1 /* 2 * Copyright (c) 2002 Luigi Rizzo, Universita` di Pisa 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions 6 * are met: 7 * 1. Redistributions of source code must retain the above copyright 8 * notice, this list of conditions and the following disclaimer. 9 * 2. Redistributions in binary form must reproduce the above copyright 10 * notice, this list of conditions and the following disclaimer in the 11 * documentation and/or other materials provided with the distribution. 12 * 13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 14 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 15 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 16 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 17 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 18 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 19 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 20 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 21 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 22 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 23 * SUCH DAMAGE. 24 * 25 * $FreeBSD: src/sys/netinet/ip_fw2.h,v 1.1.2.2 2002/08/16 11:03:11 luigi Exp $ 26 */ 27 28 #ifndef _IPFW2_H 29 #define _IPFW2_H 30 31 #ifdef _KERNEL 32 #include <net/netisr2.h> 33 #endif 34 35 /* 36 * The kernel representation of ipfw rules is made of a list of 37 * 'instructions' (for all practical purposes equivalent to BPF 38 * instructions), which specify which fields of the packet 39 * (or its metatada) should be analysed. 40 * 41 * Each instruction is stored in a structure which begins with 42 * "ipfw_insn", and can contain extra fields depending on the 43 * instruction type (listed below). 44 * 45 * "enum ipfw_opcodes" are the opcodes supported. We can have up 46 * to 256 different opcodes. 47 */ 48 49 enum ipfw_opcodes { /* arguments (4 byte each) */ 50 O_NOP, 51 52 O_IP_SRC, /* u32 = IP */ 53 O_IP_SRC_MASK, /* ip = IP/mask */ 54 O_IP_SRC_ME, /* none */ 55 O_IP_SRC_SET, /* u32=base, arg1=len, bitmap */ 56 57 O_IP_DST, /* u32 = IP */ 58 O_IP_DST_MASK, /* ip = IP/mask */ 59 O_IP_DST_ME, /* none */ 60 O_IP_DST_SET, /* u32=base, arg1=len, bitmap */ 61 62 O_IP_SRCPORT, /* (n)port list:mask 4 byte ea */ 63 O_IP_DSTPORT, /* (n)port list:mask 4 byte ea */ 64 O_PROTO, /* arg1=protocol */ 65 66 O_MACADDR2, /* 2 mac addr:mask */ 67 O_MAC_TYPE, /* same as srcport */ 68 69 O_LAYER2, /* none */ 70 O_IN, /* none */ 71 O_FRAG, /* none */ 72 73 O_RECV, /* none */ 74 O_XMIT, /* none */ 75 O_VIA, /* none */ 76 77 O_IPOPT, /* arg1 = 2*u8 bitmap */ 78 O_IPLEN, /* arg1 = len */ 79 O_IPID, /* arg1 = id */ 80 81 O_IPTOS, /* arg1 = id */ 82 O_IPPRECEDENCE, /* arg1 = precedence << 5 */ 83 O_IPTTL, /* arg1 = TTL */ 84 85 O_IPVER, /* arg1 = version */ 86 O_UID, /* u32 = id */ 87 O_GID, /* u32 = id */ 88 O_ESTAB, /* none (tcp established) */ 89 O_TCPFLAGS, /* arg1 = 2*u8 bitmap */ 90 O_TCPWIN, /* arg1 = desired win */ 91 O_TCPSEQ, /* u32 = desired seq. */ 92 O_TCPACK, /* u32 = desired seq. */ 93 O_ICMPTYPE, /* u32 = icmp bitmap */ 94 O_TCPOPTS, /* arg1 = 2*u8 bitmap */ 95 96 O_PROBE_STATE, /* none */ 97 O_KEEP_STATE, /* none */ 98 O_LIMIT, /* ipfw_insn_limit */ 99 O_LIMIT_PARENT, /* dyn_type, not an opcode. */ 100 /* 101 * these are really 'actions', and must be last in the list. 102 */ 103 104 O_LOG, /* ipfw_insn_log */ 105 O_PROB, /* u32 = match probability */ 106 107 O_CHECK_STATE, /* none */ 108 O_ACCEPT, /* none */ 109 O_DENY, /* none */ 110 O_REJECT, /* arg1=icmp arg (same as deny) */ 111 O_COUNT, /* none */ 112 O_SKIPTO, /* arg1=next rule number */ 113 O_PIPE, /* arg1=pipe number */ 114 O_QUEUE, /* arg1=queue number */ 115 O_DIVERT, /* arg1=port number */ 116 O_TEE, /* arg1=port number */ 117 O_FORWARD_IP, /* fwd sockaddr */ 118 O_FORWARD_MAC, /* fwd mac */ 119 O_LAST_OPCODE /* not an opcode! */ 120 }; 121 122 /* 123 * Template for instructions. 124 * 125 * ipfw_insn is used for all instructions which require no operands, 126 * a single 16-bit value (arg1), or a couple of 8-bit values. 127 * 128 * For other instructions which require different/larger arguments 129 * we have derived structures, ipfw_insn_*. 130 * 131 * The size of the instruction (in 32-bit words) is in the low 132 * 6 bits of "len". The 2 remaining bits are used to implement 133 * NOT and OR on individual instructions. Given a type, you can 134 * compute the length to be put in "len" using F_INSN_SIZE(t) 135 * 136 * F_NOT negates the match result of the instruction. 137 * 138 * F_OR is used to build or blocks. By default, instructions 139 * are evaluated as part of a logical AND. An "or" block 140 * { X or Y or Z } contains F_OR set in all but the last 141 * instruction of the block. A match will cause the code 142 * to skip past the last instruction of the block. 143 * 144 * NOTA BENE: in a couple of places we assume that 145 * sizeof(ipfw_insn) == sizeof(uint32_t) 146 * this needs to be fixed. 147 * 148 */ 149 typedef struct _ipfw_insn { /* template for instructions */ 150 enum ipfw_opcodes opcode:8; 151 uint8_t len; /* numer of 32-byte words */ 152 #define F_NOT 0x80 153 #define F_OR 0x40 154 #define F_LEN_MASK 0x3f 155 #define F_LEN(cmd) ((cmd)->len & F_LEN_MASK) 156 157 uint16_t arg1; 158 } ipfw_insn; 159 160 /* 161 * The F_INSN_SIZE(type) computes the size, in 4-byte words, of 162 * a given type. 163 */ 164 #define F_INSN_SIZE(t) ((sizeof (t))/sizeof(uint32_t)) 165 166 /* 167 * This is used to store an array of 16-bit entries (ports etc.) 168 */ 169 typedef struct _ipfw_insn_u16 { 170 ipfw_insn o; 171 uint16_t ports[2]; /* there may be more */ 172 } ipfw_insn_u16; 173 174 /* 175 * This is used to store an array of 32-bit entries 176 * (uid, single IPv4 addresses etc.) 177 */ 178 typedef struct _ipfw_insn_u32 { 179 ipfw_insn o; 180 uint32_t d[1]; /* one or more */ 181 } ipfw_insn_u32; 182 183 /* 184 * This is used to store IP addr-mask pairs. 185 */ 186 typedef struct _ipfw_insn_ip { 187 ipfw_insn o; 188 struct in_addr addr; 189 struct in_addr mask; 190 } ipfw_insn_ip; 191 192 /* 193 * This is used to forward to a given address (ip) 194 */ 195 typedef struct _ipfw_insn_sa { 196 ipfw_insn o; 197 struct sockaddr_in sa; 198 } ipfw_insn_sa; 199 200 /* 201 * This is used for MAC addr-mask pairs. 202 */ 203 typedef struct _ipfw_insn_mac { 204 ipfw_insn o; 205 u_char addr[12]; /* dst[6] + src[6] */ 206 u_char mask[12]; /* dst[6] + src[6] */ 207 } ipfw_insn_mac; 208 209 /* 210 * This is used for interface match rules (recv xx, xmit xx) 211 */ 212 typedef struct _ipfw_insn_if { 213 ipfw_insn o; 214 union { 215 struct in_addr ip; 216 int glob; 217 } p; 218 char name[IFNAMSIZ]; 219 } ipfw_insn_if; 220 221 /* 222 * This is used for pipe and queue actions, which need to store 223 * a single pointer (which can have different size on different 224 * architectures. 225 */ 226 typedef struct _ipfw_insn_pipe { 227 ipfw_insn o; 228 void *pipe_ptr; 229 } ipfw_insn_pipe; 230 231 /* 232 * This is used for limit rules. 233 */ 234 typedef struct _ipfw_insn_limit { 235 ipfw_insn o; 236 uint8_t _pad; 237 uint8_t limit_mask; /* combination of DYN_* below */ 238 #define DYN_SRC_ADDR 0x1 239 #define DYN_SRC_PORT 0x2 240 #define DYN_DST_ADDR 0x4 241 #define DYN_DST_PORT 0x8 242 243 uint16_t conn_limit; 244 } ipfw_insn_limit; 245 246 /* 247 * This is used for log instructions 248 */ 249 typedef struct _ipfw_insn_log { 250 ipfw_insn o; 251 uint32_t max_log; /* how many do we log -- 0 = all */ 252 uint32_t log_left; /* how many left to log */ 253 } ipfw_insn_log; 254 255 #ifdef _KERNEL 256 257 struct ip_fw; 258 struct ip_fw_stub { 259 struct ip_fw *rule[1]; 260 }; 261 262 /* 263 * Here we have the structure representing an ipfw rule. 264 * 265 * It starts with a general area (with link fields and counters) 266 * followed by an array of one or more instructions, which the code 267 * accesses as an array of 32-bit values. 268 * 269 * Given a rule pointer r: 270 * 271 * r->cmd is the start of the first instruction. 272 * ACTION_PTR(r) is the start of the first action (things to do 273 * once a rule matched). 274 * 275 * When assembling instruction, remember the following: 276 * 277 * + if a rule has a "keep-state" (or "limit") option, then the 278 * first instruction (at r->cmd) MUST BE an O_PROBE_STATE 279 * + if a rule has a "log" option, then the first action 280 * (at ACTION_PTR(r)) MUST be O_LOG 281 * 282 * NOTE: we use a simple linked list of rules because we never need 283 * to delete a rule without scanning the list. We do not use 284 * queue(3) macros for portability and readability. 285 */ 286 287 struct ip_fw { 288 struct ip_fw *next; /* linked list of rules */ 289 struct ip_fw *next_rule; /* ptr to next [skipto] rule */ 290 uint16_t act_ofs; /* offset of action in 32-bit units */ 291 uint16_t cmd_len; /* # of 32-bit words in cmd */ 292 uint16_t rulenum; /* rule number */ 293 uint8_t set; /* rule set (0..31) */ 294 uint8_t usr_flags; /* IPFW_USR_F_ */ 295 296 /* These fields are present in all rules. */ 297 uint64_t pcnt; /* Packet counter */ 298 uint64_t bcnt; /* Byte counter */ 299 uint32_t timestamp; /* tv_sec of last match */ 300 301 struct ip_fw_stub *stub; /* back pointers to clones */ 302 struct ip_fw *sibling; /* clone on next cpu */ 303 int cpuid; /* owner cpu */ 304 305 uint32_t refcnt; /* Ref count for transit pkts */ 306 uint32_t rule_flags; /* IPFW_RULE_F_ */ 307 308 ipfw_insn cmd[1]; /* storage for commands */ 309 }; 310 311 #define IPFW_RULE_F_INVALID 0x1 312 #define IPFW_RULE_F_STATE 0x2 313 314 #define RULESIZE(rule) (sizeof(struct ip_fw) + (rule)->cmd_len * 4 - 4) 315 316 /* 317 * This structure is used as a flow mask and a flow id for various 318 * parts of the code. 319 */ 320 struct ipfw_flow_id { 321 uint32_t dst_ip; 322 uint32_t src_ip; 323 uint16_t dst_port; 324 uint16_t src_port; 325 uint8_t proto; 326 uint8_t flags; /* protocol-specific flags */ 327 }; 328 329 /* 330 * dynamic ipfw rule 331 */ 332 typedef struct _ipfw_dyn_rule ipfw_dyn_rule; 333 334 struct _ipfw_dyn_rule { 335 ipfw_dyn_rule *next; /* linked list of rules. */ 336 struct ipfw_flow_id id; /* (masked) flow id */ 337 #ifdef notyet 338 struct ip_fw *rule; /* pointer to rule */ 339 #else 340 const struct ip_fw_stub *stub; /* pointer to rule's stub */ 341 #endif 342 ipfw_dyn_rule *parent; /* pointer to parent rule */ 343 uint32_t expire; /* expire time */ 344 uint64_t pcnt; /* packet match counter */ 345 uint64_t bcnt; /* byte match counter */ 346 uint32_t bucket; /* which bucket in hash table */ 347 uint32_t state; /* state of this rule (typically a 348 * combination of TCP flags) 349 */ 350 uint32_t ack_fwd; /* most recent ACKs in forward */ 351 uint32_t ack_rev; /* and reverse directions (used */ 352 /* to generate keepalives) */ 353 uint16_t dyn_type; /* rule type */ 354 uint16_t count; /* refcount */ 355 time_t keep_alive; /* last keep-alive sending time */ 356 }; 357 358 /* 359 * Main firewall chains definitions and global var's definitions. 360 */ 361 362 /* ipfw_chk/ip_fw_chk_ptr return values */ 363 #define IP_FW_PASS 0 364 #define IP_FW_DENY 1 365 #define IP_FW_DIVERT 2 366 #define IP_FW_TEE 3 367 #define IP_FW_DUMMYNET 4 368 369 /* 370 * arguments for calling ipfw_chk() and dummynet_io(). We put them 371 * all into a structure because this way it is easier and more 372 * efficient to pass variables around and extend the interface. 373 */ 374 struct ip_fw_args { 375 struct mbuf *m; /* the mbuf chain */ 376 struct ifnet *oif; /* output interface */ 377 struct ip_fw *rule; /* matching rule */ 378 struct ether_header *eh; /* for bridged packets */ 379 380 struct ipfw_flow_id f_id; /* grabbed from IP header */ 381 382 /* 383 * Depend on the return value of ipfw_chk/ip_fw_chk_ptr 384 * 'cookie' field may save following information: 385 * 386 * IP_FW_TEE or IP_FW_DIVERT 387 * The divert port number 388 * 389 * IP_FW_DUMMYNET 390 * The pipe or queue number 391 */ 392 uint32_t cookie; 393 }; 394 395 /* 396 * Function definitions. 397 */ 398 int ip_fw_sockopt(struct sockopt *); 399 400 /* Firewall hooks */ 401 struct sockopt; 402 struct dn_flow_set; 403 404 typedef int ip_fw_chk_t(struct ip_fw_args *); 405 typedef int ip_fw_ctl_t(struct sockopt *); 406 typedef void ip_fw_dn_io_t(struct mbuf *, int, int, struct ip_fw_args *); 407 408 extern ip_fw_chk_t *ip_fw_chk_ptr; 409 extern ip_fw_ctl_t *ip_fw_ctl_ptr; 410 extern ip_fw_dn_io_t *ip_fw_dn_io_ptr; 411 412 extern int fw_one_pass; 413 extern int fw_enable; 414 415 extern int ip_fw_loaded; 416 #define IPFW_LOADED (ip_fw_loaded) 417 418 #define IPFW_CFGCPUID 0 419 #define IPFW_CFGPORT netisr_cpuport(IPFW_CFGCPUID) 420 #define IPFW_ASSERT_CFGPORT(msgport) \ 421 KASSERT((msgport) == IPFW_CFGPORT, ("not IPFW CFGPORT")) 422 423 #endif /* _KERNEL */ 424 425 #define ACTION_PTR(rule) \ 426 (ipfw_insn *)((uint32_t *)((rule)->cmd) + ((rule)->act_ofs)) 427 428 struct ipfw_ioc_rule { 429 uint16_t act_ofs; /* offset of action in 32-bit units */ 430 uint16_t cmd_len; /* # of 32-bit words in cmd */ 431 uint16_t rulenum; /* rule number */ 432 uint8_t set; /* rule set (0..31) */ 433 uint8_t usr_flags; /* IPFW_USR_F_ */ 434 435 /* Rule set information */ 436 uint32_t set_disable; /* disabled rule sets */ 437 uint32_t static_count; /* # of static rules */ 438 uint32_t static_len; /* total length of static rules */ 439 440 /* Statistics */ 441 uint64_t pcnt; /* Packet counter */ 442 uint64_t bcnt; /* Byte counter */ 443 uint32_t timestamp; /* tv_sec of last match */ 444 445 uint8_t reserved[16]; 446 447 ipfw_insn cmd[1]; /* storage for commands */ 448 }; 449 450 #define IPFW_USR_F_NORULE 0x01 451 452 #define IPFW_RULE_SIZE_MAX 255 /* unit: uint32_t */ 453 454 #define IOC_RULESIZE(rule) \ 455 (sizeof(struct ipfw_ioc_rule) + (rule)->cmd_len * 4 - 4) 456 457 struct ipfw_ioc_flowid { 458 uint16_t type; /* ETHERTYPE_ */ 459 uint16_t pad; 460 union { 461 struct { 462 uint32_t dst_ip; 463 uint32_t src_ip; 464 uint16_t dst_port; 465 uint16_t src_port; 466 uint8_t proto; 467 } ip; 468 uint8_t pad[64]; 469 } u; 470 }; 471 472 struct ipfw_ioc_state { 473 uint32_t expire; /* expire time */ 474 uint64_t pcnt; /* packet match counter */ 475 uint64_t bcnt; /* byte match counter */ 476 477 uint16_t dyn_type; /* rule type */ 478 uint16_t count; /* refcount */ 479 480 uint16_t rulenum; 481 uint16_t pad; 482 483 int cpu; /* reserved */ 484 485 struct ipfw_ioc_flowid id; /* (masked) flow id */ 486 uint8_t reserved[16]; 487 }; 488 489 /* 490 * Definitions for IP option names. 491 */ 492 #define IP_FW_IPOPT_LSRR 0x01 493 #define IP_FW_IPOPT_SSRR 0x02 494 #define IP_FW_IPOPT_RR 0x04 495 #define IP_FW_IPOPT_TS 0x08 496 497 /* 498 * Definitions for TCP option names. 499 */ 500 #define IP_FW_TCPOPT_MSS 0x01 501 #define IP_FW_TCPOPT_WINDOW 0x02 502 #define IP_FW_TCPOPT_SACK 0x04 503 #define IP_FW_TCPOPT_TS 0x08 504 #define IP_FW_TCPOPT_CC 0x10 505 506 #define ICMP_REJECT_RST 0x100 /* fake ICMP code (send a TCP RST) */ 507 508 #endif /* _IPFW2_H */ 509