125184Sjkh/* 2113674Smtm * Copyright (c) 2001 Daniel Hartmeier 3113674Smtm * All rights reserved. 4113674Smtm * 5113674Smtm * Redistribution and use in source and binary forms, with or without 6113674Smtm * modification, are permitted provided that the following conditions 7113674Smtm * are met: 8113674Smtm * 9113674Smtm * - Redistributions of source code must retain the above copyright 10113674Smtm * notice, this list of conditions and the following disclaimer. 11113674Smtm * - Redistributions in binary form must reproduce the above 12113674Smtm * copyright notice, this list of conditions and the following 13113674Smtm * disclaimer in the documentation and/or other materials provided 14113674Smtm * with the distribution. 15113674Smtm * 16113674Smtm * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 17113674Smtm * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 18113674Smtm * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 19113674Smtm * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 20113674Smtm * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 21113674Smtm * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 22113674Smtm * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 23113674Smtm * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 24113674Smtm * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 2550472Speter * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 2666830Sobrien * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 2725184Sjkh * POSSIBILITY OF SUCH DAMAGE. 28113674Smtm * 29113674Smtm * $OpenBSD: pfvar.h,v 1.282 2009/01/29 15:12:28 pyr Exp $ 30113674Smtm * $FreeBSD: releng/10.3/sys/net/pfvar.h 289703 2015-10-21 15:32:21Z kp $ 31113674Smtm */ 3225184Sjkh 33178356Ssam#ifndef _NET_PFVAR_H_ 34197147Shrs#define _NET_PFVAR_H_ 35197147Shrs 36178356Ssam#include <sys/param.h> 37178356Ssam#include <sys/queue.h> 38178356Ssam#include <sys/counter.h> 39178356Ssam#include <sys/refcount.h> 40178356Ssam#include <sys/tree.h> 41178356Ssam 42178356Ssam#include <net/radix.h> 43178356Ssam#include <netinet/in.h> 44178356Ssam 45178356Ssam#include <netpfil/pf/pf.h> 46178356Ssam#include <netpfil/pf/pf_altq.h> 47222515Sbz#include <netpfil/pf/pf_mtag.h> 48222515Sbz 49222515Sbzstruct pf_addr { 50197139Shrs union { 51178356Ssam struct in_addr v4; 52178356Ssam struct in6_addr v6; 53178356Ssam u_int8_t addr8[16]; 54178356Ssam u_int16_t addr16[8]; 55197139Shrs u_int32_t addr32[4]; 56197147Shrs } pfa; /* 128-bit address */ 57197147Shrs#define v4 pfa.v4 58178356Ssam#define v6 pfa.v6 59178356Ssam#define addr8 pfa.addr8 60178356Ssam#define addr16 pfa.addr16 61178356Ssam#define addr32 pfa.addr32 62178356Ssam}; 63178356Ssam 64178356Ssam#define PFI_AFLAG_NETWORK 0x01 65197139Shrs#define PFI_AFLAG_BROADCAST 0x02 66178356Ssam#define PFI_AFLAG_PEER 0x04 67222515Sbz#define PFI_AFLAG_MODEMASK 0x07 68222515Sbz#define PFI_AFLAG_NOALIAS 0x08 69222515Sbz 70178356Ssamstruct pf_addr_wrap { 71178356Ssam union { 72197139Shrs struct { 73178356Ssam struct pf_addr addr; 74178356Ssam struct pf_addr mask; 75178356Ssam } a; 76178356Ssam char ifname[IFNAMSIZ]; 77113674Smtm char tblname[PF_TABLE_NAME_SIZE]; 78113674Smtm } v; 79113674Smtm union { 80113674Smtm struct pfi_dynaddr *dyn; 81147088Sbrooks struct pfr_ktable *tbl; 82147088Sbrooks int dyncnt; 83113674Smtm int tblcnt; 84113674Smtm } p; 85113674Smtm u_int8_t type; /* PF_ADDR_* */ 86197139Shrs u_int8_t iflags; /* PFI_AFLAG_* */ 87147088Sbrooks}; 88147088Sbrooks 89222515Sbz#ifdef _KERNEL 90222515Sbz 91222515Sbzstruct pfi_dynaddr { 92222515Sbz TAILQ_ENTRY(pfi_dynaddr) entry; 93222515Sbz struct pf_addr pfid_addr4; 94197139Shrs struct pf_addr pfid_mask4; 95147088Sbrooks struct pf_addr pfid_addr6; 96113674Smtm struct pf_addr pfid_mask6; 97223506Spluknet struct pfr_ktable *pfid_kt; 98147088Sbrooks struct pfi_kif *pfid_kif; 99113674Smtm int pfid_net; /* mask or 128 */ 100147088Sbrooks int pfid_acnt4; /* address count IPv4 */ 101197139Shrs int pfid_acnt6; /* address count IPv6 */ 102197139Shrs sa_family_t pfid_af; /* rule af */ 103222733Shrs u_int8_t pfid_iflags; /* PFI_AFLAG_* */ 104222733Shrs}; 105222746Shrs 106222733Shrs/* 107212574Shrs * Address manipulation macros 108197139Shrs */ 109222733Shrs#define HTONL(x) (x) = htonl((__uint32_t)(x)) 110222733Shrs#define HTONS(x) (x) = htons((__uint16_t)(x)) 111222733Shrs#define NTOHL(x) (x) = ntohl((__uint32_t)(x)) 112222733Shrs#define NTOHS(x) (x) = ntohs((__uint16_t)(x)) 113222733Shrs 114222733Shrs#define PF_NAME "pf" 115222733Shrs 116212574Shrs#define PF_HASHROW_ASSERT(h) mtx_assert(&(h)->lock, MA_OWNED) 117212574Shrs#define PF_HASHROW_LOCK(h) mtx_lock(&(h)->lock) 118197526Shrs#define PF_HASHROW_UNLOCK(h) mtx_unlock(&(h)->lock) 119212574Shrs 120212574Shrs#define PF_STATE_LOCK(s) \ 121212574Shrs do { \ 122212574Shrs struct pf_idhash *_ih = &V_pf_idhash[PF_IDHASH(s)]; \ 123212574Shrs PF_HASHROW_LOCK(_ih); \ 124212574Shrs } while (0) 125212574Shrs 126212574Shrs#define PF_STATE_UNLOCK(s) \ 127212574Shrs do { \ 128212574Shrs struct pf_idhash *_ih = &V_pf_idhash[PF_IDHASH((s))]; \ 129212574Shrs PF_HASHROW_UNLOCK(_ih); \ 130212574Shrs } while (0) 131212574Shrs 132212574Shrs#ifdef INVARIANTS 133212574Shrs#define PF_STATE_LOCK_ASSERT(s) \ 134212574Shrs do { \ 135212574Shrs struct pf_idhash *_ih = &V_pf_idhash[PF_IDHASH(s)]; \ 136212574Shrs PF_HASHROW_ASSERT(_ih); \ 137197139Shrs } while (0) 138197139Shrs#else /* !INVARIANTS */ 139197139Shrs#define PF_STATE_LOCK_ASSERT(s) do {} while (0) 140197139Shrs#endif /* INVARIANTS */ 141197139Shrs 142197139Shrsextern struct mtx pf_unlnkdrules_mtx; 143147088Sbrooks#define PF_UNLNKDRULES_LOCK() mtx_lock(&pf_unlnkdrules_mtx) 144147682Sbrooks#define PF_UNLNKDRULES_UNLOCK() mtx_unlock(&pf_unlnkdrules_mtx) 145147088Sbrooks 146147088Sbrooksextern struct rwlock pf_rules_lock; 147147088Sbrooks#define PF_RULES_RLOCK() rw_rlock(&pf_rules_lock) 148147088Sbrooks#define PF_RULES_RUNLOCK() rw_runlock(&pf_rules_lock) 149149726Sbrooks#define PF_RULES_WLOCK() rw_wlock(&pf_rules_lock) 150149726Sbrooks#define PF_RULES_WUNLOCK() rw_wunlock(&pf_rules_lock) 151149726Sbrooks#define PF_RULES_ASSERT() rw_assert(&pf_rules_lock, RA_LOCKED) 152157706Sbrooks#define PF_RULES_RASSERT() rw_assert(&pf_rules_lock, RA_RLOCKED) 153157706Sbrooks#define PF_RULES_WASSERT() rw_assert(&pf_rules_lock, RA_WLOCKED) 154157706Sbrooks 155147088Sbrooks#define PF_MODVER 1 156147088Sbrooks#define PFLOG_MODVER 1 157147088Sbrooks#define PFSYNC_MODVER 1 158147121Sbrooks 159113674Smtm#define PFLOG_MINVER 1 16025184Sjkh#define PFLOG_PREFVER PFLOG_MODVER 161116029Smtm#define PFLOG_MAXVER 1 162161386Sbrooks#define PFSYNC_MINVER 1 163161386Sbrooks#define PFSYNC_PREFVER PFSYNC_MODVER 164116029Smtm#define PFSYNC_MAXVER 1 165116029Smtm 166116029Smtm#ifdef INET 167197139Shrs#ifndef INET6 168147121Sbrooks#define PF_INET_ONLY 169116029Smtm#endif /* ! INET6 */ 170147088Sbrooks#endif /* INET */ 171147682Sbrooks 172147121Sbrooks#ifdef INET6 173147088Sbrooks#ifndef INET 174147088Sbrooks#define PF_INET6_ONLY 175147088Sbrooks#endif /* ! INET */ 176147088Sbrooks#endif /* INET6 */ 177147088Sbrooks 178147088Sbrooks#ifdef INET 179147088Sbrooks#ifdef INET6 180161386Sbrooks#define PF_INET_INET6 181161386Sbrooks#endif /* INET6 */ 182161386Sbrooks#endif /* INET */ 183161386Sbrooks 184157706Sbrooks#else 185147121Sbrooks 186116029Smtm#define PF_INET_INET6 187116029Smtm 188157706Sbrooks#endif /* _KERNEL */ 189197147Shrs 190197147Shrs/* Both IPv4 and IPv6 */ 191197147Shrs#ifdef PF_INET_INET6 192197147Shrs 193197147Shrs#define PF_AEQ(a, b, c) \ 194157706Sbrooks ((c == AF_INET && (a)->addr32[0] == (b)->addr32[0]) || \ 195157706Sbrooks (c == AF_INET6 && (a)->addr32[3] == (b)->addr32[3] && \ 196212578Shrs (a)->addr32[2] == (b)->addr32[2] && \ 197197139Shrs (a)->addr32[1] == (b)->addr32[1] && \ 198157706Sbrooks (a)->addr32[0] == (b)->addr32[0])) \ 199157706Sbrooks 200157706Sbrooks#define PF_ANEQ(a, b, c) \ 201157706Sbrooks ((a)->addr32[0] != (b)->addr32[0] || \ 202157706Sbrooks (a)->addr32[1] != (b)->addr32[1] || \ 203157706Sbrooks (a)->addr32[2] != (b)->addr32[2] || \ 204157736Sbrooks (a)->addr32[3] != (b)->addr32[3]) \ 205157706Sbrooks 206157706Sbrooks#define PF_AZERO(a, c) \ 207157706Sbrooks ((c == AF_INET && !(a)->addr32[0]) || \ 208157706Sbrooks (c == AF_INET6 && !(a)->addr32[0] && !(a)->addr32[1] && \ 209157706Sbrooks !(a)->addr32[2] && !(a)->addr32[3] )) \ 210157706Sbrooks 211157706Sbrooks#define PF_MATCHA(n, a, m, b, f) \ 212168033Sache pf_match_addr(n, a, m, b, f) 213157706Sbrooks 214157706Sbrooks#define PF_ACPY(a, b, f) \ 215197139Shrs pf_addrcpy(a, b, f) 216147088Sbrooks 217147088Sbrooks#define PF_AINC(a, f) \ 218147088Sbrooks pf_addr_inc(a, f) 219147088Sbrooks 220147088Sbrooks#define PF_POOLMASK(a, b, c, d, f) \ 221212574Shrs pf_poolmask(a, b, c, d, f) 222147088Sbrooks 223197139Shrs#else 224197139Shrs 225147088Sbrooks/* Just IPv6 */ 226147088Sbrooks 227147088Sbrooks#ifdef PF_INET6_ONLY 228147088Sbrooks 229212574Shrs#define PF_AEQ(a, b, c) \ 230147088Sbrooks ((a)->addr32[3] == (b)->addr32[3] && \ 231147088Sbrooks (a)->addr32[2] == (b)->addr32[2] && \ 232197139Shrs (a)->addr32[1] == (b)->addr32[1] && \ 233147088Sbrooks (a)->addr32[0] == (b)->addr32[0]) \ 234147088Sbrooks 235147088Sbrooks#define PF_ANEQ(a, b, c) \ 236147088Sbrooks ((a)->addr32[3] != (b)->addr32[3] || \ 237197139Shrs (a)->addr32[2] != (b)->addr32[2] || \ 238197139Shrs (a)->addr32[1] != (b)->addr32[1] || \ 239147088Sbrooks (a)->addr32[0] != (b)->addr32[0]) \ 240147088Sbrooks 241147088Sbrooks#define PF_AZERO(a, c) \ 242147088Sbrooks (!(a)->addr32[0] && \ 243147088Sbrooks !(a)->addr32[1] && \ 244147088Sbrooks !(a)->addr32[2] && \ 245147088Sbrooks !(a)->addr32[3] ) \ 246157706Sbrooks 247157706Sbrooks#define PF_MATCHA(n, a, m, b, f) \ 248157706Sbrooks pf_match_addr(n, a, m, b, f) 249157706Sbrooks 250157706Sbrooks#define PF_ACPY(a, b, f) \ 251147088Sbrooks pf_addrcpy(a, b, f) 252147088Sbrooks 253147088Sbrooks#define PF_AINC(a, f) \ 254147088Sbrooks pf_addr_inc(a, f) 255147088Sbrooks 256147088Sbrooks#define PF_POOLMASK(a, b, c, d, f) \ 257147088Sbrooks pf_poolmask(a, b, c, d, f) 258147088Sbrooks 259147088Sbrooks#else 260149401Sbrooks 261149401Sbrooks/* Just IPv4 */ 262149401Sbrooks#ifdef PF_INET_ONLY 263149401Sbrooks 264149401Sbrooks#define PF_AEQ(a, b, c) \ 265197139Shrs ((a)->addr32[0] == (b)->addr32[0]) 266149401Sbrooks 267197139Shrs#define PF_ANEQ(a, b, c) \ 268149401Sbrooks ((a)->addr32[0] != (b)->addr32[0]) 269149401Sbrooks 270149401Sbrooks#define PF_AZERO(a, c) \ 271149401Sbrooks (!(a)->addr32[0]) 272149401Sbrooks 273149401Sbrooks#define PF_MATCHA(n, a, m, b, f) \ 274149401Sbrooks pf_match_addr(n, a, m, b, f) 275197139Shrs 276149401Sbrooks#define PF_ACPY(a, b, f) \ 277149401Sbrooks (a)->v4.s_addr = (b)->v4.s_addr 278149401Sbrooks 279147088Sbrooks#define PF_AINC(a, f) \ 280147088Sbrooks do { \ 281147088Sbrooks (a)->addr32[0] = htonl(ntohl((a)->addr32[0]) + 1); \ 282147088Sbrooks } while (0) 283197139Shrs 284147088Sbrooks#define PF_POOLMASK(a, b, c, d, f) \ 285197139Shrs do { \ 286147088Sbrooks (a)->addr32[0] = ((b)->addr32[0] & (c)->addr32[0]) | \ 287147088Sbrooks (((c)->addr32[0] ^ 0xffffffff ) & (d)->addr32[0]); \ 288147088Sbrooks } while (0) 289147088Sbrooks 290147088Sbrooks#endif /* PF_INET_ONLY */ 291157706Sbrooks#endif /* PF_INET6_ONLY */ 292157706Sbrooks#endif /* PF_INET_INET6 */ 293157706Sbrooks 294157706Sbrooks/* 295157706Sbrooks * XXX callers not FIB-aware in our version of pf yet. 296157706Sbrooks * OpenBSD fixed it later it seems, 2010/05/07 13:33:16 claudio. 297147088Sbrooks */ 298147088Sbrooks#define PF_MISMATCHAW(aw, x, af, neg, ifp, rtid) \ 299197139Shrs ( \ 300147088Sbrooks (((aw)->type == PF_ADDR_NOROUTE && \ 301147088Sbrooks pf_routable((x), (af), NULL, (rtid))) || \ 302147088Sbrooks (((aw)->type == PF_ADDR_URPFFAILED && (ifp) != NULL && \ 303157706Sbrooks pf_routable((x), (af), (ifp), (rtid))) || \ 304157706Sbrooks ((aw)->type == PF_ADDR_TABLE && \ 305157706Sbrooks !pfr_match_addr((aw)->p.tbl, (x), (af))) || \ 306157706Sbrooks ((aw)->type == PF_ADDR_DYNIFTL && \ 307157706Sbrooks !pfi_match_addr((aw)->p.dyn, (x), (af))) || \ 308197139Shrs ((aw)->type == PF_ADDR_RANGE && \ 309157706Sbrooks !pf_match_addr_range(&(aw)->v.a.addr, \ 310197139Shrs &(aw)->v.a.mask, (x), (af))) || \ 311157706Sbrooks ((aw)->type == PF_ADDR_ADDRMASK && \ 312157706Sbrooks !PF_AZERO(&(aw)->v.a.mask, (af)) && \ 313157706Sbrooks !PF_MATCHA(0, &(aw)->v.a.addr, \ 314157706Sbrooks &(aw)->v.a.mask, (x), (af))))) != \ 315157706Sbrooks (neg) \ 316157706Sbrooks ) 317157706Sbrooks 318157706Sbrooks 319157706Sbrooksstruct pf_rule_uid { 320157706Sbrooks uid_t uid[2]; 321197139Shrs u_int8_t op; 322197139Shrs}; 323157706Sbrooks 324157706Sbrooksstruct pf_rule_gid { 325147088Sbrooks uid_t gid[2]; 326147088Sbrooks u_int8_t op; 327147088Sbrooks}; 328147088Sbrooks 329197139Shrsstruct pf_rule_addr { 330147088Sbrooks struct pf_addr_wrap addr; 331197139Shrs u_int16_t port[2]; 332147088Sbrooks u_int8_t neg; 333147088Sbrooks u_int8_t port_op; 334147088Sbrooks}; 335147088Sbrooks 336147088Sbrooksstruct pf_pooladdr { 337147088Sbrooks struct pf_addr_wrap addr; 338147088Sbrooks TAILQ_ENTRY(pf_pooladdr) entries; 339197139Shrs char ifname[IFNAMSIZ]; 340147088Sbrooks struct pfi_kif *kif; 341147088Sbrooks}; 342147088Sbrooks 343197139ShrsTAILQ_HEAD(pf_palist, pf_pooladdr); 344197139Shrs 345197139Shrsstruct pf_poolhashkey { 346197139Shrs union { 347197139Shrs u_int8_t key8[16]; 348197139Shrs u_int16_t key16[8]; 349197139Shrs u_int32_t key32[4]; 350197139Shrs } pfk; /* 128-bit hash key */ 351197139Shrs#define key8 pfk.key8 352222996Shrs#define key16 pfk.key16 353222996Shrs#define key32 pfk.key32 354197139Shrs}; 355197697Shrs 356197697Shrsstruct pf_pool { 357197697Shrs struct pf_palist list; 358197697Shrs struct pf_pooladdr *cur; 359197697Shrs struct pf_poolhashkey key; 360197697Shrs struct pf_addr counter; 361197697Shrs int tblidx; 362197697Shrs u_int16_t proxy_port[2]; 363197697Shrs u_int8_t opts; 364197697Shrs}; 365197139Shrs 366197139Shrs 367197139Shrs/* A packed Operating System description for fingerprinting */ 368197139Shrstypedef u_int32_t pf_osfp_t; 369197139Shrs#define PF_OSFP_ANY ((pf_osfp_t)0) 370197139Shrs#define PF_OSFP_UNKNOWN ((pf_osfp_t)-1) 371212574Shrs#define PF_OSFP_NOMATCH ((pf_osfp_t)-2) 372212574Shrs 373212574Shrsstruct pf_osfp_entry { 374212574Shrs SLIST_ENTRY(pf_osfp_entry) fp_entry; 375212574Shrs pf_osfp_t fp_os; 376212574Shrs int fp_enflags; 377212574Shrs#define PF_OSFP_EXPANDED 0x001 /* expanded entry */ 378212574Shrs#define PF_OSFP_GENERIC 0x002 /* generic signature */ 379212574Shrs#define PF_OSFP_NODETAIL 0x004 /* no p0f details */ 380212574Shrs#define PF_OSFP_LEN 32 381212574Shrs char fp_class_nm[PF_OSFP_LEN]; 382212574Shrs char fp_version_nm[PF_OSFP_LEN]; 383212574Shrs char fp_subtype_nm[PF_OSFP_LEN]; 384212577Shrs}; 385212574Shrs#define PF_OSFP_ENTRY_EQ(a, b) \ 386212574Shrs ((a)->fp_os == (b)->fp_os && \ 387212574Shrs memcmp((a)->fp_class_nm, (b)->fp_class_nm, PF_OSFP_LEN) == 0 && \ 388212574Shrs memcmp((a)->fp_version_nm, (b)->fp_version_nm, PF_OSFP_LEN) == 0 && \ 389212574Shrs memcmp((a)->fp_subtype_nm, (b)->fp_subtype_nm, PF_OSFP_LEN) == 0) 390212574Shrs 391212574Shrs/* handle pf_osfp_t packing */ 392212574Shrs#define _FP_RESERVED_BIT 1 /* For the special negative #defines */ 393212574Shrs#define _FP_UNUSED_BITS 1 394212574Shrs#define _FP_CLASS_BITS 10 /* OS Class (Windows, Linux) */ 395212574Shrs#define _FP_VERSION_BITS 10 /* OS version (95, 98, NT, 2.4.54, 3.2) */ 396212574Shrs#define _FP_SUBTYPE_BITS 10 /* patch level (NT SP4, SP3, ECN patch) */ 397212574Shrs#define PF_OSFP_UNPACK(osfp, class, version, subtype) do { \ 398162490Sbrooks (class) = ((osfp) >> (_FP_VERSION_BITS+_FP_SUBTYPE_BITS)) & \ 399162490Sbrooks ((1 << _FP_CLASS_BITS) - 1); \ 400162490Sbrooks (version) = ((osfp) >> _FP_SUBTYPE_BITS) & \ 401162490Sbrooks ((1 << _FP_VERSION_BITS) - 1);\ 402162490Sbrooks (subtype) = (osfp) & ((1 << _FP_SUBTYPE_BITS) - 1); \ 403212574Shrs} while(0) 404212574Shrs#define PF_OSFP_PACK(osfp, class, version, subtype) do { \ 405212574Shrs (osfp) = ((class) & ((1 << _FP_CLASS_BITS) - 1)) << (_FP_VERSION_BITS \ 406197139Shrs + _FP_SUBTYPE_BITS); \ 407162490Sbrooks (osfp) |= ((version) & ((1 << _FP_VERSION_BITS) - 1)) << \ 408162490Sbrooks _FP_SUBTYPE_BITS; \ 409197139Shrs (osfp) |= (subtype) & ((1 << _FP_SUBTYPE_BITS) - 1); \ 410197139Shrs} while(0) 411212574Shrs 412197139Shrs/* the fingerprint of an OSes TCP SYN packet */ 413197139Shrstypedef u_int64_t pf_tcpopts_t; 414197139Shrsstruct pf_os_fingerprint { 415197139Shrs SLIST_HEAD(pf_osfp_enlist, pf_osfp_entry) fp_oses; /* list of matches */ 416197139Shrs pf_tcpopts_t fp_tcpopts; /* packed TCP options */ 417212574Shrs u_int16_t fp_wsize; /* TCP window size */ 418212575Shrs u_int16_t fp_psize; /* ip->ip_len */ 419212575Shrs u_int16_t fp_mss; /* TCP MSS */ 420212575Shrs u_int16_t fp_flags; 421212575Shrs#define PF_OSFP_WSIZE_MOD 0x0001 /* Window modulus */ 422212575Shrs#define PF_OSFP_WSIZE_DC 0x0002 /* Window don't care */ 423212575Shrs#define PF_OSFP_WSIZE_MSS 0x0004 /* Window multiple of MSS */ 424197139Shrs#define PF_OSFP_WSIZE_MTU 0x0008 /* Window multiple of MTU */ 425212575Shrs#define PF_OSFP_PSIZE_MOD 0x0010 /* packet size modulus */ 426212575Shrs#define PF_OSFP_PSIZE_DC 0x0020 /* packet size don't care */ 427212575Shrs#define PF_OSFP_WSCALE 0x0040 /* TCP window scaling */ 428212574Shrs#define PF_OSFP_WSCALE_MOD 0x0080 /* TCP window scale modulus */ 429212574Shrs#define PF_OSFP_WSCALE_DC 0x0100 /* TCP window scale dont-care */ 430212575Shrs#define PF_OSFP_MSS 0x0200 /* TCP MSS */ 431212575Shrs#define PF_OSFP_MSS_MOD 0x0400 /* TCP MSS modulus */ 432197139Shrs#define PF_OSFP_MSS_DC 0x0800 /* TCP MSS dont-care */ 433162490Sbrooks#define PF_OSFP_DF 0x1000 /* IPv4 don't fragment bit */ 434162490Sbrooks#define PF_OSFP_TS0 0x2000 /* Zero timestamp */ 435162490Sbrooks#define PF_OSFP_INET6 0x4000 /* IPv6 */ 436197139Shrs u_int8_t fp_optcnt; /* TCP option count */ 437197139Shrs u_int8_t fp_wscale; /* TCP window scaling */ 438197139Shrs u_int8_t fp_ttl; /* IPv4 TTL */ 439197139Shrs#define PF_OSFP_MAXTTL_OFFSET 40 440197139Shrs/* TCP options packing */ 441197139Shrs#define PF_OSFP_TCPOPT_NOP 0x0 /* TCP NOP option */ 442197139Shrs#define PF_OSFP_TCPOPT_WSCALE 0x1 /* TCP window scaling option */ 443197139Shrs#define PF_OSFP_TCPOPT_MSS 0x2 /* TCP max segment size opt */ 444212577Shrs#define PF_OSFP_TCPOPT_SACK 0x3 /* TCP SACK OK option */ 445212577Shrs#define PF_OSFP_TCPOPT_TS 0x4 /* TCP timestamp option */ 446212577Shrs#define PF_OSFP_TCPOPT_BITS 3 /* bits used by each option */ 447212577Shrs#define PF_OSFP_MAX_OPTS \ 448212577Shrs (sizeof(((struct pf_os_fingerprint *)0)->fp_tcpopts) * 8) \ 449212577Shrs / PF_OSFP_TCPOPT_BITS 450197139Shrs 451212577Shrs SLIST_ENTRY(pf_os_fingerprint) fp_next; 452212577Shrs}; 453212574Shrs 454212574Shrsstruct pf_osfp_ioctl { 455212574Shrs struct pf_osfp_entry fp_os; 456212577Shrs pf_tcpopts_t fp_tcpopts; /* packed TCP options */ 457212577Shrs u_int16_t fp_wsize; /* TCP window size */ 458212577Shrs u_int16_t fp_psize; /* ip->ip_len */ 459197139Shrs u_int16_t fp_mss; /* TCP MSS */ 460197139Shrs u_int16_t fp_flags; 461197139Shrs u_int8_t fp_optcnt; /* TCP option count */ 462197526Shrs u_int8_t fp_wscale; /* TCP window scaling */ 463197526Shrs u_int8_t fp_ttl; /* IPv4 TTL */ 464197526Shrs 465197526Shrs int fp_getnum; /* DIOCOSFPGET number */ 466212574Shrs}; 467212574Shrs 468212577Shrs 469197526Shrsunion pf_rule_ptr { 470212577Shrs struct pf_rule *ptr; 471197526Shrs u_int32_t nr; 472197526Shrs}; 473212574Shrs 474212574Shrs#define PF_ANCHOR_NAME_SIZE 64 475212574Shrs 476212574Shrsstruct pf_rule { 477212574Shrs struct pf_rule_addr src; 478212574Shrs struct pf_rule_addr dst; 479212574Shrs#define PF_SKIP_IFP 0 480212574Shrs#define PF_SKIP_DIR 1 481212574Shrs#define PF_SKIP_AF 2 482212574Shrs#define PF_SKIP_PROTO 3 483212574Shrs#define PF_SKIP_SRC_ADDR 4 484212574Shrs#define PF_SKIP_SRC_PORT 5 485212574Shrs#define PF_SKIP_DST_ADDR 6 486212574Shrs#define PF_SKIP_DST_PORT 7 487212574Shrs#define PF_SKIP_COUNT 8 488212574Shrs union pf_rule_ptr skip[PF_SKIP_COUNT]; 489212574Shrs#define PF_RULE_LABEL_SIZE 64 490212574Shrs char label[PF_RULE_LABEL_SIZE]; 491212574Shrs char ifname[IFNAMSIZ]; 492197139Shrs char qname[PF_QNAME_SIZE]; 493197139Shrs char pqname[PF_QNAME_SIZE]; 494197139Shrs#define PF_TAG_NAME_SIZE 64 495161386Sbrooks char tagname[PF_TAG_NAME_SIZE]; 496161386Sbrooks char match_tagname[PF_TAG_NAME_SIZE]; 497161386Sbrooks 498161386Sbrooks char overload_tblname[PF_TABLE_NAME_SIZE]; 499197139Shrs 500169889Sthompsa TAILQ_ENTRY(pf_rule) entries; 501161386Sbrooks struct pf_pool rpool; 502161386Sbrooks 503152441Sbrooks u_int64_t evaluations; 504212578Shrs u_int64_t packets[2]; 505152441Sbrooks u_int64_t bytes[2]; 506152441Sbrooks 507197139Shrs struct pfi_kif *kif; 508152441Sbrooks struct pf_anchor *anchor; 509197139Shrs struct pfr_ktable *overload_tbl; 510197139Shrs 511222515Sbz pf_osfp_t os_fingerprint; 512222515Sbz 513222515Sbz int rtableid; 514222515Sbz u_int32_t timeout[PFTM_MAX]; 515222515Sbz u_int32_t max_states; 516222515Sbz u_int32_t max_src_nodes; 517222515Sbz u_int32_t max_src_states; 518197139Shrs u_int32_t max_src_conn; 519197139Shrs struct { 520197139Shrs u_int32_t limit; 521197139Shrs u_int32_t seconds; 522152441Sbrooks } max_src_conn_rate; 523152441Sbrooks u_int32_t qid; 524197139Shrs u_int32_t pqid; 525197139Shrs u_int32_t rt_listid; 526197139Shrs u_int32_t nr; 527197139Shrs u_int32_t prob; 528197139Shrs uid_t cuid; 529197139Shrs pid_t cpid; 530197139Shrs 531197139Shrs counter_u64_t states_cur; 532197139Shrs counter_u64_t states_tot; 533197139Shrs counter_u64_t src_nodes; 534197139Shrs 535197139Shrs u_int16_t return_icmp; 536197139Shrs u_int16_t return_icmp6; 537197139Shrs u_int16_t max_mss; 538197139Shrs u_int16_t tag; 539197139Shrs u_int16_t match_tag; 540197139Shrs u_int16_t spare2; /* netgraph */ 541197139Shrs 542197139Shrs struct pf_rule_uid uid; 543197139Shrs struct pf_rule_gid gid; 544197139Shrs 545197139Shrs u_int32_t rule_flag; 546197139Shrs u_int8_t action; 547152441Sbrooks u_int8_t direction; 548197147Shrs u_int8_t log; 549152441Sbrooks u_int8_t logif; 550152441Sbrooks u_int8_t quick; 551197139Shrs u_int8_t ifnot; 552152441Sbrooks u_int8_t match_tag_not; 553161386Sbrooks u_int8_t natpass; 554161386Sbrooks 555161386Sbrooks#define PF_STATE_NORMAL 0x1 556161386Sbrooks#define PF_STATE_MODULATE 0x2 557161386Sbrooks#define PF_STATE_SYNPROXY 0x3 558161386Sbrooks u_int8_t keep_state; 559161386Sbrooks sa_family_t af; 560161386Sbrooks u_int8_t proto; 561161386Sbrooks u_int8_t type; 562161386Sbrooks u_int8_t code; 563161386Sbrooks u_int8_t flags; 564161386Sbrooks u_int8_t flagset; 565161386Sbrooks u_int8_t min_ttl; 566161386Sbrooks u_int8_t allow_opts; 567161386Sbrooks u_int8_t rt; 568161386Sbrooks u_int8_t return_ttl; 569161386Sbrooks u_int8_t tos; 570161386Sbrooks u_int8_t set_tos; 571161386Sbrooks u_int8_t anchor_relative; 572161386Sbrooks u_int8_t anchor_wildcard; 573197139Shrs 574161386Sbrooks#define PF_FLUSH 0x01 575161386Sbrooks#define PF_FLUSH_GLOBAL 0x02 576161386Sbrooks u_int8_t flush; 577152441Sbrooks 578152441Sbrooks struct { 579197139Shrs struct pf_addr addr; 580197139Shrs u_int16_t port; 581197139Shrs } divert; 582197139Shrs 583197139Shrs uint64_t u_states_cur; 584197139Shrs uint64_t u_states_tot; 585197139Shrs uint64_t u_src_nodes; 586197139Shrs}; 587197139Shrs 588197139Shrs/* rule flags */ 589197139Shrs#define PFRULE_DROP 0x0000 590197139Shrs#define PFRULE_RETURNRST 0x0001 591197139Shrs#define PFRULE_FRAGMENT 0x0002 592197139Shrs#define PFRULE_RETURNICMP 0x0004 593197139Shrs#define PFRULE_RETURN 0x0008 594197139Shrs#define PFRULE_NOSYNC 0x0010 595197139Shrs#define PFRULE_SRCTRACK 0x0020 /* track source states */ 596197139Shrs#define PFRULE_RULESRCTRACK 0x0040 /* per rule */ 597197139Shrs#define PFRULE_REFS 0x0080 /* rule has references */ 598197139Shrs 599197139Shrs/* scrub flags */ 600197139Shrs#define PFRULE_NODF 0x0100 601197139Shrs#define PFRULE_FRAGCROP 0x0200 /* non-buffering frag cache */ 602197139Shrs#define PFRULE_FRAGDROP 0x0400 /* drop funny fragments */ 603197139Shrs#define PFRULE_RANDOMID 0x0800 604197139Shrs#define PFRULE_REASSEMBLE_TCP 0x1000 605197139Shrs#define PFRULE_SET_TOS 0x2000 606197139Shrs 607197139Shrs/* rule flags again */ 608197139Shrs#define PFRULE_IFBOUND 0x00010000 /* if-bound */ 609197139Shrs#define PFRULE_STATESLOPPY 0x00020000 /* sloppy state tracking */ 610197139Shrs 611197139Shrs#define PFSTATE_HIWAT 10000 /* default state table size */ 612197139Shrs#define PFSTATE_ADAPT_START 6000 /* default adaptive timeout start */ 613197139Shrs#define PFSTATE_ADAPT_END 12000 /* default adaptive timeout end */ 614197139Shrs 615152441Sbrooks 616197147Shrsstruct pf_threshold { 617197147Shrs u_int32_t limit; 618152441Sbrooks#define PF_THRESHOLD_MULT 1000 619197147Shrs#define PF_THRESHOLD_MAX 0xffffffff / PF_THRESHOLD_MULT 620197139Shrs u_int32_t seconds; 621212578Shrs u_int32_t count; 622152441Sbrooks u_int32_t last; 623152441Sbrooks}; 624152441Sbrooks 625212578Shrsstruct pf_src_node { 626152441Sbrooks LIST_ENTRY(pf_src_node) entry; 627157706Sbrooks struct pf_addr addr; 628212578Shrs struct pf_addr raddr; 629152441Sbrooks union pf_rule_ptr rule; 630152441Sbrooks struct pfi_kif *kif; 631152441Sbrooks u_int64_t bytes[2]; 632152441Sbrooks u_int64_t packets[2]; 633152441Sbrooks u_int32_t states; 634152441Sbrooks u_int32_t conn; 635152441Sbrooks struct pf_threshold conn_rate; 636152441Sbrooks u_int32_t creation; 637152441Sbrooks u_int32_t expire; 638152441Sbrooks sa_family_t af; 639152441Sbrooks u_int8_t ruletype; 640152441Sbrooks}; 641212578Shrs 642152441Sbrooks#define PFSNODE_HIWAT 10000 /* default source node table size */ 643152441Sbrooks 644152441Sbrooksstruct pf_state_scrub { 645152441Sbrooks struct timeval pfss_last; /* time received last packet */ 646152441Sbrooks u_int32_t pfss_tsecr; /* last echoed timestamp */ 647152441Sbrooks u_int32_t pfss_tsval; /* largest timestamp */ 648152441Sbrooks u_int32_t pfss_tsval0; /* original timestamp */ 649152441Sbrooks u_int16_t pfss_flags; 650152441Sbrooks#define PFSS_TIMESTAMP 0x0001 /* modulate timestamp */ 651152441Sbrooks#define PFSS_PAWS 0x0010 /* stricter PAWS checks */ 652152441Sbrooks#define PFSS_PAWS_IDLED 0x0020 /* was idle too long. no PAWS */ 653152441Sbrooks#define PFSS_DATA_TS 0x0040 /* timestamp on data packets */ 654197139Shrs#define PFSS_DATA_NOTS 0x0080 /* no timestamp on data packets */ 655152441Sbrooks u_int8_t pfss_ttl; /* stashed TTL */ 656152441Sbrooks u_int8_t pad; 657152441Sbrooks u_int32_t pfss_ts_mod; /* timestamp modulation */ 658197139Shrs}; 659113674Smtm 660113674Smtmstruct pf_state_host { 661113674Smtm struct pf_addr addr; 662113674Smtm u_int16_t port; 663113674Smtm u_int16_t pad; 664113674Smtm}; 665197139Shrs 666113674Smtmstruct pf_state_peer { 667197139Shrs struct pf_state_scrub *scrub; /* state is scrubbed */ 668197139Shrs u_int32_t seqlo; /* Max sequence number sent */ 669197139Shrs u_int32_t seqhi; /* Max the other end ACKd + win */ 670197139Shrs u_int32_t seqdiff; /* Sequence number modulator */ 671197139Shrs u_int16_t max_win; /* largest window (pre scaling) */ 672197139Shrs u_int16_t mss; /* Maximum segment size option */ 673197139Shrs u_int8_t state; /* active state level */ 674197139Shrs u_int8_t wscale; /* window scaling factor */ 675197139Shrs u_int8_t tcp_est; /* Did we reach TCPS_ESTABLISHED */ 676197139Shrs u_int8_t pad[1]; 677197139Shrs}; 678197139Shrs 679197139Shrs/* Keep synced with struct pf_state_key. */ 680197139Shrsstruct pf_state_key_cmp { 681197139Shrs struct pf_addr addr[2]; 682197139Shrs u_int16_t port[2]; 683197139Shrs sa_family_t af; 684197139Shrs u_int8_t proto; 685197139Shrs u_int8_t pad[2]; 686197139Shrs}; 687197139Shrs 688197139Shrsstruct pf_state_key { 689113674Smtm struct pf_addr addr[2]; 690113674Smtm u_int16_t port[2]; 691157706Sbrooks sa_family_t af; 692197139Shrs u_int8_t proto; 693197139Shrs u_int8_t pad[2]; 694197139Shrs 695197139Shrs LIST_ENTRY(pf_state_key) entry; 696197139Shrs TAILQ_HEAD(, pf_state) states[2]; 697197139Shrs}; 698197139Shrs 699197139Shrs/* Keep synced with struct pf_state. */ 700197147Shrsstruct pf_state_cmp { 701197139Shrs u_int64_t id; 702197139Shrs u_int32_t creatorid; 703197139Shrs u_int8_t direction; 704197139Shrs u_int8_t pad[3]; 705197139Shrs}; 706197139Shrs 707197139Shrsstruct pf_state { 708197139Shrs u_int64_t id; 709197139Shrs u_int32_t creatorid; 710197139Shrs u_int8_t direction; 711197139Shrs u_int8_t pad[3]; 712197139Shrs 713197139Shrs u_int refs; 714197139Shrs TAILQ_ENTRY(pf_state) sync_list; 715197139Shrs TAILQ_ENTRY(pf_state) key_list[2]; 716197139Shrs LIST_ENTRY(pf_state) entry; 717197139Shrs struct pf_state_peer src; 718197139Shrs struct pf_state_peer dst; 719197139Shrs union pf_rule_ptr rule; 720197139Shrs union pf_rule_ptr anchor; 721197139Shrs union pf_rule_ptr nat_rule; 722197139Shrs struct pf_addr rt_addr; 723113674Smtm struct pf_state_key *key[2]; /* addresses stack and wire */ 724197139Shrs struct pfi_kif *kif; 725197139Shrs struct pfi_kif *rt_kif; 726197139Shrs struct pf_src_node *src_node; 727113674Smtm struct pf_src_node *nat_src_node; 728197139Shrs u_int64_t packets[2]; 729197139Shrs u_int64_t bytes[2]; 730197139Shrs u_int32_t creation; 731197139Shrs u_int32_t expire; 732197139Shrs u_int32_t pfsync_time; 733197139Shrs u_int16_t tag; 734197139Shrs u_int8_t log; 735197139Shrs u_int8_t state_flags; 736197139Shrs#define PFSTATE_ALLOWOPTS 0x01 737197139Shrs#define PFSTATE_SLOPPY 0x02 738197139Shrs/* was PFSTATE_PFLOW 0x04 */ 739197526Shrs#define PFSTATE_NOSYNC 0x08 740197139Shrs#define PFSTATE_ACK 0x10 741197139Shrs u_int8_t timeout; 742197139Shrs u_int8_t sync_state; /* PFSYNC_S_x */ 743197139Shrs 744197139Shrs /* XXX */ 745197139Shrs u_int8_t sync_updates; 746113674Smtm u_int8_t _tail[3]; 747113674Smtm}; 748100280Sgordon 749197147Shrs/* 750116029Smtm * Unified state structures for pulling states out of the kernel 751116029Smtm * used by pfsync(4) and the pf(4) ioctl. 752116029Smtm */ 753116029Smtmstruct pfsync_state_scrub { 754116029Smtm u_int16_t pfss_flags; 755116029Smtm u_int8_t pfss_ttl; /* stashed TTL */ 756197139Shrs#define PFSYNC_SCRUB_FLAG_VALID 0x01 757116029Smtm u_int8_t scrub_flag; 758197139Shrs u_int32_t pfss_ts_mod; /* timestamp modulation */ 759197139Shrs} __packed; 760197139Shrs 761197139Shrsstruct pfsync_state_peer { 762197139Shrs struct pfsync_state_scrub scrub; /* state is scrubbed */ 763197139Shrs u_int32_t seqlo; /* Max sequence number sent */ 764197139Shrs u_int32_t seqhi; /* Max the other end ACKd + win */ 765197139Shrs u_int32_t seqdiff; /* Sequence number modulator */ 766197139Shrs u_int16_t max_win; /* largest window (pre scaling) */ 767197139Shrs u_int16_t mss; /* Maximum segment size option */ 768197139Shrs u_int8_t state; /* active state level */ 769197139Shrs u_int8_t wscale; /* window scaling factor */ 770197139Shrs u_int8_t pad[6]; 771197147Shrs} __packed; 772197139Shrs 773197139Shrsstruct pfsync_state_key { 774197139Shrs struct pf_addr addr[2]; 775197139Shrs u_int16_t port[2]; 776197139Shrs}; 777197139Shrs 778197139Shrsstruct pfsync_state { 779197139Shrs u_int64_t id; 780116029Smtm char ifname[IFNAMSIZ]; 781116029Smtm struct pfsync_state_key key[2]; 782157706Sbrooks struct pfsync_state_peer src; 783197139Shrs struct pfsync_state_peer dst; 784197139Shrs struct pf_addr rt_addr; 785197139Shrs u_int32_t rule; 786197139Shrs u_int32_t anchor; 787197139Shrs u_int32_t nat_rule; 788197139Shrs u_int32_t creation; 789197139Shrs u_int32_t expire; 790197139Shrs u_int32_t packets[2][2]; 791197147Shrs u_int32_t bytes[2][2]; 792197139Shrs u_int32_t creatorid; 793197139Shrs sa_family_t af; 794197139Shrs u_int8_t proto; 795197139Shrs u_int8_t direction; 796197139Shrs u_int8_t __spare[2]; 797197147Shrs u_int8_t log; 798197139Shrs u_int8_t state_flags; 799197139Shrs u_int8_t timeout; 800197139Shrs u_int8_t sync_flags; 801197139Shrs u_int8_t updates; 802197139Shrs} __packed; 803197139Shrs 804197139Shrs#ifdef _KERNEL 805197139Shrs/* pfsync */ 806197139Shrstypedef int pfsync_state_import_t(struct pfsync_state *, u_int8_t); 807197139Shrstypedef void pfsync_insert_state_t(struct pf_state *); 808197139Shrstypedef void pfsync_update_state_t(struct pf_state *); 809197139Shrstypedef void pfsync_delete_state_t(struct pf_state *); 810197139Shrstypedef void pfsync_clear_states_t(u_int32_t, const char *); 811197139Shrstypedef int pfsync_defer_t(struct pf_state *, struct mbuf *); 812197139Shrs 813197139Shrsextern pfsync_state_import_t *pfsync_state_import_ptr; 814116029Smtmextern pfsync_insert_state_t *pfsync_insert_state_ptr; 815197139Shrsextern pfsync_update_state_t *pfsync_update_state_ptr; 816197139Shrsextern pfsync_delete_state_t *pfsync_delete_state_ptr; 817197139Shrsextern pfsync_clear_states_t *pfsync_clear_states_ptr; 818116029Smtmextern pfsync_defer_t *pfsync_defer_ptr; 819197139Shrs 820197139Shrsvoid pfsync_state_export(struct pfsync_state *, 821197526Shrs struct pf_state *); 822197139Shrs 823197139Shrs/* pflog */ 824197139Shrsstruct pf_ruleset; 825197139Shrsstruct pf_pdesc; 826197139Shrstypedef int pflog_packet_t(struct pfi_kif *, struct mbuf *, sa_family_t, 827197139Shrs u_int8_t, u_int8_t, struct pf_rule *, struct pf_rule *, 828197139Shrs struct pf_ruleset *, struct pf_pdesc *, int); 829197526Shrsextern pflog_packet_t *pflog_packet_ptr; 830197526Shrs 831197139Shrs#define V_pf_end_threads VNET(pf_end_threads) 832197139Shrs#endif /* _KERNEL */ 833197139Shrs 834197526Shrs#define PFSYNC_FLAG_SRCNODE 0x04 835197139Shrs#define PFSYNC_FLAG_NATSRCNODE 0x08 836197139Shrs 837116029Smtm/* for copies to/from network byte order */ 838116029Smtm/* ioctl interface also uses network byte order */ 839116029Smtm#define pf_state_peer_hton(s,d) do { \ 840197139Shrs (d)->seqlo = htonl((s)->seqlo); \ 841197139Shrs (d)->seqhi = htonl((s)->seqhi); \ 842197139Shrs (d)->seqdiff = htonl((s)->seqdiff); \ 843197139Shrs (d)->max_win = htons((s)->max_win); \ 844197139Shrs (d)->mss = htons((s)->mss); \ 845197139Shrs (d)->state = (s)->state; \ 846197139Shrs (d)->wscale = (s)->wscale; \ 847197139Shrs if ((s)->scrub) { \ 848197139Shrs (d)->scrub.pfss_flags = \ 849197139Shrs htons((s)->scrub->pfss_flags & PFSS_TIMESTAMP); \ 850197139Shrs (d)->scrub.pfss_ttl = (s)->scrub->pfss_ttl; \ 851197139Shrs (d)->scrub.pfss_ts_mod = htonl((s)->scrub->pfss_ts_mod);\ 852197139Shrs (d)->scrub.scrub_flag = PFSYNC_SCRUB_FLAG_VALID; \ 853197139Shrs } \ 854197139Shrs} while (0) 855197139Shrs 856197139Shrs#define pf_state_peer_ntoh(s,d) do { \ 857197139Shrs (d)->seqlo = ntohl((s)->seqlo); \ 858197139Shrs (d)->seqhi = ntohl((s)->seqhi); \ 859197139Shrs (d)->seqdiff = ntohl((s)->seqdiff); \ 860197139Shrs (d)->max_win = ntohs((s)->max_win); \ 861197139Shrs (d)->mss = ntohs((s)->mss); \ 862197139Shrs (d)->state = (s)->state; \ 863197139Shrs (d)->wscale = (s)->wscale; \ 864197139Shrs if ((s)->scrub.scrub_flag == PFSYNC_SCRUB_FLAG_VALID && \ 865197139Shrs (d)->scrub != NULL) { \ 866197139Shrs (d)->scrub->pfss_flags = \ 867197139Shrs ntohs((s)->scrub.pfss_flags) & PFSS_TIMESTAMP; \ 868197139Shrs (d)->scrub->pfss_ttl = (s)->scrub.pfss_ttl; \ 869197139Shrs (d)->scrub->pfss_ts_mod = ntohl((s)->scrub.pfss_ts_mod);\ 870197139Shrs } \ 871197139Shrs} while (0) 872197139Shrs 873197139Shrs#define pf_state_counter_hton(s,d) do { \ 874203433Sume d[0] = htonl((s>>32)&0xffffffff); \ 875203433Sume d[1] = htonl(s&0xffffffff); \ 876203433Sume} while (0) 877197139Shrs 878197139Shrs#define pf_state_counter_from_pfsync(s) \ 879197139Shrs (((u_int64_t)(s[0])<<32) | (u_int64_t)(s[1])) 880197139Shrs 881197139Shrs#define pf_state_counter_ntoh(s,d) do { \ 882197139Shrs d = ntohl(s[0]); \ 883197139Shrs d = d<<32; \ 884197139Shrs d += ntohl(s[1]); \ 885197139Shrs} while (0) 886197139Shrs 887197139ShrsTAILQ_HEAD(pf_rulequeue, pf_rule); 888197139Shrs 889113674Smtmstruct pf_anchor; 890113674Smtm 891113674Smtmstruct pf_ruleset { 892113674Smtm struct { 893113674Smtm struct pf_rulequeue queues[2]; 894113674Smtm struct { 895100280Sgordon struct pf_rulequeue *ptr; 896113674Smtm struct pf_rule **ptr_array; 897113674Smtm u_int32_t rcount; 898113674Smtm u_int32_t ticket; 899197139Shrs int open; 900197139Shrs } active, inactive; 901113674Smtm } rules[PF_RULESET_MAX]; 902100280Sgordon struct pf_anchor *anchor; 903100280Sgordon u_int32_t tticket; 904116029Smtm int tables; 905116029Smtm int topen; 906116029Smtm}; 907116029Smtm 908116029SmtmRB_HEAD(pf_anchor_global, pf_anchor); 909116029SmtmRB_HEAD(pf_anchor_node, pf_anchor); 910116029Smtmstruct pf_anchor { 911116029Smtm RB_ENTRY(pf_anchor) entry_global; 912116029Smtm RB_ENTRY(pf_anchor) entry_node; 913116029Smtm struct pf_anchor *parent; 914197139Shrs struct pf_anchor_node children; 915197139Shrs char name[PF_ANCHOR_NAME_SIZE]; 916116029Smtm char path[MAXPATHLEN]; 917116029Smtm struct pf_ruleset ruleset; 918116029Smtm int refcnt; /* anchor rules */ 919197147Shrs int match; /* XXX: used for pfctl black magic */ 920197147Shrs}; 921113674SmtmRB_PROTOTYPE(pf_anchor_global, pf_anchor, entry_global, pf_anchor_compare); 922113674SmtmRB_PROTOTYPE(pf_anchor_node, pf_anchor, entry_node, pf_anchor_compare); 923100280Sgordon 924197139Shrs#define PF_RESERVED_ANCHOR "_pf" 925113674Smtm 926113674Smtm#define PFR_TFLAG_PERSIST 0x00000001 927197139Shrs#define PFR_TFLAG_CONST 0x00000002 928197139Shrs#define PFR_TFLAG_ACTIVE 0x00000004 929113674Smtm#define PFR_TFLAG_INACTIVE 0x00000008 930178527Sbrooks#define PFR_TFLAG_REFERENCED 0x00000010 931116774Skuriyama#define PFR_TFLAG_REFDANCHOR 0x00000020 932113674Smtm#define PFR_TFLAG_COUNTERS 0x00000040 933113674Smtm/* Adjust masks below when adding flags. */ 934113674Smtm#define PFR_TFLAG_USRMASK (PFR_TFLAG_PERSIST | \ 935113674Smtm PFR_TFLAG_CONST | \ 936113674Smtm PFR_TFLAG_COUNTERS) 937113674Smtm#define PFR_TFLAG_SETMASK (PFR_TFLAG_ACTIVE | \ 938100280Sgordon PFR_TFLAG_INACTIVE | \ 939197147Shrs PFR_TFLAG_REFERENCED | \ 940197147Shrs PFR_TFLAG_REFDANCHOR) 941197147Shrs#define PFR_TFLAG_ALLMASK (PFR_TFLAG_PERSIST | \ 942113674Smtm PFR_TFLAG_CONST | \ 943113674Smtm PFR_TFLAG_ACTIVE | \ 944113674Smtm PFR_TFLAG_INACTIVE | \ 945197139Shrs PFR_TFLAG_REFERENCED | \ 946113674Smtm PFR_TFLAG_REFDANCHOR | \ 947113674Smtm PFR_TFLAG_COUNTERS) 948197139Shrs 949113674Smtmstruct pf_anchor_stackframe; 950208213Sjhb 951116774Skuriyamastruct pfr_table { 952113674Smtm char pfrt_anchor[MAXPATHLEN]; 953113674Smtm char pfrt_name[PF_TABLE_NAME_SIZE]; 954113674Smtm u_int32_t pfrt_flags; 955113674Smtm u_int8_t pfrt_fback; 956113674Smtm}; 957100280Sgordon 958100280Sgordonenum { PFR_FB_NONE, PFR_FB_MATCH, PFR_FB_ADDED, PFR_FB_DELETED, 959197147Shrs PFR_FB_CHANGED, PFR_FB_CLEARED, PFR_FB_DUPLICATE, 960197147Shrs PFR_FB_NOTMATCH, PFR_FB_CONFLICT, PFR_FB_NOCOUNT, PFR_FB_MAX }; 961197147Shrs 962178356Ssamstruct pfr_addr { 963178356Ssam union { 964178356Ssam struct in_addr _pfra_ip4addr; 965201215Sjhb struct in6_addr _pfra_ip6addr; 966178356Ssam } pfra_u; 967178356Ssam u_int8_t pfra_af; 968178356Ssam u_int8_t pfra_net; 969178527Sbrooks u_int8_t pfra_not; 970178527Sbrooks u_int8_t pfra_fback; 971178527Sbrooks}; 972178527Sbrooks#define pfra_ip4addr pfra_u._pfra_ip4addr 973183517Sbrooks#define pfra_ip6addr pfra_u._pfra_ip6addr 974189759Sbrooks 975189759Sbrooksenum { PFR_DIR_IN, PFR_DIR_OUT, PFR_DIR_MAX }; 976178356Ssamenum { PFR_OP_BLOCK, PFR_OP_PASS, PFR_OP_ADDR_MAX, PFR_OP_TABLE_MAX }; 977178356Ssam#define PFR_OP_XPASS PFR_OP_ADDR_MAX 978189759Sbrooks 979189759Sbrooksstruct pfr_astats { 980189759Sbrooks struct pfr_addr pfras_a; 981178356Ssam u_int64_t pfras_packets[PFR_DIR_MAX][PFR_OP_ADDR_MAX]; 982178356Ssam u_int64_t pfras_bytes[PFR_DIR_MAX][PFR_OP_ADDR_MAX]; 983189759Sbrooks long pfras_tzero; 984189759Sbrooks}; 985189759Sbrooks 986178356Ssamenum { PFR_REFCNT_RULE, PFR_REFCNT_ANCHOR, PFR_REFCNT_MAX }; 987178356Ssam 988188118Sthompsastruct pfr_tstats { 989188118Sthompsa struct pfr_table pfrts_t; 990188118Sthompsa u_int64_t pfrts_packets[PFR_DIR_MAX][PFR_OP_TABLE_MAX]; 991178356Ssam u_int64_t pfrts_bytes[PFR_DIR_MAX][PFR_OP_TABLE_MAX]; 992178356Ssam u_int64_t pfrts_match; 993201215Sjhb u_int64_t pfrts_nomatch; 994201215Sjhb long pfrts_tzero; 995201215Sjhb int pfrts_cnt; 996201215Sjhb int pfrts_refcnt[PFR_REFCNT_MAX]; 997201215Sjhb}; 998201215Sjhb#define pfrts_name pfrts_t.pfrt_name 999201215Sjhb#define pfrts_flags pfrts_t.pfrt_flags 1000201215Sjhb 1001201215Sjhb#ifndef _SOCKADDR_UNION_DEFINED 1002201215Sjhb#define _SOCKADDR_UNION_DEFINED 1003201215Sjhbunion sockaddr_union { 1004201215Sjhb struct sockaddr sa; 1005201215Sjhb struct sockaddr_in sin; 1006201215Sjhb struct sockaddr_in6 sin6; 1007201215Sjhb}; 1008201215Sjhb#endif /* _SOCKADDR_UNION_DEFINED */ 1009201215Sjhb 1010201215Sjhbstruct pfr_kcounters { 1011201215Sjhb u_int64_t pfrkc_packets[PFR_DIR_MAX][PFR_OP_ADDR_MAX]; 1012201215Sjhb u_int64_t pfrkc_bytes[PFR_DIR_MAX][PFR_OP_ADDR_MAX]; 1013201215Sjhb}; 1014201215Sjhb 1015201215SjhbSLIST_HEAD(pfr_kentryworkq, pfr_kentry); 1016201215Sjhbstruct pfr_kentry { 1017201215Sjhb struct radix_node pfrke_node[2]; 1018201215Sjhb union sockaddr_union pfrke_sa; 1019179001Sbrooks SLIST_ENTRY(pfr_kentry) pfrke_workq; 1020178356Ssam struct pfr_kcounters *pfrke_counters; 1021178356Ssam long pfrke_tzero; 1022197147Shrs u_int8_t pfrke_af; 1023197147Shrs u_int8_t pfrke_net; 1024178356Ssam u_int8_t pfrke_not; 1025178356Ssam u_int8_t pfrke_mark; 1026178356Ssam}; 1027201215Sjhb 1028197139ShrsSLIST_HEAD(pfr_ktableworkq, pfr_ktable); 1029178356SsamRB_HEAD(pfr_ktablehead, pfr_ktable); 1030201216Sjhbstruct pfr_ktable { 1031178527Sbrooks struct pfr_tstats pfrkt_ts; 1032201215Sjhb RB_ENTRY(pfr_ktable) pfrkt_tree; 1033201215Sjhb SLIST_ENTRY(pfr_ktable) pfrkt_workq; 1034201215Sjhb struct radix_node_head *pfrkt_ip4; 1035208213Sjhb struct radix_node_head *pfrkt_ip6; 1036178356Ssam struct pfr_ktable *pfrkt_shadow; 1037197139Shrs struct pfr_ktable *pfrkt_root; 1038201215Sjhb struct pf_ruleset *pfrkt_rs; 1039201215Sjhb long pfrkt_larg; 1040201215Sjhb int pfrkt_nflags; 1041201215Sjhb}; 1042201215Sjhb#define pfrkt_t pfrkt_ts.pfrts_t 1043201215Sjhb#define pfrkt_name pfrkt_t.pfrt_name 1044201215Sjhb#define pfrkt_anchor pfrkt_t.pfrt_anchor 1045201215Sjhb#define pfrkt_ruleset pfrkt_t.pfrt_ruleset 1046208213Sjhb#define pfrkt_flags pfrkt_t.pfrt_flags 1047201215Sjhb#define pfrkt_cnt pfrkt_ts.pfrts_cnt 1048201215Sjhb#define pfrkt_refcnt pfrkt_ts.pfrts_refcnt 1049197139Shrs#define pfrkt_packets pfrkt_ts.pfrts_packets 1050178356Ssam#define pfrkt_bytes pfrkt_ts.pfrts_bytes 1051178356Ssam#define pfrkt_match pfrkt_ts.pfrts_match 1052197147Shrs#define pfrkt_nomatch pfrkt_ts.pfrts_nomatch 1053197147Shrs#define pfrkt_tzero pfrkt_ts.pfrts_tzero 1054166583Sflz 1055197147Shrs/* keep synced with pfi_kif, used in RB_FIND */ 1056197147Shrsstruct pfi_kif_cmp { 1057166583Sflz char pfik_name[IFNAMSIZ]; 1058166583Sflz}; 1059166583Sflz 1060166583Sflzstruct pfi_kif { 1061166583Sflz char pfik_name[IFNAMSIZ]; 1062166583Sflz union { 1063197147Shrs RB_ENTRY(pfi_kif) _pfik_tree; 1064197147Shrs LIST_ENTRY(pfi_kif) _pfik_list; 1065197147Shrs } _pfik_glue; 1066197147Shrs#define pfik_tree _pfik_glue._pfik_tree 1067197147Shrs#define pfik_list _pfik_glue._pfik_list 1068197139Shrs u_int64_t pfik_packets[2][2][2]; 1069197139Shrs u_int64_t pfik_bytes[2][2][2]; 1070166583Sflz u_int32_t pfik_tzero; 1071166583Sflz u_int pfik_flags; 1072166583Sflz struct ifnet *pfik_ifp; 1073166583Sflz struct ifg_group *pfik_group; 1074166583Sflz u_int pfik_rulerefs; 1075166583Sflz TAILQ_HEAD(, pfi_dynaddr) pfik_dynaddrs; 1076166583Sflz}; 1077166583Sflz 1078166583Sflz#define PFI_IFLAG_REFS 0x0001 /* has state references */ 1079197147Shrs#define PFI_IFLAG_SKIP 0x0100 /* skip filtering on interface */ 1080197147Shrs 1081197147Shrsstruct pf_pdesc { 1082197147Shrs struct { 1083197139Shrs int done; 1084197139Shrs uid_t uid; 1085166583Sflz gid_t gid; 1086166583Sflz } lookup; 1087166583Sflz u_int64_t tot_len; /* Make Mickey money */ 1088166583Sflz union { 1089166583Sflz struct tcphdr *tcp; 1090166583Sflz struct udphdr *udp; 1091166583Sflz struct icmp *icmp; 1092177682Sbrooks#ifdef INET6 1093177682Sbrooks struct icmp6_hdr *icmp6; 1094177682Sbrooks#endif /* INET6 */ 1095177682Sbrooks void *any; 1096177682Sbrooks } hdr; 1097177682Sbrooks 1098166583Sflz struct pf_rule *nat_rule; /* nat/rdr rule applied to packet */ 1099166583Sflz struct pf_addr *src; /* src address */ 1100166583Sflz struct pf_addr *dst; /* dst address */ 1101166583Sflz u_int16_t *sport; 1102166583Sflz u_int16_t *dport; 1103166583Sflz struct pf_mtag *pf_mtag; 1104166583Sflz 1105166583Sflz u_int32_t p_len; /* total length of payload */ 1106197147Shrs 1107197147Shrs u_int16_t *ip_sum; 1108197139Shrs u_int16_t *proto_sum; 1109197139Shrs u_int16_t flags; /* Let SCRUB trigger behavior in 1110166583Sflz * state code. Easier than tags */ 1111166583Sflz#define PFDESC_TCP_NORM 0x0001 /* TCP shall be statefully scrubbed */ 1112166583Sflz#define PFDESC_IP_REAS 0x0002 /* IP frags would've been reassembled */ 1113166583Sflz sa_family_t af; 1114166583Sflz u_int8_t proto; 1115166583Sflz u_int8_t tos; 1116166583Sflz u_int8_t dir; /* direction */ 1117166583Sflz u_int8_t sidx; /* key index for source */ 1118166583Sflz u_int8_t didx; /* key index for destination */ 1119166583Sflz}; 1120166583Sflz 1121166583Sflz/* flags for RDR options */ 1122166583Sflz#define PF_DPORT_RANGE 0x01 /* Dest port uses range */ 1123166583Sflz#define PF_RPORT_RANGE 0x02 /* RDR'ed port uses range */ 1124166583Sflz 1125166583Sflz/* UDP state enumeration */ 1126166583Sflz#define PFUDPS_NO_TRAFFIC 0 1127166583Sflz#define PFUDPS_SINGLE 1 1128166583Sflz#define PFUDPS_MULTIPLE 2 1129166583Sflz 1130166583Sflz#define PFUDPS_NSTATES 3 /* number of state levels */ 1131166583Sflz 1132197147Shrs#define PFUDPS_NAMES { \ 1133197147Shrs "NO_TRAFFIC", \ 1134197147Shrs "SINGLE", \ 1135197147Shrs "MULTIPLE", \ 1136197139Shrs NULL \ 1137197139Shrs} 1138166583Sflz 1139166583Sflz/* Other protocol state enumeration */ 1140166583Sflz#define PFOTHERS_NO_TRAFFIC 0 1141166583Sflz#define PFOTHERS_SINGLE 1 1142100282Sdougb#define PFOTHERS_MULTIPLE 2 1143100282Sdougb 1144100282Sdougb#define PFOTHERS_NSTATES 3 /* number of state levels */ 1145100282Sdougb 1146166583Sflz#define PFOTHERS_NAMES { \ 1147100282Sdougb "NO_TRAFFIC", \ 1148100282Sdougb "SINGLE", \ 1149100282Sdougb "MULTIPLE", \ 1150166583Sflz NULL \ 1151100282Sdougb} 1152100282Sdougb 1153113674Smtm#define ACTION_SET(a, x) \ 1154197147Shrs do { \ 1155197147Shrs if ((a) != NULL) \ 1156113674Smtm *(a) = (x); \ 1157113674Smtm } while (0) 1158100280Sgordon 1159197139Shrs#define REASON_SET(a, x) \ 1160113674Smtm do { \ 1161197139Shrs if ((a) != NULL) \ 1162197139Shrs *(a) = (x); \ 1163197139Shrs if (x < PFRES_MAX) \ 1164113674Smtm counter_u64_add(V_pf_status.counters[x], 1); \ 1165113674Smtm } while (0) 1166113674Smtm 116785831Sdesstruct pf_kstatus { 1168197139Shrs counter_u64_t counters[PFRES_MAX]; /* reason for passing/dropping */ 1169113674Smtm counter_u64_t lcounters[LCNT_MAX]; /* limit counters */ 1170113674Smtm counter_u64_t fcounters[FCNT_MAX]; /* state operation counters */ 117185831Sdes counter_u64_t scounters[SCNT_MAX]; /* src_node operation counters */ 1172116029Smtm uint32_t states; 1173116029Smtm uint32_t src_nodes; 1174116029Smtm uint32_t running; 1175113674Smtm uint32_t since; 1176116029Smtm uint32_t debug; 1177116029Smtm uint32_t hostid; 1178197139Shrs char ifname[IFNAMSIZ]; 1179197139Shrs uint8_t pf_chksum[PF_MD5_DIGEST_LENGTH]; 1180116100Smtm}; 1181116100Smtm 1182197139Shrsstruct pf_divert { 1183197139Shrs union { 1184116100Smtm struct in_addr ipv4; 1185116100Smtm struct in6_addr ipv6; 1186116100Smtm } addr; 1187116100Smtm u_int16_t port; 1188116100Smtm}; 1189116100Smtm 1190116100Smtm#define PFFRAG_FRENT_HIWAT 5000 /* Number of fragment entries */ 1191116100Smtm#define PFR_KENTRY_HIWAT 200000 /* Number of table entries */ 1192116100Smtm 1193197139Shrs/* 1194116100Smtm * ioctl parameter structures 1195116100Smtm */ 1196116100Smtm 1197116100Smtmstruct pfioc_pooladdr { 1198116100Smtm u_int32_t action; 1199116100Smtm u_int32_t ticket; 1200116029Smtm u_int32_t nr; 1201116029Smtm u_int32_t r_num; 1202137070Spjd u_int8_t r_action; 1203137070Spjd u_int8_t r_last; 1204116029Smtm u_int8_t af; 1205137070Spjd char anchor[MAXPATHLEN]; 1206137070Spjd struct pf_pooladdr addr; 1207197139Shrs}; 1208137070Spjd 1209197139Shrsstruct pfioc_rule { 1210197139Shrs u_int32_t action; 1211157706Sbrooks u_int32_t ticket; 1212137070Spjd u_int32_t pool_ticket; 1213137070Spjd u_int32_t nr; 1214137070Spjd char anchor[MAXPATHLEN]; 1215137070Spjd char anchor_call[MAXPATHLEN]; 1216197139Shrs struct pf_rule rule; 1217137070Spjd}; 1218137070Spjd 1219137070Spjdstruct pfioc_natlook { 1220113674Smtm struct pf_addr saddr; 1221113674Smtm struct pf_addr daddr; 1222113674Smtm struct pf_addr rsaddr; 1223113674Smtm struct pf_addr rdaddr; 1224197147Shrs u_int16_t sport; 1225197147Shrs u_int16_t dport; 1226197139Shrs u_int16_t rsport; 1227197139Shrs u_int16_t rdport; 1228197139Shrs sa_family_t af; 1229197139Shrs u_int8_t proto; 1230113674Smtm u_int8_t direction; 1231134429Syar}; 1232134429Syar 1233134429Syarstruct pfioc_state { 1234113674Smtm struct pfsync_state state; 1235113674Smtm}; 1236113674Smtm 1237197139Shrsstruct pfioc_src_node_kill { 1238113674Smtm sa_family_t psnk_af; 123965532Snectar struct pf_rule_addr psnk_src; 1240149726Sbrooks struct pf_rule_addr psnk_dst; 124151231Ssheldonh u_int psnk_killed; 1242197139Shrs}; 124351231Ssheldonh 124451231Ssheldonhstruct pfioc_state_kill { 1245149401Sbrooks struct pf_state_cmp psk_pfcmp; 1246149726Sbrooks sa_family_t psk_af; 1247149401Sbrooks int psk_proto; 1248149401Sbrooks struct pf_rule_addr psk_src; 1249149726Sbrooks struct pf_rule_addr psk_dst; 1250149726Sbrooks char psk_ifname[IFNAMSIZ]; 1251149726Sbrooks char psk_label[PF_RULE_LABEL_SIZE]; 1252197139Shrs u_int psk_killed; 1253149726Sbrooks}; 1254149401Sbrooks 1255149401Sbrooksstruct pfioc_states { 1256197139Shrs int ps_len; 125751231Ssheldonh union { 125883677Sbrooks caddr_t psu_buf; 1259149401Sbrooks struct pfsync_state *psu_states; 1260196478Sdougb } ps_u; 1261196478Sdougb#define ps_buf ps_u.psu_buf 1262196478Sdougb#define ps_states ps_u.psu_states 1263196478Sdougb}; 1264196523Sdougb 1265196478Sdougbstruct pfioc_src_nodes { 1266196478Sdougb int psn_len; 126783677Sbrooks union { 126851231Ssheldonh caddr_t psu_buf; 126949122Sbrian struct pf_src_node *psu_src_nodes; 1270197139Shrs } psn_u; 1271197139Shrs#define psn_buf psn_u.psu_buf 1272197139Shrs#define psn_src_nodes psn_u.psu_src_nodes 1273197139Shrs}; 1274197139Shrs 1275197139Shrsstruct pfioc_if { 1276197139Shrs char ifname[IFNAMSIZ]; 1277197147Shrs}; 1278197139Shrs 1279197139Shrsstruct pfioc_tm { 1280197139Shrs int timeout; 1281197147Shrs int seconds; 1282197147Shrs}; 1283197139Shrs 1284197147Shrsstruct pfioc_limit { 1285197147Shrs int index; 1286113674Smtm unsigned limit; 1287197139Shrs}; 1288197139Shrs 1289197139Shrsstruct pfioc_altq { 1290197139Shrs u_int32_t action; 1291197139Shrs u_int32_t ticket; 1292197139Shrs u_int32_t nr; 1293197139Shrs struct pf_altq altq; 1294113674Smtm}; 1295197139Shrs 1296197139Shrsstruct pfioc_qstats { 1297197139Shrs u_int32_t ticket; 1298197139Shrs u_int32_t nr; 1299197139Shrs void *buf; 1300197139Shrs int nbytes; 1301197139Shrs u_int8_t scheduler; 1302197139Shrs}; 1303197139Shrs 1304197139Shrsstruct pfioc_ruleset { 1305113674Smtm u_int32_t nr; 1306197139Shrs char path[MAXPATHLEN]; 1307197139Shrs char name[PF_ANCHOR_NAME_SIZE]; 1308197139Shrs}; 1309130151Sschweikh 131025184Sjkh#define PF_RULESET_ALTQ (PF_RULESET_MAX) 1311114942Sume#define PF_RULESET_TABLE (PF_RULESET_MAX+1) 1312179003Sbrooksstruct pfioc_trans { 1313179003Sbrooks int size; /* number of elements */ 1314179003Sbrooks int esize; /* size of each element in bytes */ 1315179003Sbrooks struct pfioc_trans_e { 1316179003Sbrooks int rs_num; 1317179003Sbrooks char anchor[MAXPATHLEN]; 1318197139Shrs u_int32_t ticket; 1319197139Shrs } *array; 1320179003Sbrooks}; 1321179003Sbrooks 1322179003Sbrooks#define PFR_FLAG_ATOMIC 0x00000001 /* unused */ 1323197139Shrs#define PFR_FLAG_DUMMY 0x00000002 1324179003Sbrooks#define PFR_FLAG_FEEDBACK 0x00000004 1325179003Sbrooks#define PFR_FLAG_CLSTATS 0x00000008 1326179003Sbrooks#define PFR_FLAG_ADDRSTOO 0x00000010 1327179003Sbrooks#define PFR_FLAG_REPLACE 0x00000020 1328179003Sbrooks#define PFR_FLAG_ALLRSETS 0x00000040 1329179003Sbrooks#define PFR_FLAG_ALLMASK 0x0000007F 1330179003Sbrooks#ifdef _KERNEL 1331179003Sbrooks#define PFR_FLAG_USERIOCTL 0x10000000 1332179003Sbrooks#endif 1333179003Sbrooks 1334179003Sbrooksstruct pfioc_table { 1335197147Shrs struct pfr_table pfrio_table; 1336197147Shrs void *pfrio_buffer; 1337114942Sume int pfrio_esize; 1338114942Sume int pfrio_size; 1339221884Sjilles int pfrio_size2; 1340114942Sume int pfrio_nadd; 1341114942Sume int pfrio_ndel; 1342197147Shrs int pfrio_nchange; 1343197147Shrs int pfrio_flags; 1344114942Sume u_int32_t pfrio_ticket; 1345114942Sume}; 1346221884Sjilles#define pfrio_exists pfrio_nadd 1347114942Sume#define pfrio_nzero pfrio_nadd 1348114942Sume#define pfrio_nmatch pfrio_nadd 1349196436Sdougb#define pfrio_naddr pfrio_size2 1350196436Sdougb#define pfrio_setflag pfrio_size2 1351196436Sdougb#define pfrio_clrflag pfrio_nadd 1352196436Sdougb 1353196436Sdougbstruct pfioc_iface { 1354196436Sdougb char pfiio_name[IFNAMSIZ]; 1355196436Sdougb void *pfiio_buffer; 1356196436Sdougb int pfiio_esize; 1357196436Sdougb int pfiio_size; 1358196436Sdougb int pfiio_nzero; 1359196436Sdougb int pfiio_flags; 1360197147Shrs}; 1361197147Shrs 1362197147Shrs 1363114942Sume/* 1364114942Sume * ioctl operations 1365197139Shrs */ 1366114942Sume 1367114942Sume#define DIOCSTART _IO ('D', 1) 1368114942Sume#define DIOCSTOP _IO ('D', 2) 1369114942Sume#define DIOCADDRULE _IOWR('D', 4, struct pfioc_rule) 1370114942Sume#define DIOCGETRULES _IOWR('D', 6, struct pfioc_rule) 1371114942Sume#define DIOCGETRULE _IOWR('D', 7, struct pfioc_rule) 1372114942Sume/* XXX cut 8 - 17 */ 1373114942Sume#define DIOCCLRSTATES _IOWR('D', 18, struct pfioc_state_kill) 1374114942Sume#define DIOCGETSTATE _IOWR('D', 19, struct pfioc_state) 1375114942Sume#define DIOCSETSTATUSIF _IOWR('D', 20, struct pfioc_if) 1376114942Sume#define DIOCGETSTATUS _IOWR('D', 21, struct pf_status) 1377114942Sume#define DIOCCLRSTATUS _IO ('D', 22) 1378114942Sume#define DIOCNATLOOK _IOWR('D', 23, struct pfioc_natlook) 1379114942Sume#define DIOCSETDEBUG _IOWR('D', 24, u_int32_t) 1380114942Sume#define DIOCGETSTATES _IOWR('D', 25, struct pfioc_states) 1381114942Sume#define DIOCCHANGERULE _IOWR('D', 26, struct pfioc_rule) 1382114942Sume/* XXX cut 26 - 28 */ 1383114942Sume#define DIOCSETTIMEOUT _IOWR('D', 29, struct pfioc_tm) 1384114942Sume#define DIOCGETTIMEOUT _IOWR('D', 30, struct pfioc_tm) 1385114942Sume#define DIOCADDSTATE _IOWR('D', 37, struct pfioc_state) 1386114942Sume#define DIOCCLRRULECTRS _IO ('D', 38) 1387#define DIOCGETLIMIT _IOWR('D', 39, struct pfioc_limit) 1388#define DIOCSETLIMIT _IOWR('D', 40, struct pfioc_limit) 1389#define DIOCKILLSTATES _IOWR('D', 41, struct pfioc_state_kill) 1390#define DIOCSTARTALTQ _IO ('D', 42) 1391#define DIOCSTOPALTQ _IO ('D', 43) 1392#define DIOCADDALTQ _IOWR('D', 45, struct pfioc_altq) 1393#define DIOCGETALTQS _IOWR('D', 47, struct pfioc_altq) 1394#define DIOCGETALTQ _IOWR('D', 48, struct pfioc_altq) 1395#define DIOCCHANGEALTQ _IOWR('D', 49, struct pfioc_altq) 1396#define DIOCGETQSTATS _IOWR('D', 50, struct pfioc_qstats) 1397#define DIOCBEGINADDRS _IOWR('D', 51, struct pfioc_pooladdr) 1398#define DIOCADDADDR _IOWR('D', 52, struct pfioc_pooladdr) 1399#define DIOCGETADDRS _IOWR('D', 53, struct pfioc_pooladdr) 1400#define DIOCGETADDR _IOWR('D', 54, struct pfioc_pooladdr) 1401#define DIOCCHANGEADDR _IOWR('D', 55, struct pfioc_pooladdr) 1402/* XXX cut 55 - 57 */ 1403#define DIOCGETRULESETS _IOWR('D', 58, struct pfioc_ruleset) 1404#define DIOCGETRULESET _IOWR('D', 59, struct pfioc_ruleset) 1405#define DIOCRCLRTABLES _IOWR('D', 60, struct pfioc_table) 1406#define DIOCRADDTABLES _IOWR('D', 61, struct pfioc_table) 1407#define DIOCRDELTABLES _IOWR('D', 62, struct pfioc_table) 1408#define DIOCRGETTABLES _IOWR('D', 63, struct pfioc_table) 1409#define DIOCRGETTSTATS _IOWR('D', 64, struct pfioc_table) 1410#define DIOCRCLRTSTATS _IOWR('D', 65, struct pfioc_table) 1411#define DIOCRCLRADDRS _IOWR('D', 66, struct pfioc_table) 1412#define DIOCRADDADDRS _IOWR('D', 67, struct pfioc_table) 1413#define DIOCRDELADDRS _IOWR('D', 68, struct pfioc_table) 1414#define DIOCRSETADDRS _IOWR('D', 69, struct pfioc_table) 1415#define DIOCRGETADDRS _IOWR('D', 70, struct pfioc_table) 1416#define DIOCRGETASTATS _IOWR('D', 71, struct pfioc_table) 1417#define DIOCRCLRASTATS _IOWR('D', 72, struct pfioc_table) 1418#define DIOCRTSTADDRS _IOWR('D', 73, struct pfioc_table) 1419#define DIOCRSETTFLAGS _IOWR('D', 74, struct pfioc_table) 1420#define DIOCRINADEFINE _IOWR('D', 77, struct pfioc_table) 1421#define DIOCOSFPFLUSH _IO('D', 78) 1422#define DIOCOSFPADD _IOWR('D', 79, struct pf_osfp_ioctl) 1423#define DIOCOSFPGET _IOWR('D', 80, struct pf_osfp_ioctl) 1424#define DIOCXBEGIN _IOWR('D', 81, struct pfioc_trans) 1425#define DIOCXCOMMIT _IOWR('D', 82, struct pfioc_trans) 1426#define DIOCXROLLBACK _IOWR('D', 83, struct pfioc_trans) 1427#define DIOCGETSRCNODES _IOWR('D', 84, struct pfioc_src_nodes) 1428#define DIOCCLRSRCNODES _IO('D', 85) 1429#define DIOCSETHOSTID _IOWR('D', 86, u_int32_t) 1430#define DIOCIGETIFACES _IOWR('D', 87, struct pfioc_iface) 1431#define DIOCSETIFFLAG _IOWR('D', 89, struct pfioc_iface) 1432#define DIOCCLRIFFLAG _IOWR('D', 90, struct pfioc_iface) 1433#define DIOCKILLSRCNODES _IOWR('D', 91, struct pfioc_src_node_kill) 1434struct pf_ifspeed { 1435 char ifname[IFNAMSIZ]; 1436 u_int32_t baudrate; 1437}; 1438#define DIOCGIFSPEED _IOWR('D', 92, struct pf_ifspeed) 1439 1440#ifdef _KERNEL 1441LIST_HEAD(pf_src_node_list, pf_src_node); 1442struct pf_srchash { 1443 struct pf_src_node_list nodes; 1444 struct mtx lock; 1445}; 1446 1447struct pf_keyhash { 1448 LIST_HEAD(, pf_state_key) keys; 1449 struct mtx lock; 1450}; 1451 1452struct pf_idhash { 1453 LIST_HEAD(, pf_state) states; 1454 struct mtx lock; 1455}; 1456 1457extern u_long pf_hashmask; 1458extern u_long pf_srchashmask; 1459#define PF_HASHSIZ (32768) 1460VNET_DECLARE(struct pf_keyhash *, pf_keyhash); 1461VNET_DECLARE(struct pf_idhash *, pf_idhash); 1462#define V_pf_keyhash VNET(pf_keyhash) 1463#define V_pf_idhash VNET(pf_idhash) 1464VNET_DECLARE(struct pf_srchash *, pf_srchash); 1465#define V_pf_srchash VNET(pf_srchash) 1466 1467#define PF_IDHASH(s) (be64toh((s)->id) % (pf_hashmask + 1)) 1468 1469VNET_DECLARE(void *, pf_swi_cookie); 1470#define V_pf_swi_cookie VNET(pf_swi_cookie) 1471 1472VNET_DECLARE(uint64_t, pf_stateid[MAXCPU]); 1473#define V_pf_stateid VNET(pf_stateid) 1474 1475TAILQ_HEAD(pf_altqqueue, pf_altq); 1476VNET_DECLARE(struct pf_altqqueue, pf_altqs[2]); 1477#define V_pf_altqs VNET(pf_altqs) 1478VNET_DECLARE(struct pf_palist, pf_pabuf); 1479#define V_pf_pabuf VNET(pf_pabuf) 1480 1481VNET_DECLARE(u_int32_t, ticket_altqs_active); 1482#define V_ticket_altqs_active VNET(ticket_altqs_active) 1483VNET_DECLARE(u_int32_t, ticket_altqs_inactive); 1484#define V_ticket_altqs_inactive VNET(ticket_altqs_inactive) 1485VNET_DECLARE(int, altqs_inactive_open); 1486#define V_altqs_inactive_open VNET(altqs_inactive_open) 1487VNET_DECLARE(u_int32_t, ticket_pabuf); 1488#define V_ticket_pabuf VNET(ticket_pabuf) 1489VNET_DECLARE(struct pf_altqqueue *, pf_altqs_active); 1490#define V_pf_altqs_active VNET(pf_altqs_active) 1491VNET_DECLARE(struct pf_altqqueue *, pf_altqs_inactive); 1492#define V_pf_altqs_inactive VNET(pf_altqs_inactive) 1493 1494VNET_DECLARE(struct pf_rulequeue, pf_unlinked_rules); 1495#define V_pf_unlinked_rules VNET(pf_unlinked_rules) 1496 1497void pf_initialize(void); 1498void pf_mtag_initialize(void); 1499void pf_mtag_cleanup(void); 1500void pf_cleanup(void); 1501 1502struct pf_mtag *pf_get_mtag(struct mbuf *); 1503 1504extern void pf_calc_skip_steps(struct pf_rulequeue *); 1505#ifdef ALTQ 1506extern void pf_altq_ifnet_event(struct ifnet *, int); 1507#endif 1508VNET_DECLARE(uma_zone_t, pf_state_z); 1509#define V_pf_state_z VNET(pf_state_z) 1510VNET_DECLARE(uma_zone_t, pf_state_key_z); 1511#define V_pf_state_key_z VNET(pf_state_key_z) 1512VNET_DECLARE(uma_zone_t, pf_state_scrub_z); 1513#define V_pf_state_scrub_z VNET(pf_state_scrub_z) 1514 1515extern void pf_purge_thread(void *); 1516extern void pf_intr(void *); 1517extern void pf_purge_expired_src_nodes(void); 1518 1519extern int pf_unlink_state(struct pf_state *, u_int); 1520#define PF_ENTER_LOCKED 0x00000001 1521#define PF_RETURN_LOCKED 0x00000002 1522extern int pf_state_insert(struct pfi_kif *, 1523 struct pf_state_key *, 1524 struct pf_state_key *, 1525 struct pf_state *); 1526extern void pf_free_state(struct pf_state *); 1527 1528static __inline void 1529pf_ref_state(struct pf_state *s) 1530{ 1531 1532 refcount_acquire(&s->refs); 1533} 1534 1535static __inline int 1536pf_release_state(struct pf_state *s) 1537{ 1538 1539 if (refcount_release(&s->refs)) { 1540 pf_free_state(s); 1541 return (1); 1542 } else 1543 return (0); 1544} 1545 1546extern struct pf_state *pf_find_state_byid(uint64_t, uint32_t); 1547extern struct pf_state *pf_find_state_all(struct pf_state_key_cmp *, 1548 u_int, int *); 1549extern struct pf_src_node *pf_find_src_node(struct pf_addr *, 1550 struct pf_rule *, sa_family_t, int); 1551extern void pf_unlink_src_node(struct pf_src_node *); 1552extern u_int pf_free_src_nodes(struct pf_src_node_list *); 1553extern void pf_print_state(struct pf_state *); 1554extern void pf_print_flags(u_int8_t); 1555extern u_int16_t pf_cksum_fixup(u_int16_t, u_int16_t, u_int16_t, 1556 u_int8_t); 1557extern u_int16_t pf_proto_cksum_fixup(struct mbuf *, u_int16_t, 1558 u_int16_t, u_int16_t, u_int8_t); 1559 1560VNET_DECLARE(struct ifnet *, sync_ifp); 1561#define V_sync_ifp VNET(sync_ifp); 1562VNET_DECLARE(struct pf_rule, pf_default_rule); 1563#define V_pf_default_rule VNET(pf_default_rule) 1564extern void pf_addrcpy(struct pf_addr *, struct pf_addr *, 1565 u_int8_t); 1566void pf_free_rule(struct pf_rule *); 1567 1568#ifdef INET 1569int pf_test(int, struct ifnet *, struct mbuf **, struct inpcb *); 1570int pf_normalize_ip(struct mbuf **, int, struct pfi_kif *, u_short *, 1571 struct pf_pdesc *); 1572#endif /* INET */ 1573 1574#ifdef INET6 1575int pf_test6(int, struct ifnet *, struct mbuf **, struct inpcb *); 1576int pf_normalize_ip6(struct mbuf **, int, struct pfi_kif *, u_short *, 1577 struct pf_pdesc *); 1578void pf_poolmask(struct pf_addr *, struct pf_addr*, 1579 struct pf_addr *, struct pf_addr *, u_int8_t); 1580void pf_addr_inc(struct pf_addr *, sa_family_t); 1581int pf_refragment6(struct ifnet *, struct mbuf **, struct m_tag *); 1582#endif /* INET6 */ 1583 1584u_int32_t pf_new_isn(struct pf_state *); 1585void *pf_pull_hdr(struct mbuf *, int, void *, int, u_short *, u_short *, 1586 sa_family_t); 1587void pf_change_a(void *, u_int16_t *, u_int32_t, u_int8_t); 1588void pf_change_proto_a(struct mbuf *, void *, u_int16_t *, u_int32_t, 1589 u_int8_t); 1590void pf_change_tcp_a(struct mbuf *, void *, u_int16_t *, u_int32_t); 1591void pf_send_deferred_syn(struct pf_state *); 1592int pf_match_addr(u_int8_t, struct pf_addr *, struct pf_addr *, 1593 struct pf_addr *, sa_family_t); 1594int pf_match_addr_range(struct pf_addr *, struct pf_addr *, 1595 struct pf_addr *, sa_family_t); 1596int pf_match_port(u_int8_t, u_int16_t, u_int16_t, u_int16_t); 1597 1598void pf_normalize_init(void); 1599void pf_normalize_cleanup(void); 1600int pf_normalize_tcp(int, struct pfi_kif *, struct mbuf *, int, int, void *, 1601 struct pf_pdesc *); 1602void pf_normalize_tcp_cleanup(struct pf_state *); 1603int pf_normalize_tcp_init(struct mbuf *, int, struct pf_pdesc *, 1604 struct tcphdr *, struct pf_state_peer *, struct pf_state_peer *); 1605int pf_normalize_tcp_stateful(struct mbuf *, int, struct pf_pdesc *, 1606 u_short *, struct tcphdr *, struct pf_state *, 1607 struct pf_state_peer *, struct pf_state_peer *, int *); 1608u_int32_t 1609 pf_state_expires(const struct pf_state *); 1610void pf_purge_expired_fragments(void); 1611int pf_routable(struct pf_addr *addr, sa_family_t af, struct pfi_kif *, 1612 int); 1613int pf_socket_lookup(int, struct pf_pdesc *, struct mbuf *); 1614struct pf_state_key *pf_alloc_state_key(int); 1615void pfr_initialize(void); 1616void pfr_cleanup(void); 1617int pfr_match_addr(struct pfr_ktable *, struct pf_addr *, sa_family_t); 1618void pfr_update_stats(struct pfr_ktable *, struct pf_addr *, sa_family_t, 1619 u_int64_t, int, int, int); 1620int pfr_pool_get(struct pfr_ktable *, int *, struct pf_addr *, sa_family_t); 1621void pfr_dynaddr_update(struct pfr_ktable *, struct pfi_dynaddr *); 1622struct pfr_ktable * 1623 pfr_attach_table(struct pf_ruleset *, char *); 1624void pfr_detach_table(struct pfr_ktable *); 1625int pfr_clr_tables(struct pfr_table *, int *, int); 1626int pfr_add_tables(struct pfr_table *, int, int *, int); 1627int pfr_del_tables(struct pfr_table *, int, int *, int); 1628int pfr_get_tables(struct pfr_table *, struct pfr_table *, int *, int); 1629int pfr_get_tstats(struct pfr_table *, struct pfr_tstats *, int *, int); 1630int pfr_clr_tstats(struct pfr_table *, int, int *, int); 1631int pfr_set_tflags(struct pfr_table *, int, int, int, int *, int *, int); 1632int pfr_clr_addrs(struct pfr_table *, int *, int); 1633int pfr_insert_kentry(struct pfr_ktable *, struct pfr_addr *, long); 1634int pfr_add_addrs(struct pfr_table *, struct pfr_addr *, int, int *, 1635 int); 1636int pfr_del_addrs(struct pfr_table *, struct pfr_addr *, int, int *, 1637 int); 1638int pfr_set_addrs(struct pfr_table *, struct pfr_addr *, int, int *, 1639 int *, int *, int *, int, u_int32_t); 1640int pfr_get_addrs(struct pfr_table *, struct pfr_addr *, int *, int); 1641int pfr_get_astats(struct pfr_table *, struct pfr_astats *, int *, int); 1642int pfr_clr_astats(struct pfr_table *, struct pfr_addr *, int, int *, 1643 int); 1644int pfr_tst_addrs(struct pfr_table *, struct pfr_addr *, int, int *, 1645 int); 1646int pfr_ina_begin(struct pfr_table *, u_int32_t *, int *, int); 1647int pfr_ina_rollback(struct pfr_table *, u_int32_t, int *, int); 1648int pfr_ina_commit(struct pfr_table *, u_int32_t, int *, int *, int); 1649int pfr_ina_define(struct pfr_table *, struct pfr_addr *, int, int *, 1650 int *, u_int32_t, int); 1651 1652MALLOC_DECLARE(PFI_MTYPE); 1653VNET_DECLARE(struct pfi_kif *, pfi_all); 1654#define V_pfi_all VNET(pfi_all) 1655 1656void pfi_initialize(void); 1657void pfi_cleanup(void); 1658void pfi_kif_ref(struct pfi_kif *); 1659void pfi_kif_unref(struct pfi_kif *); 1660struct pfi_kif *pfi_kif_find(const char *); 1661struct pfi_kif *pfi_kif_attach(struct pfi_kif *, const char *); 1662int pfi_kif_match(struct pfi_kif *, struct pfi_kif *); 1663void pfi_kif_purge(void); 1664int pfi_match_addr(struct pfi_dynaddr *, struct pf_addr *, 1665 sa_family_t); 1666int pfi_dynaddr_setup(struct pf_addr_wrap *, sa_family_t); 1667void pfi_dynaddr_remove(struct pfi_dynaddr *); 1668void pfi_dynaddr_copyout(struct pf_addr_wrap *); 1669void pfi_update_status(const char *, struct pf_status *); 1670void pfi_get_ifaces(const char *, struct pfi_kif *, int *); 1671int pfi_set_flags(const char *, int); 1672int pfi_clear_flags(const char *, int); 1673 1674int pf_match_tag(struct mbuf *, struct pf_rule *, int *, int); 1675int pf_tag_packet(struct mbuf *, struct pf_pdesc *, int); 1676int pf_addr_cmp(struct pf_addr *, struct pf_addr *, 1677 sa_family_t); 1678void pf_qid2qname(u_int32_t, char *); 1679 1680VNET_DECLARE(struct pf_kstatus, pf_status); 1681#define V_pf_status VNET(pf_status) 1682 1683struct pf_limit { 1684 uma_zone_t zone; 1685 u_int limit; 1686}; 1687VNET_DECLARE(struct pf_limit, pf_limits[PF_LIMIT_MAX]); 1688#define V_pf_limits VNET(pf_limits) 1689 1690#endif /* _KERNEL */ 1691 1692#ifdef _KERNEL 1693VNET_DECLARE(struct pf_anchor_global, pf_anchors); 1694#define V_pf_anchors VNET(pf_anchors) 1695VNET_DECLARE(struct pf_anchor, pf_main_anchor); 1696#define V_pf_main_anchor VNET(pf_main_anchor) 1697#define pf_main_ruleset V_pf_main_anchor.ruleset 1698#endif 1699 1700/* these ruleset functions can be linked into userland programs (pfctl) */ 1701int pf_get_ruleset_number(u_int8_t); 1702void pf_init_ruleset(struct pf_ruleset *); 1703int pf_anchor_setup(struct pf_rule *, 1704 const struct pf_ruleset *, const char *); 1705int pf_anchor_copyout(const struct pf_ruleset *, 1706 const struct pf_rule *, struct pfioc_rule *); 1707void pf_anchor_remove(struct pf_rule *); 1708void pf_remove_if_empty_ruleset(struct pf_ruleset *); 1709struct pf_ruleset *pf_find_ruleset(const char *); 1710struct pf_ruleset *pf_find_or_create_ruleset(const char *); 1711void pf_rs_initialize(void); 1712 1713/* The fingerprint functions can be linked into userland programs (tcpdump) */ 1714int pf_osfp_add(struct pf_osfp_ioctl *); 1715#ifdef _KERNEL 1716struct pf_osfp_enlist * 1717 pf_osfp_fingerprint(struct pf_pdesc *, struct mbuf *, int, 1718 const struct tcphdr *); 1719#endif /* _KERNEL */ 1720void pf_osfp_flush(void); 1721int pf_osfp_get(struct pf_osfp_ioctl *); 1722int pf_osfp_match(struct pf_osfp_enlist *, pf_osfp_t); 1723 1724#ifdef _KERNEL 1725void pf_print_host(struct pf_addr *, u_int16_t, u_int8_t); 1726 1727void pf_step_into_anchor(struct pf_anchor_stackframe *, int *, 1728 struct pf_ruleset **, int, struct pf_rule **, 1729 struct pf_rule **, int *); 1730int pf_step_out_of_anchor(struct pf_anchor_stackframe *, int *, 1731 struct pf_ruleset **, int, struct pf_rule **, 1732 struct pf_rule **, int *); 1733 1734int pf_map_addr(u_int8_t, struct pf_rule *, 1735 struct pf_addr *, struct pf_addr *, 1736 struct pf_addr *, struct pf_src_node **); 1737struct pf_rule *pf_get_translation(struct pf_pdesc *, struct mbuf *, 1738 int, int, struct pfi_kif *, struct pf_src_node **, 1739 struct pf_state_key **, struct pf_state_key **, 1740 struct pf_addr *, struct pf_addr *, 1741 uint16_t, uint16_t, struct pf_anchor_stackframe *); 1742 1743struct pf_state_key *pf_state_key_setup(struct pf_pdesc *, struct pf_addr *, 1744 struct pf_addr *, u_int16_t, u_int16_t); 1745struct pf_state_key *pf_state_key_clone(struct pf_state_key *); 1746#endif /* _KERNEL */ 1747 1748#endif /* _NET_PFVAR_H_ */ 1749