sys/netpfil/pf/pf.h

   1 /*-
   2  * SPDX-License-Identifier: BSD-2-Clause
   3  *
   4  * Copyright (c) 2001 Daniel Hartmeier
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  *
  11  *    - Redistributions of source code must retain the above copyright
  12  *      notice, this list of conditions and the following disclaimer.
  13  *    - Redistributions in binary form must reproduce the above
  14  *      copyright notice, this list of conditions and the following
  15  *      disclaimer in the documentation and/or other materials provided
  16  *      with the distribution.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  19  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  20  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  21  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  22  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  23  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  24  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  25  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  26  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  28  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  29  * POSSIBILITY OF SUCH DAMAGE.
  30  *
  31  *      $OpenBSD: pfvar.h,v 1.282 2009/01/29 15:12:28 pyr Exp $
  32  */
  33
  34 #ifndef _NET_PF_H_
  35 #define _NET_PF_H_
  36
  37 #include <sys/tree.h>
  38
  39 #define PF_TCPS_PROXY_SRC       ((TCP_NSTATES)+0)
  40 #define PF_TCPS_PROXY_DST       ((TCP_NSTATES)+1)
  41
  42 #define PF_MD5_DIGEST_LENGTH    16
  43 #ifdef MD5_DIGEST_LENGTH
  44 #if PF_MD5_DIGEST_LENGTH != MD5_DIGEST_LENGTH
  45 #error
  46 #endif
  47 #endif
  48
  49 enum    { PF_INOUT, PF_IN, PF_OUT };
  50 enum    { PF_PASS, PF_DROP, PF_SCRUB, PF_NOSCRUB, PF_NAT, PF_NONAT,
  51           PF_BINAT, PF_NOBINAT, PF_RDR, PF_NORDR, PF_SYNPROXY_DROP, PF_DEFER,
  52           PF_MATCH };
  53 enum    { PF_RULESET_SCRUB, PF_RULESET_FILTER, PF_RULESET_NAT,
  54           PF_RULESET_BINAT, PF_RULESET_RDR, PF_RULESET_MAX };
  55 enum    { PF_OP_NONE, PF_OP_IRG, PF_OP_EQ, PF_OP_NE, PF_OP_LT,
  56           PF_OP_LE, PF_OP_GT, PF_OP_GE, PF_OP_XRG, PF_OP_RRG };
  57 enum    { PF_DEBUG_NONE, PF_DEBUG_URGENT, PF_DEBUG_MISC, PF_DEBUG_NOISY };
  58 enum    { PF_CHANGE_NONE, PF_CHANGE_ADD_HEAD, PF_CHANGE_ADD_TAIL,
  59           PF_CHANGE_ADD_BEFORE, PF_CHANGE_ADD_AFTER,
  60           PF_CHANGE_REMOVE, PF_CHANGE_GET_TICKET };
  61 enum    { PF_GET_NONE, PF_GET_CLR_CNTR };
  62 enum    { PF_SK_WIRE, PF_SK_STACK, PF_SK_BOTH };
  63 enum    { PF_PEER_SRC, PF_PEER_DST, PF_PEER_BOTH };
  64
  65 /*
  66  * Note about PFTM_*: real indices into pf_rule.timeout[] come before
  67  * PFTM_MAX, special cases afterwards. See pf_state_expires().
  68  */
  69 enum    {
  70         PFTM_TCP_FIRST_PACKET   = 0,
  71         PFTM_TCP_OPENING        = 1,
  72         PFTM_TCP_ESTABLISHED    = 2,
  73         PFTM_TCP_CLOSING        = 3,
  74         PFTM_TCP_FIN_WAIT       = 4,
  75         PFTM_TCP_CLOSED         = 5,
  76         PFTM_UDP_FIRST_PACKET   = 6,
  77         PFTM_UDP_SINGLE         = 7,
  78         PFTM_UDP_MULTIPLE       = 8,
  79         PFTM_ICMP_FIRST_PACKET  = 9,
  80         PFTM_ICMP_ERROR_REPLY   = 10,
  81         PFTM_OTHER_FIRST_PACKET = 11,
  82         PFTM_OTHER_SINGLE       = 12,
  83         PFTM_OTHER_MULTIPLE     = 13,
  84         PFTM_FRAG               = 14,
  85         PFTM_INTERVAL           = 15,
  86         PFTM_ADAPTIVE_START     = 16,
  87         PFTM_ADAPTIVE_END       = 17,
  88         PFTM_SRC_NODE           = 18,
  89         PFTM_TS_DIFF            = 19,
  90         PFTM_OLD_MAX            = 20, /* Legacy limit, for binary compatibility with old kernels. */
  91         PFTM_SCTP_FIRST_PACKET  = 20,
  92         PFTM_SCTP_OPENING       = 21,
  93         PFTM_SCTP_ESTABLISHED   = 22,
  94         PFTM_SCTP_CLOSING       = 23,
  95         PFTM_SCTP_CLOSED        = 24,
  96         PFTM_MAX                = 25,
  97         PFTM_PURGE              = 26,
  98         PFTM_UNLINKED           = 27,
  99 };
 100
 101 /* PFTM default values */
 102 #define PFTM_TCP_FIRST_PACKET_VAL       120     /* First TCP packet */
 103 #define PFTM_TCP_OPENING_VAL            30      /* No response yet */
 104 #define PFTM_TCP_ESTABLISHED_VAL        24*60*60/* Established */
 105 #define PFTM_TCP_CLOSING_VAL            15 * 60 /* Half closed */
 106 #define PFTM_TCP_FIN_WAIT_VAL           45      /* Got both FINs */
 107 #define PFTM_TCP_CLOSED_VAL             90      /* Got a RST */
 108 #define PFTM_UDP_FIRST_PACKET_VAL       60      /* First UDP packet */
 109 #define PFTM_UDP_SINGLE_VAL             30      /* Unidirectional */
 110 #define PFTM_UDP_MULTIPLE_VAL           60      /* Bidirectional */
 111 #define PFTM_ICMP_FIRST_PACKET_VAL      20      /* First ICMP packet */
 112 #define PFTM_ICMP_ERROR_REPLY_VAL       10      /* Got error response */
 113 #define PFTM_OTHER_FIRST_PACKET_VAL     60      /* First packet */
 114 #define PFTM_OTHER_SINGLE_VAL           30      /* Unidirectional */
 115 #define PFTM_OTHER_MULTIPLE_VAL         60      /* Bidirectional */
 116 #define PFTM_FRAG_VAL                   30      /* Fragment expire */
 117 #define PFTM_INTERVAL_VAL               10      /* Expire interval */
 118 #define PFTM_SRC_NODE_VAL               0       /* Source tracking */
 119 #define PFTM_TS_DIFF_VAL                30      /* Allowed TS diff */
 120
 121 enum    { PF_NOPFROUTE, PF_FASTROUTE, PF_ROUTETO, PF_DUPTO, PF_REPLYTO };
 122 enum    { PF_LIMIT_STATES, PF_LIMIT_SRC_NODES, PF_LIMIT_FRAGS,
 123           PF_LIMIT_TABLE_ENTRIES, PF_LIMIT_MAX };
 124 #define PF_POOL_IDMASK          0x0f
 125 enum    { PF_POOL_NONE, PF_POOL_BITMASK, PF_POOL_RANDOM,
 126           PF_POOL_SRCHASH, PF_POOL_ROUNDROBIN };
 127 enum    { PF_ADDR_ADDRMASK, PF_ADDR_NOROUTE, PF_ADDR_DYNIFTL,
 128           PF_ADDR_TABLE, PF_ADDR_URPFFAILED,
 129           PF_ADDR_RANGE };
 130 #define PF_POOL_TYPEMASK        0x0f
 131 #define PF_POOL_STICKYADDR      0x20
 132 #define PF_WSCALE_FLAG          0x80
 133 #define PF_WSCALE_MASK          0x0f
 134
 135 #define PF_LOG                  0x01
 136 #define PF_LOG_ALL              0x02
 137 #define PF_LOG_SOCKET_LOOKUP    0x04
 138 #define PF_LOG_FORCE            0x08
 139
 140 /* Reasons code for passing/dropping a packet */
 141 #define PFRES_MATCH     0               /* Explicit match of a rule */
 142 #define PFRES_BADOFF    1               /* Bad offset for pull_hdr */
 143 #define PFRES_FRAG      2               /* Dropping following fragment */
 144 #define PFRES_SHORT     3               /* Dropping short packet */
 145 #define PFRES_NORM      4               /* Dropping by normalizer */
 146 #define PFRES_MEMORY    5               /* Dropped due to lacking mem */
 147 #define PFRES_TS        6               /* Bad TCP Timestamp (RFC1323) */
 148 #define PFRES_CONGEST   7               /* Congestion (of ipintrq) */
 149 #define PFRES_IPOPTIONS 8               /* IP option */
 150 #define PFRES_PROTCKSUM 9               /* Protocol checksum invalid */
 151 #define PFRES_BADSTATE  10              /* State mismatch */
 152 #define PFRES_STATEINS  11              /* State insertion failure */
 153 #define PFRES_MAXSTATES 12              /* State limit */
 154 #define PFRES_SRCLIMIT  13              /* Source node/conn limit */
 155 #define PFRES_SYNPROXY  14              /* SYN proxy */
 156 #define PFRES_MAPFAILED 15              /* pf_map_addr() failed */
 157 #define PFRES_MAX       16              /* total+1 */
 158
 159 #define PFRES_NAMES { \
 160         "match", \
 161         "bad-offset", \
 162         "fragment", \
 163         "short", \
 164         "normalize", \
 165         "memory", \
 166         "bad-timestamp", \
 167         "congestion", \
 168         "ip-option", \
 169         "proto-cksum", \
 170         "state-mismatch", \
 171         "state-insert", \
 172         "state-limit", \
 173         "src-limit", \
 174         "synproxy", \
 175         "map-failed", \
 176         NULL \
 177 }
 178
 179 /* Counters for other things we want to keep track of */
 180 #define LCNT_STATES             0       /* states */
 181 #define LCNT_SRCSTATES          1       /* max-src-states */
 182 #define LCNT_SRCNODES           2       /* max-src-nodes */
 183 #define LCNT_SRCCONN            3       /* max-src-conn */
 184 #define LCNT_SRCCONNRATE        4       /* max-src-conn-rate */
 185 #define LCNT_OVERLOAD_TABLE     5       /* entry added to overload table */
 186 #define LCNT_OVERLOAD_FLUSH     6       /* state entries flushed */
 187 #define LCNT_MAX                7       /* total+1 */
 188 /* Only available via the nvlist-based API */
 189 #define KLCNT_SYNFLOODS         7       /* synfloods detected */
 190 #define KLCNT_SYNCOOKIES_SENT   8       /* syncookies sent */
 191 #define KLCNT_SYNCOOKIES_VALID  9       /* syncookies validated */
 192 #define KLCNT_MAX               10      /* total+1 */
 193
 194 #define LCNT_NAMES { \
 195         "max states per rule", \
 196         "max-src-states", \
 197         "max-src-nodes", \
 198         "max-src-conn", \
 199         "max-src-conn-rate", \
 200         "overload table insertion", \
 201         "overload flush states", \
 202         NULL \
 203 }
 204 #define KLCNT_NAMES { \
 205         "max states per rule", \
 206         "max-src-states", \
 207         "max-src-nodes", \
 208         "max-src-conn", \
 209         "max-src-conn-rate", \
 210         "overload table insertion", \
 211         "overload flush states", \
 212         "synfloods detected", \
 213         "syncookies sent", \
 214         "syncookies validated", \
 215         NULL \
 216 }
 217
 218 /* state operation counters */
 219 #define FCNT_STATE_SEARCH       0
 220 #define FCNT_STATE_INSERT       1
 221 #define FCNT_STATE_REMOVALS     2
 222 #define FCNT_MAX                3
 223
 224 #ifdef _KERNEL
 225 #define FCNT_NAMES { \
 226         "searches", \
 227         "inserts", \
 228         "removals", \
 229         NULL \
 230 }
 231 #endif
 232
 233 /* src_node operation counters */
 234 #define SCNT_SRC_NODE_SEARCH    0
 235 #define SCNT_SRC_NODE_INSERT    1
 236 #define SCNT_SRC_NODE_REMOVALS  2
 237 #define SCNT_MAX                3
 238
 239 #define PF_TABLE_NAME_SIZE      32
 240 #define PF_QNAME_SIZE           64
 241
 242 struct pfioc_nv {
 243         void            *data;
 244         size_t           len;   /* The length of the nvlist data. */
 245         size_t           size;  /* The total size of the data buffer. */
 246 };
 247
 248 struct pf_rule;
 249
 250 /* keep synced with pfi_kif, used in RB_FIND */
 251 struct pfi_kif_cmp {
 252         char                             pfik_name[IFNAMSIZ];
 253 };
 254
 255 struct pfi_kif {
 256         char                             pfik_name[IFNAMSIZ];
 257         union {
 258                 RB_ENTRY(pfi_kif)        pfik_tree;
 259                 LIST_ENTRY(pfi_kif)      pfik_list;
 260         };
 261         u_int64_t                        pfik_packets[2][2][2];
 262         u_int64_t                        pfik_bytes[2][2][2];
 263         u_int32_t                        pfik_tzero;
 264         u_int                            pfik_flags;
 265         struct ifnet                    *pfik_ifp;
 266         struct ifg_group                *pfik_group;
 267         u_int                            pfik_rulerefs;
 268         TAILQ_HEAD(, pfi_dynaddr)        pfik_dynaddrs;
 269 };
 270
 271 struct pf_status {
 272         uint64_t        counters[PFRES_MAX];
 273         uint64_t        lcounters[LCNT_MAX];
 274         uint64_t        fcounters[FCNT_MAX];
 275         uint64_t        scounters[SCNT_MAX];
 276         uint64_t        pcounters[2][2][3];
 277         uint64_t        bcounters[2][2];
 278         uint32_t        running;
 279         uint32_t        states;
 280         uint32_t        src_nodes;
 281         uint32_t        since;
 282         uint32_t        debug;
 283         uint32_t        hostid;
 284         char            ifname[IFNAMSIZ];
 285         uint8_t         pf_chksum[PF_MD5_DIGEST_LENGTH];
 286 };
 287
 288 #define PF_REASS_ENABLED        0x01
 289 #define PF_REASS_NODF           0x02
 290
 291 struct pf_addr {
 292         union {
 293                 struct in_addr          v4;
 294                 struct in6_addr         v6;
 295                 u_int8_t                addr8[16];
 296                 u_int16_t               addr16[8];
 297                 u_int32_t               addr32[4];
 298         };                  /* 128-bit address */
 299 };
 300
 301 #define PFI_AFLAG_NETWORK       0x01
 302 #define PFI_AFLAG_BROADCAST     0x02
 303 #define PFI_AFLAG_PEER          0x04
 304 #define PFI_AFLAG_MODEMASK      0x07
 305 #define PFI_AFLAG_NOALIAS       0x08
 306
 307 struct pf_addr_wrap {
 308         union {
 309                 struct {
 310                         struct pf_addr           addr;
 311                         struct pf_addr           mask;
 312                 }                        a;
 313                 char                     ifname[IFNAMSIZ];
 314                 char                     tblname[PF_TABLE_NAME_SIZE];
 315         }                        v;
 316         union {
 317                 struct pfi_dynaddr      *dyn;
 318                 struct pfr_ktable       *tbl;
 319                 int                      dyncnt;
 320                 int                      tblcnt;
 321         }                        p;
 322         u_int8_t                 type;          /* PF_ADDR_* */
 323         u_int8_t                 iflags;        /* PFI_AFLAG_* */
 324 };
 325
 326 union pf_rule_ptr {
 327         struct pf_rule          *ptr;
 328         u_int32_t                nr;
 329 };
 330
 331 struct pf_rule_uid {
 332         uid_t            uid[2];
 333         u_int8_t         op;
 334 };
 335
 336 struct pf_rule_gid {
 337         uid_t            gid[2];
 338         u_int8_t         op;
 339 };
 340
 341 struct pf_rule_addr {
 342         struct pf_addr_wrap      addr;
 343         u_int16_t                port[2];
 344         u_int8_t                 neg;
 345         u_int8_t                 port_op;
 346 };
 347
 348 struct pf_pooladdr {
 349         struct pf_addr_wrap              addr;
 350         TAILQ_ENTRY(pf_pooladdr)         entries;
 351         char                             ifname[IFNAMSIZ];
 352         struct pfi_kif                  *kif;
 353 };
 354
 355 TAILQ_HEAD(pf_palist, pf_pooladdr);
 356
 357 struct pf_poolhashkey {
 358         union {
 359                 u_int8_t                key8[16];
 360                 u_int16_t               key16[8];
 361                 u_int32_t               key32[4];
 362         };                  /* 128-bit hash key */
 363 };
 364
 365 struct pf_mape_portset {
 366         u_int8_t                offset;
 367         u_int8_t                psidlen;
 368         u_int16_t               psid;
 369 };
 370
 371 struct pf_pool {
 372         struct pf_palist         list;
 373         struct pf_pooladdr      *cur;
 374         struct pf_poolhashkey    key;
 375         struct pf_addr           counter;
 376         int                      tblidx;
 377         u_int16_t                proxy_port[2];
 378         u_int8_t                 opts;
 379 };
 380
 381 /* A packed Operating System description for fingerprinting */
 382 typedef u_int32_t pf_osfp_t;
 383 #define PF_OSFP_ANY     ((pf_osfp_t)0)
 384 #define PF_OSFP_UNKNOWN ((pf_osfp_t)-1)
 385 #define PF_OSFP_NOMATCH ((pf_osfp_t)-2)
 386
 387 struct pf_osfp_entry {
 388         SLIST_ENTRY(pf_osfp_entry) fp_entry;
 389         pf_osfp_t               fp_os;
 390         int                     fp_enflags;
 391 #define PF_OSFP_EXPANDED        0x001           /* expanded entry */
 392 #define PF_OSFP_GENERIC         0x002           /* generic signature */
 393 #define PF_OSFP_NODETAIL        0x004           /* no p0f details */
 394 #define PF_OSFP_LEN     32
 395         char                    fp_class_nm[PF_OSFP_LEN];
 396         char                    fp_version_nm[PF_OSFP_LEN];
 397         char                    fp_subtype_nm[PF_OSFP_LEN];
 398 };
 399 #define PF_OSFP_ENTRY_EQ(a, b) \
 400     ((a)->fp_os == (b)->fp_os && \
 401     memcmp((a)->fp_class_nm, (b)->fp_class_nm, PF_OSFP_LEN) == 0 && \
 402     memcmp((a)->fp_version_nm, (b)->fp_version_nm, PF_OSFP_LEN) == 0 && \
 403     memcmp((a)->fp_subtype_nm, (b)->fp_subtype_nm, PF_OSFP_LEN) == 0)
 404
 405 /* handle pf_osfp_t packing */
 406 #define _FP_RESERVED_BIT        1  /* For the special negative #defines */
 407 #define _FP_UNUSED_BITS         1
 408 #define _FP_CLASS_BITS          10 /* OS Class (Windows, Linux) */
 409 #define _FP_VERSION_BITS        10 /* OS version (95, 98, NT, 2.4.54, 3.2) */
 410 #define _FP_SUBTYPE_BITS        10 /* patch level (NT SP4, SP3, ECN patch) */
 411 #define PF_OSFP_UNPACK(osfp, class, version, subtype) do { \
 412         (class) = ((osfp) >> (_FP_VERSION_BITS+_FP_SUBTYPE_BITS)) & \
 413             ((1 << _FP_CLASS_BITS) - 1); \
 414         (version) = ((osfp) >> _FP_SUBTYPE_BITS) & \
 415             ((1 << _FP_VERSION_BITS) - 1);\
 416         (subtype) = (osfp) & ((1 << _FP_SUBTYPE_BITS) - 1); \
 417 } while(0)
 418 #define PF_OSFP_PACK(osfp, class, version, subtype) do { \
 419         (osfp) = ((class) & ((1 << _FP_CLASS_BITS) - 1)) << (_FP_VERSION_BITS \
 420             + _FP_SUBTYPE_BITS); \
 421         (osfp) |= ((version) & ((1 << _FP_VERSION_BITS) - 1)) << \
 422             _FP_SUBTYPE_BITS; \
 423         (osfp) |= (subtype) & ((1 << _FP_SUBTYPE_BITS) - 1); \
 424 } while(0)
 425
 426 /* the fingerprint of an OSes TCP SYN packet */
 427 typedef u_int64_t       pf_tcpopts_t;
 428 struct pf_os_fingerprint {
 429         SLIST_HEAD(pf_osfp_enlist, pf_osfp_entry) fp_oses; /* list of matches */
 430         pf_tcpopts_t            fp_tcpopts;     /* packed TCP options */
 431         u_int16_t               fp_wsize;       /* TCP window size */
 432         u_int16_t               fp_psize;       /* ip->ip_len */
 433         u_int16_t               fp_mss;         /* TCP MSS */
 434         u_int16_t               fp_flags;
 435 #define PF_OSFP_WSIZE_MOD       0x0001          /* Window modulus */
 436 #define PF_OSFP_WSIZE_DC        0x0002          /* Window don't care */
 437 #define PF_OSFP_WSIZE_MSS       0x0004          /* Window multiple of MSS */
 438 #define PF_OSFP_WSIZE_MTU       0x0008          /* Window multiple of MTU */
 439 #define PF_OSFP_PSIZE_MOD       0x0010          /* packet size modulus */
 440 #define PF_OSFP_PSIZE_DC        0x0020          /* packet size don't care */
 441 #define PF_OSFP_WSCALE          0x0040          /* TCP window scaling */
 442 #define PF_OSFP_WSCALE_MOD      0x0080          /* TCP window scale modulus */
 443 #define PF_OSFP_WSCALE_DC       0x0100          /* TCP window scale dont-care */
 444 #define PF_OSFP_MSS             0x0200          /* TCP MSS */
 445 #define PF_OSFP_MSS_MOD         0x0400          /* TCP MSS modulus */
 446 #define PF_OSFP_MSS_DC          0x0800          /* TCP MSS dont-care */
 447 #define PF_OSFP_DF              0x1000          /* IPv4 don't fragment bit */
 448 #define PF_OSFP_TS0             0x2000          /* Zero timestamp */
 449 #define PF_OSFP_INET6           0x4000          /* IPv6 */
 450         u_int8_t                fp_optcnt;      /* TCP option count */
 451         u_int8_t                fp_wscale;      /* TCP window scaling */
 452         u_int8_t                fp_ttl;         /* IPv4 TTL */
 453 #define PF_OSFP_MAXTTL_OFFSET   40
 454 /* TCP options packing */
 455 #define PF_OSFP_TCPOPT_NOP      0x0             /* TCP NOP option */
 456 #define PF_OSFP_TCPOPT_WSCALE   0x1             /* TCP window scaling option */
 457 #define PF_OSFP_TCPOPT_MSS      0x2             /* TCP max segment size opt */
 458 #define PF_OSFP_TCPOPT_SACK     0x3             /* TCP SACK OK option */
 459 #define PF_OSFP_TCPOPT_TS       0x4             /* TCP timestamp option */
 460 #define PF_OSFP_TCPOPT_BITS     3               /* bits used by each option */
 461 #define PF_OSFP_MAX_OPTS \
 462     (sizeof(((struct pf_os_fingerprint *)0)->fp_tcpopts) * 8) \
 463     / PF_OSFP_TCPOPT_BITS
 464
 465         SLIST_ENTRY(pf_os_fingerprint)  fp_next;
 466 };
 467
 468 struct pf_osfp_ioctl {
 469         struct pf_osfp_entry    fp_os;
 470         pf_tcpopts_t            fp_tcpopts;     /* packed TCP options */
 471         u_int16_t               fp_wsize;       /* TCP window size */
 472         u_int16_t               fp_psize;       /* ip->ip_len */
 473         u_int16_t               fp_mss;         /* TCP MSS */
 474         u_int16_t               fp_flags;
 475         u_int8_t                fp_optcnt;      /* TCP option count */
 476         u_int8_t                fp_wscale;      /* TCP window scaling */
 477         u_int8_t                fp_ttl;         /* IPv4 TTL */
 478
 479         int                     fp_getnum;      /* DIOCOSFPGET number */
 480 };
 481
 482 #define PF_ANCHOR_NAME_SIZE      64
 483
 484 struct pf_rule {
 485         struct pf_rule_addr      src;
 486         struct pf_rule_addr      dst;
 487 #define PF_SKIP_IFP             0
 488 #define PF_SKIP_DIR             1
 489 #define PF_SKIP_AF              2
 490 #define PF_SKIP_PROTO           3
 491 #define PF_SKIP_SRC_ADDR        4
 492 #define PF_SKIP_SRC_PORT        5
 493 #define PF_SKIP_DST_ADDR        6
 494 #define PF_SKIP_DST_PORT        7
 495 #define PF_SKIP_COUNT           8
 496         union pf_rule_ptr        skip[PF_SKIP_COUNT];
 497 #define PF_RULE_LABEL_SIZE       64
 498 #define PF_RULE_MAX_LABEL_COUNT  5
 499         char                     label[PF_RULE_LABEL_SIZE];
 500         char                     ifname[IFNAMSIZ];
 501         char                     qname[PF_QNAME_SIZE];
 502         char                     pqname[PF_QNAME_SIZE];
 503 #define PF_TAG_NAME_SIZE         64
 504         char                     tagname[PF_TAG_NAME_SIZE];
 505         char                     match_tagname[PF_TAG_NAME_SIZE];
 506
 507         char                     overload_tblname[PF_TABLE_NAME_SIZE];
 508
 509         TAILQ_ENTRY(pf_rule)     entries;
 510         struct pf_pool           rpool;
 511
 512         u_int64_t                evaluations;
 513         u_int64_t                packets[2];
 514         u_int64_t                bytes[2];
 515
 516         struct pfi_kif          *kif;
 517         struct pf_anchor        *anchor;
 518         struct pfr_ktable       *overload_tbl;
 519
 520         pf_osfp_t                os_fingerprint;
 521
 522         int                      rtableid;
 523         u_int32_t                timeout[PFTM_OLD_MAX];
 524         u_int32_t                max_states;
 525         u_int32_t                max_src_nodes;
 526         u_int32_t                max_src_states;
 527         u_int32_t                max_src_conn;
 528         struct {
 529                 u_int32_t               limit;
 530                 u_int32_t               seconds;
 531         }                        max_src_conn_rate;
 532         u_int32_t                qid;
 533         u_int32_t                pqid;
 534         u_int32_t                rt_listid;
 535         u_int32_t                nr;
 536         u_int32_t                prob;
 537         uid_t                    cuid;
 538         pid_t                    cpid;
 539
 540         counter_u64_t            states_cur;
 541         counter_u64_t            states_tot;
 542         counter_u64_t            src_nodes;
 543
 544         u_int16_t                return_icmp;
 545         u_int16_t                return_icmp6;
 546         u_int16_t                max_mss;
 547         u_int16_t                tag;
 548         u_int16_t                match_tag;
 549         u_int16_t                scrub_flags;
 550
 551         struct pf_rule_uid       uid;
 552         struct pf_rule_gid       gid;
 553
 554         u_int32_t                rule_flag;
 555         u_int8_t                 action;
 556         u_int8_t                 direction;
 557         u_int8_t                 log;
 558         u_int8_t                 logif;
 559         u_int8_t                 quick;
 560         u_int8_t                 ifnot;
 561         u_int8_t                 match_tag_not;
 562         u_int8_t                 natpass;
 563
 564 #define PF_STATE_NORMAL         0x1
 565 #define PF_STATE_MODULATE       0x2
 566 #define PF_STATE_SYNPROXY       0x3
 567         u_int8_t                 keep_state;
 568         sa_family_t              af;
 569         u_int8_t                 proto;
 570         u_int8_t                 type;
 571         u_int8_t                 code;
 572         u_int8_t                 flags;
 573         u_int8_t                 flagset;
 574         u_int8_t                 min_ttl;
 575         u_int8_t                 allow_opts;
 576         u_int8_t                 rt;
 577         u_int8_t                 return_ttl;
 578         u_int8_t                 tos;
 579         u_int8_t                 set_tos;
 580         u_int8_t                 anchor_relative;
 581         u_int8_t                 anchor_wildcard;
 582
 583 #define PF_FLUSH                0x01
 584 #define PF_FLUSH_GLOBAL         0x02
 585         u_int8_t                 flush;
 586 #define PF_PRIO_ZERO            0xff            /* match "prio 0" packets */
 587 #define PF_PRIO_MAX             7
 588         u_int8_t                 prio;
 589         u_int8_t                 set_prio[2];
 590
 591         struct {
 592                 struct pf_addr          addr;
 593                 u_int16_t               port;
 594         }                       divert;
 595
 596         uint64_t                 u_states_cur;
 597         uint64_t                 u_states_tot;
 598         uint64_t                 u_src_nodes;
 599 };
 600
 601 /* pf_krule->rule_flag and old-style scrub flags */
 602 #define PFRULE_DROP             0x00000000
 603 #define PFRULE_RETURNRST        0x00000001
 604 #define PFRULE_FRAGMENT         0x00000002
 605 #define PFRULE_RETURNICMP       0x00000004
 606 #define PFRULE_RETURN           0x00000008
 607 #define PFRULE_NOSYNC           0x00000010
 608 #define PFRULE_SRCTRACK         0x00000020  /* track source states */
 609 #define PFRULE_RULESRCTRACK     0x00000040  /* per rule */
 610 #define PFRULE_NODF             0x00000100
 611 #define PFRULE_FRAGMENT_NOREASS 0x00000200
 612 #define PFRULE_RANDOMID         0x00000800
 613 #define PFRULE_REASSEMBLE_TCP   0x00001000
 614 #define PFRULE_SET_TOS          0x00002000
 615 #define PFRULE_IFBOUND          0x00010000 /* if-bound */
 616 #define PFRULE_STATESLOPPY      0x00020000 /* sloppy state tracking */
 617 #define PFRULE_PFLOW            0x00040000
 618
 619 #ifdef _KERNEL
 620 #define PFRULE_REFS             0x0080  /* rule has references */
 621 #endif
 622
 623 /* pf_rule_actions->dnflags */
 624 #define PFRULE_DN_IS_PIPE       0x0040
 625 #define PFRULE_DN_IS_QUEUE      0x0080
 626
 627 /* pf_state->state_flags, pf_rule_actions->flags, pf_krule->scrub_flags */
 628 #define PFSTATE_ALLOWOPTS       0x0001
 629 #define PFSTATE_SLOPPY          0x0002
 630 #define PFSTATE_PFLOW           0x0004
 631 #define PFSTATE_NOSYNC          0x0008
 632 #define PFSTATE_ACK             0x0010
 633 #define PFSTATE_NODF            0x0020
 634 #define PFSTATE_SETTOS          0x0040
 635 #define PFSTATE_RANDOMID        0x0080
 636 #define PFSTATE_SCRUB_TCP       0x0100
 637 #define PFSTATE_SETPRIO         0x0200
 638 /* was  PFSTATE_INP_UNLINKED    0x0400 */
 639 /* FreeBSD-specific flags are added from the end to keep space for porting
 640  * flags from OpenBSD */
 641 #define PFSTATE_DN_IS_PIPE      0x4000
 642 #define PFSTATE_DN_IS_QUEUE     0x8000
 643 #define PFSTATE_SCRUBMASK (PFSTATE_NODF|PFSTATE_RANDOMID|PFSTATE_SCRUB_TCP)
 644 #define PFSTATE_SETMASK   (PFSTATE_SETTOS|PFSTATE_SETPRIO)
 645
 646 #define PFSTATE_HIWAT           100000  /* default state table size */
 647 #define PFSTATE_ADAPT_START     60000   /* default adaptive timeout start */
 648 #define PFSTATE_ADAPT_END       120000  /* default adaptive timeout end */
 649
 650
 651 struct pf_threshold {
 652         u_int32_t       limit;
 653 #define PF_THRESHOLD_MULT       1000
 654 #define PF_THRESHOLD_MAX        0xffffffff / PF_THRESHOLD_MULT
 655         u_int32_t       seconds;
 656         u_int32_t       count;
 657         u_int32_t       last;
 658 };
 659
 660 struct pf_src_node {
 661         LIST_ENTRY(pf_src_node) entry;
 662         struct pf_addr   addr;
 663         struct pf_addr   raddr;
 664         union pf_rule_ptr rule;
 665         struct pfi_kif  *kif;
 666         u_int64_t        bytes[2];
 667         u_int64_t        packets[2];
 668         u_int32_t        states;
 669         u_int32_t        conn;
 670         struct pf_threshold     conn_rate;
 671         u_int32_t        creation;
 672         u_int32_t        expire;
 673         sa_family_t      af;
 674         u_int8_t         ruletype;
 675 };
 676
 677 #define PFSNODE_HIWAT           10000   /* default source node table size */
 678
 679 TAILQ_HEAD(pf_rulequeue, pf_rule);
 680
 681 struct pf_anchor;
 682
 683 struct pf_ruleset {
 684         struct {
 685                 struct pf_rulequeue      queues[2];
 686                 struct {
 687                         struct pf_rulequeue     *ptr;
 688                         struct pf_rule          **ptr_array;
 689                         u_int32_t                rcount;
 690                         u_int32_t                ticket;
 691                         int                      open;
 692                 }                        active, inactive;
 693         }                        rules[PF_RULESET_MAX];
 694         struct pf_anchor        *anchor;
 695         u_int32_t                tticket;
 696         int                      tables;
 697         int                      topen;
 698 };
 699
 700 RB_HEAD(pf_anchor_global, pf_anchor);
 701 RB_HEAD(pf_anchor_node, pf_anchor);
 702 struct pf_anchor {
 703         RB_ENTRY(pf_anchor)      entry_global;
 704         RB_ENTRY(pf_anchor)      entry_node;
 705         struct pf_anchor        *parent;
 706         struct pf_anchor_node    children;
 707         char                     name[PF_ANCHOR_NAME_SIZE];
 708         char                     path[MAXPATHLEN];
 709         struct pf_ruleset        ruleset;
 710         int                      refcnt;        /* anchor rules */
 711         int                      match; /* XXX: used for pfctl black magic */
 712 };
 713 RB_PROTOTYPE(pf_anchor_global, pf_anchor, entry_global, pf_anchor_compare);
 714 RB_PROTOTYPE(pf_anchor_node, pf_anchor, entry_node, pf_anchor_compare);
 715
 716 int      pf_get_ruleset_number(u_int8_t);
 717
 718 #endif  /* _NET_PF_H_ */