1/* $NetBSD: pfil.h,v 1.22 2003/06/23 12:57:08 martin Exp $ */
2
3/*-
4 * SPDX-License-Identifier: BSD-3-Clause
5 *
6 * Copyright (c) 2019 Gleb Smirnoff <glebius@FreeBSD.org>
7 * Copyright (c) 1996 Matthew R. Green
8 * All rights reserved.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 * 3. The name of the author may not be used to endorse or promote products
19 * derived from this software without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
27 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34#ifndef _NET_PFIL_H_
35#define _NET_PFIL_H_
36
37#include <sys/ioccom.h>
38
39enum pfil_types {
40 PFIL_TYPE_IP4,
41 PFIL_TYPE_IP6,
42 PFIL_TYPE_ETHERNET,
43};
44
45#define MAXPFILNAME 64
46
47struct pfilioc_head {
48 char pio_name[MAXPFILNAME];
49 int pio_nhooksin;
50 int pio_nhooksout;
51 enum pfil_types pio_type;
52};
53
54struct pfilioc_hook {
55 char pio_module[MAXPFILNAME];
56 char pio_ruleset[MAXPFILNAME];
57 int pio_flags;
58 enum pfil_types pio_type;
59};
60
61struct pfilioc_list {
62 u_int pio_nheads;
63 u_int pio_nhooks;
64 struct pfilioc_head *pio_heads;
65 struct pfilioc_hook *pio_hooks;
66};
67
68struct pfilioc_link {
69 char pio_name[MAXPFILNAME];
70 char pio_module[MAXPFILNAME];
71 char pio_ruleset[MAXPFILNAME];
72 int pio_flags;
73};
74
75#define PFILDEV "pfil"
76#define PFILIOC_LISTHEADS _IOWR('P', 1, struct pfilioc_list)
77#define PFILIOC_LISTHOOKS _IOWR('P', 2, struct pfilioc_list)
78#define PFILIOC_LINK _IOW('P', 3, struct pfilioc_link)
79
80#define PFIL_IN 0x00010000
81#define PFIL_OUT 0x00020000
82#define PFIL_FWD 0x00040000
83#define PFIL_DIR(f) ((f) & (PFIL_IN|PFIL_OUT))
84#define PFIL_HEADPTR 0x00100000
85#define PFIL_HOOKPTR 0x00200000
86#define PFIL_APPEND 0x00400000
87#define PFIL_UNLINK 0x00800000
88
89#ifdef _KERNEL
90struct mbuf;
91struct ifnet;
92struct inpcb;
93
94typedef enum {
95 PFIL_PASS = 0,
96 PFIL_DROPPED,
97 PFIL_CONSUMED,
98 PFIL_REALLOCED,
99} pfil_return_t;
100
101typedef pfil_return_t (*pfil_mbuf_chk_t)(struct mbuf **, struct ifnet *, int,
102 void *, struct inpcb *);
103typedef pfil_return_t (*pfil_mem_chk_t)(void *, u_int, int, struct ifnet *,
104 void *, struct mbuf **);
105
106/*
107 * A pfil head is created by a packet intercept point.
108 *
109 * A pfil hook is created by a packet filter.
110 *
111 * Hooks are chained on heads. Historically some hooking happens
112 * automatically, e.g. ipfw(4), pf(4) and ipfilter(4) would register
113 * theirselves on IPv4 and IPv6 input/output.
114 */
115
116typedef struct pfil_hook * pfil_hook_t;
117typedef struct pfil_head * pfil_head_t;
118
119/*
120 * Give us a chance to modify pfil_xxx_args structures in future.
121 */
122#define PFIL_VERSION 2
123
124/* Argument structure used by packet filters to register themselves. */
125struct pfil_hook_args {
126 int pa_version;
127 int pa_flags;
128 enum pfil_types pa_type;
129 pfil_mbuf_chk_t pa_mbuf_chk;
130 pfil_mem_chk_t pa_mem_chk;
131 void *pa_ruleset;
132 const char *pa_modname;
133 const char *pa_rulname;
134};
135
136/* Public functions for pfil hook management by packet filters. */
137pfil_hook_t pfil_add_hook(struct pfil_hook_args *);
138void pfil_remove_hook(pfil_hook_t);
139
140/* Argument structure used by ioctl() and packet filters to set filters. */
141struct pfil_link_args {
142 int pa_version;
143 int pa_flags;
144 union {
145 const char *pa_headname;
146 pfil_head_t pa_head;
147 };
148 union {
149 struct {
150 const char *pa_modname;
151 const char *pa_rulname;
152 };
153 pfil_hook_t pa_hook;
154 };
155};
156
157/* Public function to configure filter chains. Used by ioctl() and filters. */
158int pfil_link(struct pfil_link_args *);
159
160/* Argument structure used by inspection points to register themselves. */
161struct pfil_head_args {
162 int pa_version;
163 int pa_flags;
164 enum pfil_types pa_type;
165 const char *pa_headname;
166};
167
168/* Public functions for pfil head management by inspection points. */
169pfil_head_t pfil_head_register(struct pfil_head_args *);
170void pfil_head_unregister(pfil_head_t);
171
172/* Public functions to run the packet inspection by inspection points. */
173int pfil_mem_in(struct pfil_head *, void *, u_int, struct ifnet *,
174 struct mbuf **);
175int pfil_mem_out(struct pfil_head *, void *, u_int, struct ifnet *,
176 struct mbuf **);
177int pfil_mbuf_in(struct pfil_head *, struct mbuf **, struct ifnet *,
178 struct inpcb *inp);
179int pfil_mbuf_out(struct pfil_head *, struct mbuf **, struct ifnet *,
180 struct inpcb *inp);
181int pfil_mbuf_fwd(struct pfil_head *, struct mbuf **, struct ifnet *,
182 struct inpcb *);
183
184/*
185 * Minimally exposed structure to avoid function call in case of absence
186 * of any filters by protocols and macros to do the check.
187 */
188struct _pfil_head {
189 int head_nhooksin;
190 int head_nhooksout;
191};
192#define PFIL_HOOKED_IN(p) (((struct _pfil_head *)(p))->head_nhooksin > 0)
193#define PFIL_HOOKED_OUT(p) (((struct _pfil_head *)(p))->head_nhooksout > 0)
194
195#endif /* _KERNEL */
196#endif /* _NET_PFIL_H_ */