ip_fw.h revision 17587 
1/*
2 * Copyright (c) 1993 Daniel Boulet
3 * Copyright (c) 1994 Ugen J.S.Antsilevich
4 *
5 * Redistribution and use in source forms, with and without modification,
6 * are permitted provided that this entire comment appears intact.
7 *
8 * Redistribution in binary form may occur without any restrictions.
9 * Obviously, it would be nice if you gave credit where credit is due
10 * but requiring it would be too onerous.
11 *
12 * This software is provided ``AS IS'' without any warranties of any kind.
13 *
14 *	$Id: ip_fw.h,v 1.21 1996/07/10 19:44:24 julian Exp $
15 */
16
17/*
18 * Format of an IP firewall descriptor
19 *
20 * fw_src, fw_dst, fw_smsk, fw_dmsk are always stored in network byte order.
21 * fw_flg and fw_n*p are stored in host byte order (of course).
22 * Port numbers are stored in HOST byte order.
23 */
24#ifndef _IP_FW_H
25#define _IP_FW_H
26
27struct ip_fw {
28    u_long fw_pcnt,fw_bcnt;		/* Packet and byte counters */
29    struct in_addr fw_src, fw_dst;	/* Source and destination IP addr */
30    struct in_addr fw_smsk, fw_dmsk;	/* Mask for src and dest IP addr */
31    union {
32	struct in_addr fu_via_ip;	/* Specified by IP address */
33	struct {			/* Specified by interface name */
34#define FW_IFNLEN	6		/* To keep structure on 2^x boundary */
35		char  fu_via_name[FW_IFNLEN];
36		short fu_via_unit;
37	} fu_via_if;
38    } fu_via_un;
39#define fw_via_ip	fu_via_un.fu_via_ip
40#define fw_via_name	fu_via_un.fu_via_if.fu_via_name
41#define fw_via_unit	fu_via_un.fu_via_if.fu_via_unit
42    u_short fw_number;
43    u_short fw_flg;			/* Flags word */
44    u_short fw_nsp, fw_ndp;             /* N'of src ports and # of dst ports */
45    					/* in ports array (dst ports follow */
46    					/* src ports; max of 10 ports in all; */
47    					/* count of 0 means match all ports) */
48#define IP_FW_MAX_PORTS	10      	/* A reasonable maximum */
49    u_short fw_pts[IP_FW_MAX_PORTS];    /* Array of port numbers to match */
50    u_char fw_ipopt,fw_ipnopt;		/* IP options set/unset */
51    u_char fw_tcpf,fw_tcpnf;		/* TCP flags set/unset */
52#define IP_FW_ICMPTYPES_DIM (256 / (sizeof(unsigned) * 8))
53    unsigned fw_icmptypes[IP_FW_ICMPTYPES_DIM]; /* ICMP types bitmap */
54    long timestamp;         		/* timestamp (tv_sec) of last match */
55    u_short fw_divert_port;		/* Divert port (options IPDIVERT) */
56    u_char fw_prot;			/* IP protocol */
57};
58
59struct ip_fw_chain {
60        LIST_ENTRY(ip_fw_chain) chain;
61        struct ip_fw    *rule;
62};
63
64/*
65 * Values for "flags" field .
66 */
67#define IP_FW_F_IN	0x0004	/* Inbound 			      */
68#define IP_FW_F_OUT	0x0008	/* Outbound			      */
69
70#define IP_FW_F_COMMAND 0x0030	/* Mask for type of chain entry:      */
71#define IP_FW_F_ACCEPT	0x0010	/* This is an accept rule	      */
72#define IP_FW_F_COUNT	0x0020	/* This is a count rule		      */
73#define IP_FW_F_DIVERT	0x0030	/* This is a divert rule	      */
74#define IP_FW_F_DENY	0x0000	/* This is a deny rule	              */
75
76#define IP_FW_F_PRN	0x0040	/* Print if this rule matches	      */
77#define IP_FW_F_ICMPRPL	0x0080	/* Send back icmp unreachable packet  */
78
79#define IP_FW_F_SRNG	0x0100	/* The first two src ports are a min  *
80				 * and max range (stored in host byte *
81				 * order).                            */
82
83#define IP_FW_F_DRNG	0x0200	/* The first two dst ports are a min  *
84				 * and max range (stored in host byte *
85				 * order).                            */
86
87#define IP_FW_F_IFNAME	0x0400	/* Use interface name/unit (not IP)   */
88
89#define IP_FW_F_FRAG	0x0800	/* Fragment			      */
90
91#define IP_FW_F_ICMPBIT 0x1000	/* ICMP type bitmap is valid          */
92
93#define IP_FW_F_IFUWILD	0x2000	/* Match all interface units          */
94
95#define IP_FW_F_MASK	0x3FFF	/* All possible flag bits mask        */
96
97/*
98 * Definitions for IP option names.
99 */
100#define IP_FW_IPOPT_LSRR	0x01
101#define IP_FW_IPOPT_SSRR	0x02
102#define IP_FW_IPOPT_RR		0x04
103#define IP_FW_IPOPT_TS		0x08
104
105/*
106 * Definitions for TCP flags.
107 */
108#define IP_FW_TCPF_FIN		TH_FIN
109#define IP_FW_TCPF_SYN		TH_SYN
110#define IP_FW_TCPF_RST		TH_RST
111#define IP_FW_TCPF_PSH		TH_PUSH
112#define IP_FW_TCPF_ACK		TH_ACK
113#define IP_FW_TCPF_URG		TH_URG
114#define IP_FW_TCPF_ESTAB	0x40
115
116/*
117 * New IP firewall options for [gs]etsockopt at the RAW IP level.
118 */
119#define IP_FW_BASE_CTL	50
120
121#define IP_FW_ADD     (IP_FW_BASE_CTL+0)
122#define IP_FW_DEL     (IP_FW_BASE_CTL+1)
123#define IP_FW_FLUSH   (IP_FW_BASE_CTL+2)
124#define IP_FW_ZERO    (IP_FW_BASE_CTL+3)
125#define IP_FW_GET     (IP_FW_BASE_CTL+4)
126
127/*
128 * Main firewall chains definitions and global var's definitions.
129 */
130#ifdef KERNEL
131
132/*
133 * Function definitions.
134 */
135void ip_fw_init(void);
136
137#endif /* KERNEL */
138
139#endif /* _IP_FW_H */
140