1/*	$OpenBSD: pfctl_parser.h,v 1.86 2006/10/31 23:46:25 mcbride Exp $ */
2
3/*-
4 * SPDX-License-Identifier: BSD-2-Clause
5 *
6 * Copyright (c) 2001 Daniel Hartmeier
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 *
13 *    - Redistributions of source code must retain the above copyright
14 *      notice, this list of conditions and the following disclaimer.
15 *    - Redistributions in binary form must reproduce the above
16 *      copyright notice, this list of conditions and the following
17 *      disclaimer in the documentation and/or other materials provided
18 *      with the distribution.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
24 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
27 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
28 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
30 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31 * POSSIBILITY OF SUCH DAMAGE.
32 *
33 * $FreeBSD$
34 */
35
36#ifndef _PFCTL_PARSER_H_
37#define _PFCTL_PARSER_H_
38
39#include <libpfctl.h>
40
41#define PF_OSFP_FILE		"/etc/pf.os"
42
43#define PF_OPT_DISABLE		0x0001
44#define PF_OPT_ENABLE		0x0002
45#define PF_OPT_VERBOSE		0x0004
46#define PF_OPT_NOACTION		0x0008
47#define PF_OPT_QUIET		0x0010
48#define PF_OPT_CLRRULECTRS	0x0020
49#define PF_OPT_USEDNS		0x0040
50#define PF_OPT_VERBOSE2		0x0080
51#define PF_OPT_DUMMYACTION	0x0100
52#define PF_OPT_DEBUG		0x0200
53#define PF_OPT_SHOWALL		0x0400
54#define PF_OPT_OPTIMIZE		0x0800
55#define PF_OPT_NUMERIC		0x1000
56#define PF_OPT_MERGE		0x2000
57#define PF_OPT_RECURSE		0x4000
58#define PF_OPT_KILLMATCH	0x8000
59
60#define PF_TH_ALL		0xFF
61
62#define PF_NAT_PROXY_PORT_LOW	50001
63#define PF_NAT_PROXY_PORT_HIGH	65535
64
65#define PF_OPTIMIZE_BASIC	0x0001
66#define PF_OPTIMIZE_PROFILE	0x0002
67
68#define FCNT_NAMES { \
69	"searches", \
70	"inserts", \
71	"removals", \
72	NULL \
73}
74
75struct pfr_buffer;	/* forward definition */
76
77
78struct pfctl {
79	int dev;
80	int opts;
81	int optimize;
82	int loadopt;
83	int asd;			/* anchor stack depth */
84	int bn;				/* brace number */
85	int brace;
86	int tdirty;			/* kernel dirty */
87#define PFCTL_ANCHOR_STACK_DEPTH 64
88	struct pfctl_anchor *astack[PFCTL_ANCHOR_STACK_DEPTH];
89	struct pfioc_pooladdr paddr;
90	struct pfioc_altq *paltq;
91	struct pfioc_queue *pqueue;
92	struct pfr_buffer *trans;
93	struct pfctl_anchor *anchor, *alast;
94	const char *ruleset;
95
96	/* 'set foo' options */
97	u_int32_t	 timeout[PFTM_MAX];
98	u_int32_t	 limit[PF_LIMIT_MAX];
99	u_int32_t	 debug;
100	u_int32_t	 hostid;
101	char		*ifname;
102	bool		 keep_counters;
103
104	u_int8_t	 timeout_set[PFTM_MAX];
105	u_int8_t	 limit_set[PF_LIMIT_MAX];
106	u_int8_t	 debug_set;
107	u_int8_t	 hostid_set;
108	u_int8_t	 ifname_set;
109};
110
111struct node_if {
112	char			 ifname[IFNAMSIZ];
113	u_int8_t		 not;
114	u_int8_t		 dynamic; /* antispoof */
115	u_int			 ifa_flags;
116	struct node_if		*next;
117	struct node_if		*tail;
118};
119
120struct node_host {
121	struct pf_addr_wrap	 addr;
122	struct pf_addr		 bcast;
123	struct pf_addr		 peer;
124	sa_family_t		 af;
125	u_int8_t		 not;
126	u_int32_t		 ifindex;	/* link-local IPv6 addrs */
127	char			*ifname;
128	u_int			 ifa_flags;
129	struct node_host	*next;
130	struct node_host	*tail;
131};
132
133struct node_os {
134	char			*os;
135	pf_osfp_t		 fingerprint;
136	struct node_os		*next;
137	struct node_os		*tail;
138};
139
140struct node_queue_bw {
141	u_int64_t	bw_absolute;
142	u_int16_t	bw_percent;
143};
144
145struct node_hfsc_sc {
146	struct node_queue_bw	m1;	/* slope of 1st segment; bps */
147	u_int			d;	/* x-projection of m1; msec */
148	struct node_queue_bw	m2;	/* slope of 2nd segment; bps */
149	u_int8_t		used;
150};
151
152struct node_hfsc_opts {
153	struct node_hfsc_sc	realtime;
154	struct node_hfsc_sc	linkshare;
155	struct node_hfsc_sc	upperlimit;
156	int			flags;
157};
158
159struct node_fairq_sc {
160	struct node_queue_bw	m1;	/* slope of 1st segment; bps */
161	u_int			d;	/* x-projection of m1; msec */
162	struct node_queue_bw	m2;	/* slope of 2nd segment; bps */
163	u_int8_t		used;
164};
165
166struct node_fairq_opts {
167	struct node_fairq_sc	linkshare;
168	struct node_queue_bw	hogs_bw;
169	u_int			nbuckets;
170	int			flags;
171};
172
173struct node_queue_opt {
174	int			 qtype;
175	union {
176		struct cbq_opts		cbq_opts;
177		struct codel_opts	codel_opts;
178		struct priq_opts	priq_opts;
179		struct node_hfsc_opts	hfsc_opts;
180		struct node_fairq_opts	fairq_opts;
181	}			 data;
182};
183
184#define QPRI_BITSET_SIZE	256
185BITSET_DEFINE(qpri_bitset, QPRI_BITSET_SIZE);
186LIST_HEAD(gen_sc, segment);
187
188struct pfctl_altq {
189	struct pf_altq	pa;
190	struct {
191		STAILQ_ENTRY(pfctl_altq)	link;
192		u_int64_t			bwsum;
193		struct qpri_bitset		qpris;
194		int				children;
195		int				root_classes;
196		int				default_classes;
197		struct gen_sc			lssc;
198		struct gen_sc			rtsc;
199	} meta;
200};
201
202#ifdef __FreeBSD__
203/*
204 * XXX
205 * Absolutely this is not correct location to define this.
206 * Should we use an another sperate header file?
207 */
208#define	SIMPLEQ_HEAD			STAILQ_HEAD
209#define	SIMPLEQ_HEAD_INITIALIZER	STAILQ_HEAD_INITIALIZER
210#define	SIMPLEQ_ENTRY			STAILQ_ENTRY
211#define	SIMPLEQ_FIRST			STAILQ_FIRST
212#define	SIMPLEQ_END(head)		NULL
213#define	SIMPLEQ_EMPTY			STAILQ_EMPTY
214#define	SIMPLEQ_NEXT			STAILQ_NEXT
215/*#define	SIMPLEQ_FOREACH			STAILQ_FOREACH*/
216#define	SIMPLEQ_FOREACH(var, head, field)		\
217    for((var) = SIMPLEQ_FIRST(head);			\
218	(var) != SIMPLEQ_END(head);			\
219	(var) = SIMPLEQ_NEXT(var, field))
220#define	SIMPLEQ_INIT			STAILQ_INIT
221#define	SIMPLEQ_INSERT_HEAD		STAILQ_INSERT_HEAD
222#define	SIMPLEQ_INSERT_TAIL		STAILQ_INSERT_TAIL
223#define	SIMPLEQ_INSERT_AFTER		STAILQ_INSERT_AFTER
224#define	SIMPLEQ_REMOVE_HEAD		STAILQ_REMOVE_HEAD
225#endif
226SIMPLEQ_HEAD(node_tinithead, node_tinit);
227struct node_tinit {	/* table initializer */
228	SIMPLEQ_ENTRY(node_tinit)	 entries;
229	struct node_host		*host;
230	char				*file;
231};
232
233
234/* optimizer created tables */
235struct pf_opt_tbl {
236	char			 pt_name[PF_TABLE_NAME_SIZE];
237	int			 pt_rulecount;
238	int			 pt_generated;
239	struct node_tinithead	 pt_nodes;
240	struct pfr_buffer	*pt_buf;
241};
242#define PF_OPT_TABLE_PREFIX	"__automatic_"
243
244/* optimizer pf_rule container */
245struct pf_opt_rule {
246	struct pfctl_rule	 por_rule;
247	struct pf_opt_tbl	*por_src_tbl;
248	struct pf_opt_tbl	*por_dst_tbl;
249	u_int64_t		 por_profile_count;
250	TAILQ_ENTRY(pf_opt_rule) por_entry;
251	TAILQ_ENTRY(pf_opt_rule) por_skip_entry[PF_SKIP_COUNT];
252};
253
254TAILQ_HEAD(pf_opt_queue, pf_opt_rule);
255
256int	pfctl_rules(int, char *, int, int, char *, struct pfr_buffer *);
257int	pfctl_optimize_ruleset(struct pfctl *, struct pfctl_ruleset *);
258
259int	pfctl_append_rule(struct pfctl *, struct pfctl_rule *, const char *);
260int	pfctl_add_altq(struct pfctl *, struct pf_altq *);
261int	pfctl_add_pool(struct pfctl *, struct pfctl_pool *, sa_family_t);
262void	pfctl_move_pool(struct pfctl_pool *, struct pfctl_pool *);
263void	pfctl_clear_pool(struct pfctl_pool *);
264
265int	pfctl_set_timeout(struct pfctl *, const char *, int, int);
266int	pfctl_set_optimization(struct pfctl *, const char *);
267int	pfctl_set_limit(struct pfctl *, const char *, unsigned int);
268int	pfctl_set_logif(struct pfctl *, char *);
269int	pfctl_set_hostid(struct pfctl *, u_int32_t);
270int	pfctl_set_debug(struct pfctl *, char *);
271int	pfctl_set_interface_flags(struct pfctl *, char *, int, int);
272
273int	parse_config(char *, struct pfctl *);
274int	parse_flags(char *);
275int	pfctl_load_anchors(int, struct pfctl *, struct pfr_buffer *);
276
277void	print_pool(struct pfctl_pool *, u_int16_t, u_int16_t, sa_family_t, int);
278void	print_src_node(struct pf_src_node *, int);
279void	print_rule(struct pfctl_rule *, const char *, int, int);
280void	print_tabledef(const char *, int, int, struct node_tinithead *);
281void	print_status(struct pf_status *, int);
282void	print_running(struct pf_status *);
283
284int	eval_pfaltq(struct pfctl *, struct pf_altq *, struct node_queue_bw *,
285	    struct node_queue_opt *);
286int	eval_pfqueue(struct pfctl *, struct pf_altq *, struct node_queue_bw *,
287	    struct node_queue_opt *);
288
289void	 print_altq(const struct pf_altq *, unsigned, struct node_queue_bw *,
290	    struct node_queue_opt *);
291void	 print_queue(const struct pf_altq *, unsigned, struct node_queue_bw *,
292	    int, struct node_queue_opt *);
293
294int	pfctl_define_table(char *, int, int, const char *, struct pfr_buffer *,
295	    u_int32_t);
296
297void		 pfctl_clear_fingerprints(int, int);
298int		 pfctl_file_fingerprints(int, int, const char *);
299pf_osfp_t	 pfctl_get_fingerprint(const char *);
300int		 pfctl_load_fingerprints(int, int);
301char		*pfctl_lookup_fingerprint(pf_osfp_t, char *, size_t);
302void		 pfctl_show_fingerprints(int);
303
304
305struct icmptypeent {
306	const char *name;
307	u_int8_t type;
308};
309
310struct icmpcodeent {
311	const char *name;
312	u_int8_t type;
313	u_int8_t code;
314};
315
316const struct icmptypeent *geticmptypebynumber(u_int8_t, u_int8_t);
317const struct icmptypeent *geticmptypebyname(char *, u_int8_t);
318const struct icmpcodeent *geticmpcodebynumber(u_int8_t, u_int8_t, u_int8_t);
319const struct icmpcodeent *geticmpcodebyname(u_long, char *, u_int8_t);
320
321struct pf_timeout {
322	const char	*name;
323	int		 timeout;
324};
325
326#define PFCTL_FLAG_FILTER	0x02
327#define PFCTL_FLAG_NAT		0x04
328#define PFCTL_FLAG_OPTION	0x08
329#define PFCTL_FLAG_ALTQ		0x10
330#define PFCTL_FLAG_TABLE	0x20
331
332extern const struct pf_timeout pf_timeouts[];
333
334void			 set_ipmask(struct node_host *, u_int8_t);
335int			 check_netmask(struct node_host *, sa_family_t);
336int			 unmask(struct pf_addr *, sa_family_t);
337void			 ifa_load(void);
338int			 get_query_socket(void);
339struct node_host	*ifa_exists(char *);
340struct node_host	*ifa_grouplookup(char *ifa_name, int flags);
341struct node_host	*ifa_lookup(char *, int);
342struct node_host	*host(const char *);
343
344int			 append_addr(struct pfr_buffer *, char *, int);
345int			 append_addr_host(struct pfr_buffer *,
346			    struct node_host *, int, int);
347
348#endif /* _PFCTL_PARSER_H_ */
349