ip_fw.h revision 121816
1138593Ssam/* 2138593Ssam * Copyright (c) 2002 Luigi Rizzo, Universita` di Pisa 3138593Ssam * 4138593Ssam * Redistribution and use in source and binary forms, with or without 5138593Ssam * modification, are permitted provided that the following conditions 6138593Ssam * are met: 7138593Ssam * 1. Redistributions of source code must retain the above copyright 8138593Ssam * notice, this list of conditions and the following disclaimer. 9138593Ssam * 2. Redistributions in binary form must reproduce the above copyright 10138593Ssam * notice, this list of conditions and the following disclaimer in the 11138593Ssam * documentation and/or other materials provided with the distribution. 12138593Ssam * 13138593Ssam * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 14138593Ssam * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 15138593Ssam * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 16138593Ssam * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 17138593Ssam * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 18138593Ssam * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 19138593Ssam * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 20138593Ssam * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 21138593Ssam * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 22138593Ssam * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 23138593Ssam * SUCH DAMAGE. 24138593Ssam * 25138593Ssam * $FreeBSD: head/sys/netinet/ip_fw.h 121816 2003-10-31 18:32:15Z brooks $ 26138593Ssam */ 27138593Ssam 28138593Ssam#ifndef _IPFW2_H 29138593Ssam#define _IPFW2_H 30138593Ssam#define IPFW2 1 31138593Ssam/* 32138593Ssam * The kernel representation of ipfw rules is made of a list of 33138593Ssam * 'instructions' (for all practical purposes equivalent to BPF 34138593Ssam * instructions), which specify which fields of the packet 35138593Ssam * (or its metadata) should be analysed. 36138593Ssam * 37138593Ssam * Each instruction is stored in a structure which begins with 38138593Ssam * "ipfw_insn", and can contain extra fields depending on the 39138593Ssam * instruction type (listed below). 40138593Ssam * Note that the code is written so that individual instructions 41138593Ssam * have a size which is a multiple of 32 bits. This means that, if 42138593Ssam * such structures contain pointers or other 64-bit entities, 43138593Ssam * (there is just one instance now) they may end up unaligned on 44138593Ssam * 64-bit architectures, so the must be handled with care. 45166956Ssam * 46138593Ssam * "enum ipfw_opcodes" are the opcodes supported. We can have up 47138593Ssam * to 256 different opcodes. 48138593Ssam */ 49138593Ssam 50138593Ssamenum ipfw_opcodes { /* arguments (4 byte each) */ 51138593Ssam O_NOP, 52138593Ssam 53138593Ssam O_IP_SRC, /* u32 = IP */ 54138593Ssam O_IP_SRC_MASK, /* ip = IP/mask */ 55138593Ssam O_IP_SRC_ME, /* none */ 56138593Ssam O_IP_SRC_SET, /* u32=base, arg1=len, bitmap */ 57138593Ssam 58138593Ssam O_IP_DST, /* u32 = IP */ 59166956Ssam O_IP_DST_MASK, /* ip = IP/mask */ 60138593Ssam O_IP_DST_ME, /* none */ 61138593Ssam O_IP_DST_SET, /* u32=base, arg1=len, bitmap */ 62138593Ssam 63138593Ssam O_IP_SRCPORT, /* (n)port list:mask 4 byte ea */ 64138593Ssam O_IP_DSTPORT, /* (n)port list:mask 4 byte ea */ 65166956Ssam O_PROTO, /* arg1=protocol */ 66138593Ssam 67138593Ssam O_MACADDR2, /* 2 mac addr:mask */ 68138593Ssam O_MAC_TYPE, /* same as srcport */ 69138593Ssam 70138593Ssam O_LAYER2, /* none */ 71166956Ssam O_IN, /* none */ 72166956Ssam O_FRAG, /* none */ 73166956Ssam 74138593Ssam O_RECV, /* none */ 75138593Ssam O_XMIT, /* none */ 76138593Ssam O_VIA, /* none */ 77138593Ssam 78166956Ssam O_IPOPT, /* arg1 = 2*u8 bitmap */ 79166956Ssam O_IPLEN, /* arg1 = len */ 80138593Ssam O_IPID, /* arg1 = id */ 81138593Ssam 82138593Ssam O_IPTOS, /* arg1 = id */ 83166956Ssam O_IPPRECEDENCE, /* arg1 = precedence << 5 */ 84166956Ssam O_IPTTL, /* arg1 = TTL */ 85166956Ssam 86138593Ssam O_IPVER, /* arg1 = version */ 87138593Ssam O_UID, /* u32 = id */ 88138593Ssam O_GID, /* u32 = id */ 89138593Ssam O_ESTAB, /* none (tcp established) */ 90138593Ssam O_TCPFLAGS, /* arg1 = 2*u8 bitmap */ 91138593Ssam O_TCPWIN, /* arg1 = desired win */ 92138593Ssam O_TCPSEQ, /* u32 = desired seq. */ 93138593Ssam O_TCPACK, /* u32 = desired seq. */ 94138593Ssam O_ICMPTYPE, /* u32 = icmp bitmap */ 95138593Ssam O_TCPOPTS, /* arg1 = 2*u8 bitmap */ 96138593Ssam 97138593Ssam O_VERREVPATH, /* none */ 98138593Ssam 99138593Ssam O_PROBE_STATE, /* none */ 100138593Ssam O_KEEP_STATE, /* none */ 101138593Ssam O_LIMIT, /* ipfw_insn_limit */ 102138593Ssam O_LIMIT_PARENT, /* dyn_type, not an opcode. */ 103138593Ssam 104138593Ssam /* 105138593Ssam * These are really 'actions'. 106138593Ssam */ 107138593Ssam 108138593Ssam O_LOG, /* ipfw_insn_log */ 109138593Ssam O_PROB, /* u32 = match probability */ 110138593Ssam 111138593Ssam O_CHECK_STATE, /* none */ 112138593Ssam O_ACCEPT, /* none */ 113138593Ssam O_DENY, /* none */ 114138593Ssam O_REJECT, /* arg1=icmp arg (same as deny) */ 115138593Ssam O_COUNT, /* none */ 116138593Ssam O_SKIPTO, /* arg1=next rule number */ 117138593Ssam O_PIPE, /* arg1=pipe number */ 118138593Ssam O_QUEUE, /* arg1=queue number */ 119138593Ssam O_DIVERT, /* arg1=port number */ 120138593Ssam O_TEE, /* arg1=port number */ 121138593Ssam O_FORWARD_IP, /* fwd sockaddr */ 122138593Ssam O_FORWARD_MAC, /* fwd mac */ 123138593Ssam 124138593Ssam /* 125138593Ssam * More opcodes. 126138593Ssam */ 127138593Ssam O_IPSEC, /* has ipsec history */ 128138593Ssam 129138593Ssam O_LAST_OPCODE /* not an opcode! */ 130138593Ssam}; 131138593Ssam 132138593Ssam/* 133138593Ssam * Template for instructions. 134138593Ssam * 135138593Ssam * ipfw_insn is used for all instructions which require no operands, 136138593Ssam * a single 16-bit value (arg1), or a couple of 8-bit values. 137138593Ssam * 138138593Ssam * For other instructions which require different/larger arguments 139138593Ssam * we have derived structures, ipfw_insn_*. 140138593Ssam * 141138593Ssam * The size of the instruction (in 32-bit words) is in the low 142138593Ssam * 6 bits of "len". The 2 remaining bits are used to implement 143138593Ssam * NOT and OR on individual instructions. Given a type, you can 144138593Ssam * compute the length to be put in "len" using F_INSN_SIZE(t) 145138593Ssam * 146138593Ssam * F_NOT negates the match result of the instruction. 147138593Ssam * 148138593Ssam * F_OR is used to build or blocks. By default, instructions 149138593Ssam * are evaluated as part of a logical AND. An "or" block 150138593Ssam * { X or Y or Z } contains F_OR set in all but the last 151138593Ssam * instruction of the block. A match will cause the code 152138593Ssam * to skip past the last instruction of the block. 153138593Ssam * 154147437Sume * NOTA BENE: in a couple of places we assume that 155147437Sume * sizeof(ipfw_insn) == sizeof(u_int32_t) 156138593Ssam * this needs to be fixed. 157138593Ssam * 158138593Ssam */ 159138593Ssamtypedef struct _ipfw_insn { /* template for instructions */ 160138593Ssam enum ipfw_opcodes opcode:8; 161147437Sume u_int8_t len; /* numer of 32-byte words */ 162147437Sume#define F_NOT 0x80 163138593Ssam#define F_OR 0x40 164138593Ssam#define F_LEN_MASK 0x3f 165138593Ssam#define F_LEN(cmd) ((cmd)->len & F_LEN_MASK) 166138593Ssam 167138593Ssam u_int16_t arg1; 168138593Ssam} ipfw_insn; 169138593Ssam 170138593Ssam/* 171138593Ssam * The F_INSN_SIZE(type) computes the size, in 4-byte words, of 172138593Ssam * a given type. 173138593Ssam */ 174138593Ssam#define F_INSN_SIZE(t) ((sizeof (t))/sizeof(u_int32_t)) 175138593Ssam 176138593Ssam/* 177138593Ssam * This is used to store an array of 16-bit entries (ports etc.) 178138593Ssam */ 179138593Ssamtypedef struct _ipfw_insn_u16 { 180138593Ssam ipfw_insn o; 181138593Ssam u_int16_t ports[2]; /* there may be more */ 182138593Ssam} ipfw_insn_u16; 183138593Ssam 184138593Ssam/* 185138593Ssam * This is used to store an array of 32-bit entries 186138593Ssam * (uid, single IPv4 addresses etc.) 187138593Ssam */ 188138593Ssamtypedef struct _ipfw_insn_u32 { 189138593Ssam ipfw_insn o; 190138593Ssam u_int32_t d[1]; /* one or more */ 191138593Ssam} ipfw_insn_u32; 192138593Ssam 193138593Ssam/* 194138593Ssam * This is used to store IP addr-mask pairs. 195138593Ssam */ 196138593Ssamtypedef struct _ipfw_insn_ip { 197138593Ssam ipfw_insn o; 198138593Ssam struct in_addr addr; 199138593Ssam struct in_addr mask; 200138593Ssam} ipfw_insn_ip; 201 202/* 203 * This is used to forward to a given address (ip). 204 */ 205typedef struct _ipfw_insn_sa { 206 ipfw_insn o; 207 struct sockaddr_in sa; 208} ipfw_insn_sa; 209 210/* 211 * This is used for MAC addr-mask pairs. 212 */ 213typedef struct _ipfw_insn_mac { 214 ipfw_insn o; 215 u_char addr[12]; /* dst[6] + src[6] */ 216 u_char mask[12]; /* dst[6] + src[6] */ 217} ipfw_insn_mac; 218 219/* 220 * This is used for interface match rules (recv xx, xmit xx). 221 */ 222typedef struct _ipfw_insn_if { 223 ipfw_insn o; 224 union { 225 struct in_addr ip; 226 int glob; 227 } p; 228 char name[IFNAMSIZ]; 229} ipfw_insn_if; 230 231/* 232 * This is used for pipe and queue actions, which need to store 233 * a single pointer (which can have different size on different 234 * architectures. 235 * Note that, because of previous instructions, pipe_ptr might 236 * be unaligned in the overall structure, so it needs to be 237 * manipulated with care. 238 */ 239typedef struct _ipfw_insn_pipe { 240 ipfw_insn o; 241 void *pipe_ptr; /* XXX */ 242} ipfw_insn_pipe; 243 244/* 245 * This is used for limit rules. 246 */ 247typedef struct _ipfw_insn_limit { 248 ipfw_insn o; 249 u_int8_t _pad; 250 u_int8_t limit_mask; /* combination of DYN_* below */ 251#define DYN_SRC_ADDR 0x1 252#define DYN_SRC_PORT 0x2 253#define DYN_DST_ADDR 0x4 254#define DYN_DST_PORT 0x8 255 256 u_int16_t conn_limit; 257} ipfw_insn_limit; 258 259/* 260 * This is used for log instructions. 261 */ 262typedef struct _ipfw_insn_log { 263 ipfw_insn o; 264 u_int32_t max_log; /* how many do we log -- 0 = all */ 265 u_int32_t log_left; /* how many left to log */ 266} ipfw_insn_log; 267 268/* 269 * Here we have the structure representing an ipfw rule. 270 * 271 * It starts with a general area (with link fields and counters) 272 * followed by an array of one or more instructions, which the code 273 * accesses as an array of 32-bit values. 274 * 275 * Given a rule pointer r: 276 * 277 * r->cmd is the start of the first instruction. 278 * ACTION_PTR(r) is the start of the first action (things to do 279 * once a rule matched). 280 * 281 * When assembling instruction, remember the following: 282 * 283 * + if a rule has a "keep-state" (or "limit") option, then the 284 * first instruction (at r->cmd) MUST BE an O_PROBE_STATE 285 * + if a rule has a "log" option, then the first action 286 * (at ACTION_PTR(r)) MUST be O_LOG 287 * 288 * NOTE: we use a simple linked list of rules because we never need 289 * to delete a rule without scanning the list. We do not use 290 * queue(3) macros for portability and readability. 291 */ 292 293struct ip_fw { 294 struct ip_fw *next; /* linked list of rules */ 295 struct ip_fw *next_rule; /* ptr to next [skipto] rule */ 296 /* 'next_rule' is used to pass up 'set_disable' status */ 297 298 u_int16_t act_ofs; /* offset of action in 32-bit units */ 299 u_int16_t cmd_len; /* # of 32-bit words in cmd */ 300 u_int16_t rulenum; /* rule number */ 301 u_int8_t set; /* rule set (0..31) */ 302#define RESVD_SET 31 /* set for default and persistent rules */ 303 u_int8_t _pad; /* padding */ 304 305 /* These fields are present in all rules. */ 306 u_int64_t pcnt; /* Packet counter */ 307 u_int64_t bcnt; /* Byte counter */ 308 u_int32_t timestamp; /* tv_sec of last match */ 309 310 ipfw_insn cmd[1]; /* storage for commands */ 311}; 312 313#define ACTION_PTR(rule) \ 314 (ipfw_insn *)( (u_int32_t *)((rule)->cmd) + ((rule)->act_ofs) ) 315 316#define RULESIZE(rule) (sizeof(struct ip_fw) + \ 317 ((struct ip_fw *)(rule))->cmd_len * 4 - 4) 318 319/* 320 * This structure is used as a flow mask and a flow id for various 321 * parts of the code. 322 */ 323struct ipfw_flow_id { 324 u_int32_t dst_ip; 325 u_int32_t src_ip; 326 u_int16_t dst_port; 327 u_int16_t src_port; 328 u_int8_t proto; 329 u_int8_t flags; /* protocol-specific flags */ 330}; 331 332/* 333 * Dynamic ipfw rule. 334 */ 335typedef struct _ipfw_dyn_rule ipfw_dyn_rule; 336 337struct _ipfw_dyn_rule { 338 ipfw_dyn_rule *next; /* linked list of rules. */ 339 struct ip_fw *rule; /* pointer to rule */ 340 /* 'rule' is used to pass up the rule number (from the parent) */ 341 342 ipfw_dyn_rule *parent; /* pointer to parent rule */ 343 u_int64_t pcnt; /* packet match counter */ 344 u_int64_t bcnt; /* byte match counter */ 345 struct ipfw_flow_id id; /* (masked) flow id */ 346 u_int32_t expire; /* expire time */ 347 u_int32_t bucket; /* which bucket in hash table */ 348 u_int32_t state; /* state of this rule (typically a 349 * combination of TCP flags) 350 */ 351 u_int32_t ack_fwd; /* most recent ACKs in forward */ 352 u_int32_t ack_rev; /* and reverse directions (used */ 353 /* to generate keepalives) */ 354 u_int16_t dyn_type; /* rule type */ 355 u_int16_t count; /* refcount */ 356}; 357 358/* 359 * Definitions for IP option names. 360 */ 361#define IP_FW_IPOPT_LSRR 0x01 362#define IP_FW_IPOPT_SSRR 0x02 363#define IP_FW_IPOPT_RR 0x04 364#define IP_FW_IPOPT_TS 0x08 365 366/* 367 * Definitions for TCP option names. 368 */ 369#define IP_FW_TCPOPT_MSS 0x01 370#define IP_FW_TCPOPT_WINDOW 0x02 371#define IP_FW_TCPOPT_SACK 0x04 372#define IP_FW_TCPOPT_TS 0x08 373#define IP_FW_TCPOPT_CC 0x10 374 375#define ICMP_REJECT_RST 0x100 /* fake ICMP code (send a TCP RST) */ 376 377/* 378 * Main firewall chains definitions and global var's definitions. 379 */ 380#ifdef _KERNEL 381 382#define IP_FW_PORT_DYNT_FLAG 0x10000 383#define IP_FW_PORT_TEE_FLAG 0x20000 384#define IP_FW_PORT_DENY_FLAG 0x40000 385 386/* 387 * Arguments for calling ipfw_chk() and dummynet_io(). We put them 388 * all into a structure because this way it is easier and more 389 * efficient to pass variables around and extend the interface. 390 */ 391struct ip_fw_args { 392 struct mbuf *m; /* the mbuf chain */ 393 struct ifnet *oif; /* output interface */ 394 struct sockaddr_in *next_hop; /* forward address */ 395 struct ip_fw *rule; /* matching rule */ 396 struct ether_header *eh; /* for bridged packets */ 397 398 struct route *ro; /* for dummynet */ 399 struct sockaddr_in *dst; /* for dummynet */ 400 int flags; /* for dummynet */ 401 402 struct ipfw_flow_id f_id; /* grabbed from IP header */ 403 u_int16_t divert_rule; /* divert cookie */ 404 u_int32_t retval; 405}; 406 407/* 408 * Function definitions. 409 */ 410 411/* Firewall hooks */ 412struct sockopt; 413struct dn_flow_set; 414 415void flush_pipe_ptrs(struct dn_flow_set *match); /* used by dummynet */ 416 417typedef int ip_fw_chk_t (struct ip_fw_args *args); 418typedef int ip_fw_ctl_t (struct sockopt *); 419extern ip_fw_chk_t *ip_fw_chk_ptr; 420extern ip_fw_ctl_t *ip_fw_ctl_ptr; 421extern int fw_one_pass; 422extern int fw_enable; 423#define IPFW_LOADED (ip_fw_chk_ptr != NULL) 424#endif /* _KERNEL */ 425 426#endif /* _IPFW2_H */ 427