1/*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2001 Michael Shalayeff
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR OR HIS RELATIVES BE LIABLE FOR ANY DIRECT,
20 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
21 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
22 * SERVICES; LOSS OF MIND, USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
24 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
25 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
26 * THE POSSIBILITY OF SUCH DAMAGE.
27 */
28
29/*-
30 * Copyright (c) 2008 David Gwynne <dlg@openbsd.org>
31 *
32 * Permission to use, copy, modify, and distribute this software for any
33 * purpose with or without fee is hereby granted, provided that the above
34 * copyright notice and this permission notice appear in all copies.
35 *
36 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
37 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
38 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
39 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
40 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
41 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
42 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
43 */
44
45/*
46 *	$OpenBSD: if_pfsync.h,v 1.35 2008/06/29 08:42:15 mcbride Exp $
47 */
48
49#ifndef _NET_IF_PFSYNC_H_
50#define	_NET_IF_PFSYNC_H_
51
52#include <sys/types.h>
53
54#include <net/if.h>
55#include <net/pfvar.h>
56#include <netpfil/pf/pf.h>
57
58#define	PFSYNC_VERSION		5
59#define	PFSYNC_DFLTTL		255
60
61enum pfsync_msg_versions {
62	PFSYNC_MSG_VERSION_UNSPECIFIED = 0,
63	PFSYNC_MSG_VERSION_1301 = 1301,
64	PFSYNC_MSG_VERSION_1400 = 1400,
65};
66
67#define PFSYNC_MSG_VERSION_DEFAULT PFSYNC_MSG_VERSION_1400
68
69#define	PFSYNC_ACT_CLR		0	/* clear all states */
70#define	PFSYNC_ACT_INS_1301	1	/* insert state */
71#define	PFSYNC_ACT_INS_ACK	2	/* ack of inserted state */
72#define	PFSYNC_ACT_UPD_1301	3	/* update state */
73#define	PFSYNC_ACT_UPD_C	4	/* "compressed" update state */
74#define	PFSYNC_ACT_UPD_REQ	5	/* request "uncompressed" state */
75#define	PFSYNC_ACT_DEL		6	/* delete state */
76#define	PFSYNC_ACT_DEL_C	7	/* "compressed" delete state */
77#define	PFSYNC_ACT_INS_F	8	/* insert fragment */
78#define	PFSYNC_ACT_DEL_F	9	/* delete fragments */
79#define	PFSYNC_ACT_BUS		10	/* bulk update status */
80#define	PFSYNC_ACT_TDB		11	/* TDB replay counter update */
81#define	PFSYNC_ACT_EOF		12	/* end of frame */
82#define PFSYNC_ACT_INS_1400	13	/* insert state */
83#define PFSYNC_ACT_UPD_1400	14	/* update state */
84#define	PFSYNC_ACT_MAX		15
85
86/*
87 * A pfsync frame is built from a header followed by several sections which
88 * are all prefixed with their own subheaders. Frames must be terminated with
89 * an EOF subheader.
90 *
91 * | ...			|
92 * | IP header			|
93 * +============================+
94 * | pfsync_header		|
95 * +----------------------------+
96 * | pfsync_subheader		|
97 * +----------------------------+
98 * | first action fields	|
99 * | ...			|
100 * +----------------------------+
101 * | pfsync_subheader		|
102 * +----------------------------+
103 * | second action fields	|
104 * | ...			|
105 * +----------------------------+
106 * | EOF pfsync_subheader	|
107 * +----------------------------+
108 * | HMAC			|
109 * +============================+
110 */
111
112/*
113 * Frame header
114 */
115
116struct pfsync_header {
117	u_int8_t			version;
118	u_int8_t			_pad;
119	u_int16_t			len;
120	u_int8_t			pfcksum[PF_MD5_DIGEST_LENGTH];
121} __packed;
122
123/*
124 * Frame region subheader
125 */
126
127struct pfsync_subheader {
128	u_int8_t			action;
129	u_int8_t			_pad;
130	u_int16_t			count;
131} __packed;
132
133/*
134 * CLR
135 */
136
137struct pfsync_clr {
138	char				ifname[IFNAMSIZ];
139	u_int32_t			creatorid;
140} __packed;
141
142/*
143 * INS, UPD, DEL
144 */
145
146/* these use struct pfsync_state in pfvar.h */
147
148/*
149 * INS_ACK
150 */
151
152struct pfsync_ins_ack {
153	u_int64_t			id;
154	u_int32_t			creatorid;
155} __packed;
156
157/*
158 * UPD_C
159 */
160
161struct pfsync_upd_c {
162	u_int64_t			id;
163	struct pfsync_state_peer	src;
164	struct pfsync_state_peer	dst;
165	u_int32_t			creatorid;
166	u_int32_t			expire;
167	u_int8_t			timeout;
168	u_int8_t			_pad[3];
169} __packed;
170
171/*
172 * UPD_REQ
173 */
174
175struct pfsync_upd_req {
176	u_int64_t			id;
177	u_int32_t			creatorid;
178} __packed;
179
180/*
181 * DEL_C
182 */
183
184struct pfsync_del_c {
185	u_int64_t			id;
186	u_int32_t			creatorid;
187} __packed;
188
189/*
190 * INS_F, DEL_F
191 */
192
193/* not implemented (yet) */
194
195/*
196 * BUS
197 */
198
199struct pfsync_bus {
200	u_int32_t			creatorid;
201	u_int32_t			endtime;
202	u_int8_t			status;
203#define	PFSYNC_BUS_START			1
204#define	PFSYNC_BUS_END				2
205	u_int8_t			_pad[3];
206} __packed;
207
208/*
209 * TDB
210 */
211
212struct pfsync_tdb {
213	u_int32_t			spi;
214	union sockaddr_union		dst;
215	u_int32_t			rpl;
216	u_int64_t			cur_bytes;
217	u_int8_t			sproto;
218	u_int8_t			updates;
219	u_int8_t			_pad[2];
220} __packed;
221
222#define	PFSYNC_HDRLEN		sizeof(struct pfsync_header)
223
224struct pfsyncstats {
225	u_int64_t	pfsyncs_ipackets;	/* total input packets, IPv4 */
226	u_int64_t	pfsyncs_ipackets6;	/* total input packets, IPv6 */
227	u_int64_t	pfsyncs_badif;		/* not the right interface */
228	u_int64_t	pfsyncs_badttl;		/* TTL is not PFSYNC_DFLTTL */
229	u_int64_t	pfsyncs_hdrops;		/* packets shorter than hdr */
230	u_int64_t	pfsyncs_badver;		/* bad (incl unsupp) version */
231	u_int64_t	pfsyncs_badact;		/* bad action */
232	u_int64_t	pfsyncs_badlen;		/* data length does not match */
233	u_int64_t	pfsyncs_badauth;	/* bad authentication */
234	u_int64_t	pfsyncs_stale;		/* stale state */
235	u_int64_t	pfsyncs_badval;		/* bad values */
236	u_int64_t	pfsyncs_badstate;	/* insert/lookup failed */
237
238	u_int64_t	pfsyncs_opackets;	/* total output packets, IPv4 */
239	u_int64_t	pfsyncs_opackets6;	/* total output packets, IPv6 */
240	u_int64_t	pfsyncs_onomem;		/* no memory for an mbuf */
241	u_int64_t	pfsyncs_oerrors;	/* ip output error */
242
243	u_int64_t	pfsyncs_iacts[PFSYNC_ACT_MAX];
244	u_int64_t	pfsyncs_oacts[PFSYNC_ACT_MAX];
245};
246
247/*
248 * Configuration structure for SIOCSETPFSYNC SIOCGETPFSYNC
249 */
250struct pfsyncreq {
251	char		 pfsyncr_syncdev[IFNAMSIZ];
252	struct in_addr	 pfsyncr_syncpeer;
253	int		 pfsyncr_maxupdates;
254#define	PFSYNCF_OK		0x00000001
255#define	PFSYNCF_DEFER		0x00000002
256	int		 pfsyncr_defer;
257};
258
259struct pfsync_kstatus {
260	char		 	syncdev[IFNAMSIZ];
261	struct sockaddr_storage	syncpeer;
262	int		 	maxupdates;
263	int			version;
264	int		 	flags;
265};
266
267struct pfsyncioc_nv {
268	void            *data;
269	size_t           len;   /* The length of the nvlist data. */
270	size_t           size;  /* The total size of the data buffer. */
271};
272
273#define	SIOCSETPFSYNC   _IOW('i', 247, struct ifreq)
274#define	SIOCGETPFSYNC   _IOWR('i', 248, struct ifreq)
275#define	SIOCSETPFSYNCNV _IOW('i', 249, struct ifreq)
276#define	SIOCGETPFSYNCNV _IOWR('i', 250, struct ifreq)
277
278#ifdef _KERNEL
279
280/*
281 * this shows where a pf state is with respect to the syncing.
282 * pf_kstate->sync_state
283 */
284#define	PFSYNC_S_INS	0x00
285#define	PFSYNC_S_IACK	0x01
286#define	PFSYNC_S_UPD	0x02
287#define	PFSYNC_S_UPD_C	0x03
288#define	PFSYNC_S_DEL_C	0x04
289
290#define	PFSYNC_S_DEFER	0xfe
291#define	PFSYNC_S_NONE	0xff
292
293#define	PFSYNC_SI_IOCTL		0x01
294#define	PFSYNC_SI_CKSUM		0x02
295#define	PFSYNC_SI_ACK		0x04
296
297#endif /* _KERNEL */
298
299#endif /* _NET_IF_PFSYNC_H_ */
300