xref: /freebsd/sys/netinet/ip_fw.h (revision 8ef24a0d4b28fe230e20637f56869cc4148cd2ca)
1 /*-
2  * Copyright (c) 2002-2009 Luigi Rizzo, Universita` di Pisa
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  * 1. Redistributions of source code must retain the above copyright
8  *    notice, this list of conditions and the following disclaimer.
9  * 2. Redistributions in binary form must reproduce the above copyright
10  *    notice, this list of conditions and the following disclaimer in the
11  *    documentation and/or other materials provided with the distribution.
12  *
13  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
14  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
16  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
17  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
18  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
19  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
20  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
21  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
22  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
23  * SUCH DAMAGE.
24  *
25  * $FreeBSD$
26  */
27 
28 #ifndef _IPFW2_H
29 #define _IPFW2_H
30 
31 /*
32  * The default rule number.  By the design of ip_fw, the default rule
33  * is the last one, so its number can also serve as the highest number
34  * allowed for a rule.  The ip_fw code relies on both meanings of this
35  * constant.
36  */
37 #define	IPFW_DEFAULT_RULE	65535
38 
39 #define	RESVD_SET		31	/*set for default and persistent rules*/
40 #define	IPFW_MAX_SETS		32	/* Number of sets supported by ipfw*/
41 
42 /*
43  * Compat values for old clients
44  */
45 #ifndef	_KERNEL
46 #define	IPFW_TABLES_MAX		65535
47 #define	IPFW_TABLES_DEFAULT	128
48 #endif
49 
50 /*
51  * Most commands (queue, pipe, tag, untag, limit...) can have a 16-bit
52  * argument between 1 and 65534. The value 0 (IP_FW_TARG) is used
53  * to represent 'tablearg' value, e.g.  indicate the use of a 'tablearg'
54  * result of the most recent table() lookup.
55  * Note that 16bit is only a historical limit, resulting from
56  * the use of a 16-bit fields for that value. In reality, we can have
57  * 2^32 pipes, queues, tag values and so on.
58  */
59 #define	IPFW_ARG_MIN		1
60 #define	IPFW_ARG_MAX		65534
61 #define IP_FW_TABLEARG		65535	/* Compat value for old clients */
62 #define	IP_FW_TARG		0	/* Current tablearg value */
63 
64 /*
65  * Number of entries in the call stack of the call/return commands.
66  * Call stack currently is an uint16_t array with rule numbers.
67  */
68 #define	IPFW_CALLSTACK_SIZE	16
69 
70 /* IP_FW3 header/opcodes */
71 typedef struct _ip_fw3_opheader {
72 	uint16_t opcode;	/* Operation opcode */
73 	uint16_t version;	/* Opcode version */
74 	uint16_t reserved[2];	/* Align to 64-bit boundary */
75 } ip_fw3_opheader;
76 
77 /* IP_FW3 opcodes */
78 #define	IP_FW_TABLE_XADD	86	/* add entry */
79 #define	IP_FW_TABLE_XDEL	87	/* delete entry */
80 #define	IP_FW_TABLE_XGETSIZE	88	/* get table size (deprecated) */
81 #define	IP_FW_TABLE_XLIST	89	/* list table contents */
82 #define	IP_FW_TABLE_XDESTROY	90	/* destroy table */
83 #define	IP_FW_TABLES_XLIST	92	/* list all tables  */
84 #define	IP_FW_TABLE_XINFO	93	/* request info for one table */
85 #define	IP_FW_TABLE_XFLUSH	94	/* flush table data */
86 #define	IP_FW_TABLE_XCREATE	95	/* create new table  */
87 #define	IP_FW_TABLE_XMODIFY	96	/* modify existing table */
88 #define	IP_FW_XGET		97	/* Retrieve configuration */
89 #define	IP_FW_XADD		98	/* add rule */
90 #define	IP_FW_XDEL		99	/* del rule */
91 #define	IP_FW_XMOVE		100	/* move rules to different set  */
92 #define	IP_FW_XZERO		101	/* clear accounting */
93 #define	IP_FW_XRESETLOG		102	/* zero rules logs */
94 #define	IP_FW_SET_SWAP		103	/* Swap between 2 sets */
95 #define	IP_FW_SET_MOVE		104	/* Move one set to another one */
96 #define	IP_FW_SET_ENABLE	105	/* Enable/disable sets */
97 #define	IP_FW_TABLE_XFIND	106	/* finds an entry */
98 #define	IP_FW_XIFLIST		107	/* list tracked interfaces */
99 #define	IP_FW_TABLES_ALIST	108	/* list table algorithms */
100 #define	IP_FW_TABLE_XSWAP	109	/* swap two tables */
101 #define	IP_FW_TABLE_VLIST	110	/* dump table value hash */
102 
103 #define	IP_FW_NAT44_XCONFIG	111	/* Create/modify NAT44 instance */
104 #define	IP_FW_NAT44_DESTROY	112	/* Destroys NAT44 instance */
105 #define	IP_FW_NAT44_XGETCONFIG	113	/* Get NAT44 instance config */
106 #define	IP_FW_NAT44_LIST_NAT	114	/* List all NAT44 instances */
107 #define	IP_FW_NAT44_XGETLOG	115	/* Get log from NAT44 instance */
108 
109 #define	IP_FW_DUMP_SOPTCODES	116	/* Dump available sopts/versions */
110 #define	IP_FW_DUMP_SRVOBJECTS	117	/* Dump existing named objects */
111 
112 /*
113  * The kernel representation of ipfw rules is made of a list of
114  * 'instructions' (for all practical purposes equivalent to BPF
115  * instructions), which specify which fields of the packet
116  * (or its metadata) should be analysed.
117  *
118  * Each instruction is stored in a structure which begins with
119  * "ipfw_insn", and can contain extra fields depending on the
120  * instruction type (listed below).
121  * Note that the code is written so that individual instructions
122  * have a size which is a multiple of 32 bits. This means that, if
123  * such structures contain pointers or other 64-bit entities,
124  * (there is just one instance now) they may end up unaligned on
125  * 64-bit architectures, so the must be handled with care.
126  *
127  * "enum ipfw_opcodes" are the opcodes supported. We can have up
128  * to 256 different opcodes. When adding new opcodes, they should
129  * be appended to the end of the opcode list before O_LAST_OPCODE,
130  * this will prevent the ABI from being broken, otherwise users
131  * will have to recompile ipfw(8) when they update the kernel.
132  */
133 
134 enum ipfw_opcodes {		/* arguments (4 byte each)	*/
135 	O_NOP,
136 
137 	O_IP_SRC,		/* u32 = IP			*/
138 	O_IP_SRC_MASK,		/* ip = IP/mask			*/
139 	O_IP_SRC_ME,		/* none				*/
140 	O_IP_SRC_SET,		/* u32=base, arg1=len, bitmap	*/
141 
142 	O_IP_DST,		/* u32 = IP			*/
143 	O_IP_DST_MASK,		/* ip = IP/mask			*/
144 	O_IP_DST_ME,		/* none				*/
145 	O_IP_DST_SET,		/* u32=base, arg1=len, bitmap	*/
146 
147 	O_IP_SRCPORT,		/* (n)port list:mask 4 byte ea	*/
148 	O_IP_DSTPORT,		/* (n)port list:mask 4 byte ea	*/
149 	O_PROTO,		/* arg1=protocol		*/
150 
151 	O_MACADDR2,		/* 2 mac addr:mask		*/
152 	O_MAC_TYPE,		/* same as srcport		*/
153 
154 	O_LAYER2,		/* none				*/
155 	O_IN,			/* none				*/
156 	O_FRAG,			/* none				*/
157 
158 	O_RECV,			/* none				*/
159 	O_XMIT,			/* none				*/
160 	O_VIA,			/* none				*/
161 
162 	O_IPOPT,		/* arg1 = 2*u8 bitmap		*/
163 	O_IPLEN,		/* arg1 = len			*/
164 	O_IPID,			/* arg1 = id			*/
165 
166 	O_IPTOS,		/* arg1 = id			*/
167 	O_IPPRECEDENCE,		/* arg1 = precedence << 5	*/
168 	O_IPTTL,		/* arg1 = TTL			*/
169 
170 	O_IPVER,		/* arg1 = version		*/
171 	O_UID,			/* u32 = id			*/
172 	O_GID,			/* u32 = id			*/
173 	O_ESTAB,		/* none (tcp established)	*/
174 	O_TCPFLAGS,		/* arg1 = 2*u8 bitmap		*/
175 	O_TCPWIN,		/* arg1 = desired win		*/
176 	O_TCPSEQ,		/* u32 = desired seq.		*/
177 	O_TCPACK,		/* u32 = desired seq.		*/
178 	O_ICMPTYPE,		/* u32 = icmp bitmap		*/
179 	O_TCPOPTS,		/* arg1 = 2*u8 bitmap		*/
180 
181 	O_VERREVPATH,		/* none				*/
182 	O_VERSRCREACH,		/* none				*/
183 
184 	O_PROBE_STATE,		/* none				*/
185 	O_KEEP_STATE,		/* none				*/
186 	O_LIMIT,		/* ipfw_insn_limit		*/
187 	O_LIMIT_PARENT,		/* dyn_type, not an opcode.	*/
188 
189 	/*
190 	 * These are really 'actions'.
191 	 */
192 
193 	O_LOG,			/* ipfw_insn_log		*/
194 	O_PROB,			/* u32 = match probability	*/
195 
196 	O_CHECK_STATE,		/* none				*/
197 	O_ACCEPT,		/* none				*/
198 	O_DENY,			/* none 			*/
199 	O_REJECT,		/* arg1=icmp arg (same as deny)	*/
200 	O_COUNT,		/* none				*/
201 	O_SKIPTO,		/* arg1=next rule number	*/
202 	O_PIPE,			/* arg1=pipe number		*/
203 	O_QUEUE,		/* arg1=queue number		*/
204 	O_DIVERT,		/* arg1=port number		*/
205 	O_TEE,			/* arg1=port number		*/
206 	O_FORWARD_IP,		/* fwd sockaddr			*/
207 	O_FORWARD_MAC,		/* fwd mac			*/
208 	O_NAT,                  /* nope                         */
209 	O_REASS,                /* none                         */
210 
211 	/*
212 	 * More opcodes.
213 	 */
214 	O_IPSEC,		/* has ipsec history 		*/
215 	O_IP_SRC_LOOKUP,	/* arg1=table number, u32=value	*/
216 	O_IP_DST_LOOKUP,	/* arg1=table number, u32=value	*/
217 	O_ANTISPOOF,		/* none				*/
218 	O_JAIL,			/* u32 = id			*/
219 	O_ALTQ,			/* u32 = altq classif. qid	*/
220 	O_DIVERTED,		/* arg1=bitmap (1:loop, 2:out)	*/
221 	O_TCPDATALEN,		/* arg1 = tcp data len		*/
222 	O_IP6_SRC,		/* address without mask		*/
223 	O_IP6_SRC_ME,		/* my addresses			*/
224 	O_IP6_SRC_MASK,		/* address with the mask	*/
225 	O_IP6_DST,
226 	O_IP6_DST_ME,
227 	O_IP6_DST_MASK,
228 	O_FLOW6ID,		/* for flow id tag in the ipv6 pkt */
229 	O_ICMP6TYPE,		/* icmp6 packet type filtering	*/
230 	O_EXT_HDR,		/* filtering for ipv6 extension header */
231 	O_IP6,
232 
233 	/*
234 	 * actions for ng_ipfw
235 	 */
236 	O_NETGRAPH,		/* send to ng_ipfw		*/
237 	O_NGTEE,		/* copy to ng_ipfw		*/
238 
239 	O_IP4,
240 
241 	O_UNREACH6,		/* arg1=icmpv6 code arg (deny)  */
242 
243 	O_TAG,   		/* arg1=tag number */
244 	O_TAGGED,		/* arg1=tag number */
245 
246 	O_SETFIB,		/* arg1=FIB number */
247 	O_FIB,			/* arg1=FIB desired fib number */
248 
249 	O_SOCKARG,		/* socket argument */
250 
251 	O_CALLRETURN,		/* arg1=called rule number */
252 
253 	O_FORWARD_IP6,		/* fwd sockaddr_in6             */
254 
255 	O_DSCP,			/* 2 u32 = DSCP mask */
256 	O_SETDSCP,		/* arg1=DSCP value */
257 	O_IP_FLOW_LOOKUP,	/* arg1=table number, u32=value	*/
258 
259 	O_EXTERNAL_ACTION,	/* arg1=id of external action handler */
260 	O_EXTERNAL_INSTANCE,	/* arg1=id of eaction handler instance */
261 
262 	O_LAST_OPCODE		/* not an opcode!		*/
263 };
264 
265 /*
266  * The extension header are filtered only for presence using a bit
267  * vector with a flag for each header.
268  */
269 #define EXT_FRAGMENT	0x1
270 #define EXT_HOPOPTS	0x2
271 #define EXT_ROUTING	0x4
272 #define EXT_AH		0x8
273 #define EXT_ESP		0x10
274 #define EXT_DSTOPTS	0x20
275 #define EXT_RTHDR0		0x40
276 #define EXT_RTHDR2		0x80
277 
278 /*
279  * Template for instructions.
280  *
281  * ipfw_insn is used for all instructions which require no operands,
282  * a single 16-bit value (arg1), or a couple of 8-bit values.
283  *
284  * For other instructions which require different/larger arguments
285  * we have derived structures, ipfw_insn_*.
286  *
287  * The size of the instruction (in 32-bit words) is in the low
288  * 6 bits of "len". The 2 remaining bits are used to implement
289  * NOT and OR on individual instructions. Given a type, you can
290  * compute the length to be put in "len" using F_INSN_SIZE(t)
291  *
292  * F_NOT	negates the match result of the instruction.
293  *
294  * F_OR		is used to build or blocks. By default, instructions
295  *		are evaluated as part of a logical AND. An "or" block
296  *		{ X or Y or Z } contains F_OR set in all but the last
297  *		instruction of the block. A match will cause the code
298  *		to skip past the last instruction of the block.
299  *
300  * NOTA BENE: in a couple of places we assume that
301  *	sizeof(ipfw_insn) == sizeof(u_int32_t)
302  * this needs to be fixed.
303  *
304  */
305 typedef struct	_ipfw_insn {	/* template for instructions */
306 	u_int8_t 	opcode;
307 	u_int8_t	len;	/* number of 32-bit words */
308 #define	F_NOT		0x80
309 #define	F_OR		0x40
310 #define	F_LEN_MASK	0x3f
311 #define	F_LEN(cmd)	((cmd)->len & F_LEN_MASK)
312 
313 	u_int16_t	arg1;
314 } ipfw_insn;
315 
316 /*
317  * The F_INSN_SIZE(type) computes the size, in 4-byte words, of
318  * a given type.
319  */
320 #define	F_INSN_SIZE(t)	((sizeof (t))/sizeof(u_int32_t))
321 
322 /*
323  * This is used to store an array of 16-bit entries (ports etc.)
324  */
325 typedef struct	_ipfw_insn_u16 {
326 	ipfw_insn o;
327 	u_int16_t ports[2];	/* there may be more */
328 } ipfw_insn_u16;
329 
330 /*
331  * This is used to store an array of 32-bit entries
332  * (uid, single IPv4 addresses etc.)
333  */
334 typedef struct	_ipfw_insn_u32 {
335 	ipfw_insn o;
336 	u_int32_t d[1];	/* one or more */
337 } ipfw_insn_u32;
338 
339 /*
340  * This is used to store IP addr-mask pairs.
341  */
342 typedef struct	_ipfw_insn_ip {
343 	ipfw_insn o;
344 	struct in_addr	addr;
345 	struct in_addr	mask;
346 } ipfw_insn_ip;
347 
348 /*
349  * This is used to forward to a given address (ip).
350  */
351 typedef struct  _ipfw_insn_sa {
352 	ipfw_insn o;
353 	struct sockaddr_in sa;
354 } ipfw_insn_sa;
355 
356 /*
357  * This is used to forward to a given address (ipv6).
358  */
359 typedef struct _ipfw_insn_sa6 {
360 	ipfw_insn o;
361 	struct sockaddr_in6 sa;
362 } ipfw_insn_sa6;
363 
364 /*
365  * This is used for MAC addr-mask pairs.
366  */
367 typedef struct	_ipfw_insn_mac {
368 	ipfw_insn o;
369 	u_char addr[12];	/* dst[6] + src[6] */
370 	u_char mask[12];	/* dst[6] + src[6] */
371 } ipfw_insn_mac;
372 
373 /*
374  * This is used for interface match rules (recv xx, xmit xx).
375  */
376 typedef struct	_ipfw_insn_if {
377 	ipfw_insn o;
378 	union {
379 		struct in_addr ip;
380 		int glob;
381 		uint16_t kidx;
382 	} p;
383 	char name[IFNAMSIZ];
384 } ipfw_insn_if;
385 
386 /*
387  * This is used for storing an altq queue id number.
388  */
389 typedef struct _ipfw_insn_altq {
390 	ipfw_insn	o;
391 	u_int32_t	qid;
392 } ipfw_insn_altq;
393 
394 /*
395  * This is used for limit rules.
396  */
397 typedef struct	_ipfw_insn_limit {
398 	ipfw_insn o;
399 	u_int8_t _pad;
400 	u_int8_t limit_mask;	/* combination of DYN_* below	*/
401 #define	DYN_SRC_ADDR	0x1
402 #define	DYN_SRC_PORT	0x2
403 #define	DYN_DST_ADDR	0x4
404 #define	DYN_DST_PORT	0x8
405 
406 	u_int16_t conn_limit;
407 } ipfw_insn_limit;
408 
409 /*
410  * This is used for log instructions.
411  */
412 typedef struct  _ipfw_insn_log {
413         ipfw_insn o;
414 	u_int32_t max_log;	/* how many do we log -- 0 = all */
415 	u_int32_t log_left;	/* how many left to log 	*/
416 } ipfw_insn_log;
417 
418 /* Legacy NAT structures, compat only */
419 #ifndef	_KERNEL
420 /*
421  * Data structures required by both ipfw(8) and ipfw(4) but not part of the
422  * management API are protected by IPFW_INTERNAL.
423  */
424 #ifdef IPFW_INTERNAL
425 /* Server pool support (LSNAT). */
426 struct cfg_spool {
427 	LIST_ENTRY(cfg_spool)   _next;          /* chain of spool instances */
428 	struct in_addr          addr;
429 	u_short                 port;
430 };
431 #endif
432 
433 /* Redirect modes id. */
434 #define REDIR_ADDR      0x01
435 #define REDIR_PORT      0x02
436 #define REDIR_PROTO     0x04
437 
438 #ifdef IPFW_INTERNAL
439 /* Nat redirect configuration. */
440 struct cfg_redir {
441 	LIST_ENTRY(cfg_redir)   _next;          /* chain of redir instances */
442 	u_int16_t               mode;           /* type of redirect mode */
443 	struct in_addr	        laddr;          /* local ip address */
444 	struct in_addr	        paddr;          /* public ip address */
445 	struct in_addr	        raddr;          /* remote ip address */
446 	u_short                 lport;          /* local port */
447 	u_short                 pport;          /* public port */
448 	u_short                 rport;          /* remote port  */
449 	u_short                 pport_cnt;      /* number of public ports */
450 	u_short                 rport_cnt;      /* number of remote ports */
451 	int                     proto;          /* protocol: tcp/udp */
452 	struct alias_link       **alink;
453 	/* num of entry in spool chain */
454 	u_int16_t               spool_cnt;
455 	/* chain of spool instances */
456 	LIST_HEAD(spool_chain, cfg_spool) spool_chain;
457 };
458 #endif
459 
460 #ifdef IPFW_INTERNAL
461 /* Nat configuration data struct. */
462 struct cfg_nat {
463 	/* chain of nat instances */
464 	LIST_ENTRY(cfg_nat)     _next;
465 	int                     id;                     /* nat id */
466 	struct in_addr          ip;                     /* nat ip address */
467 	char                    if_name[IF_NAMESIZE];   /* interface name */
468 	int                     mode;                   /* aliasing mode */
469 	struct libalias	        *lib;                   /* libalias instance */
470 	/* number of entry in spool chain */
471 	int                     redir_cnt;
472 	/* chain of redir instances */
473 	LIST_HEAD(redir_chain, cfg_redir) redir_chain;
474 };
475 #endif
476 
477 #define SOF_NAT         sizeof(struct cfg_nat)
478 #define SOF_REDIR       sizeof(struct cfg_redir)
479 #define SOF_SPOOL       sizeof(struct cfg_spool)
480 
481 #endif	/* ifndef _KERNEL */
482 
483 
484 struct nat44_cfg_spool {
485 	struct in_addr	addr;
486 	uint16_t	port;
487 	uint16_t	spare;
488 };
489 #define NAT44_REDIR_ADDR	0x01
490 #define NAT44_REDIR_PORT	0x02
491 #define NAT44_REDIR_PROTO	0x04
492 
493 /* Nat redirect configuration. */
494 struct nat44_cfg_redir {
495 	struct in_addr	laddr;		/* local ip address */
496 	struct in_addr	paddr;		/* public ip address */
497 	struct in_addr	raddr;		/* remote ip address */
498 	uint16_t	lport;		/* local port */
499 	uint16_t	pport;		/* public port */
500 	uint16_t	rport;		/* remote port  */
501 	uint16_t	pport_cnt;	/* number of public ports */
502 	uint16_t	rport_cnt;	/* number of remote ports */
503 	uint16_t	mode;		/* type of redirect mode */
504 	uint16_t	spool_cnt;	/* num of entry in spool chain */
505 	uint16_t	spare;
506 	uint32_t	proto;		/* protocol: tcp/udp */
507 };
508 
509 /* Nat configuration data struct. */
510 struct nat44_cfg_nat {
511 	char		name[64];	/* nat name */
512 	char		if_name[64];	/* interface name */
513 	uint32_t	size;		/* structure size incl. redirs */
514 	struct in_addr	ip;		/* nat IPv4 address */
515 	uint32_t	mode;		/* aliasing mode */
516 	uint32_t	redir_cnt;	/* number of entry in spool chain */
517 };
518 
519 /* Nat command. */
520 typedef struct	_ipfw_insn_nat {
521  	ipfw_insn	o;
522  	struct cfg_nat *nat;
523 } ipfw_insn_nat;
524 
525 /* Apply ipv6 mask on ipv6 addr */
526 #define APPLY_MASK(addr,mask)                          \
527     (addr)->__u6_addr.__u6_addr32[0] &= (mask)->__u6_addr.__u6_addr32[0]; \
528     (addr)->__u6_addr.__u6_addr32[1] &= (mask)->__u6_addr.__u6_addr32[1]; \
529     (addr)->__u6_addr.__u6_addr32[2] &= (mask)->__u6_addr.__u6_addr32[2]; \
530     (addr)->__u6_addr.__u6_addr32[3] &= (mask)->__u6_addr.__u6_addr32[3];
531 
532 /* Structure for ipv6 */
533 typedef struct _ipfw_insn_ip6 {
534        ipfw_insn o;
535        struct in6_addr addr6;
536        struct in6_addr mask6;
537 } ipfw_insn_ip6;
538 
539 /* Used to support icmp6 types */
540 typedef struct _ipfw_insn_icmp6 {
541        ipfw_insn o;
542        uint32_t d[7]; /* XXX This number si related to the netinet/icmp6.h
543                        *     define ICMP6_MAXTYPE
544                        *     as follows: n = ICMP6_MAXTYPE/32 + 1
545                         *     Actually is 203
546                        */
547 } ipfw_insn_icmp6;
548 
549 /*
550  * Here we have the structure representing an ipfw rule.
551  *
552  * Layout:
553  * struct ip_fw_rule
554  * [ counter block, size = rule->cntr_len ]
555  * [ one or more instructions, size = rule->cmd_len * 4 ]
556  *
557  * It starts with a general area (with link fields).
558  * Counter block may be next (if rule->cntr_len > 0),
559  * followed by an array of one or more instructions, which the code
560  * accesses as an array of 32-bit values. rule->cmd_len represents
561  * the total instructions legth in u32 worrd, while act_ofs represents
562  * rule action offset in u32 words.
563  *
564  * When assembling instruction, remember the following:
565  *
566  *  + if a rule has a "keep-state" (or "limit") option, then the
567  *	first instruction (at r->cmd) MUST BE an O_PROBE_STATE
568  *  + if a rule has a "log" option, then the first action
569  *	(at ACTION_PTR(r)) MUST be O_LOG
570  *  + if a rule has an "altq" option, it comes after "log"
571  *  + if a rule has an O_TAG option, it comes after "log" and "altq"
572  *
573  *
574  * All structures (excluding instructions) are u64-aligned.
575  * Please keep this.
576  */
577 
578 struct ip_fw_rule {
579 	uint16_t	act_ofs;	/* offset of action in 32-bit units */
580 	uint16_t	cmd_len;	/* # of 32-bit words in cmd	*/
581 	uint16_t	spare;
582 	uint8_t		set;		/* rule set (0..31)		*/
583 	uint8_t		flags;		/* rule flags			*/
584 	uint32_t	rulenum;	/* rule number			*/
585 	uint32_t	id;		/* rule id			*/
586 
587 	ipfw_insn	cmd[1];		/* storage for commands		*/
588 };
589 #define	IPFW_RULE_NOOPT		0x01	/* Has no options in body	*/
590 
591 /* Unaligned version */
592 
593 /* Base ipfw rule counter block. */
594 struct ip_fw_bcounter {
595 	uint16_t	size;		/* Size of counter block, bytes	*/
596 	uint8_t		flags;		/* flags for given block	*/
597 	uint8_t		spare;
598 	uint32_t	timestamp;	/* tv_sec of last match		*/
599 	uint64_t	pcnt;		/* Packet counter		*/
600 	uint64_t	bcnt;		/* Byte counter			*/
601 };
602 
603 
604 #ifndef	_KERNEL
605 /*
606  * Legacy rule format
607  */
608 struct ip_fw {
609 	struct ip_fw	*x_next;	/* linked list of rules		*/
610 	struct ip_fw	*next_rule;	/* ptr to next [skipto] rule	*/
611 	/* 'next_rule' is used to pass up 'set_disable' status		*/
612 
613 	uint16_t	act_ofs;	/* offset of action in 32-bit units */
614 	uint16_t	cmd_len;	/* # of 32-bit words in cmd	*/
615 	uint16_t	rulenum;	/* rule number			*/
616 	uint8_t		set;		/* rule set (0..31)		*/
617 	uint8_t		_pad;		/* padding			*/
618 	uint32_t	id;		/* rule id */
619 
620 	/* These fields are present in all rules.			*/
621 	uint64_t	pcnt;		/* Packet counter		*/
622 	uint64_t	bcnt;		/* Byte counter			*/
623 	uint32_t	timestamp;	/* tv_sec of last match		*/
624 
625 	ipfw_insn	cmd[1];		/* storage for commands		*/
626 };
627 #endif
628 
629 #define ACTION_PTR(rule)				\
630 	(ipfw_insn *)( (u_int32_t *)((rule)->cmd) + ((rule)->act_ofs) )
631 
632 #define RULESIZE(rule)  (sizeof(*(rule)) + (rule)->cmd_len * 4 - 4)
633 
634 
635 #if 1 // should be moved to in.h
636 /*
637  * This structure is used as a flow mask and a flow id for various
638  * parts of the code.
639  * addr_type is used in userland and kernel to mark the address type.
640  * fib is used in the kernel to record the fib in use.
641  * _flags is used in the kernel to store tcp flags for dynamic rules.
642  */
643 struct ipfw_flow_id {
644 	uint32_t	dst_ip;
645 	uint32_t	src_ip;
646 	uint16_t	dst_port;
647 	uint16_t	src_port;
648 	uint8_t		fib;
649 	uint8_t		proto;
650 	uint8_t		_flags;	/* protocol-specific flags */
651 	uint8_t		addr_type; /* 4=ip4, 6=ip6, 1=ether ? */
652 	struct in6_addr dst_ip6;
653 	struct in6_addr src_ip6;
654 	uint32_t	flow_id6;
655 	uint32_t	extra; /* queue/pipe or frag_id */
656 };
657 #endif
658 
659 #define IS_IP6_FLOW_ID(id)	((id)->addr_type == 6)
660 
661 /*
662  * Dynamic ipfw rule.
663  */
664 typedef struct _ipfw_dyn_rule ipfw_dyn_rule;
665 
666 struct _ipfw_dyn_rule {
667 	ipfw_dyn_rule	*next;		/* linked list of rules.	*/
668 	struct ip_fw *rule;		/* pointer to rule		*/
669 	/* 'rule' is used to pass up the rule number (from the parent)	*/
670 
671 	ipfw_dyn_rule *parent;		/* pointer to parent rule	*/
672 	u_int64_t	pcnt;		/* packet match counter		*/
673 	u_int64_t	bcnt;		/* byte match counter		*/
674 	struct ipfw_flow_id id;		/* (masked) flow id		*/
675 	u_int32_t	expire;		/* expire time			*/
676 	u_int32_t	bucket;		/* which bucket in hash table	*/
677 	u_int32_t	state;		/* state of this rule (typically a
678 					 * combination of TCP flags)
679 					 */
680 	u_int32_t	ack_fwd;	/* most recent ACKs in forward	*/
681 	u_int32_t	ack_rev;	/* and reverse directions (used	*/
682 					/* to generate keepalives)	*/
683 	u_int16_t	dyn_type;	/* rule type			*/
684 	u_int16_t	count;		/* refcount			*/
685 };
686 
687 /*
688  * Definitions for IP option names.
689  */
690 #define	IP_FW_IPOPT_LSRR	0x01
691 #define	IP_FW_IPOPT_SSRR	0x02
692 #define	IP_FW_IPOPT_RR		0x04
693 #define	IP_FW_IPOPT_TS		0x08
694 
695 /*
696  * Definitions for TCP option names.
697  */
698 #define	IP_FW_TCPOPT_MSS	0x01
699 #define	IP_FW_TCPOPT_WINDOW	0x02
700 #define	IP_FW_TCPOPT_SACK	0x04
701 #define	IP_FW_TCPOPT_TS		0x08
702 #define	IP_FW_TCPOPT_CC		0x10
703 
704 #define	ICMP_REJECT_RST		0x100	/* fake ICMP code (send a TCP RST) */
705 #define	ICMP6_UNREACH_RST	0x100	/* fake ICMPv6 code (send a TCP RST) */
706 
707 /*
708  * These are used for lookup tables.
709  */
710 
711 #define	IPFW_TABLE_ADDR		1	/* Table for holding IPv4/IPv6 prefixes */
712 #define	IPFW_TABLE_INTERFACE	2	/* Table for holding interface names */
713 #define	IPFW_TABLE_NUMBER	3	/* Table for holding ports/uid/gid/etc */
714 #define	IPFW_TABLE_FLOW		4	/* Table for holding flow data */
715 #define	IPFW_TABLE_MAXTYPE	4	/* Maximum valid number */
716 
717 #define	IPFW_TABLE_CIDR	IPFW_TABLE_ADDR	/* compat */
718 
719 /* Value types */
720 #define	IPFW_VTYPE_LEGACY	0xFFFFFFFF	/* All data is filled in */
721 #define	IPFW_VTYPE_SKIPTO	0x00000001	/* skipto/call/callreturn */
722 #define	IPFW_VTYPE_PIPE		0x00000002	/* pipe/queue */
723 #define	IPFW_VTYPE_FIB		0x00000004	/* setfib */
724 #define	IPFW_VTYPE_NAT		0x00000008	/* nat */
725 #define	IPFW_VTYPE_DSCP		0x00000010	/* dscp */
726 #define	IPFW_VTYPE_TAG		0x00000020	/* tag/untag */
727 #define	IPFW_VTYPE_DIVERT	0x00000040	/* divert/tee */
728 #define	IPFW_VTYPE_NETGRAPH	0x00000080	/* netgraph/ngtee */
729 #define	IPFW_VTYPE_LIMIT	0x00000100	/* limit */
730 #define	IPFW_VTYPE_NH4		0x00000200	/* IPv4 nexthop */
731 #define	IPFW_VTYPE_NH6		0x00000400	/* IPv6 nexthop */
732 
733 typedef struct	_ipfw_table_entry {
734 	in_addr_t	addr;		/* network address		*/
735 	u_int32_t	value;		/* value			*/
736 	u_int16_t	tbl;		/* table number			*/
737 	u_int8_t	masklen;	/* mask length			*/
738 } ipfw_table_entry;
739 
740 typedef struct	_ipfw_table_xentry {
741 	uint16_t	len;		/* Total entry length		*/
742 	uint8_t		type;		/* entry type			*/
743 	uint8_t		masklen;	/* mask length			*/
744 	uint16_t	tbl;		/* table number			*/
745 	uint16_t	flags;		/* record flags			*/
746 	uint32_t	value;		/* value			*/
747 	union {
748 		/* Longest field needs to be aligned by 4-byte boundary	*/
749 		struct in6_addr	addr6;	/* IPv6 address 		*/
750 		char	iface[IF_NAMESIZE];	/* interface name	*/
751 	} k;
752 } ipfw_table_xentry;
753 #define	IPFW_TCF_INET	0x01		/* CIDR flags: IPv4 record	*/
754 
755 typedef struct	_ipfw_table {
756 	u_int32_t	size;		/* size of entries in bytes	*/
757 	u_int32_t	cnt;		/* # of entries			*/
758 	u_int16_t	tbl;		/* table number			*/
759 	ipfw_table_entry ent[0];	/* entries			*/
760 } ipfw_table;
761 
762 typedef struct	_ipfw_xtable {
763 	ip_fw3_opheader	opheader;	/* IP_FW3 opcode */
764 	uint32_t	size;		/* size of entries in bytes	*/
765 	uint32_t	cnt;		/* # of entries			*/
766 	uint16_t	tbl;		/* table number			*/
767 	uint8_t		type;		/* table type			*/
768 	ipfw_table_xentry xent[0];	/* entries			*/
769 } ipfw_xtable;
770 
771 typedef struct  _ipfw_obj_tlv {
772 	uint16_t        type;		/* TLV type */
773 	uint16_t	flags;		/* TLV-specific flags		*/
774 	uint32_t        length;		/* Total length, aligned to u64	*/
775 } ipfw_obj_tlv;
776 #define	IPFW_TLV_TBL_NAME	1
777 #define	IPFW_TLV_TBLNAME_LIST	2
778 #define	IPFW_TLV_RULE_LIST	3
779 #define	IPFW_TLV_DYNSTATE_LIST	4
780 #define	IPFW_TLV_TBL_ENT	5
781 #define	IPFW_TLV_DYN_ENT	6
782 #define	IPFW_TLV_RULE_ENT	7
783 #define	IPFW_TLV_TBLENT_LIST	8
784 #define	IPFW_TLV_RANGE		9
785 #define	IPFW_TLV_EACTION	10
786 
787 #define	IPFW_TLV_EACTION_BASE	1000
788 #define	IPFW_TLV_EACTION_NAME(arg)	(IPFW_TLV_EACTION_BASE + (arg))
789 
790 /* Object name TLV */
791 typedef struct _ipfw_obj_ntlv {
792 	ipfw_obj_tlv	head;		/* TLV header			*/
793 	uint16_t	idx;		/* Name index			*/
794 	uint8_t		spare;		/* unused			*/
795 	uint8_t		type;		/* object type, if applicable	*/
796 	uint32_t	set;		/* set, if applicable		*/
797 	char		name[64];	/* Null-terminated name		*/
798 } ipfw_obj_ntlv;
799 
800 /* IPv4/IPv6 L4 flow description */
801 struct tflow_entry {
802 	uint8_t		af;
803 	uint8_t		proto;
804 	uint16_t	spare;
805 	uint16_t	sport;
806 	uint16_t	dport;
807 	union {
808 		struct {
809 			struct in_addr	sip;
810 			struct in_addr	dip;
811 		} a4;
812 		struct {
813 			struct in6_addr	sip6;
814 			struct in6_addr	dip6;
815 		} a6;
816 	} a;
817 };
818 
819 typedef struct _ipfw_table_value {
820 	uint32_t	tag;		/* O_TAG/O_TAGGED */
821 	uint32_t	pipe;		/* O_PIPE/O_QUEUE */
822 	uint16_t	divert;		/* O_DIVERT/O_TEE */
823 	uint16_t	skipto;		/* skipto, CALLRET */
824 	uint32_t	netgraph;	/* O_NETGRAPH/O_NGTEE */
825 	uint32_t	fib;		/* O_SETFIB */
826 	uint32_t	nat;		/* O_NAT */
827 	uint32_t	nh4;
828 	uint8_t		dscp;
829 	uint8_t		spare0;
830 	uint16_t	spare1;
831 	struct in6_addr	nh6;
832 	uint32_t	limit;		/* O_LIMIT */
833 	uint32_t	zoneid;		/* scope zone id for nh6 */
834 	uint64_t	reserved;
835 } ipfw_table_value;
836 
837 /* Table entry TLV */
838 typedef struct	_ipfw_obj_tentry {
839 	ipfw_obj_tlv	head;		/* TLV header			*/
840 	uint8_t		subtype;	/* subtype (IPv4,IPv6)		*/
841 	uint8_t		masklen;	/* mask length			*/
842 	uint8_t		result;		/* request result		*/
843 	uint8_t		spare0;
844 	uint16_t	idx;		/* Table name index		*/
845 	uint16_t	spare1;
846 	union {
847 		/* Longest field needs to be aligned by 8-byte boundary	*/
848 		struct in_addr		addr;	/* IPv4 address		*/
849 		uint32_t		key;		/* uid/gid/port	*/
850 		struct in6_addr		addr6;	/* IPv6 address 	*/
851 		char	iface[IF_NAMESIZE];	/* interface name	*/
852 		struct tflow_entry	flow;
853 	} k;
854 	union {
855 		ipfw_table_value	value;	/* value data */
856 		uint32_t		kidx;	/* value kernel index */
857 	} v;
858 } ipfw_obj_tentry;
859 #define	IPFW_TF_UPDATE	0x01		/* Update record if exists	*/
860 /* Container TLV */
861 #define	IPFW_CTF_ATOMIC	0x01		/* Perform atomic operation	*/
862 /* Operation results */
863 #define	IPFW_TR_IGNORED		0	/* Entry was ignored (rollback)	*/
864 #define	IPFW_TR_ADDED		1	/* Entry was successfully added	*/
865 #define	IPFW_TR_UPDATED		2	/* Entry was successfully updated*/
866 #define	IPFW_TR_DELETED		3	/* Entry was successfully deleted*/
867 #define	IPFW_TR_LIMIT		4	/* Entry was ignored (limit)	*/
868 #define	IPFW_TR_NOTFOUND	5	/* Entry was not found		*/
869 #define	IPFW_TR_EXISTS		6	/* Entry already exists		*/
870 #define	IPFW_TR_ERROR		7	/* Request has failed (unknown)	*/
871 
872 typedef struct _ipfw_obj_dyntlv {
873 	ipfw_obj_tlv	head;
874 	ipfw_dyn_rule	state;
875 } ipfw_obj_dyntlv;
876 #define	IPFW_DF_LAST	0x01		/* Last state in chain		*/
877 
878 /* Containter TLVs */
879 typedef struct _ipfw_obj_ctlv {
880 	ipfw_obj_tlv	head;		/* TLV header			*/
881 	uint32_t	count;		/* Number of sub-TLVs		*/
882 	uint16_t	objsize;	/* Single object size		*/
883 	uint8_t		version;	/* TLV version			*/
884 	uint8_t		flags;		/* TLV-specific flags		*/
885 } ipfw_obj_ctlv;
886 
887 /* Range TLV */
888 typedef struct _ipfw_range_tlv {
889 	ipfw_obj_tlv	head;		/* TLV header			*/
890 	uint32_t	flags;		/* Range flags			*/
891 	uint16_t	start_rule;	/* Range start			*/
892 	uint16_t	end_rule;	/* Range end			*/
893 	uint32_t	set;		/* Range set to match		 */
894 	uint32_t	new_set;	/* New set to move/swap to	*/
895 } ipfw_range_tlv;
896 #define	IPFW_RCFLAG_RANGE	0x01	/* rule range is set		*/
897 #define	IPFW_RCFLAG_ALL		0x02	/* match ALL rules		*/
898 #define	IPFW_RCFLAG_SET		0x04	/* match rules in given set	*/
899 /* User-settable flags */
900 #define	IPFW_RCFLAG_USER	(IPFW_RCFLAG_RANGE | IPFW_RCFLAG_ALL | \
901 	IPFW_RCFLAG_SET)
902 /* Internally used flags */
903 #define	IPFW_RCFLAG_DEFAULT	0x0100	/* Do not skip defaul rule	*/
904 
905 typedef struct _ipfw_ta_tinfo {
906 	uint32_t	flags;		/* Format flags			*/
907 	uint32_t	spare;
908 	uint8_t		taclass4;	/* algorithm class		*/
909 	uint8_t		spare4;
910 	uint16_t	itemsize4;	/* item size in runtime		*/
911 	uint32_t	size4;		/* runtime structure size	*/
912 	uint32_t	count4;		/* number of items in runtime	*/
913 	uint8_t		taclass6;	/* algorithm class		*/
914 	uint8_t		spare6;
915 	uint16_t	itemsize6;	/* item size in runtime		*/
916 	uint32_t	size6;		/* runtime structure size	*/
917 	uint32_t	count6;		/* number of items in runtime	*/
918 } ipfw_ta_tinfo;
919 #define	IPFW_TACLASS_HASH	1	/* algo is based on hash	*/
920 #define	IPFW_TACLASS_ARRAY	2	/* algo is based on array	*/
921 #define	IPFW_TACLASS_RADIX	3	/* algo is based on radix tree	*/
922 
923 #define	IPFW_TATFLAGS_DATA	0x0001		/* Has data filled in	*/
924 #define	IPFW_TATFLAGS_AFDATA	0x0002		/* Separate data per AF	*/
925 #define	IPFW_TATFLAGS_AFITEM	0x0004		/* diff. items per AF	*/
926 
927 typedef struct _ipfw_xtable_info {
928 	uint8_t		type;		/* table type (addr,iface,..)	*/
929 	uint8_t		tflags;		/* type flags			*/
930 	uint16_t	mflags;		/* modification flags		*/
931 	uint16_t	flags;		/* generic table flags		*/
932 	uint16_t	spare[3];
933 	uint32_t	vmask;		/* bitmask with value types 	*/
934 	uint32_t	set;		/* set table is in		*/
935 	uint32_t	kidx;		/* kernel index			*/
936 	uint32_t	refcnt;		/* number of references		*/
937 	uint32_t	count;		/* Number of records		*/
938 	uint32_t	size;		/* Total size of records(export)*/
939 	uint32_t	limit;		/* Max number of records	*/
940 	char		tablename[64];	/* table name */
941 	char		algoname[64];	/* algorithm name		*/
942 	ipfw_ta_tinfo	ta_info;	/* additional algo stats	*/
943 } ipfw_xtable_info;
944 /* Generic table flags */
945 #define	IPFW_TGFLAGS_LOCKED	0x01	/* Tables is locked from changes*/
946 /* Table type-specific flags */
947 #define	IPFW_TFFLAG_SRCIP	0x01
948 #define	IPFW_TFFLAG_DSTIP	0x02
949 #define	IPFW_TFFLAG_SRCPORT	0x04
950 #define	IPFW_TFFLAG_DSTPORT	0x08
951 #define	IPFW_TFFLAG_PROTO	0x10
952 /* Table modification flags */
953 #define	IPFW_TMFLAGS_LIMIT	0x0002	/* Change limit value		*/
954 #define	IPFW_TMFLAGS_LOCK	0x0004	/* Change table lock state	*/
955 
956 typedef struct _ipfw_iface_info {
957 	char		ifname[64];	/* interface name		*/
958 	uint32_t	ifindex;	/* interface index		*/
959 	uint32_t	flags;		/* flags			*/
960 	uint32_t	refcnt;		/* number of references		*/
961 	uint32_t	gencnt;		/* number of changes		*/
962 	uint64_t	spare;
963 } ipfw_iface_info;
964 #define	IPFW_IFFLAG_RESOLVED	0x01	/* Interface exists		*/
965 
966 typedef struct _ipfw_ta_info {
967 	char		algoname[64];	/* algorithm name		*/
968 	uint32_t	type;		/* lookup type			*/
969 	uint32_t	flags;
970 	uint32_t	refcnt;
971 	uint32_t	spare0;
972 	uint64_t	spare1;
973 } ipfw_ta_info;
974 
975 typedef struct _ipfw_obj_header {
976 	ip_fw3_opheader	opheader;	/* IP_FW3 opcode		*/
977 	uint32_t	spare;
978 	uint16_t	idx;		/* object name index		*/
979 	uint8_t		objtype;	/* object type			*/
980 	uint8_t		objsubtype;	/* object subtype		*/
981 	ipfw_obj_ntlv	ntlv;		/* object name tlv		*/
982 } ipfw_obj_header;
983 
984 typedef struct _ipfw_obj_lheader {
985 	ip_fw3_opheader	opheader;	/* IP_FW3 opcode		*/
986 	uint32_t	set_mask;	/* disabled set mask		*/
987 	uint32_t	count;		/* Total objects count		*/
988 	uint32_t	size;		/* Total size (incl. header)	*/
989 	uint32_t	objsize;	/* Size of one object		*/
990 } ipfw_obj_lheader;
991 
992 #define	IPFW_CFG_GET_STATIC	0x01
993 #define	IPFW_CFG_GET_STATES	0x02
994 #define	IPFW_CFG_GET_COUNTERS	0x04
995 typedef struct _ipfw_cfg_lheader {
996 	ip_fw3_opheader	opheader;	/* IP_FW3 opcode		*/
997 	uint32_t	set_mask;	/* enabled set mask		*/
998 	uint32_t	spare;
999 	uint32_t	flags;		/* Request flags		*/
1000 	uint32_t	size;		/* neded buffer size		*/
1001 	uint32_t	start_rule;
1002 	uint32_t	end_rule;
1003 } ipfw_cfg_lheader;
1004 
1005 typedef struct _ipfw_range_header {
1006 	ip_fw3_opheader	opheader;	/* IP_FW3 opcode		*/
1007 	ipfw_range_tlv	range;
1008 } ipfw_range_header;
1009 
1010 typedef struct _ipfw_sopt_info {
1011 	uint16_t	opcode;
1012 	uint8_t		version;
1013 	uint8_t		dir;
1014 	uint8_t		spare;
1015 	uint64_t	refcnt;
1016 } ipfw_sopt_info;
1017 
1018 #endif /* _IPFW2_H */
1019