xref: /netbsd-src/sys/dist/pf/net/pfvar.h (revision f9967d10c997b30f59931b55be2ff010c84270ef)
1 /*	$NetBSD: pfvar.h,v 1.9 2005/07/01 12:37:35 peter Exp $	*/
2 /*	$OpenBSD: pfvar.h,v 1.213 2005/03/03 07:13:39 dhartmei Exp $ */
3 
4 /*
5  * Copyright (c) 2001 Daniel Hartmeier
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  *    - Redistributions of source code must retain the above copyright
13  *      notice, this list of conditions and the following disclaimer.
14  *    - Redistributions in binary form must reproduce the above
15  *      copyright notice, this list of conditions and the following
16  *      disclaimer in the documentation and/or other materials provided
17  *      with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
22  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
23  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
24  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
25  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
27  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
29  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30  * POSSIBILITY OF SUCH DAMAGE.
31  *
32  */
33 
34 #ifndef _NET_PFVAR_H_
35 #define _NET_PFVAR_H_
36 
37 #include <sys/param.h>
38 #include <sys/types.h>
39 #include <sys/queue.h>
40 #include <sys/tree.h>
41 
42 #include <net/radix.h>
43 #ifdef __OpenBSD__
44 #include <net/route.h>
45 #include <netinet/ip_ipsp.h>
46 #endif
47 #include <netinet/tcp_fsm.h>
48 
49 #ifdef __NetBSD__
50 union sockaddr_union {
51 	struct sockaddr         sa;
52 	struct sockaddr_in      sin;
53 	struct sockaddr_in6     sin6;
54 };
55 #endif
56 
57 struct ip;
58 
59 #define	PF_TCPS_PROXY_SRC	((TCP_NSTATES)+0)
60 #define	PF_TCPS_PROXY_DST	((TCP_NSTATES)+1)
61 
62 enum	{ PF_INOUT, PF_IN, PF_OUT };
63 enum	{ PF_LAN_EXT, PF_EXT_GWY, PF_ID };
64 enum	{ PF_PASS, PF_DROP, PF_SCRUB, PF_NOSCRUB, PF_NAT, PF_NONAT,
65 	  PF_BINAT, PF_NOBINAT, PF_RDR, PF_NORDR, PF_SYNPROXY_DROP };
66 enum	{ PF_RULESET_SCRUB, PF_RULESET_FILTER, PF_RULESET_NAT,
67 	  PF_RULESET_BINAT, PF_RULESET_RDR, PF_RULESET_MAX };
68 enum	{ PF_OP_NONE, PF_OP_IRG, PF_OP_EQ, PF_OP_NE, PF_OP_LT,
69 	  PF_OP_LE, PF_OP_GT, PF_OP_GE, PF_OP_XRG, PF_OP_RRG };
70 enum	{ PF_DEBUG_NONE, PF_DEBUG_URGENT, PF_DEBUG_MISC, PF_DEBUG_NOISY };
71 enum	{ PF_CHANGE_NONE, PF_CHANGE_ADD_HEAD, PF_CHANGE_ADD_TAIL,
72 	  PF_CHANGE_ADD_BEFORE, PF_CHANGE_ADD_AFTER,
73 	  PF_CHANGE_REMOVE, PF_CHANGE_GET_TICKET };
74 /*
75  * Note about PFTM_*: real indices into pf_rule.timeout[] come before
76  * PFTM_MAX, special cases afterwards. See pf_state_expires().
77  */
78 enum	{ PFTM_TCP_FIRST_PACKET, PFTM_TCP_OPENING, PFTM_TCP_ESTABLISHED,
79 	  PFTM_TCP_CLOSING, PFTM_TCP_FIN_WAIT, PFTM_TCP_CLOSED,
80 	  PFTM_UDP_FIRST_PACKET, PFTM_UDP_SINGLE, PFTM_UDP_MULTIPLE,
81 	  PFTM_ICMP_FIRST_PACKET, PFTM_ICMP_ERROR_REPLY,
82 	  PFTM_OTHER_FIRST_PACKET, PFTM_OTHER_SINGLE,
83 	  PFTM_OTHER_MULTIPLE, PFTM_FRAG, PFTM_INTERVAL,
84 	  PFTM_ADAPTIVE_START, PFTM_ADAPTIVE_END, PFTM_SRC_NODE,
85 	  PFTM_TS_DIFF, PFTM_MAX, PFTM_PURGE, PFTM_UNTIL_PACKET };
86 
87 /* PFTM default values */
88 #define PFTM_TCP_FIRST_PACKET_VAL	120	/* First TCP packet */
89 #define PFTM_TCP_OPENING_VAL		30	/* No response yet */
90 #define PFTM_TCP_ESTABLISHED_VAL	24*60*60/* Established */
91 #define PFTM_TCP_CLOSING_VAL		15 * 60	/* Half closed */
92 #define PFTM_TCP_FIN_WAIT_VAL		45	/* Got both FINs */
93 #define PFTM_TCP_CLOSED_VAL		90	/* Got a RST */
94 #define PFTM_UDP_FIRST_PACKET_VAL	60	/* First UDP packet */
95 #define PFTM_UDP_SINGLE_VAL		30	/* Unidirectional */
96 #define PFTM_UDP_MULTIPLE_VAL		60	/* Bidirectional */
97 #define PFTM_ICMP_FIRST_PACKET_VAL	20	/* First ICMP packet */
98 #define PFTM_ICMP_ERROR_REPLY_VAL	10	/* Got error response */
99 #define PFTM_OTHER_FIRST_PACKET_VAL	60	/* First packet */
100 #define PFTM_OTHER_SINGLE_VAL		30	/* Unidirectional */
101 #define PFTM_OTHER_MULTIPLE_VAL		60	/* Bidirectional */
102 #define PFTM_FRAG_VAL			30	/* Fragment expire */
103 #define PFTM_INTERVAL_VAL		10	/* Expire interval */
104 #define PFTM_SRC_NODE_VAL		0	/* Source tracking */
105 #define PFTM_TS_DIFF_VAL		30	/* Allowed TS diff */
106 
107 enum	{ PF_NOPFROUTE, PF_FASTROUTE, PF_ROUTETO, PF_DUPTO, PF_REPLYTO };
108 enum	{ PF_LIMIT_STATES, PF_LIMIT_SRC_NODES, PF_LIMIT_FRAGS, PF_LIMIT_MAX };
109 #define PF_POOL_IDMASK		0x0f
110 enum	{ PF_POOL_NONE, PF_POOL_BITMASK, PF_POOL_RANDOM,
111 	  PF_POOL_SRCHASH, PF_POOL_ROUNDROBIN };
112 enum	{ PF_ADDR_ADDRMASK, PF_ADDR_NOROUTE, PF_ADDR_DYNIFTL,
113 	  PF_ADDR_TABLE, PF_ADDR_RTLABEL };
114 #define PF_POOL_TYPEMASK	0x0f
115 #define PF_POOL_STICKYADDR	0x20
116 #define	PF_WSCALE_FLAG		0x80
117 #define	PF_WSCALE_MASK		0x0f
118 
119 struct pf_addr {
120 	union {
121 		struct in_addr		v4;
122 		struct in6_addr		v6;
123 		u_int8_t		addr8[16];
124 		u_int16_t		addr16[8];
125 		u_int32_t		addr32[4];
126 	} pfa;		    /* 128-bit address */
127 #define v4	pfa.v4
128 #define v6	pfa.v6
129 #define addr8	pfa.addr8
130 #define addr16	pfa.addr16
131 #define addr32	pfa.addr32
132 };
133 
134 #define	PF_TABLE_NAME_SIZE	 32
135 
136 #define PFI_AFLAG_NETWORK	0x01
137 #define PFI_AFLAG_BROADCAST	0x02
138 #define PFI_AFLAG_PEER		0x04
139 #define PFI_AFLAG_MODEMASK	0x07
140 #define PFI_AFLAG_NOALIAS	0x08
141 
142 #ifndef RTLABEL_LEN
143 #define RTLABEL_LEN	32
144 #endif
145 
146 struct pf_addr_wrap {
147 	union {
148 		struct {
149 			struct pf_addr		 addr;
150 			struct pf_addr		 mask;
151 		}			 a;
152 		char			 ifname[IFNAMSIZ];
153 		char			 tblname[PF_TABLE_NAME_SIZE];
154 		char			 rtlabelname[RTLABEL_LEN];
155 		u_int32_t		 rtlabel;
156 	}			 v;
157 	union {
158 		struct pfi_dynaddr	*dyn;
159 		struct pfr_ktable	*tbl;
160 		int			 dyncnt;
161 		int			 tblcnt;
162 	}			 p;
163 	u_int8_t		 type;		/* PF_ADDR_* */
164 	u_int8_t		 iflags;	/* PFI_AFLAG_* */
165 };
166 
167 #ifdef __NetBSD__
168 struct hook_desc {
169 	TAILQ_ENTRY(hook_desc) hd_list;
170 	void	(*hd_fn)(void *);
171 	void	*hd_arg;
172 };
173 TAILQ_HEAD(hook_desc_head, hook_desc);
174 #endif
175 
176 #ifdef _KERNEL
177 
178 struct pfi_dynaddr {
179 	struct pf_addr		 pfid_addr4;
180 	struct pf_addr		 pfid_mask4;
181 	struct pf_addr		 pfid_addr6;
182 	struct pf_addr		 pfid_mask6;
183 	struct pfr_ktable	*pfid_kt;
184 	struct pfi_kif		*pfid_kif;
185 	void			*pfid_hook_cookie;
186 	int			 pfid_net;	/* optional mask, or 128 */
187 	int			 pfid_acnt4;	/* address count, IPv4 */
188 	int			 pfid_acnt6;	/* address count, IPv6 */
189 	sa_family_t		 pfid_af;	/* rule address family */
190 	u_int8_t		 pfid_iflags;	/* PFI_AFLAG_* */
191 };
192 
193 /*
194  * Address manipulation macros
195  */
196 
197 #ifdef INET
198 #ifndef INET6
199 #define PF_INET_ONLY
200 #endif /* ! INET6 */
201 #endif /* INET */
202 
203 #ifdef INET6
204 #ifndef INET
205 #define PF_INET6_ONLY
206 #endif /* ! INET */
207 #endif /* INET6 */
208 
209 #ifdef INET
210 #ifdef INET6
211 #define PF_INET_INET6
212 #endif /* INET6 */
213 #endif /* INET */
214 
215 #else
216 
217 #define PF_INET_INET6
218 
219 #endif /* _KERNEL */
220 
221 /* Both IPv4 and IPv6 */
222 #ifdef PF_INET_INET6
223 
224 #define PF_AEQ(a, b, c) \
225 	((c == AF_INET && (a)->addr32[0] == (b)->addr32[0]) || \
226 	((a)->addr32[3] == (b)->addr32[3] && \
227 	(a)->addr32[2] == (b)->addr32[2] && \
228 	(a)->addr32[1] == (b)->addr32[1] && \
229 	(a)->addr32[0] == (b)->addr32[0])) \
230 
231 #define PF_ANEQ(a, b, c) \
232 	((c == AF_INET && (a)->addr32[0] != (b)->addr32[0]) || \
233 	((a)->addr32[3] != (b)->addr32[3] || \
234 	(a)->addr32[2] != (b)->addr32[2] || \
235 	(a)->addr32[1] != (b)->addr32[1] || \
236 	(a)->addr32[0] != (b)->addr32[0])) \
237 
238 #define PF_AZERO(a, c) \
239 	((c == AF_INET && !(a)->addr32[0]) || \
240 	(!(a)->addr32[0] && !(a)->addr32[1] && \
241 	!(a)->addr32[2] && !(a)->addr32[3] )) \
242 
243 #define PF_MATCHA(n, a, m, b, f) \
244 	pf_match_addr(n, a, m, b, f)
245 
246 #define PF_ACPY(a, b, f) \
247 	pf_addrcpy(a, b, f)
248 
249 #define PF_AINC(a, f) \
250 	pf_addr_inc(a, f)
251 
252 #define PF_POOLMASK(a, b, c, d, f) \
253 	pf_poolmask(a, b, c, d, f)
254 
255 #else
256 
257 /* Just IPv6 */
258 
259 #ifdef PF_INET6_ONLY
260 
261 #define PF_AEQ(a, b, c) \
262 	((a)->addr32[3] == (b)->addr32[3] && \
263 	(a)->addr32[2] == (b)->addr32[2] && \
264 	(a)->addr32[1] == (b)->addr32[1] && \
265 	(a)->addr32[0] == (b)->addr32[0]) \
266 
267 #define PF_ANEQ(a, b, c) \
268 	((a)->addr32[3] != (b)->addr32[3] || \
269 	(a)->addr32[2] != (b)->addr32[2] || \
270 	(a)->addr32[1] != (b)->addr32[1] || \
271 	(a)->addr32[0] != (b)->addr32[0]) \
272 
273 #define PF_AZERO(a, c) \
274 	(!(a)->addr32[0] && \
275 	!(a)->addr32[1] && \
276 	!(a)->addr32[2] && \
277 	!(a)->addr32[3] ) \
278 
279 #define PF_MATCHA(n, a, m, b, f) \
280 	pf_match_addr(n, a, m, b, f)
281 
282 #define PF_ACPY(a, b, f) \
283 	pf_addrcpy(a, b, f)
284 
285 #define PF_AINC(a, f) \
286 	pf_addr_inc(a, f)
287 
288 #define PF_POOLMASK(a, b, c, d, f) \
289 	pf_poolmask(a, b, c, d, f)
290 
291 #else
292 
293 /* Just IPv4 */
294 #ifdef PF_INET_ONLY
295 
296 #define PF_AEQ(a, b, c) \
297 	((a)->addr32[0] == (b)->addr32[0])
298 
299 #define PF_ANEQ(a, b, c) \
300 	((a)->addr32[0] != (b)->addr32[0])
301 
302 #define PF_AZERO(a, c) \
303 	(!(a)->addr32[0])
304 
305 #define PF_MATCHA(n, a, m, b, f) \
306 	pf_match_addr(n, a, m, b, f)
307 
308 #define PF_ACPY(a, b, f) \
309 	(a)->v4.s_addr = (b)->v4.s_addr
310 
311 #define PF_AINC(a, f) \
312 	do { \
313 		(a)->addr32[0] = htonl(ntohl((a)->addr32[0]) + 1); \
314 	} while (0)
315 
316 #define PF_POOLMASK(a, b, c, d, f) \
317 	do { \
318 		(a)->addr32[0] = ((b)->addr32[0] & (c)->addr32[0]) | \
319 		(((c)->addr32[0] ^ 0xffffffff ) & (d)->addr32[0]); \
320 	} while (0)
321 
322 #endif /* PF_INET_ONLY */
323 #endif /* PF_INET6_ONLY */
324 #endif /* PF_INET_INET6 */
325 
326 #define	PF_MISMATCHAW(aw, x, af, neg)				\
327 	(							\
328 		(((aw)->type == PF_ADDR_NOROUTE &&		\
329 		    pf_routable((x), (af))) ||			\
330 		((aw)->type == PF_ADDR_RTLABEL &&		\
331 		    !pf_rtlabel_match((x), (af), (aw))) ||	\
332 		((aw)->type == PF_ADDR_TABLE &&			\
333 		    !pfr_match_addr((aw)->p.tbl, (x), (af))) ||	\
334 		((aw)->type == PF_ADDR_DYNIFTL &&		\
335 		    !pfi_match_addr((aw)->p.dyn, (x), (af))) || \
336 		((aw)->type == PF_ADDR_ADDRMASK &&		\
337 		    !PF_AZERO(&(aw)->v.a.mask, (af)) &&		\
338 		    !PF_MATCHA(0, &(aw)->v.a.addr,		\
339 		    &(aw)->v.a.mask, (x), (af)))) !=		\
340 		(neg)						\
341 	)
342 
343 struct pf_rule_uid {
344 	uid_t		 uid[2];
345 	u_int8_t	 op;
346 };
347 
348 struct pf_rule_gid {
349 	uid_t		 gid[2];
350 	u_int8_t	 op;
351 };
352 
353 struct pf_rule_addr {
354 	struct pf_addr_wrap	 addr;
355 	u_int16_t		 port[2];
356 	u_int8_t		 neg;
357 	u_int8_t		 port_op;
358 };
359 
360 struct pf_pooladdr {
361 	struct pf_addr_wrap		 addr;
362 	TAILQ_ENTRY(pf_pooladdr)	 entries;
363 	char				 ifname[IFNAMSIZ];
364 	struct pfi_kif			*kif;
365 };
366 
367 TAILQ_HEAD(pf_palist, pf_pooladdr);
368 
369 struct pf_poolhashkey {
370 	union {
371 		u_int8_t		key8[16];
372 		u_int16_t		key16[8];
373 		u_int32_t		key32[4];
374 	} pfk;		    /* 128-bit hash key */
375 #define key8	pfk.key8
376 #define key16	pfk.key16
377 #define key32	pfk.key32
378 };
379 
380 struct pf_pool {
381 	struct pf_palist	 list;
382 	struct pf_pooladdr	*cur;
383 	struct pf_poolhashkey	 key;
384 	struct pf_addr		 counter;
385 	int			 tblidx;
386 	u_int16_t		 proxy_port[2];
387 	u_int8_t		 port_op;
388 	u_int8_t		 opts;
389 };
390 
391 
392 /* A packed Operating System description for fingerprinting */
393 typedef u_int32_t pf_osfp_t;
394 #define PF_OSFP_ANY	((pf_osfp_t)0)
395 #define PF_OSFP_UNKNOWN	((pf_osfp_t)-1)
396 #define PF_OSFP_NOMATCH	((pf_osfp_t)-2)
397 
398 struct pf_osfp_entry {
399 	SLIST_ENTRY(pf_osfp_entry) fp_entry;
400 	pf_osfp_t		fp_os;
401 	int			fp_enflags;
402 #define PF_OSFP_EXPANDED	0x001		/* expanded entry */
403 #define PF_OSFP_GENERIC		0x002		/* generic signature */
404 #define PF_OSFP_NODETAIL	0x004		/* no p0f details */
405 #define PF_OSFP_LEN	32
406 	char			fp_class_nm[PF_OSFP_LEN];
407 	char			fp_version_nm[PF_OSFP_LEN];
408 	char			fp_subtype_nm[PF_OSFP_LEN];
409 };
410 #define PF_OSFP_ENTRY_EQ(a, b) \
411     ((a)->fp_os == (b)->fp_os && \
412     memcmp((a)->fp_class_nm, (b)->fp_class_nm, PF_OSFP_LEN) == 0 && \
413     memcmp((a)->fp_version_nm, (b)->fp_version_nm, PF_OSFP_LEN) == 0 && \
414     memcmp((a)->fp_subtype_nm, (b)->fp_subtype_nm, PF_OSFP_LEN) == 0)
415 
416 /* handle pf_osfp_t packing */
417 #define _FP_RESERVED_BIT	1  /* For the special negative #defines */
418 #define _FP_UNUSED_BITS		1
419 #define _FP_CLASS_BITS		10 /* OS Class (Windows, Linux) */
420 #define _FP_VERSION_BITS	10 /* OS version (95, 98, NT, 2.4.54, 3.2) */
421 #define _FP_SUBTYPE_BITS	10 /* patch level (NT SP4, SP3, ECN patch) */
422 #define PF_OSFP_UNPACK(osfp, class, version, subtype) do { \
423 	(class) = ((osfp) >> (_FP_VERSION_BITS+_FP_SUBTYPE_BITS)) & \
424 	    ((1 << _FP_CLASS_BITS) - 1); \
425 	(version) = ((osfp) >> _FP_SUBTYPE_BITS) & \
426 	    ((1 << _FP_VERSION_BITS) - 1);\
427 	(subtype) = (osfp) & ((1 << _FP_SUBTYPE_BITS) - 1); \
428 } while(0)
429 #define PF_OSFP_PACK(osfp, class, version, subtype) do { \
430 	(osfp) = ((class) & ((1 << _FP_CLASS_BITS) - 1)) << (_FP_VERSION_BITS \
431 	    + _FP_SUBTYPE_BITS); \
432 	(osfp) |= ((version) & ((1 << _FP_VERSION_BITS) - 1)) << \
433 	    _FP_SUBTYPE_BITS; \
434 	(osfp) |= (subtype) & ((1 << _FP_SUBTYPE_BITS) - 1); \
435 } while(0)
436 
437 /* the fingerprint of an OSes TCP SYN packet */
438 typedef u_int64_t	pf_tcpopts_t;
439 struct pf_os_fingerprint {
440 	SLIST_HEAD(pf_osfp_enlist, pf_osfp_entry) fp_oses; /* list of matches */
441 	pf_tcpopts_t		fp_tcpopts;	/* packed TCP options */
442 	u_int16_t		fp_wsize;	/* TCP window size */
443 	u_int16_t		fp_psize;	/* ip->ip_len */
444 	u_int16_t		fp_mss;		/* TCP MSS */
445 	u_int16_t		fp_flags;
446 #define PF_OSFP_WSIZE_MOD	0x0001		/* Window modulus */
447 #define PF_OSFP_WSIZE_DC	0x0002		/* Window don't care */
448 #define PF_OSFP_WSIZE_MSS	0x0004		/* Window multiple of MSS */
449 #define PF_OSFP_WSIZE_MTU	0x0008		/* Window multiple of MTU */
450 #define PF_OSFP_PSIZE_MOD	0x0010		/* packet size modulus */
451 #define PF_OSFP_PSIZE_DC	0x0020		/* packet size don't care */
452 #define PF_OSFP_WSCALE		0x0040		/* TCP window scaling */
453 #define PF_OSFP_WSCALE_MOD	0x0080		/* TCP window scale modulus */
454 #define PF_OSFP_WSCALE_DC	0x0100		/* TCP window scale dont-care */
455 #define PF_OSFP_MSS		0x0200		/* TCP MSS */
456 #define PF_OSFP_MSS_MOD		0x0400		/* TCP MSS modulus */
457 #define PF_OSFP_MSS_DC		0x0800		/* TCP MSS dont-care */
458 #define PF_OSFP_DF		0x1000		/* IPv4 don't fragment bit */
459 #define PF_OSFP_TS0		0x2000		/* Zero timestamp */
460 	u_int8_t		fp_optcnt;	/* TCP option count */
461 	u_int8_t		fp_wscale;	/* TCP window scaling */
462 	u_int8_t		fp_ttl;		/* IPv4 TTL */
463 #define PF_OSFP_MAXTTL_OFFSET	40
464 /* TCP options packing */
465 #define PF_OSFP_TCPOPT_NOP	0x0		/* TCP NOP option */
466 #define PF_OSFP_TCPOPT_WSCALE	0x1		/* TCP window scaling option */
467 #define PF_OSFP_TCPOPT_MSS	0x2		/* TCP max segment size opt */
468 #define PF_OSFP_TCPOPT_SACK	0x3		/* TCP SACK OK option */
469 #define PF_OSFP_TCPOPT_TS	0x4		/* TCP timestamp option */
470 #define PF_OSFP_TCPOPT_BITS	3		/* bits used by each option */
471 #define PF_OSFP_MAX_OPTS \
472     (sizeof(((struct pf_os_fingerprint *)0)->fp_tcpopts) * 8) \
473     / PF_OSFP_TCPOPT_BITS
474 
475 	SLIST_ENTRY(pf_os_fingerprint)	fp_next;
476 };
477 
478 struct pf_osfp_ioctl {
479 	struct pf_osfp_entry	fp_os;
480 	pf_tcpopts_t		fp_tcpopts;	/* packed TCP options */
481 	u_int16_t		fp_wsize;	/* TCP window size */
482 	u_int16_t		fp_psize;	/* ip->ip_len */
483 	u_int16_t		fp_mss;		/* TCP MSS */
484 	u_int16_t		fp_flags;
485 	u_int8_t		fp_optcnt;	/* TCP option count */
486 	u_int8_t		fp_wscale;	/* TCP window scaling */
487 	u_int8_t		fp_ttl;		/* IPv4 TTL */
488 
489 	int			fp_getnum;	/* DIOCOSFPGET number */
490 };
491 
492 
493 union pf_rule_ptr {
494 	struct pf_rule		*ptr;
495 	u_int32_t		 nr;
496 };
497 
498 #define	PF_ANCHOR_NAME_SIZE	 64
499 
500 struct pf_rule {
501 	struct pf_rule_addr	 src;
502 	struct pf_rule_addr	 dst;
503 #define PF_SKIP_IFP		0
504 #define PF_SKIP_DIR		1
505 #define PF_SKIP_AF		2
506 #define PF_SKIP_PROTO		3
507 #define PF_SKIP_SRC_ADDR	4
508 #define PF_SKIP_SRC_PORT	5
509 #define PF_SKIP_DST_ADDR	6
510 #define PF_SKIP_DST_PORT	7
511 #define PF_SKIP_COUNT		8
512 	union pf_rule_ptr	 skip[PF_SKIP_COUNT];
513 #define PF_RULE_LABEL_SIZE	 64
514 	char			 label[PF_RULE_LABEL_SIZE];
515 #define PF_QNAME_SIZE		 16
516 	char			 ifname[IFNAMSIZ];
517 	char			 qname[PF_QNAME_SIZE];
518 	char			 pqname[PF_QNAME_SIZE];
519 #define	PF_TAG_NAME_SIZE	 16
520 	char			 tagname[PF_TAG_NAME_SIZE];
521 	char			 match_tagname[PF_TAG_NAME_SIZE];
522 
523 	char			 overload_tblname[PF_TABLE_NAME_SIZE];
524 
525 	TAILQ_ENTRY(pf_rule)	 entries;
526 	struct pf_pool		 rpool;
527 
528 	u_int64_t		 evaluations;
529 	u_int64_t		 packets;
530 	u_int64_t		 bytes;
531 
532 	struct pfi_kif		*kif;
533 	struct pf_anchor	*anchor;
534 	struct pfr_ktable	*overload_tbl;
535 
536 	pf_osfp_t		 os_fingerprint;
537 
538 	u_int32_t		 timeout[PFTM_MAX];
539 	u_int32_t		 states;
540 	u_int32_t		 max_states;
541 	u_int32_t		 src_nodes;
542 	u_int32_t		 max_src_nodes;
543 	u_int32_t		 max_src_states;
544 	u_int32_t		 max_src_conn;
545 	struct {
546 		u_int32_t		limit;
547 		u_int32_t		seconds;
548 	}			 max_src_conn_rate;
549 	u_int32_t		 qid;
550 	u_int32_t		 pqid;
551 	u_int32_t		 rt_listid;
552 	u_int32_t		 nr;
553 	u_int32_t		 prob;
554 
555 	u_int16_t		 return_icmp;
556 	u_int16_t		 return_icmp6;
557 	u_int16_t		 max_mss;
558 	u_int16_t		 tag;
559 	u_int16_t		 match_tag;
560 
561 	struct pf_rule_uid	 uid;
562 	struct pf_rule_gid	 gid;
563 
564 	u_int32_t		 rule_flag;
565 	u_int8_t		 action;
566 	u_int8_t		 direction;
567 	u_int8_t		 log;
568 	u_int8_t		 quick;
569 	u_int8_t		 ifnot;
570 	u_int8_t		 match_tag_not;
571 	u_int8_t		 natpass;
572 
573 #define PF_STATE_NORMAL		0x1
574 #define PF_STATE_MODULATE	0x2
575 #define PF_STATE_SYNPROXY	0x3
576 	u_int8_t		 keep_state;
577 	sa_family_t		 af;
578 	u_int8_t		 proto;
579 	u_int8_t		 type;
580 	u_int8_t		 code;
581 	u_int8_t		 flags;
582 	u_int8_t		 flagset;
583 	u_int8_t		 min_ttl;
584 	u_int8_t		 allow_opts;
585 	u_int8_t		 rt;
586 	u_int8_t		 return_ttl;
587 	u_int8_t		 tos;
588 	u_int8_t		 anchor_relative;
589 	u_int8_t		 anchor_wildcard;
590 
591 #define PF_FLUSH		0x01
592 #define PF_FLUSH_GLOBAL		0x02
593 	u_int8_t		 flush;
594 };
595 
596 /* rule flags */
597 #define	PFRULE_DROP		0x0000
598 #define	PFRULE_RETURNRST	0x0001
599 #define	PFRULE_FRAGMENT		0x0002
600 #define	PFRULE_RETURNICMP	0x0004
601 #define	PFRULE_RETURN		0x0008
602 #define	PFRULE_NOSYNC		0x0010
603 #define PFRULE_SRCTRACK		0x0020  /* track source states */
604 #define PFRULE_RULESRCTRACK	0x0040  /* per rule */
605 
606 /* scrub flags */
607 #define	PFRULE_NODF		0x0100
608 #define	PFRULE_FRAGCROP		0x0200	/* non-buffering frag cache */
609 #define	PFRULE_FRAGDROP		0x0400	/* drop funny fragments */
610 #define PFRULE_RANDOMID		0x0800
611 #define PFRULE_REASSEMBLE_TCP	0x1000
612 
613 /* rule flags again */
614 #define PFRULE_IFBOUND		0x00010000	/* if-bound */
615 #define PFRULE_GRBOUND		0x00020000	/* group-bound */
616 
617 #define PFSTATE_HIWAT		10000	/* default state table size */
618 
619 
620 struct pf_threshold {
621 	u_int32_t	limit;
622 #define	PF_THRESHOLD_MULT	1000
623 #define PF_THRESHOLD_MAX	0xffffffff / PF_THRESHOLD_MULT
624 	u_int32_t	seconds;
625 	u_int32_t	count;
626 	u_int32_t	last;
627 };
628 
629 struct pf_src_node {
630 	RB_ENTRY(pf_src_node) entry;
631 	struct pf_addr	 addr;
632 	struct pf_addr	 raddr;
633 	union pf_rule_ptr rule;
634 	struct pfi_kif	*kif;
635 	u_int32_t	 bytes;
636 	u_int32_t	 packets;
637 	u_int32_t	 states;
638 	u_int32_t	 conn;
639 	struct pf_threshold	conn_rate;
640 	u_int32_t	 creation;
641 	u_int32_t	 expire;
642 	sa_family_t	 af;
643 	u_int8_t	 ruletype;
644 };
645 
646 #define PFSNODE_HIWAT		10000	/* default source node table size */
647 
648 struct pf_state_scrub {
649 	struct timeval	pfss_last;	/* time received last packet	*/
650 	u_int32_t	pfss_tsecr;	/* last echoed timestamp	*/
651 	u_int32_t	pfss_tsval;	/* largest timestamp		*/
652 	u_int32_t	pfss_tsval0;	/* original timestamp		*/
653 	u_int16_t	pfss_flags;
654 #define PFSS_TIMESTAMP	0x0001		/* modulate timestamp		*/
655 #define PFSS_PAWS	0x0010		/* stricter PAWS checks		*/
656 #define PFSS_PAWS_IDLED	0x0020		/* was idle too long.  no PAWS	*/
657 #define PFSS_DATA_TS	0x0040		/* timestamp on data packets	*/
658 #define PFSS_DATA_NOTS	0x0080		/* no timestamp on data packets	*/
659 	u_int8_t	pfss_ttl;	/* stashed TTL			*/
660 	u_int8_t	pad;
661 	u_int32_t	pfss_ts_mod;	/* timestamp modulation		*/
662 };
663 
664 struct pf_state_host {
665 	struct pf_addr	addr;
666 	u_int16_t	port;
667 	u_int16_t	pad;
668 };
669 
670 struct pf_state_peer {
671 	u_int32_t	seqlo;		/* Max sequence number sent	*/
672 	u_int32_t	seqhi;		/* Max the other end ACKd + win	*/
673 	u_int32_t	seqdiff;	/* Sequence number modulator	*/
674 	u_int16_t	max_win;	/* largest window (pre scaling)	*/
675 	u_int8_t	state;		/* active state level		*/
676 	u_int8_t	wscale;		/* window scaling factor	*/
677 	u_int16_t	mss;		/* Maximum segment size option	*/
678 	struct pf_state_scrub	*scrub;	/* state is scrubbed		*/
679 };
680 
681 TAILQ_HEAD(pf_state_queue, pf_state);
682 
683 struct pf_state {
684 	u_int64_t	 id;
685 	union {
686 		struct {
687 			RB_ENTRY(pf_state)	 entry_lan_ext;
688 			RB_ENTRY(pf_state)	 entry_ext_gwy;
689 			RB_ENTRY(pf_state)	 entry_id;
690 			TAILQ_ENTRY(pf_state)	 entry_updates;
691 			struct pfi_kif		*kif;
692 		} s;
693 		char	 ifname[IFNAMSIZ];
694 	} u;
695 	struct pf_state_host lan;
696 	struct pf_state_host gwy;
697 	struct pf_state_host ext;
698 	struct pf_state_peer src;
699 	struct pf_state_peer dst;
700 	union pf_rule_ptr rule;
701 	union pf_rule_ptr anchor;
702 	union pf_rule_ptr nat_rule;
703 	struct pf_addr	 rt_addr;
704 	struct pfi_kif	*rt_kif;
705 	struct pf_src_node	*src_node;
706 	struct pf_src_node	*nat_src_node;
707 	u_int32_t	 creation;
708 	u_int32_t	 expire;
709 	u_int32_t	 pfsync_time;
710 	u_int32_t	 packets[2];
711 	u_int32_t	 bytes[2];
712 	u_int32_t	 creatorid;
713 	u_int16_t	 tag;
714 	sa_family_t	 af;
715 	u_int8_t	 proto;
716 	u_int8_t	 direction;
717 	u_int8_t	 log;
718 	u_int8_t	 allow_opts;
719 	u_int8_t	 timeout;
720 	u_int8_t	 sync_flags;
721 #define	PFSTATE_NOSYNC	 0x01
722 #define	PFSTATE_FROMSYNC 0x02
723 #define	PFSTATE_STALE	 0x04
724 	u_int8_t	 pad;
725 };
726 
727 TAILQ_HEAD(pf_rulequeue, pf_rule);
728 
729 struct pf_anchor;
730 
731 struct pf_ruleset {
732 	struct {
733 		struct pf_rulequeue	 queues[2];
734 		struct {
735 			struct pf_rulequeue	*ptr;
736 			u_int32_t		 ticket;
737 			int			 open;
738 		}			 active, inactive;
739 	}			 rules[PF_RULESET_MAX];
740 	struct pf_anchor	*anchor;
741 	u_int32_t		 tticket;
742 	int			 tables;
743 	int			 topen;
744 };
745 
746 RB_HEAD(pf_anchor_global, pf_anchor);
747 RB_HEAD(pf_anchor_node, pf_anchor);
748 struct pf_anchor {
749 	RB_ENTRY(pf_anchor)	 entry_global;
750 	RB_ENTRY(pf_anchor)	 entry_node;
751 	struct pf_anchor	*parent;
752 	struct pf_anchor_node	 children;
753 	char			 name[PF_ANCHOR_NAME_SIZE];
754 	char			 path[MAXPATHLEN];
755 	struct pf_ruleset	 ruleset;
756 	int			 refcnt;	/* anchor rules */
757 };
758 RB_PROTOTYPE(pf_anchor_global, pf_anchor, entry_global, pf_anchor_compare);
759 RB_PROTOTYPE(pf_anchor_node, pf_anchor, entry_node, pf_anchor_compare);
760 
761 #define PF_RESERVED_ANCHOR	"_pf"
762 
763 #define PFR_TFLAG_PERSIST	0x00000001
764 #define PFR_TFLAG_CONST		0x00000002
765 #define PFR_TFLAG_ACTIVE	0x00000004
766 #define PFR_TFLAG_INACTIVE	0x00000008
767 #define PFR_TFLAG_REFERENCED	0x00000010
768 #define PFR_TFLAG_REFDANCHOR	0x00000020
769 #define PFR_TFLAG_USRMASK	0x00000003
770 #define PFR_TFLAG_SETMASK	0x0000003C
771 #define PFR_TFLAG_ALLMASK	0x0000003F
772 
773 struct pfr_table {
774 	char			 pfrt_anchor[MAXPATHLEN];
775 	char			 pfrt_name[PF_TABLE_NAME_SIZE];
776 	u_int32_t		 pfrt_flags;
777 	u_int8_t		 pfrt_fback;
778 };
779 
780 enum { PFR_FB_NONE, PFR_FB_MATCH, PFR_FB_ADDED, PFR_FB_DELETED,
781 	PFR_FB_CHANGED, PFR_FB_CLEARED, PFR_FB_DUPLICATE,
782 	PFR_FB_NOTMATCH, PFR_FB_CONFLICT, PFR_FB_MAX };
783 
784 struct pfr_addr {
785 	union {
786 		struct in_addr	 _pfra_ip4addr;
787 		struct in6_addr	 _pfra_ip6addr;
788 	}		 pfra_u;
789 	u_int8_t	 pfra_af;
790 	u_int8_t	 pfra_net;
791 	u_int8_t	 pfra_not;
792 	u_int8_t	 pfra_fback;
793 };
794 #define	pfra_ip4addr	pfra_u._pfra_ip4addr
795 #define	pfra_ip6addr	pfra_u._pfra_ip6addr
796 
797 enum { PFR_DIR_IN, PFR_DIR_OUT, PFR_DIR_MAX };
798 enum { PFR_OP_BLOCK, PFR_OP_PASS, PFR_OP_ADDR_MAX, PFR_OP_TABLE_MAX };
799 #define PFR_OP_XPASS	PFR_OP_ADDR_MAX
800 
801 struct pfr_astats {
802 	struct pfr_addr	 pfras_a;
803 	u_int64_t	 pfras_packets[PFR_DIR_MAX][PFR_OP_ADDR_MAX];
804 	u_int64_t	 pfras_bytes[PFR_DIR_MAX][PFR_OP_ADDR_MAX];
805 	long		 pfras_tzero;
806 };
807 
808 enum { PFR_REFCNT_RULE, PFR_REFCNT_ANCHOR, PFR_REFCNT_MAX };
809 
810 struct pfr_tstats {
811 	struct pfr_table pfrts_t;
812 	u_int64_t	 pfrts_packets[PFR_DIR_MAX][PFR_OP_TABLE_MAX];
813 	u_int64_t	 pfrts_bytes[PFR_DIR_MAX][PFR_OP_TABLE_MAX];
814 	u_int64_t	 pfrts_match;
815 	u_int64_t	 pfrts_nomatch;
816 	long		 pfrts_tzero;
817 	int		 pfrts_cnt;
818 	int		 pfrts_refcnt[PFR_REFCNT_MAX];
819 };
820 #define	pfrts_name	pfrts_t.pfrt_name
821 #define pfrts_flags	pfrts_t.pfrt_flags
822 
823 SLIST_HEAD(pfr_kentryworkq, pfr_kentry);
824 struct pfr_kentry {
825 	struct radix_node	 pfrke_node[2];
826 	union sockaddr_union	 pfrke_sa;
827 	u_int64_t		 pfrke_packets[PFR_DIR_MAX][PFR_OP_ADDR_MAX];
828 	u_int64_t		 pfrke_bytes[PFR_DIR_MAX][PFR_OP_ADDR_MAX];
829 	SLIST_ENTRY(pfr_kentry)	 pfrke_workq;
830 	long			 pfrke_tzero;
831 	u_int8_t		 pfrke_af;
832 	u_int8_t		 pfrke_net;
833 	u_int8_t		 pfrke_not;
834 	u_int8_t		 pfrke_mark;
835 	u_int8_t		 pfrke_intrpool;
836 };
837 
838 SLIST_HEAD(pfr_ktableworkq, pfr_ktable);
839 RB_HEAD(pfr_ktablehead, pfr_ktable);
840 struct pfr_ktable {
841 	struct pfr_tstats	 pfrkt_ts;
842 	RB_ENTRY(pfr_ktable)	 pfrkt_tree;
843 	SLIST_ENTRY(pfr_ktable)	 pfrkt_workq;
844 	struct radix_node_head	*pfrkt_ip4;
845 	struct radix_node_head	*pfrkt_ip6;
846 	struct pfr_ktable	*pfrkt_shadow;
847 	struct pfr_ktable	*pfrkt_root;
848 	struct pf_ruleset	*pfrkt_rs;
849 	long			 pfrkt_larg;
850 	int			 pfrkt_nflags;
851 };
852 #define pfrkt_t		pfrkt_ts.pfrts_t
853 #define pfrkt_name	pfrkt_t.pfrt_name
854 #define pfrkt_anchor	pfrkt_t.pfrt_anchor
855 #define pfrkt_ruleset	pfrkt_t.pfrt_ruleset
856 #define pfrkt_flags	pfrkt_t.pfrt_flags
857 #define pfrkt_cnt	pfrkt_ts.pfrts_cnt
858 #define pfrkt_refcnt	pfrkt_ts.pfrts_refcnt
859 #define pfrkt_packets	pfrkt_ts.pfrts_packets
860 #define pfrkt_bytes	pfrkt_ts.pfrts_bytes
861 #define pfrkt_match	pfrkt_ts.pfrts_match
862 #define pfrkt_nomatch	pfrkt_ts.pfrts_nomatch
863 #define pfrkt_tzero	pfrkt_ts.pfrts_tzero
864 
865 RB_HEAD(pf_state_tree_lan_ext, pf_state);
866 RB_PROTOTYPE(pf_state_tree_lan_ext, pf_state,
867     u.s.entry_lan_ext, pf_state_compare_lan_ext)
868 
869 RB_HEAD(pf_state_tree_ext_gwy, pf_state);
870 RB_PROTOTYPE(pf_state_tree_ext_gwy, pf_state,
871     u.s.entry_ext_gwy, pf_state_compare_ext_gwy)
872 
873 struct pfi_if {
874 	char				 pfif_name[IFNAMSIZ];
875 	u_int64_t			 pfif_packets[2][2][2];
876 	u_int64_t			 pfif_bytes[2][2][2];
877 	u_int64_t			 pfif_addcnt;
878 	u_int64_t			 pfif_delcnt;
879 	long				 pfif_tzero;
880 	int				 pfif_states;
881 	int				 pfif_rules;
882 	int				 pfif_flags;
883 };
884 
885 TAILQ_HEAD(pfi_grouphead, pfi_kif);
886 TAILQ_HEAD(pfi_statehead, pfi_kif);
887 RB_HEAD(pfi_ifhead, pfi_kif);
888 struct pfi_kif {
889 	struct pfi_if			 pfik_if;
890 	RB_ENTRY(pfi_kif)		 pfik_tree;
891 	struct pf_state_tree_lan_ext	 pfik_lan_ext;
892 	struct pf_state_tree_ext_gwy	 pfik_ext_gwy;
893 	struct pfi_grouphead		 pfik_grouphead;
894 	TAILQ_ENTRY(pfi_kif)		 pfik_instances;
895 	TAILQ_ENTRY(pfi_kif)		 pfik_w_states;
896 	struct hook_desc_head		*pfik_ah_head;
897 	void				*pfik_ah_cookie;
898 	struct pfi_kif			*pfik_parent;
899 	struct ifnet			*pfik_ifp;
900 	int				 pfik_states;
901 	int				 pfik_rules;
902 #ifdef __NetBSD__
903 	struct hook_desc_head		 pfik_ifaddrhooks;
904 #endif
905 };
906 #define pfik_name	pfik_if.pfif_name
907 #define pfik_packets	pfik_if.pfif_packets
908 #define pfik_bytes	pfik_if.pfif_bytes
909 #define pfik_tzero	pfik_if.pfif_tzero
910 #define pfik_flags	pfik_if.pfif_flags
911 #define pfik_addcnt	pfik_if.pfif_addcnt
912 #define pfik_delcnt	pfik_if.pfif_delcnt
913 #define pfik_states	pfik_if.pfif_states
914 #define pfik_rules	pfik_if.pfif_rules
915 
916 #define PFI_IFLAG_GROUP		0x0001	/* group of interfaces */
917 #define PFI_IFLAG_INSTANCE	0x0002	/* single instance */
918 #define PFI_IFLAG_CLONABLE	0x0010	/* clonable group */
919 #define PFI_IFLAG_DYNAMIC	0x0020	/* dynamic group */
920 #define PFI_IFLAG_ATTACHED	0x0040	/* interface attached */
921 #define PFI_IFLAG_SKIP		0x0100	/* skip filtering on interface */
922 #define PFI_IFLAG_SETABLE_MASK	0x0100	/* setable via DIOC{SET,CLR}IFFLAG */
923 
924 struct pf_pdesc {
925 	u_int64_t	 tot_len;	/* Make Mickey money */
926 	union {
927 		struct tcphdr		*tcp;
928 		struct udphdr		*udp;
929 		struct icmp		*icmp;
930 #ifdef INET6
931 		struct icmp6_hdr	*icmp6;
932 #endif /* INET6 */
933 		void			*any;
934 	} hdr;
935 	struct pf_addr	 baddr;		/* address before translation */
936 	struct pf_addr	 naddr;		/* address after translation */
937 	struct pf_rule	*nat_rule;	/* nat/rdr rule applied to packet */
938 	struct pf_addr	*src;
939 	struct pf_addr	*dst;
940 	struct ether_header
941 			*eh;
942 	u_int16_t	*ip_sum;
943 	u_int32_t	 p_len;		/* total length of payload */
944 	u_int16_t	 flags;		/* Let SCRUB trigger behavior in
945 					 * state code. Easier than tags */
946 #define PFDESC_TCP_NORM	0x0001		/* TCP shall be statefully scrubbed */
947 #define PFDESC_IP_REAS	0x0002		/* IP frags would've been reassembled */
948 	sa_family_t	 af;
949 	u_int8_t	 proto;
950 	u_int8_t	 tos;
951 };
952 
953 /* flags for RDR options */
954 #define PF_DPORT_RANGE	0x01		/* Dest port uses range */
955 #define PF_RPORT_RANGE	0x02		/* RDR'ed port uses range */
956 
957 /* Reasons code for passing/dropping a packet */
958 #define PFRES_MATCH	0		/* Explicit match of a rule */
959 #define PFRES_BADOFF	1		/* Bad offset for pull_hdr */
960 #define PFRES_FRAG	2		/* Dropping following fragment */
961 #define PFRES_SHORT	3		/* Dropping short packet */
962 #define PFRES_NORM	4		/* Dropping by normalizer */
963 #define PFRES_MEMORY	5		/* Dropped due to lacking mem */
964 #define PFRES_TS	6		/* Bad TCP Timestamp (RFC1323) */
965 #define PFRES_CONGEST	7		/* Congestion (of ipintrq) */
966 #define PFRES_IPOPTIONS 8		/* IP option */
967 #define PFRES_PROTCKSUM 9		/* Protocol checksum invalid */
968 #define PFRES_BADSTATE	10		/* State mismatch */
969 #define PFRES_STATEINS	11		/* State insertion failure */
970 #define PFRES_MAXSTATES	12		/* State limit */
971 #define PFRES_SRCLIMIT	13		/* Source node/conn limit */
972 #define PFRES_SYNPROXY	14		/* SYN proxy */
973 #define PFRES_MAX	15		/* total+1 */
974 
975 #define PFRES_NAMES { \
976 	"match", \
977 	"bad-offset", \
978 	"fragment", \
979 	"short", \
980 	"normalize", \
981 	"memory", \
982 	"bad-timestamp", \
983 	"congestion", \
984 	"ip-option", \
985 	"proto-cksum", \
986 	"state-mismatch", \
987 	"state-insert", \
988 	"state-limit", \
989 	"src-limit", \
990 	"synproxy", \
991 	NULL \
992 }
993 
994 /* Counters for other things we want to keep track of */
995 #define LCNT_STATES		0	/* states */
996 #define LCNT_SRCSTATES		1	/* max-src-states */
997 #define LCNT_SRCNODES		2	/* max-src-nodes */
998 #define LCNT_SRCCONN		3	/* max-src-conn */
999 #define LCNT_SRCCONNRATE	4	/* max-src-conn-rate */
1000 #define LCNT_OVERLOAD_TABLE	5	/* entry added to overload table */
1001 #define LCNT_OVERLOAD_FLUSH	6	/* state entries flushed */
1002 #define LCNT_MAX		7	/* total+1 */
1003 
1004 #define LCNT_NAMES { \
1005 	"max states per rule", \
1006 	"max-src-states", \
1007 	"max-src-nodes", \
1008 	"max-src-conn", \
1009 	"max-src-conn-rate", \
1010 	"overload table insertion", \
1011 	"overload flush states", \
1012 	NULL \
1013 }
1014 
1015 /* UDP state enumeration */
1016 #define PFUDPS_NO_TRAFFIC	0
1017 #define PFUDPS_SINGLE		1
1018 #define PFUDPS_MULTIPLE		2
1019 
1020 #define PFUDPS_NSTATES		3	/* number of state levels */
1021 
1022 #define PFUDPS_NAMES { \
1023 	"NO_TRAFFIC", \
1024 	"SINGLE", \
1025 	"MULTIPLE", \
1026 	NULL \
1027 }
1028 
1029 /* Other protocol state enumeration */
1030 #define PFOTHERS_NO_TRAFFIC	0
1031 #define PFOTHERS_SINGLE		1
1032 #define PFOTHERS_MULTIPLE	2
1033 
1034 #define PFOTHERS_NSTATES	3	/* number of state levels */
1035 
1036 #define PFOTHERS_NAMES { \
1037 	"NO_TRAFFIC", \
1038 	"SINGLE", \
1039 	"MULTIPLE", \
1040 	NULL \
1041 }
1042 
1043 #define FCNT_STATE_SEARCH	0
1044 #define FCNT_STATE_INSERT	1
1045 #define FCNT_STATE_REMOVALS	2
1046 #define FCNT_MAX		3
1047 
1048 #define SCNT_SRC_NODE_SEARCH	0
1049 #define SCNT_SRC_NODE_INSERT	1
1050 #define SCNT_SRC_NODE_REMOVALS	2
1051 #define SCNT_MAX		3
1052 
1053 #define ACTION_SET(a, x) \
1054 	do { \
1055 		if ((a) != NULL) \
1056 			*(a) = (x); \
1057 	} while (0)
1058 
1059 #define REASON_SET(a, x) \
1060 	do { \
1061 		if ((a) != NULL) \
1062 			*(a) = (x); \
1063 		if (x < PFRES_MAX) \
1064 			pf_status.counters[x]++; \
1065 	} while (0)
1066 
1067 struct pf_status {
1068 	u_int64_t	counters[PFRES_MAX];
1069 	u_int64_t	lcounters[LCNT_MAX];	/* limit counters */
1070 	u_int64_t	fcounters[FCNT_MAX];
1071 	u_int64_t	scounters[SCNT_MAX];
1072 	u_int64_t	pcounters[2][2][3];
1073 	u_int64_t	bcounters[2][2];
1074 	u_int64_t	stateid;
1075 	u_int32_t	running;
1076 	u_int32_t	states;
1077 	u_int32_t	src_nodes;
1078 	u_int32_t	since;
1079 	u_int32_t	debug;
1080 	u_int32_t	hostid;
1081 	char		ifname[IFNAMSIZ];
1082 };
1083 
1084 struct cbq_opts {
1085 	u_int		minburst;
1086 	u_int		maxburst;
1087 	u_int		pktsize;
1088 	u_int		maxpktsize;
1089 	u_int		ns_per_byte;
1090 	u_int		maxidle;
1091 	int		minidle;
1092 	u_int		offtime;
1093 	int		flags;
1094 };
1095 
1096 struct priq_opts {
1097 	int		flags;
1098 };
1099 
1100 struct hfsc_opts {
1101 	/* real-time service curve */
1102 	u_int		rtsc_m1;	/* slope of the 1st segment in bps */
1103 	u_int		rtsc_d;		/* the x-projection of m1 in msec */
1104 	u_int		rtsc_m2;	/* slope of the 2nd segment in bps */
1105 	/* link-sharing service curve */
1106 	u_int		lssc_m1;
1107 	u_int		lssc_d;
1108 	u_int		lssc_m2;
1109 	/* upper-limit service curve */
1110 	u_int		ulsc_m1;
1111 	u_int		ulsc_d;
1112 	u_int		ulsc_m2;
1113 	int		flags;
1114 };
1115 
1116 struct pf_altq {
1117 	char			 ifname[IFNAMSIZ];
1118 
1119 	void			*altq_disc;	/* discipline-specific state */
1120 	TAILQ_ENTRY(pf_altq)	 entries;
1121 
1122 	/* scheduler spec */
1123 	u_int8_t		 scheduler;	/* scheduler type */
1124 	u_int16_t		 tbrsize;	/* tokenbucket regulator size */
1125 	u_int32_t		 ifbandwidth;	/* interface bandwidth */
1126 
1127 	/* queue spec */
1128 	char			 qname[PF_QNAME_SIZE];	/* queue name */
1129 	char			 parent[PF_QNAME_SIZE];	/* parent name */
1130 	u_int32_t		 parent_qid;	/* parent queue id */
1131 	u_int32_t		 bandwidth;	/* queue bandwidth */
1132 	u_int8_t		 priority;	/* priority */
1133 	u_int16_t		 qlimit;	/* queue size limit */
1134 	u_int16_t		 flags;		/* misc flags */
1135 	union {
1136 		struct cbq_opts		 cbq_opts;
1137 		struct priq_opts	 priq_opts;
1138 		struct hfsc_opts	 hfsc_opts;
1139 	} pq_u;
1140 
1141 	u_int32_t		 qid;		/* return value */
1142 };
1143 
1144 struct pf_tag {
1145 	u_int16_t	tag;		/* tag id */
1146 };
1147 
1148 struct pf_tagname {
1149 	TAILQ_ENTRY(pf_tagname)	entries;
1150 	char			name[PF_TAG_NAME_SIZE];
1151 	u_int16_t		tag;
1152 	int			ref;
1153 };
1154 
1155 #define PFFRAG_FRENT_HIWAT	5000	/* Number of fragment entries */
1156 #define PFFRAG_FRAG_HIWAT	1000	/* Number of fragmented packets */
1157 #define PFFRAG_FRCENT_HIWAT	50000	/* Number of fragment cache entries */
1158 #define PFFRAG_FRCACHE_HIWAT	10000	/* Number of fragment descriptors */
1159 
1160 /*
1161  * ioctl parameter structures
1162  */
1163 
1164 struct pfioc_pooladdr {
1165 	u_int32_t		 action;
1166 	u_int32_t		 ticket;
1167 	u_int32_t		 nr;
1168 	u_int32_t		 r_num;
1169 	u_int8_t		 r_action;
1170 	u_int8_t		 r_last;
1171 	u_int8_t		 af;
1172 	char			 anchor[MAXPATHLEN];
1173 	struct pf_pooladdr	 addr;
1174 };
1175 
1176 struct pfioc_rule {
1177 	u_int32_t	 action;
1178 	u_int32_t	 ticket;
1179 	u_int32_t	 pool_ticket;
1180 	u_int32_t	 nr;
1181 	char		 anchor[MAXPATHLEN];
1182 	char		 anchor_call[MAXPATHLEN];
1183 	struct pf_rule	 rule;
1184 };
1185 
1186 struct pfioc_natlook {
1187 	struct pf_addr	 saddr;
1188 	struct pf_addr	 daddr;
1189 	struct pf_addr	 rsaddr;
1190 	struct pf_addr	 rdaddr;
1191 	u_int16_t	 sport;
1192 	u_int16_t	 dport;
1193 	u_int16_t	 rsport;
1194 	u_int16_t	 rdport;
1195 	sa_family_t	 af;
1196 	u_int8_t	 proto;
1197 	u_int8_t	 direction;
1198 };
1199 
1200 struct pfioc_state {
1201 	u_int32_t	 nr;
1202 	struct pf_state	 state;
1203 };
1204 
1205 struct pfioc_state_kill {
1206 	/* XXX returns the number of states killed in psk_af */
1207 	sa_family_t		psk_af;
1208 	int			psk_proto;
1209 	struct pf_rule_addr	psk_src;
1210 	struct pf_rule_addr	psk_dst;
1211 	char			psk_ifname[IFNAMSIZ];
1212 };
1213 
1214 struct pfioc_states {
1215 	int	ps_len;
1216 	union {
1217 		caddr_t		 psu_buf;
1218 		struct pf_state	*psu_states;
1219 	} ps_u;
1220 #define ps_buf		ps_u.psu_buf
1221 #define ps_states	ps_u.psu_states
1222 };
1223 
1224 struct pfioc_src_nodes {
1225 	int	psn_len;
1226 	union {
1227 		caddr_t		 psu_buf;
1228 		struct pf_src_node	*psu_src_nodes;
1229 	} psn_u;
1230 #define psn_buf		psn_u.psu_buf
1231 #define psn_src_nodes	psn_u.psu_src_nodes
1232 };
1233 
1234 struct pfioc_if {
1235 	char		 ifname[IFNAMSIZ];
1236 };
1237 
1238 struct pfioc_tm {
1239 	int		 timeout;
1240 	int		 seconds;
1241 };
1242 
1243 struct pfioc_limit {
1244 	int		 index;
1245 	unsigned	 limit;
1246 };
1247 
1248 struct pfioc_altq {
1249 	u_int32_t	 action;
1250 	u_int32_t	 ticket;
1251 	u_int32_t	 nr;
1252 	struct pf_altq	 altq;
1253 };
1254 
1255 struct pfioc_qstats {
1256 	u_int32_t	 ticket;
1257 	u_int32_t	 nr;
1258 	void		*buf;
1259 	int		 nbytes;
1260 	u_int8_t	 scheduler;
1261 };
1262 
1263 struct pfioc_ruleset {
1264 	u_int32_t	 nr;
1265 	char		 path[MAXPATHLEN];
1266 	char		 name[PF_ANCHOR_NAME_SIZE];
1267 };
1268 
1269 #define PF_RULESET_ALTQ		(PF_RULESET_MAX)
1270 #define PF_RULESET_TABLE	(PF_RULESET_MAX+1)
1271 struct pfioc_trans {
1272 	int		 size;	/* number of elements */
1273 	int		 esize; /* size of each element in bytes */
1274 	struct pfioc_trans_e {
1275 		int		rs_num;
1276 		char		anchor[MAXPATHLEN];
1277 		u_int32_t	ticket;
1278 	}		*array;
1279 };
1280 
1281 #define PFR_FLAG_ATOMIC		0x00000001
1282 #define PFR_FLAG_DUMMY		0x00000002
1283 #define PFR_FLAG_FEEDBACK	0x00000004
1284 #define PFR_FLAG_CLSTATS	0x00000008
1285 #define PFR_FLAG_ADDRSTOO	0x00000010
1286 #define PFR_FLAG_REPLACE	0x00000020
1287 #define PFR_FLAG_ALLRSETS	0x00000040
1288 #define PFR_FLAG_ALLMASK	0x0000007F
1289 #ifdef _KERNEL
1290 #define PFR_FLAG_USERIOCTL	0x10000000
1291 #endif
1292 
1293 struct pfioc_table {
1294 	struct pfr_table	 pfrio_table;
1295 	void			*pfrio_buffer;
1296 	int			 pfrio_esize;
1297 	int			 pfrio_size;
1298 	int			 pfrio_size2;
1299 	int			 pfrio_nadd;
1300 	int			 pfrio_ndel;
1301 	int			 pfrio_nchange;
1302 	int			 pfrio_flags;
1303 	u_int32_t		 pfrio_ticket;
1304 };
1305 #define	pfrio_exists	pfrio_nadd
1306 #define	pfrio_nzero	pfrio_nadd
1307 #define	pfrio_nmatch	pfrio_nadd
1308 #define pfrio_naddr	pfrio_size2
1309 #define pfrio_setflag	pfrio_size2
1310 #define pfrio_clrflag	pfrio_nadd
1311 
1312 
1313 #define PFI_FLAG_GROUP		0x0001	/* gets groups of interfaces */
1314 #define PFI_FLAG_INSTANCE	0x0002	/* gets single interfaces */
1315 #define PFI_FLAG_ALLMASK	0x0003
1316 
1317 struct pfioc_iface {
1318 	char	 pfiio_name[IFNAMSIZ];
1319 	void	*pfiio_buffer;
1320 	int	 pfiio_esize;
1321 	int	 pfiio_size;
1322 	int	 pfiio_nzero;
1323 	int	 pfiio_flags;
1324 };
1325 
1326 
1327 /*
1328  * ioctl operations
1329  */
1330 
1331 #define DIOCSTART	_IO  ('D',  1)
1332 #define DIOCSTOP	_IO  ('D',  2)
1333 #define DIOCADDRULE	_IOWR('D',  4, struct pfioc_rule)
1334 #define DIOCGETRULES	_IOWR('D',  6, struct pfioc_rule)
1335 #define DIOCGETRULE	_IOWR('D',  7, struct pfioc_rule)
1336 /* XXX cut 8 - 17 */
1337 #define DIOCCLRSTATES	_IOWR('D', 18, struct pfioc_state_kill)
1338 #define DIOCGETSTATE	_IOWR('D', 19, struct pfioc_state)
1339 #define DIOCSETSTATUSIF _IOWR('D', 20, struct pfioc_if)
1340 #define DIOCGETSTATUS	_IOWR('D', 21, struct pf_status)
1341 #define DIOCCLRSTATUS	_IO  ('D', 22)
1342 #define DIOCNATLOOK	_IOWR('D', 23, struct pfioc_natlook)
1343 #define DIOCSETDEBUG	_IOWR('D', 24, u_int32_t)
1344 #define DIOCGETSTATES	_IOWR('D', 25, struct pfioc_states)
1345 #define DIOCCHANGERULE	_IOWR('D', 26, struct pfioc_rule)
1346 /* XXX cut 26 - 28 */
1347 #define DIOCSETTIMEOUT	_IOWR('D', 29, struct pfioc_tm)
1348 #define DIOCGETTIMEOUT	_IOWR('D', 30, struct pfioc_tm)
1349 #define DIOCADDSTATE	_IOWR('D', 37, struct pfioc_state)
1350 #define DIOCCLRRULECTRS	_IO  ('D', 38)
1351 #define DIOCGETLIMIT	_IOWR('D', 39, struct pfioc_limit)
1352 #define DIOCSETLIMIT	_IOWR('D', 40, struct pfioc_limit)
1353 #define DIOCKILLSTATES	_IOWR('D', 41, struct pfioc_state_kill)
1354 #define DIOCSTARTALTQ	_IO  ('D', 42)
1355 #define DIOCSTOPALTQ	_IO  ('D', 43)
1356 #define DIOCADDALTQ	_IOWR('D', 45, struct pfioc_altq)
1357 #define DIOCGETALTQS	_IOWR('D', 47, struct pfioc_altq)
1358 #define DIOCGETALTQ	_IOWR('D', 48, struct pfioc_altq)
1359 #define DIOCCHANGEALTQ	_IOWR('D', 49, struct pfioc_altq)
1360 #define DIOCGETQSTATS	_IOWR('D', 50, struct pfioc_qstats)
1361 #define DIOCBEGINADDRS	_IOWR('D', 51, struct pfioc_pooladdr)
1362 #define DIOCADDADDR	_IOWR('D', 52, struct pfioc_pooladdr)
1363 #define DIOCGETADDRS	_IOWR('D', 53, struct pfioc_pooladdr)
1364 #define DIOCGETADDR	_IOWR('D', 54, struct pfioc_pooladdr)
1365 #define DIOCCHANGEADDR	_IOWR('D', 55, struct pfioc_pooladdr)
1366 /* XXX cut 55 - 57 */
1367 #define	DIOCGETRULESETS	_IOWR('D', 58, struct pfioc_ruleset)
1368 #define	DIOCGETRULESET	_IOWR('D', 59, struct pfioc_ruleset)
1369 #define	DIOCRCLRTABLES	_IOWR('D', 60, struct pfioc_table)
1370 #define	DIOCRADDTABLES	_IOWR('D', 61, struct pfioc_table)
1371 #define	DIOCRDELTABLES	_IOWR('D', 62, struct pfioc_table)
1372 #define	DIOCRGETTABLES	_IOWR('D', 63, struct pfioc_table)
1373 #define	DIOCRGETTSTATS	_IOWR('D', 64, struct pfioc_table)
1374 #define DIOCRCLRTSTATS  _IOWR('D', 65, struct pfioc_table)
1375 #define	DIOCRCLRADDRS	_IOWR('D', 66, struct pfioc_table)
1376 #define	DIOCRADDADDRS	_IOWR('D', 67, struct pfioc_table)
1377 #define	DIOCRDELADDRS	_IOWR('D', 68, struct pfioc_table)
1378 #define	DIOCRSETADDRS	_IOWR('D', 69, struct pfioc_table)
1379 #define	DIOCRGETADDRS	_IOWR('D', 70, struct pfioc_table)
1380 #define	DIOCRGETASTATS	_IOWR('D', 71, struct pfioc_table)
1381 #define DIOCRCLRASTATS  _IOWR('D', 72, struct pfioc_table)
1382 #define	DIOCRTSTADDRS	_IOWR('D', 73, struct pfioc_table)
1383 #define	DIOCRSETTFLAGS	_IOWR('D', 74, struct pfioc_table)
1384 #define DIOCRINADEFINE	_IOWR('D', 77, struct pfioc_table)
1385 #define DIOCOSFPFLUSH	_IO('D', 78)
1386 #define DIOCOSFPADD	_IOWR('D', 79, struct pf_osfp_ioctl)
1387 #define DIOCOSFPGET	_IOWR('D', 80, struct pf_osfp_ioctl)
1388 #define DIOCXBEGIN      _IOWR('D', 81, struct pfioc_trans)
1389 #define DIOCXCOMMIT     _IOWR('D', 82, struct pfioc_trans)
1390 #define DIOCXROLLBACK   _IOWR('D', 83, struct pfioc_trans)
1391 #define DIOCGETSRCNODES	_IOWR('D', 84, struct pfioc_src_nodes)
1392 #define DIOCCLRSRCNODES	_IO('D', 85)
1393 #define DIOCSETHOSTID	_IOWR('D', 86, u_int32_t)
1394 #define DIOCIGETIFACES	_IOWR('D', 87, struct pfioc_iface)
1395 #define DIOCICLRISTATS  _IOWR('D', 88, struct pfioc_iface)
1396 #define DIOCSETIFFLAG	_IOWR('D', 89, struct pfioc_iface)
1397 #define DIOCCLRIFFLAG	_IOWR('D', 90, struct pfioc_iface)
1398 
1399 #ifdef _KERNEL
1400 RB_HEAD(pf_src_tree, pf_src_node);
1401 RB_PROTOTYPE(pf_src_tree, pf_src_node, entry, pf_src_compare);
1402 extern struct pf_src_tree tree_src_tracking;
1403 
1404 RB_HEAD(pf_state_tree_id, pf_state);
1405 RB_PROTOTYPE(pf_state_tree_id, pf_state,
1406     entry_id, pf_state_compare_id);
1407 extern struct pf_state_tree_id tree_id;
1408 extern struct pf_state_queue state_updates;
1409 
1410 extern struct pf_anchor_global		  pf_anchors;
1411 extern struct pf_ruleset		  pf_main_ruleset;
1412 TAILQ_HEAD(pf_poolqueue, pf_pool);
1413 extern struct pf_poolqueue		  pf_pools[2];
1414 TAILQ_HEAD(pf_altqqueue, pf_altq);
1415 extern struct pf_altqqueue		  pf_altqs[2];
1416 extern struct pf_palist			  pf_pabuf;
1417 extern struct pfi_kif			**pfi_index2kif;
1418 
1419 extern u_int32_t		 ticket_altqs_active;
1420 extern u_int32_t		 ticket_altqs_inactive;
1421 extern int			 altqs_inactive_open;
1422 extern u_int32_t		 ticket_pabuf;
1423 extern struct pf_altqqueue	*pf_altqs_active;
1424 extern struct pf_altqqueue	*pf_altqs_inactive;
1425 extern struct pf_poolqueue	*pf_pools_active;
1426 extern struct pf_poolqueue	*pf_pools_inactive;
1427 extern int			 pf_tbladdr_setup(struct pf_ruleset *,
1428 				    struct pf_addr_wrap *);
1429 extern void			 pf_tbladdr_remove(struct pf_addr_wrap *);
1430 extern void			 pf_tbladdr_copyout(struct pf_addr_wrap *);
1431 extern void			 pf_calc_skip_steps(struct pf_rulequeue *);
1432 extern struct pool		 pf_src_tree_pl, pf_rule_pl;
1433 extern struct pool		 pf_state_pl, pf_altq_pl, pf_pooladdr_pl;
1434 extern struct pool		 pf_state_scrub_pl;
1435 extern void			 pf_purge_timeout(void *);
1436 extern void			 pf_purge_expired_src_nodes(void);
1437 extern void			 pf_purge_expired_states(void);
1438 extern void			 pf_purge_expired_state(struct pf_state *);
1439 extern int			 pf_insert_state(struct pfi_kif *,
1440 				    struct pf_state *);
1441 extern int			 pf_insert_src_node(struct pf_src_node **,
1442 				    struct pf_rule *, struct pf_addr *,
1443 				    sa_family_t);
1444 void				 pf_src_tree_remove_state(struct pf_state *);
1445 extern struct pf_state		*pf_find_state_byid(struct pf_state *);
1446 extern struct pf_state		*pf_find_state_all(struct pf_state *key,
1447 				    u_int8_t tree, int *more);
1448 extern void			 pf_print_state(struct pf_state *);
1449 extern void			 pf_print_flags(u_int8_t);
1450 extern struct pf_anchor		*pf_find_anchor(const char *);
1451 extern struct pf_ruleset	*pf_find_ruleset(const char *);
1452 extern struct pf_ruleset	*pf_find_or_create_ruleset(const char *);
1453 extern void			 pf_remove_if_empty_ruleset(
1454 				    struct pf_ruleset *);
1455 extern u_int16_t		 pf_cksum_fixup(u_int16_t, u_int16_t, u_int16_t,
1456 				    u_int8_t);
1457 
1458 extern struct ifnet		*sync_ifp;
1459 extern struct pf_rule		 pf_default_rule;
1460 extern void			 pf_addrcpy(struct pf_addr *, struct pf_addr *,
1461 				    u_int8_t);
1462 void				 pf_rm_rule(struct pf_rulequeue *,
1463 				    struct pf_rule *);
1464 
1465 #ifdef INET
1466 int	pf_test(int, struct ifnet *, struct mbuf **, struct ether_header *);
1467 #endif /* INET */
1468 
1469 #ifdef INET6
1470 int	pf_test6(int, struct ifnet *, struct mbuf **, struct ether_header *);
1471 void	pf_poolmask(struct pf_addr *, struct pf_addr*,
1472 	    struct pf_addr *, struct pf_addr *, u_int8_t);
1473 void	pf_addr_inc(struct pf_addr *, sa_family_t);
1474 #endif /* INET6 */
1475 
1476 void   *pf_pull_hdr(struct mbuf *, int, void *, int, u_short *, u_short *,
1477 	    sa_family_t);
1478 void	pf_change_a(void *, u_int16_t *, u_int32_t, u_int8_t);
1479 int	pflog_packet(struct pfi_kif *, struct mbuf *, sa_family_t, u_int8_t,
1480 	    u_int8_t, struct pf_rule *, struct pf_rule *, struct pf_ruleset *);
1481 int	pf_match_addr(u_int8_t, struct pf_addr *, struct pf_addr *,
1482 	    struct pf_addr *, sa_family_t);
1483 int	pf_match(u_int8_t, u_int32_t, u_int32_t, u_int32_t);
1484 int	pf_match_port(u_int8_t, u_int16_t, u_int16_t, u_int16_t);
1485 int	pf_match_uid(u_int8_t, uid_t, uid_t, uid_t);
1486 int	pf_match_gid(u_int8_t, gid_t, gid_t, gid_t);
1487 
1488 void	pf_normalize_init(void);
1489 #ifdef _LKM
1490 void	pf_normalize_destroy(void);
1491 #endif
1492 int	pf_normalize_ip(struct mbuf **, int, struct pfi_kif *, u_short *,
1493 	    struct pf_pdesc *);
1494 int	pf_normalize_ip6(struct mbuf **, int, struct pfi_kif *, u_short *,
1495 	    struct pf_pdesc *);
1496 int	pf_normalize_tcp(int, struct pfi_kif *, struct mbuf *, int, int, void *,
1497 	    struct pf_pdesc *);
1498 void	pf_normalize_tcp_cleanup(struct pf_state *);
1499 int	pf_normalize_tcp_init(struct mbuf *, int, struct pf_pdesc *,
1500 	    struct tcphdr *, struct pf_state_peer *, struct pf_state_peer *);
1501 int	pf_normalize_tcp_stateful(struct mbuf *, int, struct pf_pdesc *,
1502 	    u_short *, struct tcphdr *, struct pf_state *,
1503 	    struct pf_state_peer *, struct pf_state_peer *, int *);
1504 u_int32_t
1505 	pf_state_expires(const struct pf_state *);
1506 void	pf_purge_expired_fragments(void);
1507 int	pf_routable(struct pf_addr *addr, sa_family_t af);
1508 int	pf_rtlabel_match(struct pf_addr *, sa_family_t, struct pf_addr_wrap *);
1509 void	pfr_initialize(void);
1510 #ifdef _LKM
1511 void	pfr_destroy(void);
1512 #endif
1513 int	pfr_match_addr(struct pfr_ktable *, struct pf_addr *, sa_family_t);
1514 void	pfr_update_stats(struct pfr_ktable *, struct pf_addr *, sa_family_t,
1515 	    u_int64_t, int, int, int);
1516 int	pfr_pool_get(struct pfr_ktable *, int *, struct pf_addr *,
1517 	    struct pf_addr **, struct pf_addr **, sa_family_t);
1518 void	pfr_dynaddr_update(struct pfr_ktable *, struct pfi_dynaddr *);
1519 struct pfr_ktable *
1520 	pfr_attach_table(struct pf_ruleset *, char *);
1521 void	pfr_detach_table(struct pfr_ktable *);
1522 int	pfr_clr_tables(struct pfr_table *, int *, int);
1523 int	pfr_add_tables(struct pfr_table *, int, int *, int);
1524 int	pfr_del_tables(struct pfr_table *, int, int *, int);
1525 int	pfr_get_tables(struct pfr_table *, struct pfr_table *, int *, int);
1526 int	pfr_get_tstats(struct pfr_table *, struct pfr_tstats *, int *, int);
1527 int	pfr_clr_tstats(struct pfr_table *, int, int *, int);
1528 int	pfr_set_tflags(struct pfr_table *, int, int, int, int *, int *, int);
1529 int	pfr_clr_addrs(struct pfr_table *, int *, int);
1530 int	pfr_insert_kentry(struct pfr_ktable *, struct pfr_addr *, long);
1531 int	pfr_add_addrs(struct pfr_table *, struct pfr_addr *, int, int *,
1532 	    int);
1533 int	pfr_del_addrs(struct pfr_table *, struct pfr_addr *, int, int *,
1534 	    int);
1535 int	pfr_set_addrs(struct pfr_table *, struct pfr_addr *, int, int *,
1536 	    int *, int *, int *, int);
1537 int	pfr_get_addrs(struct pfr_table *, struct pfr_addr *, int *, int);
1538 int	pfr_get_astats(struct pfr_table *, struct pfr_astats *, int *, int);
1539 int	pfr_clr_astats(struct pfr_table *, struct pfr_addr *, int, int *,
1540 	    int);
1541 int	pfr_tst_addrs(struct pfr_table *, struct pfr_addr *, int, int *,
1542 	    int);
1543 int	pfr_ina_begin(struct pfr_table *, u_int32_t *, int *, int);
1544 int	pfr_ina_rollback(struct pfr_table *, u_int32_t, int *, int);
1545 int	pfr_ina_commit(struct pfr_table *, u_int32_t, int *, int *, int);
1546 int	pfr_ina_define(struct pfr_table *, struct pfr_addr *, int, int *,
1547 	    int *, u_int32_t, int);
1548 
1549 void		 pfi_initialize(void);
1550 #ifdef _LKM
1551 void		 pfi_destroy(void);
1552 #endif
1553 void		 pfi_attach_clone(struct if_clone *);
1554 void		 pfi_attach_ifnet(struct ifnet *);
1555 void		 pfi_detach_ifnet(struct ifnet *);
1556 struct pfi_kif	*pfi_lookup_create(const char *);
1557 struct pfi_kif	*pfi_lookup_if(const char *);
1558 int		 pfi_maybe_destroy(struct pfi_kif *);
1559 struct pfi_kif	*pfi_attach_rule(const char *);
1560 void		 pfi_detach_rule(struct pfi_kif *);
1561 void		 pfi_attach_state(struct pfi_kif *);
1562 void		 pfi_detach_state(struct pfi_kif *);
1563 int		 pfi_dynaddr_setup(struct pf_addr_wrap *, sa_family_t);
1564 void		 pfi_dynaddr_copyout(struct pf_addr_wrap *);
1565 void		 pfi_dynaddr_remove(struct pf_addr_wrap *);
1566 void		 pfi_fill_oldstatus(struct pf_status *);
1567 int		 pfi_clr_istats(const char *, int *, int);
1568 int		 pfi_get_ifaces(const char *, struct pfi_if *, int *, int);
1569 int		 pfi_set_flags(const char *, int);
1570 int		 pfi_clear_flags(const char *, int);
1571 int		 pfi_match_addr(struct pfi_dynaddr *, struct pf_addr *,
1572 		    sa_family_t);
1573 
1574 extern struct pfi_statehead	pfi_statehead;
1575 
1576 u_int16_t	pf_tagname2tag(char *);
1577 void		pf_tag2tagname(u_int16_t, char *);
1578 void		pf_tag_ref(u_int16_t);
1579 void		pf_tag_unref(u_int16_t);
1580 int		pf_tag_packet(struct mbuf *, struct pf_tag *, int);
1581 u_int32_t	pf_qname2qid(char *);
1582 void		pf_qid2qname(u_int32_t, char *);
1583 void		pf_qid_unref(u_int32_t);
1584 
1585 extern struct pf_status	pf_status;
1586 extern struct pool	pf_frent_pl, pf_frag_pl;
1587 
1588 struct pf_pool_limit {
1589 	void		*pp;
1590 	unsigned	 limit;
1591 };
1592 extern struct pf_pool_limit	pf_pool_limits[PF_LIMIT_MAX];
1593 
1594 #ifdef __NetBSD__
1595 int pfil4_wrapper(void *, struct mbuf **, struct ifnet *, int);
1596 int pfil6_wrapper(void *, struct mbuf **, struct ifnet *, int);
1597 int pfil_ifnet_wrapper(void *, struct mbuf **, struct ifnet *, int);
1598 int pfil_ifaddr_wrapper(void *, struct mbuf **, struct ifnet *, int);
1599 
1600 #endif
1601 
1602 /*
1603  * misc compatibility stuffs
1604  */
1605 #if !defined(PRIu32)
1606 #define	PRIu32	"u"	/* XXX */
1607 #endif
1608 #if !defined(__OpenBSD__)
1609 #include <sys/kernel.h> /* mono_time */
1610 static __inline void getmicrouptime(struct timeval *);
1611 static __inline void
1612 getmicrouptime(struct timeval *tvp)
1613 {
1614 	int s;
1615 
1616 	s = splclock();
1617 	*tvp = mono_time;
1618 	splx(s);
1619 }
1620 #define	time_second	time.tv_sec
1621 #define	m_copym2	m_dup
1622 #define	pool_allocator_oldnointr	pool_allocator_nointr
1623 #endif
1624 #endif /* _KERNEL */
1625 
1626 /* The fingerprint functions can be linked into userland programs (tcpdump) */
1627 int	pf_osfp_add(struct pf_osfp_ioctl *);
1628 #ifdef _KERNEL
1629 struct pf_osfp_enlist *
1630 	pf_osfp_fingerprint(struct pf_pdesc *, struct mbuf *, int,
1631 	    const struct tcphdr *);
1632 #endif /* _KERNEL */
1633 struct pf_osfp_enlist *
1634 	pf_osfp_fingerprint_hdr(const struct ip *, const struct tcphdr *);
1635 void	pf_osfp_flush(void);
1636 int	pf_osfp_get(struct pf_osfp_ioctl *);
1637 void	pf_osfp_initialize(void);
1638 #ifdef _LKM
1639 void	pf_osfp_destroy(void);
1640 #endif
1641 int	pf_osfp_match(struct pf_osfp_enlist *, pf_osfp_t);
1642 struct pf_os_fingerprint *
1643 	pf_osfp_validate(void);
1644 
1645 
1646 #endif /* _NET_PFVAR_H_ */
1647