Meg's Mirrors

zig

1	/* $NetBSD: ip_fil.h,v 1.8 2019/11/11 19:33:43 chs Exp $ */
2
3	/*
4	* Copyright (C) 2012 by Darren Reed.
5	*
6	* See the IPFILTER.LICENCE file for details on licencing.
7	*
8	* @(#)ip_fil.h 1.35 6/5/96
9	* Id: ip_fil.h,v 1.1.1.2 2012/07/22 13:45:13 darrenr Exp
10	*/
11
12	#ifndef _NETINET_IP_FIL_H_
13	#define _NETINET_IP_FIL_H_
14
15	#include "netinet/ip_compat.h"
16	#include "netinet/ipf_rb.h"
17	#if NETBSD_GE_REV(104040000)
18	# include <sys/callout.h>
19	#endif
20	#if defined(BSD) && defined(_KERNEL)
21	# if NETBSD_LT_REV(399000000) || defined(__osf__) || FREEBSD_LT_REV(500043)
22	# include <sys/select.h>
23	# else
24	# include <sys/selinfo.h>
25	# endif
26	#endif
27
28	#if !defined(linux) || !defined(_KERNEL)
29	# include <netinet/in.h>
30	#endif
31
32	#ifndef SOLARIS
33	# if (defined(sun) && (defined(__svr4__) || defined(__SVR4)))
34	# define SOLARIS 1
35	# else
36	# define SOLARIS 0
37	# endif
38	#endif
39
40	#if defined(__STDC__) || defined(__GNUC__) || defined(_AIX51)
41	# define SIOCADAFR _IOW('r', 60, struct ipfobj)
42	# define SIOCRMAFR _IOW('r', 61, struct ipfobj)
43	# define SIOCSETFF _IOW('r', 62, u_int)
44	# define SIOCGETFF _IOR('r', 63, u_int)
45	# define SIOCGETFS _IOWR('r', 64, struct ipfobj)
46	# define SIOCIPFFL _IOWR('r', 65, int)
47	# define SIOCIPFFB _IOR('r', 66, int)
48	# define SIOCADIFR _IOW('r', 67, struct ipfobj)
49	# define SIOCRMIFR _IOW('r', 68, struct ipfobj)
50	# define SIOCSWAPA _IOR('r', 69, u_int)
51	# define SIOCINAFR _IOW('r', 70, struct ipfobj)
52	# define SIOCINIFR _IOW('r', 71, struct ipfobj)
53	# define SIOCFRENB _IOW('r', 72, u_int)
54	# define SIOCFRSYN _IOW('r', 73, u_int)
55	# define SIOCFRZST _IOWR('r', 74, struct ipfobj)
56	# define SIOCZRLST _IOWR('r', 75, struct ipfobj)
57	# define SIOCAUTHW _IOWR('r', 76, struct ipfobj)
58	# define SIOCAUTHR _IOWR('r', 77, struct ipfobj)
59	# define SIOCSTAT1 _IOWR('r', 78, struct ipfobj)
60	# define SIOCSTLCK _IOWR('r', 79, u_int)
61	# define SIOCSTPUT _IOWR('r', 80, struct ipfobj)
62	# define SIOCSTGET _IOWR('r', 81, struct ipfobj)
63	# define SIOCSTGSZ _IOWR('r', 82, struct ipfobj)
64	# define SIOCSTAT2 _IOWR('r', 83, struct ipfobj)
65	# define SIOCSETLG _IOWR('r', 84, int)
66	# define SIOCGETLG _IOWR('r', 85, int)
67	# define SIOCFUNCL _IOWR('r', 86, struct ipfunc_resolve)
68	# define SIOCIPFGETNEXT _IOWR('r', 87, struct ipfobj)
69	# define SIOCIPFGET _IOWR('r', 88, struct ipfobj)
70	# define SIOCIPFSET _IOWR('r', 89, struct ipfobj)
71	# define SIOCIPFL6 _IOWR('r', 90, int)
72	# define SIOCIPFITER _IOWR('r', 91, struct ipfobj)
73	# define SIOCGENITER _IOWR('r', 92, struct ipfobj)
74	# define SIOCGTABL _IOWR('r', 93, struct ipfobj)
75	# define SIOCIPFDELTOK _IOWR('r', 94, int)
76	# define SIOCLOOKUPITER _IOWR('r', 95, struct ipfobj)
77	# define SIOCGTQTAB _IOWR('r', 96, struct ipfobj)
78	# define SIOCMATCHFLUSH _IOWR('r', 97, struct ipfobj)
79	# define SIOCIPFINTERROR _IOR('r', 98, int)
80	#else
81	# define SIOCADAFR _IOW(r, 60, struct ipfobj)
82	# define SIOCRMAFR _IOW(r, 61, struct ipfobj)
83	# define SIOCSETFF _IOW(r, 62, u_int)
84	# define SIOCGETFF _IOR(r, 63, u_int)
85	# define SIOCGETFS _IOWR(r, 64, struct ipfobj)
86	# define SIOCIPFFL _IOWR(r, 65, int)
87	# define SIOCIPFFB _IOR(r, 66, int)
88	# define SIOCADIFR _IOW(r, 67, struct ipfobj)
89	# define SIOCRMIFR _IOW(r, 68, struct ipfobj)
90	# define SIOCSWAPA _IOR(r, 69, u_int)
91	# define SIOCINAFR _IOW(r, 70, struct ipfobj)
92	# define SIOCINIFR _IOW(r, 71, struct ipfobj)
93	# define SIOCFRENB _IOW(r, 72, u_int)
94	# define SIOCFRSYN _IOW(r, 73, u_int)
95	# define SIOCFRZST _IOWR(r, 74, struct ipfobj)
96	# define SIOCZRLST _IOWR(r, 75, struct ipfobj)
97	# define SIOCAUTHW _IOWR(r, 76, struct ipfobj)
98	# define SIOCAUTHR _IOWR(r, 77, struct ipfobj)
99	# define SIOCSTAT1 _IOWR(r, 78, struct ipfobj)
100	# define SIOCSTLCK _IOWR(r, 79, u_int)
101	# define SIOCSTPUT _IOWR(r, 80, struct ipfobj)
102	# define SIOCSTGET _IOWR(r, 81, struct ipfobj)
103	# define SIOCSTGSZ _IOWR(r, 82, struct ipfobj)
104	# define SIOCSTAT2 _IOWR(r, 83, struct ipfobj)
105	# define SIOCSETLG _IOWR(r, 84, int)
106	# define SIOCGETLG _IOWR(r, 85, int)
107	# define SIOCFUNCL _IOWR(r, 86, struct ipfunc_resolve)
108	# define SIOCIPFGETNEXT _IOWR(r, 87, struct ipfobj)
109	# define SIOCIPFGET _IOWR(r, 88, struct ipfobj)
110	# define SIOCIPFSET _IOWR(r, 89, struct ipfobj)
111	# define SIOCIPFL6 _IOWR(r, 90, int)
112	# define SIOCIPFITER _IOWR(r, 91, struct ipfobj)
113	# define SIOCGENITER _IOWR(r, 92, struct ipfobj)
114	# define SIOCGTABL _IOWR(r, 93, struct ipfobj)
115	# define SIOCIPFDELTOK _IOWR(r, 94, int)
116	# define SIOCLOOKUPITER _IOWR(r, 95, struct ipfobj)
117	# define SIOCGTQTAB _IOWR(r, 96, struct ipfobj)
118	# define SIOCMATCHFLUSH _IOWR(r, 97, struct ipfobj)
119	# define SIOCIPFINTERROR _IOR(r, 98, int)
120	#endif
121	#define SIOCADDFR SIOCADAFR
122	#define SIOCDELFR SIOCRMAFR
123	#define SIOCINSFR SIOCINAFR
124	#define SIOCATHST SIOCSTAT1
125	#define SIOCGFRST SIOCSTAT2
126
127
128	struct ipscan;
129	struct ifnet;
130	struct ipf_main_softc_s;
131
132	typedef int (* lookupfunc_t)(struct ipf_main_softc_s *, void *,
133	int, void *, u_int);
134
135	/*
136	* i6addr is used as a container for both IPv4 and IPv6 addresses, as well
137	* as other types of objects, depending on its qualifier.
138	*/
139	#ifdef USE_INET6
140	typedef union i6addr {
141	u_32_t i6[4];
142	struct in_addr in4;
143	struct in6_addr in6;
144	void *vptr[2];
145	lookupfunc_t lptr[2];
146	struct {
147	u_short type;
148	u_short subtype;
149	int name;
150	} i6un;
151	} i6addr_t;
152	#else
153	typedef union i6addr {
154	u_32_t i6[4];
155	struct in_addr in4;
156	void *vptr[2];
157	lookupfunc_t lptr[2];
158	struct {
159	u_short type;
160	u_short subtype;
161	int name;
162	} i6un;
163	} i6addr_t;
164	#endif
165
166	#define in4_addr in4.s_addr
167	#define iplookupnum i6[1]
168	#define iplookupname i6un.name
169	#define iplookuptype i6un.type
170	#define iplookupsubtype i6un.subtype
171	/*
172	* NOTE: These DO overlap the above on 64bit systems and this IS recognised.
173	*/
174	#define iplookupptr vptr[0]
175	#define iplookupfunc lptr[1]
176
177	/* Avoid casting to a type presuming 64-bit alignment. */
178	#define I60(x) (((u_32_t *)(x))[0])
179	#define I61(x) (((u_32_t *)(x))[1])
180	#define I62(x) (((u_32_t *)(x))[2])
181	#define I63(x) (((u_32_t *)(x))[3])
182	#define HI60(x) ntohl(((u_32_t *)(x))[0])
183	#define HI61(x) ntohl(((u_32_t *)(x))[1])
184	#define HI62(x) ntohl(((u_32_t *)(x))[2])
185	#define HI63(x) ntohl(((u_32_t *)(x))[3])
186
187	#define IP6_EQ(a,b) ((I63(a) == I63(b)) && (I62(a) == I62(b)) && \
188	(I61(a) == I61(b)) && (I60(a) == I60(b)))
189	#define IP6_NEQ(a,b) ((I63(a) != I63(b)) || (I62(a) != I62(b)) || \
190	(I61(a) != I61(b)) || (I60(a) != I60(b)))
191	#define IP6_ISZERO(a) ((I60(a) | I61(a) | I62(a) | I63(a)) == 0)
192	#define IP6_NOTZERO(a) ((I60(a) | I61(a) | I62(a) | I63(a)) != 0)
193	#define IP6_ISONES(a) ((I63(a) == 0xffffffff) && (I62(a) == 0xffffffff) && \
194	(I61(a) == 0xffffffff) && (I60(a) == 0xffffffff))
195	#define IP6_GT(a,b) (ntohl(HI60(a)) > ntohl(HI60(b)) || \
196	(HI60(a) == HI60(b) && \
197	(ntohl(HI61(a)) > ntohl(HI61(b)) || \
198	(HI61(a) == HI61(b) && \
199	(ntohl(HI62(a)) > ntohl(HI62(b)) || \
200	(HI62(a) == HI62(b) && \
201	ntohl(HI63(a)) > ntohl(HI63(b))))))))
202	#define IP6_LT(a,b) (ntohl(HI60(a)) < ntohl(HI60(b)) || \
203	(HI60(a) == HI60(b) && \
204	(ntohl(HI61(a)) < ntohl(HI61(b)) || \
205	(HI61(a) == HI61(b) && \
206	(ntohl(HI62(a)) < ntohl(HI62(b)) || \
207	(HI62(a) == HI62(b) && \
208	ntohl(HI63(a)) < ntohl(HI63(b))))))))
209	#define NLADD(n,x) htonl(ntohl(n) + (x))
210	#define IP6_INC(a) \
211	do { u_32_t *_i6 = (u_32_t *)(a); \
212	_i6[3] = NLADD(_i6[3], 1); \
213	if (_i6[3] == 0) { \
214	_i6[2] = NLADD(_i6[2], 1); \
215	if (_i6[2] == 0) { \
216	_i6[1] = NLADD(_i6[1], 1); \
217	if (_i6[1] == 0) { \
218	_i6[0] = NLADD(_i6[0], 1); \
219	} \
220	} \
221	} \
222	} while (0)
223	#define IP6_ADD(a,x,d) \
224	do { i6addr_t *_s = (i6addr_t *)(a); \
225	i6addr_t *_d = (i6addr_t *)(d); \
226	_d->i6[0] = NLADD(_s->i6[0], x); \
227	if (ntohl(_d->i6[0]) < ntohl(_s->i6[0])) { \
228	_d->i6[1] = NLADD(_d->i6[1], 1); \
229	if (ntohl(_d->i6[1]) < ntohl(_s->i6[1])) { \
230	_d->i6[2] = NLADD(_d->i6[2], 1); \
231	if (ntohl(_d->i6[2]) < ntohl(_s->i6[2])) { \
232	_d->i6[3] = NLADD(_d->i6[3], 1); \
233	} \
234	} \
235	} \
236	} while (0)
237	#define IP6_AND(a,b,d) do { i6addr_t *_s1 = (i6addr_t *)(a); \
238	i6addr_t *_s2 = (i6addr_t *)(b); \
239	i6addr_t *_d = (i6addr_t *)(d); \
240	_d->i6[0] = _s1->i6[0] & _s2->i6[0]; \
241	_d->i6[1] = _s1->i6[1] & _s2->i6[1]; \
242	_d->i6[2] = _s1->i6[2] & _s2->i6[2]; \
243	_d->i6[3] = _s1->i6[3] & _s2->i6[3]; \
244	} while (0)
245	#define IP6_ANDASSIGN(a,m) \
246	do { i6addr_t *_d = (i6addr_t *)(a); \
247	i6addr_t *_m = (i6addr_t *)(m); \
248	_d->i6[0] &= _m->i6[0]; \
249	_d->i6[1] &= _m->i6[1]; \
250	_d->i6[2] &= _m->i6[2]; \
251	_d->i6[3] &= _m->i6[3]; \
252	} while (0)
253	#define IP6_MASKEQ(a,m,b) \
254	(((I60(a) & I60(m)) == I60(b)) && \
255	((I61(a) & I61(m)) == I61(b)) && \
256	((I62(a) & I62(m)) == I62(b)) && \
257	((I63(a) & I63(m)) == I63(b)))
258	#define IP6_MASKNEQ(a,m,b) \
259	(((I60(a) & I60(m)) != I60(b)) || \
260	((I61(a) & I61(m)) != I61(b)) || \
261	((I62(a) & I62(m)) != I62(b)) || \
262	((I63(a) & I63(m)) != I63(b)))
263	#define IP6_MERGE(a,b,c) \
264	do { i6addr_t *_d, *_s1, *_s2; \
265	_d = (i6addr_t *)(a); \
266	_s1 = (i6addr_t *)(b); \
267	_s2 = (i6addr_t *)(c); \
268	_d->i6[0] |= _s1->i6[0] & ~_s2->i6[0]; \
269	_d->i6[1] |= _s1->i6[1] & ~_s2->i6[1]; \
270	_d->i6[2] |= _s1->i6[2] & ~_s2->i6[2]; \
271	_d->i6[3] |= _s1->i6[3] & ~_s2->i6[3]; \
272	} while (0)
273	#define IP6_MASK(a,b,c) \
274	do { i6addr_t *_d, *_s1, *_s2; \
275	_d = (i6addr_t *)(a); \
276	_s1 = (i6addr_t *)(b); \
277	_s2 = (i6addr_t *)(c); \
278	_d->i6[0] = _s1->i6[0] & ~_s2->i6[0]; \
279	_d->i6[1] = _s1->i6[1] & ~_s2->i6[1]; \
280	_d->i6[2] = _s1->i6[2] & ~_s2->i6[2]; \
281	_d->i6[3] = _s1->i6[3] & ~_s2->i6[3]; \
282	} while (0)
283	#define IP6_SETONES(a) \
284	do { i6addr_t *_d = (i6addr_t *)(a); \
285	_d->i6[0] = 0xffffffff; \
286	_d->i6[1] = 0xffffffff; \
287	_d->i6[2] = 0xffffffff; \
288	_d->i6[3] = 0xffffffff; \
289	} while (0)
290
291	typedef union ipso_u {
292	u_short ipso_ripso[2];
293	u_32_t ipso_doi;
294	} ipso_t;
295
296	typedef struct fr_ip {
297	u_32_t fi_v:4; /* IP version */
298	u_32_t fi_xx:4; /* spare */
299	u_32_t fi_tos:8; /* IP packet TOS */
300	u_32_t fi_ttl:8; /* IP packet TTL */
301	u_32_t fi_p:8; /* IP packet protocol */
302	u_32_t fi_optmsk; /* bitmask composed from IP options */
303	i6addr_t fi_src; /* source address from packet */
304	i6addr_t fi_dst; /* destination address from packet */
305	ipso_t fi_ipso; /* IP security options */
306	u_32_t fi_flx; /* packet flags */
307	u_32_t fi_tcpmsk; /* TCP options set/reset */
308	u_32_t fi_ports[2]; /* TCP ports */
309	u_char fi_tcpf; /* TCP flags */
310	u_char fi_sensitivity;
311	u_char fi_xxx[2]; /* pad */
312	} fr_ip_t;
313
314	/*
315	* For use in fi_flx
316	*/
317	#define FI_TCPUDP 0x0001 /* TCP/UCP implied comparison*/
318	#define FI_OPTIONS 0x0002
319	#define FI_FRAG 0x0004
320	#define FI_SHORT 0x0008
321	#define FI_NATED 0x0010
322	#define FI_MULTICAST 0x0020
323	#define FI_BROADCAST 0x0040
324	#define FI_MBCAST 0x0080
325	#define FI_STATE 0x0100
326	#define FI_BADNAT 0x0200
327	#define FI_BAD 0x0400
328	#define FI_OOW 0x0800 /* Out of state window, else match */
329	#define FI_ICMPERR 0x1000
330	#define FI_FRAGBODY 0x2000
331	#define FI_BADSRC 0x4000
332	#define FI_LOWTTL 0x8000
333	#define FI_CMP 0x5cfe3 /* Not FI_FRAG,FI_NATED,FI_FRAGTAIL */
334	#define FI_ICMPCMP 0x0003 /* Flags we can check for ICMP error packets */
335	#define FI_WITH 0x5effe /* Not FI_TCPUDP */
336	#define FI_V6EXTHDR 0x10000
337	#define FI_COALESCE 0x20000
338	#define FI_NEWNAT 0x40000
339	#define FI_ICMPQUERY 0x80000
340	#define FI_ENCAP 0x100000 /* encap/decap with NAT */
341	#define FI_AH 0x200000 /* AH header present */
342	#define FI_DOCKSUM 0x10000000 /* Proxy wants L4 recalculation */
343	#define FI_NOCKSUM 0x20000000 /* don't do a L4 checksum validation */
344	#define FI_NOWILD 0x40000000 /* Do not do wildcard searches */
345	#define FI_IGNORE 0x80000000
346
347	#define fi_secmsk fi_ipso.ipso_ripso[0]
348	#define fi_auth fi_ipso.ipso_ripso[1]
349	#define fi_doi fi_ipso.ipso_doi
350	#define fi_saddr fi_src.in4.s_addr
351	#define fi_daddr fi_dst.in4.s_addr
352	#define fi_srcnum fi_src.iplookupnum
353	#define fi_dstnum fi_dst.iplookupnum
354	#define fi_srcname fi_src.iplookupname
355	#define fi_dstname fi_dst.iplookupname
356	#define fi_srctype fi_src.iplookuptype
357	#define fi_dsttype fi_dst.iplookuptype
358	#define fi_srcsubtype fi_src.iplookupsubtype
359	#define fi_dstsubtype fi_dst.iplookupsubtype
360	#define fi_srcptr fi_src.iplookupptr
361	#define fi_dstptr fi_dst.iplookupptr
362	#define fi_srcfunc fi_src.iplookupfunc
363	#define fi_dstfunc fi_dst.iplookupfunc
364
365
366	/*
367	* These are both used by the state and NAT code to indicate that one port or
368	* the other should be treated as a wildcard.
369	* NOTE: When updating, check bit masks in ip_state.h and update there too.
370	*/
371	#define SI_W_SPORT 0x00000100
372	#define SI_W_DPORT 0x00000200
373	#define SI_WILDP (SI_W_SPORT|SI_W_DPORT)
374	#define SI_W_SADDR 0x00000400
375	#define SI_W_DADDR 0x00000800
376	#define SI_WILDA (SI_W_SADDR|SI_W_DADDR)
377	#define SI_NEWFR 0x00001000
378	#define SI_CLONE 0x00002000
379	#define SI_CLONED 0x00004000
380	#define SI_NEWCLONE 0x00008000
381
382	typedef struct {
383	u_short fda_ports[2];
384	u_char fda_tcpf; /* TCP header flags (SYN, ACK, etc) */
385	} frdat_t;
386
387	typedef enum fr_breasons_e {
388	FRB_BLOCKED = 0,
389	FRB_LOGFAIL = 1,
390	FRB_PPSRATE = 2,
391	FRB_JUMBO = 3,
392	FRB_MAKEFRIP = 4,
393	FRB_STATEADD = 5,
394	FRB_UPDATEIPID = 6,
395	FRB_LOGFAIL2 = 7,
396	FRB_DECAPFRIP = 8,
397	FRB_AUTHNEW = 9,
398	FRB_AUTHCAPTURE = 10,
399	FRB_COALESCE = 11,
400	FRB_PULLUP = 12,
401	FRB_AUTHFEEDBACK = 13,
402	FRB_BADFRAG = 14,
403	FRB_NATV4 = 15,
404	FRB_NATV6 = 16,
405	} fr_breason_t;
406
407	#define FRB_MAX_VALUE 16
408
409	typedef enum ipf_cksum_e {
410	FI_CK_BAD = -1,
411	FI_CK_NEEDED = 0,
412	FI_CK_SUMOK = 1,
413	FI_CK_L4PART = 2,
414	FI_CK_L4FULL = 4
415	} ipf_cksum_t;
416
417	typedef struct fr_info {
418	void *fin_main_soft;
419	void *fin_ifp; /* interface packet is `on' */
420	struct frentry *fin_fr; /* last matching rule */
421	int fin_out; /* in or out ? 1 == out, 0 == in */
422	fr_ip_t fin_fi; /* IP Packet summary */
423	frdat_t fin_dat; /* TCP/UDP ports, ICMP code/type */
424	int fin_dlen; /* length of data portion of packet */
425	int fin_plen;
426	u_32_t fin_rule; /* rule # last matched */
427	u_short fin_hlen; /* length of IP header in bytes */
428	char fin_group[FR_GROUPLEN]; /* group number, -1 for none */
429	void *fin_dp; /* start of data past IP header */
430	/*
431	* Fields after fin_dp aren't used for compression of log records.
432	* fin_fi contains the IP version (fin_family)
433	* fin_rule isn't included because adding a new rule can change it but
434	* not change fin_fr. fin_rule is the rule number reported.
435	* It isn't necessary to include fin_crc because that is checked
436	* for explicitly, before calling bcmp.
437	*/
438	u_32_t fin_crc; /* Simple calculation for logging */
439	int fin_family; /* AF_INET, etc. */
440	int fin_icode; /* ICMP error to return */
441	int fin_mtu; /* MTU input for ICMP need-frag */
442	int fin_rev; /* state only: 1 = reverse */
443	int fin_ipoff; /* # bytes from buffer start to hdr */
444	u_32_t fin_id; /* IP packet id field */
445	u_short fin_l4hlen; /* length of L4 header, if known */
446	u_short fin_off;
447	int fin_depth; /* Group nesting depth */
448	int fin_error; /* Error code to return */
449	ipf_cksum_t fin_cksum; /* -1 = bad, 1 = good, 0 = not done */
450	fr_breason_t fin_reason; /* why auto blocked */
451	u_int fin_pktnum;
452	void *fin_nattag;
453	struct frdest *fin_dif;
454	struct frdest *fin_tif;
455	union {
456	ip_t *fip_ip;
457	#ifdef USE_INET6
458	ip6_t *fip_ip6;
459	#endif
460	} fin_ipu;
461	mb_t **fin_mp; /* pointer to pointer to mbuf */
462	mb_t *fin_m; /* pointer to mbuf */
463	#ifdef MENTAT
464	mb_t *fin_qfm; /* pointer to mblk where pkt starts */
465	void *fin_qpi;
466	char fin_ifname[LIFNAMSIZ];
467	#endif
468	#ifdef __sgi
469	void *fin_hbuf;
470	#endif
471	void *fin_fraghdr; /* pointer to start of ipv6 frag hdr */
472	} fr_info_t;
473
474	#define fin_ip fin_ipu.fip_ip
475	#define fin_ip6 fin_ipu.fip_ip6
476	#define fin_v fin_fi.fi_v
477	#define fin_p fin_fi.fi_p
478	#define fin_flx fin_fi.fi_flx
479	#define fin_optmsk fin_fi.fi_optmsk
480	#define fin_secmsk fin_fi.fi_secmsk
481	#define fin_doi fin_fi.fi_doi
482	#define fin_auth fin_fi.fi_auth
483	#define fin_src fin_fi.fi_src.in4
484	#define fin_saddr fin_fi.fi_saddr
485	#define fin_dst fin_fi.fi_dst.in4
486	#define fin_daddr fin_fi.fi_daddr
487	#define fin_data fin_fi.fi_ports
488	#define fin_sport fin_fi.fi_ports[0]
489	#define fin_dport fin_fi.fi_ports[1]
490	#define fin_tcpf fin_fi.fi_tcpf
491	#define fin_src6 fin_fi.fi_src
492	#define fin_dst6 fin_fi.fi_dst
493	#define fin_srcip6 fin_fi.fi_src.in6
494	#define fin_dstip6 fin_fi.fi_dst.in6
495
496	#define IPF_IN 0
497	#define IPF_OUT 1
498
499	typedef struct frentry *(*ipfunc_t)(fr_info_t *, u_32_t *);
500	typedef int (*ipfuncinit_t)(struct ipf_main_softc_s *,
501	struct frentry *);
502
503	typedef struct ipfunc_resolve {
504	char ipfu_name[32];
505	ipfunc_t ipfu_addr;
506	ipfuncinit_t ipfu_init;
507	ipfuncinit_t ipfu_fini;
508	} ipfunc_resolve_t;
509
510	/*
511	* Size for compares on fr_info structures
512	*/
513	#define FI_CSIZE offsetof(fr_info_t, fin_icode)
514	#define FI_LCSIZE offsetof(fr_info_t, fin_dp)
515
516	/*
517	* Size for copying cache fr_info structure
518	*/
519	#define FI_COPYSIZE offsetof(fr_info_t, fin_dp)
520
521	/*
522	* Structure for holding IPFilter's tag information
523	*/
524	#define IPFTAG_LEN 16
525	typedef struct {
526	union {
527	u_32_t iptu_num[4];
528	char iptu_tag[IPFTAG_LEN];
529	} ipt_un;
530	int ipt_not;
531	} ipftag_t;
532
533	#define ipt_tag ipt_un.iptu_tag
534	#define ipt_num ipt_un.iptu_num
535
536	/*
537	* Structure to define address for pool lookups.
538	*/
539	typedef struct {
540	u_char adf_len;
541	sa_family_t adf_family;
542	u_char adf_xxx[2];
543	i6addr_t adf_addr;
544	} addrfamily_t;
545
546
547	RBI_LINK(ipf_rb, host_node_s);
548
549	typedef struct host_node_s {
550	RBI_FIELD(ipf_rb) hn_entry;
551	addrfamily_t hn_addr;
552	int hn_active;
553	} host_node_t;
554
555	typedef RBI_HEAD(ipf_rb, host_node_s) ipf_rb_head_t;
556
557	typedef struct host_track_s {
558	ipf_rb_head_t ht_root;
559	int ht_max_nodes;
560	int ht_max_per_node;
561	int ht_netmask;
562	int ht_cur_nodes;
563	} host_track_t;
564
565
566	typedef enum fr_dtypes_e {
567	FRD_NORMAL = 0,
568	FRD_DSTLIST
569	} fr_dtypes_t;
570	/*
571	* This structure is used to hold information about the next hop for where
572	* to forward a packet.
573	*/
574	typedef struct frdest {
575	void *fd_ptr;
576	addrfamily_t fd_addr;
577	fr_dtypes_t fd_type;
578	int fd_name;
579	int fd_unused; /* part of the kernel/user ABI */
580	} frdest_t;
581
582	#define fd_ip6 fd_addr.adf_addr
583	#define fd_ip fd_ip6.in4
584
585
586	typedef enum fr_ctypes_e {
587	FR_NONE = 0,
588	FR_EQUAL,
589	FR_NEQUAL,
590	FR_LESST,
591	FR_GREATERT,
592	FR_LESSTE,
593	FR_GREATERTE,
594	FR_OUTRANGE,
595	FR_INRANGE,
596	FR_INCRANGE
597	} fr_ctypes_t;
598
599	/*
600	* This structure holds information about a port comparison.
601	*/
602	typedef struct frpcmp {
603	fr_ctypes_t frp_cmp; /* data for port comparisons */
604	u_32_t frp_port; /* top port for <> and >< */
605	u_32_t frp_top; /* top port for <> and >< */
606	} frpcmp_t;
607
608
609	/*
610	* Structure containing all the relevant TCP things that can be checked in
611	* a filter rule.
612	*/
613	typedef struct frtuc {
614	u_char ftu_tcpfm; /* tcp flags mask */
615	u_char ftu_tcpf; /* tcp flags */
616	frpcmp_t ftu_src;
617	frpcmp_t ftu_dst;
618	} frtuc_t;
619
620	#define ftu_scmp ftu_src.frp_cmp
621	#define ftu_dcmp ftu_dst.frp_cmp
622	#define ftu_sport ftu_src.frp_port
623	#define ftu_dport ftu_dst.frp_port
624	#define ftu_stop ftu_src.frp_top
625	#define ftu_dtop ftu_dst.frp_top
626
627	#define FR_TCPFMAX 0x3f
628
629	typedef enum fr_atypes_e {
630	FRI_NONE = -1, /* For LHS of NAT */
631	FRI_NORMAL = 0, /* Normal address */
632	FRI_DYNAMIC, /* dynamic address */
633	FRI_LOOKUP, /* address is a pool # */
634	FRI_RANGE, /* address/mask is a range */
635	FRI_NETWORK, /* network address from if */
636	FRI_BROADCAST, /* broadcast address from if */
637	FRI_PEERADDR, /* Peer address for P-to-P */
638	FRI_NETMASKED, /* network address with netmask from if */
639	FRI_SPLIT, /* For NAT compatibility */
640	FRI_INTERFACE /* address is based on interface name */
641	} fr_atypes_t;
642
643	/*
644	* This structure makes up what is considered to be the IPFilter specific
645	* matching components of a filter rule, as opposed to the data structures
646	* used to define the result which are in frentry_t and not here.
647	*/
648	typedef struct fripf {
649	fr_ip_t fri_ip;
650	fr_ip_t fri_mip; /* mask structure */
651
652	u_short fri_icmpm; /* data for ICMP packets (mask) */
653	u_short fri_icmp;
654
655	frtuc_t fri_tuc;
656	fr_atypes_t fri_satype; /* addres type */
657	fr_atypes_t fri_datype; /* addres type */
658	int fri_sifpidx; /* doing dynamic addressing */
659	int fri_difpidx; /* index into fr_ifps[] to use when */
660	} fripf_t;
661
662	#define fri_dlookup fri_mip.fi_dst
663	#define fri_slookup fri_mip.fi_src
664	#define fri_dstnum fri_mip.fi_dstnum
665	#define fri_srcnum fri_mip.fi_srcnum
666	#define fri_dstname fri_mip.fi_dstname
667	#define fri_srcname fri_mip.fi_srcname
668	#define fri_dstptr fri_mip.fi_dstptr
669	#define fri_srcptr fri_mip.fi_srcptr
670
671
672	typedef enum fr_rtypes_e {
673	FR_T_NONE = 0,
674	FR_T_IPF, /* IPF structures */
675	FR_T_BPFOPC, /* BPF opcode */
676	FR_T_CALLFUNC, /* callout to function in fr_func only */
677	FR_T_COMPIPF, /* compiled C code */
678	FR_T_IPFEXPR, /* IPF expression */
679	FR_T_BUILTIN = 0x40000000, /* rule is in kernel space */
680	FR_T_IPF_BUILTIN,
681	FR_T_BPFOPC_BUILTIN,
682	FR_T_CALLFUNC_BUILTIN,
683	FR_T_COMPIPF_BUILTIN,
684	FR_T_IPFEXPR_BUILTIN
685	} fr_rtypes_t;
686
687	typedef struct frentry * (* frentfunc_t)(fr_info_t *);
688
689	typedef struct frentry {
690	ipfmutex_t fr_lock;
691	struct frentry *fr_next;
692	struct frentry **fr_pnext;
693	struct frgroup *fr_grp;
694	struct frgroup *fr_grphead;
695	struct frgroup *fr_icmpgrp;
696	struct ipscan *fr_isc;
697	struct frentry *fr_dnext; /* 2 fr_die linked list pointers */
698	struct frentry **fr_pdnext;
699	void *fr_ifas[4];
700	void *fr_ptr; /* for use with fr_arg */
701	int fr_comment; /* text comment for rule */
702	int fr_size; /* size of this structure */
703	int fr_ref; /* reference count */
704	int fr_statecnt; /* state count - for limit rules */
705	u_32_t fr_die; /* only used on loading the rule */
706	u_int fr_cksum; /* checksum on filter rules for performance */
707	/*
708	* The line number from a file is here because we need to be able to
709	* match the rule generated with ``grep rule ipf.conf | ipf -rf -''
710	* with the rule loaded using ``ipf -f ipf.conf'' - thus it can't be
711	* on the other side of fr_func.
712	*/
713	int fr_flineno; /* line number from conf file */
714	/*
715	* These are only incremented when a packet matches this rule and
716	* it is the last match
717	*/
718	U_QUAD_T fr_hits;
719	U_QUAD_T fr_bytes;
720
721	/*
722	* For PPS rate limiting
723	* fr_lpu is used to always have the same size for this field,
724	* allocating 64bits for seconds and 32bits for milliseconds.
725	*/
726	union {
727	struct timeval frp_lastpkt;
728	char frp_bytes[12];
729	} fr_lpu;
730	int fr_curpps;
731
732	union {
733	void *fru_data;
734	char *fru_caddr;
735	fripf_t *fru_ipf;
736	frentfunc_t fru_func;
737	} fr_dun;
738
739	/*
740	* Fields after this may not change whilst in the kernel.
741	*/
742	ipfunc_t fr_func; /* call this function */
743	int fr_dsize;
744	int fr_pps;
745	fr_rtypes_t fr_type;
746	u_32_t fr_flags; /* per-rule flags && options (see below) */
747	u_32_t fr_logtag; /* user defined log tag # */
748	u_32_t fr_collect; /* collection number */
749	u_int fr_arg; /* misc. numeric arg for rule */
750	u_int fr_loglevel; /* syslog log facility + priority */
751	u_char fr_family;
752	u_char fr_icode; /* return ICMP code */
753	int fr_group; /* group to which this rule belongs */
754	int fr_grhead; /* group # which this rule starts */
755	int fr_ifnames[4];
756	int fr_isctag;
757	int fr_rpc; /* XID Filtering */
758	ipftag_t fr_nattag;
759	frdest_t fr_tifs[2]; /* "to"/"reply-to" interface */
760	frdest_t fr_dif; /* duplicate packet interface */
761	/*
762	* These are all options related to stateful filtering
763	*/
764	host_track_t fr_srctrack;
765	int fr_nostatelog;
766	int fr_statemax; /* max reference count */
767	int fr_icmphead; /* ICMP group for state options */
768	u_int fr_age[2]; /* non-TCP state timeouts */
769	/*
770	* How big is the name buffer at the end?
771	*/
772	int fr_namelen;
773	char fr_names[1];
774	} frentry_t;
775
776	#define fr_lastpkt fr_lpu.frp_lastpkt
777	#define fr_caddr fr_dun.fru_caddr
778	#define fr_data fr_dun.fru_data
779	#define fr_dfunc fr_dun.fru_func
780	#define fr_ipf fr_dun.fru_ipf
781	#define fr_ip fr_ipf->fri_ip
782	#define fr_mip fr_ipf->fri_mip
783	#define fr_icmpm fr_ipf->fri_icmpm
784	#define fr_icmp fr_ipf->fri_icmp
785	#define fr_tuc fr_ipf->fri_tuc
786	#define fr_satype fr_ipf->fri_satype
787	#define fr_datype fr_ipf->fri_datype
788	#define fr_sifpidx fr_ipf->fri_sifpidx
789	#define fr_difpidx fr_ipf->fri_difpidx
790	#define fr_proto fr_ip.fi_p
791	#define fr_mproto fr_mip.fi_p
792	#define fr_ttl fr_ip.fi_ttl
793	#define fr_mttl fr_mip.fi_ttl
794	#define fr_tos fr_ip.fi_tos
795	#define fr_mtos fr_mip.fi_tos
796	#define fr_tcpfm fr_tuc.ftu_tcpfm
797	#define fr_tcpf fr_tuc.ftu_tcpf
798	#define fr_scmp fr_tuc.ftu_scmp
799	#define fr_dcmp fr_tuc.ftu_dcmp
800	#define fr_dport fr_tuc.ftu_dport
801	#define fr_sport fr_tuc.ftu_sport
802	#define fr_stop fr_tuc.ftu_stop
803	#define fr_dtop fr_tuc.ftu_dtop
804	#define fr_dst fr_ip.fi_dst.in4
805	#define fr_dst6 fr_ip.fi_dst
806	#define fr_daddr fr_ip.fi_dst.in4.s_addr
807	#define fr_src fr_ip.fi_src.in4
808	#define fr_src6 fr_ip.fi_src
809	#define fr_saddr fr_ip.fi_src.in4.s_addr
810	#define fr_dmsk fr_mip.fi_dst.in4
811	#define fr_dmsk6 fr_mip.fi_dst
812	#define fr_dmask fr_mip.fi_dst.in4.s_addr
813	#define fr_smsk fr_mip.fi_src.in4
814	#define fr_smsk6 fr_mip.fi_src
815	#define fr_smask fr_mip.fi_src.in4.s_addr
816	#define fr_dstnum fr_ip.fi_dstnum
817	#define fr_srcnum fr_ip.fi_srcnum
818	#define fr_dlookup fr_ip.fi_dst
819	#define fr_slookup fr_ip.fi_src
820	#define fr_dstname fr_ip.fi_dstname
821	#define fr_srcname fr_ip.fi_srcname
822	#define fr_dsttype fr_ip.fi_dsttype
823	#define fr_srctype fr_ip.fi_srctype
824	#define fr_dstsubtype fr_ip.fi_dstsubtype
825	#define fr_srcsubtype fr_ip.fi_srcsubtype
826	#define fr_dstptr fr_mip.fi_dstptr
827	#define fr_srcptr fr_mip.fi_srcptr
828	#define fr_dstfunc fr_mip.fi_dstfunc
829	#define fr_srcfunc fr_mip.fi_srcfunc
830	#define fr_optbits fr_ip.fi_optmsk
831	#define fr_optmask fr_mip.fi_optmsk
832	#define fr_secbits fr_ip.fi_secmsk
833	#define fr_secmask fr_mip.fi_secmsk
834	#define fr_authbits fr_ip.fi_auth
835	#define fr_authmask fr_mip.fi_auth
836	#define fr_doi fr_ip.fi_doi
837	#define fr_doimask fr_mip.fi_doi
838	#define fr_flx fr_ip.fi_flx
839	#define fr_mflx fr_mip.fi_flx
840	#define fr_ifa fr_ifas[0]
841	#define fr_oifa fr_ifas[2]
842	#define fr_tif fr_tifs[0]
843	#define fr_rif fr_tifs[1]
844
845	#define FR_NOLOGTAG 0
846
847	#define FR_CMPSIZ (sizeof(struct frentry) - \
848	offsetof(struct frentry, fr_func))
849	#define FR_NAME(_f, _n) (_f)->fr_names + (_f)->_n
850
851
852	/*
853	* fr_flags
854	*/
855	#define FR_BLOCK 0x00001 /* do not allow packet to pass */
856	#define FR_PASS 0x00002 /* allow packet to pass */
857	#define FR_AUTH 0x00003 /* use authentication */
858	#define FR_PREAUTH 0x00004 /* require preauthentication */
859	#define FR_ACCOUNT 0x00005 /* Accounting rule */
860	#define FR_SKIP 0x00006 /* skip rule */
861	#define FR_DECAPSULATE 0x00008 /* decapsulate rule */
862	#define FR_CALL 0x00009 /* call rule */
863	#define FR_CMDMASK 0x0000f
864	#define FR_LOG 0x00010 /* Log */
865	#define FR_LOGB 0x00011 /* Log-fail */
866	#define FR_LOGP 0x00012 /* Log-pass */
867	#define FR_LOGMASK (FR_LOG|FR_CMDMASK)
868	#define FR_CALLNOW 0x00020 /* call another function (fr_func) if matches */
869	#define FR_NOTSRCIP 0x00040
870	#define FR_NOTDSTIP 0x00080
871	#define FR_QUICK 0x00100 /* match & stop processing list */
872	#define FR_KEEPFRAG 0x00200 /* keep fragment information */
873	#define FR_KEEPSTATE 0x00400 /* keep `connection' state information */
874	#define FR_FASTROUTE 0x00800 /* bypass normal routing */
875	#define FR_RETRST 0x01000 /* Return TCP RST packet - reset connection */
876	#define FR_RETICMP 0x02000 /* Return ICMP unreachable packet */
877	#define FR_FAKEICMP 0x03000 /* Return ICMP unreachable with fake source */
878	#define FR_OUTQUE 0x04000 /* outgoing packets */
879	#define FR_INQUE 0x08000 /* ingoing packets */
880	#define FR_LOGBODY 0x10000 /* Log the body */
881	#define FR_LOGFIRST 0x20000 /* Log the first byte if state held */
882	#define FR_LOGORBLOCK 0x40000 /* block the packet if it can't be logged */
883	#define FR_STLOOSE 0x80000 /* loose state checking */
884	#define FR_FRSTRICT 0x100000 /* strict frag. cache */
885	#define FR_STSTRICT 0x200000 /* strict keep state */
886	#define FR_NEWISN 0x400000 /* new ISN for outgoing TCP */
887	#define FR_NOICMPERR 0x800000 /* do not match ICMP errors in state */
888	#define FR_STATESYNC 0x1000000 /* synchronize state to slave */
889	#define FR_COPIED 0x2000000 /* copied from user space */
890	#define FR_INACTIVE 0x4000000 /* only used when flush'ing rules */
891	#define FR_NOMATCH 0x8000000 /* no match occured */
892	/* 0x10000000 FF_LOGPASS */
893	/* 0x20000000 FF_LOGBLOCK */
894	/* 0x40000000 FF_LOGNOMATCH */
895	/* 0x80000000 FF_BLOCKNONIP */
896
897	#define FR_RETMASK (FR_RETICMP|FR_RETRST|FR_FAKEICMP)
898	#define FR_ISBLOCK(x) (((x) & FR_CMDMASK) == FR_BLOCK)
899	#define FR_ISPASS(x) (((x) & FR_CMDMASK) == FR_PASS)
900	#define FR_ISAUTH(x) (((x) & FR_CMDMASK) == FR_AUTH)
901	#define FR_ISPREAUTH(x) (((x) & FR_CMDMASK) == FR_PREAUTH)
902	#define FR_ISACCOUNT(x) (((x) & FR_CMDMASK) == FR_ACCOUNT)
903	#define FR_ISSKIP(x) (((x) & FR_CMDMASK) == FR_SKIP)
904	#define FR_ISDECAPS(x) (((x) & FR_CMDMASK) == FR_DECAPSULATE)
905	#define FR_ISNOMATCH(x) ((x) & FR_NOMATCH)
906	#define FR_INOUT (FR_INQUE|FR_OUTQUE)
907
908	/*
909	* recognized flags for SIOCGETFF and SIOCSETFF, and get put in fr_flags
910	*/
911	#define FF_LOGPASS 0x10000000
912	#define FF_LOGBLOCK 0x20000000
913	#define FF_LOGNOMATCH 0x40000000
914	#define FF_LOGGING (FF_LOGPASS|FF_LOGBLOCK|FF_LOGNOMATCH)
915	#define FF_BLOCKNONIP 0x80000000 /* Solaris2 Only */
916
917
918	/*
919	* Structure that passes information on what/how to flush to the kernel.
920	*/
921	typedef struct ipfflush {
922	int ipflu_how;
923	int ipflu_arg;
924	} ipfflush_t;
925
926
927	/*
928	*
929	*/
930	typedef struct ipfgetctl {
931	u_int ipfg_min; /* min value */
932	u_int ipfg_current; /* current value */
933	u_int ipfg_max; /* max value */
934	u_int ipfg_default; /* default value */
935	u_int ipfg_steps; /* value increments */
936	char ipfg_name[40]; /* tag name for this control */
937	} ipfgetctl_t;
938
939	typedef struct ipfsetctl {
940	int ipfs_which; /* 0 = min 1 = current 2 = max 3 = default */
941	u_int ipfs_value; /* min value */
942	char ipfs_name[40]; /* tag name for this control */
943	} ipfsetctl_t;
944
945
946	/*
947	* Some of the statistics below are in their own counters, but most are kept
948	* in this single structure so that they can all easily be collected and
949	* copied back as required.
950	*/
951	typedef struct ipf_statistics {
952	u_long fr_icmp_coalesce;
953	u_long fr_tcp_frag;
954	u_long fr_tcp_pullup;
955	u_long fr_tcp_short;
956	u_long fr_tcp_small;
957	u_long fr_tcp_bad_flags;
958	u_long fr_udp_pullup;
959	u_long fr_ip_freed;
960	u_long fr_v6_ah_bad;
961	u_long fr_v6_bad;
962	u_long fr_v6_badfrag;
963	u_long fr_v6_dst_bad;
964	u_long fr_v6_esp_pullup;
965	u_long fr_v6_ext_short;
966	u_long fr_v6_ext_pullup;
967	u_long fr_v6_ext_hlen;
968	u_long fr_v6_frag_bad;
969	u_long fr_v6_frag_pullup;
970	u_long fr_v6_frag_size;
971	u_long fr_v6_gre_pullup;
972	u_long fr_v6_icmp6_pullup;
973	u_long fr_v6_rh_bad;
974	u_long fr_v6_badttl; /* TTL in packet doesn't reach minimum */
975	u_long fr_v4_ah_bad;
976	u_long fr_v4_ah_pullup;
977	u_long fr_v4_esp_pullup;
978	u_long fr_v4_cipso_bad;
979	u_long fr_v4_cipso_tlen;
980	u_long fr_v4_gre_frag;
981	u_long fr_v4_gre_pullup;
982	u_long fr_v4_icmp_frag;
983	u_long fr_v4_icmp_pullup;
984	u_long fr_v4_badttl; /* TTL in packet doesn't reach minimum */
985	u_long fr_v4_badsrc; /* source received doesn't match route */
986	u_long fr_l4_badcksum; /* layer 4 header checksum failure */
987	u_long fr_badcoalesces;
988	u_long fr_pass; /* packets allowed */
989	u_long fr_block; /* packets denied */
990	u_long fr_nom; /* packets which don't match any rule */
991	u_long fr_short; /* packets which are short */
992	u_long fr_ppkl; /* packets allowed and logged */
993	u_long fr_bpkl; /* packets denied and logged */
994	u_long fr_npkl; /* packets unmatched and logged */
995	u_long fr_ret; /* packets for which a return is sent */
996	u_long fr_acct; /* packets for which counting was performed */
997	u_long fr_bnfr; /* bad attempts to allocate fragment state */
998	u_long fr_nfr; /* new fragment state kept */
999	u_long fr_cfr; /* add new fragment state but complete pkt */
1000	u_long fr_bads; /* bad attempts to allocate packet state */
1001	u_long fr_ads; /* new packet state kept */
1002	u_long fr_chit; /* cached hit */
1003	u_long fr_cmiss; /* cached miss */
1004	u_long fr_tcpbad; /* TCP checksum check failures */
1005	u_long fr_pull[2]; /* good and bad pullup attempts */
1006	u_long fr_bad; /* bad IP packets to the filter */
1007	u_long fr_ipv6; /* IPv6 packets in/out */
1008	u_long fr_ppshit; /* dropped because of pps ceiling */
1009	u_long fr_ipud; /* IP id update failures */
1010	u_long fr_blocked[FRB_MAX_VALUE + 1];
1011	} ipf_statistics_t;
1012
1013	/*
1014	* Log structure. Each packet header logged is prepended by one of these.
1015	* Following this in the log records read from the device will be an ipflog
1016	* structure which is then followed by any packet data.
1017	*/
1018	typedef struct iplog {
1019	u_32_t ipl_magic;
1020	u_int ipl_count;
1021	u_32_t ipl_seqnum;
1022	struct timeval ipl_time;
1023	size_t ipl_dsize;
1024	struct iplog *ipl_next;
1025	} iplog_t;
1026
1027	#define ipl_sec ipl_time.tv_sec
1028	#define ipl_usec ipl_time.tv_usec
1029
1030	#define IPL_MAGIC 0x49504c4d /* 'IPLM' */
1031	#define IPL_MAGIC_NAT 0x49504c4e /* 'IPLN' */
1032	#define IPL_MAGIC_STATE 0x49504c53 /* 'IPLS' */
1033	#define IPLOG_SIZE sizeof(iplog_t)
1034
1035	typedef struct ipflog {
1036	#if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199603)) || \
1037	(defined(OpenBSD) && (OpenBSD >= 199603))
1038	#else
1039	u_int fl_unit;
1040	#endif
1041	u_32_t fl_rule;
1042	u_32_t fl_flags;
1043	u_32_t fl_lflags;
1044	u_32_t fl_logtag;
1045	ipftag_t fl_nattag;
1046	u_short fl_plen; /* extra data after hlen */
1047	u_short fl_loglevel; /* syslog log level */
1048	char fl_group[FR_GROUPLEN];
1049	u_char fl_hlen; /* length of IP headers saved */
1050	u_char fl_dir;
1051	u_char fl_breason; /* from fin_reason */
1052	u_char fl_family; /* address family of packet logged */
1053	char fl_ifname[LIFNAMSIZ];
1054	} ipflog_t;
1055
1056	#ifndef IPF_LOGGING
1057	# define IPF_LOGGING 0
1058	#endif
1059	#ifndef IPF_DEFAULT_PASS
1060	# define IPF_DEFAULT_PASS FR_PASS
1061	#endif
1062
1063	#define DEFAULT_IPFLOGSIZE 32768
1064	#ifndef IPFILTER_LOGSIZE
1065	# define IPFILTER_LOGSIZE DEFAULT_IPFLOGSIZE
1066	#else
1067	# if IPFILTER_LOGSIZE < 8192
1068	# error IPFILTER_LOGSIZE too small. Must be >= 8192
1069	# endif
1070	#endif
1071
1072	#define IPF_OPTCOPY 0x07ff00 /* bit mask of copied options */
1073
1074	/*
1075	* Device filenames for reading log information. Use ipf on Solaris2 because
1076	* ipl is already a name used by something else.
1077	*/
1078	#ifndef IPL_NAME
1079	# if SOLARIS
1080	# define IPL_NAME "/dev/ipf"
1081	# else
1082	# define IPL_NAME "/dev/ipl"
1083	# endif
1084	#endif
1085	/*
1086	* Pathnames for various IP Filter control devices. Used by LKM
1087	* and userland, so defined here.
1088	*/
1089	#define IPNAT_NAME "/dev/ipnat"
1090	#define IPSTATE_NAME "/dev/ipstate"
1091	#define IPAUTH_NAME "/dev/ipauth"
1092	#define IPSYNC_NAME "/dev/ipsync"
1093	#define IPSCAN_NAME "/dev/ipscan"
1094	#define IPLOOKUP_NAME "/dev/iplookup"
1095
1096	#define IPL_LOGIPF 0 /* Minor device #'s for accessing logs */
1097	#define IPL_LOGNAT 1
1098	#define IPL_LOGSTATE 2
1099	#define IPL_LOGAUTH 3
1100	#define IPL_LOGSYNC 4
1101	#define IPL_LOGSCAN 5
1102	#define IPL_LOGLOOKUP 6
1103	#define IPL_LOGCOUNT 7
1104	#define IPL_LOGMAX 7
1105	#define IPL_LOGSIZE IPL_LOGMAX + 1
1106	#define IPL_LOGALL -1
1107	#define IPL_LOGNONE -2
1108
1109	/*
1110	* For SIOCGETFS
1111	*/
1112	typedef struct friostat {
1113	ipf_statistics_t f_st[2];
1114	frentry_t *f_ipf[2][2];
1115	frentry_t *f_acct[2][2];
1116	frentry_t *f_auth;
1117	struct frgroup *f_groups[IPL_LOGSIZE][2];
1118	u_long f_froute[2];
1119	u_long f_log_ok;
1120	u_long f_log_fail;
1121	u_long f_rb_no_mem;
1122	u_long f_rb_node_max;
1123	u_32_t f_ticks;
1124	int f_locks[IPL_LOGSIZE];
1125	int f_defpass; /* default pass - from fr_pass */
1126	int f_active; /* 1 or 0 - active rule set */
1127	int f_running; /* 1 if running, else 0 */
1128	int f_logging; /* 1 if enabled, else 0 */
1129	int f_features;
1130	char f_version[32]; /* version string */
1131	} friostat_t;
1132
1133	#define f_fin f_ipf[0]
1134	#define f_fout f_ipf[1]
1135	#define f_acctin f_acct[0]
1136	#define f_acctout f_acct[1]
1137
1138	#define IPF_FEAT_LKM 0x001
1139	#define IPF_FEAT_LOG 0x002
1140	#define IPF_FEAT_LOOKUP 0x004
1141	#define IPF_FEAT_BPF 0x008
1142	#define IPF_FEAT_COMPILED 0x010
1143	#define IPF_FEAT_CKSUM 0x020
1144	#define IPF_FEAT_SYNC 0x040
1145	#define IPF_FEAT_SCAN 0x080
1146	#define IPF_FEAT_IPV6 0x100
1147
1148	typedef struct optlist {
1149	u_short ol_val;
1150	int ol_bit;
1151	} optlist_t;
1152
1153
1154	/*
1155	* Group list structure.
1156	*/
1157	typedef struct frgroup {
1158	struct frgroup *fg_next;
1159	struct frentry *fg_head;
1160	struct frentry *fg_start;
1161	struct frgroup **fg_set;
1162	u_32_t fg_flags;
1163	int fg_ref;
1164	char fg_name[FR_GROUPLEN];
1165	} frgroup_t;
1166
1167	#define FG_NAME(g) (*(g)->fg_name == '\0' ? "" : (g)->fg_name)
1168
1169
1170	/*
1171	* Used by state and NAT tables
1172	*/
1173	typedef struct icmpinfo {
1174	u_short ici_id;
1175	u_short ici_seq;
1176	u_char ici_type;
1177	} icmpinfo_t;
1178
1179	typedef struct udpinfo {
1180	u_short us_sport;
1181	u_short us_dport;
1182	} udpinfo_t;
1183
1184
1185	typedef struct tcpdata {
1186	u_32_t td_end;
1187	u_32_t td_maxend;
1188	u_32_t td_maxwin;
1189	u_32_t td_winscale;
1190	u_32_t td_maxseg;
1191	int td_winflags;
1192	} tcpdata_t;
1193
1194	#define TCP_WSCALE_MAX 14
1195
1196	#define TCP_WSCALE_SEEN 0x00000001
1197	#define TCP_WSCALE_FIRST 0x00000002
1198	#define TCP_SACK_PERMIT 0x00000004
1199
1200
1201	typedef struct tcpinfo {
1202	u_32_t ts_sport;
1203	u_32_t ts_dport;
1204	tcpdata_t ts_data[2];
1205	} tcpinfo_t;
1206
1207
1208	/*
1209	* Structures to define a GRE header as seen in a packet.
1210	*/
1211	struct grebits {
1212	#if defined(sparc)
1213	u_32_t grb_ver:3;
1214	u_32_t grb_flags:3;
1215	u_32_t grb_A:1;
1216	u_32_t grb_recur:1;
1217	u_32_t grb_s:1;
1218	u_32_t grb_S:1;
1219	u_32_t grb_K:1;
1220	u_32_t grb_R:1;
1221	u_32_t grb_C:1;
1222	#else
1223	u_32_t grb_C:1;
1224	u_32_t grb_R:1;
1225	u_32_t grb_K:1;
1226	u_32_t grb_S:1;
1227	u_32_t grb_s:1;
1228	u_32_t grb_recur:1;
1229	u_32_t grb_A:1;
1230	u_32_t grb_flags:3;
1231	u_32_t grb_ver:3;
1232	#endif
1233	u_short grb_ptype;
1234	};
1235
1236	typedef struct grehdr {
1237	union {
1238	struct grebits gru_bits;
1239	u_short gru_flags;
1240	} gr_un;
1241	u_short gr_len;
1242	u_short gr_call;
1243	} grehdr_t;
1244
1245	#define gr_flags gr_un.gru_flags
1246	#define gr_bits gr_un.gru_bits
1247	#define gr_ptype gr_bits.grb_ptype
1248	#define gr_C gr_bits.grb_C
1249	#define gr_R gr_bits.grb_R
1250	#define gr_K gr_bits.grb_K
1251	#define gr_S gr_bits.grb_S
1252	#define gr_s gr_bits.grb_s
1253	#define gr_recur gr_bits.grb_recur
1254	#define gr_A gr_bits.grb_A
1255	#define gr_ver gr_bits.grb_ver
1256
1257	/*
1258	* GRE information tracked by "keep state"
1259	*/
1260	typedef struct greinfo {
1261	u_short gs_call[2];
1262	u_short gs_flags;
1263	u_short gs_ptype;
1264	} greinfo_t;
1265
1266	#define GRE_REV(x) ((ntohs(x) >> 13) & 7)
1267
1268
1269	/*
1270	* Format of an Authentication header
1271	*/
1272	typedef struct authhdr {
1273	u_char ah_next;
1274	u_char ah_plen;
1275	u_short ah_reserved;
1276	u_32_t ah_spi;
1277	u_32_t ah_seq;
1278	/* Following the sequence number field is 0 or more bytes of */
1279	/* authentication data, as specified by ah_plen - RFC 2402. */
1280	} authhdr_t;
1281
1282
1283	/*
1284	* Timeout tail queue list member
1285	*/
1286	typedef struct ipftqent {
1287	struct ipftqent **tqe_pnext;
1288	struct ipftqent *tqe_next;
1289	struct ipftq *tqe_ifq;
1290	void *tqe_parent; /* pointer back to NAT/state struct */
1291	u_32_t tqe_die; /* when this entriy is to die */
1292	u_32_t tqe_touched;
1293	int tqe_flags;
1294	int tqe_state[2]; /* current state of this entry */
1295	} ipftqent_t;
1296
1297	#define TQE_RULEBASED 0x00000001
1298	#define TQE_DELETE 0x00000002
1299
1300
1301	/*
1302	* Timeout tail queue head for IPFilter
1303	*/
1304	typedef struct ipftq {
1305	ipfmutex_t ifq_lock;
1306	u_int ifq_ttl;
1307	ipftqent_t *ifq_head;
1308	ipftqent_t **ifq_tail;
1309	struct ipftq *ifq_next;
1310	struct ipftq **ifq_pnext;
1311	int ifq_ref;
1312	u_int ifq_flags;
1313	} ipftq_t;
1314
1315	#define IFQF_USER 0x01 /* User defined aging */
1316	#define IFQF_DELETE 0x02 /* Marked for deletion */
1317	#define IFQF_PROXY 0x04 /* Timeout queue in use by a proxy */
1318
1319	#define IPFTQ_INIT(x,y,z) do { \
1320	(x)->ifq_ttl = (y); \
1321	(x)->ifq_head = NULL; \
1322	(x)->ifq_ref = 1; \
1323	(x)->ifq_tail = &(x)->ifq_head; \
1324	MUTEX_INIT(&(x)->ifq_lock, (z)); \
1325	} while (0)
1326
1327	#define IPF_HZ_MULT 1
1328	#define IPF_HZ_DIVIDE 2 /* How many times a second ipfilter */
1329	/* checks its timeout queues. */
1330	#define IPF_TTLVAL(x) (((x) / IPF_HZ_MULT) * IPF_HZ_DIVIDE)
1331
1332	typedef int (*ipftq_delete_fn_t)(struct ipf_main_softc_s *, void *);
1333
1334
1335	/*
1336	* Object structure description. For passing through in ioctls.
1337	*/
1338	typedef struct ipfobj {
1339	u_32_t ipfo_rev; /* IPFilter version number */
1340	u_32_t ipfo_size; /* size of object at ipfo_ptr */
1341	void *ipfo_ptr; /* pointer to object */
1342	int ipfo_type; /* type of object being pointed to */
1343	int ipfo_offset; /* bytes from ipfo_ptr where to start */
1344	int ipfo_retval; /* return value */
1345	u_char ipfo_xxxpad[28]; /* reserved for future use */
1346	} ipfobj_t;
1347
1348	#define IPFOBJ_FRENTRY 0 /* struct frentry */
1349	#define IPFOBJ_IPFSTAT 1 /* struct friostat */
1350	#define IPFOBJ_IPFINFO 2 /* struct fr_info */
1351	#define IPFOBJ_AUTHSTAT 3 /* struct fr_authstat */
1352	#define IPFOBJ_FRAGSTAT 4 /* struct ipfrstat */
1353	#define IPFOBJ_IPNAT 5 /* struct ipnat */
1354	#define IPFOBJ_NATSTAT 6 /* struct natstat */
1355	#define IPFOBJ_STATESAVE 7 /* struct ipstate_save */
1356	#define IPFOBJ_NATSAVE 8 /* struct nat_save */
1357	#define IPFOBJ_NATLOOKUP 9 /* struct natlookup */
1358	#define IPFOBJ_IPSTATE 10 /* struct ipstate */
1359	#define IPFOBJ_STATESTAT 11 /* struct ips_stat */
1360	#define IPFOBJ_FRAUTH 12 /* struct frauth */
1361	#define IPFOBJ_TUNEABLE 13 /* struct ipftune */
1362	#define IPFOBJ_NAT 14 /* struct nat */
1363	#define IPFOBJ_IPFITER 15 /* struct ipfruleiter */
1364	#define IPFOBJ_GENITER 16 /* struct ipfgeniter */
1365	#define IPFOBJ_GTABLE 17 /* struct ipftable */
1366	#define IPFOBJ_LOOKUPITER 18 /* struct ipflookupiter */
1367	#define IPFOBJ_STATETQTAB 19 /* struct ipftq * NSTATES */
1368	#define IPFOBJ_IPFEXPR 20
1369	#define IPFOBJ_PROXYCTL 21 /* strct ap_ctl */
1370	#define IPFOBJ_FRIPF 22 /* structfripf */
1371	#define IPFOBJ_COUNT 23 /* How many #defines are above this? */
1372
1373
1374	typedef union ipftunevalptr {
1375	void *ipftp_void;
1376	u_long *ipftp_long;
1377	u_int *ipftp_int;
1378	u_short *ipftp_short;
1379	u_char *ipftp_char;
1380	u_long ipftp_offset;
1381	} ipftunevalptr_t;
1382
1383	typedef union ipftuneval {
1384	u_long ipftu_long;
1385	u_int ipftu_int;
1386	u_short ipftu_short;
1387	u_char ipftu_char;
1388	} ipftuneval_t;
1389
1390	struct ipftuneable;
1391	typedef int (* ipftunefunc_t)(struct ipf_main_softc_s *, struct ipftuneable *,
1392	ipftuneval_t *);
1393
1394	typedef struct ipftuneable {
1395	ipftunevalptr_t ipft_una;
1396	const char *ipft_name;
1397	u_long ipft_min;
1398	u_long ipft_max;
1399	int ipft_sz;
1400	int ipft_flags;
1401	struct ipftuneable *ipft_next;
1402	ipftunefunc_t ipft_func;
1403	} ipftuneable_t;
1404
1405	#define ipft_addr ipft_una.ipftp_void
1406	#define ipft_plong ipft_una.ipftp_long
1407	#define ipft_pint ipft_una.ipftp_int
1408	#define ipft_pshort ipft_una.ipftp_short
1409	#define ipft_pchar ipft_una.ipftp_char
1410
1411	#define IPFT_RDONLY 1 /* read-only */
1412	#define IPFT_WRDISABLED 2 /* write when disabled only */
1413
1414	typedef struct ipftune {
1415	void *ipft_cookie;
1416	ipftuneval_t ipft_un;
1417	u_long ipft_min;
1418	u_long ipft_max;
1419	int ipft_sz;
1420	int ipft_flags;
1421	char ipft_name[80];
1422	} ipftune_t;
1423
1424	#define ipft_vlong ipft_un.ipftu_long
1425	#define ipft_vint ipft_un.ipftu_int
1426	#define ipft_vshort ipft_un.ipftu_short
1427	#define ipft_vchar ipft_un.ipftu_char
1428
1429	/*
1430	* Hash table header
1431	*/
1432	#define IPFHASH(x,y) typedef struct { \
1433	ipfrwlock_t ipfh_lock; \
1434	struct x *ipfh_head; \
1435	} y
1436
1437	/*
1438	** HPUX Port
1439	*/
1440	#ifdef __hpux
1441	/* HP-UX locking sequence deadlock detection module lock MAJOR ID */
1442	# define IPF_SMAJ 0 /* temp assignment XXX, not critical */
1443	#endif
1444
1445	#if !defined(CDEV_MAJOR) && defined (__FreeBSD_version) && \
1446	(__FreeBSD_version >= 220000)
1447	# define CDEV_MAJOR 79
1448	#endif
1449
1450	/*
1451	* Post NetBSD 1.2 has the PFIL interface for packet filters. This turns
1452	* on those hooks. We don't need any special mods in non-IP Filter code
1453	* with this!
1454	*/
1455	#if (defined(NetBSD) && (NetBSD > 199609) && (NetBSD <= 1991011)) || \
1456	(defined(NetBSD1_2) && NetBSD1_2 > 1) || \
1457	(defined(__FreeBSD__) && (__FreeBSD_version >= 500043))
1458	# if (NetBSD >= 199905) && !defined(PFIL_HOOKS)
1459	# define PFIL_HOOKS
1460	# endif
1461	# ifdef PFIL_HOOKS
1462	# define NETBSD_PF
1463	# endif
1464	#endif
1465
1466	#ifdef _KERNEL
1467	# define FR_VERBOSE(verb_pr)
1468	# define FR_DEBUG(verb_pr)
1469	#else
1470	extern void ipfkdebug(char *, ...);
1471	extern void ipfkverbose(char *, ...);
1472	# define FR_VERBOSE(verb_pr) ipfkverbose verb_pr
1473	# define FR_DEBUG(verb_pr) ipfkdebug verb_pr
1474	#endif
1475
1476	/*
1477	*
1478	*/
1479	typedef struct ipfruleiter {
1480	int iri_inout;
1481	char iri_group[FR_GROUPLEN];
1482	int iri_active;
1483	int iri_nrules;
1484	int iri_v; /* No longer used (compatibility) */
1485	frentry_t *iri_rule;
1486	} ipfruleiter_t;
1487
1488	/*
1489	* Values for iri_inout
1490	*/
1491	#define F_IN 0
1492	#define F_OUT 1
1493	#define F_ACIN 2
1494	#define F_ACOUT 3
1495
1496
1497	typedef struct ipfgeniter {
1498	int igi_type;
1499	int igi_nitems;
1500	void *igi_data;
1501	} ipfgeniter_t;
1502
1503	#define IPFGENITER_IPF 0
1504	#define IPFGENITER_NAT 1
1505	#define IPFGENITER_IPNAT 2
1506	#define IPFGENITER_FRAG 3
1507	#define IPFGENITER_AUTH 4
1508	#define IPFGENITER_STATE 5
1509	#define IPFGENITER_NATFRAG 6
1510	#define IPFGENITER_HOSTMAP 7
1511	#define IPFGENITER_LOOKUP 8
1512
1513	typedef struct ipftable {
1514	int ita_type;
1515	void *ita_table;
1516	} ipftable_t;
1517
1518	#define IPFTABLE_BUCKETS 1
1519	#define IPFTABLE_BUCKETS_NATIN 2
1520	#define IPFTABLE_BUCKETS_NATOUT 3
1521
1522
1523	typedef struct ipf_v4_masktab_s {
1524	u_32_t imt4_active[33];
1525	int imt4_masks[33];
1526	int imt4_max;
1527	} ipf_v4_masktab_t;
1528
1529	typedef struct ipf_v6_masktab_s {
1530	i6addr_t imt6_active[129];
1531	int imt6_masks[129];
1532	int imt6_max;
1533	} ipf_v6_masktab_t;
1534
1535
1536	/*
1537	*
1538	*/
1539	typedef struct ipftoken {
1540	struct ipftoken *ipt_next;
1541	struct ipftoken **ipt_pnext;
1542	void *ipt_ctx;
1543	void *ipt_data;
1544	u_long ipt_die;
1545	int ipt_type;
1546	int ipt_uid;
1547	int ipt_subtype;
1548	int ipt_ref;
1549	int ipt_complete;
1550	} ipftoken_t;
1551
1552
1553	/*
1554	*
1555	*/
1556	typedef struct ipfexp {
1557	int ipfe_cmd;
1558	int ipfe_not;
1559	int ipfe_narg;
1560	int ipfe_size;
1561	int ipfe_arg0[1];
1562	} ipfexp_t;
1563
1564	/*
1565	* Currently support commands (ipfe_cmd)
1566	* 32bits is split up follows:
1567	* aabbcccc
1568	* aa = 0 = packet matching, 1 = meta data matching
1569	* bb = IP protocol number
1570	* cccc = command
1571	*/
1572	#define IPF_EXP_IP_PR 0x00000001
1573	#define IPF_EXP_IP_ADDR 0x00000002
1574	#define IPF_EXP_IP_SRCADDR 0x00000003
1575	#define IPF_EXP_IP_DSTADDR 0x00000004
1576	#define IPF_EXP_IP6_ADDR 0x00000005
1577	#define IPF_EXP_IP6_SRCADDR 0x00000006
1578	#define IPF_EXP_IP6_DSTADDR 0x00000007
1579	#define IPF_EXP_TCP_FLAGS 0x00060001
1580	#define IPF_EXP_TCP_PORT 0x00060002
1581	#define IPF_EXP_TCP_SPORT 0x00060003
1582	#define IPF_EXP_TCP_DPORT 0x00060004
1583	#define IPF_EXP_UDP_PORT 0x00110002
1584	#define IPF_EXP_UDP_SPORT 0x00110003
1585	#define IPF_EXP_UDP_DPORT 0x00110004
1586	#define IPF_EXP_IDLE_GT 0x01000001
1587	#define IPF_EXP_TCP_STATE 0x01060002
1588	#define IPF_EXP_END 0xffffffff
1589
1590	#define ONE_DAY IPF_TTLVAL(1 * 86400) /* 1 day */
1591	#define FIVE_DAYS (5 * ONE_DAY)
1592
1593	typedef struct ipf_main_softc_s {
1594	struct ipf_main_softc_s *ipf_next;
1595	ipfmutex_t ipf_rw;
1596	ipfmutex_t ipf_timeoutlock;
1597	ipfrwlock_t ipf_mutex;
1598	ipfrwlock_t ipf_frag;
1599	ipfrwlock_t ipf_global;
1600	ipfrwlock_t ipf_tokens;
1601	ipfrwlock_t ipf_state;
1602	ipfrwlock_t ipf_nat;
1603	ipfrwlock_t ipf_natfrag;
1604	ipfrwlock_t ipf_poolrw;
1605	int ipf_dynamic_softc;
1606	int ipf_refcnt;
1607	int ipf_running;
1608	int ipf_flags;
1609	int ipf_active;
1610	int ipf_control_forwarding;
1611	int ipf_update_ipid;
1612	int ipf_chksrc; /* causes a system crash if enabled */
1613	int ipf_pass;
1614	int ipf_minttl;
1615	int ipf_icmpminfragmtu;
1616	int ipf_interror; /* Should be in a struct that is per */
1617	/* thread or process. Does not belong */
1618	/* here but there's a lot more work */
1619	/* in doing that properly. For now, */
1620	/* it is squatting. */
1621	u_int ipf_tcpidletimeout;
1622	u_int ipf_tcpclosewait;
1623	u_int ipf_tcplastack;
1624	u_int ipf_tcptimewait;
1625	u_int ipf_tcptimeout;
1626	u_int ipf_tcpsynsent;
1627	u_int ipf_tcpsynrecv;
1628	u_int ipf_tcpclosed;
1629	u_int ipf_tcphalfclosed;
1630	u_int ipf_udptimeout;
1631	u_int ipf_udpacktimeout;
1632	u_int ipf_icmptimeout;
1633	u_int ipf_icmpacktimeout;
1634	u_int ipf_iptimeout;
1635	u_long ipf_ticks;
1636	u_long ipf_userifqs;
1637	u_long ipf_rb_no_mem;
1638	u_long ipf_rb_node_max;
1639	u_long ipf_frouteok[2];
1640	ipftuneable_t *ipf_tuners;
1641	void *ipf_frag_soft;
1642	void *ipf_nat_soft;
1643	void *ipf_state_soft;
1644	void *ipf_auth_soft;
1645	void *ipf_proxy_soft;
1646	void *ipf_sync_soft;
1647	void *ipf_lookup_soft;
1648	void *ipf_log_soft;
1649	struct frgroup *ipf_groups[IPL_LOGSIZE][2];
1650	frentry_t *ipf_rules[2][2];
1651	frentry_t *ipf_acct[2][2];
1652	frentry_t *ipf_rule_explist[2];
1653	ipftoken_t *ipf_token_head;
1654	ipftoken_t **ipf_token_tail;
1655	#if defined(__FreeBSD_version) && (__FreeBSD_version >= 300000) && \
1656	defined(_KERNEL)
1657	struct callout_handle ipf_slow_ch;
1658	#endif
1659	#if defined(linux) && defined(_KERNEL)
1660	struct timer_list ipf_timer;
1661	#endif
1662	#if NETBSD_GE_REV(104040000)
1663	struct callout ipf_slow_ch;
1664	#endif
1665	#if SOLARIS
1666	# if SOLARIS2 >= 7
1667	timeout_id_t ipf_slow_ch;
1668	# else
1669	int ipf_slow_ch;
1670	# endif
1671	#endif
1672	#if defined(_KERNEL)
1673	# if SOLARIS
1674	struct pollhead ipf_poll_head[IPL_LOGSIZE];
1675	void *ipf_dip;
1676	# if defined(INSTANCES)
1677	int ipf_get_loopback;
1678	u_long ipf_idnum;
1679	net_handle_t ipf_nd_v4;
1680	net_handle_t ipf_nd_v6;
1681	hook_t *ipf_hk_v4_in;
1682	hook_t *ipf_hk_v4_out;
1683	hook_t *ipf_hk_v4_nic;
1684	hook_t *ipf_hk_v6_in;
1685	hook_t *ipf_hk_v6_out;
1686	hook_t *ipf_hk_v6_nic;
1687	hook_t *ipf_hk_loop_v4_in;
1688	hook_t *ipf_hk_loop_v4_out;
1689	hook_t *ipf_hk_loop_v6_in;
1690	hook_t *ipf_hk_loop_v6_out;
1691	# endif
1692	# else
1693	# if defined(linux) && defined(_KERNEL)
1694	struct poll_table_struct ipf_selwait[IPL_LOGSIZE];
1695	wait_queue_head_t iplh_linux[IPL_LOGSIZE];
1696	# else
1697	struct selinfo ipf_selwait[IPL_LOGSIZE];
1698	# endif
1699	# endif
1700	#endif
1701	void *ipf_slow;
1702	ipf_statistics_t ipf_stats[2];
1703	u_char ipf_iss_secret[32];
1704	u_short ipf_ip_id;
1705	} ipf_main_softc_t;
1706
1707	#define IPFERROR(_e) do { softc->ipf_interror = (_e); \
1708	DT1(user_error, int, _e); \
1709	} while (0)
1710
1711	#ifndef _KERNEL
1712	extern int ipf_check(void *, struct ip *, int, void *, int, mb_t **);
1713	extern int (*ipf_checkp)(ip_t *, int, void *, int, mb_t **);
1714	extern struct ifnet *get_unit(char *, int);
1715	extern char *get_ifname(struct ifnet *);
1716	extern int ipfioctl(ipf_main_softc_t *, int, ioctlcmd_t,
1717	void *, int);
1718	extern void m_freem(mb_t *);
1719	extern size_t msgdsize(mb_t *);
1720	extern int bcopywrap(void *, void *, size_t);
1721	#else /* #ifndef _KERNEL */
1722	# if defined(__NetBSD__) && defined(PFIL_HOOKS)
1723	extern void ipfilterattach(int);
1724	# endif
1725	extern int ipl_enable(void);
1726	extern int ipl_disable(void);
1727	# ifdef MENTAT
1728	extern int ipf_check(void *, struct ip *, int, void *, int, void *,
1729	mblk_t **);
1730	# if SOLARIS
1731	extern void ipf_prependmbt(fr_info_t *, mblk_t *);
1732	# if SOLARIS2 >= 7
1733	extern int ipfioctl(dev_t, int, intptr_t, int, cred_t *, int *);
1734	# else
1735	extern int ipfioctl(dev_t, int, int *, int, cred_t *, int *);
1736	# endif
1737	# endif
1738	# ifdef __hpux
1739	extern int ipfioctl(dev_t, int, caddr_t, int);
1740	extern int ipf_select(dev_t, int);
1741	# endif
1742	extern int ipf_qout(queue_t *, mblk_t *);
1743	# else /* MENTAT */
1744	extern int ipf_check(void *, struct ip *, int, void *, int, mb_t **);
1745	extern int (*fr_checkp)(ip_t *, int, void *, int, mb_t **);
1746	extern size_t mbufchainlen(mb_t *);
1747	# ifdef __sgi
1748	# include <sys/cred.h>
1749	extern int ipfioctl(dev_t, int, caddr_t, int, cred_t *, int *);
1750	extern int ipfilter_sgi_attach(void);
1751	extern void ipfilter_sgi_detach(void);
1752	extern void ipfilter_sgi_intfsync(void);
1753	# else
1754	# ifdef IPFILTER_LKM
1755	extern int ipf_identify(char *);
1756	# endif
1757	# if BSDOS_GE_REV(199510) || FREEBSD_GE_REV(220000) || \
1758	(defined(NetBSD) && (NetBSD >= 199511)) || defined(__OpenBSD__)
1759	# if defined(__NetBSD__) || BSDOS_GE_REV(199701) || \
1760	defined(__OpenBSD__) || FREEBSD_GE_REV(300000)
1761	# if (__FreeBSD_version >= 500024)
1762	# if (__FreeBSD_version >= 502116)
1763	extern int ipfioctl(struct cdev*, u_long, caddr_t, int, struct thread *);
1764	# else
1765	extern int ipfioctl(dev_t, u_long, caddr_t, int, struct thread *);
1766	# endif /* __FreeBSD_version >= 502116 */
1767	# else
1768	# if NETBSD_GE_REV(499001000)
1769	extern int ipfioctl(dev_t, u_long, void *, int, struct lwp *);
1770	# else
1771	# if NETBSD_GE_REV(399001400)
1772	extern int ipfioctl(dev_t, u_long, caddr_t, int, struct lwp *);
1773	# else
1774	extern int ipfioctl(dev_t, u_long, caddr_t, int, struct proc *);
1775	# endif
1776	# endif
1777	# endif /* __FreeBSD_version >= 500024 */
1778	# else
1779	extern int ipfioctl(dev_t, int, caddr_t, int, struct proc *);
1780	# endif
1781	# else
1782	# ifdef linux
1783	extern int ipfioctl(struct inode *, struct file *, u_int, u_long);
1784	# else
1785	extern int ipfioctl(dev_t, int, caddr_t, int);
1786	# endif
1787	# endif /* (_BSDI_VERSION >= 199510) */
1788	# endif /* __ sgi */
1789	# endif /* MENTAT */
1790
1791	# if defined(__FreeBSD_version)
1792	extern int ipf_pfil_hook(void);
1793	extern int ipf_pfil_unhook(void);
1794	extern void ipf_event_reg(void);
1795	extern void ipf_event_dereg(void);
1796	# endif
1797
1798	# if defined(INSTANCES)
1799	extern ipf_main_softc_t *ipf_find_softc(u_long);
1800	extern int ipf_set_loopback(ipf_main_softc_t *, ipftuneable_t *,
1801	ipftuneval_t *);
1802	# endif
1803
1804	#endif /* #ifndef _KERNEL */
1805
1806	extern char *memstr(const char *, char *, size_t, size_t);
1807	extern int count4bits(u_32_t);
1808	#ifdef USE_INET6
1809	extern int count6bits(u_32_t *);
1810	#endif
1811	extern int frrequest(ipf_main_softc_t *, int, ioctlcmd_t, void *,
1812	int, int);
1813	extern char *getifname(struct ifnet *);
1814	extern int ipfattach(ipf_main_softc_t *);
1815	extern int ipfdetach(ipf_main_softc_t *);
1816	extern u_short ipf_cksum(u_short *, int);
1817	extern int copyinptr(ipf_main_softc_t *, void *, void *, size_t);
1818	extern int copyoutptr(ipf_main_softc_t *, void *, void *, size_t);
1819	extern int ipf_fastroute(mb_t *, mb_t **, fr_info_t *, frdest_t *);
1820	extern int ipf_inject(fr_info_t *, mb_t *);
1821	extern int ipf_inobj(ipf_main_softc_t *, void *, ipfobj_t *,
1822	void *, int);
1823	extern int ipf_inobjsz(ipf_main_softc_t *, void *, void *,
1824	int , int);
1825	extern int ipf_ioctlswitch(ipf_main_softc_t *, int, void *,
1826	ioctlcmd_t, int, int, void *);
1827	extern int ipf_ipf_ioctl(ipf_main_softc_t *, void *, ioctlcmd_t,
1828	int, int, void *);
1829	extern int ipf_ipftune(ipf_main_softc_t *, ioctlcmd_t, void *);
1830	extern int ipf_matcharray_load(ipf_main_softc_t *, void *,
1831	ipfobj_t *, int **);
1832	extern int ipf_matcharray_verify(int *, int);
1833	extern int ipf_outobj(ipf_main_softc_t *, void *, void *, int);
1834	extern int ipf_outobjk(ipf_main_softc_t *, ipfobj_t *, void *);
1835	extern int ipf_outobjsz(ipf_main_softc_t *, void *, void *,
1836	int, int);
1837	extern void *ipf_pullup(mb_t *, fr_info_t *, int);
1838	extern int ipf_resolvedest(ipf_main_softc_t *, char *,
1839	struct frdest *, int);
1840	extern int ipf_resolvefunc(ipf_main_softc_t *, void *);
1841	extern void *ipf_resolvenic(ipf_main_softc_t *, char *, int);
1842	extern int ipf_send_icmp_err(int, fr_info_t *, int);
1843	extern int ipf_send_reset(fr_info_t *);
1844	#if (defined(__FreeBSD_version) && (__FreeBSD_version < 501000)) || \
1845	!defined(_KERNEL) || defined(linux)
1846	extern int ppsratecheck(struct timeval *, int *, int);
1847	#endif
1848	extern void ipf_apply_timeout(ipftq_t *, u_int);
1849	extern ipftq_t *ipf_addtimeoutqueue(ipf_main_softc_t *, ipftq_t **,
1850	u_int);
1851	extern void ipf_deletequeueentry(ipftqent_t *);
1852	extern int ipf_deletetimeoutqueue(ipftq_t *);
1853	extern void ipf_freetimeoutqueue(ipf_main_softc_t *, ipftq_t *);
1854	extern void ipf_movequeue(u_long, ipftqent_t *, ipftq_t *,
1855	ipftq_t *);
1856	extern void ipf_queueappend(u_long, ipftqent_t *, ipftq_t *, void *);
1857	extern void ipf_queueback(u_long, ipftqent_t *);
1858	extern int ipf_queueflush(ipf_main_softc_t *, ipftq_delete_fn_t,
1859	ipftq_t *, ipftq_t *, u_int *, int, int);
1860	extern void ipf_queuefront(ipftqent_t *);
1861	extern int ipf_settimeout_tcp(ipftuneable_t *, ipftuneval_t *,
1862	ipftq_t *);
1863	extern int ipf_checkv4sum(fr_info_t *);
1864	extern int ipf_checkl4sum(fr_info_t *);
1865	extern int ipf_ifpfillv4addr(int, struct sockaddr_in *,
1866	struct sockaddr_in *, struct in_addr *,
1867	struct in_addr *);
1868	extern int ipf_coalesce(fr_info_t *);
1869	#ifdef USE_INET6
1870	extern int ipf_checkv6sum(fr_info_t *);
1871	extern int ipf_ifpfillv6addr(int, struct sockaddr_in6 *,
1872	struct sockaddr_in6 *, i6addr_t *,
1873	i6addr_t *);
1874	#endif
1875
1876	extern int ipf_tune_add(ipf_main_softc_t *, ipftuneable_t *);
1877	extern int ipf_tune_add_array(ipf_main_softc_t *, ipftuneable_t *);
1878	extern int ipf_tune_del(ipf_main_softc_t *, ipftuneable_t *);
1879	extern int ipf_tune_del_array(ipf_main_softc_t *, ipftuneable_t *);
1880	extern int ipf_tune_array_link(ipf_main_softc_t *, ipftuneable_t *);
1881	extern int ipf_tune_array_unlink(ipf_main_softc_t *,
1882	ipftuneable_t *);
1883	extern ipftuneable_t *ipf_tune_array_copy(void *, size_t,
1884	const ipftuneable_t *);
1885
1886	extern int ipf_pr_pullup(fr_info_t *, int);
1887
1888	extern int ipf_flush(ipf_main_softc_t *, minor_t, int);
1889	extern frgroup_t *ipf_group_add(ipf_main_softc_t *, char *, void *,
1890	u_32_t, minor_t, int);
1891	extern void ipf_group_del(ipf_main_softc_t *, frgroup_t *, frentry_t *);
1892	extern int ipf_derefrule(ipf_main_softc_t *, frentry_t **);
1893	extern frgroup_t *ipf_findgroup(ipf_main_softc_t *, char *, minor_t,
1894	int, frgroup_t ***);
1895
1896	extern int ipf_log_init(void);
1897	extern int ipf_log_bytesused(ipf_main_softc_t *, int);
1898	extern int ipf_log_canread(ipf_main_softc_t *, int);
1899	extern int ipf_log_clear(ipf_main_softc_t *, minor_t);
1900	extern u_long ipf_log_failures(ipf_main_softc_t *, int);
1901	extern int ipf_log_read(ipf_main_softc_t *, minor_t, uio_t *);
1902	extern int ipf_log_items(ipf_main_softc_t *, int, fr_info_t *,
1903	void **, size_t *, int *, int);
1904	extern u_long ipf_log_logok(ipf_main_softc_t *, int);
1905	extern void ipf_log_unload(ipf_main_softc_t *);
1906	extern int ipf_log_pkt(fr_info_t *, u_int);
1907	extern int ipf_log_pkt(fr_info_t *, u_int);
1908
1909	extern frentry_t *ipf_acctpkt(fr_info_t *, u_32_t *);
1910	extern u_short fr_cksum(fr_info_t *, ip_t *, int, void *);
1911	extern void ipf_deinitialise(ipf_main_softc_t *);
1912	extern int ipf_deliverlocal(ipf_main_softc_t *, int, void *,
1913	i6addr_t *);
1914	extern frentry_t *ipf_dstgrpmap(fr_info_t *, u_32_t *);
1915	extern void ipf_fixskip(frentry_t **, frentry_t *, int);
1916	extern void ipf_forgetifp(ipf_main_softc_t *, void *);
1917	extern frentry_t *ipf_getrulen(ipf_main_softc_t *, int, char *,
1918	u_32_t);
1919	extern int ipf_ifpaddr(ipf_main_softc_t *, int, int, void *,
1920	i6addr_t *, i6addr_t *);
1921	extern int ipf_initialise(void);
1922	extern int ipf_lock(void *, int *);
1923	extern int ipf_makefrip(int, ip_t *, fr_info_t *);
1924	extern void ipf_inet_mask_add(int, ipf_v4_masktab_t *);
1925	extern void ipf_inet_mask_del(int, ipf_v4_masktab_t *);
1926	#ifdef USE_INET6
1927	extern void ipf_inet6_mask_add(int, i6addr_t *, ipf_v6_masktab_t *);
1928	extern void ipf_inet6_mask_del(int, i6addr_t *, ipf_v6_masktab_t *);
1929	#endif
1930	extern int ipf_matchtag(ipftag_t *, ipftag_t *);
1931	extern int ipf_matchicmpqueryreply(int, icmpinfo_t *,
1932	struct icmp *, int);
1933	extern u_32_t ipf_newisn(fr_info_t *);
1934	extern u_short ipf_nextipid(fr_info_t *);
1935	extern u_int ipf_pcksum(fr_info_t *, int, u_int);
1936	extern void ipf_rule_expire(ipf_main_softc_t *);
1937	extern int ipf_scanlist(fr_info_t *, u_32_t);
1938	extern frentry_t *ipf_srcgrpmap(fr_info_t *, u_32_t *);
1939	extern int ipf_tcpudpchk(fr_ip_t *, frtuc_t *);
1940	extern int ipf_verifysrc(fr_info_t *fin);
1941	extern int ipf_zerostats(ipf_main_softc_t *, void *);
1942	extern int ipf_getnextrule(ipf_main_softc_t *, ipftoken_t *,
1943	void *);
1944	extern int ipf_sync(ipf_main_softc_t *, void *);
1945	extern int ipf_token_deref(ipf_main_softc_t *, ipftoken_t *);
1946	extern void ipf_token_expire(ipf_main_softc_t *);
1947	extern ipftoken_t *ipf_token_find(ipf_main_softc_t *, int, int,
1948	void *);
1949	extern void ipf_token_free(ipf_main_softc_t *, ipftoken_t *);
1950	extern int ipf_token_del(ipf_main_softc_t *, int, int,
1951	void *);
1952	extern void ipf_token_mark_complete(ipftoken_t *);
1953	extern int ipf_genericiter(ipf_main_softc_t *, void *,
1954	int, void *);
1955	#ifdef IPFILTER_LOOKUP
1956	extern void *ipf_resolvelookup(int, u_int, u_int,
1957	lookupfunc_t *);
1958	#endif
1959	extern u_32_t ipf_random(void);
1960
1961	extern int ipf_main_load(void);
1962	extern void *ipf_main_soft_create(void *);
1963	extern void ipf_main_soft_destroy(ipf_main_softc_t *);
1964	extern int ipf_main_soft_init(ipf_main_softc_t *);
1965	extern int ipf_main_soft_fini(ipf_main_softc_t *);
1966	extern int ipf_main_unload(void);
1967	extern int ipf_load_all(void);
1968	extern int ipf_unload_all(void);
1969	extern void ipf_destroy_all(ipf_main_softc_t *);
1970	extern ipf_main_softc_t *ipf_create_all(void *);
1971	extern int ipf_init_all(ipf_main_softc_t *);
1972	extern int ipf_fini_all(ipf_main_softc_t *);
1973	extern void ipf_log_soft_destroy(ipf_main_softc_t *, void *);
1974	extern void *ipf_log_soft_create(ipf_main_softc_t *);
1975	extern int ipf_log_soft_init(ipf_main_softc_t *, void *);
1976	extern int ipf_log_soft_fini(ipf_main_softc_t *, void *);
1977	extern int ipf_log_main_load(void);
1978	extern int ipf_log_main_unload(void);
1979
1980
1981	extern char ipfilter_version[];
1982	#ifdef USE_INET6
1983	extern int icmptoicmp6types[ICMP_MAXTYPE+1];
1984	extern int icmptoicmp6unreach[ICMP_MAX_UNREACH];
1985	extern int icmpreplytype6[ICMP6_MAXTYPE + 1];
1986	#endif
1987	#ifdef IPFILTER_COMPAT
1988	extern int ipf_in_compat(ipf_main_softc_t *, ipfobj_t *, void *,int);
1989	extern int ipf_out_compat(ipf_main_softc_t *, ipfobj_t *, void *);
1990	#endif
1991	extern int icmpreplytype4[ICMP_MAXTYPE + 1];
1992
1993	extern int ipf_ht_node_add(ipf_main_softc_t *, host_track_t *,
1994	int, i6addr_t *);
1995	extern int ipf_ht_node_del(host_track_t *, int, i6addr_t *);
1996	extern void ipf_rb_ht_flush(host_track_t *);
1997	extern void ipf_rb_ht_freenode(host_node_t *, void *);
1998	extern void ipf_rb_ht_init(host_track_t *);
1999
2000	#endif /* _NETINET_IP_FIL_H_ */