1 /* $NetBSD: pfil.h,v 1.22 2003/06/23 12:57:08 martin Exp $ */ 2 3 /*- 4 * SPDX-License-Identifier: BSD-3-Clause 5 * 6 * Copyright (c) 2019 Gleb Smirnoff <glebius@FreeBSD.org> 7 * Copyright (c) 1996 Matthew R. Green 8 * All rights reserved. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 3. The name of the author may not be used to endorse or promote products 19 * derived from this software without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 22 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 23 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 24 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 26 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 27 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 28 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 29 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 #ifndef _NET_PFIL_H_ 35 #define _NET_PFIL_H_ 36 37 #include <sys/ioccom.h> 38 39 enum pfil_types { 40 PFIL_TYPE_IP4, 41 PFIL_TYPE_IP6, 42 PFIL_TYPE_ETHERNET, 43 }; 44 45 #define MAXPFILNAME 64 46 47 struct pfilioc_head { 48 char pio_name[MAXPFILNAME]; 49 int pio_nhooksin; 50 int pio_nhooksout; 51 enum pfil_types pio_type; 52 }; 53 54 struct pfilioc_hook { 55 char pio_module[MAXPFILNAME]; 56 char pio_ruleset[MAXPFILNAME]; 57 int pio_flags; 58 enum pfil_types pio_type; 59 }; 60 61 struct pfilioc_list { 62 u_int pio_nheads; 63 u_int pio_nhooks; 64 struct pfilioc_head *pio_heads; 65 struct pfilioc_hook *pio_hooks; 66 }; 67 68 struct pfilioc_link { 69 char pio_name[MAXPFILNAME]; 70 char pio_module[MAXPFILNAME]; 71 char pio_ruleset[MAXPFILNAME]; 72 int pio_flags; 73 }; 74 75 #define PFILDEV "pfil" 76 #define PFILIOC_LISTHEADS _IOWR('P', 1, struct pfilioc_list) 77 #define PFILIOC_LISTHOOKS _IOWR('P', 2, struct pfilioc_list) 78 #define PFILIOC_LINK _IOW('P', 3, struct pfilioc_link) 79 80 #define PFIL_IN 0x00010000 81 #define PFIL_OUT 0x00020000 82 #define PFIL_FWD 0x00040000 83 #define PFIL_DIR(f) ((f) & (PFIL_IN|PFIL_OUT)) 84 #define PFIL_HEADPTR 0x00100000 85 #define PFIL_HOOKPTR 0x00200000 86 #define PFIL_APPEND 0x00400000 87 #define PFIL_UNLINK 0x00800000 88 89 #ifdef _KERNEL 90 struct mbuf; 91 struct ifnet; 92 struct inpcb; 93 94 typedef enum { 95 PFIL_PASS = 0, 96 PFIL_DROPPED, 97 PFIL_CONSUMED, 98 PFIL_REALLOCED, 99 } pfil_return_t; 100 101 typedef pfil_return_t (*pfil_mbuf_chk_t)(struct mbuf **, struct ifnet *, int, 102 void *, struct inpcb *); 103 typedef pfil_return_t (*pfil_mem_chk_t)(void *, u_int, int, struct ifnet *, 104 void *, struct mbuf **); 105 106 /* 107 * A pfil head is created by a packet intercept point. 108 * 109 * A pfil hook is created by a packet filter. 110 * 111 * Hooks are chained on heads. Historically some hooking happens 112 * automatically, e.g. ipfw(4), pf(4) and ipfilter(4) would register 113 * theirselves on IPv4 and IPv6 input/output. 114 */ 115 116 typedef struct pfil_hook * pfil_hook_t; 117 typedef struct pfil_head * pfil_head_t; 118 119 /* 120 * Give us a chance to modify pfil_xxx_args structures in future. 121 */ 122 #define PFIL_VERSION 2 123 124 /* Argument structure used by packet filters to register themselves. */ 125 struct pfil_hook_args { 126 int pa_version; 127 int pa_flags; 128 enum pfil_types pa_type; 129 pfil_mbuf_chk_t pa_mbuf_chk; 130 pfil_mem_chk_t pa_mem_chk; 131 void *pa_ruleset; 132 const char *pa_modname; 133 const char *pa_rulname; 134 }; 135 136 /* Public functions for pfil hook management by packet filters. */ 137 pfil_hook_t pfil_add_hook(struct pfil_hook_args *); 138 void pfil_remove_hook(pfil_hook_t); 139 140 /* Argument structure used by ioctl() and packet filters to set filters. */ 141 struct pfil_link_args { 142 int pa_version; 143 int pa_flags; 144 union { 145 const char *pa_headname; 146 pfil_head_t pa_head; 147 }; 148 union { 149 struct { 150 const char *pa_modname; 151 const char *pa_rulname; 152 }; 153 pfil_hook_t pa_hook; 154 }; 155 }; 156 157 /* Public function to configure filter chains. Used by ioctl() and filters. */ 158 int pfil_link(struct pfil_link_args *); 159 160 /* Argument structure used by inspection points to register themselves. */ 161 struct pfil_head_args { 162 int pa_version; 163 int pa_flags; 164 enum pfil_types pa_type; 165 const char *pa_headname; 166 }; 167 168 /* Public functions for pfil head management by inspection points. */ 169 pfil_head_t pfil_head_register(struct pfil_head_args *); 170 void pfil_head_unregister(pfil_head_t); 171 172 /* Public functions to run the packet inspection by inspection points. */ 173 int pfil_mem_in(struct pfil_head *, void *, u_int, struct ifnet *, 174 struct mbuf **); 175 int pfil_mem_out(struct pfil_head *, void *, u_int, struct ifnet *, 176 struct mbuf **); 177 int pfil_mbuf_in(struct pfil_head *, struct mbuf **, struct ifnet *, 178 struct inpcb *inp); 179 int pfil_mbuf_out(struct pfil_head *, struct mbuf **, struct ifnet *, 180 struct inpcb *inp); 181 int pfil_mbuf_fwd(struct pfil_head *, struct mbuf **, struct ifnet *, 182 struct inpcb *); 183 184 /* 185 * Minimally exposed structure to avoid function call in case of absence 186 * of any filters by protocols and macros to do the check. 187 */ 188 struct _pfil_head { 189 int head_nhooksin; 190 int head_nhooksout; 191 }; 192 #define PFIL_HOOKED_IN(p) (((struct _pfil_head *)(p))->head_nhooksin > 0) 193 #define PFIL_HOOKED_OUT(p) (((struct _pfil_head *)(p))->head_nhooksout > 0) 194 195 #endif /* _KERNEL */ 196 #endif /* _NET_PFIL_H_ */ 197