1/*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2001 Michael Shalayeff
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR OR HIS RELATIVES BE LIABLE FOR ANY DIRECT,
20 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
21 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
22 * SERVICES; LOSS OF MIND, USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
24 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
25 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
26 * THE POSSIBILITY OF SUCH DAMAGE.
27 */
28
29/*-
30 * Copyright (c) 2008 David Gwynne <dlg@openbsd.org>
31 *
32 * Permission to use, copy, modify, and distribute this software for any
33 * purpose with or without fee is hereby granted, provided that the above
34 * copyright notice and this permission notice appear in all copies.
35 *
36 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
37 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
38 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
39 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
40 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
41 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
42 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
43 */
44
45/*
46 * $OpenBSD: if_pfsync.h,v 1.35 2008/06/29 08:42:15 mcbride Exp $
47 */
48
49#ifndef _NET_IF_PFSYNC_H_
50#define _NET_IF_PFSYNC_H_
51
52#include <sys/types.h>
53
54#include <net/if.h>
55#include <net/pfvar.h>
56#include <netpfil/pf/pf.h>
57
58#define PFSYNC_VERSION 5
59#define PFSYNC_DFLTTL 255
60
61enum pfsync_msg_versions {
62 PFSYNC_MSG_VERSION_UNSPECIFIED = 0,
63 PFSYNC_MSG_VERSION_1301 = 1301,
64 PFSYNC_MSG_VERSION_1400 = 1400,
65 PFSYNC_MSG_VERSION_1500 = 1500,
66};
67
68#define PFSYNC_MSG_VERSION_DEFAULT PFSYNC_MSG_VERSION_1500
69
70#define PFSYNC_ACT_CLR 0 /* clear all states */
71#define PFSYNC_ACT_INS_1301 1 /* insert state */
72#define PFSYNC_ACT_INS_ACK 2 /* ack of inserted state */
73#define PFSYNC_ACT_UPD_1301 3 /* update state */
74#define PFSYNC_ACT_UPD_C 4 /* "compressed" update state */
75#define PFSYNC_ACT_UPD_REQ 5 /* request "uncompressed" state */
76#define PFSYNC_ACT_DEL 6 /* delete state */
77#define PFSYNC_ACT_DEL_C 7 /* "compressed" delete state */
78#define PFSYNC_ACT_INS_F 8 /* insert fragment */
79#define PFSYNC_ACT_DEL_F 9 /* delete fragments */
80#define PFSYNC_ACT_BUS 10 /* bulk update status */
81#define PFSYNC_ACT_TDB 11 /* TDB replay counter update */
82#define PFSYNC_ACT_EOF 12 /* end of frame */
83#define PFSYNC_ACT_INS_1400 13 /* insert state */
84#define PFSYNC_ACT_UPD_1400 14 /* update state */
85#define PFSYNC_ACT_INS_1500 15 /* insert state */
86#define PFSYNC_ACT_UPD_1500 16 /* update state */
87#define PFSYNC_ACT_MAX 17
88
89/*
90 * A pfsync frame is built from a header followed by several sections which
91 * are all prefixed with their own subheaders. Frames must be terminated with
92 * an EOF subheader.
93 *
94 * | ... |
95 * | IP header |
96 * +============================+
97 * | pfsync_header |
98 * +----------------------------+
99 * | pfsync_subheader |
100 * +----------------------------+
101 * | first action fields |
102 * | ... |
103 * +----------------------------+
104 * | pfsync_subheader |
105 * +----------------------------+
106 * | second action fields |
107 * | ... |
108 * +----------------------------+
109 * | EOF pfsync_subheader |
110 * +----------------------------+
111 * | HMAC |
112 * +============================+
113 */
114
115/*
116 * Frame header
117 */
118
119struct pfsync_header {
120 u_int8_t version;
121 u_int8_t _pad;
122 u_int16_t len;
123 u_int8_t pfcksum[PF_MD5_DIGEST_LENGTH];
124} __packed;
125
126/*
127 * Frame region subheader
128 */
129
130struct pfsync_subheader {
131 u_int8_t action;
132 u_int8_t _pad;
133 u_int16_t count;
134} __packed;
135
136/*
137 * CLR
138 */
139
140struct pfsync_clr {
141 char ifname[IFNAMSIZ];
142 u_int32_t creatorid;
143} __packed;
144
145/*
146 * INS, UPD, DEL
147 */
148
149/* these use struct pfsync_state in pfvar.h */
150
151/*
152 * INS_ACK
153 */
154
155struct pfsync_ins_ack {
156 u_int64_t id;
157 u_int32_t creatorid;
158} __packed;
159
160/*
161 * UPD_C
162 */
163
164struct pfsync_upd_c {
165 u_int64_t id;
166 struct pf_state_peer_export src;
167 struct pf_state_peer_export dst;
168 u_int32_t creatorid;
169 u_int32_t expire;
170 u_int8_t timeout;
171 u_int8_t _pad[3];
172} __packed;
173
174/*
175 * UPD_REQ
176 */
177
178struct pfsync_upd_req {
179 u_int64_t id;
180 u_int32_t creatorid;
181} __packed;
182
183/*
184 * DEL_C
185 */
186
187struct pfsync_del_c {
188 u_int64_t id;
189 u_int32_t creatorid;
190} __packed;
191
192/*
193 * INS_F, DEL_F
194 */
195
196/* not implemented (yet) */
197
198/*
199 * BUS
200 */
201
202struct pfsync_bus {
203 u_int32_t creatorid;
204 u_int32_t endtime;
205 u_int8_t status;
206#define PFSYNC_BUS_START 1
207#define PFSYNC_BUS_END 2
208 u_int8_t _pad[3];
209} __packed;
210
211/*
212 * TDB
213 */
214
215struct pfsync_tdb {
216 u_int32_t spi;
217 union sockaddr_union dst;
218 u_int32_t rpl;
219 u_int64_t cur_bytes;
220 u_int8_t sproto;
221 u_int8_t updates;
222 u_int8_t _pad[2];
223} __packed;
224
225#define PFSYNC_HDRLEN sizeof(struct pfsync_header)
226
227struct pfsyncstats {
228 u_int64_t pfsyncs_ipackets; /* total input packets, IPv4 */
229 u_int64_t pfsyncs_ipackets6; /* total input packets, IPv6 */
230 u_int64_t pfsyncs_badif; /* not the right interface */
231 u_int64_t pfsyncs_badttl; /* TTL is not PFSYNC_DFLTTL */
232 u_int64_t pfsyncs_hdrops; /* packets shorter than hdr */
233 u_int64_t pfsyncs_badver; /* bad (incl unsupp) version */
234 u_int64_t pfsyncs_badact; /* bad action */
235 u_int64_t pfsyncs_badlen; /* data length does not match */
236 u_int64_t pfsyncs_badauth; /* bad authentication */
237 u_int64_t pfsyncs_stale; /* stale state */
238 u_int64_t pfsyncs_badval; /* bad values */
239 u_int64_t pfsyncs_badstate; /* insert/lookup failed */
240
241 u_int64_t pfsyncs_opackets; /* total output packets, IPv4 */
242 u_int64_t pfsyncs_opackets6; /* total output packets, IPv6 */
243 u_int64_t pfsyncs_onomem; /* no memory for an mbuf */
244 u_int64_t pfsyncs_oerrors; /* ip output error */
245
246 u_int64_t pfsyncs_iacts[PFSYNC_ACT_MAX];
247 u_int64_t pfsyncs_oacts[PFSYNC_ACT_MAX];
248};
249
250/*
251 * Configuration structure for SIOCSETPFSYNC SIOCGETPFSYNC
252 */
253struct pfsyncreq {
254 char pfsyncr_syncdev[IFNAMSIZ];
255 struct in_addr pfsyncr_syncpeer;
256 int pfsyncr_maxupdates;
257#define PFSYNCF_OK 0x00000001
258#define PFSYNCF_DEFER 0x00000002
259 int pfsyncr_defer;
260};
261
262struct pfsync_kstatus {
263 char syncdev[IFNAMSIZ];
264 struct sockaddr_storage syncpeer;
265 int maxupdates;
266 int version;
267 int flags;
268};
269
270struct pfsyncioc_nv {
271 void *data;
272 size_t len; /* The length of the nvlist data. */
273 size_t size; /* The total size of the data buffer. */
274};
275
276#define SIOCSETPFSYNC _IOW('i', 247, struct ifreq)
277#define SIOCGETPFSYNC _IOWR('i', 248, struct ifreq)
278#define SIOCSETPFSYNCNV _IOW('i', 249, struct ifreq)
279#define SIOCGETPFSYNCNV _IOWR('i', 250, struct ifreq)
280
281#ifdef _KERNEL
282
283/*
284 * this shows where a pf state is with respect to the syncing.
285 * pf_kstate->sync_state
286 */
287#define PFSYNC_S_INS 0x00
288#define PFSYNC_S_IACK 0x01
289#define PFSYNC_S_UPD 0x02
290#define PFSYNC_S_UPD_C 0x03
291#define PFSYNC_S_DEL_C 0x04
292
293#define PFSYNC_S_DEFER 0xfe
294#define PFSYNC_S_NONE 0xff
295
296#define PFSYNC_SI_IOCTL 0x01
297#define PFSYNC_SI_CKSUM 0x02
298#define PFSYNC_SI_ACK 0x04
299
300#endif /* _KERNEL */
301
302#endif /* _NET_IF_PFSYNC_H_ */