xref: /freebsd/sys/netinet/ip_fw.h (revision b2d48be1bc7df45ddd13b143a160d0acb5a383c5)
1 /*-
2  * Copyright (c) 2002-2009 Luigi Rizzo, Universita` di Pisa
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  * 1. Redistributions of source code must retain the above copyright
8  *    notice, this list of conditions and the following disclaimer.
9  * 2. Redistributions in binary form must reproduce the above copyright
10  *    notice, this list of conditions and the following disclaimer in the
11  *    documentation and/or other materials provided with the distribution.
12  *
13  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
14  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
16  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
17  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
18  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
19  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
20  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
21  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
22  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
23  * SUCH DAMAGE.
24  *
25  * $FreeBSD$
26  */
27 
28 #ifndef _IPFW2_H
29 #define _IPFW2_H
30 
31 /*
32  * The default rule number.  By the design of ip_fw, the default rule
33  * is the last one, so its number can also serve as the highest number
34  * allowed for a rule.  The ip_fw code relies on both meanings of this
35  * constant.
36  */
37 #define	IPFW_DEFAULT_RULE	65535
38 
39 #define	RESVD_SET		31	/*set for default and persistent rules*/
40 #define	IPFW_MAX_SETS		32	/* Number of sets supported by ipfw*/
41 
42 /*
43  * Compat values for old clients
44  */
45 #ifndef	_KERNEL
46 #define	IPFW_TABLES_MAX		65535
47 #define	IPFW_TABLES_DEFAULT	128
48 #endif
49 
50 /*
51  * Most commands (queue, pipe, tag, untag, limit...) can have a 16-bit
52  * argument between 1 and 65534. The value 0 (IP_FW_TARG) is used
53  * to represent 'tablearg' value, e.g.  indicate the use of a 'tablearg'
54  * result of the most recent table() lookup.
55  * Note that 16bit is only a historical limit, resulting from
56  * the use of a 16-bit fields for that value. In reality, we can have
57  * 2^32 pipes, queues, tag values and so on.
58  */
59 #define	IPFW_ARG_MIN		1
60 #define	IPFW_ARG_MAX		65534
61 #define IP_FW_TABLEARG		65535	/* Compat value for old clients */
62 #define	IP_FW_TARG		0	/* Current tablearg value */
63 
64 /*
65  * Number of entries in the call stack of the call/return commands.
66  * Call stack currently is an uint16_t array with rule numbers.
67  */
68 #define	IPFW_CALLSTACK_SIZE	16
69 
70 /* IP_FW3 header/opcodes */
71 typedef struct _ip_fw3_opheader {
72 	uint16_t opcode;	/* Operation opcode */
73 	uint16_t version;	/* Opcode version */
74 	uint16_t reserved[2];	/* Align to 64-bit boundary */
75 } ip_fw3_opheader;
76 
77 /* IP_FW3 opcodes */
78 #define	IP_FW_TABLE_XADD	86	/* add entry */
79 #define	IP_FW_TABLE_XDEL	87	/* delete entry */
80 #define	IP_FW_TABLE_XGETSIZE	88	/* get table size (deprecated) */
81 #define	IP_FW_TABLE_XLIST	89	/* list table contents */
82 #define	IP_FW_TABLE_XDESTROY	90	/* destroy table */
83 #define	IP_FW_TABLES_XLIST	92	/* list all tables  */
84 #define	IP_FW_TABLE_XINFO	93	/* request info for one table */
85 #define	IP_FW_TABLE_XFLUSH	94	/* flush table data */
86 #define	IP_FW_TABLE_XCREATE	95	/* create new table  */
87 #define	IP_FW_TABLE_XMODIFY	96	/* modify existing table */
88 #define	IP_FW_XGET		97	/* Retrieve configuration */
89 #define	IP_FW_XADD		98	/* add rule */
90 #define	IP_FW_XDEL		99	/* del rule */
91 #define	IP_FW_XMOVE		100	/* move rules to different set  */
92 #define	IP_FW_XZERO		101	/* clear accounting */
93 #define	IP_FW_XRESETLOG		102	/* zero rules logs */
94 #define	IP_FW_SET_SWAP		103	/* Swap between 2 sets */
95 #define	IP_FW_SET_MOVE		104	/* Move one set to another one */
96 #define	IP_FW_SET_ENABLE	105	/* Enable/disable sets */
97 #define	IP_FW_TABLE_XFIND	106	/* finds an entry */
98 #define	IP_FW_XIFLIST		107	/* list tracked interfaces */
99 #define	IP_FW_TABLES_ALIST	108	/* list table algorithms */
100 #define	IP_FW_TABLE_XSWAP	109	/* swap two tables */
101 #define	IP_FW_TABLE_VLIST	110	/* dump table value hash */
102 
103 #define	IP_FW_NAT44_XCONFIG	111	/* Create/modify NAT44 instance */
104 #define	IP_FW_NAT44_DESTROY	112	/* Destroys NAT44 instance */
105 #define	IP_FW_NAT44_XGETCONFIG	113	/* Get NAT44 instance config */
106 #define	IP_FW_NAT44_LIST_NAT	114	/* List all NAT44 instances */
107 #define	IP_FW_NAT44_XGETLOG	115	/* Get log from NAT44 instance */
108 
109 #define	IP_FW_DUMP_SOPTCODES	116	/* Dump available sopts/versions */
110 
111 /*
112  * The kernel representation of ipfw rules is made of a list of
113  * 'instructions' (for all practical purposes equivalent to BPF
114  * instructions), which specify which fields of the packet
115  * (or its metadata) should be analysed.
116  *
117  * Each instruction is stored in a structure which begins with
118  * "ipfw_insn", and can contain extra fields depending on the
119  * instruction type (listed below).
120  * Note that the code is written so that individual instructions
121  * have a size which is a multiple of 32 bits. This means that, if
122  * such structures contain pointers or other 64-bit entities,
123  * (there is just one instance now) they may end up unaligned on
124  * 64-bit architectures, so the must be handled with care.
125  *
126  * "enum ipfw_opcodes" are the opcodes supported. We can have up
127  * to 256 different opcodes. When adding new opcodes, they should
128  * be appended to the end of the opcode list before O_LAST_OPCODE,
129  * this will prevent the ABI from being broken, otherwise users
130  * will have to recompile ipfw(8) when they update the kernel.
131  */
132 
133 enum ipfw_opcodes {		/* arguments (4 byte each)	*/
134 	O_NOP,
135 
136 	O_IP_SRC,		/* u32 = IP			*/
137 	O_IP_SRC_MASK,		/* ip = IP/mask			*/
138 	O_IP_SRC_ME,		/* none				*/
139 	O_IP_SRC_SET,		/* u32=base, arg1=len, bitmap	*/
140 
141 	O_IP_DST,		/* u32 = IP			*/
142 	O_IP_DST_MASK,		/* ip = IP/mask			*/
143 	O_IP_DST_ME,		/* none				*/
144 	O_IP_DST_SET,		/* u32=base, arg1=len, bitmap	*/
145 
146 	O_IP_SRCPORT,		/* (n)port list:mask 4 byte ea	*/
147 	O_IP_DSTPORT,		/* (n)port list:mask 4 byte ea	*/
148 	O_PROTO,		/* arg1=protocol		*/
149 
150 	O_MACADDR2,		/* 2 mac addr:mask		*/
151 	O_MAC_TYPE,		/* same as srcport		*/
152 
153 	O_LAYER2,		/* none				*/
154 	O_IN,			/* none				*/
155 	O_FRAG,			/* none				*/
156 
157 	O_RECV,			/* none				*/
158 	O_XMIT,			/* none				*/
159 	O_VIA,			/* none				*/
160 
161 	O_IPOPT,		/* arg1 = 2*u8 bitmap		*/
162 	O_IPLEN,		/* arg1 = len			*/
163 	O_IPID,			/* arg1 = id			*/
164 
165 	O_IPTOS,		/* arg1 = id			*/
166 	O_IPPRECEDENCE,		/* arg1 = precedence << 5	*/
167 	O_IPTTL,		/* arg1 = TTL			*/
168 
169 	O_IPVER,		/* arg1 = version		*/
170 	O_UID,			/* u32 = id			*/
171 	O_GID,			/* u32 = id			*/
172 	O_ESTAB,		/* none (tcp established)	*/
173 	O_TCPFLAGS,		/* arg1 = 2*u8 bitmap		*/
174 	O_TCPWIN,		/* arg1 = desired win		*/
175 	O_TCPSEQ,		/* u32 = desired seq.		*/
176 	O_TCPACK,		/* u32 = desired seq.		*/
177 	O_ICMPTYPE,		/* u32 = icmp bitmap		*/
178 	O_TCPOPTS,		/* arg1 = 2*u8 bitmap		*/
179 
180 	O_VERREVPATH,		/* none				*/
181 	O_VERSRCREACH,		/* none				*/
182 
183 	O_PROBE_STATE,		/* none				*/
184 	O_KEEP_STATE,		/* none				*/
185 	O_LIMIT,		/* ipfw_insn_limit		*/
186 	O_LIMIT_PARENT,		/* dyn_type, not an opcode.	*/
187 
188 	/*
189 	 * These are really 'actions'.
190 	 */
191 
192 	O_LOG,			/* ipfw_insn_log		*/
193 	O_PROB,			/* u32 = match probability	*/
194 
195 	O_CHECK_STATE,		/* none				*/
196 	O_ACCEPT,		/* none				*/
197 	O_DENY,			/* none 			*/
198 	O_REJECT,		/* arg1=icmp arg (same as deny)	*/
199 	O_COUNT,		/* none				*/
200 	O_SKIPTO,		/* arg1=next rule number	*/
201 	O_PIPE,			/* arg1=pipe number		*/
202 	O_QUEUE,		/* arg1=queue number		*/
203 	O_DIVERT,		/* arg1=port number		*/
204 	O_TEE,			/* arg1=port number		*/
205 	O_FORWARD_IP,		/* fwd sockaddr			*/
206 	O_FORWARD_MAC,		/* fwd mac			*/
207 	O_NAT,                  /* nope                         */
208 	O_REASS,                /* none                         */
209 
210 	/*
211 	 * More opcodes.
212 	 */
213 	O_IPSEC,		/* has ipsec history 		*/
214 	O_IP_SRC_LOOKUP,	/* arg1=table number, u32=value	*/
215 	O_IP_DST_LOOKUP,	/* arg1=table number, u32=value	*/
216 	O_ANTISPOOF,		/* none				*/
217 	O_JAIL,			/* u32 = id			*/
218 	O_ALTQ,			/* u32 = altq classif. qid	*/
219 	O_DIVERTED,		/* arg1=bitmap (1:loop, 2:out)	*/
220 	O_TCPDATALEN,		/* arg1 = tcp data len		*/
221 	O_IP6_SRC,		/* address without mask		*/
222 	O_IP6_SRC_ME,		/* my addresses			*/
223 	O_IP6_SRC_MASK,		/* address with the mask	*/
224 	O_IP6_DST,
225 	O_IP6_DST_ME,
226 	O_IP6_DST_MASK,
227 	O_FLOW6ID,		/* for flow id tag in the ipv6 pkt */
228 	O_ICMP6TYPE,		/* icmp6 packet type filtering	*/
229 	O_EXT_HDR,		/* filtering for ipv6 extension header */
230 	O_IP6,
231 
232 	/*
233 	 * actions for ng_ipfw
234 	 */
235 	O_NETGRAPH,		/* send to ng_ipfw		*/
236 	O_NGTEE,		/* copy to ng_ipfw		*/
237 
238 	O_IP4,
239 
240 	O_UNREACH6,		/* arg1=icmpv6 code arg (deny)  */
241 
242 	O_TAG,   		/* arg1=tag number */
243 	O_TAGGED,		/* arg1=tag number */
244 
245 	O_SETFIB,		/* arg1=FIB number */
246 	O_FIB,			/* arg1=FIB desired fib number */
247 
248 	O_SOCKARG,		/* socket argument */
249 
250 	O_CALLRETURN,		/* arg1=called rule number */
251 
252 	O_FORWARD_IP6,		/* fwd sockaddr_in6             */
253 
254 	O_DSCP,			/* 2 u32 = DSCP mask */
255 	O_SETDSCP,		/* arg1=DSCP value */
256 	O_IP_FLOW_LOOKUP,	/* arg1=table number, u32=value	*/
257 
258 	O_LAST_OPCODE		/* not an opcode!		*/
259 };
260 
261 
262 /*
263  * The extension header are filtered only for presence using a bit
264  * vector with a flag for each header.
265  */
266 #define EXT_FRAGMENT	0x1
267 #define EXT_HOPOPTS	0x2
268 #define EXT_ROUTING	0x4
269 #define EXT_AH		0x8
270 #define EXT_ESP		0x10
271 #define EXT_DSTOPTS	0x20
272 #define EXT_RTHDR0		0x40
273 #define EXT_RTHDR2		0x80
274 
275 /*
276  * Template for instructions.
277  *
278  * ipfw_insn is used for all instructions which require no operands,
279  * a single 16-bit value (arg1), or a couple of 8-bit values.
280  *
281  * For other instructions which require different/larger arguments
282  * we have derived structures, ipfw_insn_*.
283  *
284  * The size of the instruction (in 32-bit words) is in the low
285  * 6 bits of "len". The 2 remaining bits are used to implement
286  * NOT and OR on individual instructions. Given a type, you can
287  * compute the length to be put in "len" using F_INSN_SIZE(t)
288  *
289  * F_NOT	negates the match result of the instruction.
290  *
291  * F_OR		is used to build or blocks. By default, instructions
292  *		are evaluated as part of a logical AND. An "or" block
293  *		{ X or Y or Z } contains F_OR set in all but the last
294  *		instruction of the block. A match will cause the code
295  *		to skip past the last instruction of the block.
296  *
297  * NOTA BENE: in a couple of places we assume that
298  *	sizeof(ipfw_insn) == sizeof(u_int32_t)
299  * this needs to be fixed.
300  *
301  */
302 typedef struct	_ipfw_insn {	/* template for instructions */
303 	u_int8_t 	opcode;
304 	u_int8_t	len;	/* number of 32-bit words */
305 #define	F_NOT		0x80
306 #define	F_OR		0x40
307 #define	F_LEN_MASK	0x3f
308 #define	F_LEN(cmd)	((cmd)->len & F_LEN_MASK)
309 
310 	u_int16_t	arg1;
311 } ipfw_insn;
312 
313 /*
314  * The F_INSN_SIZE(type) computes the size, in 4-byte words, of
315  * a given type.
316  */
317 #define	F_INSN_SIZE(t)	((sizeof (t))/sizeof(u_int32_t))
318 
319 /*
320  * This is used to store an array of 16-bit entries (ports etc.)
321  */
322 typedef struct	_ipfw_insn_u16 {
323 	ipfw_insn o;
324 	u_int16_t ports[2];	/* there may be more */
325 } ipfw_insn_u16;
326 
327 /*
328  * This is used to store an array of 32-bit entries
329  * (uid, single IPv4 addresses etc.)
330  */
331 typedef struct	_ipfw_insn_u32 {
332 	ipfw_insn o;
333 	u_int32_t d[1];	/* one or more */
334 } ipfw_insn_u32;
335 
336 /*
337  * This is used to store IP addr-mask pairs.
338  */
339 typedef struct	_ipfw_insn_ip {
340 	ipfw_insn o;
341 	struct in_addr	addr;
342 	struct in_addr	mask;
343 } ipfw_insn_ip;
344 
345 /*
346  * This is used to forward to a given address (ip).
347  */
348 typedef struct  _ipfw_insn_sa {
349 	ipfw_insn o;
350 	struct sockaddr_in sa;
351 } ipfw_insn_sa;
352 
353 /*
354  * This is used to forward to a given address (ipv6).
355  */
356 typedef struct _ipfw_insn_sa6 {
357 	ipfw_insn o;
358 	struct sockaddr_in6 sa;
359 } ipfw_insn_sa6;
360 
361 /*
362  * This is used for MAC addr-mask pairs.
363  */
364 typedef struct	_ipfw_insn_mac {
365 	ipfw_insn o;
366 	u_char addr[12];	/* dst[6] + src[6] */
367 	u_char mask[12];	/* dst[6] + src[6] */
368 } ipfw_insn_mac;
369 
370 /*
371  * This is used for interface match rules (recv xx, xmit xx).
372  */
373 typedef struct	_ipfw_insn_if {
374 	ipfw_insn o;
375 	union {
376 		struct in_addr ip;
377 		int glob;
378 		uint16_t kidx;
379 	} p;
380 	char name[IFNAMSIZ];
381 } ipfw_insn_if;
382 
383 /*
384  * This is used for storing an altq queue id number.
385  */
386 typedef struct _ipfw_insn_altq {
387 	ipfw_insn	o;
388 	u_int32_t	qid;
389 } ipfw_insn_altq;
390 
391 /*
392  * This is used for limit rules.
393  */
394 typedef struct	_ipfw_insn_limit {
395 	ipfw_insn o;
396 	u_int8_t _pad;
397 	u_int8_t limit_mask;	/* combination of DYN_* below	*/
398 #define	DYN_SRC_ADDR	0x1
399 #define	DYN_SRC_PORT	0x2
400 #define	DYN_DST_ADDR	0x4
401 #define	DYN_DST_PORT	0x8
402 
403 	u_int16_t conn_limit;
404 } ipfw_insn_limit;
405 
406 /*
407  * This is used for log instructions.
408  */
409 typedef struct  _ipfw_insn_log {
410         ipfw_insn o;
411 	u_int32_t max_log;	/* how many do we log -- 0 = all */
412 	u_int32_t log_left;	/* how many left to log 	*/
413 } ipfw_insn_log;
414 
415 /* Legacy NAT structures, compat only */
416 #ifndef	_KERNEL
417 /*
418  * Data structures required by both ipfw(8) and ipfw(4) but not part of the
419  * management API are protected by IPFW_INTERNAL.
420  */
421 #ifdef IPFW_INTERNAL
422 /* Server pool support (LSNAT). */
423 struct cfg_spool {
424 	LIST_ENTRY(cfg_spool)   _next;          /* chain of spool instances */
425 	struct in_addr          addr;
426 	u_short                 port;
427 };
428 #endif
429 
430 /* Redirect modes id. */
431 #define REDIR_ADDR      0x01
432 #define REDIR_PORT      0x02
433 #define REDIR_PROTO     0x04
434 
435 #ifdef IPFW_INTERNAL
436 /* Nat redirect configuration. */
437 struct cfg_redir {
438 	LIST_ENTRY(cfg_redir)   _next;          /* chain of redir instances */
439 	u_int16_t               mode;           /* type of redirect mode */
440 	struct in_addr	        laddr;          /* local ip address */
441 	struct in_addr	        paddr;          /* public ip address */
442 	struct in_addr	        raddr;          /* remote ip address */
443 	u_short                 lport;          /* local port */
444 	u_short                 pport;          /* public port */
445 	u_short                 rport;          /* remote port  */
446 	u_short                 pport_cnt;      /* number of public ports */
447 	u_short                 rport_cnt;      /* number of remote ports */
448 	int                     proto;          /* protocol: tcp/udp */
449 	struct alias_link       **alink;
450 	/* num of entry in spool chain */
451 	u_int16_t               spool_cnt;
452 	/* chain of spool instances */
453 	LIST_HEAD(spool_chain, cfg_spool) spool_chain;
454 };
455 #endif
456 
457 #ifdef IPFW_INTERNAL
458 /* Nat configuration data struct. */
459 struct cfg_nat {
460 	/* chain of nat instances */
461 	LIST_ENTRY(cfg_nat)     _next;
462 	int                     id;                     /* nat id */
463 	struct in_addr          ip;                     /* nat ip address */
464 	char                    if_name[IF_NAMESIZE];   /* interface name */
465 	int                     mode;                   /* aliasing mode */
466 	struct libalias	        *lib;                   /* libalias instance */
467 	/* number of entry in spool chain */
468 	int                     redir_cnt;
469 	/* chain of redir instances */
470 	LIST_HEAD(redir_chain, cfg_redir) redir_chain;
471 };
472 #endif
473 
474 #define SOF_NAT         sizeof(struct cfg_nat)
475 #define SOF_REDIR       sizeof(struct cfg_redir)
476 #define SOF_SPOOL       sizeof(struct cfg_spool)
477 
478 #endif	/* ifndef _KERNEL */
479 
480 
481 struct nat44_cfg_spool {
482 	struct in_addr	addr;
483 	uint16_t	port;
484 	uint16_t	spare;
485 };
486 #define NAT44_REDIR_ADDR	0x01
487 #define NAT44_REDIR_PORT	0x02
488 #define NAT44_REDIR_PROTO	0x04
489 
490 /* Nat redirect configuration. */
491 struct nat44_cfg_redir {
492 	struct in_addr	laddr;		/* local ip address */
493 	struct in_addr	paddr;		/* public ip address */
494 	struct in_addr	raddr;		/* remote ip address */
495 	uint16_t	lport;		/* local port */
496 	uint16_t	pport;		/* public port */
497 	uint16_t	rport;		/* remote port  */
498 	uint16_t	pport_cnt;	/* number of public ports */
499 	uint16_t	rport_cnt;	/* number of remote ports */
500 	uint16_t	mode;		/* type of redirect mode */
501 	uint16_t	spool_cnt;	/* num of entry in spool chain */
502 	uint16_t	spare;
503 	uint32_t	proto;		/* protocol: tcp/udp */
504 };
505 
506 /* Nat configuration data struct. */
507 struct nat44_cfg_nat {
508 	char		name[64];	/* nat name */
509 	char		if_name[64];	/* interface name */
510 	uint32_t	size;		/* structure size incl. redirs */
511 	struct in_addr	ip;		/* nat IPv4 address */
512 	uint32_t	mode;		/* aliasing mode */
513 	uint32_t	redir_cnt;	/* number of entry in spool chain */
514 };
515 
516 /* Nat command. */
517 typedef struct	_ipfw_insn_nat {
518  	ipfw_insn	o;
519  	struct cfg_nat *nat;
520 } ipfw_insn_nat;
521 
522 /* Apply ipv6 mask on ipv6 addr */
523 #define APPLY_MASK(addr,mask)                          \
524     (addr)->__u6_addr.__u6_addr32[0] &= (mask)->__u6_addr.__u6_addr32[0]; \
525     (addr)->__u6_addr.__u6_addr32[1] &= (mask)->__u6_addr.__u6_addr32[1]; \
526     (addr)->__u6_addr.__u6_addr32[2] &= (mask)->__u6_addr.__u6_addr32[2]; \
527     (addr)->__u6_addr.__u6_addr32[3] &= (mask)->__u6_addr.__u6_addr32[3];
528 
529 /* Structure for ipv6 */
530 typedef struct _ipfw_insn_ip6 {
531        ipfw_insn o;
532        struct in6_addr addr6;
533        struct in6_addr mask6;
534 } ipfw_insn_ip6;
535 
536 /* Used to support icmp6 types */
537 typedef struct _ipfw_insn_icmp6 {
538        ipfw_insn o;
539        uint32_t d[7]; /* XXX This number si related to the netinet/icmp6.h
540                        *     define ICMP6_MAXTYPE
541                        *     as follows: n = ICMP6_MAXTYPE/32 + 1
542                         *     Actually is 203
543                        */
544 } ipfw_insn_icmp6;
545 
546 /*
547  * Here we have the structure representing an ipfw rule.
548  *
549  * Layout:
550  * struct ip_fw_rule
551  * [ counter block, size = rule->cntr_len ]
552  * [ one or more instructions, size = rule->cmd_len * 4 ]
553  *
554  * It starts with a general area (with link fields).
555  * Counter block may be next (if rule->cntr_len > 0),
556  * followed by an array of one or more instructions, which the code
557  * accesses as an array of 32-bit values. rule->cmd_len represents
558  * the total instructions legth in u32 worrd, while act_ofs represents
559  * rule action offset in u32 words.
560  *
561  * When assembling instruction, remember the following:
562  *
563  *  + if a rule has a "keep-state" (or "limit") option, then the
564  *	first instruction (at r->cmd) MUST BE an O_PROBE_STATE
565  *  + if a rule has a "log" option, then the first action
566  *	(at ACTION_PTR(r)) MUST be O_LOG
567  *  + if a rule has an "altq" option, it comes after "log"
568  *  + if a rule has an O_TAG option, it comes after "log" and "altq"
569  *
570  *
571  * All structures (excluding instructions) are u64-aligned.
572  * Please keep this.
573  */
574 
575 struct ip_fw_rule {
576 	uint16_t	act_ofs;	/* offset of action in 32-bit units */
577 	uint16_t	cmd_len;	/* # of 32-bit words in cmd	*/
578 	uint16_t	spare;
579 	uint8_t		set;		/* rule set (0..31)		*/
580 	uint8_t		flags;		/* rule flags			*/
581 	uint32_t	rulenum;	/* rule number			*/
582 	uint32_t	id;		/* rule id			*/
583 
584 	ipfw_insn	cmd[1];		/* storage for commands		*/
585 };
586 #define	IPFW_RULE_NOOPT		0x01	/* Has no options in body	*/
587 
588 /* Unaligned version */
589 
590 /* Base ipfw rule counter block. */
591 struct ip_fw_bcounter {
592 	uint16_t	size;		/* Size of counter block, bytes	*/
593 	uint8_t		flags;		/* flags for given block	*/
594 	uint8_t		spare;
595 	uint32_t	timestamp;	/* tv_sec of last match		*/
596 	uint64_t	pcnt;		/* Packet counter		*/
597 	uint64_t	bcnt;		/* Byte counter			*/
598 };
599 
600 
601 #ifndef	_KERNEL
602 /*
603  * Legacy rule format
604  */
605 struct ip_fw {
606 	struct ip_fw	*x_next;	/* linked list of rules		*/
607 	struct ip_fw	*next_rule;	/* ptr to next [skipto] rule	*/
608 	/* 'next_rule' is used to pass up 'set_disable' status		*/
609 
610 	uint16_t	act_ofs;	/* offset of action in 32-bit units */
611 	uint16_t	cmd_len;	/* # of 32-bit words in cmd	*/
612 	uint16_t	rulenum;	/* rule number			*/
613 	uint8_t		set;		/* rule set (0..31)		*/
614 	uint8_t		_pad;		/* padding			*/
615 	uint32_t	id;		/* rule id */
616 
617 	/* These fields are present in all rules.			*/
618 	uint64_t	pcnt;		/* Packet counter		*/
619 	uint64_t	bcnt;		/* Byte counter			*/
620 	uint32_t	timestamp;	/* tv_sec of last match		*/
621 
622 	ipfw_insn	cmd[1];		/* storage for commands		*/
623 };
624 #endif
625 
626 #define ACTION_PTR(rule)				\
627 	(ipfw_insn *)( (u_int32_t *)((rule)->cmd) + ((rule)->act_ofs) )
628 
629 #define RULESIZE(rule)  (sizeof(*(rule)) + (rule)->cmd_len * 4 - 4)
630 
631 
632 #if 1 // should be moved to in.h
633 /*
634  * This structure is used as a flow mask and a flow id for various
635  * parts of the code.
636  * addr_type is used in userland and kernel to mark the address type.
637  * fib is used in the kernel to record the fib in use.
638  * _flags is used in the kernel to store tcp flags for dynamic rules.
639  */
640 struct ipfw_flow_id {
641 	uint32_t	dst_ip;
642 	uint32_t	src_ip;
643 	uint16_t	dst_port;
644 	uint16_t	src_port;
645 	uint8_t		fib;
646 	uint8_t		proto;
647 	uint8_t		_flags;	/* protocol-specific flags */
648 	uint8_t		addr_type; /* 4=ip4, 6=ip6, 1=ether ? */
649 	struct in6_addr dst_ip6;
650 	struct in6_addr src_ip6;
651 	uint32_t	flow_id6;
652 	uint32_t	extra; /* queue/pipe or frag_id */
653 };
654 #endif
655 
656 #define IS_IP6_FLOW_ID(id)	((id)->addr_type == 6)
657 
658 /*
659  * Dynamic ipfw rule.
660  */
661 typedef struct _ipfw_dyn_rule ipfw_dyn_rule;
662 
663 struct _ipfw_dyn_rule {
664 	ipfw_dyn_rule	*next;		/* linked list of rules.	*/
665 	struct ip_fw *rule;		/* pointer to rule		*/
666 	/* 'rule' is used to pass up the rule number (from the parent)	*/
667 
668 	ipfw_dyn_rule *parent;		/* pointer to parent rule	*/
669 	u_int64_t	pcnt;		/* packet match counter		*/
670 	u_int64_t	bcnt;		/* byte match counter		*/
671 	struct ipfw_flow_id id;		/* (masked) flow id		*/
672 	u_int32_t	expire;		/* expire time			*/
673 	u_int32_t	bucket;		/* which bucket in hash table	*/
674 	u_int32_t	state;		/* state of this rule (typically a
675 					 * combination of TCP flags)
676 					 */
677 	u_int32_t	ack_fwd;	/* most recent ACKs in forward	*/
678 	u_int32_t	ack_rev;	/* and reverse directions (used	*/
679 					/* to generate keepalives)	*/
680 	u_int16_t	dyn_type;	/* rule type			*/
681 	u_int16_t	count;		/* refcount			*/
682 };
683 
684 /*
685  * Definitions for IP option names.
686  */
687 #define	IP_FW_IPOPT_LSRR	0x01
688 #define	IP_FW_IPOPT_SSRR	0x02
689 #define	IP_FW_IPOPT_RR		0x04
690 #define	IP_FW_IPOPT_TS		0x08
691 
692 /*
693  * Definitions for TCP option names.
694  */
695 #define	IP_FW_TCPOPT_MSS	0x01
696 #define	IP_FW_TCPOPT_WINDOW	0x02
697 #define	IP_FW_TCPOPT_SACK	0x04
698 #define	IP_FW_TCPOPT_TS		0x08
699 #define	IP_FW_TCPOPT_CC		0x10
700 
701 #define	ICMP_REJECT_RST		0x100	/* fake ICMP code (send a TCP RST) */
702 #define	ICMP6_UNREACH_RST	0x100	/* fake ICMPv6 code (send a TCP RST) */
703 
704 /*
705  * These are used for lookup tables.
706  */
707 
708 #define	IPFW_TABLE_ADDR		1	/* Table for holding IPv4/IPv6 prefixes */
709 #define	IPFW_TABLE_INTERFACE	2	/* Table for holding interface names */
710 #define	IPFW_TABLE_NUMBER	3	/* Table for holding ports/uid/gid/etc */
711 #define	IPFW_TABLE_FLOW		4	/* Table for holding flow data */
712 #define	IPFW_TABLE_MAXTYPE	4	/* Maximum valid number */
713 
714 #define	IPFW_TABLE_CIDR	IPFW_TABLE_ADDR	/* compat */
715 
716 /* Value types */
717 #define	IPFW_VTYPE_LEGACY	0xFFFFFFFF	/* All data is filled in */
718 #define	IPFW_VTYPE_SKIPTO	0x00000001	/* skipto/call/callreturn */
719 #define	IPFW_VTYPE_PIPE		0x00000002	/* pipe/queue */
720 #define	IPFW_VTYPE_FIB		0x00000004	/* setfib */
721 #define	IPFW_VTYPE_NAT		0x00000008	/* nat */
722 #define	IPFW_VTYPE_DSCP		0x00000010	/* dscp */
723 #define	IPFW_VTYPE_TAG		0x00000020	/* tag/untag */
724 #define	IPFW_VTYPE_DIVERT	0x00000040	/* divert/tee */
725 #define	IPFW_VTYPE_NETGRAPH	0x00000080	/* netgraph/ngtee */
726 #define	IPFW_VTYPE_LIMIT	0x00000100	/* limit */
727 #define	IPFW_VTYPE_NH4		0x00000200	/* IPv4 nexthop */
728 #define	IPFW_VTYPE_NH6		0x00000400	/* IPv6 nexthop */
729 
730 typedef struct	_ipfw_table_entry {
731 	in_addr_t	addr;		/* network address		*/
732 	u_int32_t	value;		/* value			*/
733 	u_int16_t	tbl;		/* table number			*/
734 	u_int8_t	masklen;	/* mask length			*/
735 } ipfw_table_entry;
736 
737 typedef struct	_ipfw_table_xentry {
738 	uint16_t	len;		/* Total entry length		*/
739 	uint8_t		type;		/* entry type			*/
740 	uint8_t		masklen;	/* mask length			*/
741 	uint16_t	tbl;		/* table number			*/
742 	uint16_t	flags;		/* record flags			*/
743 	uint32_t	value;		/* value			*/
744 	union {
745 		/* Longest field needs to be aligned by 4-byte boundary	*/
746 		struct in6_addr	addr6;	/* IPv6 address 		*/
747 		char	iface[IF_NAMESIZE];	/* interface name	*/
748 	} k;
749 } ipfw_table_xentry;
750 #define	IPFW_TCF_INET	0x01		/* CIDR flags: IPv4 record	*/
751 
752 typedef struct	_ipfw_table {
753 	u_int32_t	size;		/* size of entries in bytes	*/
754 	u_int32_t	cnt;		/* # of entries			*/
755 	u_int16_t	tbl;		/* table number			*/
756 	ipfw_table_entry ent[0];	/* entries			*/
757 } ipfw_table;
758 
759 typedef struct	_ipfw_xtable {
760 	ip_fw3_opheader	opheader;	/* IP_FW3 opcode */
761 	uint32_t	size;		/* size of entries in bytes	*/
762 	uint32_t	cnt;		/* # of entries			*/
763 	uint16_t	tbl;		/* table number			*/
764 	uint8_t		type;		/* table type			*/
765 	ipfw_table_xentry xent[0];	/* entries			*/
766 } ipfw_xtable;
767 
768 typedef struct  _ipfw_obj_tlv {
769 	uint16_t        type;		/* TLV type */
770 	uint16_t	flags;		/* TLV-specific flags		*/
771 	uint32_t        length;		/* Total length, aligned to u64	*/
772 } ipfw_obj_tlv;
773 #define	IPFW_TLV_TBL_NAME	1
774 #define	IPFW_TLV_TBLNAME_LIST	2
775 #define	IPFW_TLV_RULE_LIST	3
776 #define	IPFW_TLV_DYNSTATE_LIST	4
777 #define	IPFW_TLV_TBL_ENT	5
778 #define	IPFW_TLV_DYN_ENT	6
779 #define	IPFW_TLV_RULE_ENT	7
780 #define	IPFW_TLV_TBLENT_LIST	8
781 #define	IPFW_TLV_RANGE		9
782 
783 /* Object name TLV */
784 typedef struct _ipfw_obj_ntlv {
785 	ipfw_obj_tlv	head;		/* TLV header			*/
786 	uint16_t	idx;		/* Name index			*/
787 	uint8_t		spare;		/* unused			*/
788 	uint8_t		type;		/* object type, if applicable	*/
789 	uint32_t	set;		/* set, if applicable		*/
790 	char		name[64];	/* Null-terminated name		*/
791 } ipfw_obj_ntlv;
792 
793 /* IPv4/IPv6 L4 flow description */
794 struct tflow_entry {
795 	uint8_t		af;
796 	uint8_t		proto;
797 	uint16_t	spare;
798 	uint16_t	sport;
799 	uint16_t	dport;
800 	union {
801 		struct {
802 			struct in_addr	sip;
803 			struct in_addr	dip;
804 		} a4;
805 		struct {
806 			struct in6_addr	sip6;
807 			struct in6_addr	dip6;
808 		} a6;
809 	} a;
810 };
811 
812 typedef struct _ipfw_table_value {
813 	uint32_t	tag;		/* O_TAG/O_TAGGED */
814 	uint32_t	pipe;		/* O_PIPE/O_QUEUE */
815 	uint16_t	divert;		/* O_DIVERT/O_TEE */
816 	uint16_t	skipto;		/* skipto, CALLRET */
817 	uint32_t	netgraph;	/* O_NETGRAPH/O_NGTEE */
818 	uint32_t	fib;		/* O_SETFIB */
819 	uint32_t	nat;		/* O_NAT */
820 	uint32_t	nh4;
821 	uint8_t		dscp;
822 	uint8_t		spare0;
823 	uint16_t	spare1;
824 	struct in6_addr	nh6;
825 	uint32_t	limit;		/* O_LIMIT */
826 	uint32_t	zoneid;		/* scope zone id for nh6 */
827 	uint64_t	reserved;
828 } ipfw_table_value;
829 
830 /* Table entry TLV */
831 typedef struct	_ipfw_obj_tentry {
832 	ipfw_obj_tlv	head;		/* TLV header			*/
833 	uint8_t		subtype;	/* subtype (IPv4,IPv6)		*/
834 	uint8_t		masklen;	/* mask length			*/
835 	uint8_t		result;		/* request result		*/
836 	uint8_t		spare0;
837 	uint16_t	idx;		/* Table name index		*/
838 	uint16_t	spare1;
839 	union {
840 		/* Longest field needs to be aligned by 8-byte boundary	*/
841 		struct in_addr		addr;	/* IPv4 address		*/
842 		uint32_t		key;		/* uid/gid/port	*/
843 		struct in6_addr		addr6;	/* IPv6 address 	*/
844 		char	iface[IF_NAMESIZE];	/* interface name	*/
845 		struct tflow_entry	flow;
846 	} k;
847 	union {
848 		ipfw_table_value	value;	/* value data */
849 		uint32_t		kidx;	/* value kernel index */
850 	} v;
851 } ipfw_obj_tentry;
852 #define	IPFW_TF_UPDATE	0x01		/* Update record if exists	*/
853 /* Container TLV */
854 #define	IPFW_CTF_ATOMIC	0x01		/* Perform atomic operation	*/
855 /* Operation results */
856 #define	IPFW_TR_IGNORED		0	/* Entry was ignored (rollback)	*/
857 #define	IPFW_TR_ADDED		1	/* Entry was succesfully added	*/
858 #define	IPFW_TR_UPDATED		2	/* Entry was succesfully updated*/
859 #define	IPFW_TR_DELETED		3	/* Entry was succesfully deleted*/
860 #define	IPFW_TR_LIMIT		4	/* Entry was ignored (limit)	*/
861 #define	IPFW_TR_NOTFOUND	5	/* Entry was not found		*/
862 #define	IPFW_TR_EXISTS		6	/* Entry already exists		*/
863 #define	IPFW_TR_ERROR		7	/* Request has failed (unknown)	*/
864 
865 typedef struct _ipfw_obj_dyntlv {
866 	ipfw_obj_tlv	head;
867 	ipfw_dyn_rule	state;
868 } ipfw_obj_dyntlv;
869 #define	IPFW_DF_LAST	0x01		/* Last state in chain		*/
870 
871 /* Containter TLVs */
872 typedef struct _ipfw_obj_ctlv {
873 	ipfw_obj_tlv	head;		/* TLV header			*/
874 	uint32_t	count;		/* Number of sub-TLVs		*/
875 	uint16_t	objsize;	/* Single object size		*/
876 	uint8_t		version;	/* TLV version			*/
877 	uint8_t		flags;		/* TLV-specific flags		*/
878 } ipfw_obj_ctlv;
879 
880 /* Range TLV */
881 typedef struct _ipfw_range_tlv {
882 	ipfw_obj_tlv	head;		/* TLV header			*/
883 	uint32_t	flags;		/* Range flags			*/
884 	uint16_t	start_rule;	/* Range start			*/
885 	uint16_t	end_rule;	/* Range end			*/
886 	uint32_t	set;		/* Range set to match		 */
887 	uint32_t	new_set;	/* New set to move/swap to	*/
888 } ipfw_range_tlv;
889 #define	IPFW_RCFLAG_RANGE	0x01	/* rule range is set		*/
890 #define	IPFW_RCFLAG_ALL		0x02	/* match ALL rules		*/
891 #define	IPFW_RCFLAG_SET		0x04	/* match rules in given set	*/
892 /* User-settable flags */
893 #define	IPFW_RCFLAG_USER	(IPFW_RCFLAG_RANGE | IPFW_RCFLAG_ALL | \
894 	IPFW_RCFLAG_SET)
895 /* Internally used flags */
896 #define	IPFW_RCFLAG_DEFAULT	0x0100	/* Do not skip defaul rule	*/
897 
898 typedef struct _ipfw_ta_tinfo {
899 	uint32_t	flags;		/* Format flags			*/
900 	uint32_t	spare;
901 	uint8_t		taclass4;	/* algorithm class		*/
902 	uint8_t		spare4;
903 	uint16_t	itemsize4;	/* item size in runtime		*/
904 	uint32_t	size4;		/* runtime structure size	*/
905 	uint32_t	count4;		/* number of items in runtime	*/
906 	uint8_t		taclass6;	/* algorithm class		*/
907 	uint8_t		spare6;
908 	uint16_t	itemsize6;	/* item size in runtime		*/
909 	uint32_t	size6;		/* runtime structure size	*/
910 	uint32_t	count6;		/* number of items in runtime	*/
911 } ipfw_ta_tinfo;
912 #define	IPFW_TACLASS_HASH	1	/* algo is based on hash	*/
913 #define	IPFW_TACLASS_ARRAY	2	/* algo is based on array	*/
914 #define	IPFW_TACLASS_RADIX	3	/* algo is based on radix tree	*/
915 
916 #define	IPFW_TATFLAGS_DATA	0x0001		/* Has data filled in	*/
917 #define	IPFW_TATFLAGS_AFDATA	0x0002		/* Separate data per AF	*/
918 #define	IPFW_TATFLAGS_AFITEM	0x0004		/* diff. items per AF	*/
919 
920 typedef struct _ipfw_xtable_info {
921 	uint8_t		type;		/* table type (addr,iface,..)	*/
922 	uint8_t		tflags;		/* type flags			*/
923 	uint16_t	mflags;		/* modification flags		*/
924 	uint16_t	flags;		/* generic table flags		*/
925 	uint16_t	spare[3];
926 	uint32_t	vmask;		/* bitmask with value types 	*/
927 	uint32_t	set;		/* set table is in		*/
928 	uint32_t	kidx;		/* kernel index			*/
929 	uint32_t	refcnt;		/* number of references		*/
930 	uint32_t	count;		/* Number of records		*/
931 	uint32_t	size;		/* Total size of records(export)*/
932 	uint32_t	limit;		/* Max number of records	*/
933 	char		tablename[64];	/* table name */
934 	char		algoname[64];	/* algorithm name		*/
935 	ipfw_ta_tinfo	ta_info;	/* additional algo stats	*/
936 } ipfw_xtable_info;
937 /* Generic table flags */
938 #define	IPFW_TGFLAGS_LOCKED	0x01	/* Tables is locked from changes*/
939 /* Table type-specific flags */
940 #define	IPFW_TFFLAG_SRCIP	0x01
941 #define	IPFW_TFFLAG_DSTIP	0x02
942 #define	IPFW_TFFLAG_SRCPORT	0x04
943 #define	IPFW_TFFLAG_DSTPORT	0x08
944 #define	IPFW_TFFLAG_PROTO	0x10
945 /* Table modification flags */
946 #define	IPFW_TMFLAGS_LIMIT	0x0002	/* Change limit value		*/
947 #define	IPFW_TMFLAGS_LOCK	0x0004	/* Change table lock state	*/
948 
949 typedef struct _ipfw_iface_info {
950 	char		ifname[64];	/* interface name		*/
951 	uint32_t	ifindex;	/* interface index		*/
952 	uint32_t	flags;		/* flags			*/
953 	uint32_t	refcnt;		/* number of references		*/
954 	uint32_t	gencnt;		/* number of changes		*/
955 	uint64_t	spare;
956 } ipfw_iface_info;
957 #define	IPFW_IFFLAG_RESOLVED	0x01	/* Interface exists		*/
958 
959 typedef struct _ipfw_ta_info {
960 	char		algoname[64];	/* algorithm name		*/
961 	uint32_t	type;		/* lookup type			*/
962 	uint32_t	flags;
963 	uint32_t	refcnt;
964 	uint32_t	spare0;
965 	uint64_t	spare1;
966 } ipfw_ta_info;
967 
968 typedef struct _ipfw_obj_header {
969 	ip_fw3_opheader	opheader;	/* IP_FW3 opcode		*/
970 	uint32_t	spare;
971 	uint16_t	idx;		/* object name index		*/
972 	uint8_t		objtype;	/* object type			*/
973 	uint8_t		objsubtype;	/* object subtype		*/
974 	ipfw_obj_ntlv	ntlv;		/* object name tlv		*/
975 } ipfw_obj_header;
976 
977 typedef struct _ipfw_obj_lheader {
978 	ip_fw3_opheader	opheader;	/* IP_FW3 opcode		*/
979 	uint32_t	set_mask;	/* disabled set mask		*/
980 	uint32_t	count;		/* Total objects count		*/
981 	uint32_t	size;		/* Total size (incl. header)	*/
982 	uint32_t	objsize;	/* Size of one object		*/
983 } ipfw_obj_lheader;
984 
985 #define	IPFW_CFG_GET_STATIC	0x01
986 #define	IPFW_CFG_GET_STATES	0x02
987 #define	IPFW_CFG_GET_COUNTERS	0x04
988 typedef struct _ipfw_cfg_lheader {
989 	ip_fw3_opheader	opheader;	/* IP_FW3 opcode		*/
990 	uint32_t	set_mask;	/* enabled set mask		*/
991 	uint32_t	spare;
992 	uint32_t	flags;		/* Request flags		*/
993 	uint32_t	size;		/* neded buffer size		*/
994 	uint32_t	start_rule;
995 	uint32_t	end_rule;
996 } ipfw_cfg_lheader;
997 
998 typedef struct _ipfw_range_header {
999 	ip_fw3_opheader	opheader;	/* IP_FW3 opcode		*/
1000 	ipfw_range_tlv	range;
1001 } ipfw_range_header;
1002 
1003 typedef struct _ipfw_sopt_info {
1004 	uint16_t	opcode;
1005 	uint8_t		version;
1006 	uint8_t		dir;
1007 	uint8_t		spare;
1008 	uint64_t	refcnt;
1009 } ipfw_sopt_info;
1010 
1011 #endif /* _IPFW2_H */
1012