1 /* $NetBSD: if_pfsync.h,v 1.3 2009/09/14 10:36:49 degroote Exp $ */
2 /* $OpenBSD: if_pfsync.h,v 1.31 2007/05/31 04:11:42 mcbride Exp $ */
5 * Copyright (c) 2001 Michael Shalayeff
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20 * IN NO EVENT SHALL THE AUTHOR OR HIS RELATIVES BE LIABLE FOR ANY DIRECT,
21 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
22 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
23 * SERVICES; LOSS OF MIND, USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
25 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
26 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
27 * THE POSSIBILITY OF SUCH DAMAGE.
30 #ifndef _NET_IF_PFSYNC_H_
31 #define _NET_IF_PFSYNC_H_
33 #define INADDR_PFSYNC_GROUP __IPADDR(0xe00000f0) /* 224.0.0.240 */
35 #define PFSYNC_ID_LEN sizeof(u_int64_t)
39 union sockaddr_union dst
;
47 struct pfsync_state_upd
{
49 struct pfsync_state_peer src
;
50 struct pfsync_state_peer dst
;
58 struct pfsync_state_del
{
70 struct pfsync_state_upd_req
{
76 struct pfsync_state_clr
{
77 char ifname
[IFNAMSIZ
];
82 struct pfsync_state_bus
{
86 #define PFSYNC_BUS_START 1
87 #define PFSYNC_BUS_END 2
94 struct pfsync_state
*s
;
95 struct pfsync_state_upd
*u
;
96 struct pfsync_state_del
*d
;
97 struct pfsync_state_clr
*c
;
98 struct pfsync_state_bus
*b
;
99 struct pfsync_state_upd_req
*r
;
102 union sc_tdb_statep
{
103 struct pfsync_tdb
*t
;
106 extern int pfsync_sync_ok
;
108 struct pfsync_softc
{
110 struct ifnet
*sc_sync_ifp
;
112 struct ip_moptions sc_imo
;
113 struct callout sc_tmo
;
114 struct callout sc_tdb_tmo
;
115 struct callout sc_bulk_tmo
;
116 struct callout sc_bulkfail_tmo
;
117 struct in_addr sc_sync_peer
;
118 struct in_addr sc_sendaddr
;
119 struct mbuf
*sc_mbuf
; /* current cumulative mbuf */
120 struct mbuf
*sc_mbuf_net
; /* current cumulative mbuf */
121 struct mbuf
*sc_mbuf_tdb
; /* dito for TDB updates */
122 union sc_statep sc_statep
;
123 union sc_statep sc_statep_net
;
124 union sc_tdb_statep sc_statep_tdb
;
125 u_int32_t sc_ureq_received
;
126 u_int32_t sc_ureq_sent
;
127 struct pf_state
*sc_bulk_send_next
;
128 struct pf_state
*sc_bulk_terminator
;
130 int sc_maxcount
; /* number of states in mtu */
131 int sc_maxupdates
; /* number of updates/state */
134 extern struct pfsync_softc
*pfsyncif
;
138 struct pfsync_header
{
140 #define PFSYNC_VERSION 3
143 #define PFSYNC_ACT_CLR 0 /* clear all states */
144 #define PFSYNC_ACT_INS 1 /* insert state */
145 #define PFSYNC_ACT_UPD 2 /* update state */
146 #define PFSYNC_ACT_DEL 3 /* delete state */
147 #define PFSYNC_ACT_UPD_C 4 /* "compressed" state update */
148 #define PFSYNC_ACT_DEL_C 5 /* "compressed" state delete */
149 #define PFSYNC_ACT_INS_F 6 /* insert fragment */
150 #define PFSYNC_ACT_DEL_F 7 /* delete fragments */
151 #define PFSYNC_ACT_UREQ 8 /* request "uncompressed" state */
152 #define PFSYNC_ACT_BUS 9 /* Bulk Update Status */
153 #define PFSYNC_ACT_TDB_UPD 10 /* TDB replay counter update */
154 #define PFSYNC_ACT_MAX 11
156 u_int8_t pf_chksum
[PF_MD5_DIGEST_LENGTH
];
159 #define PFSYNC_BULKPACKETS 1 /* # of packets per timeout */
160 #define PFSYNC_MAX_BULKTRIES 12
161 #define PFSYNC_HDRLEN sizeof(struct pfsync_header)
162 #define PFSYNC_ACTIONS \
163 "CLR ST", "INS ST", "UPD ST", "DEL ST", \
164 "UPD ST COMP", "DEL ST COMP", "INS FR", "DEL FR", \
165 "UPD REQ", "BLK UPD STAT", "TDB UPD"
167 #define PFSYNC_DFLTTL 255
169 #define PFSYNC_STAT_IPACKETS 0 /* total input packets, IPv4 */
170 #define PFSYNC_STAT_IPACKETS6 1 /* total input packets, IPv6 */
171 #define PFSYNC_STAT_BADIF 2 /* not the right interface */
172 #define PFSYNC_STAT_BADTTL 3 /* TTL is not PFSYNC_DFLTTL */
173 #define PFSYNC_STAT_HDROPS 4 /* packets shorter than hdr */
174 #define PFSYNC_STAT_BADVER 5 /* bad (incl unsupp) version */
175 #define PFSYNC_STAT_BADACT 6 /* bad action */
176 #define PFSYNC_STAT_BADLEN 7 /* data length does not match */
177 #define PFSYNC_STAT_BADAUTH 8 /* bad authentication */
178 #define PFSYNC_STAT_STALE 9 /* stale state */
179 #define PFSYNC_STAT_BADVAL 10 /* bad values */
180 #define PFSYNC_STAT_BADSTATE 11 /* insert/lookup failed */
181 #define PFSYNC_STAT_OPACKETS 12 /* total output packets, IPv4 */
182 #define PFSYNC_STAT_OPACKETS6 13 /* total output packets, IPv6 */
183 #define PFSYNC_STAT_ONOMEM 14 /* no memory for an mbuf */
184 #define PFSYNC_STAT_OERRORS 15 /* ip output error */
186 #define PFSYNC_NSTATS 16
189 * Configuration structure for SIOCSETPFSYNC SIOCGETPFSYNC
192 char pfsyncr_syncdev
[IFNAMSIZ
];
193 struct in_addr pfsyncr_syncpeer
;
194 int pfsyncr_maxupdates
;
195 int pfsyncr_authlevel
;
199 /* for copies to/from network */
200 #define pf_state_peer_hton(s,d) do { \
201 (d)->seqlo = htonl((s)->seqlo); \
202 (d)->seqhi = htonl((s)->seqhi); \
203 (d)->seqdiff = htonl((s)->seqdiff); \
204 (d)->max_win = htons((s)->max_win); \
205 (d)->mss = htons((s)->mss); \
206 (d)->state = (s)->state; \
207 (d)->wscale = (s)->wscale; \
209 (d)->scrub.pfss_flags = \
210 htons((s)->scrub->pfss_flags & PFSS_TIMESTAMP); \
211 (d)->scrub.pfss_ttl = (s)->scrub->pfss_ttl; \
212 (d)->scrub.pfss_ts_mod = htonl((s)->scrub->pfss_ts_mod);\
213 (d)->scrub.scrub_flag = PFSYNC_SCRUB_FLAG_VALID; \
217 #define pf_state_peer_ntoh(s,d) do { \
218 (d)->seqlo = ntohl((s)->seqlo); \
219 (d)->seqhi = ntohl((s)->seqhi); \
220 (d)->seqdiff = ntohl((s)->seqdiff); \
221 (d)->max_win = ntohs((s)->max_win); \
222 (d)->mss = ntohs((s)->mss); \
223 (d)->state = (s)->state; \
224 (d)->wscale = (s)->wscale; \
225 if ((s)->scrub.scrub_flag == PFSYNC_SCRUB_FLAG_VALID && \
226 (d)->scrub != NULL) { \
227 (d)->scrub->pfss_flags = \
228 ntohs((s)->scrub.pfss_flags) & PFSS_TIMESTAMP; \
229 (d)->scrub->pfss_ttl = (s)->scrub.pfss_ttl; \
230 (d)->scrub->pfss_ts_mod = ntohl((s)->scrub.pfss_ts_mod);\
234 #define pf_state_host_hton(s,d) do { \
235 memcpy(&(d)->addr, &(s)->addr, sizeof((d)->addr)); \
236 (d)->port = (s)->port; \
239 #define pf_state_host_ntoh(s,d) do { \
240 memcpy(&(d)->addr, &(s)->addr, sizeof((d)->addr)); \
241 (d)->port = (s)->port; \
244 #define pf_state_counter_hton(s,d) do { \
245 d[0] = htonl((s>>32)&0xffffffff); \
246 d[1] = htonl(s&0xffffffff); \
249 #define pf_state_counter_ntoh(s,d) do { \
256 void pfsync_input(struct mbuf
*, ...);
257 int pfsync_clear_states(u_int32_t
, char *);
258 int pfsync_pack_state(u_int8_t
, struct pf_state
*, int);
259 #define pfsync_insert_state(st) do { \
260 if ((st->rule.ptr->rule_flag & PFRULE_NOSYNC) || \
261 (st->state_key->proto == IPPROTO_PFSYNC)) \
262 st->sync_flags |= PFSTATE_NOSYNC; \
263 else if (!st->sync_flags) \
264 pfsync_pack_state(PFSYNC_ACT_INS, (st), \
265 PFSYNC_FLAG_COMPRESS); \
266 st->sync_flags &= ~PFSTATE_FROMSYNC; \
268 #define pfsync_update_state(st) do { \
269 if (!st->sync_flags) \
270 pfsync_pack_state(PFSYNC_ACT_UPD, (st), \
271 PFSYNC_FLAG_COMPRESS); \
272 st->sync_flags &= ~PFSTATE_FROMSYNC; \
274 #define pfsync_delete_state(st) do { \
275 if (!st->sync_flags) \
276 pfsync_pack_state(PFSYNC_ACT_DEL, (st), \
277 PFSYNC_FLAG_COMPRESS); \
280 int pfsync_update_tdb(struct tdb
*, int);
284 #endif /* _NET_IF_PFSYNC_H_ */