1/*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2001 Daniel Hartmeier
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 *
11 * - Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * - Redistributions in binary form must reproduce the above
14 * copyright notice, this list of conditions and the following
15 * disclaimer in the documentation and/or other materials provided
16 * with the distribution.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
20 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
21 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
22 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
24 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
25 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
26 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
28 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29 * POSSIBILITY OF SUCH DAMAGE.
30 *
31 * $OpenBSD: pfvar.h,v 1.282 2009/01/29 15:12:28 pyr Exp $
32 */
33
34#ifndef _NET_PF_H_
35#define _NET_PF_H_
36
37#include <sys/tree.h>
38
39#define PF_TCPS_PROXY_SRC ((TCP_NSTATES)+0)
40#define PF_TCPS_PROXY_DST ((TCP_NSTATES)+1)
41
42#define PF_MD5_DIGEST_LENGTH 16
43#ifdef MD5_DIGEST_LENGTH
44#if PF_MD5_DIGEST_LENGTH != MD5_DIGEST_LENGTH
45#error
46#endif
47#endif
48
49enum { PF_INOUT, PF_IN, PF_OUT };
50enum { PF_PASS, PF_DROP, PF_SCRUB, PF_NOSCRUB, PF_NAT, PF_NONAT,
51 PF_BINAT, PF_NOBINAT, PF_RDR, PF_NORDR, PF_SYNPROXY_DROP, PF_DEFER,
52 PF_MATCH, PF_AFRT, PF_RT };
53enum { PF_RULESET_SCRUB, PF_RULESET_FILTER, PF_RULESET_NAT,
54 PF_RULESET_BINAT, PF_RULESET_RDR, PF_RULESET_MAX };
55enum { PF_OP_NONE, PF_OP_IRG, PF_OP_EQ, PF_OP_NE, PF_OP_LT,
56 PF_OP_LE, PF_OP_GT, PF_OP_GE, PF_OP_XRG, PF_OP_RRG };
57enum { PF_DEBUG_NONE, PF_DEBUG_URGENT, PF_DEBUG_MISC, PF_DEBUG_NOISY };
58enum { PF_CHANGE_NONE, PF_CHANGE_ADD_HEAD, PF_CHANGE_ADD_TAIL,
59 PF_CHANGE_ADD_BEFORE, PF_CHANGE_ADD_AFTER,
60 PF_CHANGE_REMOVE, PF_CHANGE_GET_TICKET };
61enum { PF_GET_NONE, PF_GET_CLR_CNTR };
62enum { PF_SK_WIRE, PF_SK_STACK, PF_SK_BOTH };
63enum { PF_PEER_SRC, PF_PEER_DST, PF_PEER_BOTH };
64
65/*
66 * Note about PFTM_*: real indices into pf_rule.timeout[] come before
67 * PFTM_MAX, special cases afterwards. See pf_state_expires().
68 */
69enum {
70 PFTM_TCP_FIRST_PACKET = 0,
71 PFTM_TCP_OPENING = 1,
72 PFTM_TCP_ESTABLISHED = 2,
73 PFTM_TCP_CLOSING = 3,
74 PFTM_TCP_FIN_WAIT = 4,
75 PFTM_TCP_CLOSED = 5,
76 PFTM_UDP_FIRST_PACKET = 6,
77 PFTM_UDP_SINGLE = 7,
78 PFTM_UDP_MULTIPLE = 8,
79 PFTM_ICMP_FIRST_PACKET = 9,
80 PFTM_ICMP_ERROR_REPLY = 10,
81 PFTM_OTHER_FIRST_PACKET = 11,
82 PFTM_OTHER_SINGLE = 12,
83 PFTM_OTHER_MULTIPLE = 13,
84 PFTM_FRAG = 14,
85 PFTM_INTERVAL = 15,
86 PFTM_ADAPTIVE_START = 16,
87 PFTM_ADAPTIVE_END = 17,
88 PFTM_SRC_NODE = 18,
89 PFTM_TS_DIFF = 19,
90 PFTM_OLD_MAX = 20, /* Legacy limit, for binary compatibility with old kernels. */
91 PFTM_SCTP_FIRST_PACKET = 20,
92 PFTM_SCTP_OPENING = 21,
93 PFTM_SCTP_ESTABLISHED = 22,
94 PFTM_SCTP_CLOSING = 23,
95 PFTM_SCTP_CLOSED = 24,
96 PFTM_MAX = 25,
97 PFTM_PURGE = 26,
98 PFTM_UNLINKED = 27,
99};
100
101/* PFTM default values */
102#define PFTM_TCP_FIRST_PACKET_VAL 120 /* First TCP packet */
103#define PFTM_TCP_OPENING_VAL 30 /* No response yet */
104#define PFTM_TCP_ESTABLISHED_VAL 24*60*60/* Established */
105#define PFTM_TCP_CLOSING_VAL 15 * 60 /* Half closed */
106#define PFTM_TCP_FIN_WAIT_VAL 45 /* Got both FINs */
107#define PFTM_TCP_CLOSED_VAL 90 /* Got a RST */
108#define PFTM_UDP_FIRST_PACKET_VAL 60 /* First UDP packet */
109#define PFTM_UDP_SINGLE_VAL 30 /* Unidirectional */
110#define PFTM_UDP_MULTIPLE_VAL 60 /* Bidirectional */
111#define PFTM_ICMP_FIRST_PACKET_VAL 20 /* First ICMP packet */
112#define PFTM_ICMP_ERROR_REPLY_VAL 10 /* Got error response */
113#define PFTM_OTHER_FIRST_PACKET_VAL 60 /* First packet */
114#define PFTM_OTHER_SINGLE_VAL 30 /* Unidirectional */
115#define PFTM_OTHER_MULTIPLE_VAL 60 /* Bidirectional */
116#define PFTM_FRAG_VAL 60 /* Fragment expire */
117#define PFTM_INTERVAL_VAL 10 /* Expire interval */
118#define PFTM_SRC_NODE_VAL 0 /* Source tracking */
119#define PFTM_TS_DIFF_VAL 30 /* Allowed TS diff */
120
121enum { PF_NOPFROUTE, PF_FASTROUTE, PF_ROUTETO, PF_DUPTO, PF_REPLYTO };
122enum { PF_LIMIT_STATES, PF_LIMIT_SRC_NODES, PF_LIMIT_FRAGS,
123 PF_LIMIT_TABLE_ENTRIES, PF_LIMIT_ANCHORS, PF_LIMIT_ETH_ANCHORS,
124 PF_LIMIT_MAX };
125#define PF_POOL_IDMASK 0x0f
126enum { PF_POOL_NONE, PF_POOL_BITMASK, PF_POOL_RANDOM,
127 PF_POOL_SRCHASH, PF_POOL_ROUNDROBIN };
128enum { PF_ADDR_ADDRMASK, PF_ADDR_NOROUTE, PF_ADDR_DYNIFTL,
129 PF_ADDR_TABLE, PF_ADDR_URPFFAILED,
130 PF_ADDR_RANGE, PF_ADDR_NONE };
131#define PF_POOL_TYPEMASK 0x0f
132#define PF_POOL_STICKYADDR 0x20
133#define PF_POOL_ENDPI 0x40
134#define PF_POOL_IPV6NH 0x80
135#define PF_WSCALE_FLAG 0x80
136#define PF_WSCALE_MASK 0x0f
137
138#define PF_POOL_DYNTYPE(_o) \
139 ((((_o) & PF_POOL_TYPEMASK) == PF_POOL_ROUNDROBIN) || \
140 (((_o) & PF_POOL_TYPEMASK) == PF_POOL_RANDOM) || \
141 (((_o) & PF_POOL_TYPEMASK) == PF_POOL_SRCHASH))
142
143#define PF_LOG 0x01
144#define PF_LOG_ALL 0x02
145#define PF_LOG_USER 0x04
146#define PF_LOG_FORCE 0x08
147#define PF_LOG_MATCHES 0x10
148
149/* Reasons code for passing/dropping a packet */
150#define PFRES_MATCH 0 /* Explicit match of a rule */
151#define PFRES_BADOFF 1 /* Bad offset for pull_hdr */
152#define PFRES_FRAG 2 /* Dropping following fragment */
153#define PFRES_SHORT 3 /* Dropping short packet */
154#define PFRES_NORM 4 /* Dropping by normalizer */
155#define PFRES_MEMORY 5 /* Dropped due to lacking mem */
156#define PFRES_TS 6 /* Bad TCP Timestamp (RFC1323) */
157#define PFRES_CONGEST 7 /* Congestion (of ipintrq) */
158#define PFRES_IPOPTIONS 8 /* IP option */
159#define PFRES_PROTCKSUM 9 /* Protocol checksum invalid */
160#define PFRES_BADSTATE 10 /* State mismatch */
161#define PFRES_STATEINS 11 /* State insertion failure */
162#define PFRES_MAXSTATES 12 /* State limit */
163#define PFRES_SRCLIMIT 13 /* Source node/conn limit */
164#define PFRES_SYNPROXY 14 /* SYN proxy */
165#define PFRES_MAPFAILED 15 /* pf_map_addr() failed */
166#define PFRES_TRANSLATE 16 /* No translation address available */
167#define PFRES_MAX 17 /* total+1 */
168
169#define PFRES_NAMES { \
170 "match", \
171 "bad-offset", \
172 "fragment", \
173 "short", \
174 "normalize", \
175 "memory", \
176 "bad-timestamp", \
177 "congestion", \
178 "ip-option", \
179 "proto-cksum", \
180 "state-mismatch", \
181 "state-insert", \
182 "state-limit", \
183 "src-limit", \
184 "synproxy", \
185 "map-failed", \
186 "translate", \
187 NULL \
188}
189
190/* Counters for other things we want to keep track of */
191#define LCNT_STATES 0 /* states */
192#define LCNT_SRCSTATES 1 /* max-src-states */
193#define LCNT_SRCNODES 2 /* max-src-nodes */
194#define LCNT_SRCCONN 3 /* max-src-conn */
195#define LCNT_SRCCONNRATE 4 /* max-src-conn-rate */
196#define LCNT_OVERLOAD_TABLE 5 /* entry added to overload table */
197#define LCNT_OVERLOAD_FLUSH 6 /* state entries flushed */
198#define LCNT_MAX 7 /* total+1 */
199/* Only available via the nvlist-based API */
200#define KLCNT_SYNFLOODS 7 /* synfloods detected */
201#define KLCNT_SYNCOOKIES_SENT 8 /* syncookies sent */
202#define KLCNT_SYNCOOKIES_VALID 9 /* syncookies validated */
203#define KLCNT_MAX 10 /* total+1 */
204
205#define LCNT_NAMES { \
206 "max states per rule", \
207 "max-src-states", \
208 "max-src-nodes", \
209 "max-src-conn", \
210 "max-src-conn-rate", \
211 "overload table insertion", \
212 "overload flush states", \
213 NULL \
214}
215#define KLCNT_NAMES { \
216 "max states per rule", \
217 "max-src-states", \
218 "max-src-nodes", \
219 "max-src-conn", \
220 "max-src-conn-rate", \
221 "overload table insertion", \
222 "overload flush states", \
223 "synfloods detected", \
224 "syncookies sent", \
225 "syncookies validated", \
226 NULL \
227}
228
229/* state operation counters */
230#define FCNT_STATE_SEARCH 0
231#define FCNT_STATE_INSERT 1
232#define FCNT_STATE_REMOVALS 2
233#define FCNT_MAX 3
234
235#ifdef _KERNEL
236#define FCNT_NAMES { \
237 "searches", \
238 "inserts", \
239 "removals", \
240 NULL \
241}
242#endif
243
244/* src_node operation counters */
245#define SCNT_SRC_NODE_SEARCH 0
246#define SCNT_SRC_NODE_INSERT 1
247#define SCNT_SRC_NODE_REMOVALS 2
248#define SCNT_MAX 3
249
250#define PF_TABLE_NAME_SIZE 32
251#define PF_QNAME_SIZE 64
252
253struct pfioc_nv {
254 void *data;
255 size_t len; /* The length of the nvlist data. */
256 size_t size; /* The total size of the data buffer. */
257};
258
259struct pf_rule;
260
261/* keep synced with pfi_kif, used in RB_FIND */
262struct pfi_kif_cmp {
263 char pfik_name[IFNAMSIZ];
264};
265
266struct pfi_kif {
267 char pfik_name[IFNAMSIZ];
268 union {
269 RB_ENTRY(pfi_kif) pfik_tree;
270 LIST_ENTRY(pfi_kif) pfik_list;
271 };
272 u_int64_t pfik_packets[2][2][2];
273 u_int64_t pfik_bytes[2][2][2];
274 u_int32_t pfik_tzero;
275 u_int pfik_flags;
276 struct ifnet *pfik_ifp;
277 struct ifg_group *pfik_group;
278 u_int pfik_rulerefs;
279 TAILQ_HEAD(, pfi_dynaddr) pfik_dynaddrs;
280};
281
282struct pf_status {
283 uint64_t counters[PFRES_MAX];
284 uint64_t lcounters[LCNT_MAX];
285 uint64_t fcounters[FCNT_MAX];
286 uint64_t scounters[SCNT_MAX];
287 uint64_t pcounters[2][2][3];
288 uint64_t bcounters[2][2];
289 uint32_t running;
290 uint32_t states;
291 uint32_t src_nodes;
292 uint32_t since;
293 uint32_t debug;
294 uint32_t hostid;
295 char ifname[IFNAMSIZ];
296 uint8_t pf_chksum[PF_MD5_DIGEST_LENGTH];
297};
298
299#define PF_REASS_ENABLED 0x01
300#define PF_REASS_NODF 0x02
301
302struct pf_addr {
303 union {
304 struct in_addr v4;
305 struct in6_addr v6;
306 u_int8_t addr8[16];
307 u_int16_t addr16[8];
308 u_int32_t addr32[4];
309 }; /* 128-bit address */
310};
311
312#define PFI_AFLAG_NETWORK 0x01
313#define PFI_AFLAG_BROADCAST 0x02
314#define PFI_AFLAG_PEER 0x04
315#define PFI_AFLAG_MODEMASK 0x07
316#define PFI_AFLAG_NOALIAS 0x08
317
318struct pf_addr_wrap {
319 union {
320 struct {
321 struct pf_addr addr;
322 struct pf_addr mask;
323 } a;
324 char ifname[IFNAMSIZ];
325 char tblname[PF_TABLE_NAME_SIZE];
326 } v;
327 union {
328 struct pfi_dynaddr *dyn;
329 struct pfr_ktable *tbl;
330 int dyncnt;
331 int tblcnt;
332 } p;
333 u_int8_t type; /* PF_ADDR_* */
334 u_int8_t iflags; /* PFI_AFLAG_* */
335};
336
337union pf_rule_ptr {
338 struct pf_rule *ptr;
339 u_int32_t nr;
340};
341
342struct pf_rule_uid {
343 uid_t uid[2];
344 u_int8_t op;
345};
346
347struct pf_rule_gid {
348 uid_t gid[2];
349 u_int8_t op;
350};
351
352struct pf_rule_addr {
353 struct pf_addr_wrap addr;
354 u_int16_t port[2];
355 u_int8_t neg;
356 u_int8_t port_op;
357};
358
359struct pf_pooladdr {
360 struct pf_addr_wrap addr;
361 TAILQ_ENTRY(pf_pooladdr) entries;
362 char ifname[IFNAMSIZ];
363 struct pfi_kif *kif;
364};
365
366TAILQ_HEAD(pf_palist, pf_pooladdr);
367
368struct pf_poolhashkey {
369 union {
370 u_int8_t key8[16];
371 u_int16_t key16[8];
372 u_int32_t key32[4];
373 }; /* 128-bit hash key */
374};
375
376struct pf_mape_portset {
377 u_int8_t offset;
378 u_int8_t psidlen;
379 u_int16_t psid;
380};
381
382struct pf_pool {
383 struct pf_palist list;
384 struct pf_pooladdr *cur;
385 struct pf_poolhashkey key;
386 struct pf_addr counter;
387 int tblidx;
388 u_int16_t proxy_port[2];
389 u_int8_t opts;
390};
391
392/* A packed Operating System description for fingerprinting */
393typedef u_int32_t pf_osfp_t;
394#define PF_OSFP_ANY ((pf_osfp_t)0)
395#define PF_OSFP_UNKNOWN ((pf_osfp_t)-1)
396#define PF_OSFP_NOMATCH ((pf_osfp_t)-2)
397
398struct pf_osfp_entry {
399 SLIST_ENTRY(pf_osfp_entry) fp_entry;
400 pf_osfp_t fp_os;
401 int fp_enflags;
402#define PF_OSFP_EXPANDED 0x001 /* expanded entry */
403#define PF_OSFP_GENERIC 0x002 /* generic signature */
404#define PF_OSFP_NODETAIL 0x004 /* no p0f details */
405#define PF_OSFP_LEN 32
406 char fp_class_nm[PF_OSFP_LEN];
407 char fp_version_nm[PF_OSFP_LEN];
408 char fp_subtype_nm[PF_OSFP_LEN];
409};
410#define PF_OSFP_ENTRY_EQ(a, b) \
411 ((a)->fp_os == (b)->fp_os && \
412 memcmp((a)->fp_class_nm, (b)->fp_class_nm, PF_OSFP_LEN) == 0 && \
413 memcmp((a)->fp_version_nm, (b)->fp_version_nm, PF_OSFP_LEN) == 0 && \
414 memcmp((a)->fp_subtype_nm, (b)->fp_subtype_nm, PF_OSFP_LEN) == 0)
415
416/* handle pf_osfp_t packing */
417#define _FP_RESERVED_BIT 1 /* For the special negative #defines */
418#define _FP_UNUSED_BITS 1
419#define _FP_CLASS_BITS 10 /* OS Class (Windows, Linux) */
420#define _FP_VERSION_BITS 10 /* OS version (95, 98, NT, 2.4.54, 3.2) */
421#define _FP_SUBTYPE_BITS 10 /* patch level (NT SP4, SP3, ECN patch) */
422#define PF_OSFP_UNPACK(osfp, class, version, subtype) do { \
423 (class) = ((osfp) >> (_FP_VERSION_BITS+_FP_SUBTYPE_BITS)) & \
424 ((1 << _FP_CLASS_BITS) - 1); \
425 (version) = ((osfp) >> _FP_SUBTYPE_BITS) & \
426 ((1 << _FP_VERSION_BITS) - 1);\
427 (subtype) = (osfp) & ((1 << _FP_SUBTYPE_BITS) - 1); \
428} while(0)
429#define PF_OSFP_PACK(osfp, class, version, subtype) do { \
430 (osfp) = ((class) & ((1 << _FP_CLASS_BITS) - 1)) << (_FP_VERSION_BITS \
431 + _FP_SUBTYPE_BITS); \
432 (osfp) |= ((version) & ((1 << _FP_VERSION_BITS) - 1)) << \
433 _FP_SUBTYPE_BITS; \
434 (osfp) |= (subtype) & ((1 << _FP_SUBTYPE_BITS) - 1); \
435} while(0)
436
437/* the fingerprint of an OSes TCP SYN packet */
438typedef u_int64_t pf_tcpopts_t;
439struct pf_os_fingerprint {
440 SLIST_HEAD(pf_osfp_enlist, pf_osfp_entry) fp_oses; /* list of matches */
441 pf_tcpopts_t fp_tcpopts; /* packed TCP options */
442 u_int16_t fp_wsize; /* TCP window size */
443 u_int16_t fp_psize; /* ip->ip_len */
444 u_int16_t fp_mss; /* TCP MSS */
445 u_int16_t fp_flags;
446#define PF_OSFP_WSIZE_MOD 0x0001 /* Window modulus */
447#define PF_OSFP_WSIZE_DC 0x0002 /* Window don't care */
448#define PF_OSFP_WSIZE_MSS 0x0004 /* Window multiple of MSS */
449#define PF_OSFP_WSIZE_MTU 0x0008 /* Window multiple of MTU */
450#define PF_OSFP_PSIZE_MOD 0x0010 /* packet size modulus */
451#define PF_OSFP_PSIZE_DC 0x0020 /* packet size don't care */
452#define PF_OSFP_WSCALE 0x0040 /* TCP window scaling */
453#define PF_OSFP_WSCALE_MOD 0x0080 /* TCP window scale modulus */
454#define PF_OSFP_WSCALE_DC 0x0100 /* TCP window scale dont-care */
455#define PF_OSFP_MSS 0x0200 /* TCP MSS */
456#define PF_OSFP_MSS_MOD 0x0400 /* TCP MSS modulus */
457#define PF_OSFP_MSS_DC 0x0800 /* TCP MSS dont-care */
458#define PF_OSFP_DF 0x1000 /* IPv4 don't fragment bit */
459#define PF_OSFP_TS0 0x2000 /* Zero timestamp */
460#define PF_OSFP_INET6 0x4000 /* IPv6 */
461 u_int8_t fp_optcnt; /* TCP option count */
462 u_int8_t fp_wscale; /* TCP window scaling */
463 u_int8_t fp_ttl; /* IPv4 TTL */
464#define PF_OSFP_MAXTTL_OFFSET 40
465/* TCP options packing */
466#define PF_OSFP_TCPOPT_NOP 0x0 /* TCP NOP option */
467#define PF_OSFP_TCPOPT_WSCALE 0x1 /* TCP window scaling option */
468#define PF_OSFP_TCPOPT_MSS 0x2 /* TCP max segment size opt */
469#define PF_OSFP_TCPOPT_SACK 0x3 /* TCP SACK OK option */
470#define PF_OSFP_TCPOPT_TS 0x4 /* TCP timestamp option */
471#define PF_OSFP_TCPOPT_BITS 3 /* bits used by each option */
472#define PF_OSFP_MAX_OPTS \
473 (sizeof(((struct pf_os_fingerprint *)0)->fp_tcpopts) * 8) \
474 / PF_OSFP_TCPOPT_BITS
475
476 SLIST_ENTRY(pf_os_fingerprint) fp_next;
477};
478
479struct pf_osfp_ioctl {
480 struct pf_osfp_entry fp_os;
481 pf_tcpopts_t fp_tcpopts; /* packed TCP options */
482 u_int16_t fp_wsize; /* TCP window size */
483 u_int16_t fp_psize; /* ip->ip_len */
484 u_int16_t fp_mss; /* TCP MSS */
485 u_int16_t fp_flags;
486 u_int8_t fp_optcnt; /* TCP option count */
487 u_int8_t fp_wscale; /* TCP window scaling */
488 u_int8_t fp_ttl; /* IPv4 TTL */
489
490 int fp_getnum; /* DIOCOSFPGET number */
491};
492
493#define PF_ANCHOR_NAME_SIZE 64
494#define PF_ANCHOR_MAXPATH (MAXPATHLEN - PF_ANCHOR_NAME_SIZE - 1)
495#define PF_ANCHOR_HIWAT 512
496#define PF_OPTIMIZER_TABLE_PFX "__automatic_"
497
498struct pf_rule {
499 struct pf_rule_addr src;
500 struct pf_rule_addr dst;
501#define PF_SKIP_IFP 0
502#define PF_SKIP_DIR 1
503#define PF_SKIP_AF 2
504#define PF_SKIP_PROTO 3
505#define PF_SKIP_SRC_ADDR 4
506#define PF_SKIP_DST_ADDR 5
507#define PF_SKIP_SRC_PORT 6
508#define PF_SKIP_DST_PORT 7
509#define PF_SKIP_COUNT 8
510 union pf_rule_ptr skip[PF_SKIP_COUNT];
511#define PF_RULE_LABEL_SIZE 64
512#define PF_RULE_MAX_LABEL_COUNT 5
513 char label[PF_RULE_LABEL_SIZE];
514 char ifname[IFNAMSIZ];
515 char qname[PF_QNAME_SIZE];
516 char pqname[PF_QNAME_SIZE];
517#define PF_TAG_NAME_SIZE 64
518 char tagname[PF_TAG_NAME_SIZE];
519 char match_tagname[PF_TAG_NAME_SIZE];
520
521 char overload_tblname[PF_TABLE_NAME_SIZE];
522
523 TAILQ_ENTRY(pf_rule) entries;
524 struct pf_pool rpool;
525
526 u_int64_t evaluations;
527 u_int64_t packets[2];
528 u_int64_t bytes[2];
529
530 struct pfi_kif *kif;
531 struct pf_anchor *anchor;
532 struct pfr_ktable *overload_tbl;
533
534 pf_osfp_t os_fingerprint;
535
536 int rtableid;
537 u_int32_t timeout[PFTM_OLD_MAX];
538 u_int32_t max_states;
539 u_int32_t max_src_nodes;
540 u_int32_t max_src_states;
541 u_int32_t max_src_conn;
542 struct {
543 u_int32_t limit;
544 u_int32_t seconds;
545 } max_src_conn_rate;
546 u_int32_t qid;
547 u_int32_t pqid;
548 u_int32_t rt_listid;
549 u_int32_t nr;
550 u_int32_t prob;
551 uid_t cuid;
552 pid_t cpid;
553
554 counter_u64_t states_cur;
555 counter_u64_t states_tot;
556 counter_u64_t src_nodes;
557
558 u_int16_t return_icmp;
559 u_int16_t return_icmp6;
560 u_int16_t max_mss;
561 u_int16_t tag;
562 u_int16_t match_tag;
563 u_int16_t scrub_flags;
564
565 struct pf_rule_uid uid;
566 struct pf_rule_gid gid;
567
568 u_int32_t rule_flag;
569 u_int8_t action;
570 u_int8_t direction;
571 u_int8_t log;
572 u_int8_t logif;
573 u_int8_t quick;
574 u_int8_t ifnot;
575 u_int8_t match_tag_not;
576 u_int8_t natpass;
577
578#define PF_STATE_NORMAL 0x1
579#define PF_STATE_MODULATE 0x2
580#define PF_STATE_SYNPROXY 0x3
581 u_int8_t keep_state;
582 sa_family_t af;
583 u_int8_t proto;
584 u_int8_t type;
585 u_int8_t code;
586 u_int8_t flags;
587 u_int8_t flagset;
588 u_int8_t min_ttl;
589 u_int8_t allow_opts;
590 u_int8_t rt;
591 u_int8_t return_ttl;
592 u_int8_t tos;
593 u_int8_t set_tos;
594 u_int8_t anchor_relative;
595 u_int8_t anchor_wildcard;
596
597#define PF_FLUSH 0x01
598#define PF_FLUSH_GLOBAL 0x02
599 u_int8_t flush;
600#define PF_PRIO_ZERO 0xff /* match "prio 0" packets */
601#define PF_PRIO_MAX 7
602 u_int8_t prio;
603 u_int8_t set_prio[2];
604
605 struct {
606 struct pf_addr addr;
607 u_int16_t port;
608 } divert;
609
610 uint64_t u_states_cur;
611 uint64_t u_states_tot;
612 uint64_t u_src_nodes;
613};
614
615/* pf_krule->rule_flag and old-style scrub flags */
616#define PFRULE_DROP 0x00000000
617#define PFRULE_RETURNRST 0x00000001
618#define PFRULE_FRAGMENT 0x00000002
619#define PFRULE_RETURNICMP 0x00000004
620#define PFRULE_RETURN 0x00000008
621#define PFRULE_NOSYNC 0x00000010
622#define PFRULE_SRCTRACK 0x00000020 /* track source states */
623#define PFRULE_RULESRCTRACK 0x00000040 /* per rule */
624#define PFRULE_NODF 0x00000100
625#define PFRULE_FRAGMENT_NOREASS 0x00000200
626#define PFRULE_RANDOMID 0x00000800
627#define PFRULE_REASSEMBLE_TCP 0x00001000
628#define PFRULE_SET_TOS 0x00002000
629#define PFRULE_IFBOUND 0x00010000 /* if-bound */
630#define PFRULE_STATESLOPPY 0x00020000 /* sloppy state tracking */
631#define PFRULE_PFLOW 0x00040000
632#define PFRULE_ALLOW_RELATED 0x00080000
633#define PFRULE_AFTO 0x00200000 /* af-to rule */
634
635#ifdef _KERNEL
636#define PFRULE_REFS 0x0080 /* rule has references */
637#endif
638
639/* pf_rule_actions->dnflags */
640#define PFRULE_DN_IS_PIPE 0x0040
641#define PFRULE_DN_IS_QUEUE 0x0080
642
643/* pf_state->state_flags, pf_rule_actions->flags, pf_krule->scrub_flags */
644#define PFSTATE_ALLOWOPTS 0x0001
645#define PFSTATE_SLOPPY 0x0002
646#define PFSTATE_PFLOW 0x0004
647#define PFSTATE_NOSYNC 0x0008
648#define PFSTATE_ACK 0x0010
649#define PFSTATE_NODF 0x0020
650#define PFSTATE_SETTOS 0x0040
651#define PFSTATE_RANDOMID 0x0080
652#define PFSTATE_SCRUB_TCP 0x0100
653#define PFSTATE_SETPRIO 0x0200
654/* was PFSTATE_INP_UNLINKED 0x0400 */
655/* FreeBSD-specific flags are added from the end to keep space for porting
656 * flags from OpenBSD */
657#define PFSTATE_DN_IS_PIPE 0x4000
658#define PFSTATE_DN_IS_QUEUE 0x8000
659#define PFSTATE_SCRUBMASK (PFSTATE_NODF|PFSTATE_RANDOMID|PFSTATE_SCRUB_TCP)
660#define PFSTATE_SETMASK (PFSTATE_SETTOS|PFSTATE_SETPRIO)
661
662/* pfctl_state->src_node_flags */
663#define PFSTATE_SRC_NODE_LIMIT 0x01
664#define PFSTATE_SRC_NODE_NAT 0x02
665#define PFSTATE_SRC_NODE_ROUTE 0x04
666#define PFSTATE_SRC_NODE_LIMIT_GLOBAL 0x10
667
668#define PFSTATE_HIWAT 100000 /* default state table size */
669#define PFSTATE_ADAPT_START 60000 /* default adaptive timeout start */
670#define PFSTATE_ADAPT_END 120000 /* default adaptive timeout end */
671
672
673struct pf_threshold {
674 u_int32_t limit;
675#define PF_THRESHOLD_MULT 1000
676#define PF_THRESHOLD_MAX 0xffffffff / PF_THRESHOLD_MULT
677 u_int32_t seconds;
678 u_int32_t count;
679 u_int32_t last;
680};
681
682struct pf_src_node {
683 LIST_ENTRY(pf_src_node) entry;
684 struct pf_addr addr;
685 struct pf_addr raddr;
686 union pf_rule_ptr rule;
687 struct pfi_kif *kif;
688 u_int64_t bytes[2];
689 u_int64_t packets[2];
690 u_int32_t states;
691 u_int32_t conn;
692 struct pf_threshold conn_rate;
693 u_int32_t creation;
694 u_int32_t expire;
695 sa_family_t af;
696 sa_family_t naf;
697 u_int8_t ruletype;
698};
699
700#define PFSNODE_HIWAT 10000 /* default source node table size */
701
702TAILQ_HEAD(pf_rulequeue, pf_rule);
703
704struct pf_anchor;
705
706struct pf_ruleset {
707 struct {
708 struct pf_rulequeue queues[2];
709 struct {
710 struct pf_rulequeue *ptr;
711 struct pf_rule **ptr_array;
712 u_int32_t rcount;
713 u_int32_t ticket;
714 int open;
715 } active, inactive;
716 } rules[PF_RULESET_MAX];
717 struct pf_anchor *anchor;
718 u_int32_t tticket;
719 int tables;
720 int topen;
721};
722
723RB_HEAD(pf_anchor_global, pf_anchor);
724RB_HEAD(pf_anchor_node, pf_anchor);
725struct pf_anchor {
726 RB_ENTRY(pf_anchor) entry_global;
727 RB_ENTRY(pf_anchor) entry_node;
728 struct pf_anchor *parent;
729 struct pf_anchor_node children;
730 char name[PF_ANCHOR_NAME_SIZE];
731 char path[MAXPATHLEN];
732 struct pf_ruleset ruleset;
733 int refcnt; /* anchor rules */
734 int match; /* XXX: used for pfctl black magic */
735};
736RB_PROTOTYPE(pf_anchor_global, pf_anchor, entry_global, pf_anchor_compare);
737RB_PROTOTYPE(pf_anchor_node, pf_anchor, entry_node, pf_anchor_compare);
738
739int pf_get_ruleset_number(u_int8_t);
740
741#endif /* _NET_PF_H_ */