dist/pf/sbin/pfctl/pfctl_parser.h

   1 /*      $NetBSD$        */
   2 /*      $OpenBSD: pfctl_parser.h,v 1.86 2006/10/31 23:46:25 mcbride Exp $ */
   3
   4 /*
   5  * Copyright (c) 2001 Daniel Hartmeier
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  *    - Redistributions of source code must retain the above copyright
  13  *      notice, this list of conditions and the following disclaimer.
  14  *    - Redistributions in binary form must reproduce the above
  15  *      copyright notice, this list of conditions and the following
  16  *      disclaimer in the documentation and/or other materials provided
  17  *      with the distribution.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  20  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  21  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  22  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  23  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  24  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  25  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  26  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  27  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  29  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  30  * POSSIBILITY OF SUCH DAMAGE.
  31  *
  32  */
  33
  34 #ifndef _PFCTL_PARSER_H_
  35 #define _PFCTL_PARSER_H_
  36
  37 #define PF_OSFP_FILE            "/etc/pf.os"
  38
  39 #define PF_OPT_DISABLE          0x0001
  40 #define PF_OPT_ENABLE           0x0002
  41 #define PF_OPT_VERBOSE          0x0004
  42 #define PF_OPT_NOACTION         0x0008
  43 #define PF_OPT_QUIET            0x0010
  44 #define PF_OPT_CLRRULECTRS      0x0020
  45 #define PF_OPT_USEDNS           0x0040
  46 #define PF_OPT_VERBOSE2         0x0080
  47 #define PF_OPT_DUMMYACTION      0x0100
  48 #define PF_OPT_DEBUG            0x0200
  49 #define PF_OPT_SHOWALL          0x0400
  50 #define PF_OPT_OPTIMIZE         0x0800
  51 #define PF_OPT_MERGE            0x2000
  52 #define PF_OPT_RECURSE          0x4000
  53
  54 #define PF_TH_ALL               0xFF
  55
  56 #define PF_NAT_PROXY_PORT_LOW   50001
  57 #define PF_NAT_PROXY_PORT_HIGH  65535
  58
  59 #define PF_OPTIMIZE_BASIC       0x0001
  60 #define PF_OPTIMIZE_PROFILE     0x0002
  61
  62 #define FCNT_NAMES { \
  63         "searches", \
  64         "inserts", \
  65         "removals", \
  66         NULL \
  67 }
  68
  69 struct pfr_buffer;      /* forward definition */
  70
  71
  72 struct pfctl {
  73         int dev;
  74         int opts;
  75         int optimize;
  76         int loadopt;
  77         int asd;                        /* anchor stack depth */
  78         int bn;                         /* brace number */
  79         int brace;
  80         int tdirty;                     /* kernel dirty */
  81 #define PFCTL_ANCHOR_STACK_DEPTH 64
  82         struct pf_anchor *astack[PFCTL_ANCHOR_STACK_DEPTH];
  83         struct pfioc_pooladdr paddr;
  84         struct pfioc_altq *paltq;
  85         struct pfioc_queue *pqueue;
  86         struct pfr_buffer *trans;
  87         struct pf_anchor *anchor, *alast;
  88         const char *ruleset;
  89
  90         /* 'set foo' options */
  91         u_int32_t        timeout[PFTM_MAX];
  92         u_int32_t        limit[PF_LIMIT_MAX];
  93         u_int32_t        debug;
  94         u_int32_t        hostid;
  95         char            *ifname;
  96
  97         u_int8_t         timeout_set[PFTM_MAX];
  98         u_int8_t         limit_set[PF_LIMIT_MAX];
  99         u_int8_t         debug_set;
 100         u_int8_t         hostid_set;
 101         u_int8_t         ifname_set;
 102 };
 103
 104 struct node_if {
 105         char                     ifname[IFNAMSIZ];
 106         u_int8_t                 not;
 107         u_int8_t                 dynamic; /* antispoof */
 108         u_int                    ifa_flags;
 109         struct node_if          *next;
 110         struct node_if          *tail;
 111 };
 112
 113 struct node_host {
 114         struct pf_addr_wrap      addr;
 115         struct pf_addr           bcast;
 116         struct pf_addr           peer;
 117         sa_family_t              af;
 118         u_int8_t                 not;
 119         u_int32_t                ifindex;       /* link-local IPv6 addrs */
 120         char                    *ifname;
 121         u_int                    ifa_flags;
 122         struct node_host        *next;
 123         struct node_host        *tail;
 124 };
 125
 126 struct node_os {
 127         char                    *os;
 128         pf_osfp_t                fingerprint;
 129         struct node_os          *next;
 130         struct node_os          *tail;
 131 };
 132
 133 struct node_queue_bw {
 134         u_int32_t       bw_absolute;
 135         u_int16_t       bw_percent;
 136 };
 137
 138 struct node_hfsc_sc {
 139         struct node_queue_bw    m1;     /* slope of 1st segment; bps */
 140         u_int                   d;      /* x-projection of m1; msec */
 141         struct node_queue_bw    m2;     /* slope of 2nd segment; bps */
 142         u_int8_t                used;
 143 };
 144
 145 struct node_hfsc_opts {
 146         struct node_hfsc_sc     realtime;
 147         struct node_hfsc_sc     linkshare;
 148         struct node_hfsc_sc     upperlimit;
 149         int                     flags;
 150 };
 151
 152 struct node_queue_opt {
 153         int                      qtype;
 154         union {
 155                 struct cbq_opts         cbq_opts;
 156                 struct priq_opts        priq_opts;
 157                 struct node_hfsc_opts   hfsc_opts;
 158         }                        data;
 159 };
 160
 161 SIMPLEQ_HEAD(node_tinithead, node_tinit);
 162 struct node_tinit {     /* table initializer */
 163         SIMPLEQ_ENTRY(node_tinit)        entries;
 164         struct node_host                *host;
 165         char                            *file;
 166 };
 167
 168
 169 /* optimizer created tables */
 170 struct pf_opt_tbl {
 171         char                     pt_name[PF_TABLE_NAME_SIZE];
 172         int                      pt_rulecount;
 173         int                      pt_generated;
 174         struct node_tinithead    pt_nodes;
 175         struct pfr_buffer       *pt_buf;
 176 };
 177 #define PF_OPT_TABLE_PREFIX     "__automatic_"
 178
 179 /* optimizer pf_rule container */
 180 struct pf_opt_rule {
 181         struct pf_rule           por_rule;
 182         struct pf_opt_tbl       *por_src_tbl;
 183         struct pf_opt_tbl       *por_dst_tbl;
 184         u_int64_t                por_profile_count;
 185         TAILQ_ENTRY(pf_opt_rule) por_entry;
 186         TAILQ_ENTRY(pf_opt_rule) por_skip_entry[PF_SKIP_COUNT];
 187 };
 188
 189 TAILQ_HEAD(pf_opt_queue, pf_opt_rule);
 190
 191 int     pfctl_rules(int, char *, FILE *, int, int, char *, struct pfr_buffer *);
 192 int     pfctl_optimize_ruleset(struct pfctl *, struct pf_ruleset *);
 193
 194 int     pfctl_add_rule(struct pfctl *, struct pf_rule *, const char *);
 195 int     pfctl_add_altq(struct pfctl *, struct pf_altq *);
 196 int     pfctl_add_pool(struct pfctl *, struct pf_pool *, sa_family_t);
 197 void    pfctl_move_pool(struct pf_pool *, struct pf_pool *);
 198 void    pfctl_clear_pool(struct pf_pool *);
 199
 200 int     pfctl_set_timeout(struct pfctl *, const char *, int, int);
 201 int     pfctl_set_optimization(struct pfctl *, const char *);
 202 int     pfctl_set_limit(struct pfctl *, const char *, unsigned int);
 203 int     pfctl_set_logif(struct pfctl *, char *);
 204 int     pfctl_set_hostid(struct pfctl *, u_int32_t);
 205 int     pfctl_set_debug(struct pfctl *, char *);
 206 int     pfctl_set_interface_flags(struct pfctl *, char *, int, int);
 207
 208 int     parse_rules(FILE *, struct pfctl *);
 209 int     parse_flags(char *);
 210 int     pfctl_load_anchors(int, struct pfctl *, struct pfr_buffer *);
 211
 212 void    print_pool(struct pf_pool *, u_int16_t, u_int16_t, sa_family_t, int);
 213 void    print_src_node(struct pf_src_node *, int);
 214 void    print_rule(struct pf_rule *, const char *, int);
 215 void    print_tabledef(const char *, int, int, struct node_tinithead *);
 216 void    print_status(struct pf_status *, int);
 217
 218 int     eval_pfaltq(struct pfctl *, struct pf_altq *, struct node_queue_bw *,
 219             struct node_queue_opt *);
 220 int     eval_pfqueue(struct pfctl *, struct pf_altq *, struct node_queue_bw *,
 221             struct node_queue_opt *);
 222
 223 void     print_altq(const struct pf_altq *, unsigned, struct node_queue_bw *,
 224             struct node_queue_opt *);
 225 void     print_queue(const struct pf_altq *, unsigned, struct node_queue_bw *,
 226             int, struct node_queue_opt *);
 227
 228 int     pfctl_define_table(char *, int, int, const char *, struct pfr_buffer *,
 229             u_int32_t);
 230
 231 void             pfctl_clear_fingerprints(int, int);
 232 int              pfctl_file_fingerprints(int, int, const char *);
 233 pf_osfp_t        pfctl_get_fingerprint(const char *);
 234 int              pfctl_load_fingerprints(int, int);
 235 char            *pfctl_lookup_fingerprint(pf_osfp_t, char *, size_t);
 236 void             pfctl_show_fingerprints(int);
 237
 238
 239 struct icmptypeent {
 240         const char *name;
 241         u_int8_t type;
 242 };
 243
 244 struct icmpcodeent {
 245         const char *name;
 246         u_int8_t type;
 247         u_int8_t code;
 248 };
 249
 250 const struct icmptypeent *geticmptypebynumber(u_int8_t, u_int8_t);
 251 const struct icmptypeent *geticmptypebyname(char *, u_int8_t);
 252 const struct icmpcodeent *geticmpcodebynumber(u_int8_t, u_int8_t, u_int8_t);
 253 const struct icmpcodeent *geticmpcodebyname(u_long, char *, u_int8_t);
 254
 255 struct pf_timeout {
 256         const char      *name;
 257         int              timeout;
 258 };
 259
 260 #define PFCTL_FLAG_FILTER       0x02
 261 #define PFCTL_FLAG_NAT          0x04
 262 #define PFCTL_FLAG_OPTION       0x08
 263 #define PFCTL_FLAG_ALTQ         0x10
 264 #define PFCTL_FLAG_TABLE        0x20
 265
 266 extern const struct pf_timeout pf_timeouts[];
 267
 268 void                     set_ipmask(struct node_host *, u_int8_t);
 269 int                      check_netmask(struct node_host *, sa_family_t);
 270 int                      unmask(struct pf_addr *, sa_family_t);
 271 void                     ifa_load(void);
 272 struct node_host        *ifa_exists(const char *);
 273 struct node_host        *ifa_lookup(const char *, int);
 274 struct node_host        *host(const char *);
 275
 276 int                      append_addr(struct pfr_buffer *, char *, int);
 277 int                      append_addr_host(struct pfr_buffer *,
 278                             struct node_host *, int, int);
 279
 280 #endif /* _PFCTL_PARSER_H_ */