xref: /freebsd/sbin/pfctl/pfctl_parser.h (revision fdc418f15e92732a3551832bcb625ba9b47242df)
1 /*	$OpenBSD: pfctl_parser.h,v 1.86 2006/10/31 23:46:25 mcbride Exp $ */
2 
3 /*-
4  * SPDX-License-Identifier: BSD-2-Clause
5  *
6  * Copyright (c) 2001 Daniel Hartmeier
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  *
13  *    - Redistributions of source code must retain the above copyright
14  *      notice, this list of conditions and the following disclaimer.
15  *    - Redistributions in binary form must reproduce the above
16  *      copyright notice, this list of conditions and the following
17  *      disclaimer in the documentation and/or other materials provided
18  *      with the distribution.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
24  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
27  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
28  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
30  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31  * POSSIBILITY OF SUCH DAMAGE.
32  *
33  * $FreeBSD$
34  */
35 
36 #ifndef _PFCTL_PARSER_H_
37 #define _PFCTL_PARSER_H_
38 
39 #include <libpfctl.h>
40 
41 #define PF_OSFP_FILE		"/etc/pf.os"
42 
43 #define PF_OPT_DISABLE		0x0001
44 #define PF_OPT_ENABLE		0x0002
45 #define PF_OPT_VERBOSE		0x0004
46 #define PF_OPT_NOACTION		0x0008
47 #define PF_OPT_QUIET		0x0010
48 #define PF_OPT_CLRRULECTRS	0x0020
49 #define PF_OPT_USEDNS		0x0040
50 #define PF_OPT_VERBOSE2		0x0080
51 #define PF_OPT_DUMMYACTION	0x0100
52 #define PF_OPT_DEBUG		0x0200
53 #define PF_OPT_SHOWALL		0x0400
54 #define PF_OPT_OPTIMIZE		0x0800
55 #define PF_OPT_NUMERIC		0x1000
56 #define PF_OPT_MERGE		0x2000
57 #define PF_OPT_RECURSE		0x4000
58 #define PF_OPT_KILLMATCH	0x8000
59 
60 #define PF_TH_ALL		0xFF
61 
62 #define PF_NAT_PROXY_PORT_LOW	50001
63 #define PF_NAT_PROXY_PORT_HIGH	65535
64 
65 #define PF_OPTIMIZE_BASIC	0x0001
66 #define PF_OPTIMIZE_PROFILE	0x0002
67 
68 #define FCNT_NAMES { \
69 	"searches", \
70 	"inserts", \
71 	"removals", \
72 	NULL \
73 }
74 
75 struct pfr_buffer;	/* forward definition */
76 
77 
78 struct pfctl {
79 	int dev;
80 	int opts;
81 	int optimize;
82 	int loadopt;
83 	int asd;			/* anchor stack depth */
84 	int bn;				/* brace number */
85 	int tdirty;			/* kernel dirty */
86 #define PFCTL_ANCHOR_STACK_DEPTH 64
87 	struct pfctl_anchor *astack[PFCTL_ANCHOR_STACK_DEPTH];
88 	struct pfioc_pooladdr paddr;
89 	struct pfioc_altq *paltq;
90 	struct pfioc_queue *pqueue;
91 	struct pfr_buffer *trans;
92 	struct pfctl_anchor *anchor, *alast;
93 	int eth_nr;
94 	struct pfctl_eth_anchor *eanchor, *ealast;
95 	struct pfctl_eth_anchor *eastack[PFCTL_ANCHOR_STACK_DEPTH];
96 	u_int32_t eth_ticket;
97 	const char *ruleset;
98 
99 	/* 'set foo' options */
100 	u_int32_t	 timeout[PFTM_MAX];
101 	u_int32_t	 limit[PF_LIMIT_MAX];
102 	u_int32_t	 debug;
103 	u_int32_t	 hostid;
104 	char		*ifname;
105 	bool		 keep_counters;
106 	u_int8_t	 syncookies;
107 	u_int8_t	 syncookieswat[2];	/* lowat, highwat, in % */
108 	u_int8_t	 syncookieswat_set;
109 
110 	u_int8_t	 timeout_set[PFTM_MAX];
111 	u_int8_t	 limit_set[PF_LIMIT_MAX];
112 	u_int8_t	 debug_set;
113 	u_int8_t	 hostid_set;
114 	u_int8_t	 ifname_set;
115 };
116 
117 struct node_if {
118 	char			 ifname[IFNAMSIZ];
119 	u_int8_t		 not;
120 	u_int8_t		 dynamic; /* antispoof */
121 	u_int			 ifa_flags;
122 	struct node_if		*next;
123 	struct node_if		*tail;
124 };
125 
126 struct node_host {
127 	struct pf_addr_wrap	 addr;
128 	struct pf_addr		 bcast;
129 	struct pf_addr		 peer;
130 	sa_family_t		 af;
131 	u_int8_t		 not;
132 	u_int32_t		 ifindex;	/* link-local IPv6 addrs */
133 	char			*ifname;
134 	u_int			 ifa_flags;
135 	struct node_host	*next;
136 	struct node_host	*tail;
137 };
138 
139 struct node_mac {
140 	u_int8_t	 mac[ETHER_ADDR_LEN];
141 	u_int8_t	 mask[ETHER_ADDR_LEN];
142 	bool		 neg;
143 	bool		 isset;
144 	struct node_mac	*next;
145 	struct node_mac	*tail;
146 };
147 
148 struct node_os {
149 	char			*os;
150 	pf_osfp_t		 fingerprint;
151 	struct node_os		*next;
152 	struct node_os		*tail;
153 };
154 
155 struct node_queue_bw {
156 	u_int64_t	bw_absolute;
157 	u_int16_t	bw_percent;
158 };
159 
160 struct node_hfsc_sc {
161 	struct node_queue_bw	m1;	/* slope of 1st segment; bps */
162 	u_int			d;	/* x-projection of m1; msec */
163 	struct node_queue_bw	m2;	/* slope of 2nd segment; bps */
164 	u_int8_t		used;
165 };
166 
167 struct node_hfsc_opts {
168 	struct node_hfsc_sc	realtime;
169 	struct node_hfsc_sc	linkshare;
170 	struct node_hfsc_sc	upperlimit;
171 	int			flags;
172 };
173 
174 struct node_fairq_sc {
175 	struct node_queue_bw	m1;	/* slope of 1st segment; bps */
176 	u_int			d;	/* x-projection of m1; msec */
177 	struct node_queue_bw	m2;	/* slope of 2nd segment; bps */
178 	u_int8_t		used;
179 };
180 
181 struct node_fairq_opts {
182 	struct node_fairq_sc	linkshare;
183 	struct node_queue_bw	hogs_bw;
184 	u_int			nbuckets;
185 	int			flags;
186 };
187 
188 struct node_queue_opt {
189 	int			 qtype;
190 	union {
191 		struct cbq_opts		cbq_opts;
192 		struct codel_opts	codel_opts;
193 		struct priq_opts	priq_opts;
194 		struct node_hfsc_opts	hfsc_opts;
195 		struct node_fairq_opts	fairq_opts;
196 	}			 data;
197 };
198 
199 #define QPRI_BITSET_SIZE	256
200 __BITSET_DEFINE(qpri_bitset, QPRI_BITSET_SIZE);
201 LIST_HEAD(gen_sc, segment);
202 
203 struct pfctl_altq {
204 	struct pf_altq	pa;
205 	struct {
206 		STAILQ_ENTRY(pfctl_altq)	link;
207 		u_int64_t			bwsum;
208 		struct qpri_bitset		qpris;
209 		int				children;
210 		int				root_classes;
211 		int				default_classes;
212 		struct gen_sc			lssc;
213 		struct gen_sc			rtsc;
214 	} meta;
215 };
216 
217 struct pfctl_watermarks {
218 	uint32_t	hi;
219 	uint32_t	lo;
220 };
221 
222 #ifdef __FreeBSD__
223 /*
224  * XXX
225  * Absolutely this is not correct location to define this.
226  * Should we use an another sperate header file?
227  */
228 #define	SIMPLEQ_HEAD			STAILQ_HEAD
229 #define	SIMPLEQ_HEAD_INITIALIZER	STAILQ_HEAD_INITIALIZER
230 #define	SIMPLEQ_ENTRY			STAILQ_ENTRY
231 #define	SIMPLEQ_FIRST			STAILQ_FIRST
232 #define	SIMPLEQ_END(head)		NULL
233 #define	SIMPLEQ_EMPTY			STAILQ_EMPTY
234 #define	SIMPLEQ_NEXT			STAILQ_NEXT
235 /*#define	SIMPLEQ_FOREACH			STAILQ_FOREACH*/
236 #define	SIMPLEQ_FOREACH(var, head, field)		\
237     for((var) = SIMPLEQ_FIRST(head);			\
238 	(var) != SIMPLEQ_END(head);			\
239 	(var) = SIMPLEQ_NEXT(var, field))
240 #define	SIMPLEQ_INIT			STAILQ_INIT
241 #define	SIMPLEQ_INSERT_HEAD		STAILQ_INSERT_HEAD
242 #define	SIMPLEQ_INSERT_TAIL		STAILQ_INSERT_TAIL
243 #define	SIMPLEQ_INSERT_AFTER		STAILQ_INSERT_AFTER
244 #define	SIMPLEQ_REMOVE_HEAD		STAILQ_REMOVE_HEAD
245 #endif
246 SIMPLEQ_HEAD(node_tinithead, node_tinit);
247 struct node_tinit {	/* table initializer */
248 	SIMPLEQ_ENTRY(node_tinit)	 entries;
249 	struct node_host		*host;
250 	char				*file;
251 };
252 
253 
254 /* optimizer created tables */
255 struct pf_opt_tbl {
256 	char			 pt_name[PF_TABLE_NAME_SIZE];
257 	int			 pt_rulecount;
258 	int			 pt_generated;
259 	struct node_tinithead	 pt_nodes;
260 	struct pfr_buffer	*pt_buf;
261 };
262 #define PF_OPT_TABLE_PREFIX	"__automatic_"
263 
264 /* optimizer pf_rule container */
265 struct pf_opt_rule {
266 	struct pfctl_rule	 por_rule;
267 	struct pf_opt_tbl	*por_src_tbl;
268 	struct pf_opt_tbl	*por_dst_tbl;
269 	u_int64_t		 por_profile_count;
270 	TAILQ_ENTRY(pf_opt_rule) por_entry;
271 	TAILQ_ENTRY(pf_opt_rule) por_skip_entry[PF_SKIP_COUNT];
272 };
273 
274 TAILQ_HEAD(pf_opt_queue, pf_opt_rule);
275 
276 int	pfctl_rules(int, char *, int, int, char *, struct pfr_buffer *);
277 int	pfctl_optimize_ruleset(struct pfctl *, struct pfctl_ruleset *);
278 
279 int	pfctl_append_rule(struct pfctl *, struct pfctl_rule *, const char *);
280 int	pfctl_append_eth_rule(struct pfctl *, struct pfctl_eth_rule *,
281 	    const char *);
282 int	pfctl_add_altq(struct pfctl *, struct pf_altq *);
283 int	pfctl_add_pool(struct pfctl *, struct pfctl_pool *, sa_family_t);
284 void	pfctl_move_pool(struct pfctl_pool *, struct pfctl_pool *);
285 void	pfctl_clear_pool(struct pfctl_pool *);
286 
287 int	pfctl_set_timeout(struct pfctl *, const char *, int, int);
288 int	pfctl_set_optimization(struct pfctl *, const char *);
289 int	pfctl_set_limit(struct pfctl *, const char *, unsigned int);
290 int	pfctl_set_logif(struct pfctl *, char *);
291 int	pfctl_set_hostid(struct pfctl *, u_int32_t);
292 int	pfctl_set_debug(struct pfctl *, char *);
293 int	pfctl_set_interface_flags(struct pfctl *, char *, int, int);
294 int	pfctl_cfg_syncookies(struct pfctl *, uint8_t, struct pfctl_watermarks *);
295 
296 int	parse_config(char *, struct pfctl *);
297 int	parse_flags(char *);
298 int	pfctl_load_anchors(int, struct pfctl *, struct pfr_buffer *);
299 
300 void	print_pool(struct pfctl_pool *, u_int16_t, u_int16_t, sa_family_t, int);
301 void	print_src_node(struct pf_src_node *, int);
302 void	print_eth_rule(struct pfctl_eth_rule *, const char *, int);
303 void	print_rule(struct pfctl_rule *, const char *, int, int);
304 void	print_tabledef(const char *, int, int, struct node_tinithead *);
305 void	print_status(struct pfctl_status *, struct pfctl_syncookies *, int);
306 void	print_running(struct pfctl_status *);
307 
308 int	eval_pfaltq(struct pfctl *, struct pf_altq *, struct node_queue_bw *,
309 	    struct node_queue_opt *);
310 int	eval_pfqueue(struct pfctl *, struct pf_altq *, struct node_queue_bw *,
311 	    struct node_queue_opt *);
312 
313 void	 print_altq(const struct pf_altq *, unsigned, struct node_queue_bw *,
314 	    struct node_queue_opt *);
315 void	 print_queue(const struct pf_altq *, unsigned, struct node_queue_bw *,
316 	    int, struct node_queue_opt *);
317 
318 int	pfctl_define_table(char *, int, int, const char *, struct pfr_buffer *,
319 	    u_int32_t);
320 
321 void		 pfctl_clear_fingerprints(int, int);
322 int		 pfctl_file_fingerprints(int, int, const char *);
323 pf_osfp_t	 pfctl_get_fingerprint(const char *);
324 int		 pfctl_load_fingerprints(int, int);
325 char		*pfctl_lookup_fingerprint(pf_osfp_t, char *, size_t);
326 void		 pfctl_show_fingerprints(int);
327 
328 
329 struct icmptypeent {
330 	const char *name;
331 	u_int8_t type;
332 };
333 
334 struct icmpcodeent {
335 	const char *name;
336 	u_int8_t type;
337 	u_int8_t code;
338 };
339 
340 const struct icmptypeent *geticmptypebynumber(u_int8_t, u_int8_t);
341 const struct icmptypeent *geticmptypebyname(char *, u_int8_t);
342 const struct icmpcodeent *geticmpcodebynumber(u_int8_t, u_int8_t, u_int8_t);
343 const struct icmpcodeent *geticmpcodebyname(u_long, char *, u_int8_t);
344 
345 struct pf_timeout {
346 	const char	*name;
347 	int		 timeout;
348 };
349 
350 #define PFCTL_FLAG_FILTER	0x02
351 #define PFCTL_FLAG_NAT		0x04
352 #define PFCTL_FLAG_OPTION	0x08
353 #define PFCTL_FLAG_ALTQ		0x10
354 #define PFCTL_FLAG_TABLE	0x20
355 #define PFCTL_FLAG_ETH		0x40
356 
357 extern const struct pf_timeout pf_timeouts[];
358 
359 void			 set_ipmask(struct node_host *, u_int8_t);
360 int			 check_netmask(struct node_host *, sa_family_t);
361 int			 unmask(struct pf_addr *, sa_family_t);
362 void			 ifa_load(void);
363 int			 get_query_socket(void);
364 struct node_host	*ifa_exists(char *);
365 struct node_host	*ifa_grouplookup(char *ifa_name, int flags);
366 struct node_host	*ifa_lookup(char *, int);
367 struct node_host	*host(const char *);
368 
369 int			 append_addr(struct pfr_buffer *, char *, int);
370 int			 append_addr_host(struct pfr_buffer *,
371 			    struct node_host *, int, int);
372 
373 #endif /* _PFCTL_PARSER_H_ */
374