1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2001 Michael Shalayeff 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 19 * IN NO EVENT SHALL THE AUTHOR OR HIS RELATIVES BE LIABLE FOR ANY DIRECT, 20 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 21 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 22 * SERVICES; LOSS OF MIND, USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 24 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 25 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF 26 * THE POSSIBILITY OF SUCH DAMAGE. 27 */ 28 29 /*- 30 * Copyright (c) 2008 David Gwynne <dlg@openbsd.org> 31 * 32 * Permission to use, copy, modify, and distribute this software for any 33 * purpose with or without fee is hereby granted, provided that the above 34 * copyright notice and this permission notice appear in all copies. 35 * 36 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 37 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 38 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 39 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 40 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 41 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 42 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 43 */ 44 45 /* 46 * $OpenBSD: if_pfsync.h,v 1.35 2008/06/29 08:42:15 mcbride Exp $ 47 * $FreeBSD$ 48 */ 49 50 #ifndef _NET_IF_PFSYNC_H_ 51 #define _NET_IF_PFSYNC_H_ 52 53 #include <sys/types.h> 54 55 #include <net/if.h> 56 #include <net/pfvar.h> 57 #include <netpfil/pf/pf.h> 58 59 #define PFSYNC_VERSION 5 60 #define PFSYNC_DFLTTL 255 61 62 enum pfsync_msg_versions { 63 PFSYNC_MSG_VERSION_UNSPECIFIED = 0, 64 PFSYNC_MSG_VERSION_1301 = 1301, 65 PFSYNC_MSG_VERSION_1400 = 1400, 66 }; 67 68 #define PFSYNC_MSG_VERSION_DEFAULT PFSYNC_MSG_VERSION_1400 69 70 #define PFSYNC_ACT_CLR 0 /* clear all states */ 71 #define PFSYNC_ACT_INS_1301 1 /* insert state */ 72 #define PFSYNC_ACT_INS_ACK 2 /* ack of inserted state */ 73 #define PFSYNC_ACT_UPD_1301 3 /* update state */ 74 #define PFSYNC_ACT_UPD_C 4 /* "compressed" update state */ 75 #define PFSYNC_ACT_UPD_REQ 5 /* request "uncompressed" state */ 76 #define PFSYNC_ACT_DEL 6 /* delete state */ 77 #define PFSYNC_ACT_DEL_C 7 /* "compressed" delete state */ 78 #define PFSYNC_ACT_INS_F 8 /* insert fragment */ 79 #define PFSYNC_ACT_DEL_F 9 /* delete fragments */ 80 #define PFSYNC_ACT_BUS 10 /* bulk update status */ 81 #define PFSYNC_ACT_TDB 11 /* TDB replay counter update */ 82 #define PFSYNC_ACT_EOF 12 /* end of frame */ 83 #define PFSYNC_ACT_INS_1400 13 /* insert state */ 84 #define PFSYNC_ACT_UPD_1400 14 /* update state */ 85 #define PFSYNC_ACT_MAX 15 86 87 /* 88 * A pfsync frame is built from a header followed by several sections which 89 * are all prefixed with their own subheaders. Frames must be terminated with 90 * an EOF subheader. 91 * 92 * | ... | 93 * | IP header | 94 * +============================+ 95 * | pfsync_header | 96 * +----------------------------+ 97 * | pfsync_subheader | 98 * +----------------------------+ 99 * | first action fields | 100 * | ... | 101 * +----------------------------+ 102 * | pfsync_subheader | 103 * +----------------------------+ 104 * | second action fields | 105 * | ... | 106 * +----------------------------+ 107 * | EOF pfsync_subheader | 108 * +----------------------------+ 109 * | HMAC | 110 * +============================+ 111 */ 112 113 /* 114 * Frame header 115 */ 116 117 struct pfsync_header { 118 u_int8_t version; 119 u_int8_t _pad; 120 u_int16_t len; 121 u_int8_t pfcksum[PF_MD5_DIGEST_LENGTH]; 122 } __packed; 123 124 /* 125 * Frame region subheader 126 */ 127 128 struct pfsync_subheader { 129 u_int8_t action; 130 u_int8_t _pad; 131 u_int16_t count; 132 } __packed; 133 134 /* 135 * CLR 136 */ 137 138 struct pfsync_clr { 139 char ifname[IFNAMSIZ]; 140 u_int32_t creatorid; 141 } __packed; 142 143 /* 144 * INS, UPD, DEL 145 */ 146 147 /* these use struct pfsync_state in pfvar.h */ 148 149 /* 150 * INS_ACK 151 */ 152 153 struct pfsync_ins_ack { 154 u_int64_t id; 155 u_int32_t creatorid; 156 } __packed; 157 158 /* 159 * UPD_C 160 */ 161 162 struct pfsync_upd_c { 163 u_int64_t id; 164 struct pfsync_state_peer src; 165 struct pfsync_state_peer dst; 166 u_int32_t creatorid; 167 u_int32_t expire; 168 u_int8_t timeout; 169 u_int8_t _pad[3]; 170 } __packed; 171 172 /* 173 * UPD_REQ 174 */ 175 176 struct pfsync_upd_req { 177 u_int64_t id; 178 u_int32_t creatorid; 179 } __packed; 180 181 /* 182 * DEL_C 183 */ 184 185 struct pfsync_del_c { 186 u_int64_t id; 187 u_int32_t creatorid; 188 } __packed; 189 190 /* 191 * INS_F, DEL_F 192 */ 193 194 /* not implemented (yet) */ 195 196 /* 197 * BUS 198 */ 199 200 struct pfsync_bus { 201 u_int32_t creatorid; 202 u_int32_t endtime; 203 u_int8_t status; 204 #define PFSYNC_BUS_START 1 205 #define PFSYNC_BUS_END 2 206 u_int8_t _pad[3]; 207 } __packed; 208 209 /* 210 * TDB 211 */ 212 213 struct pfsync_tdb { 214 u_int32_t spi; 215 union sockaddr_union dst; 216 u_int32_t rpl; 217 u_int64_t cur_bytes; 218 u_int8_t sproto; 219 u_int8_t updates; 220 u_int8_t _pad[2]; 221 } __packed; 222 223 #define PFSYNC_HDRLEN sizeof(struct pfsync_header) 224 225 struct pfsyncstats { 226 u_int64_t pfsyncs_ipackets; /* total input packets, IPv4 */ 227 u_int64_t pfsyncs_ipackets6; /* total input packets, IPv6 */ 228 u_int64_t pfsyncs_badif; /* not the right interface */ 229 u_int64_t pfsyncs_badttl; /* TTL is not PFSYNC_DFLTTL */ 230 u_int64_t pfsyncs_hdrops; /* packets shorter than hdr */ 231 u_int64_t pfsyncs_badver; /* bad (incl unsupp) version */ 232 u_int64_t pfsyncs_badact; /* bad action */ 233 u_int64_t pfsyncs_badlen; /* data length does not match */ 234 u_int64_t pfsyncs_badauth; /* bad authentication */ 235 u_int64_t pfsyncs_stale; /* stale state */ 236 u_int64_t pfsyncs_badval; /* bad values */ 237 u_int64_t pfsyncs_badstate; /* insert/lookup failed */ 238 239 u_int64_t pfsyncs_opackets; /* total output packets, IPv4 */ 240 u_int64_t pfsyncs_opackets6; /* total output packets, IPv6 */ 241 u_int64_t pfsyncs_onomem; /* no memory for an mbuf */ 242 u_int64_t pfsyncs_oerrors; /* ip output error */ 243 244 u_int64_t pfsyncs_iacts[PFSYNC_ACT_MAX]; 245 u_int64_t pfsyncs_oacts[PFSYNC_ACT_MAX]; 246 }; 247 248 /* 249 * Configuration structure for SIOCSETPFSYNC SIOCGETPFSYNC 250 */ 251 struct pfsyncreq { 252 char pfsyncr_syncdev[IFNAMSIZ]; 253 struct in_addr pfsyncr_syncpeer; 254 int pfsyncr_maxupdates; 255 #define PFSYNCF_OK 0x00000001 256 #define PFSYNCF_DEFER 0x00000002 257 int pfsyncr_defer; 258 }; 259 260 struct pfsync_kstatus { 261 char syncdev[IFNAMSIZ]; 262 struct sockaddr_storage syncpeer; 263 int maxupdates; 264 int version; 265 int flags; 266 }; 267 268 struct pfsyncioc_nv { 269 void *data; 270 size_t len; /* The length of the nvlist data. */ 271 size_t size; /* The total size of the data buffer. */ 272 }; 273 274 #define SIOCSETPFSYNC _IOW('i', 247, struct ifreq) 275 #define SIOCGETPFSYNC _IOWR('i', 248, struct ifreq) 276 #define SIOCSETPFSYNCNV _IOW('i', 249, struct ifreq) 277 #define SIOCGETPFSYNCNV _IOWR('i', 250, struct ifreq) 278 279 #ifdef _KERNEL 280 281 /* 282 * this shows where a pf state is with respect to the syncing. 283 * pf_kstate->sync_state 284 */ 285 #define PFSYNC_S_INS 0x00 286 #define PFSYNC_S_IACK 0x01 287 #define PFSYNC_S_UPD 0x02 288 #define PFSYNC_S_UPD_C 0x03 289 #define PFSYNC_S_DEL_C 0x04 290 291 #define PFSYNC_S_DEFER 0xfe 292 #define PFSYNC_S_NONE 0xff 293 294 #define PFSYNC_SI_IOCTL 0x01 295 #define PFSYNC_SI_CKSUM 0x02 296 #define PFSYNC_SI_ACK 0x04 297 298 #endif /* _KERNEL */ 299 300 #endif /* _NET_IF_PFSYNC_H_ */ 301