xref: /freebsd/sys/netinet/ip_fw.h (revision 05c7a37afb48ddd5ee1bd921a5d46fe59cc70b15)
1 /*
2  * Copyright (c) 1993 Daniel Boulet
3  * Copyright (c) 1994 Ugen J.S.Antsilevich
4  *
5  * Redistribution and use in source forms, with and without modification,
6  * are permitted provided that this entire comment appears intact.
7  *
8  * Redistribution in binary form may occur without any restrictions.
9  * Obviously, it would be nice if you gave credit where credit is due
10  * but requiring it would be too onerous.
11  *
12  * This software is provided ``AS IS'' without any warranties of any kind.
13  *
14  *	$Id: ip_fw.h,v 1.17 1996/02/24 13:38:27 phk Exp $
15  */
16 
17 /*
18  * Format of an IP firewall descriptor
19  *
20  * fw_src, fw_dst, fw_smsk, fw_dmsk are always stored in network byte order.
21  * fw_flg and fw_n*p are stored in host byte order (of course).
22  * Port numbers are stored in HOST byte order.
23  */
24 #ifndef _IP_FW_H
25 #define _IP_FW_H
26 
27 struct ip_fw {
28     u_long fw_pcnt,fw_bcnt;		/* Packet and byte counters */
29     struct in_addr fw_src, fw_dst;	/* Source and destination IP addr */
30     struct in_addr fw_smsk, fw_dmsk;	/* Mask for src and dest IP addr */
31     union {
32 	struct in_addr fu_via_ip;
33 	struct {
34 #define FW_IFNLEN	6		/* To keep structure on 2^x boundary */
35 		char  fu_via_name[FW_IFNLEN];
36 		short fu_via_unit;
37 	} fu_via_if;
38     } fu_via_un;
39 #define fw_via_ip	fu_via_un.fu_via_ip
40 #define fw_via_name	fu_via_un.fu_via_if.fu_via_name
41 #define fw_via_unit	fu_via_un.fu_via_if.fu_via_unit
42     u_short fw_number;
43     u_short fw_flg;			/* Flags word */
44     u_short fw_nsp, fw_ndp;             /* N'of src ports and # of dst ports */
45     					/* in ports array (dst ports follow */
46     					/* src ports; max of 10 ports in all; */
47     					/* count of 0 means match all ports) */
48 #define IP_FW_MAX_PORTS	10      	/* A reasonable maximum */
49     u_short fw_pts[IP_FW_MAX_PORTS];    /* Array of port numbers to match */
50     u_char fw_ipopt,fw_ipnopt;		/* IP options set/unset */
51     u_char fw_tcpf,fw_tcpnf;		/* TCP flags sen/unset */
52 };
53 
54 struct ip_fw_chain {
55         LIST_ENTRY(ip_fw_chain) chain;
56         struct ip_fw    *rule;
57 };
58 
59 /*
60  * Values for "flags" field .
61  */
62 
63 #define IP_FW_F_ALL	0x000	/* This is a universal packet rule    */
64 #define IP_FW_F_TCP	0x001	/* This is a TCP packet rule          */
65 #define IP_FW_F_UDP	0x002	/* This is a UDP packet rule          */
66 #define IP_FW_F_ICMP	0x003	/* This is a ICMP packet rule         */
67 #define IP_FW_F_KIND	0x003	/* Mask to isolate rule kind          */
68 
69 #define IP_FW_F_IN	0x004	/* Inbound 			      */
70 #define IP_FW_F_OUT	0x008	/* Outboun 			      */
71 
72 #define IP_FW_F_ACCEPT	0x010	/* This is an accept rule	      */
73 #define IP_FW_F_COUNT	0x020	/* This is an accept rule	      */
74 #define IP_FW_F_PRN	0x040	/* Print if this rule matches	      */
75 #define IP_FW_F_ICMPRPL	0x080	/* Send back icmp unreachable packet  */
76 
77 #define IP_FW_F_SRNG	0x100	/* The first two src ports are a min  *
78 				 * and max range (stored in host byte *
79 				 * order).                            */
80 
81 #define IP_FW_F_DRNG	0x200	/* The first two dst ports are a min  *
82 				 * and max range (stored in host byte *
83 				 * order).                            */
84 
85 #define IP_FW_F_IFNAME	0x400	/* Use interface name/unit (not IP)   */
86 
87 #define IP_FW_F_FRAG	0x800	/* Fragment			      */
88 
89 #define IP_FW_F_MASK	0xFFF	/* All possible flag bits mask        */
90 
91 /*
92  * Definitions for IP option names.
93  */
94 #define IP_FW_IPOPT_LSRR	0x01
95 #define IP_FW_IPOPT_SSRR	0x02
96 #define IP_FW_IPOPT_RR		0x04
97 #define IP_FW_IPOPT_TS		0x08
98 
99 /*
100  * Definitions for TCP flags.
101  */
102 #define IP_FW_TCPF_FIN		TH_FIN
103 #define IP_FW_TCPF_SYN		TH_SYN
104 #define IP_FW_TCPF_RST		TH_RST
105 #define IP_FW_TCPF_PSH		TH_PUSH
106 #define IP_FW_TCPF_ACK		TH_ACK
107 #define IP_FW_TCPF_URG		TH_URG
108 #define IP_FW_TCPF_ESTAB	0x40
109 
110 /*
111  * New IP firewall options for [gs]etsockopt at the RAW IP level.
112  */
113 #define IP_FW_BASE_CTL	50
114 
115 #define IP_FW_ADD     (IP_FW_BASE_CTL+0)
116 #define IP_FW_DEL     (IP_FW_BASE_CTL+1)
117 #define IP_FW_FLUSH   (IP_FW_BASE_CTL+2)
118 #define IP_FW_ZERO    (IP_FW_BASE_CTL+3)
119 #define IP_FW_GET     (IP_FW_BASE_CTL+4)
120 
121 /*
122  * Main firewall chains definitions and global var's definitions.
123  */
124 #ifdef KERNEL
125 
126 /*
127  * Function definitions.
128  */
129 void ip_fw_init(void);
130 
131 #endif /* KERNEL */
132 
133 #endif /* _IP_FW_H */
134