master
1/*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2001 Daniel Hartmeier
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 *
11 * - Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * - Redistributions in binary form must reproduce the above
14 * copyright notice, this list of conditions and the following
15 * disclaimer in the documentation and/or other materials provided
16 * with the distribution.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
20 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
21 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
22 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
24 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
25 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
26 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
28 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29 * POSSIBILITY OF SUCH DAMAGE.
30 *
31 * $OpenBSD: pfvar.h,v 1.282 2009/01/29 15:12:28 pyr Exp $
32 */
33
34#ifndef _NET_PF_H_
35#define _NET_PF_H_
36
37#include <sys/tree.h>
38
39#define PF_TCPS_PROXY_SRC ((TCP_NSTATES)+0)
40#define PF_TCPS_PROXY_DST ((TCP_NSTATES)+1)
41
42#define PF_MD5_DIGEST_LENGTH 16
43#ifdef MD5_DIGEST_LENGTH
44#if PF_MD5_DIGEST_LENGTH != MD5_DIGEST_LENGTH
45#error
46#endif
47#endif
48
49enum { PF_INOUT, PF_IN, PF_OUT };
50enum { PF_PASS, PF_DROP, PF_SCRUB, PF_NOSCRUB, PF_NAT, PF_NONAT,
51 PF_BINAT, PF_NOBINAT, PF_RDR, PF_NORDR, PF_SYNPROXY_DROP, PF_DEFER,
52 PF_MATCH };
53enum { PF_RULESET_SCRUB, PF_RULESET_FILTER, PF_RULESET_NAT,
54 PF_RULESET_BINAT, PF_RULESET_RDR, PF_RULESET_MAX };
55enum { PF_OP_NONE, PF_OP_IRG, PF_OP_EQ, PF_OP_NE, PF_OP_LT,
56 PF_OP_LE, PF_OP_GT, PF_OP_GE, PF_OP_XRG, PF_OP_RRG };
57enum { PF_DEBUG_NONE, PF_DEBUG_URGENT, PF_DEBUG_MISC, PF_DEBUG_NOISY };
58enum { PF_CHANGE_NONE, PF_CHANGE_ADD_HEAD, PF_CHANGE_ADD_TAIL,
59 PF_CHANGE_ADD_BEFORE, PF_CHANGE_ADD_AFTER,
60 PF_CHANGE_REMOVE, PF_CHANGE_GET_TICKET };
61enum { PF_GET_NONE, PF_GET_CLR_CNTR };
62enum { PF_SK_WIRE, PF_SK_STACK, PF_SK_BOTH };
63enum { PF_PEER_SRC, PF_PEER_DST, PF_PEER_BOTH };
64
65/*
66 * Note about PFTM_*: real indices into pf_rule.timeout[] come before
67 * PFTM_MAX, special cases afterwards. See pf_state_expires().
68 */
69enum {
70 PFTM_TCP_FIRST_PACKET = 0,
71 PFTM_TCP_OPENING = 1,
72 PFTM_TCP_ESTABLISHED = 2,
73 PFTM_TCP_CLOSING = 3,
74 PFTM_TCP_FIN_WAIT = 4,
75 PFTM_TCP_CLOSED = 5,
76 PFTM_UDP_FIRST_PACKET = 6,
77 PFTM_UDP_SINGLE = 7,
78 PFTM_UDP_MULTIPLE = 8,
79 PFTM_ICMP_FIRST_PACKET = 9,
80 PFTM_ICMP_ERROR_REPLY = 10,
81 PFTM_OTHER_FIRST_PACKET = 11,
82 PFTM_OTHER_SINGLE = 12,
83 PFTM_OTHER_MULTIPLE = 13,
84 PFTM_FRAG = 14,
85 PFTM_INTERVAL = 15,
86 PFTM_ADAPTIVE_START = 16,
87 PFTM_ADAPTIVE_END = 17,
88 PFTM_SRC_NODE = 18,
89 PFTM_TS_DIFF = 19,
90 PFTM_OLD_MAX = 20, /* Legacy limit, for binary compatibility with old kernels. */
91 PFTM_SCTP_FIRST_PACKET = 20,
92 PFTM_SCTP_OPENING = 21,
93 PFTM_SCTP_ESTABLISHED = 22,
94 PFTM_SCTP_CLOSING = 23,
95 PFTM_SCTP_CLOSED = 24,
96 PFTM_MAX = 25,
97 PFTM_PURGE = 26,
98 PFTM_UNLINKED = 27,
99};
100
101/* PFTM default values */
102#define PFTM_TCP_FIRST_PACKET_VAL 120 /* First TCP packet */
103#define PFTM_TCP_OPENING_VAL 30 /* No response yet */
104#define PFTM_TCP_ESTABLISHED_VAL 24*60*60/* Established */
105#define PFTM_TCP_CLOSING_VAL 15 * 60 /* Half closed */
106#define PFTM_TCP_FIN_WAIT_VAL 45 /* Got both FINs */
107#define PFTM_TCP_CLOSED_VAL 90 /* Got a RST */
108#define PFTM_UDP_FIRST_PACKET_VAL 60 /* First UDP packet */
109#define PFTM_UDP_SINGLE_VAL 30 /* Unidirectional */
110#define PFTM_UDP_MULTIPLE_VAL 60 /* Bidirectional */
111#define PFTM_ICMP_FIRST_PACKET_VAL 20 /* First ICMP packet */
112#define PFTM_ICMP_ERROR_REPLY_VAL 10 /* Got error response */
113#define PFTM_OTHER_FIRST_PACKET_VAL 60 /* First packet */
114#define PFTM_OTHER_SINGLE_VAL 30 /* Unidirectional */
115#define PFTM_OTHER_MULTIPLE_VAL 60 /* Bidirectional */
116#define PFTM_FRAG_VAL 30 /* Fragment expire */
117#define PFTM_INTERVAL_VAL 10 /* Expire interval */
118#define PFTM_SRC_NODE_VAL 0 /* Source tracking */
119#define PFTM_TS_DIFF_VAL 30 /* Allowed TS diff */
120
121enum { PF_NOPFROUTE, PF_FASTROUTE, PF_ROUTETO, PF_DUPTO, PF_REPLYTO };
122enum { PF_LIMIT_STATES, PF_LIMIT_SRC_NODES, PF_LIMIT_FRAGS,
123 PF_LIMIT_TABLE_ENTRIES, PF_LIMIT_MAX };
124#define PF_POOL_IDMASK 0x0f
125enum { PF_POOL_NONE, PF_POOL_BITMASK, PF_POOL_RANDOM,
126 PF_POOL_SRCHASH, PF_POOL_ROUNDROBIN };
127enum { PF_ADDR_ADDRMASK, PF_ADDR_NOROUTE, PF_ADDR_DYNIFTL,
128 PF_ADDR_TABLE, PF_ADDR_URPFFAILED,
129 PF_ADDR_RANGE };
130#define PF_POOL_TYPEMASK 0x0f
131#define PF_POOL_STICKYADDR 0x20
132#define PF_WSCALE_FLAG 0x80
133#define PF_WSCALE_MASK 0x0f
134
135#define PF_LOG 0x01
136#define PF_LOG_ALL 0x02
137#define PF_LOG_SOCKET_LOOKUP 0x04
138#define PF_LOG_FORCE 0x08
139
140/* Reasons code for passing/dropping a packet */
141#define PFRES_MATCH 0 /* Explicit match of a rule */
142#define PFRES_BADOFF 1 /* Bad offset for pull_hdr */
143#define PFRES_FRAG 2 /* Dropping following fragment */
144#define PFRES_SHORT 3 /* Dropping short packet */
145#define PFRES_NORM 4 /* Dropping by normalizer */
146#define PFRES_MEMORY 5 /* Dropped due to lacking mem */
147#define PFRES_TS 6 /* Bad TCP Timestamp (RFC1323) */
148#define PFRES_CONGEST 7 /* Congestion (of ipintrq) */
149#define PFRES_IPOPTIONS 8 /* IP option */
150#define PFRES_PROTCKSUM 9 /* Protocol checksum invalid */
151#define PFRES_BADSTATE 10 /* State mismatch */
152#define PFRES_STATEINS 11 /* State insertion failure */
153#define PFRES_MAXSTATES 12 /* State limit */
154#define PFRES_SRCLIMIT 13 /* Source node/conn limit */
155#define PFRES_SYNPROXY 14 /* SYN proxy */
156#define PFRES_MAPFAILED 15 /* pf_map_addr() failed */
157#define PFRES_MAX 16 /* total+1 */
158
159#define PFRES_NAMES { \
160 "match", \
161 "bad-offset", \
162 "fragment", \
163 "short", \
164 "normalize", \
165 "memory", \
166 "bad-timestamp", \
167 "congestion", \
168 "ip-option", \
169 "proto-cksum", \
170 "state-mismatch", \
171 "state-insert", \
172 "state-limit", \
173 "src-limit", \
174 "synproxy", \
175 "map-failed", \
176 NULL \
177}
178
179/* Counters for other things we want to keep track of */
180#define LCNT_STATES 0 /* states */
181#define LCNT_SRCSTATES 1 /* max-src-states */
182#define LCNT_SRCNODES 2 /* max-src-nodes */
183#define LCNT_SRCCONN 3 /* max-src-conn */
184#define LCNT_SRCCONNRATE 4 /* max-src-conn-rate */
185#define LCNT_OVERLOAD_TABLE 5 /* entry added to overload table */
186#define LCNT_OVERLOAD_FLUSH 6 /* state entries flushed */
187#define LCNT_MAX 7 /* total+1 */
188/* Only available via the nvlist-based API */
189#define KLCNT_SYNFLOODS 7 /* synfloods detected */
190#define KLCNT_SYNCOOKIES_SENT 8 /* syncookies sent */
191#define KLCNT_SYNCOOKIES_VALID 9 /* syncookies validated */
192#define KLCNT_MAX 10 /* total+1 */
193
194#define LCNT_NAMES { \
195 "max states per rule", \
196 "max-src-states", \
197 "max-src-nodes", \
198 "max-src-conn", \
199 "max-src-conn-rate", \
200 "overload table insertion", \
201 "overload flush states", \
202 NULL \
203}
204#define KLCNT_NAMES { \
205 "max states per rule", \
206 "max-src-states", \
207 "max-src-nodes", \
208 "max-src-conn", \
209 "max-src-conn-rate", \
210 "overload table insertion", \
211 "overload flush states", \
212 "synfloods detected", \
213 "syncookies sent", \
214 "syncookies validated", \
215 NULL \
216}
217
218/* state operation counters */
219#define FCNT_STATE_SEARCH 0
220#define FCNT_STATE_INSERT 1
221#define FCNT_STATE_REMOVALS 2
222#define FCNT_MAX 3
223
224#ifdef _KERNEL
225#define FCNT_NAMES { \
226 "searches", \
227 "inserts", \
228 "removals", \
229 NULL \
230}
231#endif
232
233/* src_node operation counters */
234#define SCNT_SRC_NODE_SEARCH 0
235#define SCNT_SRC_NODE_INSERT 1
236#define SCNT_SRC_NODE_REMOVALS 2
237#define SCNT_MAX 3
238
239#define PF_TABLE_NAME_SIZE 32
240#define PF_QNAME_SIZE 64
241
242struct pfioc_nv {
243 void *data;
244 size_t len; /* The length of the nvlist data. */
245 size_t size; /* The total size of the data buffer. */
246};
247
248struct pf_rule;
249
250/* keep synced with pfi_kif, used in RB_FIND */
251struct pfi_kif_cmp {
252 char pfik_name[IFNAMSIZ];
253};
254
255struct pfi_kif {
256 char pfik_name[IFNAMSIZ];
257 union {
258 RB_ENTRY(pfi_kif) pfik_tree;
259 LIST_ENTRY(pfi_kif) pfik_list;
260 };
261 u_int64_t pfik_packets[2][2][2];
262 u_int64_t pfik_bytes[2][2][2];
263 u_int32_t pfik_tzero;
264 u_int pfik_flags;
265 struct ifnet *pfik_ifp;
266 struct ifg_group *pfik_group;
267 u_int pfik_rulerefs;
268 TAILQ_HEAD(, pfi_dynaddr) pfik_dynaddrs;
269};
270
271struct pf_status {
272 uint64_t counters[PFRES_MAX];
273 uint64_t lcounters[LCNT_MAX];
274 uint64_t fcounters[FCNT_MAX];
275 uint64_t scounters[SCNT_MAX];
276 uint64_t pcounters[2][2][3];
277 uint64_t bcounters[2][2];
278 uint32_t running;
279 uint32_t states;
280 uint32_t src_nodes;
281 uint32_t since;
282 uint32_t debug;
283 uint32_t hostid;
284 char ifname[IFNAMSIZ];
285 uint8_t pf_chksum[PF_MD5_DIGEST_LENGTH];
286};
287
288#define PF_REASS_ENABLED 0x01
289#define PF_REASS_NODF 0x02
290
291struct pf_addr {
292 union {
293 struct in_addr v4;
294 struct in6_addr v6;
295 u_int8_t addr8[16];
296 u_int16_t addr16[8];
297 u_int32_t addr32[4];
298 }; /* 128-bit address */
299};
300
301#define PFI_AFLAG_NETWORK 0x01
302#define PFI_AFLAG_BROADCAST 0x02
303#define PFI_AFLAG_PEER 0x04
304#define PFI_AFLAG_MODEMASK 0x07
305#define PFI_AFLAG_NOALIAS 0x08
306
307struct pf_addr_wrap {
308 union {
309 struct {
310 struct pf_addr addr;
311 struct pf_addr mask;
312 } a;
313 char ifname[IFNAMSIZ];
314 char tblname[PF_TABLE_NAME_SIZE];
315 } v;
316 union {
317 struct pfi_dynaddr *dyn;
318 struct pfr_ktable *tbl;
319 int dyncnt;
320 int tblcnt;
321 } p;
322 u_int8_t type; /* PF_ADDR_* */
323 u_int8_t iflags; /* PFI_AFLAG_* */
324};
325
326union pf_rule_ptr {
327 struct pf_rule *ptr;
328 u_int32_t nr;
329};
330
331struct pf_rule_uid {
332 uid_t uid[2];
333 u_int8_t op;
334};
335
336struct pf_rule_gid {
337 uid_t gid[2];
338 u_int8_t op;
339};
340
341struct pf_rule_addr {
342 struct pf_addr_wrap addr;
343 u_int16_t port[2];
344 u_int8_t neg;
345 u_int8_t port_op;
346};
347
348struct pf_pooladdr {
349 struct pf_addr_wrap addr;
350 TAILQ_ENTRY(pf_pooladdr) entries;
351 char ifname[IFNAMSIZ];
352 struct pfi_kif *kif;
353};
354
355TAILQ_HEAD(pf_palist, pf_pooladdr);
356
357struct pf_poolhashkey {
358 union {
359 u_int8_t key8[16];
360 u_int16_t key16[8];
361 u_int32_t key32[4];
362 }; /* 128-bit hash key */
363};
364
365struct pf_mape_portset {
366 u_int8_t offset;
367 u_int8_t psidlen;
368 u_int16_t psid;
369};
370
371struct pf_pool {
372 struct pf_palist list;
373 struct pf_pooladdr *cur;
374 struct pf_poolhashkey key;
375 struct pf_addr counter;
376 int tblidx;
377 u_int16_t proxy_port[2];
378 u_int8_t opts;
379};
380
381/* A packed Operating System description for fingerprinting */
382typedef u_int32_t pf_osfp_t;
383#define PF_OSFP_ANY ((pf_osfp_t)0)
384#define PF_OSFP_UNKNOWN ((pf_osfp_t)-1)
385#define PF_OSFP_NOMATCH ((pf_osfp_t)-2)
386
387struct pf_osfp_entry {
388 SLIST_ENTRY(pf_osfp_entry) fp_entry;
389 pf_osfp_t fp_os;
390 int fp_enflags;
391#define PF_OSFP_EXPANDED 0x001 /* expanded entry */
392#define PF_OSFP_GENERIC 0x002 /* generic signature */
393#define PF_OSFP_NODETAIL 0x004 /* no p0f details */
394#define PF_OSFP_LEN 32
395 char fp_class_nm[PF_OSFP_LEN];
396 char fp_version_nm[PF_OSFP_LEN];
397 char fp_subtype_nm[PF_OSFP_LEN];
398};
399#define PF_OSFP_ENTRY_EQ(a, b) \
400 ((a)->fp_os == (b)->fp_os && \
401 memcmp((a)->fp_class_nm, (b)->fp_class_nm, PF_OSFP_LEN) == 0 && \
402 memcmp((a)->fp_version_nm, (b)->fp_version_nm, PF_OSFP_LEN) == 0 && \
403 memcmp((a)->fp_subtype_nm, (b)->fp_subtype_nm, PF_OSFP_LEN) == 0)
404
405/* handle pf_osfp_t packing */
406#define _FP_RESERVED_BIT 1 /* For the special negative #defines */
407#define _FP_UNUSED_BITS 1
408#define _FP_CLASS_BITS 10 /* OS Class (Windows, Linux) */
409#define _FP_VERSION_BITS 10 /* OS version (95, 98, NT, 2.4.54, 3.2) */
410#define _FP_SUBTYPE_BITS 10 /* patch level (NT SP4, SP3, ECN patch) */
411#define PF_OSFP_UNPACK(osfp, class, version, subtype) do { \
412 (class) = ((osfp) >> (_FP_VERSION_BITS+_FP_SUBTYPE_BITS)) & \
413 ((1 << _FP_CLASS_BITS) - 1); \
414 (version) = ((osfp) >> _FP_SUBTYPE_BITS) & \
415 ((1 << _FP_VERSION_BITS) - 1);\
416 (subtype) = (osfp) & ((1 << _FP_SUBTYPE_BITS) - 1); \
417} while(0)
418#define PF_OSFP_PACK(osfp, class, version, subtype) do { \
419 (osfp) = ((class) & ((1 << _FP_CLASS_BITS) - 1)) << (_FP_VERSION_BITS \
420 + _FP_SUBTYPE_BITS); \
421 (osfp) |= ((version) & ((1 << _FP_VERSION_BITS) - 1)) << \
422 _FP_SUBTYPE_BITS; \
423 (osfp) |= (subtype) & ((1 << _FP_SUBTYPE_BITS) - 1); \
424} while(0)
425
426/* the fingerprint of an OSes TCP SYN packet */
427typedef u_int64_t pf_tcpopts_t;
428struct pf_os_fingerprint {
429 SLIST_HEAD(pf_osfp_enlist, pf_osfp_entry) fp_oses; /* list of matches */
430 pf_tcpopts_t fp_tcpopts; /* packed TCP options */
431 u_int16_t fp_wsize; /* TCP window size */
432 u_int16_t fp_psize; /* ip->ip_len */
433 u_int16_t fp_mss; /* TCP MSS */
434 u_int16_t fp_flags;
435#define PF_OSFP_WSIZE_MOD 0x0001 /* Window modulus */
436#define PF_OSFP_WSIZE_DC 0x0002 /* Window don't care */
437#define PF_OSFP_WSIZE_MSS 0x0004 /* Window multiple of MSS */
438#define PF_OSFP_WSIZE_MTU 0x0008 /* Window multiple of MTU */
439#define PF_OSFP_PSIZE_MOD 0x0010 /* packet size modulus */
440#define PF_OSFP_PSIZE_DC 0x0020 /* packet size don't care */
441#define PF_OSFP_WSCALE 0x0040 /* TCP window scaling */
442#define PF_OSFP_WSCALE_MOD 0x0080 /* TCP window scale modulus */
443#define PF_OSFP_WSCALE_DC 0x0100 /* TCP window scale dont-care */
444#define PF_OSFP_MSS 0x0200 /* TCP MSS */
445#define PF_OSFP_MSS_MOD 0x0400 /* TCP MSS modulus */
446#define PF_OSFP_MSS_DC 0x0800 /* TCP MSS dont-care */
447#define PF_OSFP_DF 0x1000 /* IPv4 don't fragment bit */
448#define PF_OSFP_TS0 0x2000 /* Zero timestamp */
449#define PF_OSFP_INET6 0x4000 /* IPv6 */
450 u_int8_t fp_optcnt; /* TCP option count */
451 u_int8_t fp_wscale; /* TCP window scaling */
452 u_int8_t fp_ttl; /* IPv4 TTL */
453#define PF_OSFP_MAXTTL_OFFSET 40
454/* TCP options packing */
455#define PF_OSFP_TCPOPT_NOP 0x0 /* TCP NOP option */
456#define PF_OSFP_TCPOPT_WSCALE 0x1 /* TCP window scaling option */
457#define PF_OSFP_TCPOPT_MSS 0x2 /* TCP max segment size opt */
458#define PF_OSFP_TCPOPT_SACK 0x3 /* TCP SACK OK option */
459#define PF_OSFP_TCPOPT_TS 0x4 /* TCP timestamp option */
460#define PF_OSFP_TCPOPT_BITS 3 /* bits used by each option */
461#define PF_OSFP_MAX_OPTS \
462 (sizeof(((struct pf_os_fingerprint *)0)->fp_tcpopts) * 8) \
463 / PF_OSFP_TCPOPT_BITS
464
465 SLIST_ENTRY(pf_os_fingerprint) fp_next;
466};
467
468struct pf_osfp_ioctl {
469 struct pf_osfp_entry fp_os;
470 pf_tcpopts_t fp_tcpopts; /* packed TCP options */
471 u_int16_t fp_wsize; /* TCP window size */
472 u_int16_t fp_psize; /* ip->ip_len */
473 u_int16_t fp_mss; /* TCP MSS */
474 u_int16_t fp_flags;
475 u_int8_t fp_optcnt; /* TCP option count */
476 u_int8_t fp_wscale; /* TCP window scaling */
477 u_int8_t fp_ttl; /* IPv4 TTL */
478
479 int fp_getnum; /* DIOCOSFPGET number */
480};
481
482#define PF_ANCHOR_NAME_SIZE 64
483
484struct pf_rule {
485 struct pf_rule_addr src;
486 struct pf_rule_addr dst;
487#define PF_SKIP_IFP 0
488#define PF_SKIP_DIR 1
489#define PF_SKIP_AF 2
490#define PF_SKIP_PROTO 3
491#define PF_SKIP_SRC_ADDR 4
492#define PF_SKIP_SRC_PORT 5
493#define PF_SKIP_DST_ADDR 6
494#define PF_SKIP_DST_PORT 7
495#define PF_SKIP_COUNT 8
496 union pf_rule_ptr skip[PF_SKIP_COUNT];
497#define PF_RULE_LABEL_SIZE 64
498#define PF_RULE_MAX_LABEL_COUNT 5
499 char label[PF_RULE_LABEL_SIZE];
500 char ifname[IFNAMSIZ];
501 char qname[PF_QNAME_SIZE];
502 char pqname[PF_QNAME_SIZE];
503#define PF_TAG_NAME_SIZE 64
504 char tagname[PF_TAG_NAME_SIZE];
505 char match_tagname[PF_TAG_NAME_SIZE];
506
507 char overload_tblname[PF_TABLE_NAME_SIZE];
508
509 TAILQ_ENTRY(pf_rule) entries;
510 struct pf_pool rpool;
511
512 u_int64_t evaluations;
513 u_int64_t packets[2];
514 u_int64_t bytes[2];
515
516 struct pfi_kif *kif;
517 struct pf_anchor *anchor;
518 struct pfr_ktable *overload_tbl;
519
520 pf_osfp_t os_fingerprint;
521
522 int rtableid;
523 u_int32_t timeout[PFTM_OLD_MAX];
524 u_int32_t max_states;
525 u_int32_t max_src_nodes;
526 u_int32_t max_src_states;
527 u_int32_t max_src_conn;
528 struct {
529 u_int32_t limit;
530 u_int32_t seconds;
531 } max_src_conn_rate;
532 u_int32_t qid;
533 u_int32_t pqid;
534 u_int32_t rt_listid;
535 u_int32_t nr;
536 u_int32_t prob;
537 uid_t cuid;
538 pid_t cpid;
539
540 counter_u64_t states_cur;
541 counter_u64_t states_tot;
542 counter_u64_t src_nodes;
543
544 u_int16_t return_icmp;
545 u_int16_t return_icmp6;
546 u_int16_t max_mss;
547 u_int16_t tag;
548 u_int16_t match_tag;
549 u_int16_t scrub_flags;
550
551 struct pf_rule_uid uid;
552 struct pf_rule_gid gid;
553
554 u_int32_t rule_flag;
555 u_int8_t action;
556 u_int8_t direction;
557 u_int8_t log;
558 u_int8_t logif;
559 u_int8_t quick;
560 u_int8_t ifnot;
561 u_int8_t match_tag_not;
562 u_int8_t natpass;
563
564#define PF_STATE_NORMAL 0x1
565#define PF_STATE_MODULATE 0x2
566#define PF_STATE_SYNPROXY 0x3
567 u_int8_t keep_state;
568 sa_family_t af;
569 u_int8_t proto;
570 u_int8_t type;
571 u_int8_t code;
572 u_int8_t flags;
573 u_int8_t flagset;
574 u_int8_t min_ttl;
575 u_int8_t allow_opts;
576 u_int8_t rt;
577 u_int8_t return_ttl;
578 u_int8_t tos;
579 u_int8_t set_tos;
580 u_int8_t anchor_relative;
581 u_int8_t anchor_wildcard;
582
583#define PF_FLUSH 0x01
584#define PF_FLUSH_GLOBAL 0x02
585 u_int8_t flush;
586#define PF_PRIO_ZERO 0xff /* match "prio 0" packets */
587#define PF_PRIO_MAX 7
588 u_int8_t prio;
589 u_int8_t set_prio[2];
590
591 struct {
592 struct pf_addr addr;
593 u_int16_t port;
594 } divert;
595
596 uint64_t u_states_cur;
597 uint64_t u_states_tot;
598 uint64_t u_src_nodes;
599};
600
601/* pf_krule->rule_flag and old-style scrub flags */
602#define PFRULE_DROP 0x00000000
603#define PFRULE_RETURNRST 0x00000001
604#define PFRULE_FRAGMENT 0x00000002
605#define PFRULE_RETURNICMP 0x00000004
606#define PFRULE_RETURN 0x00000008
607#define PFRULE_NOSYNC 0x00000010
608#define PFRULE_SRCTRACK 0x00000020 /* track source states */
609#define PFRULE_RULESRCTRACK 0x00000040 /* per rule */
610#define PFRULE_NODF 0x00000100
611#define PFRULE_FRAGMENT_NOREASS 0x00000200
612#define PFRULE_RANDOMID 0x00000800
613#define PFRULE_REASSEMBLE_TCP 0x00001000
614#define PFRULE_SET_TOS 0x00002000
615#define PFRULE_IFBOUND 0x00010000 /* if-bound */
616#define PFRULE_STATESLOPPY 0x00020000 /* sloppy state tracking */
617
618#ifdef _KERNEL
619#define PFRULE_REFS 0x0080 /* rule has references */
620#endif
621
622/* pf_rule_actions->dnflags */
623#define PFRULE_DN_IS_PIPE 0x0040
624#define PFRULE_DN_IS_QUEUE 0x0080
625
626/* pf_state->state_flags, pf_rule_actions->flags, pf_krule->scrub_flags */
627#define PFSTATE_ALLOWOPTS 0x0001
628#define PFSTATE_SLOPPY 0x0002
629/* was PFSTATE_PFLOW 0x0004 */
630#define PFSTATE_NOSYNC 0x0008
631#define PFSTATE_ACK 0x0010
632#define PFSTATE_NODF 0x0020
633#define PFSTATE_SETTOS 0x0040
634#define PFSTATE_RANDOMID 0x0080
635#define PFSTATE_SCRUB_TCP 0x0100
636#define PFSTATE_SETPRIO 0x0200
637/* was PFSTATE_INP_UNLINKED 0x0400 */
638/* FreeBSD-specific flags are added from the end to keep space for porting
639 * flags from OpenBSD */
640#define PFSTATE_DN_IS_PIPE 0x4000
641#define PFSTATE_DN_IS_QUEUE 0x8000
642#define PFSTATE_SCRUBMASK (PFSTATE_NODF|PFSTATE_RANDOMID|PFSTATE_SCRUB_TCP)
643#define PFSTATE_SETMASK (PFSTATE_SETTOS|PFSTATE_SETPRIO)
644
645#define PFSTATE_HIWAT 100000 /* default state table size */
646#define PFSTATE_ADAPT_START 60000 /* default adaptive timeout start */
647#define PFSTATE_ADAPT_END 120000 /* default adaptive timeout end */
648
649
650struct pf_threshold {
651 u_int32_t limit;
652#define PF_THRESHOLD_MULT 1000
653#define PF_THRESHOLD_MAX 0xffffffff / PF_THRESHOLD_MULT
654 u_int32_t seconds;
655 u_int32_t count;
656 u_int32_t last;
657};
658
659struct pf_src_node {
660 LIST_ENTRY(pf_src_node) entry;
661 struct pf_addr addr;
662 struct pf_addr raddr;
663 union pf_rule_ptr rule;
664 struct pfi_kif *kif;
665 u_int64_t bytes[2];
666 u_int64_t packets[2];
667 u_int32_t states;
668 u_int32_t conn;
669 struct pf_threshold conn_rate;
670 u_int32_t creation;
671 u_int32_t expire;
672 sa_family_t af;
673 u_int8_t ruletype;
674};
675
676#define PFSNODE_HIWAT 10000 /* default source node table size */
677
678TAILQ_HEAD(pf_rulequeue, pf_rule);
679
680struct pf_anchor;
681
682struct pf_ruleset {
683 struct {
684 struct pf_rulequeue queues[2];
685 struct {
686 struct pf_rulequeue *ptr;
687 struct pf_rule **ptr_array;
688 u_int32_t rcount;
689 u_int32_t ticket;
690 int open;
691 } active, inactive;
692 } rules[PF_RULESET_MAX];
693 struct pf_anchor *anchor;
694 u_int32_t tticket;
695 int tables;
696 int topen;
697};
698
699RB_HEAD(pf_anchor_global, pf_anchor);
700RB_HEAD(pf_anchor_node, pf_anchor);
701struct pf_anchor {
702 RB_ENTRY(pf_anchor) entry_global;
703 RB_ENTRY(pf_anchor) entry_node;
704 struct pf_anchor *parent;
705 struct pf_anchor_node children;
706 char name[PF_ANCHOR_NAME_SIZE];
707 char path[MAXPATHLEN];
708 struct pf_ruleset ruleset;
709 int refcnt; /* anchor rules */
710 int match; /* XXX: used for pfctl black magic */
711};
712RB_PROTOTYPE(pf_anchor_global, pf_anchor, entry_global, pf_anchor_compare);
713RB_PROTOTYPE(pf_anchor_node, pf_anchor, entry_node, pf_anchor_compare);
714
715int pf_get_ruleset_number(u_int8_t);
716
717#endif /* _NET_PF_H_ */