pf.h revision 263086 
1/*
2 * Copyright (c) 2001 Daniel Hartmeier
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *
9 *    - Redistributions of source code must retain the above copyright
10 *      notice, this list of conditions and the following disclaimer.
11 *    - Redistributions in binary form must reproduce the above
12 *      copyright notice, this list of conditions and the following
13 *      disclaimer in the documentation and/or other materials provided
14 *      with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
17 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
18 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
19 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
20 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
22 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
23 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
24 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
26 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27 * POSSIBILITY OF SUCH DAMAGE.
28 *
29 *	$OpenBSD: pfvar.h,v 1.282 2009/01/29 15:12:28 pyr Exp $
30 *	$FreeBSD: stable/10/sys/netpfil/pf/pf.h 263086 2014-03-12 10:45:58Z glebius $
31 */
32
33#ifndef	_NET_PF_H_
34#define	_NET_PF_H_
35
36#define	PF_TCPS_PROXY_SRC	((TCP_NSTATES)+0)
37#define	PF_TCPS_PROXY_DST	((TCP_NSTATES)+1)
38
39#define	PF_MD5_DIGEST_LENGTH	16
40#ifdef MD5_DIGEST_LENGTH
41#if PF_MD5_DIGEST_LENGTH != MD5_DIGEST_LENGTH
42#error
43#endif
44#endif
45
46enum	{ PF_INOUT, PF_IN, PF_OUT };
47enum	{ PF_PASS, PF_DROP, PF_SCRUB, PF_NOSCRUB, PF_NAT, PF_NONAT,
48	  PF_BINAT, PF_NOBINAT, PF_RDR, PF_NORDR, PF_SYNPROXY_DROP, PF_DEFER };
49enum	{ PF_RULESET_SCRUB, PF_RULESET_FILTER, PF_RULESET_NAT,
50	  PF_RULESET_BINAT, PF_RULESET_RDR, PF_RULESET_MAX };
51enum	{ PF_OP_NONE, PF_OP_IRG, PF_OP_EQ, PF_OP_NE, PF_OP_LT,
52	  PF_OP_LE, PF_OP_GT, PF_OP_GE, PF_OP_XRG, PF_OP_RRG };
53enum	{ PF_DEBUG_NONE, PF_DEBUG_URGENT, PF_DEBUG_MISC, PF_DEBUG_NOISY };
54enum	{ PF_CHANGE_NONE, PF_CHANGE_ADD_HEAD, PF_CHANGE_ADD_TAIL,
55	  PF_CHANGE_ADD_BEFORE, PF_CHANGE_ADD_AFTER,
56	  PF_CHANGE_REMOVE, PF_CHANGE_GET_TICKET };
57enum	{ PF_GET_NONE, PF_GET_CLR_CNTR };
58enum	{ PF_SK_WIRE, PF_SK_STACK, PF_SK_BOTH };
59
60/*
61 * Note about PFTM_*: real indices into pf_rule.timeout[] come before
62 * PFTM_MAX, special cases afterwards. See pf_state_expires().
63 */
64enum	{ PFTM_TCP_FIRST_PACKET, PFTM_TCP_OPENING, PFTM_TCP_ESTABLISHED,
65	  PFTM_TCP_CLOSING, PFTM_TCP_FIN_WAIT, PFTM_TCP_CLOSED,
66	  PFTM_UDP_FIRST_PACKET, PFTM_UDP_SINGLE, PFTM_UDP_MULTIPLE,
67	  PFTM_ICMP_FIRST_PACKET, PFTM_ICMP_ERROR_REPLY,
68	  PFTM_OTHER_FIRST_PACKET, PFTM_OTHER_SINGLE,
69	  PFTM_OTHER_MULTIPLE, PFTM_FRAG, PFTM_INTERVAL,
70	  PFTM_ADAPTIVE_START, PFTM_ADAPTIVE_END, PFTM_SRC_NODE,
71	  PFTM_TS_DIFF, PFTM_MAX, PFTM_PURGE, PFTM_UNLINKED,
72	  PFTM_UNTIL_PACKET };
73
74/* PFTM default values */
75#define PFTM_TCP_FIRST_PACKET_VAL	120	/* First TCP packet */
76#define PFTM_TCP_OPENING_VAL		30	/* No response yet */
77#define PFTM_TCP_ESTABLISHED_VAL	24*60*60/* Established */
78#define PFTM_TCP_CLOSING_VAL		15 * 60	/* Half closed */
79#define PFTM_TCP_FIN_WAIT_VAL		45	/* Got both FINs */
80#define PFTM_TCP_CLOSED_VAL		90	/* Got a RST */
81#define PFTM_UDP_FIRST_PACKET_VAL	60	/* First UDP packet */
82#define PFTM_UDP_SINGLE_VAL		30	/* Unidirectional */
83#define PFTM_UDP_MULTIPLE_VAL		60	/* Bidirectional */
84#define PFTM_ICMP_FIRST_PACKET_VAL	20	/* First ICMP packet */
85#define PFTM_ICMP_ERROR_REPLY_VAL	10	/* Got error response */
86#define PFTM_OTHER_FIRST_PACKET_VAL	60	/* First packet */
87#define PFTM_OTHER_SINGLE_VAL		30	/* Unidirectional */
88#define PFTM_OTHER_MULTIPLE_VAL		60	/* Bidirectional */
89#define PFTM_FRAG_VAL			30	/* Fragment expire */
90#define PFTM_INTERVAL_VAL		10	/* Expire interval */
91#define PFTM_SRC_NODE_VAL		0	/* Source tracking */
92#define PFTM_TS_DIFF_VAL		30	/* Allowed TS diff */
93
94enum	{ PF_NOPFROUTE, PF_FASTROUTE, PF_ROUTETO, PF_DUPTO, PF_REPLYTO };
95enum	{ PF_LIMIT_STATES, PF_LIMIT_SRC_NODES, PF_LIMIT_FRAGS,
96	  PF_LIMIT_TABLE_ENTRIES, PF_LIMIT_MAX };
97#define PF_POOL_IDMASK		0x0f
98enum	{ PF_POOL_NONE, PF_POOL_BITMASK, PF_POOL_RANDOM,
99	  PF_POOL_SRCHASH, PF_POOL_ROUNDROBIN };
100enum	{ PF_ADDR_ADDRMASK, PF_ADDR_NOROUTE, PF_ADDR_DYNIFTL,
101	  PF_ADDR_TABLE, PF_ADDR_URPFFAILED,
102	  PF_ADDR_RANGE };
103#define PF_POOL_TYPEMASK	0x0f
104#define PF_POOL_STICKYADDR	0x20
105#define	PF_WSCALE_FLAG		0x80
106#define	PF_WSCALE_MASK		0x0f
107
108#define	PF_LOG			0x01
109#define	PF_LOG_ALL		0x02
110#define	PF_LOG_SOCKET_LOOKUP	0x04
111
112/* Reasons code for passing/dropping a packet */
113#define PFRES_MATCH	0		/* Explicit match of a rule */
114#define PFRES_BADOFF	1		/* Bad offset for pull_hdr */
115#define PFRES_FRAG	2		/* Dropping following fragment */
116#define PFRES_SHORT	3		/* Dropping short packet */
117#define PFRES_NORM	4		/* Dropping by normalizer */
118#define PFRES_MEMORY	5		/* Dropped due to lacking mem */
119#define PFRES_TS	6		/* Bad TCP Timestamp (RFC1323) */
120#define PFRES_CONGEST	7		/* Congestion (of ipintrq) */
121#define PFRES_IPOPTIONS 8		/* IP option */
122#define PFRES_PROTCKSUM 9		/* Protocol checksum invalid */
123#define PFRES_BADSTATE	10		/* State mismatch */
124#define PFRES_STATEINS	11		/* State insertion failure */
125#define PFRES_MAXSTATES	12		/* State limit */
126#define PFRES_SRCLIMIT	13		/* Source node/conn limit */
127#define PFRES_SYNPROXY	14		/* SYN proxy */
128#define PFRES_MAX	15		/* total+1 */
129
130#define PFRES_NAMES { \
131	"match", \
132	"bad-offset", \
133	"fragment", \
134	"short", \
135	"normalize", \
136	"memory", \
137	"bad-timestamp", \
138	"congestion", \
139	"ip-option", \
140	"proto-cksum", \
141	"state-mismatch", \
142	"state-insert", \
143	"state-limit", \
144	"src-limit", \
145	"synproxy", \
146	NULL \
147}
148
149#define	PF_TABLE_NAME_SIZE	32
150#define	PF_QNAME_SIZE		64
151
152#endif	/* _NET_PF_H_ */
153