1 /* 2 * Copyright (c) 1993 Daniel Boulet 3 * Copyright (c) 1994 Ugen J.S.Antsilevich 4 * Copyright (c) 2002 Luigi Rizzo, Universita` di Pisa 5 * Copyright (c) 2015 The DragonFly Project. All rights reserved. 6 * 7 * This code is derived from software contributed to The DragonFly Project 8 * by Bill Yuan <bycn82@gmail.com> 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in 18 * the documentation and/or other materials provided with the 19 * distribution. 20 * 3. Neither the name of The DragonFly Project nor the names of its 21 * contributors may be used to endorse or promote products derived 22 * from this software without specific, prior written permission. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 25 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 26 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 27 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 28 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 29 * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING, 30 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 31 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 32 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 33 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT 34 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 35 * SUCH DAMAGE. 36 * 37 */ 38 39 #ifndef _IP_FW3_H_ 40 #define _IP_FW3_H_ 41 42 #ifdef _KERNEL 43 #include <net/netisr2.h> 44 45 int ip_fw3_sockopt(struct sockopt *); 46 extern int ip_fw3_loaded; 47 48 #endif 49 50 #define IPFW3_LOADED (ip_fw3_loaded) 51 52 /* 53 * _IPFW2_H is from ipfw/ip_fw2.h, both cannot be included past this 54 * point but we need both the IPFW2_LOADED and IPFW3_LOADED macros 55 */ 56 #ifndef _IPFW2_H 57 #define _IPFW2_H 58 59 #define RESERVED_SIZE 12 60 #define SIZE_OF_IPFWINSN 8 61 #define LEN_OF_IPFWINSN 2 62 #define IPFW_DEFAULT_RULE 65535 /* rulenum for the default rule */ 63 #define IPFW_DEFAULT_SET 31 /* set number for the default rule */ 64 65 /* 66 * Template for instructions. 67 * 68 * ipfw_insn is used for all instructions which require no operands, 69 * a single 16-bit value (arg1), or a couple of 8-bit values. 70 * 71 * For other instructions which require different/larger arguments 72 * we have derived structures, ipfw_insn_*. 73 * 74 * The size of the instruction (in 32-bit words) is in the low 75 * 6 bits of "len". The 2 remaining bits are used to implement 76 * NOT and OR on individual instructions. Given a type, you can 77 * compute the length to be put in "len" using F_INSN_SIZE(t) 78 * 79 * F_NOT negates the match result of the instruction. 80 * 81 * F_OR is used to build or blocks. By default, instructions 82 * are evaluated as part of a logical AND. An "or" block 83 * { X or Y or Z } contains F_OR set in all but the last 84 * instruction of the block. A match will cause the code 85 * to skip past the last instruction of the block. 86 * 87 * NOTA BENE: in a couple of places we assume that 88 * sizeof(ipfw_insn) == sizeof(uint32_t) 89 * this needs to be fixed. 90 * 91 */ 92 93 #define F_NOT 0x80 94 #define F_OR 0x40 95 #define F_LEN_MASK 0x3f 96 #define F_LEN(cmd) ((cmd)->len & F_LEN_MASK) 97 98 typedef struct _ipfw_insn { /* template for instructions */ 99 uint8_t opcode; 100 uint8_t len; /* numer of 32-byte words */ 101 uint16_t arg1; 102 103 uint8_t module; 104 uint8_t arg3; 105 uint16_t arg2; 106 } ipfw_insn; 107 108 /* 109 * The F_INSN_SIZE(type) computes the size, in 4-byte words, of 110 * a given type. 111 */ 112 #define F_INSN_SIZE(t) ((sizeof (t))/sizeof(uint32_t)) 113 114 #define MTAG_IPFW 1148380143 /* IPFW-tagged cookie */ 115 116 /* 117 * This is used to store an array of 16-bit entries (ports etc.) 118 */ 119 typedef struct _ipfw_insn_u16 { 120 ipfw_insn o; 121 uint16_t ports[2]; /* there may be more */ 122 } ipfw_insn_u16; 123 124 /* 125 * This is used to store an array of 32-bit entries 126 * (uid, single IPv4 addresses etc.) 127 */ 128 typedef struct _ipfw_insn_u32 { 129 ipfw_insn o; 130 uint32_t d[1]; /* one or more */ 131 } ipfw_insn_u32; 132 133 /* 134 * This is used to store IP addr-mask pairs. 135 */ 136 typedef struct _ipfw_insn_ip { 137 ipfw_insn o; 138 struct in_addr addr; 139 struct in_addr mask; 140 } ipfw_insn_ip; 141 142 /* 143 * This is used to forward to a given address (ip) 144 */ 145 typedef struct _ipfw_insn_sa { 146 ipfw_insn o; 147 struct sockaddr_in sa; 148 } ipfw_insn_sa; 149 150 /* 151 * This is used for MAC addr-mask pairs. 152 */ 153 typedef struct _ipfw_insn_mac { 154 ipfw_insn o; 155 u_char addr[12]; /* dst[6] + src[6] */ 156 u_char mask[12]; /* dst[6] + src[6] */ 157 } ipfw_insn_mac; 158 159 /* 160 * This is used for interface match rules (recv xx, xmit xx) 161 */ 162 typedef struct _ipfw_insn_if { 163 ipfw_insn o; 164 union { 165 struct in_addr ip; 166 int glob; 167 } p; 168 char name[IFNAMSIZ]; 169 } ipfw_insn_if; 170 171 /* 172 * This is used for pipe and queue actions, which need to store 173 * a single pointer (which can have different size on different 174 * architectures. 175 */ 176 typedef struct _ipfw_insn_pipe { 177 ipfw_insn o; 178 void *pipe_ptr; 179 } ipfw_insn_pipe; 180 181 /* 182 * This is used for limit rules. 183 */ 184 typedef struct _ipfw_insn_limit { 185 ipfw_insn o; 186 uint8_t _pad; 187 uint8_t limit_mask; /* combination of DYN_* below */ 188 #define DYN_SRC_ADDR 0x1 189 #define DYN_SRC_PORT 0x2 190 #define DYN_DST_ADDR 0x4 191 #define DYN_DST_PORT 0x8 192 193 uint16_t conn_limit; 194 } ipfw_insn_limit; 195 196 197 /* 198 * Here we have the structure representing an ipfw rule. 199 * 200 * It starts with a general area (with link fields and counters) 201 * followed by an array of one or more instructions, which the code 202 * accesses as an array of 32-bit values. 203 * 204 * Given a rule pointer r: 205 * 206 * r->cmd is the start of the first instruction. 207 * ACTION_PTR(r) is the start of the first action (things to do 208 * once a rule matched). 209 * 210 * When assembling instruction, remember the following: 211 * 212 * + if a rule has a "keep-state" (or "limit") option, then the 213 * first instruction (at r->cmd) MUST BE an O_PROBE_STATE 214 * + if a rule has a "log" option, then the first action 215 * (at ACTION_PTR(r)) MUST be O_LOG 216 * 217 * NOTE: we use a simple linked list of rules because we never need 218 * to delete a rule without scanning the list. We do not use 219 * queue(3) macros for portability and readability. 220 */ 221 222 struct ip_fw { 223 struct ip_fw *next; /* linked list of rules */ 224 struct ip_fw *next_rule; /* ptr to next [skipto] rule */ 225 uint16_t act_ofs; /* offset of action in 32-bit units */ 226 uint16_t cmd_len; /* # of 32-bit words in cmd */ 227 uint16_t rulenum; /* rule number */ 228 uint8_t set; /* rule set (0..31) */ 229 uint8_t flags; /* IPFW_USR_F_ */ 230 231 /* These fields are present in all rules. */ 232 uint64_t pcnt; /* Packet counter */ 233 uint64_t bcnt; /* Byte counter */ 234 uint32_t timestamp; /* tv_sec of last match */ 235 236 struct ip_fw *sibling; /* pointer to the rule in next CPU */ 237 238 ipfw_insn cmd[1]; /* storage for commands */ 239 }; 240 241 242 #define IPFW_RULE_F_INVALID 0x1 243 #define IPFW_RULE_F_STATE 0x2 244 245 #define RULESIZE(rule) (sizeof(struct ip_fw) + (rule)->cmd_len * 4 - SIZE_OF_IPFWINSN) 246 247 /* 248 * This structure is used as a flow mask and a flow id for various 249 * parts of the code. 250 */ 251 struct ipfw_flow_id { 252 uint32_t dst_ip; 253 uint32_t src_ip; 254 uint16_t dst_port; 255 uint16_t src_port; 256 uint8_t proto; 257 uint8_t flags; /* protocol-specific flags */ 258 }; 259 260 struct ip_fw_state { 261 struct ip_fw_state *next; 262 struct ipfw_flow_id flow_id; 263 struct ip_fw *stub; 264 265 uint64_t pcnt; /* packet match counter */ 266 uint64_t bcnt; /* byte match counter */ 267 268 uint16_t lifetime; 269 uint32_t timestamp; 270 uint32_t expiry; 271 }; 272 273 274 /* ipfw_chk/ip_fw_chk_ptr return values */ 275 #define IP_FW_PASS 0 276 #define IP_FW_DENY 1 277 #define IP_FW_DIVERT 2 278 #define IP_FW_TEE 3 279 #define IP_FW_DUMMYNET 4 280 #define IP_FW_NAT 5 281 #define IP_FW_ROUTE 6 282 283 /* ipfw_chk controller values */ 284 #define IP_FW_CTL_NO 0 285 #define IP_FW_CTL_DONE 1 286 #define IP_FW_CTL_AGAIN 2 287 #define IP_FW_CTL_NEXT 3 288 #define IP_FW_CTL_NAT 4 289 #define IP_FW_CTL_LOOP 5 290 #define IP_FW_CTL_CHK_STATE 6 291 292 #define IP_FW_NOT_MATCH 0 293 #define IP_FW_MATCH 1 294 295 /* 296 * arguments for calling ipfw_chk() and dummynet_io(). We put them 297 * all into a structure because this way it is easier and more 298 * efficient to pass variables around and extend the interface. 299 */ 300 struct ip_fw_args { 301 struct mbuf *m; /* the mbuf chain */ 302 struct ifnet *oif; /* output interface */ 303 struct ip_fw *rule; /* matching rule */ 304 struct ether_header *eh; /* for bridged packets */ 305 306 struct ipfw_flow_id f_id; /* grabbed from IP header */ 307 308 /* 309 * Depend on the return value of ipfw_chk/ip_fw_chk_ptr 310 * 'cookie' field may save following information: 311 * 312 * IP_FW_TEE or IP_FW_DIVERT 313 * The divert port number 314 * 315 * IP_FW_DUMMYNET 316 * The pipe or queue number 317 */ 318 uint32_t cookie; 319 }; 320 321 #ifdef _KERNEL 322 /* 323 * Function definitions. 324 */ 325 int ip_fw_sockopt(struct sockopt *); 326 int ipfw_ctl_x(struct sockopt *sopt); 327 328 /* Firewall hooks */ 329 struct sockopt; 330 struct dn_flow_set; 331 332 typedef int ip_fw_chk_t(struct ip_fw_args *); 333 typedef int ip_fw_ctl_t(struct sockopt *); 334 typedef int ipfw_nat_cfg_t(struct sockopt *); 335 typedef void ip_fw_dn_io_t(struct mbuf *, int, int, struct ip_fw_args *); 336 337 338 extern ip_fw_chk_t *ip_fw_chk_ptr; 339 extern ip_fw_ctl_t *ip_fw_ctl_x_ptr; 340 extern ip_fw_dn_io_t *ip_fw_dn_io_ptr; 341 342 extern int fw3_one_pass; 343 extern int fw3_enable; 344 345 346 #define IPFW_CFGCPUID 0 347 #define IPFW_CFGPORT netisr_cpuport(IPFW_CFGCPUID) 348 #define IPFW_ASSERT_CFGPORT(msgport) \ 349 KASSERT((msgport) == IPFW_CFGPORT, ("not IPFW CFGPORT")) 350 351 352 struct ipfw_context { 353 struct ip_fw *ipfw_rule_chain; /* list of rules*/ 354 struct ip_fw *ipfw_default_rule; /* default rule */ 355 struct ipfw_state_context *state_ctx; 356 uint16_t state_hash_size; 357 uint32_t ipfw_set_disable; 358 }; 359 360 struct ipfw_state_context { 361 struct ip_fw_state *state; 362 struct ip_fw_state *last; 363 int count; 364 }; 365 366 struct ipfw_nat_context { 367 LIST_HEAD(, cfg_nat) nat; /* list of nat entries */ 368 }; 369 370 typedef void (*filter_func)(int *cmd_ctl,int *cmd_val,struct ip_fw_args **args, 371 struct ip_fw **f,ipfw_insn *cmd,uint16_t ip_len); 372 void register_ipfw_filter_funcs(int module,int opcode,filter_func func); 373 void unregister_ipfw_filter_funcs(int module,filter_func func); 374 void register_ipfw_module(int module_id,char *module_name); 375 int unregister_ipfw_module(int module_id); 376 377 #endif 378 379 #define ACTION_PTR(rule) \ 380 (ipfw_insn *)((uint32_t *)((rule)->cmd) + ((rule)->act_ofs)) 381 382 383 384 struct ipfw_ioc_rule { 385 uint16_t act_ofs; /* offset of action in 32-bit units */ 386 uint16_t cmd_len; /* # of 32-bit words in cmd */ 387 uint16_t rulenum; /* rule number */ 388 uint8_t set; /* rule set (0..31) */ 389 uint8_t usr_flags; /* IPFW_USR_F_ */ 390 391 /* Rule set information */ 392 uint32_t set_disable; /* disabled rule sets */ 393 uint32_t static_count; /* # of static rules */ 394 uint32_t static_len; /* total length of static rules */ 395 396 /* Statistics */ 397 uint64_t pcnt; /* Packet counter */ 398 uint64_t bcnt; /* Byte counter */ 399 uint32_t timestamp; /* tv_sec of last match */ 400 401 uint8_t reserved[RESERVED_SIZE]; 402 403 ipfw_insn cmd[1]; /* storage for commands */ 404 }; 405 406 #define IPFW_USR_F_NORULE 0x01 407 408 #define IPFW_RULE_SIZE_MAX 255 /* unit: uint32_t */ 409 410 #define IOC_RULESIZE(rule) \ 411 (sizeof(struct ipfw_ioc_rule) + (rule)->cmd_len * 4 - SIZE_OF_IPFWINSN) 412 413 struct ipfw_ioc_flowid { 414 uint16_t type; /* ETHERTYPE_ */ 415 uint16_t pad; 416 union { 417 struct { 418 uint32_t dst_ip; 419 uint32_t src_ip; 420 uint16_t dst_port; 421 uint16_t src_port; 422 uint8_t proto; 423 } ip; 424 uint8_t pad[64]; 425 } u; 426 }; 427 428 struct ipfw_ioc_state { 429 uint64_t pcnt; /* packet match counter */ 430 uint64_t bcnt; /* byte match counter */ 431 uint16_t lifetime; 432 uint32_t timestamp; /* alive time */ 433 uint32_t expiry; /* expire time */ 434 435 uint16_t rulenum; 436 uint16_t cpuid; 437 struct ipfw_flow_id flow_id; /* proto +src/dst ip/port */ 438 uint8_t reserved[16]; 439 }; 440 441 /* 442 * Definitions for IP option names. 443 */ 444 #define IP_FW_IPOPT_LSRR 0x01 445 #define IP_FW_IPOPT_SSRR 0x02 446 #define IP_FW_IPOPT_RR 0x04 447 #define IP_FW_IPOPT_TS 0x08 448 449 /* 450 * Definitions for TCP option names. 451 */ 452 #define IP_FW_TCPOPT_MSS 0x01 453 #define IP_FW_TCPOPT_WINDOW 0x02 454 #define IP_FW_TCPOPT_SACK 0x04 455 #define IP_FW_TCPOPT_TS 0x08 456 #define IP_FW_TCPOPT_CC 0x10 457 458 #define ICMP_REJECT_RST 0x100 /* fake ICMP code (send a TCP RST) */ 459 460 struct ipfw_module{ 461 int type; 462 int id; 463 char name[20]; 464 }; 465 466 #define IPFW_KEYWORD_TYPE_NONE 0 467 #define IPFW_KEYWORD_TYPE_ACTION 1 468 #define IPFW_KEYWORD_TYPE_FILTER 2 469 #define IPFW_KEYWORD_TYPE_OTHERS 3 470 471 #define IPFW_MAPPING_TYPE_NONE 0 472 #define IPFW_MAPPING_TYPE_IN_USE 1 473 474 #define NEED1(msg) {if (ac < 1) errx(EX_USAGE, msg);} 475 #define NEED2(msg) {if (ac < 2) errx(EX_USAGE, msg);} 476 #define NEED(c, n, msg) {if (c < n) errx(EX_USAGE, msg);} 477 478 #define NEXT_ARG ac--; if(ac > 0){av++;} 479 #define NEXT_ARG1 (*ac)--; if(*ac > 0){(*av)++;} 480 481 #define MATCH_REVERSE 0 482 #define MATCH_FORWARD 1 483 #define MATCH_NONE 2 484 #define MATCH_UNKNOWN 3 485 486 #define BOTH_SYN (TH_SYN | (TH_SYN << 8)) 487 #define BOTH_FIN (TH_FIN | (TH_FIN << 8)) 488 489 #define TIME_LEQ(a, b) ((int)((a) - (b)) <= 0) 490 #define L3HDR(T, ip) ((T *)((uint32_t *)(ip) + (ip)->ip_hl)) 491 492 /* IP_FW_X header/opcodes */ 493 typedef struct _ip_fw_x_header { 494 uint16_t opcode; /* Operation opcode */ 495 uint16_t _pad; /* Opcode version */ 496 } ip_fw_x_header; 497 498 typedef void ipfw_basic_delete_state_t(struct ip_fw *); 499 typedef void ipfw_basic_append_state_t(struct ipfw_ioc_state *); 500 501 /* IP_FW3 opcodes */ 502 503 #define IP_FW_ADD 50 /* add a firewall rule to chain */ 504 #define IP_FW_DEL 51 /* delete a firewall rule from chain */ 505 #define IP_FW_FLUSH 52 /* flush firewall rule chain */ 506 #define IP_FW_ZERO 53 /* clear single/all firewall counter(s) */ 507 #define IP_FW_GET 54 /* get entire firewall rule chain */ 508 #define IP_FW_RESETLOG 55 /* reset logging counters */ 509 510 #define IP_DUMMYNET_CONFIGURE 60 /* add/configure a dummynet pipe */ 511 #define IP_DUMMYNET_DEL 61 /* delete a dummynet pipe from chain */ 512 #define IP_DUMMYNET_FLUSH 62 /* flush dummynet */ 513 #define IP_DUMMYNET_GET 64 /* get entire dummynet pipes */ 514 515 #define IP_FW_MODULE 67 /* get modules names */ 516 517 #define IP_FW_NAT_CFG 68 /* add/config a nat rule */ 518 #define IP_FW_NAT_DEL 69 /* delete a nat rule */ 519 #define IP_FW_NAT_FLUSH 70 /* get configuration of a nat rule */ 520 #define IP_FW_NAT_GET 71 /* get log of a nat rule */ 521 #define IP_FW_NAT_LOG 72 /* get log of a nat rule */ 522 523 #define IP_FW_STATE_ADD 56 /* add one state */ 524 #define IP_FW_STATE_DEL 57 /* delete states of one rulenum */ 525 #define IP_FW_STATE_FLUSH 58 /* flush all states */ 526 #endif 527 528 #endif /* _IPFW3_H_ */ 529