xref: /openbsd/sys/net/pfvar.h (revision 8a978b4c)
1 /*	$OpenBSD: pfvar.h,v 1.540 2024/10/12 23:31:14 jsg Exp $ */
2 
3 /*
4  * Copyright (c) 2001 Daniel Hartmeier
5  * Copyright (c) 2002 - 2013 Henning Brauer <henning@openbsd.org>
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  *    - Redistributions of source code must retain the above copyright
13  *      notice, this list of conditions and the following disclaimer.
14  *    - Redistributions in binary form must reproduce the above
15  *      copyright notice, this list of conditions and the following
16  *      disclaimer in the documentation and/or other materials provided
17  *      with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
22  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
23  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
24  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
25  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
27  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
29  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30  * POSSIBILITY OF SUCH DAMAGE.
31  *
32  */
33 
34 #ifndef _NET_PFVAR_H_
35 #define _NET_PFVAR_H_
36 
37 #include <sys/queue.h>
38 #include <sys/tree.h>
39 #include <sys/syslimits.h>
40 #include <sys/refcnt.h>
41 #include <sys/timeout.h>
42 
43 #include <netinet/in.h>
44 
45 #include <net/radix.h>
46 #include <net/route.h>
47 
48 struct ip;
49 struct ip6_hdr;
50 struct mbuf_list;
51 
52 #define	PF_TCPS_PROXY_SRC	((TCP_NSTATES)+0)
53 #define	PF_TCPS_PROXY_DST	((TCP_NSTATES)+1)
54 
55 #define	PF_MD5_DIGEST_LENGTH	16
56 #ifdef MD5_DIGEST_LENGTH
57 #if PF_MD5_DIGEST_LENGTH != MD5_DIGEST_LENGTH
58 #error md5 digest length mismatch
59 #endif
60 #endif
61 
62 typedef struct refcnt	pf_refcnt_t;
63 #define	PF_REF_INIT(_x)	refcnt_init(&(_x))
64 #define	PF_REF_TAKE(_x)	refcnt_take(&(_x))
65 #define	PF_REF_RELE(_x)	refcnt_rele(&(_x))
66 
67 enum	{ PF_INOUT, PF_IN, PF_OUT, PF_FWD };
68 enum	{ PF_PASS, PF_DROP, PF_SCRUB, PF_NOSCRUB, PF_NAT, PF_NONAT,
69 	  PF_BINAT, PF_NOBINAT, PF_RDR, PF_NORDR, PF_SYNPROXY_DROP, PF_DEFER,
70 	  PF_MATCH, PF_DIVERT, PF_RT, PF_AFRT };
71 enum	{ PF_TRANS_RULESET, PF_TRANS_TABLE };
72 enum	{ PF_OP_NONE, PF_OP_IRG, PF_OP_EQ, PF_OP_NE, PF_OP_LT,
73 	  PF_OP_LE, PF_OP_GT, PF_OP_GE, PF_OP_XRG, PF_OP_RRG };
74 enum	{ PF_CHANGE_NONE, PF_CHANGE_ADD_HEAD, PF_CHANGE_ADD_TAIL,
75 	  PF_CHANGE_ADD_BEFORE, PF_CHANGE_ADD_AFTER,
76 	  PF_CHANGE_REMOVE, PF_CHANGE_GET_TICKET };
77 enum	{ PF_GET_NONE, PF_GET_CLR_CNTR };
78 enum	{ PF_SK_WIRE, PF_SK_STACK, PF_SK_BOTH };
79 enum	{ PF_PEER_SRC, PF_PEER_DST, PF_PEER_BOTH };
80 
81 /*
82  * Note about PFTM_*: real indices into pf_rule.timeout[] come before
83  * PFTM_MAX, special cases afterwards. See pf_state_expires().
84  */
85 enum	{ PFTM_TCP_FIRST_PACKET, PFTM_TCP_OPENING, PFTM_TCP_ESTABLISHED,
86 	  PFTM_TCP_CLOSING, PFTM_TCP_FIN_WAIT, PFTM_TCP_CLOSED,
87 	  PFTM_UDP_FIRST_PACKET, PFTM_UDP_SINGLE, PFTM_UDP_MULTIPLE,
88 	  PFTM_ICMP_FIRST_PACKET, PFTM_ICMP_ERROR_REPLY,
89 	  PFTM_OTHER_FIRST_PACKET, PFTM_OTHER_SINGLE,
90 	  PFTM_OTHER_MULTIPLE, PFTM_FRAG, PFTM_INTERVAL,
91 	  PFTM_ADAPTIVE_START, PFTM_ADAPTIVE_END, PFTM_SRC_NODE,
92 	  PFTM_TS_DIFF, PFTM_MAX, PFTM_PURGE, PFTM_UNLINKED };
93 
94 /* PFTM default values */
95 #define PFTM_TCP_FIRST_PACKET_VAL	120	/* First TCP packet */
96 #define PFTM_TCP_OPENING_VAL		30	/* No response yet */
97 #define PFTM_TCP_ESTABLISHED_VAL	24*60*60/* Established */
98 #define PFTM_TCP_CLOSING_VAL		15 * 60	/* Half closed */
99 #define PFTM_TCP_FIN_WAIT_VAL		45	/* Got both FINs */
100 #define PFTM_TCP_CLOSED_VAL		90	/* Got a RST */
101 #define PFTM_UDP_FIRST_PACKET_VAL	60	/* First UDP packet */
102 #define PFTM_UDP_SINGLE_VAL		30	/* Unidirectional */
103 #define PFTM_UDP_MULTIPLE_VAL		60	/* Bidirectional */
104 #define PFTM_ICMP_FIRST_PACKET_VAL	20	/* First ICMP packet */
105 #define PFTM_ICMP_ERROR_REPLY_VAL	10	/* Got error response */
106 #define PFTM_OTHER_FIRST_PACKET_VAL	60	/* First packet */
107 #define PFTM_OTHER_SINGLE_VAL		30	/* Unidirectional */
108 #define PFTM_OTHER_MULTIPLE_VAL		60	/* Bidirectional */
109 #define PFTM_FRAG_VAL			60	/* Fragment expire */
110 #define PFTM_INTERVAL_VAL		10	/* Expire interval */
111 #define PFTM_SRC_NODE_VAL		0	/* Source tracking */
112 #define PFTM_TS_DIFF_VAL		30	/* Allowed TS diff */
113 
114 /*
115  * For each connection (combination of proto,src,dst,af) the number
116  * of fragments is limited.  Over the PFTM_FRAG interval the average
117  * rate must be less than PF_FRAG_STALE fragments per second.
118  * Otherwise older fragments are considered stale and are dropped.
119  */
120 #define PF_FRAG_STALE			200
121 
122 /*
123  * Limit the length of the fragment queue traversal.  Remember
124  * search entry points based on the fragment offset.
125  */
126 #define PF_FRAG_ENTRY_POINTS		16
127 
128 /*
129  * The number of entries in the fragment queue must be limited
130  * to avoid DoS by linear searching.  Instead of a global limit,
131  * use a limit per entry point.  For large packets these sum up.
132  */
133 #define PF_FRAG_ENTRY_LIMIT		64
134 
135 enum	{ PF_NOPFROUTE, PF_ROUTETO, PF_DUPTO, PF_REPLYTO };
136 enum	{ PF_LIMIT_STATES, PF_LIMIT_SRC_NODES, PF_LIMIT_FRAGS,
137 	  PF_LIMIT_TABLES, PF_LIMIT_TABLE_ENTRIES, PF_LIMIT_PKTDELAY_PKTS,
138 	  PF_LIMIT_ANCHORS, PF_LIMIT_MAX };
139 #define PF_POOL_IDMASK		0x0f
140 enum	{ PF_POOL_NONE, PF_POOL_BITMASK, PF_POOL_RANDOM,
141 	  PF_POOL_SRCHASH, PF_POOL_ROUNDROBIN, PF_POOL_LEASTSTATES };
142 enum	{ PF_ADDR_ADDRMASK, PF_ADDR_NOROUTE, PF_ADDR_DYNIFTL,
143 	  PF_ADDR_TABLE, PF_ADDR_RTLABEL, PF_ADDR_URPFFAILED,
144 	  PF_ADDR_RANGE, PF_ADDR_NONE };
145 #define PF_POOL_TYPEMASK	0x0f
146 #define PF_POOL_STICKYADDR	0x20
147 #define	PF_WSCALE_FLAG		0x80
148 #define	PF_WSCALE_MASK		0x0f
149 
150 #define PF_POOL_DYNTYPE(_o)						\
151 	((((_o) & PF_POOL_TYPEMASK) == PF_POOL_ROUNDROBIN) ||		\
152 	(((_o) & PF_POOL_TYPEMASK) == PF_POOL_LEASTSTATES) ||		\
153 	(((_o) & PF_POOL_TYPEMASK) == PF_POOL_RANDOM) ||		\
154 	(((_o) & PF_POOL_TYPEMASK) == PF_POOL_SRCHASH))
155 
156 #define	PF_LOG			0x01
157 #define	PF_LOG_ALL		0x02
158 #define	PF_LOG_USER		0x04
159 #define	PF_LOG_FORCE		0x08
160 #define	PF_LOG_MATCHES		0x10
161 
162 struct pf_addr {
163 	union {
164 		struct in_addr		v4;
165 		struct in6_addr		v6;
166 		u_int8_t		addr8[16];
167 		u_int16_t		addr16[8];
168 		u_int32_t		addr32[4];
169 	} pfa;		    /* 128-bit address */
170 #define v4	pfa.v4
171 #define v6	pfa.v6
172 #define addr8	pfa.addr8
173 #define addr16	pfa.addr16
174 #define addr32	pfa.addr32
175 };
176 
177 #define	PF_TABLE_NAME_SIZE	 32
178 
179 #define PFI_AFLAG_NETWORK	0x01
180 #define PFI_AFLAG_BROADCAST	0x02
181 #define PFI_AFLAG_PEER		0x04
182 #define PFI_AFLAG_MODEMASK	0x07
183 #define PFI_AFLAG_NOALIAS	0x08
184 
185 struct pf_addr_wrap {
186 	union {
187 		struct {
188 			struct pf_addr		 addr;
189 			struct pf_addr		 mask;
190 		}			 a;
191 		char			 ifname[IFNAMSIZ];
192 		char			 tblname[PF_TABLE_NAME_SIZE];
193 		char			 rtlabelname[RTLABEL_LEN];
194 		u_int32_t		 rtlabel;
195 	}			 v;
196 	union {
197 		struct pfi_dynaddr	*dyn;
198 		struct pfr_ktable	*tbl;
199 		int			 dyncnt;
200 		int			 tblcnt;
201 	}			 p;
202 	u_int8_t		 type;		/* PF_ADDR_* */
203 	u_int8_t		 iflags;	/* PFI_AFLAG_* */
204 };
205 
206 #ifdef _KERNEL
207 struct pfi_dynaddr {
208 	TAILQ_ENTRY(pfi_dynaddr)	 entry;
209 	struct pf_addr			 pfid_addr4;
210 	struct pf_addr			 pfid_mask4;
211 	struct pf_addr			 pfid_addr6;
212 	struct pf_addr			 pfid_mask6;
213 	struct pfr_ktable		*pfid_kt;
214 	struct pfi_kif			*pfid_kif;
215 	void				*pfid_hook_cookie;
216 	int				 pfid_net;	/* mask or 128 */
217 	int				 pfid_acnt4;	/* address count IPv4 */
218 	int				 pfid_acnt6;	/* address count IPv6 */
219 	sa_family_t			 pfid_af;	/* rule af */
220 	u_int8_t			 pfid_iflags;	/* PFI_AFLAG_* */
221 };
222 #endif /* _KERNEL */
223 
224 
225 /*
226  * Logging macros
227  */
228 
229 #ifndef PF_DEBUGNAME
230 #define PF_DEBUGNAME "pf: "
231 #endif
232 
233 #ifdef _KERNEL
234 #define	DPFPRINTF(n, format, x...)					\
235 	do {								\
236 		if (pf_status.debug >= (n)) {				\
237 			log(n, PF_DEBUGNAME);				\
238 			addlog(format, ##x);				\
239 			addlog("\n");					\
240 		}							\
241 	} while (0)
242 #else
243 #ifdef PFDEBUG
244 #define	DPFPRINTF(n, format, x...)					\
245 	do {								\
246 		fprintf(stderr, format, ##x);				\
247 		fprintf(stderr, "\n");					\
248 	} while (0)
249 #else
250 #define	DPFPRINTF(n, format, x...)	((void)0)
251 #endif /* PFDEBUG */
252 #endif /* _KERNEL */
253 
254 
255 /*
256  * Address manipulation macros
257  */
258 
259 #define PF_AEQ(a, b, c) \
260 	((c == AF_INET && (a)->addr32[0] == (b)->addr32[0]) || \
261 	(c == AF_INET6 && \
262 	(a)->addr32[3] == (b)->addr32[3] && \
263 	(a)->addr32[2] == (b)->addr32[2] && \
264 	(a)->addr32[1] == (b)->addr32[1] && \
265 	(a)->addr32[0] == (b)->addr32[0])) \
266 
267 #define PF_ANEQ(a, b, c) \
268 	((c == AF_INET && (a)->addr32[0] != (b)->addr32[0]) || \
269 	(c == AF_INET6 && \
270 	((a)->addr32[3] != (b)->addr32[3] || \
271 	(a)->addr32[2] != (b)->addr32[2] || \
272 	(a)->addr32[1] != (b)->addr32[1] || \
273 	(a)->addr32[0] != (b)->addr32[0]))) \
274 
275 #define PF_AZERO(a, c) \
276 	((c == AF_INET && !(a)->addr32[0]) || \
277 	(c == AF_INET6 && \
278 	!(a)->addr32[0] && !(a)->addr32[1] && \
279 	!(a)->addr32[2] && !(a)->addr32[3] )) \
280 
281 #define	PF_MISMATCHAW(aw, x, af, neg, ifp, rtid)			\
282 	(								\
283 		(((aw)->type == PF_ADDR_NOROUTE &&			\
284 		    pf_routable((x), (af), NULL, (rtid))) ||		\
285 		(((aw)->type == PF_ADDR_URPFFAILED && (ifp) != NULL &&	\
286 		    pf_routable((x), (af), (ifp), (rtid))) ||		\
287 		((aw)->type == PF_ADDR_RTLABEL &&			\
288 		    !pf_rtlabel_match((x), (af), (aw), (rtid))) ||	\
289 		((aw)->type == PF_ADDR_TABLE &&				\
290 		    !pfr_match_addr((aw)->p.tbl, (x), (af))) ||		\
291 		((aw)->type == PF_ADDR_DYNIFTL &&			\
292 		    !pfi_match_addr((aw)->p.dyn, (x), (af))) ||		\
293 		((aw)->type == PF_ADDR_RANGE &&				\
294 		    !pf_match_addr_range(&(aw)->v.a.addr,		\
295 		    &(aw)->v.a.mask, (x), (af))) ||			\
296 		((aw)->type == PF_ADDR_ADDRMASK &&			\
297 		    !PF_AZERO(&(aw)->v.a.mask, (af)) &&			\
298 		    !pf_match_addr(0, &(aw)->v.a.addr,			\
299 		    &(aw)->v.a.mask, (x), (af))))) !=			\
300 		(neg)							\
301 	)
302 
303 struct pf_rule_uid {
304 	uid_t		 uid[2];
305 	u_int8_t	 op;
306 };
307 
308 struct pf_rule_gid {
309 	uid_t		 gid[2];
310 	u_int8_t	 op;
311 };
312 
313 struct pf_rule_addr {
314 	struct pf_addr_wrap	 addr;
315 	u_int16_t		 port[2];
316 	u_int8_t		 neg;
317 	u_int8_t		 port_op;
318 	u_int16_t		 weight;
319 };
320 
321 struct pf_threshold {
322 	u_int32_t	limit;
323 #define	PF_THRESHOLD_MULT	1000
324 #define	PF_THRESHOLD_MAX	0xffffffff / PF_THRESHOLD_MULT
325 	u_int32_t	seconds;
326 	u_int32_t	count;
327 	u_int32_t	last;
328 };
329 
330 struct pf_poolhashkey {
331 	union {
332 		u_int8_t		key8[16];
333 		u_int16_t		key16[8];
334 		u_int32_t		key32[4];
335 	} pfk;		    /* 128-bit hash key */
336 #define key8	pfk.key8
337 #define key16	pfk.key16
338 #define key32	pfk.key32
339 };
340 
341 struct pf_pool {
342 	struct pf_addr_wrap	 addr;
343 	struct pf_poolhashkey	 key;
344 	struct pf_addr		 counter;
345 	char			 ifname[IFNAMSIZ];
346 	struct pfi_kif		*kif;
347 	int			 tblidx;
348 	u_int64_t		 states;
349 	int			 curweight;
350 	u_int16_t		 weight;
351 	u_int16_t		 proxy_port[2];
352 	u_int8_t		 port_op;
353 	u_int8_t		 opts;
354 };
355 
356 /* A packed Operating System description for fingerprinting */
357 typedef u_int32_t pf_osfp_t;
358 #define PF_OSFP_ANY	((pf_osfp_t)0)
359 #define PF_OSFP_UNKNOWN	((pf_osfp_t)-1)
360 #define PF_OSFP_NOMATCH	((pf_osfp_t)-2)
361 
362 struct pf_osfp_entry {
363 	SLIST_ENTRY(pf_osfp_entry) fp_entry;
364 	pf_osfp_t		fp_os;
365 	int			fp_enflags;
366 #define PF_OSFP_EXPANDED	0x001		/* expanded entry */
367 #define PF_OSFP_GENERIC		0x002		/* generic signature */
368 #define PF_OSFP_NODETAIL	0x004		/* no p0f details */
369 #define PF_OSFP_LEN	32
370 	u_char			fp_class_nm[PF_OSFP_LEN];
371 	u_char			fp_version_nm[PF_OSFP_LEN];
372 	u_char			fp_subtype_nm[PF_OSFP_LEN];
373 };
374 #define PF_OSFP_ENTRY_EQ(a, b) \
375     ((a)->fp_os == (b)->fp_os && \
376     memcmp((a)->fp_class_nm, (b)->fp_class_nm, PF_OSFP_LEN) == 0 && \
377     memcmp((a)->fp_version_nm, (b)->fp_version_nm, PF_OSFP_LEN) == 0 && \
378     memcmp((a)->fp_subtype_nm, (b)->fp_subtype_nm, PF_OSFP_LEN) == 0)
379 
380 /* handle pf_osfp_t packing */
381 #define _FP_RESERVED_BIT	1  /* For the special negative #defines */
382 #define _FP_UNUSED_BITS		1
383 #define _FP_CLASS_BITS		10 /* OS Class (Windows, Linux) */
384 #define _FP_VERSION_BITS	10 /* OS version (95, 98, NT, 2.4.54, 3.2) */
385 #define _FP_SUBTYPE_BITS	10 /* patch level (NT SP4, SP3, ECN patch) */
386 #define PF_OSFP_UNPACK(osfp, class, version, subtype) do { \
387 	(class) = ((osfp) >> (_FP_VERSION_BITS+_FP_SUBTYPE_BITS)) & \
388 	    ((1 << _FP_CLASS_BITS) - 1); \
389 	(version) = ((osfp) >> _FP_SUBTYPE_BITS) & \
390 	    ((1 << _FP_VERSION_BITS) - 1);\
391 	(subtype) = (osfp) & ((1 << _FP_SUBTYPE_BITS) - 1); \
392 } while(0)
393 #define PF_OSFP_PACK(osfp, class, version, subtype) do { \
394 	(osfp) = ((class) & ((1 << _FP_CLASS_BITS) - 1)) << (_FP_VERSION_BITS \
395 	    + _FP_SUBTYPE_BITS); \
396 	(osfp) |= ((version) & ((1 << _FP_VERSION_BITS) - 1)) << \
397 	    _FP_SUBTYPE_BITS; \
398 	(osfp) |= (subtype) & ((1 << _FP_SUBTYPE_BITS) - 1); \
399 } while(0)
400 
401 /* the fingerprint of an OSes TCP SYN packet */
402 typedef u_int64_t	pf_tcpopts_t;
403 struct pf_os_fingerprint {
404 	SLIST_HEAD(pf_osfp_enlist, pf_osfp_entry) fp_oses; /* list of matches */
405 	pf_tcpopts_t		fp_tcpopts;	/* packed TCP options */
406 	u_int16_t		fp_wsize;	/* TCP window size */
407 	u_int16_t		fp_psize;	/* ip->ip_len */
408 	u_int16_t		fp_mss;		/* TCP MSS */
409 	u_int16_t		fp_flags;
410 #define PF_OSFP_WSIZE_MOD	0x0001		/* Window modulus */
411 #define PF_OSFP_WSIZE_DC	0x0002		/* Window don't care */
412 #define PF_OSFP_WSIZE_MSS	0x0004		/* Window multiple of MSS */
413 #define PF_OSFP_WSIZE_MTU	0x0008		/* Window multiple of MTU */
414 #define PF_OSFP_PSIZE_MOD	0x0010		/* packet size modulus */
415 #define PF_OSFP_PSIZE_DC	0x0020		/* packet size don't care */
416 #define PF_OSFP_WSCALE		0x0040		/* TCP window scaling */
417 #define PF_OSFP_WSCALE_MOD	0x0080		/* TCP window scale modulus */
418 #define PF_OSFP_WSCALE_DC	0x0100		/* TCP window scale dont-care */
419 #define PF_OSFP_MSS		0x0200		/* TCP MSS */
420 #define PF_OSFP_MSS_MOD		0x0400		/* TCP MSS modulus */
421 #define PF_OSFP_MSS_DC		0x0800		/* TCP MSS dont-care */
422 #define PF_OSFP_DF		0x1000		/* IPv4 don't fragment bit */
423 #define PF_OSFP_TS0		0x2000		/* Zero timestamp */
424 #define PF_OSFP_INET6		0x4000		/* IPv6 */
425 	u_int8_t		fp_optcnt;	/* TCP option count */
426 	u_int8_t		fp_wscale;	/* TCP window scaling */
427 	u_int8_t		fp_ttl;		/* IPv4 TTL */
428 #define PF_OSFP_MAXTTL_OFFSET	40
429 /* TCP options packing */
430 #define PF_OSFP_TCPOPT_NOP	0x0		/* TCP NOP option */
431 #define PF_OSFP_TCPOPT_WSCALE	0x1		/* TCP window scaling option */
432 #define PF_OSFP_TCPOPT_MSS	0x2		/* TCP max segment size opt */
433 #define PF_OSFP_TCPOPT_SACK	0x3		/* TCP SACK OK option */
434 #define PF_OSFP_TCPOPT_TS	0x4		/* TCP timestamp option */
435 #define PF_OSFP_TCPOPT_BITS	3		/* bits used by each option */
436 #define PF_OSFP_MAX_OPTS \
437     (sizeof(((struct pf_os_fingerprint *)0)->fp_tcpopts) * 8) \
438     / PF_OSFP_TCPOPT_BITS
439 
440 	SLIST_ENTRY(pf_os_fingerprint)	fp_next;
441 };
442 
443 struct pf_osfp_ioctl {
444 	struct pf_osfp_entry	fp_os;
445 	pf_tcpopts_t		fp_tcpopts;	/* packed TCP options */
446 	u_int16_t		fp_wsize;	/* TCP window size */
447 	u_int16_t		fp_psize;	/* ip->ip_len */
448 	u_int16_t		fp_mss;		/* TCP MSS */
449 	u_int16_t		fp_flags;
450 	u_int8_t		fp_optcnt;	/* TCP option count */
451 	u_int8_t		fp_wscale;	/* TCP window scaling */
452 	u_int8_t		fp_ttl;		/* IPv4 TTL */
453 
454 	int			fp_getnum;	/* DIOCOSFPGET number */
455 };
456 
457 struct pf_rule_actions {
458 	int		rtableid;
459 	u_int16_t	qid;
460 	u_int16_t	pqid;
461 	u_int16_t	max_mss;
462 	u_int16_t	flags;
463 	u_int16_t	delay;
464 	u_int8_t	log;
465 	u_int8_t	set_tos;
466 	u_int8_t	min_ttl;
467 	u_int8_t	set_prio[2];
468 	u_int8_t	pad[1];
469 };
470 
471 union pf_rule_ptr {
472 	struct pf_rule		*ptr;
473 	u_int32_t		 nr;
474 };
475 
476 #define	PF_ANCHOR_STACK_MAX	 64
477 #define	PF_ANCHOR_NAME_SIZE	 64
478 #define	PF_ANCHOR_MAXPATH	(PATH_MAX - PF_ANCHOR_NAME_SIZE - 1)
479 #define	PF_ANCHOR_HIWAT		 512
480 #define	PF_OPTIMIZER_TABLE_PFX	"__automatic_"
481 
482 struct pf_rule {
483 	struct pf_rule_addr	 src;
484 	struct pf_rule_addr	 dst;
485 #define PF_SKIP_IFP		0
486 #define PF_SKIP_DIR		1
487 #define PF_SKIP_RDOM		2
488 #define PF_SKIP_AF		3
489 #define PF_SKIP_PROTO		4
490 #define PF_SKIP_SRC_ADDR	5
491 #define PF_SKIP_DST_ADDR	6
492 #define PF_SKIP_SRC_PORT	7
493 #define PF_SKIP_DST_PORT	8
494 #define PF_SKIP_COUNT		9
495 	union pf_rule_ptr	 skip[PF_SKIP_COUNT];
496 #define PF_RULE_LABEL_SIZE	 64
497 	char			 label[PF_RULE_LABEL_SIZE];
498 #define PF_QNAME_SIZE		 64
499 	char			 ifname[IFNAMSIZ];
500 	char			 rcv_ifname[IFNAMSIZ];
501 	char			 qname[PF_QNAME_SIZE];
502 	char			 pqname[PF_QNAME_SIZE];
503 #define	PF_TAG_NAME_SIZE	 64
504 	char			 tagname[PF_TAG_NAME_SIZE];
505 	char			 match_tagname[PF_TAG_NAME_SIZE];
506 
507 	char			 overload_tblname[PF_TABLE_NAME_SIZE];
508 
509 	TAILQ_ENTRY(pf_rule)	 entries;
510 	struct pf_pool		 nat;
511 	struct pf_pool		 rdr;
512 	struct pf_pool		 route;
513 	struct pf_threshold	 pktrate;
514 
515 	u_int64_t		 evaluations;
516 	u_int64_t		 packets[2];
517 	u_int64_t		 bytes[2];
518 
519 	struct pfi_kif		*kif;
520 	struct pfi_kif		*rcv_kif;
521 	struct pf_anchor	*anchor;
522 	struct pfr_ktable	*overload_tbl;
523 
524 	pf_osfp_t		 os_fingerprint;
525 
526 	int			 rtableid;
527 	int			 onrdomain;
528 	u_int32_t		 timeout[PFTM_MAX];
529 	u_int32_t		 states_cur;
530 	u_int32_t		 states_tot;
531 	u_int32_t		 max_states;
532 	u_int32_t		 src_nodes;
533 	u_int32_t		 max_src_nodes;
534 	u_int32_t		 max_src_states;
535 	u_int32_t		 max_src_conn;
536 	struct {
537 		u_int32_t		limit;
538 		u_int32_t		seconds;
539 	}			 max_src_conn_rate;
540 	u_int32_t		 qid;
541 	u_int32_t		 pqid;
542 	u_int32_t		 rt_listid;
543 	u_int32_t		 nr;
544 	u_int32_t		 prob;
545 	uid_t			 cuid;
546 	pid_t			 cpid;
547 
548 	u_int16_t		 return_icmp;
549 	u_int16_t		 return_icmp6;
550 	u_int16_t		 max_mss;
551 	u_int16_t		 tag;
552 	u_int16_t		 match_tag;
553 	u_int16_t		 scrub_flags;
554 	u_int16_t		 delay;
555 
556 	struct pf_rule_uid	 uid;
557 	struct pf_rule_gid	 gid;
558 
559 	u_int32_t		 rule_flag;
560 	u_int8_t		 action;
561 	u_int8_t		 direction;
562 	u_int8_t		 log;
563 	u_int8_t		 logif;
564 	u_int8_t		 quick;
565 	u_int8_t		 ifnot;
566 	u_int8_t		 match_tag_not;
567 
568 #define PF_STATE_NORMAL		0x1
569 #define PF_STATE_MODULATE	0x2
570 #define PF_STATE_SYNPROXY	0x3
571 	u_int8_t		 keep_state;
572 	sa_family_t		 af;
573 	u_int8_t		 proto;
574 	u_int16_t		 type;	/* aux. value 256 is legit */
575 	u_int16_t		 code;	/* aux. value 256 is legit */
576 	u_int8_t		 flags;
577 	u_int8_t		 flagset;
578 	u_int8_t		 min_ttl;
579 	u_int8_t		 allow_opts;
580 	u_int8_t		 rt;
581 	u_int8_t		 return_ttl;
582 	u_int8_t		 tos;
583 	u_int8_t		 set_tos;
584 	u_int8_t		 anchor_relative;
585 	u_int8_t		 anchor_wildcard;
586 
587 #define PF_FLUSH		0x01
588 #define PF_FLUSH_GLOBAL		0x02
589 	u_int8_t		 flush;
590 	u_int8_t		 prio;
591 	u_int8_t		 set_prio[2];
592 	sa_family_t		 naf;
593 	u_int8_t		 rcvifnot;
594 
595 	struct {
596 		struct pf_addr		addr;
597 		u_int16_t		port;
598 		u_int8_t		type;
599 	}			divert;
600 
601 	time_t			 exptime;
602 };
603 
604 /* rule flags */
605 #define	PFRULE_DROP		0x0000
606 #define	PFRULE_RETURNRST	0x0001
607 #define	PFRULE_FRAGMENT		0x0002
608 #define	PFRULE_RETURNICMP	0x0004
609 #define	PFRULE_RETURN		0x0008
610 #define	PFRULE_NOSYNC		0x0010
611 #define	PFRULE_SRCTRACK		0x0020  /* track source states */
612 #define	PFRULE_RULESRCTRACK	0x0040  /* per rule */
613 #define	PFRULE_SETDELAY		0x0080
614 
615 /* rule flags again */
616 #define PFRULE_IFBOUND		0x00010000	/* if-bound */
617 #define PFRULE_STATESLOPPY	0x00020000	/* sloppy state tracking */
618 #define PFRULE_PFLOW		0x00040000
619 #define PFRULE_ONCE		0x00100000	/* one shot rule */
620 #define PFRULE_AFTO		0x00200000	/* af-to rule */
621 #define	PFRULE_EXPIRED		0x00400000	/* one shot rule hit by pkt */
622 
623 #define PFSTATE_HIWAT		100000	/* default state table size */
624 #define PFSTATE_ADAPT_START	60000	/* default adaptive timeout start */
625 #define PFSTATE_ADAPT_END	120000	/* default adaptive timeout end */
626 #define	PF_PKTDELAY_MAXPKTS	10000	/* max # of pkts held in delay queue */
627 
628 struct pf_rule_item {
629 	SLIST_ENTRY(pf_rule_item)	 entry;
630 	struct pf_rule			*r;
631 };
632 
633 SLIST_HEAD(pf_rule_slist, pf_rule_item);
634 
635 enum pf_sn_types { PF_SN_NONE, PF_SN_NAT, PF_SN_RDR, PF_SN_ROUTE, PF_SN_MAX };
636 
637 struct pf_src_node {
638 	RB_ENTRY(pf_src_node)	 entry;
639 	struct pf_addr		 addr;
640 	struct pf_addr		 raddr;
641 	union pf_rule_ptr	 rule;
642 	struct pfi_kif		*kif;
643 	u_int64_t		 bytes[2];
644 	u_int64_t		 packets[2];
645 	u_int32_t		 states;
646 	u_int32_t		 conn;
647 	struct pf_threshold	 conn_rate;
648 	int32_t			 creation;
649 	int32_t			 expire;
650 	sa_family_t		 af;
651 	sa_family_t		 naf;
652 	u_int8_t		 type;
653 };
654 
655 struct pf_sn_item {
656 	SLIST_ENTRY(pf_sn_item)	 next;
657 	struct pf_src_node	*sn;
658 };
659 
660 SLIST_HEAD(pf_sn_head, pf_sn_item);
661 
662 #define PFSNODE_HIWAT		10000	/* default source node table size */
663 
664 struct pf_state_scrub {
665 	struct timeval	pfss_last;	/* time received last packet	*/
666 	u_int32_t	pfss_tsecr;	/* last echoed timestamp	*/
667 	u_int32_t	pfss_tsval;	/* largest timestamp		*/
668 	u_int32_t	pfss_tsval0;	/* original timestamp		*/
669 	u_int16_t	pfss_flags;
670 #define PFSS_TIMESTAMP	0x0001		/* modulate timestamp		*/
671 #define PFSS_PAWS	0x0010		/* stricter PAWS checks		*/
672 #define PFSS_PAWS_IDLED	0x0020		/* was idle too long.  no PAWS	*/
673 #define PFSS_DATA_TS	0x0040		/* timestamp on data packets	*/
674 #define PFSS_DATA_NOTS	0x0080		/* no timestamp on data packets	*/
675 	u_int8_t	pfss_ttl;	/* stashed TTL			*/
676 	u_int8_t	pad;
677 	u_int32_t	pfss_ts_mod;	/* timestamp modulation		*/
678 };
679 
680 struct pf_state_host {
681 	struct pf_addr	addr;
682 	u_int16_t	port;
683 	u_int16_t	pad;
684 };
685 
686 struct pf_state_peer {
687 	struct pf_state_scrub	*scrub;	/* state is scrubbed		*/
688 	u_int32_t	seqlo;		/* Max sequence number sent	*/
689 	u_int32_t	seqhi;		/* Max the other end ACKd + win	*/
690 	u_int32_t	seqdiff;	/* Sequence number modulator	*/
691 	u_int16_t	max_win;	/* largest window (pre scaling)	*/
692 	u_int16_t	mss;		/* Maximum segment size option	*/
693 	u_int8_t	state;		/* active state level		*/
694 	u_int8_t	wscale;		/* window scaling factor	*/
695 	u_int8_t	tcp_est;	/* Did we reach TCPS_ESTABLISHED */
696 	u_int8_t	pad[1];
697 };
698 
699 TAILQ_HEAD(pf_state_queue, pf_state);
700 
701 /* keep synced with struct pf_state_key, used in RB_FIND */
702 struct pf_state_key_cmp {
703 	struct pf_addr	 addr[2];
704 	u_int16_t	 port[2];
705 	u_int16_t	 rdomain;
706 	u_int16_t	 hash;
707 	sa_family_t	 af;
708 	u_int8_t	 proto;
709 };
710 
711 /* keep synced with struct pf_state, used in RB_FIND */
712 struct pf_state_cmp {
713 	u_int64_t		 id;
714 	u_int32_t		 creatorid;
715 	u_int8_t		 direction;
716 	u_int8_t		 pad[3];
717 };
718 
719 /* struct pf_state.state_flags */
720 #define	PFSTATE_ALLOWOPTS	0x0001
721 #define	PFSTATE_SLOPPY		0x0002
722 #define	PFSTATE_PFLOW		0x0004
723 #define	PFSTATE_NOSYNC		0x0008
724 #define	PFSTATE_ACK		0x0010
725 #define	PFSTATE_NODF		0x0020
726 #define	PFSTATE_SETTOS		0x0040
727 #define	PFSTATE_RANDOMID	0x0080
728 #define	PFSTATE_SCRUB_TCP	0x0100
729 #define	PFSTATE_SETPRIO		0x0200
730 #define	PFSTATE_INP_UNLINKED	0x0400
731 #define	PFSTATE_SCRUBMASK (PFSTATE_NODF|PFSTATE_RANDOMID|PFSTATE_SCRUB_TCP)
732 #define	PFSTATE_SETMASK   (PFSTATE_SETTOS|PFSTATE_SETPRIO)
733 
734 /*
735  * Unified state structures for pulling states out of the kernel
736  * used by pfsync(4) and the pf(4) ioctl.
737  */
738 struct pfsync_state_scrub {
739 	u_int16_t	pfss_flags;
740 	u_int8_t	pfss_ttl;	/* stashed TTL		*/
741 #define PFSYNC_SCRUB_FLAG_VALID		0x01
742 	u_int8_t	scrub_flag;
743 	u_int32_t	pfss_ts_mod;	/* timestamp modulation	*/
744 } __packed;
745 
746 struct pfsync_state_peer {
747 	struct pfsync_state_scrub scrub;	/* state is scrubbed	*/
748 	u_int32_t	seqlo;		/* Max sequence number sent	*/
749 	u_int32_t	seqhi;		/* Max the other end ACKd + win	*/
750 	u_int32_t	seqdiff;	/* Sequence number modulator	*/
751 	u_int16_t	max_win;	/* largest window (pre scaling)	*/
752 	u_int16_t	mss;		/* Maximum segment size option	*/
753 	u_int8_t	state;		/* active state level		*/
754 	u_int8_t	wscale;		/* window scaling factor	*/
755 	u_int8_t	pad[6];
756 } __packed;
757 
758 struct pfsync_state_key {
759 	struct pf_addr	 addr[2];
760 	u_int16_t	 port[2];
761 	u_int16_t	 rdomain;
762 	sa_family_t	 af;
763 	u_int8_t	 pad;
764 };
765 
766 struct pfsync_state {
767 	u_int64_t	 id;
768 	char		 ifname[IFNAMSIZ];
769 	struct pfsync_state_key	key[2];
770 	struct pfsync_state_peer src;
771 	struct pfsync_state_peer dst;
772 	struct pf_addr	 rt_addr;
773 	u_int32_t	 rule;
774 	u_int32_t	 anchor;
775 	u_int32_t	 nat_rule;
776 	u_int32_t	 creation;
777 	u_int32_t	 expire;
778 	u_int32_t	 packets[2][2];
779 	u_int32_t	 bytes[2][2];
780 	u_int32_t	 creatorid;
781 	int32_t		 rtableid[2];
782 	u_int16_t	 max_mss;
783 	sa_family_t	 af;
784 	u_int8_t	 proto;
785 	u_int8_t	 direction;
786 	u_int8_t	 log;
787 	u_int8_t	 rt;
788 	u_int8_t	 timeout;
789 	u_int8_t	 sync_flags;
790 	u_int8_t	 updates;
791 	u_int8_t	 min_ttl;
792 	u_int8_t	 set_tos;
793 	u_int16_t	 state_flags;
794 	u_int8_t	 set_prio[2];
795 } __packed;
796 
797 #define PFSYNC_FLAG_SRCNODE	0x04
798 #define PFSYNC_FLAG_NATSRCNODE	0x08
799 
800 #define pf_state_counter_hton(s,d) do {				\
801 	d[0] = htonl((s>>32)&0xffffffff);			\
802 	d[1] = htonl(s&0xffffffff);				\
803 } while (0)
804 
805 #define pf_state_counter_from_pfsync(s)				\
806 	(((u_int64_t)(s[0])<<32) | (u_int64_t)(s[1]))
807 
808 #define pf_state_counter_ntoh(s,d) do {				\
809 	d = ntohl(s[0]);					\
810 	d = d<<32;						\
811 	d += ntohl(s[1]);					\
812 } while (0)
813 
814 TAILQ_HEAD(pf_rulequeue, pf_rule);
815 
816 struct pf_anchor;
817 
818 struct pf_ruleset {
819 	struct {
820 		struct pf_rulequeue	 queues[2];
821 		struct {
822 			struct pf_rulequeue	*ptr;
823 			u_int32_t		 rcount;
824 			u_int32_t		 version;
825 			int			 open;
826 		}			 active, inactive;
827 	}			 rules;
828 	struct pf_anchor	*anchor;
829 	u_int32_t		 tticket;
830 	int			 tables;
831 	int			 topen;
832 };
833 
834 RB_HEAD(pf_anchor_global, pf_anchor);
835 RB_HEAD(pf_anchor_node, pf_anchor);
836 struct pf_anchor {
837 	RB_ENTRY(pf_anchor)	 entry_global;
838 	RB_ENTRY(pf_anchor)	 entry_node;
839 	struct pf_anchor	*parent;
840 	struct pf_anchor_node	 children;
841 	char			 name[PF_ANCHOR_NAME_SIZE];
842 	char			 path[PATH_MAX];
843 	struct pf_ruleset	 ruleset;
844 	int			 refcnt;	/* anchor rules */
845 	int			 match;
846 	struct refcnt		 ref;		/* for transactions */
847 };
848 RB_PROTOTYPE(pf_anchor_global, pf_anchor, entry_global, pf_anchor_compare)
849 RB_PROTOTYPE(pf_anchor_node, pf_anchor, entry_node, pf_anchor_compare)
850 
851 #define PF_RESERVED_ANCHOR	"_pf"
852 
853 #define PFR_TFLAG_PERSIST	0x00000001
854 #define PFR_TFLAG_CONST		0x00000002
855 #define PFR_TFLAG_ACTIVE	0x00000004
856 #define PFR_TFLAG_INACTIVE	0x00000008
857 #define PFR_TFLAG_REFERENCED	0x00000010
858 #define PFR_TFLAG_REFDANCHOR	0x00000020
859 #define PFR_TFLAG_COUNTERS	0x00000040
860 /* Adjust masks below when adding flags. */
861 #define PFR_TFLAG_USRMASK	0x00000043
862 #define PFR_TFLAG_SETMASK	0x0000003C
863 #define PFR_TFLAG_ALLMASK	0x0000007F
864 
865 struct pfr_table {
866 	char			 pfrt_anchor[PATH_MAX];
867 	char			 pfrt_name[PF_TABLE_NAME_SIZE];
868 	u_int32_t		 pfrt_flags;
869 	u_int8_t		 pfrt_fback;
870 };
871 
872 enum { PFR_FB_NONE, PFR_FB_MATCH, PFR_FB_ADDED, PFR_FB_DELETED,
873 	PFR_FB_CHANGED, PFR_FB_CLEARED, PFR_FB_DUPLICATE,
874 	PFR_FB_NOTMATCH, PFR_FB_CONFLICT, PFR_FB_NOCOUNT, PFR_FB_MAX };
875 
876 struct pfr_addr {
877 	union {
878 		struct in_addr	 _pfra_ip4addr;
879 		struct in6_addr	 _pfra_ip6addr;
880 	}		 pfra_u;
881 	char		 pfra_ifname[IFNAMSIZ];
882 	u_int32_t	 pfra_states;
883 	u_int16_t	 pfra_weight;
884 	u_int8_t	 pfra_af;
885 	u_int8_t	 pfra_net;
886 	u_int8_t	 pfra_not;
887 	u_int8_t	 pfra_fback;
888 	u_int8_t	 pfra_type;
889 	u_int8_t	 pad[7];
890 };
891 #define	pfra_ip4addr	pfra_u._pfra_ip4addr
892 #define	pfra_ip6addr	pfra_u._pfra_ip6addr
893 
894 enum { PFR_DIR_IN, PFR_DIR_OUT, PFR_DIR_MAX };
895 enum { PFR_OP_BLOCK, PFR_OP_MATCH, PFR_OP_PASS, PFR_OP_ADDR_MAX,
896     PFR_OP_TABLE_MAX };
897 #define PFR_OP_XPASS	PFR_OP_ADDR_MAX
898 
899 struct pfr_astats {
900 	struct pfr_addr	 pfras_a;
901 	u_int64_t	 pfras_packets[PFR_DIR_MAX][PFR_OP_ADDR_MAX];
902 	u_int64_t	 pfras_bytes[PFR_DIR_MAX][PFR_OP_ADDR_MAX];
903 	time_t		 pfras_tzero;
904 };
905 
906 enum { PFR_REFCNT_RULE, PFR_REFCNT_ANCHOR, PFR_REFCNT_MAX };
907 
908 struct pfr_tstats {
909 	struct pfr_table pfrts_t;
910 	u_int64_t	 pfrts_packets[PFR_DIR_MAX][PFR_OP_TABLE_MAX];
911 	u_int64_t	 pfrts_bytes[PFR_DIR_MAX][PFR_OP_TABLE_MAX];
912 	u_int64_t	 pfrts_match;
913 	u_int64_t	 pfrts_nomatch;
914 	time_t		 pfrts_tzero;
915 	int		 pfrts_cnt;
916 	int		 pfrts_refcnt[PFR_REFCNT_MAX];
917 };
918 #define	pfrts_name	pfrts_t.pfrt_name
919 #define pfrts_flags	pfrts_t.pfrt_flags
920 
921 struct pfr_kcounters {
922 	u_int64_t		 pfrkc_packets[PFR_DIR_MAX][PFR_OP_ADDR_MAX];
923 	u_int64_t		 pfrkc_bytes[PFR_DIR_MAX][PFR_OP_ADDR_MAX];
924 	u_int64_t		 states;
925 };
926 
927 /*
928  * XXX ip_ipsp.h's sockaddr_union should be converted to sockaddr *
929  * passing with correct sa_len, then a good approach for cleaning this
930  * will become more clear.
931  */
932 union pfsockaddr_union {
933 	struct sockaddr		sa;
934 	struct sockaddr_in	sin;
935 	struct sockaddr_in6	sin6;
936 };
937 
938 SLIST_HEAD(pfr_kentryworkq, pfr_kentry);
939 struct _pfr_kentry {
940 	struct radix_node	 _pfrke_node[2];
941 	union pfsockaddr_union	 _pfrke_sa;
942 	SLIST_ENTRY(pfr_kentry)	 _pfrke_workq;
943 	SLIST_ENTRY(pfr_kentry)	 _pfrke_ioq;
944 	struct pfr_kcounters	*_pfrke_counters;
945 	time_t			 _pfrke_tzero;
946 	u_int8_t		 _pfrke_af;
947 	u_int8_t		 _pfrke_net;
948 	u_int8_t		 _pfrke_flags;
949 	u_int8_t		 _pfrke_type;
950 	u_int8_t		 _pfrke_fb;
951 };
952 #define PFRKE_FLAG_NOT		0x01
953 #define PFRKE_FLAG_MARK		0x02
954 
955 /* pfrke_type */
956 enum { PFRKE_PLAIN, PFRKE_ROUTE, PFRKE_COST, PFRKE_MAX };
957 
958 struct pfr_kentry {
959 	union {
960 		struct _pfr_kentry	_ke;
961 	} u;
962 };
963 #define pfrke_node	u._ke._pfrke_node
964 #define pfrke_sa	u._ke._pfrke_sa
965 #define pfrke_workq	u._ke._pfrke_workq
966 #define pfrke_ioq	u._ke._pfrke_ioq
967 #define pfrke_counters	u._ke._pfrke_counters
968 #define pfrke_tzero	u._ke._pfrke_tzero
969 #define pfrke_af	u._ke._pfrke_af
970 #define pfrke_net	u._ke._pfrke_net
971 #define pfrke_flags	u._ke._pfrke_flags
972 #define pfrke_type	u._ke._pfrke_type
973 #define pfrke_fb	u._ke._pfrke_fb
974 
975 struct pfr_kentry_route {
976 	union {
977 		struct _pfr_kentry	_ke;
978 	} u;
979 
980 	struct pfi_kif		*kif;
981 	char			ifname[IFNAMSIZ];
982 };
983 
984 struct pfr_kentry_cost {
985 	union {
986 		struct _pfr_kentry	_ke;
987 	} u;
988 
989 	struct pfi_kif		*kif;
990 	char			ifname[IFNAMSIZ];
991 	/* Above overlaps with pfr_kentry route */
992 
993 	u_int16_t		 weight;
994 };
995 
996 struct pfr_kentry_all {
997 	union {
998 		struct _pfr_kentry		_ke;
999 		struct pfr_kentry_route		kr;
1000 		struct pfr_kentry_cost		kc;
1001 	} u;
1002 };
1003 #define pfrke_rkif	u.kr.kif
1004 #define pfrke_rifname	u.kr.ifname
1005 
1006 SLIST_HEAD(pfr_ktableworkq, pfr_ktable);
1007 RB_HEAD(pfr_ktablehead, pfr_ktable);
1008 struct pfr_ktable {
1009 	struct pfr_tstats	 pfrkt_ts;
1010 	RB_ENTRY(pfr_ktable)	 pfrkt_tree;
1011 	SLIST_ENTRY(pfr_ktable)	 pfrkt_workq;
1012 	struct radix_node_head	*pfrkt_ip4;
1013 	struct radix_node_head	*pfrkt_ip6;
1014 	struct pfr_ktable	*pfrkt_shadow;
1015 	struct pfr_ktable	*pfrkt_root;
1016 	struct pf_ruleset	*pfrkt_rs;
1017 	long			 pfrkt_larg;
1018 	int			 pfrkt_nflags;
1019 	u_int64_t		 pfrkt_refcntcost;
1020 	u_int16_t		 pfrkt_gcdweight;
1021 	u_int16_t		 pfrkt_maxweight;
1022 };
1023 #define pfrkt_t		pfrkt_ts.pfrts_t
1024 #define pfrkt_name	pfrkt_t.pfrt_name
1025 #define pfrkt_anchor	pfrkt_t.pfrt_anchor
1026 #define pfrkt_ruleset	pfrkt_t.pfrt_ruleset
1027 #define pfrkt_flags	pfrkt_t.pfrt_flags
1028 #define pfrkt_cnt	pfrkt_ts.pfrts_cnt
1029 #define pfrkt_refcnt	pfrkt_ts.pfrts_refcnt
1030 #define pfrkt_packets	pfrkt_ts.pfrts_packets
1031 #define pfrkt_bytes	pfrkt_ts.pfrts_bytes
1032 #define pfrkt_match	pfrkt_ts.pfrts_match
1033 #define pfrkt_nomatch	pfrkt_ts.pfrts_nomatch
1034 #define pfrkt_tzero	pfrkt_ts.pfrts_tzero
1035 
1036 RB_HEAD(pfi_ifhead, pfi_kif);
1037 
1038 /* state tables */
1039 extern struct pf_state_tree	 pf_statetbl;
1040 
1041 /* keep synced with pfi_kif, used in RB_FIND */
1042 struct pfi_kif_cmp {
1043 	char				 pfik_name[IFNAMSIZ];
1044 };
1045 
1046 struct ifnet;
1047 struct ifg_group;
1048 
1049 struct pfi_kif {
1050 	char				 pfik_name[IFNAMSIZ];
1051 	RB_ENTRY(pfi_kif)		 pfik_tree;
1052 	u_int64_t			 pfik_packets[2][2][2];
1053 	u_int64_t			 pfik_bytes[2][2][2];
1054 	time_t				 pfik_tzero;
1055 	int				 pfik_flags;
1056 	int				 pfik_flags_new;
1057 	void				*pfik_ah_cookie;
1058 	struct ifnet			*pfik_ifp;
1059 	struct ifg_group		*pfik_group;
1060 	int				 pfik_states;
1061 	int				 pfik_rules;
1062 	int				 pfik_routes;
1063 	int				 pfik_srcnodes;
1064 	int				 pfik_flagrefs;
1065 	TAILQ_HEAD(, pfi_dynaddr)	 pfik_dynaddrs;
1066 };
1067 
1068 enum pfi_kif_refs {
1069 	PFI_KIF_REF_NONE,
1070 	PFI_KIF_REF_STATE,
1071 	PFI_KIF_REF_RULE,
1072 	PFI_KIF_REF_ROUTE,
1073 	PFI_KIF_REF_SRCNODE,
1074 	PFI_KIF_REF_FLAG
1075 };
1076 
1077 #define PFI_IFLAG_SKIP		0x0100	/* skip filtering on interface */
1078 #define PFI_IFLAG_ANY		0x0200	/* match any non-loopback interface */
1079 
1080 /* flags for RDR options */
1081 #define PF_DPORT_RANGE	0x01		/* Dest port uses range */
1082 #define PF_RPORT_RANGE	0x02		/* RDR'ed port uses range */
1083 
1084 /* Reasons code for passing/dropping a packet */
1085 #define PFRES_MATCH	0		/* Explicit match of a rule */
1086 #define PFRES_BADOFF	1		/* Bad offset for pull_hdr */
1087 #define PFRES_FRAG	2		/* Dropping following fragment */
1088 #define PFRES_SHORT	3		/* Dropping short packet */
1089 #define PFRES_NORM	4		/* Dropping by normalizer */
1090 #define PFRES_MEMORY	5		/* Dropped due to lacking mem */
1091 #define PFRES_TS	6		/* Bad TCP Timestamp (RFC1323) */
1092 #define PFRES_CONGEST	7		/* Congestion */
1093 #define PFRES_IPOPTIONS 8		/* IP option */
1094 #define PFRES_PROTCKSUM 9		/* Protocol checksum invalid */
1095 #define PFRES_BADSTATE	10		/* State mismatch */
1096 #define PFRES_STATEINS	11		/* State insertion failure */
1097 #define PFRES_MAXSTATES	12		/* State limit */
1098 #define PFRES_SRCLIMIT	13		/* Source node/conn limit */
1099 #define PFRES_SYNPROXY	14		/* SYN proxy */
1100 #define PFRES_TRANSLATE	15		/* No translation address available */
1101 #define PFRES_NOROUTE	16		/* No route found for PBR action */
1102 #define PFRES_MAX	17		/* total+1 */
1103 
1104 #define PFRES_NAMES { \
1105 	"match", \
1106 	"bad-offset", \
1107 	"fragment", \
1108 	"short", \
1109 	"normalize", \
1110 	"memory", \
1111 	"bad-timestamp", \
1112 	"congestion", \
1113 	"ip-option", \
1114 	"proto-cksum", \
1115 	"state-mismatch", \
1116 	"state-insert", \
1117 	"state-limit", \
1118 	"src-limit", \
1119 	"synproxy", \
1120 	"translate", \
1121 	"no-route", \
1122 	NULL \
1123 }
1124 
1125 /* Counters for other things we want to keep track of */
1126 #define LCNT_STATES		0	/* states */
1127 #define LCNT_SRCSTATES		1	/* max-src-states */
1128 #define LCNT_SRCNODES		2	/* max-src-nodes */
1129 #define LCNT_SRCCONN		3	/* max-src-conn */
1130 #define LCNT_SRCCONNRATE	4	/* max-src-conn-rate */
1131 #define LCNT_OVERLOAD_TABLE	5	/* entry added to overload table */
1132 #define LCNT_OVERLOAD_FLUSH	6	/* state entries flushed */
1133 #define	LCNT_SYNFLOODS		7	/* synfloods detected */
1134 #define	LCNT_SYNCOOKIES_SENT	8	/* syncookies sent */
1135 #define	LCNT_SYNCOOKIES_VALID	9	/* syncookies validated */
1136 #define LCNT_MAX		10	/* total+1 */
1137 
1138 #define LCNT_NAMES { \
1139 	"max states per rule", \
1140 	"max-src-states", \
1141 	"max-src-nodes", \
1142 	"max-src-conn", \
1143 	"max-src-conn-rate", \
1144 	"overload table insertion", \
1145 	"overload flush states", \
1146 	"synfloods detected", \
1147 	"syncookies sent", \
1148 	"syncookies validated", \
1149 	NULL \
1150 }
1151 
1152 /* UDP state enumeration */
1153 #define PFUDPS_NO_TRAFFIC	0
1154 #define PFUDPS_SINGLE		1
1155 #define PFUDPS_MULTIPLE		2
1156 
1157 #define PFUDPS_NSTATES		3	/* number of state levels */
1158 
1159 #define PFUDPS_NAMES { \
1160 	"NO_TRAFFIC", \
1161 	"SINGLE", \
1162 	"MULTIPLE", \
1163 	NULL \
1164 }
1165 
1166 /* Other protocol state enumeration */
1167 #define PFOTHERS_NO_TRAFFIC	0
1168 #define PFOTHERS_SINGLE		1
1169 #define PFOTHERS_MULTIPLE	2
1170 
1171 #define PFOTHERS_NSTATES	3	/* number of state levels */
1172 
1173 #define PFOTHERS_NAMES { \
1174 	"NO_TRAFFIC", \
1175 	"SINGLE", \
1176 	"MULTIPLE", \
1177 	NULL \
1178 }
1179 
1180 #define FCNT_STATE_SEARCH	0
1181 #define FCNT_STATE_INSERT	1
1182 #define FCNT_STATE_REMOVALS	2
1183 #define FCNT_MAX		3
1184 
1185 #define SCNT_SRC_NODE_SEARCH	0
1186 #define SCNT_SRC_NODE_INSERT	1
1187 #define SCNT_SRC_NODE_REMOVALS	2
1188 #define SCNT_MAX		3
1189 
1190 #define NCNT_FRAG_SEARCH	0
1191 #define NCNT_FRAG_INSERT	1
1192 #define NCNT_FRAG_REMOVALS	2
1193 #define NCNT_MAX		3
1194 
1195 #define REASON_SET(a, x) \
1196 	do { \
1197 		if ((void *)(a) != NULL) { \
1198 			*(a) = (x); \
1199 			if (x < PFRES_MAX) \
1200 				pf_status.counters[x]++; \
1201 		} \
1202 	} while (0)
1203 
1204 struct pf_status {
1205 	u_int64_t	counters[PFRES_MAX];
1206 	u_int64_t	lcounters[LCNT_MAX];	/* limit counters */
1207 	u_int64_t	fcounters[FCNT_MAX];
1208 	u_int64_t	scounters[SCNT_MAX];
1209 	u_int64_t	ncounters[NCNT_MAX];
1210 	u_int64_t	pcounters[2][2][3];
1211 	u_int64_t	bcounters[2][2];
1212 	u_int64_t	stateid;
1213 	u_int64_t	syncookies_inflight[2];	/* unACKed SYNcookies */
1214 	time_t		since;
1215 	u_int32_t	running;
1216 	u_int32_t	states;
1217 	u_int32_t	states_halfopen;
1218 	u_int32_t	src_nodes;
1219 	u_int32_t	fragments;
1220 	u_int32_t	debug;
1221 	u_int32_t	hostid;
1222 	u_int32_t	reass;			/* reassembly */
1223 	u_int8_t	syncookies_active;
1224 	u_int8_t	syncookies_mode;	/* never/always/adaptive */
1225 	u_int8_t	pad[2];
1226 	char		ifname[IFNAMSIZ];
1227 	u_int8_t	pf_chksum[PF_MD5_DIGEST_LENGTH];
1228 };
1229 
1230 #define PF_REASS_ENABLED	0x01
1231 #define PF_REASS_NODF		0x02
1232 
1233 #define	PF_SYNCOOKIES_NEVER	0
1234 #define	PF_SYNCOOKIES_ALWAYS	1
1235 #define	PF_SYNCOOKIES_ADAPTIVE	2
1236 #define	PF_SYNCOOKIES_MODE_MAX	PF_SYNCOOKIES_ADAPTIVE
1237 
1238 #define	PF_SYNCOOKIES_HIWATPCT	25
1239 #define	PF_SYNCOOKIES_LOWATPCT	PF_SYNCOOKIES_HIWATPCT/2
1240 
1241 #define PF_PRIO_ZERO		0xff		/* match "prio 0" packets */
1242 
1243 struct pf_queue_bwspec {
1244 	u_int		absolute;
1245 	u_int		percent;
1246 };
1247 
1248 struct pf_queue_scspec {
1249 	struct pf_queue_bwspec	m1;
1250 	struct pf_queue_bwspec	m2;
1251 	u_int			d;
1252 };
1253 
1254 struct pf_queue_fqspec {
1255 	u_int		flows;
1256 	u_int		quantum;
1257 	u_int		target;
1258 	u_int		interval;
1259 };
1260 
1261 struct pf_queuespec {
1262 	TAILQ_ENTRY(pf_queuespec)	 entries;
1263 	char				 qname[PF_QNAME_SIZE];
1264 	char				 parent[PF_QNAME_SIZE];
1265 	char				 ifname[IFNAMSIZ];
1266 	struct pf_queue_scspec		 realtime;
1267 	struct pf_queue_scspec		 linkshare;
1268 	struct pf_queue_scspec		 upperlimit;
1269 	struct pf_queue_fqspec		 flowqueue;
1270 	struct pfi_kif			*kif;
1271 	u_int				 flags;
1272 	u_int				 qlimit;
1273 	u_int32_t			 qid;
1274 	u_int32_t			 parent_qid;
1275 };
1276 
1277 #define PFQS_FLOWQUEUE			0x0001
1278 #define PFQS_ROOTCLASS			0x0002
1279 #define PFQS_DEFAULT			0x1000 /* maps to HFSC_DEFAULTCLASS */
1280 
1281 struct priq_opts {
1282 	int		flags;
1283 };
1284 
1285 struct hfsc_opts {
1286 	/* real-time service curve */
1287 	u_int		rtsc_m1;	/* slope of the 1st segment in bps */
1288 	u_int		rtsc_d;		/* the x-projection of m1 in msec */
1289 	u_int		rtsc_m2;	/* slope of the 2nd segment in bps */
1290 	/* link-sharing service curve */
1291 	u_int		lssc_m1;
1292 	u_int		lssc_d;
1293 	u_int		lssc_m2;
1294 	/* upper-limit service curve */
1295 	u_int		ulsc_m1;
1296 	u_int		ulsc_d;
1297 	u_int		ulsc_m2;
1298 	int		flags;
1299 };
1300 
1301 struct pfq_ops {
1302 	void *		(*pfq_alloc)(struct ifnet *);
1303 	int		(*pfq_addqueue)(void *, struct pf_queuespec *);
1304 	void		(*pfq_free)(void *);
1305 	int		(*pfq_qstats)(struct pf_queuespec *, void *, int *);
1306 	/* Queue manager ops */
1307 	unsigned int	(*pfq_qlength)(void *);
1308 	struct mbuf *	(*pfq_enqueue)(void *, struct mbuf *);
1309 	struct mbuf *	(*pfq_deq_begin)(void *, void **, struct mbuf_list *);
1310 	void		(*pfq_deq_commit)(void *, struct mbuf *, void *);
1311 	void		(*pfq_purge)(void *, struct mbuf_list *);
1312 };
1313 
1314 struct pf_tagname {
1315 	TAILQ_ENTRY(pf_tagname)	entries;
1316 	char			name[PF_TAG_NAME_SIZE];
1317 	u_int16_t		tag;
1318 	int			ref;
1319 };
1320 
1321 struct pf_divert {
1322 	struct pf_addr	addr;
1323 	u_int16_t	port;
1324 	u_int16_t	rdomain;
1325 	u_int8_t	type;
1326 };
1327 
1328 enum pf_divert_types {
1329 	PF_DIVERT_NONE,
1330 	PF_DIVERT_TO,
1331 	PF_DIVERT_REPLY,
1332 	PF_DIVERT_PACKET
1333 };
1334 
1335 struct pf_pktdelay {
1336 	struct timeout	 to;
1337 	struct mbuf	*m;
1338 	u_int		 ifidx;
1339 };
1340 
1341 /* Fragment entries reference mbuf clusters, so base the default on that. */
1342 #define PFFRAG_FRENT_HIWAT	(NMBCLUSTERS / 16) /* Number of entries */
1343 #define PFFRAG_FRAG_HIWAT	(NMBCLUSTERS / 32) /* Number of packets */
1344 
1345 #define PFR_KTABLE_HIWAT	1000	/* Number of tables */
1346 #define PFR_KENTRY_HIWAT	200000	/* Number of table entries */
1347 #define PFR_KENTRY_HIWAT_SMALL	100000	/* Number of entries for tiny hosts */
1348 
1349 /*
1350  * ioctl parameter structures
1351  */
1352 
1353 struct pfioc_rule {
1354 	u_int32_t	 action;
1355 	u_int32_t	 ticket;
1356 	u_int32_t	 nr;
1357 	char		 anchor[PATH_MAX];
1358 	char		 anchor_call[PATH_MAX];
1359 	struct pf_rule	 rule;
1360 };
1361 
1362 struct pfioc_natlook {
1363 	struct pf_addr	 saddr;
1364 	struct pf_addr	 daddr;
1365 	struct pf_addr	 rsaddr;
1366 	struct pf_addr	 rdaddr;
1367 	u_int16_t	 rdomain;
1368 	u_int16_t	 rrdomain;
1369 	u_int16_t	 sport;
1370 	u_int16_t	 dport;
1371 	u_int16_t	 rsport;
1372 	u_int16_t	 rdport;
1373 	sa_family_t	 af;
1374 	u_int8_t	 proto;
1375 	u_int8_t	 direction;
1376 };
1377 
1378 struct pfioc_state {
1379 	struct pfsync_state	state;
1380 };
1381 
1382 struct pfioc_src_node_kill {
1383 	sa_family_t psnk_af;
1384 	struct pf_rule_addr psnk_src;
1385 	struct pf_rule_addr psnk_dst;
1386 	u_int		    psnk_killed;
1387 };
1388 
1389 struct pfioc_state_kill {
1390 	struct pf_state_cmp	psk_pfcmp;
1391 	sa_family_t		psk_af;
1392 	int			psk_proto;
1393 	struct pf_rule_addr	psk_src;
1394 	struct pf_rule_addr	psk_dst;
1395 	char			psk_ifname[IFNAMSIZ];
1396 	char			psk_label[PF_RULE_LABEL_SIZE];
1397 	u_int			psk_killed;
1398 	u_int16_t		psk_rdomain;
1399 };
1400 
1401 struct pfioc_states {
1402 	size_t	ps_len;
1403 	union {
1404 		caddr_t			 psu_buf;
1405 		struct pfsync_state	*psu_states;
1406 	} ps_u;
1407 #define ps_buf		ps_u.psu_buf
1408 #define ps_states	ps_u.psu_states
1409 };
1410 
1411 struct pfioc_src_nodes {
1412 	size_t	psn_len;
1413 	union {
1414 		caddr_t		 psu_buf;
1415 		struct pf_src_node	*psu_src_nodes;
1416 	} psn_u;
1417 #define psn_buf		psn_u.psu_buf
1418 #define psn_src_nodes	psn_u.psu_src_nodes
1419 };
1420 
1421 struct pfioc_tm {
1422 	int		 timeout;
1423 	int		 seconds;
1424 };
1425 
1426 struct pfioc_limit {
1427 	int		 index;
1428 	unsigned	 limit;
1429 };
1430 
1431 struct pfioc_ruleset {
1432 	u_int32_t	 nr;
1433 	char		 path[PATH_MAX];
1434 	char		 name[PF_ANCHOR_NAME_SIZE];
1435 };
1436 
1437 struct pfioc_trans {
1438 	int		 size;	/* number of elements */
1439 	int		 esize; /* size of each element in bytes */
1440 	struct pfioc_trans_e {
1441 		int		type;
1442 		char		anchor[PATH_MAX];
1443 		u_int32_t	ticket;
1444 	}		*array;
1445 };
1446 
1447 struct pfioc_queue {
1448 	u_int32_t		ticket;
1449 	u_int			nr;
1450 	struct pf_queuespec	queue;
1451 };
1452 
1453 struct pfioc_qstats {
1454 	u_int32_t		 ticket;
1455 	u_int32_t		 nr;
1456 	struct pf_queuespec	 queue;
1457 	void			*buf;
1458 	int			 nbytes;
1459 };
1460 
1461 #define PFR_FLAG_DUMMY		0x00000002
1462 #define PFR_FLAG_FEEDBACK	0x00000004
1463 #define PFR_FLAG_CLSTATS	0x00000008
1464 #define PFR_FLAG_ADDRSTOO	0x00000010
1465 #define PFR_FLAG_REPLACE	0x00000020
1466 #define PFR_FLAG_ALLRSETS	0x00000040
1467 #define PFR_FLAG_ALLMASK	0x0000007F
1468 #ifdef _KERNEL
1469 #define PFR_FLAG_USERIOCTL	0x10000000
1470 #endif
1471 
1472 struct pfioc_table {
1473 	struct pfr_table	 pfrio_table;
1474 	void			*pfrio_buffer;
1475 	int			 pfrio_esize;
1476 	int			 pfrio_size;
1477 	int			 pfrio_size2;
1478 	int			 pfrio_nadd;
1479 	int			 pfrio_ndel;
1480 	int			 pfrio_nchange;
1481 	int			 pfrio_flags;
1482 	u_int32_t		 pfrio_ticket;
1483 };
1484 #define	pfrio_exists	pfrio_nadd
1485 #define	pfrio_nzero	pfrio_nadd
1486 #define	pfrio_nmatch	pfrio_nadd
1487 #define pfrio_naddr	pfrio_size2
1488 #define pfrio_setflag	pfrio_size2
1489 #define pfrio_clrflag	pfrio_nadd
1490 
1491 struct pfioc_iface {
1492 	char	 pfiio_name[IFNAMSIZ];
1493 	void	*pfiio_buffer;
1494 	int	 pfiio_esize;
1495 	int	 pfiio_size;
1496 	int	 pfiio_nzero;
1497 	int	 pfiio_flags;
1498 };
1499 
1500 struct pfioc_synflwats {
1501 	u_int32_t	hiwat;
1502 	u_int32_t	lowat;
1503 };
1504 
1505 /*
1506  * ioctl operations
1507  */
1508 
1509 #define DIOCSTART	_IO  ('D',  1)
1510 #define DIOCSTOP	_IO  ('D',  2)
1511 #define DIOCADDRULE	_IOWR('D',  4, struct pfioc_rule)
1512 #define DIOCGETRULES	_IOWR('D',  6, struct pfioc_rule)
1513 #define DIOCGETRULE	_IOWR('D',  7, struct pfioc_rule)
1514 /* cut 8 - 17 */
1515 #define DIOCCLRSTATES	_IOWR('D', 18, struct pfioc_state_kill)
1516 #define DIOCGETSTATE	_IOWR('D', 19, struct pfioc_state)
1517 #define DIOCSETSTATUSIF _IOWR('D', 20, struct pfioc_iface)
1518 #define DIOCGETSTATUS	_IOWR('D', 21, struct pf_status)
1519 #define DIOCCLRSTATUS	_IOWR('D', 22, struct pfioc_iface)
1520 #define DIOCNATLOOK	_IOWR('D', 23, struct pfioc_natlook)
1521 #define DIOCSETDEBUG	_IOWR('D', 24, u_int32_t)
1522 #define DIOCGETSTATES	_IOWR('D', 25, struct pfioc_states)
1523 #define DIOCCHANGERULE	_IOWR('D', 26, struct pfioc_rule)
1524 /* cut 27 - 28 */
1525 #define DIOCSETTIMEOUT	_IOWR('D', 29, struct pfioc_tm)
1526 #define DIOCGETTIMEOUT	_IOWR('D', 30, struct pfioc_tm)
1527 #define DIOCADDSTATE	_IOWR('D', 37, struct pfioc_state)
1528 /* cut 38 */
1529 #define DIOCGETLIMIT	_IOWR('D', 39, struct pfioc_limit)
1530 #define DIOCSETLIMIT	_IOWR('D', 40, struct pfioc_limit)
1531 #define DIOCKILLSTATES	_IOWR('D', 41, struct pfioc_state_kill)
1532 /* cut 42 - 57 */
1533 #define	DIOCGETRULESETS	_IOWR('D', 58, struct pfioc_ruleset)
1534 #define	DIOCGETRULESET	_IOWR('D', 59, struct pfioc_ruleset)
1535 #define	DIOCRCLRTABLES	_IOWR('D', 60, struct pfioc_table)
1536 #define	DIOCRADDTABLES	_IOWR('D', 61, struct pfioc_table)
1537 #define	DIOCRDELTABLES	_IOWR('D', 62, struct pfioc_table)
1538 #define	DIOCRGETTABLES	_IOWR('D', 63, struct pfioc_table)
1539 #define	DIOCRGETTSTATS	_IOWR('D', 64, struct pfioc_table)
1540 #define DIOCRCLRTSTATS  _IOWR('D', 65, struct pfioc_table)
1541 #define	DIOCRCLRADDRS	_IOWR('D', 66, struct pfioc_table)
1542 #define	DIOCRADDADDRS	_IOWR('D', 67, struct pfioc_table)
1543 #define	DIOCRDELADDRS	_IOWR('D', 68, struct pfioc_table)
1544 #define	DIOCRSETADDRS	_IOWR('D', 69, struct pfioc_table)
1545 #define	DIOCRGETADDRS	_IOWR('D', 70, struct pfioc_table)
1546 #define	DIOCRGETASTATS	_IOWR('D', 71, struct pfioc_table)
1547 #define DIOCRCLRASTATS  _IOWR('D', 72, struct pfioc_table)
1548 #define	DIOCRTSTADDRS	_IOWR('D', 73, struct pfioc_table)
1549 #define	DIOCRSETTFLAGS	_IOWR('D', 74, struct pfioc_table)
1550 #define DIOCRINADEFINE	_IOWR('D', 77, struct pfioc_table)
1551 #define DIOCOSFPFLUSH	_IO('D', 78)
1552 #define DIOCOSFPADD	_IOWR('D', 79, struct pf_osfp_ioctl)
1553 #define DIOCOSFPGET	_IOWR('D', 80, struct pf_osfp_ioctl)
1554 #define DIOCXBEGIN      _IOWR('D', 81, struct pfioc_trans)
1555 #define DIOCXCOMMIT     _IOWR('D', 82, struct pfioc_trans)
1556 #define DIOCXROLLBACK   _IOWR('D', 83, struct pfioc_trans)
1557 #define DIOCGETSRCNODES	_IOWR('D', 84, struct pfioc_src_nodes)
1558 #define DIOCCLRSRCNODES	_IO('D', 85)
1559 #define DIOCSETHOSTID	_IOWR('D', 86, u_int32_t)
1560 #define DIOCIGETIFACES	_IOWR('D', 87, struct pfioc_iface)
1561 #define DIOCSETIFFLAG	_IOWR('D', 89, struct pfioc_iface)
1562 #define DIOCCLRIFFLAG	_IOWR('D', 90, struct pfioc_iface)
1563 #define DIOCKILLSRCNODES	_IOWR('D', 91, struct pfioc_src_node_kill)
1564 #define DIOCSETREASS	_IOWR('D', 92, u_int32_t)
1565 #define DIOCADDQUEUE	_IOWR('D', 93, struct pfioc_queue)
1566 #define DIOCGETQUEUES	_IOWR('D', 94, struct pfioc_queue)
1567 #define DIOCGETQUEUE	_IOWR('D', 95, struct pfioc_queue)
1568 #define DIOCGETQSTATS	_IOWR('D', 96, struct pfioc_qstats)
1569 #define DIOCSETSYNFLWATS	_IOWR('D', 97, struct pfioc_synflwats)
1570 #define DIOCSETSYNCOOKIES	_IOWR('D', 98, u_int8_t)
1571 #define DIOCGETSYNFLWATS	_IOWR('D', 99, struct pfioc_synflwats)
1572 #define DIOCXEND	_IOWR('D', 100, u_int32_t)
1573 
1574 #ifdef _KERNEL
1575 
1576 struct pf_pdesc;
1577 
1578 RB_HEAD(pf_src_tree, pf_src_node);
1579 RB_PROTOTYPE(pf_src_tree, pf_src_node, entry, pf_src_compare);
1580 extern struct pf_src_tree tree_src_tracking;
1581 
1582 extern struct pf_state_list pf_state_list;
1583 
1584 TAILQ_HEAD(pf_queuehead, pf_queuespec);
1585 extern struct pf_queuehead		  pf_queues[2];
1586 extern struct pf_queuehead		 *pf_queues_active, *pf_queues_inactive;
1587 
1588 extern struct pool		 pf_src_tree_pl, pf_sn_item_pl, pf_rule_pl;
1589 extern struct pool		 pf_state_pl, pf_state_key_pl, pf_state_item_pl,
1590 				    pf_rule_item_pl, pf_queue_pl,
1591 				    pf_pktdelay_pl, pf_anchor_pl;
1592 extern struct pool		 pf_state_scrub_pl;
1593 extern struct pf_rule		 pf_default_rule;
1594 
1595 extern int			 pf_tbladdr_setup(struct pf_ruleset *,
1596 				    struct pf_addr_wrap *, int);
1597 extern void			 pf_tbladdr_remove(struct pf_addr_wrap *);
1598 extern void			 pf_tbladdr_copyout(struct pf_addr_wrap *);
1599 extern void			 pf_calc_skip_steps(struct pf_rulequeue *);
1600 extern void			 pf_purge_expired_src_nodes(void);
1601 extern void			 pf_remove_state(struct pf_state *);
1602 extern void			 pf_remove_divert_state(struct inpcb *);
1603 extern void			 pf_free_state(struct pf_state *);
1604 int				 pf_insert_src_node(struct pf_src_node **,
1605 				    struct pf_rule *, enum pf_sn_types,
1606 				    sa_family_t, struct pf_addr *,
1607 				    struct pf_addr *, struct pfi_kif *);
1608 void				 pf_remove_src_node(struct pf_src_node *);
1609 struct pf_src_node		*pf_get_src_node(struct pf_state *,
1610 				    enum pf_sn_types);
1611 void				 pf_src_tree_remove_state(struct pf_state *);
1612 void				 pf_state_rm_src_node(struct pf_state *,
1613 				    struct pf_src_node *);
1614 
1615 extern struct pf_state		*pf_find_state_byid(struct pf_state_cmp *);
1616 extern struct pf_state		*pf_find_state_all(struct pf_state_key_cmp *,
1617 				    u_int, int *);
1618 extern void			 pf_state_export(struct pfsync_state *,
1619 				    struct pf_state *);
1620 int				 pf_state_import(const struct pfsync_state *,
1621 				     int);
1622 int				 pf_state_alloc_scrub_memory(
1623 				     const struct pfsync_state_peer *,
1624 				     struct pf_state_peer *);
1625 extern void			 pf_print_state(struct pf_state *);
1626 extern void			 pf_print_flags(u_int8_t);
1627 extern void			 pf_addrcpy(struct pf_addr *, struct pf_addr *,
1628 				    sa_family_t);
1629 extern void			 pf_cksum_fixup(u_int16_t *, u_int16_t,
1630 				    u_int16_t, u_int8_t);
1631 void				 pf_rm_rule(struct pf_rulequeue *,
1632 				    struct pf_rule *);
1633 struct pf_divert		*pf_find_divert(struct mbuf *);
1634 int				 pf_setup_pdesc(struct pf_pdesc *, sa_family_t,
1635 				    int, struct pfi_kif *, struct mbuf *,
1636 				    u_short *);
1637 
1638 int	pf_test(sa_family_t, int, struct ifnet *, struct mbuf **);
1639 
1640 void	pf_poolmask(struct pf_addr *, struct pf_addr*,
1641 	    struct pf_addr *, struct pf_addr *, sa_family_t);
1642 void	pf_addr_inc(struct pf_addr *, sa_family_t);
1643 
1644 void   *pf_pull_hdr(struct mbuf *, int, void *, int, u_short *, sa_family_t);
1645 #define PF_HI (true)
1646 #define PF_LO (!PF_HI)
1647 #define PF_ALGNMNT(off) (((off) % 2) == 0 ? PF_HI : PF_LO)
1648 int	pf_patch_8(struct pf_pdesc *, u_int8_t *, u_int8_t, bool);
1649 int	pf_patch_16(struct pf_pdesc *, u_int16_t *, u_int16_t);
1650 int	pf_patch_16_unaligned(struct pf_pdesc *, void *, u_int16_t, bool);
1651 int	pf_patch_32(struct pf_pdesc *, u_int32_t *, u_int32_t);
1652 int	pf_patch_32_unaligned(struct pf_pdesc *, void *, u_int32_t, bool);
1653 int	pflog_packet(struct pf_pdesc *, u_int8_t, struct pf_rule *,
1654 	    struct pf_rule *, struct pf_ruleset *, struct pf_rule *);
1655 int	pf_match_addr(u_int8_t, struct pf_addr *, struct pf_addr *,
1656 	    struct pf_addr *, sa_family_t);
1657 int	pf_match_addr_range(struct pf_addr *, struct pf_addr *,
1658 	    struct pf_addr *, sa_family_t);
1659 int	pf_match(u_int8_t, u_int32_t, u_int32_t, u_int32_t);
1660 int	pf_match_port(u_int8_t, u_int16_t, u_int16_t, u_int16_t);
1661 int	pf_match_uid(u_int8_t, uid_t, uid_t, uid_t);
1662 int	pf_match_gid(u_int8_t, gid_t, gid_t, gid_t);
1663 
1664 struct pf_state_scrub *
1665 	pf_state_scrub_get(void);
1666 void	pf_state_scrub_put(struct pf_state_scrub *);
1667 
1668 int	pf_refragment6(struct mbuf **, struct m_tag *mtag,
1669 	    struct sockaddr_in6 *, struct ifnet *, struct rtentry *);
1670 void	pf_normalize_init(void);
1671 int	pf_normalize_ip(struct pf_pdesc *, u_short *);
1672 int	pf_normalize_ip6(struct pf_pdesc *, u_short *);
1673 int	pf_normalize_tcp(struct pf_pdesc *);
1674 void	pf_normalize_tcp_cleanup(struct pf_state *);
1675 int	pf_normalize_tcp_init(struct pf_pdesc *, struct pf_state_peer *);
1676 int	pf_normalize_tcp_alloc(struct pf_state_peer *);
1677 int	pf_normalize_tcp_stateful(struct pf_pdesc *, u_short *,
1678 	    struct pf_state *, struct pf_state_peer *, struct pf_state_peer *,
1679 	    int *);
1680 int	pf_normalize_mss(struct pf_pdesc *, u_int16_t);
1681 void	pf_scrub(struct mbuf *, u_int16_t, sa_family_t, u_int8_t, u_int8_t);
1682 void	pf_purge_expired_fragments(void);
1683 int	pf_routable(struct pf_addr *addr, sa_family_t af, struct pfi_kif *,
1684 	    int);
1685 int	pf_rtlabel_match(struct pf_addr *, sa_family_t, struct pf_addr_wrap *,
1686 	    int);
1687 int	pf_socket_lookup(struct pf_pdesc *);
1688 struct pf_state_key *pf_alloc_state_key(int);
1689 int	pf_ouraddr(struct mbuf *);
1690 void	pf_pkt_addr_changed(struct mbuf *);
1691 struct inpcb *pf_inp_lookup(struct mbuf *);
1692 void	pf_inp_link(struct mbuf *, struct inpcb *);
1693 void	pf_inp_unlink(struct inpcb *);
1694 int	pf_translate(struct pf_pdesc *, struct pf_addr *, u_int16_t,
1695 	    struct pf_addr *, u_int16_t, u_int16_t, int);
1696 int	pf_translate_af(struct pf_pdesc *);
1697 void	pf_route(struct pf_pdesc *, struct pf_state *);
1698 void	pf_route6(struct pf_pdesc *, struct pf_state *);
1699 void	pf_init_threshold(struct pf_threshold *, u_int32_t, u_int32_t);
1700 int	pf_delay_pkt(struct mbuf *, u_int);
1701 
1702 void	pfr_initialize(void);
1703 int	pfr_match_addr(struct pfr_ktable *, struct pf_addr *, sa_family_t);
1704 void	pfr_update_stats(struct pfr_ktable *, struct pf_addr *,
1705 	    struct pf_pdesc *, int, int);
1706 int	pfr_pool_get(struct pf_pool *, struct pf_addr **,
1707 	    struct pf_addr **, sa_family_t);
1708 int	pfr_states_increase(struct pfr_ktable *, struct pf_addr *, int);
1709 int	pfr_states_decrease(struct pfr_ktable *, struct pf_addr *, int);
1710 struct pfr_kentry *
1711 	pfr_kentry_byaddr(struct pfr_ktable *, struct pf_addr *, sa_family_t,
1712 	    int);
1713 void	pfr_dynaddr_update(struct pfr_ktable *, struct pfi_dynaddr *);
1714 struct pfr_ktable *
1715 	pfr_attach_table(struct pf_ruleset *, char *, int);
1716 void	pfr_detach_table(struct pfr_ktable *);
1717 int	pfr_clr_tables(struct pfr_table *, int *, int);
1718 int	pfr_add_tables(struct pfr_table *, int, int *, int);
1719 int	pfr_del_tables(struct pfr_table *, int, int *, int);
1720 int	pfr_get_tables(struct pfr_table *, struct pfr_table *, int *, int);
1721 int	pfr_get_tstats(struct pfr_table *, struct pfr_tstats *, int *, int);
1722 int	pfr_clr_tstats(struct pfr_table *, int, int *, int);
1723 int	pfr_set_tflags(struct pfr_table *, int, int, int, int *, int *, int);
1724 int	pfr_clr_addrs(struct pfr_table *, int *, int);
1725 int	pfr_insert_kentry(struct pfr_ktable *, struct pfr_addr *, time_t);
1726 int	pfr_add_addrs(struct pfr_table *, struct pfr_addr *, int, int *,
1727 	    int);
1728 int	pfr_del_addrs(struct pfr_table *, struct pfr_addr *, int, int *,
1729 	    int);
1730 int	pfr_set_addrs(struct pfr_table *, struct pfr_addr *, int, int *,
1731 	    int *, int *, int *, int, u_int32_t);
1732 int	pfr_get_addrs(struct pfr_table *, struct pfr_addr *, int *, int);
1733 int	pfr_get_astats(struct pfr_table *, struct pfr_astats *, int *, int);
1734 int	pfr_clr_astats(struct pfr_table *, struct pfr_addr *, int, int *,
1735 	    int);
1736 int	pfr_tst_addrs(struct pfr_table *, struct pfr_addr *, int, int *,
1737 	    int);
1738 int	pfr_ina_begin(struct pfr_table *, u_int32_t *, int *, int);
1739 int	pfr_ina_rollback(struct pfr_table *, u_int32_t, int *, int);
1740 int	pfr_ina_commit(struct pfr_table *, u_int32_t, int *, int *, int);
1741 int	pfr_ina_define(struct pfr_table *, struct pfr_addr *, int, int *,
1742 	    int *, u_int32_t, int);
1743 struct pfr_ktable
1744 	*pfr_ktable_select_active(struct pfr_ktable *);
1745 
1746 extern struct pfi_kif		*pfi_all;
1747 
1748 void		 pfi_initialize(void);
1749 struct pfi_kif	*pfi_kif_alloc(const char *, int);
1750 void		 pfi_kif_free(struct pfi_kif *);
1751 struct pfi_kif	*pfi_kif_find(const char *);
1752 struct pfi_kif	*pfi_kif_get(const char *, struct pfi_kif **);
1753 void		 pfi_kif_ref(struct pfi_kif *, enum pfi_kif_refs);
1754 void		 pfi_kif_unref(struct pfi_kif *, enum pfi_kif_refs);
1755 int		 pfi_kif_match(struct pfi_kif *, struct pfi_kif *);
1756 void		 pfi_attach_ifnet(struct ifnet *);
1757 void		 pfi_detach_ifnet(struct ifnet *);
1758 void		 pfi_attach_ifgroup(struct ifg_group *);
1759 void		 pfi_detach_ifgroup(struct ifg_group *);
1760 void		 pfi_group_addmember(const char *);
1761 void		 pfi_group_delmember(const char *);
1762 int		 pfi_match_addr(struct pfi_dynaddr *, struct pf_addr *,
1763 		    sa_family_t);
1764 int		 pfi_dynaddr_setup(struct pf_addr_wrap *, sa_family_t, int);
1765 void		 pfi_dynaddr_remove(struct pf_addr_wrap *);
1766 void		 pfi_dynaddr_copyout(struct pf_addr_wrap *);
1767 void		 pfi_update_status(const char *, struct pf_status *);
1768 void		 pfi_get_ifaces(const char *, struct pfi_kif *, int *);
1769 int		 pfi_set_flags(const char *, int);
1770 int		 pfi_clear_flags(const char *, int);
1771 void		 pfi_xcommit(void);
1772 
1773 int		 pf_match_tag(struct mbuf *, struct pf_rule *, int *);
1774 u_int16_t	 pf_tagname2tag(char *, int);
1775 void		 pf_tag2tagname(u_int16_t, char *);
1776 void		 pf_tag_ref(u_int16_t);
1777 void		 pf_tag_unref(u_int16_t);
1778 void		 pf_tag_packet(struct mbuf *, int, int);
1779 int		 pf_addr_compare(const struct pf_addr *,
1780 		     const struct pf_addr *, sa_family_t);
1781 
1782 const struct pfq_ops
1783 		*pf_queue_manager(struct pf_queuespec *);
1784 
1785 extern struct pf_status	pf_status;
1786 extern struct pool	pf_frent_pl, pf_frag_pl;
1787 
1788 /*
1789  * Protection/ownership of pf_pool_limit:
1790  *	I	immutable after pfattach()
1791  *	p	pf_lock
1792  */
1793 
1794 struct pf_pool_limit {
1795 	void		*pp;		/* [I] */
1796 	unsigned	 limit;		/* [p] */
1797 	unsigned	 limit_new;	/* [p] */
1798 };
1799 extern struct pf_pool_limit	pf_pool_limits[PF_LIMIT_MAX];
1800 
1801 #endif /* _KERNEL */
1802 
1803 extern struct pf_anchor_global	pf_anchors;
1804 extern struct pf_anchor		pf_main_anchor;
1805 #define pf_main_ruleset		pf_main_anchor.ruleset
1806 
1807 struct tcphdr;
1808 
1809 /* these ruleset functions can be linked into userland programs (pfctl) */
1810 void			 pf_init_ruleset(struct pf_ruleset *);
1811 int			 pf_anchor_setup(struct pf_rule *,
1812 			    const struct pf_ruleset *, const char *);
1813 int			 pf_anchor_copyout(const struct pf_ruleset *,
1814 			    const struct pf_rule *, struct pfioc_rule *);
1815 void			 pf_remove_anchor(struct pf_rule *);
1816 void			 pf_remove_if_empty_ruleset(struct pf_ruleset *);
1817 struct pf_anchor	*pf_find_anchor(const char *);
1818 struct pf_ruleset	*pf_find_ruleset(const char *);
1819 struct pf_ruleset 	*pf_get_leaf_ruleset(char *, char **);
1820 struct pf_anchor 	*pf_create_anchor(struct pf_anchor *, const char *);
1821 struct pf_ruleset	*pf_find_or_create_ruleset(const char *);
1822 void			 pf_anchor_rele(struct pf_anchor *);
1823 struct pf_anchor	*pf_anchor_take(struct pf_anchor *);
1824 
1825 /* The fingerprint functions can be linked into userland programs (tcpdump) */
1826 int	pf_osfp_add(struct pf_osfp_ioctl *);
1827 #ifdef _KERNEL
1828 struct pf_osfp_enlist *
1829 	pf_osfp_fingerprint(struct pf_pdesc *);
1830 #endif /* _KERNEL */
1831 struct pf_osfp_enlist *
1832 	pf_osfp_fingerprint_hdr(const struct ip *, const struct ip6_hdr *,
1833 	    const struct tcphdr *);
1834 void	pf_osfp_flush(void);
1835 int	pf_osfp_get(struct pf_osfp_ioctl *);
1836 void	pf_osfp_initialize(void);
1837 int	pf_osfp_match(struct pf_osfp_enlist *, pf_osfp_t);
1838 struct pf_os_fingerprint *
1839 	pf_osfp_validate(void);
1840 
1841 #ifdef _KERNEL
1842 void			 pf_print_host(struct pf_addr *, u_int16_t,
1843 			    sa_family_t);
1844 int			 pf_get_transaddr(struct pf_rule *, struct pf_pdesc *,
1845 			    struct pf_src_node **, struct pf_rule **);
1846 int			 pf_map_addr(sa_family_t, struct pf_rule *,
1847 			    struct pf_addr *, struct pf_addr *,
1848 			    struct pf_addr *, struct pf_src_node **,
1849 			    struct pf_pool *, enum pf_sn_types);
1850 int			 pf_postprocess_addr(struct pf_state *);
1851 
1852 void			 pf_mbuf_link_state_key(struct mbuf *,
1853 			    struct pf_state_key *);
1854 void			 pf_mbuf_unlink_state_key(struct mbuf *);
1855 void			 pf_mbuf_link_inpcb(struct mbuf *, struct inpcb *);
1856 void			 pf_mbuf_unlink_inpcb(struct mbuf *);
1857 
1858 u_int8_t*		 pf_find_tcpopt(u_int8_t *, u_int8_t *, size_t,
1859 			    u_int8_t, u_int8_t);
1860 u_int8_t		 pf_get_wscale(struct pf_pdesc *);
1861 u_int16_t		 pf_get_mss(struct pf_pdesc *);
1862 struct mbuf *		 pf_build_tcp(const struct pf_rule *, sa_family_t,
1863 			    const struct pf_addr *, const struct pf_addr *,
1864 			    u_int16_t, u_int16_t, u_int32_t, u_int32_t,
1865 			    u_int8_t, u_int16_t, u_int16_t, u_int8_t, int,
1866 			    u_int16_t, u_int, u_int);
1867 void			 pf_send_tcp(const struct pf_rule *, sa_family_t,
1868 			    const struct pf_addr *, const struct pf_addr *,
1869 			    u_int16_t, u_int16_t, u_int32_t, u_int32_t,
1870 			    u_int8_t, u_int16_t, u_int16_t, u_int8_t, int,
1871 			    u_int16_t, u_int);
1872 void			 pf_syncookies_init(void);
1873 int			 pf_syncookies_setmode(u_int8_t);
1874 int			 pf_syncookies_setwats(u_int32_t, u_int32_t);
1875 int			 pf_syncookies_getwats(struct pfioc_synflwats *);
1876 int			 pf_synflood_check(struct pf_pdesc *);
1877 void			 pf_syncookie_send(struct pf_pdesc *);
1878 u_int8_t		 pf_syncookie_validate(struct pf_pdesc *);
1879 struct mbuf *		 pf_syncookie_recreate_syn(struct pf_pdesc *);
1880 #endif /* _KERNEL */
1881 
1882 #endif /* _NET_PFVAR_H_ */
1883