1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2021 Rubicon Communications, LLC (Netgate) 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 11 * - Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * - Redistributions in binary form must reproduce the above 14 * copyright notice, this list of conditions and the following 15 * disclaimer in the documentation and/or other materials provided 16 * with the distribution. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 19 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 20 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 21 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 22 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 24 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 25 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 26 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 28 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 #ifndef _PFCTL_IOCTL_H_ 33 #define _PFCTL_IOCTL_H_ 34 35 #include <netpfil/pf/pf.h> 36 37 struct pfctl_anchor; 38 39 struct pfctl_status_counter { 40 uint64_t id; 41 uint64_t counter; 42 char *name; 43 44 TAILQ_ENTRY(pfctl_status_counter) entry; 45 }; 46 TAILQ_HEAD(pfctl_status_counters, pfctl_status_counter); 47 48 struct pfctl_status { 49 bool running; 50 uint32_t since; 51 uint32_t debug; 52 uint32_t hostid; 53 uint64_t states; 54 uint64_t src_nodes; 55 char ifname[IFNAMSIZ]; 56 uint8_t pf_chksum[PF_MD5_DIGEST_LENGTH]; 57 bool syncookies_active; 58 59 struct pfctl_status_counters counters; 60 struct pfctl_status_counters lcounters; 61 struct pfctl_status_counters fcounters; 62 struct pfctl_status_counters scounters; 63 uint64_t pcounters[2][2][2]; 64 uint64_t bcounters[2][2]; 65 }; 66 67 struct pfctl_pool { 68 struct pf_palist list; 69 struct pf_pooladdr *cur; 70 struct pf_poolhashkey key; 71 struct pf_addr counter; 72 struct pf_mape_portset mape; 73 int tblidx; 74 uint16_t proxy_port[2]; 75 uint8_t opts; 76 }; 77 78 struct pfctl_rules_info { 79 uint32_t nr; 80 uint32_t ticket; 81 }; 82 83 struct pfctl_rule { 84 struct pf_rule_addr src; 85 struct pf_rule_addr dst; 86 union pf_rule_ptr skip[PF_SKIP_COUNT]; 87 char label[PF_RULE_MAX_LABEL_COUNT][PF_RULE_LABEL_SIZE]; 88 uint32_t ridentifier; 89 char ifname[IFNAMSIZ]; 90 char qname[PF_QNAME_SIZE]; 91 char pqname[PF_QNAME_SIZE]; 92 char tagname[PF_TAG_NAME_SIZE]; 93 char match_tagname[PF_TAG_NAME_SIZE]; 94 95 char overload_tblname[PF_TABLE_NAME_SIZE]; 96 97 TAILQ_ENTRY(pfctl_rule) entries; 98 struct pfctl_pool rpool; 99 100 uint64_t evaluations; 101 uint64_t packets[2]; 102 uint64_t bytes[2]; 103 104 struct pfi_kif *kif; 105 struct pfctl_anchor *anchor; 106 struct pfr_ktable *overload_tbl; 107 108 pf_osfp_t os_fingerprint; 109 110 int rtableid; 111 uint32_t timeout[PFTM_MAX]; 112 uint32_t max_states; 113 uint32_t max_src_nodes; 114 uint32_t max_src_states; 115 uint32_t max_src_conn; 116 struct { 117 uint32_t limit; 118 uint32_t seconds; 119 } max_src_conn_rate; 120 uint32_t qid; 121 uint32_t pqid; 122 uint32_t nr; 123 uint32_t prob; 124 uid_t cuid; 125 pid_t cpid; 126 127 uint64_t states_cur; 128 uint64_t states_tot; 129 uint64_t src_nodes; 130 131 uint16_t return_icmp; 132 uint16_t return_icmp6; 133 uint16_t max_mss; 134 uint16_t tag; 135 uint16_t match_tag; 136 uint16_t scrub_flags; 137 138 struct pf_rule_uid uid; 139 struct pf_rule_gid gid; 140 141 uint32_t rule_flag; 142 uint8_t action; 143 uint8_t direction; 144 uint8_t log; 145 uint8_t logif; 146 uint8_t quick; 147 uint8_t ifnot; 148 uint8_t match_tag_not; 149 uint8_t natpass; 150 151 uint8_t keep_state; 152 sa_family_t af; 153 uint8_t proto; 154 uint8_t type; 155 uint8_t code; 156 uint8_t flags; 157 uint8_t flagset; 158 uint8_t min_ttl; 159 uint8_t allow_opts; 160 uint8_t rt; 161 uint8_t return_ttl; 162 uint8_t tos; 163 uint8_t set_tos; 164 uint8_t anchor_relative; 165 uint8_t anchor_wildcard; 166 167 uint8_t flush; 168 uint8_t prio; 169 uint8_t set_prio[2]; 170 171 struct { 172 struct pf_addr addr; 173 uint16_t port; 174 } divert; 175 }; 176 177 TAILQ_HEAD(pfctl_rulequeue, pfctl_rule); 178 179 struct pfctl_ruleset { 180 struct { 181 struct pfctl_rulequeue queues[2]; 182 struct { 183 struct pfctl_rulequeue *ptr; 184 struct pfctl_rule **ptr_array; 185 uint32_t rcount; 186 uint32_t ticket; 187 int open; 188 } active, inactive; 189 } rules[PF_RULESET_MAX]; 190 struct pfctl_anchor *anchor; 191 uint32_t tticket; 192 int tables; 193 int topen; 194 }; 195 196 RB_HEAD(pfctl_anchor_global, pfctl_anchor); 197 RB_HEAD(pfctl_anchor_node, pfctl_anchor); 198 struct pfctl_anchor { 199 RB_ENTRY(pfctl_anchor) entry_global; 200 RB_ENTRY(pfctl_anchor) entry_node; 201 struct pfctl_anchor *parent; 202 struct pfctl_anchor_node children; 203 char name[PF_ANCHOR_NAME_SIZE]; 204 char path[MAXPATHLEN]; 205 struct pfctl_ruleset ruleset; 206 int refcnt; /* anchor rules */ 207 int match; /* XXX: used for pfctl black magic */ 208 }; 209 RB_PROTOTYPE(pfctl_anchor_global, pfctl_anchor, entry_global, 210 pf_anchor_compare); 211 RB_PROTOTYPE(pfctl_anchor_node, pfctl_anchor, entry_node, 212 pf_anchor_compare); 213 214 struct pfctl_state_cmp { 215 uint64_t id; 216 uint32_t creatorid; 217 uint8_t direction; 218 }; 219 220 struct pfctl_kill { 221 struct pfctl_state_cmp cmp; 222 sa_family_t af; 223 int proto; 224 struct pf_rule_addr src; 225 struct pf_rule_addr dst; 226 struct pf_rule_addr rt_addr; 227 char ifname[IFNAMSIZ]; 228 char label[PF_RULE_LABEL_SIZE]; 229 bool kill_match; 230 }; 231 232 struct pfctl_state_peer { 233 uint32_t seqlo; 234 uint32_t seqhi; 235 uint32_t seqdiff; 236 uint8_t state; 237 uint8_t wscale; 238 }; 239 240 struct pfctl_state_key { 241 struct pf_addr addr[2]; 242 uint16_t port[2]; 243 sa_family_t af; 244 uint8_t proto; 245 }; 246 247 struct pfctl_state { 248 TAILQ_ENTRY(pfctl_state) entry; 249 250 uint64_t id; 251 uint32_t creatorid; 252 uint8_t direction; 253 254 struct pfctl_state_peer src; 255 struct pfctl_state_peer dst; 256 257 uint32_t rule; 258 uint32_t anchor; 259 uint32_t nat_rule; 260 struct pf_addr rt_addr; 261 struct pfctl_state_key key[2]; /* addresses stack and wire */ 262 char ifname[IFNAMSIZ]; 263 char orig_ifname[IFNAMSIZ]; 264 uint64_t packets[2]; 265 uint64_t bytes[2]; 266 uint32_t creation; 267 uint32_t expire; 268 uint32_t pfsync_time; 269 uint8_t state_flags; 270 uint32_t sync_flags; 271 }; 272 273 TAILQ_HEAD(pfctl_statelist, pfctl_state); 274 struct pfctl_states { 275 struct pfctl_statelist states; 276 }; 277 278 enum pfctl_syncookies_mode { 279 PFCTL_SYNCOOKIES_NEVER, 280 PFCTL_SYNCOOKIES_ALWAYS, 281 PFCTL_SYNCOOKIES_ADAPTIVE 282 }; 283 extern const char* PFCTL_SYNCOOKIES_MODE_NAMES[]; 284 285 struct pfctl_syncookies { 286 enum pfctl_syncookies_mode mode; 287 uint8_t highwater; /* Percent */ 288 uint8_t lowwater; /* Percent */ 289 uint32_t halfopen_states; 290 }; 291 292 struct pfctl_status* pfctl_get_status(int dev); 293 uint64_t pfctl_status_counter(struct pfctl_status *status, int id); 294 uint64_t pfctl_status_lcounter(struct pfctl_status *status, int id); 295 uint64_t pfctl_status_fcounter(struct pfctl_status *status, int id); 296 uint64_t pfctl_status_scounter(struct pfctl_status *status, int id); 297 void pfctl_free_status(struct pfctl_status *status); 298 299 int pfctl_get_rules_info(int dev, struct pfctl_rules_info *rules, 300 uint32_t ruleset, const char *path); 301 int pfctl_get_rule(int dev, uint32_t nr, uint32_t ticket, 302 const char *anchor, uint32_t ruleset, struct pfctl_rule *rule, 303 char *anchor_call); 304 int pfctl_get_clear_rule(int dev, uint32_t nr, uint32_t ticket, 305 const char *anchor, uint32_t ruleset, struct pfctl_rule *rule, 306 char *anchor_call, bool clear); 307 int pfctl_add_rule(int dev, const struct pfctl_rule *r, 308 const char *anchor, const char *anchor_call, uint32_t ticket, 309 uint32_t pool_ticket); 310 int pfctl_set_keepcounters(int dev, bool keep); 311 int pfctl_get_states(int dev, struct pfctl_states *states); 312 void pfctl_free_states(struct pfctl_states *states); 313 int pfctl_clear_states(int dev, const struct pfctl_kill *kill, 314 unsigned int *killed); 315 int pfctl_kill_states(int dev, const struct pfctl_kill *kill, 316 unsigned int *killed); 317 int pfctl_clear_rules(int dev, const char *anchorname); 318 int pfctl_clear_nat(int dev, const char *anchorname); 319 int pfctl_set_syncookies(int dev, const struct pfctl_syncookies *s); 320 int pfctl_get_syncookies(int dev, struct pfctl_syncookies *s); 321 int pfctl_table_add_addrs(int dev, struct pfr_table *tbl, struct pfr_addr 322 *addr, int size, int *nadd, int flags); 323 int pfctl_table_del_addrs(int dev, struct pfr_table *tbl, struct pfr_addr 324 *addr, int size, int *ndel, int flags); 325 int pfctl_table_set_addrs(int dev, struct pfr_table *tbl, struct pfr_addr 326 *addr, int size, int *size2, int *nadd, int *ndel, int *nchange, 327 int flags); 328 int pfctl_table_get_addrs(int dev, struct pfr_table *tbl, struct pfr_addr 329 *addr, int *size, int flags); 330 #endif 331