lib/libpfctl/libpfctl.h

   1 /*-
   2  * SPDX-License-Identifier: BSD-2-Clause
   3  *
   4  * Copyright (c) 2021 Rubicon Communications, LLC (Netgate)
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  *
  11  *    - Redistributions of source code must retain the above copyright
  12  *      notice, this list of conditions and the following disclaimer.
  13  *    - Redistributions in binary form must reproduce the above
  14  *      copyright notice, this list of conditions and the following
  15  *      disclaimer in the documentation and/or other materials provided
  16  *      with the distribution.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  19  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  20  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  21  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  22  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  23  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  24  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  25  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  26  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  28  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  29  * POSSIBILITY OF SUCH DAMAGE.
  30  *
  31  * $FreeBSD$
  32  */
  33
  34 #ifndef _PFCTL_IOCTL_H_
  35 #define _PFCTL_IOCTL_H_
  36
  37 #include <netpfil/pf/pf.h>
  38
  39 struct pfctl_anchor;
  40
  41 struct pfctl_pool {
  42         struct pf_palist         list;
  43         struct pf_pooladdr      *cur;
  44         struct pf_poolhashkey    key;
  45         struct pf_addr           counter;
  46         int                      tblidx;
  47         u_int16_t                proxy_port[2];
  48         u_int8_t                 opts;
  49 };
  50
  51 struct pfctl_rule {
  52         struct pf_rule_addr      src;
  53         struct pf_rule_addr      dst;
  54         union pf_rule_ptr        skip[PF_SKIP_COUNT];
  55         char                     label[PF_RULE_MAX_LABEL_COUNT][PF_RULE_LABEL_SIZE];
  56         char                     ifname[IFNAMSIZ];
  57         char                     qname[PF_QNAME_SIZE];
  58         char                     pqname[PF_QNAME_SIZE];
  59         char                     tagname[PF_TAG_NAME_SIZE];
  60         char                     match_tagname[PF_TAG_NAME_SIZE];
  61
  62         char                     overload_tblname[PF_TABLE_NAME_SIZE];
  63
  64         TAILQ_ENTRY(pfctl_rule)  entries;
  65         struct pfctl_pool        rpool;
  66
  67         u_int64_t                evaluations;
  68         u_int64_t                packets[2];
  69         u_int64_t                bytes[2];
  70
  71         struct pfi_kif          *kif;
  72         struct pfctl_anchor     *anchor;
  73         struct pfr_ktable       *overload_tbl;
  74
  75         pf_osfp_t                os_fingerprint;
  76
  77         int                      rtableid;
  78         u_int32_t                timeout[PFTM_MAX];
  79         u_int32_t                max_states;
  80         u_int32_t                max_src_nodes;
  81         u_int32_t                max_src_states;
  82         u_int32_t                max_src_conn;
  83         struct {
  84                 u_int32_t               limit;
  85                 u_int32_t               seconds;
  86         }                        max_src_conn_rate;
  87         u_int32_t                qid;
  88         u_int32_t                pqid;
  89         u_int32_t                nr;
  90         u_int32_t                prob;
  91         uid_t                    cuid;
  92         pid_t                    cpid;
  93
  94         uint64_t                 states_cur;
  95         uint64_t                 states_tot;
  96         uint64_t                 src_nodes;
  97
  98         u_int16_t                return_icmp;
  99         u_int16_t                return_icmp6;
 100         u_int16_t                max_mss;
 101         u_int16_t                tag;
 102         u_int16_t                match_tag;
 103         u_int16_t                scrub_flags;
 104
 105         struct pf_rule_uid       uid;
 106         struct pf_rule_gid       gid;
 107
 108         u_int32_t                rule_flag;
 109         u_int8_t                 action;
 110         u_int8_t                 direction;
 111         u_int8_t                 log;
 112         u_int8_t                 logif;
 113         u_int8_t                 quick;
 114         u_int8_t                 ifnot;
 115         u_int8_t                 match_tag_not;
 116         u_int8_t                 natpass;
 117
 118         u_int8_t                 keep_state;
 119         sa_family_t              af;
 120         u_int8_t                 proto;
 121         u_int8_t                 type;
 122         u_int8_t                 code;
 123         u_int8_t                 flags;
 124         u_int8_t                 flagset;
 125         u_int8_t                 min_ttl;
 126         u_int8_t                 allow_opts;
 127         u_int8_t                 rt;
 128         u_int8_t                 return_ttl;
 129         u_int8_t                 tos;
 130         u_int8_t                 set_tos;
 131         u_int8_t                 anchor_relative;
 132         u_int8_t                 anchor_wildcard;
 133
 134         u_int8_t                 flush;
 135         u_int8_t                 prio;
 136         u_int8_t                 set_prio[2];
 137
 138         struct {
 139                 struct pf_addr          addr;
 140                 u_int16_t               port;
 141         }                       divert;
 142 };
 143
 144 TAILQ_HEAD(pfctl_rulequeue, pfctl_rule);
 145
 146 struct pfctl_ruleset {
 147         struct {
 148                 struct pfctl_rulequeue   queues[2];
 149                 struct {
 150                         struct pfctl_rulequeue  *ptr;
 151                         struct pfctl_rule       **ptr_array;
 152                         u_int32_t                rcount;
 153                         u_int32_t                ticket;
 154                         int                      open;
 155                 }                        active, inactive;
 156         }                        rules[PF_RULESET_MAX];
 157         struct pfctl_anchor     *anchor;
 158         u_int32_t                tticket;
 159         int                      tables;
 160         int                      topen;
 161 };
 162
 163 RB_HEAD(pfctl_anchor_global, pfctl_anchor);
 164 RB_HEAD(pfctl_anchor_node, pfctl_anchor);
 165 struct pfctl_anchor {
 166         RB_ENTRY(pfctl_anchor)   entry_global;
 167         RB_ENTRY(pfctl_anchor)   entry_node;
 168         struct pfctl_anchor     *parent;
 169         struct pfctl_anchor_node children;
 170         char                     name[PF_ANCHOR_NAME_SIZE];
 171         char                     path[MAXPATHLEN];
 172         struct pfctl_ruleset     ruleset;
 173         int                      refcnt;        /* anchor rules */
 174         int                      match; /* XXX: used for pfctl black magic */
 175 };
 176 RB_PROTOTYPE(pfctl_anchor_global, pfctl_anchor, entry_global,
 177     pf_anchor_compare);
 178 RB_PROTOTYPE(pfctl_anchor_node, pfctl_anchor, entry_node,
 179     pf_anchor_compare);
 180
 181 int     pfctl_get_rule(int dev, u_int32_t nr, u_int32_t ticket,
 182             const char *anchor, u_int32_t ruleset, struct pfctl_rule *rule,
 183             char *anchor_call);
 184 int     pfctl_get_clear_rule(int dev, u_int32_t nr, u_int32_t ticket,
 185             const char *anchor, u_int32_t ruleset, struct pfctl_rule *rule,
 186             char *anchor_call, bool clear);
 187 int     pfctl_add_rule(int dev, const struct pfctl_rule *r,
 188             const char *anchor, const char *anchor_call, u_int32_t ticket,
 189             u_int32_t pool_ticket);
 190
 191 #endif