release/src/router/shared/netconf.h

   1 /*
   2  * Network configuration layer
   3  *
   4  * Copyright (C) 2010, Broadcom Corporation. All Rights Reserved.
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  13  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  15  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  16  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  *
  18  * $Id: netconf.h 241398 2011-02-18 03:46:33Z stakita $
  19  */
  20
  21 #ifndef _netconf_h_
  22 #define _netconf_h_
  23
  24 #include <sys/types.h>
  25 #include <sys/socket.h>
  26 #include <netinet/in.h>
  27 #include <net/if.h>
  28
  29 #include <typedefs.h>
  30 #include <proto/ethernet.h>
  31
  32 #include <bcmconfig.h>
  33
  34 /* Supported match states */
  35 #define NETCONF_INVALID         0x01    /* Packet could not be classified */
  36 #define NETCONF_ESTABLISHED     0x02    /* Packet is related to an existing connection */
  37 #define NETCONF_RELATED         0x04    /* Packet is part of an established connection */
  38 #define NETCONF_NEW             0x08    /* Packet is trying to establish a new connection */
  39
  40 /* Supported match flags */
  41 #define NETCONF_INV_SRCIP       0x01    /* Invert the sense of source IP address */
  42 #define NETCONF_INV_DSTIP       0x02    /* Invert the sense of destination IP address */
  43 #define NETCONF_INV_SRCPT       0x04    /* Invert the sense of source port range */
  44 #define NETCONF_INV_DSTPT       0x08    /* Invert the sense of destination port range */
  45 #define NETCONF_INV_MAC         0x10    /* Invert the sense of source MAC address */
  46 #define NETCONF_INV_IN          0x20    /* Invert the sense of inbound interface */
  47 #define NETCONF_INV_OUT         0x40    /* Invert the sense of outbound interface */
  48 #define NETCONF_INV_STATE       0x80    /* Invert the sense of state */
  49 #define NETCONF_INV_DAYS        0x100   /* Invert the sense of day of the week */
  50 #define NETCONF_INV_SECS        0x200   /* Invert the sense of time of day */
  51
  52 #define NETCONF_DISABLED        0x80000000 /* Entry is disabled */
  53
  54
  55 /* Cone NAT, Otherwise Symmetric NAT */
  56 /* Please remember, the value 0x800 is in continuation with
  57  * the NFC_IP_XXX codes defined in linux/linux/inxlude/linux/netfilter_ipv4.h.
  58  * So, we need to keep both NETCONF_CONE_NAT here and NFC_IP_CONE_NAT
  59  * in netfilter_ipv4.h in sync.
  60  */
  61 #define NETCONF_CONE_NAT         0x0800
  62
  63 /* Match description */
  64 typedef struct _netconf_match_t {
  65         int ipproto;                    /* IP protocol (TCP/UDP) */
  66         struct {
  67                 struct in_addr ipaddr;  /* Match by IP address */
  68                 struct in_addr netmask;
  69                 uint16 ports[2];        /* Match by TCP/UDP port range */
  70         } src, dst;
  71         struct ether_addr mac;          /* Match by source MAC address */
  72         struct {
  73                 char name[IFNAMSIZ];    /* Match by interface name */
  74         } in, out;
  75         int state;                      /* Match by packet state */
  76         int flags;                      /* Match flags */
  77         uint days[2];                   /* Match by day of the week (local time) (Sunday == 0) */
  78         uint secs[2];                   /* Match by time of day (local time) (12:00 AM == 0) */
  79         struct _netconf_match_t *next, *prev;
  80 } netconf_match_t;
  81
  82 #ifndef __CONFIG_IPV6__
  83 #define netconf_valid_ipproto(ipproto) \
  84         ((ipproto == 0) || (ipproto) == IPPROTO_TCP || (ipproto) == IPPROTO_UDP)
  85 #else
  86 #define netconf_valid_ipproto(ipproto) \
  87         ((ipproto == 0) || (ipproto) == IPPROTO_TCP || (ipproto) == IPPROTO_UDP || \
  88         (ipproto) == IPPROTO_IPV6)
  89 #endif /* __CONFIG_IPV6__ */
  90
  91 /* Supported firewall target types */
  92 enum netconf_target {
  93         NETCONF_DROP,                   /* Drop packet (filter) */
  94         NETCONF_ACCEPT,                 /* Accept packet (filter) */
  95         NETCONF_LOG_DROP,               /* Log and drop packet (filter) */
  96         NETCONF_LOG_ACCEPT,             /* Log and accept packet (filter) */
  97         NETCONF_SNAT,                   /* Source NAT (nat) */
  98         NETCONF_DNAT,                   /* Destination NAT (nat) */
  99         NETCONF_MASQ,                   /* IP masquerade (nat) */
 100         NETCONF_APP,                    /* Application specific port forward (app) */
 101         NETCONF_TARGET_MAX
 102 };
 103
 104 #define netconf_valid_filter(target) \
 105         ((target) == NETCONF_DROP || (target) == NETCONF_ACCEPT || \
 106          (target) == NETCONF_LOG_DROP || (target) == NETCONF_LOG_ACCEPT)
 107
 108 #define netconf_valid_nat(target) \
 109         ((target) == NETCONF_SNAT || (target) == NETCONF_DNAT || (target) == NETCONF_MASQ)
 110
 111 #define netconf_valid_target(target) \
 112         ((target) >= 0 && (target) < NETCONF_TARGET_MAX)
 113
 114 #define NETCONF_FW_COMMON \
 115         netconf_match_t match;          /* Match type */ \
 116         enum netconf_target target;     /* Target type */ \
 117         char desc[40];                  /* String description */ \
 118         struct _netconf_fw_t *next, *prev \
 119
 120 /* Generic firewall entry description */
 121 typedef struct _netconf_fw_t {
 122         NETCONF_FW_COMMON;
 123         char data[0];                   /* Target specific */
 124 } netconf_fw_t;
 125
 126 /* Supported filter directions */
 127 enum netconf_dir {
 128         NETCONF_IN,                     /* Packets destined for the firewall */
 129         NETCONF_FORWARD,                /* Packets routed through the firewall */
 130         NETCONF_OUT,                    /* Packets generated by the firewall */
 131         NETCONF_DIR_MAX
 132 };
 133
 134 #define netconf_valid_dir(dir) \
 135         ((dir) >= 0 && (dir) < NETCONF_DIR_MAX)
 136
 137 /* Filter target firewall entry description */
 138 typedef struct _netconf_filter_t {
 139         NETCONF_FW_COMMON;
 140         enum netconf_dir dir;           /* Direction to filter */
 141 } netconf_filter_t;
 142
 143 #ifdef __CONFIG_URLFILTER__
 144 /* URL filter entry description */
 145 typedef struct _netconf_urlfilter_t {
 146         NETCONF_FW_COMMON;
 147         char url[256];
 148 } netconf_urlfilter_t;
 149 #endif /* __CONFIG_URLFILTER__ */
 150
 151 /* NAT target firewall entry description */
 152 typedef struct _netconf_nat_t {
 153         NETCONF_FW_COMMON;
 154         unsigned int type;              /* Indicates Cone/Symmetric NAT */
 155         struct in_addr ipaddr;          /* Address to map packet to */
 156         uint16 ports[2];                /* Port(s) to map packet to (network order) */
 157 } netconf_nat_t;
 158
 159 /* Application specific port forward description */
 160 typedef struct _netconf_app_t {
 161         NETCONF_FW_COMMON;
 162         uint16 proto;           /* Related protocol */
 163         uint16 dport[2];        /* Related destination port(s) (network order) */
 164         uint16 to[2];           /* Port(s) to map related destination port to (network order) */
 165 } netconf_app_t;
 166
 167 /* Match description for Media traffic management */
 168 typedef struct _netconf_trmgmt_t {
 169         NETCONF_FW_COMMON;
 170         uint16 prio;             /* Priority */
 171         uint16 favored;          /* Flags */
 172 } netconf_trmgmt_t;
 173
 174 /* Generic doubly linked list processing macros */
 175 #define netconf_list_init(head) ((head)->next = (head)->prev = (head))
 176
 177 #define netconf_list_empty(head) ((head)->next == (head))
 178
 179 #define netconf_list_add(new, head) do { \
 180         (head)->next->prev = (new); \
 181         (new)->next = (head)->next; \
 182         (new)->prev = (head); \
 183         (head)->next = (new); \
 184 } while (0)
 185
 186 #define netconf_list_del(old) do { \
 187         (old)->next->prev = (old)->prev; \
 188         (old)->prev->next = (old)->next; \
 189 } while (0)
 190
 191 #define netconf_list_for_each(pos, head) \
 192         for ((pos) = (head)->next; (pos) != (head); (pos) = (pos)->next)
 193
 194 #define netconf_list_free(head) do { \
 195         typeof(head) pos, next; \
 196         for ((pos) = (head)->next; (pos) != (head); (pos) = next) { \
 197                 next = pos->next; \
 198                 netconf_list_del(pos); \
 199                 free(pos); \
 200         } \
 201 } while (0)
 202
 203 /*
 204  * Functions that work on arrays take a pointer to the array byte
 205  * length. If the length is zero, the function will set the length to
 206  * the number of bytes that must be provided to fulfill the
 207  * request. If the length is non-zero, then the array will be
 208  * constructed until the buffer length is exhausted or the request is
 209  * fulfilled.
 210  */
 211
 212 /*
 213  * Add a firewall entry
 214  * @param       fw      firewall entry
 215  * @return      0 on success and errno on failure
 216  */
 217 extern int netconf_add_fw(netconf_fw_t *fw);
 218
 219 /*
 220  * Delete a firewall entry
 221  * @param       fw      firewall entry
 222  * @return      0 on success and errno on failure
 223  */
 224 extern int netconf_del_fw(netconf_fw_t *fw);
 225
 226 /*
 227  * Get a list of the current firewall entries
 228  * @param       fw_list         list of firewall entries
 229  * @return      0 on success and errno on failure
 230  */
 231 extern int netconf_get_fw(netconf_fw_t *fw_list);
 232
 233 /*
 234  * See if a given firewall entry already exists
 235  * @param       nat     NAT entry to look for
 236  * @return      whether NAT entry exists
 237  */
 238 extern int netconf_fw_exists(netconf_fw_t *fw);
 239
 240 /*
 241  * Reset the firewall to a sane state
 242  * @return 0 on success and errno on failure
 243  */
 244 extern int netconf_reset_fw(void);
 245
 246 /*
 247  * Add a NAT entry or list of NAT entries
 248  * @param       nat_list        NAT entry or list of NAT entries
 249  * @return      0 on success and errno on failure
 250  */
 251 extern int netconf_add_nat(netconf_nat_t *nat_list);
 252
 253 /*
 254  * Delete a NAT entry or list of NAT entries
 255  * @param       nat_list        NAT entry or list of NAT entries
 256  * @return      0 on success and errno on failure
 257  */
 258 extern int netconf_del_nat(netconf_nat_t *nat_list);
 259
 260 /*
 261  * Get an array of the current NAT entries
 262  * @param       nat_array       array of NAT entries
 263  * @param       space           Pointer to size of nat_array in bytes
 264  * @return 0 on success and errno on failure
 265  */
 266 extern int netconf_get_nat(netconf_nat_t *nat_array, int *space);
 267
 268 /*
 269  * Add a filter entry or list of filter entries
 270  * @param       filter_list     filter entry or list of filter entries
 271  * @return      0 on success and errno on failure
 272  */
 273 extern int netconf_add_filter(netconf_filter_t *filter_list);
 274
 275 /*
 276  * Delete a filter entry or list of filter entries
 277  * @param       filter_list     filter entry or list of filter entries
 278  * @return      0 on success and errno on failure
 279  */
 280 extern int netconf_del_filter(netconf_filter_t *filter_list);
 281
 282 /*
 283  * Get an array of the current filter entries
 284  * @param       filter_array    array of filter entries
 285  * @param       space           Pointer to size of filter_array in bytes
 286  * @return 0 on success and errno on failure
 287  */
 288 extern int netconf_get_filter(netconf_filter_t *filter_array, int *space);
 289
 290 extern int netconf_clamp_mss_to_pmtu(void);
 291
 292
 293 #endif /* _netconf_h_ */