xref: /freebsd/sys/netinet/ip_fw.h (revision 11b249f99e4d4891bd2a21ef796d40073ee15508)
1 /*-
2  * Copyright (c) 2002-2009 Luigi Rizzo, Universita` di Pisa
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  * 1. Redistributions of source code must retain the above copyright
8  *    notice, this list of conditions and the following disclaimer.
9  * 2. Redistributions in binary form must reproduce the above copyright
10  *    notice, this list of conditions and the following disclaimer in the
11  *    documentation and/or other materials provided with the distribution.
12  *
13  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
14  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
16  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
17  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
18  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
19  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
20  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
21  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
22  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
23  * SUCH DAMAGE.
24  *
25  * $FreeBSD$
26  */
27 
28 #ifndef _IPFW2_H
29 #define _IPFW2_H
30 
31 /*
32  * The default rule number.  By the design of ip_fw, the default rule
33  * is the last one, so its number can also serve as the highest number
34  * allowed for a rule.  The ip_fw code relies on both meanings of this
35  * constant.
36  */
37 #define	IPFW_DEFAULT_RULE	65535
38 
39 #define	RESVD_SET		31	/*set for default and persistent rules*/
40 #define	IPFW_MAX_SETS		32	/* Number of sets supported by ipfw*/
41 
42 /*
43  * Compat values for old clients
44  */
45 #ifndef	_KERNEL
46 #define	IPFW_TABLES_MAX		65535
47 #define	IPFW_TABLES_DEFAULT	128
48 #endif
49 
50 /*
51  * Most commands (queue, pipe, tag, untag, limit...) can have a 16-bit
52  * argument between 1 and 65534. The value 0 (IP_FW_TARG) is used
53  * to represent 'tablearg' value, e.g.  indicate the use of a 'tablearg'
54  * result of the most recent table() lookup.
55  * Note that 16bit is only a historical limit, resulting from
56  * the use of a 16-bit fields for that value. In reality, we can have
57  * 2^32 pipes, queues, tag values and so on.
58  */
59 #define	IPFW_ARG_MIN		1
60 #define	IPFW_ARG_MAX		65534
61 #define IP_FW_TABLEARG		65535	/* Compat value for old clients */
62 #define	IP_FW_TARG		0	/* Current tablearg value */
63 
64 /*
65  * Number of entries in the call stack of the call/return commands.
66  * Call stack currently is an uint16_t array with rule numbers.
67  */
68 #define	IPFW_CALLSTACK_SIZE	16
69 
70 /* IP_FW3 header/opcodes */
71 typedef struct _ip_fw3_opheader {
72 	uint16_t opcode;	/* Operation opcode */
73 	uint16_t version;	/* Opcode version */
74 	uint16_t reserved[2];	/* Align to 64-bit boundary */
75 } ip_fw3_opheader;
76 
77 /* IP_FW3 opcodes */
78 #define	IP_FW_TABLE_XADD	86	/* add entry */
79 #define	IP_FW_TABLE_XDEL	87	/* delete entry */
80 #define	IP_FW_TABLE_XGETSIZE	88	/* get table size (deprecated) */
81 #define	IP_FW_TABLE_XLIST	89	/* list table contents */
82 #define	IP_FW_TABLE_XDESTROY	90	/* destroy table */
83 #define	IP_FW_TABLES_XLIST	92	/* list all tables  */
84 #define	IP_FW_TABLE_XINFO	93	/* request info for one table */
85 #define	IP_FW_TABLE_XFLUSH	94	/* flush table data */
86 #define	IP_FW_TABLE_XCREATE	95	/* create new table  */
87 #define	IP_FW_TABLE_XMODIFY	96	/* modify existing table */
88 #define	IP_FW_XGET		97	/* Retrieve configuration */
89 #define	IP_FW_XADD		98	/* add rule */
90 #define	IP_FW_XDEL		99	/* del rule */
91 #define	IP_FW_XMOVE		100	/* move rules to different set  */
92 #define	IP_FW_XZERO		101	/* clear accounting */
93 #define	IP_FW_XRESETLOG		102	/* zero rules logs */
94 #define	IP_FW_SET_SWAP		103	/* Swap between 2 sets */
95 #define	IP_FW_SET_MOVE		104	/* Move one set to another one */
96 #define	IP_FW_SET_ENABLE	105	/* Enable/disable sets */
97 #define	IP_FW_TABLE_XFIND	106	/* finds an entry */
98 #define	IP_FW_XIFLIST		107	/* list tracked interfaces */
99 #define	IP_FW_TABLES_ALIST	108	/* list table algorithms */
100 #define	IP_FW_TABLE_XSWAP	109	/* swap two tables */
101 #define	IP_FW_TABLE_VLIST	110	/* dump table value hash */
102 
103 #define	IP_FW_NAT44_XCONFIG	111	/* Create/modify NAT44 instance */
104 #define	IP_FW_NAT44_DESTROY	112	/* Destroys NAT44 instance */
105 #define	IP_FW_NAT44_XGETCONFIG	113	/* Get NAT44 instance config */
106 #define	IP_FW_NAT44_LIST_NAT	114	/* List all NAT44 instances */
107 #define	IP_FW_NAT44_XGETLOG	115	/* Get log from NAT44 instance */
108 
109 #define	IP_FW_DUMP_SOPTCODES	116	/* Dump available sopts/versions */
110 #define	IP_FW_DUMP_SRVOBJECTS	117	/* Dump existing named objects */
111 
112 /*
113  * The kernel representation of ipfw rules is made of a list of
114  * 'instructions' (for all practical purposes equivalent to BPF
115  * instructions), which specify which fields of the packet
116  * (or its metadata) should be analysed.
117  *
118  * Each instruction is stored in a structure which begins with
119  * "ipfw_insn", and can contain extra fields depending on the
120  * instruction type (listed below).
121  * Note that the code is written so that individual instructions
122  * have a size which is a multiple of 32 bits. This means that, if
123  * such structures contain pointers or other 64-bit entities,
124  * (there is just one instance now) they may end up unaligned on
125  * 64-bit architectures, so the must be handled with care.
126  *
127  * "enum ipfw_opcodes" are the opcodes supported. We can have up
128  * to 256 different opcodes. When adding new opcodes, they should
129  * be appended to the end of the opcode list before O_LAST_OPCODE,
130  * this will prevent the ABI from being broken, otherwise users
131  * will have to recompile ipfw(8) when they update the kernel.
132  */
133 
134 enum ipfw_opcodes {		/* arguments (4 byte each)	*/
135 	O_NOP,
136 
137 	O_IP_SRC,		/* u32 = IP			*/
138 	O_IP_SRC_MASK,		/* ip = IP/mask			*/
139 	O_IP_SRC_ME,		/* none				*/
140 	O_IP_SRC_SET,		/* u32=base, arg1=len, bitmap	*/
141 
142 	O_IP_DST,		/* u32 = IP			*/
143 	O_IP_DST_MASK,		/* ip = IP/mask			*/
144 	O_IP_DST_ME,		/* none				*/
145 	O_IP_DST_SET,		/* u32=base, arg1=len, bitmap	*/
146 
147 	O_IP_SRCPORT,		/* (n)port list:mask 4 byte ea	*/
148 	O_IP_DSTPORT,		/* (n)port list:mask 4 byte ea	*/
149 	O_PROTO,		/* arg1=protocol		*/
150 
151 	O_MACADDR2,		/* 2 mac addr:mask		*/
152 	O_MAC_TYPE,		/* same as srcport		*/
153 
154 	O_LAYER2,		/* none				*/
155 	O_IN,			/* none				*/
156 	O_FRAG,			/* none				*/
157 
158 	O_RECV,			/* none				*/
159 	O_XMIT,			/* none				*/
160 	O_VIA,			/* none				*/
161 
162 	O_IPOPT,		/* arg1 = 2*u8 bitmap		*/
163 	O_IPLEN,		/* arg1 = len			*/
164 	O_IPID,			/* arg1 = id			*/
165 
166 	O_IPTOS,		/* arg1 = id			*/
167 	O_IPPRECEDENCE,		/* arg1 = precedence << 5	*/
168 	O_IPTTL,		/* arg1 = TTL			*/
169 
170 	O_IPVER,		/* arg1 = version		*/
171 	O_UID,			/* u32 = id			*/
172 	O_GID,			/* u32 = id			*/
173 	O_ESTAB,		/* none (tcp established)	*/
174 	O_TCPFLAGS,		/* arg1 = 2*u8 bitmap		*/
175 	O_TCPWIN,		/* arg1 = desired win		*/
176 	O_TCPSEQ,		/* u32 = desired seq.		*/
177 	O_TCPACK,		/* u32 = desired seq.		*/
178 	O_ICMPTYPE,		/* u32 = icmp bitmap		*/
179 	O_TCPOPTS,		/* arg1 = 2*u8 bitmap		*/
180 
181 	O_VERREVPATH,		/* none				*/
182 	O_VERSRCREACH,		/* none				*/
183 
184 	O_PROBE_STATE,		/* none				*/
185 	O_KEEP_STATE,		/* none				*/
186 	O_LIMIT,		/* ipfw_insn_limit		*/
187 	O_LIMIT_PARENT,		/* dyn_type, not an opcode.	*/
188 
189 	/*
190 	 * These are really 'actions'.
191 	 */
192 
193 	O_LOG,			/* ipfw_insn_log		*/
194 	O_PROB,			/* u32 = match probability	*/
195 
196 	O_CHECK_STATE,		/* none				*/
197 	O_ACCEPT,		/* none				*/
198 	O_DENY,			/* none 			*/
199 	O_REJECT,		/* arg1=icmp arg (same as deny)	*/
200 	O_COUNT,		/* none				*/
201 	O_SKIPTO,		/* arg1=next rule number	*/
202 	O_PIPE,			/* arg1=pipe number		*/
203 	O_QUEUE,		/* arg1=queue number		*/
204 	O_DIVERT,		/* arg1=port number		*/
205 	O_TEE,			/* arg1=port number		*/
206 	O_FORWARD_IP,		/* fwd sockaddr			*/
207 	O_FORWARD_MAC,		/* fwd mac			*/
208 	O_NAT,                  /* nope                         */
209 	O_REASS,                /* none                         */
210 
211 	/*
212 	 * More opcodes.
213 	 */
214 	O_IPSEC,		/* has ipsec history 		*/
215 	O_IP_SRC_LOOKUP,	/* arg1=table number, u32=value	*/
216 	O_IP_DST_LOOKUP,	/* arg1=table number, u32=value	*/
217 	O_ANTISPOOF,		/* none				*/
218 	O_JAIL,			/* u32 = id			*/
219 	O_ALTQ,			/* u32 = altq classif. qid	*/
220 	O_DIVERTED,		/* arg1=bitmap (1:loop, 2:out)	*/
221 	O_TCPDATALEN,		/* arg1 = tcp data len		*/
222 	O_IP6_SRC,		/* address without mask		*/
223 	O_IP6_SRC_ME,		/* my addresses			*/
224 	O_IP6_SRC_MASK,		/* address with the mask	*/
225 	O_IP6_DST,
226 	O_IP6_DST_ME,
227 	O_IP6_DST_MASK,
228 	O_FLOW6ID,		/* for flow id tag in the ipv6 pkt */
229 	O_ICMP6TYPE,		/* icmp6 packet type filtering	*/
230 	O_EXT_HDR,		/* filtering for ipv6 extension header */
231 	O_IP6,
232 
233 	/*
234 	 * actions for ng_ipfw
235 	 */
236 	O_NETGRAPH,		/* send to ng_ipfw		*/
237 	O_NGTEE,		/* copy to ng_ipfw		*/
238 
239 	O_IP4,
240 
241 	O_UNREACH6,		/* arg1=icmpv6 code arg (deny)  */
242 
243 	O_TAG,   		/* arg1=tag number */
244 	O_TAGGED,		/* arg1=tag number */
245 
246 	O_SETFIB,		/* arg1=FIB number */
247 	O_FIB,			/* arg1=FIB desired fib number */
248 
249 	O_SOCKARG,		/* socket argument */
250 
251 	O_CALLRETURN,		/* arg1=called rule number */
252 
253 	O_FORWARD_IP6,		/* fwd sockaddr_in6             */
254 
255 	O_DSCP,			/* 2 u32 = DSCP mask */
256 	O_SETDSCP,		/* arg1=DSCP value */
257 	O_IP_FLOW_LOOKUP,	/* arg1=table number, u32=value	*/
258 
259 	O_LAST_OPCODE		/* not an opcode!		*/
260 };
261 
262 
263 /*
264  * The extension header are filtered only for presence using a bit
265  * vector with a flag for each header.
266  */
267 #define EXT_FRAGMENT	0x1
268 #define EXT_HOPOPTS	0x2
269 #define EXT_ROUTING	0x4
270 #define EXT_AH		0x8
271 #define EXT_ESP		0x10
272 #define EXT_DSTOPTS	0x20
273 #define EXT_RTHDR0		0x40
274 #define EXT_RTHDR2		0x80
275 
276 /*
277  * Template for instructions.
278  *
279  * ipfw_insn is used for all instructions which require no operands,
280  * a single 16-bit value (arg1), or a couple of 8-bit values.
281  *
282  * For other instructions which require different/larger arguments
283  * we have derived structures, ipfw_insn_*.
284  *
285  * The size of the instruction (in 32-bit words) is in the low
286  * 6 bits of "len". The 2 remaining bits are used to implement
287  * NOT and OR on individual instructions. Given a type, you can
288  * compute the length to be put in "len" using F_INSN_SIZE(t)
289  *
290  * F_NOT	negates the match result of the instruction.
291  *
292  * F_OR		is used to build or blocks. By default, instructions
293  *		are evaluated as part of a logical AND. An "or" block
294  *		{ X or Y or Z } contains F_OR set in all but the last
295  *		instruction of the block. A match will cause the code
296  *		to skip past the last instruction of the block.
297  *
298  * NOTA BENE: in a couple of places we assume that
299  *	sizeof(ipfw_insn) == sizeof(u_int32_t)
300  * this needs to be fixed.
301  *
302  */
303 typedef struct	_ipfw_insn {	/* template for instructions */
304 	u_int8_t 	opcode;
305 	u_int8_t	len;	/* number of 32-bit words */
306 #define	F_NOT		0x80
307 #define	F_OR		0x40
308 #define	F_LEN_MASK	0x3f
309 #define	F_LEN(cmd)	((cmd)->len & F_LEN_MASK)
310 
311 	u_int16_t	arg1;
312 } ipfw_insn;
313 
314 /*
315  * The F_INSN_SIZE(type) computes the size, in 4-byte words, of
316  * a given type.
317  */
318 #define	F_INSN_SIZE(t)	((sizeof (t))/sizeof(u_int32_t))
319 
320 /*
321  * This is used to store an array of 16-bit entries (ports etc.)
322  */
323 typedef struct	_ipfw_insn_u16 {
324 	ipfw_insn o;
325 	u_int16_t ports[2];	/* there may be more */
326 } ipfw_insn_u16;
327 
328 /*
329  * This is used to store an array of 32-bit entries
330  * (uid, single IPv4 addresses etc.)
331  */
332 typedef struct	_ipfw_insn_u32 {
333 	ipfw_insn o;
334 	u_int32_t d[1];	/* one or more */
335 } ipfw_insn_u32;
336 
337 /*
338  * This is used to store IP addr-mask pairs.
339  */
340 typedef struct	_ipfw_insn_ip {
341 	ipfw_insn o;
342 	struct in_addr	addr;
343 	struct in_addr	mask;
344 } ipfw_insn_ip;
345 
346 /*
347  * This is used to forward to a given address (ip).
348  */
349 typedef struct  _ipfw_insn_sa {
350 	ipfw_insn o;
351 	struct sockaddr_in sa;
352 } ipfw_insn_sa;
353 
354 /*
355  * This is used to forward to a given address (ipv6).
356  */
357 typedef struct _ipfw_insn_sa6 {
358 	ipfw_insn o;
359 	struct sockaddr_in6 sa;
360 } ipfw_insn_sa6;
361 
362 /*
363  * This is used for MAC addr-mask pairs.
364  */
365 typedef struct	_ipfw_insn_mac {
366 	ipfw_insn o;
367 	u_char addr[12];	/* dst[6] + src[6] */
368 	u_char mask[12];	/* dst[6] + src[6] */
369 } ipfw_insn_mac;
370 
371 /*
372  * This is used for interface match rules (recv xx, xmit xx).
373  */
374 typedef struct	_ipfw_insn_if {
375 	ipfw_insn o;
376 	union {
377 		struct in_addr ip;
378 		int glob;
379 		uint16_t kidx;
380 	} p;
381 	char name[IFNAMSIZ];
382 } ipfw_insn_if;
383 
384 /*
385  * This is used for storing an altq queue id number.
386  */
387 typedef struct _ipfw_insn_altq {
388 	ipfw_insn	o;
389 	u_int32_t	qid;
390 } ipfw_insn_altq;
391 
392 /*
393  * This is used for limit rules.
394  */
395 typedef struct	_ipfw_insn_limit {
396 	ipfw_insn o;
397 	u_int8_t _pad;
398 	u_int8_t limit_mask;	/* combination of DYN_* below	*/
399 #define	DYN_SRC_ADDR	0x1
400 #define	DYN_SRC_PORT	0x2
401 #define	DYN_DST_ADDR	0x4
402 #define	DYN_DST_PORT	0x8
403 
404 	u_int16_t conn_limit;
405 } ipfw_insn_limit;
406 
407 /*
408  * This is used for log instructions.
409  */
410 typedef struct  _ipfw_insn_log {
411         ipfw_insn o;
412 	u_int32_t max_log;	/* how many do we log -- 0 = all */
413 	u_int32_t log_left;	/* how many left to log 	*/
414 } ipfw_insn_log;
415 
416 /* Legacy NAT structures, compat only */
417 #ifndef	_KERNEL
418 /*
419  * Data structures required by both ipfw(8) and ipfw(4) but not part of the
420  * management API are protected by IPFW_INTERNAL.
421  */
422 #ifdef IPFW_INTERNAL
423 /* Server pool support (LSNAT). */
424 struct cfg_spool {
425 	LIST_ENTRY(cfg_spool)   _next;          /* chain of spool instances */
426 	struct in_addr          addr;
427 	u_short                 port;
428 };
429 #endif
430 
431 /* Redirect modes id. */
432 #define REDIR_ADDR      0x01
433 #define REDIR_PORT      0x02
434 #define REDIR_PROTO     0x04
435 
436 #ifdef IPFW_INTERNAL
437 /* Nat redirect configuration. */
438 struct cfg_redir {
439 	LIST_ENTRY(cfg_redir)   _next;          /* chain of redir instances */
440 	u_int16_t               mode;           /* type of redirect mode */
441 	struct in_addr	        laddr;          /* local ip address */
442 	struct in_addr	        paddr;          /* public ip address */
443 	struct in_addr	        raddr;          /* remote ip address */
444 	u_short                 lport;          /* local port */
445 	u_short                 pport;          /* public port */
446 	u_short                 rport;          /* remote port  */
447 	u_short                 pport_cnt;      /* number of public ports */
448 	u_short                 rport_cnt;      /* number of remote ports */
449 	int                     proto;          /* protocol: tcp/udp */
450 	struct alias_link       **alink;
451 	/* num of entry in spool chain */
452 	u_int16_t               spool_cnt;
453 	/* chain of spool instances */
454 	LIST_HEAD(spool_chain, cfg_spool) spool_chain;
455 };
456 #endif
457 
458 #ifdef IPFW_INTERNAL
459 /* Nat configuration data struct. */
460 struct cfg_nat {
461 	/* chain of nat instances */
462 	LIST_ENTRY(cfg_nat)     _next;
463 	int                     id;                     /* nat id */
464 	struct in_addr          ip;                     /* nat ip address */
465 	char                    if_name[IF_NAMESIZE];   /* interface name */
466 	int                     mode;                   /* aliasing mode */
467 	struct libalias	        *lib;                   /* libalias instance */
468 	/* number of entry in spool chain */
469 	int                     redir_cnt;
470 	/* chain of redir instances */
471 	LIST_HEAD(redir_chain, cfg_redir) redir_chain;
472 };
473 #endif
474 
475 #define SOF_NAT         sizeof(struct cfg_nat)
476 #define SOF_REDIR       sizeof(struct cfg_redir)
477 #define SOF_SPOOL       sizeof(struct cfg_spool)
478 
479 #endif	/* ifndef _KERNEL */
480 
481 
482 struct nat44_cfg_spool {
483 	struct in_addr	addr;
484 	uint16_t	port;
485 	uint16_t	spare;
486 };
487 #define NAT44_REDIR_ADDR	0x01
488 #define NAT44_REDIR_PORT	0x02
489 #define NAT44_REDIR_PROTO	0x04
490 
491 /* Nat redirect configuration. */
492 struct nat44_cfg_redir {
493 	struct in_addr	laddr;		/* local ip address */
494 	struct in_addr	paddr;		/* public ip address */
495 	struct in_addr	raddr;		/* remote ip address */
496 	uint16_t	lport;		/* local port */
497 	uint16_t	pport;		/* public port */
498 	uint16_t	rport;		/* remote port  */
499 	uint16_t	pport_cnt;	/* number of public ports */
500 	uint16_t	rport_cnt;	/* number of remote ports */
501 	uint16_t	mode;		/* type of redirect mode */
502 	uint16_t	spool_cnt;	/* num of entry in spool chain */
503 	uint16_t	spare;
504 	uint32_t	proto;		/* protocol: tcp/udp */
505 };
506 
507 /* Nat configuration data struct. */
508 struct nat44_cfg_nat {
509 	char		name[64];	/* nat name */
510 	char		if_name[64];	/* interface name */
511 	uint32_t	size;		/* structure size incl. redirs */
512 	struct in_addr	ip;		/* nat IPv4 address */
513 	uint32_t	mode;		/* aliasing mode */
514 	uint32_t	redir_cnt;	/* number of entry in spool chain */
515 };
516 
517 /* Nat command. */
518 typedef struct	_ipfw_insn_nat {
519  	ipfw_insn	o;
520  	struct cfg_nat *nat;
521 } ipfw_insn_nat;
522 
523 /* Apply ipv6 mask on ipv6 addr */
524 #define APPLY_MASK(addr,mask)                          \
525     (addr)->__u6_addr.__u6_addr32[0] &= (mask)->__u6_addr.__u6_addr32[0]; \
526     (addr)->__u6_addr.__u6_addr32[1] &= (mask)->__u6_addr.__u6_addr32[1]; \
527     (addr)->__u6_addr.__u6_addr32[2] &= (mask)->__u6_addr.__u6_addr32[2]; \
528     (addr)->__u6_addr.__u6_addr32[3] &= (mask)->__u6_addr.__u6_addr32[3];
529 
530 /* Structure for ipv6 */
531 typedef struct _ipfw_insn_ip6 {
532        ipfw_insn o;
533        struct in6_addr addr6;
534        struct in6_addr mask6;
535 } ipfw_insn_ip6;
536 
537 /* Used to support icmp6 types */
538 typedef struct _ipfw_insn_icmp6 {
539        ipfw_insn o;
540        uint32_t d[7]; /* XXX This number si related to the netinet/icmp6.h
541                        *     define ICMP6_MAXTYPE
542                        *     as follows: n = ICMP6_MAXTYPE/32 + 1
543                         *     Actually is 203
544                        */
545 } ipfw_insn_icmp6;
546 
547 /*
548  * Here we have the structure representing an ipfw rule.
549  *
550  * Layout:
551  * struct ip_fw_rule
552  * [ counter block, size = rule->cntr_len ]
553  * [ one or more instructions, size = rule->cmd_len * 4 ]
554  *
555  * It starts with a general area (with link fields).
556  * Counter block may be next (if rule->cntr_len > 0),
557  * followed by an array of one or more instructions, which the code
558  * accesses as an array of 32-bit values. rule->cmd_len represents
559  * the total instructions legth in u32 worrd, while act_ofs represents
560  * rule action offset in u32 words.
561  *
562  * When assembling instruction, remember the following:
563  *
564  *  + if a rule has a "keep-state" (or "limit") option, then the
565  *	first instruction (at r->cmd) MUST BE an O_PROBE_STATE
566  *  + if a rule has a "log" option, then the first action
567  *	(at ACTION_PTR(r)) MUST be O_LOG
568  *  + if a rule has an "altq" option, it comes after "log"
569  *  + if a rule has an O_TAG option, it comes after "log" and "altq"
570  *
571  *
572  * All structures (excluding instructions) are u64-aligned.
573  * Please keep this.
574  */
575 
576 struct ip_fw_rule {
577 	uint16_t	act_ofs;	/* offset of action in 32-bit units */
578 	uint16_t	cmd_len;	/* # of 32-bit words in cmd	*/
579 	uint16_t	spare;
580 	uint8_t		set;		/* rule set (0..31)		*/
581 	uint8_t		flags;		/* rule flags			*/
582 	uint32_t	rulenum;	/* rule number			*/
583 	uint32_t	id;		/* rule id			*/
584 
585 	ipfw_insn	cmd[1];		/* storage for commands		*/
586 };
587 #define	IPFW_RULE_NOOPT		0x01	/* Has no options in body	*/
588 
589 /* Unaligned version */
590 
591 /* Base ipfw rule counter block. */
592 struct ip_fw_bcounter {
593 	uint16_t	size;		/* Size of counter block, bytes	*/
594 	uint8_t		flags;		/* flags for given block	*/
595 	uint8_t		spare;
596 	uint32_t	timestamp;	/* tv_sec of last match		*/
597 	uint64_t	pcnt;		/* Packet counter		*/
598 	uint64_t	bcnt;		/* Byte counter			*/
599 };
600 
601 
602 #ifndef	_KERNEL
603 /*
604  * Legacy rule format
605  */
606 struct ip_fw {
607 	struct ip_fw	*x_next;	/* linked list of rules		*/
608 	struct ip_fw	*next_rule;	/* ptr to next [skipto] rule	*/
609 	/* 'next_rule' is used to pass up 'set_disable' status		*/
610 
611 	uint16_t	act_ofs;	/* offset of action in 32-bit units */
612 	uint16_t	cmd_len;	/* # of 32-bit words in cmd	*/
613 	uint16_t	rulenum;	/* rule number			*/
614 	uint8_t		set;		/* rule set (0..31)		*/
615 	uint8_t		_pad;		/* padding			*/
616 	uint32_t	id;		/* rule id */
617 
618 	/* These fields are present in all rules.			*/
619 	uint64_t	pcnt;		/* Packet counter		*/
620 	uint64_t	bcnt;		/* Byte counter			*/
621 	uint32_t	timestamp;	/* tv_sec of last match		*/
622 
623 	ipfw_insn	cmd[1];		/* storage for commands		*/
624 };
625 #endif
626 
627 #define ACTION_PTR(rule)				\
628 	(ipfw_insn *)( (u_int32_t *)((rule)->cmd) + ((rule)->act_ofs) )
629 
630 #define RULESIZE(rule)  (sizeof(*(rule)) + (rule)->cmd_len * 4 - 4)
631 
632 
633 #if 1 // should be moved to in.h
634 /*
635  * This structure is used as a flow mask and a flow id for various
636  * parts of the code.
637  * addr_type is used in userland and kernel to mark the address type.
638  * fib is used in the kernel to record the fib in use.
639  * _flags is used in the kernel to store tcp flags for dynamic rules.
640  */
641 struct ipfw_flow_id {
642 	uint32_t	dst_ip;
643 	uint32_t	src_ip;
644 	uint16_t	dst_port;
645 	uint16_t	src_port;
646 	uint8_t		fib;
647 	uint8_t		proto;
648 	uint8_t		_flags;	/* protocol-specific flags */
649 	uint8_t		addr_type; /* 4=ip4, 6=ip6, 1=ether ? */
650 	struct in6_addr dst_ip6;
651 	struct in6_addr src_ip6;
652 	uint32_t	flow_id6;
653 	uint32_t	extra; /* queue/pipe or frag_id */
654 };
655 #endif
656 
657 #define IS_IP6_FLOW_ID(id)	((id)->addr_type == 6)
658 
659 /*
660  * Dynamic ipfw rule.
661  */
662 typedef struct _ipfw_dyn_rule ipfw_dyn_rule;
663 
664 struct _ipfw_dyn_rule {
665 	ipfw_dyn_rule	*next;		/* linked list of rules.	*/
666 	struct ip_fw *rule;		/* pointer to rule		*/
667 	/* 'rule' is used to pass up the rule number (from the parent)	*/
668 
669 	ipfw_dyn_rule *parent;		/* pointer to parent rule	*/
670 	u_int64_t	pcnt;		/* packet match counter		*/
671 	u_int64_t	bcnt;		/* byte match counter		*/
672 	struct ipfw_flow_id id;		/* (masked) flow id		*/
673 	u_int32_t	expire;		/* expire time			*/
674 	u_int32_t	bucket;		/* which bucket in hash table	*/
675 	u_int32_t	state;		/* state of this rule (typically a
676 					 * combination of TCP flags)
677 					 */
678 	u_int32_t	ack_fwd;	/* most recent ACKs in forward	*/
679 	u_int32_t	ack_rev;	/* and reverse directions (used	*/
680 					/* to generate keepalives)	*/
681 	u_int16_t	dyn_type;	/* rule type			*/
682 	u_int16_t	count;		/* refcount			*/
683 };
684 
685 /*
686  * Definitions for IP option names.
687  */
688 #define	IP_FW_IPOPT_LSRR	0x01
689 #define	IP_FW_IPOPT_SSRR	0x02
690 #define	IP_FW_IPOPT_RR		0x04
691 #define	IP_FW_IPOPT_TS		0x08
692 
693 /*
694  * Definitions for TCP option names.
695  */
696 #define	IP_FW_TCPOPT_MSS	0x01
697 #define	IP_FW_TCPOPT_WINDOW	0x02
698 #define	IP_FW_TCPOPT_SACK	0x04
699 #define	IP_FW_TCPOPT_TS		0x08
700 #define	IP_FW_TCPOPT_CC		0x10
701 
702 #define	ICMP_REJECT_RST		0x100	/* fake ICMP code (send a TCP RST) */
703 #define	ICMP6_UNREACH_RST	0x100	/* fake ICMPv6 code (send a TCP RST) */
704 
705 /*
706  * These are used for lookup tables.
707  */
708 
709 #define	IPFW_TABLE_ADDR		1	/* Table for holding IPv4/IPv6 prefixes */
710 #define	IPFW_TABLE_INTERFACE	2	/* Table for holding interface names */
711 #define	IPFW_TABLE_NUMBER	3	/* Table for holding ports/uid/gid/etc */
712 #define	IPFW_TABLE_FLOW		4	/* Table for holding flow data */
713 #define	IPFW_TABLE_MAXTYPE	4	/* Maximum valid number */
714 
715 #define	IPFW_TABLE_CIDR	IPFW_TABLE_ADDR	/* compat */
716 
717 /* Value types */
718 #define	IPFW_VTYPE_LEGACY	0xFFFFFFFF	/* All data is filled in */
719 #define	IPFW_VTYPE_SKIPTO	0x00000001	/* skipto/call/callreturn */
720 #define	IPFW_VTYPE_PIPE		0x00000002	/* pipe/queue */
721 #define	IPFW_VTYPE_FIB		0x00000004	/* setfib */
722 #define	IPFW_VTYPE_NAT		0x00000008	/* nat */
723 #define	IPFW_VTYPE_DSCP		0x00000010	/* dscp */
724 #define	IPFW_VTYPE_TAG		0x00000020	/* tag/untag */
725 #define	IPFW_VTYPE_DIVERT	0x00000040	/* divert/tee */
726 #define	IPFW_VTYPE_NETGRAPH	0x00000080	/* netgraph/ngtee */
727 #define	IPFW_VTYPE_LIMIT	0x00000100	/* limit */
728 #define	IPFW_VTYPE_NH4		0x00000200	/* IPv4 nexthop */
729 #define	IPFW_VTYPE_NH6		0x00000400	/* IPv6 nexthop */
730 
731 typedef struct	_ipfw_table_entry {
732 	in_addr_t	addr;		/* network address		*/
733 	u_int32_t	value;		/* value			*/
734 	u_int16_t	tbl;		/* table number			*/
735 	u_int8_t	masklen;	/* mask length			*/
736 } ipfw_table_entry;
737 
738 typedef struct	_ipfw_table_xentry {
739 	uint16_t	len;		/* Total entry length		*/
740 	uint8_t		type;		/* entry type			*/
741 	uint8_t		masklen;	/* mask length			*/
742 	uint16_t	tbl;		/* table number			*/
743 	uint16_t	flags;		/* record flags			*/
744 	uint32_t	value;		/* value			*/
745 	union {
746 		/* Longest field needs to be aligned by 4-byte boundary	*/
747 		struct in6_addr	addr6;	/* IPv6 address 		*/
748 		char	iface[IF_NAMESIZE];	/* interface name	*/
749 	} k;
750 } ipfw_table_xentry;
751 #define	IPFW_TCF_INET	0x01		/* CIDR flags: IPv4 record	*/
752 
753 typedef struct	_ipfw_table {
754 	u_int32_t	size;		/* size of entries in bytes	*/
755 	u_int32_t	cnt;		/* # of entries			*/
756 	u_int16_t	tbl;		/* table number			*/
757 	ipfw_table_entry ent[0];	/* entries			*/
758 } ipfw_table;
759 
760 typedef struct	_ipfw_xtable {
761 	ip_fw3_opheader	opheader;	/* IP_FW3 opcode */
762 	uint32_t	size;		/* size of entries in bytes	*/
763 	uint32_t	cnt;		/* # of entries			*/
764 	uint16_t	tbl;		/* table number			*/
765 	uint8_t		type;		/* table type			*/
766 	ipfw_table_xentry xent[0];	/* entries			*/
767 } ipfw_xtable;
768 
769 typedef struct  _ipfw_obj_tlv {
770 	uint16_t        type;		/* TLV type */
771 	uint16_t	flags;		/* TLV-specific flags		*/
772 	uint32_t        length;		/* Total length, aligned to u64	*/
773 } ipfw_obj_tlv;
774 #define	IPFW_TLV_TBL_NAME	1
775 #define	IPFW_TLV_TBLNAME_LIST	2
776 #define	IPFW_TLV_RULE_LIST	3
777 #define	IPFW_TLV_DYNSTATE_LIST	4
778 #define	IPFW_TLV_TBL_ENT	5
779 #define	IPFW_TLV_DYN_ENT	6
780 #define	IPFW_TLV_RULE_ENT	7
781 #define	IPFW_TLV_TBLENT_LIST	8
782 #define	IPFW_TLV_RANGE		9
783 
784 /* Object name TLV */
785 typedef struct _ipfw_obj_ntlv {
786 	ipfw_obj_tlv	head;		/* TLV header			*/
787 	uint16_t	idx;		/* Name index			*/
788 	uint8_t		spare;		/* unused			*/
789 	uint8_t		type;		/* object type, if applicable	*/
790 	uint32_t	set;		/* set, if applicable		*/
791 	char		name[64];	/* Null-terminated name		*/
792 } ipfw_obj_ntlv;
793 
794 /* IPv4/IPv6 L4 flow description */
795 struct tflow_entry {
796 	uint8_t		af;
797 	uint8_t		proto;
798 	uint16_t	spare;
799 	uint16_t	sport;
800 	uint16_t	dport;
801 	union {
802 		struct {
803 			struct in_addr	sip;
804 			struct in_addr	dip;
805 		} a4;
806 		struct {
807 			struct in6_addr	sip6;
808 			struct in6_addr	dip6;
809 		} a6;
810 	} a;
811 };
812 
813 typedef struct _ipfw_table_value {
814 	uint32_t	tag;		/* O_TAG/O_TAGGED */
815 	uint32_t	pipe;		/* O_PIPE/O_QUEUE */
816 	uint16_t	divert;		/* O_DIVERT/O_TEE */
817 	uint16_t	skipto;		/* skipto, CALLRET */
818 	uint32_t	netgraph;	/* O_NETGRAPH/O_NGTEE */
819 	uint32_t	fib;		/* O_SETFIB */
820 	uint32_t	nat;		/* O_NAT */
821 	uint32_t	nh4;
822 	uint8_t		dscp;
823 	uint8_t		spare0;
824 	uint16_t	spare1;
825 	struct in6_addr	nh6;
826 	uint32_t	limit;		/* O_LIMIT */
827 	uint32_t	zoneid;		/* scope zone id for nh6 */
828 	uint64_t	reserved;
829 } ipfw_table_value;
830 
831 /* Table entry TLV */
832 typedef struct	_ipfw_obj_tentry {
833 	ipfw_obj_tlv	head;		/* TLV header			*/
834 	uint8_t		subtype;	/* subtype (IPv4,IPv6)		*/
835 	uint8_t		masklen;	/* mask length			*/
836 	uint8_t		result;		/* request result		*/
837 	uint8_t		spare0;
838 	uint16_t	idx;		/* Table name index		*/
839 	uint16_t	spare1;
840 	union {
841 		/* Longest field needs to be aligned by 8-byte boundary	*/
842 		struct in_addr		addr;	/* IPv4 address		*/
843 		uint32_t		key;		/* uid/gid/port	*/
844 		struct in6_addr		addr6;	/* IPv6 address 	*/
845 		char	iface[IF_NAMESIZE];	/* interface name	*/
846 		struct tflow_entry	flow;
847 	} k;
848 	union {
849 		ipfw_table_value	value;	/* value data */
850 		uint32_t		kidx;	/* value kernel index */
851 	} v;
852 } ipfw_obj_tentry;
853 #define	IPFW_TF_UPDATE	0x01		/* Update record if exists	*/
854 /* Container TLV */
855 #define	IPFW_CTF_ATOMIC	0x01		/* Perform atomic operation	*/
856 /* Operation results */
857 #define	IPFW_TR_IGNORED		0	/* Entry was ignored (rollback)	*/
858 #define	IPFW_TR_ADDED		1	/* Entry was succesfully added	*/
859 #define	IPFW_TR_UPDATED		2	/* Entry was succesfully updated*/
860 #define	IPFW_TR_DELETED		3	/* Entry was succesfully deleted*/
861 #define	IPFW_TR_LIMIT		4	/* Entry was ignored (limit)	*/
862 #define	IPFW_TR_NOTFOUND	5	/* Entry was not found		*/
863 #define	IPFW_TR_EXISTS		6	/* Entry already exists		*/
864 #define	IPFW_TR_ERROR		7	/* Request has failed (unknown)	*/
865 
866 typedef struct _ipfw_obj_dyntlv {
867 	ipfw_obj_tlv	head;
868 	ipfw_dyn_rule	state;
869 } ipfw_obj_dyntlv;
870 #define	IPFW_DF_LAST	0x01		/* Last state in chain		*/
871 
872 /* Containter TLVs */
873 typedef struct _ipfw_obj_ctlv {
874 	ipfw_obj_tlv	head;		/* TLV header			*/
875 	uint32_t	count;		/* Number of sub-TLVs		*/
876 	uint16_t	objsize;	/* Single object size		*/
877 	uint8_t		version;	/* TLV version			*/
878 	uint8_t		flags;		/* TLV-specific flags		*/
879 } ipfw_obj_ctlv;
880 
881 /* Range TLV */
882 typedef struct _ipfw_range_tlv {
883 	ipfw_obj_tlv	head;		/* TLV header			*/
884 	uint32_t	flags;		/* Range flags			*/
885 	uint16_t	start_rule;	/* Range start			*/
886 	uint16_t	end_rule;	/* Range end			*/
887 	uint32_t	set;		/* Range set to match		 */
888 	uint32_t	new_set;	/* New set to move/swap to	*/
889 } ipfw_range_tlv;
890 #define	IPFW_RCFLAG_RANGE	0x01	/* rule range is set		*/
891 #define	IPFW_RCFLAG_ALL		0x02	/* match ALL rules		*/
892 #define	IPFW_RCFLAG_SET		0x04	/* match rules in given set	*/
893 /* User-settable flags */
894 #define	IPFW_RCFLAG_USER	(IPFW_RCFLAG_RANGE | IPFW_RCFLAG_ALL | \
895 	IPFW_RCFLAG_SET)
896 /* Internally used flags */
897 #define	IPFW_RCFLAG_DEFAULT	0x0100	/* Do not skip defaul rule	*/
898 
899 typedef struct _ipfw_ta_tinfo {
900 	uint32_t	flags;		/* Format flags			*/
901 	uint32_t	spare;
902 	uint8_t		taclass4;	/* algorithm class		*/
903 	uint8_t		spare4;
904 	uint16_t	itemsize4;	/* item size in runtime		*/
905 	uint32_t	size4;		/* runtime structure size	*/
906 	uint32_t	count4;		/* number of items in runtime	*/
907 	uint8_t		taclass6;	/* algorithm class		*/
908 	uint8_t		spare6;
909 	uint16_t	itemsize6;	/* item size in runtime		*/
910 	uint32_t	size6;		/* runtime structure size	*/
911 	uint32_t	count6;		/* number of items in runtime	*/
912 } ipfw_ta_tinfo;
913 #define	IPFW_TACLASS_HASH	1	/* algo is based on hash	*/
914 #define	IPFW_TACLASS_ARRAY	2	/* algo is based on array	*/
915 #define	IPFW_TACLASS_RADIX	3	/* algo is based on radix tree	*/
916 
917 #define	IPFW_TATFLAGS_DATA	0x0001		/* Has data filled in	*/
918 #define	IPFW_TATFLAGS_AFDATA	0x0002		/* Separate data per AF	*/
919 #define	IPFW_TATFLAGS_AFITEM	0x0004		/* diff. items per AF	*/
920 
921 typedef struct _ipfw_xtable_info {
922 	uint8_t		type;		/* table type (addr,iface,..)	*/
923 	uint8_t		tflags;		/* type flags			*/
924 	uint16_t	mflags;		/* modification flags		*/
925 	uint16_t	flags;		/* generic table flags		*/
926 	uint16_t	spare[3];
927 	uint32_t	vmask;		/* bitmask with value types 	*/
928 	uint32_t	set;		/* set table is in		*/
929 	uint32_t	kidx;		/* kernel index			*/
930 	uint32_t	refcnt;		/* number of references		*/
931 	uint32_t	count;		/* Number of records		*/
932 	uint32_t	size;		/* Total size of records(export)*/
933 	uint32_t	limit;		/* Max number of records	*/
934 	char		tablename[64];	/* table name */
935 	char		algoname[64];	/* algorithm name		*/
936 	ipfw_ta_tinfo	ta_info;	/* additional algo stats	*/
937 } ipfw_xtable_info;
938 /* Generic table flags */
939 #define	IPFW_TGFLAGS_LOCKED	0x01	/* Tables is locked from changes*/
940 /* Table type-specific flags */
941 #define	IPFW_TFFLAG_SRCIP	0x01
942 #define	IPFW_TFFLAG_DSTIP	0x02
943 #define	IPFW_TFFLAG_SRCPORT	0x04
944 #define	IPFW_TFFLAG_DSTPORT	0x08
945 #define	IPFW_TFFLAG_PROTO	0x10
946 /* Table modification flags */
947 #define	IPFW_TMFLAGS_LIMIT	0x0002	/* Change limit value		*/
948 #define	IPFW_TMFLAGS_LOCK	0x0004	/* Change table lock state	*/
949 
950 typedef struct _ipfw_iface_info {
951 	char		ifname[64];	/* interface name		*/
952 	uint32_t	ifindex;	/* interface index		*/
953 	uint32_t	flags;		/* flags			*/
954 	uint32_t	refcnt;		/* number of references		*/
955 	uint32_t	gencnt;		/* number of changes		*/
956 	uint64_t	spare;
957 } ipfw_iface_info;
958 #define	IPFW_IFFLAG_RESOLVED	0x01	/* Interface exists		*/
959 
960 typedef struct _ipfw_ta_info {
961 	char		algoname[64];	/* algorithm name		*/
962 	uint32_t	type;		/* lookup type			*/
963 	uint32_t	flags;
964 	uint32_t	refcnt;
965 	uint32_t	spare0;
966 	uint64_t	spare1;
967 } ipfw_ta_info;
968 
969 typedef struct _ipfw_obj_header {
970 	ip_fw3_opheader	opheader;	/* IP_FW3 opcode		*/
971 	uint32_t	spare;
972 	uint16_t	idx;		/* object name index		*/
973 	uint8_t		objtype;	/* object type			*/
974 	uint8_t		objsubtype;	/* object subtype		*/
975 	ipfw_obj_ntlv	ntlv;		/* object name tlv		*/
976 } ipfw_obj_header;
977 
978 typedef struct _ipfw_obj_lheader {
979 	ip_fw3_opheader	opheader;	/* IP_FW3 opcode		*/
980 	uint32_t	set_mask;	/* disabled set mask		*/
981 	uint32_t	count;		/* Total objects count		*/
982 	uint32_t	size;		/* Total size (incl. header)	*/
983 	uint32_t	objsize;	/* Size of one object		*/
984 } ipfw_obj_lheader;
985 
986 #define	IPFW_CFG_GET_STATIC	0x01
987 #define	IPFW_CFG_GET_STATES	0x02
988 #define	IPFW_CFG_GET_COUNTERS	0x04
989 typedef struct _ipfw_cfg_lheader {
990 	ip_fw3_opheader	opheader;	/* IP_FW3 opcode		*/
991 	uint32_t	set_mask;	/* enabled set mask		*/
992 	uint32_t	spare;
993 	uint32_t	flags;		/* Request flags		*/
994 	uint32_t	size;		/* neded buffer size		*/
995 	uint32_t	start_rule;
996 	uint32_t	end_rule;
997 } ipfw_cfg_lheader;
998 
999 typedef struct _ipfw_range_header {
1000 	ip_fw3_opheader	opheader;	/* IP_FW3 opcode		*/
1001 	ipfw_range_tlv	range;
1002 } ipfw_range_header;
1003 
1004 typedef struct _ipfw_sopt_info {
1005 	uint16_t	opcode;
1006 	uint8_t		version;
1007 	uint8_t		dir;
1008 	uint8_t		spare;
1009 	uint64_t	refcnt;
1010 } ipfw_sopt_info;
1011 
1012 #endif /* _IPFW2_H */
1013