ip_fw.h revision 22975 
1267843Sdelphij/*
2 * Copyright (c) 1993 Daniel Boulet
3 * Copyright (c) 1994 Ugen J.S.Antsilevich
4 *
5 * Redistribution and use in source forms, with and without modification,
6 * are permitted provided that this entire comment appears intact.
7 *
8 * Redistribution in binary form may occur without any restrictions.
9 * Obviously, it would be nice if you gave credit where credit is due
10 * but requiring it would be too onerous.
11 *
12 * This software is provided ``AS IS'' without any warranties of any kind.
13 *
14 *	$Id$
15 */
16
17/*
18 * Format of an IP firewall descriptor
19 *
20 * fw_src, fw_dst, fw_smsk, fw_dmsk are always stored in network byte order.
21 * fw_flg and fw_n*p are stored in host byte order (of course).
22 * Port numbers are stored in HOST byte order.
23 */
24#ifndef _IP_FW_H
25#define _IP_FW_H
26
27struct ip_fw {
28    u_long fw_pcnt,fw_bcnt;		/* Packet and byte counters */
29    struct in_addr fw_src, fw_dst;	/* Source and destination IP addr */
30    struct in_addr fw_smsk, fw_dmsk;	/* Mask for src and dest IP addr */
31    union {
32	struct in_addr fu_via_ip;	/* Specified by IP address */
33	struct {			/* Specified by interface name */
34#define FW_IFNLEN	6		/* To keep structure on 2^x boundary */
35		char  fu_via_name[FW_IFNLEN];
36		short fu_via_unit;
37	} fu_via_if;
38    } fu_via_un;
39#define fw_via_ip	fu_via_un.fu_via_ip
40#define fw_via_name	fu_via_un.fu_via_if.fu_via_name
41#define fw_via_unit	fu_via_un.fu_via_if.fu_via_unit
42    u_short fw_number;
43    u_short fw_flg;			/* Flags word */
44    u_short fw_nsp, fw_ndp;             /* N'of src ports and # of dst ports */
45    					/* in ports array (dst ports follow */
46    					/* src ports; max of 10 ports in all; */
47    					/* count of 0 means match all ports) */
48#define IP_FW_MAX_PORTS	10      	/* A reasonable maximum */
49    u_short fw_pts[IP_FW_MAX_PORTS];    /* Array of port numbers to match */
50    u_char fw_ipopt,fw_ipnopt;		/* IP options set/unset */
51    u_char fw_tcpf,fw_tcpnf;		/* TCP flags set/unset */
52#define IP_FW_ICMPTYPES_DIM (256 / (sizeof(unsigned) * 8))
53    unsigned fw_icmptypes[IP_FW_ICMPTYPES_DIM]; /* ICMP types bitmap */
54    long timestamp;         		/* timestamp (tv_sec) of last match */
55    u_short fw_divert_port;		/* Divert port (options IPDIVERT) */
56    u_char fw_prot;			/* IP protocol */
57};
58
59struct ip_fw_chain {
60        LIST_ENTRY(ip_fw_chain) chain;
61        struct ip_fw    *rule;
62};
63
64/*
65 * Values for "flags" field .
66 */
67#define IP_FW_F_INVSRC	0x0001	/* Invert sense of src check	      */
68#define IP_FW_F_INVDST	0x0002	/* Invert sense of dst check	      */
69#define IP_FW_F_IN	0x0004	/* Inbound 			      */
70#define IP_FW_F_OUT	0x0008	/* Outbound			      */
71
72#define IP_FW_F_COMMAND 0x0030	/* Mask for type of chain entry:      */
73#define IP_FW_F_ACCEPT	0x0010	/* This is an accept rule	      */
74#define IP_FW_F_COUNT	0x0020	/* This is a count rule		      */
75#define IP_FW_F_DIVERT	0x0030	/* This is a divert rule	      */
76#define IP_FW_F_DENY	0x0000	/* This is a deny rule	              */
77
78#define IP_FW_F_PRN	0x0040	/* Print if this rule matches	      */
79#define IP_FW_F_ICMPRPL	0x0080	/* Send back icmp unreachable packet  */
80
81#define IP_FW_F_SRNG	0x0100	/* The first two src ports are a min  *
82				 * and max range (stored in host byte *
83				 * order).                            */
84
85#define IP_FW_F_DRNG	0x0200	/* The first two dst ports are a min  *
86				 * and max range (stored in host byte *
87				 * order).                            */
88
89#define IP_FW_F_IFNAME	0x0400	/* Use interface name/unit (not IP)   */
90
91#define IP_FW_F_FRAG	0x0800	/* Fragment			      */
92
93#define IP_FW_F_ICMPBIT 0x1000	/* ICMP type bitmap is valid          */
94
95#define IP_FW_F_IFUWILD	0x2000	/* Match all interface units          */
96
97#define IP_FW_F_MASK	0x3FFF	/* All possible flag bits mask        */
98
99/*
100 * Definitions for IP option names.
101 */
102#define IP_FW_IPOPT_LSRR	0x01
103#define IP_FW_IPOPT_SSRR	0x02
104#define IP_FW_IPOPT_RR		0x04
105#define IP_FW_IPOPT_TS		0x08
106
107/*
108 * Definitions for TCP flags.
109 */
110#define IP_FW_TCPF_FIN		TH_FIN
111#define IP_FW_TCPF_SYN		TH_SYN
112#define IP_FW_TCPF_RST		TH_RST
113#define IP_FW_TCPF_PSH		TH_PUSH
114#define IP_FW_TCPF_ACK		TH_ACK
115#define IP_FW_TCPF_URG		TH_URG
116#define IP_FW_TCPF_ESTAB	0x40
117
118/*
119 * Main firewall chains definitions and global var's definitions.
120 */
121#ifdef KERNEL
122
123/*
124 * Function definitions.
125 */
126void ip_fw_init(void);
127
128#endif /* KERNEL */
129
130#endif /* _IP_FW_H */
131