-#define PFTM_TCP_FIRST_PACKET_VAL 120 /* First TCP packet */
-#define PFTM_TCP_OPENING_VAL 30 /* No response yet */
-#define PFTM_TCP_ESTABLISHED_VAL (24 * 60 * 60) /* Established */
-#define PFTM_TCP_CLOSING_VAL (15 * 60) /* Half closed */
-#define PFTM_TCP_FIN_WAIT_VAL 45 /* Got both FINs */
-#define PFTM_TCP_CLOSED_VAL 90 /* Got a RST */
-#define PFTM_UDP_FIRST_PACKET_VAL 60 /* First UDP packet */
-#define PFTM_UDP_SINGLE_VAL 30 /* Unidirectional */
-#define PFTM_UDP_MULTIPLE_VAL 60 /* Bidirectional */
-#define PFTM_ICMP_FIRST_PACKET_VAL 20 /* First ICMP packet */
-#define PFTM_ICMP_ERROR_REPLY_VAL 10 /* Got error response */
-#define PFTM_GREv1_FIRST_PACKET_VAL 120
-#define PFTM_GREv1_INITIATING_VAL 30
-#define PFTM_GREv1_ESTABLISHED_VAL 1800
-#define PFTM_ESP_FIRST_PACKET_VAL 120
-#define PFTM_ESP_INITIATING_VAL 30
-#define PFTM_ESP_ESTABLISHED_VAL 900
-#define PFTM_OTHER_FIRST_PACKET_VAL 60 /* First packet */
-#define PFTM_OTHER_SINGLE_VAL 30 /* Unidirectional */
-#define PFTM_OTHER_MULTIPLE_VAL 60 /* Bidirectional */
-#define PFTM_FRAG_VAL 30 /* Fragment expire */
-#define PFTM_INTERVAL_VAL 10 /* Expire interval */
-#define PFTM_SRC_NODE_VAL 0 /* Source tracking */
-#define PFTM_TS_DIFF_VAL 30 /* Allowed TS diff */
-
-enum { PF_NOPFROUTE, PF_FASTROUTE, PF_ROUTETO, PF_DUPTO, PF_REPLYTO };
-enum { PF_LIMIT_STATES,
+#define PFTM_TCP_FIRST_PACKET_VAL 120 /* First TCP packet */
+#define PFTM_TCP_OPENING_VAL 30 /* No response yet */
+#define PFTM_TCP_ESTABLISHED_VAL (24 * 60 * 60) /* Established */
+#define PFTM_TCP_CLOSING_VAL (15 * 60) /* Half closed */
+#define PFTM_TCP_FIN_WAIT_VAL 45 /* Got both FINs */
+#define PFTM_TCP_CLOSED_VAL 90 /* Got a RST */
+#define PFTM_UDP_FIRST_PACKET_VAL 60 /* First UDP packet */
+#define PFTM_UDP_SINGLE_VAL 30 /* Unidirectional */
+#define PFTM_UDP_MULTIPLE_VAL 60 /* Bidirectional */
+#define PFTM_ICMP_FIRST_PACKET_VAL 20 /* First ICMP packet */
+#define PFTM_ICMP_ERROR_REPLY_VAL 10 /* Got error response */
+#define PFTM_GREv1_FIRST_PACKET_VAL 120
+#define PFTM_GREv1_INITIATING_VAL 30
+#define PFTM_GREv1_ESTABLISHED_VAL 1800
+#define PFTM_ESP_FIRST_PACKET_VAL 120
+#define PFTM_ESP_INITIATING_VAL 30
+#define PFTM_ESP_ESTABLISHED_VAL 900
+#define PFTM_OTHER_FIRST_PACKET_VAL 60 /* First packet */
+#define PFTM_OTHER_SINGLE_VAL 30 /* Unidirectional */
+#define PFTM_OTHER_MULTIPLE_VAL 60 /* Bidirectional */
+#define PFTM_FRAG_VAL 30 /* Fragment expire */
+#define PFTM_INTERVAL_VAL 10 /* Expire interval */
+#define PFTM_SRC_NODE_VAL 0 /* Source tracking */
+#define PFTM_TS_DIFF_VAL 30 /* Allowed TS diff */
+
+enum { PF_NOPFROUTE, PF_FASTROUTE, PF_ROUTETO, PF_DUPTO, PF_REPLYTO };
+enum { PF_LIMIT_STATES,
- struct in_addr _v4addr;
- struct in6_addr _v6addr;
- u_int8_t _addr8[16];
- u_int16_t _addr16[8];
- u_int32_t _addr32[4];
- } pfa; /* 128-bit address */
-#define v4addr pfa._v4addr
-#define v6addr pfa._v6addr
-#define addr8 pfa._addr8
-#define addr16 pfa._addr16
-#define addr32 pfa._addr32
-};
-
-#define PF_TABLE_NAME_SIZE 32
-
-#define PFI_AFLAG_NETWORK 0x01
-#define PFI_AFLAG_BROADCAST 0x02
-#define PFI_AFLAG_PEER 0x04
-#define PFI_AFLAG_MODEMASK 0x07
-#define PFI_AFLAG_NOALIAS 0x08
+ struct in_addr _v4addr;
+ struct in6_addr _v6addr;
+ u_int8_t _addr8[16];
+ u_int16_t _addr16[8];
+ u_int32_t _addr32[4];
+ } pfa; /* 128-bit address */
+#define v4addr pfa._v4addr
+#define v6addr pfa._v6addr
+#define addr8 pfa._addr8
+#define addr16 pfa._addr16
+#define addr32 pfa._addr32
+};
+
+#define PF_TABLE_NAME_SIZE 32
+
+#define PFI_AFLAG_NETWORK 0x01
+#define PFI_AFLAG_BROADCAST 0x02
+#define PFI_AFLAG_PEER 0x04
+#define PFI_AFLAG_MODEMASK 0x07
+#define PFI_AFLAG_NOALIAS 0x08
- TAILQ_ENTRY(pfi_dynaddr) entry;
- struct pf_addr pfid_addr4;
- struct pf_addr pfid_mask4;
- struct pf_addr pfid_addr6;
- struct pf_addr pfid_mask6;
- struct pfr_ktable *pfid_kt;
- struct pfi_kif *pfid_kif;
- void *pfid_hook_cookie;
- int pfid_net; /* mask or 128 */
- int pfid_acnt4; /* address count IPv4 */
- int pfid_acnt6; /* address count IPv6 */
- sa_family_t pfid_af; /* rule af */
- u_int8_t pfid_iflags; /* PFI_AFLAG_* */
+ TAILQ_ENTRY(pfi_dynaddr) entry;
+ struct pf_addr pfid_addr4;
+ struct pf_addr pfid_mask4;
+ struct pf_addr pfid_addr6;
+ struct pf_addr pfid_mask6;
+ struct pfr_ktable *pfid_kt;
+ struct pfi_kif *pfid_kif;
+ void *pfid_hook_cookie;
+ int pfid_net; /* mask or 128 */
+ int pfid_acnt4; /* address count IPv4 */
+ int pfid_acnt6; /* address count IPv6 */
+ sa_family_t pfid_af; /* rule af */
+ u_int8_t pfid_iflags; /* PFI_AFLAG_* */
-#define PF_MISMATCHAW(aw, x, af, neg, ifp) \
- ( \
- (((aw)->type == PF_ADDR_NOROUTE && \
- pf_routable((x), (af), NULL)) || \
- (((aw)->type == PF_ADDR_URPFFAILED && (ifp) != NULL && \
- pf_routable((x), (af), (ifp))) || \
- ((aw)->type == PF_ADDR_RTLABEL && \
- !pf_rtlabel_match((x), (af), (aw))) || \
- ((aw)->type == PF_ADDR_TABLE && \
- !pfr_match_addr((aw)->p.tbl, (x), (af))) || \
- ((aw)->type == PF_ADDR_DYNIFTL && \
- !pfi_match_addr((aw)->p.dyn, (x), (af))) || \
- ((aw)->type == PF_ADDR_RANGE && \
- !pf_match_addr_range(&(aw)->v.a.addr, \
- &(aw)->v.a.mask, (x), (af))) || \
- ((aw)->type == PF_ADDR_ADDRMASK && \
- !PF_AZERO(&(aw)->v.a.mask, (af)) && \
- !PF_MATCHA(0, &(aw)->v.a.addr, \
- &(aw)->v.a.mask, (x), (af))))) != \
- (neg) \
+#define PF_MISMATCHAW(aw, x, af, neg, ifp) \
+ ( \
+ (((aw)->type == PF_ADDR_NOROUTE && \
+ pf_routable((x), (af), NULL)) || \
+ (((aw)->type == PF_ADDR_URPFFAILED && (ifp) != NULL && \
+ pf_routable((x), (af), (ifp))) || \
+ ((aw)->type == PF_ADDR_RTLABEL && \
+ !pf_rtlabel_match((x), (af), (aw))) || \
+ ((aw)->type == PF_ADDR_TABLE && \
+ !pfr_match_addr((aw)->p.tbl, (x), (af))) || \
+ ((aw)->type == PF_ADDR_DYNIFTL && \
+ !pfi_match_addr((aw)->p.dyn, (x), (af))) || \
+ ((aw)->type == PF_ADDR_RANGE && \
+ !pf_match_addr_range(&(aw)->v.a.addr, \
+ &(aw)->v.a.mask, (x), (af))) || \
+ ((aw)->type == PF_ADDR_ADDRMASK && \
+ !PF_AZERO(&(aw)->v.a.mask, (af)) && \
+ !PF_MATCHA(0, &(aw)->v.a.addr, \
+ &(aw)->v.a.mask, (x), (af))))) != \
+ (neg) \
- pf_tcpopts_t fp_tcpopts; /* packed TCP options */
- u_int16_t fp_wsize; /* TCP window size */
- u_int16_t fp_psize; /* ip->ip_len */
- u_int16_t fp_mss; /* TCP MSS */
- u_int16_t fp_flags;
-#define PF_OSFP_WSIZE_MOD 0x0001 /* Window modulus */
-#define PF_OSFP_WSIZE_DC 0x0002 /* Window don't care */
-#define PF_OSFP_WSIZE_MSS 0x0004 /* Window multiple of MSS */
-#define PF_OSFP_WSIZE_MTU 0x0008 /* Window multiple of MTU */
-#define PF_OSFP_PSIZE_MOD 0x0010 /* packet size modulus */
-#define PF_OSFP_PSIZE_DC 0x0020 /* packet size don't care */
-#define PF_OSFP_WSCALE 0x0040 /* TCP window scaling */
-#define PF_OSFP_WSCALE_MOD 0x0080 /* TCP window scale modulus */
-#define PF_OSFP_WSCALE_DC 0x0100 /* TCP window scale dont-care */
-#define PF_OSFP_MSS 0x0200 /* TCP MSS */
-#define PF_OSFP_MSS_MOD 0x0400 /* TCP MSS modulus */
-#define PF_OSFP_MSS_DC 0x0800 /* TCP MSS dont-care */
-#define PF_OSFP_DF 0x1000 /* IPv4 don't fragment bit */
-#define PF_OSFP_TS0 0x2000 /* Zero timestamp */
-#define PF_OSFP_INET6 0x4000 /* IPv6 */
- u_int8_t fp_optcnt; /* TCP option count */
- u_int8_t fp_wscale; /* TCP window scaling */
- u_int8_t fp_ttl; /* IPv4 TTL */
-#define PF_OSFP_MAXTTL_OFFSET 40
+ pf_tcpopts_t fp_tcpopts; /* packed TCP options */
+ u_int16_t fp_wsize; /* TCP window size */
+ u_int16_t fp_psize; /* ip->ip_len */
+ u_int16_t fp_mss; /* TCP MSS */
+ u_int16_t fp_flags;
+#define PF_OSFP_WSIZE_MOD 0x0001 /* Window modulus */
+#define PF_OSFP_WSIZE_DC 0x0002 /* Window don't care */
+#define PF_OSFP_WSIZE_MSS 0x0004 /* Window multiple of MSS */
+#define PF_OSFP_WSIZE_MTU 0x0008 /* Window multiple of MTU */
+#define PF_OSFP_PSIZE_MOD 0x0010 /* packet size modulus */
+#define PF_OSFP_PSIZE_DC 0x0020 /* packet size don't care */
+#define PF_OSFP_WSCALE 0x0040 /* TCP window scaling */
+#define PF_OSFP_WSCALE_MOD 0x0080 /* TCP window scale modulus */
+#define PF_OSFP_WSCALE_DC 0x0100 /* TCP window scale dont-care */
+#define PF_OSFP_MSS 0x0200 /* TCP MSS */
+#define PF_OSFP_MSS_MOD 0x0400 /* TCP MSS modulus */
+#define PF_OSFP_MSS_DC 0x0800 /* TCP MSS dont-care */
+#define PF_OSFP_DF 0x1000 /* IPv4 don't fragment bit */
+#define PF_OSFP_TS0 0x2000 /* Zero timestamp */
+#define PF_OSFP_INET6 0x4000 /* IPv6 */
+ u_int8_t fp_optcnt; /* TCP option count */
+ u_int8_t fp_wscale; /* TCP window scaling */
+ u_int8_t fp_ttl; /* IPv4 TTL */
+#define PF_OSFP_MAXTTL_OFFSET 40
- struct pf_rule_addr src;
- struct pf_rule_addr dst;
-#define PF_SKIP_IFP 0
-#define PF_SKIP_DIR 1
-#define PF_SKIP_AF 2
-#define PF_SKIP_PROTO 3
-#define PF_SKIP_SRC_ADDR 4
-#define PF_SKIP_SRC_PORT 5
-#define PF_SKIP_DST_ADDR 6
-#define PF_SKIP_DST_PORT 7
-#define PF_SKIP_COUNT 8
- union pf_rule_ptr skip[PF_SKIP_COUNT];
-#define PF_RULE_LABEL_SIZE 64
- char label[PF_RULE_LABEL_SIZE];
-#define PF_QNAME_SIZE 64
- char ifname[IFNAMSIZ];
- char qname[PF_QNAME_SIZE];
- char pqname[PF_QNAME_SIZE];
-#define PF_TAG_NAME_SIZE 64
- char tagname[PF_TAG_NAME_SIZE];
- char match_tagname[PF_TAG_NAME_SIZE];
-
- char overload_tblname[PF_TABLE_NAME_SIZE];
-
- TAILQ_ENTRY(pf_rule) entries;
+ struct pf_rule_addr src;
+ struct pf_rule_addr dst;
+#define PF_SKIP_IFP 0
+#define PF_SKIP_DIR 1
+#define PF_SKIP_AF 2
+#define PF_SKIP_PROTO 3
+#define PF_SKIP_SRC_ADDR 4
+#define PF_SKIP_SRC_PORT 5
+#define PF_SKIP_DST_ADDR 6
+#define PF_SKIP_DST_PORT 7
+#define PF_SKIP_COUNT 8
+ union pf_rule_ptr skip[PF_SKIP_COUNT];
+#define PF_RULE_LABEL_SIZE 64
+ char label[PF_RULE_LABEL_SIZE];
+#define PF_QNAME_SIZE 64
+ char ifname[IFNAMSIZ];
+ char qname[PF_QNAME_SIZE];
+ char pqname[PF_QNAME_SIZE];
+#define PF_TAG_NAME_SIZE 64
+ char tagname[PF_TAG_NAME_SIZE];
+ char match_tagname[PF_TAG_NAME_SIZE];
+
+ char overload_tblname[PF_TABLE_NAME_SIZE];
+
+ TAILQ_ENTRY(pf_rule) entries;
- struct timeval pfss_last; /* time received last packet */
- u_int32_t pfss_tsecr; /* last echoed timestamp */
- u_int32_t pfss_tsval; /* largest timestamp */
- u_int32_t pfss_tsval0; /* original timestamp */
- u_int16_t pfss_flags;
-#define PFSS_TIMESTAMP 0x0001 /* modulate timestamp */
-#define PFSS_PAWS 0x0010 /* stricter PAWS checks */
-#define PFSS_PAWS_IDLED 0x0020 /* was idle too long. no PAWS */
-#define PFSS_DATA_TS 0x0040 /* timestamp on data packets */
-#define PFSS_DATA_NOTS 0x0080 /* no timestamp on data packets */
- u_int8_t pfss_ttl; /* stashed TTL */
- u_int8_t pad;
- u_int32_t pfss_ts_mod; /* timestamp modulation */
+ struct timeval pfss_last; /* time received last packet */
+ u_int32_t pfss_tsecr; /* last echoed timestamp */
+ u_int32_t pfss_tsval; /* largest timestamp */
+ u_int32_t pfss_tsval0; /* original timestamp */
+ u_int16_t pfss_flags;
+#define PFSS_TIMESTAMP 0x0001 /* modulate timestamp */
+#define PFSS_PAWS 0x0010 /* stricter PAWS checks */
+#define PFSS_PAWS_IDLED 0x0020 /* was idle too long. no PAWS */
+#define PFSS_DATA_TS 0x0040 /* timestamp on data packets */
+#define PFSS_DATA_NOTS 0x0080 /* no timestamp on data packets */
+ u_int8_t pfss_ttl; /* stashed TTL */
+ u_int8_t pad;
+ u_int32_t pfss_ts_mod; /* timestamp modulation */
- u_int64_t id;
- u_int32_t creatorid;
- u_int32_t pad;
-
- TAILQ_ENTRY(pf_state) entry_list;
- TAILQ_ENTRY(pf_state) next;
- RB_ENTRY(pf_state) entry_id;
- struct pf_state_peer src;
- struct pf_state_peer dst;
- union pf_rule_ptr rule;
- union pf_rule_ptr anchor;
- union pf_rule_ptr nat_rule;
- struct pf_addr rt_addr;
- struct hook_desc_head unlink_hooks;
- struct pf_state_key *state_key;
- struct pfi_kif *kif;
- struct pfi_kif *rt_kif;
- struct pf_src_node *src_node;
- struct pf_src_node *nat_src_node;
- u_int64_t packets[2];
- u_int64_t bytes[2];
- u_int64_t creation;
- u_int64_t expire;
- u_int64_t pfsync_time;
- u_int16_t tag;
- u_int8_t log;
- u_int8_t allow_opts;
- u_int8_t timeout;
- u_int8_t sync_flags;
+ u_int64_t id;
+ u_int32_t creatorid;
+ u_int32_t pad;
+
+ TAILQ_ENTRY(pf_state) entry_list;
+ TAILQ_ENTRY(pf_state) next;
+ RB_ENTRY(pf_state) entry_id;
+ struct pf_state_peer src;
+ struct pf_state_peer dst;
+ union pf_rule_ptr rule;
+ union pf_rule_ptr anchor;
+ union pf_rule_ptr nat_rule;
+ struct pf_addr rt_addr;
+ struct hook_desc_head unlink_hooks;
+ struct pf_state_key *state_key;
+ struct pfi_kif *kif;
+ struct pfi_kif *rt_kif;
+ struct pf_src_node *src_node;
+ struct pf_src_node *nat_src_node;
+ u_int64_t packets[2];
+ u_int64_t bytes[2];
+ u_int64_t creation;
+ u_int64_t expire;
+ u_int64_t pfsync_time;
+ u_int16_t tag;
+ u_int8_t log;
+ u_int8_t allow_opts;
+ u_int8_t timeout;
+ u_int8_t sync_flags;
-#define pf_state_peer_to_pfsync(s, d) do { \
- (d)->seqlo = (s)->seqlo; \
- (d)->seqhi = (s)->seqhi; \
- (d)->seqdiff = (s)->seqdiff; \
- (d)->max_win = (s)->max_win; \
- (d)->mss = (s)->mss; \
- (d)->state = (s)->state; \
- (d)->wscale = (s)->wscale; \
- if ((s)->scrub) { \
- (d)->scrub.pfss_flags = \
- (s)->scrub->pfss_flags & PFSS_TIMESTAMP; \
- (d)->scrub.pfss_ttl = (s)->scrub->pfss_ttl; \
- (d)->scrub.pfss_ts_mod = (s)->scrub->pfss_ts_mod; \
- (d)->scrub.scrub_flag = PFSYNC_SCRUB_FLAG_VALID; \
- } \
+#define pf_state_peer_to_pfsync(s, d) do { \
+ (d)->seqlo = (s)->seqlo; \
+ (d)->seqhi = (s)->seqhi; \
+ (d)->seqdiff = (s)->seqdiff; \
+ (d)->max_win = (s)->max_win; \
+ (d)->mss = (s)->mss; \
+ (d)->state = (s)->state; \
+ (d)->wscale = (s)->wscale; \
+ if ((s)->scrub) { \
+ (d)->scrub.pfss_flags = \
+ (s)->scrub->pfss_flags & PFSS_TIMESTAMP; \
+ (d)->scrub.pfss_ttl = (s)->scrub->pfss_ttl; \
+ (d)->scrub.pfss_ts_mod = (s)->scrub->pfss_ts_mod; \
+ (d)->scrub.scrub_flag = PFSYNC_SCRUB_FLAG_VALID; \
+ } \
-#define pf_state_peer_from_pfsync(s, d) do { \
- (d)->seqlo = (s)->seqlo; \
- (d)->seqhi = (s)->seqhi; \
- (d)->seqdiff = (s)->seqdiff; \
- (d)->max_win = (s)->max_win; \
- (d)->mss = ntohs((s)->mss); \
- (d)->state = (s)->state; \
- (d)->wscale = (s)->wscale; \
- if ((s)->scrub.scrub_flag == PFSYNC_SCRUB_FLAG_VALID && \
- (d)->scrub != NULL) { \
- (d)->scrub->pfss_flags = \
- ntohs((s)->scrub.pfss_flags) & PFSS_TIMESTAMP; \
- (d)->scrub->pfss_ttl = (s)->scrub.pfss_ttl; \
- (d)->scrub->pfss_ts_mod = (s)->scrub.pfss_ts_mod; \
- } \
+#define pf_state_peer_from_pfsync(s, d) do { \
+ (d)->seqlo = (s)->seqlo; \
+ (d)->seqhi = (s)->seqhi; \
+ (d)->seqdiff = (s)->seqdiff; \
+ (d)->max_win = (s)->max_win; \
+ (d)->mss = ntohs((s)->mss); \
+ (d)->state = (s)->state; \
+ (d)->wscale = (s)->wscale; \
+ if ((s)->scrub.scrub_flag == PFSYNC_SCRUB_FLAG_VALID && \
+ (d)->scrub != NULL) { \
+ (d)->scrub->pfss_flags = \
+ ntohs((s)->scrub.pfss_flags) & PFSS_TIMESTAMP; \
+ (d)->scrub->pfss_ttl = (s)->scrub.pfss_ttl; \
+ (d)->scrub->pfss_ts_mod = (s)->scrub.pfss_ts_mod; \
+ } \
- struct pfr_tstats pfrkt_ts;
- RB_ENTRY(pfr_ktable) pfrkt_tree;
- SLIST_ENTRY(pfr_ktable) pfrkt_workq;
- struct radix_node_head *pfrkt_ip4;
- struct radix_node_head *pfrkt_ip6;
- struct pfr_ktable *pfrkt_shadow;
- struct pfr_ktable *pfrkt_root;
- struct pf_ruleset *pfrkt_rs;
- u_int64_t pfrkt_larg;
- u_int32_t pfrkt_nflags;
-};
-#define pfrkt_t pfrkt_ts.pfrts_t
-#define pfrkt_name pfrkt_t.pfrt_name
-#define pfrkt_anchor pfrkt_t.pfrt_anchor
-#define pfrkt_ruleset pfrkt_t.pfrt_ruleset
-#define pfrkt_flags pfrkt_t.pfrt_flags
-#define pfrkt_cnt pfrkt_ts.pfrts_cnt
-#define pfrkt_refcnt pfrkt_ts.pfrts_refcnt
-#define pfrkt_packets pfrkt_ts.pfrts_packets
-#define pfrkt_bytes pfrkt_ts.pfrts_bytes
-#define pfrkt_match pfrkt_ts.pfrts_match
-#define pfrkt_nomatch pfrkt_ts.pfrts_nomatch
-#define pfrkt_tzero pfrkt_ts.pfrts_tzero
+ struct pfr_tstats pfrkt_ts;
+ RB_ENTRY(pfr_ktable) pfrkt_tree;
+ SLIST_ENTRY(pfr_ktable) pfrkt_workq;
+ struct radix_node_head *pfrkt_ip4;
+ struct radix_node_head *pfrkt_ip6;
+ struct pfr_ktable *pfrkt_shadow;
+ struct pfr_ktable *pfrkt_root;
+ struct pf_ruleset *pfrkt_rs;
+ u_int64_t pfrkt_larg;
+ u_int32_t pfrkt_nflags;
+};
+#define pfrkt_t pfrkt_ts.pfrts_t
+#define pfrkt_name pfrkt_t.pfrt_name
+#define pfrkt_anchor pfrkt_t.pfrt_anchor
+#define pfrkt_ruleset pfrkt_t.pfrt_ruleset
+#define pfrkt_flags pfrkt_t.pfrt_flags
+#define pfrkt_cnt pfrkt_ts.pfrts_cnt
+#define pfrkt_refcnt pfrkt_ts.pfrts_refcnt
+#define pfrkt_packets pfrkt_ts.pfrts_packets
+#define pfrkt_bytes pfrkt_ts.pfrts_bytes
+#define pfrkt_match pfrkt_ts.pfrts_match
+#define pfrkt_nomatch pfrkt_ts.pfrts_nomatch
+#define pfrkt_tzero pfrkt_ts.pfrts_tzero
- struct pf_addr baddr; /* src address before translation */
- struct pf_addr bdaddr; /* dst address before translation */
- struct pf_addr naddr; /* src address after translation */
- struct pf_addr ndaddr; /* dst address after translation */
- struct pf_rule *nat_rule; /* nat/rdr rule applied to packet */
- struct pf_addr *src;
- struct pf_addr *dst;
- struct ether_header
- *eh;
- pbuf_t *mp;
- int lmw; /* lazy writable offset */
- struct pf_mtag *pf_mtag;
- u_int16_t *ip_sum;
- u_int32_t off; /* protocol header offset */
- u_int32_t hdrlen; /* protocol header length */
- u_int32_t p_len; /* total length of payload */
- u_int16_t flags; /* Let SCRUB trigger behavior in */
- /* state code. Easier than tags */
-#define PFDESC_TCP_NORM 0x0001 /* TCP shall be statefully scrubbed */
-#define PFDESC_IP_REAS 0x0002 /* IP frags would've been reassembled */
-#define PFDESC_IP_FRAG 0x0004 /* This is a fragment */
- sa_family_t af;
- sa_family_t naf; /* address family after translation */
- u_int8_t proto;
- u_int8_t tos;
- u_int8_t ttl;
- u_int8_t proto_variant;
- mbuf_svc_class_t sc; /* mbuf service class (MBUF_SVC) */
- u_int32_t pktflags; /* mbuf packet flags (PKTF) */
- u_int32_t flowsrc; /* flow source (FLOWSRC) */
- u_int32_t flowhash; /* flow hash to identify the sender */
+ struct pf_addr baddr; /* src address before translation */
+ struct pf_addr bdaddr; /* dst address before translation */
+ struct pf_addr naddr; /* src address after translation */
+ struct pf_addr ndaddr; /* dst address after translation */
+ struct pf_rule *nat_rule; /* nat/rdr rule applied to packet */
+ struct pf_addr *src;
+ struct pf_addr *dst;
+ struct ether_header *eh;
+ pbuf_t *mp;
+ int lmw; /* lazy writable offset */
+ struct pf_mtag *pf_mtag;
+ u_int16_t *ip_sum;
+ u_int32_t off; /* protocol header offset */
+ u_int32_t hdrlen; /* protocol header length */
+ u_int32_t p_len; /* total length of payload */
+ u_int16_t flags; /* Let SCRUB trigger behavior in */
+ /* state code. Easier than tags */
+#define PFDESC_TCP_NORM 0x0001 /* TCP shall be statefully scrubbed */
+#define PFDESC_IP_REAS 0x0002 /* IP frags would've been reassembled */
+#define PFDESC_IP_FRAG 0x0004 /* This is a fragment */
+ sa_family_t af;
+ sa_family_t naf; /* address family after translation */
+ u_int8_t proto;
+ u_int8_t tos;
+ u_int8_t ttl;
+ u_int8_t proto_variant;
+ mbuf_svc_class_t sc; /* mbuf service class (MBUF_SVC) */
+ u_int32_t pktflags; /* mbuf packet flags (PKTF) */
+ u_int32_t flowsrc; /* flow source (FLOWSRC) */
+ u_int32_t flowhash; /* flow hash to identify the sender */
-#define PFRES_MATCH 0 /* Explicit match of a rule */
-#define PFRES_BADOFF 1 /* Bad offset for pull_hdr */
-#define PFRES_FRAG 2 /* Dropping following fragment */
-#define PFRES_SHORT 3 /* Dropping short packet */
-#define PFRES_NORM 4 /* Dropping by normalizer */
-#define PFRES_MEMORY 5 /* Dropped due to lacking mem */
-#define PFRES_TS 6 /* Bad TCP Timestamp (RFC1323) */
-#define PFRES_CONGEST 7 /* Congestion (of ipintrq) */
-#define PFRES_IPOPTIONS 8 /* IP option */
-#define PFRES_PROTCKSUM 9 /* Protocol checksum invalid */
-#define PFRES_BADSTATE 10 /* State mismatch */
-#define PFRES_STATEINS 11 /* State insertion failure */
-#define PFRES_MAXSTATES 12 /* State limit */
-#define PFRES_SRCLIMIT 13 /* Source node/conn limit */
-#define PFRES_SYNPROXY 14 /* SYN proxy */
-#define PFRES_DUMMYNET 15 /* Dummynet */
-#define PFRES_MAX 16 /* total+1 */
+#define PFRES_MATCH 0 /* Explicit match of a rule */
+#define PFRES_BADOFF 1 /* Bad offset for pull_hdr */
+#define PFRES_FRAG 2 /* Dropping following fragment */
+#define PFRES_SHORT 3 /* Dropping short packet */
+#define PFRES_NORM 4 /* Dropping by normalizer */
+#define PFRES_MEMORY 5 /* Dropped due to lacking mem */
+#define PFRES_TS 6 /* Bad TCP Timestamp (RFC1323) */
+#define PFRES_CONGEST 7 /* Congestion (of ipintrq) */
+#define PFRES_IPOPTIONS 8 /* IP option */
+#define PFRES_PROTCKSUM 9 /* Protocol checksum invalid */
+#define PFRES_BADSTATE 10 /* State mismatch */
+#define PFRES_STATEINS 11 /* State insertion failure */
+#define PFRES_MAXSTATES 12 /* State limit */
+#define PFRES_SRCLIMIT 13 /* Source node/conn limit */
+#define PFRES_SYNPROXY 14 /* SYN proxy */
+#define PFRES_DUMMYNET 15 /* Dummynet */
+#define PFRES_MAX 16 /* total+1 */
- struct pfr_table pfrio_table;
- void *pfrio_buffer __attribute__((aligned(8)));
- int pfrio_esize __attribute__((aligned(8)));
- int pfrio_size;
- int pfrio_size2;
- int pfrio_nadd;
- int pfrio_ndel;
- int pfrio_nchange;
- int pfrio_flags;
- u_int32_t pfrio_ticket;
-};
-#define pfrio_exists pfrio_nadd
-#define pfrio_nzero pfrio_nadd
-#define pfrio_nmatch pfrio_nadd
-#define pfrio_naddr pfrio_size2
-#define pfrio_setflag pfrio_size2
-#define pfrio_clrflag pfrio_nadd
+ struct pfr_table pfrio_table;
+ void *pfrio_buffer __attribute__((aligned(8)));
+ int pfrio_esize __attribute__((aligned(8)));
+ int pfrio_size;
+ int pfrio_size2;
+ int pfrio_nadd;
+ int pfrio_ndel;
+ int pfrio_nchange;
+ int pfrio_flags;
+ u_int32_t pfrio_ticket;
+};
+#define pfrio_exists pfrio_nadd
+#define pfrio_nzero pfrio_nadd
+#define pfrio_nmatch pfrio_nadd
+#define pfrio_naddr pfrio_size2
+#define pfrio_setflag pfrio_size2
+#define pfrio_clrflag pfrio_nadd
-#define DIOCSTART _IO ('D', 1)
-#define DIOCSTOP _IO ('D', 2)
-#define DIOCADDRULE _IOWR('D', 4, struct pfioc_rule)
-#define DIOCGETSTARTERS _IOWR('D', 5, struct pfioc_tokens)
-#define DIOCGETRULES _IOWR('D', 6, struct pfioc_rule)
-#define DIOCGETRULE _IOWR('D', 7, struct pfioc_rule)
-#define DIOCSTARTREF _IOR ('D', 8, u_int64_t)
-#define DIOCSTOPREF _IOWR('D', 9, struct pfioc_remove_token)
+#define DIOCSTART _IO ('D', 1)
+#define DIOCSTOP _IO ('D', 2)
+#define DIOCADDRULE _IOWR('D', 4, struct pfioc_rule)
+#define DIOCGETSTARTERS _IOWR('D', 5, struct pfioc_tokens)
+#define DIOCGETRULES _IOWR('D', 6, struct pfioc_rule)
+#define DIOCGETRULE _IOWR('D', 7, struct pfioc_rule)
+#define DIOCSTARTREF _IOR ('D', 8, u_int64_t)
+#define DIOCSTOPREF _IOWR('D', 9, struct pfioc_remove_token)
-#define DIOCCLRSTATES _IOWR('D', 18, struct pfioc_state_kill)
-#define DIOCGETSTATE _IOWR('D', 19, struct pfioc_state)
-#define DIOCSETSTATUSIF _IOWR('D', 20, struct pfioc_if)
-#define DIOCGETSTATUS _IOWR('D', 21, struct pf_status)
-#define DIOCCLRSTATUS _IO ('D', 22)
-#define DIOCNATLOOK _IOWR('D', 23, struct pfioc_natlook)
-#define DIOCSETDEBUG _IOWR('D', 24, u_int32_t)
-#define DIOCGETSTATES _IOWR('D', 25, struct pfioc_states)
-#define DIOCCHANGERULE _IOWR('D', 26, struct pfioc_rule)
-#define DIOCINSERTRULE _IOWR('D', 27, struct pfioc_rule)
-#define DIOCDELETERULE _IOWR('D', 28, struct pfioc_rule)
-#define DIOCSETTIMEOUT _IOWR('D', 29, struct pfioc_tm)
-#define DIOCGETTIMEOUT _IOWR('D', 30, struct pfioc_tm)
-#define DIOCADDSTATE _IOWR('D', 37, struct pfioc_state)
-#define DIOCCLRRULECTRS _IO ('D', 38)
-#define DIOCGETLIMIT _IOWR('D', 39, struct pfioc_limit)
-#define DIOCSETLIMIT _IOWR('D', 40, struct pfioc_limit)
-#define DIOCKILLSTATES _IOWR('D', 41, struct pfioc_state_kill)
-#define DIOCSTARTALTQ _IO ('D', 42)
-#define DIOCSTOPALTQ _IO ('D', 43)
-#define DIOCADDALTQ _IOWR('D', 45, struct pfioc_altq)
-#define DIOCGETALTQS _IOWR('D', 47, struct pfioc_altq)
-#define DIOCGETALTQ _IOWR('D', 48, struct pfioc_altq)
-#define DIOCCHANGEALTQ _IOWR('D', 49, struct pfioc_altq)
-#define DIOCGETQSTATS _IOWR('D', 50, struct pfioc_qstats)
-#define DIOCBEGINADDRS _IOWR('D', 51, struct pfioc_pooladdr)
-#define DIOCADDADDR _IOWR('D', 52, struct pfioc_pooladdr)
-#define DIOCGETADDRS _IOWR('D', 53, struct pfioc_pooladdr)
-#define DIOCGETADDR _IOWR('D', 54, struct pfioc_pooladdr)
-#define DIOCCHANGEADDR _IOWR('D', 55, struct pfioc_pooladdr)
+#define DIOCCLRSTATES _IOWR('D', 18, struct pfioc_state_kill)
+#define DIOCGETSTATE _IOWR('D', 19, struct pfioc_state)
+#define DIOCSETSTATUSIF _IOWR('D', 20, struct pfioc_if)
+#define DIOCGETSTATUS _IOWR('D', 21, struct pf_status)
+#define DIOCCLRSTATUS _IO ('D', 22)
+#define DIOCNATLOOK _IOWR('D', 23, struct pfioc_natlook)
+#define DIOCSETDEBUG _IOWR('D', 24, u_int32_t)
+#define DIOCGETSTATES _IOWR('D', 25, struct pfioc_states)
+#define DIOCCHANGERULE _IOWR('D', 26, struct pfioc_rule)
+#define DIOCINSERTRULE _IOWR('D', 27, struct pfioc_rule)
+#define DIOCDELETERULE _IOWR('D', 28, struct pfioc_rule)
+#define DIOCSETTIMEOUT _IOWR('D', 29, struct pfioc_tm)
+#define DIOCGETTIMEOUT _IOWR('D', 30, struct pfioc_tm)
+#define DIOCADDSTATE _IOWR('D', 37, struct pfioc_state)
+#define DIOCCLRRULECTRS _IO ('D', 38)
+#define DIOCGETLIMIT _IOWR('D', 39, struct pfioc_limit)
+#define DIOCSETLIMIT _IOWR('D', 40, struct pfioc_limit)
+#define DIOCKILLSTATES _IOWR('D', 41, struct pfioc_state_kill)
+#define DIOCSTARTALTQ _IO ('D', 42)
+#define DIOCSTOPALTQ _IO ('D', 43)
+#define DIOCADDALTQ _IOWR('D', 45, struct pfioc_altq)
+#define DIOCGETALTQS _IOWR('D', 47, struct pfioc_altq)
+#define DIOCGETALTQ _IOWR('D', 48, struct pfioc_altq)
+#define DIOCCHANGEALTQ _IOWR('D', 49, struct pfioc_altq)
+#define DIOCGETQSTATS _IOWR('D', 50, struct pfioc_qstats)
+#define DIOCBEGINADDRS _IOWR('D', 51, struct pfioc_pooladdr)
+#define DIOCADDADDR _IOWR('D', 52, struct pfioc_pooladdr)
+#define DIOCGETADDRS _IOWR('D', 53, struct pfioc_pooladdr)
+#define DIOCGETADDR _IOWR('D', 54, struct pfioc_pooladdr)
+#define DIOCCHANGEADDR _IOWR('D', 55, struct pfioc_pooladdr)
-#define DIOCGETRULESETS _IOWR('D', 58, struct pfioc_ruleset)
-#define DIOCGETRULESET _IOWR('D', 59, struct pfioc_ruleset)
-#define DIOCRCLRTABLES _IOWR('D', 60, struct pfioc_table)
-#define DIOCRADDTABLES _IOWR('D', 61, struct pfioc_table)
-#define DIOCRDELTABLES _IOWR('D', 62, struct pfioc_table)
-#define DIOCRGETTABLES _IOWR('D', 63, struct pfioc_table)
-#define DIOCRGETTSTATS _IOWR('D', 64, struct pfioc_table)
-#define DIOCRCLRTSTATS _IOWR('D', 65, struct pfioc_table)
-#define DIOCRCLRADDRS _IOWR('D', 66, struct pfioc_table)
-#define DIOCRADDADDRS _IOWR('D', 67, struct pfioc_table)
-#define DIOCRDELADDRS _IOWR('D', 68, struct pfioc_table)
-#define DIOCRSETADDRS _IOWR('D', 69, struct pfioc_table)
-#define DIOCRGETADDRS _IOWR('D', 70, struct pfioc_table)
-#define DIOCRGETASTATS _IOWR('D', 71, struct pfioc_table)
-#define DIOCRCLRASTATS _IOWR('D', 72, struct pfioc_table)
-#define DIOCRTSTADDRS _IOWR('D', 73, struct pfioc_table)
-#define DIOCRSETTFLAGS _IOWR('D', 74, struct pfioc_table)
-#define DIOCRINADEFINE _IOWR('D', 77, struct pfioc_table)
-#define DIOCOSFPFLUSH _IO('D', 78)
-#define DIOCOSFPADD _IOWR('D', 79, struct pf_osfp_ioctl)
-#define DIOCOSFPGET _IOWR('D', 80, struct pf_osfp_ioctl)
-#define DIOCXBEGIN _IOWR('D', 81, struct pfioc_trans)
-#define DIOCXCOMMIT _IOWR('D', 82, struct pfioc_trans)
-#define DIOCXROLLBACK _IOWR('D', 83, struct pfioc_trans)
-#define DIOCGETSRCNODES _IOWR('D', 84, struct pfioc_src_nodes)
-#define DIOCCLRSRCNODES _IO('D', 85)
-#define DIOCSETHOSTID _IOWR('D', 86, u_int32_t)
-#define DIOCIGETIFACES _IOWR('D', 87, struct pfioc_iface)
-#define DIOCSETIFFLAG _IOWR('D', 89, struct pfioc_iface)
-#define DIOCCLRIFFLAG _IOWR('D', 90, struct pfioc_iface)
+#define DIOCGETRULESETS _IOWR('D', 58, struct pfioc_ruleset)
+#define DIOCGETRULESET _IOWR('D', 59, struct pfioc_ruleset)
+#define DIOCRCLRTABLES _IOWR('D', 60, struct pfioc_table)
+#define DIOCRADDTABLES _IOWR('D', 61, struct pfioc_table)
+#define DIOCRDELTABLES _IOWR('D', 62, struct pfioc_table)
+#define DIOCRGETTABLES _IOWR('D', 63, struct pfioc_table)
+#define DIOCRGETTSTATS _IOWR('D', 64, struct pfioc_table)
+#define DIOCRCLRTSTATS _IOWR('D', 65, struct pfioc_table)
+#define DIOCRCLRADDRS _IOWR('D', 66, struct pfioc_table)
+#define DIOCRADDADDRS _IOWR('D', 67, struct pfioc_table)
+#define DIOCRDELADDRS _IOWR('D', 68, struct pfioc_table)
+#define DIOCRSETADDRS _IOWR('D', 69, struct pfioc_table)
+#define DIOCRGETADDRS _IOWR('D', 70, struct pfioc_table)
+#define DIOCRGETASTATS _IOWR('D', 71, struct pfioc_table)
+#define DIOCRCLRASTATS _IOWR('D', 72, struct pfioc_table)
+#define DIOCRTSTADDRS _IOWR('D', 73, struct pfioc_table)
+#define DIOCRSETTFLAGS _IOWR('D', 74, struct pfioc_table)
+#define DIOCRINADEFINE _IOWR('D', 77, struct pfioc_table)
+#define DIOCOSFPFLUSH _IO('D', 78)
+#define DIOCOSFPADD _IOWR('D', 79, struct pf_osfp_ioctl)
+#define DIOCOSFPGET _IOWR('D', 80, struct pf_osfp_ioctl)
+#define DIOCXBEGIN _IOWR('D', 81, struct pfioc_trans)
+#define DIOCXCOMMIT _IOWR('D', 82, struct pfioc_trans)
+#define DIOCXROLLBACK _IOWR('D', 83, struct pfioc_trans)
+#define DIOCGETSRCNODES _IOWR('D', 84, struct pfioc_src_nodes)
+#define DIOCCLRSRCNODES _IO('D', 85)
+#define DIOCSETHOSTID _IOWR('D', 86, u_int32_t)
+#define DIOCIGETIFACES _IOWR('D', 87, struct pfioc_iface)
+#define DIOCSETIFFLAG _IOWR('D', 89, struct pfioc_iface)
+#define DIOCCLRIFFLAG _IOWR('D', 90, struct pfioc_iface)
projects / apple / xnu.git / blobdiff