1 /* $OpenBSD: if_pfsync.h,v 1.35 2008/06/29 08:42:15 mcbride Exp $ */
4 * Copyright (c) 2001 Michael Shalayeff
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR OR HIS RELATIVES BE LIABLE FOR ANY DIRECT,
20 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
21 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
22 * SERVICES; LOSS OF MIND, USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
24 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
25 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
26 * THE POSSIBILITY OF SUCH DAMAGE.
30 * Copyright (c) 2008 David Gwynne <dlg@openbsd.org>
32 * Permission to use, copy, modify, and distribute this software for any
33 * purpose with or without fee is hereby granted, provided that the above
34 * copyright notice and this permission notice appear in all copies.
36 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
37 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
38 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
39 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
40 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
41 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
42 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
45 #ifndef _NET_IF_PFSYNC_H_
46 #define _NET_IF_PFSYNC_H_
48 #define PFSYNC_VERSION 5
49 #define PFSYNC_DFLTTL 255
51 #define PFSYNC_ACT_CLR 0 /* clear all states */
52 #define PFSYNC_ACT_INS 1 /* insert state */
53 #define PFSYNC_ACT_INS_ACK 2 /* ack of insterted state */
54 #define PFSYNC_ACT_UPD 3 /* update state */
55 #define PFSYNC_ACT_UPD_C 4 /* "compressed" update state */
56 #define PFSYNC_ACT_UPD_REQ 5 /* request "uncompressed" state */
57 #define PFSYNC_ACT_DEL 6 /* delete state */
58 #define PFSYNC_ACT_DEL_C 7 /* "compressed" delete state */
59 #define PFSYNC_ACT_INS_F 8 /* insert fragment */
60 #define PFSYNC_ACT_DEL_F 9 /* delete fragments */
61 #define PFSYNC_ACT_BUS 10 /* bulk update status */
62 #define PFSYNC_ACT_TDB 11 /* TDB replay counter update */
63 #define PFSYNC_ACT_EOF 12 /* end of frame */
64 #define PFSYNC_ACT_MAX 13
66 #define PFSYNC_ACTIONS "CLR ST", \
80 #define PFSYNC_HMAC_LEN 20
83 * A pfsync frame is built from a header followed by several sections which
84 * are all prefixed with their own subheaders. Frames must be terminated with
89 * +============================+
91 * +----------------------------+
92 * | pfsync_subheader |
93 * +----------------------------+
94 * | first action fields |
96 * +----------------------------+
97 * | pfsync_subheader |
98 * +----------------------------+
99 * | second action fields |
101 * +----------------------------+
102 * | EOF pfsync_subheader |
103 * +----------------------------+
105 * +============================+
112 struct pfsync_header {
116 u_int8_t pfcksum[PF_MD5_DIGEST_LENGTH];
120 * Frame region subheader
123 struct pfsync_subheader {
134 char ifname[IFNAMSIZ];
142 /* these use struct pfsync_state in pfvar.h */
148 struct pfsync_ins_ack {
157 struct pfsync_upd_c {
159 struct pfsync_state_peer src;
160 struct pfsync_state_peer dst;
171 struct pfsync_upd_req {
180 struct pfsync_del_c {
189 /* not implemented (yet) */
199 #define PFSYNC_BUS_START 1
200 #define PFSYNC_BUS_END 2
210 union sockaddr_union dst;
223 u_int8_t hmac[PFSYNC_HMAC_LEN];
226 #define PFSYNC_HDRLEN sizeof(struct pfsync_header)
231 * Names for PFSYNC sysctl objects
233 #define PFSYNCCTL_STATS 1 /* PFSYNC stats */
234 #define PFSYNCCTL_MAXID 2
236 #define PFSYNCCTL_NAMES { \
238 { "stats", CTLTYPE_STRUCT }, \
242 u_int64_t pfsyncs_ipackets; /* total input packets, IPv4 */
243 u_int64_t pfsyncs_ipackets6; /* total input packets, IPv6 */
244 u_int64_t pfsyncs_badif; /* not the right interface */
245 u_int64_t pfsyncs_badttl; /* TTL is not PFSYNC_DFLTTL */
246 u_int64_t pfsyncs_hdrops; /* packets shorter than hdr */
247 u_int64_t pfsyncs_badver; /* bad (incl unsupp) version */
248 u_int64_t pfsyncs_badact; /* bad action */
249 u_int64_t pfsyncs_badlen; /* data length does not match */
250 u_int64_t pfsyncs_badauth; /* bad authentication */
251 u_int64_t pfsyncs_stale; /* stale state */
252 u_int64_t pfsyncs_badval; /* bad values */
253 u_int64_t pfsyncs_badstate; /* insert/lookup failed */
255 u_int64_t pfsyncs_opackets; /* total output packets, IPv4 */
256 u_int64_t pfsyncs_opackets6; /* total output packets, IPv6 */
257 u_int64_t pfsyncs_onomem; /* no memory for an mbuf */
258 u_int64_t pfsyncs_oerrors; /* ip output error */
260 u_int64_t pfsyncs_iacts[PFSYNC_ACT_MAX];
261 u_int64_t pfsyncs_oacts[PFSYNC_ACT_MAX];
265 * Configuration structure for SIOCSETPFSYNC SIOCGETPFSYNC
268 char pfsyncr_syncdev[IFNAMSIZ];
269 struct in_addr pfsyncr_syncpeer;
270 int pfsyncr_maxupdates;
274 #define SIOCSETPFSYNC _IOW('i', 247, struct ifreq)
275 #define SIOCGETPFSYNC _IOWR('i', 248, struct ifreq)
280 * this shows where a pf state is with respect to the syncing.
282 #define PFSYNC_S_INS 0x00
283 #define PFSYNC_S_IACK 0x01
284 #define PFSYNC_S_UPD 0x02
285 #define PFSYNC_S_UPD_C 0x03
286 #define PFSYNC_S_DEL 0x04
287 #define PFSYNC_S_COUNT 0x05
289 #define PFSYNC_S_DEFER 0xfe
290 #define PFSYNC_S_NONE 0xff
292 #define PFSYNC_SI_IOCTL 0x01
293 #define PFSYNC_SI_CKSUM 0x02
294 #define PFSYNC_SI_ACK 0x04
298 #endif /* _NET_IF_PFSYNC_H_ */