xref: /freebsd/sbin/pfctl/pfctl_parser.h (revision 9c125336727b48c576bf3598d7d2c52daa5909d7)
13b3a8eb9SGleb Smirnoff /*	$OpenBSD: pfctl_parser.h,v 1.86 2006/10/31 23:46:25 mcbride Exp $ */
23b3a8eb9SGleb Smirnoff 
31de7b4b8SPedro F. Giffuni /*-
41de7b4b8SPedro F. Giffuni  * SPDX-License-Identifier: BSD-2-Clause
51de7b4b8SPedro F. Giffuni  *
63b3a8eb9SGleb Smirnoff  * Copyright (c) 2001 Daniel Hartmeier
73b3a8eb9SGleb Smirnoff  * All rights reserved.
83b3a8eb9SGleb Smirnoff  *
93b3a8eb9SGleb Smirnoff  * Redistribution and use in source and binary forms, with or without
103b3a8eb9SGleb Smirnoff  * modification, are permitted provided that the following conditions
113b3a8eb9SGleb Smirnoff  * are met:
123b3a8eb9SGleb Smirnoff  *
133b3a8eb9SGleb Smirnoff  *    - Redistributions of source code must retain the above copyright
143b3a8eb9SGleb Smirnoff  *      notice, this list of conditions and the following disclaimer.
153b3a8eb9SGleb Smirnoff  *    - Redistributions in binary form must reproduce the above
163b3a8eb9SGleb Smirnoff  *      copyright notice, this list of conditions and the following
173b3a8eb9SGleb Smirnoff  *      disclaimer in the documentation and/or other materials provided
183b3a8eb9SGleb Smirnoff  *      with the distribution.
193b3a8eb9SGleb Smirnoff  *
203b3a8eb9SGleb Smirnoff  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
213b3a8eb9SGleb Smirnoff  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
223b3a8eb9SGleb Smirnoff  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
233b3a8eb9SGleb Smirnoff  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
243b3a8eb9SGleb Smirnoff  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
253b3a8eb9SGleb Smirnoff  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
263b3a8eb9SGleb Smirnoff  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
273b3a8eb9SGleb Smirnoff  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
283b3a8eb9SGleb Smirnoff  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
293b3a8eb9SGleb Smirnoff  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
303b3a8eb9SGleb Smirnoff  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
313b3a8eb9SGleb Smirnoff  * POSSIBILITY OF SUCH DAMAGE.
323b3a8eb9SGleb Smirnoff  */
333b3a8eb9SGleb Smirnoff 
343b3a8eb9SGleb Smirnoff #ifndef _PFCTL_PARSER_H_
353b3a8eb9SGleb Smirnoff #define _PFCTL_PARSER_H_
363b3a8eb9SGleb Smirnoff 
37e9eb0941SKristof Provost #include <libpfctl.h>
38e9eb0941SKristof Provost 
393b3a8eb9SGleb Smirnoff #define PF_OSFP_FILE		"/etc/pf.os"
403b3a8eb9SGleb Smirnoff 
413b3a8eb9SGleb Smirnoff #define PF_OPT_DISABLE		0x0001
423b3a8eb9SGleb Smirnoff #define PF_OPT_ENABLE		0x0002
433b3a8eb9SGleb Smirnoff #define PF_OPT_VERBOSE		0x0004
443b3a8eb9SGleb Smirnoff #define PF_OPT_NOACTION		0x0008
453b3a8eb9SGleb Smirnoff #define PF_OPT_QUIET		0x0010
463b3a8eb9SGleb Smirnoff #define PF_OPT_CLRRULECTRS	0x0020
473b3a8eb9SGleb Smirnoff #define PF_OPT_USEDNS		0x0040
483b3a8eb9SGleb Smirnoff #define PF_OPT_VERBOSE2		0x0080
493b3a8eb9SGleb Smirnoff #define PF_OPT_DUMMYACTION	0x0100
503b3a8eb9SGleb Smirnoff #define PF_OPT_DEBUG		0x0200
513b3a8eb9SGleb Smirnoff #define PF_OPT_SHOWALL		0x0400
523b3a8eb9SGleb Smirnoff #define PF_OPT_OPTIMIZE		0x0800
533b3a8eb9SGleb Smirnoff #define PF_OPT_NUMERIC		0x1000
543b3a8eb9SGleb Smirnoff #define PF_OPT_MERGE		0x2000
553b3a8eb9SGleb Smirnoff #define PF_OPT_RECURSE		0x4000
5693abcf17SKristof Provost #define PF_OPT_KILLMATCH	0x8000
573b3a8eb9SGleb Smirnoff 
583b3a8eb9SGleb Smirnoff #define PF_TH_ALL		0xFF
593b3a8eb9SGleb Smirnoff 
603b3a8eb9SGleb Smirnoff #define PF_NAT_PROXY_PORT_LOW	50001
613b3a8eb9SGleb Smirnoff #define PF_NAT_PROXY_PORT_HIGH	65535
623b3a8eb9SGleb Smirnoff 
633b3a8eb9SGleb Smirnoff #define PF_OPTIMIZE_BASIC	0x0001
643b3a8eb9SGleb Smirnoff #define PF_OPTIMIZE_PROFILE	0x0002
653b3a8eb9SGleb Smirnoff 
663b3a8eb9SGleb Smirnoff #define FCNT_NAMES { \
673b3a8eb9SGleb Smirnoff 	"searches", \
683b3a8eb9SGleb Smirnoff 	"inserts", \
693b3a8eb9SGleb Smirnoff 	"removals", \
703b3a8eb9SGleb Smirnoff 	NULL \
713b3a8eb9SGleb Smirnoff }
723b3a8eb9SGleb Smirnoff 
733b3a8eb9SGleb Smirnoff struct pfr_buffer;	/* forward definition */
743b3a8eb9SGleb Smirnoff 
753b3a8eb9SGleb Smirnoff 
763b3a8eb9SGleb Smirnoff struct pfctl {
773b3a8eb9SGleb Smirnoff 	int dev;
78f1612e70SKristof Provost 	struct pfctl_handle *h;
793b3a8eb9SGleb Smirnoff 	int opts;
803b3a8eb9SGleb Smirnoff 	int optimize;
813b3a8eb9SGleb Smirnoff 	int loadopt;
823b3a8eb9SGleb Smirnoff 	int asd;			/* anchor stack depth */
833b3a8eb9SGleb Smirnoff 	int bn;				/* brace number */
843b3a8eb9SGleb Smirnoff 	int tdirty;			/* kernel dirty */
853b3a8eb9SGleb Smirnoff #define PFCTL_ANCHOR_STACK_DEPTH 64
86e9eb0941SKristof Provost 	struct pfctl_anchor *astack[PFCTL_ANCHOR_STACK_DEPTH];
873b3a8eb9SGleb Smirnoff 	struct pfioc_pooladdr paddr;
883b3a8eb9SGleb Smirnoff 	struct pfioc_altq *paltq;
893b3a8eb9SGleb Smirnoff 	struct pfioc_queue *pqueue;
903b3a8eb9SGleb Smirnoff 	struct pfr_buffer *trans;
91e9eb0941SKristof Provost 	struct pfctl_anchor *anchor, *alast;
922b29ceb8SKristof Provost 	int eth_nr;
93c5131afeSKristof Provost 	struct pfctl_eth_anchor *eanchor, *ealast;
94c5131afeSKristof Provost 	struct pfctl_eth_anchor *eastack[PFCTL_ANCHOR_STACK_DEPTH];
952b29ceb8SKristof Provost 	u_int32_t eth_ticket;
963b3a8eb9SGleb Smirnoff 	const char *ruleset;
973b3a8eb9SGleb Smirnoff 
983b3a8eb9SGleb Smirnoff 	/* 'set foo' options */
993b3a8eb9SGleb Smirnoff 	u_int32_t	 timeout[PFTM_MAX];
1003b3a8eb9SGleb Smirnoff 	u_int32_t	 limit[PF_LIMIT_MAX];
1013b3a8eb9SGleb Smirnoff 	u_int32_t	 debug;
1023b3a8eb9SGleb Smirnoff 	u_int32_t	 hostid;
10339282ef3SKajetan Staszkiewicz 	u_int32_t	 reassemble;
1043b3a8eb9SGleb Smirnoff 	char		*ifname;
10542ec75f8SKristof Provost 	bool		 keep_counters;
106c69121c4SKristof Provost 	u_int8_t	 syncookies;
1075062afffSKristof Provost 	u_int8_t	 syncookieswat[2];	/* lowat, highwat, in % */
1085062afffSKristof Provost 	u_int8_t	 syncookieswat_set;
1093b3a8eb9SGleb Smirnoff 
1103b3a8eb9SGleb Smirnoff 	u_int8_t	 timeout_set[PFTM_MAX];
1113b3a8eb9SGleb Smirnoff 	u_int8_t	 limit_set[PF_LIMIT_MAX];
1123b3a8eb9SGleb Smirnoff 	u_int8_t	 debug_set;
1133b3a8eb9SGleb Smirnoff 	u_int8_t	 hostid_set;
1143b3a8eb9SGleb Smirnoff 	u_int8_t	 ifname_set;
11539282ef3SKajetan Staszkiewicz 	u_int8_t	 reass_set;
1163b3a8eb9SGleb Smirnoff };
1173b3a8eb9SGleb Smirnoff 
1183b3a8eb9SGleb Smirnoff struct node_if {
1193b3a8eb9SGleb Smirnoff 	char			 ifname[IFNAMSIZ];
1203b3a8eb9SGleb Smirnoff 	u_int8_t		 not;
1213b3a8eb9SGleb Smirnoff 	u_int8_t		 dynamic; /* antispoof */
1223b3a8eb9SGleb Smirnoff 	u_int			 ifa_flags;
1233b3a8eb9SGleb Smirnoff 	struct node_if		*next;
1243b3a8eb9SGleb Smirnoff 	struct node_if		*tail;
1253b3a8eb9SGleb Smirnoff };
1263b3a8eb9SGleb Smirnoff 
1273b3a8eb9SGleb Smirnoff struct node_host {
1283b3a8eb9SGleb Smirnoff 	struct pf_addr_wrap	 addr;
1293b3a8eb9SGleb Smirnoff 	struct pf_addr		 bcast;
1303b3a8eb9SGleb Smirnoff 	struct pf_addr		 peer;
1313b3a8eb9SGleb Smirnoff 	sa_family_t		 af;
1323b3a8eb9SGleb Smirnoff 	u_int8_t		 not;
1333b3a8eb9SGleb Smirnoff 	u_int32_t		 ifindex;	/* link-local IPv6 addrs */
1343b3a8eb9SGleb Smirnoff 	char			*ifname;
1353b3a8eb9SGleb Smirnoff 	u_int			 ifa_flags;
1363b3a8eb9SGleb Smirnoff 	struct node_host	*next;
1373b3a8eb9SGleb Smirnoff 	struct node_host	*tail;
1383b3a8eb9SGleb Smirnoff };
1393b3a8eb9SGleb Smirnoff 
140637d81c5SKristof Provost void	freehostlist(struct node_host *);
141637d81c5SKristof Provost 
14287a89d6eSKristof Provost struct node_mac {
14387a89d6eSKristof Provost 	u_int8_t	 mac[ETHER_ADDR_LEN];
144b590f17aSKristof Provost 	u_int8_t	 mask[ETHER_ADDR_LEN];
14587a89d6eSKristof Provost 	bool		 neg;
146c32cd180SKristof Provost 	bool		 isset;
14787a89d6eSKristof Provost 	struct node_mac	*next;
14887a89d6eSKristof Provost 	struct node_mac	*tail;
14987a89d6eSKristof Provost };
15087a89d6eSKristof Provost 
1513b3a8eb9SGleb Smirnoff struct node_os {
1523b3a8eb9SGleb Smirnoff 	char			*os;
1533b3a8eb9SGleb Smirnoff 	pf_osfp_t		 fingerprint;
1543b3a8eb9SGleb Smirnoff 	struct node_os		*next;
1553b3a8eb9SGleb Smirnoff 	struct node_os		*tail;
1563b3a8eb9SGleb Smirnoff };
1573b3a8eb9SGleb Smirnoff 
1583b3a8eb9SGleb Smirnoff struct node_queue_bw {
159249cc75fSPatrick Kelsey 	u_int64_t	bw_absolute;
1603b3a8eb9SGleb Smirnoff 	u_int16_t	bw_percent;
1613b3a8eb9SGleb Smirnoff };
1623b3a8eb9SGleb Smirnoff 
1633b3a8eb9SGleb Smirnoff struct node_hfsc_sc {
1643b3a8eb9SGleb Smirnoff 	struct node_queue_bw	m1;	/* slope of 1st segment; bps */
1653b3a8eb9SGleb Smirnoff 	u_int			d;	/* x-projection of m1; msec */
1663b3a8eb9SGleb Smirnoff 	struct node_queue_bw	m2;	/* slope of 2nd segment; bps */
1673b3a8eb9SGleb Smirnoff 	u_int8_t		used;
1683b3a8eb9SGleb Smirnoff };
1693b3a8eb9SGleb Smirnoff 
1703b3a8eb9SGleb Smirnoff struct node_hfsc_opts {
1713b3a8eb9SGleb Smirnoff 	struct node_hfsc_sc	realtime;
1723b3a8eb9SGleb Smirnoff 	struct node_hfsc_sc	linkshare;
1733b3a8eb9SGleb Smirnoff 	struct node_hfsc_sc	upperlimit;
1743b3a8eb9SGleb Smirnoff 	int			flags;
1753b3a8eb9SGleb Smirnoff };
1763b3a8eb9SGleb Smirnoff 
177a5b789f6SErmal Luçi struct node_fairq_sc {
178a5b789f6SErmal Luçi 	struct node_queue_bw	m1;	/* slope of 1st segment; bps */
179a5b789f6SErmal Luçi 	u_int			d;	/* x-projection of m1; msec */
180a5b789f6SErmal Luçi 	struct node_queue_bw	m2;	/* slope of 2nd segment; bps */
181a5b789f6SErmal Luçi 	u_int8_t		used;
182a5b789f6SErmal Luçi };
183a5b789f6SErmal Luçi 
184a5b789f6SErmal Luçi struct node_fairq_opts {
185a5b789f6SErmal Luçi 	struct node_fairq_sc	linkshare;
186a5b789f6SErmal Luçi 	struct node_queue_bw	hogs_bw;
187a5b789f6SErmal Luçi 	u_int			nbuckets;
188a5b789f6SErmal Luçi 	int			flags;
189a5b789f6SErmal Luçi };
190a5b789f6SErmal Luçi 
1913b3a8eb9SGleb Smirnoff struct node_queue_opt {
1923b3a8eb9SGleb Smirnoff 	int			 qtype;
1933b3a8eb9SGleb Smirnoff 	union {
1943b3a8eb9SGleb Smirnoff 		struct cbq_opts		cbq_opts;
1950a70aaf8SLuiz Otavio O Souza 		struct codel_opts	codel_opts;
1963b3a8eb9SGleb Smirnoff 		struct priq_opts	priq_opts;
1973b3a8eb9SGleb Smirnoff 		struct node_hfsc_opts	hfsc_opts;
198a5b789f6SErmal Luçi 		struct node_fairq_opts	fairq_opts;
1993b3a8eb9SGleb Smirnoff 	}			 data;
2003b3a8eb9SGleb Smirnoff };
2013b3a8eb9SGleb Smirnoff 
2021d34c9daSPatrick Kelsey #define QPRI_BITSET_SIZE	256
2035e04571cSStefan Eßer __BITSET_DEFINE(qpri_bitset, QPRI_BITSET_SIZE);
2041d34c9daSPatrick Kelsey LIST_HEAD(gen_sc, segment);
2051d34c9daSPatrick Kelsey 
2061d34c9daSPatrick Kelsey struct pfctl_altq {
2071d34c9daSPatrick Kelsey 	struct pf_altq	pa;
2081d34c9daSPatrick Kelsey 	struct {
2091d34c9daSPatrick Kelsey 		STAILQ_ENTRY(pfctl_altq)	link;
2101d34c9daSPatrick Kelsey 		u_int64_t			bwsum;
2111d34c9daSPatrick Kelsey 		struct qpri_bitset		qpris;
2121d34c9daSPatrick Kelsey 		int				children;
2131d34c9daSPatrick Kelsey 		int				root_classes;
2141d34c9daSPatrick Kelsey 		int				default_classes;
2151d34c9daSPatrick Kelsey 		struct gen_sc			lssc;
2161d34c9daSPatrick Kelsey 		struct gen_sc			rtsc;
2171d34c9daSPatrick Kelsey 	} meta;
2181d34c9daSPatrick Kelsey };
2191d34c9daSPatrick Kelsey 
2205062afffSKristof Provost struct pfctl_watermarks {
2215062afffSKristof Provost 	uint32_t	hi;
2225062afffSKristof Provost 	uint32_t	lo;
2235062afffSKristof Provost };
2245062afffSKristof Provost 
2253b3a8eb9SGleb Smirnoff #ifdef __FreeBSD__
2263b3a8eb9SGleb Smirnoff /*
2273b3a8eb9SGleb Smirnoff  * XXX
2283b3a8eb9SGleb Smirnoff  * Absolutely this is not correct location to define this.
2293b3a8eb9SGleb Smirnoff  * Should we use an another sperate header file?
2303b3a8eb9SGleb Smirnoff  */
2313b3a8eb9SGleb Smirnoff #define	SIMPLEQ_HEAD			STAILQ_HEAD
2323b3a8eb9SGleb Smirnoff #define	SIMPLEQ_HEAD_INITIALIZER	STAILQ_HEAD_INITIALIZER
2333b3a8eb9SGleb Smirnoff #define	SIMPLEQ_ENTRY			STAILQ_ENTRY
2343b3a8eb9SGleb Smirnoff #define	SIMPLEQ_FIRST			STAILQ_FIRST
2353b3a8eb9SGleb Smirnoff #define	SIMPLEQ_END(head)		NULL
2363b3a8eb9SGleb Smirnoff #define	SIMPLEQ_EMPTY			STAILQ_EMPTY
2373b3a8eb9SGleb Smirnoff #define	SIMPLEQ_NEXT			STAILQ_NEXT
2383b3a8eb9SGleb Smirnoff /*#define	SIMPLEQ_FOREACH			STAILQ_FOREACH*/
2393b3a8eb9SGleb Smirnoff #define	SIMPLEQ_FOREACH(var, head, field)		\
2403b3a8eb9SGleb Smirnoff     for((var) = SIMPLEQ_FIRST(head);			\
2413b3a8eb9SGleb Smirnoff 	(var) != SIMPLEQ_END(head);			\
2423b3a8eb9SGleb Smirnoff 	(var) = SIMPLEQ_NEXT(var, field))
2433b3a8eb9SGleb Smirnoff #define	SIMPLEQ_INIT			STAILQ_INIT
2443b3a8eb9SGleb Smirnoff #define	SIMPLEQ_INSERT_HEAD		STAILQ_INSERT_HEAD
2453b3a8eb9SGleb Smirnoff #define	SIMPLEQ_INSERT_TAIL		STAILQ_INSERT_TAIL
2463b3a8eb9SGleb Smirnoff #define	SIMPLEQ_INSERT_AFTER		STAILQ_INSERT_AFTER
2473b3a8eb9SGleb Smirnoff #define	SIMPLEQ_REMOVE_HEAD		STAILQ_REMOVE_HEAD
2483b3a8eb9SGleb Smirnoff #endif
2493b3a8eb9SGleb Smirnoff SIMPLEQ_HEAD(node_tinithead, node_tinit);
2503b3a8eb9SGleb Smirnoff struct node_tinit {	/* table initializer */
2513b3a8eb9SGleb Smirnoff 	SIMPLEQ_ENTRY(node_tinit)	 entries;
2523b3a8eb9SGleb Smirnoff 	struct node_host		*host;
2533b3a8eb9SGleb Smirnoff 	char				*file;
2543b3a8eb9SGleb Smirnoff };
2553b3a8eb9SGleb Smirnoff 
2563b3a8eb9SGleb Smirnoff 
2573b3a8eb9SGleb Smirnoff /* optimizer created tables */
2583b3a8eb9SGleb Smirnoff struct pf_opt_tbl {
2593b3a8eb9SGleb Smirnoff 	char			 pt_name[PF_TABLE_NAME_SIZE];
2603b3a8eb9SGleb Smirnoff 	int			 pt_rulecount;
2613b3a8eb9SGleb Smirnoff 	int			 pt_generated;
2623b3a8eb9SGleb Smirnoff 	struct node_tinithead	 pt_nodes;
2633b3a8eb9SGleb Smirnoff 	struct pfr_buffer	*pt_buf;
2643b3a8eb9SGleb Smirnoff };
2653b3a8eb9SGleb Smirnoff #define PF_OPT_TABLE_PREFIX	"__automatic_"
2663b3a8eb9SGleb Smirnoff 
2673b3a8eb9SGleb Smirnoff /* optimizer pf_rule container */
2683b3a8eb9SGleb Smirnoff struct pf_opt_rule {
269e9eb0941SKristof Provost 	struct pfctl_rule	 por_rule;
2703b3a8eb9SGleb Smirnoff 	struct pf_opt_tbl	*por_src_tbl;
2713b3a8eb9SGleb Smirnoff 	struct pf_opt_tbl	*por_dst_tbl;
2723b3a8eb9SGleb Smirnoff 	u_int64_t		 por_profile_count;
2733b3a8eb9SGleb Smirnoff 	TAILQ_ENTRY(pf_opt_rule) por_entry;
2743b3a8eb9SGleb Smirnoff 	TAILQ_ENTRY(pf_opt_rule) por_skip_entry[PF_SKIP_COUNT];
2753b3a8eb9SGleb Smirnoff };
2763b3a8eb9SGleb Smirnoff 
2773b3a8eb9SGleb Smirnoff TAILQ_HEAD(pf_opt_queue, pf_opt_rule);
2783b3a8eb9SGleb Smirnoff 
2793b3a8eb9SGleb Smirnoff int	pfctl_rules(int, char *, int, int, char *, struct pfr_buffer *);
280e9eb0941SKristof Provost int	pfctl_optimize_ruleset(struct pfctl *, struct pfctl_ruleset *);
2813b3a8eb9SGleb Smirnoff 
282e9eb0941SKristof Provost int	pfctl_append_rule(struct pfctl *, struct pfctl_rule *, const char *);
283c5131afeSKristof Provost int	pfctl_append_eth_rule(struct pfctl *, struct pfctl_eth_rule *,
284c5131afeSKristof Provost 	    const char *);
2853b3a8eb9SGleb Smirnoff int	pfctl_add_altq(struct pfctl *, struct pf_altq *);
286600bd6ceSKurosawa Takahiro int	pfctl_add_pool(struct pfctl *, struct pfctl_pool *, sa_family_t);
287600bd6ceSKurosawa Takahiro void	pfctl_move_pool(struct pfctl_pool *, struct pfctl_pool *);
288600bd6ceSKurosawa Takahiro void	pfctl_clear_pool(struct pfctl_pool *);
2893b3a8eb9SGleb Smirnoff 
29030bad751SKristof Provost int	pfctl_apply_timeout(struct pfctl *, const char *, int, int);
29139282ef3SKajetan Staszkiewicz int	pfctl_set_reassembly(struct pfctl *, int, int);
2923b3a8eb9SGleb Smirnoff int	pfctl_set_optimization(struct pfctl *, const char *);
293d9ab8999SKristof Provost int	pfctl_apply_limit(struct pfctl *, const char *, unsigned int);
2943b3a8eb9SGleb Smirnoff int	pfctl_set_logif(struct pfctl *, char *);
2953b3a8eb9SGleb Smirnoff int	pfctl_set_hostid(struct pfctl *, u_int32_t);
296c36c90a2SKristof Provost int	pfctl_do_set_debug(struct pfctl *, char *);
2973b3a8eb9SGleb Smirnoff int	pfctl_set_interface_flags(struct pfctl *, char *, int, int);
2985062afffSKristof Provost int	pfctl_cfg_syncookies(struct pfctl *, uint8_t, struct pfctl_watermarks *);
2993b3a8eb9SGleb Smirnoff 
3003b3a8eb9SGleb Smirnoff int	parse_config(char *, struct pfctl *);
3013b3a8eb9SGleb Smirnoff int	parse_flags(char *);
3023b3a8eb9SGleb Smirnoff int	pfctl_load_anchors(int, struct pfctl *, struct pfr_buffer *);
3033b3a8eb9SGleb Smirnoff 
304600bd6ceSKurosawa Takahiro void	print_pool(struct pfctl_pool *, u_int16_t, u_int16_t, sa_family_t, int);
305*9c125336SKristof Provost void	print_src_node(struct pfctl_src_node *, int);
306c5131afeSKristof Provost void	print_eth_rule(struct pfctl_eth_rule *, const char *, int);
307e9eb0941SKristof Provost void	print_rule(struct pfctl_rule *, const char *, int, int);
3083b3a8eb9SGleb Smirnoff void	print_tabledef(const char *, int, int, struct node_tinithead *);
30980078d9dSKristof Provost void	print_status(struct pfctl_status *, struct pfctl_syncookies *, int);
31080078d9dSKristof Provost void	print_running(struct pfctl_status *);
3113b3a8eb9SGleb Smirnoff 
3123b3a8eb9SGleb Smirnoff int	eval_pfaltq(struct pfctl *, struct pf_altq *, struct node_queue_bw *,
3133b3a8eb9SGleb Smirnoff 	    struct node_queue_opt *);
3143b3a8eb9SGleb Smirnoff int	eval_pfqueue(struct pfctl *, struct pf_altq *, struct node_queue_bw *,
3153b3a8eb9SGleb Smirnoff 	    struct node_queue_opt *);
3163b3a8eb9SGleb Smirnoff 
3173b3a8eb9SGleb Smirnoff void	 print_altq(const struct pf_altq *, unsigned, struct node_queue_bw *,
3183b3a8eb9SGleb Smirnoff 	    struct node_queue_opt *);
3193b3a8eb9SGleb Smirnoff void	 print_queue(const struct pf_altq *, unsigned, struct node_queue_bw *,
3203b3a8eb9SGleb Smirnoff 	    int, struct node_queue_opt *);
3213b3a8eb9SGleb Smirnoff 
3223b3a8eb9SGleb Smirnoff int	pfctl_define_table(char *, int, int, const char *, struct pfr_buffer *,
3233b3a8eb9SGleb Smirnoff 	    u_int32_t);
3243b3a8eb9SGleb Smirnoff 
3253b3a8eb9SGleb Smirnoff void		 pfctl_clear_fingerprints(int, int);
3263b3a8eb9SGleb Smirnoff int		 pfctl_file_fingerprints(int, int, const char *);
3273b3a8eb9SGleb Smirnoff pf_osfp_t	 pfctl_get_fingerprint(const char *);
3283b3a8eb9SGleb Smirnoff int		 pfctl_load_fingerprints(int, int);
3293b3a8eb9SGleb Smirnoff char		*pfctl_lookup_fingerprint(pf_osfp_t, char *, size_t);
3303b3a8eb9SGleb Smirnoff void		 pfctl_show_fingerprints(int);
3313b3a8eb9SGleb Smirnoff 
3323b3a8eb9SGleb Smirnoff 
3333b3a8eb9SGleb Smirnoff struct icmptypeent {
3343b3a8eb9SGleb Smirnoff 	const char *name;
3353b3a8eb9SGleb Smirnoff 	u_int8_t type;
3363b3a8eb9SGleb Smirnoff };
3373b3a8eb9SGleb Smirnoff 
3383b3a8eb9SGleb Smirnoff struct icmpcodeent {
3393b3a8eb9SGleb Smirnoff 	const char *name;
3403b3a8eb9SGleb Smirnoff 	u_int8_t type;
3413b3a8eb9SGleb Smirnoff 	u_int8_t code;
3423b3a8eb9SGleb Smirnoff };
3433b3a8eb9SGleb Smirnoff 
344dbce131bSKristof Provost const struct icmptypeent *geticmptypebynumber(u_int8_t, sa_family_t);
345dbce131bSKristof Provost const struct icmptypeent *geticmptypebyname(char *, sa_family_t);
346dbce131bSKristof Provost const struct icmpcodeent *geticmpcodebynumber(u_int8_t, u_int8_t, sa_family_t);
347dbce131bSKristof Provost const struct icmpcodeent *geticmpcodebyname(u_long, char *, sa_family_t);
3483b3a8eb9SGleb Smirnoff 
3493b3a8eb9SGleb Smirnoff struct pf_timeout {
3503b3a8eb9SGleb Smirnoff 	const char	*name;
3513b3a8eb9SGleb Smirnoff 	int		 timeout;
3523b3a8eb9SGleb Smirnoff };
3533b3a8eb9SGleb Smirnoff 
3543b3a8eb9SGleb Smirnoff #define PFCTL_FLAG_FILTER	0x02
3553b3a8eb9SGleb Smirnoff #define PFCTL_FLAG_NAT		0x04
3563b3a8eb9SGleb Smirnoff #define PFCTL_FLAG_OPTION	0x08
3573b3a8eb9SGleb Smirnoff #define PFCTL_FLAG_ALTQ		0x10
3583b3a8eb9SGleb Smirnoff #define PFCTL_FLAG_TABLE	0x20
3592b29ceb8SKristof Provost #define PFCTL_FLAG_ETH		0x40
3603b3a8eb9SGleb Smirnoff 
3613b3a8eb9SGleb Smirnoff extern const struct pf_timeout pf_timeouts[];
3623b3a8eb9SGleb Smirnoff 
3633b3a8eb9SGleb Smirnoff void			 set_ipmask(struct node_host *, u_int8_t);
3643b3a8eb9SGleb Smirnoff int			 check_netmask(struct node_host *, sa_family_t);
3653b3a8eb9SGleb Smirnoff int			 unmask(struct pf_addr *, sa_family_t);
3667ce98cf2SKristof Provost struct node_host	*gen_dynnode(struct node_host *, sa_family_t);
3673b3a8eb9SGleb Smirnoff void			 ifa_load(void);
3681d34c9daSPatrick Kelsey int			 get_query_socket(void);
3691d34c9daSPatrick Kelsey struct node_host	*ifa_exists(char *);
3701d34c9daSPatrick Kelsey struct node_host	*ifa_grouplookup(char *ifa_name, int flags);
3711d34c9daSPatrick Kelsey struct node_host	*ifa_lookup(char *, int);
3723b3a8eb9SGleb Smirnoff struct node_host	*host(const char *);
3733b3a8eb9SGleb Smirnoff 
3743b3a8eb9SGleb Smirnoff int			 append_addr(struct pfr_buffer *, char *, int);
3753b3a8eb9SGleb Smirnoff int			 append_addr_host(struct pfr_buffer *,
3763b3a8eb9SGleb Smirnoff 			    struct node_host *, int, int);
3773b3a8eb9SGleb Smirnoff 
3783b3a8eb9SGleb Smirnoff #endif /* _PFCTL_PARSER_H_ */
379