source: rtems-libbsd/freebsd/contrib/pf/pfctl/pfctl_parser.h @ 084d4db

4.11
Last change on this file since 084d4db was 084d4db, checked in by Christian Mauderer <Christian.Mauderer@…>, on 07/05/16 at 14:07:37

pfctl: Import sources from FreeBSD.
  • Property mode set to 100644
File size: 8.8 KB
Line 
1/*      $OpenBSD: pfctl_parser.h,v 1.86 2006/10/31 23:46:25 mcbride Exp $ */
2
3/*
4 * Copyright (c) 2001 Daniel Hartmeier
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 *
11 *    - Redistributions of source code must retain the above copyright
12 *      notice, this list of conditions and the following disclaimer.
13 *    - Redistributions in binary form must reproduce the above
14 *      copyright notice, this list of conditions and the following
15 *      disclaimer in the documentation and/or other materials provided
16 *      with the distribution.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
20 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
21 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
22 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
24 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
25 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
26 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
28 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29 * POSSIBILITY OF SUCH DAMAGE.
30 *
31 * $FreeBSD$
32 */
33
34#ifndef _PFCTL_PARSER_H_
35#define _PFCTL_PARSER_H_
36
37#define PF_OSFP_FILE            "/etc/pf.os"
38
39#define PF_OPT_DISABLE          0x0001
40#define PF_OPT_ENABLE           0x0002
41#define PF_OPT_VERBOSE          0x0004
42#define PF_OPT_NOACTION         0x0008
43#define PF_OPT_QUIET            0x0010
44#define PF_OPT_CLRRULECTRS      0x0020
45#define PF_OPT_USEDNS           0x0040
46#define PF_OPT_VERBOSE2         0x0080
47#define PF_OPT_DUMMYACTION      0x0100
48#define PF_OPT_DEBUG            0x0200
49#define PF_OPT_SHOWALL          0x0400
50#define PF_OPT_OPTIMIZE         0x0800
51#define PF_OPT_NUMERIC          0x1000
52#define PF_OPT_MERGE            0x2000
53#define PF_OPT_RECURSE          0x4000
54
55#define PF_TH_ALL               0xFF
56
57#define PF_NAT_PROXY_PORT_LOW   50001
58#define PF_NAT_PROXY_PORT_HIGH  65535
59
60#define PF_OPTIMIZE_BASIC       0x0001
61#define PF_OPTIMIZE_PROFILE     0x0002
62
63#define FCNT_NAMES { \
64        "searches", \
65        "inserts", \
66        "removals", \
67        NULL \
68}
69
70struct pfr_buffer;      /* forward definition */
71
72
73struct pfctl {
74        int dev;
75        int opts;
76        int optimize;
77        int loadopt;
78        int asd;                        /* anchor stack depth */
79        int bn;                         /* brace number */
80        int brace;
81        int tdirty;                     /* kernel dirty */
82#define PFCTL_ANCHOR_STACK_DEPTH 64
83        struct pf_anchor *astack[PFCTL_ANCHOR_STACK_DEPTH];
84        struct pfioc_pooladdr paddr;
85        struct pfioc_altq *paltq;
86        struct pfioc_queue *pqueue;
87        struct pfr_buffer *trans;
88        struct pf_anchor *anchor, *alast;
89        const char *ruleset;
90
91        /* 'set foo' options */
92        u_int32_t        timeout[PFTM_MAX];
93        u_int32_t        limit[PF_LIMIT_MAX];
94        u_int32_t        debug;
95        u_int32_t        hostid;
96        char            *ifname;
97
98        u_int8_t         timeout_set[PFTM_MAX];
99        u_int8_t         limit_set[PF_LIMIT_MAX];
100        u_int8_t         debug_set;
101        u_int8_t         hostid_set;
102        u_int8_t         ifname_set;
103};
104
105struct node_if {
106        char                     ifname[IFNAMSIZ];
107        u_int8_t                 not;
108        u_int8_t                 dynamic; /* antispoof */
109        u_int                    ifa_flags;
110        struct node_if          *next;
111        struct node_if          *tail;
112};
113
114struct node_host {
115        struct pf_addr_wrap      addr;
116        struct pf_addr           bcast;
117        struct pf_addr           peer;
118        sa_family_t              af;
119        u_int8_t                 not;
120        u_int32_t                ifindex;       /* link-local IPv6 addrs */
121        char                    *ifname;
122        u_int                    ifa_flags;
123        struct node_host        *next;
124        struct node_host        *tail;
125};
126
127struct node_os {
128        char                    *os;
129        pf_osfp_t                fingerprint;
130        struct node_os          *next;
131        struct node_os          *tail;
132};
133
134struct node_queue_bw {
135        u_int32_t       bw_absolute;
136        u_int16_t       bw_percent;
137};
138
139struct node_hfsc_sc {
140        struct node_queue_bw    m1;     /* slope of 1st segment; bps */
141        u_int                   d;      /* x-projection of m1; msec */
142        struct node_queue_bw    m2;     /* slope of 2nd segment; bps */
143        u_int8_t                used;
144};
145
146struct node_hfsc_opts {
147        struct node_hfsc_sc     realtime;
148        struct node_hfsc_sc     linkshare;
149        struct node_hfsc_sc     upperlimit;
150        int                     flags;
151};
152
153struct node_queue_opt {
154        int                      qtype;
155        union {
156                struct cbq_opts         cbq_opts;
157                struct priq_opts        priq_opts;
158                struct node_hfsc_opts   hfsc_opts;
159        }                        data;
160};
161
162#ifdef __FreeBSD__
163/*
164 * XXX
165 * Absolutely this is not correct location to define this.
166 * Should we use an another sperate header file?
167 */
168#define SIMPLEQ_HEAD                    STAILQ_HEAD
169#define SIMPLEQ_HEAD_INITIALIZER        STAILQ_HEAD_INITIALIZER
170#define SIMPLEQ_ENTRY                   STAILQ_ENTRY
171#define SIMPLEQ_FIRST                   STAILQ_FIRST
172#define SIMPLEQ_END(head)               NULL
173#define SIMPLEQ_EMPTY                   STAILQ_EMPTY
174#define SIMPLEQ_NEXT                    STAILQ_NEXT
175/*#define       SIMPLEQ_FOREACH                 STAILQ_FOREACH*/
176#define SIMPLEQ_FOREACH(var, head, field)               \
177    for((var) = SIMPLEQ_FIRST(head);                    \
178        (var) != SIMPLEQ_END(head);                     \
179        (var) = SIMPLEQ_NEXT(var, field))
180#define SIMPLEQ_INIT                    STAILQ_INIT
181#define SIMPLEQ_INSERT_HEAD             STAILQ_INSERT_HEAD
182#define SIMPLEQ_INSERT_TAIL             STAILQ_INSERT_TAIL
183#define SIMPLEQ_INSERT_AFTER            STAILQ_INSERT_AFTER
184#define SIMPLEQ_REMOVE_HEAD             STAILQ_REMOVE_HEAD
185#endif
186SIMPLEQ_HEAD(node_tinithead, node_tinit);
187struct node_tinit {     /* table initializer */
188        SIMPLEQ_ENTRY(node_tinit)        entries;
189        struct node_host                *host;
190        char                            *file;
191};
192
193
194/* optimizer created tables */
195struct pf_opt_tbl {
196        char                     pt_name[PF_TABLE_NAME_SIZE];
197        int                      pt_rulecount;
198        int                      pt_generated;
199        struct node_tinithead    pt_nodes;
200        struct pfr_buffer       *pt_buf;
201};
202#define PF_OPT_TABLE_PREFIX     "__automatic_"
203
204/* optimizer pf_rule container */
205struct pf_opt_rule {
206        struct pf_rule           por_rule;
207        struct pf_opt_tbl       *por_src_tbl;
208        struct pf_opt_tbl       *por_dst_tbl;
209        u_int64_t                por_profile_count;
210        TAILQ_ENTRY(pf_opt_rule) por_entry;
211        TAILQ_ENTRY(pf_opt_rule) por_skip_entry[PF_SKIP_COUNT];
212};
213
214TAILQ_HEAD(pf_opt_queue, pf_opt_rule);
215
216int     pfctl_rules(int, char *, int, int, char *, struct pfr_buffer *);
217int     pfctl_optimize_ruleset(struct pfctl *, struct pf_ruleset *);
218
219int     pfctl_add_rule(struct pfctl *, struct pf_rule *, const char *);
220int     pfctl_add_altq(struct pfctl *, struct pf_altq *);
221int     pfctl_add_pool(struct pfctl *, struct pf_pool *, sa_family_t);
222void    pfctl_move_pool(struct pf_pool *, struct pf_pool *);
223void    pfctl_clear_pool(struct pf_pool *);
224
225int     pfctl_set_timeout(struct pfctl *, const char *, int, int);
226int     pfctl_set_optimization(struct pfctl *, const char *);
227int     pfctl_set_limit(struct pfctl *, const char *, unsigned int);
228int     pfctl_set_logif(struct pfctl *, char *);
229int     pfctl_set_hostid(struct pfctl *, u_int32_t);
230int     pfctl_set_debug(struct pfctl *, char *);
231int     pfctl_set_interface_flags(struct pfctl *, char *, int, int);
232
233int     parse_config(char *, struct pfctl *);
234int     parse_flags(char *);
235int     pfctl_load_anchors(int, struct pfctl *, struct pfr_buffer *);
236
237void    print_pool(struct pf_pool *, u_int16_t, u_int16_t, sa_family_t, int);
238void    print_src_node(struct pf_src_node *, int);
239void    print_rule(struct pf_rule *, const char *, int, int);
240void    print_tabledef(const char *, int, int, struct node_tinithead *);
241void    print_status(struct pf_status *, int);
242
243int     eval_pfaltq(struct pfctl *, struct pf_altq *, struct node_queue_bw *,
244            struct node_queue_opt *);
245int     eval_pfqueue(struct pfctl *, struct pf_altq *, struct node_queue_bw *,
246            struct node_queue_opt *);
247
248void     print_altq(const struct pf_altq *, unsigned, struct node_queue_bw *,
249            struct node_queue_opt *);
250void     print_queue(const struct pf_altq *, unsigned, struct node_queue_bw *,
251            int, struct node_queue_opt *);
252
253int     pfctl_define_table(char *, int, int, const char *, struct pfr_buffer *,
254            u_int32_t);
255
256void             pfctl_clear_fingerprints(int, int);
257int              pfctl_file_fingerprints(int, int, const char *);
258pf_osfp_t        pfctl_get_fingerprint(const char *);
259int              pfctl_load_fingerprints(int, int);
260char            *pfctl_lookup_fingerprint(pf_osfp_t, char *, size_t);
261void             pfctl_show_fingerprints(int);
262
263
264struct icmptypeent {
265        const char *name;
266        u_int8_t type;
267};
268
269struct icmpcodeent {
270        const char *name;
271        u_int8_t type;
272        u_int8_t code;
273};
274
275const struct icmptypeent *geticmptypebynumber(u_int8_t, u_int8_t);
276const struct icmptypeent *geticmptypebyname(char *, u_int8_t);
277const struct icmpcodeent *geticmpcodebynumber(u_int8_t, u_int8_t, u_int8_t);
278const struct icmpcodeent *geticmpcodebyname(u_long, char *, u_int8_t);
279
280struct pf_timeout {
281        const char      *name;
282        int              timeout;
283};
284
285#define PFCTL_FLAG_FILTER       0x02
286#define PFCTL_FLAG_NAT          0x04
287#define PFCTL_FLAG_OPTION       0x08
288#define PFCTL_FLAG_ALTQ         0x10
289#define PFCTL_FLAG_TABLE        0x20
290
291extern const struct pf_timeout pf_timeouts[];
292
293void                     set_ipmask(struct node_host *, u_int8_t);
294int                      check_netmask(struct node_host *, sa_family_t);
295int                      unmask(struct pf_addr *, sa_family_t);
296void                     ifa_load(void);
297struct node_host        *ifa_exists(const char *);
298struct node_host        *ifa_lookup(const char *, int);
299struct node_host        *host(const char *);
300
301int                      append_addr(struct pfr_buffer *, char *, int);
302int                      append_addr_host(struct pfr_buffer *,
303                            struct node_host *, int, int);
304
305#endif /* _PFCTL_PARSER_H_ */
Note: See TracBrowser for help on using the repository browser.