1/*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2002-2009 Luigi Rizzo, Universita` di Pisa
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25 * SUCH DAMAGE.
26 */
27
28#ifndef _IPFW2_H
29#define _IPFW2_H
30
31/*
32 * The default rule number. By the design of ip_fw, the default rule
33 * is the last one, so its number can also serve as the highest number
34 * allowed for a rule. The ip_fw code relies on both meanings of this
35 * constant.
36 */
37#define IPFW_DEFAULT_RULE 65535
38
39#define RESVD_SET 31 /*set for default and persistent rules*/
40#define IPFW_MAX_SETS 32 /* Number of sets supported by ipfw*/
41
42/*
43 * Compat values for old clients
44 */
45#ifndef _KERNEL
46#define IPFW_TABLES_MAX 65535
47#define IPFW_TABLES_DEFAULT 128
48#endif
49
50/*
51 * Most commands (queue, pipe, tag, untag, limit...) can have a 16-bit
52 * argument between 1 and 65534. The value 0 (IP_FW_TARG) is used
53 * to represent 'tablearg' value, e.g. indicate the use of a 'tablearg'
54 * result of the most recent table() lookup.
55 * Note that 16bit is only a historical limit, resulting from
56 * the use of a 16-bit fields for that value. In reality, we can have
57 * 2^32 pipes, queues, tag values and so on.
58 */
59#define IPFW_ARG_MIN 1
60#define IPFW_ARG_MAX 65534
61#define IP_FW_TABLEARG 65535 /* Compat value for old clients */
62#define IP_FW_TARG 0 /* Current tablearg value */
63#define IP_FW_NAT44_GLOBAL 65535 /* arg1 value for "nat global" */
64
65/*
66 * Number of entries in the call stack of the call/return commands.
67 * Call stack currently is an uint16_t array with rule numbers.
68 */
69#define IPFW_CALLSTACK_SIZE 16
70
71/* IP_FW3 header/opcodes */
72typedef struct _ip_fw3_opheader {
73 uint16_t opcode; /* Operation opcode */
74 uint16_t version; /* Opcode version */
75 uint16_t reserved[2]; /* Align to 64-bit boundary */
76} ip_fw3_opheader;
77
78#define IP_FW3_OPVER_0 0
79#define IP_FW3_OPVER_1 1 /* 32bit rulenum */
80#define IP_FW3_OPVER IP_FW3_OPVER_1
81
82/* IP_FW3 opcodes */
83#define IP_FW_TABLE_XADD 86 /* add entry */
84#define IP_FW_TABLE_XDEL 87 /* delete entry */
85#define IP_FW_TABLE_XGETSIZE 88 /* get table size (deprecated) */
86#define IP_FW_TABLE_XLIST 89 /* list table contents */
87#define IP_FW_TABLE_XDESTROY 90 /* destroy table */
88#define IP_FW_TABLES_XLIST 92 /* list all tables */
89#define IP_FW_TABLE_XINFO 93 /* request info for one table */
90#define IP_FW_TABLE_XFLUSH 94 /* flush table data */
91#define IP_FW_TABLE_XCREATE 95 /* create new table */
92#define IP_FW_TABLE_XMODIFY 96 /* modify existing table */
93#define IP_FW_XGET 97 /* Retrieve configuration */
94#define IP_FW_XADD 98 /* add rule */
95#define IP_FW_XDEL 99 /* del rule */
96#define IP_FW_XMOVE 100 /* move rules to different set */
97#define IP_FW_XZERO 101 /* clear accounting */
98#define IP_FW_XRESETLOG 102 /* zero rules logs */
99#define IP_FW_SET_SWAP 103 /* Swap between 2 sets */
100#define IP_FW_SET_MOVE 104 /* Move one set to another one */
101#define IP_FW_SET_ENABLE 105 /* Enable/disable sets */
102#define IP_FW_TABLE_XFIND 106 /* finds an entry */
103#define IP_FW_XIFLIST 107 /* list tracked interfaces */
104#define IP_FW_TABLES_ALIST 108 /* list table algorithms */
105#define IP_FW_TABLE_XSWAP 109 /* swap two tables */
106#define IP_FW_TABLE_VLIST 110 /* dump table value hash */
107
108#define IP_FW_NAT44_XCONFIG 111 /* Create/modify NAT44 instance */
109#define IP_FW_NAT44_DESTROY 112 /* Destroys NAT44 instance */
110#define IP_FW_NAT44_XGETCONFIG 113 /* Get NAT44 instance config */
111#define IP_FW_NAT44_LIST_NAT 114 /* List all NAT44 instances */
112#define IP_FW_NAT44_XGETLOG 115 /* Get log from NAT44 instance */
113
114#define IP_FW_DUMP_SOPTCODES 116 /* Dump available sopts/versions */
115#define IP_FW_DUMP_SRVOBJECTS 117 /* Dump existing named objects */
116#define IP_FW_SKIPTO_CACHE 118 /* Manage skipto cache */
117
118#define IP_FW_NAT64STL_CREATE 130 /* Create stateless NAT64 instance */
119#define IP_FW_NAT64STL_DESTROY 131 /* Destroy stateless NAT64 instance */
120#define IP_FW_NAT64STL_CONFIG 132 /* Modify stateless NAT64 instance */
121#define IP_FW_NAT64STL_LIST 133 /* List stateless NAT64 instances */
122#define IP_FW_NAT64STL_STATS 134 /* Get NAT64STL instance statistics */
123#define IP_FW_NAT64STL_RESET_STATS 135 /* Reset NAT64STL instance statistics */
124
125#define IP_FW_NAT64LSN_CREATE 140 /* Create stateful NAT64 instance */
126#define IP_FW_NAT64LSN_DESTROY 141 /* Destroy stateful NAT64 instance */
127#define IP_FW_NAT64LSN_CONFIG 142 /* Modify stateful NAT64 instance */
128#define IP_FW_NAT64LSN_LIST 143 /* List stateful NAT64 instances */
129#define IP_FW_NAT64LSN_STATS 144 /* Get NAT64LSN instance statistics */
130#define IP_FW_NAT64LSN_LIST_STATES 145 /* Get stateful NAT64 states */
131#define IP_FW_NAT64LSN_RESET_STATS 146 /* Reset NAT64LSN instance statistics */
132
133#define IP_FW_NPTV6_CREATE 150 /* Create NPTv6 instance */
134#define IP_FW_NPTV6_DESTROY 151 /* Destroy NPTv6 instance */
135#define IP_FW_NPTV6_CONFIG 152 /* Modify NPTv6 instance */
136#define IP_FW_NPTV6_LIST 153 /* List NPTv6 instances */
137#define IP_FW_NPTV6_STATS 154 /* Get NPTv6 instance statistics */
138#define IP_FW_NPTV6_RESET_STATS 155 /* Reset NPTv6 instance statistics */
139
140#define IP_FW_NAT64CLAT_CREATE 160 /* Create clat NAT64 instance */
141#define IP_FW_NAT64CLAT_DESTROY 161 /* Destroy clat NAT64 instance */
142#define IP_FW_NAT64CLAT_CONFIG 162 /* Modify clat NAT64 instance */
143#define IP_FW_NAT64CLAT_LIST 163 /* List clat NAT64 instances */
144#define IP_FW_NAT64CLAT_STATS 164 /* Get NAT64CLAT instance statistics */
145#define IP_FW_NAT64CLAT_RESET_STATS 165 /* Reset NAT64CLAT instance statistics */
146
147/*
148 * The kernel representation of ipfw rules is made of a list of
149 * 'instructions' (for all practical purposes equivalent to BPF
150 * instructions), which specify which fields of the packet
151 * (or its metadata) should be analysed.
152 *
153 * Each instruction is stored in a structure which begins with
154 * "ipfw_insn", and can contain extra fields depending on the
155 * instruction type (listed below).
156 * Note that the code is written so that individual instructions
157 * have a size which is a multiple of 32 bits. This means that, if
158 * such structures contain pointers or other 64-bit entities,
159 * (there is just one instance now) they may end up unaligned on
160 * 64-bit architectures, so the must be handled with care.
161 *
162 * "enum ipfw_opcodes" are the opcodes supported. We can have up
163 * to 256 different opcodes. When adding new opcodes, they should
164 * be appended to the end of the opcode list before O_LAST_OPCODE,
165 * this will prevent the ABI from being broken, otherwise users
166 * will have to recompile ipfw(8) when they update the kernel.
167 */
168
169enum ipfw_opcodes { /* arguments (4 byte each) */
170 O_NOP = 0,
171
172 O_IP_SRC = 1, /* u32 = IP */
173 O_IP_SRC_MASK = 2, /* ip = IP/mask */
174 O_IP_SRC_ME = 3, /* none */
175 O_IP_SRC_SET = 4, /* u32=base, arg1=len, bitmap */
176
177 O_IP_DST = 5, /* u32 = IP */
178 O_IP_DST_MASK = 6, /* ip = IP/mask */
179 O_IP_DST_ME = 7, /* none */
180 O_IP_DST_SET = 8, /* u32=base, arg1=len, bitmap */
181
182 O_IP_SRCPORT = 9, /* (n)port list:mask 4 byte ea */
183 O_IP_DSTPORT = 10, /* (n)port list:mask 4 byte ea */
184 O_PROTO = 11, /* arg1=protocol */
185
186 O_MACADDR2 = 12, /* 2 mac addr:mask */
187 O_MAC_TYPE = 13, /* same as srcport */
188
189 O_LAYER2 = 14, /* none */
190 O_IN = 15, /* none */
191 O_FRAG = 16, /* none */
192
193 O_RECV = 17, /* none */
194 O_XMIT = 18, /* none */
195 O_VIA = 19, /* none */
196
197 O_IPOPT = 20, /* arg1 = 2*u8 bitmap */
198 O_IPLEN = 21, /* arg1 = len */
199 O_IPID = 22, /* arg1 = id */
200
201 O_IPTOS = 23, /* arg1 = id */
202 O_IPPRECEDENCE = 24, /* arg1 = precedence << 5 */
203 O_IPTTL = 25, /* arg1 = TTL */
204
205 O_IPVER = 26, /* arg1 = version */
206 O_UID = 27, /* u32 = id */
207 O_GID = 28, /* u32 = id */
208 O_ESTAB = 29, /* none (tcp established) */
209 O_TCPFLAGS = 30, /* arg1 = 2*u8 bitmap */
210 O_TCPWIN = 31, /* arg1 = desired win */
211 O_TCPSEQ = 32, /* u32 = desired seq. */
212 O_TCPACK = 33, /* u32 = desired seq. */
213 O_ICMPTYPE = 34, /* u32 = icmp bitmap */
214 O_TCPOPTS = 35, /* arg1 = 2*u8 bitmap */
215
216 O_VERREVPATH = 36, /* none */
217 O_VERSRCREACH = 37, /* none */
218
219 O_PROBE_STATE = 38, /* v0:arg1=kidx, v1:kidx=kidx */
220 O_KEEP_STATE = 39, /* v0:arg1=kidx, v1:kidx=kidx */
221 O_LIMIT = 40, /* ipfw_insn_limit */
222 O_LIMIT_PARENT = 41, /* dyn_type, not an opcode. */
223
224 /*
225 * These are really 'actions'.
226 */
227
228 O_LOG = 42, /* ipfw_insn_log */
229 O_PROB = 43, /* u32 = match probability */
230
231 O_CHECK_STATE = 44, /* v0:arg1=kidx, v1:kidx=kidx */
232 O_ACCEPT = 45, /* none */
233 O_DENY = 46, /* none */
234 O_REJECT = 47, /* arg1=icmp arg (same as deny) */
235 O_COUNT = 48, /* none */
236 O_SKIPTO = 49, /* v0:arg1=next rule number */
237 /* v1:kidx= next rule number */
238 O_PIPE = 50, /* arg1=pipe number */
239 O_QUEUE = 51, /* arg1=queue number */
240 O_DIVERT = 52, /* arg1=port number */
241 O_TEE = 53, /* arg1=port number */
242 O_FORWARD_IP = 54, /* fwd sockaddr */
243 O_FORWARD_MAC = 55, /* fwd mac */
244 O_NAT = 56, /* nope */
245 O_REASS = 57, /* none */
246
247 /*
248 * More opcodes.
249 */
250 O_IPSEC = 58, /* has ipsec history */
251 O_IP_SRC_LOOKUP = 59, /* v0:arg1=table number, u32=value */
252 /* v1:kidx=name, u32=value, arg1=key */
253 O_IP_DST_LOOKUP = 60, /* arg1=table number, u32=value */
254 /* v1:kidx=name, u32=value, arg1=key */
255 O_ANTISPOOF = 61, /* none */
256 O_JAIL = 62, /* u32 = id */
257 O_ALTQ = 63, /* u32 = altq classif. qid */
258 O_DIVERTED = 64, /* arg1=bitmap (1:loop, 2:out) */
259 O_TCPDATALEN = 65, /* arg1 = tcp data len */
260 O_IP6_SRC = 66, /* address without mask */
261 O_IP6_SRC_ME = 67, /* my addresses */
262 O_IP6_SRC_MASK = 68, /* address with the mask */
263 O_IP6_DST = 69,
264 O_IP6_DST_ME = 70,
265 O_IP6_DST_MASK = 71,
266 O_FLOW6ID = 72, /* for flow id tag in the ipv6 pkt */
267 O_ICMP6TYPE = 73, /* icmp6 packet type filtering */
268 O_EXT_HDR = 74, /* filtering for ipv6 extension header */
269 O_IP6 = 75,
270
271 /*
272 * actions for ng_ipfw
273 */
274 O_NETGRAPH = 76, /* send to ng_ipfw */
275 O_NGTEE = 77, /* copy to ng_ipfw */
276
277 O_IP4 = 78,
278
279 O_UNREACH6 = 79, /* arg1=icmpv6 code arg (deny) */
280
281 O_TAG = 80, /* arg1=tag number */
282 O_TAGGED = 81, /* arg1=tag number */
283
284 O_SETFIB = 82, /* arg1=FIB number */
285 O_FIB = 83, /* arg1=FIB desired fib number */
286
287 O_SOCKARG = 84, /* socket argument */
288
289 O_CALLRETURN = 85, /* v0:arg1=called rule number */
290 /* v1:kidx=called rule number */
291
292 O_FORWARD_IP6 = 86, /* fwd sockaddr_in6 */
293
294 O_DSCP = 87, /* 2 u32 = DSCP mask */
295 O_SETDSCP = 88, /* arg1=DSCP value */
296 O_IP_FLOW_LOOKUP = 89, /* v0:arg1=table number, u32=value */
297 /* v1:kidx=name, u32=value */
298
299 O_EXTERNAL_ACTION = 90, /* v0:arg1=id of external action handler */
300 /* v1:kidx=id of external action handler */
301 O_EXTERNAL_INSTANCE = 91, /* v0:arg1=id of eaction handler instance */
302 /* v1:kidx=id of eaction handler instance */
303 O_EXTERNAL_DATA = 92, /* variable length data */
304
305 O_SKIP_ACTION = 93, /* none */
306 O_TCPMSS = 94, /* arg1=MSS value */
307
308 O_MAC_SRC_LOOKUP = 95, /* kidx=name, u32=value, arg1=key */
309 O_MAC_DST_LOOKUP = 96, /* kidx=name, u32=value, arg1=key */
310
311 O_SETMARK = 97, /* u32 = value */
312 O_MARK = 98, /* 2 u32 = value, bitmask */
313
314 O_LAST_OPCODE /* not an opcode! */
315};
316
317/*
318 * The extension header are filtered only for presence using a bit
319 * vector with a flag for each header.
320 */
321#define EXT_FRAGMENT 0x1
322#define EXT_HOPOPTS 0x2
323#define EXT_ROUTING 0x4
324#define EXT_AH 0x8
325#define EXT_ESP 0x10
326#define EXT_DSTOPTS 0x20
327#define EXT_RTHDR0 0x40
328#define EXT_RTHDR2 0x80
329
330/*
331 * Template for instructions.
332 *
333 * ipfw_insn is used for all instructions which require no operands,
334 * a single 16-bit value (arg1), or a couple of 8-bit values.
335 *
336 * For other instructions which require different/larger arguments
337 * we have derived structures, ipfw_insn_*.
338 *
339 * The size of the instruction (in 32-bit words) is in the low
340 * 6 bits of "len". The 2 remaining bits are used to implement
341 * NOT and OR on individual instructions. Given a type, you can
342 * compute the length to be put in "len" using F_INSN_SIZE(t)
343 *
344 * F_NOT negates the match result of the instruction.
345 *
346 * F_OR is used to build or blocks. By default, instructions
347 * are evaluated as part of a logical AND. An "or" block
348 * { X or Y or Z } contains F_OR set in all but the last
349 * instruction of the block. A match will cause the code
350 * to skip past the last instruction of the block.
351 *
352 * NOTA BENE: in a couple of places we assume that
353 * sizeof(ipfw_insn) == sizeof(u_int32_t)
354 * this needs to be fixed.
355 *
356 */
357typedef struct _ipfw_insn { /* template for instructions */
358 _Alignas(_Alignof(u_int32_t)) u_int8_t opcode;
359 u_int8_t len; /* number of 32-bit words */
360#define F_NOT 0x80
361#define F_OR 0x40
362#define F_LEN_MASK 0x3f
363#define F_LEN(cmd) ((cmd)->len & F_LEN_MASK)
364
365 u_int16_t arg1;
366} ipfw_insn;
367
368/*
369 * The F_INSN_SIZE(type) computes the size, in 4-byte words, of
370 * a given type.
371 */
372#define F_INSN_SIZE(t) ((sizeof (t))/sizeof(u_int32_t))
373
374/*
375 * This is used to store an array of 16-bit entries (ports etc.)
376 */
377typedef struct _ipfw_insn_u16 {
378 ipfw_insn o;
379 u_int16_t ports[2]; /* there may be more */
380} ipfw_insn_u16;
381
382/*
383 * This is used to store an array of 32-bit entries
384 * (uid, single IPv4 addresses etc.)
385 */
386typedef struct _ipfw_insn_u32 {
387 ipfw_insn o;
388 u_int32_t d[1]; /* one or more */
389} ipfw_insn_u32;
390
391typedef struct _ipfw_insn_kidx {
392 ipfw_insn o;
393 uint32_t kidx;
394} ipfw_insn_kidx;
395
396/*
397 * This is used to store IP addr-mask pairs.
398 */
399typedef struct _ipfw_insn_ip {
400 ipfw_insn o;
401 struct in_addr addr;
402 struct in_addr mask;
403} ipfw_insn_ip;
404
405typedef struct _ipfw_insn_table {
406 ipfw_insn o; /* arg1 is optional lookup key */
407 uint32_t kidx; /* table name index */
408 uint32_t value; /* table value */
409} ipfw_insn_table;
410
411#define IPFW_LOOKUP_TYPE_MASK 0x00FF
412#define IPFW_LOOKUP_TYPE(insn) ((insn)->arg1 & IPFW_LOOKUP_TYPE_MASK)
413#define IPFW_SET_LOOKUP_TYPE(insn, type) do { \
414 (insn)->arg1 &= ~IPFW_LOOKUP_TYPE_MASK; \
415 (insn)->arg1 |= (type) & IPFW_LOOKUP_TYPE_MASK; \
416} while (0)
417
418/*
419 * Defines key types used by lookup instruction
420 */
421enum ipfw_table_lookup_type {
422 LOOKUP_NONE = 0,
423 LOOKUP_DST_IP,
424 LOOKUP_SRC_IP,
425 LOOKUP_DST_PORT,
426 LOOKUP_SRC_PORT,
427 LOOKUP_UID,
428 LOOKUP_JAIL,
429 LOOKUP_DSCP,
430 LOOKUP_DST_MAC,
431 LOOKUP_SRC_MAC,
432 LOOKUP_MARK,
433 LOOKUP_RULENUM,
434};
435
436enum ipfw_return_type {
437 RETURN_NEXT_RULENUM = 0,
438 RETURN_NEXT_RULE,
439};
440
441enum ipfw_skipto_cache_op {
442 SKIPTO_CACHE_DISABLE = 0,
443 SKIPTO_CACHE_ENABLE,
444};
445
446/*
447 * This is used to forward to a given address (ip).
448 */
449typedef struct _ipfw_insn_sa {
450 ipfw_insn o;
451 struct sockaddr_in sa;
452} ipfw_insn_sa;
453
454/*
455 * This is used to forward to a given address (ipv6).
456 */
457typedef struct _ipfw_insn_sa6 {
458 ipfw_insn o;
459 struct sockaddr_in6 sa;
460} ipfw_insn_sa6;
461
462/*
463 * This is used for MAC addr-mask pairs.
464 */
465typedef struct _ipfw_insn_mac {
466 ipfw_insn o;
467 u_char addr[12]; /* dst[6] + src[6] */
468 u_char mask[12]; /* dst[6] + src[6] */
469} ipfw_insn_mac;
470
471/*
472 * This is used for interface match rules (recv xx, xmit xx).
473 */
474typedef struct _ipfw_insn_if {
475 ipfw_insn o;
476 union {
477 struct in_addr ip;
478 int glob;
479 uint16_t kidx_v0;
480 uint32_t kidx;
481 } p;
482 char name[IFNAMSIZ];
483} ipfw_insn_if;
484
485/*
486 * This is used for storing an altq queue id number.
487 */
488typedef struct _ipfw_insn_altq {
489 ipfw_insn o;
490 u_int32_t qid;
491} ipfw_insn_altq;
492
493/*
494 * This is used for limit rules.
495 */
496typedef struct _ipfw_insn_limit {
497 ipfw_insn o;
498 u_int32_t kidx;
499 u_int8_t _pad;
500 u_int8_t limit_mask; /* combination of DYN_* below */
501#define DYN_SRC_ADDR 0x1
502#define DYN_SRC_PORT 0x2
503#define DYN_DST_ADDR 0x4
504#define DYN_DST_PORT 0x8
505
506 u_int16_t conn_limit;
507} ipfw_insn_limit;
508
509/* MAC/InfiniBand/etc address length */
510#define IPFW_MAX_L2_ADDR_LEN 20
511
512/*
513 * This is used for log instructions.
514 */
515typedef struct _ipfw_insn_log {
516 ipfw_insn o;
517 u_int32_t max_log; /* how many do we log -- 0 = all */
518 u_int32_t log_left; /* how many left to log */
519} ipfw_insn_log;
520
521/* ipfw_insn_log->o.arg1 bitmasks */
522#define IPFW_LOG_DEFAULT 0x0000
523#define IPFW_LOG_SYSLOG (1 << 15)
524#define IPFW_LOG_IPFW0 (1 << 14)
525#define IPFW_LOG_RTSOCK (1 << 13)
526
527typedef struct _ipfwlog_rtsock_hdr_v2 {
528 uint32_t rulenum;
529 uint32_t tablearg;
530 ipfw_insn cmd;
531 u_char ether_shost[IPFW_MAX_L2_ADDR_LEN];
532 u_char ether_dhost[IPFW_MAX_L2_ADDR_LEN];
533 uint32_t mark;
534 char comment[0];
535} ipfwlog_rtsock_hdr_v2;
536
537/* Legacy NAT structures, compat only */
538#ifndef _KERNEL
539/*
540 * Data structures required by both ipfw(8) and ipfw(4) but not part of the
541 * management API are protected by IPFW_INTERNAL.
542 */
543#ifdef IPFW_INTERNAL
544/* Server pool support (LSNAT). */
545struct cfg_spool {
546 LIST_ENTRY(cfg_spool) _next; /* chain of spool instances */
547 struct in_addr addr;
548 u_short port;
549};
550#endif
551
552/* Redirect modes id. */
553#define REDIR_ADDR 0x01
554#define REDIR_PORT 0x02
555#define REDIR_PROTO 0x04
556
557#ifdef IPFW_INTERNAL
558/* Nat redirect configuration. */
559struct cfg_redir {
560 LIST_ENTRY(cfg_redir) _next; /* chain of redir instances */
561 u_int16_t mode; /* type of redirect mode */
562 struct in_addr laddr; /* local ip address */
563 struct in_addr paddr; /* public ip address */
564 struct in_addr raddr; /* remote ip address */
565 u_short lport; /* local port */
566 u_short pport; /* public port */
567 u_short rport; /* remote port */
568 u_short pport_cnt; /* number of public ports */
569 u_short rport_cnt; /* number of remote ports */
570 int proto; /* protocol: tcp/udp */
571 struct alias_link **alink;
572 /* num of entry in spool chain */
573 u_int16_t spool_cnt;
574 /* chain of spool instances */
575 LIST_HEAD(spool_chain, cfg_spool) spool_chain;
576};
577#endif
578
579#ifdef IPFW_INTERNAL
580/* Nat configuration data struct. */
581struct cfg_nat {
582 /* chain of nat instances */
583 LIST_ENTRY(cfg_nat) _next;
584 int id; /* nat id */
585 struct in_addr ip; /* nat ip address */
586 char if_name[IF_NAMESIZE]; /* interface name */
587 int mode; /* aliasing mode */
588 struct libalias *lib; /* libalias instance */
589 /* number of entry in spool chain */
590 int redir_cnt;
591 /* chain of redir instances */
592 LIST_HEAD(redir_chain, cfg_redir) redir_chain;
593};
594#endif
595
596#define SOF_NAT sizeof(struct cfg_nat)
597#define SOF_REDIR sizeof(struct cfg_redir)
598#define SOF_SPOOL sizeof(struct cfg_spool)
599
600#endif /* ifndef _KERNEL */
601
602struct nat44_cfg_spool {
603 struct in_addr addr;
604 uint16_t port;
605 uint16_t spare;
606};
607#define NAT44_REDIR_ADDR 0x01
608#define NAT44_REDIR_PORT 0x02
609#define NAT44_REDIR_PROTO 0x04
610
611/* Nat redirect configuration. */
612struct nat44_cfg_redir {
613 struct in_addr laddr; /* local ip address */
614 struct in_addr paddr; /* public ip address */
615 struct in_addr raddr; /* remote ip address */
616 uint16_t lport; /* local port */
617 uint16_t pport; /* public port */
618 uint16_t rport; /* remote port */
619 uint16_t pport_cnt; /* number of public ports */
620 uint16_t rport_cnt; /* number of remote ports */
621 uint16_t mode; /* type of redirect mode */
622 uint16_t spool_cnt; /* num of entry in spool chain */
623 uint16_t spare;
624 uint32_t proto; /* protocol: tcp/udp */
625};
626
627/* Nat configuration data struct. */
628struct nat44_cfg_nat {
629 char name[64]; /* nat name */
630 char if_name[64]; /* interface name */
631 uint32_t size; /* structure size incl. redirs */
632 struct in_addr ip; /* nat IPv4 address */
633 uint32_t mode; /* aliasing mode */
634 uint32_t redir_cnt; /* number of entry in spool chain */
635 u_short alias_port_lo; /* low range for port aliasing */
636 u_short alias_port_hi; /* high range for port aliasing */
637};
638
639/* Nat command. */
640typedef struct _ipfw_insn_nat {
641 ipfw_insn o;
642 struct cfg_nat *nat;
643} ipfw_insn_nat;
644
645/* Apply ipv6 mask on ipv6 addr */
646#define APPLY_MASK(addr,mask) do { \
647 (addr)->__u6_addr.__u6_addr32[0] &= (mask)->__u6_addr.__u6_addr32[0]; \
648 (addr)->__u6_addr.__u6_addr32[1] &= (mask)->__u6_addr.__u6_addr32[1]; \
649 (addr)->__u6_addr.__u6_addr32[2] &= (mask)->__u6_addr.__u6_addr32[2]; \
650 (addr)->__u6_addr.__u6_addr32[3] &= (mask)->__u6_addr.__u6_addr32[3]; \
651} while (0)
652
653/* Structure for ipv6 */
654typedef struct _ipfw_insn_ip6 {
655 ipfw_insn o;
656 struct in6_addr addr6;
657 struct in6_addr mask6;
658} ipfw_insn_ip6;
659
660/* Used to support icmp6 types */
661typedef struct _ipfw_insn_icmp6 {
662 ipfw_insn o;
663 uint32_t d[7]; /* XXX This number si related to the netinet/icmp6.h
664 * define ICMP6_MAXTYPE
665 * as follows: n = ICMP6_MAXTYPE/32 + 1
666 * Actually is 203
667 */
668} ipfw_insn_icmp6;
669
670/* Convert pointer to instruction with specified type */
671#define insntod(p, type) ((ipfw_insn_ ## type *)(p))
672#define insntoc(p, type) ((const ipfw_insn_ ## type *)(p))
673
674/*
675 * Here we have the structure representing an ipfw rule.
676 *
677 * Layout:
678 * struct ip_fw_rule
679 * [ counter block, size = rule->cntr_len ]
680 * [ one or more instructions, size = rule->cmd_len * 4 ]
681 *
682 * It starts with a general area (with link fields).
683 * Counter block may be next (if rule->cntr_len > 0),
684 * followed by an array of one or more instructions, which the code
685 * accesses as an array of 32-bit values. rule->cmd_len represents
686 * the total instructions legth in u32 worrd, while act_ofs represents
687 * rule action offset in u32 words.
688 *
689 * When assembling instruction, remember the following:
690 *
691 * + if a rule has a "keep-state" (or "limit") option, then the
692 * first instruction (at r->cmd) MUST BE an O_PROBE_STATE
693 * + if a rule has a "log" option, then the first action
694 * (at ACTION_PTR(r)) MUST be O_LOG
695 * + if a rule has an "altq" option, it comes after "log"
696 * + if a rule has an O_TAG option, it comes after "log" and "altq"
697 *
698 *
699 * All structures (excluding instructions) are u64-aligned.
700 * Please keep this.
701 */
702
703struct ip_fw_rule {
704 uint16_t act_ofs; /* offset of action in 32-bit units */
705 uint16_t cmd_len; /* # of 32-bit words in cmd */
706 uint16_t spare;
707 uint8_t set; /* rule set (0..31) */
708 uint8_t flags; /* rule flags */
709 uint32_t rulenum; /* rule number */
710 uint32_t id; /* rule id */
711
712 ipfw_insn cmd[1]; /* storage for commands */
713};
714#define IPFW_RULE_NOOPT 0x01 /* Has no options in body */
715#define IPFW_RULE_JUSTOPTS 0x02 /* new format of rule body */
716
717/* Unaligned version */
718
719/* Base ipfw rule counter block. */
720struct ip_fw_bcounter {
721 uint16_t size; /* Size of counter block, bytes */
722 uint8_t flags; /* flags for given block */
723 uint8_t spare;
724 uint32_t timestamp; /* tv_sec of last match */
725 uint64_t pcnt; /* Packet counter */
726 uint64_t bcnt; /* Byte counter */
727};
728
729#ifndef _KERNEL
730/*
731 * Legacy rule format
732 */
733struct ip_fw {
734 struct ip_fw *x_next; /* linked list of rules */
735 struct ip_fw *next_rule; /* ptr to next [skipto] rule */
736 /* 'next_rule' is used to pass up 'set_disable' status */
737
738 uint16_t act_ofs; /* offset of action in 32-bit units */
739 uint16_t cmd_len; /* # of 32-bit words in cmd */
740 uint16_t rulenum; /* rule number */
741 uint8_t set; /* rule set (0..31) */
742 uint8_t _pad; /* padding */
743 uint32_t id; /* rule id */
744
745 /* These fields are present in all rules. */
746 uint64_t pcnt; /* Packet counter */
747 uint64_t bcnt; /* Byte counter */
748 uint32_t timestamp; /* tv_sec of last match */
749
750 ipfw_insn cmd[1]; /* storage for commands */
751};
752#endif
753
754#define ACTION_PTR(rule) \
755 (ipfw_insn *)( (u_int32_t *)((rule)->cmd) + ((rule)->act_ofs) )
756
757#define RULESIZE(rule) (sizeof(*(rule)) + (rule)->cmd_len * 4 - 4)
758
759#if 1 // should be moved to in.h
760/*
761 * This structure is used as a flow mask and a flow id for various
762 * parts of the code.
763 * addr_type is used in userland and kernel to mark the address type.
764 * fib is used in the kernel to record the fib in use.
765 * _flags is used in the kernel to store tcp flags for dynamic rules.
766 */
767struct ipfw_flow_id {
768 uint32_t dst_ip;
769 uint32_t src_ip;
770 uint16_t dst_port;
771 uint16_t src_port;
772 uint8_t fib; /* XXX: must be uint16_t */
773 uint8_t proto;
774 uint8_t _flags; /* protocol-specific flags */
775 uint8_t addr_type; /* 4=ip4, 6=ip6, 1=ether ? */
776 struct in6_addr dst_ip6;
777 struct in6_addr src_ip6;
778 uint32_t flow_id6;
779 uint32_t extra; /* queue/pipe or frag_id */
780};
781#endif
782
783#define IS_IP4_FLOW_ID(id) ((id)->addr_type == 4)
784#define IS_IP6_FLOW_ID(id) ((id)->addr_type == 6)
785
786/*
787 * Dynamic ipfw rule.
788 */
789#define IPFW_DYN_ORPHANED 0x40000 /* state's parent rule was deleted */
790
791typedef struct _ipfw_dyn_rule {
792 struct ipfw_flow_id id; /* (masked) flow id */
793 uint8_t set;
794 uint8_t type; /* rule type */
795 uint16_t pad;
796 uint32_t expire; /* expire time */
797 uint32_t rulenum; /* parent's rule number */
798 uint32_t kidx; /* index of named object */
799 uint64_t pcnt; /* packet match counter */
800 uint64_t bcnt; /* byte match counter */
801 uint32_t hashval; /* hash value */
802 union {
803 uint32_t state; /* state of this rule (typically a
804 * combination of TCP flags)
805 */
806 uint32_t count; /* number of linked states */
807 };
808 uint32_t ack_fwd; /* most recent ACKs in forward */
809 uint32_t ack_rev; /* and reverse directions (used */
810 /* to generate keepalives) */
811} __packed __aligned(8) ipfw_dyn_rule;
812
813/*
814 * Definitions for IP option names.
815 */
816#define IP_FW_IPOPT_LSRR 0x01
817#define IP_FW_IPOPT_SSRR 0x02
818#define IP_FW_IPOPT_RR 0x04
819#define IP_FW_IPOPT_TS 0x08
820
821/*
822 * Definitions for TCP option names.
823 */
824#define IP_FW_TCPOPT_MSS 0x01
825#define IP_FW_TCPOPT_WINDOW 0x02
826#define IP_FW_TCPOPT_SACK 0x04
827#define IP_FW_TCPOPT_TS 0x08
828#define IP_FW_TCPOPT_CC 0x10
829
830#define ICMP_REJECT_RST 0x100 /* fake ICMP code (send a TCP RST) */
831#define ICMP6_UNREACH_RST 0x100 /* fake ICMPv6 code (send a TCP RST) */
832#define ICMP_REJECT_ABORT 0x101 /* fake ICMP code (send an SCTP ABORT) */
833#define ICMP6_UNREACH_ABORT 0x101 /* fake ICMPv6 code (send an SCTP ABORT) */
834
835/*
836 * These are used for lookup tables.
837 */
838
839#define IPFW_TABLE_ADDR 1 /* Table for holding IPv4/IPv6 prefixes */
840#define IPFW_TABLE_INTERFACE 2 /* Table for holding interface names */
841#define IPFW_TABLE_NUMBER 3 /* Table for holding ports/uid/gid/etc */
842#define IPFW_TABLE_FLOW 4 /* Table for holding flow data */
843#define IPFW_TABLE_MAC 5 /* Table for holding mac address prefixes */
844#define IPFW_TABLE_MAXTYPE 5 /* Maximum valid number */
845
846#define IPFW_TABLE_CIDR IPFW_TABLE_ADDR /* compat */
847
848/* Value types */
849#define IPFW_VTYPE_LEGACY 0xFFFFFFFF /* All data is filled in */
850#define IPFW_VTYPE_SKIPTO 0x00000001 /* skipto/call/callreturn */
851#define IPFW_VTYPE_PIPE 0x00000002 /* pipe/queue */
852#define IPFW_VTYPE_FIB 0x00000004 /* setfib */
853#define IPFW_VTYPE_NAT 0x00000008 /* nat */
854#define IPFW_VTYPE_DSCP 0x00000010 /* dscp */
855#define IPFW_VTYPE_TAG 0x00000020 /* tag/untag */
856#define IPFW_VTYPE_DIVERT 0x00000040 /* divert/tee */
857#define IPFW_VTYPE_NETGRAPH 0x00000080 /* netgraph/ngtee */
858#define IPFW_VTYPE_LIMIT 0x00000100 /* limit */
859#define IPFW_VTYPE_NH4 0x00000200 /* IPv4 nexthop */
860#define IPFW_VTYPE_NH6 0x00000400 /* IPv6 nexthop */
861#define IPFW_VTYPE_MARK 0x00000800 /* [fw]mark */
862
863typedef struct _ipfw_table_xentry {
864 uint16_t len; /* Total entry length */
865 uint8_t type; /* entry type */
866 uint8_t masklen; /* mask length */
867 uint16_t tbl; /* table number */
868 uint16_t flags; /* record flags */
869 uint32_t value; /* value */
870 union {
871 /* Longest field needs to be aligned by 4-byte boundary */
872 struct in6_addr addr6; /* IPv6 address */
873 char iface[IF_NAMESIZE]; /* interface name */
874 } k;
875} ipfw_table_xentry;
876#define IPFW_TCF_INET 0x01 /* CIDR flags: IPv4 record */
877
878typedef struct _ipfw_xtable {
879 ip_fw3_opheader opheader; /* IP_FW3 opcode */
880 uint32_t size; /* size of entries in bytes */
881 uint32_t cnt; /* # of entries */
882 uint16_t tbl; /* table number */
883 uint8_t type; /* table type */
884 ipfw_table_xentry xent[0]; /* entries */
885} ipfw_xtable;
886
887typedef struct _ipfw_obj_tlv {
888 uint16_t type; /* TLV type */
889 uint16_t flags; /* TLV-specific flags */
890 uint32_t length; /* Total length, aligned to u64 */
891} ipfw_obj_tlv;
892#define IPFW_TLV_TBL_NAME 1
893#define IPFW_TLV_TBLNAME_LIST 2
894#define IPFW_TLV_RULE_LIST 3
895#define IPFW_TLV_DYNSTATE_LIST 4
896#define IPFW_TLV_TBL_ENT 5
897#define IPFW_TLV_DYN_ENT 6
898#define IPFW_TLV_RULE_ENT 7
899#define IPFW_TLV_TBLENT_LIST 8
900#define IPFW_TLV_RANGE 9
901#define IPFW_TLV_EACTION 10
902#define IPFW_TLV_COUNTERS 11
903#define IPFW_TLV_OBJDATA 12
904#define IPFW_TLV_STATE_NAME 14
905
906#define IPFW_TLV_EACTION_BASE 1000
907#define IPFW_TLV_EACTION_NAME(arg) (IPFW_TLV_EACTION_BASE + (arg))
908
909typedef struct _ipfw_obj_data {
910 ipfw_obj_tlv head;
911 void *data[0];
912} ipfw_obj_data;
913
914/* Object name TLV */
915typedef struct _ipfw_obj_ntlv {
916 ipfw_obj_tlv head; /* TLV header */
917 uint32_t idx; /* Name index */
918 uint8_t set; /* set, if applicable */
919 uint8_t type; /* object type, if applicable */
920 uint16_t spare; /* unused */
921 char name[64]; /* Null-terminated name */
922} ipfw_obj_ntlv;
923
924/* IPv4/IPv6 L4 flow description */
925struct tflow_entry {
926 uint8_t af;
927 uint8_t proto;
928 uint16_t spare;
929 uint16_t sport;
930 uint16_t dport;
931 union {
932 struct {
933 struct in_addr sip;
934 struct in_addr dip;
935 } a4;
936 struct {
937 struct in6_addr sip6;
938 struct in6_addr dip6;
939 } a6;
940 } a;
941};
942
943#define IPFW_TVALUE_TYPE_MASK 0xFF00
944#define IPFW_TVALUE_TYPE(insn) (((insn)->arg1 & IPFW_TVALUE_TYPE_MASK) >> 8)
945#define IPFW_SET_TVALUE_TYPE(insn, type) do { \
946 (insn)->arg1 &= ~IPFW_TVALUE_TYPE_MASK; \
947 (insn)->arg1 |= ((type) << 8) & IPFW_TVALUE_TYPE_MASK; \
948} while (0)
949
950enum ipfw_table_value_type {
951 TVALUE_TAG = 0,
952 TVALUE_PIPE,
953 TVALUE_DIVERT,
954 TVALUE_SKIPTO,
955 TVALUE_NETGRAPH,
956 TVALUE_FIB,
957 TVALUE_NAT,
958 TVALUE_NH4,
959 TVALUE_DSCP,
960 TVALUE_LIMIT,
961 TVALUE_MARK,
962};
963
964/* 64-byte structure representing multi-field table value */
965typedef struct _ipfw_table_value {
966 uint32_t tag; /* O_TAG/O_TAGGED */
967 uint16_t pipe; /* O_PIPE/O_QUEUE */
968 uint16_t divert; /* O_DIVERT/O_TEE */
969 uint32_t skipto; /* skipto, CALLRET */
970 uint32_t netgraph; /* O_NETGRAPH/O_NGTEE */
971 uint32_t nat; /* O_NAT */
972 uint32_t nh4;
973 uint16_t fib; /* O_SETFIB */
974 uint8_t dscp;
975 uint8_t spare0;
976 uint32_t kidx; /* value kernel index */
977 struct in6_addr nh6;
978 uint32_t limit; /* O_LIMIT */
979 uint32_t zoneid; /* scope zone id for nh6 */
980 uint32_t mark; /* O_SETMARK/O_MARK */
981 uint32_t refcnt; /* XXX 64-bit in kernel */
982} ipfw_table_value;
983
984/* Table entry TLV */
985typedef struct _ipfw_obj_tentry {
986 ipfw_obj_tlv head; /* TLV header */
987 uint8_t subtype; /* subtype (IPv4,IPv6) */
988 uint8_t masklen; /* mask length */
989 uint8_t result; /* request result */
990 uint8_t spare0;
991 uint32_t idx; /* Table name index */
992 union {
993 /* Longest field needs to be aligned by 8-byte boundary */
994 struct in_addr addr; /* IPv4 address */
995 uint32_t key; /* uid/gid/port */
996 struct in6_addr addr6; /* IPv6 address */
997 char iface[IF_NAMESIZE]; /* interface name */
998 u_char mac[IPFW_MAX_L2_ADDR_LEN]; /* MAC address */
999 struct tflow_entry flow;
1000 } k;
1001 union {
1002 ipfw_table_value value; /* value data */
1003 uint32_t kidx; /* value kernel index */
1004 } v;
1005} ipfw_obj_tentry;
1006#define IPFW_TF_UPDATE 0x01 /* Update record if exists */
1007/* Container TLV */
1008#define IPFW_CTF_ATOMIC 0x01 /* Perform atomic operation */
1009/* Operation results */
1010#define IPFW_TR_IGNORED 0 /* Entry was ignored (rollback) */
1011#define IPFW_TR_ADDED 1 /* Entry was successfully added */
1012#define IPFW_TR_UPDATED 2 /* Entry was successfully updated*/
1013#define IPFW_TR_DELETED 3 /* Entry was successfully deleted*/
1014#define IPFW_TR_LIMIT 4 /* Entry was ignored (limit) */
1015#define IPFW_TR_NOTFOUND 5 /* Entry was not found */
1016#define IPFW_TR_EXISTS 6 /* Entry already exists */
1017#define IPFW_TR_ERROR 7 /* Request has failed (unknown) */
1018
1019typedef struct _ipfw_obj_dyntlv {
1020 ipfw_obj_tlv head;
1021 ipfw_dyn_rule state;
1022} ipfw_obj_dyntlv;
1023#define IPFW_DF_LAST 0x01 /* Last state in chain */
1024
1025/* Containter TLVs */
1026typedef struct _ipfw_obj_ctlv {
1027 ipfw_obj_tlv head; /* TLV header */
1028 uint32_t count; /* Number of sub-TLVs */
1029 uint16_t objsize; /* Single object size */
1030 uint8_t version; /* TLV version */
1031 uint8_t flags; /* TLV-specific flags */
1032} ipfw_obj_ctlv;
1033
1034/* Range TLV */
1035typedef struct _ipfw_range_tlv {
1036 ipfw_obj_tlv head; /* TLV header */
1037 uint32_t flags; /* Range flags */
1038 uint32_t start_rule; /* Range start */
1039 uint32_t end_rule; /* Range end */
1040 uint32_t set; /* Range set to match */
1041 uint32_t new_set; /* New set to move/swap to */
1042} ipfw_range_tlv;
1043#define IPFW_RCFLAG_RANGE 0x01 /* rule range is set */
1044#define IPFW_RCFLAG_ALL 0x02 /* match ALL rules */
1045#define IPFW_RCFLAG_SET 0x04 /* match rules in given set */
1046#define IPFW_RCFLAG_DYNAMIC 0x08 /* match only dynamic states */
1047/* User-settable flags */
1048#define IPFW_RCFLAG_USER (IPFW_RCFLAG_RANGE | IPFW_RCFLAG_ALL | \
1049 IPFW_RCFLAG_SET | IPFW_RCFLAG_DYNAMIC)
1050/* Internally used flags */
1051#define IPFW_RCFLAG_DEFAULT 0x0100 /* Do not skip default rule */
1052
1053typedef struct _ipfw_ta_tinfo {
1054 uint32_t flags; /* Format flags */
1055 uint32_t spare;
1056 uint8_t taclass4; /* algorithm class */
1057 uint8_t spare4;
1058 uint16_t itemsize4; /* item size in runtime */
1059 uint32_t size4; /* runtime structure size */
1060 uint32_t count4; /* number of items in runtime */
1061 uint8_t taclass6; /* algorithm class */
1062 uint8_t spare6;
1063 uint16_t itemsize6; /* item size in runtime */
1064 uint32_t size6; /* runtime structure size */
1065 uint32_t count6; /* number of items in runtime */
1066} ipfw_ta_tinfo;
1067#define IPFW_TACLASS_HASH 1 /* algo is based on hash */
1068#define IPFW_TACLASS_ARRAY 2 /* algo is based on array */
1069#define IPFW_TACLASS_RADIX 3 /* algo is based on radix tree */
1070
1071#define IPFW_TATFLAGS_DATA 0x0001 /* Has data filled in */
1072#define IPFW_TATFLAGS_AFDATA 0x0002 /* Separate data per AF */
1073#define IPFW_TATFLAGS_AFITEM 0x0004 /* diff. items per AF */
1074
1075typedef struct _ipfw_xtable_info {
1076 uint8_t type; /* table type (addr,iface,..) */
1077 uint8_t tflags; /* type flags */
1078 uint16_t mflags; /* modification flags */
1079 uint16_t flags; /* generic table flags */
1080 uint16_t spare[3];
1081 uint32_t vmask; /* bitmask with value types */
1082 uint32_t set; /* set table is in */
1083 uint32_t kidx; /* kernel index */
1084 uint32_t refcnt; /* number of references */
1085 uint32_t count; /* Number of records */
1086 uint32_t size; /* Total size of records(export)*/
1087 uint32_t limit; /* Max number of records */
1088 char tablename[64]; /* table name */
1089 char algoname[64]; /* algorithm name */
1090 ipfw_ta_tinfo ta_info; /* additional algo stats */
1091} ipfw_xtable_info;
1092/* Generic table flags */
1093#define IPFW_TGFLAGS_LOCKED 0x01 /* Tables is locked from changes*/
1094/* Table type-specific flags */
1095#define IPFW_TFFLAG_SRCIP 0x01
1096#define IPFW_TFFLAG_DSTIP 0x02
1097#define IPFW_TFFLAG_SRCPORT 0x04
1098#define IPFW_TFFLAG_DSTPORT 0x08
1099#define IPFW_TFFLAG_PROTO 0x10
1100/* Table modification flags */
1101#define IPFW_TMFLAGS_LIMIT 0x0002 /* Change limit value */
1102#define IPFW_TMFLAGS_LOCK 0x0004 /* Change table lock state */
1103
1104typedef struct _ipfw_iface_info {
1105 char ifname[64]; /* interface name */
1106 uint32_t ifindex; /* interface index */
1107 uint32_t flags; /* flags */
1108 uint32_t refcnt; /* number of references */
1109 uint32_t gencnt; /* number of changes */
1110 uint64_t spare;
1111} ipfw_iface_info;
1112#define IPFW_IFFLAG_RESOLVED 0x01 /* Interface exists */
1113
1114typedef struct _ipfw_ta_info {
1115 char algoname[64]; /* algorithm name */
1116 uint32_t type; /* lookup type */
1117 uint32_t flags;
1118 uint32_t refcnt;
1119 uint32_t spare0;
1120 uint64_t spare1;
1121} ipfw_ta_info;
1122
1123typedef struct _ipfw_cmd_header { /* control command header */
1124 ip_fw3_opheader opheader; /* IP_FW3 opcode */
1125 uint32_t size; /* Total size (incl. header) */
1126 uint32_t cmd; /* command */
1127} ipfw_cmd_header;
1128
1129typedef struct _ipfw_obj_header {
1130 ip_fw3_opheader opheader; /* IP_FW3 opcode */
1131 uint32_t idx; /* object name index */
1132 uint16_t spare;
1133 uint8_t objtype; /* object type */
1134 uint8_t objsubtype; /* object subtype */
1135 ipfw_obj_ntlv ntlv; /* object name tlv */
1136} ipfw_obj_header;
1137
1138typedef struct _ipfw_obj_lheader {
1139 ip_fw3_opheader opheader; /* IP_FW3 opcode */
1140 uint32_t set_mask; /* disabled set mask */
1141 uint32_t count; /* Total objects count */
1142 uint32_t size; /* Total size (incl. header) */
1143 uint32_t objsize; /* Size of one object */
1144} ipfw_obj_lheader;
1145
1146#define IPFW_CFG_GET_STATIC 0x01
1147#define IPFW_CFG_GET_STATES 0x02
1148#define IPFW_CFG_GET_COUNTERS 0x04
1149typedef struct _ipfw_cfg_lheader {
1150 ip_fw3_opheader opheader; /* IP_FW3 opcode */
1151 uint32_t set_mask; /* enabled set mask */
1152 uint32_t spare;
1153 uint32_t flags; /* Request flags */
1154 uint32_t size; /* neded buffer size */
1155 uint32_t start_rule;
1156 uint32_t end_rule;
1157} ipfw_cfg_lheader;
1158
1159typedef struct _ipfw_range_header {
1160 ip_fw3_opheader opheader; /* IP_FW3 opcode */
1161 ipfw_range_tlv range;
1162} ipfw_range_header;
1163
1164typedef struct _ipfw_sopt_info {
1165 uint16_t opcode;
1166 uint8_t version;
1167 uint8_t dir;
1168 uint8_t spare;
1169 uint64_t refcnt;
1170} ipfw_sopt_info;
1171
1172#endif /* _IPFW2_H */