1126258Smlaier/* 2126258Smlaier * Copyright (c) 2001 Daniel Hartmeier 3126258Smlaier * All rights reserved. 4126258Smlaier * 5126258Smlaier * Redistribution and use in source and binary forms, with or without 6126258Smlaier * modification, are permitted provided that the following conditions 7126258Smlaier * are met: 8126258Smlaier * 9126258Smlaier * - Redistributions of source code must retain the above copyright 10126258Smlaier * notice, this list of conditions and the following disclaimer. 11126258Smlaier * - Redistributions in binary form must reproduce the above 12126258Smlaier * copyright notice, this list of conditions and the following 13126258Smlaier * disclaimer in the documentation and/or other materials provided 14126258Smlaier * with the distribution. 15126258Smlaier * 16126258Smlaier * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 17126258Smlaier * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 18126258Smlaier * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 19126258Smlaier * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 20126258Smlaier * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 21126258Smlaier * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 22126258Smlaier * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 23126258Smlaier * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 24126258Smlaier * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25126258Smlaier * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 26126258Smlaier * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 27126258Smlaier * POSSIBILITY OF SUCH DAMAGE. 28126258Smlaier * 29240644Sglebius * $OpenBSD: pfvar.h,v 1.282 2009/01/29 15:12:28 pyr Exp $ 30240640Sglebius * $FreeBSD$ 31126258Smlaier */ 32126258Smlaier 33257186Sglebius#ifndef _NET_PF_H_ 34263086Sglebius#define _NET_PF_H_ 35126258Smlaier 36126258Smlaier#define PF_TCPS_PROXY_SRC ((TCP_NSTATES)+0) 37126258Smlaier#define PF_TCPS_PROXY_DST ((TCP_NSTATES)+1) 38126258Smlaier 39171168Smlaier#define PF_MD5_DIGEST_LENGTH 16 40171168Smlaier#ifdef MD5_DIGEST_LENGTH 41171168Smlaier#if PF_MD5_DIGEST_LENGTH != MD5_DIGEST_LENGTH 42171168Smlaier#error 43171168Smlaier#endif 44171168Smlaier#endif 45171168Smlaier 46126258Smlaierenum { PF_INOUT, PF_IN, PF_OUT }; 47145836Smlaierenum { PF_PASS, PF_DROP, PF_SCRUB, PF_NOSCRUB, PF_NAT, PF_NONAT, 48223637Sbz PF_BINAT, PF_NOBINAT, PF_RDR, PF_NORDR, PF_SYNPROXY_DROP, PF_DEFER }; 49126258Smlaierenum { PF_RULESET_SCRUB, PF_RULESET_FILTER, PF_RULESET_NAT, 50126258Smlaier PF_RULESET_BINAT, PF_RULESET_RDR, PF_RULESET_MAX }; 51126258Smlaierenum { PF_OP_NONE, PF_OP_IRG, PF_OP_EQ, PF_OP_NE, PF_OP_LT, 52126258Smlaier PF_OP_LE, PF_OP_GT, PF_OP_GE, PF_OP_XRG, PF_OP_RRG }; 53126258Smlaierenum { PF_DEBUG_NONE, PF_DEBUG_URGENT, PF_DEBUG_MISC, PF_DEBUG_NOISY }; 54126258Smlaierenum { PF_CHANGE_NONE, PF_CHANGE_ADD_HEAD, PF_CHANGE_ADD_TAIL, 55126258Smlaier PF_CHANGE_ADD_BEFORE, PF_CHANGE_ADD_AFTER, 56126258Smlaier PF_CHANGE_REMOVE, PF_CHANGE_GET_TICKET }; 57171168Smlaierenum { PF_GET_NONE, PF_GET_CLR_CNTR }; 58223637Sbzenum { PF_SK_WIRE, PF_SK_STACK, PF_SK_BOTH }; 59171168Smlaier 60126258Smlaier/* 61126258Smlaier * Note about PFTM_*: real indices into pf_rule.timeout[] come before 62126258Smlaier * PFTM_MAX, special cases afterwards. See pf_state_expires(). 63126258Smlaier */ 64126258Smlaierenum { PFTM_TCP_FIRST_PACKET, PFTM_TCP_OPENING, PFTM_TCP_ESTABLISHED, 65126258Smlaier PFTM_TCP_CLOSING, PFTM_TCP_FIN_WAIT, PFTM_TCP_CLOSED, 66126258Smlaier PFTM_UDP_FIRST_PACKET, PFTM_UDP_SINGLE, PFTM_UDP_MULTIPLE, 67126258Smlaier PFTM_ICMP_FIRST_PACKET, PFTM_ICMP_ERROR_REPLY, 68126258Smlaier PFTM_OTHER_FIRST_PACKET, PFTM_OTHER_SINGLE, 69126258Smlaier PFTM_OTHER_MULTIPLE, PFTM_FRAG, PFTM_INTERVAL, 70130613Smlaier PFTM_ADAPTIVE_START, PFTM_ADAPTIVE_END, PFTM_SRC_NODE, 71171168Smlaier PFTM_TS_DIFF, PFTM_MAX, PFTM_PURGE, PFTM_UNLINKED, 72171168Smlaier PFTM_UNTIL_PACKET }; 73145836Smlaier 74145836Smlaier/* PFTM default values */ 75145836Smlaier#define PFTM_TCP_FIRST_PACKET_VAL 120 /* First TCP packet */ 76145836Smlaier#define PFTM_TCP_OPENING_VAL 30 /* No response yet */ 77145836Smlaier#define PFTM_TCP_ESTABLISHED_VAL 24*60*60/* Established */ 78145836Smlaier#define PFTM_TCP_CLOSING_VAL 15 * 60 /* Half closed */ 79145836Smlaier#define PFTM_TCP_FIN_WAIT_VAL 45 /* Got both FINs */ 80145836Smlaier#define PFTM_TCP_CLOSED_VAL 90 /* Got a RST */ 81145836Smlaier#define PFTM_UDP_FIRST_PACKET_VAL 60 /* First UDP packet */ 82145836Smlaier#define PFTM_UDP_SINGLE_VAL 30 /* Unidirectional */ 83145836Smlaier#define PFTM_UDP_MULTIPLE_VAL 60 /* Bidirectional */ 84145836Smlaier#define PFTM_ICMP_FIRST_PACKET_VAL 20 /* First ICMP packet */ 85145836Smlaier#define PFTM_ICMP_ERROR_REPLY_VAL 10 /* Got error response */ 86145836Smlaier#define PFTM_OTHER_FIRST_PACKET_VAL 60 /* First packet */ 87145836Smlaier#define PFTM_OTHER_SINGLE_VAL 30 /* Unidirectional */ 88145836Smlaier#define PFTM_OTHER_MULTIPLE_VAL 60 /* Bidirectional */ 89145836Smlaier#define PFTM_FRAG_VAL 30 /* Fragment expire */ 90145836Smlaier#define PFTM_INTERVAL_VAL 10 /* Expire interval */ 91145836Smlaier#define PFTM_SRC_NODE_VAL 0 /* Source tracking */ 92145836Smlaier#define PFTM_TS_DIFF_VAL 30 /* Allowed TS diff */ 93145836Smlaier 94126258Smlaierenum { PF_NOPFROUTE, PF_FASTROUTE, PF_ROUTETO, PF_DUPTO, PF_REPLYTO }; 95171168Smlaierenum { PF_LIMIT_STATES, PF_LIMIT_SRC_NODES, PF_LIMIT_FRAGS, 96240233Sglebius PF_LIMIT_TABLE_ENTRIES, PF_LIMIT_MAX }; 97126258Smlaier#define PF_POOL_IDMASK 0x0f 98126258Smlaierenum { PF_POOL_NONE, PF_POOL_BITMASK, PF_POOL_RANDOM, 99126258Smlaier PF_POOL_SRCHASH, PF_POOL_ROUNDROBIN }; 100126258Smlaierenum { PF_ADDR_ADDRMASK, PF_ADDR_NOROUTE, PF_ADDR_DYNIFTL, 101240233Sglebius PF_ADDR_TABLE, PF_ADDR_URPFFAILED, 102223637Sbz PF_ADDR_RANGE }; 103126258Smlaier#define PF_POOL_TYPEMASK 0x0f 104130613Smlaier#define PF_POOL_STICKYADDR 0x20 105126258Smlaier#define PF_WSCALE_FLAG 0x80 106126258Smlaier#define PF_WSCALE_MASK 0x0f 107126258Smlaier 108171168Smlaier#define PF_LOG 0x01 109171168Smlaier#define PF_LOG_ALL 0x02 110171168Smlaier#define PF_LOG_SOCKET_LOOKUP 0x04 111171168Smlaier 112126258Smlaier/* Reasons code for passing/dropping a packet */ 113126258Smlaier#define PFRES_MATCH 0 /* Explicit match of a rule */ 114126258Smlaier#define PFRES_BADOFF 1 /* Bad offset for pull_hdr */ 115126258Smlaier#define PFRES_FRAG 2 /* Dropping following fragment */ 116126258Smlaier#define PFRES_SHORT 3 /* Dropping short packet */ 117126258Smlaier#define PFRES_NORM 4 /* Dropping by normalizer */ 118126258Smlaier#define PFRES_MEMORY 5 /* Dropped due to lacking mem */ 119145836Smlaier#define PFRES_TS 6 /* Bad TCP Timestamp (RFC1323) */ 120145836Smlaier#define PFRES_CONGEST 7 /* Congestion (of ipintrq) */ 121145836Smlaier#define PFRES_IPOPTIONS 8 /* IP option */ 122145836Smlaier#define PFRES_PROTCKSUM 9 /* Protocol checksum invalid */ 123145836Smlaier#define PFRES_BADSTATE 10 /* State mismatch */ 124145836Smlaier#define PFRES_STATEINS 11 /* State insertion failure */ 125145836Smlaier#define PFRES_MAXSTATES 12 /* State limit */ 126145836Smlaier#define PFRES_SRCLIMIT 13 /* Source node/conn limit */ 127145836Smlaier#define PFRES_SYNPROXY 14 /* SYN proxy */ 128270925Sglebius#define PFRES_MAX 15 /* total+1 */ 129126258Smlaier 130126258Smlaier#define PFRES_NAMES { \ 131126258Smlaier "match", \ 132126258Smlaier "bad-offset", \ 133126258Smlaier "fragment", \ 134126258Smlaier "short", \ 135126258Smlaier "normalize", \ 136126258Smlaier "memory", \ 137145836Smlaier "bad-timestamp", \ 138145836Smlaier "congestion", \ 139145836Smlaier "ip-option", \ 140145836Smlaier "proto-cksum", \ 141145836Smlaier "state-mismatch", \ 142145836Smlaier "state-insert", \ 143145836Smlaier "state-limit", \ 144145836Smlaier "src-limit", \ 145145836Smlaier "synproxy", \ 146126258Smlaier NULL \ 147126258Smlaier} 148126258Smlaier 149270574Sglebius/* Counters for other things we want to keep track of */ 150270574Sglebius#define LCNT_STATES 0 /* states */ 151270574Sglebius#define LCNT_SRCSTATES 1 /* max-src-states */ 152270574Sglebius#define LCNT_SRCNODES 2 /* max-src-nodes */ 153270574Sglebius#define LCNT_SRCCONN 3 /* max-src-conn */ 154270574Sglebius#define LCNT_SRCCONNRATE 4 /* max-src-conn-rate */ 155270574Sglebius#define LCNT_OVERLOAD_TABLE 5 /* entry added to overload table */ 156270574Sglebius#define LCNT_OVERLOAD_FLUSH 6 /* state entries flushed */ 157270574Sglebius#define LCNT_MAX 7 /* total+1 */ 158270574Sglebius 159270574Sglebius#define LCNT_NAMES { \ 160270574Sglebius "max states per rule", \ 161270574Sglebius "max-src-states", \ 162270574Sglebius "max-src-nodes", \ 163270574Sglebius "max-src-conn", \ 164270574Sglebius "max-src-conn-rate", \ 165270574Sglebius "overload table insertion", \ 166270574Sglebius "overload flush states", \ 167270574Sglebius NULL \ 168270574Sglebius} 169270574Sglebius 170270574Sglebius/* state operation counters */ 171270574Sglebius#define FCNT_STATE_SEARCH 0 172270574Sglebius#define FCNT_STATE_INSERT 1 173270574Sglebius#define FCNT_STATE_REMOVALS 2 174270574Sglebius#define FCNT_MAX 3 175270574Sglebius 176270574Sglebius/* src_node operation counters */ 177270574Sglebius#define SCNT_SRC_NODE_SEARCH 0 178270574Sglebius#define SCNT_SRC_NODE_INSERT 1 179270574Sglebius#define SCNT_SRC_NODE_REMOVALS 2 180270574Sglebius#define SCNT_MAX 3 181270574Sglebius 182257186Sglebius#define PF_TABLE_NAME_SIZE 32 183257186Sglebius#define PF_QNAME_SIZE 64 184145836Smlaier 185270574Sglebiusstruct pf_status { 186270574Sglebius uint64_t counters[PFRES_MAX]; 187270574Sglebius uint64_t lcounters[LCNT_MAX]; 188270574Sglebius uint64_t fcounters[FCNT_MAX]; 189270574Sglebius uint64_t scounters[SCNT_MAX]; 190270574Sglebius uint64_t pcounters[2][2][3]; 191270574Sglebius uint64_t bcounters[2][2]; 192270574Sglebius uint32_t running; 193270574Sglebius uint32_t states; 194270574Sglebius uint32_t src_nodes; 195270574Sglebius uint32_t since; 196270574Sglebius uint32_t debug; 197270574Sglebius uint32_t hostid; 198270574Sglebius char ifname[IFNAMSIZ]; 199270574Sglebius uint8_t pf_chksum[PF_MD5_DIGEST_LENGTH]; 200270574Sglebius}; 201270574Sglebius 202257186Sglebius#endif /* _NET_PF_H_ */ 203