1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2021 Rubicon Communications, LLC (Netgate) 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 11 * - Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * - Redistributions in binary form must reproduce the above 14 * copyright notice, this list of conditions and the following 15 * disclaimer in the documentation and/or other materials provided 16 * with the distribution. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 19 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 20 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 21 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 22 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 24 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 25 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 26 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 28 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 * 31 * $FreeBSD$ 32 */ 33 34 #ifndef _PFCTL_IOCTL_H_ 35 #define _PFCTL_IOCTL_H_ 36 37 #include <netpfil/pf/pf.h> 38 39 struct pfctl_anchor; 40 41 struct pfctl_pool { 42 struct pf_palist list; 43 struct pf_pooladdr *cur; 44 struct pf_poolhashkey key; 45 struct pf_addr counter; 46 struct pf_mape_portset mape; 47 int tblidx; 48 u_int16_t proxy_port[2]; 49 u_int8_t opts; 50 }; 51 52 struct pfctl_rule { 53 struct pf_rule_addr src; 54 struct pf_rule_addr dst; 55 union pf_rule_ptr skip[PF_SKIP_COUNT]; 56 char label[PF_RULE_MAX_LABEL_COUNT][PF_RULE_LABEL_SIZE]; 57 char ifname[IFNAMSIZ]; 58 char qname[PF_QNAME_SIZE]; 59 char pqname[PF_QNAME_SIZE]; 60 char tagname[PF_TAG_NAME_SIZE]; 61 char match_tagname[PF_TAG_NAME_SIZE]; 62 63 char overload_tblname[PF_TABLE_NAME_SIZE]; 64 65 TAILQ_ENTRY(pfctl_rule) entries; 66 struct pfctl_pool rpool; 67 68 u_int64_t evaluations; 69 u_int64_t packets[2]; 70 u_int64_t bytes[2]; 71 72 struct pfi_kif *kif; 73 struct pfctl_anchor *anchor; 74 struct pfr_ktable *overload_tbl; 75 76 pf_osfp_t os_fingerprint; 77 78 int rtableid; 79 u_int32_t timeout[PFTM_MAX]; 80 u_int32_t max_states; 81 u_int32_t max_src_nodes; 82 u_int32_t max_src_states; 83 u_int32_t max_src_conn; 84 struct { 85 u_int32_t limit; 86 u_int32_t seconds; 87 } max_src_conn_rate; 88 u_int32_t qid; 89 u_int32_t pqid; 90 u_int32_t nr; 91 u_int32_t prob; 92 uid_t cuid; 93 pid_t cpid; 94 95 uint64_t states_cur; 96 uint64_t states_tot; 97 uint64_t src_nodes; 98 99 u_int16_t return_icmp; 100 u_int16_t return_icmp6; 101 u_int16_t max_mss; 102 u_int16_t tag; 103 u_int16_t match_tag; 104 u_int16_t scrub_flags; 105 106 struct pf_rule_uid uid; 107 struct pf_rule_gid gid; 108 109 u_int32_t rule_flag; 110 u_int8_t action; 111 u_int8_t direction; 112 u_int8_t log; 113 u_int8_t logif; 114 u_int8_t quick; 115 u_int8_t ifnot; 116 u_int8_t match_tag_not; 117 u_int8_t natpass; 118 119 u_int8_t keep_state; 120 sa_family_t af; 121 u_int8_t proto; 122 u_int8_t type; 123 u_int8_t code; 124 u_int8_t flags; 125 u_int8_t flagset; 126 u_int8_t min_ttl; 127 u_int8_t allow_opts; 128 u_int8_t rt; 129 u_int8_t return_ttl; 130 u_int8_t tos; 131 u_int8_t set_tos; 132 u_int8_t anchor_relative; 133 u_int8_t anchor_wildcard; 134 135 u_int8_t flush; 136 u_int8_t prio; 137 u_int8_t set_prio[2]; 138 139 struct { 140 struct pf_addr addr; 141 u_int16_t port; 142 } divert; 143 }; 144 145 TAILQ_HEAD(pfctl_rulequeue, pfctl_rule); 146 147 struct pfctl_ruleset { 148 struct { 149 struct pfctl_rulequeue queues[2]; 150 struct { 151 struct pfctl_rulequeue *ptr; 152 struct pfctl_rule **ptr_array; 153 u_int32_t rcount; 154 u_int32_t ticket; 155 int open; 156 } active, inactive; 157 } rules[PF_RULESET_MAX]; 158 struct pfctl_anchor *anchor; 159 u_int32_t tticket; 160 int tables; 161 int topen; 162 }; 163 164 RB_HEAD(pfctl_anchor_global, pfctl_anchor); 165 RB_HEAD(pfctl_anchor_node, pfctl_anchor); 166 struct pfctl_anchor { 167 RB_ENTRY(pfctl_anchor) entry_global; 168 RB_ENTRY(pfctl_anchor) entry_node; 169 struct pfctl_anchor *parent; 170 struct pfctl_anchor_node children; 171 char name[PF_ANCHOR_NAME_SIZE]; 172 char path[MAXPATHLEN]; 173 struct pfctl_ruleset ruleset; 174 int refcnt; /* anchor rules */ 175 int match; /* XXX: used for pfctl black magic */ 176 }; 177 RB_PROTOTYPE(pfctl_anchor_global, pfctl_anchor, entry_global, 178 pf_anchor_compare); 179 RB_PROTOTYPE(pfctl_anchor_node, pfctl_anchor, entry_node, 180 pf_anchor_compare); 181 182 struct pfctl_state_cmp { 183 uint64_t id; 184 uint32_t creatorid; 185 uint8_t direction; 186 }; 187 188 struct pfctl_kill { 189 struct pfctl_state_cmp cmp; 190 sa_family_t af; 191 int proto; 192 struct pf_rule_addr src; 193 struct pf_rule_addr dst; 194 struct pf_rule_addr rt_addr; 195 char ifname[IFNAMSIZ]; 196 char label[PF_RULE_LABEL_SIZE]; 197 bool kill_match; 198 }; 199 200 struct pfctl_state_scrub { 201 bool timestamp; 202 uint8_t ttl; 203 uint32_t ts_mod; 204 }; 205 206 struct pfctl_state_peer { 207 struct pfctl_state_scrub *scrub; 208 uint32_t seqlo; 209 uint32_t seqhi; 210 uint32_t seqdiff; 211 uint16_t max_win; 212 uint16_t mss; 213 uint8_t state; 214 uint8_t wscale; 215 }; 216 217 struct pfctl_state_key { 218 struct pf_addr addr[2]; 219 uint16_t port[2]; 220 sa_family_t af; 221 uint8_t proto; 222 }; 223 224 struct pfctl_state { 225 TAILQ_ENTRY(pfctl_state) entry; 226 227 uint64_t id; 228 uint32_t creatorid; 229 uint8_t direction; 230 231 struct pfctl_state_peer src; 232 struct pfctl_state_peer dst; 233 234 uint32_t rule; 235 uint32_t anchor; 236 uint32_t nat_rule; 237 struct pf_addr rt_addr; 238 struct pfctl_state_key key[2]; /* addresses stack and wire */ 239 char ifname[IFNAMSIZ]; 240 char orig_ifname[IFNAMSIZ]; 241 uint64_t packets[2]; 242 uint64_t bytes[2]; 243 uint32_t creation; 244 uint32_t expire; 245 uint32_t pfsync_time; 246 uint16_t tag; 247 uint8_t log; 248 uint8_t state_flags; 249 uint8_t timeout; 250 uint32_t sync_flags; 251 }; 252 253 TAILQ_HEAD(pfctl_statelist, pfctl_state); 254 struct pfctl_states { 255 struct pfctl_statelist states; 256 size_t count; 257 }; 258 259 int pfctl_get_rule(int dev, u_int32_t nr, u_int32_t ticket, 260 const char *anchor, u_int32_t ruleset, struct pfctl_rule *rule, 261 char *anchor_call); 262 int pfctl_get_clear_rule(int dev, u_int32_t nr, u_int32_t ticket, 263 const char *anchor, u_int32_t ruleset, struct pfctl_rule *rule, 264 char *anchor_call, bool clear); 265 int pfctl_add_rule(int dev, const struct pfctl_rule *r, 266 const char *anchor, const char *anchor_call, u_int32_t ticket, 267 u_int32_t pool_ticket); 268 int pfctl_set_keepcounters(int dev, bool keep); 269 int pfctl_get_states(int dev, struct pfctl_states *states); 270 void pfctl_free_states(struct pfctl_states *states); 271 int pfctl_clear_states(int dev, const struct pfctl_kill *kill, 272 unsigned int *killed); 273 int pfctl_kill_states(int dev, const struct pfctl_kill *kill, 274 unsigned int *killed); 275 276 #endif 277