1/*
2 * Copyright (C) 2012 by Darren Reed.
3 *
4 * See the IPFILTER.LICENCE file for details on licencing.
5 * Id: ip_fil.h,v 2.170.2.51 2007/10/10 09:48:03 darrenr Exp $
6 */
7
8#ifndef __IP_FIL_H__
9#define __IP_FIL_H__
10
11#include <netinet/in.h>
12
13#include "netinet/ip_compat.h"
14#include "netinet/ipf_rb.h"
15#if NETBSD_GE_REV(104040000)
16# include <sys/callout.h>
17#endif
18#if defined(BSD) && defined(_KERNEL)
19# include <sys/selinfo.h>
20#endif
21
22#ifndef SOLARIS
23# if defined(sun) && defined(__SVR4)
24# define SOLARIS 1
25# else
26# define SOLARIS 0
27# endif
28#endif
29
30#ifndef __P
31# define __P(x) x
32#endif
33
34#define SIOCADAFR _IOW('r', 60, struct ipfobj)
35#define SIOCRMAFR _IOW('r', 61, struct ipfobj)
36#define SIOCSETFF _IOW('r', 62, u_int)
37#define SIOCGETFF _IOR('r', 63, u_int)
38#define SIOCGETFS _IOWR('r', 64, struct ipfobj)
39#define SIOCIPFFL _IOWR('r', 65, int)
40#define SIOCIPFFB _IOR('r', 66, int)
41#define SIOCADIFR _IOW('r', 67, struct ipfobj)
42#define SIOCRMIFR _IOW('r', 68, struct ipfobj)
43#define SIOCSWAPA _IOR('r', 69, u_int)
44#define SIOCINAFR _IOW('r', 70, struct ipfobj)
45#define SIOCINIFR _IOW('r', 71, struct ipfobj)
46#define SIOCFRENB _IOW('r', 72, u_int)
47#define SIOCFRSYN _IOW('r', 73, u_int)
48#define SIOCFRZST _IOWR('r', 74, struct ipfobj)
49#define SIOCZRLST _IOWR('r', 75, struct ipfobj)
50#define SIOCAUTHW _IOWR('r', 76, struct ipfobj)
51#define SIOCAUTHR _IOWR('r', 77, struct ipfobj)
52#define SIOCSTAT1 _IOWR('r', 78, struct ipfobj)
53#define SIOCSTLCK _IOWR('r', 79, u_int)
54#define SIOCSTPUT _IOWR('r', 80, struct ipfobj)
55#define SIOCSTGET _IOWR('r', 81, struct ipfobj)
56#define SIOCSTGSZ _IOWR('r', 82, struct ipfobj)
57#define SIOCSTAT2 _IOWR('r', 83, struct ipfobj)
58#define SIOCSETLG _IOWR('r', 84, int)
59#define SIOCGETLG _IOWR('r', 85, int)
60#define SIOCFUNCL _IOWR('r', 86, struct ipfunc_resolve)
61#define SIOCIPFGETNEXT _IOWR('r', 87, struct ipfobj)
62#define SIOCIPFGET _IOWR('r', 88, struct ipfobj)
63#define SIOCIPFSET _IOWR('r', 89, struct ipfobj)
64#define SIOCIPFL6 _IOWR('r', 90, int)
65#define SIOCIPFITER _IOWR('r', 91, struct ipfobj)
66#define SIOCGENITER _IOWR('r', 92, struct ipfobj)
67#define SIOCGTABL _IOWR('r', 93, struct ipfobj)
68#define SIOCIPFDELTOK _IOWR('r', 94, int)
69#define SIOCLOOKUPITER _IOWR('r', 95, struct ipfobj)
70#define SIOCGTQTAB _IOWR('r', 96, struct ipfobj)
71#define SIOCMATCHFLUSH _IOWR('r', 97, struct ipfobj)
72#define SIOCIPFINTERROR _IOR('r', 98, int)
73#define SIOCADDFR SIOCADAFR
74#define SIOCDELFR SIOCRMAFR
75#define SIOCINSFR SIOCINAFR
76#define SIOCATHST SIOCSTAT1
77#define SIOCGFRST SIOCSTAT2
78
79
80struct ipscan;
81struct ifnet;
82struct ipf_main_softc_s;
83
84typedef int (* lookupfunc_t)(struct ipf_main_softc_s *, void *,
85 int, void *, u_int);
86
87/*
88 * i6addr is used as a container for both IPv4 and IPv6 addresses, as well
89 * as other types of objects, depending on its qualifier.
90 */
91typedef union i6addr {
92 u_32_t i6[4];
93 struct in_addr in4;
94#ifdef USE_INET6
95 struct in6_addr in6;
96#endif
97 void *vptr[2];
98 lookupfunc_t lptr[2];
99 struct {
100 u_short type;
101 u_short subtype;
102 int name;
103 } i6un;
104} i6addr_t;
105
106#define in4_addr in4.s_addr
107#define iplookupnum i6[1]
108#define iplookupname i6un.name
109#define iplookuptype i6un.type
110#define iplookupsubtype i6un.subtype
111/*
112 * NOTE: These DO overlap the above on 64bit systems and this IS recognised.
113 */
114#define iplookupptr vptr[0]
115#define iplookupfunc lptr[1]
116
117#define I60(x) (((u_32_t *)(x))[0])
118#define I61(x) (((u_32_t *)(x))[1])
119#define I62(x) (((u_32_t *)(x))[2])
120#define I63(x) (((u_32_t *)(x))[3])
121#define HI60(x) ntohl(((u_32_t *)(x))[0])
122#define HI61(x) ntohl(((u_32_t *)(x))[1])
123#define HI62(x) ntohl(((u_32_t *)(x))[2])
124#define HI63(x) ntohl(((u_32_t *)(x))[3])
125
126#define IP6_EQ(a,b) ((I63(a) == I63(b)) && (I62(a) == I62(b)) && \
127 (I61(a) == I61(b)) && (I60(a) == I60(b)))
128#define IP6_NEQ(a,b) ((I63(a) != I63(b)) || (I62(a) != I62(b)) || \
129 (I61(a) != I61(b)) || (I60(a) != I60(b)))
130#define IP6_ISZERO(a) ((I60(a) | I61(a) | I62(a) | I63(a)) == 0)
131#define IP6_NOTZERO(a) ((I60(a) | I61(a) | I62(a) | I63(a)) != 0)
132#define IP6_ISONES(a) ((I63(a) == 0xffffffff) && (I62(a) == 0xffffffff) && \
133 (I61(a) == 0xffffffff) && (I60(a) == 0xffffffff))
134#define IP6_GT(a,b) (ntohl(HI60(a)) > ntohl(HI60(b)) || \
135 (HI60(a) == HI60(b) && \
136 (ntohl(HI61(a)) > ntohl(HI61(b)) || \
137 (HI61(a) == HI61(b) && \
138 (ntohl(HI62(a)) > ntohl(HI62(b)) || \
139 (HI62(a) == HI62(b) && \
140 ntohl(HI63(a)) > ntohl(HI63(b))))))))
141#define IP6_LT(a,b) (ntohl(HI60(a)) < ntohl(HI60(b)) || \
142 (HI60(a) == HI60(b) && \
143 (ntohl(HI61(a)) < ntohl(HI61(b)) || \
144 (HI61(a) == HI61(b) && \
145 (ntohl(HI62(a)) < ntohl(HI62(b)) || \
146 (HI62(a) == HI62(b) && \
147 ntohl(HI63(a)) < ntohl(HI63(b))))))))
148#define NLADD(n,x) htonl(ntohl(n) + (x))
149#define IP6_INC(a) \
150 do { u_32_t *_i6 = (u_32_t *)(a); \
151 _i6[3] = NLADD(_i6[3], 1); \
152 if (_i6[3] == 0) { \
153 _i6[2] = NLADD(_i6[2], 1); \
154 if (_i6[2] == 0) { \
155 _i6[1] = NLADD(_i6[1], 1); \
156 if (_i6[1] == 0) { \
157 _i6[0] = NLADD(_i6[0], 1); \
158 } \
159 } \
160 } \
161 } while (0)
162#define IP6_ADD(a,x,d) \
163 do { i6addr_t *_s = (i6addr_t *)(a); \
164 i6addr_t *_d = (i6addr_t *)(d); \
165 _d->i6[0] = NLADD(_s->i6[0], x); \
166 if (ntohl(_d->i6[0]) < ntohl(_s->i6[0])) { \
167 _d->i6[1] = NLADD(_d->i6[1], 1); \
168 if (ntohl(_d->i6[1]) < ntohl(_s->i6[1])) { \
169 _d->i6[2] = NLADD(_d->i6[2], 1); \
170 if (ntohl(_d->i6[2]) < ntohl(_s->i6[2])) { \
171 _d->i6[3] = NLADD(_d->i6[3], 1); \
172 } \
173 } \
174 } \
175 } while (0)
176#define IP6_AND(a,b,d) do { i6addr_t *_s1 = (i6addr_t *)(a); \
177 i6addr_t *_s2 = (i6addr_t *)(b); \
178 i6addr_t *_d = (i6addr_t *)(d); \
179 _d->i6[0] = _s1->i6[0] & _s2->i6[0]; \
180 _d->i6[1] = _s1->i6[1] & _s2->i6[1]; \
181 _d->i6[2] = _s1->i6[2] & _s2->i6[2]; \
182 _d->i6[3] = _s1->i6[3] & _s2->i6[3]; \
183 } while (0)
184#define IP6_ANDASSIGN(a,m) \
185 do { i6addr_t *_d = (i6addr_t *)(a); \
186 i6addr_t *_m = (i6addr_t *)(m); \
187 _d->i6[0] &= _m->i6[0]; \
188 _d->i6[1] &= _m->i6[1]; \
189 _d->i6[2] &= _m->i6[2]; \
190 _d->i6[3] &= _m->i6[3]; \
191 } while (0)
192#define IP6_MASKEQ(a,m,b) \
193 (((I60(a) & I60(m)) == I60(b)) && \
194 ((I61(a) & I61(m)) == I61(b)) && \
195 ((I62(a) & I62(m)) == I62(b)) && \
196 ((I63(a) & I63(m)) == I63(b)))
197#define IP6_MASKNEQ(a,m,b) \
198 (((I60(a) & I60(m)) != I60(b)) || \
199 ((I61(a) & I61(m)) != I61(b)) || \
200 ((I62(a) & I62(m)) != I62(b)) || \
201 ((I63(a) & I63(m)) != I63(b)))
202#define IP6_MERGE(a,b,c) \
203 do { i6addr_t *_d, *_s1, *_s2; \
204 _d = (i6addr_t *)(a); \
205 _s1 = (i6addr_t *)(b); \
206 _s2 = (i6addr_t *)(c); \
207 _d->i6[0] |= _s1->i6[0] & ~_s2->i6[0]; \
208 _d->i6[1] |= _s1->i6[1] & ~_s2->i6[1]; \
209 _d->i6[2] |= _s1->i6[2] & ~_s2->i6[2]; \
210 _d->i6[3] |= _s1->i6[3] & ~_s2->i6[3]; \
211 } while (0)
212#define IP6_MASK(a,b,c) \
213 do { i6addr_t *_d, *_s1, *_s2; \
214 _d = (i6addr_t *)(a); \
215 _s1 = (i6addr_t *)(b); \
216 _s2 = (i6addr_t *)(c); \
217 _d->i6[0] = _s1->i6[0] & ~_s2->i6[0]; \
218 _d->i6[1] = _s1->i6[1] & ~_s2->i6[1]; \
219 _d->i6[2] = _s1->i6[2] & ~_s2->i6[2]; \
220 _d->i6[3] = _s1->i6[3] & ~_s2->i6[3]; \
221 } while (0)
222#define IP6_SETONES(a) \
223 do { i6addr_t *_d = (i6addr_t *)(a); \
224 _d->i6[0] = 0xffffffff; \
225 _d->i6[1] = 0xffffffff; \
226 _d->i6[2] = 0xffffffff; \
227 _d->i6[3] = 0xffffffff; \
228 } while (0)
229
230typedef union ipso_u {
231 u_short ipso_ripso[2];
232 u_32_t ipso_doi;
233} ipso_t;
234
235typedef struct fr_ip {
236 u_32_t fi_v:4; /* IP version */
237 u_32_t fi_xx:4; /* spare */
238 u_32_t fi_tos:8; /* IP packet TOS */
239 u_32_t fi_ttl:8; /* IP packet TTL */
240 u_32_t fi_p:8; /* IP packet protocol */
241 u_32_t fi_optmsk; /* bitmask composed from IP options */
242 i6addr_t fi_src; /* source address from packet */
243 i6addr_t fi_dst; /* destination address from packet */
244 ipso_t fi_ipso; /* IP security options */
245 u_32_t fi_flx; /* packet flags */
246 u_32_t fi_tcpmsk; /* TCP options set/reset */
247 u_32_t fi_ports[2]; /* TCP ports */
248 u_char fi_tcpf; /* TCP flags */
249 u_char fi_sensitivity;
250 u_char fi_xxx[2]; /* pad */
251} fr_ip_t;
252
253/*
254 * For use in fi_flx
255 */
256#define FI_TCPUDP 0x0001 /* TCP/UCP implied comparison*/
257#define FI_OPTIONS 0x0002
258#define FI_FRAG 0x0004
259#define FI_SHORT 0x0008
260#define FI_NATED 0x0010
261#define FI_MULTICAST 0x0020
262#define FI_BROADCAST 0x0040
263#define FI_MBCAST 0x0080
264#define FI_STATE 0x0100
265#define FI_BADNAT 0x0200
266#define FI_BAD 0x0400
267#define FI_OOW 0x0800 /* Out of state window, else match */
268#define FI_ICMPERR 0x1000
269#define FI_FRAGBODY 0x2000
270#define FI_BADSRC 0x4000
271#define FI_LOWTTL 0x8000
272#define FI_CMP 0x5cfe3 /* Not FI_FRAG,FI_NATED,FI_FRAGTAIL */
273#define FI_ICMPCMP 0x0003 /* Flags we can check for ICMP error packets */
274#define FI_WITH 0x5effe /* Not FI_TCPUDP */
275#define FI_V6EXTHDR 0x10000
276#define FI_COALESCE 0x20000
277#define FI_NEWNAT 0x40000
278#define FI_ICMPQUERY 0x80000
279#define FI_ENCAP 0x100000 /* encap/decap with NAT */
280#define FI_AH 0x200000 /* AH header present */
281#define FI_DOCKSUM 0x10000000 /* Proxy wants L4 recalculation */
282#define FI_NOCKSUM 0x20000000 /* don't do a L4 checksum validation */
283#define FI_NOWILD 0x40000000 /* Do not do wildcard searches */
284#define FI_IGNORE 0x80000000
285
286#define fi_secmsk fi_ipso.ipso_ripso[0]
287#define fi_auth fi_ipso.ipso_ripso[1]
288#define fi_doi fi_ipso.ipso_doi
289#define fi_saddr fi_src.in4.s_addr
290#define fi_daddr fi_dst.in4.s_addr
291#define fi_srcnum fi_src.iplookupnum
292#define fi_dstnum fi_dst.iplookupnum
293#define fi_srcname fi_src.iplookupname
294#define fi_dstname fi_dst.iplookupname
295#define fi_srctype fi_src.iplookuptype
296#define fi_dsttype fi_dst.iplookuptype
297#define fi_srcsubtype fi_src.iplookupsubtype
298#define fi_dstsubtype fi_dst.iplookupsubtype
299#define fi_srcptr fi_src.iplookupptr
300#define fi_dstptr fi_dst.iplookupptr
301#define fi_srcfunc fi_src.iplookupfunc
302#define fi_dstfunc fi_dst.iplookupfunc
303
304
305/*
306 * These are both used by the state and NAT code to indicate that one port or
307 * the other should be treated as a wildcard.
308 * NOTE: When updating, check bit masks in ip_state.h and update there too.
309 */
310#define SI_W_SPORT 0x00000100
311#define SI_W_DPORT 0x00000200
312#define SI_WILDP (SI_W_SPORT|SI_W_DPORT)
313#define SI_W_SADDR 0x00000400
314#define SI_W_DADDR 0x00000800
315#define SI_WILDA (SI_W_SADDR|SI_W_DADDR)
316#define SI_NEWFR 0x00001000
317#define SI_CLONE 0x00002000
318#define SI_CLONED 0x00004000
319#define SI_NEWCLONE 0x00008000
320
321typedef struct {
322 u_short fda_ports[2];
323 u_char fda_tcpf; /* TCP header flags (SYN, ACK, etc) */
324} frdat_t;
325
326typedef enum fr_breasons_e {
327 FRB_BLOCKED = 0,
328 FRB_LOGFAIL = 1,
329 FRB_PPSRATE = 2,
330 FRB_JUMBO = 3,
331 FRB_MAKEFRIP = 4,
332 FRB_STATEADD = 5,
333 FRB_UPDATEIPID = 6,
334 FRB_LOGFAIL2 = 7,
335 FRB_DECAPFRIP = 8,
336 FRB_AUTHNEW = 9,
337 FRB_AUTHCAPTURE = 10,
338 FRB_COALESCE = 11,
339 FRB_PULLUP = 12,
340 FRB_AUTHFEEDBACK = 13,
341 FRB_BADFRAG = 14,
342 FRB_NATV4 = 15,
343 FRB_NATV6 = 16,
344} fr_breason_t;
345
346#define FRB_MAX_VALUE 16
347
348typedef enum ipf_cksum_e {
349 FI_CK_BAD = -1,
350 FI_CK_NEEDED = 0,
351 FI_CK_SUMOK = 1,
352 FI_CK_L4PART = 2,
353 FI_CK_L4FULL = 4
354} ipf_cksum_t;
355
356typedef struct fr_info {
357 void *fin_main_soft;
358#ifdef __FreeBSD__
359 struct ifnet *fin_ifp; /* interface packet is `on' */
360#else
361 void *fin_ifp; /* interface packet is `on' */
362#endif
363 struct frentry *fin_fr; /* last matching rule */
364 int fin_out; /* in or out ? 1 == out, 0 == in */
365 fr_ip_t fin_fi; /* IP Packet summary */
366 frdat_t fin_dat; /* TCP/UDP ports, ICMP code/type */
367 int fin_dlen; /* length of data portion of packet */
368 int fin_plen;
369 u_32_t fin_rule; /* rule # last matched */
370 u_short fin_hlen; /* length of IP header in bytes */
371 char fin_group[FR_GROUPLEN]; /* group number, -1 for none */
372 void *fin_dp; /* start of data past IP header */
373 /*
374 * Fields after fin_dp aren't used for compression of log records.
375 * fin_fi contains the IP version (fin_family)
376 * fin_rule isn't included because adding a new rule can change it but
377 * not change fin_fr. fin_rule is the rule number reported.
378 * It isn't necessary to include fin_crc because that is checked
379 * for explicitly, before calling bcmp.
380 */
381 u_32_t fin_crc; /* Simple calculation for logging */
382 int fin_family; /* AF_INET, etc. */
383 int fin_icode; /* ICMP error to return */
384 int fin_mtu; /* MTU input for ICMP need-frag */
385 int fin_rev; /* state only: 1 = reverse */
386 int fin_ipoff; /* # bytes from buffer start to hdr */
387 u_32_t fin_id; /* IP packet id field */
388 u_short fin_l4hlen; /* length of L4 header, if known */
389 u_short fin_off;
390 int fin_depth; /* Group nesting depth */
391 int fin_error; /* Error code to return */
392 ipf_cksum_t fin_cksum; /* -1 = bad, 1 = good, 0 = not done */
393 fr_breason_t fin_reason; /* why auto blocked */
394 u_int fin_pktnum;
395 void *fin_nattag;
396 struct frdest *fin_dif;
397 struct frdest *fin_tif;
398 union {
399 ip_t *fip_ip;
400#ifdef USE_INET6
401 ip6_t *fip_ip6;
402#endif
403 } fin_ipu;
404 mb_t **fin_mp; /* pointer to pointer to mbuf */
405 mb_t *fin_m; /* pointer to mbuf */
406#if SOLARIS
407 mb_t *fin_qfm; /* pointer to mblk where pkt starts */
408 void *fin_qpi;
409 char fin_ifname[LIFNAMSIZ];
410#endif
411 void *fin_fraghdr; /* pointer to start of ipv6 frag hdr */
412} fr_info_t;
413
414#define fin_ip fin_ipu.fip_ip
415#define fin_ip6 fin_ipu.fip_ip6
416#define fin_v fin_fi.fi_v
417#define fin_p fin_fi.fi_p
418#define fin_flx fin_fi.fi_flx
419#define fin_optmsk fin_fi.fi_optmsk
420#define fin_secmsk fin_fi.fi_secmsk
421#define fin_doi fin_fi.fi_doi
422#define fin_auth fin_fi.fi_auth
423#define fin_src fin_fi.fi_src.in4
424#define fin_saddr fin_fi.fi_saddr
425#define fin_dst fin_fi.fi_dst.in4
426#define fin_daddr fin_fi.fi_daddr
427#define fin_data fin_fi.fi_ports
428#define fin_sport fin_fi.fi_ports[0]
429#define fin_dport fin_fi.fi_ports[1]
430#define fin_tcpf fin_fi.fi_tcpf
431#define fin_src6 fin_fi.fi_src
432#define fin_dst6 fin_fi.fi_dst
433#define fin_srcip6 fin_fi.fi_src.in6
434#define fin_dstip6 fin_fi.fi_dst.in6
435
436#define IPF_IN 0
437#define IPF_OUT 1
438
439typedef struct frentry *(*ipfunc_t)(fr_info_t *, u_32_t *);
440typedef int (*ipfuncinit_t)(struct ipf_main_softc_s *, struct frentry *);
441
442typedef struct ipfunc_resolve {
443 char ipfu_name[32];
444 ipfunc_t ipfu_addr;
445 ipfuncinit_t ipfu_init;
446 ipfuncinit_t ipfu_fini;
447} ipfunc_resolve_t;
448
449/*
450 * Size for compares on fr_info structures
451 */
452#define FI_CSIZE offsetof(fr_info_t, fin_icode)
453#define FI_LCSIZE offsetof(fr_info_t, fin_dp)
454
455/*
456 * Size for copying cache fr_info structure
457 */
458#define FI_COPYSIZE offsetof(fr_info_t, fin_dp)
459
460/*
461 * Structure for holding IPFilter's tag information
462 */
463#define IPFTAG_LEN 16
464typedef struct {
465 union {
466 u_32_t iptu_num[4];
467 char iptu_tag[IPFTAG_LEN];
468 } ipt_un;
469 int ipt_not;
470} ipftag_t;
471
472#define ipt_tag ipt_un.iptu_tag
473#define ipt_num ipt_un.iptu_num
474
475/*
476 * Structure to define address for pool lookups.
477 */
478typedef struct {
479 u_char adf_len;
480 sa_family_t adf_family;
481 u_char adf_xxx[2];
482 i6addr_t adf_addr;
483} addrfamily_t;
484
485
486RBI_LINK(ipf_rb, host_node_s);
487
488typedef struct host_node_s {
489 RBI_FIELD(ipf_rb) hn_entry;
490 addrfamily_t hn_addr;
491 int hn_active;
492} host_node_t;
493
494typedef RBI_HEAD(ipf_rb, host_node_s) ipf_rb_head_t;
495
496typedef struct host_track_s {
497 ipf_rb_head_t ht_root;
498 int ht_max_nodes;
499 int ht_max_per_node;
500 int ht_netmask;
501 int ht_cur_nodes;
502} host_track_t;
503
504
505typedef enum fr_dtypes_e {
506 FRD_NORMAL = 0,
507 FRD_DSTLIST
508} fr_dtypes_t;
509/*
510 * This structure is used to hold information about the next hop for where
511 * to forward a packet.
512 */
513typedef struct frdest {
514 void *fd_ptr;
515 addrfamily_t fd_addr;
516 fr_dtypes_t fd_type;
517 int fd_name;
518} frdest_t;
519
520#define fd_ip6 fd_addr.adf_addr
521#define fd_ip fd_ip6.in4
522
523
524typedef enum fr_ctypes_e {
525 FR_NONE = 0,
526 FR_EQUAL,
527 FR_NEQUAL,
528 FR_LESST,
529 FR_GREATERT,
530 FR_LESSTE,
531 FR_GREATERTE,
532 FR_OUTRANGE,
533 FR_INRANGE,
534 FR_INCRANGE
535} fr_ctypes_t;
536
537/*
538 * This structure holds information about a port comparison.
539 */
540typedef struct frpcmp {
541 fr_ctypes_t frp_cmp; /* data for port comparisons */
542 u_32_t frp_port; /* low port for <> and >< */
543 u_32_t frp_top; /* high port for <> and >< */
544} frpcmp_t;
545
546
547/*
548 * Structure containing all the relevant TCP/UDP things that can be checked in
549 * a filter rule.
550 */
551typedef struct frtuc {
552 u_char ftu_tcpfm; /* tcp flags mask */
553 u_char ftu_tcpf; /* tcp flags */
554 frpcmp_t ftu_src; /* source port */
555 frpcmp_t ftu_dst; /* destination port */
556} frtuc_t;
557
558#define ftu_scmp ftu_src.frp_cmp
559#define ftu_dcmp ftu_dst.frp_cmp
560#define ftu_sport ftu_src.frp_port
561#define ftu_dport ftu_dst.frp_port
562#define ftu_stop ftu_src.frp_top
563#define ftu_dtop ftu_dst.frp_top
564
565#define FR_TCPFMAX 0x3f
566
567typedef enum fr_atypes_e {
568 FRI_NONE = -1, /* For LHS of NAT */
569 FRI_NORMAL = 0, /* Normal address */
570 FRI_DYNAMIC, /* dynamic address */
571 FRI_LOOKUP, /* address is a pool # */
572 FRI_RANGE, /* address/mask is a range */
573 FRI_NETWORK, /* network address from if */
574 FRI_BROADCAST, /* broadcast address from if */
575 FRI_PEERADDR, /* Peer address for P-to-P */
576 FRI_NETMASKED, /* network address with netmask from if */
577 FRI_SPLIT, /* For NAT compatibility */
578 FRI_INTERFACE /* address is based on interface name */
579} fr_atypes_t;
580
581/*
582 * This structure makes up what is considered to be the IPFilter specific
583 * matching components of a filter rule, as opposed to the data structures
584 * used to define the result which are in frentry_t and not here.
585 */
586typedef struct fripf {
587 fr_ip_t fri_ip;
588 fr_ip_t fri_mip; /* mask structure */
589
590 u_short fri_icmpm; /* data for ICMP packets (mask) */
591 u_short fri_icmp;
592
593 frtuc_t fri_tuc;
594 fr_atypes_t fri_satype; /* address type */
595 fr_atypes_t fri_datype; /* address type */
596 int fri_sifpidx; /* doing dynamic addressing */
597 int fri_difpidx; /* index into fr_ifps[] to use when */
598} fripf_t;
599
600#define fri_dlookup fri_mip.fi_dst
601#define fri_slookup fri_mip.fi_src
602#define fri_dstnum fri_mip.fi_dstnum
603#define fri_srcnum fri_mip.fi_srcnum
604#define fri_dstname fri_mip.fi_dstname
605#define fri_srcname fri_mip.fi_srcname
606#define fri_dstptr fri_mip.fi_dstptr
607#define fri_srcptr fri_mip.fi_srcptr
608
609
610typedef enum fr_rtypes_e {
611 FR_T_NONE = 0,
612 FR_T_IPF, /* IPF structures */
613 FR_T_BPFOPC, /* BPF opcode */
614 FR_T_CALLFUNC, /* callout to function in fr_func only */
615 FR_T_COMPIPF, /* compiled C code */
616 FR_T_IPFEXPR, /* IPF expression */
617 FR_T_BUILTIN = 0x40000000, /* rule is in kernel space */
618 FR_T_IPF_BUILTIN,
619 FR_T_BPFOPC_BUILTIN,
620 FR_T_CALLFUNC_BUILTIN,
621 FR_T_COMPIPF_BUILTIN,
622 FR_T_IPFEXPR_BUILTIN
623} fr_rtypes_t;
624
625typedef struct frentry * (* frentfunc_t)(fr_info_t *);
626
627typedef struct frentry {
628 ipfmutex_t fr_lock;
629 struct frentry *fr_next;
630 struct frentry **fr_pnext;
631 struct frgroup *fr_grp;
632 struct frgroup *fr_grphead;
633 struct frgroup *fr_icmpgrp;
634 struct ipscan *fr_isc;
635 struct frentry *fr_dnext; /* 2 fr_die linked list pointers */
636 struct frentry **fr_pdnext;
637 void *fr_ifas[4];
638 void *fr_ptr; /* for use with fr_arg */
639 int fr_comment; /* text comment for rule */
640 int fr_size; /* size of this structure */
641 int fr_ref; /* reference count */
642 int fr_statecnt; /* state count - for limit rules */
643 u_32_t fr_die; /* only used on loading the rule */
644 u_int fr_cksum; /* checksum on filter rules for performance */
645 /*
646 * The line number from a file is here because we need to be able to
647 * match the rule generated with ``grep rule ipf.conf | ipf -rf -''
648 * with the rule loaded using ``ipf -f ipf.conf'' - thus it can't be
649 * on the other side of fr_func.
650 */
651 int fr_flineno; /* line number from conf file */
652 /*
653 * These are only incremented when a packet matches this rule and
654 * it is the last match
655 */
656 U_QUAD_T fr_hits;
657 U_QUAD_T fr_bytes;
658
659 /*
660 * For PPS rate limiting
661 * fr_lpu is used to always have the same size for this field,
662 * allocating 64bits for seconds and 32bits for milliseconds.
663 */
664 union {
665 struct timeval frp_lastpkt;
666 char frp_bytes[12];
667 } fr_lpu;
668 int fr_curpps;
669
670 union {
671 void *fru_data;
672 char *fru_caddr;
673 fripf_t *fru_ipf;
674 frentfunc_t fru_func;
675 } fr_dun;
676
677 /*
678 * Fields after this may not change whilst in the kernel.
679 */
680 ipfunc_t fr_func; /* call this function */
681 int fr_dsize;
682 int fr_pps;
683 fr_rtypes_t fr_type;
684 u_32_t fr_flags; /* per-rule flags && options (see below) */
685 u_32_t fr_logtag; /* user defined log tag # */
686 u_32_t fr_collect; /* collection number */
687 u_int fr_arg; /* misc. numeric arg for rule */
688 u_int fr_loglevel; /* syslog log facility + priority */
689 u_char fr_family;
690 u_char fr_icode; /* return ICMP code */
691 int fr_group; /* group to which this rule belongs */
692 int fr_grhead; /* group # which this rule starts */
693 int fr_isctag;
694 int fr_rpc; /* XID Filtering */
695 ipftag_t fr_nattag;
696 /*
697 * These are all options related to stateful filtering
698 */
699 host_track_t fr_srctrack;
700 int fr_nostatelog;
701 int fr_statemax; /* max reference count */
702 int fr_icmphead; /* ICMP group for state options */
703 u_int fr_age[2]; /* non-TCP state timeouts */
704 /*
705 * These are compared separately.
706 */
707 int fr_ifnames[4];
708 frdest_t fr_tifs[2]; /* "to"/"reply-to" interface */
709 frdest_t fr_dif; /* duplicate packet interface */
710 /*
711 * How big is the name buffer at the end?
712 */
713 int fr_namelen;
714 char fr_names[1];
715} frentry_t;
716
717#define fr_lastpkt fr_lpu.frp_lastpkt
718#define fr_caddr fr_dun.fru_caddr
719#define fr_data fr_dun.fru_data
720#define fr_dfunc fr_dun.fru_func
721#define fr_ipf fr_dun.fru_ipf
722#define fr_ip fr_ipf->fri_ip
723#define fr_mip fr_ipf->fri_mip
724#define fr_icmpm fr_ipf->fri_icmpm
725#define fr_icmp fr_ipf->fri_icmp
726#define fr_tuc fr_ipf->fri_tuc
727#define fr_satype fr_ipf->fri_satype
728#define fr_datype fr_ipf->fri_datype
729#define fr_sifpidx fr_ipf->fri_sifpidx
730#define fr_difpidx fr_ipf->fri_difpidx
731#define fr_proto fr_ip.fi_p
732#define fr_mproto fr_mip.fi_p
733#define fr_ttl fr_ip.fi_ttl
734#define fr_mttl fr_mip.fi_ttl
735#define fr_tos fr_ip.fi_tos
736#define fr_mtos fr_mip.fi_tos
737#define fr_tcpfm fr_tuc.ftu_tcpfm
738#define fr_tcpf fr_tuc.ftu_tcpf
739#define fr_scmp fr_tuc.ftu_scmp
740#define fr_dcmp fr_tuc.ftu_dcmp
741#define fr_dport fr_tuc.ftu_dport
742#define fr_sport fr_tuc.ftu_sport
743#define fr_stop fr_tuc.ftu_stop
744#define fr_dtop fr_tuc.ftu_dtop
745#define fr_dst fr_ip.fi_dst.in4
746#define fr_dst6 fr_ip.fi_dst
747#define fr_daddr fr_ip.fi_dst.in4.s_addr
748#define fr_src fr_ip.fi_src.in4
749#define fr_src6 fr_ip.fi_src
750#define fr_saddr fr_ip.fi_src.in4.s_addr
751#define fr_dmsk fr_mip.fi_dst.in4
752#define fr_dmsk6 fr_mip.fi_dst
753#define fr_dmask fr_mip.fi_dst.in4.s_addr
754#define fr_smsk fr_mip.fi_src.in4
755#define fr_smsk6 fr_mip.fi_src
756#define fr_smask fr_mip.fi_src.in4.s_addr
757#define fr_dstnum fr_ip.fi_dstnum
758#define fr_srcnum fr_ip.fi_srcnum
759#define fr_dlookup fr_ip.fi_dst
760#define fr_slookup fr_ip.fi_src
761#define fr_dstname fr_ip.fi_dstname
762#define fr_srcname fr_ip.fi_srcname
763#define fr_dsttype fr_ip.fi_dsttype
764#define fr_srctype fr_ip.fi_srctype
765#define fr_dstsubtype fr_ip.fi_dstsubtype
766#define fr_srcsubtype fr_ip.fi_srcsubtype
767#define fr_dstptr fr_mip.fi_dstptr
768#define fr_srcptr fr_mip.fi_srcptr
769#define fr_dstfunc fr_mip.fi_dstfunc
770#define fr_srcfunc fr_mip.fi_srcfunc
771#define fr_optbits fr_ip.fi_optmsk
772#define fr_optmask fr_mip.fi_optmsk
773#define fr_secbits fr_ip.fi_secmsk
774#define fr_secmask fr_mip.fi_secmsk
775#define fr_authbits fr_ip.fi_auth
776#define fr_authmask fr_mip.fi_auth
777#define fr_doi fr_ip.fi_doi
778#define fr_doimask fr_mip.fi_doi
779#define fr_flx fr_ip.fi_flx
780#define fr_mflx fr_mip.fi_flx
781#define fr_ifa fr_ifas[0]
782#define fr_oifa fr_ifas[2]
783#define fr_tif fr_tifs[0]
784#define fr_rif fr_tifs[1]
785
786#define FR_NOLOGTAG 0
787
788#define FR_CMPSIZ (offsetof(struct frentry, fr_ifnames) - \
789 offsetof(struct frentry, fr_func))
790#define FR_NAME(_f, _n) (_f)->fr_names + (_f)->_n
791#define FR_NUM(_a) (sizeof(_a) / sizeof(*_a))
792
793
794/*
795 * fr_flags
796 */
797#define FR_BLOCK 0x00001 /* do not allow packet to pass */
798#define FR_PASS 0x00002 /* allow packet to pass */
799#define FR_AUTH 0x00003 /* use authentication */
800#define FR_PREAUTH 0x00004 /* require preauthentication */
801#define FR_ACCOUNT 0x00005 /* Accounting rule */
802#define FR_SKIP 0x00006 /* skip rule */
803#define FR_DECAPSULATE 0x00008 /* decapsulate rule */
804#define FR_CALL 0x00009 /* call rule */
805#define FR_CMDMASK 0x0000f
806#define FR_LOG 0x00010 /* Log */
807#define FR_LOGB 0x00011 /* Log-fail */
808#define FR_LOGP 0x00012 /* Log-pass */
809#define FR_LOGMASK (FR_LOG|FR_CMDMASK)
810#define FR_CALLNOW 0x00020 /* call another function (fr_func) if matches */
811#define FR_NOTSRCIP 0x00040
812#define FR_NOTDSTIP 0x00080
813#define FR_QUICK 0x00100 /* match & stop processing list */
814#define FR_KEEPFRAG 0x00200 /* keep fragment information */
815#define FR_KEEPSTATE 0x00400 /* keep `connection' state information */
816#define FR_FASTROUTE 0x00800 /* bypass normal routing */
817#define FR_RETRST 0x01000 /* Return TCP RST packet - reset connection */
818#define FR_RETICMP 0x02000 /* Return ICMP unreachable packet */
819#define FR_FAKEICMP 0x03000 /* Return ICMP unreachable with fake source */
820#define FR_OUTQUE 0x04000 /* outgoing packets */
821#define FR_INQUE 0x08000 /* ingoing packets */
822#define FR_LOGBODY 0x10000 /* Log the body */
823#define FR_LOGFIRST 0x20000 /* Log the first byte if state held */
824#define FR_LOGORBLOCK 0x40000 /* block the packet if it can't be logged */
825#define FR_STLOOSE 0x80000 /* loose state checking */
826#define FR_FRSTRICT 0x100000 /* strict frag. cache */
827#define FR_STSTRICT 0x200000 /* strict keep state */
828#define FR_NEWISN 0x400000 /* new ISN for outgoing TCP */
829#define FR_NOICMPERR 0x800000 /* do not match ICMP errors in state */
830#define FR_STATESYNC 0x1000000 /* synchronize state to slave */
831#define FR_COPIED 0x2000000 /* copied from user space */
832#define FR_INACTIVE 0x4000000 /* only used when flush'ing rules */
833#define FR_NOMATCH 0x8000000 /* no match occurred */
834 /* 0x10000000 FF_LOGPASS */
835 /* 0x20000000 FF_LOGBLOCK */
836 /* 0x40000000 FF_LOGNOMATCH */
837 /* 0x80000000 FF_BLOCKNONIP */
838
839#define FR_RETMASK (FR_RETICMP|FR_RETRST|FR_FAKEICMP)
840#define FR_ISBLOCK(x) (((x) & FR_CMDMASK) == FR_BLOCK)
841#define FR_ISPASS(x) (((x) & FR_CMDMASK) == FR_PASS)
842#define FR_ISAUTH(x) (((x) & FR_CMDMASK) == FR_AUTH)
843#define FR_ISPREAUTH(x) (((x) & FR_CMDMASK) == FR_PREAUTH)
844#define FR_ISACCOUNT(x) (((x) & FR_CMDMASK) == FR_ACCOUNT)
845#define FR_ISSKIP(x) (((x) & FR_CMDMASK) == FR_SKIP)
846#define FR_ISDECAPS(x) (((x) & FR_CMDMASK) == FR_DECAPSULATE)
847#define FR_ISNOMATCH(x) ((x) & FR_NOMATCH)
848#define FR_INOUT (FR_INQUE|FR_OUTQUE)
849
850/*
851 * recognized flags for SIOCGETFF and SIOCSETFF, and get put in fr_flags
852 */
853#define FF_LOGPASS 0x10000000
854#define FF_LOGBLOCK 0x20000000
855#define FF_LOGNOMATCH 0x40000000
856#define FF_LOGGING (FF_LOGPASS|FF_LOGBLOCK|FF_LOGNOMATCH)
857#define FF_BLOCKNONIP 0x80000000 /* Solaris2 Only */
858
859
860/*
861 * Structure that passes information on what/how to flush to the kernel.
862 */
863typedef struct ipfflush {
864 int ipflu_how;
865 int ipflu_arg;
866} ipfflush_t;
867
868
869/*
870 *
871 */
872typedef struct ipfgetctl {
873 u_int ipfg_min; /* min value */
874 u_int ipfg_current; /* current value */
875 u_int ipfg_max; /* max value */
876 u_int ipfg_default; /* default value */
877 u_int ipfg_steps; /* value increments */
878 char ipfg_name[40]; /* tag name for this control */
879} ipfgetctl_t;
880
881typedef struct ipfsetctl {
882 int ipfs_which; /* 0 = min 1 = current 2 = max 3 = default */
883 u_int ipfs_value; /* min value */
884 char ipfs_name[40]; /* tag name for this control */
885} ipfsetctl_t;
886
887
888/*
889 * Some of the statistics below are in their own counters, but most are kept
890 * in this single structure so that they can all easily be collected and
891 * copied back as required.
892 */
893typedef struct ipf_statistics {
894 u_long fr_icmp_coalesce;
895 u_long fr_tcp_frag;
896 u_long fr_tcp_pullup;
897 u_long fr_tcp_short;
898 u_long fr_tcp_small;
899 u_long fr_tcp_bad_flags;
900 u_long fr_udp_pullup;
901 u_long fr_ip_freed;
902 u_long fr_v6_ah_bad;
903 u_long fr_v6_bad;
904 u_long fr_v6_badfrag;
905 u_long fr_v6_dst_bad;
906 u_long fr_v6_esp_pullup;
907 u_long fr_v6_ext_short;
908 u_long fr_v6_ext_pullup;
909 u_long fr_v6_ext_hlen;
910 u_long fr_v6_frag_bad;
911 u_long fr_v6_frag_pullup;
912 u_long fr_v6_frag_size;
913 u_long fr_v6_gre_pullup;
914 u_long fr_v6_icmp6_pullup;
915 u_long fr_v6_rh_bad;
916 u_long fr_v6_badttl; /* TTL in packet doesn't reach minimum */
917 u_long fr_v4_ah_bad;
918 u_long fr_v4_ah_pullup;
919 u_long fr_v4_esp_pullup;
920 u_long fr_v4_cipso_bad;
921 u_long fr_v4_cipso_tlen;
922 u_long fr_v4_gre_frag;
923 u_long fr_v4_gre_pullup;
924 u_long fr_v4_icmp_frag;
925 u_long fr_v4_icmp_pullup;
926 u_long fr_v4_badttl; /* TTL in packet doesn't reach minimum */
927 u_long fr_v4_badsrc; /* source received doesn't match route */
928 u_long fr_l4_badcksum; /* layer 4 header checksum failure */
929 u_long fr_badcoalesces;
930 u_long fr_pass; /* packets allowed */
931 u_long fr_block; /* packets denied */
932 u_long fr_nom; /* packets which don't match any rule */
933 u_long fr_short; /* packets which are short */
934 u_long fr_ppkl; /* packets allowed and logged */
935 u_long fr_bpkl; /* packets denied and logged */
936 u_long fr_npkl; /* packets unmatched and logged */
937 u_long fr_ret; /* packets for which a return is sent */
938 u_long fr_acct; /* packets for which counting was performed */
939 u_long fr_bnfr; /* bad attempts to allocate fragment state */
940 u_long fr_nfr; /* new fragment state kept */
941 u_long fr_cfr; /* add new fragment state but complete pkt */
942 u_long fr_bads; /* bad attempts to allocate packet state */
943 u_long fr_ads; /* new packet state kept */
944 u_long fr_chit; /* cached hit */
945 u_long fr_cmiss; /* cached miss */
946 u_long fr_tcpbad; /* TCP checksum check failures */
947 u_long fr_pull[2]; /* good and bad pullup attempts */
948 u_long fr_bad; /* bad IP packets to the filter */
949 u_long fr_ipv6; /* IPv6 packets in/out */
950 u_long fr_ppshit; /* dropped because of pps ceiling */
951 u_long fr_ipud; /* IP id update failures */
952 u_long fr_blocked[FRB_MAX_VALUE + 1];
953} ipf_statistics_t;
954
955/*
956 * Log structure. Each packet header logged is prepended by one of these.
957 * Following this in the log records read from the device will be an ipflog
958 * structure which is then followed by any packet data.
959 */
960typedef struct iplog {
961 u_32_t ipl_magic;
962 u_int ipl_count;
963 u_32_t ipl_seqnum;
964 struct timeval ipl_time;
965 size_t ipl_dsize;
966 struct iplog *ipl_next;
967} iplog_t;
968
969#define ipl_sec ipl_time.tv_sec
970#define ipl_usec ipl_time.tv_usec
971
972#define IPL_MAGIC 0x49504c4d /* 'IPLM' */
973#define IPL_MAGIC_NAT 0x49504c4e /* 'IPLN' */
974#define IPL_MAGIC_STATE 0x49504c53 /* 'IPLS' */
975#define IPLOG_SIZE sizeof(iplog_t)
976
977typedef struct ipflog {
978 u_int fl_unit;
979 u_32_t fl_rule;
980 u_32_t fl_flags;
981 u_32_t fl_lflags;
982 u_32_t fl_logtag;
983 ipftag_t fl_nattag;
984 u_short fl_plen; /* extra data after hlen */
985 u_short fl_loglevel; /* syslog log level */
986 char fl_group[FR_GROUPLEN];
987 u_char fl_hlen; /* length of IP headers saved */
988 u_char fl_dir;
989 u_char fl_breason; /* from fin_reason */
990 u_char fl_family; /* address family of packet logged */
991 char fl_ifname[LIFNAMSIZ];
992} ipflog_t;
993
994#ifndef IPF_LOGGING
995# define IPF_LOGGING 0
996#endif
997#ifndef IPF_DEFAULT_PASS
998# define IPF_DEFAULT_PASS FR_PASS
999#endif
1000
1001#define DEFAULT_IPFLOGSIZE 32768
1002#ifndef IPFILTER_LOGSIZE
1003# define IPFILTER_LOGSIZE DEFAULT_IPFLOGSIZE
1004#else
1005# if IPFILTER_LOGSIZE < 8192
1006# error IPFILTER_LOGSIZE too small. Must be >= 8192
1007# endif
1008#endif
1009
1010#define IPF_OPTCOPY 0x07ff00 /* bit mask of copied options */
1011
1012/*
1013 * Device filenames for reading log information. Use ipf on Solaris2 because
1014 * ipl is already a name used by something else.
1015 */
1016#ifndef IPL_NAME
1017# if SOLARIS
1018# define IPL_NAME "/dev/ipf"
1019# else
1020# define IPL_NAME "/dev/ipl"
1021# endif
1022#endif
1023/*
1024 * Pathnames for various IP Filter control devices. Used by LKM
1025 * and userland, so defined here.
1026 */
1027#define IPNAT_NAME "/dev/ipnat"
1028#define IPSTATE_NAME "/dev/ipstate"
1029#define IPAUTH_NAME "/dev/ipauth"
1030#define IPSYNC_NAME "/dev/ipsync"
1031#define IPSCAN_NAME "/dev/ipscan"
1032#define IPLOOKUP_NAME "/dev/iplookup"
1033
1034#define IPL_LOGIPF 0 /* Minor device #'s for accessing logs */
1035#define IPL_LOGNAT 1
1036#define IPL_LOGSTATE 2
1037#define IPL_LOGAUTH 3
1038#define IPL_LOGSYNC 4
1039#define IPL_LOGSCAN 5
1040#define IPL_LOGLOOKUP 6
1041#define IPL_LOGCOUNT 7
1042#define IPL_LOGMAX 7
1043#define IPL_LOGSIZE IPL_LOGMAX + 1
1044#define IPL_LOGALL -1
1045#define IPL_LOGNONE -2
1046
1047/*
1048 * For SIOCGETFS
1049 */
1050typedef struct friostat {
1051 ipf_statistics_t f_st[2];
1052 frentry_t *f_ipf[2][2];
1053 frentry_t *f_acct[2][2];
1054 frentry_t *f_auth;
1055 struct frgroup *f_groups[IPL_LOGSIZE][2];
1056 u_long f_froute[2];
1057 u_long f_log_ok;
1058 u_long f_log_fail;
1059 u_long f_rb_no_mem;
1060 u_long f_rb_node_max;
1061 u_32_t f_ticks;
1062 int f_locks[IPL_LOGSIZE];
1063 int f_defpass; /* default pass - from fr_pass */
1064 int f_active; /* 1 or 0 - active rule set */
1065 int f_running; /* 1 if running, else 0 */
1066 int f_logging; /* 1 if enabled, else 0 */
1067 int f_features;
1068 char f_version[32]; /* version string */
1069} friostat_t;
1070
1071#define f_fin f_ipf[0]
1072#define f_fout f_ipf[1]
1073#define f_acctin f_acct[0]
1074#define f_acctout f_acct[1]
1075
1076#define IPF_FEAT_LKM 0x001
1077#define IPF_FEAT_LOG 0x002
1078#define IPF_FEAT_LOOKUP 0x004
1079#define IPF_FEAT_BPF 0x008
1080#define IPF_FEAT_COMPILED 0x010
1081#define IPF_FEAT_CKSUM 0x020
1082#define IPF_FEAT_SYNC 0x040
1083#define IPF_FEAT_SCAN 0x080
1084#define IPF_FEAT_IPV6 0x100
1085
1086typedef struct optlist {
1087 u_short ol_val;
1088 int ol_bit;
1089} optlist_t;
1090
1091
1092/*
1093 * Group list structure.
1094 */
1095typedef struct frgroup {
1096 struct frgroup *fg_next;
1097 struct frentry *fg_head;
1098 struct frentry *fg_start;
1099 struct frgroup **fg_set;
1100 u_32_t fg_flags;
1101 int fg_ref;
1102 char fg_name[FR_GROUPLEN];
1103} frgroup_t;
1104
1105#define FG_NAME(g) (*(g)->fg_name == '\0' ? "" : (g)->fg_name)
1106
1107
1108/*
1109 * Used by state and NAT tables
1110 */
1111typedef struct icmpinfo {
1112 u_short ici_id;
1113 u_short ici_seq;
1114 u_char ici_type;
1115} icmpinfo_t;
1116
1117typedef struct udpinfo {
1118 u_short us_sport;
1119 u_short us_dport;
1120} udpinfo_t;
1121
1122
1123typedef struct tcpdata {
1124 u_32_t td_end;
1125 u_32_t td_maxend;
1126 u_32_t td_maxwin;
1127 u_32_t td_winscale;
1128 u_32_t td_maxseg;
1129 int td_winflags;
1130} tcpdata_t;
1131
1132#define TCP_WSCALE_MAX 14
1133
1134#define TCP_WSCALE_SEEN 0x00000001
1135#define TCP_WSCALE_FIRST 0x00000002
1136#define TCP_SACK_PERMIT 0x00000004
1137
1138
1139typedef struct tcpinfo {
1140 u_32_t ts_sport;
1141 u_32_t ts_dport;
1142 tcpdata_t ts_data[2];
1143} tcpinfo_t;
1144
1145
1146/*
1147 * Structures to define a GRE header as seen in a packet.
1148 */
1149struct grebits {
1150#if defined(sparc)
1151 u_32_t grb_ver:3;
1152 u_32_t grb_flags:3;
1153 u_32_t grb_A:1;
1154 u_32_t grb_recur:1;
1155 u_32_t grb_s:1;
1156 u_32_t grb_S:1;
1157 u_32_t grb_K:1;
1158 u_32_t grb_R:1;
1159 u_32_t grb_C:1;
1160#else
1161 u_32_t grb_C:1;
1162 u_32_t grb_R:1;
1163 u_32_t grb_K:1;
1164 u_32_t grb_S:1;
1165 u_32_t grb_s:1;
1166 u_32_t grb_recur:1;
1167 u_32_t grb_A:1;
1168 u_32_t grb_flags:3;
1169 u_32_t grb_ver:3;
1170#endif
1171 u_short grb_ptype;
1172};
1173
1174typedef struct grehdr {
1175 union {
1176 struct grebits gru_bits;
1177 u_short gru_flags;
1178 } gr_un;
1179 u_short gr_len;
1180 u_short gr_call;
1181} grehdr_t;
1182
1183#define gr_flags gr_un.gru_flags
1184#define gr_bits gr_un.gru_bits
1185#define gr_ptype gr_bits.grb_ptype
1186#define gr_C gr_bits.grb_C
1187#define gr_R gr_bits.grb_R
1188#define gr_K gr_bits.grb_K
1189#define gr_S gr_bits.grb_S
1190#define gr_s gr_bits.grb_s
1191#define gr_recur gr_bits.grb_recur
1192#define gr_A gr_bits.grb_A
1193#define gr_ver gr_bits.grb_ver
1194
1195/*
1196 * GRE information tracked by "keep state"
1197 */
1198typedef struct greinfo {
1199 u_short gs_call[2];
1200 u_short gs_flags;
1201 u_short gs_ptype;
1202} greinfo_t;
1203
1204#define GRE_REV(x) ((ntohs(x) >> 13) & 7)
1205
1206
1207/*
1208 * Format of an Authentication header
1209 */
1210typedef struct authhdr {
1211 u_char ah_next;
1212 u_char ah_plen;
1213 u_short ah_reserved;
1214 u_32_t ah_spi;
1215 u_32_t ah_seq;
1216 /* Following the sequence number field is 0 or more bytes of */
1217 /* authentication data, as specified by ah_plen - RFC 2402. */
1218} authhdr_t;
1219
1220
1221/*
1222 * Timeout tail queue list member
1223 */
1224typedef struct ipftqent {
1225 struct ipftqent **tqe_pnext;
1226 struct ipftqent *tqe_next;
1227 struct ipftq *tqe_ifq;
1228 void *tqe_parent; /* pointer back to NAT/state struct */
1229 u_32_t tqe_die; /* when this entriy is to die */
1230 u_32_t tqe_touched;
1231 int tqe_flags;
1232 int tqe_state[2]; /* current state of this entry */
1233} ipftqent_t;
1234
1235#define TQE_RULEBASED 0x00000001
1236#define TQE_DELETE 0x00000002
1237
1238
1239/*
1240 * Timeout tail queue head for IPFilter
1241 */
1242typedef struct ipftq {
1243 ipfmutex_t ifq_lock;
1244 u_int ifq_ttl;
1245 ipftqent_t *ifq_head;
1246 ipftqent_t **ifq_tail;
1247 struct ipftq *ifq_next;
1248 struct ipftq **ifq_pnext;
1249 int ifq_ref;
1250 u_int ifq_flags;
1251} ipftq_t;
1252
1253#define IFQF_USER 0x01 /* User defined aging */
1254#define IFQF_DELETE 0x02 /* Marked for deletion */
1255#define IFQF_PROXY 0x04 /* Timeout queue in use by a proxy */
1256
1257#define IPFTQ_INIT(x,y,z) do { \
1258 (x)->ifq_ttl = (y); \
1259 (x)->ifq_head = NULL; \
1260 (x)->ifq_ref = 1; \
1261 (x)->ifq_tail = &(x)->ifq_head; \
1262 MUTEX_INIT(&(x)->ifq_lock, (z)); \
1263 } while (0)
1264
1265#define IPF_HZ_MULT 1
1266#define IPF_HZ_DIVIDE 2 /* How many times a second ipfilter */
1267 /* checks its timeout queues. */
1268#define IPF_TTLVAL(x) (((x) / IPF_HZ_MULT) * IPF_HZ_DIVIDE)
1269
1270typedef int (*ipftq_delete_fn_t)(struct ipf_main_softc_s *, void *);
1271
1272
1273/*
1274 * Object structure description. For passing through in ioctls.
1275 */
1276typedef struct ipfobj {
1277 u_32_t ipfo_rev; /* IPFilter version number */
1278 u_32_t ipfo_size; /* size of object at ipfo_ptr */
1279 void *ipfo_ptr; /* pointer to object */
1280 int ipfo_type; /* type of object being pointed to */
1281 int ipfo_offset; /* bytes from ipfo_ptr where to start */
1282 int ipfo_retval; /* return value */
1283 u_char ipfo_xxxpad[28]; /* reserved for future use */
1284} ipfobj_t;
1285
1286#define IPFOBJ_FRENTRY 0 /* struct frentry */
1287#define IPFOBJ_IPFSTAT 1 /* struct friostat */
1288#define IPFOBJ_IPFINFO 2 /* struct fr_info */
1289#define IPFOBJ_AUTHSTAT 3 /* struct fr_authstat */
1290#define IPFOBJ_FRAGSTAT 4 /* struct ipfrstat */
1291#define IPFOBJ_IPNAT 5 /* struct ipnat */
1292#define IPFOBJ_NATSTAT 6 /* struct natstat */
1293#define IPFOBJ_STATESAVE 7 /* struct ipstate_save */
1294#define IPFOBJ_NATSAVE 8 /* struct nat_save */
1295#define IPFOBJ_NATLOOKUP 9 /* struct natlookup */
1296#define IPFOBJ_IPSTATE 10 /* struct ipstate */
1297#define IPFOBJ_STATESTAT 11 /* struct ips_stat */
1298#define IPFOBJ_FRAUTH 12 /* struct frauth */
1299#define IPFOBJ_TUNEABLE 13 /* struct ipftune */
1300#define IPFOBJ_NAT 14 /* struct nat */
1301#define IPFOBJ_IPFITER 15 /* struct ipfruleiter */
1302#define IPFOBJ_GENITER 16 /* struct ipfgeniter */
1303#define IPFOBJ_GTABLE 17 /* struct ipftable */
1304#define IPFOBJ_LOOKUPITER 18 /* struct ipflookupiter */
1305#define IPFOBJ_STATETQTAB 19 /* struct ipftq * NSTATES */
1306#define IPFOBJ_IPFEXPR 20
1307#define IPFOBJ_PROXYCTL 21 /* strct ap_ctl */
1308#define IPFOBJ_FRIPF 22 /* structfripf */
1309#define IPFOBJ_COUNT 23 /* How many #defines are above this? */
1310
1311
1312typedef union ipftunevalptr {
1313 void *ipftp_void;
1314 u_long *ipftp_long;
1315 u_int *ipftp_int;
1316 u_short *ipftp_short;
1317 u_char *ipftp_char;
1318 u_long ipftp_offset;
1319} ipftunevalptr_t;
1320
1321typedef union ipftuneval {
1322 u_long ipftu_long;
1323 u_int ipftu_int;
1324 u_short ipftu_short;
1325 u_char ipftu_char;
1326} ipftuneval_t;
1327
1328struct ipftuneable;
1329typedef int (* ipftunefunc_t)(struct ipf_main_softc_s *, struct ipftuneable *, ipftuneval_t *);
1330
1331typedef struct ipftuneable {
1332 ipftunevalptr_t ipft_una;
1333 const char *ipft_name;
1334 u_long ipft_min;
1335 u_long ipft_max;
1336 int ipft_sz;
1337 int ipft_flags;
1338 struct ipftuneable *ipft_next;
1339 ipftunefunc_t ipft_func;
1340} ipftuneable_t;
1341
1342#define ipft_addr ipft_una.ipftp_void
1343#define ipft_plong ipft_una.ipftp_long
1344#define ipft_pint ipft_una.ipftp_int
1345#define ipft_pshort ipft_una.ipftp_short
1346#define ipft_pchar ipft_una.ipftp_char
1347
1348#define IPFT_RDONLY 1 /* read-only */
1349#define IPFT_WRDISABLED 2 /* write when disabled only */
1350
1351typedef struct ipftune {
1352 void *ipft_cookie;
1353 ipftuneval_t ipft_un;
1354 u_long ipft_min;
1355 u_long ipft_max;
1356 int ipft_sz;
1357 int ipft_flags;
1358 char ipft_name[80];
1359} ipftune_t;
1360
1361#define ipft_vlong ipft_un.ipftu_long
1362#define ipft_vint ipft_un.ipftu_int
1363#define ipft_vshort ipft_un.ipftu_short
1364#define ipft_vchar ipft_un.ipftu_char
1365
1366/*
1367 * Hash table header
1368 */
1369#define IPFHASH(x,y) typedef struct { \
1370 ipfrwlock_t ipfh_lock; \
1371 struct x *ipfh_head; \
1372 } y
1373
1374/*
1375** HPUX Port
1376*/
1377
1378#if !defined(CDEV_MAJOR) && defined (__FreeBSD__)
1379# define CDEV_MAJOR 79
1380#endif
1381
1382#ifdef _KERNEL
1383# define FR_VERBOSE(verb_pr)
1384# define FR_DEBUG(verb_pr)
1385#else
1386extern void ipfkdebug(char *, ...);
1387extern void ipfkverbose(char *, ...);
1388# define FR_VERBOSE(verb_pr) ipfkverbose verb_pr
1389# define FR_DEBUG(verb_pr) ipfkdebug verb_pr
1390#endif
1391
1392/*
1393 *
1394 */
1395typedef struct ipfruleiter {
1396 int iri_inout;
1397 char iri_group[FR_GROUPLEN];
1398 int iri_active;
1399 int iri_nrules;
1400 int iri_v; /* No longer used (compatibility) */
1401 frentry_t *iri_rule;
1402} ipfruleiter_t;
1403
1404/*
1405 * Values for iri_inout
1406 */
1407#define F_IN 0
1408#define F_OUT 1
1409#define F_ACIN 2
1410#define F_ACOUT 3
1411
1412
1413typedef struct ipfgeniter {
1414 int igi_type;
1415 int igi_nitems;
1416 void *igi_data;
1417} ipfgeniter_t;
1418
1419#define IPFGENITER_IPF 0
1420#define IPFGENITER_NAT 1
1421#define IPFGENITER_IPNAT 2
1422#define IPFGENITER_FRAG 3
1423#define IPFGENITER_AUTH 4
1424#define IPFGENITER_STATE 5
1425#define IPFGENITER_NATFRAG 6
1426#define IPFGENITER_HOSTMAP 7
1427#define IPFGENITER_LOOKUP 8
1428
1429typedef struct ipftable {
1430 int ita_type;
1431 void *ita_table;
1432} ipftable_t;
1433
1434#define IPFTABLE_BUCKETS 1
1435#define IPFTABLE_BUCKETS_NATIN 2
1436#define IPFTABLE_BUCKETS_NATOUT 3
1437
1438
1439typedef struct ipf_v4_masktab_s {
1440 u_32_t imt4_active[33];
1441 int imt4_masks[33];
1442 int imt4_max;
1443} ipf_v4_masktab_t;
1444
1445typedef struct ipf_v6_masktab_s {
1446 i6addr_t imt6_active[129];
1447 int imt6_masks[129];
1448 int imt6_max;
1449} ipf_v6_masktab_t;
1450
1451
1452/*
1453 *
1454 */
1455typedef struct ipftoken {
1456 struct ipftoken *ipt_next;
1457 struct ipftoken **ipt_pnext;
1458 void *ipt_ctx;
1459 void *ipt_data;
1460 u_long ipt_die;
1461 int ipt_type;
1462 int ipt_uid;
1463 int ipt_subtype;
1464 int ipt_ref;
1465 int ipt_complete;
1466} ipftoken_t;
1467
1468
1469/*
1470 *
1471 */
1472typedef struct ipfexp {
1473 int ipfe_cmd;
1474 int ipfe_not;
1475 int ipfe_narg;
1476 int ipfe_size;
1477 int ipfe_arg0[1];
1478} ipfexp_t;
1479
1480/*
1481 * Currently support commands (ipfe_cmd)
1482 * 32bits is split up follows:
1483 * aabbcccc
1484 * aa = 0 = packet matching, 1 = meta data matching
1485 * bb = IP protocol number
1486 * cccc = command
1487 */
1488#define IPF_EXP_IP_PR 0x00000001
1489#define IPF_EXP_IP_ADDR 0x00000002
1490#define IPF_EXP_IP_SRCADDR 0x00000003
1491#define IPF_EXP_IP_DSTADDR 0x00000004
1492#define IPF_EXP_IP6_ADDR 0x00000005
1493#define IPF_EXP_IP6_SRCADDR 0x00000006
1494#define IPF_EXP_IP6_DSTADDR 0x00000007
1495#define IPF_EXP_TCP_FLAGS 0x00060001
1496#define IPF_EXP_TCP_PORT 0x00060002
1497#define IPF_EXP_TCP_SPORT 0x00060003
1498#define IPF_EXP_TCP_DPORT 0x00060004
1499#define IPF_EXP_UDP_PORT 0x00110002
1500#define IPF_EXP_UDP_SPORT 0x00110003
1501#define IPF_EXP_UDP_DPORT 0x00110004
1502#define IPF_EXP_IDLE_GT 0x01000001
1503#define IPF_EXP_TCP_STATE 0x01060002
1504#define IPF_EXP_END 0xffffffff
1505
1506#define ONE_DAY IPF_TTLVAL(1 * 86400) /* 1 day */
1507#define FIVE_DAYS (5 * ONE_DAY)
1508
1509typedef struct ipf_main_softc_s {
1510 struct ipf_main_softc_s *ipf_next;
1511 ipfmutex_t ipf_rw;
1512 ipfmutex_t ipf_timeoutlock;
1513 ipfrwlock_t ipf_mutex;
1514 ipfrwlock_t ipf_frag;
1515 ipfrwlock_t ipf_global;
1516 ipfrwlock_t ipf_tokens;
1517 ipfrwlock_t ipf_state;
1518 ipfrwlock_t ipf_nat;
1519 ipfrwlock_t ipf_natfrag;
1520 ipfrwlock_t ipf_poolrw;
1521 int ipf_dynamic_softc;
1522 int ipf_refcnt;
1523 int ipf_running;
1524 int ipf_flags;
1525 int ipf_active;
1526 int ipf_control_forwarding;
1527 int ipf_update_ipid;
1528 int ipf_chksrc; /* causes a system crash if enabled */
1529 int ipf_pass;
1530 int ipf_minttl;
1531 int ipf_icmpminfragmtu;
1532 int ipf_interror; /* Should be in a struct that is per */
1533 /* thread or process. Does not belong */
1534 /* here but there's a lot more work */
1535 /* in doing that properly. For now, */
1536 /* it is squatting. */
1537 u_int ipf_tcpidletimeout;
1538 u_int ipf_tcpclosewait;
1539 u_int ipf_tcplastack;
1540 u_int ipf_tcptimewait;
1541 u_int ipf_tcptimeout;
1542 u_int ipf_tcpsynsent;
1543 u_int ipf_tcpsynrecv;
1544 u_int ipf_tcpclosed;
1545 u_int ipf_tcphalfclosed;
1546 u_int ipf_udptimeout;
1547 u_int ipf_udpacktimeout;
1548 u_int ipf_icmptimeout;
1549 u_int ipf_icmpacktimeout;
1550 u_int ipf_iptimeout;
1551 u_int ipf_large_nat;
1552 u_long ipf_ticks;
1553 u_long ipf_userifqs;
1554 u_long ipf_rb_no_mem;
1555 u_long ipf_rb_node_max;
1556 u_long ipf_frouteok[2];
1557 ipftuneable_t *ipf_tuners;
1558 void *ipf_frag_soft;
1559 void *ipf_nat_soft;
1560 void *ipf_state_soft;
1561 void *ipf_auth_soft;
1562 void *ipf_proxy_soft;
1563 void *ipf_sync_soft;
1564 void *ipf_lookup_soft;
1565 void *ipf_log_soft;
1566 struct frgroup *ipf_groups[IPL_LOGSIZE][2];
1567 frentry_t *ipf_rules[2][2];
1568 frentry_t *ipf_acct[2][2];
1569 frentry_t *ipf_rule_explist[2];
1570 ipftoken_t *ipf_token_head;
1571 ipftoken_t **ipf_token_tail;
1572#if defined(__FreeBSD__) && defined(_KERNEL)
1573 struct callout ipf_slow_ch;
1574#endif
1575#if NETBSD_GE_REV(104040000)
1576 struct callout ipf_slow_ch;
1577#endif
1578#if SOLARIS
1579 timeout_id_t ipf_slow_ch;
1580#endif
1581#if defined(_KERNEL)
1582# if SOLARIS
1583 struct pollhead ipf_poll_head[IPL_LOGSIZE];
1584 void *ipf_dip;
1585# if defined(INSTANCES)
1586 int ipf_get_loopback;
1587 u_long ipf_idnum;
1588 net_handle_t ipf_nd_v4;
1589 net_handle_t ipf_nd_v6;
1590 hook_t *ipf_hk_v4_in;
1591 hook_t *ipf_hk_v4_out;
1592 hook_t *ipf_hk_v4_nic;
1593 hook_t *ipf_hk_v6_in;
1594 hook_t *ipf_hk_v6_out;
1595 hook_t *ipf_hk_v6_nic;
1596 hook_t *ipf_hk_loop_v4_in;
1597 hook_t *ipf_hk_loop_v4_out;
1598 hook_t *ipf_hk_loop_v6_in;
1599 hook_t *ipf_hk_loop_v6_out;
1600# endif
1601# else
1602 struct selinfo ipf_selwait[IPL_LOGSIZE];
1603# endif
1604#endif
1605 void *ipf_slow;
1606 ipf_statistics_t ipf_stats[2];
1607 u_char ipf_iss_secret[32];
1608 u_short ipf_ip_id;
1609} ipf_main_softc_t;
1610
1611#define IPFERROR(_e) do { softc->ipf_interror = (_e); \
1612 DT1(user_error, int, _e); \
1613 } while (0)
1614
1615#ifndef _KERNEL
1616extern int ipf_check(void *, struct ip *, int, struct ifnet *, int, mb_t **);
1617extern struct ifnet *get_unit(char *, int);
1618extern char *get_ifname(struct ifnet *);
1619extern int ipfioctl(ipf_main_softc_t *, int, ioctlcmd_t,
1620 caddr_t, int);
1621extern void m_freem(mb_t *);
1622extern size_t msgdsize(mb_t *);
1623extern int bcopywrap(void *, void *, size_t);
1624extern void ip_fillid(struct ip *);
1625#else /* #ifndef _KERNEL */
1626# if defined(__NetBSD__) && defined(PFIL_HOOKS)
1627extern void ipfilterattach(int);
1628# endif
1629extern int ipl_enable(void);
1630extern int ipl_disable(void);
1631# if SOLARIS
1632extern int ipf_check(void *, struct ip *, int, struct ifnet *, int, void *,
1633 mblk_t **);
1634# if SOLARIS
1635extern void ipf_prependmbt(fr_info_t *, mblk_t *);
1636extern int ipfioctl(dev_t, int, intptr_t, int, cred_t *, int *);
1637# endif
1638extern int ipf_qout(queue_t *, mblk_t *);
1639# else /* SOLARIS */
1640extern int ipf_check(void *, struct ip *, int, struct ifnet *, int, mb_t **);
1641extern int (*fr_checkp)(ip_t *, int, void *, int, mb_t **);
1642extern size_t mbufchainlen(mb_t *);
1643# ifdef IPFILTER_LKM
1644extern int ipf_identify(char *);
1645# endif
1646# if defined(__FreeBSD__)
1647extern int ipfioctl(struct cdev*, u_long, caddr_t, int, struct thread *);
1648# elif defined(__NetBSD__)
1649extern int ipfioctl(dev_t, u_long, void *, int, struct lwp *);
1650# endif
1651# endif /* SOLARIS */
1652
1653# if defined(__FreeBSD__)
1654extern int ipf_pfil_hook(void);
1655extern int ipf_pfil_unhook(void);
1656extern void ipf_event_reg(void);
1657extern void ipf_event_dereg(void);
1658extern void ipf_fbsd_kenv_get(ipf_main_softc_t *);
1659# endif
1660
1661# if defined(INSTANCES)
1662extern ipf_main_softc_t *ipf_find_softc(u_long);
1663extern int ipf_set_loopback(ipf_main_softc_t *, ipftuneable_t *,
1664 ipftuneval_t *);
1665# endif
1666
1667#endif /* #ifndef _KERNEL */
1668
1669extern char *memstr(const char *, char *, size_t, size_t);
1670extern int count4bits(u_32_t);
1671#ifdef USE_INET6
1672extern int count6bits(u_32_t *);
1673#endif
1674extern int frrequest(ipf_main_softc_t *, int, ioctlcmd_t, caddr_t,
1675 int, int);
1676extern char *getifname(struct ifnet *);
1677extern int ipfattach(ipf_main_softc_t *);
1678extern int ipfdetach(ipf_main_softc_t *);
1679extern u_short ipf_cksum(u_short *, int);
1680extern int copyinptr(ipf_main_softc_t *, void *, void *, size_t);
1681extern int copyoutptr(ipf_main_softc_t *, void *, void *, size_t);
1682extern int ipf_fastroute(mb_t *, mb_t **, fr_info_t *, frdest_t *);
1683extern int ipf_inject(fr_info_t *, mb_t *);
1684extern int ipf_inobj(ipf_main_softc_t *, void *, ipfobj_t *,
1685 void *, int);
1686extern int ipf_inobjsz(ipf_main_softc_t *, void *, void *,
1687 int , int);
1688extern int ipf_ioctlswitch(ipf_main_softc_t *, int, void *,
1689 ioctlcmd_t, int, int, void *);
1690extern int ipf_ipf_ioctl(ipf_main_softc_t *, caddr_t, ioctlcmd_t,
1691 int, int, void *);
1692extern int ipf_ipftune(ipf_main_softc_t *, ioctlcmd_t, void *);
1693extern int ipf_matcharray_load(ipf_main_softc_t *, caddr_t,
1694 ipfobj_t *, int **);
1695extern int ipf_matcharray_verify(int *, int);
1696extern int ipf_outobj(ipf_main_softc_t *, void *, void *, int);
1697extern int ipf_outobjk(ipf_main_softc_t *, ipfobj_t *, void *);
1698extern int ipf_outobjsz(ipf_main_softc_t *, void *, void *,
1699 int, int);
1700extern ip_t *ipf_pullup(mb_t *, fr_info_t *, int);
1701extern int ipf_resolvedest(ipf_main_softc_t *, char *,
1702 struct frdest *, int);
1703extern int ipf_resolvefunc(ipf_main_softc_t *, void *);
1704extern void *ipf_resolvenic(ipf_main_softc_t *, char *, int);
1705extern int ipf_send_icmp_err(int, fr_info_t *, int);
1706extern int ipf_send_reset(fr_info_t *);
1707extern void ipf_apply_timeout(ipftq_t *, u_int);
1708extern ipftq_t *ipf_addtimeoutqueue(ipf_main_softc_t *, ipftq_t **,
1709 u_int);
1710extern void ipf_deletequeueentry(ipftqent_t *);
1711extern int ipf_deletetimeoutqueue(ipftq_t *);
1712extern void ipf_freetimeoutqueue(ipf_main_softc_t *, ipftq_t *);
1713extern void ipf_movequeue(u_long, ipftqent_t *, ipftq_t *,
1714 ipftq_t *);
1715extern void ipf_queueappend(u_long, ipftqent_t *, ipftq_t *, void *);
1716extern void ipf_queueback(u_long, ipftqent_t *);
1717extern int ipf_queueflush(ipf_main_softc_t *, ipftq_delete_fn_t,
1718 ipftq_t *, ipftq_t *, u_int *, int, int);
1719extern void ipf_queuefront(ipftqent_t *);
1720extern int ipf_settimeout_tcp(ipftuneable_t *, ipftuneval_t *,
1721 ipftq_t *);
1722extern int ipf_checkv4sum(fr_info_t *);
1723extern int ipf_checkl4sum(fr_info_t *);
1724extern int ipf_ifpfillv4addr(int, struct sockaddr_in *,
1725 struct sockaddr_in *, struct in_addr *,
1726 struct in_addr *);
1727extern int ipf_coalesce(fr_info_t *);
1728#ifdef USE_INET6
1729extern int ipf_checkv6sum(fr_info_t *);
1730extern int ipf_ifpfillv6addr(int, struct sockaddr_in6 *,
1731 struct sockaddr_in6 *, i6addr_t *,
1732 i6addr_t *);
1733#endif
1734
1735extern int ipf_tune_add(ipf_main_softc_t *, ipftuneable_t *);
1736extern int ipf_tune_add_array(ipf_main_softc_t *, ipftuneable_t *);
1737extern int ipf_tune_del(ipf_main_softc_t *, ipftuneable_t *);
1738extern int ipf_tune_del_array(ipf_main_softc_t *, ipftuneable_t *);
1739extern int ipf_tune_array_link(ipf_main_softc_t *, ipftuneable_t *);
1740extern int ipf_tune_array_unlink(ipf_main_softc_t *,
1741 ipftuneable_t *);
1742extern ipftuneable_t *ipf_tune_array_copy(void *, size_t,
1743 ipftuneable_t *);
1744
1745extern int ipf_pr_pullup(fr_info_t *, int);
1746
1747extern int ipf_flush(ipf_main_softc_t *, minor_t, int);
1748extern frgroup_t *ipf_group_add(ipf_main_softc_t *, char *, void *,
1749 u_32_t, minor_t, int);
1750extern void ipf_group_del(ipf_main_softc_t *, frgroup_t *,
1751 frentry_t *);
1752extern int ipf_derefrule(ipf_main_softc_t *, frentry_t **);
1753extern frgroup_t *ipf_findgroup(ipf_main_softc_t *, char *, minor_t,
1754 int, frgroup_t ***);
1755
1756extern int ipf_log_init(void);
1757extern int ipf_log_bytesused(ipf_main_softc_t *, int);
1758extern int ipf_log_canread(ipf_main_softc_t *, int);
1759extern int ipf_log_clear(ipf_main_softc_t *, minor_t);
1760extern u_long ipf_log_failures(ipf_main_softc_t *, int);
1761extern int ipf_log_read(ipf_main_softc_t *, minor_t, uio_t *);
1762extern int ipf_log_items(ipf_main_softc_t *, int, fr_info_t *,
1763 void **, size_t *, int *, int);
1764extern u_long ipf_log_logok(ipf_main_softc_t *, int);
1765extern void ipf_log_unload(ipf_main_softc_t *);
1766extern int ipf_log_pkt(fr_info_t *, u_int);
1767
1768extern frentry_t *ipf_acctpkt(fr_info_t *, u_32_t *);
1769extern u_short fr_cksum(fr_info_t *, ip_t *, int, void *);
1770extern void ipf_deinitialise(ipf_main_softc_t *);
1771extern int ipf_deliverlocal(ipf_main_softc_t *, int, void *,
1772 i6addr_t *);
1773extern frentry_t *ipf_dstgrpmap(fr_info_t *, u_32_t *);
1774extern void ipf_fixskip(frentry_t **, frentry_t *, int);
1775extern void ipf_forgetifp(ipf_main_softc_t *, void *);
1776extern frentry_t *ipf_getrulen(ipf_main_softc_t *, int, char *,
1777 u_32_t);
1778extern int ipf_ifpaddr(ipf_main_softc_t *, int, int, void *,
1779 i6addr_t *, i6addr_t *);
1780extern void ipf_inet_mask_add(int, ipf_v4_masktab_t *);
1781extern void ipf_inet_mask_del(int, ipf_v4_masktab_t *);
1782#ifdef USE_INET6
1783extern void ipf_inet6_mask_add(int, i6addr_t *,
1784 ipf_v6_masktab_t *);
1785extern void ipf_inet6_mask_del(int, i6addr_t *,
1786 ipf_v6_masktab_t *);
1787#endif
1788extern int ipf_initialise(void);
1789extern int ipf_lock(caddr_t, int *);
1790extern int ipf_makefrip(int, ip_t *, fr_info_t *);
1791extern int ipf_matchtag(ipftag_t *, ipftag_t *);
1792extern int ipf_matchicmpqueryreply(int, icmpinfo_t *,
1793 struct icmp *, int);
1794extern u_32_t ipf_newisn(fr_info_t *);
1795extern u_int ipf_pcksum(fr_info_t *, int, u_int);
1796#ifdef USE_INET6
1797extern u_int ipf_pcksum6(struct mbuf *, ip6_t *,
1798 u_int32_t, u_int32_t);
1799#endif
1800extern void ipf_rule_expire(ipf_main_softc_t *);
1801extern int ipf_scanlist(fr_info_t *, u_32_t);
1802extern frentry_t *ipf_srcgrpmap(fr_info_t *, u_32_t *);
1803extern int ipf_tcpudpchk(fr_ip_t *, frtuc_t *);
1804extern int ipf_verifysrc(fr_info_t *fin);
1805extern int ipf_zerostats(ipf_main_softc_t *, char *);
1806extern int ipf_getnextrule(ipf_main_softc_t *, ipftoken_t *,
1807 void *);
1808extern int ipf_sync(ipf_main_softc_t *, void *);
1809extern int ipf_token_deref(ipf_main_softc_t *, ipftoken_t *);
1810extern void ipf_token_expire(ipf_main_softc_t *);
1811extern ipftoken_t *ipf_token_find(ipf_main_softc_t *, int, int,
1812 void *);
1813extern int ipf_token_del(ipf_main_softc_t *, int, int,
1814 void *);
1815extern void ipf_token_mark_complete(ipftoken_t *);
1816extern int ipf_genericiter(ipf_main_softc_t *, void *,
1817 int, void *);
1818#ifdef IPFILTER_LOOKUP
1819extern void *ipf_resolvelookup(int, u_int, u_int,
1820 lookupfunc_t *);
1821#endif
1822extern u_32_t ipf_random(void);
1823
1824extern int ipf_main_load(void);
1825extern void *ipf_main_soft_create(void *);
1826extern void ipf_main_soft_destroy(ipf_main_softc_t *);
1827extern int ipf_main_soft_init(ipf_main_softc_t *);
1828extern int ipf_main_soft_fini(ipf_main_softc_t *);
1829extern int ipf_main_unload(void);
1830extern int ipf_load_all(void);
1831extern int ipf_unload_all(void);
1832extern void ipf_destroy_all(ipf_main_softc_t *);
1833extern ipf_main_softc_t *ipf_create_all(void *);
1834extern int ipf_init_all(ipf_main_softc_t *);
1835extern int ipf_fini_all(ipf_main_softc_t *);
1836extern void ipf_log_soft_destroy(ipf_main_softc_t *, void *);
1837extern void *ipf_log_soft_create(ipf_main_softc_t *);
1838extern int ipf_log_soft_init(ipf_main_softc_t *, void *);
1839extern int ipf_log_soft_fini(ipf_main_softc_t *, void *);
1840extern int ipf_log_main_load(void);
1841extern int ipf_log_main_unload(void);
1842
1843
1844extern char ipfilter_version[];
1845#ifdef USE_INET6
1846extern int icmptoicmp6types[ICMP_MAXTYPE+1];
1847extern int icmptoicmp6unreach[ICMP_MAX_UNREACH];
1848extern int icmpreplytype6[ICMP6_MAXTYPE + 1];
1849#endif
1850#ifdef IPFILTER_COMPAT
1851extern int ipf_in_compat(ipf_main_softc_t *, ipfobj_t *, void *,int);
1852extern int ipf_out_compat(ipf_main_softc_t *, ipfobj_t *, void *);
1853#endif
1854extern int icmpreplytype4[ICMP_MAXTYPE + 1];
1855
1856extern int ipf_ht_node_add(ipf_main_softc_t *, host_track_t *,
1857 int, i6addr_t *);
1858extern int ipf_ht_node_del(host_track_t *, int, i6addr_t *);
1859extern void ipf_rb_ht_flush(host_track_t *);
1860extern void ipf_rb_ht_freenode(host_node_t *, void *);
1861extern void ipf_rb_ht_init(host_track_t *);
1862
1863#endif /* __IP_FIL_H__ */