
| 1180 |
"SINGLE", \
|
| 1181 |
"MULTIPLE", \
|
| 1182 |
NULL \
|
| 1183 |
} |
| 1184 |
|
| 1185 |
/* Other protocol state enumeration */
|
| 1186 |
#define PFOTHERS_NO_TRAFFIC 0 |
| 1187 |
#define PFOTHERS_SINGLE 1 |
| 1188 |
#define PFOTHERS_MULTIPLE 2 |
| 1189 |
|
| 1190 |
#define PFOTHERS_NSTATES 3 /* number of state levels */ |
| 1191 |
|
| 1192 |
#define PFOTHERS_NAMES { \
|
| 1193 |
"NO_TRAFFIC", \
|
| 1194 |
"SINGLE", \
|
| 1195 |
"MULTIPLE", \
|
| 1196 |
NULL \
|
| 1197 |
} |
| 1198 |
|
| 1199 |
#define FCNT_STATE_SEARCH 0 |
| 1200 |
#define FCNT_STATE_INSERT 1 |
| 1201 |
#define FCNT_STATE_REMOVALS 2 |
| 1202 |
#define FCNT_MAX 3 |
| 1203 |
|
| 1204 |
#define SCNT_SRC_NODE_SEARCH 0 |
| 1205 |
#define SCNT_SRC_NODE_INSERT 1 |
| 1206 |
#define SCNT_SRC_NODE_REMOVALS 2 |
| 1207 |
#define SCNT_MAX 3 |
| 1208 |
|
| 1209 |
#define ACTION_SET(a, x) \
|
| 1210 |
do { \
|
| 1211 |
if ((a) != NULL) \ |
| 1212 |
*(a) = (x); \ |
| 1213 |
} while (0) |
| 1214 |
|
| 1215 |
#define REASON_SET(a, x) \
|
| 1216 |
do { \
|
| 1217 |
if ((a) != NULL) \ |
| 1218 |
*(a) = (x); \ |
| 1219 |
if (x < PFRES_MAX) \
|
| 1220 |
pf_status.counters[x]++; \ |
| 1221 |
} while (0) |
| 1222 |
#define REASON_SET_NOPTR(a, x) \
|
| 1223 |
do { \
|
| 1224 |
*(a) = (x); \ |
| 1225 |
if (x < PFRES_MAX) \
|
| 1226 |
pf_status.counters[x]++; \ |
| 1227 |
} while (0) |
| 1228 |
|
| 1229 |
struct pf_status {
|
| 1230 |
u_int64_t counters[PFRES_MAX]; |
| 1231 |
u_int64_t lcounters[LCNT_MAX]; /* limit counters */
|
| 1232 |
u_int64_t fcounters[FCNT_MAX]; |
| 1233 |
u_int64_t scounters[SCNT_MAX]; |
| 1234 |
u_int64_t pcounters[2][2][3]; |
| 1235 |
u_int64_t bcounters[2][2]; |
| 1236 |
u_int64_t stateid; |
| 1237 |
u_int32_t running; |
| 1238 |
u_int32_t states; |
| 1239 |
u_int32_t src_nodes; |
| 1240 |
u_int32_t since; |
| 1241 |
u_int32_t debug; |
| 1242 |
u_int32_t hostid; |
| 1243 |
char ifname[IFNAMSIZ];
|
| 1244 |
u_int8_t pf_chksum[PF_MD5_DIGEST_LENGTH]; |
| 1245 |
}; |
| 1246 |
|
| 1247 |
struct cbq_opts {
|
| 1248 |
u_int minburst; |
| 1249 |
u_int maxburst; |
| 1250 |
u_int pktsize; |
| 1251 |
u_int maxpktsize; |
| 1252 |
u_int ns_per_byte; |
| 1253 |
u_int maxidle; |
| 1254 |
int minidle;
|
| 1255 |
u_int offtime; |
| 1256 |
int flags;
|
| 1257 |
}; |
| 1258 |
|
| 1259 |
struct priq_opts {
|
| 1260 |
int flags;
|
| 1261 |
}; |
| 1262 |
|
| 1263 |
struct hfsc_opts {
|
| 1264 |
/* real-time service curve */
|
| 1265 |
u_int rtsc_m1; /* slope of the 1st segment in bps */
|
| 1266 |
u_int rtsc_d; /* the x-projection of m1 in msec */
|
| 1267 |
u_int rtsc_m2; /* slope of the 2nd segment in bps */
|
| 1268 |
/* link-sharing service curve */
|
| 1269 |
u_int lssc_m1; |
| 1270 |
u_int lssc_d; |
| 1271 |
u_int lssc_m2; |
| 1272 |
/* upper-limit service curve */
|
| 1273 |
u_int ulsc_m1; |
| 1274 |
u_int ulsc_d; |
| 1275 |
u_int ulsc_m2; |
| 1276 |
int flags;
|
| 1277 |
}; |
| 1278 |
|
| 1279 |
struct pf_altq {
|
| 1280 |
char ifname[IFNAMSIZ];
|
| 1281 |
|
| 1282 |
void *altq_disc; /* discipline-specific state */ |
| 1283 |
TAILQ_ENTRY(pf_altq) entries; |
| 1284 |
|
| 1285 |
/* scheduler spec */
|
| 1286 |
u_int8_t scheduler; /* scheduler type */
|
| 1287 |
u_int16_t tbrsize; /* tokenbucket regulator size */
|
| 1288 |
u_int32_t ifbandwidth; /* interface bandwidth */
|
| 1289 |
|
| 1290 |
/* queue spec */
|
| 1291 |
char qname[PF_QNAME_SIZE]; /* queue name */ |
| 1292 |
char parent[PF_QNAME_SIZE]; /* parent name */ |
| 1293 |
u_int32_t parent_qid; /* parent queue id */
|
| 1294 |
u_int32_t bandwidth; /* queue bandwidth */
|
| 1295 |
u_int8_t priority; /* priority */
|
| 1296 |
u_int16_t qlimit; /* queue size limit */
|
| 1297 |
u_int16_t flags; /* misc flags */
|
| 1298 |
union {
|
| 1299 |
struct cbq_opts cbq_opts;
|
| 1300 |
struct priq_opts priq_opts;
|
| 1301 |
struct hfsc_opts hfsc_opts;
|
| 1302 |
} pq_u; |
| 1303 |
|
| 1304 |
u_int32_t qid; /* return value */
|
| 1305 |
}; |
| 1306 |
|
| 1307 |
struct pf_tag {
|
| 1308 |
u_int16_t tag; /* tag id */
|
| 1309 |
}; |
| 1310 |
|
| 1311 |
struct pf_tagname {
|
| 1312 |
TAILQ_ENTRY(pf_tagname) entries; |
| 1313 |
char name[PF_TAG_NAME_SIZE];
|
| 1314 |
u_int16_t tag; |
| 1315 |
int ref;
|
| 1316 |
}; |
| 1317 |
|
| 1318 |
#define PFFRAG_FRENT_HIWAT 5000 /* Number of fragment entries */ |
| 1319 |
#define PFFRAG_FRAG_HIWAT 1000 /* Number of fragmented packets */ |
| 1320 |
#define PFFRAG_FRCENT_HIWAT 50000 /* Number of fragment cache entries */ |
| 1321 |
#define PFFRAG_FRCACHE_HIWAT 10000 /* Number of fragment descriptors */ |
| 1322 |
|
| 1323 |
#define PFR_KTABLE_HIWAT 1000 /* Number of tables */ |
| 1324 |
#define PFR_KENTRY_HIWAT 200000 /* Number of table entries */ |
| 1325 |
#define PFR_KENTRY_HIWAT_SMALL 100000 /* Number of table entries (tiny hosts) */ |
| 1326 |
|
| 1327 |
/*
|
| 1328 |
* ioctl parameter structures
|
| 1329 |
*/
|
| 1330 |
|
| 1331 |
struct pfioc_pooladdr {
|
| 1332 |
u_int32_t action; |
| 1333 |
u_int32_t ticket; |
| 1334 |
u_int32_t nr; |
| 1335 |
u_int32_t r_num; |
| 1336 |
u_int8_t r_action; |
| 1337 |
u_int8_t r_last; |
| 1338 |
u_int8_t af; |
| 1339 |
char anchor[MAXPATHLEN];
|
| 1340 |
struct pf_pooladdr addr;
|
| 1341 |
}; |
| 1342 |
|
| 1343 |
struct pfioc_rule {
|
| 1344 |
u_int32_t action; |
| 1345 |
u_int32_t ticket; |
| 1346 |
u_int32_t pool_ticket; |
| 1347 |
u_int32_t nr; |
| 1348 |
char anchor[MAXPATHLEN];
|
| 1349 |
char anchor_call[MAXPATHLEN];
|
| 1350 |
struct pf_rule rule;
|
| 1351 |
}; |
| 1352 |
|
| 1353 |
struct pfioc_natlook {
|
| 1354 |
struct pf_addr saddr;
|
| 1355 |
struct pf_addr daddr;
|
| 1356 |
struct pf_addr rsaddr;
|
| 1357 |
struct pf_addr rdaddr;
|
| 1358 |
u_int16_t sport; |
| 1359 |
u_int16_t dport; |
| 1360 |
u_int16_t rsport; |
| 1361 |
u_int16_t rdport; |
| 1362 |
sa_family_t af; |
| 1363 |
u_int8_t proto; |
| 1364 |
u_int8_t direction; |
| 1365 |
}; |
| 1366 |
|
| 1367 |
struct pfioc_state {
|
| 1368 |
u_int32_t nr; |
| 1369 |
void *state;
|
| 1370 |
}; |
| 1371 |
|
| 1372 |
struct pfioc_src_node_kill {
|
| 1373 |
/* XXX returns the number of src nodes killed in psnk_af */
|
| 1374 |
sa_family_t psnk_af; |
| 1375 |
struct pf_rule_addr psnk_src;
|
| 1376 |
struct pf_rule_addr psnk_dst;
|
| 1377 |
}; |
| 1378 |
|
| 1379 |
struct pfioc_state_kill {
|
| 1380 |
/* XXX returns the number of states killed in psk_af */
|
| 1381 |
sa_family_t psk_af; |
| 1382 |
int psk_proto;
|
| 1383 |
struct pf_rule_addr psk_src;
|
| 1384 |
struct pf_rule_addr psk_dst;
|
| 1385 |
char psk_ifname[IFNAMSIZ];
|
| 1386 |
}; |
| 1387 |
|
| 1388 |
struct pfioc_states {
|
| 1389 |
int ps_len;
|
| 1390 |
union {
|
| 1391 |
void *psu_buf;
|
| 1392 |
struct pfsync_state *psu_states;
|
| 1393 |
} ps_u; |
| 1394 |
#define ps_buf ps_u.psu_buf
|
| 1395 |
#define ps_states ps_u.psu_states
|
| 1396 |
}; |
| 1397 |
|
| 1398 |
struct pfioc_src_nodes {
|
| 1399 |
int psn_len;
|
| 1400 |
union {
|
| 1401 |
void *psu_buf;
|
| 1402 |
struct pf_src_node *psu_src_nodes;
|
| 1403 |
} psn_u; |
| 1404 |
#define psn_buf psn_u.psu_buf
|
| 1405 |
#define psn_src_nodes psn_u.psu_src_nodes
|
| 1406 |
}; |
| 1407 |
|
| 1408 |
struct pfioc_if {
|
| 1409 |
char ifname[IFNAMSIZ];
|
| 1410 |
}; |
| 1411 |
|
| 1412 |
struct pfioc_tm {
|
| 1413 |
int timeout;
|
| 1414 |
int seconds;
|
| 1415 |
}; |
| 1416 |
|
| 1417 |
struct pfioc_limit {
|
| 1418 |
int index;
|
| 1419 |
unsigned limit;
|
| 1420 |
}; |
| 1421 |
|
| 1422 |
struct pfioc_altq {
|
| 1423 |
u_int32_t action; |
| 1424 |
u_int32_t ticket; |
| 1425 |
u_int32_t nr; |
| 1426 |
struct pf_altq altq;
|
| 1427 |
}; |
| 1428 |
|
| 1429 |
struct pfioc_qstats {
|
| 1430 |
u_int32_t ticket; |
| 1431 |
u_int32_t nr; |
| 1432 |
void *buf;
|
| 1433 |
int nbytes;
|
| 1434 |
u_int8_t scheduler; |
| 1435 |
}; |
| 1436 |
|
| 1437 |
struct pfioc_ruleset {
|
| 1438 |
u_int32_t nr; |
| 1439 |
char path[MAXPATHLEN];
|
| 1440 |
char name[PF_ANCHOR_NAME_SIZE];
|
| 1441 |
}; |
| 1442 |
|
| 1443 |
#define PF_RULESET_ALTQ (PF_RULESET_MAX)
|
| 1444 |
#define PF_RULESET_TABLE (PF_RULESET_MAX+1) |
| 1445 |
struct pfioc_trans {
|
| 1446 |
int size; /* number of elements */ |
| 1447 |
int esize; /* size of each element in bytes */ |
| 1448 |
struct pfioc_trans_e {
|
| 1449 |
int rs_num;
|
| 1450 |
char anchor[MAXPATHLEN];
|
| 1451 |
u_int32_t ticket; |
| 1452 |
} *array; |
| 1453 |
}; |
| 1454 |
|
| 1455 |
#define PFR_FLAG_ATOMIC 0x00000001 |
| 1456 |
#define PFR_FLAG_DUMMY 0x00000002 |
| 1457 |
#define PFR_FLAG_FEEDBACK 0x00000004 |
| 1458 |
#define PFR_FLAG_CLSTATS 0x00000008 |
| 1459 |
#define PFR_FLAG_ADDRSTOO 0x00000010 |
| 1460 |
#define PFR_FLAG_REPLACE 0x00000020 |
| 1461 |
#define PFR_FLAG_ALLRSETS 0x00000040 |
| 1462 |
#define PFR_FLAG_ALLMASK 0x0000007F |
| 1463 |
#ifdef _KERNEL
|
| 1464 |
#define PFR_FLAG_USERIOCTL 0x10000000 |
| 1465 |
#endif
|
| 1466 |
|
| 1467 |
struct pfioc_table {
|
| 1468 |
struct pfr_table pfrio_table;
|
| 1469 |
void *pfrio_buffer;
|
| 1470 |
int pfrio_esize;
|
| 1471 |
int pfrio_size;
|
| 1472 |
int pfrio_size2;
|
| 1473 |
int pfrio_nadd;
|
| 1474 |
int pfrio_ndel;
|
| 1475 |
int pfrio_nchange;
|
| 1476 |
int pfrio_flags;
|
| 1477 |
u_int32_t pfrio_ticket; |
| 1478 |
}; |
| 1479 |
#define pfrio_exists pfrio_nadd
|
| 1480 |
#define pfrio_nzero pfrio_nadd
|
| 1481 |
#define pfrio_nmatch pfrio_nadd
|
| 1482 |
#define pfrio_naddr pfrio_size2
|
| 1483 |
#define pfrio_setflag pfrio_size2
|
| 1484 |
#define pfrio_clrflag pfrio_nadd
|
| 1485 |
|
| 1486 |
struct pfioc_iface {
|
| 1487 |
char pfiio_name[IFNAMSIZ];
|
| 1488 |
void *pfiio_buffer;
|
| 1489 |
int pfiio_esize;
|
| 1490 |
int pfiio_size;
|
| 1491 |
int pfiio_nzero;
|
| 1492 |
int pfiio_flags;
|
| 1493 |
}; |
| 1494 |
|
| 1495 |
|
| 1496 |
/*
|
| 1497 |
* ioctl operations
|
| 1498 |
*/
|
| 1499 |
|
| 1500 |
#define DIOCSTART _IO ('D', 1) |
| 1501 |
#define DIOCSTOP _IO ('D', 2) |
| 1502 |
#define DIOCADDRULE _IOWR('D', 4, struct pfioc_rule) |
| 1503 |
#define DIOCGETRULES _IOWR('D', 6, struct pfioc_rule) |
| 1504 |
#define DIOCGETRULE _IOWR('D', 7, struct pfioc_rule) |
| 1505 |
#define DIOCSETLCK _IOWR('D', 8, uint32_t) |
| 1506 |
/* XXX cut 9 - 17 */
|
| 1507 |
#define DIOCCLRSTATES _IOWR('D', 18, struct pfioc_state_kill) |
| 1508 |
#define DIOCGETSTATE _IOWR('D', 19, struct pfioc_state) |
| 1509 |
#define DIOCSETSTATUSIF _IOWR('D', 20, struct pfioc_if) |
| 1510 |
#define DIOCGETSTATUS _IOWR('D', 21, struct pf_status) |
| 1511 |
#define DIOCCLRSTATUS _IO ('D', 22) |
| 1512 |
#define DIOCNATLOOK _IOWR('D', 23, struct pfioc_natlook) |
| 1513 |
#define DIOCSETDEBUG _IOWR('D', 24, u_int32_t) |
| 1514 |
#define DIOCGETSTATES _IOWR('D', 25, struct pfioc_states) |
| 1515 |
#define DIOCCHANGERULE _IOWR('D', 26, struct pfioc_rule) |
| 1516 |
/* XXX cut 26 - 28 */
|
| 1517 |
#define DIOCSETTIMEOUT _IOWR('D', 29, struct pfioc_tm) |
| 1518 |
#define DIOCGETTIMEOUT _IOWR('D', 30, struct pfioc_tm) |
| 1519 |
#define DIOCADDSTATE _IOWR('D', 37, struct pfioc_state) |
| 1520 |
#define DIOCCLRRULECTRS _IO ('D', 38) |
| 1521 |
#define DIOCGETLIMIT _IOWR('D', 39, struct pfioc_limit) |
| 1522 |
#define DIOCSETLIMIT _IOWR('D', 40, struct pfioc_limit) |
| 1523 |
#define DIOCKILLSTATES _IOWR('D', 41, struct pfioc_state_kill) |
| 1524 |
#define DIOCSTARTALTQ _IO ('D', 42) |
| 1525 |
#define DIOCSTOPALTQ _IO ('D', 43) |
| 1526 |
#define DIOCADDALTQ _IOWR('D', 45, struct pfioc_altq) |
| 1527 |
#define DIOCGETALTQS _IOWR('D', 47, struct pfioc_altq) |
| 1528 |
#define DIOCGETALTQ _IOWR('D', 48, struct pfioc_altq) |
| 1529 |
#define DIOCCHANGEALTQ _IOWR('D', 49, struct pfioc_altq) |
| 1530 |
#define DIOCGETQSTATS _IOWR('D', 50, struct pfioc_qstats) |
| 1531 |
#define DIOCBEGINADDRS _IOWR('D', 51, struct pfioc_pooladdr) |
| 1532 |
#define DIOCADDADDR _IOWR('D', 52, struct pfioc_pooladdr) |
| 1533 |
#define DIOCGETADDRS _IOWR('D', 53, struct pfioc_pooladdr) |
| 1534 |
#define DIOCGETADDR _IOWR('D', 54, struct pfioc_pooladdr) |
| 1535 |
#define DIOCCHANGEADDR _IOWR('D', 55, struct pfioc_pooladdr) |
| 1536 |
#define DIOCADDSTATES _IOWR('D', 56, struct pfioc_states) |
| 1537 |
/* XXX cut 57 - 57 */
|
| 1538 |
#define DIOCGETRULESETS _IOWR('D', 58, struct pfioc_ruleset) |
| 1539 |
#define DIOCGETRULESET _IOWR('D', 59, struct pfioc_ruleset) |
| 1540 |
#define DIOCRCLRTABLES _IOWR('D', 60, struct pfioc_table) |
| 1541 |
#define DIOCRADDTABLES _IOWR('D', 61, struct pfioc_table) |
| 1542 |
#define DIOCRDELTABLES _IOWR('D', 62, struct pfioc_table) |
| 1543 |
#define DIOCRGETTABLES _IOWR('D', 63, struct pfioc_table) |
| 1544 |
#define DIOCRGETTSTATS _IOWR('D', 64, struct pfioc_table) |
| 1545 |
#define DIOCRCLRTSTATS _IOWR('D', 65, struct pfioc_table) |
| 1546 |
#define DIOCRCLRADDRS _IOWR('D', 66, struct pfioc_table) |
| 1547 |
#define DIOCRADDADDRS _IOWR('D', 67, struct pfioc_table) |
| 1548 |
#define DIOCRDELADDRS _IOWR('D', 68, struct pfioc_table) |
| 1549 |
#define DIOCRSETADDRS _IOWR('D', 69, struct pfioc_table) |
| 1550 |
#define DIOCRGETADDRS _IOWR('D', 70, struct pfioc_table) |
| 1551 |
#define DIOCRGETASTATS _IOWR('D', 71, struct pfioc_table) |
| 1552 |
#define DIOCRCLRASTATS _IOWR('D', 72, struct pfioc_table) |
| 1553 |
#define DIOCRTSTADDRS _IOWR('D', 73, struct pfioc_table) |
| 1554 |
#define DIOCRSETTFLAGS _IOWR('D', 74, struct pfioc_table) |
| 1555 |
#define DIOCRINADEFINE _IOWR('D', 77, struct pfioc_table) |
| 1556 |
#define DIOCOSFPFLUSH _IO('D', 78) |
| 1557 |
#define DIOCOSFPADD _IOWR('D', 79, struct pf_osfp_ioctl) |
| 1558 |
#define DIOCOSFPGET _IOWR('D', 80, struct pf_osfp_ioctl) |
| 1559 |
#define DIOCXBEGIN _IOWR('D', 81, struct pfioc_trans) |
| 1560 |
#define DIOCXCOMMIT _IOWR('D', 82, struct pfioc_trans) |
| 1561 |
#define DIOCXROLLBACK _IOWR('D', 83, struct pfioc_trans) |
| 1562 |
#define DIOCGETSRCNODES _IOWR('D', 84, struct pfioc_src_nodes) |
| 1563 |
#define DIOCCLRSRCNODES _IO('D', 85) |
| 1564 |
#define DIOCSETHOSTID _IOWR('D', 86, u_int32_t) |
| 1565 |
#define DIOCIGETIFACES _IOWR('D', 87, struct pfioc_iface) |
| 1566 |
#define DIOCSETIFFLAG _IOWR('D', 89, struct pfioc_iface) |
| 1567 |
#define DIOCCLRIFFLAG _IOWR('D', 90, struct pfioc_iface) |
| 1568 |
#define DIOCKILLSRCNODES _IOWR('D', 91, struct pfioc_src_node_kill) |
| 1569 |
|
| 1570 |
#ifdef _KERNEL
|
| 1571 |
RB_HEAD(pf_src_tree, pf_src_node); |
| 1572 |
RB_PROTOTYPE(pf_src_tree, pf_src_node, entry, pf_src_compare); |
| 1573 |
extern struct pf_src_tree tree_src_tracking; |
| 1574 |
|
| 1575 |
RB_HEAD(pf_state_tree_id, pf_state); |
| 1576 |
RB_PROTOTYPE(pf_state_tree_id, pf_state, |
| 1577 |
entry_id, pf_state_compare_id); |
| 1578 |
extern struct pf_state_tree_id tree_id; |
| 1579 |
extern struct pf_state_queue state_list; |
| 1580 |
|
| 1581 |
TAILQ_HEAD(pf_poolqueue, pf_pool); |
| 1582 |
extern struct pf_poolqueue pf_pools[2]; |
| 1583 |
TAILQ_HEAD(pf_altqqueue, pf_altq); |
| 1584 |
extern struct pf_altqqueue pf_altqs[2]; |
| 1585 |
extern struct pf_palist pf_pabuf; |
| 1586 |
|
| 1587 |
extern u_int32_t ticket_altqs_active;
|
| 1588 |
extern u_int32_t ticket_altqs_inactive;
|
| 1589 |
extern int altqs_inactive_open; |
| 1590 |
extern u_int32_t ticket_pabuf;
|
| 1591 |
extern struct pf_altqqueue *pf_altqs_active; |
| 1592 |
extern struct pf_altqqueue *pf_altqs_inactive; |
| 1593 |
extern struct pf_poolqueue *pf_pools_active; |
| 1594 |
extern struct pf_poolqueue *pf_pools_inactive; |
| 1595 |
extern int pf_tbladdr_setup(struct pf_ruleset *, |
| 1596 |
struct pf_addr_wrap *);
|
| 1597 |
extern void pf_tbladdr_remove(struct pf_addr_wrap *); |
| 1598 |
extern void pf_tbladdr_copyout(struct pf_addr_wrap *); |
| 1599 |
extern void pf_calc_skip_steps(struct pf_rulequeue *); |
| 1600 |
extern struct pool pf_src_tree_pl, pf_rule_pl; |
| 1601 |
extern struct pool pf_state_pl, pf_state_key_pl, pf_altq_pl, |
| 1602 |
pf_pooladdr_pl; |
| 1603 |
extern struct pool pf_state_scrub_pl; |
| 1604 |
extern void pf_purge_thread(void *); |
| 1605 |
extern void pf_purge_expired_src_nodes(int); |
| 1606 |
extern void pf_purge_expired_states(u_int32_t); |
| 1607 |
extern void pf_unlink_state(struct pf_state *); |
| 1608 |
extern void pf_free_state(struct pf_state *); |
| 1609 |
extern int pf_insert_state(struct pfi_kif *, |
| 1610 |
struct pf_state *);
|
| 1611 |
extern int pf_insert_src_node(struct pf_src_node **, |
| 1612 |
struct pf_rule *, struct pf_addr *, |
| 1613 |
sa_family_t); |
| 1614 |
void pf_src_tree_remove_state(struct pf_state *); |
| 1615 |
extern struct pf_state *pf_find_state_byid(struct pf_state_cmp *); |
| 1616 |
extern struct pf_state *pf_find_state_all(struct pf_state_key_cmp *, |
| 1617 |
u_int8_t, int *);
|
| 1618 |
extern void pf_print_state(struct pf_state *); |
| 1619 |
extern void pf_print_flags(u_int8_t); |
| 1620 |
extern u_int16_t pf_cksum_fixup(u_int16_t, u_int16_t, u_int16_t,
|
| 1621 |
u_int8_t); |
| 1622 |
|
| 1623 |
extern struct ifnet *sync_ifp; |
| 1624 |
extern struct pf_rule pf_default_rule; |
| 1625 |
extern void pf_addrcpy(struct pf_addr *, |
| 1626 |
const struct pf_addr *, u_int8_t); |
| 1627 |
void pf_rm_rule(struct pf_rulequeue *, |
| 1628 |
struct pf_rule *);
|
| 1629 |
|
| 1630 |
#ifdef INET
|
| 1631 |
int pf_test(int, struct ifnet *, struct mbuf **, struct ether_header *); |
| 1632 |
#endif /* INET */ |
| 1633 |
|
| 1634 |
#ifdef INET6
|
| 1635 |
int pf_test6(int, struct ifnet *, struct mbuf **, struct ether_header *); |
| 1636 |
void pf_poolmask(struct pf_addr *, struct pf_addr*, |
| 1637 |
struct pf_addr *, const struct pf_addr *, u_int8_t); |
| 1638 |
void pf_addr_inc(struct pf_addr *, sa_family_t); |
| 1639 |
#endif /* INET6 */ |
| 1640 |
|
| 1641 |
void *pf_pull_hdr(struct mbuf *, int, void *, int, u_short *, u_short *, |
| 1642 |
sa_family_t); |
| 1643 |
void pf_change_a(void *, u_int16_t *, u_int32_t, u_int8_t); |
| 1644 |
int pflog_packet(struct pfi_kif *, struct mbuf *, sa_family_t, u_int8_t, |
| 1645 |
u_int8_t, struct pf_rule *, struct pf_rule *, struct pf_ruleset *, |
| 1646 |
struct pf_pdesc *);
|
| 1647 |
int pf_match_addr(u_int8_t, struct pf_addr *, struct pf_addr *, |
| 1648 |
struct pf_addr *, sa_family_t);
|
| 1649 |
int pf_match(u_int8_t, u_int32_t, u_int32_t, u_int32_t);
|
| 1650 |
int pf_match_port(u_int8_t, u_int16_t, u_int16_t, u_int16_t);
|
| 1651 |
int pf_match_uid(u_int8_t, uid_t, uid_t, uid_t);
|
| 1652 |
int pf_match_gid(u_int8_t, gid_t, gid_t, gid_t);
|
| 1653 |
|
| 1654 |
void pf_normalize_init(void); |
| 1655 |
#ifdef _MODULE
|
| 1656 |
void pf_normalize_destroy(void); |
| 1657 |
#endif /* _MODULE */ |
| 1658 |
int pf_normalize_ip(struct mbuf **, int, struct pfi_kif *, u_short *, |
| 1659 |
struct pf_pdesc *);
|
| 1660 |
int pf_normalize_ip6(struct mbuf **, int, struct pfi_kif *, u_short *, |
| 1661 |
struct pf_pdesc *);
|
| 1662 |
int pf_normalize_tcp(int, struct pfi_kif *, struct mbuf *, int, int, void *, |
| 1663 |
struct pf_pdesc *);
|
| 1664 |
void pf_normalize_tcp_cleanup(struct pf_state *); |
| 1665 |
int pf_normalize_tcp_init(struct mbuf *, int, struct pf_pdesc *, |
| 1666 |
struct tcphdr *, struct pf_state_peer *, struct pf_state_peer *); |
| 1667 |
int pf_normalize_tcp_stateful(struct mbuf *, int, struct pf_pdesc *, |
| 1668 |
u_short *, struct tcphdr *, struct pf_state *, |
| 1669 |
struct pf_state_peer *, struct pf_state_peer *, int *); |
| 1670 |
u_int32_t |
| 1671 |
pf_state_expires(const struct pf_state *); |
| 1672 |
void pf_purge_expired_fragments(void); |
| 1673 |
int pf_routable(struct pf_addr *addr, sa_family_t af, struct pfi_kif *); |
| 1674 |
int pf_rtlabel_match(struct pf_addr *, sa_family_t, struct pf_addr_wrap *); |
| 1675 |
int pf_socket_lookup(int, struct pf_pdesc *); |
| 1676 |
struct pf_state_key *
|
| 1677 |
pf_alloc_state_key(struct pf_state *);
|
| 1678 |
void pfr_initialize(void); |
| 1679 |
#ifdef _MODULE
|
| 1680 |
void pfr_destroy(void); |
| 1681 |
#endif /* _MODULE */ |
| 1682 |
int pfr_match_addr(struct pfr_ktable *, struct pf_addr *, sa_family_t); |
| 1683 |
void pfr_update_stats(struct pfr_ktable *, struct pf_addr *, sa_family_t, |
| 1684 |
u_int64_t, int, int, int); |
| 1685 |
int pfr_pool_get(struct pfr_ktable *, int *, struct pf_addr *, |
| 1686 |
struct pf_addr **, struct pf_addr **, sa_family_t); |
| 1687 |
void pfr_dynaddr_update(struct pfr_ktable *, struct pfi_dynaddr *); |
| 1688 |
struct pfr_ktable *
|
| 1689 |
pfr_attach_table(struct pf_ruleset *, char *); |
| 1690 |
void pfr_detach_table(struct pfr_ktable *); |
| 1691 |
int pfr_clr_tables(struct pfr_table *, int *, int); |
| 1692 |
int pfr_add_tables(struct pfr_table *, int, int *, int); |
| 1693 |
int pfr_del_tables(struct pfr_table *, int, int *, int); |
| 1694 |
int pfr_get_tables(struct pfr_table *, struct pfr_table *, int *, int); |
| 1695 |
int pfr_get_tstats(struct pfr_table *, struct pfr_tstats *, int *, int); |
| 1696 |
int pfr_clr_tstats(struct pfr_table *, int, int *, int); |
| 1697 |
int pfr_set_tflags(struct pfr_table *, int, int, int, int *, int *, int); |
| 1698 |
int pfr_clr_addrs(struct pfr_table *, int *, int); |
| 1699 |
int pfr_insert_kentry(struct pfr_ktable *, struct pfr_addr *, long); |
| 1700 |
int pfr_add_addrs(struct pfr_table *, struct pfr_addr *, int, int *, |
| 1701 |
int);
|
| 1702 |
int pfr_del_addrs(struct pfr_table *, struct pfr_addr *, int, int *, |
| 1703 |
int);
|
| 1704 |
int pfr_set_addrs(struct pfr_table *, struct pfr_addr *, int, int *, |
| 1705 |
int *, int *, int *, int, u_int32_t); |
| 1706 |
int pfr_get_addrs(struct pfr_table *, struct pfr_addr *, int *, int); |
| 1707 |
int pfr_get_astats(struct pfr_table *, struct pfr_astats *, int *, int); |
| 1708 |
int pfr_clr_astats(struct pfr_table *, struct pfr_addr *, int, int *, |
| 1709 |
int);
|
| 1710 |
int pfr_tst_addrs(struct pfr_table *, struct pfr_addr *, int, int *, |
| 1711 |
int);
|
| 1712 |
int pfr_ina_begin(struct pfr_table *, u_int32_t *, int *, int); |
| 1713 |
int pfr_ina_rollback(struct pfr_table *, u_int32_t, int *, int); |
| 1714 |
int pfr_ina_commit(struct pfr_table *, u_int32_t, int *, int *, int); |
| 1715 |
int pfr_ina_define(struct pfr_table *, struct pfr_addr *, int, int *, |
| 1716 |
int *, u_int32_t, int); |
| 1717 |
|
| 1718 |
extern struct pfi_kif *pfi_all; |
| 1719 |
|
| 1720 |
void pfi_initialize(void); |
| 1721 |
#ifdef _MODULE
|
| 1722 |
void pfi_destroy(void); |
| 1723 |
#endif /* _MODULE */ |
| 1724 |
struct pfi_kif *pfi_kif_get(const char *); |
| 1725 |
void pfi_kif_ref(struct pfi_kif *, enum pfi_kif_refs); |
| 1726 |
void pfi_kif_unref(struct pfi_kif *, enum pfi_kif_refs); |
| 1727 |
int pfi_kif_match(struct pfi_kif *, struct pfi_kif *); |
| 1728 |
void pfi_attach_ifnet(struct ifnet *); |
| 1729 |
void pfi_detach_ifnet(struct ifnet *); |
| 1730 |
void pfi_attach_ifgroup(struct ifg_group *); |
| 1731 |
void pfi_detach_ifgroup(struct ifg_group *); |
| 1732 |
void pfi_group_change(const char *); |
| 1733 |
int pfi_match_addr(struct pfi_dynaddr *, struct pf_addr *, |
| 1734 |
sa_family_t); |
| 1735 |
int pfi_dynaddr_setup(struct pf_addr_wrap *, sa_family_t); |
| 1736 |
void pfi_dynaddr_remove(struct pf_addr_wrap *); |
| 1737 |
void pfi_dynaddr_copyout(struct pf_addr_wrap *); |
| 1738 |
void pfi_fill_oldstatus(struct pf_status *); |
| 1739 |
int pfi_clr_istats(const char *); |
| 1740 |
int pfi_get_ifaces(const char *, struct pfi_kif *, int *); |
| 1741 |
int pfi_set_flags(const char *, int); |
| 1742 |
int pfi_clear_flags(const char *, int); |
| 1743 |
|
| 1744 |
u_int16_t pf_tagname2tag(char *);
|
| 1745 |
void pf_tag2tagname(u_int16_t, char *); |
| 1746 |
void pf_tag_ref(u_int16_t);
|
| 1747 |
void pf_tag_unref(u_int16_t);
|
| 1748 |
int pf_tag_packet(struct mbuf *, int, int); |
| 1749 |
u_int32_t pf_qname2qid(char *);
|
| 1750 |
void pf_qid2qname(u_int32_t, char *); |
| 1751 |
void pf_qid_unref(u_int32_t);
|
| 1752 |
|
| 1753 |
extern struct pf_status pf_status; |
| 1754 |
extern struct pool pf_frent_pl, pf_frag_pl; |
| 1755 |
#ifdef __NetBSD__
|
| 1756 |
extern krwlock_t pf_consistency_lock;
|
| 1757 |
#else
|
| 1758 |
extern struct rwlock pf_consistency_lock; |
| 1759 |
#endif /* !__NetBSD__ */ |
| 1760 |
|
| 1761 |
struct pf_pool_limit {
|
| 1762 |
void *pp;
|
| 1763 |
unsigned limit;
|
| 1764 |
}; |
| 1765 |
extern struct pf_pool_limit pf_pool_limits[PF_LIMIT_MAX]; |
| 1766 |
|
| 1767 |
/*
|
| 1768 |
* misc compatibility definitions
|
| 1769 |
*/
|
| 1770 |
#if !defined(PRIu32)
|
| 1771 |
#define PRIu32 "u" /* XXX */ |
| 1772 |
#endif
|
| 1773 |
|
| 1774 |
#if !defined(NO_PID)
|
| 1775 |
#define NO_PID (PID_MAX + 1) |
| 1776 |
#endif
|
| 1777 |
|
| 1778 |
#if defined(__NetBSD__)
|
| 1779 |
/* rwlock compatibility definitions */
|
| 1780 |
#define rw_enter_write(a) rw_enter((a), (RW_WRITER))
|
| 1781 |
#define rw_exit_write(a) rw_exit((a))
|
| 1782 |
#define rw_enter_read(a) rw_enter((a), (RW_READER))
|
| 1783 |
#define rw_exit_read(a) rw_exit((a))
|
| 1784 |
#endif /* __NetBSD__ */ |
| 1785 |
|
| 1786 |
#endif /* _KERNEL */ |
| 1787 |
|
| 1788 |
extern struct pf_anchor_global pf_anchors; |
| 1789 |
extern struct pf_anchor pf_main_anchor; |
| 1790 |
#define pf_main_ruleset pf_main_anchor.ruleset
|
| 1791 |
|
| 1792 |
/* these ruleset functions can be linked into userland programs (pfctl) */
|
| 1793 |
int pf_get_ruleset_number(u_int8_t);
|
| 1794 |
void pf_init_ruleset(struct pf_ruleset *); |
| 1795 |
int pf_anchor_setup(struct pf_rule *, |
| 1796 |
const struct pf_ruleset *, const char *); |
| 1797 |
int pf_anchor_copyout(const struct pf_ruleset *, |
| 1798 |
const struct pf_rule *, struct pfioc_rule *); |
| 1799 |
void pf_anchor_remove(struct pf_rule *); |
| 1800 |
void pf_remove_if_empty_ruleset(struct pf_ruleset *); |
| 1801 |
struct pf_anchor *pf_find_anchor(const char *); |
| 1802 |
struct pf_ruleset *pf_find_ruleset(const char *); |
| 1803 |
struct pf_ruleset *pf_find_or_create_ruleset(const char *); |
| 1804 |
void pf_rs_initialize(void); |
| 1805 |
|
| 1806 |
#ifdef _KERNEL
|
| 1807 |
int pf_anchor_copyout(const struct pf_ruleset *, |
| 1808 |
const struct pf_rule *, struct pfioc_rule *); |
| 1809 |
void pf_anchor_remove(struct pf_rule *); |
| 1810 |
|
| 1811 |
#endif /* _KERNEL */ |
| 1812 |
|
| 1813 |
/* The fingerprint functions can be linked into userland programs (tcpdump) */
|
| 1814 |
int pf_osfp_add(struct pf_osfp_ioctl *); |
| 1815 |
#ifdef _KERNEL
|
| 1816 |
struct pf_osfp_enlist *
|
| 1817 |
pf_osfp_fingerprint(struct pf_pdesc *, struct mbuf *, int, |
| 1818 |
const struct tcphdr *); |
| 1819 |
#endif /* _KERNEL */ |
| 1820 |
struct pf_osfp_enlist *
|
| 1821 |
pf_osfp_fingerprint_hdr(const struct ip *, const struct ip6_hdr *, |
| 1822 |
const struct tcphdr *); |
| 1823 |
void pf_osfp_flush(void); |
| 1824 |
int pf_osfp_get(struct pf_osfp_ioctl *); |
| 1825 |
void pf_osfp_initialize(void); |
| 1826 |
#ifdef _MODULE
|
| 1827 |
void pf_osfp_destroy(void); |
| 1828 |
#endif /* _MODULE */ |
| 1829 |
int pf_osfp_match(struct pf_osfp_enlist *, pf_osfp_t); |
| 1830 |
struct pf_os_fingerprint *
|
| 1831 |
pf_osfp_validate(void);
|
| 1832 |
|
| 1833 |
|
| 1834 |
#endif /* _NET_PFVAR_H_ */ |