1 | /* |
2 | * Copyright (c) 2007-2021 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | |
29 | /* $apfw: git commit b6bf13f8321283cd7ee82b1795e86506084b1b95 $ */ |
30 | /* $OpenBSD: pfvar.h,v 1.259 2007/12/02 12:08:04 pascoe Exp $ */ |
31 | |
32 | /* |
33 | * Copyright (c) 2001 Daniel Hartmeier |
34 | * NAT64 - Copyright (c) 2010 Viagenie Inc. (http://www.viagenie.ca) |
35 | * All rights reserved. |
36 | * |
37 | * Redistribution and use in source and binary forms, with or without |
38 | * modification, are permitted provided that the following conditions |
39 | * are met: |
40 | * |
41 | * - Redistributions of source code must retain the above copyright |
42 | * notice, this list of conditions and the following disclaimer. |
43 | * - Redistributions in binary form must reproduce the above |
44 | * copyright notice, this list of conditions and the following |
45 | * disclaimer in the documentation and/or other materials provided |
46 | * with the distribution. |
47 | * |
48 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
49 | * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
50 | * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS |
51 | * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE |
52 | * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, |
53 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, |
54 | * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
55 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER |
56 | * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
57 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN |
58 | * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE |
59 | * POSSIBILITY OF SUCH DAMAGE. |
60 | * |
61 | */ |
62 | |
63 | #ifndef _NET_PFVAR_H_ |
64 | #define _NET_PFVAR_H_ |
65 | |
66 | #ifdef PRIVATE |
67 | /* |
68 | * XXX |
69 | * XXX Private interfaces. Do not include this file; use pfctl(8) instead. |
70 | * XXX |
71 | */ |
72 | #if PF || !defined(KERNEL) |
73 | |
74 | #ifdef __cplusplus |
75 | extern "C" { |
76 | #endif |
77 | |
78 | #include <stdbool.h> |
79 | #include <sys/param.h> |
80 | #include <sys/types.h> |
81 | #include <sys/queue.h> |
82 | #include <libkern/tree.h> |
83 | |
84 | #include <net/radix.h> |
85 | #include <netinet/in.h> |
86 | #include <net/if_var.h> |
87 | #ifdef KERNEL |
88 | #include <kern/kern_types.h> |
89 | #include <kern/zalloc.h> |
90 | #include <kern/locks.h> |
91 | |
92 | #include <machine/endian.h> |
93 | #include <sys/systm.h> |
94 | #include <net/pf_pbuf.h> |
95 | |
96 | #if SKYWALK |
97 | #include <netinet/in_pcb.h> |
98 | #include <skywalk/namespace/netns.h> |
99 | #endif |
100 | |
101 | #if BYTE_ORDER == BIG_ENDIAN |
102 | #define htobe64(x) (x) |
103 | #else /* LITTLE ENDIAN */ |
104 | #define htobe64(x) __DARWIN_OSSwapInt64(x) |
105 | #endif /* LITTLE_ENDIAN */ |
106 | |
107 | #define be64toh(x) htobe64(x) |
108 | |
109 | extern lck_rw_t pf_perim_lock; |
110 | extern lck_mtx_t pf_lock; |
111 | |
112 | struct pool { |
113 | struct zone *pool_zone; /* pointer to backend zone */ |
114 | const char *pool_name; /* name of pool */ |
115 | unsigned int pool_count; /* # of outstanding elements */ |
116 | unsigned int pool_hiwat; /* high watermark */ |
117 | unsigned int pool_limit; /* hard limit */ |
118 | unsigned int pool_fails; /* # of failed allocs due to limit */ |
119 | }; |
120 | |
121 | #define PR_NOWAIT FALSE |
122 | #define PR_WAITOK TRUE |
123 | |
124 | __private_extern__ void pool_init(struct pool *, size_t, unsigned int, |
125 | unsigned int, int, const char *, void *); |
126 | __private_extern__ void pool_destroy(struct pool *); |
127 | __private_extern__ void pool_sethiwat(struct pool *, int); |
128 | __private_extern__ void pool_sethardlimit(struct pool *, int, |
129 | const char *, int); |
130 | __private_extern__ void *pool_get(struct pool *, int); |
131 | __private_extern__ void pool_put(struct pool *, void *); |
132 | __private_extern__ u_int64_t pf_time_second(void); |
133 | __private_extern__ u_int64_t pf_calendar_time_second(void); |
134 | #endif /* KERNEL */ |
135 | |
136 | union sockaddr_union { |
137 | struct sockaddr sa; |
138 | struct sockaddr_in sin; |
139 | struct sockaddr_in6 sin6; |
140 | }; |
141 | |
142 | #define PF_TCPS_PROXY_SRC ((TCP_NSTATES)+0) |
143 | #define PF_TCPS_PROXY_DST ((TCP_NSTATES)+1) |
144 | |
145 | #define PF_MD5_DIGEST_LENGTH 16 |
146 | #ifdef MD5_DIGEST_LENGTH |
147 | #if PF_MD5_DIGEST_LENGTH != MD5_DIGEST_LENGTH |
148 | #error |
149 | #endif /* PF_MD5_DIGEST_LENGTH != MD5_DIGEST_LENGTH */ |
150 | #endif /* MD5_DIGEST_LENGTH */ |
151 | |
152 | #ifdef KERNEL |
153 | struct ip; |
154 | struct ip6_hdr; |
155 | struct tcphdr; |
156 | struct pf_grev1_hdr; |
157 | struct pf_esp_hdr; |
158 | #endif /* KERNEL */ |
159 | |
160 | #define PF_GRE_PPTP_VARIANT 0x01 |
161 | |
162 | enum { PF_INOUT, PF_IN, PF_OUT }; |
163 | enum { PF_PASS, PF_DROP, PF_SCRUB, PF_NOSCRUB, PF_NAT, PF_NONAT, |
164 | PF_BINAT, PF_NOBINAT, PF_RDR, PF_NORDR, PF_SYNPROXY_DROP, |
165 | PF_DUMMYNET, PF_NODUMMYNET, PF_NAT64, PF_NONAT64 }; |
166 | enum { PF_RULESET_SCRUB, PF_RULESET_FILTER, PF_RULESET_NAT, |
167 | PF_RULESET_BINAT, PF_RULESET_RDR, PF_RULESET_DUMMYNET, |
168 | PF_RULESET_MAX }; |
169 | enum { PF_OP_NONE, PF_OP_IRG, PF_OP_EQ, PF_OP_NE, PF_OP_LT, |
170 | PF_OP_LE, PF_OP_GT, PF_OP_GE, PF_OP_XRG, PF_OP_RRG }; |
171 | enum { PF_DEBUG_NONE, PF_DEBUG_URGENT, PF_DEBUG_MISC, PF_DEBUG_NOISY }; |
172 | enum { PF_CHANGE_NONE, PF_CHANGE_ADD_HEAD, PF_CHANGE_ADD_TAIL, |
173 | PF_CHANGE_ADD_BEFORE, PF_CHANGE_ADD_AFTER, |
174 | PF_CHANGE_REMOVE, PF_CHANGE_GET_TICKET }; |
175 | enum { PF_GET_NONE, PF_GET_CLR_CNTR }; |
176 | |
177 | /* |
178 | * Note about PFTM_*: real indices into pf_rule.timeout[] come before |
179 | * PFTM_MAX, special cases afterwards. See pf_state_expires(). |
180 | */ |
181 | enum { PFTM_TCP_FIRST_PACKET, PFTM_TCP_OPENING, PFTM_TCP_ESTABLISHED, |
182 | PFTM_TCP_CLOSING, PFTM_TCP_FIN_WAIT, PFTM_TCP_CLOSED, |
183 | PFTM_UDP_FIRST_PACKET, PFTM_UDP_SINGLE, PFTM_UDP_MULTIPLE, |
184 | PFTM_ICMP_FIRST_PACKET, PFTM_ICMP_ERROR_REPLY, |
185 | PFTM_GREv1_FIRST_PACKET, PFTM_GREv1_INITIATING, |
186 | PFTM_GREv1_ESTABLISHED, PFTM_ESP_FIRST_PACKET, PFTM_ESP_INITIATING, |
187 | PFTM_ESP_ESTABLISHED, PFTM_OTHER_FIRST_PACKET, PFTM_OTHER_SINGLE, |
188 | PFTM_OTHER_MULTIPLE, PFTM_FRAG, PFTM_INTERVAL, |
189 | PFTM_ADAPTIVE_START, PFTM_ADAPTIVE_END, PFTM_SRC_NODE, |
190 | PFTM_TS_DIFF, PFTM_MAX, PFTM_PURGE, PFTM_UNLINKED }; |
191 | |
192 | /* PFTM default values */ |
193 | #define PFTM_TCP_FIRST_PACKET_VAL 120 /* First TCP packet */ |
194 | #define PFTM_TCP_OPENING_VAL 30 /* No response yet */ |
195 | #define PFTM_TCP_ESTABLISHED_VAL (24 * 60 * 60) /* Established */ |
196 | #define PFTM_TCP_CLOSING_VAL (15 * 60) /* Half closed */ |
197 | #define PFTM_TCP_FIN_WAIT_VAL 45 /* Got both FINs */ |
198 | #define PFTM_TCP_CLOSED_VAL 90 /* Got a RST */ |
199 | #define PFTM_UDP_FIRST_PACKET_VAL 60 /* First UDP packet */ |
200 | #define PFTM_UDP_SINGLE_VAL 30 /* Unidirectional */ |
201 | #define PFTM_UDP_MULTIPLE_VAL 60 /* Bidirectional */ |
202 | #define PFTM_ICMP_FIRST_PACKET_VAL 20 /* First ICMP packet */ |
203 | #define PFTM_ICMP_ERROR_REPLY_VAL 10 /* Got error response */ |
204 | #define PFTM_GREv1_FIRST_PACKET_VAL 120 |
205 | #define PFTM_GREv1_INITIATING_VAL 30 |
206 | #define PFTM_GREv1_ESTABLISHED_VAL 1800 |
207 | #define PFTM_ESP_FIRST_PACKET_VAL 120 |
208 | #define PFTM_ESP_INITIATING_VAL 30 |
209 | #define PFTM_ESP_ESTABLISHED_VAL 900 |
210 | #define PFTM_OTHER_FIRST_PACKET_VAL 60 /* First packet */ |
211 | #define PFTM_OTHER_SINGLE_VAL 30 /* Unidirectional */ |
212 | #define PFTM_OTHER_MULTIPLE_VAL 60 /* Bidirectional */ |
213 | #define PFTM_FRAG_VAL 30 /* Fragment expire */ |
214 | #define PFTM_INTERVAL_VAL 10 /* Expire interval */ |
215 | #define PFTM_SRC_NODE_VAL 0 /* Source tracking */ |
216 | #define PFTM_TS_DIFF_VAL 30 /* Allowed TS diff */ |
217 | |
218 | enum { PF_NOPFROUTE, PF_FASTROUTE, PF_ROUTETO, PF_DUPTO, PF_REPLYTO }; |
219 | enum { PF_LIMIT_STATES, |
220 | PF_LIMIT_APP_STATES, |
221 | PF_LIMIT_SRC_NODES, PF_LIMIT_FRAGS, |
222 | PF_LIMIT_TABLES, PF_LIMIT_TABLE_ENTRIES, PF_LIMIT_MAX }; |
223 | #define PF_POOL_IDMASK 0x0f |
224 | enum { PF_POOL_NONE, PF_POOL_BITMASK, PF_POOL_RANDOM, |
225 | PF_POOL_SRCHASH, PF_POOL_ROUNDROBIN }; |
226 | enum { PF_ADDR_ADDRMASK, PF_ADDR_NOROUTE, PF_ADDR_DYNIFTL, |
227 | PF_ADDR_TABLE, PF_ADDR_RTLABEL, PF_ADDR_URPFFAILED, |
228 | PF_ADDR_RANGE }; |
229 | #define PF_POOL_TYPEMASK 0x0f |
230 | #define PF_POOL_STICKYADDR 0x20 |
231 | #define PF_WSCALE_FLAG 0x80 |
232 | #define PF_WSCALE_MASK 0x0f |
233 | |
234 | #define PF_LOG 0x01 |
235 | #define PF_LOG_ALL 0x02 |
236 | #define PF_LOG_SOCKET_LOOKUP 0x04 |
237 | |
238 | struct pf_addr { |
239 | union { |
240 | struct in_addr _v4addr; |
241 | struct in6_addr _v6addr; |
242 | u_int8_t _addr8[16]; |
243 | u_int16_t _addr16[8]; |
244 | u_int32_t _addr32[4]; |
245 | } pfa; /* 128-bit address */ |
246 | #define v4addr pfa._v4addr |
247 | #define v6addr pfa._v6addr |
248 | #define addr8 pfa._addr8 |
249 | #define addr16 pfa._addr16 |
250 | #define addr32 pfa._addr32 |
251 | }; |
252 | |
253 | #define PF_TABLE_NAME_SIZE 32 |
254 | |
255 | #define PFI_AFLAG_NETWORK 0x01 |
256 | #define PFI_AFLAG_BROADCAST 0x02 |
257 | #define PFI_AFLAG_PEER 0x04 |
258 | #define PFI_AFLAG_MODEMASK 0x07 |
259 | #define PFI_AFLAG_NOALIAS 0x08 |
260 | |
261 | #ifndef RTLABEL_LEN |
262 | #define RTLABEL_LEN 32 |
263 | #endif |
264 | |
265 | struct pf_addr_wrap { |
266 | union { |
267 | struct { |
268 | struct pf_addr addr; |
269 | struct pf_addr mask; |
270 | } a; |
271 | char ifname[IFNAMSIZ]; |
272 | char tblname[PF_TABLE_NAME_SIZE]; |
273 | char rtlabelname[RTLABEL_LEN]; |
274 | u_int32_t rtlabel; |
275 | } v; |
276 | union { |
277 | #ifdef KERNEL |
278 | struct pfi_dynaddr *dyn __attribute__((aligned(8))); |
279 | struct pfr_ktable *tbl __attribute__((aligned(8))); |
280 | #else /* !KERNEL */ |
281 | void *dyn __attribute__((aligned(8))); |
282 | void *tbl __attribute__((aligned(8))); |
283 | #endif /* !KERNEL */ |
284 | int dyncnt __attribute__((aligned(8))); |
285 | int tblcnt __attribute__((aligned(8))); |
286 | } p __attribute__((aligned(8))); |
287 | u_int8_t type; /* PF_ADDR_* */ |
288 | u_int8_t iflags; /* PFI_AFLAG_* */ |
289 | }; |
290 | |
291 | struct pf_port_range { |
292 | u_int16_t port[2]; |
293 | u_int8_t op; |
294 | }; |
295 | |
296 | union pf_rule_xport { |
297 | struct pf_port_range range; |
298 | u_int16_t call_id; |
299 | u_int32_t spi; |
300 | }; |
301 | |
302 | #ifdef KERNEL |
303 | struct pfi_dynaddr { |
304 | TAILQ_ENTRY(pfi_dynaddr) entry; |
305 | struct pf_addr pfid_addr4; |
306 | struct pf_addr pfid_mask4; |
307 | struct pf_addr pfid_addr6; |
308 | struct pf_addr pfid_mask6; |
309 | struct pfr_ktable *pfid_kt; |
310 | struct pfi_kif *pfid_kif; |
311 | void *pfid_hook_cookie; |
312 | uint8_t pfid_net; /* mask or 128 */ |
313 | int pfid_acnt4; /* address count IPv4 */ |
314 | int pfid_acnt6; /* address count IPv6 */ |
315 | sa_family_t pfid_af; /* rule af */ |
316 | u_int8_t pfid_iflags; /* PFI_AFLAG_* */ |
317 | }; |
318 | |
319 | /* |
320 | * Address manipulation macros |
321 | */ |
322 | |
323 | #if INET |
324 | #endif /* INET */ |
325 | |
326 | #if !INET |
327 | #define PF_INET6_ONLY |
328 | #endif /* ! INET */ |
329 | |
330 | #if INET |
331 | #define PF_INET_INET6 |
332 | #endif /* INET */ |
333 | |
334 | #else /* !KERNEL */ |
335 | |
336 | #define PF_INET_INET6 |
337 | |
338 | #endif /* !KERNEL */ |
339 | |
340 | /* Both IPv4 and IPv6 */ |
341 | #ifdef PF_INET_INET6 |
342 | |
343 | #define PF_AEQ(a, b, c) \ |
344 | ((c == AF_INET && (a)->addr32[0] == (b)->addr32[0]) || \ |
345 | (c == AF_INET6 && ((a)->addr32[3] == (b)->addr32[3] && \ |
346 | (a)->addr32[2] == (b)->addr32[2] && \ |
347 | (a)->addr32[1] == (b)->addr32[1] && \ |
348 | (a)->addr32[0] == (b)->addr32[0]))) \ |
349 | |
350 | #define PF_ANEQ(a, b, c) \ |
351 | ((c == AF_INET && (a)->addr32[0] != (b)->addr32[0]) || \ |
352 | (c == AF_INET6 && ((a)->addr32[3] != (b)->addr32[3] || \ |
353 | (a)->addr32[2] != (b)->addr32[2] || \ |
354 | (a)->addr32[1] != (b)->addr32[1] || \ |
355 | (a)->addr32[0] != (b)->addr32[0]))) \ |
356 | |
357 | #define PF_ALEQ(a, b, c) \ |
358 | ((c == AF_INET && (a)->addr32[0] <= (b)->addr32[0]) || \ |
359 | (c == AF_INET6 && ((a)->addr32[3] <= (b)->addr32[3] && \ |
360 | (a)->addr32[2] <= (b)->addr32[2] && \ |
361 | (a)->addr32[1] <= (b)->addr32[1] && \ |
362 | (a)->addr32[0] <= (b)->addr32[0]))) \ |
363 | |
364 | #define PF_AZERO(a, c) \ |
365 | ((c == AF_INET && !(a)->addr32[0]) || \ |
366 | (c == AF_INET6 && (!(a)->addr32[0] && !(a)->addr32[1] && \ |
367 | !(a)->addr32[2] && !(a)->addr32[3]))) \ |
368 | |
369 | #define PF_MATCHA(n, a, m, b, f) \ |
370 | pf_match_addr(n, a, m, b, f) |
371 | |
372 | #define PF_ACPY(a, b, f) \ |
373 | pf_addrcpy(a, b, f) |
374 | |
375 | #define PF_AINC(a, f) \ |
376 | pf_addr_inc(a, f) |
377 | |
378 | #define PF_POOLMASK(a, b, c, d, f) \ |
379 | pf_poolmask(a, b, c, d, f) |
380 | |
381 | #else |
382 | |
383 | /* Just IPv6 */ |
384 | |
385 | #ifdef PF_INET6_ONLY |
386 | |
387 | #define PF_AEQ(a, b, c) \ |
388 | ((a)->addr32[3] == (b)->addr32[3] && \ |
389 | (a)->addr32[2] == (b)->addr32[2] && \ |
390 | (a)->addr32[1] == (b)->addr32[1] && \ |
391 | (a)->addr32[0] == (b)->addr32[0]) \ |
392 | |
393 | #define PF_ANEQ(a, b, c) \ |
394 | ((a)->addr32[3] != (b)->addr32[3] || \ |
395 | (a)->addr32[2] != (b)->addr32[2] || \ |
396 | (a)->addr32[1] != (b)->addr32[1] || \ |
397 | (a)->addr32[0] != (b)->addr32[0]) \ |
398 | |
399 | #define PF_ALEQ(a, b, c) \ |
400 | ((a)->addr32[3] <= (b)->addr32[3] && \ |
401 | (a)->addr32[2] <= (b)->addr32[2] && \ |
402 | (a)->addr32[1] <= (b)->addr32[1] && \ |
403 | (a)->addr32[0] <= (b)->addr32[0]) \ |
404 | |
405 | #define PF_AZERO(a, c) \ |
406 | (!(a)->addr32[0] && \ |
407 | !(a)->addr32[1] && \ |
408 | !(a)->addr32[2] && \ |
409 | !(a)->addr32[3]) \ |
410 | |
411 | #define PF_MATCHA(n, a, m, b, f) \ |
412 | pf_match_addr(n, a, m, b, f) |
413 | |
414 | #define PF_ACPY(a, b, f) \ |
415 | pf_addrcpy(a, b, f) |
416 | |
417 | #define PF_AINC(a, f) \ |
418 | pf_addr_inc(a, f) |
419 | |
420 | #define PF_POOLMASK(a, b, c, d, f) \ |
421 | pf_poolmask(a, b, c, d, f) |
422 | |
423 | #else |
424 | |
425 | /* Just IPv4 */ |
426 | #ifdef PF_INET_ONLY |
427 | |
428 | #define PF_AEQ(a, b, c) \ |
429 | ((a)->addr32[0] == (b)->addr32[0]) |
430 | |
431 | #define PF_ANEQ(a, b, c) \ |
432 | ((a)->addr32[0] != (b)->addr32[0]) |
433 | |
434 | #define PF_ALEQ(a, b, c) \ |
435 | ((a)->addr32[0] <= (b)->addr32[0]) |
436 | |
437 | #define PF_AZERO(a, c) \ |
438 | (!(a)->addr32[0]) |
439 | |
440 | #define PF_MATCHA(n, a, m, b, f) \ |
441 | pf_match_addr(n, a, m, b, f) |
442 | |
443 | #define PF_ACPY(a, b, f) \ |
444 | (a)->v4.s_addr = (b)->v4.s_addr |
445 | |
446 | #define PF_AINC(a, f) \ |
447 | do { \ |
448 | (a)->addr32[0] = htonl(ntohl((a)->addr32[0]) + 1); \ |
449 | } while (0) |
450 | |
451 | #define PF_POOLMASK(a, b, c, d, f) \ |
452 | do { \ |
453 | (a)->addr32[0] = ((b)->addr32[0] & (c)->addr32[0]) | \ |
454 | (((c)->addr32[0] ^ 0xffffffff) & (d)->addr32[0]); \ |
455 | } while (0) |
456 | |
457 | #endif /* PF_INET_ONLY */ |
458 | #endif /* PF_INET6_ONLY */ |
459 | #endif /* PF_INET_INET6 */ |
460 | |
461 | #ifdef KERNEL |
462 | #define PF_MISMATCHAW(aw, x, af, neg, ifp) \ |
463 | ( \ |
464 | (((aw)->type == PF_ADDR_NOROUTE && \ |
465 | pf_routable((x), (af), NULL)) || \ |
466 | (((aw)->type == PF_ADDR_URPFFAILED && (ifp) != NULL && \ |
467 | pf_routable((x), (af), (ifp))) || \ |
468 | ((aw)->type == PF_ADDR_RTLABEL && \ |
469 | !pf_rtlabel_match((x), (af), (aw))) || \ |
470 | ((aw)->type == PF_ADDR_TABLE && \ |
471 | !pfr_match_addr((aw)->p.tbl, (x), (af))) || \ |
472 | ((aw)->type == PF_ADDR_DYNIFTL && \ |
473 | !pfi_match_addr((aw)->p.dyn, (x), (af))) || \ |
474 | ((aw)->type == PF_ADDR_RANGE && \ |
475 | !pf_match_addr_range(&(aw)->v.a.addr, \ |
476 | &(aw)->v.a.mask, (x), (af))) || \ |
477 | ((aw)->type == PF_ADDR_ADDRMASK && \ |
478 | !PF_AZERO(&(aw)->v.a.mask, (af)) && \ |
479 | !PF_MATCHA(0, &(aw)->v.a.addr, \ |
480 | &(aw)->v.a.mask, (x), (af))))) != \ |
481 | (neg) \ |
482 | ) |
483 | #endif /* KERNEL */ |
484 | |
485 | struct pf_rule_uid { |
486 | uid_t uid[2]; |
487 | u_int8_t op; |
488 | u_int8_t _pad[3]; |
489 | }; |
490 | |
491 | struct pf_rule_gid { |
492 | uid_t gid[2]; |
493 | u_int8_t op; |
494 | u_int8_t _pad[3]; |
495 | }; |
496 | |
497 | struct pf_rule_addr { |
498 | struct pf_addr_wrap addr; |
499 | union pf_rule_xport xport; |
500 | u_int8_t neg; |
501 | }; |
502 | |
503 | struct pf_pooladdr { |
504 | struct pf_addr_wrap addr; |
505 | TAILQ_ENTRY(pf_pooladdr) entries; |
506 | #if !defined(__LP64__) |
507 | u_int32_t _pad[2]; |
508 | #endif /* !__LP64__ */ |
509 | char ifname[IFNAMSIZ]; |
510 | #ifdef KERNEL |
511 | struct pfi_kif *kif __attribute__((aligned(8))); |
512 | #else /* !KERNEL */ |
513 | void *kif __attribute__((aligned(8))); |
514 | #endif /* !KERNEL */ |
515 | }; |
516 | |
517 | TAILQ_HEAD(pf_palist, pf_pooladdr); |
518 | |
519 | struct pf_poolhashkey { |
520 | union { |
521 | u_int8_t key8[16]; |
522 | u_int16_t key16[8]; |
523 | u_int32_t key32[4]; |
524 | } pfk; /* 128-bit hash key */ |
525 | #define key8 pfk.key8 |
526 | #define key16 pfk.key16 |
527 | #define key32 pfk.key32 |
528 | }; |
529 | |
530 | struct pf_pool { |
531 | struct pf_palist list; |
532 | #if !defined(__LP64__) |
533 | u_int32_t _pad[2]; |
534 | #endif /* !__LP64__ */ |
535 | #ifdef KERNEL |
536 | struct pf_pooladdr *cur __attribute__((aligned(8))); |
537 | #else /* !KERNEL */ |
538 | void *cur __attribute__((aligned(8))); |
539 | #endif /* !KERNEL */ |
540 | struct pf_poolhashkey key __attribute__((aligned(8))); |
541 | struct pf_addr counter; |
542 | int tblidx; |
543 | u_int16_t proxy_port[2]; |
544 | u_int8_t port_op; |
545 | u_int8_t opts; |
546 | sa_family_t af; |
547 | }; |
548 | |
549 | |
550 | /* A packed Operating System description for fingerprinting */ |
551 | typedef u_int32_t pf_osfp_t; |
552 | #define PF_OSFP_ANY ((pf_osfp_t)0) |
553 | #define PF_OSFP_UNKNOWN ((pf_osfp_t)-1) |
554 | #define PF_OSFP_NOMATCH ((pf_osfp_t)-2) |
555 | |
556 | struct pf_osfp_entry { |
557 | SLIST_ENTRY(pf_osfp_entry) fp_entry; |
558 | #if !defined(__LP64__) |
559 | u_int32_t _pad; |
560 | #endif /* !__LP64__ */ |
561 | pf_osfp_t fp_os; |
562 | int fp_enflags; |
563 | #define PF_OSFP_EXPANDED 0x001 /* expanded entry */ |
564 | #define PF_OSFP_GENERIC 0x002 /* generic signature */ |
565 | #define PF_OSFP_NODETAIL 0x004 /* no p0f details */ |
566 | #define PF_OSFP_LEN 32 |
567 | char fp_class_nm[PF_OSFP_LEN]; |
568 | char fp_version_nm[PF_OSFP_LEN]; |
569 | char fp_subtype_nm[PF_OSFP_LEN]; |
570 | }; |
571 | #define PF_OSFP_ENTRY_EQ(a, b) \ |
572 | ((a)->fp_os == (b)->fp_os && \ |
573 | memcmp((a)->fp_class_nm, (b)->fp_class_nm, PF_OSFP_LEN) == 0 && \ |
574 | memcmp((a)->fp_version_nm, (b)->fp_version_nm, PF_OSFP_LEN) == 0 && \ |
575 | memcmp((a)->fp_subtype_nm, (b)->fp_subtype_nm, PF_OSFP_LEN) == 0) |
576 | |
577 | /* handle pf_osfp_t packing */ |
578 | #define _FP_RESERVED_BIT 1 /* For the special negative #defines */ |
579 | #define _FP_UNUSED_BITS 1 |
580 | #define _FP_CLASS_BITS 10 /* OS Class (Windows, Linux) */ |
581 | #define _FP_VERSION_BITS 10 /* OS version (95, 98, NT, 2.4.54, 3.2) */ |
582 | #define _FP_SUBTYPE_BITS 10 /* patch level (NT SP4, SP3, ECN patch) */ |
583 | #define PF_OSFP_UNPACK(osfp, class, version, subtype) do { \ |
584 | (class) = ((osfp) >> (_FP_VERSION_BITS+_FP_SUBTYPE_BITS)) & \ |
585 | ((1 << _FP_CLASS_BITS) - 1); \ |
586 | (version) = ((osfp) >> _FP_SUBTYPE_BITS) & \ |
587 | ((1 << _FP_VERSION_BITS) - 1);\ |
588 | (subtype) = (osfp) & ((1 << _FP_SUBTYPE_BITS) - 1); \ |
589 | } while (0) |
590 | #define PF_OSFP_PACK(osfp, class, version, subtype) do { \ |
591 | (osfp) = ((class) & ((1 << _FP_CLASS_BITS) - 1)) << (_FP_VERSION_BITS \ |
592 | + _FP_SUBTYPE_BITS); \ |
593 | (osfp) |= ((version) & ((1 << _FP_VERSION_BITS) - 1)) << \ |
594 | _FP_SUBTYPE_BITS; \ |
595 | (osfp) |= (subtype) & ((1 << _FP_SUBTYPE_BITS) - 1); \ |
596 | } while (0) |
597 | |
598 | /* the fingerprint of an OSes TCP SYN packet */ |
599 | typedef u_int64_t pf_tcpopts_t; |
600 | struct pf_os_fingerprint { |
601 | SLIST_HEAD(pf_osfp_enlist, pf_osfp_entry) fp_oses; /* list of matches */ |
602 | pf_tcpopts_t fp_tcpopts; /* packed TCP options */ |
603 | u_int16_t fp_wsize; /* TCP window size */ |
604 | u_int16_t fp_psize; /* ip->ip_len */ |
605 | u_int16_t fp_mss; /* TCP MSS */ |
606 | u_int16_t fp_flags; |
607 | #define PF_OSFP_WSIZE_MOD 0x0001 /* Window modulus */ |
608 | #define PF_OSFP_WSIZE_DC 0x0002 /* Window don't care */ |
609 | #define PF_OSFP_WSIZE_MSS 0x0004 /* Window multiple of MSS */ |
610 | #define PF_OSFP_WSIZE_MTU 0x0008 /* Window multiple of MTU */ |
611 | #define PF_OSFP_PSIZE_MOD 0x0010 /* packet size modulus */ |
612 | #define PF_OSFP_PSIZE_DC 0x0020 /* packet size don't care */ |
613 | #define PF_OSFP_WSCALE 0x0040 /* TCP window scaling */ |
614 | #define PF_OSFP_WSCALE_MOD 0x0080 /* TCP window scale modulus */ |
615 | #define PF_OSFP_WSCALE_DC 0x0100 /* TCP window scale dont-care */ |
616 | #define PF_OSFP_MSS 0x0200 /* TCP MSS */ |
617 | #define PF_OSFP_MSS_MOD 0x0400 /* TCP MSS modulus */ |
618 | #define PF_OSFP_MSS_DC 0x0800 /* TCP MSS dont-care */ |
619 | #define PF_OSFP_DF 0x1000 /* IPv4 don't fragment bit */ |
620 | #define PF_OSFP_TS0 0x2000 /* Zero timestamp */ |
621 | #define PF_OSFP_INET6 0x4000 /* IPv6 */ |
622 | u_int8_t fp_optcnt; /* TCP option count */ |
623 | u_int8_t fp_wscale; /* TCP window scaling */ |
624 | u_int8_t fp_ttl; /* IPv4 TTL */ |
625 | #define PF_OSFP_MAXTTL_OFFSET 40 |
626 | /* TCP options packing */ |
627 | #define PF_OSFP_TCPOPT_NOP 0x0 /* TCP NOP option */ |
628 | #define PF_OSFP_TCPOPT_WSCALE 0x1 /* TCP window scaling option */ |
629 | #define PF_OSFP_TCPOPT_MSS 0x2 /* TCP max segment size opt */ |
630 | #define PF_OSFP_TCPOPT_SACK 0x3 /* TCP SACK OK option */ |
631 | #define PF_OSFP_TCPOPT_TS 0x4 /* TCP timestamp option */ |
632 | #define PF_OSFP_TCPOPT_BITS 3 /* bits used by each option */ |
633 | #define PF_OSFP_MAX_OPTS \ |
634 | ((sizeof(pf_tcpopts_t) * 8) \ |
635 | / PF_OSFP_TCPOPT_BITS) |
636 | |
637 | SLIST_ENTRY(pf_os_fingerprint) fp_next; |
638 | }; |
639 | |
640 | struct pf_osfp_ioctl { |
641 | struct pf_osfp_entry fp_os; |
642 | pf_tcpopts_t fp_tcpopts; /* packed TCP options */ |
643 | u_int16_t fp_wsize; /* TCP window size */ |
644 | u_int16_t fp_psize; /* ip->ip_len */ |
645 | u_int16_t fp_mss; /* TCP MSS */ |
646 | u_int16_t fp_flags; |
647 | u_int8_t fp_optcnt; /* TCP option count */ |
648 | u_int8_t fp_wscale; /* TCP window scaling */ |
649 | u_int8_t fp_ttl; /* IPv4 TTL */ |
650 | |
651 | int fp_getnum; /* DIOCOSFPGET number */ |
652 | }; |
653 | |
654 | |
655 | union pf_rule_ptr { |
656 | struct pf_rule *ptr __attribute__((aligned(8))); |
657 | u_int32_t nr __attribute__((aligned(8))); |
658 | } __attribute__((aligned(8))); |
659 | |
660 | #define PF_ANCHOR_NAME_SIZE 64 |
661 | |
662 | struct pf_rule { |
663 | struct pf_rule_addr src; |
664 | struct pf_rule_addr dst; |
665 | #define PF_SKIP_IFP 0 |
666 | #define PF_SKIP_DIR 1 |
667 | #define PF_SKIP_AF 2 |
668 | #define PF_SKIP_PROTO 3 |
669 | #define PF_SKIP_SRC_ADDR 4 |
670 | #define PF_SKIP_SRC_PORT 5 |
671 | #define PF_SKIP_DST_ADDR 6 |
672 | #define PF_SKIP_DST_PORT 7 |
673 | #define PF_SKIP_COUNT 8 |
674 | union pf_rule_ptr skip[PF_SKIP_COUNT]; |
675 | #define PF_RULE_LABEL_SIZE 64 |
676 | char label[PF_RULE_LABEL_SIZE]; |
677 | #define PF_QNAME_SIZE 64 |
678 | char ifname[IFNAMSIZ]; |
679 | char qname[PF_QNAME_SIZE]; |
680 | char pqname[PF_QNAME_SIZE]; |
681 | #define PF_TAG_NAME_SIZE 64 |
682 | char tagname[PF_TAG_NAME_SIZE]; |
683 | char match_tagname[PF_TAG_NAME_SIZE]; |
684 | |
685 | char overload_tblname[PF_TABLE_NAME_SIZE]; |
686 | |
687 | TAILQ_ENTRY(pf_rule) entries; |
688 | #if !defined(__LP64__) |
689 | u_int32_t _pad[2]; |
690 | #endif /* !__LP64__ */ |
691 | struct pf_pool rpool; |
692 | |
693 | u_int64_t evaluations; |
694 | u_int64_t packets[2]; |
695 | u_int64_t bytes[2]; |
696 | |
697 | u_int64_t ticket; |
698 | #define PF_OWNER_NAME_SIZE 64 |
699 | char owner[PF_OWNER_NAME_SIZE]; |
700 | u_int32_t priority; |
701 | |
702 | #ifdef KERNEL |
703 | struct pfi_kif *kif __attribute__((aligned(8))); |
704 | #else /* !KERNEL */ |
705 | void *kif __attribute__((aligned(8))); |
706 | #endif /* !KERNEL */ |
707 | struct pf_anchor *anchor __attribute__((aligned(8))); |
708 | #ifdef KERNEL |
709 | struct pfr_ktable *overload_tbl __attribute__((aligned(8))); |
710 | #else /* !KERNEL */ |
711 | void *overload_tbl __attribute__((aligned(8))); |
712 | #endif /* !KERNEL */ |
713 | |
714 | pf_osfp_t os_fingerprint __attribute__((aligned(8))); |
715 | |
716 | unsigned int rtableid; |
717 | u_int32_t timeout[PFTM_MAX]; |
718 | u_int32_t states; |
719 | u_int32_t max_states; |
720 | u_int32_t src_nodes; |
721 | u_int32_t max_src_nodes; |
722 | u_int32_t max_src_states; |
723 | u_int32_t max_src_conn; |
724 | struct { |
725 | u_int32_t limit; |
726 | u_int32_t seconds; |
727 | } max_src_conn_rate; |
728 | u_int32_t qid; |
729 | u_int32_t pqid; |
730 | u_int32_t rt_listid; |
731 | u_int32_t nr; |
732 | u_int32_t prob; |
733 | uid_t cuid; |
734 | pid_t cpid; |
735 | |
736 | u_int16_t return_icmp; |
737 | u_int16_t return_icmp6; |
738 | u_int16_t max_mss; |
739 | u_int16_t tag; |
740 | u_int16_t match_tag; |
741 | |
742 | struct pf_rule_uid uid; |
743 | struct pf_rule_gid gid; |
744 | |
745 | u_int32_t rule_flag; |
746 | u_int8_t action; |
747 | u_int8_t direction; |
748 | u_int8_t log; |
749 | u_int8_t logif; |
750 | u_int8_t quick; |
751 | u_int8_t ifnot; |
752 | u_int8_t match_tag_not; |
753 | u_int8_t natpass; |
754 | |
755 | #define PF_STATE_NORMAL 0x1 |
756 | #define PF_STATE_MODULATE 0x2 |
757 | #define PF_STATE_SYNPROXY 0x3 |
758 | u_int8_t keep_state; |
759 | sa_family_t af; |
760 | u_int8_t proto; |
761 | u_int8_t type; |
762 | u_int8_t code; |
763 | u_int8_t flags; |
764 | u_int8_t flagset; |
765 | u_int8_t min_ttl; |
766 | u_int8_t allow_opts; |
767 | u_int8_t rt; |
768 | u_int8_t return_ttl; |
769 | |
770 | /* service class categories */ |
771 | #define SCIDX_MASK 0x0f |
772 | #define SC_BE 0x10 |
773 | #define SC_BK_SYS 0x11 |
774 | #define SC_BK 0x12 |
775 | #define SC_RD 0x13 |
776 | #define SC_OAM 0x14 |
777 | #define SC_AV 0x15 |
778 | #define SC_RV 0x16 |
779 | #define SC_VI 0x17 |
780 | #define SC_SIG 0x17 |
781 | #define SC_VO 0x18 |
782 | #define SC_CTL 0x19 |
783 | |
784 | /* diffserve code points */ |
785 | #define DSCP_MASK 0xfc |
786 | #define DSCP_CUMASK 0x03 |
787 | #define DSCP_EF 0xb8 |
788 | #define DSCP_AF11 0x28 |
789 | #define DSCP_AF12 0x30 |
790 | #define DSCP_AF13 0x38 |
791 | #define DSCP_AF21 0x48 |
792 | #define DSCP_AF22 0x50 |
793 | #define DSCP_AF23 0x58 |
794 | #define DSCP_AF31 0x68 |
795 | #define DSCP_AF32 0x70 |
796 | #define DSCP_AF33 0x78 |
797 | #define DSCP_AF41 0x88 |
798 | #define DSCP_AF42 0x90 |
799 | #define DSCP_AF43 0x98 |
800 | #define AF_CLASSMASK 0xe0 |
801 | #define AF_DROPPRECMASK 0x18 |
802 | u_int8_t tos; |
803 | u_int8_t anchor_relative; |
804 | u_int8_t anchor_wildcard; |
805 | |
806 | #define PF_FLUSH 0x01 |
807 | #define PF_FLUSH_GLOBAL 0x02 |
808 | u_int8_t flush; |
809 | |
810 | u_int8_t proto_variant; |
811 | u_int8_t extfilter; /* Filter mode [PF_EXTFILTER_xxx] */ |
812 | u_int8_t extmap; /* Mapping mode [PF_EXTMAP_xxx] */ |
813 | u_int32_t dnpipe; |
814 | u_int32_t dntype; |
815 | }; |
816 | |
817 | /* pf device identifiers */ |
818 | #define PFDEV_PF 0 |
819 | #define PFDEV_PFM 1 |
820 | #define PFDEV_MAX 2 |
821 | |
822 | /* rule flags */ |
823 | #define PFRULE_DROP 0x0000 |
824 | #define PFRULE_RETURNRST 0x0001 |
825 | #define PFRULE_FRAGMENT 0x0002 |
826 | #define PFRULE_RETURNICMP 0x0004 |
827 | #define PFRULE_RETURN 0x0008 |
828 | #define PFRULE_NOSYNC 0x0010 |
829 | #define PFRULE_SRCTRACK 0x0020 /* track source states */ |
830 | #define PFRULE_RULESRCTRACK 0x0040 /* per rule */ |
831 | |
832 | /* scrub flags */ |
833 | #define PFRULE_NODF 0x0100 |
834 | #define PFRULE_FRAGCROP 0x0200 /* non-buffering frag cache */ |
835 | #define PFRULE_FRAGDROP 0x0400 /* drop funny fragments */ |
836 | #define PFRULE_RANDOMID 0x0800 |
837 | #define PFRULE_REASSEMBLE_TCP 0x1000 |
838 | |
839 | /* rule flags for TOS/DSCP/service class differentiation */ |
840 | #define PFRULE_TOS 0x2000 |
841 | #define PFRULE_DSCP 0x4000 |
842 | #define PFRULE_SC 0x8000 |
843 | |
844 | /* rule flags again */ |
845 | #define PFRULE_IFBOUND 0x00010000 /* if-bound */ |
846 | #define PFRULE_PFM 0x00020000 /* created by pfm device */ |
847 | |
848 | #define PFSTATE_HIWAT 10000 /* default state table size */ |
849 | #define PFSTATE_ADAPT_START 6000 /* default adaptive timeout start */ |
850 | #define PFSTATE_ADAPT_END 12000 /* default adaptive timeout end */ |
851 | |
852 | #define PFAPPSTATE_HIWAT 10000 /* default same as state table */ |
853 | |
854 | /* PF reserved special purpose tags */ |
855 | #define PF_TAG_NAME_SYSTEM_SERVICE "com.apple.pf.system_service_tag" |
856 | #define PF_TAG_NAME_STACK_DROP "com.apple.pf.stack_drop_tag" |
857 | |
858 | enum pf_extmap { |
859 | PF_EXTMAP_APD = 1, /* Address-port-dependent mapping */ |
860 | PF_EXTMAP_AD, /* Address-dependent mapping */ |
861 | PF_EXTMAP_EI /* Endpoint-independent mapping */ |
862 | }; |
863 | |
864 | enum pf_extfilter { |
865 | PF_EXTFILTER_APD = 1, /* Address-port-dependent filtering */ |
866 | PF_EXTFILTER_AD, /* Address-dependent filtering */ |
867 | PF_EXTFILTER_EI /* Endpoint-independent filtering */ |
868 | }; |
869 | |
870 | struct pf_threshold { |
871 | u_int32_t limit; |
872 | #define PF_THRESHOLD_MULT 1000 |
873 | #define PF_THRESHOLD_MAX 0xffffffff / PF_THRESHOLD_MULT |
874 | u_int32_t seconds; |
875 | u_int32_t count; |
876 | u_int32_t last; |
877 | }; |
878 | |
879 | struct pf_src_node { |
880 | RB_ENTRY(pf_src_node) entry; |
881 | struct pf_addr addr; |
882 | struct pf_addr raddr; |
883 | union pf_rule_ptr rule; |
884 | #ifdef KERNEL |
885 | struct pfi_kif *kif; |
886 | #else /* !KERNEL */ |
887 | void *kif; |
888 | #endif /* !KERNEL */ |
889 | u_int64_t bytes[2]; |
890 | u_int64_t packets[2]; |
891 | u_int32_t states; |
892 | u_int32_t conn; |
893 | struct pf_threshold conn_rate; |
894 | u_int64_t creation; |
895 | u_int64_t expire; |
896 | sa_family_t af; |
897 | u_int8_t ruletype; |
898 | }; |
899 | |
900 | #define PFSNODE_HIWAT 10000 /* default source node table size */ |
901 | |
902 | #ifdef KERNEL |
903 | struct pf_state_scrub { |
904 | struct timeval pfss_last; /* time received last packet */ |
905 | u_int32_t pfss_tsecr; /* last echoed timestamp */ |
906 | u_int32_t pfss_tsval; /* largest timestamp */ |
907 | u_int32_t pfss_tsval0; /* original timestamp */ |
908 | u_int16_t pfss_flags; |
909 | #define PFSS_TIMESTAMP 0x0001 /* modulate timestamp */ |
910 | #define PFSS_PAWS 0x0010 /* stricter PAWS checks */ |
911 | #define PFSS_PAWS_IDLED 0x0020 /* was idle too long. no PAWS */ |
912 | #define PFSS_DATA_TS 0x0040 /* timestamp on data packets */ |
913 | #define PFSS_DATA_NOTS 0x0080 /* no timestamp on data packets */ |
914 | u_int8_t pfss_ttl; /* stashed TTL */ |
915 | u_int8_t pad; |
916 | u_int32_t pfss_ts_mod; /* timestamp modulation */ |
917 | }; |
918 | #endif /* KERNEL */ |
919 | |
920 | union pf_state_xport { |
921 | u_int16_t port; |
922 | u_int16_t call_id; |
923 | u_int32_t spi; |
924 | }; |
925 | |
926 | struct pf_state_host { |
927 | struct pf_addr addr; |
928 | union pf_state_xport xport; |
929 | }; |
930 | |
931 | #ifdef KERNEL |
932 | struct pf_state_peer { |
933 | u_int32_t seqlo; /* Max sequence number sent */ |
934 | u_int32_t seqhi; /* Max the other end ACKd + win */ |
935 | u_int32_t seqdiff; /* Sequence number modulator */ |
936 | u_int16_t max_win; /* largest window (pre scaling) */ |
937 | u_int8_t state; /* active state level */ |
938 | u_int8_t wscale; /* window scaling factor */ |
939 | u_int16_t mss; /* Maximum segment size option */ |
940 | u_int8_t tcp_est; /* Did we reach TCPS_ESTABLISHED */ |
941 | struct pf_state_scrub *scrub; /* state is scrubbed */ |
942 | u_int8_t pad[3]; |
943 | }; |
944 | |
945 | TAILQ_HEAD(pf_state_queue, pf_state); |
946 | |
947 | struct pf_state; |
948 | struct pf_pdesc; |
949 | struct pf_app_state; |
950 | |
951 | typedef void (*pf_app_handler)(struct pf_state *, int, int, struct pf_pdesc *, |
952 | struct pfi_kif *); |
953 | |
954 | typedef int (*pf_app_compare)(struct pf_app_state *, struct pf_app_state *); |
955 | |
956 | struct pf_pptp_state { |
957 | struct pf_state *grev1_state; |
958 | }; |
959 | |
960 | struct pf_grev1_state { |
961 | struct pf_state *pptp_state; |
962 | }; |
963 | |
964 | struct pf_ike_state { |
965 | u_int64_t cookie; |
966 | }; |
967 | |
968 | struct pf_app_state { |
969 | pf_app_handler handler; |
970 | pf_app_compare compare_lan_ext; |
971 | pf_app_compare compare_ext_gwy; |
972 | union { |
973 | struct pf_pptp_state pptp; |
974 | struct pf_grev1_state grev1; |
975 | struct pf_ike_state ike; |
976 | } u; |
977 | }; |
978 | |
979 | /* keep synced with struct pf_state, used in RB_FIND */ |
980 | struct pf_state_key_cmp { |
981 | struct pf_state_host lan; |
982 | struct pf_state_host gwy; |
983 | struct pf_state_host ext_lan; |
984 | struct pf_state_host ext_gwy; |
985 | sa_family_t af_lan; |
986 | sa_family_t af_gwy; |
987 | u_int8_t proto; |
988 | u_int8_t direction; |
989 | u_int8_t proto_variant; |
990 | struct pf_app_state *app_state; |
991 | }; |
992 | |
993 | TAILQ_HEAD(pf_statelist, pf_state); |
994 | |
995 | struct pf_state_key { |
996 | struct pf_state_host lan; |
997 | struct pf_state_host gwy; |
998 | struct pf_state_host ext_lan; |
999 | struct pf_state_host ext_gwy; |
1000 | sa_family_t af_lan; |
1001 | sa_family_t af_gwy; |
1002 | u_int8_t proto; |
1003 | u_int8_t direction; |
1004 | u_int8_t proto_variant; |
1005 | struct pf_app_state *app_state; |
1006 | u_int32_t flowsrc; |
1007 | u_int32_t flowhash; |
1008 | |
1009 | RB_ENTRY(pf_state_key) entry_lan_ext; |
1010 | RB_ENTRY(pf_state_key) entry_ext_gwy; |
1011 | struct pf_statelist states; |
1012 | u_int32_t refcnt; |
1013 | }; |
1014 | |
1015 | |
1016 | /* keep synced with struct pf_state, used in RB_FIND */ |
1017 | struct pf_state_cmp { |
1018 | u_int64_t id; |
1019 | u_int32_t creatorid; |
1020 | u_int32_t pad; |
1021 | }; |
1022 | |
1023 | /* flowhash key (12-bytes multiple for performance) */ |
1024 | struct pf_flowhash_key { |
1025 | struct pf_state_host ap1; /* address+port blob 1 */ |
1026 | struct pf_state_host ap2; /* address+port blob 2 */ |
1027 | u_int32_t af; |
1028 | u_int32_t proto; |
1029 | }; |
1030 | #endif /* KERNEL */ |
1031 | |
1032 | struct hook_desc; |
1033 | TAILQ_HEAD(hook_desc_head, hook_desc); |
1034 | |
1035 | #ifdef KERNEL |
1036 | struct pf_state { |
1037 | u_int64_t id; |
1038 | u_int32_t creatorid; |
1039 | u_int32_t pad; |
1040 | |
1041 | TAILQ_ENTRY(pf_state) entry_list; |
1042 | TAILQ_ENTRY(pf_state) next; |
1043 | RB_ENTRY(pf_state) entry_id; |
1044 | struct pf_state_peer src; |
1045 | struct pf_state_peer dst; |
1046 | union pf_rule_ptr rule; |
1047 | union pf_rule_ptr anchor; |
1048 | union pf_rule_ptr nat_rule; |
1049 | struct pf_addr rt_addr; |
1050 | struct hook_desc_head unlink_hooks; |
1051 | struct pf_state_key *state_key; |
1052 | struct pfi_kif *kif; |
1053 | struct pfi_kif *rt_kif; |
1054 | struct pf_src_node *src_node; |
1055 | struct pf_src_node *nat_src_node; |
1056 | u_int64_t packets[2]; |
1057 | u_int64_t bytes[2]; |
1058 | u_int64_t creation; |
1059 | u_int64_t expire; |
1060 | u_int64_t pfsync_time; |
1061 | u_int16_t tag; |
1062 | u_int8_t log; |
1063 | u_int8_t allow_opts; |
1064 | u_int8_t timeout; |
1065 | u_int8_t sync_flags; |
1066 | #if SKYWALK |
1067 | netns_token nstoken; |
1068 | #endif |
1069 | }; |
1070 | #endif /* KERNEL */ |
1071 | |
1072 | #define PFSTATE_NOSYNC 0x01 |
1073 | #define PFSTATE_FROMSYNC 0x02 |
1074 | #define PFSTATE_STALE 0x04 |
1075 | |
1076 | #define __packed __attribute__((__packed__)) |
1077 | |
1078 | /* |
1079 | * Unified state structures for pulling states out of the kernel |
1080 | * used by pfsync(4) and the pf(4) ioctl. |
1081 | */ |
1082 | struct pfsync_state_scrub { |
1083 | u_int16_t pfss_flags; |
1084 | u_int8_t pfss_ttl; /* stashed TTL */ |
1085 | #define PFSYNC_SCRUB_FLAG_VALID 0x01 |
1086 | u_int8_t scrub_flag; |
1087 | u_int32_t pfss_ts_mod; /* timestamp modulation */ |
1088 | } __packed; |
1089 | |
1090 | struct pfsync_state_host { |
1091 | struct pf_addr addr; |
1092 | union pf_state_xport xport; |
1093 | u_int16_t pad[2]; |
1094 | } __packed; |
1095 | |
1096 | struct pfsync_state_peer { |
1097 | struct pfsync_state_scrub scrub; /* state is scrubbed */ |
1098 | u_int32_t seqlo; /* Max sequence number sent */ |
1099 | u_int32_t seqhi; /* Max the other end ACKd + win */ |
1100 | u_int32_t seqdiff; /* Sequence number modulator */ |
1101 | u_int16_t max_win; /* largest window (pre scaling) */ |
1102 | u_int16_t mss; /* Maximum segment size option */ |
1103 | u_int8_t state; /* active state level */ |
1104 | u_int8_t wscale; /* window scaling factor */ |
1105 | u_int8_t pad[6]; |
1106 | } __packed; |
1107 | |
1108 | struct pfsync_state { |
1109 | u_int32_t id[2]; |
1110 | char ifname[IFNAMSIZ]; |
1111 | struct pfsync_state_host lan; |
1112 | struct pfsync_state_host gwy; |
1113 | struct pfsync_state_host ext_lan; |
1114 | struct pfsync_state_host ext_gwy; |
1115 | struct pfsync_state_peer src; |
1116 | struct pfsync_state_peer dst; |
1117 | struct pf_addr rt_addr; |
1118 | struct hook_desc_head unlink_hooks; |
1119 | #if !defined(__LP64__) |
1120 | u_int32_t _pad[2]; |
1121 | #endif /* !__LP64__ */ |
1122 | u_int32_t rule; |
1123 | u_int32_t anchor; |
1124 | u_int32_t nat_rule; |
1125 | u_int64_t creation; |
1126 | u_int64_t expire; |
1127 | u_int32_t packets[2][2]; |
1128 | u_int32_t bytes[2][2]; |
1129 | u_int32_t creatorid; |
1130 | u_int16_t tag; |
1131 | sa_family_t af_lan; |
1132 | sa_family_t af_gwy; |
1133 | u_int8_t proto; |
1134 | u_int8_t direction; |
1135 | u_int8_t log; |
1136 | u_int8_t allow_opts; |
1137 | u_int8_t timeout; |
1138 | u_int8_t sync_flags; |
1139 | u_int8_t updates; |
1140 | u_int8_t proto_variant; |
1141 | u_int8_t __pad; |
1142 | u_int32_t flowhash; |
1143 | } __packed; |
1144 | |
1145 | #define PFSYNC_FLAG_COMPRESS 0x01 |
1146 | #define PFSYNC_FLAG_STALE 0x02 |
1147 | #define PFSYNC_FLAG_SRCNODE 0x04 |
1148 | #define PFSYNC_FLAG_NATSRCNODE 0x08 |
1149 | |
1150 | #ifdef KERNEL |
1151 | /* for copies to/from userland via pf_ioctl() */ |
1152 | #define pf_state_peer_to_pfsync(s, d) do { \ |
1153 | (d)->seqlo = (s)->seqlo; \ |
1154 | (d)->seqhi = (s)->seqhi; \ |
1155 | (d)->seqdiff = (s)->seqdiff; \ |
1156 | (d)->max_win = (s)->max_win; \ |
1157 | (d)->mss = (s)->mss; \ |
1158 | (d)->state = (s)->state; \ |
1159 | (d)->wscale = (s)->wscale; \ |
1160 | if ((s)->scrub) { \ |
1161 | (d)->scrub.pfss_flags = \ |
1162 | (s)->scrub->pfss_flags & PFSS_TIMESTAMP; \ |
1163 | (d)->scrub.pfss_ttl = (s)->scrub->pfss_ttl; \ |
1164 | (d)->scrub.pfss_ts_mod = (s)->scrub->pfss_ts_mod; \ |
1165 | (d)->scrub.scrub_flag = PFSYNC_SCRUB_FLAG_VALID; \ |
1166 | } \ |
1167 | } while (0) |
1168 | |
1169 | #define pf_state_peer_from_pfsync(s, d) do { \ |
1170 | (d)->seqlo = (s)->seqlo; \ |
1171 | (d)->seqhi = (s)->seqhi; \ |
1172 | (d)->seqdiff = (s)->seqdiff; \ |
1173 | (d)->max_win = (s)->max_win; \ |
1174 | (d)->mss = ntohs((s)->mss); \ |
1175 | (d)->state = (s)->state; \ |
1176 | (d)->wscale = (s)->wscale; \ |
1177 | if ((s)->scrub.scrub_flag == PFSYNC_SCRUB_FLAG_VALID && \ |
1178 | (d)->scrub != NULL) { \ |
1179 | (d)->scrub->pfss_flags = \ |
1180 | ntohs((s)->scrub.pfss_flags) & PFSS_TIMESTAMP; \ |
1181 | (d)->scrub->pfss_ttl = (s)->scrub.pfss_ttl; \ |
1182 | (d)->scrub->pfss_ts_mod = (s)->scrub.pfss_ts_mod; \ |
1183 | } \ |
1184 | } while (0) |
1185 | #endif /* KERNEL */ |
1186 | |
1187 | #define pf_state_counter_to_pfsync(s, d) do { \ |
1188 | d[0] = (s>>32)&0xffffffff; \ |
1189 | d[1] = s&0xffffffff; \ |
1190 | } while (0) |
1191 | |
1192 | #define pf_state_counter_from_pfsync(s) \ |
1193 | (((u_int64_t)(s[0])<<32) | (u_int64_t)(s[1])) |
1194 | |
1195 | |
1196 | |
1197 | TAILQ_HEAD(pf_rulequeue, pf_rule); |
1198 | |
1199 | struct pf_anchor; |
1200 | |
1201 | struct pf_ruleset { |
1202 | struct { |
1203 | struct pf_rulequeue queues[2]; |
1204 | struct { |
1205 | struct pf_rulequeue *ptr; |
1206 | struct pf_rule **ptr_array; |
1207 | u_int32_t rcount; |
1208 | u_int32_t rsize; |
1209 | u_int32_t ticket; |
1210 | int open; |
1211 | } active, inactive; |
1212 | } rules[PF_RULESET_MAX]; |
1213 | struct pf_anchor *anchor; |
1214 | u_int32_t tticket; |
1215 | int tables; |
1216 | int topen; |
1217 | }; |
1218 | |
1219 | RB_HEAD(pf_anchor_global, pf_anchor); |
1220 | RB_HEAD(pf_anchor_node, pf_anchor); |
1221 | struct pf_anchor { |
1222 | RB_ENTRY(pf_anchor) entry_global; |
1223 | RB_ENTRY(pf_anchor) entry_node; |
1224 | struct pf_anchor *parent; |
1225 | struct pf_anchor_node children; |
1226 | char name[PF_ANCHOR_NAME_SIZE]; |
1227 | char path[MAXPATHLEN]; |
1228 | struct pf_ruleset ruleset; |
1229 | int refcnt; /* anchor rules */ |
1230 | int match; |
1231 | char owner[PF_OWNER_NAME_SIZE]; |
1232 | }; |
1233 | #ifdef KERNEL |
1234 | RB_PROTOTYPE_SC(__private_extern__, pf_anchor_global, pf_anchor, entry_global, |
1235 | pf_anchor_compare); |
1236 | RB_PROTOTYPE_SC(__private_extern__, pf_anchor_node, pf_anchor, entry_node, |
1237 | pf_anchor_compare); |
1238 | #else /* !KERNEL */ |
1239 | RB_PROTOTYPE(pf_anchor_global, pf_anchor, entry_global, pf_anchor_compare); |
1240 | RB_PROTOTYPE(pf_anchor_node, pf_anchor, entry_node, pf_anchor_compare); |
1241 | #endif /* !KERNEL */ |
1242 | |
1243 | #define PF_RESERVED_ANCHOR "_pf" |
1244 | |
1245 | #define PFR_TFLAG_PERSIST 0x00000001 |
1246 | #define PFR_TFLAG_CONST 0x00000002 |
1247 | #define PFR_TFLAG_ACTIVE 0x00000004 |
1248 | #define PFR_TFLAG_INACTIVE 0x00000008 |
1249 | #define PFR_TFLAG_REFERENCED 0x00000010 |
1250 | #define PFR_TFLAG_REFDANCHOR 0x00000020 |
1251 | #define PFR_TFLAG_USRMASK 0x00000003 |
1252 | #define PFR_TFLAG_SETMASK 0x0000003C |
1253 | #define PFR_TFLAG_ALLMASK 0x0000003F |
1254 | |
1255 | struct pfr_table { |
1256 | char pfrt_anchor[MAXPATHLEN]; |
1257 | char pfrt_name[PF_TABLE_NAME_SIZE]; |
1258 | uint32_t pfrt_flags; |
1259 | uint8_t pfrt_fback; |
1260 | }; |
1261 | |
1262 | enum { PFR_FB_NONE, PFR_FB_MATCH, PFR_FB_ADDED, PFR_FB_DELETED, |
1263 | PFR_FB_CHANGED, PFR_FB_CLEARED, PFR_FB_DUPLICATE, |
1264 | PFR_FB_NOTMATCH, PFR_FB_CONFLICT, PFR_FB_MAX }; |
1265 | |
1266 | struct pfr_addr { |
1267 | union { |
1268 | struct in_addr _pfra_ip4addr; |
1269 | struct in6_addr _pfra_ip6addr; |
1270 | } pfra_u; |
1271 | uint8_t pfra_af; |
1272 | uint8_t pfra_net; |
1273 | uint8_t pfra_not; |
1274 | uint8_t pfra_fback; |
1275 | }; |
1276 | #define pfra_ip4addr pfra_u._pfra_ip4addr |
1277 | #define pfra_ip6addr pfra_u._pfra_ip6addr |
1278 | |
1279 | enum { PFR_DIR_IN, PFR_DIR_OUT, PFR_DIR_MAX }; |
1280 | enum { PFR_OP_BLOCK, PFR_OP_PASS, PFR_OP_ADDR_MAX, PFR_OP_TABLE_MAX }; |
1281 | #define PFR_OP_XPASS PFR_OP_ADDR_MAX |
1282 | |
1283 | struct pfr_astats { |
1284 | struct pfr_addr pfras_a; |
1285 | #if !defined(__LP64__) |
1286 | uint32_t _pad; |
1287 | #endif /* !__LP64__ */ |
1288 | uint64_t pfras_packets[PFR_DIR_MAX][PFR_OP_ADDR_MAX]; |
1289 | uint64_t pfras_bytes[PFR_DIR_MAX][PFR_OP_ADDR_MAX]; |
1290 | uint64_t pfras_tzero; |
1291 | }; |
1292 | |
1293 | enum { PFR_REFCNT_RULE, PFR_REFCNT_ANCHOR, PFR_REFCNT_MAX }; |
1294 | |
1295 | struct pfr_tstats { |
1296 | struct pfr_table pfrts_t; |
1297 | u_int64_t pfrts_packets[PFR_DIR_MAX][PFR_OP_TABLE_MAX]; |
1298 | u_int64_t pfrts_bytes[PFR_DIR_MAX][PFR_OP_TABLE_MAX]; |
1299 | u_int64_t pfrts_match; |
1300 | u_int64_t pfrts_nomatch; |
1301 | u_int64_t pfrts_tzero; |
1302 | int pfrts_cnt; |
1303 | int pfrts_refcnt[PFR_REFCNT_MAX]; |
1304 | #if !defined(__LP64__) |
1305 | u_int32_t _pad; |
1306 | #endif /* !__LP64__ */ |
1307 | }; |
1308 | #define pfrts_name pfrts_t.pfrt_name |
1309 | #define pfrts_flags pfrts_t.pfrt_flags |
1310 | |
1311 | #ifdef KERNEL |
1312 | SLIST_HEAD(pfr_kentryworkq, pfr_kentry); |
1313 | struct pfr_kentry { |
1314 | struct radix_node pfrke_node[2]; |
1315 | union sockaddr_union pfrke_sa; |
1316 | u_int64_t pfrke_packets[PFR_DIR_MAX][PFR_OP_ADDR_MAX]; |
1317 | u_int64_t pfrke_bytes[PFR_DIR_MAX][PFR_OP_ADDR_MAX]; |
1318 | SLIST_ENTRY(pfr_kentry) pfrke_workq; |
1319 | u_int64_t pfrke_tzero; |
1320 | u_int8_t pfrke_af; |
1321 | u_int8_t pfrke_net; |
1322 | u_int8_t pfrke_not; |
1323 | u_int8_t pfrke_mark; |
1324 | u_int8_t pfrke_intrpool; |
1325 | }; |
1326 | |
1327 | SLIST_HEAD(pfr_ktableworkq, pfr_ktable); |
1328 | RB_HEAD(pfr_ktablehead, pfr_ktable); |
1329 | struct pfr_ktable { |
1330 | struct pfr_tstats pfrkt_ts; |
1331 | RB_ENTRY(pfr_ktable) pfrkt_tree; |
1332 | SLIST_ENTRY(pfr_ktable) pfrkt_workq; |
1333 | struct radix_node_head *pfrkt_ip4; |
1334 | struct radix_node_head *pfrkt_ip6; |
1335 | struct pfr_ktable *pfrkt_shadow; |
1336 | struct pfr_ktable *pfrkt_root; |
1337 | struct pf_ruleset *pfrkt_rs; |
1338 | u_int64_t pfrkt_larg; |
1339 | u_int32_t pfrkt_nflags; |
1340 | }; |
1341 | #define pfrkt_t pfrkt_ts.pfrts_t |
1342 | #define pfrkt_name pfrkt_t.pfrt_name |
1343 | #define pfrkt_anchor pfrkt_t.pfrt_anchor |
1344 | #define pfrkt_ruleset pfrkt_t.pfrt_ruleset |
1345 | #define pfrkt_flags pfrkt_t.pfrt_flags |
1346 | #define pfrkt_cnt pfrkt_ts.pfrts_cnt |
1347 | #define pfrkt_refcnt pfrkt_ts.pfrts_refcnt |
1348 | #define pfrkt_packets pfrkt_ts.pfrts_packets |
1349 | #define pfrkt_bytes pfrkt_ts.pfrts_bytes |
1350 | #define pfrkt_match pfrkt_ts.pfrts_match |
1351 | #define pfrkt_nomatch pfrkt_ts.pfrts_nomatch |
1352 | #define pfrkt_tzero pfrkt_ts.pfrts_tzero |
1353 | |
1354 | RB_HEAD(pf_state_tree_lan_ext, pf_state_key); |
1355 | RB_PROTOTYPE_SC(__private_extern__, pf_state_tree_lan_ext, pf_state_key, |
1356 | entry_lan_ext, pf_state_compare_lan_ext); |
1357 | |
1358 | RB_HEAD(pf_state_tree_ext_gwy, pf_state_key); |
1359 | RB_PROTOTYPE_SC(__private_extern__, pf_state_tree_ext_gwy, pf_state_key, |
1360 | entry_ext_gwy, pf_state_compare_ext_gwy); |
1361 | |
1362 | RB_HEAD(pfi_ifhead, pfi_kif); |
1363 | |
1364 | /* state tables */ |
1365 | extern struct pf_state_tree_lan_ext pf_statetbl_lan_ext; |
1366 | extern struct pf_state_tree_ext_gwy pf_statetbl_ext_gwy; |
1367 | |
1368 | struct pfi_kif { |
1369 | char pfik_name[IFNAMSIZ]; |
1370 | RB_ENTRY(pfi_kif) pfik_tree; |
1371 | u_int64_t pfik_packets[2][2][2]; |
1372 | u_int64_t pfik_bytes[2][2][2]; |
1373 | u_int64_t pfik_tzero; |
1374 | int pfik_flags; |
1375 | void *pfik_ah_cookie; |
1376 | struct ifnet *pfik_ifp; |
1377 | int pfik_states; |
1378 | int pfik_rules; |
1379 | TAILQ_HEAD(, pfi_dynaddr) pfik_dynaddrs; |
1380 | }; |
1381 | |
1382 | enum pfi_kif_refs { |
1383 | PFI_KIF_REF_NONE, |
1384 | PFI_KIF_REF_STATE, |
1385 | PFI_KIF_REF_RULE |
1386 | }; |
1387 | |
1388 | struct pfi_uif { |
1389 | #else /* !KERNEL */ |
1390 | struct pfi_kif { |
1391 | #endif /* !KERNEL */ |
1392 | char pfik_name[IFNAMSIZ]; |
1393 | u_int64_t pfik_packets[2][2][2]; |
1394 | u_int64_t pfik_bytes[2][2][2]; |
1395 | u_int64_t pfik_tzero; |
1396 | int pfik_flags; |
1397 | int pfik_states; |
1398 | int pfik_rules; |
1399 | #if !defined(__LP64__) |
1400 | u_int32_t _pad; |
1401 | #endif /* !__LP64__ */ |
1402 | }; |
1403 | |
1404 | #define PFI_IFLAG_SKIP 0x0100 /* skip filtering on interface */ |
1405 | |
1406 | #ifdef KERNEL |
1407 | struct pf_pdesc { |
1408 | struct { |
1409 | int done; |
1410 | uid_t uid; |
1411 | gid_t gid; |
1412 | pid_t pid; |
1413 | } lookup; |
1414 | u_int64_t tot_len; /* Make Mickey money */ |
1415 | union { |
1416 | struct tcphdr *tcp; |
1417 | struct udphdr *udp; |
1418 | struct icmp *icmp; |
1419 | struct icmp6_hdr *icmp6; |
1420 | struct pf_grev1_hdr *grev1; |
1421 | struct pf_esp_hdr *esp; |
1422 | void *any; |
1423 | } hdr; |
1424 | |
1425 | /* XXX TODO: Change baddr and naddr to *saddr */ |
1426 | struct pf_addr baddr; /* src address before translation */ |
1427 | struct pf_addr bdaddr; /* dst address before translation */ |
1428 | struct pf_addr naddr; /* src address after translation */ |
1429 | struct pf_addr ndaddr; /* dst address after translation */ |
1430 | struct pf_rule *nat_rule; /* nat/rdr rule applied to packet */ |
1431 | struct pf_addr *src; |
1432 | struct pf_addr *dst; |
1433 | struct ether_header *eh; |
1434 | pbuf_t *mp; |
1435 | int lmw; /* lazy writable offset */ |
1436 | struct pf_mtag *pf_mtag; |
1437 | u_int16_t *ip_sum; |
1438 | u_int32_t off; /* protocol header offset */ |
1439 | u_int32_t hdrlen; /* protocol header length */ |
1440 | u_int32_t p_len; /* total length of payload */ |
1441 | u_int16_t flags; /* Let SCRUB trigger behavior in */ |
1442 | /* state code. Easier than tags */ |
1443 | #define PFDESC_TCP_NORM 0x0001 /* TCP shall be statefully scrubbed */ |
1444 | #define PFDESC_IP_REAS 0x0002 /* IP frags would've been reassembled */ |
1445 | #define PFDESC_IP_FRAG 0x0004 /* This is a fragment */ |
1446 | sa_family_t af; |
1447 | sa_family_t naf; /* address family after translation */ |
1448 | u_int8_t proto; |
1449 | u_int8_t tos; |
1450 | u_int8_t ttl; |
1451 | u_int8_t proto_variant; |
1452 | mbuf_svc_class_t sc; /* mbuf service class (MBUF_SVC) */ |
1453 | u_int32_t pktflags; /* mbuf packet flags (PKTF) */ |
1454 | u_int32_t flowsrc; /* flow source (FLOWSRC) */ |
1455 | u_int32_t flowhash; /* flow hash to identify the sender */ |
1456 | }; |
1457 | #endif /* KERNEL */ |
1458 | |
1459 | /* flags for RDR options */ |
1460 | #define PF_DPORT_RANGE 0x01 /* Dest port uses range */ |
1461 | #define PF_RPORT_RANGE 0x02 /* RDR'ed port uses range */ |
1462 | |
1463 | /* Reasons code for passing/dropping a packet */ |
1464 | #define PFRES_MATCH 0 /* Explicit match of a rule */ |
1465 | #define PFRES_BADOFF 1 /* Bad offset for pull_hdr */ |
1466 | #define PFRES_FRAG 2 /* Dropping following fragment */ |
1467 | #define PFRES_SHORT 3 /* Dropping short packet */ |
1468 | #define PFRES_NORM 4 /* Dropping by normalizer */ |
1469 | #define PFRES_MEMORY 5 /* Dropped due to lacking mem */ |
1470 | #define PFRES_TS 6 /* Bad TCP Timestamp (RFC1323) */ |
1471 | #define PFRES_CONGEST 7 /* Congestion (of ipintrq) */ |
1472 | #define PFRES_IPOPTIONS 8 /* IP option */ |
1473 | #define PFRES_PROTCKSUM 9 /* Protocol checksum invalid */ |
1474 | #define PFRES_BADSTATE 10 /* State mismatch */ |
1475 | #define PFRES_STATEINS 11 /* State insertion failure */ |
1476 | #define PFRES_MAXSTATES 12 /* State limit */ |
1477 | #define PFRES_SRCLIMIT 13 /* Source node/conn limit */ |
1478 | #define PFRES_SYNPROXY 14 /* SYN proxy */ |
1479 | #define PFRES_DUMMYNET 15 /* Dummynet */ |
1480 | #define PFRES_INVPORT 16 /* Invalid TCP/UDP port */ |
1481 | #define PFRES_MAX 17 /* total+1 */ |
1482 | |
1483 | #define PFRES_NAMES { \ |
1484 | "match", \ |
1485 | "bad-offset", \ |
1486 | "fragment", \ |
1487 | "short", \ |
1488 | "normalize", \ |
1489 | "memory", \ |
1490 | "bad-timestamp", \ |
1491 | "congestion", \ |
1492 | "ip-option", \ |
1493 | "proto-cksum", \ |
1494 | "state-mismatch", \ |
1495 | "state-insert", \ |
1496 | "state-limit", \ |
1497 | "src-limit", \ |
1498 | "synproxy", \ |
1499 | "dummynet", \ |
1500 | "invalid-port", \ |
1501 | NULL \ |
1502 | } |
1503 | |
1504 | /* Counters for other things we want to keep track of */ |
1505 | #define LCNT_STATES 0 /* states */ |
1506 | #define LCNT_SRCSTATES 1 /* max-src-states */ |
1507 | #define LCNT_SRCNODES 2 /* max-src-nodes */ |
1508 | #define LCNT_SRCCONN 3 /* max-src-conn */ |
1509 | #define LCNT_SRCCONNRATE 4 /* max-src-conn-rate */ |
1510 | #define LCNT_OVERLOAD_TABLE 5 /* entry added to overload table */ |
1511 | #define LCNT_OVERLOAD_FLUSH 6 /* state entries flushed */ |
1512 | #define LCNT_MAX 7 /* total+1 */ |
1513 | |
1514 | #define LCNT_NAMES { \ |
1515 | "max states per rule", \ |
1516 | "max-src-states", \ |
1517 | "max-src-nodes", \ |
1518 | "max-src-conn", \ |
1519 | "max-src-conn-rate", \ |
1520 | "overload table insertion", \ |
1521 | "overload flush states", \ |
1522 | NULL \ |
1523 | } |
1524 | |
1525 | /* UDP state enumeration */ |
1526 | #define PFUDPS_NO_TRAFFIC 0 |
1527 | #define PFUDPS_SINGLE 1 |
1528 | #define PFUDPS_MULTIPLE 2 |
1529 | |
1530 | #define PFUDPS_NSTATES 3 /* number of state levels */ |
1531 | |
1532 | #define PFUDPS_NAMES { \ |
1533 | "NO_TRAFFIC", \ |
1534 | "SINGLE", \ |
1535 | "MULTIPLE", \ |
1536 | NULL \ |
1537 | } |
1538 | |
1539 | /* GREv1 protocol state enumeration */ |
1540 | #define PFGRE1S_NO_TRAFFIC 0 |
1541 | #define PFGRE1S_INITIATING 1 |
1542 | #define PFGRE1S_ESTABLISHED 2 |
1543 | |
1544 | #define PFGRE1S_NSTATES 3 /* number of state levels */ |
1545 | |
1546 | #define PFGRE1S_NAMES { \ |
1547 | "NO_TRAFFIC", \ |
1548 | "INITIATING", \ |
1549 | "ESTABLISHED", \ |
1550 | NULL \ |
1551 | } |
1552 | |
1553 | #define PFESPS_NO_TRAFFIC 0 |
1554 | #define PFESPS_INITIATING 1 |
1555 | #define PFESPS_ESTABLISHED 2 |
1556 | |
1557 | #define PFESPS_NSTATES 3 /* number of state levels */ |
1558 | |
1559 | #define PFESPS_NAMES { "NO_TRAFFIC", "INITIATING", "ESTABLISHED", NULL } |
1560 | |
1561 | /* Other protocol state enumeration */ |
1562 | #define PFOTHERS_NO_TRAFFIC 0 |
1563 | #define PFOTHERS_SINGLE 1 |
1564 | #define PFOTHERS_MULTIPLE 2 |
1565 | |
1566 | #define PFOTHERS_NSTATES 3 /* number of state levels */ |
1567 | |
1568 | #define PFOTHERS_NAMES { \ |
1569 | "NO_TRAFFIC", \ |
1570 | "SINGLE", \ |
1571 | "MULTIPLE", \ |
1572 | NULL \ |
1573 | } |
1574 | |
1575 | #define FCNT_STATE_SEARCH 0 |
1576 | #define FCNT_STATE_INSERT 1 |
1577 | #define FCNT_STATE_REMOVALS 2 |
1578 | #define FCNT_MAX 3 |
1579 | |
1580 | #define SCNT_SRC_NODE_SEARCH 0 |
1581 | #define SCNT_SRC_NODE_INSERT 1 |
1582 | #define SCNT_SRC_NODE_REMOVALS 2 |
1583 | #define SCNT_MAX 3 |
1584 | |
1585 | #ifdef KERNEL |
1586 | #define ACTION_SET(a, x) \ |
1587 | do { \ |
1588 | if ((a) != NULL) \ |
1589 | *(a) = (x); \ |
1590 | } while (0) |
1591 | |
1592 | #define REASON_SET(a, x) \ |
1593 | do { \ |
1594 | if ((a) != NULL) \ |
1595 | *(a) = (x); \ |
1596 | if (x < PFRES_MAX) \ |
1597 | pf_status.counters[x]++; \ |
1598 | } while (0) |
1599 | #endif /* KERNEL */ |
1600 | |
1601 | struct pf_status { |
1602 | u_int64_t counters[PFRES_MAX]; |
1603 | u_int64_t lcounters[LCNT_MAX]; /* limit counters */ |
1604 | u_int64_t fcounters[FCNT_MAX]; |
1605 | u_int64_t scounters[SCNT_MAX]; |
1606 | u_int64_t pcounters[2][2][3]; |
1607 | u_int64_t bcounters[2][2]; |
1608 | u_int64_t stateid; |
1609 | u_int32_t running; |
1610 | u_int32_t states; |
1611 | u_int32_t src_nodes; |
1612 | u_int64_t since __attribute__((aligned(8))); |
1613 | u_int32_t debug; |
1614 | u_int32_t hostid; |
1615 | char ifname[IFNAMSIZ]; |
1616 | u_int8_t pf_chksum[PF_MD5_DIGEST_LENGTH]; |
1617 | }; |
1618 | |
1619 | struct cbq_opts { |
1620 | u_int32_t minburst; |
1621 | u_int32_t maxburst; |
1622 | u_int32_t pktsize; |
1623 | u_int32_t maxpktsize; |
1624 | u_int32_t ns_per_byte; |
1625 | u_int32_t maxidle; |
1626 | int32_t minidle; |
1627 | u_int32_t offtime; |
1628 | u_int32_t flags; |
1629 | }; |
1630 | |
1631 | struct priq_opts { |
1632 | u_int32_t flags; |
1633 | }; |
1634 | |
1635 | struct hfsc_opts { |
1636 | /* real-time service curve */ |
1637 | u_int64_t rtsc_m1; /* slope of the 1st segment in bps */ |
1638 | u_int64_t rtsc_d; /* the x-projection of m1 in msec */ |
1639 | u_int64_t rtsc_m2; /* slope of the 2nd segment in bps */ |
1640 | u_int32_t rtsc_fl; /* service curve flags */ |
1641 | #if !defined(__LP64__) |
1642 | u_int32_t _pad; |
1643 | #endif /* !__LP64__ */ |
1644 | /* link-sharing service curve */ |
1645 | u_int64_t lssc_m1; |
1646 | u_int64_t lssc_d; |
1647 | u_int64_t lssc_m2; |
1648 | u_int32_t lssc_fl; |
1649 | #if !defined(__LP64__) |
1650 | u_int32_t __pad; |
1651 | #endif /* !__LP64__ */ |
1652 | /* upper-limit service curve */ |
1653 | u_int64_t ulsc_m1; |
1654 | u_int64_t ulsc_d; |
1655 | u_int64_t ulsc_m2; |
1656 | u_int32_t ulsc_fl; |
1657 | u_int32_t flags; /* scheduler flags */ |
1658 | }; |
1659 | |
1660 | struct fairq_opts { |
1661 | u_int32_t nbuckets; /* hash buckets */ |
1662 | u_int32_t flags; |
1663 | u_int64_t hogs_m1; /* hog detection bandwidth */ |
1664 | |
1665 | /* link-sharing service curve */ |
1666 | u_int64_t lssc_m1; |
1667 | u_int64_t lssc_d; |
1668 | u_int64_t lssc_m2; |
1669 | }; |
1670 | |
1671 | /* bandwidth types */ |
1672 | #define PF_ALTQ_BW_ABSOLUTE 1 /* bw in absolute value (bps) */ |
1673 | #define PF_ALTQ_BW_PERCENT 2 /* bandwidth in percentage */ |
1674 | |
1675 | /* ALTQ rule flags */ |
1676 | #define PF_ALTQF_TBR 0x1 /* enable Token Bucket Regulator */ |
1677 | |
1678 | /* queue rule flags */ |
1679 | #define PF_ALTQ_QRF_WEIGHT 0x1 /* weight instead of priority */ |
1680 | |
1681 | struct pf_altq { |
1682 | char ifname[IFNAMSIZ]; |
1683 | |
1684 | /* discipline-specific state */ |
1685 | void *altq_disc __attribute__((aligned(8))); |
1686 | TAILQ_ENTRY(pf_altq) entries __attribute__((aligned(8))); |
1687 | #if !defined(__LP64__) |
1688 | u_int32_t _pad[2]; |
1689 | #endif /* !__LP64__ */ |
1690 | |
1691 | u_int32_t aflags; /* ALTQ rule flags */ |
1692 | u_int32_t bwtype; /* bandwidth type */ |
1693 | |
1694 | /* scheduler spec */ |
1695 | u_int32_t scheduler; /* scheduler type */ |
1696 | u_int32_t tbrsize; /* tokenbucket regulator size */ |
1697 | u_int64_t ifbandwidth; /* interface bandwidth */ |
1698 | |
1699 | /* queue spec */ |
1700 | char qname[PF_QNAME_SIZE]; /* queue name */ |
1701 | char parent[PF_QNAME_SIZE]; /* parent name */ |
1702 | u_int32_t parent_qid; /* parent queue id */ |
1703 | u_int32_t qrflags; /* queue rule flags */ |
1704 | union { |
1705 | u_int32_t priority; /* priority */ |
1706 | u_int32_t weight; /* weight */ |
1707 | }; |
1708 | u_int32_t qlimit; /* queue size limit */ |
1709 | u_int32_t flags; /* misc flags */ |
1710 | #if !defined(__LP64__) |
1711 | u_int32_t __pad; |
1712 | #endif /* !__LP64__ */ |
1713 | u_int64_t bandwidth; /* queue bandwidth */ |
1714 | union { |
1715 | struct cbq_opts cbq_opts; |
1716 | struct priq_opts priq_opts; |
1717 | struct hfsc_opts hfsc_opts; |
1718 | struct fairq_opts fairq_opts; |
1719 | } pq_u; |
1720 | |
1721 | u_int32_t qid; /* return value */ |
1722 | }; |
1723 | |
1724 | struct pf_tagname { |
1725 | TAILQ_ENTRY(pf_tagname) entries; |
1726 | char name[PF_TAG_NAME_SIZE]; |
1727 | u_int16_t tag; |
1728 | int ref; |
1729 | }; |
1730 | |
1731 | #define PFFRAG_FRENT_HIWAT 5000 /* Number of fragment entries */ |
1732 | #define PFFRAG_FRAG_HIWAT 1000 /* Number of fragmented packets */ |
1733 | #define PFFRAG_FRCENT_HIWAT 50000 /* Number of fragment cache entries */ |
1734 | #define PFFRAG_FRCACHE_HIWAT 10000 /* Number of fragment descriptors */ |
1735 | |
1736 | #define PFR_KTABLE_HIWAT 1000 /* Number of tables */ |
1737 | #define PFR_KENTRY_HIWAT 200000 /* Number of table entries */ |
1738 | #define PFR_KENTRY_HIWAT_SMALL 100000 /* Number of table entries (tiny hosts) */ |
1739 | |
1740 | /* |
1741 | * ioctl parameter structures |
1742 | */ |
1743 | |
1744 | struct pfioc_pooladdr { |
1745 | u_int32_t action; |
1746 | u_int32_t ticket; |
1747 | u_int32_t nr; |
1748 | u_int32_t r_num; |
1749 | u_int8_t r_action; |
1750 | u_int8_t r_last; |
1751 | u_int8_t af; |
1752 | char anchor[MAXPATHLEN]; |
1753 | struct pf_pooladdr addr; |
1754 | }; |
1755 | |
1756 | struct pfioc_rule { |
1757 | u_int32_t action; |
1758 | u_int32_t ticket; |
1759 | u_int32_t pool_ticket; |
1760 | u_int32_t nr; |
1761 | char anchor[MAXPATHLEN]; |
1762 | char anchor_call[MAXPATHLEN]; |
1763 | struct pf_rule rule; |
1764 | }; |
1765 | |
1766 | struct pfioc_natlook { |
1767 | struct pf_addr saddr; |
1768 | struct pf_addr daddr; |
1769 | struct pf_addr rsaddr; |
1770 | struct pf_addr rdaddr; |
1771 | union pf_state_xport sxport; |
1772 | union pf_state_xport dxport; |
1773 | union pf_state_xport rsxport; |
1774 | union pf_state_xport rdxport; |
1775 | sa_family_t af; |
1776 | u_int8_t proto; |
1777 | u_int8_t proto_variant; |
1778 | u_int8_t direction; |
1779 | }; |
1780 | |
1781 | struct pfioc_state { |
1782 | struct pfsync_state state; |
1783 | }; |
1784 | |
1785 | struct pfioc_src_node_kill { |
1786 | /* XXX returns the number of src nodes killed in psnk_af */ |
1787 | sa_family_t psnk_af; |
1788 | struct pf_rule_addr psnk_src; |
1789 | struct pf_rule_addr psnk_dst; |
1790 | }; |
1791 | |
1792 | struct pfioc_state_addr_kill { |
1793 | struct pf_addr_wrap addr; |
1794 | u_int8_t reserved_[3]; |
1795 | u_int8_t neg; |
1796 | union pf_rule_xport xport; |
1797 | }; |
1798 | |
1799 | struct pfioc_state_kill { |
1800 | /* XXX returns the number of states killed in psk_af */ |
1801 | sa_family_t psk_af; |
1802 | u_int8_t psk_proto; |
1803 | u_int8_t psk_proto_variant; |
1804 | u_int8_t _pad; |
1805 | struct pfioc_state_addr_kill psk_src; |
1806 | struct pfioc_state_addr_kill psk_dst; |
1807 | char psk_ifname[IFNAMSIZ]; |
1808 | char psk_ownername[PF_OWNER_NAME_SIZE]; |
1809 | }; |
1810 | |
1811 | struct pfioc_states { |
1812 | int ps_len; |
1813 | union { |
1814 | caddr_t psu_buf; |
1815 | struct pfsync_state *psu_states; |
1816 | } ps_u __attribute__((aligned(8))); |
1817 | #define ps_buf ps_u.psu_buf |
1818 | #define ps_states ps_u.psu_states |
1819 | }; |
1820 | |
1821 | #ifdef KERNEL |
1822 | struct pfioc_states_32 { |
1823 | int ps_len; |
1824 | union { |
1825 | user32_addr_t psu_buf; |
1826 | user32_addr_t psu_states; |
1827 | } ps_u __attribute__((aligned(8))); |
1828 | }; |
1829 | |
1830 | struct pfioc_states_64 { |
1831 | int ps_len; |
1832 | union { |
1833 | user64_addr_t psu_buf; |
1834 | user64_addr_t psu_states; |
1835 | } ps_u __attribute__((aligned(8))); |
1836 | }; |
1837 | #endif /* KERNEL */ |
1838 | |
1839 | #define PFTOK_PROCNAME_LEN 64 |
1840 | #pragma pack(1) |
1841 | struct pfioc_token { |
1842 | u_int64_t token_value; |
1843 | u_int64_t timestamp; |
1844 | pid_t pid; |
1845 | char proc_name[PFTOK_PROCNAME_LEN]; |
1846 | }; |
1847 | #pragma pack() |
1848 | |
1849 | struct pfioc_kernel_token { |
1850 | SLIST_ENTRY(pfioc_kernel_token) next; |
1851 | struct pfioc_token token; |
1852 | }; |
1853 | |
1854 | struct pfioc_remove_token { |
1855 | u_int64_t token_value; |
1856 | u_int64_t refcount; |
1857 | }; |
1858 | |
1859 | struct pfioc_tokens { |
1860 | int size; |
1861 | union { |
1862 | caddr_t pgtu_buf; |
1863 | struct pfioc_token *pgtu_tokens; |
1864 | } pgt_u __attribute__((aligned(8))); |
1865 | #define pgt_buf pgt_u.pgtu_buf |
1866 | #define pgt_tokens pgt_u.pgtu_tokens |
1867 | }; |
1868 | |
1869 | #ifdef KERNEL |
1870 | struct pfioc_tokens_32 { |
1871 | int size; |
1872 | union { |
1873 | user32_addr_t pgtu_buf; |
1874 | user32_addr_t pgtu_tokens; |
1875 | } pgt_u __attribute__((aligned(8))); |
1876 | }; |
1877 | |
1878 | struct pfioc_tokens_64 { |
1879 | int size; |
1880 | union { |
1881 | user64_addr_t pgtu_buf; |
1882 | user64_addr_t pgtu_tokens; |
1883 | } pgt_u __attribute__((aligned(8))); |
1884 | }; |
1885 | #endif /* KERNEL */ |
1886 | |
1887 | |
1888 | struct pfioc_src_nodes { |
1889 | int psn_len; |
1890 | union { |
1891 | caddr_t psu_buf; |
1892 | struct pf_src_node *psu_src_nodes; |
1893 | } psn_u __attribute__((aligned(8))); |
1894 | #define psn_buf psn_u.psu_buf |
1895 | #define psn_src_nodes psn_u.psu_src_nodes |
1896 | }; |
1897 | |
1898 | #ifdef KERNEL |
1899 | struct pfioc_src_nodes_32 { |
1900 | int psn_len; |
1901 | union { |
1902 | user32_addr_t psu_buf; |
1903 | user32_addr_t psu_src_nodes; |
1904 | } psn_u __attribute__((aligned(8))); |
1905 | }; |
1906 | |
1907 | struct pfioc_src_nodes_64 { |
1908 | int psn_len; |
1909 | union { |
1910 | user64_addr_t psu_buf; |
1911 | user64_addr_t psu_src_nodes; |
1912 | } psn_u __attribute__((aligned(8))); |
1913 | }; |
1914 | #endif /* KERNEL */ |
1915 | |
1916 | struct pfioc_if { |
1917 | char ifname[IFNAMSIZ]; |
1918 | }; |
1919 | |
1920 | struct pfioc_tm { |
1921 | int timeout; |
1922 | int seconds; |
1923 | }; |
1924 | |
1925 | struct pfioc_limit { |
1926 | int index; |
1927 | unsigned limit; |
1928 | }; |
1929 | |
1930 | struct pfioc_altq { |
1931 | u_int32_t action; |
1932 | u_int32_t ticket; |
1933 | u_int32_t nr; |
1934 | struct pf_altq altq __attribute__((aligned(8))); |
1935 | }; |
1936 | |
1937 | struct pfioc_qstats { |
1938 | u_int32_t ticket; |
1939 | u_int32_t nr; |
1940 | void *buf __attribute__((aligned(8))); |
1941 | int nbytes __attribute__((aligned(8))); |
1942 | u_int8_t scheduler; |
1943 | }; |
1944 | |
1945 | struct pfioc_ruleset { |
1946 | u_int32_t nr; |
1947 | char path[MAXPATHLEN]; |
1948 | char name[PF_ANCHOR_NAME_SIZE]; |
1949 | }; |
1950 | |
1951 | #define PF_RULESET_ALTQ (PF_RULESET_MAX) |
1952 | #define PF_RULESET_TABLE (PF_RULESET_MAX+1) |
1953 | struct pfioc_trans { |
1954 | int size; /* number of elements */ |
1955 | int esize; /* size of each element in bytes */ |
1956 | struct pfioc_trans_e { |
1957 | int rs_num; |
1958 | char anchor[MAXPATHLEN]; |
1959 | u_int32_t ticket; |
1960 | } *array __attribute__((aligned(8))); |
1961 | }; |
1962 | |
1963 | #ifdef KERNEL |
1964 | struct pfioc_trans_32 { |
1965 | int size; /* number of elements */ |
1966 | int esize; /* size of each element in bytes */ |
1967 | user32_addr_t array __attribute__((aligned(8))); |
1968 | }; |
1969 | |
1970 | struct pfioc_trans_64 { |
1971 | int size; /* number of elements */ |
1972 | int esize; /* size of each element in bytes */ |
1973 | user64_addr_t array __attribute__((aligned(8))); |
1974 | }; |
1975 | #endif /* KERNEL */ |
1976 | |
1977 | |
1978 | #define PFR_FLAG_ATOMIC 0x00000001 |
1979 | #define PFR_FLAG_DUMMY 0x00000002 |
1980 | #define PFR_FLAG_FEEDBACK 0x00000004 |
1981 | #define PFR_FLAG_CLSTATS 0x00000008 |
1982 | #define PFR_FLAG_ADDRSTOO 0x00000010 |
1983 | #define PFR_FLAG_REPLACE 0x00000020 |
1984 | #define PFR_FLAG_ALLRSETS 0x00000040 |
1985 | #define PFR_FLAG_ALLMASK 0x0000007F |
1986 | #ifdef KERNEL |
1987 | #define PFR_FLAG_USERIOCTL 0x10000000 |
1988 | #endif /* KERNEL */ |
1989 | |
1990 | struct pfioc_table { |
1991 | struct pfr_table pfrio_table; |
1992 | void *pfrio_buffer __attribute__((aligned(8))); |
1993 | int pfrio_esize __attribute__((aligned(8))); |
1994 | int pfrio_size; |
1995 | int pfrio_size2; |
1996 | int pfrio_nadd; |
1997 | int pfrio_ndel; |
1998 | int pfrio_nchange; |
1999 | int pfrio_flags; |
2000 | u_int32_t pfrio_ticket; |
2001 | }; |
2002 | #define pfrio_exists pfrio_nadd |
2003 | #define pfrio_nzero pfrio_nadd |
2004 | #define pfrio_nmatch pfrio_nadd |
2005 | #define pfrio_naddr pfrio_size2 |
2006 | #define pfrio_setflag pfrio_size2 |
2007 | #define pfrio_clrflag pfrio_nadd |
2008 | |
2009 | #ifdef KERNEL |
2010 | struct pfioc_table_32 { |
2011 | struct pfr_table pfrio_table; |
2012 | user32_addr_t pfrio_buffer __attribute__((aligned(8))); |
2013 | int pfrio_esize __attribute__((aligned(8))); |
2014 | int pfrio_size; |
2015 | int pfrio_size2; |
2016 | int pfrio_nadd; |
2017 | int pfrio_ndel; |
2018 | int pfrio_nchange; |
2019 | int pfrio_flags; |
2020 | u_int32_t pfrio_ticket; |
2021 | }; |
2022 | |
2023 | struct pfioc_table_64 { |
2024 | struct pfr_table pfrio_table; |
2025 | user64_addr_t pfrio_buffer __attribute__((aligned(8))); |
2026 | int pfrio_esize __attribute__((aligned(8))); |
2027 | int pfrio_size; |
2028 | int pfrio_size2; |
2029 | int pfrio_nadd; |
2030 | int pfrio_ndel; |
2031 | int pfrio_nchange; |
2032 | int pfrio_flags; |
2033 | u_int32_t pfrio_ticket; |
2034 | }; |
2035 | #endif /* KERNEL */ |
2036 | |
2037 | struct pfioc_iface { |
2038 | char pfiio_name[IFNAMSIZ]; |
2039 | void *pfiio_buffer __attribute__((aligned(8))); |
2040 | int pfiio_esize __attribute__((aligned(8))); |
2041 | int pfiio_size; |
2042 | int pfiio_nzero; |
2043 | int pfiio_flags; |
2044 | }; |
2045 | |
2046 | #ifdef KERNEL |
2047 | struct pfioc_iface_32 { |
2048 | char pfiio_name[IFNAMSIZ]; |
2049 | user32_addr_t pfiio_buffer __attribute__((aligned(8))); |
2050 | int pfiio_esize __attribute__((aligned(8))); |
2051 | int pfiio_size; |
2052 | int pfiio_nzero; |
2053 | int pfiio_flags; |
2054 | }; |
2055 | |
2056 | struct pfioc_iface_64 { |
2057 | char pfiio_name[IFNAMSIZ]; |
2058 | user64_addr_t pfiio_buffer __attribute__((aligned(8))); |
2059 | int pfiio_esize __attribute__((aligned(8))); |
2060 | int pfiio_size; |
2061 | int pfiio_nzero; |
2062 | int pfiio_flags; |
2063 | }; |
2064 | #endif /* KERNEL */ |
2065 | |
2066 | struct pf_ifspeed { |
2067 | char ifname[IFNAMSIZ]; |
2068 | u_int64_t baudrate; |
2069 | }; |
2070 | |
2071 | /* |
2072 | * ioctl operations |
2073 | */ |
2074 | |
2075 | #define DIOCSTART _IO ('D', 1) |
2076 | #define DIOCSTOP _IO ('D', 2) |
2077 | #define DIOCADDRULE _IOWR('D', 4, struct pfioc_rule) |
2078 | #define DIOCGETSTARTERS _IOWR('D', 5, struct pfioc_tokens) |
2079 | #define DIOCGETRULES _IOWR('D', 6, struct pfioc_rule) |
2080 | #define DIOCGETRULE _IOWR('D', 7, struct pfioc_rule) |
2081 | #define DIOCSTARTREF _IOR ('D', 8, u_int64_t) |
2082 | #define DIOCSTOPREF _IOWR('D', 9, struct pfioc_remove_token) |
2083 | /* XXX cut 10 - 17 */ |
2084 | #define DIOCCLRSTATES _IOWR('D', 18, struct pfioc_state_kill) |
2085 | #define DIOCGETSTATE _IOWR('D', 19, struct pfioc_state) |
2086 | #define DIOCSETSTATUSIF _IOWR('D', 20, struct pfioc_if) |
2087 | #define DIOCGETSTATUS _IOWR('D', 21, struct pf_status) |
2088 | #define DIOCCLRSTATUS _IO ('D', 22) |
2089 | #define DIOCNATLOOK _IOWR('D', 23, struct pfioc_natlook) |
2090 | #define DIOCSETDEBUG _IOWR('D', 24, u_int32_t) |
2091 | #define DIOCGETSTATES _IOWR('D', 25, struct pfioc_states) |
2092 | #define DIOCCHANGERULE _IOWR('D', 26, struct pfioc_rule) |
2093 | #define DIOCINSERTRULE _IOWR('D', 27, struct pfioc_rule) |
2094 | #define DIOCDELETERULE _IOWR('D', 28, struct pfioc_rule) |
2095 | #define DIOCSETTIMEOUT _IOWR('D', 29, struct pfioc_tm) |
2096 | #define DIOCGETTIMEOUT _IOWR('D', 30, struct pfioc_tm) |
2097 | #define DIOCADDSTATE _IOWR('D', 37, struct pfioc_state) |
2098 | #define DIOCCLRRULECTRS _IO ('D', 38) |
2099 | #define DIOCGETLIMIT _IOWR('D', 39, struct pfioc_limit) |
2100 | #define DIOCSETLIMIT _IOWR('D', 40, struct pfioc_limit) |
2101 | #define DIOCKILLSTATES _IOWR('D', 41, struct pfioc_state_kill) |
2102 | #define DIOCSTARTALTQ _IO ('D', 42) |
2103 | #define DIOCSTOPALTQ _IO ('D', 43) |
2104 | #define DIOCADDALTQ _IOWR('D', 45, struct pfioc_altq) |
2105 | #define DIOCGETALTQS _IOWR('D', 47, struct pfioc_altq) |
2106 | #define DIOCGETALTQ _IOWR('D', 48, struct pfioc_altq) |
2107 | #define DIOCCHANGEALTQ _IOWR('D', 49, struct pfioc_altq) |
2108 | #define DIOCGETQSTATS _IOWR('D', 50, struct pfioc_qstats) |
2109 | #define DIOCBEGINADDRS _IOWR('D', 51, struct pfioc_pooladdr) |
2110 | #define DIOCADDADDR _IOWR('D', 52, struct pfioc_pooladdr) |
2111 | #define DIOCGETADDRS _IOWR('D', 53, struct pfioc_pooladdr) |
2112 | #define DIOCGETADDR _IOWR('D', 54, struct pfioc_pooladdr) |
2113 | #define DIOCCHANGEADDR _IOWR('D', 55, struct pfioc_pooladdr) |
2114 | /* XXX cut 55 - 57 */ |
2115 | #define DIOCGETRULESETS _IOWR('D', 58, struct pfioc_ruleset) |
2116 | #define DIOCGETRULESET _IOWR('D', 59, struct pfioc_ruleset) |
2117 | #define DIOCRCLRTABLES _IOWR('D', 60, struct pfioc_table) |
2118 | #define DIOCRADDTABLES _IOWR('D', 61, struct pfioc_table) |
2119 | #define DIOCRDELTABLES _IOWR('D', 62, struct pfioc_table) |
2120 | #define DIOCRGETTABLES _IOWR('D', 63, struct pfioc_table) |
2121 | #define DIOCRGETTSTATS _IOWR('D', 64, struct pfioc_table) |
2122 | #define DIOCRCLRTSTATS _IOWR('D', 65, struct pfioc_table) |
2123 | #define DIOCRCLRADDRS _IOWR('D', 66, struct pfioc_table) |
2124 | #define DIOCRADDADDRS _IOWR('D', 67, struct pfioc_table) |
2125 | #define DIOCRDELADDRS _IOWR('D', 68, struct pfioc_table) |
2126 | #define DIOCRSETADDRS _IOWR('D', 69, struct pfioc_table) |
2127 | #define DIOCRGETADDRS _IOWR('D', 70, struct pfioc_table) |
2128 | #define DIOCRGETASTATS _IOWR('D', 71, struct pfioc_table) |
2129 | #define DIOCRCLRASTATS _IOWR('D', 72, struct pfioc_table) |
2130 | #define DIOCRTSTADDRS _IOWR('D', 73, struct pfioc_table) |
2131 | #define DIOCRSETTFLAGS _IOWR('D', 74, struct pfioc_table) |
2132 | #define DIOCRINADEFINE _IOWR('D', 77, struct pfioc_table) |
2133 | #define DIOCOSFPFLUSH _IO('D', 78) |
2134 | #define DIOCOSFPADD _IOWR('D', 79, struct pf_osfp_ioctl) |
2135 | #define DIOCOSFPGET _IOWR('D', 80, struct pf_osfp_ioctl) |
2136 | #define DIOCXBEGIN _IOWR('D', 81, struct pfioc_trans) |
2137 | #define DIOCXCOMMIT _IOWR('D', 82, struct pfioc_trans) |
2138 | #define DIOCXROLLBACK _IOWR('D', 83, struct pfioc_trans) |
2139 | #define DIOCGETSRCNODES _IOWR('D', 84, struct pfioc_src_nodes) |
2140 | #define DIOCCLRSRCNODES _IO('D', 85) |
2141 | #define DIOCSETHOSTID _IOWR('D', 86, u_int32_t) |
2142 | #define DIOCIGETIFACES _IOWR('D', 87, struct pfioc_iface) |
2143 | #define DIOCSETIFFLAG _IOWR('D', 89, struct pfioc_iface) |
2144 | #define DIOCCLRIFFLAG _IOWR('D', 90, struct pfioc_iface) |
2145 | #define DIOCKILLSRCNODES _IOWR('D', 91, struct pfioc_src_node_kill) |
2146 | #define DIOCGIFSPEED _IOWR('D', 92, struct pf_ifspeed) |
2147 | |
2148 | #ifdef KERNEL |
2149 | RB_HEAD(pf_src_tree, pf_src_node); |
2150 | RB_PROTOTYPE_SC(__private_extern__, pf_src_tree, pf_src_node, entry, |
2151 | pf_src_compare); |
2152 | extern struct pf_src_tree tree_src_tracking; |
2153 | |
2154 | RB_HEAD(pf_state_tree_id, pf_state); |
2155 | RB_PROTOTYPE_SC(__private_extern__, pf_state_tree_id, pf_state, |
2156 | entry_id, pf_state_compare_id); |
2157 | extern struct pf_state_tree_id tree_id; |
2158 | extern struct pf_state_queue state_list; |
2159 | |
2160 | TAILQ_HEAD(pf_poolqueue, pf_pool); |
2161 | extern struct pf_poolqueue pf_pools[2]; |
2162 | extern struct pf_palist pf_pabuf; |
2163 | extern u_int32_t ticket_pabuf; |
2164 | extern struct pf_poolqueue *pf_pools_active; |
2165 | extern struct pf_poolqueue *pf_pools_inactive; |
2166 | |
2167 | __private_extern__ int pf_tbladdr_setup(struct pf_ruleset *, |
2168 | struct pf_addr_wrap *); |
2169 | __private_extern__ void pf_tbladdr_remove(struct pf_addr_wrap *); |
2170 | __private_extern__ void pf_tbladdr_copyout(struct pf_addr_wrap *); |
2171 | __private_extern__ void pf_calc_skip_steps(struct pf_rulequeue *); |
2172 | __private_extern__ u_int32_t pf_calc_state_key_flowhash(struct pf_state_key *); |
2173 | |
2174 | extern struct pool pf_src_tree_pl, pf_rule_pl; |
2175 | extern struct pool pf_state_pl, pf_state_key_pl, pf_pooladdr_pl; |
2176 | extern struct pool pf_state_scrub_pl; |
2177 | extern struct pool pf_app_state_pl; |
2178 | |
2179 | extern struct thread *pf_purge_thread; |
2180 | |
2181 | extern void pf_register_m_tag(void); |
2182 | |
2183 | __private_extern__ void pfinit(void); |
2184 | __private_extern__ void pf_purge_thread_fn(void *, wait_result_t) __dead2; |
2185 | __private_extern__ void pf_purge_expired_src_nodes(void); |
2186 | __private_extern__ void pf_purge_expired_states(u_int32_t); |
2187 | __private_extern__ void pf_unlink_state(struct pf_state *); |
2188 | __private_extern__ void pf_free_state(struct pf_state *); |
2189 | __private_extern__ int pf_insert_state(struct pfi_kif *, struct pf_state *); |
2190 | __private_extern__ int pf_insert_src_node(struct pf_src_node **, |
2191 | struct pf_rule *, struct pf_addr *, sa_family_t); |
2192 | __private_extern__ void pf_src_tree_remove_state(struct pf_state *); |
2193 | __private_extern__ struct pf_state *pf_find_state_byid(struct pf_state_cmp *); |
2194 | __private_extern__ struct pf_state *pf_find_state_all(struct pf_state_key_cmp *, |
2195 | u_int, int *); |
2196 | __private_extern__ void pf_print_state(struct pf_state *); |
2197 | __private_extern__ void pf_print_flags(u_int8_t); |
2198 | __private_extern__ u_int16_t pf_cksum_fixup(u_int16_t, u_int16_t, u_int16_t, |
2199 | u_int8_t); |
2200 | |
2201 | extern struct ifnet *sync_ifp; |
2202 | extern struct pf_rule pf_default_rule; |
2203 | __private_extern__ void pf_addrcpy(struct pf_addr *, struct pf_addr *, |
2204 | u_int8_t); |
2205 | __private_extern__ void pf_rm_rule(struct pf_rulequeue *, struct pf_rule *); |
2206 | |
2207 | struct ip_fw_args; |
2208 | |
2209 | extern boolean_t is_nlc_enabled_glb; |
2210 | |
2211 | #if INET |
2212 | __private_extern__ int pf_test_mbuf(int, struct ifnet *, struct mbuf **, |
2213 | struct ether_header *, struct ip_fw_args *); |
2214 | #endif /* INET */ |
2215 | |
2216 | __private_extern__ int pf_test6_mbuf(int, struct ifnet *, struct mbuf **, |
2217 | struct ether_header *, struct ip_fw_args *); |
2218 | __private_extern__ void pf_poolmask(struct pf_addr *, struct pf_addr *, |
2219 | struct pf_addr *, struct pf_addr *, u_int8_t); |
2220 | __private_extern__ void pf_addr_inc(struct pf_addr *, sa_family_t); |
2221 | __private_extern__ int pf_normalize_ip6(pbuf_t *, int, struct pfi_kif *, |
2222 | u_short *, struct pf_pdesc *); |
2223 | __private_extern__ int pf_refragment6(struct ifnet *, pbuf_t **, |
2224 | struct pf_fragment_tag *); |
2225 | |
2226 | __private_extern__ void *pf_lazy_makewritable(struct pf_pdesc *, |
2227 | pbuf_t *, int); |
2228 | __private_extern__ void *pf_pull_hdr(pbuf_t *, int, void *, int, |
2229 | u_short *, u_short *, sa_family_t); |
2230 | __private_extern__ void pf_change_a(void *, u_int16_t *, u_int32_t, u_int8_t); |
2231 | __private_extern__ int pflog_packet(struct pfi_kif *, pbuf_t *, |
2232 | sa_family_t, u_int8_t, u_int8_t, struct pf_rule *, struct pf_rule *, |
2233 | struct pf_ruleset *, struct pf_pdesc *); |
2234 | __private_extern__ int pf_match_addr(u_int8_t, struct pf_addr *, |
2235 | struct pf_addr *, struct pf_addr *, sa_family_t); |
2236 | __private_extern__ int pf_match_addr_range(struct pf_addr *, struct pf_addr *, |
2237 | struct pf_addr *, sa_family_t); |
2238 | __private_extern__ int pf_match(u_int8_t, u_int32_t, u_int32_t, u_int32_t); |
2239 | __private_extern__ int pf_match_port(u_int8_t, u_int16_t, u_int16_t, u_int16_t); |
2240 | __private_extern__ int pf_match_xport(u_int8_t, u_int8_t, union pf_rule_xport *, |
2241 | union pf_state_xport *); |
2242 | __private_extern__ int pf_match_uid(u_int8_t, uid_t, uid_t, uid_t); |
2243 | __private_extern__ int pf_match_gid(u_int8_t, gid_t, gid_t, gid_t); |
2244 | |
2245 | __private_extern__ void pf_normalize_init(void); |
2246 | __private_extern__ int pf_normalize_isempty(void); |
2247 | __private_extern__ int pf_normalize_ip(pbuf_t *, int, struct pfi_kif *, |
2248 | u_short *, struct pf_pdesc *); |
2249 | __private_extern__ int pf_normalize_tcp(int, struct pfi_kif *, pbuf_t *, |
2250 | int, int, void *, struct pf_pdesc *); |
2251 | __private_extern__ void pf_normalize_tcp_cleanup(struct pf_state *); |
2252 | __private_extern__ int pf_normalize_tcp_init(pbuf_t *, int, |
2253 | struct pf_pdesc *, struct tcphdr *, struct pf_state_peer *, |
2254 | struct pf_state_peer *); |
2255 | __private_extern__ int pf_normalize_tcp_stateful(pbuf_t *, int, |
2256 | struct pf_pdesc *, u_short *, struct tcphdr *, struct pf_state *, |
2257 | struct pf_state_peer *, struct pf_state_peer *, int *); |
2258 | __private_extern__ u_int64_t pf_state_expires(const struct pf_state *); |
2259 | __private_extern__ void pf_purge_expired_fragments(void); |
2260 | __private_extern__ int pf_routable(struct pf_addr *addr, sa_family_t af, |
2261 | struct pfi_kif *); |
2262 | __private_extern__ int pf_rtlabel_match(struct pf_addr *, sa_family_t, |
2263 | struct pf_addr_wrap *); |
2264 | __private_extern__ int pf_socket_lookup(int, struct pf_pdesc *); |
2265 | __private_extern__ struct pf_state_key *pf_alloc_state_key(struct pf_state *, |
2266 | struct pf_state_key *); |
2267 | __private_extern__ void pf_detach_state(struct pf_state *, int); |
2268 | __private_extern__ void pfr_initialize(void); |
2269 | __private_extern__ int pfr_match_addr(struct pfr_ktable *, struct pf_addr *, |
2270 | sa_family_t); |
2271 | __private_extern__ void pfr_update_stats(struct pfr_ktable *, struct pf_addr *, |
2272 | sa_family_t, u_int64_t, int, int, int); |
2273 | __private_extern__ int pfr_pool_get(struct pfr_ktable *, int *, |
2274 | struct pf_addr *, struct pf_addr **, struct pf_addr **, sa_family_t); |
2275 | __private_extern__ void pfr_dynaddr_update(struct pfr_ktable *, |
2276 | struct pfi_dynaddr *); |
2277 | __private_extern__ void pfr_table_copyin_cleanup(struct pfr_table *); |
2278 | __private_extern__ struct pfr_ktable *pfr_attach_table(struct pf_ruleset *, |
2279 | char *); |
2280 | __private_extern__ void pfr_detach_table(struct pfr_ktable *); |
2281 | __private_extern__ int pfr_clr_tables(struct pfr_table *, int *, int); |
2282 | __private_extern__ int pfr_add_tables(user_addr_t, int, int *, int); |
2283 | __private_extern__ int pfr_del_tables(user_addr_t, int, int *, int); |
2284 | __private_extern__ int pfr_get_tables(struct pfr_table *, user_addr_t, |
2285 | int *, int); |
2286 | __private_extern__ int pfr_get_tstats(struct pfr_table *, user_addr_t, |
2287 | int *, int); |
2288 | __private_extern__ int pfr_clr_tstats(user_addr_t, int, int *, int); |
2289 | __private_extern__ int pfr_set_tflags(user_addr_t, int, int, int, int *, |
2290 | int *, int); |
2291 | __private_extern__ int pfr_clr_addrs(struct pfr_table *, int *, int); |
2292 | __private_extern__ int pfr_insert_kentry(struct pfr_ktable *, struct pfr_addr *, |
2293 | u_int64_t); |
2294 | __private_extern__ int pfr_add_addrs(struct pfr_table *, user_addr_t, |
2295 | int, int *, int); |
2296 | __private_extern__ int pfr_del_addrs(struct pfr_table *, user_addr_t, |
2297 | int, int *, int); |
2298 | __private_extern__ int pfr_set_addrs(struct pfr_table *, user_addr_t, |
2299 | int, int *, int *, int *, int *, int, u_int32_t); |
2300 | __private_extern__ int pfr_get_addrs(struct pfr_table *, user_addr_t, |
2301 | int *, int); |
2302 | __private_extern__ int pfr_get_astats(struct pfr_table *, user_addr_t, |
2303 | int *, int); |
2304 | __private_extern__ int pfr_clr_astats(struct pfr_table *, user_addr_t, |
2305 | int, int *, int); |
2306 | __private_extern__ int pfr_tst_addrs(struct pfr_table *, user_addr_t, |
2307 | int, int *, int); |
2308 | __private_extern__ int pfr_ina_begin(struct pfr_table *, u_int32_t *, int *, |
2309 | int); |
2310 | __private_extern__ int pfr_ina_rollback(struct pfr_table *, u_int32_t, int *, |
2311 | int); |
2312 | __private_extern__ int pfr_ina_commit(struct pfr_table *, u_int32_t, int *, |
2313 | int *, int); |
2314 | __private_extern__ int pfr_ina_define(struct pfr_table *, user_addr_t, |
2315 | int, int *, int *, u_int32_t, int); |
2316 | |
2317 | extern struct pfi_kif *pfi_all; |
2318 | |
2319 | __private_extern__ void pfi_initialize(void); |
2320 | __private_extern__ struct pfi_kif *pfi_kif_get(const char *); |
2321 | __private_extern__ void pfi_kif_ref(struct pfi_kif *, enum pfi_kif_refs); |
2322 | __private_extern__ void pfi_kif_unref(struct pfi_kif *, enum pfi_kif_refs); |
2323 | __private_extern__ int pfi_kif_match(struct pfi_kif *, struct pfi_kif *); |
2324 | __private_extern__ void pfi_attach_ifnet(struct ifnet *); |
2325 | __private_extern__ void pfi_detach_ifnet(struct ifnet *); |
2326 | __private_extern__ int pfi_match_addr(struct pfi_dynaddr *, struct pf_addr *, |
2327 | sa_family_t); |
2328 | __private_extern__ int pfi_dynaddr_setup(struct pf_addr_wrap *, sa_family_t); |
2329 | __private_extern__ void pfi_dynaddr_remove(struct pf_addr_wrap *); |
2330 | __private_extern__ void pfi_dynaddr_copyout(struct pf_addr_wrap *); |
2331 | __private_extern__ void pfi_update_status(const char *, struct pf_status *); |
2332 | __private_extern__ int pfi_get_ifaces(const char *, user_addr_t, int *); |
2333 | __private_extern__ int pfi_set_flags(const char *, int); |
2334 | __private_extern__ int pfi_clear_flags(const char *, int); |
2335 | |
2336 | __private_extern__ u_int16_t pf_tagname2tag(char *); |
2337 | __private_extern__ u_int16_t pf_tagname2tag_ext(char *); |
2338 | __private_extern__ void pf_tag_ref(u_int16_t); |
2339 | __private_extern__ void pf_tag_unref(u_int16_t); |
2340 | __private_extern__ int pf_tag_packet(pbuf_t *, struct pf_mtag *, |
2341 | int, unsigned int, struct pf_pdesc *); |
2342 | __private_extern__ void pf_step_into_anchor(int *, struct pf_ruleset **, int, |
2343 | struct pf_rule **, struct pf_rule **, int *); |
2344 | __private_extern__ int pf_step_out_of_anchor(int *, struct pf_ruleset **, int, |
2345 | struct pf_rule **, struct pf_rule **, int *); |
2346 | __private_extern__ u_int32_t pf_qname2qid(char *); |
2347 | __private_extern__ void pf_qid2qname(u_int32_t, char *); |
2348 | __private_extern__ void pf_qid_unref(u_int32_t); |
2349 | |
2350 | extern struct pf_status pf_status; |
2351 | extern struct pool pf_frent_pl, pf_frag_pl; |
2352 | |
2353 | struct pf_pool_limit { |
2354 | void *pp; |
2355 | unsigned limit; |
2356 | }; |
2357 | extern struct pf_pool_limit pf_pool_limits[PF_LIMIT_MAX]; |
2358 | |
2359 | __private_extern__ int pf_af_hook(struct ifnet *, struct mbuf **, |
2360 | struct mbuf **, unsigned int, int, struct ip_fw_args *); |
2361 | __private_extern__ int pf_ifaddr_hook(struct ifnet *); |
2362 | __private_extern__ void pf_ifnet_hook(struct ifnet *, int); |
2363 | |
2364 | /* |
2365 | * The following are defined with "private extern" storage class for |
2366 | * kernel, and "extern" for user-space. |
2367 | */ |
2368 | extern struct pf_anchor_global pf_anchors; |
2369 | extern struct pf_anchor pf_main_anchor; |
2370 | #define pf_main_ruleset pf_main_anchor.ruleset |
2371 | |
2372 | extern int pf_is_enabled; |
2373 | extern int16_t pf_nat64_configured; |
2374 | #define PF_IS_ENABLED (pf_is_enabled != 0) |
2375 | extern u_int32_t pf_hash_seed; |
2376 | |
2377 | __private_extern__ int pf_get_ruleset_number(u_int8_t); |
2378 | __private_extern__ void pf_init_ruleset(struct pf_ruleset *); |
2379 | __private_extern__ int pf_anchor_setup(struct pf_rule *, |
2380 | const struct pf_ruleset *, const char *); |
2381 | __private_extern__ int pf_anchor_copyout(const struct pf_ruleset *, |
2382 | const struct pf_rule *, struct pfioc_rule *); |
2383 | __private_extern__ void pf_anchor_remove(struct pf_rule *); |
2384 | __private_extern__ void pf_remove_if_empty_ruleset(struct pf_ruleset *); |
2385 | __private_extern__ struct pf_anchor *pf_find_anchor(const char *); |
2386 | __private_extern__ int pf_reference_anchor(struct pf_anchor *a); |
2387 | __private_extern__ int pf_release_anchor(struct pf_anchor *a); |
2388 | __private_extern__ int pf_release_ruleset(struct pf_ruleset *r); |
2389 | __private_extern__ struct pf_ruleset *pf_find_ruleset(const char *); |
2390 | __private_extern__ struct pf_ruleset *pf_find_ruleset_with_owner(const char *, |
2391 | const char *, int, int *); |
2392 | __private_extern__ struct pf_ruleset *pf_find_or_create_ruleset(const char *); |
2393 | __private_extern__ void pf_rs_initialize(void); |
2394 | |
2395 | __private_extern__ int pf_osfp_add(struct pf_osfp_ioctl *); |
2396 | __private_extern__ struct pf_osfp_enlist *pf_osfp_fingerprint(struct pf_pdesc *, |
2397 | pbuf_t *, int, const struct tcphdr *); |
2398 | __private_extern__ struct pf_osfp_enlist *pf_osfp_fingerprint_hdr( |
2399 | const struct ip *, const struct ip6_hdr *, const struct tcphdr *); |
2400 | __private_extern__ void pf_osfp_flush(void); |
2401 | __private_extern__ int pf_osfp_get(struct pf_osfp_ioctl *); |
2402 | __private_extern__ void pf_osfp_initialize(void); |
2403 | __private_extern__ int pf_osfp_match(struct pf_osfp_enlist *, pf_osfp_t); |
2404 | __private_extern__ struct pf_os_fingerprint *pf_osfp_validate(void); |
2405 | __private_extern__ struct pf_mtag *pf_find_mtag(struct mbuf *); |
2406 | __private_extern__ struct pf_mtag *pf_find_mtag_pbuf(pbuf_t *); |
2407 | __private_extern__ struct pf_mtag *pf_get_mtag(struct mbuf *); |
2408 | __private_extern__ struct pf_mtag *pf_get_mtag_pbuf(pbuf_t *); |
2409 | __private_extern__ struct pf_fragment_tag * pf_find_fragment_tag_pbuf(pbuf_t *); |
2410 | __private_extern__ struct pf_fragment_tag * pf_find_fragment_tag(struct mbuf *); |
2411 | __private_extern__ struct pf_fragment_tag * pf_copy_fragment_tag(struct mbuf *, |
2412 | struct pf_fragment_tag *, int); |
2413 | #if SKYWALK && defined(XNU_TARGET_OS_OSX) |
2414 | #define PF_COMPATIBLE_FLAGS_PF_ENABLED 0x00000001 |
2415 | #define PF_COMPATIBLE_FLAGS_CUSTOM_ANCHORS_PRESENT 0x00000002 |
2416 | #define PF_COMPATIBLE_FLAGS_CUSTOM_RULES_PRESENT 0x00000004 |
2417 | |
2418 | __private_extern__ uint32_t pf_check_compatible_rules(void); |
2419 | #endif // SKYWALK && defined(XNU_TARGET_OS_OSX) |
2420 | #else /* !KERNEL */ |
2421 | extern struct pf_anchor_global pf_anchors; |
2422 | extern struct pf_anchor pf_main_anchor; |
2423 | #define pf_main_ruleset pf_main_anchor.ruleset |
2424 | |
2425 | /* these ruleset functions can be linked into userland programs (pfctl) */ |
2426 | extern int pf_get_ruleset_number(u_int8_t); |
2427 | extern void pf_init_ruleset(struct pf_ruleset *); |
2428 | extern int pf_anchor_setup(struct pf_rule *, const struct pf_ruleset *, |
2429 | const char *); |
2430 | extern int pf_anchor_copyout(const struct pf_ruleset *, const struct pf_rule *, |
2431 | struct pfioc_rule *); |
2432 | extern void pf_anchor_remove(struct pf_rule *); |
2433 | extern void pf_remove_if_empty_ruleset(struct pf_ruleset *); |
2434 | extern struct pf_anchor *pf_find_anchor(const char *); |
2435 | extern struct pf_ruleset *pf_find_ruleset(const char *); |
2436 | extern struct pf_ruleset *pf_find_ruleset_with_owner(const char *, |
2437 | const char *, int, int *); |
2438 | extern struct pf_ruleset *pf_find_or_create_ruleset(const char *); |
2439 | extern void pf_rs_initialize(void); |
2440 | #endif /* !KERNEL */ |
2441 | |
2442 | #ifdef __cplusplus |
2443 | } |
2444 | #endif |
2445 | #endif /* PF || !KERNEL */ |
2446 | #endif /* PRIVATE */ |
2447 | #endif /* _NET_PFVAR_H_ */ |
2448 | |