sys/netinet/ip_fw.h

34  * The default rule number.  By the design of ip_fw, the default rule
36  * allowed for a rule.  The ip_fw code relies on both meanings of this
69  * Call stack currently is an uint16_t array with rule numbers.
92 #define	IP_FW_XADD		98	/* add rule */
93 #define	IP_FW_XDEL		99	/* del rule */
233 	O_SKIPTO,		/* arg1=next rule number	*/
283 	O_CALLRETURN,		/* arg1=called rule number */
588  * Here we have the structure representing an ipfw rule.
592  * [ counter block, size = rule->cntr_len ]
593  * [ one or more instructions, size = rule->cmd_len * 4 ]
596  * Counter block may be next (if rule->cntr_len > 0),
598  * accesses as an array of 32-bit values. rule->cmd_len represents
600  * rule action offset in u32 words.
604  *  + if a rule has a "keep-state" (or "limit") option, then the
606  *  + if a rule has a "log" option, then the first action
608  *  + if a rule has an "altq" option, it comes after "log"
609  *  + if a rule has an O_TAG option, it comes after "log" and "altq"
620 	uint8_t		set;		/* rule set (0..31)		*/
621 	uint8_t		flags;		/* rule flags			*/
622 	uint32_t	rulenum;	/* rule number			*/
623 	uint32_t	id;		/* rule id			*/
628 #define	IPFW_RULE_JUSTOPTS	0x02	/* new format of rule body	*/
632 /* Base ipfw rule counter block. */
644  * Legacy rule format
648 	struct ip_fw	*next_rule;	/* ptr to next [skipto] rule	*/
653 	uint16_t	rulenum;	/* rule number			*/
654 	uint8_t		set;		/* rule set (0..31)		*/
656 	uint32_t	id;		/* rule id */
667 #define ACTION_PTR(rule)				\
668 	(ipfw_insn *)( (u_int32_t *)((rule)->cmd) + ((rule)->act_ofs) )
670 #define RULESIZE(rule)  (sizeof(*(rule)) + (rule)->cmd_len * 4 - 4)
700  * Dynamic ipfw rule.
706 	struct ip_fw *rule;		/* pointer to rule		*/
707 	/* 'rule' is used to pass up the rule number (from the parent)	*/
709 	ipfw_dyn_rule *parent;		/* pointer to parent rule	*/
715 	u_int32_t	state;		/* state of this rule (typically a
718 #define	IPFW_DYN_ORPHANED	0x40000	/* state's parent rule was deleted */
722 	u_int16_t	dyn_type;	/* rule type			*/
946 #define	IPFW_RCFLAG_RANGE	0x01	/* rule range is set		*/
954 #define	IPFW_RCFLAG_DEFAULT	0x0100	/* Do not skip defaul rule	*/