1 /* 2 * Copyright (c) 1993 Daniel Boulet 3 * Copyright (c) 1994 Ugen J.S.Antsilevich 4 * 5 * Redistribution and use in source forms, with and without modification, 6 * are permitted provided that this entire comment appears intact. 7 * 8 * Redistribution in binary form may occur without any restrictions. 9 * Obviously, it would be nice if you gave credit where credit is due 10 * but requiring it would be too onerous. 11 * 12 * This software is provided ``AS IS'' without any warranties of any kind. 13 * 14 * $FreeBSD: src/sys/netinet/ip_fw.h,v 1.47.2.11 2002/07/09 09:11:42 luigi Exp $ 15 * $DragonFly: src/sys/net/ipfw/ip_fw.h,v 1.7 2006/06/25 11:02:39 corecode Exp $ 16 */ 17 18 #ifndef _IP_FW_H 19 #define _IP_FW_H 20 21 #if IPFW2 22 #include "ip_fw2.h" 23 #else /* !IPFW2, good old ipfw */ 24 25 #include <sys/queue.h> 26 27 /* 28 * This union structure identifies an interface, either explicitly 29 * by name or implicitly by IP address. The flags IP_FW_F_IIFNAME 30 * and IP_FW_F_OIFNAME say how to interpret this structure. An 31 * interface unit number of -1 matches any unit number, while an 32 * IP address of 0.0.0.0 indicates matches any interface. 33 * 34 * The receive and transmit interfaces are only compared against the 35 * the packet if the corresponding bit (IP_FW_F_IIFACE or IP_FW_F_OIFACE) 36 * is set. Note some packets lack a receive or transmit interface 37 * (in which case the missing "interface" never matches). 38 */ 39 40 union ip_fw_if { 41 struct in_addr fu_via_ip; /* Specified by IP address */ 42 struct { /* Specified by interface name */ 43 #define FW_IFNLEN IFNAMSIZ 44 char name[FW_IFNLEN]; 45 short glob; 46 } fu_via_if; 47 }; 48 49 /* 50 * Format of an IP firewall descriptor 51 * 52 * fw_src, fw_dst, fw_smsk, fw_dmsk are always stored in network byte order. 53 * fw_flg and fw_n*p are stored in host byte order (of course). 54 * Port numbers are stored in HOST byte order. 55 */ 56 57 struct ip_fw { 58 LIST_ENTRY(ip_fw) next; /* bidirectional list of rules */ 59 u_int32_t fw_flg; /* Operational Flags word */ 60 u_int64_t fw_pcnt; /* Packet counters */ 61 u_int64_t fw_bcnt; /* Byte counters */ 62 struct in_addr fw_src; /* Source IP address */ 63 struct in_addr fw_dst; /* Destination IP address */ 64 struct in_addr fw_smsk; /* Mask for source IP address */ 65 struct in_addr fw_dmsk; /* Mask for destination address */ 66 u_short fw_number; /* Rule number */ 67 u_char fw_prot; /* IP protocol */ 68 #if 1 69 u_char fw_nports; /* # of src/dst port in array */ 70 #define IP_FW_GETNSRCP(rule) ((rule)->fw_nports & 0x0f) 71 #define IP_FW_SETNSRCP(rule, n) do { \ 72 (rule)->fw_nports &= ~0x0f; \ 73 (rule)->fw_nports |= (n); \ 74 } while (0) 75 #define IP_FW_GETNDSTP(rule) ((rule)->fw_nports >> 4) 76 #define IP_FW_SETNDSTP(rule, n) do { \ 77 (rule)->fw_nports &= ~0xf0; \ 78 (rule)->fw_nports |= (n) << 4;\ 79 } while (0) 80 #define IP_FW_HAVEPORTS(rule) ((rule)->fw_nports != 0) 81 #else 82 u_char __pad[1]; 83 u_int _nsrcp; 84 u_int _ndstp; 85 #define IP_FW_GETNSRCP(rule) (rule)->_nsrcp 86 #define IP_FW_SETNSRCP(rule,n) (rule)->_nsrcp = n 87 #define IP_FW_GETNDSTP(rule) (rule)->_ndstp 88 #define IP_FW_SETNDSTP(rule,n) (rule)->_ndstp = n 89 #define IP_FW_HAVEPORTS(rule) ((rule)->_ndstp + (rule)->_nsrcp != 0) 90 #endif 91 #define IP_FW_MAX_PORTS 10 /* A reasonable maximum */ 92 union { 93 u_short fw_pts[IP_FW_MAX_PORTS]; /* port numbers to match */ 94 #define IP_FW_ICMPTYPES_MAX 128 95 #define IP_FW_ICMPTYPES_DIM (IP_FW_ICMPTYPES_MAX / (sizeof(unsigned) * 8)) 96 unsigned fw_icmptypes[IP_FW_ICMPTYPES_DIM]; /*ICMP types bitmap*/ 97 } fw_uar; 98 99 u_int fw_ipflg; /* IP flags word */ 100 u_short fw_iplen; /* IP length XXX */ 101 u_short fw_ipid; /* Identification XXX */ 102 103 u_char fw_ipopt; /* IP options set */ 104 u_char fw_ipnopt; /* IP options unset */ 105 u_char fw_iptos; /* IP type of service set XXX */ 106 u_char fw_ipntos; /* IP type of service unset XXX */ 107 108 u_char fw_ipttl; /* IP time to live XXX */ 109 u_char fw_ipver:4; /* IP version XXX */ 110 u_char fw_tcpopt; /* TCP options set */ 111 u_char fw_tcpnopt; /* TCP options unset */ 112 113 u_char fw_tcpf; /* TCP flags set/unset */ 114 u_char fw_tcpnf; /* TCP flags set/unset */ 115 u_short fw_tcpwin; /* TCP window size XXX */ 116 117 u_int32_t fw_tcpseq; /* TCP sequence XXX */ 118 u_int32_t fw_tcpack; /* TCP acknowledgement XXX */ 119 120 long timestamp; /* timestamp (tv_sec) of last match */ 121 union ip_fw_if fw_in_if; /* Incoming interfaces */ 122 union ip_fw_if fw_out_if; /* Outgoing interfaces */ 123 union { 124 u_short fu_divert_port; /* Divert/tee port (options IPDIVERT) */ 125 u_short fu_pipe_nr; /* queue number (option DUMMYNET) */ 126 u_short fu_skipto_rule; /* SKIPTO command rule number */ 127 u_short fu_reject_code; /* REJECT response code */ 128 struct sockaddr_in fu_fwd_ip; 129 } fw_un; 130 131 /* 132 * N'of src ports and # of dst ports in ports array (dst ports 133 * follow src ports; max of 10 ports in all; count of 0 means 134 * match all ports) 135 */ 136 void *pipe_ptr; /* flow_set ptr for dummynet pipe */ 137 void *next_rule_ptr; /* next rule in case of match */ 138 uid_t fw_uid; /* uid to match */ 139 gid_t fw_gid; /* gid to match */ 140 int fw_logamount; /* amount to log */ 141 u_int64_t fw_loghighest; /* highest number packet to log */ 142 143 long dont_match_prob; /* 0x7fffffff means 1.0-always fail */ 144 u_char dyn_type; /* type for dynamic rule */ 145 146 #define DYN_KEEP_STATE 0 /* type for keep-state rules */ 147 #define DYN_LIMIT 1 /* type for limit connection rules */ 148 #define DYN_LIMIT_PARENT 2 /* parent entry for limit connection rules */ 149 150 /* 151 * following two fields are used to limit number of connections 152 * basing on either src, srcport, dst, dstport. 153 */ 154 u_char limit_mask; /* mask type for limit rule, can 155 * have many. 156 */ 157 #define DYN_SRC_ADDR 0x1 158 #define DYN_SRC_PORT 0x2 159 #define DYN_DST_ADDR 0x4 160 #define DYN_DST_PORT 0x8 161 162 u_short conn_limit; /* # of connections for limit rule */ 163 }; 164 165 #define fw_divert_port fw_un.fu_divert_port 166 #define fw_skipto_rule fw_un.fu_skipto_rule 167 #define fw_reject_code fw_un.fu_reject_code 168 #define fw_pipe_nr fw_un.fu_pipe_nr 169 #define fw_fwd_ip fw_un.fu_fwd_ip 170 171 /* 172 * 173 * rule_ptr -------------+ 174 * V 175 * [ next.le_next ]---->[ next.le_next ]---- [ next.le_next ]---> 176 * [ next.le_prev ]<----[ next.le_prev ]<----[ next.le_prev ]<--- 177 * [ <ip_fw> body ] [ <ip_fw> body ] [ <ip_fw> body ] 178 * 179 */ 180 181 /* 182 * Flow mask/flow id for each queue. 183 */ 184 struct ipfw_flow_id { 185 u_int32_t dst_ip; 186 u_int32_t src_ip; 187 u_int16_t dst_port; 188 u_int16_t src_port; 189 u_int8_t proto; 190 u_int8_t flags; /* protocol-specific flags */ 191 }; 192 193 /* 194 * dynamic ipfw rule 195 */ 196 struct ipfw_dyn_rule { 197 struct ipfw_dyn_rule *next; 198 struct ipfw_flow_id id; /* (masked) flow id */ 199 struct ip_fw *rule; /* pointer to rule */ 200 struct ipfw_dyn_rule *parent; /* pointer to parent rule */ 201 u_int32_t expire; /* expire time */ 202 u_int64_t pcnt; /* packet match counters */ 203 u_int64_t bcnt; /* byte match counters */ 204 u_int32_t bucket; /* which bucket in hash table */ 205 u_int32_t state; /* state of this rule (typically a 206 * combination of TCP flags) 207 */ 208 u_int16_t dyn_type; /* rule type */ 209 u_int16_t count; /* refcount */ 210 }; 211 212 /* 213 * Values for "flags" field . 214 */ 215 #define IP_FW_F_COMMAND 0x000000ff /* Mask for type of chain entry: */ 216 #define IP_FW_F_DENY 0x00000000 /* This is a deny rule */ 217 #define IP_FW_F_REJECT 0x00000001 /* Deny and send a response packet */ 218 #define IP_FW_F_ACCEPT 0x00000002 /* This is an accept rule */ 219 #define IP_FW_F_COUNT 0x00000003 /* This is a count rule */ 220 #define IP_FW_F_DIVERT 0x00000004 /* This is a divert rule */ 221 #define IP_FW_F_TEE 0x00000005 /* This is a tee rule */ 222 #define IP_FW_F_SKIPTO 0x00000006 /* This is a skipto rule */ 223 #define IP_FW_F_FWD 0x00000007 /* This is a "change forwarding 224 * address" rule 225 */ 226 #define IP_FW_F_PIPE 0x00000008 /* This is a dummynet rule */ 227 #define IP_FW_F_QUEUE 0x00000009 /* This is a dummynet queue */ 228 229 #define IP_FW_F_IN 0x00000100 /* Check inbound packets */ 230 #define IP_FW_F_OUT 0x00000200 /* Check outbound packets */ 231 #define IP_FW_F_IIFACE 0x00000400 /* Apply inbound interface test */ 232 #define IP_FW_F_OIFACE 0x00000800 /* Apply outbound interface test */ 233 #define IP_FW_F_PRN 0x00001000 /* Print if this rule matches */ 234 #define IP_FW_F_SRNG 0x00002000 /* The first two src ports are a min 235 * and max range (stored in host byte 236 * order). 237 */ 238 #define IP_FW_F_DRNG 0x00004000 /* The first two dst ports are a min 239 * and max range (stored in host byte 240 * order). 241 */ 242 #define IP_FW_F_FRAG 0x00008000 /* Fragment */ 243 #define IP_FW_F_IIFNAME 0x00010000 /* In interface by name/unit (not IP) */ 244 #define IP_FW_F_OIFNAME 0x00020000 /* Out interface by name/unit (not IP)*/ 245 #define IP_FW_F_INVSRC 0x00040000 /* Invert sense of src check */ 246 #define IP_FW_F_INVDST 0x00080000 /* Invert sense of dst check */ 247 #define IP_FW_F_ICMPBIT 0x00100000 /* ICMP type bitmap is valid */ 248 #define IP_FW_F_UID 0x00200000 /* filter by uid */ 249 #define IP_FW_F_GID 0x00400000 /* filter by gid */ 250 #define IP_FW_F_RND_MATCH 0x00800000 /* probabilistic rule match */ 251 #define IP_FW_F_SMSK 0x01000000 /* src-port + mask */ 252 #define IP_FW_F_DMSK 0x02000000 /* dst-port + mask */ 253 #define IP_FW_UNUSED0 0x04000000 254 #define IP_FW_F_KEEP_S 0x08000000 /* keep state */ 255 #define IP_FW_F_CHECK_S 0x10000000 /* check state */ 256 #define IP_FW_F_SME 0x20000000 /* source = me */ 257 #define IP_FW_F_DME 0x40000000 /* destination = me */ 258 259 #define IP_FW_F_MASK 0x7FFFFFFF /* All possible flag bits mask */ 260 261 /* 262 * Flags for the 'fw_ipflg' field, for comparing values 263 * of ip and its protocols. Not all are currently used, 264 * IP_FW_IF_*MSK list the one actually used. 265 */ 266 #define IP_FW_IF_TCPOPT 0x00000001 /* tcp options */ 267 #define IP_FW_IF_TCPFLG 0x00000002 /* tcp flags */ 268 #define IP_FW_IF_TCPSEQ 0x00000004 /* tcp sequence number */ 269 #define IP_FW_IF_TCPACK 0x00000008 /* tcp acknowledgement number */ 270 #define IP_FW_IF_TCPWIN 0x00000010 /* tcp window size */ 271 #define IP_FW_IF_TCPEST 0x00000020 /* established TCP connection */ 272 #define IP_FW_IF_TCPMSK 0x00000020 /* mask of all tcp values */ 273 274 #define IP_FW_IF_IPOPT 0x00000100 /* ip options */ 275 #define IP_FW_IF_IPLEN 0x00000200 /* ip length */ 276 #define IP_FW_IF_IPID 0x00000400 /* ip identification */ 277 #define IP_FW_IF_IPTOS 0x00000800 /* ip type of service */ 278 #define IP_FW_IF_IPTTL 0x00001000 /* ip time to live */ 279 #define IP_FW_IF_IPVER 0x00002000 /* ip version */ 280 #define IP_FW_IF_IPMSK 0x00000000 /* mask of all ip values */ 281 282 #define IP_FW_IF_MSK 0x00000020 /* All possible bits mask */ 283 284 /* 285 * For backwards compatibility with rules specifying "via iface" but 286 * not restricted to only "in" or "out" packets, we define this combination 287 * of bits to represent this configuration. 288 */ 289 290 #define IF_FW_F_VIAHACK (IP_FW_F_IN|IP_FW_F_OUT|IP_FW_F_IIFACE|IP_FW_F_OIFACE) 291 292 /* 293 * Definitions for REJECT response codes. 294 * Values less than 256 correspond to ICMP unreachable codes. 295 */ 296 #define IP_FW_REJECT_RST 0x0100 /* TCP packets: send RST */ 297 298 /* 299 * Definitions for IP option names. 300 */ 301 #define IP_FW_IPOPT_LSRR 0x01 302 #define IP_FW_IPOPT_SSRR 0x02 303 #define IP_FW_IPOPT_RR 0x04 304 #define IP_FW_IPOPT_TS 0x08 305 306 /* 307 * Definitions for TCP option names. 308 */ 309 #define IP_FW_TCPOPT_MSS 0x01 310 #define IP_FW_TCPOPT_WINDOW 0x02 311 #define IP_FW_TCPOPT_SACK 0x04 312 #define IP_FW_TCPOPT_TS 0x08 313 #define IP_FW_TCPOPT_CC 0x10 314 315 /* 316 * Definitions for TCP flags. 317 */ 318 #define IP_FW_TCPF_FIN TH_FIN 319 #define IP_FW_TCPF_SYN TH_SYN 320 #define IP_FW_TCPF_RST TH_RST 321 #define IP_FW_TCPF_PSH TH_PUSH 322 #define IP_FW_TCPF_ACK TH_ACK 323 #define IP_FW_TCPF_URG TH_URG 324 325 /* 326 * Main firewall chains definitions and global var's definitions. 327 */ 328 #ifdef _KERNEL 329 330 #define IP_FW_PORT_DYNT_FLAG 0x10000 331 #define IP_FW_PORT_TEE_FLAG 0x20000 332 #define IP_FW_PORT_DENY_FLAG 0x40000 333 334 /* 335 * arguments for calling ipfw_chk() and dummynet_io(). We put them 336 * all into a structure because this way it is easier and more 337 * efficient to pass variables around and extend the interface. 338 */ 339 struct ip_fw_args { 340 struct mbuf *m; /* the mbuf chain */ 341 struct ifnet *oif; /* output interface */ 342 struct sockaddr_in *next_hop; /* forward address */ 343 struct ip_fw *rule; /* matching rule */ 344 struct ether_header *eh; /* for bridged packets */ 345 346 struct route *ro; /* for dummynet */ 347 struct sockaddr_in *dst; /* for dummynet */ 348 int flags; /* for dummynet */ 349 350 struct ipfw_flow_id f_id; /* grabbed from IP header */ 351 u_int32_t retval; 352 }; 353 354 /* 355 * Function definitions. 356 */ 357 void ip_fw_init (void); 358 359 /* Firewall hooks */ 360 struct sockopt; 361 struct dn_flow_set; 362 void flush_pipe_ptrs(struct dn_flow_set *match); /* used by dummynet */ 363 364 typedef int ip_fw_chk_t (struct ip_fw_args *args); 365 typedef int ip_fw_ctl_t (struct sockopt *); 366 extern ip_fw_chk_t *ip_fw_chk_ptr; 367 extern ip_fw_ctl_t *ip_fw_ctl_ptr; 368 extern int fw_one_pass; 369 extern int fw_enable; 370 extern struct ipfw_flow_id last_pkt; 371 #define IPFW_LOADED (ip_fw_chk_ptr != NULL) 372 #endif /* _KERNEL */ 373 374 #endif /* !IPFW2 */ 375 #endif /* _IP_FW_H */ 376