1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2023 Alexander V. Chernikov <melifaro@FreeBSD.org> 5 * Copyright (c) 2023 Rubicon Communications, LLC (Netgate) 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 * 28 */ 29 30 #ifndef _NETPFIL_PF_PF_NL_H_ 31 #define _NETPFIL_PF_PF_NL_H_ 32 33 /* Genetlink family */ 34 #define PFNL_FAMILY_NAME "pfctl" 35 36 /* available commands */ 37 enum { 38 PFNL_CMD_UNSPEC = 0, 39 PFNL_CMD_GETSTATES = 1, 40 PFNL_CMD_GETCREATORS = 2, 41 PFNL_CMD_START = 3, 42 PFNL_CMD_STOP = 4, 43 PFNL_CMD_ADDRULE = 5, 44 PFNL_CMD_GETRULES = 6, 45 PFNL_CMD_GETRULE = 7, 46 PFNL_CMD_CLRSTATES = 8, 47 PFNL_CMD_KILLSTATES = 9, 48 PFNL_CMD_SET_STATUSIF = 10, 49 PFNL_CMD_GET_STATUS = 11, 50 PFNL_CMD_CLEAR_STATUS = 12, 51 PFNL_CMD_NATLOOK = 13, 52 PFNL_CMD_SET_DEBUG = 14, 53 PFNL_CMD_SET_TIMEOUT = 15, 54 PFNL_CMD_GET_TIMEOUT = 16, 55 PFNL_CMD_SET_LIMIT = 17, 56 PFNL_CMD_GET_LIMIT = 18, 57 PFNL_CMD_BEGIN_ADDRS = 19, 58 PFNL_CMD_ADD_ADDR = 20, 59 PFNL_CMD_GET_ADDRS = 21, 60 PFNL_CMD_GET_ADDR = 22, 61 PFNL_CMD_GET_RULESETS = 23, 62 PFNL_CMD_GET_RULESET = 24, 63 PFNL_CMD_GET_SRCNODES = 25, 64 __PFNL_CMD_MAX, 65 }; 66 #define PFNL_CMD_MAX (__PFNL_CMD_MAX -1) 67 68 enum pfstate_key_type_t { 69 PF_STK_UNSPEC, 70 PF_STK_ADDR0 = 1, /* ip */ 71 PF_STK_ADDR1 = 2, /* ip */ 72 PF_STK_PORT0 = 3, /* u16 */ 73 PF_STK_PORT1 = 4, /* u16 */ 74 }; 75 76 enum pfstate_peer_type_t { 77 PF_STP_UNSPEC, 78 PF_STP_PFSS_FLAGS = 1, /* u16 */ 79 PF_STP_PFSS_TTL = 2, /* u8 */ 80 PF_STP_SCRUB_FLAG = 3, /* u8 */ 81 PF_STP_PFSS_TS_MOD = 4, /* u32 */ 82 PF_STP_SEQLO = 5, /* u32 */ 83 PF_STP_SEQHI = 6, /* u32 */ 84 PF_STP_SEQDIFF = 7, /* u32 */ 85 PF_STP_MAX_WIN = 8, /* u16 */ 86 PF_STP_MSS = 9, /* u16 */ 87 PF_STP_STATE = 10, /* u8 */ 88 PF_STP_WSCALE = 11, /* u8 */ 89 }; 90 91 enum pfstate_type_t { 92 PF_ST_UNSPEC, 93 PF_ST_ID = 1, /* u32, state id */ 94 PF_ST_CREATORID = 2, /* u32, */ 95 PF_ST_IFNAME = 3, /* string */ 96 PF_ST_ORIG_IFNAME = 4, /* string */ 97 PF_ST_KEY_WIRE = 5, /* nested, pfstate_key_type_t */ 98 PF_ST_KEY_STACK = 6, /* nested, pfstate_key_type_t */ 99 PF_ST_PEER_SRC = 7, /* nested, pfstate_peer_type_t*/ 100 PF_ST_PEER_DST = 8, /* nested, pfstate_peer_type_t */ 101 PF_ST_RT_ADDR = 9, /* ip */ 102 PF_ST_RULE = 10, /* u32 */ 103 PF_ST_ANCHOR = 11, /* u32 */ 104 PF_ST_NAT_RULE = 12, /* u32 */ 105 PF_ST_CREATION = 13, /* u32 */ 106 PF_ST_EXPIRE = 14, /* u32 */ 107 PF_ST_PACKETS0 = 15, /* u64 */ 108 PF_ST_PACKETS1 = 16, /* u64 */ 109 PF_ST_BYTES0 = 17, /* u64 */ 110 PF_ST_BYTES1 = 18, /* u64 */ 111 PF_ST_AF = 19, /* u8 */ 112 PF_ST_PROTO = 21, /* u8 */ 113 PF_ST_DIRECTION = 22, /* u8 */ 114 PF_ST_LOG = 23, /* u8 */ 115 PF_ST_TIMEOUT = 24, /* u8 */ 116 PF_ST_STATE_FLAGS = 25, /* u8 */ 117 PF_ST_SYNC_FLAGS = 26, /* u8 */ 118 PF_ST_UPDATES = 27, /* u8 */ 119 PF_ST_VERSION = 28, /* u64 */ 120 PF_ST_FILTER_ADDR = 29, /* in6_addr */ 121 PF_ST_FILTER_MASK = 30, /* in6_addr */ 122 PF_ST_RTABLEID = 31, /* i32 */ 123 PF_ST_MIN_TTL = 32, /* u8 */ 124 PF_ST_MAX_MSS = 33, /* u16 */ 125 PF_ST_DNPIPE = 34, /* u16 */ 126 PF_ST_DNRPIPE = 35, /* u16 */ 127 PF_ST_RT = 36, /* u8 */ 128 PF_ST_RT_IFNAME = 37, /* string */ 129 }; 130 131 enum pf_addr_type_t { 132 PF_AT_UNSPEC, 133 PF_AT_ADDR = 1, /* in6_addr */ 134 PF_AT_MASK = 2, /* in6_addr */ 135 PF_AT_IFNAME = 3, /* string */ 136 PF_AT_TABLENAME = 4, /* string */ 137 PF_AT_TYPE = 5, /* u8 */ 138 PF_AT_IFLAGS = 6, /* u8 */ 139 PF_AT_TBLCNT = 7, /* u32 */ 140 PF_AT_DYNCNT = 8, /* u32 */ 141 }; 142 143 enum pfrule_addr_type_t { 144 PF_RAT_UNSPEC, 145 PF_RAT_ADDR = 1, /* nested, pf_addr_type_t */ 146 PF_RAT_SRC_PORT = 2, /* u16 */ 147 PF_RAT_DST_PORT = 3, /* u16 */ 148 PF_RAT_NEG = 4, /* u8 */ 149 PF_RAT_OP = 5, /* u8 */ 150 }; 151 152 enum pf_labels_type_t { 153 PF_LT_UNSPEC, 154 PF_LT_LABEL = 1, /* string */ 155 }; 156 157 enum pf_mape_portset_type_t 158 { 159 PF_MET_UNSPEC, 160 PF_MET_OFFSET = 1, /* u8 */ 161 PF_MET_PSID_LEN = 2, /* u8 */ 162 PF_MET_PSID = 3, /* u16 */ 163 }; 164 165 enum pf_rpool_type_t 166 { 167 PF_PT_UNSPEC, 168 PF_PT_KEY = 1, /* bytes, sizeof(struct pf_poolhashkey) */ 169 PF_PT_COUNTER = 2, /* in6_addr */ 170 PF_PT_TBLIDX = 3, /* u32 */ 171 PF_PT_PROXY_SRC_PORT = 4, /* u16 */ 172 PF_PT_PROXY_DST_PORT = 5, /* u16 */ 173 PF_PT_OPTS = 6, /* u8 */ 174 PF_PT_MAPE = 7, /* nested, pf_mape_portset_type_t */ 175 }; 176 177 enum pf_timeout_type_t { 178 PF_TT_UNSPEC, 179 PF_TT_TIMEOUT = 1, /* u32 */ 180 }; 181 182 enum pf_rule_uid_type_t { 183 PF_RUT_UNSPEC, 184 PF_RUT_UID_LOW = 1, /* u32 */ 185 PF_RUT_UID_HIGH = 2, /* u32 */ 186 PF_RUT_OP = 3, /* u8 */ 187 }; 188 189 enum pf_rule_type_t { 190 PF_RT_UNSPEC, 191 PF_RT_SRC = 1, /* nested, pf_rule_addr_type_t */ 192 PF_RT_DST = 2, /* nested, pf_rule_addr_type_t */ 193 PF_RT_RIDENTIFIER = 3, /* u32 */ 194 PF_RT_LABELS = 4, /* nested, pf_labels_type_t */ 195 PF_RT_IFNAME = 5, /* string */ 196 PF_RT_QNAME = 6, /* string */ 197 PF_RT_PQNAME = 7, /* string */ 198 PF_RT_TAGNAME = 8, /* string */ 199 PF_RT_MATCH_TAGNAME = 9, /* string */ 200 PF_RT_OVERLOAD_TBLNAME = 10, /* string */ 201 PF_RT_RPOOL = 11, /* nested, pf_rpool_type_t */ 202 PF_RT_OS_FINGERPRINT = 12, /* u32 */ 203 PF_RT_RTABLEID = 13, /* u32 */ 204 PF_RT_TIMEOUT = 14, /* nested, pf_timeout_type_t */ 205 PF_RT_MAX_STATES = 15, /* u32 */ 206 PF_RT_MAX_SRC_NODES = 16, /* u32 */ 207 PF_RT_MAX_SRC_STATES = 17, /* u32 */ 208 PF_RT_MAX_SRC_CONN_RATE_LIMIT = 18, /* u32 */ 209 PF_RT_MAX_SRC_CONN_RATE_SECS = 19, /* u32 */ 210 PF_RT_DNPIPE = 20, /* u16 */ 211 PF_RT_DNRPIPE = 21, /* u16 */ 212 PF_RT_DNFLAGS = 22, /* u32 */ 213 PF_RT_NR = 23, /* u32 */ 214 PF_RT_PROB = 24, /* u32 */ 215 PF_RT_CUID = 25, /* u32 */ 216 PF_RT_CPID = 26, /* u32 */ 217 PF_RT_RETURN_ICMP = 27, /* u16 */ 218 PF_RT_RETURN_ICMP6 = 28, /* u16 */ 219 PF_RT_MAX_MSS = 29, /* u16 */ 220 PF_RT_SCRUB_FLAGS = 30, /* u16 */ 221 PF_RT_UID = 31, /* nested, pf_rule_uid_type_t */ 222 PF_RT_GID = 32, /* nested, pf_rule_uid_type_t */ 223 PF_RT_RULE_FLAG = 33, /* u32 */ 224 PF_RT_ACTION = 34, /* u8 */ 225 PF_RT_DIRECTION = 35, /* u8 */ 226 PF_RT_LOG = 36, /* u8 */ 227 PF_RT_LOGIF = 37, /* u8 */ 228 PF_RT_QUICK = 38, /* u8 */ 229 PF_RT_IF_NOT = 39, /* u8 */ 230 PF_RT_MATCH_TAG_NOT = 40, /* u8 */ 231 PF_RT_NATPASS = 41, /* u8 */ 232 PF_RT_KEEP_STATE = 42, /* u8 */ 233 PF_RT_AF = 43, /* u8 */ 234 PF_RT_PROTO = 44, /* u8 */ 235 PF_RT_TYPE = 45, /* u8 */ 236 PF_RT_CODE = 46, /* u8 */ 237 PF_RT_FLAGS = 47, /* u8 */ 238 PF_RT_FLAGSET = 48, /* u8 */ 239 PF_RT_MIN_TTL = 49, /* u8 */ 240 PF_RT_ALLOW_OPTS = 50, /* u8 */ 241 PF_RT_RT = 51, /* u8 */ 242 PF_RT_RETURN_TTL = 52, /* u8 */ 243 PF_RT_TOS = 53, /* u8 */ 244 PF_RT_SET_TOS = 54, /* u8 */ 245 PF_RT_ANCHOR_RELATIVE = 55, /* u8 */ 246 PF_RT_ANCHOR_WILDCARD = 56, /* u8 */ 247 PF_RT_FLUSH = 57, /* u8 */ 248 PF_RT_PRIO = 58, /* u8 */ 249 PF_RT_SET_PRIO = 59, /* u8 */ 250 PF_RT_SET_PRIO_REPLY = 60, /* u8 */ 251 PF_RT_DIVERT_ADDRESS = 61, /* in6_addr */ 252 PF_RT_DIVERT_PORT = 62, /* u16 */ 253 PF_RT_PACKETS_IN = 63, /* u64 */ 254 PF_RT_PACKETS_OUT = 64, /* u64 */ 255 PF_RT_BYTES_IN = 65, /* u64 */ 256 PF_RT_BYTES_OUT = 66, /* u64 */ 257 PF_RT_EVALUATIONS = 67, /* u64 */ 258 PF_RT_TIMESTAMP = 68, /* u64 */ 259 PF_RT_STATES_CUR = 69, /* u64 */ 260 PF_RT_STATES_TOTAL = 70, /* u64 */ 261 PF_RT_SRC_NODES = 71, /* u64 */ 262 PF_RT_ANCHOR_CALL = 72, /* string */ 263 PF_RT_RCV_IFNAME = 73, /* string */ 264 PF_RT_MAX_SRC_CONN = 74, /* u32 */ 265 }; 266 267 enum pf_addrule_type_t { 268 PF_ART_UNSPEC, 269 PF_ART_TICKET = 1, /* u32 */ 270 PF_ART_POOL_TICKET = 2, /* u32 */ 271 PF_ART_ANCHOR = 3, /* string */ 272 PF_ART_ANCHOR_CALL = 4, /* string */ 273 PF_ART_RULE = 5, /* nested, pfrule_type_t */ 274 }; 275 276 enum pf_getrules_type_t { 277 PF_GR_UNSPEC, 278 PF_GR_ANCHOR = 1, /* string */ 279 PF_GR_ACTION = 2, /* u8 */ 280 PF_GR_NR = 3, /* u32 */ 281 PF_GR_TICKET = 4, /* u32 */ 282 PF_GR_CLEAR = 5, /* u8 */ 283 }; 284 285 enum pf_clear_states_type_t { 286 PF_CS_UNSPEC, 287 PF_CS_CMP_ID = 1, /* u64 */ 288 PF_CS_CMP_CREATORID = 2, /* u32 */ 289 PF_CS_CMP_DIR = 3, /* u8 */ 290 PF_CS_AF = 4, /* u8 */ 291 PF_CS_PROTO = 5, /* u8 */ 292 PF_CS_SRC = 6, /* nested, pf_addr_wrap */ 293 PF_CS_DST = 7, /* nested, pf_addr_wrap */ 294 PF_CS_RT_ADDR = 8, /* nested, pf_addr_wrap */ 295 PF_CS_IFNAME = 9, /* string */ 296 PF_CS_LABEL = 10, /* string */ 297 PF_CS_KILL_MATCH = 11, /* bool */ 298 PF_CS_NAT = 12, /* bool */ 299 PF_CS_KILLED = 13, /* u32 */ 300 }; 301 302 enum pf_set_statusif_types_t { 303 PF_SS_UNSPEC, 304 PF_SS_IFNAME = 1, /* string */ 305 }; 306 307 enum pf_counter_types_t { 308 PF_C_UNSPEC, 309 PF_C_COUNTER = 1, /* u64 */ 310 PF_C_NAME = 2, /* string */ 311 PF_C_ID = 3, /* u32 */ 312 }; 313 314 enum pf_get_status_types_t { 315 PF_GS_UNSPEC, 316 PF_GS_IFNAME = 1, /* string */ 317 PF_GS_RUNNING = 2, /* bool */ 318 PF_GS_SINCE = 3, /* u32 */ 319 PF_GS_DEBUG = 4, /* u32 */ 320 PF_GS_HOSTID = 5, /* u32 */ 321 PF_GS_STATES = 6, /* u32 */ 322 PF_GS_SRC_NODES = 7, /* u32 */ 323 PF_GS_REASSEMBLE = 8, /* u32 */ 324 PF_GS_SYNCOOKIES_ACTIVE = 9, /* bool */ 325 PF_GS_COUNTERS = 10, /* nested, */ 326 PF_GS_LCOUNTERS = 11, /* nested, */ 327 PF_GS_FCOUNTERS = 12, /* nested, */ 328 PF_GS_SCOUNTERS = 13, /* nested, */ 329 PF_GS_CHKSUM = 14, /* byte array */ 330 PF_GS_PCOUNTERS = 15, /* u64 array */ 331 PF_GS_BCOUNTERS = 16, /* u64 array */ 332 }; 333 334 enum pf_natlook_types_t { 335 PF_NL_UNSPEC, 336 PF_NL_AF = 1, /* u8 */ 337 PF_NL_DIRECTION = 2, /* u8 */ 338 PF_NL_PROTO = 3, /* u8 */ 339 PF_NL_SRC_ADDR = 4, /* in6_addr */ 340 PF_NL_DST_ADDR = 5, /* in6_addr */ 341 PF_NL_SRC_PORT = 6, /* u16 */ 342 PF_NL_DST_PORT = 7, /* u16 */ 343 }; 344 345 enum pf_set_debug_types_t { 346 PF_SD_UNSPEC, 347 PF_SD_LEVEL = 1, /* u32 */ 348 }; 349 350 enum pf_timeout_types_t { 351 PF_TO_UNSPEC, 352 PF_TO_TIMEOUT = 1, /* u32 */ 353 PF_TO_SECONDS = 2, /* u32 */ 354 }; 355 356 enum pf_limit_types_t { 357 PF_LI_UNSPEC, 358 PF_LI_INDEX = 1, /* u32 */ 359 PF_LI_LIMIT = 2, /* u32 */ 360 }; 361 362 enum pf_begin_addrs_types_t { 363 PF_BA_UNSPEC, 364 PF_BA_TICKET = 1, /* u32 */ 365 }; 366 367 enum pf_pool_addr_types_t { 368 PF_PA_UNSPEC, 369 PF_PA_ADDR = 1, /* nested, pf_addr_wrap */ 370 PF_PA_IFNAME = 2, /* string */ 371 }; 372 373 enum pf_add_addr_types_t { 374 PF_AA_UNSPEC, 375 PF_AA_ACTION = 1, /* u32 */ 376 PF_AA_TICKET = 2, /* u32 */ 377 PF_AA_NR = 3, /* u32 */ 378 PF_AA_R_NUM = 4, /* u32 */ 379 PF_AA_R_ACTION = 5, /* u8 */ 380 PF_AA_R_LAST = 6, /* u8 */ 381 PF_AA_AF = 7, /* u8 */ 382 PF_AA_ANCHOR = 8, /* string */ 383 PF_AA_ADDR = 9, /* nested, pf_pooladdr */ 384 }; 385 386 enum pf_get_rulesets_types_t { 387 PF_RS_UNSPEC, 388 PF_RS_PATH = 1, /* string */ 389 PF_RS_NR = 2, /* u32 */ 390 PF_RS_NAME = 3, /* string */ 391 }; 392 393 enum pf_threshold_types_t { 394 PF_TH_UNSPEC, 395 PF_TH_LIMIT = 1, /* u32 */ 396 PF_TH_SECONDS = 2, /* u32 */ 397 PF_TH_COUNT = 3, /* u32 */ 398 PF_TH_LAST = 4, /* u32 */ 399 }; 400 401 enum pf_srcnodes_types_t { 402 PF_SN_UNSPEC, 403 PF_SN_ADDR = 1, /* nested, pf_addr */ 404 PF_SN_RADDR = 2, /* nested, pf_addr */ 405 PF_SN_RULE_NR = 3, /* u32 */ 406 PF_SN_BYTES_IN = 4, /* u64 */ 407 PF_SN_BYTES_OUT = 5, /* u64 */ 408 PF_SN_PACKETS_IN = 6, /* u64 */ 409 PF_SN_PACKETS_OUT = 7, /* u64 */ 410 PF_SN_STATES = 8, /* u32 */ 411 PF_SN_CONNECTIONS = 9, /* u32 */ 412 PF_SN_AF = 10, /* u8 */ 413 PF_SN_RULE_TYPE = 11, /* u8 */ 414 PF_SN_CREATION = 12, /* u64 */ 415 PF_SN_EXPIRE = 13, /* u64 */ 416 PF_SN_CONNECTION_RATE = 14, /* nested, pf_threshold */ 417 }; 418 419 #ifdef _KERNEL 420 421 void pf_nl_register(void); 422 void pf_nl_unregister(void); 423 424 #endif 425 426 #endif 427