1/*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2001 Daniel Hartmeier 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 11 * - Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * - Redistributions in binary form must reproduce the above 14 * copyright notice, this list of conditions and the following 15 * disclaimer in the documentation and/or other materials provided 16 * with the distribution. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 19 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 20 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 21 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 22 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 24 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 25 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 26 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 28 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 * 31 * $OpenBSD: pfvar.h,v 1.282 2009/01/29 15:12:28 pyr Exp $ 32 */ 33 34#ifndef _NET_PF_H_ 35#define _NET_PF_H_ 36 37#include <sys/tree.h> 38 39#define PF_TCPS_PROXY_SRC ((TCP_NSTATES)+0) 40#define PF_TCPS_PROXY_DST ((TCP_NSTATES)+1) 41 42#define PF_MD5_DIGEST_LENGTH 16 43#ifdef MD5_DIGEST_LENGTH 44#if PF_MD5_DIGEST_LENGTH != MD5_DIGEST_LENGTH 45#error 46#endif 47#endif 48 49enum { PF_INOUT, PF_IN, PF_OUT }; 50enum { PF_PASS, PF_DROP, PF_SCRUB, PF_NOSCRUB, PF_NAT, PF_NONAT, 51 PF_BINAT, PF_NOBINAT, PF_RDR, PF_NORDR, PF_SYNPROXY_DROP, PF_DEFER, 52 PF_MATCH }; 53enum { PF_RULESET_SCRUB, PF_RULESET_FILTER, PF_RULESET_NAT, 54 PF_RULESET_BINAT, PF_RULESET_RDR, PF_RULESET_MAX }; 55enum { PF_OP_NONE, PF_OP_IRG, PF_OP_EQ, PF_OP_NE, PF_OP_LT, 56 PF_OP_LE, PF_OP_GT, PF_OP_GE, PF_OP_XRG, PF_OP_RRG }; 57enum { PF_DEBUG_NONE, PF_DEBUG_URGENT, PF_DEBUG_MISC, PF_DEBUG_NOISY }; 58enum { PF_CHANGE_NONE, PF_CHANGE_ADD_HEAD, PF_CHANGE_ADD_TAIL, 59 PF_CHANGE_ADD_BEFORE, PF_CHANGE_ADD_AFTER, 60 PF_CHANGE_REMOVE, PF_CHANGE_GET_TICKET }; 61enum { PF_GET_NONE, PF_GET_CLR_CNTR }; 62enum { PF_SK_WIRE, PF_SK_STACK, PF_SK_BOTH }; 63enum { PF_PEER_SRC, PF_PEER_DST, PF_PEER_BOTH }; 64 65/* 66 * Note about PFTM_*: real indices into pf_rule.timeout[] come before 67 * PFTM_MAX, special cases afterwards. See pf_state_expires(). 68 */ 69enum { 70 PFTM_TCP_FIRST_PACKET = 0, 71 PFTM_TCP_OPENING = 1, 72 PFTM_TCP_ESTABLISHED = 2, 73 PFTM_TCP_CLOSING = 3, 74 PFTM_TCP_FIN_WAIT = 4, 75 PFTM_TCP_CLOSED = 5, 76 PFTM_UDP_FIRST_PACKET = 6, 77 PFTM_UDP_SINGLE = 7, 78 PFTM_UDP_MULTIPLE = 8, 79 PFTM_ICMP_FIRST_PACKET = 9, 80 PFTM_ICMP_ERROR_REPLY = 10, 81 PFTM_OTHER_FIRST_PACKET = 11, 82 PFTM_OTHER_SINGLE = 12, 83 PFTM_OTHER_MULTIPLE = 13, 84 PFTM_FRAG = 14, 85 PFTM_INTERVAL = 15, 86 PFTM_ADAPTIVE_START = 16, 87 PFTM_ADAPTIVE_END = 17, 88 PFTM_SRC_NODE = 18, 89 PFTM_TS_DIFF = 19, 90 PFTM_OLD_MAX = 20, /* Legacy limit, for binary compatibility with old kernels. */ 91 PFTM_SCTP_FIRST_PACKET = 20, 92 PFTM_SCTP_OPENING = 21, 93 PFTM_SCTP_ESTABLISHED = 22, 94 PFTM_SCTP_CLOSING = 23, 95 PFTM_SCTP_CLOSED = 24, 96 PFTM_MAX = 25, 97 PFTM_PURGE = 26, 98 PFTM_UNLINKED = 27, 99}; 100 101/* PFTM default values */ 102#define PFTM_TCP_FIRST_PACKET_VAL 120 /* First TCP packet */ 103#define PFTM_TCP_OPENING_VAL 30 /* No response yet */ 104#define PFTM_TCP_ESTABLISHED_VAL 24*60*60/* Established */ 105#define PFTM_TCP_CLOSING_VAL 15 * 60 /* Half closed */ 106#define PFTM_TCP_FIN_WAIT_VAL 45 /* Got both FINs */ 107#define PFTM_TCP_CLOSED_VAL 90 /* Got a RST */ 108#define PFTM_UDP_FIRST_PACKET_VAL 60 /* First UDP packet */ 109#define PFTM_UDP_SINGLE_VAL 30 /* Unidirectional */ 110#define PFTM_UDP_MULTIPLE_VAL 60 /* Bidirectional */ 111#define PFTM_ICMP_FIRST_PACKET_VAL 20 /* First ICMP packet */ 112#define PFTM_ICMP_ERROR_REPLY_VAL 10 /* Got error response */ 113#define PFTM_OTHER_FIRST_PACKET_VAL 60 /* First packet */ 114#define PFTM_OTHER_SINGLE_VAL 30 /* Unidirectional */ 115#define PFTM_OTHER_MULTIPLE_VAL 60 /* Bidirectional */ 116#define PFTM_FRAG_VAL 30 /* Fragment expire */ 117#define PFTM_INTERVAL_VAL 10 /* Expire interval */ 118#define PFTM_SRC_NODE_VAL 0 /* Source tracking */ 119#define PFTM_TS_DIFF_VAL 30 /* Allowed TS diff */ 120 121enum { PF_NOPFROUTE, PF_FASTROUTE, PF_ROUTETO, PF_DUPTO, PF_REPLYTO }; 122enum { PF_LIMIT_STATES, PF_LIMIT_SRC_NODES, PF_LIMIT_FRAGS, 123 PF_LIMIT_TABLE_ENTRIES, PF_LIMIT_MAX }; 124#define PF_POOL_IDMASK 0x0f 125enum { PF_POOL_NONE, PF_POOL_BITMASK, PF_POOL_RANDOM, 126 PF_POOL_SRCHASH, PF_POOL_ROUNDROBIN }; 127enum { PF_ADDR_ADDRMASK, PF_ADDR_NOROUTE, PF_ADDR_DYNIFTL, 128 PF_ADDR_TABLE, PF_ADDR_URPFFAILED, 129 PF_ADDR_RANGE }; 130#define PF_POOL_TYPEMASK 0x0f 131#define PF_POOL_STICKYADDR 0x20 132#define PF_WSCALE_FLAG 0x80 133#define PF_WSCALE_MASK 0x0f 134 135#define PF_LOG 0x01 136#define PF_LOG_ALL 0x02 137#define PF_LOG_SOCKET_LOOKUP 0x04 138#define PF_LOG_FORCE 0x08 139 140/* Reasons code for passing/dropping a packet */ 141#define PFRES_MATCH 0 /* Explicit match of a rule */ 142#define PFRES_BADOFF 1 /* Bad offset for pull_hdr */ 143#define PFRES_FRAG 2 /* Dropping following fragment */ 144#define PFRES_SHORT 3 /* Dropping short packet */ 145#define PFRES_NORM 4 /* Dropping by normalizer */ 146#define PFRES_MEMORY 5 /* Dropped due to lacking mem */ 147#define PFRES_TS 6 /* Bad TCP Timestamp (RFC1323) */ 148#define PFRES_CONGEST 7 /* Congestion (of ipintrq) */ 149#define PFRES_IPOPTIONS 8 /* IP option */ 150#define PFRES_PROTCKSUM 9 /* Protocol checksum invalid */ 151#define PFRES_BADSTATE 10 /* State mismatch */ 152#define PFRES_STATEINS 11 /* State insertion failure */ 153#define PFRES_MAXSTATES 12 /* State limit */ 154#define PFRES_SRCLIMIT 13 /* Source node/conn limit */ 155#define PFRES_SYNPROXY 14 /* SYN proxy */ 156#define PFRES_MAPFAILED 15 /* pf_map_addr() failed */ 157#define PFRES_MAX 16 /* total+1 */ 158 159#define PFRES_NAMES { \ 160 "match", \ 161 "bad-offset", \ 162 "fragment", \ 163 "short", \ 164 "normalize", \ 165 "memory", \ 166 "bad-timestamp", \ 167 "congestion", \ 168 "ip-option", \ 169 "proto-cksum", \ 170 "state-mismatch", \ 171 "state-insert", \ 172 "state-limit", \ 173 "src-limit", \ 174 "synproxy", \ 175 "map-failed", \ 176 NULL \ 177} 178 179/* Counters for other things we want to keep track of */ 180#define LCNT_STATES 0 /* states */ 181#define LCNT_SRCSTATES 1 /* max-src-states */ 182#define LCNT_SRCNODES 2 /* max-src-nodes */ 183#define LCNT_SRCCONN 3 /* max-src-conn */ 184#define LCNT_SRCCONNRATE 4 /* max-src-conn-rate */ 185#define LCNT_OVERLOAD_TABLE 5 /* entry added to overload table */ 186#define LCNT_OVERLOAD_FLUSH 6 /* state entries flushed */ 187#define LCNT_MAX 7 /* total+1 */ 188/* Only available via the nvlist-based API */ 189#define KLCNT_SYNFLOODS 7 /* synfloods detected */ 190#define KLCNT_SYNCOOKIES_SENT 8 /* syncookies sent */ 191#define KLCNT_SYNCOOKIES_VALID 9 /* syncookies validated */ 192#define KLCNT_MAX 10 /* total+1 */ 193 194#define LCNT_NAMES { \ 195 "max states per rule", \ 196 "max-src-states", \ 197 "max-src-nodes", \ 198 "max-src-conn", \ 199 "max-src-conn-rate", \ 200 "overload table insertion", \ 201 "overload flush states", \ 202 NULL \ 203} 204#define KLCNT_NAMES { \ 205 "max states per rule", \ 206 "max-src-states", \ 207 "max-src-nodes", \ 208 "max-src-conn", \ 209 "max-src-conn-rate", \ 210 "overload table insertion", \ 211 "overload flush states", \ 212 "synfloods detected", \ 213 "syncookies sent", \ 214 "syncookies validated", \ 215 NULL \ 216} 217 218/* state operation counters */ 219#define FCNT_STATE_SEARCH 0 220#define FCNT_STATE_INSERT 1 221#define FCNT_STATE_REMOVALS 2 222#define FCNT_MAX 3 223 224#ifdef _KERNEL 225#define FCNT_NAMES { \ 226 "searches", \ 227 "inserts", \ 228 "removals", \ 229 NULL \ 230} 231#endif 232 233/* src_node operation counters */ 234#define SCNT_SRC_NODE_SEARCH 0 235#define SCNT_SRC_NODE_INSERT 1 236#define SCNT_SRC_NODE_REMOVALS 2 237#define SCNT_MAX 3 238 239#define PF_TABLE_NAME_SIZE 32 240#define PF_QNAME_SIZE 64 241 242struct pfioc_nv { 243 void *data; 244 size_t len; /* The length of the nvlist data. */ 245 size_t size; /* The total size of the data buffer. */ 246}; 247 248struct pf_rule; 249 250/* keep synced with pfi_kif, used in RB_FIND */ 251struct pfi_kif_cmp { 252 char pfik_name[IFNAMSIZ]; 253}; 254 255struct pfi_kif { 256 char pfik_name[IFNAMSIZ]; 257 union { 258 RB_ENTRY(pfi_kif) pfik_tree; 259 LIST_ENTRY(pfi_kif) pfik_list; 260 }; 261 u_int64_t pfik_packets[2][2][2]; 262 u_int64_t pfik_bytes[2][2][2]; 263 u_int32_t pfik_tzero; 264 u_int pfik_flags; 265 struct ifnet *pfik_ifp; 266 struct ifg_group *pfik_group; 267 u_int pfik_rulerefs; 268 TAILQ_HEAD(, pfi_dynaddr) pfik_dynaddrs; 269}; 270 271struct pf_status { 272 uint64_t counters[PFRES_MAX]; 273 uint64_t lcounters[LCNT_MAX]; 274 uint64_t fcounters[FCNT_MAX]; 275 uint64_t scounters[SCNT_MAX]; 276 uint64_t pcounters[2][2][3]; 277 uint64_t bcounters[2][2]; 278 uint32_t running; 279 uint32_t states; 280 uint32_t src_nodes; 281 uint32_t since; 282 uint32_t debug; 283 uint32_t hostid; 284 char ifname[IFNAMSIZ]; 285 uint8_t pf_chksum[PF_MD5_DIGEST_LENGTH]; 286}; 287 288#define PF_REASS_ENABLED 0x01 289#define PF_REASS_NODF 0x02 290 291struct pf_addr { 292 union { 293 struct in_addr v4; 294 struct in6_addr v6; 295 u_int8_t addr8[16]; 296 u_int16_t addr16[8]; 297 u_int32_t addr32[4]; 298 }; /* 128-bit address */ 299}; 300 301#define PFI_AFLAG_NETWORK 0x01 302#define PFI_AFLAG_BROADCAST 0x02 303#define PFI_AFLAG_PEER 0x04 304#define PFI_AFLAG_MODEMASK 0x07 305#define PFI_AFLAG_NOALIAS 0x08 306 307struct pf_addr_wrap { 308 union { 309 struct { 310 struct pf_addr addr; 311 struct pf_addr mask; 312 } a; 313 char ifname[IFNAMSIZ]; 314 char tblname[PF_TABLE_NAME_SIZE]; 315 } v; 316 union { 317 struct pfi_dynaddr *dyn; 318 struct pfr_ktable *tbl; 319 int dyncnt; 320 int tblcnt; 321 } p; 322 u_int8_t type; /* PF_ADDR_* */ 323 u_int8_t iflags; /* PFI_AFLAG_* */ 324}; 325 326union pf_rule_ptr { 327 struct pf_rule *ptr; 328 u_int32_t nr; 329}; 330 331struct pf_rule_uid { 332 uid_t uid[2]; 333 u_int8_t op; 334}; 335 336struct pf_rule_gid { 337 uid_t gid[2]; 338 u_int8_t op; 339}; 340 341struct pf_rule_addr { 342 struct pf_addr_wrap addr; 343 u_int16_t port[2]; 344 u_int8_t neg; 345 u_int8_t port_op; 346}; 347 348struct pf_pooladdr { 349 struct pf_addr_wrap addr; 350 TAILQ_ENTRY(pf_pooladdr) entries; 351 char ifname[IFNAMSIZ]; 352 struct pfi_kif *kif; 353}; 354 355TAILQ_HEAD(pf_palist, pf_pooladdr); 356 357struct pf_poolhashkey { 358 union { 359 u_int8_t key8[16]; 360 u_int16_t key16[8]; 361 u_int32_t key32[4]; 362 }; /* 128-bit hash key */ 363}; 364 365struct pf_mape_portset { 366 u_int8_t offset; 367 u_int8_t psidlen; 368 u_int16_t psid; 369}; 370 371struct pf_pool { 372 struct pf_palist list; 373 struct pf_pooladdr *cur; 374 struct pf_poolhashkey key; 375 struct pf_addr counter; 376 int tblidx; 377 u_int16_t proxy_port[2]; 378 u_int8_t opts; 379}; 380 381/* A packed Operating System description for fingerprinting */ 382typedef u_int32_t pf_osfp_t; 383#define PF_OSFP_ANY ((pf_osfp_t)0) 384#define PF_OSFP_UNKNOWN ((pf_osfp_t)-1) 385#define PF_OSFP_NOMATCH ((pf_osfp_t)-2) 386 387struct pf_osfp_entry { 388 SLIST_ENTRY(pf_osfp_entry) fp_entry; 389 pf_osfp_t fp_os; 390 int fp_enflags; 391#define PF_OSFP_EXPANDED 0x001 /* expanded entry */ 392#define PF_OSFP_GENERIC 0x002 /* generic signature */ 393#define PF_OSFP_NODETAIL 0x004 /* no p0f details */ 394#define PF_OSFP_LEN 32 395 char fp_class_nm[PF_OSFP_LEN]; 396 char fp_version_nm[PF_OSFP_LEN]; 397 char fp_subtype_nm[PF_OSFP_LEN]; 398}; 399#define PF_OSFP_ENTRY_EQ(a, b) \ 400 ((a)->fp_os == (b)->fp_os && \ 401 memcmp((a)->fp_class_nm, (b)->fp_class_nm, PF_OSFP_LEN) == 0 && \ 402 memcmp((a)->fp_version_nm, (b)->fp_version_nm, PF_OSFP_LEN) == 0 && \ 403 memcmp((a)->fp_subtype_nm, (b)->fp_subtype_nm, PF_OSFP_LEN) == 0) 404 405/* handle pf_osfp_t packing */ 406#define _FP_RESERVED_BIT 1 /* For the special negative #defines */ 407#define _FP_UNUSED_BITS 1 408#define _FP_CLASS_BITS 10 /* OS Class (Windows, Linux) */ 409#define _FP_VERSION_BITS 10 /* OS version (95, 98, NT, 2.4.54, 3.2) */ 410#define _FP_SUBTYPE_BITS 10 /* patch level (NT SP4, SP3, ECN patch) */ 411#define PF_OSFP_UNPACK(osfp, class, version, subtype) do { \ 412 (class) = ((osfp) >> (_FP_VERSION_BITS+_FP_SUBTYPE_BITS)) & \ 413 ((1 << _FP_CLASS_BITS) - 1); \ 414 (version) = ((osfp) >> _FP_SUBTYPE_BITS) & \ 415 ((1 << _FP_VERSION_BITS) - 1);\ 416 (subtype) = (osfp) & ((1 << _FP_SUBTYPE_BITS) - 1); \ 417} while(0) 418#define PF_OSFP_PACK(osfp, class, version, subtype) do { \ 419 (osfp) = ((class) & ((1 << _FP_CLASS_BITS) - 1)) << (_FP_VERSION_BITS \ 420 + _FP_SUBTYPE_BITS); \ 421 (osfp) |= ((version) & ((1 << _FP_VERSION_BITS) - 1)) << \ 422 _FP_SUBTYPE_BITS; \ 423 (osfp) |= (subtype) & ((1 << _FP_SUBTYPE_BITS) - 1); \ 424} while(0) 425 426/* the fingerprint of an OSes TCP SYN packet */ 427typedef u_int64_t pf_tcpopts_t; 428struct pf_os_fingerprint { 429 SLIST_HEAD(pf_osfp_enlist, pf_osfp_entry) fp_oses; /* list of matches */ 430 pf_tcpopts_t fp_tcpopts; /* packed TCP options */ 431 u_int16_t fp_wsize; /* TCP window size */ 432 u_int16_t fp_psize; /* ip->ip_len */ 433 u_int16_t fp_mss; /* TCP MSS */ 434 u_int16_t fp_flags; 435#define PF_OSFP_WSIZE_MOD 0x0001 /* Window modulus */ 436#define PF_OSFP_WSIZE_DC 0x0002 /* Window don't care */ 437#define PF_OSFP_WSIZE_MSS 0x0004 /* Window multiple of MSS */ 438#define PF_OSFP_WSIZE_MTU 0x0008 /* Window multiple of MTU */ 439#define PF_OSFP_PSIZE_MOD 0x0010 /* packet size modulus */ 440#define PF_OSFP_PSIZE_DC 0x0020 /* packet size don't care */ 441#define PF_OSFP_WSCALE 0x0040 /* TCP window scaling */ 442#define PF_OSFP_WSCALE_MOD 0x0080 /* TCP window scale modulus */ 443#define PF_OSFP_WSCALE_DC 0x0100 /* TCP window scale dont-care */ 444#define PF_OSFP_MSS 0x0200 /* TCP MSS */ 445#define PF_OSFP_MSS_MOD 0x0400 /* TCP MSS modulus */ 446#define PF_OSFP_MSS_DC 0x0800 /* TCP MSS dont-care */ 447#define PF_OSFP_DF 0x1000 /* IPv4 don't fragment bit */ 448#define PF_OSFP_TS0 0x2000 /* Zero timestamp */ 449#define PF_OSFP_INET6 0x4000 /* IPv6 */ 450 u_int8_t fp_optcnt; /* TCP option count */ 451 u_int8_t fp_wscale; /* TCP window scaling */ 452 u_int8_t fp_ttl; /* IPv4 TTL */ 453#define PF_OSFP_MAXTTL_OFFSET 40 454/* TCP options packing */ 455#define PF_OSFP_TCPOPT_NOP 0x0 /* TCP NOP option */ 456#define PF_OSFP_TCPOPT_WSCALE 0x1 /* TCP window scaling option */ 457#define PF_OSFP_TCPOPT_MSS 0x2 /* TCP max segment size opt */ 458#define PF_OSFP_TCPOPT_SACK 0x3 /* TCP SACK OK option */ 459#define PF_OSFP_TCPOPT_TS 0x4 /* TCP timestamp option */ 460#define PF_OSFP_TCPOPT_BITS 3 /* bits used by each option */ 461#define PF_OSFP_MAX_OPTS \ 462 (sizeof(((struct pf_os_fingerprint *)0)->fp_tcpopts) * 8) \ 463 / PF_OSFP_TCPOPT_BITS 464 465 SLIST_ENTRY(pf_os_fingerprint) fp_next; 466}; 467 468struct pf_osfp_ioctl { 469 struct pf_osfp_entry fp_os; 470 pf_tcpopts_t fp_tcpopts; /* packed TCP options */ 471 u_int16_t fp_wsize; /* TCP window size */ 472 u_int16_t fp_psize; /* ip->ip_len */ 473 u_int16_t fp_mss; /* TCP MSS */ 474 u_int16_t fp_flags; 475 u_int8_t fp_optcnt; /* TCP option count */ 476 u_int8_t fp_wscale; /* TCP window scaling */ 477 u_int8_t fp_ttl; /* IPv4 TTL */ 478 479 int fp_getnum; /* DIOCOSFPGET number */ 480}; 481 482#define PF_ANCHOR_NAME_SIZE 64 483 484struct pf_rule { 485 struct pf_rule_addr src; 486 struct pf_rule_addr dst; 487#define PF_SKIP_IFP 0 488#define PF_SKIP_DIR 1 489#define PF_SKIP_AF 2 490#define PF_SKIP_PROTO 3 491#define PF_SKIP_SRC_ADDR 4 492#define PF_SKIP_SRC_PORT 5 493#define PF_SKIP_DST_ADDR 6 494#define PF_SKIP_DST_PORT 7 495#define PF_SKIP_COUNT 8 496 union pf_rule_ptr skip[PF_SKIP_COUNT]; 497#define PF_RULE_LABEL_SIZE 64 498#define PF_RULE_MAX_LABEL_COUNT 5 499 char label[PF_RULE_LABEL_SIZE]; 500 char ifname[IFNAMSIZ]; 501 char qname[PF_QNAME_SIZE]; 502 char pqname[PF_QNAME_SIZE]; 503#define PF_TAG_NAME_SIZE 64 504 char tagname[PF_TAG_NAME_SIZE]; 505 char match_tagname[PF_TAG_NAME_SIZE]; 506 507 char overload_tblname[PF_TABLE_NAME_SIZE]; 508 509 TAILQ_ENTRY(pf_rule) entries; 510 struct pf_pool rpool; 511 512 u_int64_t evaluations; 513 u_int64_t packets[2]; 514 u_int64_t bytes[2]; 515 516 struct pfi_kif *kif; 517 struct pf_anchor *anchor; 518 struct pfr_ktable *overload_tbl; 519 520 pf_osfp_t os_fingerprint; 521 522 int rtableid; 523 u_int32_t timeout[PFTM_OLD_MAX]; 524 u_int32_t max_states; 525 u_int32_t max_src_nodes; 526 u_int32_t max_src_states; 527 u_int32_t max_src_conn; 528 struct { 529 u_int32_t limit; 530 u_int32_t seconds; 531 } max_src_conn_rate; 532 u_int32_t qid; 533 u_int32_t pqid; 534 u_int32_t rt_listid; 535 u_int32_t nr; 536 u_int32_t prob; 537 uid_t cuid; 538 pid_t cpid; 539 540 counter_u64_t states_cur; 541 counter_u64_t states_tot; 542 counter_u64_t src_nodes; 543 544 u_int16_t return_icmp; 545 u_int16_t return_icmp6; 546 u_int16_t max_mss; 547 u_int16_t tag; 548 u_int16_t match_tag; 549 u_int16_t scrub_flags; 550 551 struct pf_rule_uid uid; 552 struct pf_rule_gid gid; 553 554 u_int32_t rule_flag; 555 u_int8_t action; 556 u_int8_t direction; 557 u_int8_t log; 558 u_int8_t logif; 559 u_int8_t quick; 560 u_int8_t ifnot; 561 u_int8_t match_tag_not; 562 u_int8_t natpass; 563 564#define PF_STATE_NORMAL 0x1 565#define PF_STATE_MODULATE 0x2 566#define PF_STATE_SYNPROXY 0x3 567 u_int8_t keep_state; 568 sa_family_t af; 569 u_int8_t proto; 570 u_int8_t type; 571 u_int8_t code; 572 u_int8_t flags; 573 u_int8_t flagset; 574 u_int8_t min_ttl; 575 u_int8_t allow_opts; 576 u_int8_t rt; 577 u_int8_t return_ttl; 578 u_int8_t tos; 579 u_int8_t set_tos; 580 u_int8_t anchor_relative; 581 u_int8_t anchor_wildcard; 582 583#define PF_FLUSH 0x01 584#define PF_FLUSH_GLOBAL 0x02 585 u_int8_t flush; 586#define PF_PRIO_ZERO 0xff /* match "prio 0" packets */ 587#define PF_PRIO_MAX 7 588 u_int8_t prio; 589 u_int8_t set_prio[2]; 590 591 struct { 592 struct pf_addr addr; 593 u_int16_t port; 594 } divert; 595 596 uint64_t u_states_cur; 597 uint64_t u_states_tot; 598 uint64_t u_src_nodes; 599}; 600 601/* pf_krule->rule_flag and old-style scrub flags */ 602#define PFRULE_DROP 0x00000000 603#define PFRULE_RETURNRST 0x00000001 604#define PFRULE_FRAGMENT 0x00000002 605#define PFRULE_RETURNICMP 0x00000004 606#define PFRULE_RETURN 0x00000008 607#define PFRULE_NOSYNC 0x00000010 608#define PFRULE_SRCTRACK 0x00000020 /* track source states */ 609#define PFRULE_RULESRCTRACK 0x00000040 /* per rule */ 610#define PFRULE_NODF 0x00000100 611#define PFRULE_FRAGMENT_NOREASS 0x00000200 612#define PFRULE_RANDOMID 0x00000800 613#define PFRULE_REASSEMBLE_TCP 0x00001000 614#define PFRULE_SET_TOS 0x00002000 615#define PFRULE_IFBOUND 0x00010000 /* if-bound */ 616#define PFRULE_STATESLOPPY 0x00020000 /* sloppy state tracking */ 617#define PFRULE_PFLOW 0x00040000 618 619#ifdef _KERNEL 620#define PFRULE_REFS 0x0080 /* rule has references */ 621#endif 622 623/* pf_rule_actions->dnflags */ 624#define PFRULE_DN_IS_PIPE 0x0040 625#define PFRULE_DN_IS_QUEUE 0x0080 626 627/* pf_state->state_flags, pf_rule_actions->flags, pf_krule->scrub_flags */ 628#define PFSTATE_ALLOWOPTS 0x0001 629#define PFSTATE_SLOPPY 0x0002 630#define PFSTATE_PFLOW 0x0004 631#define PFSTATE_NOSYNC 0x0008 632#define PFSTATE_ACK 0x0010 633#define PFSTATE_NODF 0x0020 634#define PFSTATE_SETTOS 0x0040 635#define PFSTATE_RANDOMID 0x0080 636#define PFSTATE_SCRUB_TCP 0x0100 637#define PFSTATE_SETPRIO 0x0200 638/* was PFSTATE_INP_UNLINKED 0x0400 */ 639/* FreeBSD-specific flags are added from the end to keep space for porting 640 * flags from OpenBSD */ 641#define PFSTATE_DN_IS_PIPE 0x4000 642#define PFSTATE_DN_IS_QUEUE 0x8000 643#define PFSTATE_SCRUBMASK (PFSTATE_NODF|PFSTATE_RANDOMID|PFSTATE_SCRUB_TCP) 644#define PFSTATE_SETMASK (PFSTATE_SETTOS|PFSTATE_SETPRIO) 645 646#define PFSTATE_HIWAT 100000 /* default state table size */ 647#define PFSTATE_ADAPT_START 60000 /* default adaptive timeout start */ 648#define PFSTATE_ADAPT_END 120000 /* default adaptive timeout end */ 649 650 651struct pf_threshold { 652 u_int32_t limit; 653#define PF_THRESHOLD_MULT 1000 654#define PF_THRESHOLD_MAX 0xffffffff / PF_THRESHOLD_MULT 655 u_int32_t seconds; 656 u_int32_t count; 657 u_int32_t last; 658}; 659 660struct pf_src_node { 661 LIST_ENTRY(pf_src_node) entry; 662 struct pf_addr addr; 663 struct pf_addr raddr; 664 union pf_rule_ptr rule; 665 struct pfi_kif *kif; 666 u_int64_t bytes[2]; 667 u_int64_t packets[2]; 668 u_int32_t states; 669 u_int32_t conn; 670 struct pf_threshold conn_rate; 671 u_int32_t creation; 672 u_int32_t expire; 673 sa_family_t af; 674 u_int8_t ruletype; 675}; 676 677#define PFSNODE_HIWAT 10000 /* default source node table size */ 678 679TAILQ_HEAD(pf_rulequeue, pf_rule); 680 681struct pf_anchor; 682 683struct pf_ruleset { 684 struct { 685 struct pf_rulequeue queues[2]; 686 struct { 687 struct pf_rulequeue *ptr; 688 struct pf_rule **ptr_array; 689 u_int32_t rcount; 690 u_int32_t ticket; 691 int open; 692 } active, inactive; 693 } rules[PF_RULESET_MAX]; 694 struct pf_anchor *anchor; 695 u_int32_t tticket; 696 int tables; 697 int topen; 698}; 699 700RB_HEAD(pf_anchor_global, pf_anchor); 701RB_HEAD(pf_anchor_node, pf_anchor); 702struct pf_anchor { 703 RB_ENTRY(pf_anchor) entry_global; 704 RB_ENTRY(pf_anchor) entry_node; 705 struct pf_anchor *parent; 706 struct pf_anchor_node children; 707 char name[PF_ANCHOR_NAME_SIZE]; 708 char path[MAXPATHLEN]; 709 struct pf_ruleset ruleset; 710 int refcnt; /* anchor rules */ 711 int match; /* XXX: used for pfctl black magic */ 712}; 713RB_PROTOTYPE(pf_anchor_global, pf_anchor, entry_global, pf_anchor_compare); 714RB_PROTOTYPE(pf_anchor_node, pf_anchor, entry_node, pf_anchor_compare); 715 716int pf_get_ruleset_number(u_int8_t); 717 718#endif /* _NET_PF_H_ */ 719