xref: /freebsd/sys/net/if_pfsync.h (revision 59c8e88e72633afbc47a4ace0d2170d00d51f7dc)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2001 Michael Shalayeff
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19  * IN NO EVENT SHALL THE AUTHOR OR HIS RELATIVES BE LIABLE FOR ANY DIRECT,
20  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
21  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
22  * SERVICES; LOSS OF MIND, USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
24  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
25  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
26  * THE POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 /*-
30  * Copyright (c) 2008 David Gwynne <dlg@openbsd.org>
31  *
32  * Permission to use, copy, modify, and distribute this software for any
33  * purpose with or without fee is hereby granted, provided that the above
34  * copyright notice and this permission notice appear in all copies.
35  *
36  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
37  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
38  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
39  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
40  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
41  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
42  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
43  */
44 
45 /*
46  *	$OpenBSD: if_pfsync.h,v 1.35 2008/06/29 08:42:15 mcbride Exp $
47  */
48 
49 #ifndef _NET_IF_PFSYNC_H_
50 #define	_NET_IF_PFSYNC_H_
51 
52 #include <sys/types.h>
53 
54 #include <net/if.h>
55 #include <net/pfvar.h>
56 #include <netpfil/pf/pf.h>
57 
58 #define	PFSYNC_VERSION		5
59 #define	PFSYNC_DFLTTL		255
60 
61 enum pfsync_msg_versions {
62 	PFSYNC_MSG_VERSION_UNSPECIFIED = 0,
63 	PFSYNC_MSG_VERSION_1301 = 1301,
64 	PFSYNC_MSG_VERSION_1400 = 1400,
65 };
66 
67 #define PFSYNC_MSG_VERSION_DEFAULT PFSYNC_MSG_VERSION_1400
68 
69 #define	PFSYNC_ACT_CLR		0	/* clear all states */
70 #define	PFSYNC_ACT_INS_1301	1	/* insert state */
71 #define	PFSYNC_ACT_INS_ACK	2	/* ack of inserted state */
72 #define	PFSYNC_ACT_UPD_1301	3	/* update state */
73 #define	PFSYNC_ACT_UPD_C	4	/* "compressed" update state */
74 #define	PFSYNC_ACT_UPD_REQ	5	/* request "uncompressed" state */
75 #define	PFSYNC_ACT_DEL		6	/* delete state */
76 #define	PFSYNC_ACT_DEL_C	7	/* "compressed" delete state */
77 #define	PFSYNC_ACT_INS_F	8	/* insert fragment */
78 #define	PFSYNC_ACT_DEL_F	9	/* delete fragments */
79 #define	PFSYNC_ACT_BUS		10	/* bulk update status */
80 #define	PFSYNC_ACT_TDB		11	/* TDB replay counter update */
81 #define	PFSYNC_ACT_EOF		12	/* end of frame */
82 #define PFSYNC_ACT_INS_1400	13	/* insert state */
83 #define PFSYNC_ACT_UPD_1400	14	/* update state */
84 #define	PFSYNC_ACT_MAX		15
85 
86 /*
87  * A pfsync frame is built from a header followed by several sections which
88  * are all prefixed with their own subheaders. Frames must be terminated with
89  * an EOF subheader.
90  *
91  * | ...			|
92  * | IP header			|
93  * +============================+
94  * | pfsync_header		|
95  * +----------------------------+
96  * | pfsync_subheader		|
97  * +----------------------------+
98  * | first action fields	|
99  * | ...			|
100  * +----------------------------+
101  * | pfsync_subheader		|
102  * +----------------------------+
103  * | second action fields	|
104  * | ...			|
105  * +----------------------------+
106  * | EOF pfsync_subheader	|
107  * +----------------------------+
108  * | HMAC			|
109  * +============================+
110  */
111 
112 /*
113  * Frame header
114  */
115 
116 struct pfsync_header {
117 	u_int8_t			version;
118 	u_int8_t			_pad;
119 	u_int16_t			len;
120 	u_int8_t			pfcksum[PF_MD5_DIGEST_LENGTH];
121 } __packed;
122 
123 /*
124  * Frame region subheader
125  */
126 
127 struct pfsync_subheader {
128 	u_int8_t			action;
129 	u_int8_t			_pad;
130 	u_int16_t			count;
131 } __packed;
132 
133 /*
134  * CLR
135  */
136 
137 struct pfsync_clr {
138 	char				ifname[IFNAMSIZ];
139 	u_int32_t			creatorid;
140 } __packed;
141 
142 /*
143  * INS, UPD, DEL
144  */
145 
146 /* these use struct pfsync_state in pfvar.h */
147 
148 /*
149  * INS_ACK
150  */
151 
152 struct pfsync_ins_ack {
153 	u_int64_t			id;
154 	u_int32_t			creatorid;
155 } __packed;
156 
157 /*
158  * UPD_C
159  */
160 
161 struct pfsync_upd_c {
162 	u_int64_t			id;
163 	struct pfsync_state_peer	src;
164 	struct pfsync_state_peer	dst;
165 	u_int32_t			creatorid;
166 	u_int32_t			expire;
167 	u_int8_t			timeout;
168 	u_int8_t			_pad[3];
169 } __packed;
170 
171 /*
172  * UPD_REQ
173  */
174 
175 struct pfsync_upd_req {
176 	u_int64_t			id;
177 	u_int32_t			creatorid;
178 } __packed;
179 
180 /*
181  * DEL_C
182  */
183 
184 struct pfsync_del_c {
185 	u_int64_t			id;
186 	u_int32_t			creatorid;
187 } __packed;
188 
189 /*
190  * INS_F, DEL_F
191  */
192 
193 /* not implemented (yet) */
194 
195 /*
196  * BUS
197  */
198 
199 struct pfsync_bus {
200 	u_int32_t			creatorid;
201 	u_int32_t			endtime;
202 	u_int8_t			status;
203 #define	PFSYNC_BUS_START			1
204 #define	PFSYNC_BUS_END				2
205 	u_int8_t			_pad[3];
206 } __packed;
207 
208 /*
209  * TDB
210  */
211 
212 struct pfsync_tdb {
213 	u_int32_t			spi;
214 	union sockaddr_union		dst;
215 	u_int32_t			rpl;
216 	u_int64_t			cur_bytes;
217 	u_int8_t			sproto;
218 	u_int8_t			updates;
219 	u_int8_t			_pad[2];
220 } __packed;
221 
222 #define	PFSYNC_HDRLEN		sizeof(struct pfsync_header)
223 
224 struct pfsyncstats {
225 	u_int64_t	pfsyncs_ipackets;	/* total input packets, IPv4 */
226 	u_int64_t	pfsyncs_ipackets6;	/* total input packets, IPv6 */
227 	u_int64_t	pfsyncs_badif;		/* not the right interface */
228 	u_int64_t	pfsyncs_badttl;		/* TTL is not PFSYNC_DFLTTL */
229 	u_int64_t	pfsyncs_hdrops;		/* packets shorter than hdr */
230 	u_int64_t	pfsyncs_badver;		/* bad (incl unsupp) version */
231 	u_int64_t	pfsyncs_badact;		/* bad action */
232 	u_int64_t	pfsyncs_badlen;		/* data length does not match */
233 	u_int64_t	pfsyncs_badauth;	/* bad authentication */
234 	u_int64_t	pfsyncs_stale;		/* stale state */
235 	u_int64_t	pfsyncs_badval;		/* bad values */
236 	u_int64_t	pfsyncs_badstate;	/* insert/lookup failed */
237 
238 	u_int64_t	pfsyncs_opackets;	/* total output packets, IPv4 */
239 	u_int64_t	pfsyncs_opackets6;	/* total output packets, IPv6 */
240 	u_int64_t	pfsyncs_onomem;		/* no memory for an mbuf */
241 	u_int64_t	pfsyncs_oerrors;	/* ip output error */
242 
243 	u_int64_t	pfsyncs_iacts[PFSYNC_ACT_MAX];
244 	u_int64_t	pfsyncs_oacts[PFSYNC_ACT_MAX];
245 };
246 
247 /*
248  * Configuration structure for SIOCSETPFSYNC SIOCGETPFSYNC
249  */
250 struct pfsyncreq {
251 	char		 pfsyncr_syncdev[IFNAMSIZ];
252 	struct in_addr	 pfsyncr_syncpeer;
253 	int		 pfsyncr_maxupdates;
254 #define	PFSYNCF_OK		0x00000001
255 #define	PFSYNCF_DEFER		0x00000002
256 	int		 pfsyncr_defer;
257 };
258 
259 struct pfsync_kstatus {
260 	char		 	syncdev[IFNAMSIZ];
261 	struct sockaddr_storage	syncpeer;
262 	int		 	maxupdates;
263 	int			version;
264 	int		 	flags;
265 };
266 
267 struct pfsyncioc_nv {
268 	void            *data;
269 	size_t           len;   /* The length of the nvlist data. */
270 	size_t           size;  /* The total size of the data buffer. */
271 };
272 
273 #define	SIOCSETPFSYNC   _IOW('i', 247, struct ifreq)
274 #define	SIOCGETPFSYNC   _IOWR('i', 248, struct ifreq)
275 #define	SIOCSETPFSYNCNV _IOW('i', 249, struct ifreq)
276 #define	SIOCGETPFSYNCNV _IOWR('i', 250, struct ifreq)
277 
278 #ifdef _KERNEL
279 
280 /*
281  * this shows where a pf state is with respect to the syncing.
282  * pf_kstate->sync_state
283  */
284 #define	PFSYNC_S_INS	0x00
285 #define	PFSYNC_S_IACK	0x01
286 #define	PFSYNC_S_UPD	0x02
287 #define	PFSYNC_S_UPD_C	0x03
288 #define	PFSYNC_S_DEL_C	0x04
289 
290 #define	PFSYNC_S_DEFER	0xfe
291 #define	PFSYNC_S_NONE	0xff
292 
293 #define	PFSYNC_SI_IOCTL		0x01
294 #define	PFSYNC_SI_CKSUM		0x02
295 #define	PFSYNC_SI_ACK		0x04
296 
297 #endif /* _KERNEL */
298 
299 #endif /* _NET_IF_PFSYNC_H_ */
300