2 * Copyright (C) 1995-2001 by Darren Reed.
4 * See the IPFILTER.LICENCE file for details on licencing.
6 * @(#)ip_state.h 1.3 1/12/96 (C) 1995 Darren Reed
7 * $Id: ip_state.h,v 2.68.2.5 2005/08/11 19:58:04 darrenr Exp $
9 * Copyright 2010 Sun Microsystems, Inc. All rights reserved.
10 * Use is subject to license terms.
13 #ifndef __IP_STATE_H__
14 #define __IP_STATE_H__
16 #if defined(__STDC__) || defined(__GNUC__) || defined(_AIX51)
17 # define SIOCDELST _IOW('r', 61, struct ipfobj)
19 # define SIOCDELST _IOW(r, 61, struct ipfobj)
25 # define IPSTATE_SIZE 5737
28 # define IPSTATE_MAX 50000 /* Maximum number of states held */
31 #define PAIRS(s1,d1,s2,d2) ((((s1) == (s2)) && ((d1) == (d2))) ||\
32 (((s1) == (d2)) && ((d1) == (s2))))
33 #define IPPAIR(s1,d1,s2,d2) PAIRS((s1).s_addr, (d1).s_addr, \
34 (s2).s_addr, (d2).s_addr)
37 typedef struct ipstate
{
39 struct ipstate
*is_next
;
40 struct ipstate
**is_pnext
;
41 struct ipstate
*is_hnext
;
42 struct ipstate
**is_phnext
;
43 struct ipstate
**is_me
;
46 struct nat
*is_nat
[2];
48 struct ipftq
*is_tqehead
[2];
49 struct ipscan
*is_isc
;
52 U_QUAD_T is_icmppkts
[4];
53 struct ipftqent is_sti
;
55 int is_ref
; /* reference count */
61 u_char is_p
; /* Protocol */
65 u_32_t is_opt
[2]; /* packet options set */
66 /* in both directions */
67 u_32_t is_optmsk
[2]; /* " " mask */
68 /* in both directions */
69 u_short is_sec
; /* security options set */
70 u_short is_secmsk
; /* " " mask */
71 u_short is_auth
; /* authentication options set */
72 u_short is_authmsk
; /* " " mask */
81 u_32_t is_rulen
; /* rule number when created */
84 char is_group
[FR_GROUPLEN
];
86 char is_ifname
[4][LIFNAMSIZ
];
89 #define is_die is_sti.tqe_die
90 #define is_state is_sti.tqe_state
91 #define is_saddr is_src.in4.s_addr
92 #define is_daddr is_dst.in4.s_addr
93 #define is_icmp is_ps.is_ics
94 #define is_type is_icmp.ici_type
95 #define is_code is_icmp.ici_code
96 #define is_tcp is_ps.is_ts
97 #define is_udp is_ps.is_us
98 #define is_send is_tcp.ts_data[0].td_end
99 #define is_dend is_tcp.ts_data[1].td_end
100 #define is_maxswin is_tcp.ts_data[0].td_maxwin
101 #define is_maxdwin is_tcp.ts_data[1].td_maxwin
102 #define is_maxsend is_tcp.ts_data[0].td_maxend
103 #define is_maxdend is_tcp.ts_data[1].td_maxend
104 #define is_swinscale is_tcp.ts_data[0].td_winscale
105 #define is_dwinscale is_tcp.ts_data[1].td_winscale
106 #define is_swinflags is_tcp.ts_data[0].td_winflags
107 #define is_dwinflags is_tcp.ts_data[1].td_winflags
108 #define is_sport is_tcp.ts_sport
109 #define is_dport is_tcp.ts_dport
110 #define is_ifpin is_ifp[0]
111 #define is_ifpout is_ifp[2]
112 #define is_gre is_ps.is_ug
113 #define is_call is_gre.gs_call
115 #define IS_WSPORT SI_W_SPORT /* 0x00100 */
116 #define IS_WDPORT SI_W_DPORT /* 0x00200 */
117 #define IS_WSADDR SI_W_SADDR /* 0x00400 */
118 #define IS_WDADDR SI_W_DADDR /* 0x00800 */
119 #define IS_NEWFR SI_NEWFR /* 0x01000 */
120 #define IS_CLONE SI_CLONE /* 0x02000 */
121 #define IS_CLONED SI_CLONED /* 0x04000 */
122 #define IS_TCPFSM 0x10000
123 #define IS_STRICT 0x20000
124 #define IS_ISNSYN 0x40000
125 #define IS_ISNACK 0x80000
126 #define IS_STATESYNC 0x100000
128 * IS_SC flags are for scan-operations that need to be recognised in state.
130 #define IS_SC_CLIENT 0x10000000
131 #define IS_SC_SERVER 0x20000000
132 #define IS_SC_MATCHC 0x40000000
133 #define IS_SC_MATCHS 0x80000000
134 #define IS_SC_MATCHALL (IS_SC_MATCHC|IS_SC_MATCHC)
135 #define IS_SC_ALL (IS_SC_MATCHC|IS_SC_MATCHC|IS_SC_CLIENT|IS_SC_SERVER)
138 * Flags that can be passed into fr_addstate
140 #define IS_INHERITED 0x0fffff00
142 #define TH_OPENING (TH_SYN|TH_ACK)
145 * Bits 0 - 3 are use as a mask with the current packet's bits to check for
146 * whether it is short, tcp/udp, a fragment or the presence of IP options.
147 * Bits 4 - 7 are set from the initial packet and contain what the packet
148 * anded with bits 0-3 must match.
149 * Bits 8,9 are used to indicate wildcard source/destination port matching.
150 * Bits 10,11 are reserved for other wildcard flag compatibility.
151 * Bits 12,13 are for scaning.
154 typedef struct ipstate_save
{
156 struct ipstate ips_is
;
157 struct frentry ips_fr
;
160 #define ips_rule ips_is.is_rule
163 typedef struct ipslog
{
164 U_QUAD_T isl_pkts
[4];
165 U_QUAD_T isl_bytes
[4];
171 u_short isl_filler
[2];
172 u_short isl_ports
[2];
180 char isl_group
[FR_GROUPLEN
];
183 #define isl_sport isl_ps.isl_ports[0]
184 #define isl_dport isl_ps.isl_ports[1]
185 #define isl_itype isl_ps.isl_icmp
189 #define ISL_EXPIRE 0xffff
190 #define ISL_FLUSH 0xfffe
191 #define ISL_REMOVE 0xfffd
192 #define ISL_INTERMEDIATE 0xfffc
193 #define ISL_KILLED 0xfffb
194 #define ISL_ORPHAN 0xfffa
197 typedef struct ips_stat
{
215 u_long iss_bucketfull
;
218 ipstate_t
**iss_table
;
220 u_long
*iss_bucketlen
;
224 typedef struct port_pair
{
229 extern int fr_stateinit
__P((ipf_stack_t
*));
230 extern ipstate_t
*fr_addstate
__P((fr_info_t
*, ipstate_t
**, u_int
));
231 extern frentry_t
*fr_checkstate
__P((struct fr_info
*, u_32_t
*));
232 extern ipstate_t
*fr_stlookup
__P((fr_info_t
*, tcphdr_t
*, ipftq_t
**));
233 extern void fr_statesync
__P((int, int, void *, char *, ipf_stack_t
*));
234 extern void fr_timeoutstate
__P((ipf_stack_t
*));
235 extern int fr_tcp_age
__P((struct ipftqent
*, struct fr_info
*,
236 struct ipftq
*, int));
237 extern int fr_tcpinwindow
__P((struct fr_info
*, struct tcpdata
*,
238 struct tcpdata
*, tcphdr_t
*, int));
239 extern void fr_stateunload
__P((ipf_stack_t
*));
240 extern void ipstate_log
__P((struct ipstate
*, u_int
, ipf_stack_t
*));
241 extern int fr_state_ioctl
__P((caddr_t
, ioctlcmd_t
, int, int, void *, ipf_stack_t
*));
242 extern void fr_stinsert
__P((struct ipstate
*, int, ipf_stack_t
*));
243 extern void fr_sttab_init
__P((struct ipftq
*, ipf_stack_t
*));
244 extern void fr_sttab_destroy
__P((struct ipftq
*));
245 extern void fr_updatestate
__P((fr_info_t
*, ipstate_t
*, ipftq_t
*));
246 extern void fr_statederef
__P((ipstate_t
**, ipf_stack_t
*));
247 extern void fr_setstatequeue
__P((ipstate_t
*, int, ipf_stack_t
*));
248 extern int fr_delstate
__P((ipstate_t
*, int, ipf_stack_t
*));
250 extern void fr_stateifindexsync
__P((void *, void *, ipf_stack_t
*));
253 #endif /* __IP_STATE_H__ */