xref: /freebsd/lib/libpfctl/libpfctl.h (revision 8a271827e7b5d5310e06df1f9f49ba0ef9efd263)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2021 Rubicon Communications, LLC (Netgate)
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  *
11  *    - Redistributions of source code must retain the above copyright
12  *      notice, this list of conditions and the following disclaimer.
13  *    - Redistributions in binary form must reproduce the above
14  *      copyright notice, this list of conditions and the following
15  *      disclaimer in the documentation and/or other materials provided
16  *      with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
20  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
21  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
22  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
23  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
24  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
25  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
26  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
28  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29  * POSSIBILITY OF SUCH DAMAGE.
30  *
31  * $FreeBSD$
32  */
33 
34 #ifndef _PFCTL_IOCTL_H_
35 #define _PFCTL_IOCTL_H_
36 
37 #include <netpfil/pf/pf.h>
38 
39 struct pfctl_anchor;
40 struct pfctl_eth_anchor;
41 
42 struct pfctl_status_counter {
43 	uint64_t	 id;
44 	uint64_t	 counter;
45 	char		*name;
46 
47 	TAILQ_ENTRY(pfctl_status_counter) entry;
48 };
49 TAILQ_HEAD(pfctl_status_counters, pfctl_status_counter);
50 
51 struct pfctl_status {
52 	bool		running;
53 	uint32_t	since;
54 	uint32_t	debug;
55 	uint32_t	hostid;
56 	uint64_t	states;
57 	uint64_t	src_nodes;
58 	char		ifname[IFNAMSIZ];
59 	uint8_t		pf_chksum[PF_MD5_DIGEST_LENGTH];
60 	bool		syncookies_active;
61 	uint32_t	reass;
62 
63 	struct pfctl_status_counters	 counters;
64 	struct pfctl_status_counters	 lcounters;
65 	struct pfctl_status_counters	 fcounters;
66 	struct pfctl_status_counters	 scounters;
67 	uint64_t	pcounters[2][2][3];
68 	uint64_t	bcounters[2][2];
69 };
70 
71 struct pfctl_eth_rulesets_info {
72 	uint32_t	nr;
73 };
74 
75 struct pfctl_eth_rules_info {
76 	uint32_t	nr;
77 	uint32_t	ticket;
78 };
79 
80 struct pfctl_eth_addr {
81 	uint8_t	addr[ETHER_ADDR_LEN];
82 	uint8_t	mask[ETHER_ADDR_LEN];
83 	bool	neg;
84 	bool	isset;
85 };
86 
87 struct pfctl_eth_rule {
88 	uint32_t		 nr;
89 
90 	bool			 quick;
91 
92 	/* Filter */
93 	char			 ifname[IFNAMSIZ];
94 	uint8_t			 ifnot;
95 	uint8_t			 direction;
96 	uint16_t		 proto;
97 	struct pfctl_eth_addr	 src, dst;
98 	struct pf_rule_addr	 ipsrc, ipdst;
99 	char			 match_tagname[PF_TAG_NAME_SIZE];
100 	uint16_t		 match_tag;
101 	bool			 match_tag_not;
102 
103 	/* Stats */
104 	uint64_t		 evaluations;
105 	uint64_t		 packets[2];
106 	uint64_t		 bytes[2];
107 	time_t			 last_active_timestamp;
108 
109 	/* Action */
110 	char			 qname[PF_QNAME_SIZE];
111 	char			 tagname[PF_TAG_NAME_SIZE];
112 	uint16_t		 dnpipe;
113 	uint32_t		 dnflags;
114 	char			 bridge_to[IFNAMSIZ];
115 	uint8_t			 action;
116 
117 	struct pfctl_eth_anchor	*anchor;
118 	uint8_t			 anchor_relative;
119 	uint8_t			 anchor_wildcard;
120 
121 	TAILQ_ENTRY(pfctl_eth_rule)	 entries;
122 };
123 TAILQ_HEAD(pfctl_eth_rules, pfctl_eth_rule);
124 
125 struct pfctl_eth_ruleset_info {
126 	uint32_t	nr;
127 	char		name[PF_ANCHOR_NAME_SIZE];
128 	char		path[MAXPATHLEN];
129 };
130 
131 struct pfctl_eth_ruleset {
132 	struct pfctl_eth_rules	 rules;
133 	struct pfctl_eth_anchor	*anchor;
134 };
135 
136 struct pfctl_eth_anchor {
137 	struct pfctl_eth_anchor		*parent;
138 	char				 name[PF_ANCHOR_NAME_SIZE];
139 	char				 path[MAXPATHLEN];
140 	struct pfctl_eth_ruleset	 ruleset;
141 	int				 refcnt;	/* anchor rules */
142 	int				 match;	/* XXX: used for pfctl black magic */
143 };
144 
145 struct pfctl_pool {
146 	struct pf_palist	 list;
147 	struct pf_pooladdr	*cur;
148 	struct pf_poolhashkey	 key;
149 	struct pf_addr		 counter;
150 	struct pf_mape_portset	 mape;
151 	int			 tblidx;
152 	uint16_t		 proxy_port[2];
153 	uint8_t			 opts;
154 };
155 
156 struct pfctl_rules_info {
157 	uint32_t	nr;
158 	uint32_t	ticket;
159 };
160 
161 struct pfctl_rule {
162 	struct pf_rule_addr	 src;
163 	struct pf_rule_addr	 dst;
164 	union pf_rule_ptr	 skip[PF_SKIP_COUNT];
165 	char			 label[PF_RULE_MAX_LABEL_COUNT][PF_RULE_LABEL_SIZE];
166 	uint32_t		 ridentifier;
167 	char			 ifname[IFNAMSIZ];
168 	char			 qname[PF_QNAME_SIZE];
169 	char			 pqname[PF_QNAME_SIZE];
170 	char			 tagname[PF_TAG_NAME_SIZE];
171 	char			 match_tagname[PF_TAG_NAME_SIZE];
172 
173 	char			 overload_tblname[PF_TABLE_NAME_SIZE];
174 
175 	TAILQ_ENTRY(pfctl_rule)	 entries;
176 	struct pfctl_pool	 rpool;
177 
178 	uint64_t		 evaluations;
179 	uint64_t		 packets[2];
180 	uint64_t		 bytes[2];
181 	time_t			 last_active_timestamp;
182 
183 	struct pfi_kif		*kif;
184 	struct pfctl_anchor	*anchor;
185 	struct pfr_ktable	*overload_tbl;
186 
187 	pf_osfp_t		 os_fingerprint;
188 
189 	int			 rtableid;
190 	uint32_t		 timeout[PFTM_MAX];
191 	uint32_t		 max_states;
192 	uint32_t		 max_src_nodes;
193 	uint32_t		 max_src_states;
194 	uint32_t		 max_src_conn;
195 	struct {
196 		uint32_t		limit;
197 		uint32_t		seconds;
198 	}			 max_src_conn_rate;
199 	uint32_t		 qid;
200 	uint32_t		 pqid;
201 	uint16_t		 dnpipe;
202 	uint16_t		 dnrpipe;
203 	uint32_t		 free_flags;
204 	uint32_t		 nr;
205 	uint32_t		 prob;
206 	uid_t			 cuid;
207 	pid_t			 cpid;
208 
209 	uint64_t		 states_cur;
210 	uint64_t		 states_tot;
211 	uint64_t		 src_nodes;
212 
213 	uint16_t		 return_icmp;
214 	uint16_t		 return_icmp6;
215 	uint16_t		 max_mss;
216 	uint16_t		 tag;
217 	uint16_t		 match_tag;
218 	uint16_t		 scrub_flags;
219 
220 	struct pf_rule_uid	 uid;
221 	struct pf_rule_gid	 gid;
222 
223 	uint32_t		 rule_flag;
224 	uint8_t			 action;
225 	uint8_t			 direction;
226 	uint8_t			 log;
227 	uint8_t			 logif;
228 	uint8_t			 quick;
229 	uint8_t			 ifnot;
230 	uint8_t			 match_tag_not;
231 	uint8_t			 natpass;
232 
233 	uint8_t			 keep_state;
234 	sa_family_t		 af;
235 	uint8_t			 proto;
236 	uint8_t			 type;
237 	uint8_t			 code;
238 	uint8_t			 flags;
239 	uint8_t			 flagset;
240 	uint8_t			 min_ttl;
241 	uint8_t			 allow_opts;
242 	uint8_t			 rt;
243 	uint8_t			 return_ttl;
244 	uint8_t			 tos;
245 	uint8_t			 set_tos;
246 	uint8_t			 anchor_relative;
247 	uint8_t			 anchor_wildcard;
248 
249 	uint8_t			 flush;
250 	uint8_t			 prio;
251 	uint8_t			 set_prio[2];
252 
253 	struct {
254 		struct pf_addr		addr;
255 		uint16_t		port;
256 	}			divert;
257 };
258 
259 TAILQ_HEAD(pfctl_rulequeue, pfctl_rule);
260 
261 struct pfctl_ruleset {
262 	struct {
263 		struct pfctl_rulequeue	 queues[2];
264 		struct {
265 			struct pfctl_rulequeue	*ptr;
266 			struct pfctl_rule	**ptr_array;
267 			uint32_t		 rcount;
268 			uint32_t		 ticket;
269 			int			 open;
270 		}			 active, inactive;
271 	}			 rules[PF_RULESET_MAX];
272 	struct pfctl_anchor	*anchor;
273 	uint32_t		 tticket;
274 	int			 tables;
275 	int			 topen;
276 };
277 
278 RB_HEAD(pfctl_anchor_global, pfctl_anchor);
279 RB_HEAD(pfctl_anchor_node, pfctl_anchor);
280 struct pfctl_anchor {
281 	RB_ENTRY(pfctl_anchor)	 entry_global;
282 	RB_ENTRY(pfctl_anchor)	 entry_node;
283 	struct pfctl_anchor	*parent;
284 	struct pfctl_anchor_node children;
285 	char			 name[PF_ANCHOR_NAME_SIZE];
286 	char			 path[MAXPATHLEN];
287 	struct pfctl_ruleset	 ruleset;
288 	int			 refcnt;	/* anchor rules */
289 	int			 match;	/* XXX: used for pfctl black magic */
290 };
291 RB_PROTOTYPE(pfctl_anchor_global, pfctl_anchor, entry_global,
292     pf_anchor_compare);
293 RB_PROTOTYPE(pfctl_anchor_node, pfctl_anchor, entry_node,
294     pf_anchor_compare);
295 
296 struct pfctl_state_cmp {
297 	uint64_t	id;
298 	uint32_t	creatorid;
299 	uint8_t		direction;
300 };
301 
302 struct pfctl_kill {
303 	struct pfctl_state_cmp	cmp;
304 	sa_family_t		af;
305 	int			proto;
306 	struct pf_rule_addr	src;
307 	struct pf_rule_addr	dst;
308 	struct pf_rule_addr	rt_addr;
309 	char			ifname[IFNAMSIZ];
310 	char			label[PF_RULE_LABEL_SIZE];
311 	bool			kill_match;
312 };
313 
314 struct pfctl_state_peer {
315 	uint32_t			 seqlo;
316 	uint32_t			 seqhi;
317 	uint32_t			 seqdiff;
318 	uint8_t				 state;
319 	uint8_t				 wscale;
320 };
321 
322 struct pfctl_state_key {
323 	struct pf_addr	 addr[2];
324 	uint16_t	 port[2];
325 	sa_family_t	 af;
326 	uint8_t	 	 proto;
327 };
328 
329 struct pfctl_state {
330 	TAILQ_ENTRY(pfctl_state)	entry;
331 
332 	uint64_t		 id;
333 	uint32_t		 creatorid;
334 	uint8_t		 	 direction;
335 
336 	struct pfctl_state_peer	 src;
337 	struct pfctl_state_peer	 dst;
338 
339 	uint32_t		 rule;
340 	uint32_t		 anchor;
341 	uint32_t		 nat_rule;
342 	struct pf_addr		 rt_addr;
343 	struct pfctl_state_key	 key[2];	/* addresses stack and wire  */
344 	char			 ifname[IFNAMSIZ];
345 	char			 orig_ifname[IFNAMSIZ];
346 	uint64_t		 packets[2];
347 	uint64_t		 bytes[2];
348 	uint32_t		 creation;
349 	uint32_t		 expire;
350 	uint32_t		 pfsync_time;
351 	uint16_t		 state_flags;
352 	uint32_t		 sync_flags;
353 };
354 
355 TAILQ_HEAD(pfctl_statelist, pfctl_state);
356 struct pfctl_states {
357 	struct pfctl_statelist	states;
358 	size_t 			count;
359 };
360 
361 enum pfctl_syncookies_mode {
362 	PFCTL_SYNCOOKIES_NEVER,
363 	PFCTL_SYNCOOKIES_ALWAYS,
364 	PFCTL_SYNCOOKIES_ADAPTIVE
365 };
366 extern const char* PFCTL_SYNCOOKIES_MODE_NAMES[];
367 
368 struct pfctl_syncookies {
369 	enum pfctl_syncookies_mode	mode;
370 	uint8_t				highwater;	/* Percent */
371 	uint8_t				lowwater;	/* Percent */
372 };
373 
374 struct pfctl_status* pfctl_get_status(int dev);
375 void	pfctl_free_status(struct pfctl_status *status);
376 
377 int	pfctl_get_eth_rulesets_info(int dev,
378 	    struct pfctl_eth_rulesets_info *ri, const char *path);
379 int	pfctl_get_eth_ruleset(int dev, const char *path, int nr,
380 	    struct pfctl_eth_ruleset_info *ri);
381 int	pfctl_get_eth_rules_info(int dev, struct pfctl_eth_rules_info *rules,
382 	    const char *path);
383 int	pfctl_get_eth_rule(int dev, uint32_t nr, uint32_t ticket,
384 	    const char *path, struct pfctl_eth_rule *rule, bool clear,
385 	    char *anchor_call);
386 int	pfctl_add_eth_rule(int dev, const struct pfctl_eth_rule *r,
387 	    const char *anchor, const char *anchor_call, uint32_t ticket);
388 int	pfctl_get_rules_info(int dev, struct pfctl_rules_info *rules,
389 	    uint32_t ruleset, const char *path);
390 int	pfctl_get_rule(int dev, uint32_t nr, uint32_t ticket,
391 	    const char *anchor, uint32_t ruleset, struct pfctl_rule *rule,
392 	    char *anchor_call);
393 int	pfctl_get_clear_rule(int dev, uint32_t nr, uint32_t ticket,
394 	    const char *anchor, uint32_t ruleset, struct pfctl_rule *rule,
395 	    char *anchor_call, bool clear);
396 int	pfctl_add_rule(int dev, const struct pfctl_rule *r,
397 	    const char *anchor, const char *anchor_call, uint32_t ticket,
398 	    uint32_t pool_ticket);
399 int	pfctl_set_keepcounters(int dev, bool keep);
400 int	pfctl_get_states(int dev, struct pfctl_states *states);
401 void	pfctl_free_states(struct pfctl_states *states);
402 int	pfctl_clear_states(int dev, const struct pfctl_kill *kill,
403 	    unsigned int *killed);
404 int	pfctl_kill_states(int dev, const struct pfctl_kill *kill,
405 	    unsigned int *killed);
406 int	pfctl_clear_rules(int dev, const char *anchorname);
407 int	pfctl_clear_nat(int dev, const char *anchorname);
408 int	pfctl_clear_eth_rules(int dev, const char *anchorname);
409 int	pfctl_set_syncookies(int dev, const struct pfctl_syncookies *s);
410 int	pfctl_get_syncookies(int dev, struct pfctl_syncookies *s);
411 int	pfctl_table_add_addrs(int dev, struct pfr_table *tbl, struct pfr_addr
412 	    *addr, int size, int *nadd, int flags);
413 int	pfctl_table_del_addrs(int dev, struct pfr_table *tbl, struct pfr_addr
414 	    *addr, int size, int *ndel, int flags);
415 int     pfctl_table_set_addrs(int dev, struct pfr_table *tbl, struct pfr_addr
416 	    *addr, int size, int *size2, int *nadd, int *ndel, int *nchange,
417 	    int flags);
418 int	pfctl_table_get_addrs(int dev, struct pfr_table *tbl, struct pfr_addr
419 	    *addr, int *size, int flags);
420 #endif
421