xref: /freebsd/lib/libpfctl/libpfctl.h (revision ccd9b49f20e7a2e6eac1e7e68db23e222bf40263)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2021 Rubicon Communications, LLC (Netgate)
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  *
11  *    - Redistributions of source code must retain the above copyright
12  *      notice, this list of conditions and the following disclaimer.
13  *    - Redistributions in binary form must reproduce the above
14  *      copyright notice, this list of conditions and the following
15  *      disclaimer in the documentation and/or other materials provided
16  *      with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
20  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
21  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
22  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
23  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
24  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
25  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
26  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
28  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29  * POSSIBILITY OF SUCH DAMAGE.
30  *
31  * $FreeBSD$
32  */
33 
34 #ifndef _PFCTL_IOCTL_H_
35 #define _PFCTL_IOCTL_H_
36 
37 #include <netpfil/pf/pf.h>
38 
39 struct pfctl_anchor;
40 struct pfctl_eth_anchor;
41 
42 struct pfctl_status_counter {
43 	uint64_t	 id;
44 	uint64_t	 counter;
45 	char		*name;
46 
47 	TAILQ_ENTRY(pfctl_status_counter) entry;
48 };
49 TAILQ_HEAD(pfctl_status_counters, pfctl_status_counter);
50 
51 struct pfctl_status {
52 	bool		running;
53 	uint32_t	since;
54 	uint32_t	debug;
55 	uint32_t	hostid;
56 	uint64_t	states;
57 	uint64_t	src_nodes;
58 	char		ifname[IFNAMSIZ];
59 	uint8_t		pf_chksum[PF_MD5_DIGEST_LENGTH];
60 	bool		syncookies_active;
61 
62 	struct pfctl_status_counters	 counters;
63 	struct pfctl_status_counters	 lcounters;
64 	struct pfctl_status_counters	 fcounters;
65 	struct pfctl_status_counters	 scounters;
66 	uint64_t	pcounters[2][2][3];
67 	uint64_t	bcounters[2][2];
68 };
69 
70 struct pfctl_eth_rulesets_info {
71 	uint32_t	nr;
72 };
73 
74 struct pfctl_eth_rules_info {
75 	uint32_t	nr;
76 	uint32_t	ticket;
77 };
78 
79 struct pfctl_eth_addr {
80 	uint8_t	addr[ETHER_ADDR_LEN];
81 	uint8_t	mask[ETHER_ADDR_LEN];
82 	bool	neg;
83 	bool	isset;
84 };
85 
86 struct pfctl_eth_rule {
87 	uint32_t		 nr;
88 
89 	bool			 quick;
90 
91 	/* Filter */
92 	char			 ifname[IFNAMSIZ];
93 	uint8_t			 ifnot;
94 	uint8_t			 direction;
95 	uint16_t		 proto;
96 	struct pfctl_eth_addr	 src, dst;
97 	struct pf_rule_addr	 ipsrc, ipdst;
98 	char			 match_tagname[PF_TAG_NAME_SIZE];
99 	uint16_t		 match_tag;
100 	bool			 match_tag_not;
101 
102 	/* Stats */
103 	uint64_t		 evaluations;
104 	uint64_t		 packets[2];
105 	uint64_t		 bytes[2];
106 	time_t			 last_active_timestamp;
107 
108 	/* Action */
109 	char			 qname[PF_QNAME_SIZE];
110 	char			 tagname[PF_TAG_NAME_SIZE];
111 	uint16_t		 dnpipe;
112 	uint32_t		 dnflags;
113 	uint8_t			 action;
114 
115 	struct pfctl_eth_anchor	*anchor;
116 	uint8_t			 anchor_relative;
117 	uint8_t			 anchor_wildcard;
118 
119 	TAILQ_ENTRY(pfctl_eth_rule)	 entries;
120 };
121 TAILQ_HEAD(pfctl_eth_rules, pfctl_eth_rule);
122 
123 struct pfctl_eth_ruleset_info {
124 	uint32_t	nr;
125 	char		name[PF_ANCHOR_NAME_SIZE];
126 	char		path[MAXPATHLEN];
127 };
128 
129 struct pfctl_eth_ruleset {
130 	struct pfctl_eth_rules	 rules;
131 	struct pfctl_eth_anchor	*anchor;
132 };
133 
134 struct pfctl_eth_anchor {
135 	struct pfctl_eth_anchor		*parent;
136 	char				 name[PF_ANCHOR_NAME_SIZE];
137 	char				 path[MAXPATHLEN];
138 	struct pfctl_eth_ruleset	 ruleset;
139 	int				 refcnt;	/* anchor rules */
140 	int				 match;	/* XXX: used for pfctl black magic */
141 };
142 
143 struct pfctl_pool {
144 	struct pf_palist	 list;
145 	struct pf_pooladdr	*cur;
146 	struct pf_poolhashkey	 key;
147 	struct pf_addr		 counter;
148 	struct pf_mape_portset	 mape;
149 	int			 tblidx;
150 	uint16_t		 proxy_port[2];
151 	uint8_t			 opts;
152 };
153 
154 struct pfctl_rules_info {
155 	uint32_t	nr;
156 	uint32_t	ticket;
157 };
158 
159 struct pfctl_rule {
160 	struct pf_rule_addr	 src;
161 	struct pf_rule_addr	 dst;
162 	union pf_rule_ptr	 skip[PF_SKIP_COUNT];
163 	char			 label[PF_RULE_MAX_LABEL_COUNT][PF_RULE_LABEL_SIZE];
164 	uint32_t		 ridentifier;
165 	char			 ifname[IFNAMSIZ];
166 	char			 qname[PF_QNAME_SIZE];
167 	char			 pqname[PF_QNAME_SIZE];
168 	char			 tagname[PF_TAG_NAME_SIZE];
169 	char			 match_tagname[PF_TAG_NAME_SIZE];
170 
171 	char			 overload_tblname[PF_TABLE_NAME_SIZE];
172 
173 	TAILQ_ENTRY(pfctl_rule)	 entries;
174 	struct pfctl_pool	 rpool;
175 
176 	uint64_t		 evaluations;
177 	uint64_t		 packets[2];
178 	uint64_t		 bytes[2];
179 	time_t			 last_active_timestamp;
180 
181 	struct pfi_kif		*kif;
182 	struct pfctl_anchor	*anchor;
183 	struct pfr_ktable	*overload_tbl;
184 
185 	pf_osfp_t		 os_fingerprint;
186 
187 	int			 rtableid;
188 	uint32_t		 timeout[PFTM_MAX];
189 	uint32_t		 max_states;
190 	uint32_t		 max_src_nodes;
191 	uint32_t		 max_src_states;
192 	uint32_t		 max_src_conn;
193 	struct {
194 		uint32_t		limit;
195 		uint32_t		seconds;
196 	}			 max_src_conn_rate;
197 	uint32_t		 qid;
198 	uint32_t		 pqid;
199 	uint16_t		 dnpipe;
200 	uint16_t		 dnrpipe;
201 	uint32_t		 free_flags;
202 	uint32_t		 nr;
203 	uint32_t		 prob;
204 	uid_t			 cuid;
205 	pid_t			 cpid;
206 
207 	uint64_t		 states_cur;
208 	uint64_t		 states_tot;
209 	uint64_t		 src_nodes;
210 
211 	uint16_t		 return_icmp;
212 	uint16_t		 return_icmp6;
213 	uint16_t		 max_mss;
214 	uint16_t		 tag;
215 	uint16_t		 match_tag;
216 	uint16_t		 scrub_flags;
217 
218 	struct pf_rule_uid	 uid;
219 	struct pf_rule_gid	 gid;
220 
221 	uint32_t		 rule_flag;
222 	uint8_t			 action;
223 	uint8_t			 direction;
224 	uint8_t			 log;
225 	uint8_t			 logif;
226 	uint8_t			 quick;
227 	uint8_t			 ifnot;
228 	uint8_t			 match_tag_not;
229 	uint8_t			 natpass;
230 
231 	uint8_t			 keep_state;
232 	sa_family_t		 af;
233 	uint8_t			 proto;
234 	uint8_t			 type;
235 	uint8_t			 code;
236 	uint8_t			 flags;
237 	uint8_t			 flagset;
238 	uint8_t			 min_ttl;
239 	uint8_t			 allow_opts;
240 	uint8_t			 rt;
241 	uint8_t			 return_ttl;
242 	uint8_t			 tos;
243 	uint8_t			 set_tos;
244 	uint8_t			 anchor_relative;
245 	uint8_t			 anchor_wildcard;
246 
247 	uint8_t			 flush;
248 	uint8_t			 prio;
249 	uint8_t			 set_prio[2];
250 
251 	struct {
252 		struct pf_addr		addr;
253 		uint16_t		port;
254 	}			divert;
255 };
256 
257 TAILQ_HEAD(pfctl_rulequeue, pfctl_rule);
258 
259 struct pfctl_ruleset {
260 	struct {
261 		struct pfctl_rulequeue	 queues[2];
262 		struct {
263 			struct pfctl_rulequeue	*ptr;
264 			struct pfctl_rule	**ptr_array;
265 			uint32_t		 rcount;
266 			uint32_t		 ticket;
267 			int			 open;
268 		}			 active, inactive;
269 	}			 rules[PF_RULESET_MAX];
270 	struct pfctl_anchor	*anchor;
271 	uint32_t		 tticket;
272 	int			 tables;
273 	int			 topen;
274 };
275 
276 RB_HEAD(pfctl_anchor_global, pfctl_anchor);
277 RB_HEAD(pfctl_anchor_node, pfctl_anchor);
278 struct pfctl_anchor {
279 	RB_ENTRY(pfctl_anchor)	 entry_global;
280 	RB_ENTRY(pfctl_anchor)	 entry_node;
281 	struct pfctl_anchor	*parent;
282 	struct pfctl_anchor_node children;
283 	char			 name[PF_ANCHOR_NAME_SIZE];
284 	char			 path[MAXPATHLEN];
285 	struct pfctl_ruleset	 ruleset;
286 	int			 refcnt;	/* anchor rules */
287 	int			 match;	/* XXX: used for pfctl black magic */
288 };
289 RB_PROTOTYPE(pfctl_anchor_global, pfctl_anchor, entry_global,
290     pf_anchor_compare);
291 RB_PROTOTYPE(pfctl_anchor_node, pfctl_anchor, entry_node,
292     pf_anchor_compare);
293 
294 struct pfctl_state_cmp {
295 	uint64_t	id;
296 	uint32_t	creatorid;
297 	uint8_t		direction;
298 };
299 
300 struct pfctl_kill {
301 	struct pfctl_state_cmp	cmp;
302 	sa_family_t		af;
303 	int			proto;
304 	struct pf_rule_addr	src;
305 	struct pf_rule_addr	dst;
306 	struct pf_rule_addr	rt_addr;
307 	char			ifname[IFNAMSIZ];
308 	char			label[PF_RULE_LABEL_SIZE];
309 	bool			kill_match;
310 };
311 
312 struct pfctl_state_peer {
313 	uint32_t			 seqlo;
314 	uint32_t			 seqhi;
315 	uint32_t			 seqdiff;
316 	uint8_t				 state;
317 	uint8_t				 wscale;
318 };
319 
320 struct pfctl_state_key {
321 	struct pf_addr	 addr[2];
322 	uint16_t	 port[2];
323 	sa_family_t	 af;
324 	uint8_t	 	 proto;
325 };
326 
327 struct pfctl_state {
328 	TAILQ_ENTRY(pfctl_state)	entry;
329 
330 	uint64_t		 id;
331 	uint32_t		 creatorid;
332 	uint8_t		 	 direction;
333 
334 	struct pfctl_state_peer	 src;
335 	struct pfctl_state_peer	 dst;
336 
337 	uint32_t		 rule;
338 	uint32_t		 anchor;
339 	uint32_t		 nat_rule;
340 	struct pf_addr		 rt_addr;
341 	struct pfctl_state_key	 key[2];	/* addresses stack and wire  */
342 	char			 ifname[IFNAMSIZ];
343 	char			 orig_ifname[IFNAMSIZ];
344 	uint64_t		 packets[2];
345 	uint64_t		 bytes[2];
346 	uint32_t		 creation;
347 	uint32_t		 expire;
348 	uint32_t		 pfsync_time;
349 	uint8_t			 state_flags;
350 	uint32_t		 sync_flags;
351 };
352 
353 TAILQ_HEAD(pfctl_statelist, pfctl_state);
354 struct pfctl_states {
355 	struct pfctl_statelist	states;
356 	size_t 			count;
357 };
358 
359 enum pfctl_syncookies_mode {
360 	PFCTL_SYNCOOKIES_NEVER,
361 	PFCTL_SYNCOOKIES_ALWAYS,
362 	PFCTL_SYNCOOKIES_ADAPTIVE
363 };
364 extern const char* PFCTL_SYNCOOKIES_MODE_NAMES[];
365 
366 struct pfctl_syncookies {
367 	enum pfctl_syncookies_mode	mode;
368 	uint8_t				highwater;	/* Percent */
369 	uint8_t				lowwater;	/* Percent */
370 };
371 
372 struct pfctl_status* pfctl_get_status(int dev);
373 void	pfctl_free_status(struct pfctl_status *status);
374 
375 int	pfctl_get_eth_rulesets_info(int dev,
376 	    struct pfctl_eth_rulesets_info *ri, const char *path);
377 int	pfctl_get_eth_ruleset(int dev, const char *path, int nr,
378 	    struct pfctl_eth_ruleset_info *ri);
379 int	pfctl_get_eth_rules_info(int dev, struct pfctl_eth_rules_info *rules,
380 	    const char *path);
381 int	pfctl_get_eth_rule(int dev, uint32_t nr, uint32_t ticket,
382 	    const char *path, struct pfctl_eth_rule *rule, bool clear,
383 	    char *anchor_call);
384 int	pfctl_add_eth_rule(int dev, const struct pfctl_eth_rule *r,
385 	    const char *anchor, const char *anchor_call, uint32_t ticket);
386 int	pfctl_get_rules_info(int dev, struct pfctl_rules_info *rules,
387 	    uint32_t ruleset, const char *path);
388 int	pfctl_get_rule(int dev, uint32_t nr, uint32_t ticket,
389 	    const char *anchor, uint32_t ruleset, struct pfctl_rule *rule,
390 	    char *anchor_call);
391 int	pfctl_get_clear_rule(int dev, uint32_t nr, uint32_t ticket,
392 	    const char *anchor, uint32_t ruleset, struct pfctl_rule *rule,
393 	    char *anchor_call, bool clear);
394 int	pfctl_add_rule(int dev, const struct pfctl_rule *r,
395 	    const char *anchor, const char *anchor_call, uint32_t ticket,
396 	    uint32_t pool_ticket);
397 int	pfctl_set_keepcounters(int dev, bool keep);
398 int	pfctl_get_states(int dev, struct pfctl_states *states);
399 void	pfctl_free_states(struct pfctl_states *states);
400 int	pfctl_clear_states(int dev, const struct pfctl_kill *kill,
401 	    unsigned int *killed);
402 int	pfctl_kill_states(int dev, const struct pfctl_kill *kill,
403 	    unsigned int *killed);
404 int	pfctl_clear_rules(int dev, const char *anchorname);
405 int	pfctl_clear_nat(int dev, const char *anchorname);
406 int	pfctl_clear_eth_rules(int dev, const char *anchorname);
407 int	pfctl_set_syncookies(int dev, const struct pfctl_syncookies *s);
408 int	pfctl_get_syncookies(int dev, struct pfctl_syncookies *s);
409 int	pfctl_table_add_addrs(int dev, struct pfr_table *tbl, struct pfr_addr
410 	    *addr, int size, int *nadd, int flags);
411 int	pfctl_table_del_addrs(int dev, struct pfr_table *tbl, struct pfr_addr
412 	    *addr, int size, int *ndel, int flags);
413 int     pfctl_table_set_addrs(int dev, struct pfr_table *tbl, struct pfr_addr
414 	    *addr, int size, int *size2, int *nadd, int *ndel, int *nchange,
415 	    int flags);
416 int	pfctl_table_get_addrs(int dev, struct pfr_table *tbl, struct pfr_addr
417 	    *addr, int *size, int flags);
418 #endif
419