xref: /freebsd/sbin/pfctl/pfctl_parser.h (revision 3332f1b444d4a73238e9f59cca27bfc95fe936bd)
1 /*	$OpenBSD: pfctl_parser.h,v 1.86 2006/10/31 23:46:25 mcbride Exp $ */
2 
3 /*-
4  * SPDX-License-Identifier: BSD-2-Clause
5  *
6  * Copyright (c) 2001 Daniel Hartmeier
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  *
13  *    - Redistributions of source code must retain the above copyright
14  *      notice, this list of conditions and the following disclaimer.
15  *    - Redistributions in binary form must reproduce the above
16  *      copyright notice, this list of conditions and the following
17  *      disclaimer in the documentation and/or other materials provided
18  *      with the distribution.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
24  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
27  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
28  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
30  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31  * POSSIBILITY OF SUCH DAMAGE.
32  *
33  * $FreeBSD$
34  */
35 
36 #ifndef _PFCTL_PARSER_H_
37 #define _PFCTL_PARSER_H_
38 
39 #include <libpfctl.h>
40 
41 #define PF_OSFP_FILE		"/etc/pf.os"
42 
43 #define PF_OPT_DISABLE		0x0001
44 #define PF_OPT_ENABLE		0x0002
45 #define PF_OPT_VERBOSE		0x0004
46 #define PF_OPT_NOACTION		0x0008
47 #define PF_OPT_QUIET		0x0010
48 #define PF_OPT_CLRRULECTRS	0x0020
49 #define PF_OPT_USEDNS		0x0040
50 #define PF_OPT_VERBOSE2		0x0080
51 #define PF_OPT_DUMMYACTION	0x0100
52 #define PF_OPT_DEBUG		0x0200
53 #define PF_OPT_SHOWALL		0x0400
54 #define PF_OPT_OPTIMIZE		0x0800
55 #define PF_OPT_NUMERIC		0x1000
56 #define PF_OPT_MERGE		0x2000
57 #define PF_OPT_RECURSE		0x4000
58 #define PF_OPT_KILLMATCH	0x8000
59 
60 #define PF_TH_ALL		0xFF
61 
62 #define PF_NAT_PROXY_PORT_LOW	50001
63 #define PF_NAT_PROXY_PORT_HIGH	65535
64 
65 #define PF_OPTIMIZE_BASIC	0x0001
66 #define PF_OPTIMIZE_PROFILE	0x0002
67 
68 #define FCNT_NAMES { \
69 	"searches", \
70 	"inserts", \
71 	"removals", \
72 	NULL \
73 }
74 
75 struct pfr_buffer;	/* forward definition */
76 
77 
78 struct pfctl {
79 	int dev;
80 	int opts;
81 	int optimize;
82 	int loadopt;
83 	int asd;			/* anchor stack depth */
84 	int bn;				/* brace number */
85 	int tdirty;			/* kernel dirty */
86 #define PFCTL_ANCHOR_STACK_DEPTH 64
87 	struct pfctl_anchor *astack[PFCTL_ANCHOR_STACK_DEPTH];
88 	struct pfioc_pooladdr paddr;
89 	struct pfioc_altq *paltq;
90 	struct pfioc_queue *pqueue;
91 	struct pfr_buffer *trans;
92 	struct pfctl_anchor *anchor, *alast;
93 	const char *ruleset;
94 
95 	/* 'set foo' options */
96 	u_int32_t	 timeout[PFTM_MAX];
97 	u_int32_t	 limit[PF_LIMIT_MAX];
98 	u_int32_t	 debug;
99 	u_int32_t	 hostid;
100 	char		*ifname;
101 	bool		 keep_counters;
102 	u_int8_t	 syncookies;
103 	u_int8_t	 syncookieswat[2];	/* lowat, highwat, in % */
104 	u_int8_t	 syncookieswat_set;
105 
106 	u_int8_t	 timeout_set[PFTM_MAX];
107 	u_int8_t	 limit_set[PF_LIMIT_MAX];
108 	u_int8_t	 debug_set;
109 	u_int8_t	 hostid_set;
110 	u_int8_t	 ifname_set;
111 };
112 
113 struct node_if {
114 	char			 ifname[IFNAMSIZ];
115 	u_int8_t		 not;
116 	u_int8_t		 dynamic; /* antispoof */
117 	u_int			 ifa_flags;
118 	struct node_if		*next;
119 	struct node_if		*tail;
120 };
121 
122 struct node_host {
123 	struct pf_addr_wrap	 addr;
124 	struct pf_addr		 bcast;
125 	struct pf_addr		 peer;
126 	sa_family_t		 af;
127 	u_int8_t		 not;
128 	u_int32_t		 ifindex;	/* link-local IPv6 addrs */
129 	char			*ifname;
130 	u_int			 ifa_flags;
131 	struct node_host	*next;
132 	struct node_host	*tail;
133 };
134 
135 struct node_os {
136 	char			*os;
137 	pf_osfp_t		 fingerprint;
138 	struct node_os		*next;
139 	struct node_os		*tail;
140 };
141 
142 struct node_queue_bw {
143 	u_int64_t	bw_absolute;
144 	u_int16_t	bw_percent;
145 };
146 
147 struct node_hfsc_sc {
148 	struct node_queue_bw	m1;	/* slope of 1st segment; bps */
149 	u_int			d;	/* x-projection of m1; msec */
150 	struct node_queue_bw	m2;	/* slope of 2nd segment; bps */
151 	u_int8_t		used;
152 };
153 
154 struct node_hfsc_opts {
155 	struct node_hfsc_sc	realtime;
156 	struct node_hfsc_sc	linkshare;
157 	struct node_hfsc_sc	upperlimit;
158 	int			flags;
159 };
160 
161 struct node_fairq_sc {
162 	struct node_queue_bw	m1;	/* slope of 1st segment; bps */
163 	u_int			d;	/* x-projection of m1; msec */
164 	struct node_queue_bw	m2;	/* slope of 2nd segment; bps */
165 	u_int8_t		used;
166 };
167 
168 struct node_fairq_opts {
169 	struct node_fairq_sc	linkshare;
170 	struct node_queue_bw	hogs_bw;
171 	u_int			nbuckets;
172 	int			flags;
173 };
174 
175 struct node_queue_opt {
176 	int			 qtype;
177 	union {
178 		struct cbq_opts		cbq_opts;
179 		struct codel_opts	codel_opts;
180 		struct priq_opts	priq_opts;
181 		struct node_hfsc_opts	hfsc_opts;
182 		struct node_fairq_opts	fairq_opts;
183 	}			 data;
184 };
185 
186 #define QPRI_BITSET_SIZE	256
187 BITSET_DEFINE(qpri_bitset, QPRI_BITSET_SIZE);
188 LIST_HEAD(gen_sc, segment);
189 
190 struct pfctl_altq {
191 	struct pf_altq	pa;
192 	struct {
193 		STAILQ_ENTRY(pfctl_altq)	link;
194 		u_int64_t			bwsum;
195 		struct qpri_bitset		qpris;
196 		int				children;
197 		int				root_classes;
198 		int				default_classes;
199 		struct gen_sc			lssc;
200 		struct gen_sc			rtsc;
201 	} meta;
202 };
203 
204 struct pfctl_watermarks {
205 	uint32_t	hi;
206 	uint32_t	lo;
207 };
208 
209 #ifdef __FreeBSD__
210 /*
211  * XXX
212  * Absolutely this is not correct location to define this.
213  * Should we use an another sperate header file?
214  */
215 #define	SIMPLEQ_HEAD			STAILQ_HEAD
216 #define	SIMPLEQ_HEAD_INITIALIZER	STAILQ_HEAD_INITIALIZER
217 #define	SIMPLEQ_ENTRY			STAILQ_ENTRY
218 #define	SIMPLEQ_FIRST			STAILQ_FIRST
219 #define	SIMPLEQ_END(head)		NULL
220 #define	SIMPLEQ_EMPTY			STAILQ_EMPTY
221 #define	SIMPLEQ_NEXT			STAILQ_NEXT
222 /*#define	SIMPLEQ_FOREACH			STAILQ_FOREACH*/
223 #define	SIMPLEQ_FOREACH(var, head, field)		\
224     for((var) = SIMPLEQ_FIRST(head);			\
225 	(var) != SIMPLEQ_END(head);			\
226 	(var) = SIMPLEQ_NEXT(var, field))
227 #define	SIMPLEQ_INIT			STAILQ_INIT
228 #define	SIMPLEQ_INSERT_HEAD		STAILQ_INSERT_HEAD
229 #define	SIMPLEQ_INSERT_TAIL		STAILQ_INSERT_TAIL
230 #define	SIMPLEQ_INSERT_AFTER		STAILQ_INSERT_AFTER
231 #define	SIMPLEQ_REMOVE_HEAD		STAILQ_REMOVE_HEAD
232 #endif
233 SIMPLEQ_HEAD(node_tinithead, node_tinit);
234 struct node_tinit {	/* table initializer */
235 	SIMPLEQ_ENTRY(node_tinit)	 entries;
236 	struct node_host		*host;
237 	char				*file;
238 };
239 
240 
241 /* optimizer created tables */
242 struct pf_opt_tbl {
243 	char			 pt_name[PF_TABLE_NAME_SIZE];
244 	int			 pt_rulecount;
245 	int			 pt_generated;
246 	struct node_tinithead	 pt_nodes;
247 	struct pfr_buffer	*pt_buf;
248 };
249 #define PF_OPT_TABLE_PREFIX	"__automatic_"
250 
251 /* optimizer pf_rule container */
252 struct pf_opt_rule {
253 	struct pfctl_rule	 por_rule;
254 	struct pf_opt_tbl	*por_src_tbl;
255 	struct pf_opt_tbl	*por_dst_tbl;
256 	u_int64_t		 por_profile_count;
257 	TAILQ_ENTRY(pf_opt_rule) por_entry;
258 	TAILQ_ENTRY(pf_opt_rule) por_skip_entry[PF_SKIP_COUNT];
259 };
260 
261 TAILQ_HEAD(pf_opt_queue, pf_opt_rule);
262 
263 int	pfctl_rules(int, char *, int, int, char *, struct pfr_buffer *);
264 int	pfctl_optimize_ruleset(struct pfctl *, struct pfctl_ruleset *);
265 
266 int	pfctl_append_rule(struct pfctl *, struct pfctl_rule *, const char *);
267 int	pfctl_add_altq(struct pfctl *, struct pf_altq *);
268 int	pfctl_add_pool(struct pfctl *, struct pfctl_pool *, sa_family_t);
269 void	pfctl_move_pool(struct pfctl_pool *, struct pfctl_pool *);
270 void	pfctl_clear_pool(struct pfctl_pool *);
271 
272 int	pfctl_set_timeout(struct pfctl *, const char *, int, int);
273 int	pfctl_set_optimization(struct pfctl *, const char *);
274 int	pfctl_set_limit(struct pfctl *, const char *, unsigned int);
275 int	pfctl_set_logif(struct pfctl *, char *);
276 int	pfctl_set_hostid(struct pfctl *, u_int32_t);
277 int	pfctl_set_debug(struct pfctl *, char *);
278 int	pfctl_set_interface_flags(struct pfctl *, char *, int, int);
279 int	pfctl_cfg_syncookies(struct pfctl *, uint8_t, struct pfctl_watermarks *);
280 
281 int	parse_config(char *, struct pfctl *);
282 int	parse_flags(char *);
283 int	pfctl_load_anchors(int, struct pfctl *, struct pfr_buffer *);
284 
285 void	print_pool(struct pfctl_pool *, u_int16_t, u_int16_t, sa_family_t, int);
286 void	print_src_node(struct pf_src_node *, int);
287 void	print_rule(struct pfctl_rule *, const char *, int, int);
288 void	print_tabledef(const char *, int, int, struct node_tinithead *);
289 void	print_status(struct pfctl_status *, struct pfctl_syncookies *, int);
290 void	print_running(struct pfctl_status *);
291 
292 int	eval_pfaltq(struct pfctl *, struct pf_altq *, struct node_queue_bw *,
293 	    struct node_queue_opt *);
294 int	eval_pfqueue(struct pfctl *, struct pf_altq *, struct node_queue_bw *,
295 	    struct node_queue_opt *);
296 
297 void	 print_altq(const struct pf_altq *, unsigned, struct node_queue_bw *,
298 	    struct node_queue_opt *);
299 void	 print_queue(const struct pf_altq *, unsigned, struct node_queue_bw *,
300 	    int, struct node_queue_opt *);
301 
302 int	pfctl_define_table(char *, int, int, const char *, struct pfr_buffer *,
303 	    u_int32_t);
304 
305 void		 pfctl_clear_fingerprints(int, int);
306 int		 pfctl_file_fingerprints(int, int, const char *);
307 pf_osfp_t	 pfctl_get_fingerprint(const char *);
308 int		 pfctl_load_fingerprints(int, int);
309 char		*pfctl_lookup_fingerprint(pf_osfp_t, char *, size_t);
310 void		 pfctl_show_fingerprints(int);
311 
312 
313 struct icmptypeent {
314 	const char *name;
315 	u_int8_t type;
316 };
317 
318 struct icmpcodeent {
319 	const char *name;
320 	u_int8_t type;
321 	u_int8_t code;
322 };
323 
324 const struct icmptypeent *geticmptypebynumber(u_int8_t, u_int8_t);
325 const struct icmptypeent *geticmptypebyname(char *, u_int8_t);
326 const struct icmpcodeent *geticmpcodebynumber(u_int8_t, u_int8_t, u_int8_t);
327 const struct icmpcodeent *geticmpcodebyname(u_long, char *, u_int8_t);
328 
329 struct pf_timeout {
330 	const char	*name;
331 	int		 timeout;
332 };
333 
334 #define PFCTL_FLAG_FILTER	0x02
335 #define PFCTL_FLAG_NAT		0x04
336 #define PFCTL_FLAG_OPTION	0x08
337 #define PFCTL_FLAG_ALTQ		0x10
338 #define PFCTL_FLAG_TABLE	0x20
339 
340 extern const struct pf_timeout pf_timeouts[];
341 
342 void			 set_ipmask(struct node_host *, u_int8_t);
343 int			 check_netmask(struct node_host *, sa_family_t);
344 int			 unmask(struct pf_addr *, sa_family_t);
345 void			 ifa_load(void);
346 int			 get_query_socket(void);
347 struct node_host	*ifa_exists(char *);
348 struct node_host	*ifa_grouplookup(char *ifa_name, int flags);
349 struct node_host	*ifa_lookup(char *, int);
350 struct node_host	*host(const char *);
351 
352 int			 append_addr(struct pfr_buffer *, char *, int);
353 int			 append_addr_host(struct pfr_buffer *,
354 			    struct node_host *, int, int);
355 
356 #endif /* _PFCTL_PARSER_H_ */
357