1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2021 Rubicon Communications, LLC (Netgate) 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 11 * - Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * - Redistributions in binary form must reproduce the above 14 * copyright notice, this list of conditions and the following 15 * disclaimer in the documentation and/or other materials provided 16 * with the distribution. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 19 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 20 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 21 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 22 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 24 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 25 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 26 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 28 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 #ifndef _PFCTL_IOCTL_H_ 33 #define _PFCTL_IOCTL_H_ 34 35 #include <netpfil/pf/pf.h> 36 37 struct pfctl_anchor; 38 struct pfctl_eth_anchor; 39 40 struct pfctl_status_counter { 41 uint64_t id; 42 uint64_t counter; 43 char *name; 44 45 TAILQ_ENTRY(pfctl_status_counter) entry; 46 }; 47 TAILQ_HEAD(pfctl_status_counters, pfctl_status_counter); 48 49 struct pfctl_status { 50 bool running; 51 uint32_t since; 52 uint32_t debug; 53 uint32_t hostid; 54 uint64_t states; 55 uint64_t src_nodes; 56 char ifname[IFNAMSIZ]; 57 uint8_t pf_chksum[PF_MD5_DIGEST_LENGTH]; 58 bool syncookies_active; 59 uint32_t reass; 60 61 struct pfctl_status_counters counters; 62 struct pfctl_status_counters lcounters; 63 struct pfctl_status_counters fcounters; 64 struct pfctl_status_counters scounters; 65 struct pfctl_status_counters ncounters; 66 uint64_t fragments; 67 uint64_t pcounters[2][2][2]; 68 uint64_t bcounters[2][2]; 69 }; 70 71 struct pfctl_eth_rulesets_info { 72 uint32_t nr; 73 }; 74 75 struct pfctl_eth_rules_info { 76 uint32_t nr; 77 uint32_t ticket; 78 }; 79 80 struct pfctl_eth_addr { 81 uint8_t addr[ETHER_ADDR_LEN]; 82 uint8_t mask[ETHER_ADDR_LEN]; 83 bool neg; 84 bool isset; 85 }; 86 87 struct pfctl_eth_rule { 88 uint32_t nr; 89 90 char label[PF_RULE_MAX_LABEL_COUNT][PF_RULE_LABEL_SIZE]; 91 uint32_t ridentifier; 92 93 bool quick; 94 95 /* Filter */ 96 char ifname[IFNAMSIZ]; 97 uint8_t ifnot; 98 uint8_t direction; 99 uint16_t proto; 100 struct pfctl_eth_addr src, dst; 101 struct pf_rule_addr ipsrc, ipdst; 102 char match_tagname[PF_TAG_NAME_SIZE]; 103 uint16_t match_tag; 104 bool match_tag_not; 105 106 /* Stats */ 107 uint64_t evaluations; 108 uint64_t packets[2]; 109 uint64_t bytes[2]; 110 time_t last_active_timestamp; 111 112 /* Action */ 113 char qname[PF_QNAME_SIZE]; 114 char tagname[PF_TAG_NAME_SIZE]; 115 uint16_t dnpipe; 116 uint32_t dnflags; 117 char bridge_to[IFNAMSIZ]; 118 uint8_t action; 119 120 struct pfctl_eth_anchor *anchor; 121 uint8_t anchor_relative; 122 uint8_t anchor_wildcard; 123 124 TAILQ_ENTRY(pfctl_eth_rule) entries; 125 }; 126 TAILQ_HEAD(pfctl_eth_rules, pfctl_eth_rule); 127 128 struct pfctl_eth_ruleset_info { 129 uint32_t nr; 130 char name[PF_ANCHOR_NAME_SIZE]; 131 char path[MAXPATHLEN]; 132 }; 133 134 struct pfctl_eth_ruleset { 135 struct pfctl_eth_rules rules; 136 struct pfctl_eth_anchor *anchor; 137 }; 138 139 struct pfctl_eth_anchor { 140 struct pfctl_eth_anchor *parent; 141 char name[PF_ANCHOR_NAME_SIZE]; 142 char path[MAXPATHLEN]; 143 struct pfctl_eth_ruleset ruleset; 144 int refcnt; /* anchor rules */ 145 int match; /* XXX: used for pfctl black magic */ 146 }; 147 148 struct pfctl_pooladdr { 149 struct pf_addr_wrap addr; 150 TAILQ_ENTRY(pfctl_pooladdr) entries; 151 char ifname[IFNAMSIZ]; 152 sa_family_t af; 153 }; 154 155 TAILQ_HEAD(pfctl_palist, pfctl_pooladdr); 156 157 struct pfctl_pool { 158 struct pfctl_palist list; 159 struct pfctl_pooladdr *cur; 160 struct pf_poolhashkey key; 161 struct pf_addr counter; 162 struct pf_mape_portset mape; 163 int tblidx; 164 uint16_t proxy_port[2]; 165 uint8_t opts; 166 }; 167 168 struct pfctl_rules_info { 169 uint32_t nr; 170 uint32_t ticket; 171 }; 172 173 struct pfctl_threshold { 174 uint32_t limit; 175 uint32_t seconds; 176 uint32_t count; 177 uint32_t last; 178 }; 179 180 struct pfctl_rule { 181 struct pf_rule_addr src; 182 struct pf_rule_addr dst; 183 union pf_rule_ptr skip[PF_SKIP_COUNT]; 184 char label[PF_RULE_MAX_LABEL_COUNT][PF_RULE_LABEL_SIZE]; 185 uint32_t ridentifier; 186 char ifname[IFNAMSIZ]; 187 char qname[PF_QNAME_SIZE]; 188 char pqname[PF_QNAME_SIZE]; 189 char tagname[PF_TAG_NAME_SIZE]; 190 char match_tagname[PF_TAG_NAME_SIZE]; 191 192 char overload_tblname[PF_TABLE_NAME_SIZE]; 193 194 TAILQ_ENTRY(pfctl_rule) entries; 195 struct pfctl_pool nat; 196 union { 197 /* Alias old and new names. */ 198 struct pfctl_pool rpool; 199 struct pfctl_pool rdr; 200 }; 201 struct pfctl_pool route; 202 struct pfctl_threshold pktrate; 203 204 uint64_t evaluations; 205 uint64_t packets[2]; 206 uint64_t bytes[2]; 207 time_t last_active_timestamp; 208 209 struct pfi_kif *kif; 210 struct pfctl_anchor *anchor; 211 struct pfr_ktable *overload_tbl; 212 213 pf_osfp_t os_fingerprint; 214 215 int rtableid; 216 uint32_t timeout[PFTM_MAX]; 217 uint32_t max_states; 218 uint32_t max_src_nodes; 219 uint32_t max_src_states; 220 uint32_t max_src_conn; 221 struct { 222 uint32_t limit; 223 uint32_t seconds; 224 } max_src_conn_rate; 225 uint16_t max_pkt_size; 226 uint32_t qid; 227 uint32_t pqid; 228 uint16_t dnpipe; 229 uint16_t dnrpipe; 230 uint32_t free_flags; 231 uint32_t nr; 232 uint32_t prob; 233 uid_t cuid; 234 pid_t cpid; 235 236 uint64_t states_cur; 237 uint64_t states_tot; 238 uint64_t src_nodes; 239 uint64_t src_nodes_type[PF_SN_MAX]; 240 241 uint16_t return_icmp; 242 uint16_t return_icmp6; 243 uint16_t max_mss; 244 uint16_t tag; 245 uint16_t match_tag; 246 uint16_t scrub_flags; 247 248 struct pf_rule_uid uid; 249 struct pf_rule_gid gid; 250 char rcv_ifname[IFNAMSIZ]; 251 bool rcvifnot; 252 struct { 253 uint8_t id; 254 int limiter_action; 255 } statelim; 256 struct { 257 uint8_t id; 258 int limiter_action; 259 } sourcelim; 260 261 uint32_t rule_flag; 262 uint8_t action; 263 uint8_t direction; 264 uint8_t log; 265 uint8_t logif; 266 uint8_t quick; 267 uint8_t ifnot; 268 uint8_t match_tag_not; 269 uint8_t natpass; 270 271 uint8_t keep_state; 272 sa_family_t af; 273 uint8_t proto; 274 uint16_t type; 275 uint16_t code; 276 uint8_t flags; 277 uint8_t flagset; 278 uint8_t min_ttl; 279 uint8_t allow_opts; 280 uint8_t rt; 281 uint8_t return_ttl; 282 uint8_t tos; 283 uint8_t set_tos; 284 uint8_t anchor_relative; 285 uint8_t anchor_wildcard; 286 287 uint8_t flush; 288 uint8_t prio; 289 uint8_t set_prio[2]; 290 sa_family_t naf; 291 292 struct { 293 struct pf_addr addr; 294 uint16_t port; 295 } divert; 296 297 time_t exptime; 298 }; 299 300 TAILQ_HEAD(pfctl_rulequeue, pfctl_rule); 301 302 struct pfctl_ruleset { 303 struct { 304 struct pfctl_rulequeue queues[2]; 305 struct { 306 struct pfctl_rulequeue *ptr; 307 struct pfctl_rule **ptr_array; 308 uint32_t rcount; 309 uint32_t ticket; 310 int open; 311 } active, inactive; 312 } rules[PF_RULESET_MAX]; 313 struct pfctl_anchor *anchor; 314 uint32_t tticket; 315 int tables; 316 int topen; 317 }; 318 319 RB_HEAD(pfctl_anchor_global, pfctl_anchor); 320 RB_HEAD(pfctl_anchor_node, pfctl_anchor); 321 struct pfctl_anchor { 322 RB_ENTRY(pfctl_anchor) entry_global; 323 RB_ENTRY(pfctl_anchor) entry_node; 324 struct pfctl_anchor *parent; 325 struct pfctl_anchor_node children; 326 char name[PF_ANCHOR_NAME_SIZE]; 327 char path[MAXPATHLEN]; 328 struct pfctl_ruleset ruleset; 329 int refcnt; /* anchor rules */ 330 int match; /* XXX: used for pfctl black magic */ 331 }; 332 RB_PROTOTYPE(pfctl_anchor_global, pfctl_anchor, entry_global, 333 pf_anchor_compare); 334 RB_PROTOTYPE(pfctl_anchor_node, pfctl_anchor, entry_node, 335 pf_anchor_compare); 336 337 struct pfctl_state_cmp { 338 uint64_t id; 339 uint32_t creatorid; 340 uint8_t direction; 341 }; 342 343 struct pfctl_kill { 344 struct pfctl_state_cmp cmp; 345 sa_family_t af; 346 int proto; 347 struct pf_rule_addr src; 348 struct pf_rule_addr dst; 349 struct pf_rule_addr rt_addr; 350 char ifname[IFNAMSIZ]; 351 char label[PF_RULE_LABEL_SIZE]; 352 bool kill_match; 353 bool nat; 354 }; 355 356 struct pfctl_state_peer { 357 uint32_t seqlo; 358 uint32_t seqhi; 359 uint32_t seqdiff; 360 uint8_t state; 361 uint8_t wscale; 362 uint16_t max_win; 363 uint16_t mss; 364 }; 365 366 struct pfctl_state_key { 367 struct pf_addr addr[2]; 368 uint16_t port[2]; 369 sa_family_t af; 370 uint8_t proto; 371 }; 372 373 struct pfctl_state { 374 uint64_t id; 375 uint32_t creatorid; 376 uint8_t direction; 377 378 struct pfctl_state_peer src; 379 struct pfctl_state_peer dst; 380 381 uint32_t rule; 382 uint32_t anchor; 383 uint32_t nat_rule; 384 struct pf_addr rt_addr; 385 struct pfctl_state_key key[2]; /* addresses stack and wire */ 386 char ifname[IFNAMSIZ]; 387 char orig_ifname[IFNAMSIZ]; 388 uint64_t packets[2]; 389 uint64_t bytes[2]; 390 uint32_t creation; 391 uint32_t expire; 392 uint32_t pfsync_time; 393 uint16_t state_flags; 394 uint32_t sync_flags; 395 uint16_t qid; 396 uint16_t pqid; 397 uint16_t dnpipe; 398 uint16_t dnrpipe; 399 uint8_t log; 400 int32_t rtableid; 401 uint8_t min_ttl; 402 uint8_t set_tos; 403 uint16_t max_mss; 404 uint8_t set_prio[2]; 405 uint8_t rt; 406 char rt_ifname[IFNAMSIZ]; 407 sa_family_t rt_af; 408 uint8_t src_node_flags; 409 struct pfctl_rule created_by_rule; 410 }; 411 412 enum pfctl_syncookies_mode { 413 PFCTL_SYNCOOKIES_NEVER, 414 PFCTL_SYNCOOKIES_ALWAYS, 415 PFCTL_SYNCOOKIES_ADAPTIVE 416 }; 417 extern const char* PFCTL_SYNCOOKIES_MODE_NAMES[]; 418 419 struct pfctl_syncookies { 420 enum pfctl_syncookies_mode mode; 421 uint8_t highwater; /* Percent */ 422 uint8_t lowwater; /* Percent */ 423 uint32_t halfopen_states; 424 }; 425 426 struct pfctl_src_node { 427 struct pf_addr addr; 428 struct pf_addr raddr; 429 int rule; 430 uint64_t bytes[2]; 431 uint64_t packets[2]; 432 uint32_t states; 433 uint32_t conn; 434 sa_family_t af; 435 sa_family_t raf; 436 uint8_t ruletype; 437 uint64_t creation; 438 uint64_t expire; 439 struct pfctl_threshold conn_rate; 440 pf_sn_types_t type; 441 }; 442 443 #define PF_DEVICE "/dev/pf" 444 445 struct pfctl_handle; 446 struct pfctl_handle *pfctl_open(const char *pf_device); 447 void pfctl_close(struct pfctl_handle *); 448 int pfctl_fd(struct pfctl_handle *); 449 450 int pfctl_startstop(struct pfctl_handle *h, int start); 451 struct pfctl_status* pfctl_get_status_h(struct pfctl_handle *h); 452 struct pfctl_status* pfctl_get_status(int dev); 453 int pfctl_clear_status(struct pfctl_handle *h); 454 uint64_t pfctl_status_counter(struct pfctl_status *status, int id); 455 uint64_t pfctl_status_lcounter(struct pfctl_status *status, int id); 456 uint64_t pfctl_status_fcounter(struct pfctl_status *status, int id); 457 uint64_t pfctl_status_scounter(struct pfctl_status *status, int id); 458 void pfctl_free_status(struct pfctl_status *status); 459 460 int pfctl_get_eth_rulesets_info(int dev, 461 struct pfctl_eth_rulesets_info *ri, const char *path); 462 int pfctl_get_eth_ruleset(int dev, const char *path, int nr, 463 struct pfctl_eth_ruleset_info *ri); 464 int pfctl_get_eth_rules_info(int dev, struct pfctl_eth_rules_info *rules, 465 const char *path); 466 int pfctl_get_eth_rule(int dev, uint32_t nr, uint32_t ticket, 467 const char *path, struct pfctl_eth_rule *rule, bool clear, 468 char *anchor_call); 469 int pfctl_add_eth_rule(int dev, const struct pfctl_eth_rule *r, 470 const char *anchor, const char *anchor_call, uint32_t ticket); 471 int pfctl_get_rules_info_h(struct pfctl_handle *h, 472 struct pfctl_rules_info *rules, uint32_t ruleset, 473 const char *path); 474 int pfctl_get_rules_info(int dev, struct pfctl_rules_info *rules, 475 uint32_t ruleset, const char *path); 476 int pfctl_get_rule(int dev, uint32_t nr, uint32_t ticket, 477 const char *anchor, uint32_t ruleset, struct pfctl_rule *rule, 478 char *anchor_call); 479 int pfctl_get_rule_h(struct pfctl_handle *h, uint32_t nr, uint32_t ticket, 480 const char *anchor, uint32_t ruleset, struct pfctl_rule *rule, 481 char *anchor_call); 482 int pfctl_get_clear_rule(int dev, uint32_t nr, uint32_t ticket, 483 const char *anchor, uint32_t ruleset, struct pfctl_rule *rule, 484 char *anchor_call, bool clear); 485 int pfctl_get_clear_rule_h(struct pfctl_handle *h, uint32_t nr, uint32_t ticket, 486 const char *anchor, uint32_t ruleset, struct pfctl_rule *rule, 487 char *anchor_call, bool clear); 488 int pfctl_add_rule(int dev, const struct pfctl_rule *r, 489 const char *anchor, const char *anchor_call, uint32_t ticket, 490 uint32_t pool_ticket); 491 int pfctl_add_rule_h(struct pfctl_handle *h, const struct pfctl_rule *r, 492 const char *anchor, const char *anchor_call, uint32_t ticket, 493 uint32_t pool_ticket); 494 int pfctl_set_keepcounters(int dev, bool keep); 495 int pfctl_get_creatorids(struct pfctl_handle *h, uint32_t *creators, size_t *len); 496 497 struct pfctl_state_filter { 498 char ifname[IFNAMSIZ]; 499 uint16_t proto; 500 sa_family_t af; 501 struct pf_addr addr; 502 struct pf_addr mask; 503 bool include_rule; 504 }; 505 typedef int (*pfctl_get_state_fn)(struct pfctl_state *, void *); 506 int pfctl_get_states_h(struct pfctl_handle *h, struct pfctl_state_filter *filter, pfctl_get_state_fn f, void *arg); 507 int pfctl_clear_states(int dev, const struct pfctl_kill *kill, 508 unsigned int *killed); 509 int pfctl_kill_states(int dev, const struct pfctl_kill *kill, 510 unsigned int *killed); 511 int pfctl_clear_states_h(struct pfctl_handle *h, const struct pfctl_kill *kill, 512 unsigned int *killed); 513 int pfctl_kill_states_h(struct pfctl_handle *h, const struct pfctl_kill *kill, 514 unsigned int *killed); 515 int pfctl_clear_rules(int dev, const char *anchorname); 516 int pfctl_clear_nat(int dev, const char *anchorname); 517 int pfctl_clear_eth_rules(int dev, const char *anchorname); 518 int pfctl_set_syncookies(int dev, const struct pfctl_syncookies *s); 519 int pfctl_get_syncookies(int dev, struct pfctl_syncookies *s); 520 int pfctl_table_add_addrs_h(struct pfctl_handle *h, struct pfr_table *tbl, struct pfr_addr 521 *addr, int size, int *nadd, int flags); 522 int pfctl_table_add_addrs(int dev, struct pfr_table *tbl, struct pfr_addr 523 *addr, int size, int *nadd, int flags); 524 int pfctl_table_del_addrs_h(struct pfctl_handle *h, struct pfr_table *tbl, 525 struct pfr_addr *addr, int size, int *ndel, int flags); 526 int pfctl_table_del_addrs(int dev, struct pfr_table *tbl, struct pfr_addr 527 *addr, int size, int *ndel, int flags); 528 int pfctl_table_set_addrs_h(struct pfctl_handle *h, struct pfr_table *tbl, 529 struct pfr_addr *addr, int size, int *nadd, int *ndel, 530 int *nchange, int flags); 531 int pfctl_table_set_addrs(int dev, struct pfr_table *tbl, struct pfr_addr 532 *addr, int size, int *size2, int *nadd, int *ndel, int *nchange, 533 int flags); 534 int pfctl_table_get_addrs_h(struct pfctl_handle *h, struct pfr_table *tbl, struct pfr_addr *addr, 535 int *size, int flags); 536 int pfctl_table_get_addrs(int dev, struct pfr_table *tbl, struct pfr_addr 537 *addr, int *size, int flags); 538 int pfctl_set_statusif(struct pfctl_handle *h, const char *ifname); 539 540 struct pfctl_natlook_key { 541 sa_family_t af; 542 uint8_t direction; 543 uint8_t proto; 544 struct pf_addr saddr; 545 struct pf_addr daddr; 546 uint16_t sport; 547 uint16_t dport; 548 }; 549 struct pfctl_natlook { 550 struct pf_addr saddr; 551 struct pf_addr daddr; 552 uint16_t sport; 553 uint16_t dport; 554 }; 555 int pfctl_natlook(struct pfctl_handle *h, 556 const struct pfctl_natlook_key *k, struct pfctl_natlook *r); 557 int pfctl_set_debug(struct pfctl_handle *h, uint32_t level); 558 int pfctl_set_timeout(struct pfctl_handle *h, uint32_t timeout, uint32_t seconds); 559 int pfctl_get_timeout(struct pfctl_handle *h, uint32_t timeout, uint32_t *seconds); 560 int pfctl_set_limit(struct pfctl_handle *h, const int index, const uint limit); 561 int pfctl_get_limit(struct pfctl_handle *h, const int index, uint *limit); 562 int pfctl_begin_addrs(struct pfctl_handle *h, uint32_t *ticket); 563 int pfctl_add_addr(struct pfctl_handle *h, const struct pfioc_pooladdr *pa, int which); 564 int pfctl_get_addrs(struct pfctl_handle *h, uint32_t ticket, uint32_t r_num, 565 uint8_t r_action, const char *anchor, uint32_t *nr, int which); 566 int pfctl_get_addr(struct pfctl_handle *h, uint32_t ticket, uint32_t r_num, 567 uint8_t r_action, const char *anchor, uint32_t nr, struct pfioc_pooladdr *pa, 568 int which); 569 int pfctl_get_rulesets(struct pfctl_handle *h, const char *path, uint32_t *nr); 570 int pfctl_get_ruleset(struct pfctl_handle *h, const char *path, uint32_t nr, struct pfioc_ruleset *rs); 571 typedef int (*pfctl_get_srcnode_fn)(struct pfctl_src_node*, void *); 572 int pfctl_get_srcnodes(struct pfctl_handle *h, pfctl_get_srcnode_fn fn, void *arg); 573 574 int pfctl_clear_tables(struct pfctl_handle *h, struct pfr_table *filter, 575 int *ndel, int flags); 576 int pfctl_add_table(struct pfctl_handle *h, struct pfr_table *table, 577 int *nadd, int flags); 578 int pfctl_del_table(struct pfctl_handle *h, struct pfr_table *table, 579 int *ndel, int flags); 580 581 typedef int (*pfctl_get_tstats_fn)(const struct pfr_tstats *t, void *arg); 582 int pfctl_get_tstats(struct pfctl_handle *h, const struct pfr_table *filter, 583 pfctl_get_tstats_fn fn, void *arg); 584 int pfctl_clear_tstats(struct pfctl_handle *h, const struct pfr_table *filter, 585 int *nzero, int flags); 586 int pfctl_clear_addrs(struct pfctl_handle *h, const struct pfr_table *filter, 587 int *ndel, int flags); 588 589 int pfctl_get_astats(struct pfctl_handle *h, const struct pfr_table *tbl, 590 struct pfr_astats *addr, int *size, int flags); 591 int pfctl_clr_astats(struct pfctl_handle *h, const struct pfr_table *tbl, 592 struct pfr_addr *addr, int size, int *nzero, int flags); 593 int pfctl_test_addrs(struct pfctl_handle *h, const struct pfr_table *tbl, 594 struct pfr_addr *addr, int size, int *nmatch, int flags); 595 int pfctl_ina_define(struct pfctl_handle *h, struct pfr_table *tbl, 596 struct pfr_addr *addr, int size, int *nadd, int *naddr, 597 int ticket, int flags); 598 599 struct pfctl_limit_rate { 600 unsigned int limit; 601 unsigned int seconds; 602 }; 603 604 struct pfctl_state_lim { 605 uint32_t ticket; 606 char name[PF_STATELIM_NAME_LEN]; 607 uint32_t id; 608 unsigned int limit; 609 610 struct pfctl_limit_rate rate; 611 612 char description[PF_STATELIM_DESCR_LEN]; 613 614 unsigned int inuse; 615 uint64_t admitted; 616 uint64_t hardlimited; 617 uint64_t ratelimited; 618 }; 619 620 int pfctl_state_limiter_nget(struct pfctl_handle *h, struct pfctl_state_lim *lim); 621 int pfctl_state_limiter_add(struct pfctl_handle *h, struct pfctl_state_lim *lim); 622 623 struct pfctl_source_lim { 624 uint32_t ticket; 625 626 char name[PF_SOURCELIM_NAME_LEN]; 627 uint32_t id; 628 629 /* limit on the total number of address entries */ 630 unsigned int entries; 631 632 /* limit on the number of states per address entry */ 633 unsigned int limit; 634 635 /* rate limit on the creation of states by an address entry */ 636 struct pfctl_limit_rate rate; 637 638 /* 639 * when the number of states on an entry exceeds hwm, add 640 * the address to the specified table. when the number of 641 * states goes below lwm, remove it from the table. 642 */ 643 char overload_tblname[PF_TABLE_NAME_SIZE]; 644 unsigned int overload_hwm; 645 unsigned int overload_lwm; 646 647 /* 648 * mask addresses before they're used for entries. /64s 649 * everywhere for inet6 makes it easy to use too much memory. 650 */ 651 unsigned int inet_prefix; 652 unsigned int inet6_prefix; 653 654 char description[PF_SOURCELIM_DESCR_LEN]; 655 656 unsigned int nentries; 657 unsigned int inuse; 658 659 uint64_t addrallocs; 660 uint64_t addrnomem; 661 uint64_t admitted; 662 uint64_t addrlimited; 663 uint64_t hardlimited; 664 uint64_t ratelimited; 665 }; 666 667 int pfctl_source_limiter_get(struct pfctl_handle *h, struct pfctl_source_lim *lim); 668 int pfctl_source_limiter_nget(struct pfctl_handle *h, struct pfctl_source_lim *lim); 669 int pfctl_source_limiter_add(struct pfctl_handle *h, struct pfctl_source_lim *lim); 670 671 struct pfctl_source { 672 sa_family_t af; 673 unsigned int rdomain; 674 struct pf_addr addr; 675 676 unsigned int inet_prefix; 677 unsigned int inet6_prefix; 678 679 unsigned int limit; 680 unsigned int inuse; 681 uint64_t admitted; 682 uint64_t hardlimited; 683 uint64_t ratelimited; 684 }; 685 typedef int (*pfctl_get_source_fn)(struct pfctl_source *, void *); 686 int pfctl_source_get(struct pfctl_handle *h, int id, 687 pfctl_get_source_fn fn, void *arg); 688 689 struct pfctl_source_clear { 690 char name[PF_SOURCELIM_NAME_LEN]; 691 uint32_t id; 692 sa_family_t af; 693 unsigned int rdomain; 694 struct pf_addr addr; 695 }; 696 int pfctl_source_clear(struct pfctl_handle *h, struct pfctl_source_clear *); 697 698 int pfctl_flush_fingerprints(struct pfctl_handle *h); 699 int pfctl_get_fingerprint(struct pfctl_handle *h, int idx, struct pf_osfp_ioctl *fp); 700 int pfctl_add_fingerprint(struct pfctl_handle *h, struct pf_osfp_ioctl *fp); 701 702 #endif 703