ip_fw.h revision 15026 
1/*
2 * Copyright (c) 1993 Daniel Boulet
3 * Copyright (c) 1994 Ugen J.S.Antsilevich
4 *
5 * Redistribution and use in source forms, with and without modification,
6 * are permitted provided that this entire comment appears intact.
7 *
8 * Redistribution in binary form may occur without any restrictions.
9 * Obviously, it would be nice if you gave credit where credit is due
10 * but requiring it would be too onerous.
11 *
12 * This software is provided ``AS IS'' without any warranties of any kind.
13 *
14 *	$Id: ip_fw.h,v 1.17 1996/02/24 13:38:27 phk Exp $
15 */
16
17/*
18 * Format of an IP firewall descriptor
19 *
20 * fw_src, fw_dst, fw_smsk, fw_dmsk are always stored in network byte order.
21 * fw_flg and fw_n*p are stored in host byte order (of course).
22 * Port numbers are stored in HOST byte order.
23 */
24#ifndef _IP_FW_H
25#define _IP_FW_H
26
27struct ip_fw {
28    u_long fw_pcnt,fw_bcnt;		/* Packet and byte counters */
29    struct in_addr fw_src, fw_dst;	/* Source and destination IP addr */
30    struct in_addr fw_smsk, fw_dmsk;	/* Mask for src and dest IP addr */
31    union {
32	struct in_addr fu_via_ip;
33	struct {
34#define FW_IFNLEN	6		/* To keep structure on 2^x boundary */
35		char  fu_via_name[FW_IFNLEN];
36		short fu_via_unit;
37	} fu_via_if;
38    } fu_via_un;
39#define fw_via_ip	fu_via_un.fu_via_ip
40#define fw_via_name	fu_via_un.fu_via_if.fu_via_name
41#define fw_via_unit	fu_via_un.fu_via_if.fu_via_unit
42    u_short fw_number;
43    u_short fw_flg;			/* Flags word */
44    u_short fw_nsp, fw_ndp;             /* N'of src ports and # of dst ports */
45    					/* in ports array (dst ports follow */
46    					/* src ports; max of 10 ports in all; */
47    					/* count of 0 means match all ports) */
48#define IP_FW_MAX_PORTS	10      	/* A reasonable maximum */
49    u_short fw_pts[IP_FW_MAX_PORTS];    /* Array of port numbers to match */
50    u_char fw_ipopt,fw_ipnopt;		/* IP options set/unset */
51    u_char fw_tcpf,fw_tcpnf;		/* TCP flags sen/unset */
52};
53
54struct ip_fw_chain {
55        LIST_ENTRY(ip_fw_chain) chain;
56        struct ip_fw    *rule;
57};
58
59/*
60 * Values for "flags" field .
61 */
62
63#define IP_FW_F_ALL	0x000	/* This is a universal packet rule    */
64#define IP_FW_F_TCP	0x001	/* This is a TCP packet rule          */
65#define IP_FW_F_UDP	0x002	/* This is a UDP packet rule          */
66#define IP_FW_F_ICMP	0x003	/* This is a ICMP packet rule         */
67#define IP_FW_F_KIND	0x003	/* Mask to isolate rule kind          */
68
69#define IP_FW_F_IN	0x004	/* Inbound 			      */
70#define IP_FW_F_OUT	0x008	/* Outboun 			      */
71
72#define IP_FW_F_ACCEPT	0x010	/* This is an accept rule	      */
73#define IP_FW_F_COUNT	0x020	/* This is an accept rule	      */
74#define IP_FW_F_PRN	0x040	/* Print if this rule matches	      */
75#define IP_FW_F_ICMPRPL	0x080	/* Send back icmp unreachable packet  */
76
77#define IP_FW_F_SRNG	0x100	/* The first two src ports are a min  *
78				 * and max range (stored in host byte *
79				 * order).                            */
80
81#define IP_FW_F_DRNG	0x200	/* The first two dst ports are a min  *
82				 * and max range (stored in host byte *
83				 * order).                            */
84
85#define IP_FW_F_IFNAME	0x400	/* Use interface name/unit (not IP)   */
86
87#define IP_FW_F_FRAG	0x800	/* Fragment			      */
88
89#define IP_FW_F_MASK	0xFFF	/* All possible flag bits mask        */
90
91/*
92 * Definitions for IP option names.
93 */
94#define IP_FW_IPOPT_LSRR	0x01
95#define IP_FW_IPOPT_SSRR	0x02
96#define IP_FW_IPOPT_RR		0x04
97#define IP_FW_IPOPT_TS		0x08
98
99/*
100 * Definitions for TCP flags.
101 */
102#define IP_FW_TCPF_FIN		TH_FIN
103#define IP_FW_TCPF_SYN		TH_SYN
104#define IP_FW_TCPF_RST		TH_RST
105#define IP_FW_TCPF_PSH		TH_PUSH
106#define IP_FW_TCPF_ACK		TH_ACK
107#define IP_FW_TCPF_URG		TH_URG
108#define IP_FW_TCPF_ESTAB	0x40
109
110/*
111 * New IP firewall options for [gs]etsockopt at the RAW IP level.
112 */
113#define IP_FW_BASE_CTL	50
114
115#define IP_FW_ADD     (IP_FW_BASE_CTL+0)
116#define IP_FW_DEL     (IP_FW_BASE_CTL+1)
117#define IP_FW_FLUSH   (IP_FW_BASE_CTL+2)
118#define IP_FW_ZERO    (IP_FW_BASE_CTL+3)
119#define IP_FW_GET     (IP_FW_BASE_CTL+4)
120
121/*
122 * Main firewall chains definitions and global var's definitions.
123 */
124#ifdef KERNEL
125
126/*
127 * Function definitions.
128 */
129void ip_fw_init(void);
130
131#endif /* KERNEL */
132
133#endif /* _IP_FW_H */
134