1 /* $NetBSD: npf.h,v 1.30 2013/03/11 17:20:02 christos Exp $ */ 2 3 /*- 4 * Copyright (c) 2009-2013 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /* 33 * Public NPF interfaces. 34 */ 35 36 #ifndef _NPF_NET_H_ 37 #define _NPF_NET_H_ 38 39 #include <sys/param.h> 40 #include <sys/types.h> 41 42 #include <sys/ioctl.h> 43 #include <prop/proplib.h> 44 45 #include <netinet/in_systm.h> 46 #include <netinet/in.h> 47 48 #define NPF_VERSION 9 49 50 /* 51 * Public declarations and definitions. 52 */ 53 54 /* Storage of address (both for IPv4 and IPv6) and netmask */ 55 typedef struct in6_addr npf_addr_t; 56 typedef uint8_t npf_netmask_t; 57 58 #define NPF_MAX_NETMASK (128) 59 #define NPF_NO_NETMASK ((npf_netmask_t)~0) 60 61 #if defined(_KERNEL) 62 63 #define NPF_DECISION_BLOCK 0 64 #define NPF_DECISION_PASS 1 65 66 #define NPF_EXT_MODULE(name, req) \ 67 MODULE(MODULE_CLASS_MISC, name, (sizeof(req) - 1) ? ("npf," req) : "npf") 68 69 /* 70 * Packet information cache. 71 */ 72 #include <net/if.h> 73 #include <netinet/ip.h> 74 #include <netinet/ip6.h> 75 #include <netinet/tcp.h> 76 #include <netinet/udp.h> 77 #include <netinet/ip_icmp.h> 78 #include <netinet/icmp6.h> 79 80 #define NPC_IP4 0x01 /* Indicates fetched IPv4 header. */ 81 #define NPC_IP6 0x02 /* Indicates IPv6 header. */ 82 #define NPC_IPFRAG 0x04 /* IPv4/IPv6 fragment. */ 83 #define NPC_LAYER4 0x08 /* Layer 4 has been fetched. */ 84 85 #define NPC_TCP 0x10 /* TCP header. */ 86 #define NPC_UDP 0x20 /* UDP header. */ 87 #define NPC_ICMP 0x40 /* ICMP header. */ 88 #define NPC_ICMP_ID 0x80 /* ICMP with query ID. */ 89 90 #define NPC_ALG_EXEC 0x100 /* ALG execution. */ 91 92 #define NPC_IP46 (NPC_IP4|NPC_IP6) 93 94 typedef struct { 95 /* Information flags. */ 96 uint32_t npc_info; 97 /* Pointers to the IP v4/v6 addresses. */ 98 npf_addr_t * npc_srcip; 99 npf_addr_t * npc_dstip; 100 /* Size (v4 or v6) of IP addresses. */ 101 uint8_t npc_alen; 102 uint8_t npc_hlen; 103 uint16_t npc_proto; 104 /* IPv4, IPv6. */ 105 union { 106 struct ip * v4; 107 struct ip6_hdr * v6; 108 } npc_ip; 109 /* TCP, UDP, ICMP. */ 110 union { 111 struct tcphdr * tcp; 112 struct udphdr * udp; 113 struct icmp * icmp; 114 struct icmp6_hdr * icmp6; 115 void * hdr; 116 } npc_l4; 117 } npf_cache_t; 118 119 static inline bool 120 npf_iscached(const npf_cache_t *npc, const int inf) 121 { 122 return __predict_true((npc->npc_info & inf) != 0); 123 } 124 125 /* 126 * Network buffer interface. 127 */ 128 129 #define NBUF_DATAREF_RESET 0x01 130 131 typedef struct { 132 struct mbuf * nb_mbuf0; 133 struct mbuf * nb_mbuf; 134 void * nb_nptr; 135 const ifnet_t * nb_ifp; 136 int nb_flags; 137 } nbuf_t; 138 139 void nbuf_init(nbuf_t *, struct mbuf *, const ifnet_t *); 140 void nbuf_reset(nbuf_t *); 141 struct mbuf * nbuf_head_mbuf(nbuf_t *); 142 143 bool nbuf_flag_p(const nbuf_t *, int); 144 void nbuf_unset_flag(nbuf_t *, int); 145 146 void * nbuf_dataptr(nbuf_t *); 147 size_t nbuf_offset(const nbuf_t *); 148 void * nbuf_advance(nbuf_t *, size_t, size_t); 149 150 void * nbuf_ensure_contig(nbuf_t *, size_t); 151 void * nbuf_ensure_writable(nbuf_t *, size_t); 152 153 bool nbuf_cksum_barrier(nbuf_t *, int); 154 int nbuf_add_tag(nbuf_t *, uint32_t, uint32_t); 155 int nbuf_find_tag(nbuf_t *, uint32_t, void **); 156 157 /* 158 * NPF extensions and rule procedure interface. 159 */ 160 161 struct npf_rproc; 162 typedef struct npf_rproc npf_rproc_t; 163 164 void npf_rproc_assign(npf_rproc_t *, void *); 165 166 typedef struct { 167 unsigned int version; 168 void * ctx; 169 int (*ctor)(npf_rproc_t *, prop_dictionary_t); 170 void (*dtor)(npf_rproc_t *, void *); 171 void (*proc)(npf_cache_t *, nbuf_t *, void *, int *); 172 } npf_ext_ops_t; 173 174 void * npf_ext_register(const char *, const npf_ext_ops_t *); 175 int npf_ext_unregister(void *); 176 177 /* 178 * Misc. 179 */ 180 181 bool npf_autounload_p(void); 182 183 #endif /* _KERNEL */ 184 185 /* Rule attributes. */ 186 #define NPF_RULE_PASS 0x0001 187 #define NPF_RULE_GROUP 0x0002 188 #define NPF_RULE_FINAL 0x0004 189 #define NPF_RULE_STATEFUL 0x0008 190 #define NPF_RULE_RETRST 0x0010 191 #define NPF_RULE_RETICMP 0x0020 192 #define NPF_RULE_DYNAMIC 0x0040 193 194 #define NPF_DYNAMIC_GROUP (NPF_RULE_GROUP | NPF_RULE_DYNAMIC) 195 196 #define NPF_RULE_IN 0x10000000 197 #define NPF_RULE_OUT 0x20000000 198 #define NPF_RULE_DIMASK (NPF_RULE_IN | NPF_RULE_OUT) 199 #define NPF_RULE_FORW 0x40000000 200 201 #define NPF_RULE_MAXNAMELEN 64 202 #define NPF_RULE_MAXKEYLEN 32 203 204 /* Priority values. */ 205 #define NPF_PRI_FIRST (-2) 206 #define NPF_PRI_LAST (-1) 207 208 /* Types of code. */ 209 #define NPF_CODE_NC 1 210 #define NPF_CODE_BPF 2 211 212 /* Address translation types and flags. */ 213 #define NPF_NATIN 1 214 #define NPF_NATOUT 2 215 216 #define NPF_NAT_PORTS 0x01 217 #define NPF_NAT_PORTMAP 0x02 218 219 /* Table types. */ 220 #define NPF_TABLE_HASH 1 221 #define NPF_TABLE_TREE 2 222 223 /* Layers. */ 224 #define NPF_LAYER_2 2 225 #define NPF_LAYER_3 3 226 227 /* XXX mbuf.h: just for now. */ 228 #define PACKET_TAG_NPF 10 229 230 /* 231 * Rule commands (non-ioctl). 232 */ 233 234 #define NPF_CMD_RULE_ADD 1 235 #define NPF_CMD_RULE_INSERT 2 236 #define NPF_CMD_RULE_REMOVE 3 237 #define NPF_CMD_RULE_REMKEY 4 238 #define NPF_CMD_RULE_LIST 5 239 #define NPF_CMD_RULE_FLUSH 6 240 241 /* 242 * NPF ioctl(2): table commands and structures. 243 */ 244 245 #define NPF_CMD_TABLE_LOOKUP 1 246 #define NPF_CMD_TABLE_ADD 2 247 #define NPF_CMD_TABLE_REMOVE 3 248 #define NPF_CMD_TABLE_LIST 4 249 #define NPF_CMD_TABLE_FLUSH 5 250 251 typedef struct npf_ioctl_ent { 252 int alen; 253 npf_addr_t addr; 254 npf_netmask_t mask; 255 } npf_ioctl_ent_t; 256 257 typedef struct npf_ioctl_buf { 258 void * buf; 259 size_t len; 260 } npf_ioctl_buf_t; 261 262 typedef struct npf_ioctl_table { 263 int nct_cmd; 264 u_int nct_tid; 265 union { 266 npf_ioctl_ent_t ent; 267 npf_ioctl_buf_t buf; 268 } nct_data; 269 } npf_ioctl_table_t; 270 271 /* 272 * IOCTL operations. 273 */ 274 275 #define IOC_NPF_VERSION _IOR('N', 100, int) 276 #define IOC_NPF_SWITCH _IOW('N', 101, int) 277 #define IOC_NPF_RELOAD _IOWR('N', 102, struct plistref) 278 #define IOC_NPF_TABLE _IOW('N', 103, struct npf_ioctl_table) 279 #define IOC_NPF_STATS _IOW('N', 104, void *) 280 #define IOC_NPF_SESSIONS_SAVE _IOR('N', 105, struct plistref) 281 #define IOC_NPF_SESSIONS_LOAD _IOW('N', 106, struct plistref) 282 #define IOC_NPF_RULE _IOWR('N', 107, struct plistref) 283 #define IOC_NPF_GETCONF _IOR('N', 108, struct plistref) 284 285 /* 286 * Statistics counters. 287 */ 288 289 typedef enum { 290 /* Packets passed. */ 291 NPF_STAT_PASS_DEFAULT, 292 NPF_STAT_PASS_RULESET, 293 NPF_STAT_PASS_SESSION, 294 /* Packets blocked. */ 295 NPF_STAT_BLOCK_DEFAULT, 296 NPF_STAT_BLOCK_RULESET, 297 /* Session and NAT entries. */ 298 NPF_STAT_SESSION_CREATE, 299 NPF_STAT_SESSION_DESTROY, 300 NPF_STAT_NAT_CREATE, 301 NPF_STAT_NAT_DESTROY, 302 /* Invalid state cases. */ 303 NPF_STAT_INVALID_STATE, 304 NPF_STAT_INVALID_STATE_TCP1, 305 NPF_STAT_INVALID_STATE_TCP2, 306 NPF_STAT_INVALID_STATE_TCP3, 307 /* Raced packets. */ 308 NPF_STAT_RACE_SESSION, 309 NPF_STAT_RACE_NAT, 310 /* Fragments. */ 311 NPF_STAT_FRAGMENTS, 312 NPF_STAT_REASSEMBLY, 313 NPF_STAT_REASSFAIL, 314 /* Other errors. */ 315 NPF_STAT_ERROR, 316 /* nbuf non-contiguous cases. */ 317 NPF_STAT_NBUF_NONCONTIG, 318 NPF_STAT_NBUF_CONTIG_FAIL, 319 /* Count (last). */ 320 NPF_STATS_COUNT 321 } npf_stats_t; 322 323 #define NPF_STATS_SIZE (sizeof(uint64_t) * NPF_STATS_COUNT) 324 325 #endif /* _NPF_NET_H_ */ 326