1/* $NetBSD: pfil.h,v 1.22 2003/06/23 12:57:08 martin Exp $ */ 2 3/*- 4 * SPDX-License-Identifier: BSD-3-Clause 5 * 6 * Copyright (c) 2019 Gleb Smirnoff <glebius@FreeBSD.org> 7 * Copyright (c) 1996 Matthew R. Green 8 * All rights reserved. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 3. The name of the author may not be used to endorse or promote products 19 * derived from this software without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 22 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 23 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 24 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 26 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 27 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 28 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 29 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34#ifndef _NET_PFIL_H_ 35#define _NET_PFIL_H_ 36 37#include <sys/ioccom.h> 38 39enum pfil_types { 40 PFIL_TYPE_IP4, 41 PFIL_TYPE_IP6, 42 PFIL_TYPE_ETHERNET, 43}; 44 45#define MAXPFILNAME 64 46 47struct pfilioc_head { 48 char pio_name[MAXPFILNAME]; 49 int pio_nhooksin; 50 int pio_nhooksout; 51 enum pfil_types pio_type; 52}; 53 54struct pfilioc_hook { 55 char pio_module[MAXPFILNAME]; 56 char pio_ruleset[MAXPFILNAME]; 57 int pio_flags; 58 enum pfil_types pio_type; 59}; 60 61struct pfilioc_list { 62 u_int pio_nheads; 63 u_int pio_nhooks; 64 struct pfilioc_head *pio_heads; 65 struct pfilioc_hook *pio_hooks; 66}; 67 68struct pfilioc_link { 69 char pio_name[MAXPFILNAME]; 70 char pio_module[MAXPFILNAME]; 71 char pio_ruleset[MAXPFILNAME]; 72 int pio_flags; 73}; 74 75#define PFILDEV "pfil" 76#define PFILIOC_LISTHEADS _IOWR('P', 1, struct pfilioc_list) 77#define PFILIOC_LISTHOOKS _IOWR('P', 2, struct pfilioc_list) 78#define PFILIOC_LINK _IOW('P', 3, struct pfilioc_link) 79 80#define PFIL_IN 0x00010000 81#define PFIL_OUT 0x00020000 82#define PFIL_FWD 0x00040000 83#define PFIL_DIR(f) ((f) & (PFIL_IN|PFIL_OUT)) 84#define PFIL_HEADPTR 0x00100000 85#define PFIL_HOOKPTR 0x00200000 86#define PFIL_APPEND 0x00400000 87#define PFIL_UNLINK 0x00800000 88 89#ifdef _KERNEL 90struct mbuf; 91struct ifnet; 92struct inpcb; 93 94typedef enum { 95 PFIL_PASS = 0, 96 PFIL_DROPPED, 97 PFIL_CONSUMED, 98 PFIL_REALLOCED, 99} pfil_return_t; 100 101typedef pfil_return_t (*pfil_mbuf_chk_t)(struct mbuf **, struct ifnet *, int, 102 void *, struct inpcb *); 103typedef pfil_return_t (*pfil_mem_chk_t)(void *, u_int, int, struct ifnet *, 104 void *, struct mbuf **); 105 106/* 107 * A pfil head is created by a packet intercept point. 108 * 109 * A pfil hook is created by a packet filter. 110 * 111 * Hooks are chained on heads. Historically some hooking happens 112 * automatically, e.g. ipfw(4), pf(4) and ipfilter(4) would register 113 * theirselves on IPv4 and IPv6 input/output. 114 */ 115 116typedef struct pfil_hook * pfil_hook_t; 117typedef struct pfil_head * pfil_head_t; 118 119/* 120 * Give us a chance to modify pfil_xxx_args structures in future. 121 */ 122#define PFIL_VERSION 2 123 124/* Argument structure used by packet filters to register themselves. */ 125struct pfil_hook_args { 126 int pa_version; 127 int pa_flags; 128 enum pfil_types pa_type; 129 pfil_mbuf_chk_t pa_mbuf_chk; 130 pfil_mem_chk_t pa_mem_chk; 131 void *pa_ruleset; 132 const char *pa_modname; 133 const char *pa_rulname; 134}; 135 136/* Public functions for pfil hook management by packet filters. */ 137pfil_hook_t pfil_add_hook(struct pfil_hook_args *); 138void pfil_remove_hook(pfil_hook_t); 139 140/* Argument structure used by ioctl() and packet filters to set filters. */ 141struct pfil_link_args { 142 int pa_version; 143 int pa_flags; 144 union { 145 const char *pa_headname; 146 pfil_head_t pa_head; 147 }; 148 union { 149 struct { 150 const char *pa_modname; 151 const char *pa_rulname; 152 }; 153 pfil_hook_t pa_hook; 154 }; 155}; 156 157/* Public function to configure filter chains. Used by ioctl() and filters. */ 158int pfil_link(struct pfil_link_args *); 159 160/* Argument structure used by inspection points to register themselves. */ 161struct pfil_head_args { 162 int pa_version; 163 int pa_flags; 164 enum pfil_types pa_type; 165 const char *pa_headname; 166}; 167 168/* Public functions for pfil head management by inspection points. */ 169pfil_head_t pfil_head_register(struct pfil_head_args *); 170void pfil_head_unregister(pfil_head_t); 171 172/* Public functions to run the packet inspection by inspection points. */ 173int pfil_mem_in(struct pfil_head *, void *, u_int, struct ifnet *, 174 struct mbuf **); 175int pfil_mem_out(struct pfil_head *, void *, u_int, struct ifnet *, 176 struct mbuf **); 177int pfil_mbuf_in(struct pfil_head *, struct mbuf **, struct ifnet *, 178 struct inpcb *inp); 179int pfil_mbuf_out(struct pfil_head *, struct mbuf **, struct ifnet *, 180 struct inpcb *inp); 181int pfil_mbuf_fwd(struct pfil_head *, struct mbuf **, struct ifnet *, 182 struct inpcb *); 183 184/* 185 * Minimally exposed structure to avoid function call in case of absence 186 * of any filters by protocols and macros to do the check. 187 */ 188struct _pfil_head { 189 int head_nhooksin; 190 int head_nhooksout; 191}; 192#define PFIL_HOOKED_IN(p) (((struct _pfil_head *)(p))->head_nhooksin > 0) 193#define PFIL_HOOKED_OUT(p) (((struct _pfil_head *)(p))->head_nhooksout > 0) 194 195#endif /* _KERNEL */ 196#endif /* _NET_PFIL_H_ */ 197