[apple/xnu.git] / bsd / netinet / ip_fw2.h

/*
 * Copyright (c) 2002 Luigi Rizzo, Universita` di Pisa
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 * $FreeBSD: src/sys/netinet/ip_fw2.h,v 1.1.2.4 2003/07/17 06:03:39 luigi Exp $
 */

#ifndef _IPFW2_H
#define _IPFW2_H

/*
 * The kernel representation of ipfw rules is made of a list of
 * 'instructions' (for all practical purposes equivalent to BPF
 * instructions), which specify which fields of the packet
 * (or its metadata) should be analysed.
 *
 * Each instruction is stored in a structure which begins with
 * "ipfw_insn", and can contain extra fields depending on the
 * instruction type (listed below).
 * Note that the code is written so that individual instructions
 * have a size which is a multiple of 32 bits. This means that, if
 * such structures contain pointers or other 64-bit entities,
 * (there is just one instance now) they may end up unaligned on
 * 64-bit architectures, so the must be handled with care.
 *
 * "enum ipfw_opcodes" are the opcodes supported. We can have up
 * to 256 different opcodes.
 */

enum ipfw_opcodes {		/* arguments (4 byte each)	*/
	O_NOP,

	O_IP_SRC,		/* u32 = IP			*/
	O_IP_SRC_MASK,		/* ip = IP/mask			*/
	O_IP_SRC_ME,		/* none				*/
	O_IP_SRC_SET,		/* u32=base, arg1=len, bitmap	*/

	O_IP_DST,		/* u32 = IP			*/
	O_IP_DST_MASK,		/* ip = IP/mask			*/
	O_IP_DST_ME,		/* none				*/
	O_IP_DST_SET,		/* u32=base, arg1=len, bitmap	*/

	O_IP_SRCPORT,		/* (n)port list:mask 4 byte ea	*/
	O_IP_DSTPORT,		/* (n)port list:mask 4 byte ea	*/
	O_PROTO,		/* arg1=protocol		*/

	O_MACADDR2,		/* 2 mac addr:mask		*/
	O_MAC_TYPE,		/* same as srcport		*/

	O_LAYER2,		/* none				*/
	O_IN,			/* none				*/
	O_FRAG,			/* none				*/

	O_RECV,			/* none				*/
	O_XMIT,			/* none				*/
	O_VIA,			/* none				*/

	O_IPOPT,		/* arg1 = 2*u8 bitmap		*/
	O_IPLEN,		/* arg1 = len			*/
	O_IPID,			/* arg1 = id			*/

	O_IPTOS,		/* arg1 = id			*/
	O_IPPRECEDENCE,		/* arg1 = precedence << 5	*/
	O_IPTTL,		/* arg1 = TTL			*/

	O_IPVER,		/* arg1 = version		*/
	O_UID,			/* u32 = id			*/
	O_GID,			/* u32 = id			*/
	O_ESTAB,		/* none (tcp established)	*/
	O_TCPFLAGS,		/* arg1 = 2*u8 bitmap		*/
	O_TCPWIN,		/* arg1 = desired win		*/
	O_TCPSEQ,		/* u32 = desired seq.		*/
	O_TCPACK,		/* u32 = desired seq.		*/
	O_ICMPTYPE,		/* u32 = icmp bitmap		*/
	O_TCPOPTS,		/* arg1 = 2*u8 bitmap		*/

	O_VERREVPATH,		/* none				*/

	O_PROBE_STATE,		/* none				*/
	O_KEEP_STATE,		/* none				*/
	O_LIMIT,		/* ipfw_insn_limit		*/
	O_LIMIT_PARENT,		/* dyn_type, not an opcode.	*/

	/*
	 * These are really 'actions'.
	 */

	O_LOG,			/* ipfw_insn_log		*/
	O_PROB,			/* u32 = match probability	*/

	O_CHECK_STATE,		/* none				*/
	O_ACCEPT,		/* none				*/
	O_DENY,			/* none 			*/
	O_REJECT,		/* arg1=icmp arg (same as deny)	*/
	O_COUNT,		/* none				*/
	O_SKIPTO,		/* arg1=next rule number	*/
	O_PIPE,			/* arg1=pipe number		*/
	O_QUEUE,		/* arg1=queue number		*/
	O_DIVERT,		/* arg1=port number		*/
	O_TEE,			/* arg1=port number		*/
	O_FORWARD_IP,		/* fwd sockaddr			*/
	O_FORWARD_MAC,		/* fwd mac			*/

	/*
	 * More opcodes.
	 */
	O_IPSEC,		/* has ipsec history		*/

	O_LAST_OPCODE		/* not an opcode!		*/
};

/*
 * Template for instructions.
 *
 * ipfw_insn is used for all instructions which require no operands,
 * a single 16-bit value (arg1), or a couple of 8-bit values.
 *
 * For other instructions which require different/larger arguments
 * we have derived structures, ipfw_insn_*.
 *
 * The size of the instruction (in 32-bit words) is in the low
 * 6 bits of "len". The 2 remaining bits are used to implement
 * NOT and OR on individual instructions. Given a type, you can
 * compute the length to be put in "len" using F_INSN_SIZE(t)
 *
 * F_NOT	negates the match result of the instruction.
 *
 * F_OR		is used to build or blocks. By default, instructions
 *		are evaluated as part of a logical AND. An "or" block
 *		{ X or Y or Z } contains F_OR set in all but the last
 *		instruction of the block. A match will cause the code
 *		to skip past the last instruction of the block.
 *
 * NOTA BENE: in a couple of places we assume that
 *	sizeof(ipfw_insn) == sizeof(u_int32_t)
 * this needs to be fixed.
 *
 */
typedef struct	_ipfw_insn {	/* template for instructions */
	enum ipfw_opcodes	opcode:8;
	u_int8_t	len;	/* numer of 32-byte words */
#define	F_NOT		0x80
#define	F_OR		0x40
#define	F_LEN_MASK	0x3f
#define	F_LEN(cmd)	((cmd)->len & F_LEN_MASK)

	u_int16_t	arg1;
} ipfw_insn;

/*
 * The F_INSN_SIZE(type) computes the size, in 4-byte words, of
 * a given type.
 */
#define	F_INSN_SIZE(t)	((sizeof (t))/sizeof(u_int32_t))

/*
 * This is used to store an array of 16-bit entries (ports etc.)
 */
typedef struct	_ipfw_insn_u16 {
	ipfw_insn o;
	u_int16_t ports[2];	/* there may be more */
} ipfw_insn_u16;

/*
 * This is used to store an array of 32-bit entries
 * (uid, single IPv4 addresses etc.)
 */
typedef struct	_ipfw_insn_u32 {
	ipfw_insn o;
	u_int32_t d[1];	/* one or more */
} ipfw_insn_u32;

/*
 * This is used to store IP addr-mask pairs.
 */
typedef struct	_ipfw_insn_ip {
	ipfw_insn o;
	struct in_addr	addr;
	struct in_addr	mask;
} ipfw_insn_ip;

/*
 * This is used to forward to a given address (ip).
 */
typedef struct  _ipfw_insn_sa {
	ipfw_insn o;
	struct sockaddr_in sa;
} ipfw_insn_sa;

/*
 * This is used for MAC addr-mask pairs.
 */
typedef struct	_ipfw_insn_mac {
	ipfw_insn o;
	u_char addr[12];	/* dst[6] + src[6] */
	u_char mask[12];	/* dst[6] + src[6] */
} ipfw_insn_mac;

/*
 * This is used for interface match rules (recv xx, xmit xx).
 */
typedef struct	_ipfw_insn_if {
	ipfw_insn o;
	union {
		struct in_addr ip;
		int32_t unit;
	} p;
	char name[IFNAMSIZ];
} ipfw_insn_if;

/*
 * This is used for pipe and queue actions, which need to store
 * a single pointer (which can have different size on different
 * architectures.
 * Note that, because of previous instructions, pipe_ptr might
 * be unaligned in the overall structure, so it needs to be
 * manipulated with care.
 */
typedef struct	_ipfw_insn_pipe {
	ipfw_insn	o;
	void		*pipe_ptr;	/* XXX */
} ipfw_insn_pipe;

/*
 * This is used for limit rules.
 */
typedef struct	_ipfw_insn_limit {
	ipfw_insn o;
	u_int8_t _pad;
	u_int8_t limit_mask;	/* combination of DYN_* below	*/
#define	DYN_SRC_ADDR	0x1
#define	DYN_SRC_PORT	0x2
#define	DYN_DST_ADDR	0x4
#define	DYN_DST_PORT	0x8

	u_int16_t conn_limit;
} ipfw_insn_limit;

/*
 * This is used for log instructions.
 */
typedef struct  _ipfw_insn_log {
        ipfw_insn o;
	u_int32_t max_log;	/* how many do we log -- 0 = all */
	u_int32_t log_left;	/* how many left to log 	*/
} ipfw_insn_log;

/* Version of this API */
#define IP_FW_VERSION_NONE 0 
#define IP_FW_VERSION_0 10	/* old ipfw */
#define IP_FW_VERSION_1 20	/* ipfw in Jaguar/Panther */
#define IP_FW_VERSION_2 30	/* ipfw2 */
#define IP_FW_CURRENT_API_VERSION IP_FW_VERSION_2 

/*
 * Here we have the structure representing an ipfw rule.
 *
 * It starts with a general area (with link fields and counters)
 * followed by an array of one or more instructions, which the code
 * accesses as an array of 32-bit values.
 *
 * Given a rule pointer  r:
 *
 *  r->cmd		is the start of the first instruction.
 *  ACTION_PTR(r)	is the start of the first action (things to do
 *			once a rule matched).
 *
 * When assembling instruction, remember the following:
 *
 *  + if a rule has a "keep-state" (or "limit") option, then the
 *	first instruction (at r->cmd) MUST BE an O_PROBE_STATE
 *  + if a rule has a "log" option, then the first action
 *	(at ACTION_PTR(r)) MUST be O_LOG
 *
 * NOTE: we use a simple linked list of rules because we never need
 * 	to delete a rule without scanning the list. We do not use
 *	queue(3) macros for portability and readability.
 */

struct ip_fw {
	u_int32_t version;		/* Version of this structure. MUST be set */
							/* by clients. Should always be */
							/* set to IP_FW_CURRENT_API_VERSION. */
	void *context;			/* Context that is usable by user processes to */
							/* identify this rule. */
	struct ip_fw	*next;		/* linked list of rules		*/
	struct ip_fw	*next_rule;	/* ptr to next [skipto] rule	*/
	/* 'next_rule' is used to pass up 'set_disable' status		*/

	u_int16_t	act_ofs;	/* offset of action in 32-bit units */
	u_int16_t	cmd_len;	/* # of 32-bit words in cmd	*/
	u_int16_t	rulenum;	/* rule number			*/
	u_int8_t	set;		/* rule set (0..31)		*/
	u_int32_t	set_masks[2];	/* masks for manipulating sets atomically */
#define	RESVD_SET	31	/* set for default and persistent rules */
	u_int8_t	_pad;		/* padding			*/

	/* These fields are present in all rules.			*/
	u_int64_t	pcnt;		/* Packet counter		*/
	u_int64_t	bcnt;		/* Byte counter			*/
	u_int32_t	timestamp;	/* tv_sec of last match		*/
	
	u_int32_t	reserved_1;	/* reserved - set to 0 */
	u_int32_t	reserved_2;	/* reserved - set to 0 */

	ipfw_insn	cmd[1];		/* storage for commands		*/
};

#define ACTION_PTR(rule)				\
	(ipfw_insn *)( (u_int32_t *)((rule)->cmd) + ((rule)->act_ofs) )

#define RULESIZE(rule)  (sizeof(struct ip_fw) + \
	((struct ip_fw *)(rule))->cmd_len * 4 - 4)

/*
 * This structure is used as a flow mask and a flow id for various
 * parts of the code.
 */
struct ipfw_flow_id {
	u_int32_t	dst_ip;
	u_int32_t	src_ip;
	u_int16_t	dst_port;
	u_int16_t	src_port;
	u_int8_t	proto;
	u_int8_t	flags;	/* protocol-specific flags */
};

/*
 * Dynamic ipfw rule.
 */
typedef struct _ipfw_dyn_rule ipfw_dyn_rule;

struct _ipfw_dyn_rule {
	ipfw_dyn_rule	*next;		/* linked list of rules.	*/
	struct ip_fw *rule;		/* pointer to rule		*/
	/* 'rule' is used to pass up the rule number (from the parent)	*/

	ipfw_dyn_rule *parent;		/* pointer to parent rule	*/
	u_int64_t	pcnt;		/* packet match counter		*/
	u_int64_t	bcnt;		/* byte match counter		*/
	struct ipfw_flow_id id;		/* (masked) flow id		*/
	u_int32_t	expire;		/* expire time			*/
	u_int32_t	bucket;		/* which bucket in hash table	*/
	u_int32_t	state;		/* state of this rule (typically a
					 * combination of TCP flags)
					 */
	u_int32_t	ack_fwd;	/* most recent ACKs in forward	*/
	u_int32_t	ack_rev;	/* and reverse directions (used	*/
					/* to generate keepalives)	*/
	u_int16_t	dyn_type;	/* rule type			*/
	u_int16_t	count;		/* refcount			*/
};

/*
 * Definitions for IP option names.
 */
#define	IP_FW_IPOPT_LSRR	0x01
#define	IP_FW_IPOPT_SSRR	0x02
#define	IP_FW_IPOPT_RR		0x04
#define	IP_FW_IPOPT_TS		0x08

/*
 * Definitions for TCP option names.
 */
#define	IP_FW_TCPOPT_MSS	0x01
#define	IP_FW_TCPOPT_WINDOW	0x02
#define	IP_FW_TCPOPT_SACK	0x04
#define	IP_FW_TCPOPT_TS		0x08
#define	IP_FW_TCPOPT_CC		0x10

#define	ICMP_REJECT_RST		0x100	/* fake ICMP code (send a TCP RST) */

/*
 * Main firewall chains definitions and global var's definitions.
 */
#ifdef KERNEL

#define	IP_FW_PORT_DYNT_FLAG	0x10000
#define	IP_FW_PORT_TEE_FLAG	0x20000
#define	IP_FW_PORT_DENY_FLAG	0x40000

/*
 * Arguments for calling ipfw_chk() and dummynet_io(). We put them
 * all into a structure because this way it is easier and more
 * efficient to pass variables around and extend the interface.
 */
struct ip_fw_args {
	struct mbuf	*m;		/* the mbuf chain		*/
	struct ifnet	*oif;		/* output interface		*/
	struct sockaddr_in *next_hop;	/* forward address		*/
	struct ip_fw	*rule;		/* matching rule		*/
	struct ether_header *eh;	/* for bridged packets		*/

	struct route	*ro;		/* for dummynet			*/
	struct sockaddr_in *dst;	/* for dummynet			*/
	int flags;			/* for dummynet			*/

	struct ipfw_flow_id f_id;	/* grabbed from IP header	*/
	u_int16_t	divert_rule;	/* divert cookie		*/
	u_int32_t	retval;
};

/*
 * Function definitions.
 */

/* Firewall hooks */
struct sockopt;
struct dn_flow_set;

void flush_pipe_ptrs(struct dn_flow_set *match); /* used by dummynet */
void ipfw_init(void);	/* called from raw_ip.c: load_ipfw() */

typedef int ip_fw_chk_t (struct ip_fw_args *args);
typedef int ip_fw_ctl_t (struct sockopt *);
extern ip_fw_chk_t *ip_fw_chk_ptr;
extern ip_fw_ctl_t *ip_fw_ctl_ptr;
extern int fw_one_pass;
extern int fw_enable;
#define	IPFW_LOADED	(ip_fw_chk_ptr != NULL)
#endif /* KERNEL */

#endif /* _IPFW2_H */
Commit	Line	Data
91447636 A	1	/*
	2	* Copyright (c) 2002 Luigi Rizzo, Universita` di Pisa
	3	*
	4	* Redistribution and use in source and binary forms, with or without
	5	* modification, are permitted provided that the following conditions
	6	* are met:
	7	* 1. Redistributions of source code must retain the above copyright
	8	* notice, this list of conditions and the following disclaimer.
	9	* 2. Redistributions in binary form must reproduce the above copyright
	10	* notice, this list of conditions and the following disclaimer in the
	11	* documentation and/or other materials provided with the distribution.
	12	*
	13	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
	14	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	16	* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
	17	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	18	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	19	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	20	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	21	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	22	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	23	* SUCH DAMAGE.
	24	*
	25	* $FreeBSD: src/sys/netinet/ip_fw2.h,v 1.1.2.4 2003/07/17 06:03:39 luigi Exp $
	26	*/
	27
	28	#ifndef _IPFW2_H
	29	#define _IPFW2_H
	30
	31	/*
	32	* The kernel representation of ipfw rules is made of a list of
	33	* 'instructions' (for all practical purposes equivalent to BPF
	34	* instructions), which specify which fields of the packet
	35	* (or its metadata) should be analysed.
	36	*
	37	* Each instruction is stored in a structure which begins with
	38	* "ipfw_insn", and can contain extra fields depending on the
	39	* instruction type (listed below).
	40	* Note that the code is written so that individual instructions
	41	* have a size which is a multiple of 32 bits. This means that, if
	42	* such structures contain pointers or other 64-bit entities,
	43	* (there is just one instance now) they may end up unaligned on
	44	* 64-bit architectures, so the must be handled with care.
	45	*
	46	* "enum ipfw_opcodes" are the opcodes supported. We can have up
	47	* to 256 different opcodes.
	48	*/
	49
	50	enum ipfw_opcodes { /* arguments (4 byte each) */
	51	O_NOP,
	52
	53	O_IP_SRC, /* u32 = IP */
	54	O_IP_SRC_MASK, /* ip = IP/mask */
	55	O_IP_SRC_ME, /* none */
	56	O_IP_SRC_SET, /* u32=base, arg1=len, bitmap */
	57
	58	O_IP_DST, /* u32 = IP */
	59	O_IP_DST_MASK, /* ip = IP/mask */
	60	O_IP_DST_ME, /* none */
	61	O_IP_DST_SET, /* u32=base, arg1=len, bitmap */
	62
	63	O_IP_SRCPORT, /* (n)port list:mask 4 byte ea */
	64	O_IP_DSTPORT, /* (n)port list:mask 4 byte ea */
65	O_PROTO, /* arg1=protocol */
66
67	O_MACADDR2, /* 2 mac addr:mask */
68	O_MAC_TYPE, /* same as srcport */
69
70	O_LAYER2, /* none */
71	O_IN, /* none */
72	O_FRAG, /* none */
73
74	O_RECV, /* none */
75	O_XMIT, /* none */
76	O_VIA, /* none */
77
78	O_IPOPT, /* arg1 = 2u8 bitmap /
79	O_IPLEN, /* arg1 = len */
80	O_IPID, /* arg1 = id */
81
82	O_IPTOS, /* arg1 = id */
83	O_IPPRECEDENCE, /* arg1 = precedence << 5 */
84	O_IPTTL, /* arg1 = TTL */
85
86	O_IPVER, /* arg1 = version */
87	O_UID, /* u32 = id */
88	O_GID, /* u32 = id */
89	O_ESTAB, /* none (tcp established) */
90	O_TCPFLAGS, /* arg1 = 2u8 bitmap /
91	O_TCPWIN, /* arg1 = desired win */
92	O_TCPSEQ, /* u32 = desired seq. */
93	O_TCPACK, /* u32 = desired seq. */
94	O_ICMPTYPE, /* u32 = icmp bitmap */
95	O_TCPOPTS, /* arg1 = 2u8 bitmap /
96
97	O_VERREVPATH, /* none */
98
99	O_PROBE_STATE, /* none */
100	O_KEEP_STATE, /* none */
101	O_LIMIT, /* ipfw_insn_limit */
102	O_LIMIT_PARENT, /* dyn_type, not an opcode. */
103
104	/*
105	* These are really 'actions'.
106	*/
107
108	O_LOG, /* ipfw_insn_log */
109	O_PROB, /* u32 = match probability */
110
111	O_CHECK_STATE, /* none */
112	O_ACCEPT, /* none */
113	O_DENY, /* none */
114	O_REJECT, /* arg1=icmp arg (same as deny) */
115	O_COUNT, /* none */
116	O_SKIPTO, /* arg1=next rule number */
117	O_PIPE, /* arg1=pipe number */
118	O_QUEUE, /* arg1=queue number */
119	O_DIVERT, /* arg1=port number */
120	O_TEE, /* arg1=port number */
121	O_FORWARD_IP, /* fwd sockaddr */
122	O_FORWARD_MAC, /* fwd mac */
123
124	/*
125	* More opcodes.
126	*/
127	O_IPSEC, /* has ipsec history */
128
129	O_LAST_OPCODE /* not an opcode! */
130	};
131
132	/*
133	* Template for instructions.
134	*
135	* ipfw_insn is used for all instructions which require no operands,
136	* a single 16-bit value (arg1), or a couple of 8-bit values.
137	*
138	* For other instructions which require different/larger arguments
139	* we have derived structures, ipfw_insn_*.
140	*
141	* The size of the instruction (in 32-bit words) is in the low
142	* 6 bits of "len". The 2 remaining bits are used to implement
143	* NOT and OR on individual instructions. Given a type, you can
144	* compute the length to be put in "len" using F_INSN_SIZE(t)
145	*
146	* F_NOT negates the match result of the instruction.
147	*
148	* F_OR is used to build or blocks. By default, instructions
149	* are evaluated as part of a logical AND. An "or" block
150	* { X or Y or Z } contains F_OR set in all but the last
151	* instruction of the block. A match will cause the code
152	* to skip past the last instruction of the block.
153	*
154	* NOTA BENE: in a couple of places we assume that
155	* sizeof(ipfw_insn) == sizeof(u_int32_t)
156	* this needs to be fixed.
157	*
158	*/
159	typedef struct _ipfw_insn { /* template for instructions */
160	enum ipfw_opcodes opcode:8;
161	u_int8_t len; /* numer of 32-byte words */
162	#define F_NOT 0x80
163	#define F_OR 0x40
164	#define F_LEN_MASK 0x3f
165	#define F_LEN(cmd) ((cmd)->len & F_LEN_MASK)
166
167	u_int16_t arg1;
168	} ipfw_insn;
169
170	/*
171	* The F_INSN_SIZE(type) computes the size, in 4-byte words, of
172	* a given type.
173	*/
174	#define F_INSN_SIZE(t) ((sizeof (t))/sizeof(u_int32_t))
175
176	/*
177	* This is used to store an array of 16-bit entries (ports etc.)
178	*/
179	typedef struct _ipfw_insn_u16 {
180	ipfw_insn o;
181	u_int16_t ports[2]; /* there may be more */
182	} ipfw_insn_u16;
183
184	/*
185	* This is used to store an array of 32-bit entries
186	* (uid, single IPv4 addresses etc.)
187	*/
188	typedef struct _ipfw_insn_u32 {
189	ipfw_insn o;
190	u_int32_t d[1]; /* one or more */
191	} ipfw_insn_u32;
192
193	/*
194	* This is used to store IP addr-mask pairs.
195	*/
196	typedef struct _ipfw_insn_ip {
197	ipfw_insn o;
198	struct in_addr addr;
199	struct in_addr mask;
200	} ipfw_insn_ip;
201
202	/*
203	* This is used to forward to a given address (ip).
204	*/
205	typedef struct _ipfw_insn_sa {
206	ipfw_insn o;
207	struct sockaddr_in sa;
208	} ipfw_insn_sa;
209
210	/*
211	* This is used for MAC addr-mask pairs.
212	*/
213	typedef struct _ipfw_insn_mac {
214	ipfw_insn o;
215	u_char addr[12]; /* dst[6] + src[6] */
216	u_char mask[12]; /* dst[6] + src[6] */
217	} ipfw_insn_mac;
218
219	/*
220	* This is used for interface match rules (recv xx, xmit xx).
221	*/
222	typedef struct _ipfw_insn_if {
223	ipfw_insn o;
224	union {
225	struct in_addr ip;
226	int32_t unit;
227	} p;
228	char name[IFNAMSIZ];
229	} ipfw_insn_if;
230
231	/*
232	* This is used for pipe and queue actions, which need to store
233	* a single pointer (which can have different size on different
234	* architectures.
235	* Note that, because of previous instructions, pipe_ptr might
236	* be unaligned in the overall structure, so it needs to be
237	* manipulated with care.
238	*/
239	typedef struct _ipfw_insn_pipe {
240	ipfw_insn o;
241	void pipe_ptr; / XXX */
242	} ipfw_insn_pipe;
243
244	/*
245	* This is used for limit rules.
246	*/
247	typedef struct _ipfw_insn_limit {
248	ipfw_insn o;
249	u_int8_t _pad;
250	u_int8_t limit_mask; /* combination of DYN_* below */
251	#define DYN_SRC_ADDR 0x1
252	#define DYN_SRC_PORT 0x2
253	#define DYN_DST_ADDR 0x4
254	#define DYN_DST_PORT 0x8
255
256	u_int16_t conn_limit;
257	} ipfw_insn_limit;
258
259	/*
260	* This is used for log instructions.
261	*/
262	typedef struct _ipfw_insn_log {
263	ipfw_insn o;
264	u_int32_t max_log; /* how many do we log -- 0 = all */
265	u_int32_t log_left; /* how many left to log */
266	} ipfw_insn_log;
267
268	/* Version of this API */
269	#define IP_FW_VERSION_NONE 0
270	#define IP_FW_VERSION_0 10 /* old ipfw */
271	#define IP_FW_VERSION_1 20 /* ipfw in Jaguar/Panther */
272	#define IP_FW_VERSION_2 30 /* ipfw2 */
273	#define IP_FW_CURRENT_API_VERSION IP_FW_VERSION_2
274
275	/*
276	* Here we have the structure representing an ipfw rule.
277	*
278	* It starts with a general area (with link fields and counters)
279	* followed by an array of one or more instructions, which the code
280	* accesses as an array of 32-bit values.
281	*
282	* Given a rule pointer r:
283	*
284	* r->cmd is the start of the first instruction.
285	* ACTION_PTR(r) is the start of the first action (things to do
286	* once a rule matched).
287	*
288	* When assembling instruction, remember the following:
289	*
290	* + if a rule has a "keep-state" (or "limit") option, then the
291	* first instruction (at r->cmd) MUST BE an O_PROBE_STATE
292	* + if a rule has a "log" option, then the first action
293	* (at ACTION_PTR(r)) MUST be O_LOG
294	*
295	* NOTE: we use a simple linked list of rules because we never need
296	* to delete a rule without scanning the list. We do not use
297	* queue(3) macros for portability and readability.
298	*/
299
300	struct ip_fw {
301	u_int32_t version; /* Version of this structure. MUST be set */
302	/* by clients. Should always be */
303	/* set to IP_FW_CURRENT_API_VERSION. */
304	void context; / Context that is usable by user processes to */
305	/* identify this rule. */
306	struct ip_fw next; / linked list of rules */
307	struct ip_fw next_rule; / ptr to next [skipto] rule */
308	/* 'next_rule' is used to pass up 'set_disable' status */
309
310	u_int16_t act_ofs; /* offset of action in 32-bit units */
311	u_int16_t cmd_len; /* # of 32-bit words in cmd */
312	u_int16_t rulenum; /* rule number */
313	u_int8_t set; /* rule set (0..31) */
314	u_int32_t set_masks[2]; /* masks for manipulating sets atomically */
315	#define RESVD_SET 31 /* set for default and persistent rules */
316	u_int8_t _pad; /* padding */
317
318	/* These fields are present in all rules. */
319	u_int64_t pcnt; /* Packet counter */
320	u_int64_t bcnt; /* Byte counter */
321	u_int32_t timestamp; /* tv_sec of last match */
322
323	u_int32_t reserved_1; /* reserved - set to 0 */
324	u_int32_t reserved_2; /* reserved - set to 0 */
325
326	ipfw_insn cmd[1]; /* storage for commands */
327	};
328
329	#define ACTION_PTR(rule) \
330	(ipfw_insn )( (u_int32_t )((rule)->cmd) + ((rule)->act_ofs) )
331
332	#define RULESIZE(rule) (sizeof(struct ip_fw) + \
333	((struct ip_fw )(rule))->cmd_len 4 - 4)
334
335	/*
336	* This structure is used as a flow mask and a flow id for various
337	* parts of the code.
338	*/
339	struct ipfw_flow_id {
340	u_int32_t dst_ip;
341	u_int32_t src_ip;
342	u_int16_t dst_port;
343	u_int16_t src_port;
344	u_int8_t proto;
345	u_int8_t flags; /* protocol-specific flags */
346	};
347
348	/*
349	* Dynamic ipfw rule.
350	*/
351	typedef struct _ipfw_dyn_rule ipfw_dyn_rule;
352
353	struct _ipfw_dyn_rule {
354	ipfw_dyn_rule next; / linked list of rules. */
355	struct ip_fw rule; / pointer to rule */
356	/* 'rule' is used to pass up the rule number (from the parent) */
357
358	ipfw_dyn_rule parent; / pointer to parent rule */
359	u_int64_t pcnt; /* packet match counter */
360	u_int64_t bcnt; /* byte match counter */
361	struct ipfw_flow_id id; /* (masked) flow id */
362	u_int32_t expire; /* expire time */
363	u_int32_t bucket; /* which bucket in hash table */
364	u_int32_t state; /* state of this rule (typically a
365	* combination of TCP flags)
366	*/
367	u_int32_t ack_fwd; /* most recent ACKs in forward */
368	u_int32_t ack_rev; /* and reverse directions (used */
369	/* to generate keepalives) */
370	u_int16_t dyn_type; /* rule type */
371	u_int16_t count; /* refcount */
372	};
373
374	/*
375	* Definitions for IP option names.
376	*/
377	#define IP_FW_IPOPT_LSRR 0x01
378	#define IP_FW_IPOPT_SSRR 0x02
379	#define IP_FW_IPOPT_RR 0x04
380	#define IP_FW_IPOPT_TS 0x08
381
382	/*
383	* Definitions for TCP option names.
384	*/
385	#define IP_FW_TCPOPT_MSS 0x01
386	#define IP_FW_TCPOPT_WINDOW 0x02
387	#define IP_FW_TCPOPT_SACK 0x04
388	#define IP_FW_TCPOPT_TS 0x08
389	#define IP_FW_TCPOPT_CC 0x10
390
391	#define ICMP_REJECT_RST 0x100 /* fake ICMP code (send a TCP RST) */
392
393	/*
394	* Main firewall chains definitions and global var's definitions.
395	*/
396	#ifdef KERNEL
397
398	#define IP_FW_PORT_DYNT_FLAG 0x10000
399	#define IP_FW_PORT_TEE_FLAG 0x20000
400	#define IP_FW_PORT_DENY_FLAG 0x40000
401
402	/*
403	* Arguments for calling ipfw_chk() and dummynet_io(). We put them
404	* all into a structure because this way it is easier and more
405	* efficient to pass variables around and extend the interface.
406	*/
407	struct ip_fw_args {
408	struct mbuf m; / the mbuf chain */
409	struct ifnet oif; / output interface */
410	struct sockaddr_in next_hop; / forward address */
411	struct ip_fw rule; / matching rule */
412	struct ether_header eh; / for bridged packets */
413
414	struct route ro; / for dummynet */
415	struct sockaddr_in dst; / for dummynet */
416	int flags; /* for dummynet */
417
418	struct ipfw_flow_id f_id; /* grabbed from IP header */
419	u_int16_t divert_rule; /* divert cookie */
420	u_int32_t retval;
421	};
422
423	/*
424	* Function definitions.
425	*/
426
427	/* Firewall hooks */
428	struct sockopt;
429	struct dn_flow_set;
430
431	void flush_pipe_ptrs(struct dn_flow_set match); / used by dummynet */
432	void ipfw_init(void); /* called from raw_ip.c: load_ipfw() */
433
434	typedef int ip_fw_chk_t (struct ip_fw_args *args);
435	typedef int ip_fw_ctl_t (struct sockopt *);
436	extern ip_fw_chk_t *ip_fw_chk_ptr;
437	extern ip_fw_ctl_t *ip_fw_ctl_ptr;
438	extern int fw_one_pass;
439	extern int fw_enable;
440	#define IPFW_LOADED (ip_fw_chk_ptr != NULL)
441	#endif /* KERNEL */
442
443	#endif /* _IPFW2_H */