usr.sbin/pfctl/pfctl_parser.h

   1 /*      $OpenBSD: pfctl_parser.h,v 1.74 2004/02/10 22:26:56 dhartmei Exp $ */
   2 /*      $DragonFly: src/usr.sbin/pfctl/pfctl_parser.h,v 1.3 2008/04/11 18:21:49 dillon Exp $ */
   3
   4 /*
   5  * Copyright (c) 2001 Daniel Hartmeier
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  *    - Redistributions of source code must retain the above copyright
  13  *      notice, this list of conditions and the following disclaimer.
  14  *    - Redistributions in binary form must reproduce the above
  15  *      copyright notice, this list of conditions and the following
  16  *      disclaimer in the documentation and/or other materials provided
  17  *      with the distribution.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  20  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  21  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  22  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  23  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  24  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  25  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  26  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  27  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  29  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  30  * POSSIBILITY OF SUCH DAMAGE.
  31  *
  32  */
  33
  34 #ifndef _PFCTL_PARSER_H_
  35 #define _PFCTL_PARSER_H_
  36
  37 #define PF_OSFP_FILE            "/etc/pf.os"
  38
  39 #define PF_OPT_DISABLE          0x0001
  40 #define PF_OPT_ENABLE           0x0002
  41 #define PF_OPT_VERBOSE          0x0004
  42 #define PF_OPT_NOACTION         0x0008
  43 #define PF_OPT_QUIET            0x0010
  44 #define PF_OPT_CLRRULECTRS      0x0020
  45 #define PF_OPT_USEDNS           0x0040
  46 #define PF_OPT_VERBOSE2         0x0080
  47 #define PF_OPT_DUMMYACTION      0x0100
  48 #define PF_OPT_DEBUG            0x0200
  49 #define PF_OPT_SHOWALL          0x0400
  50
  51 #define PF_TH_ALL               0xFF
  52
  53 #define PF_NAT_PROXY_PORT_LOW   50001
  54 #define PF_NAT_PROXY_PORT_HIGH  65535
  55
  56 #define FCNT_NAMES { \
  57         "searches", \
  58         "inserts", \
  59         "removals", \
  60         NULL \
  61 }
  62
  63 struct pfctl {
  64         int dev;
  65         int opts;
  66         int loadopt;
  67         u_int32_t tticket;              /* table ticket */
  68         int tdirty;                     /* kernel dirty */
  69         u_int32_t rule_nr;
  70         struct pfioc_pooladdr paddr;
  71         struct pfioc_altq *paltq;
  72         struct pfioc_queue *pqueue;
  73         struct pfr_buffer *trans;
  74         const char *anchor;
  75         const char *ruleset;
  76 };
  77
  78 struct node_if {
  79         char                     ifname[IFNAMSIZ];
  80         u_int8_t                 not;
  81         u_int                    ifa_flags;
  82         struct node_if          *next;
  83         struct node_if          *tail;
  84 };
  85
  86 struct node_host {
  87         struct pf_addr_wrap      addr;
  88         struct pf_addr           bcast;
  89         struct pf_addr           peer;
  90         sa_family_t              af;
  91         u_int8_t                 not;
  92         u_int32_t                ifindex;       /* link-local IPv6 addrs */
  93         char                    *ifname;
  94         u_int                    ifa_flags;
  95         struct node_host        *next;
  96         struct node_host        *tail;
  97 };
  98 /* special flags used by ifa_exists */
  99 #define PF_IFA_FLAG_GROUP       0x10000
 100 #define PF_IFA_FLAG_DYNAMIC     0x20000
 101 #define PF_IFA_FLAG_CLONABLE    0x40000
 102
 103 struct node_os {
 104         char                    *os;
 105         pf_osfp_t                fingerprint;
 106         struct node_os          *next;
 107         struct node_os          *tail;
 108 };
 109
 110 struct node_queue_bw {
 111         u_int32_t       bw_absolute;
 112         u_int16_t       bw_percent;
 113 };
 114
 115 struct node_hfsc_sc {
 116         struct node_queue_bw    m1;     /* slope of 1st segment; bps */
 117         u_int                   d;      /* x-projection of m1; msec */
 118         struct node_queue_bw    m2;     /* slope of 2nd segment; bps */
 119         u_int8_t                used;
 120 };
 121
 122 struct node_hfsc_opts {
 123         struct node_hfsc_sc     realtime;
 124         struct node_hfsc_sc     linkshare;
 125         struct node_hfsc_sc     upperlimit;
 126         int                     flags;
 127 };
 128
 129 struct node_fairq_sc {
 130         struct node_queue_bw    m1;     /* slope of 1st segment; bps */
 131         u_int                   d;      /* x-projection of m1; msec */
 132         struct node_queue_bw    m2;     /* slope of 2nd segment; bps */
 133         u_int8_t                used;
 134 };
 135
 136 struct node_fairq_opts {
 137         struct node_fairq_sc    linkshare;
 138         struct node_queue_bw    hogs_bw;
 139         u_int                   nbuckets;
 140         int                     flags;
 141 };
 142
 143 struct node_queue_opt {
 144         int                      qtype;
 145         union {
 146                 struct cbq_opts         cbq_opts;
 147                 struct priq_opts        priq_opts;
 148                 struct node_hfsc_opts   hfsc_opts;
 149                 struct node_fairq_opts  fairq_opts;
 150         }                        data;
 151 };
 152
 153 /* XXX should be in machine/limits.h */
 154 #include <limits.h>
 155 #define UID_MAX UINT_MAX
 156 #define GID_MAX UINT_MAX
 157
 158 /*
 159  * XXX
 160  * Absolutely this is not correct location to define this.
 161  * Should we use an another sperate header file?
 162  * NOTE: This is also defined in sys/bus/usb/usb_port.h
 163  * perhaps place in sys/queue.h?
 164  */
 165 #define SIMPLEQ_HEAD                    STAILQ_HEAD
 166 #define SIMPLEQ_HEAD_INITIALIZER        STAILQ_HEAD_INITIALIZER
 167 #define SIMPLEQ_ENTRY                   STAILQ_ENTRY
 168 #define SIMPLEQ_FIRST                   STAILQ_FIRST
 169 #define SIMPLEQ_END(head)               NULL
 170 #define SIMPLEQ_EMPTY                   STAILQ_EMPTY
 171 #define SIMPLEQ_NEXT                    STAILQ_NEXT
 172 /*#define SIMPLEQ_FOREACH               STAILQ_FOREACH*/
 173 #define SIMPLEQ_FOREACH(var, head, field)       \
 174     for((var) = SIMPLEQ_FIRST(head);            \
 175         (var) != SIMPLEQ_END(head);             \
 176         (var) = SIMPLEQ_NEXT(var, field))
 177 #define SIMPLEQ_INIT                    STAILQ_INIT
 178 #define SIMPLEQ_INSERT_HEAD             STAILQ_INSERT_HEAD
 179 #define SIMPLEQ_INSERT_TAIL             STAILQ_INSERT_TAIL
 180 #define SIMPLEQ_INSERT_AFTER            STAILQ_INSERT_AFTER
 181 #define SIMPLEQ_REMOVE_HEAD             STAILQ_REMOVE_HEAD
 182
 183 SIMPLEQ_HEAD(node_tinithead, node_tinit);
 184 struct node_tinit {     /* table initializer */
 185         SIMPLEQ_ENTRY(node_tinit)        entries;
 186         struct node_host                *host;
 187         char                            *file;
 188 };
 189
 190 struct pfr_buffer;      /* forward definition */
 191
 192 int     pfctl_rules(int, char *, int, char *, char *, struct pfr_buffer *);
 193
 194 int     pfctl_add_rule(struct pfctl *, struct pf_rule *);
 195 int     pfctl_add_altq(struct pfctl *, struct pf_altq *);
 196 int     pfctl_add_pool(struct pfctl *, struct pf_pool *, sa_family_t);
 197 void    pfctl_clear_pool(struct pf_pool *);
 198
 199 int     pfctl_set_timeout(struct pfctl *, const char *, int, int);
 200 int     pfctl_set_optimization(struct pfctl *, const char *);
 201 int     pfctl_set_limit(struct pfctl *, const char *, unsigned int);
 202 int     pfctl_set_logif(struct pfctl *, char *);
 203 int     pfctl_set_hostid(struct pfctl *, u_int32_t);
 204 int     pfctl_set_debug(struct pfctl *, char *);
 205
 206 int     parse_rules(FILE *, struct pfctl *);
 207 int     parse_flags(const char *);
 208 int     pfctl_load_anchors(int, int, struct pfr_buffer *);
 209
 210 void    print_pool(struct pf_pool *, u_int16_t, u_int16_t, sa_family_t, int);
 211 void    print_src_node(struct pf_src_node *, int);
 212 void    print_rule(struct pf_rule *, int);
 213 void    print_tabledef(const char *, int, int, struct node_tinithead *);
 214 void    print_status(struct pf_status *, int);
 215
 216 int     eval_pfaltq(struct pfctl *, struct pf_altq *, struct node_queue_bw *,
 217             struct node_queue_opt *);
 218 int     eval_pfqueue(struct pfctl *, struct pf_altq *, struct node_queue_bw *,
 219             struct node_queue_opt *);
 220
 221 void     print_altq(const struct pf_altq *, unsigned, struct node_queue_bw *,
 222             struct node_queue_opt *);
 223 void     print_queue(const struct pf_altq *, unsigned, struct node_queue_bw *,
 224             int, struct node_queue_opt *);
 225
 226 int     pfctl_define_table(char *, int, int, const char *, const char *,
 227             struct pfr_buffer *, u_int32_t);
 228
 229 void             pfctl_clear_fingerprints(int, int);
 230 int              pfctl_file_fingerprints(int, int, const char *);
 231 pf_osfp_t        pfctl_get_fingerprint(const char *);
 232 int              pfctl_load_fingerprints(int, int);
 233 char            *pfctl_lookup_fingerprint(pf_osfp_t, char *, size_t);
 234 void             pfctl_show_fingerprints(int);
 235
 236
 237 struct icmptypeent {
 238         const char *name;
 239         u_int8_t type;
 240 };
 241
 242 struct icmpcodeent {
 243         const char *name;
 244         u_int8_t type;
 245         u_int8_t code;
 246 };
 247
 248 const struct icmptypeent *geticmptypebynumber(u_int8_t, u_int8_t);
 249 const struct icmptypeent *geticmptypebyname(char *, u_int8_t);
 250 const struct icmpcodeent *geticmpcodebynumber(u_int8_t, u_int8_t, u_int8_t);
 251 const struct icmpcodeent *geticmpcodebyname(u_long, char *, u_int8_t);
 252
 253 struct pf_timeout {
 254         const char      *name;
 255         int              timeout;
 256 };
 257
 258 #define PFCTL_FLAG_FILTER       0x02
 259 #define PFCTL_FLAG_NAT          0x04
 260 #define PFCTL_FLAG_OPTION       0x08
 261 #define PFCTL_FLAG_ALTQ         0x10
 262 #define PFCTL_FLAG_TABLE        0x20
 263
 264 extern const struct pf_timeout pf_timeouts[];
 265
 266 void                     set_ipmask(struct node_host *, u_int8_t);
 267 int                      check_netmask(struct node_host *, sa_family_t);
 268 void                     ifa_load(void);
 269 struct node_host        *ifa_exists(const char *, int);
 270 struct node_host        *ifa_lookup(const char *, int);
 271 struct node_host        *host(const char *);
 272
 273 int                      append_addr(struct pfr_buffer *, char *, int);
 274 int                      append_addr_host(struct pfr_buffer *,
 275                             struct node_host *, int, int);
 276
 277 #endif /* _PFCTL_PARSER_H_ */