xref: /freebsd/sys/netinet/ip_fw.h (revision 9a14aa017b21c292740c00ee098195cd46642730)
1 /*-
2  * Copyright (c) 2002-2009 Luigi Rizzo, Universita` di Pisa
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  * 1. Redistributions of source code must retain the above copyright
8  *    notice, this list of conditions and the following disclaimer.
9  * 2. Redistributions in binary form must reproduce the above copyright
10  *    notice, this list of conditions and the following disclaimer in the
11  *    documentation and/or other materials provided with the distribution.
12  *
13  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
14  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
16  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
17  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
18  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
19  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
20  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
21  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
22  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
23  * SUCH DAMAGE.
24  *
25  * $FreeBSD$
26  */
27 
28 #ifndef _IPFW2_H
29 #define _IPFW2_H
30 
31 /*
32  * The default rule number.  By the design of ip_fw, the default rule
33  * is the last one, so its number can also serve as the highest number
34  * allowed for a rule.  The ip_fw code relies on both meanings of this
35  * constant.
36  */
37 #define	IPFW_DEFAULT_RULE	65535
38 
39 /*
40  * The number of ipfw tables.  The maximum allowed table number is the
41  * (IPFW_TABLES_MAX - 1).
42  */
43 #define	IPFW_TABLES_MAX		128
44 
45 /*
46  * Most commands (queue, pipe, tag, untag, limit...) can have a 16-bit
47  * argument between 1 and 65534. The value 0 is unused, the value
48  * 65535 (IP_FW_TABLEARG) is used to represent 'tablearg', i.e. the
49  * can be 1..65534, or 65535 to indicate the use of a 'tablearg'
50  * result of the most recent table() lookup.
51  * Note that 16bit is only a historical limit, resulting from
52  * the use of a 16-bit fields for that value. In reality, we can have
53  * 2^32 pipes, queues, tag values and so on, and use 0 as a tablearg.
54  */
55 #define	IPFW_ARG_MIN		1
56 #define	IPFW_ARG_MAX		65534
57 #define IP_FW_TABLEARG		65535	/* XXX should use 0 */
58 
59 /*
60  * Number of entries in the call stack of the call/return commands.
61  * Call stack currently is an uint16_t array with rule numbers.
62  */
63 #define	IPFW_CALLSTACK_SIZE	16
64 
65 /*
66  * The kernel representation of ipfw rules is made of a list of
67  * 'instructions' (for all practical purposes equivalent to BPF
68  * instructions), which specify which fields of the packet
69  * (or its metadata) should be analysed.
70  *
71  * Each instruction is stored in a structure which begins with
72  * "ipfw_insn", and can contain extra fields depending on the
73  * instruction type (listed below).
74  * Note that the code is written so that individual instructions
75  * have a size which is a multiple of 32 bits. This means that, if
76  * such structures contain pointers or other 64-bit entities,
77  * (there is just one instance now) they may end up unaligned on
78  * 64-bit architectures, so the must be handled with care.
79  *
80  * "enum ipfw_opcodes" are the opcodes supported. We can have up
81  * to 256 different opcodes. When adding new opcodes, they should
82  * be appended to the end of the opcode list before O_LAST_OPCODE,
83  * this will prevent the ABI from being broken, otherwise users
84  * will have to recompile ipfw(8) when they update the kernel.
85  */
86 
87 enum ipfw_opcodes {		/* arguments (4 byte each)	*/
88 	O_NOP,
89 
90 	O_IP_SRC,		/* u32 = IP			*/
91 	O_IP_SRC_MASK,		/* ip = IP/mask			*/
92 	O_IP_SRC_ME,		/* none				*/
93 	O_IP_SRC_SET,		/* u32=base, arg1=len, bitmap	*/
94 
95 	O_IP_DST,		/* u32 = IP			*/
96 	O_IP_DST_MASK,		/* ip = IP/mask			*/
97 	O_IP_DST_ME,		/* none				*/
98 	O_IP_DST_SET,		/* u32=base, arg1=len, bitmap	*/
99 
100 	O_IP_SRCPORT,		/* (n)port list:mask 4 byte ea	*/
101 	O_IP_DSTPORT,		/* (n)port list:mask 4 byte ea	*/
102 	O_PROTO,		/* arg1=protocol		*/
103 
104 	O_MACADDR2,		/* 2 mac addr:mask		*/
105 	O_MAC_TYPE,		/* same as srcport		*/
106 
107 	O_LAYER2,		/* none				*/
108 	O_IN,			/* none				*/
109 	O_FRAG,			/* none				*/
110 
111 	O_RECV,			/* none				*/
112 	O_XMIT,			/* none				*/
113 	O_VIA,			/* none				*/
114 
115 	O_IPOPT,		/* arg1 = 2*u8 bitmap		*/
116 	O_IPLEN,		/* arg1 = len			*/
117 	O_IPID,			/* arg1 = id			*/
118 
119 	O_IPTOS,		/* arg1 = id			*/
120 	O_IPPRECEDENCE,		/* arg1 = precedence << 5	*/
121 	O_IPTTL,		/* arg1 = TTL			*/
122 
123 	O_IPVER,		/* arg1 = version		*/
124 	O_UID,			/* u32 = id			*/
125 	O_GID,			/* u32 = id			*/
126 	O_ESTAB,		/* none (tcp established)	*/
127 	O_TCPFLAGS,		/* arg1 = 2*u8 bitmap		*/
128 	O_TCPWIN,		/* arg1 = desired win		*/
129 	O_TCPSEQ,		/* u32 = desired seq.		*/
130 	O_TCPACK,		/* u32 = desired seq.		*/
131 	O_ICMPTYPE,		/* u32 = icmp bitmap		*/
132 	O_TCPOPTS,		/* arg1 = 2*u8 bitmap		*/
133 
134 	O_VERREVPATH,		/* none				*/
135 	O_VERSRCREACH,		/* none				*/
136 
137 	O_PROBE_STATE,		/* none				*/
138 	O_KEEP_STATE,		/* none				*/
139 	O_LIMIT,		/* ipfw_insn_limit		*/
140 	O_LIMIT_PARENT,		/* dyn_type, not an opcode.	*/
141 
142 	/*
143 	 * These are really 'actions'.
144 	 */
145 
146 	O_LOG,			/* ipfw_insn_log		*/
147 	O_PROB,			/* u32 = match probability	*/
148 
149 	O_CHECK_STATE,		/* none				*/
150 	O_ACCEPT,		/* none				*/
151 	O_DENY,			/* none 			*/
152 	O_REJECT,		/* arg1=icmp arg (same as deny)	*/
153 	O_COUNT,		/* none				*/
154 	O_SKIPTO,		/* arg1=next rule number	*/
155 	O_PIPE,			/* arg1=pipe number		*/
156 	O_QUEUE,		/* arg1=queue number		*/
157 	O_DIVERT,		/* arg1=port number		*/
158 	O_TEE,			/* arg1=port number		*/
159 	O_FORWARD_IP,		/* fwd sockaddr			*/
160 	O_FORWARD_MAC,		/* fwd mac			*/
161 	O_NAT,                  /* nope                         */
162 	O_REASS,                /* none                         */
163 
164 	/*
165 	 * More opcodes.
166 	 */
167 	O_IPSEC,		/* has ipsec history 		*/
168 	O_IP_SRC_LOOKUP,	/* arg1=table number, u32=value	*/
169 	O_IP_DST_LOOKUP,	/* arg1=table number, u32=value	*/
170 	O_ANTISPOOF,		/* none				*/
171 	O_JAIL,			/* u32 = id			*/
172 	O_ALTQ,			/* u32 = altq classif. qid	*/
173 	O_DIVERTED,		/* arg1=bitmap (1:loop, 2:out)	*/
174 	O_TCPDATALEN,		/* arg1 = tcp data len		*/
175 	O_IP6_SRC,		/* address without mask		*/
176 	O_IP6_SRC_ME,		/* my addresses			*/
177 	O_IP6_SRC_MASK,		/* address with the mask	*/
178 	O_IP6_DST,
179 	O_IP6_DST_ME,
180 	O_IP6_DST_MASK,
181 	O_FLOW6ID,		/* for flow id tag in the ipv6 pkt */
182 	O_ICMP6TYPE,		/* icmp6 packet type filtering	*/
183 	O_EXT_HDR,		/* filtering for ipv6 extension header */
184 	O_IP6,
185 
186 	/*
187 	 * actions for ng_ipfw
188 	 */
189 	O_NETGRAPH,		/* send to ng_ipfw		*/
190 	O_NGTEE,		/* copy to ng_ipfw		*/
191 
192 	O_IP4,
193 
194 	O_UNREACH6,		/* arg1=icmpv6 code arg (deny)  */
195 
196 	O_TAG,   		/* arg1=tag number */
197 	O_TAGGED,		/* arg1=tag number */
198 
199 	O_SETFIB,		/* arg1=FIB number */
200 	O_FIB,			/* arg1=FIB desired fib number */
201 
202 	O_SOCKARG,		/* socket argument */
203 
204 	O_CALLRETURN,		/* arg1=called rule number */
205 
206 	O_FORWARD_IP6,		/* fwd sockaddr_in6             */
207 
208 	O_LAST_OPCODE		/* not an opcode!		*/
209 };
210 
211 
212 /*
213  * The extension header are filtered only for presence using a bit
214  * vector with a flag for each header.
215  */
216 #define EXT_FRAGMENT	0x1
217 #define EXT_HOPOPTS	0x2
218 #define EXT_ROUTING	0x4
219 #define EXT_AH		0x8
220 #define EXT_ESP		0x10
221 #define EXT_DSTOPTS	0x20
222 #define EXT_RTHDR0		0x40
223 #define EXT_RTHDR2		0x80
224 
225 /*
226  * Template for instructions.
227  *
228  * ipfw_insn is used for all instructions which require no operands,
229  * a single 16-bit value (arg1), or a couple of 8-bit values.
230  *
231  * For other instructions which require different/larger arguments
232  * we have derived structures, ipfw_insn_*.
233  *
234  * The size of the instruction (in 32-bit words) is in the low
235  * 6 bits of "len". The 2 remaining bits are used to implement
236  * NOT and OR on individual instructions. Given a type, you can
237  * compute the length to be put in "len" using F_INSN_SIZE(t)
238  *
239  * F_NOT	negates the match result of the instruction.
240  *
241  * F_OR		is used to build or blocks. By default, instructions
242  *		are evaluated as part of a logical AND. An "or" block
243  *		{ X or Y or Z } contains F_OR set in all but the last
244  *		instruction of the block. A match will cause the code
245  *		to skip past the last instruction of the block.
246  *
247  * NOTA BENE: in a couple of places we assume that
248  *	sizeof(ipfw_insn) == sizeof(u_int32_t)
249  * this needs to be fixed.
250  *
251  */
252 typedef struct	_ipfw_insn {	/* template for instructions */
253 	u_int8_t 	opcode;
254 	u_int8_t	len;	/* number of 32-bit words */
255 #define	F_NOT		0x80
256 #define	F_OR		0x40
257 #define	F_LEN_MASK	0x3f
258 #define	F_LEN(cmd)	((cmd)->len & F_LEN_MASK)
259 
260 	u_int16_t	arg1;
261 } ipfw_insn;
262 
263 /*
264  * The F_INSN_SIZE(type) computes the size, in 4-byte words, of
265  * a given type.
266  */
267 #define	F_INSN_SIZE(t)	((sizeof (t))/sizeof(u_int32_t))
268 
269 /*
270  * This is used to store an array of 16-bit entries (ports etc.)
271  */
272 typedef struct	_ipfw_insn_u16 {
273 	ipfw_insn o;
274 	u_int16_t ports[2];	/* there may be more */
275 } ipfw_insn_u16;
276 
277 /*
278  * This is used to store an array of 32-bit entries
279  * (uid, single IPv4 addresses etc.)
280  */
281 typedef struct	_ipfw_insn_u32 {
282 	ipfw_insn o;
283 	u_int32_t d[1];	/* one or more */
284 } ipfw_insn_u32;
285 
286 /*
287  * This is used to store IP addr-mask pairs.
288  */
289 typedef struct	_ipfw_insn_ip {
290 	ipfw_insn o;
291 	struct in_addr	addr;
292 	struct in_addr	mask;
293 } ipfw_insn_ip;
294 
295 /*
296  * This is used to forward to a given address (ip).
297  */
298 typedef struct  _ipfw_insn_sa {
299 	ipfw_insn o;
300 	struct sockaddr_in sa;
301 } ipfw_insn_sa;
302 
303 /*
304  * This is used to forward to a given address (ipv6).
305  */
306 typedef struct _ipfw_insn_sa6 {
307 	ipfw_insn o;
308 	struct sockaddr_in6 sa;
309 } ipfw_insn_sa6;
310 
311 /*
312  * This is used for MAC addr-mask pairs.
313  */
314 typedef struct	_ipfw_insn_mac {
315 	ipfw_insn o;
316 	u_char addr[12];	/* dst[6] + src[6] */
317 	u_char mask[12];	/* dst[6] + src[6] */
318 } ipfw_insn_mac;
319 
320 /*
321  * This is used for interface match rules (recv xx, xmit xx).
322  */
323 typedef struct	_ipfw_insn_if {
324 	ipfw_insn o;
325 	union {
326 		struct in_addr ip;
327 		int glob;
328 	} p;
329 	char name[IFNAMSIZ];
330 } ipfw_insn_if;
331 
332 /*
333  * This is used for storing an altq queue id number.
334  */
335 typedef struct _ipfw_insn_altq {
336 	ipfw_insn	o;
337 	u_int32_t	qid;
338 } ipfw_insn_altq;
339 
340 /*
341  * This is used for limit rules.
342  */
343 typedef struct	_ipfw_insn_limit {
344 	ipfw_insn o;
345 	u_int8_t _pad;
346 	u_int8_t limit_mask;	/* combination of DYN_* below	*/
347 #define	DYN_SRC_ADDR	0x1
348 #define	DYN_SRC_PORT	0x2
349 #define	DYN_DST_ADDR	0x4
350 #define	DYN_DST_PORT	0x8
351 
352 	u_int16_t conn_limit;
353 } ipfw_insn_limit;
354 
355 /*
356  * This is used for log instructions.
357  */
358 typedef struct  _ipfw_insn_log {
359         ipfw_insn o;
360 	u_int32_t max_log;	/* how many do we log -- 0 = all */
361 	u_int32_t log_left;	/* how many left to log 	*/
362 } ipfw_insn_log;
363 
364 /*
365  * Data structures required by both ipfw(8) and ipfw(4) but not part of the
366  * management API are protected by IPFW_INTERNAL.
367  */
368 #ifdef IPFW_INTERNAL
369 /* Server pool support (LSNAT). */
370 struct cfg_spool {
371 	LIST_ENTRY(cfg_spool)   _next;          /* chain of spool instances */
372 	struct in_addr          addr;
373 	u_short                 port;
374 };
375 #endif
376 
377 /* Redirect modes id. */
378 #define REDIR_ADDR      0x01
379 #define REDIR_PORT      0x02
380 #define REDIR_PROTO     0x04
381 
382 #ifdef IPFW_INTERNAL
383 /* Nat redirect configuration. */
384 struct cfg_redir {
385 	LIST_ENTRY(cfg_redir)   _next;          /* chain of redir instances */
386 	u_int16_t               mode;           /* type of redirect mode */
387 	struct in_addr	        laddr;          /* local ip address */
388 	struct in_addr	        paddr;          /* public ip address */
389 	struct in_addr	        raddr;          /* remote ip address */
390 	u_short                 lport;          /* local port */
391 	u_short                 pport;          /* public port */
392 	u_short                 rport;          /* remote port  */
393 	u_short                 pport_cnt;      /* number of public ports */
394 	u_short                 rport_cnt;      /* number of remote ports */
395 	int                     proto;          /* protocol: tcp/udp */
396 	struct alias_link       **alink;
397 	/* num of entry in spool chain */
398 	u_int16_t               spool_cnt;
399 	/* chain of spool instances */
400 	LIST_HEAD(spool_chain, cfg_spool) spool_chain;
401 };
402 #endif
403 
404 #ifdef IPFW_INTERNAL
405 /* Nat configuration data struct. */
406 struct cfg_nat {
407 	/* chain of nat instances */
408 	LIST_ENTRY(cfg_nat)     _next;
409 	int                     id;                     /* nat id */
410 	struct in_addr          ip;                     /* nat ip address */
411 	char                    if_name[IF_NAMESIZE];   /* interface name */
412 	int                     mode;                   /* aliasing mode */
413 	struct libalias	        *lib;                   /* libalias instance */
414 	/* number of entry in spool chain */
415 	int                     redir_cnt;
416 	/* chain of redir instances */
417 	LIST_HEAD(redir_chain, cfg_redir) redir_chain;
418 };
419 #endif
420 
421 #define SOF_NAT         sizeof(struct cfg_nat)
422 #define SOF_REDIR       sizeof(struct cfg_redir)
423 #define SOF_SPOOL       sizeof(struct cfg_spool)
424 
425 /* Nat command. */
426 typedef struct	_ipfw_insn_nat {
427  	ipfw_insn	o;
428  	struct cfg_nat *nat;
429 } ipfw_insn_nat;
430 
431 /* Apply ipv6 mask on ipv6 addr */
432 #define APPLY_MASK(addr,mask)                          \
433     (addr)->__u6_addr.__u6_addr32[0] &= (mask)->__u6_addr.__u6_addr32[0]; \
434     (addr)->__u6_addr.__u6_addr32[1] &= (mask)->__u6_addr.__u6_addr32[1]; \
435     (addr)->__u6_addr.__u6_addr32[2] &= (mask)->__u6_addr.__u6_addr32[2]; \
436     (addr)->__u6_addr.__u6_addr32[3] &= (mask)->__u6_addr.__u6_addr32[3];
437 
438 /* Structure for ipv6 */
439 typedef struct _ipfw_insn_ip6 {
440        ipfw_insn o;
441        struct in6_addr addr6;
442        struct in6_addr mask6;
443 } ipfw_insn_ip6;
444 
445 /* Used to support icmp6 types */
446 typedef struct _ipfw_insn_icmp6 {
447        ipfw_insn o;
448        uint32_t d[7]; /* XXX This number si related to the netinet/icmp6.h
449                        *     define ICMP6_MAXTYPE
450                        *     as follows: n = ICMP6_MAXTYPE/32 + 1
451                         *     Actually is 203
452                        */
453 } ipfw_insn_icmp6;
454 
455 /*
456  * Here we have the structure representing an ipfw rule.
457  *
458  * It starts with a general area (with link fields and counters)
459  * followed by an array of one or more instructions, which the code
460  * accesses as an array of 32-bit values.
461  *
462  * Given a rule pointer  r:
463  *
464  *  r->cmd		is the start of the first instruction.
465  *  ACTION_PTR(r)	is the start of the first action (things to do
466  *			once a rule matched).
467  *
468  * When assembling instruction, remember the following:
469  *
470  *  + if a rule has a "keep-state" (or "limit") option, then the
471  *	first instruction (at r->cmd) MUST BE an O_PROBE_STATE
472  *  + if a rule has a "log" option, then the first action
473  *	(at ACTION_PTR(r)) MUST be O_LOG
474  *  + if a rule has an "altq" option, it comes after "log"
475  *  + if a rule has an O_TAG option, it comes after "log" and "altq"
476  *
477  * NOTE: we use a simple linked list of rules because we never need
478  * 	to delete a rule without scanning the list. We do not use
479  *	queue(3) macros for portability and readability.
480  */
481 
482 struct ip_fw {
483 	struct ip_fw	*x_next;	/* linked list of rules		*/
484 	struct ip_fw	*next_rule;	/* ptr to next [skipto] rule	*/
485 	/* 'next_rule' is used to pass up 'set_disable' status		*/
486 
487 	uint16_t	act_ofs;	/* offset of action in 32-bit units */
488 	uint16_t	cmd_len;	/* # of 32-bit words in cmd	*/
489 	uint16_t	rulenum;	/* rule number			*/
490 	uint8_t	set;		/* rule set (0..31)		*/
491 #define	RESVD_SET	31	/* set for default and persistent rules */
492 	uint8_t		_pad;		/* padding			*/
493 	uint32_t	id;		/* rule id */
494 
495 	/* These fields are present in all rules.			*/
496 	uint64_t	pcnt;		/* Packet counter		*/
497 	uint64_t	bcnt;		/* Byte counter			*/
498 	uint32_t	timestamp;	/* tv_sec of last match		*/
499 
500 	ipfw_insn	cmd[1];		/* storage for commands		*/
501 };
502 
503 #define ACTION_PTR(rule)				\
504 	(ipfw_insn *)( (u_int32_t *)((rule)->cmd) + ((rule)->act_ofs) )
505 
506 #define RULESIZE(rule)  (sizeof(struct ip_fw) + \
507 	((struct ip_fw *)(rule))->cmd_len * 4 - 4)
508 
509 #if 1 // should be moved to in.h
510 /*
511  * This structure is used as a flow mask and a flow id for various
512  * parts of the code.
513  * addr_type is used in userland and kernel to mark the address type.
514  * fib is used in the kernel to record the fib in use.
515  * _flags is used in the kernel to store tcp flags for dynamic rules.
516  */
517 struct ipfw_flow_id {
518 	uint32_t	dst_ip;
519 	uint32_t	src_ip;
520 	uint16_t	dst_port;
521 	uint16_t	src_port;
522 	uint8_t		fib;
523 	uint8_t		proto;
524 	uint8_t		_flags;	/* protocol-specific flags */
525 	uint8_t		addr_type; /* 4=ip4, 6=ip6, 1=ether ? */
526 	struct in6_addr dst_ip6;
527 	struct in6_addr src_ip6;
528 	uint32_t	flow_id6;
529 	uint32_t	extra; /* queue/pipe or frag_id */
530 };
531 #endif
532 
533 #define IS_IP6_FLOW_ID(id)	((id)->addr_type == 6)
534 
535 /*
536  * Dynamic ipfw rule.
537  */
538 typedef struct _ipfw_dyn_rule ipfw_dyn_rule;
539 
540 struct _ipfw_dyn_rule {
541 	ipfw_dyn_rule	*next;		/* linked list of rules.	*/
542 	struct ip_fw *rule;		/* pointer to rule		*/
543 	/* 'rule' is used to pass up the rule number (from the parent)	*/
544 
545 	ipfw_dyn_rule *parent;		/* pointer to parent rule	*/
546 	u_int64_t	pcnt;		/* packet match counter		*/
547 	u_int64_t	bcnt;		/* byte match counter		*/
548 	struct ipfw_flow_id id;		/* (masked) flow id		*/
549 	u_int32_t	expire;		/* expire time			*/
550 	u_int32_t	bucket;		/* which bucket in hash table	*/
551 	u_int32_t	state;		/* state of this rule (typically a
552 					 * combination of TCP flags)
553 					 */
554 	u_int32_t	ack_fwd;	/* most recent ACKs in forward	*/
555 	u_int32_t	ack_rev;	/* and reverse directions (used	*/
556 					/* to generate keepalives)	*/
557 	u_int16_t	dyn_type;	/* rule type			*/
558 	u_int16_t	count;		/* refcount			*/
559 };
560 
561 /*
562  * Definitions for IP option names.
563  */
564 #define	IP_FW_IPOPT_LSRR	0x01
565 #define	IP_FW_IPOPT_SSRR	0x02
566 #define	IP_FW_IPOPT_RR		0x04
567 #define	IP_FW_IPOPT_TS		0x08
568 
569 /*
570  * Definitions for TCP option names.
571  */
572 #define	IP_FW_TCPOPT_MSS	0x01
573 #define	IP_FW_TCPOPT_WINDOW	0x02
574 #define	IP_FW_TCPOPT_SACK	0x04
575 #define	IP_FW_TCPOPT_TS		0x08
576 #define	IP_FW_TCPOPT_CC		0x10
577 
578 #define	ICMP_REJECT_RST		0x100	/* fake ICMP code (send a TCP RST) */
579 #define	ICMP6_UNREACH_RST	0x100	/* fake ICMPv6 code (send a TCP RST) */
580 
581 /*
582  * These are used for lookup tables.
583  */
584 typedef struct	_ipfw_table_entry {
585 	in_addr_t	addr;		/* network address		*/
586 	u_int32_t	value;		/* value			*/
587 	u_int16_t	tbl;		/* table number			*/
588 	u_int8_t	masklen;	/* mask length			*/
589 } ipfw_table_entry;
590 
591 typedef struct	_ipfw_table {
592 	u_int32_t	size;		/* size of entries in bytes	*/
593 	u_int32_t	cnt;		/* # of entries			*/
594 	u_int16_t	tbl;		/* table number			*/
595 	ipfw_table_entry ent[0];	/* entries			*/
596 } ipfw_table;
597 
598 #endif /* _IPFW2_H */
599