1 /* $NetBSD: npf.h,v 1.33 2013/11/12 00:46:34 rmind Exp $ */ 2 3 /*- 4 * Copyright (c) 2009-2013 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /* 33 * Public NPF interfaces. 34 */ 35 36 #ifndef _NPF_NET_H_ 37 #define _NPF_NET_H_ 38 39 #include <sys/param.h> 40 #include <sys/types.h> 41 42 #include <sys/ioctl.h> 43 #include <prop/proplib.h> 44 45 #include <netinet/in_systm.h> 46 #include <netinet/in.h> 47 48 #define NPF_VERSION 12 49 50 /* 51 * Public declarations and definitions. 52 */ 53 54 /* Storage of address (both for IPv4 and IPv6) and netmask */ 55 typedef struct in6_addr npf_addr_t; 56 typedef uint8_t npf_netmask_t; 57 58 #define NPF_MAX_NETMASK (128) 59 #define NPF_NO_NETMASK ((npf_netmask_t)~0) 60 61 /* BPF coprocessor. */ 62 #if defined(NPF_BPFCOP) 63 #define NPF_COP_L3 0 64 #define NPF_COP_TABLE 1 65 66 #define BPF_MW_IPVER 0 67 #define BPF_MW_L4OFF 1 68 #define BPF_MW_L4PROTO 2 69 #endif 70 71 #if defined(_KERNEL) 72 73 #define NPF_DECISION_BLOCK 0 74 #define NPF_DECISION_PASS 1 75 76 #define NPF_EXT_MODULE(name, req) \ 77 MODULE(MODULE_CLASS_MISC, name, (sizeof(req) - 1) ? ("npf," req) : "npf") 78 79 /* 80 * Packet information cache. 81 */ 82 #include <net/if.h> 83 #include <netinet/ip.h> 84 #include <netinet/ip6.h> 85 #include <netinet/tcp.h> 86 #include <netinet/udp.h> 87 #include <netinet/ip_icmp.h> 88 #include <netinet/icmp6.h> 89 90 #define NPC_IP4 0x01 /* Indicates fetched IPv4 header. */ 91 #define NPC_IP6 0x02 /* Indicates IPv6 header. */ 92 #define NPC_IPFRAG 0x04 /* IPv4/IPv6 fragment. */ 93 #define NPC_LAYER4 0x08 /* Layer 4 has been fetched. */ 94 95 #define NPC_TCP 0x10 /* TCP header. */ 96 #define NPC_UDP 0x20 /* UDP header. */ 97 #define NPC_ICMP 0x40 /* ICMP header. */ 98 #define NPC_ICMP_ID 0x80 /* ICMP with query ID. */ 99 100 #define NPC_ALG_EXEC 0x100 /* ALG execution. */ 101 102 #define NPC_IP46 (NPC_IP4|NPC_IP6) 103 104 typedef struct { 105 /* Information flags. */ 106 uint32_t npc_info; 107 /* Pointers to the IP v4/v6 addresses. */ 108 npf_addr_t * npc_srcip; 109 npf_addr_t * npc_dstip; 110 /* Size (v4 or v6) of IP addresses. */ 111 uint8_t npc_alen; 112 uint8_t npc_hlen; 113 uint16_t npc_proto; 114 /* IPv4, IPv6. */ 115 union { 116 struct ip * v4; 117 struct ip6_hdr * v6; 118 } npc_ip; 119 /* TCP, UDP, ICMP. */ 120 union { 121 struct tcphdr * tcp; 122 struct udphdr * udp; 123 struct icmp * icmp; 124 struct icmp6_hdr * icmp6; 125 void * hdr; 126 } npc_l4; 127 } npf_cache_t; 128 129 static inline bool 130 npf_iscached(const npf_cache_t *npc, const int inf) 131 { 132 return __predict_true((npc->npc_info & inf) != 0); 133 } 134 135 /* 136 * Network buffer interface. 137 */ 138 139 #define NBUF_DATAREF_RESET 0x01 140 141 typedef struct { 142 struct mbuf * nb_mbuf0; 143 struct mbuf * nb_mbuf; 144 void * nb_nptr; 145 const ifnet_t * nb_ifp; 146 unsigned nb_ifid; 147 int nb_flags; 148 } nbuf_t; 149 150 void nbuf_init(nbuf_t *, struct mbuf *, const ifnet_t *); 151 void nbuf_reset(nbuf_t *); 152 struct mbuf * nbuf_head_mbuf(nbuf_t *); 153 154 bool nbuf_flag_p(const nbuf_t *, int); 155 void nbuf_unset_flag(nbuf_t *, int); 156 157 void * nbuf_dataptr(nbuf_t *); 158 size_t nbuf_offset(const nbuf_t *); 159 void * nbuf_advance(nbuf_t *, size_t, size_t); 160 161 void * nbuf_ensure_contig(nbuf_t *, size_t); 162 void * nbuf_ensure_writable(nbuf_t *, size_t); 163 164 bool nbuf_cksum_barrier(nbuf_t *, int); 165 int nbuf_add_tag(nbuf_t *, uint32_t, uint32_t); 166 int nbuf_find_tag(nbuf_t *, uint32_t, void **); 167 168 /* 169 * NPF extensions and rule procedure interface. 170 */ 171 172 struct npf_rproc; 173 typedef struct npf_rproc npf_rproc_t; 174 175 void npf_rproc_assign(npf_rproc_t *, void *); 176 177 typedef struct { 178 unsigned int version; 179 void * ctx; 180 int (*ctor)(npf_rproc_t *, prop_dictionary_t); 181 void (*dtor)(npf_rproc_t *, void *); 182 void (*proc)(npf_cache_t *, nbuf_t *, void *, int *); 183 } npf_ext_ops_t; 184 185 void * npf_ext_register(const char *, const npf_ext_ops_t *); 186 int npf_ext_unregister(void *); 187 188 /* 189 * Misc. 190 */ 191 192 bool npf_autounload_p(void); 193 194 #endif /* _KERNEL */ 195 196 /* Rule attributes. */ 197 #define NPF_RULE_PASS 0x0001 198 #define NPF_RULE_GROUP 0x0002 199 #define NPF_RULE_FINAL 0x0004 200 #define NPF_RULE_STATEFUL 0x0008 201 #define NPF_RULE_RETRST 0x0010 202 #define NPF_RULE_RETICMP 0x0020 203 #define NPF_RULE_DYNAMIC 0x0040 204 205 #define NPF_DYNAMIC_GROUP (NPF_RULE_GROUP | NPF_RULE_DYNAMIC) 206 207 #define NPF_RULE_IN 0x10000000 208 #define NPF_RULE_OUT 0x20000000 209 #define NPF_RULE_DIMASK (NPF_RULE_IN | NPF_RULE_OUT) 210 #define NPF_RULE_FORW 0x40000000 211 212 #define NPF_RULE_MAXNAMELEN 64 213 #define NPF_RULE_MAXKEYLEN 32 214 215 /* Priority values. */ 216 #define NPF_PRI_FIRST (-2) 217 #define NPF_PRI_LAST (-1) 218 219 /* Types of code. */ 220 #define NPF_CODE_NC 1 221 #define NPF_CODE_BPF 2 222 223 /* Address translation types and flags. */ 224 #define NPF_NATIN 1 225 #define NPF_NATOUT 2 226 227 #define NPF_NAT_PORTS 0x01 228 #define NPF_NAT_PORTMAP 0x02 229 230 /* Table types. */ 231 #define NPF_TABLE_HASH 1 232 #define NPF_TABLE_TREE 2 233 234 #define NPF_TABLE_MAXNAMELEN 32 235 236 /* Layers. */ 237 #define NPF_LAYER_2 2 238 #define NPF_LAYER_3 3 239 240 /* XXX mbuf.h: just for now. */ 241 #define PACKET_TAG_NPF 10 242 243 /* 244 * Rule commands (non-ioctl). 245 */ 246 247 #define NPF_CMD_RULE_ADD 1 248 #define NPF_CMD_RULE_INSERT 2 249 #define NPF_CMD_RULE_REMOVE 3 250 #define NPF_CMD_RULE_REMKEY 4 251 #define NPF_CMD_RULE_LIST 5 252 #define NPF_CMD_RULE_FLUSH 6 253 254 /* 255 * NPF ioctl(2): table commands and structures. 256 */ 257 258 #define NPF_CMD_TABLE_LOOKUP 1 259 #define NPF_CMD_TABLE_ADD 2 260 #define NPF_CMD_TABLE_REMOVE 3 261 #define NPF_CMD_TABLE_LIST 4 262 #define NPF_CMD_TABLE_FLUSH 5 263 264 typedef struct npf_ioctl_ent { 265 int alen; 266 npf_addr_t addr; 267 npf_netmask_t mask; 268 } npf_ioctl_ent_t; 269 270 typedef struct npf_ioctl_buf { 271 void * buf; 272 size_t len; 273 } npf_ioctl_buf_t; 274 275 typedef struct npf_ioctl_table { 276 int nct_cmd; 277 const char * nct_name; 278 union { 279 npf_ioctl_ent_t ent; 280 npf_ioctl_buf_t buf; 281 } nct_data; 282 } npf_ioctl_table_t; 283 284 /* 285 * IOCTL operations. 286 */ 287 288 #define IOC_NPF_VERSION _IOR('N', 100, int) 289 #define IOC_NPF_SWITCH _IOW('N', 101, int) 290 #define IOC_NPF_RELOAD _IOWR('N', 102, struct plistref) 291 #define IOC_NPF_TABLE _IOW('N', 103, struct npf_ioctl_table) 292 #define IOC_NPF_STATS _IOW('N', 104, void *) 293 #define IOC_NPF_SESSIONS_SAVE _IOR('N', 105, struct plistref) 294 #define IOC_NPF_SESSIONS_LOAD _IOW('N', 106, struct plistref) 295 #define IOC_NPF_RULE _IOWR('N', 107, struct plistref) 296 #define IOC_NPF_GETCONF _IOR('N', 108, struct plistref) 297 298 /* 299 * Statistics counters. 300 */ 301 302 typedef enum { 303 /* Packets passed. */ 304 NPF_STAT_PASS_DEFAULT, 305 NPF_STAT_PASS_RULESET, 306 NPF_STAT_PASS_SESSION, 307 /* Packets blocked. */ 308 NPF_STAT_BLOCK_DEFAULT, 309 NPF_STAT_BLOCK_RULESET, 310 /* Session and NAT entries. */ 311 NPF_STAT_SESSION_CREATE, 312 NPF_STAT_SESSION_DESTROY, 313 NPF_STAT_NAT_CREATE, 314 NPF_STAT_NAT_DESTROY, 315 /* Invalid state cases. */ 316 NPF_STAT_INVALID_STATE, 317 NPF_STAT_INVALID_STATE_TCP1, 318 NPF_STAT_INVALID_STATE_TCP2, 319 NPF_STAT_INVALID_STATE_TCP3, 320 /* Raced packets. */ 321 NPF_STAT_RACE_SESSION, 322 NPF_STAT_RACE_NAT, 323 /* Fragments. */ 324 NPF_STAT_FRAGMENTS, 325 NPF_STAT_REASSEMBLY, 326 NPF_STAT_REASSFAIL, 327 /* Other errors. */ 328 NPF_STAT_ERROR, 329 /* nbuf non-contiguous cases. */ 330 NPF_STAT_NBUF_NONCONTIG, 331 NPF_STAT_NBUF_CONTIG_FAIL, 332 /* Count (last). */ 333 NPF_STATS_COUNT 334 } npf_stats_t; 335 336 #define NPF_STATS_SIZE (sizeof(uint64_t) * NPF_STATS_COUNT) 337 338 #endif /* _NPF_NET_H_ */ 339