sys/dist/pf/net/if_pfsync.h

   1 /*      $NetBSD: if_pfsync.h,v 1.3 2009/09/14 10:36:49 degroote Exp $   */
   2 /*      $OpenBSD: if_pfsync.h,v 1.31 2007/05/31 04:11:42 mcbride Exp $  */
   3
   4 /*
   5  * Copyright (c) 2001 Michael Shalayeff
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  18  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  19  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  20  * IN NO EVENT SHALL THE AUTHOR OR HIS RELATIVES BE LIABLE FOR ANY DIRECT,
  21  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  22  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  23  * SERVICES; LOSS OF MIND, USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  25  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
  26  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  27  * THE POSSIBILITY OF SUCH DAMAGE.
  28  */
  29
  30 #ifndef _NET_IF_PFSYNC_H_
  31 #define _NET_IF_PFSYNC_H_
  32
  33 #define  INADDR_PFSYNC_GROUP     __IPADDR(0xe00000f0)    /* 224.0.0.240 */
  34
  35 #define PFSYNC_ID_LEN   sizeof(u_int64_t)
  36
  37 struct pfsync_tdb {
  38         u_int32_t       spi;
  39         union sockaddr_union dst;
  40         u_int32_t       rpl;
  41         u_int64_t       cur_bytes;
  42         u_int8_t        sproto;
  43         u_int8_t        updates;
  44         u_int8_t        pad[2];
  45 } __packed;
  46
  47 struct pfsync_state_upd {
  48         u_int32_t               id[2];
  49         struct pfsync_state_peer        src;
  50         struct pfsync_state_peer        dst;
  51         u_int32_t               creatorid;
  52         u_int32_t               expire;
  53         u_int8_t                timeout;
  54         u_int8_t                updates;
  55         u_int8_t                pad[6];
  56 } __packed;
  57
  58 struct pfsync_state_del {
  59         u_int32_t               id[2];
  60         u_int32_t               creatorid;
  61         struct {
  62                 u_int8_t        state;
  63         } src;
  64         struct {
  65                 u_int8_t        state;
  66         } dst;
  67         u_int8_t                pad[2];
  68 } __packed;
  69
  70 struct pfsync_state_upd_req {
  71         u_int32_t               id[2];
  72         u_int32_t               creatorid;
  73         u_int32_t               pad;
  74 } __packed;
  75
  76 struct pfsync_state_clr {
  77         char                    ifname[IFNAMSIZ];
  78         u_int32_t               creatorid;
  79         u_int32_t               pad;
  80 } __packed;
  81
  82 struct pfsync_state_bus {
  83         u_int32_t               creatorid;
  84         u_int32_t               endtime;
  85         u_int8_t                status;
  86 #define PFSYNC_BUS_START        1
  87 #define PFSYNC_BUS_END          2
  88         u_int8_t                pad[7];
  89 } __packed;
  90
  91 #ifdef _KERNEL
  92
  93 union sc_statep {
  94         struct pfsync_state     *s;
  95         struct pfsync_state_upd *u;
  96         struct pfsync_state_del *d;
  97         struct pfsync_state_clr *c;
  98         struct pfsync_state_bus *b;
  99         struct pfsync_state_upd_req     *r;
 100 };
 101
 102 union sc_tdb_statep {
 103         struct pfsync_tdb       *t;
 104 };
 105
 106 extern int      pfsync_sync_ok;
 107
 108 struct pfsync_softc {
 109         struct ifnet             sc_if;
 110         struct ifnet            *sc_sync_ifp;
 111
 112         struct ip_moptions       sc_imo;
 113         struct callout           sc_tmo;
 114         struct callout           sc_tdb_tmo;
 115         struct callout           sc_bulk_tmo;
 116         struct callout           sc_bulkfail_tmo;
 117         struct in_addr           sc_sync_peer;
 118         struct in_addr           sc_sendaddr;
 119         struct mbuf             *sc_mbuf;       /* current cumulative mbuf */
 120         struct mbuf             *sc_mbuf_net;   /* current cumulative mbuf */
 121         struct mbuf             *sc_mbuf_tdb;   /* dito for TDB updates */
 122         union sc_statep          sc_statep;
 123         union sc_statep          sc_statep_net;
 124         union sc_tdb_statep      sc_statep_tdb;
 125         u_int32_t                sc_ureq_received;
 126         u_int32_t                sc_ureq_sent;
 127         struct pf_state         *sc_bulk_send_next;
 128         struct pf_state         *sc_bulk_terminator;
 129         int                      sc_bulk_tries;
 130         int                      sc_maxcount;   /* number of states in mtu */
 131         int                      sc_maxupdates; /* number of updates/state */
 132 };
 133
 134 extern struct pfsync_softc      *pfsyncif;
 135 #endif
 136
 137
 138 struct pfsync_header {
 139         u_int8_t version;
 140 #define PFSYNC_VERSION  3
 141         u_int8_t af;
 142         u_int8_t action;
 143 #define PFSYNC_ACT_CLR          0       /* clear all states */
 144 #define PFSYNC_ACT_INS          1       /* insert state */
 145 #define PFSYNC_ACT_UPD          2       /* update state */
 146 #define PFSYNC_ACT_DEL          3       /* delete state */
 147 #define PFSYNC_ACT_UPD_C        4       /* "compressed" state update */
 148 #define PFSYNC_ACT_DEL_C        5       /* "compressed" state delete */
 149 #define PFSYNC_ACT_INS_F        6       /* insert fragment */
 150 #define PFSYNC_ACT_DEL_F        7       /* delete fragments */
 151 #define PFSYNC_ACT_UREQ         8       /* request "uncompressed" state */
 152 #define PFSYNC_ACT_BUS          9       /* Bulk Update Status */
 153 #define PFSYNC_ACT_TDB_UPD      10      /* TDB replay counter update */
 154 #define PFSYNC_ACT_MAX          11
 155         u_int8_t count;
 156         u_int8_t pf_chksum[PF_MD5_DIGEST_LENGTH];
 157 } __packed;
 158
 159 #define PFSYNC_BULKPACKETS      1       /* # of packets per timeout */
 160 #define PFSYNC_MAX_BULKTRIES    12
 161 #define PFSYNC_HDRLEN   sizeof(struct pfsync_header)
 162 #define PFSYNC_ACTIONS \
 163         "CLR ST", "INS ST", "UPD ST", "DEL ST", \
 164         "UPD ST COMP", "DEL ST COMP", "INS FR", "DEL FR", \
 165         "UPD REQ", "BLK UPD STAT", "TDB UPD"
 166
 167 #define PFSYNC_DFLTTL           255
 168
 169 #define PFSYNC_STAT_IPACKETS    0       /* total input packets, IPv4 */
 170 #define PFSYNC_STAT_IPACKETS6   1       /* total input packets, IPv6 */
 171 #define PFSYNC_STAT_BADIF               2       /* not the right interface */
 172 #define PFSYNC_STAT_BADTTL              3       /* TTL is not PFSYNC_DFLTTL */
 173 #define PFSYNC_STAT_HDROPS              4       /* packets shorter than hdr */
 174 #define PFSYNC_STAT_BADVER              5       /* bad (incl unsupp) version */
 175 #define PFSYNC_STAT_BADACT              6       /* bad action */
 176 #define PFSYNC_STAT_BADLEN              7       /* data length does not match */
 177 #define PFSYNC_STAT_BADAUTH             8       /* bad authentication */
 178 #define PFSYNC_STAT_STALE               9       /* stale state */
 179 #define PFSYNC_STAT_BADVAL              10      /* bad values */
 180 #define PFSYNC_STAT_BADSTATE    11      /* insert/lookup failed */
 181 #define PFSYNC_STAT_OPACKETS    12      /* total output packets, IPv4 */
 182 #define PFSYNC_STAT_OPACKETS6   13      /* total output packets, IPv6 */
 183 #define PFSYNC_STAT_ONOMEM              14      /* no memory for an mbuf */
 184 #define PFSYNC_STAT_OERRORS             15      /* ip output error */
 185
 186 #define PFSYNC_NSTATS                   16
 187
 188 /*
 189  * Configuration structure for SIOCSETPFSYNC SIOCGETPFSYNC
 190  */
 191 struct pfsyncreq {
 192         char             pfsyncr_syncdev[IFNAMSIZ];
 193         struct in_addr   pfsyncr_syncpeer;
 194         int              pfsyncr_maxupdates;
 195         int              pfsyncr_authlevel;
 196 };
 197
 198
 199 /* for copies to/from network */
 200 #define pf_state_peer_hton(s,d) do {            \
 201         (d)->seqlo = htonl((s)->seqlo);         \
 202         (d)->seqhi = htonl((s)->seqhi);         \
 203         (d)->seqdiff = htonl((s)->seqdiff);     \
 204         (d)->max_win = htons((s)->max_win);     \
 205         (d)->mss = htons((s)->mss);             \
 206         (d)->state = (s)->state;                \
 207         (d)->wscale = (s)->wscale;              \
 208         if ((s)->scrub) {                                               \
 209                 (d)->scrub.pfss_flags =                                 \
 210                     htons((s)->scrub->pfss_flags & PFSS_TIMESTAMP);     \
 211                 (d)->scrub.pfss_ttl = (s)->scrub->pfss_ttl;             \
 212                 (d)->scrub.pfss_ts_mod = htonl((s)->scrub->pfss_ts_mod);\
 213                 (d)->scrub.scrub_flag = PFSYNC_SCRUB_FLAG_VALID;        \
 214         }                                                               \
 215 } while (0)
 216
 217 #define pf_state_peer_ntoh(s,d) do {            \
 218         (d)->seqlo = ntohl((s)->seqlo);         \
 219         (d)->seqhi = ntohl((s)->seqhi);         \
 220         (d)->seqdiff = ntohl((s)->seqdiff);     \
 221         (d)->max_win = ntohs((s)->max_win);     \
 222         (d)->mss = ntohs((s)->mss);             \
 223         (d)->state = (s)->state;                \
 224         (d)->wscale = (s)->wscale;              \
 225         if ((s)->scrub.scrub_flag == PFSYNC_SCRUB_FLAG_VALID &&         \
 226             (d)->scrub != NULL) {                                       \
 227                 (d)->scrub->pfss_flags =                                \
 228                     ntohs((s)->scrub.pfss_flags) & PFSS_TIMESTAMP;      \
 229                 (d)->scrub->pfss_ttl = (s)->scrub.pfss_ttl;             \
 230                 (d)->scrub->pfss_ts_mod = ntohl((s)->scrub.pfss_ts_mod);\
 231         }                                                               \
 232 } while (0)
 233
 234 #define pf_state_host_hton(s,d) do {                            \
 235         memcpy(&(d)->addr, &(s)->addr, sizeof((d)->addr));      \
 236         (d)->port = (s)->port;                                  \
 237 } while (0)
 238
 239 #define pf_state_host_ntoh(s,d) do {                            \
 240         memcpy(&(d)->addr, &(s)->addr, sizeof((d)->addr));      \
 241         (d)->port = (s)->port;                                  \
 242 } while (0)
 243
 244 #define pf_state_counter_hton(s,d) do {                         \
 245         d[0] = htonl((s>>32)&0xffffffff);                       \
 246         d[1] = htonl(s&0xffffffff);                             \
 247 } while (0)
 248
 249 #define pf_state_counter_ntoh(s,d) do {                         \
 250         d = ntohl(s[0]);                                        \
 251         d = d<<32;                                              \
 252         d += ntohl(s[1]);                                       \
 253 } while (0)
 254
 255 #ifdef _KERNEL
 256 void pfsync_input(struct mbuf *, ...);
 257 int pfsync_clear_states(u_int32_t, char *);
 258 int pfsync_pack_state(u_int8_t, struct pf_state *, int);
 259 #define pfsync_insert_state(st) do {                            \
 260         if ((st->rule.ptr->rule_flag & PFRULE_NOSYNC) ||        \
 261             (st->state_key->proto == IPPROTO_PFSYNC))                   \
 262                 st->sync_flags |= PFSTATE_NOSYNC;               \
 263         else if (!st->sync_flags)                               \
 264                 pfsync_pack_state(PFSYNC_ACT_INS, (st),         \
 265                     PFSYNC_FLAG_COMPRESS);                      \
 266         st->sync_flags &= ~PFSTATE_FROMSYNC;                    \
 267 } while (0)
 268 #define pfsync_update_state(st) do {                            \
 269         if (!st->sync_flags)                                    \
 270                 pfsync_pack_state(PFSYNC_ACT_UPD, (st),         \
 271                     PFSYNC_FLAG_COMPRESS);                      \
 272         st->sync_flags &= ~PFSTATE_FROMSYNC;                    \
 273 } while (0)
 274 #define pfsync_delete_state(st) do {                            \
 275         if (!st->sync_flags)                                    \
 276                 pfsync_pack_state(PFSYNC_ACT_DEL, (st),         \
 277                     PFSYNC_FLAG_COMPRESS);                      \
 278 } while (0)
 279 #ifdef NOTYET
 280 int pfsync_update_tdb(struct tdb *, int);
 281 #endif /* NOTYET */
 282 #endif
 283
 284 #endif /* _NET_IF_PFSYNC_H_ */