ip_state.h revision 1.2.2.2
1 1.2.2.2 joerg /* $NetBSD: ip_state.h,v 1.2.2.2 2012/04/17 19:25:22 joerg Exp $ */ 2 1.2.2.2 joerg 3 1.2.2.2 joerg /* 4 1.2.2.2 joerg * Copyright (C) 2011 by Darren Reed. 5 1.2.2.2 joerg * 6 1.2.2.2 joerg * See the IPFILTER.LICENCE file for details on licencing. 7 1.2.2.2 joerg * 8 1.2.2.2 joerg * @(#)ip_state.h 1.3 1/12/96 (C) 1995 Darren Reed 9 1.2.2.2 joerg * Id: ip_state.h,v 2.95.2.4 2012/01/26 05:29:13 darrenr Exp 10 1.2.2.2 joerg */ 11 1.2.2.2 joerg #ifndef _NETINET_IP_STATE_H_ 12 1.2.2.2 joerg #define _NETINET_IP_STATE_H_ 13 1.2.2.2 joerg 14 1.2.2.2 joerg #if defined(__STDC__) || defined(__GNUC__) || defined(_AIX51) 15 1.2.2.2 joerg # define SIOCDELST _IOW('r', 61, struct ipfobj) 16 1.2.2.2 joerg #else 17 1.2.2.2 joerg # define SIOCDELST _IOW(r, 61, struct ipfobj) 18 1.2.2.2 joerg #endif 19 1.2.2.2 joerg 20 1.2.2.2 joerg struct ipscan; 21 1.2.2.2 joerg 22 1.2.2.2 joerg #ifndef IPSTATE_SIZE 23 1.2.2.2 joerg # define IPSTATE_SIZE 5737 24 1.2.2.2 joerg #endif 25 1.2.2.2 joerg #ifndef IPSTATE_MAX 26 1.2.2.2 joerg # define IPSTATE_MAX 4013 /* Maximum number of states held */ 27 1.2.2.2 joerg #endif 28 1.2.2.2 joerg 29 1.2.2.2 joerg #define PAIRS(s1,d1,s2,d2) ((((s1) == (s2)) && ((d1) == (d2))) ||\ 30 1.2.2.2 joerg (((s1) == (d2)) && ((d1) == (s2)))) 31 1.2.2.2 joerg #define IPPAIR(s1,d1,s2,d2) PAIRS((s1).s_addr, (d1).s_addr, \ 32 1.2.2.2 joerg (s2).s_addr, (d2).s_addr) 33 1.2.2.2 joerg 34 1.2.2.2 joerg 35 1.2.2.2 joerg typedef struct ipstate { 36 1.2.2.2 joerg ipfmutex_t is_lock; 37 1.2.2.2 joerg struct ipstate *is_next; 38 1.2.2.2 joerg struct ipstate **is_pnext; 39 1.2.2.2 joerg struct ipstate *is_hnext; 40 1.2.2.2 joerg struct ipstate **is_phnext; 41 1.2.2.2 joerg struct ipstate **is_me; 42 1.2.2.2 joerg void *is_ifp[4]; 43 1.2.2.2 joerg void *is_sync; 44 1.2.2.2 joerg frentry_t *is_rule; 45 1.2.2.2 joerg struct ipftq *is_tqehead[2]; 46 1.2.2.2 joerg struct ipscan *is_isc; 47 1.2.2.2 joerg U_QUAD_T is_pkts[4]; 48 1.2.2.2 joerg U_QUAD_T is_bytes[4]; 49 1.2.2.2 joerg U_QUAD_T is_icmppkts[4]; 50 1.2.2.2 joerg struct ipftqent is_sti; 51 1.2.2.2 joerg u_int is_frage[2]; 52 1.2.2.2 joerg int is_ref; /* reference count */ 53 1.2.2.2 joerg int is_isninc[2]; 54 1.2.2.2 joerg u_short is_sumd[2]; 55 1.2.2.2 joerg i6addr_t is_src; 56 1.2.2.2 joerg i6addr_t is_dst; 57 1.2.2.2 joerg u_int is_pass; 58 1.2.2.2 joerg u_char is_p; /* Protocol */ 59 1.2.2.2 joerg u_char is_v; 60 1.2.2.2 joerg int is_family; 61 1.2.2.2 joerg u_32_t is_hv; 62 1.2.2.2 joerg u_32_t is_tag; 63 1.2.2.2 joerg u_32_t is_opt[2]; /* packet options set */ 64 1.2.2.2 joerg u_32_t is_optmsk[2]; /* " " mask */ 65 1.2.2.2 joerg u_short is_sec; /* security options set */ 66 1.2.2.2 joerg u_short is_secmsk; /* " " mask */ 67 1.2.2.2 joerg u_short is_auth; /* authentication options set */ 68 1.2.2.2 joerg u_short is_authmsk; /* " " mask */ 69 1.2.2.2 joerg union { 70 1.2.2.2 joerg icmpinfo_t is_ics; 71 1.2.2.2 joerg tcpinfo_t is_ts; 72 1.2.2.2 joerg udpinfo_t is_us; 73 1.2.2.2 joerg greinfo_t is_ug; 74 1.2.2.2 joerg } is_ps; 75 1.2.2.2 joerg u_32_t is_flags; 76 1.2.2.2 joerg int is_flx[2][2]; 77 1.2.2.2 joerg u_32_t is_rulen; /* rule number when created */ 78 1.2.2.2 joerg u_32_t is_s0[2]; 79 1.2.2.2 joerg u_short is_smsk[2]; 80 1.2.2.2 joerg frdest_t is_dif; 81 1.2.2.2 joerg frdest_t is_tifs[2]; 82 1.2.2.2 joerg char is_group[FR_GROUPLEN]; 83 1.2.2.2 joerg char is_sbuf[2][16]; 84 1.2.2.2 joerg char is_ifname[4][LIFNAMSIZ]; 85 1.2.2.2 joerg } ipstate_t; 86 1.2.2.2 joerg 87 1.2.2.2 joerg #define is_die is_sti.tqe_die 88 1.2.2.2 joerg #define is_state is_sti.tqe_state 89 1.2.2.2 joerg #define is_touched is_sti.tqe_touched 90 1.2.2.2 joerg #define is_saddr is_src.in4.s_addr 91 1.2.2.2 joerg #define is_daddr is_dst.in4.s_addr 92 1.2.2.2 joerg #define is_icmp is_ps.is_ics 93 1.2.2.2 joerg #define is_type is_icmp.ici_type 94 1.2.2.2 joerg #define is_tcp is_ps.is_ts 95 1.2.2.2 joerg #define is_udp is_ps.is_us 96 1.2.2.2 joerg #define is_send is_tcp.ts_data[0].td_end 97 1.2.2.2 joerg #define is_dend is_tcp.ts_data[1].td_end 98 1.2.2.2 joerg #define is_maxswin is_tcp.ts_data[0].td_maxwin 99 1.2.2.2 joerg #define is_maxdwin is_tcp.ts_data[1].td_maxwin 100 1.2.2.2 joerg #define is_maxsend is_tcp.ts_data[0].td_maxend 101 1.2.2.2 joerg #define is_maxdend is_tcp.ts_data[1].td_maxend 102 1.2.2.2 joerg #define is_swinscale is_tcp.ts_data[0].td_winscale 103 1.2.2.2 joerg #define is_dwinscale is_tcp.ts_data[1].td_winscale 104 1.2.2.2 joerg #define is_swinflags is_tcp.ts_data[0].td_winflags 105 1.2.2.2 joerg #define is_dwinflags is_tcp.ts_data[1].td_winflags 106 1.2.2.2 joerg #define is_sport is_tcp.ts_sport 107 1.2.2.2 joerg #define is_dport is_tcp.ts_dport 108 1.2.2.2 joerg #define is_ifpin is_ifp[0] 109 1.2.2.2 joerg #define is_ifpout is_ifp[2] 110 1.2.2.2 joerg #define is_gre is_ps.is_ug 111 1.2.2.2 joerg #define is_call is_gre.gs_call 112 1.2.2.2 joerg 113 1.2.2.2 joerg #define IS_WSPORT SI_W_SPORT /* 0x00100 */ 114 1.2.2.2 joerg #define IS_WDPORT SI_W_DPORT /* 0x00200 */ 115 1.2.2.2 joerg #define IS_WSADDR SI_W_SADDR /* 0x00400 */ 116 1.2.2.2 joerg #define IS_WDADDR SI_W_DADDR /* 0x00800 */ 117 1.2.2.2 joerg #define IS_NEWFR SI_NEWFR /* 0x01000 */ 118 1.2.2.2 joerg #define IS_CLONE SI_CLONE /* 0x02000 */ 119 1.2.2.2 joerg #define IS_CLONED SI_CLONED /* 0x04000 */ 120 1.2.2.2 joerg #define IS_TCPFSM 0x10000 121 1.2.2.2 joerg #define IS_STRICT 0x20000 122 1.2.2.2 joerg #define IS_ISNSYN 0x40000 123 1.2.2.2 joerg #define IS_ISNACK 0x80000 124 1.2.2.2 joerg #define IS_STATESYNC 0x100000 125 1.2.2.2 joerg #define IS_LOOSE 0x200000 126 1.2.2.2 joerg /* 127 1.2.2.2 joerg * IS_SC flags are for scan-operations that need to be recognised in state. 128 1.2.2.2 joerg */ 129 1.2.2.2 joerg #define IS_SC_CLIENT 0x10000000 130 1.2.2.2 joerg #define IS_SC_SERVER 0x20000000 131 1.2.2.2 joerg #define IS_SC_MATCHC 0x40000000 132 1.2.2.2 joerg #define IS_SC_MATCHS 0x80000000 133 1.2.2.2 joerg #define IS_SC_MATCHALL (IS_SC_MATCHC|IS_SC_MATCHC) 134 1.2.2.2 joerg #define IS_SC_ALL (IS_SC_MATCHC|IS_SC_MATCHC|IS_SC_CLIENT|IS_SC_SERVER) 135 1.2.2.2 joerg 136 1.2.2.2 joerg /* 137 1.2.2.2 joerg * Flags that can be passed into ipf_addstate 138 1.2.2.2 joerg */ 139 1.2.2.2 joerg #define IS_INHERITED 0x0fffff00 140 1.2.2.2 joerg 141 1.2.2.2 joerg #define TH_OPENING (TH_SYN|TH_ACK) 142 1.2.2.2 joerg /* 143 1.2.2.2 joerg * is_flags: 144 1.2.2.2 joerg * Bits 0 - 3 are use as a mask with the current packet's bits to check for 145 1.2.2.2 joerg * whether it is short, tcp/udp, a fragment or the presence of IP options. 146 1.2.2.2 joerg * Bits 4 - 7 are set from the initial packet and contain what the packet 147 1.2.2.2 joerg * anded with bits 0-3 must match. 148 1.2.2.2 joerg * Bits 8,9 are used to indicate wildcard source/destination port matching. 149 1.2.2.2 joerg * Bits 10,11 are reserved for other wildcard flag compatibility. 150 1.2.2.2 joerg * Bits 12,13 are for scaning. 151 1.2.2.2 joerg */ 152 1.2.2.2 joerg 153 1.2.2.2 joerg typedef struct ipstate_save { 154 1.2.2.2 joerg void *ips_next; 155 1.2.2.2 joerg struct ipstate ips_is; 156 1.2.2.2 joerg struct frentry ips_fr; 157 1.2.2.2 joerg } ipstate_save_t; 158 1.2.2.2 joerg 159 1.2.2.2 joerg #define ips_rule ips_is.is_rule 160 1.2.2.2 joerg 161 1.2.2.2 joerg 162 1.2.2.2 joerg typedef struct ipslog { 163 1.2.2.2 joerg U_QUAD_T isl_pkts[4]; 164 1.2.2.2 joerg U_QUAD_T isl_bytes[4]; 165 1.2.2.2 joerg i6addr_t isl_src; 166 1.2.2.2 joerg i6addr_t isl_dst; 167 1.2.2.2 joerg u_32_t isl_tag; 168 1.2.2.2 joerg u_short isl_type; 169 1.2.2.2 joerg union { 170 1.2.2.2 joerg u_short isl_filler[2]; 171 1.2.2.2 joerg u_short isl_ports[2]; 172 1.2.2.2 joerg u_short isl_icmp; 173 1.2.2.2 joerg } isl_ps; 174 1.2.2.2 joerg u_char isl_v; 175 1.2.2.2 joerg u_char isl_p; 176 1.2.2.2 joerg u_char isl_flags; 177 1.2.2.2 joerg u_char isl_state[2]; 178 1.2.2.2 joerg u_32_t isl_rulen; 179 1.2.2.2 joerg char isl_group[FR_GROUPLEN]; 180 1.2.2.2 joerg } ipslog_t; 181 1.2.2.2 joerg 182 1.2.2.2 joerg #define isl_sport isl_ps.isl_ports[0] 183 1.2.2.2 joerg #define isl_dport isl_ps.isl_ports[1] 184 1.2.2.2 joerg #define isl_itype isl_ps.isl_icmp 185 1.2.2.2 joerg 186 1.2.2.2 joerg #define ISL_NEW 0 187 1.2.2.2 joerg #define ISL_CLONE 1 188 1.2.2.2 joerg #define ISL_STATECHANGE 2 189 1.2.2.2 joerg #define ISL_EXPIRE 0xffff 190 1.2.2.2 joerg #define ISL_FLUSH 0xfffe 191 1.2.2.2 joerg #define ISL_REMOVE 0xfffd 192 1.2.2.2 joerg #define ISL_INTERMEDIATE 0xfffc 193 1.2.2.2 joerg #define ISL_KILLED 0xfffb 194 1.2.2.2 joerg #define ISL_ORPHAN 0xfffa 195 1.2.2.2 joerg #define ISL_UNLOAD 0xfff9 196 1.2.2.2 joerg 197 1.2.2.2 joerg 198 1.2.2.2 joerg typedef struct ips_stat { 199 1.2.2.2 joerg u_int iss_active; 200 1.2.2.2 joerg u_int iss_active_proto[256]; 201 1.2.2.2 joerg u_long iss_add_bad; 202 1.2.2.2 joerg u_long iss_add_dup; 203 1.2.2.2 joerg u_long iss_add_locked; 204 1.2.2.2 joerg u_long iss_add_oow; 205 1.2.2.2 joerg u_long iss_bucket_full; 206 1.2.2.2 joerg u_long iss_check_bad; 207 1.2.2.2 joerg u_long iss_check_miss; 208 1.2.2.2 joerg u_long iss_check_nattag; 209 1.2.2.2 joerg u_long iss_check_notag; 210 1.2.2.2 joerg u_long iss_clone_nomem; 211 1.2.2.2 joerg u_long iss_cloned; 212 1.2.2.2 joerg u_long iss_expire; 213 1.2.2.2 joerg u_long iss_fin; 214 1.2.2.2 joerg u_long iss_flush_all; 215 1.2.2.2 joerg u_long iss_flush_closing; 216 1.2.2.2 joerg u_long iss_flush_queue; 217 1.2.2.2 joerg u_long iss_flush_state; 218 1.2.2.2 joerg u_long iss_flush_timeout; 219 1.2.2.2 joerg u_long iss_hits; 220 1.2.2.2 joerg u_long iss_icmp6_icmperr; 221 1.2.2.2 joerg u_long iss_icmp6_miss; 222 1.2.2.2 joerg u_long iss_icmp6_notinfo; 223 1.2.2.2 joerg u_long iss_icmp6_notquery; 224 1.2.2.2 joerg u_long iss_icmp_bad; 225 1.2.2.2 joerg u_long iss_icmp_banned; 226 1.2.2.2 joerg u_long iss_icmp_headblock; 227 1.2.2.2 joerg u_long iss_icmp_hits; 228 1.2.2.2 joerg u_long iss_icmp_icmperr; 229 1.2.2.2 joerg u_long iss_icmp_miss; 230 1.2.2.2 joerg u_long iss_icmp_notquery; 231 1.2.2.2 joerg u_long iss_icmp_short; 232 1.2.2.2 joerg u_long iss_icmp_toomany; 233 1.2.2.2 joerg u_int iss_inuse; 234 1.2.2.2 joerg ipstate_t *iss_list; 235 1.2.2.2 joerg u_long iss_log_fail; 236 1.2.2.2 joerg u_long iss_log_ok; 237 1.2.2.2 joerg u_long iss_lookup_badifp; 238 1.2.2.2 joerg u_long iss_lookup_badport; 239 1.2.2.2 joerg u_long iss_lookup_miss; 240 1.2.2.2 joerg u_long iss_max; 241 1.2.2.2 joerg u_long iss_max_ref; 242 1.2.2.2 joerg u_long iss_max_track; 243 1.2.2.2 joerg u_long iss_miss_mask; 244 1.2.2.2 joerg u_long iss_nomem; 245 1.2.2.2 joerg u_long iss_oow; 246 1.2.2.2 joerg u_long iss_orphan; 247 1.2.2.2 joerg u_long iss_proto[256]; 248 1.2.2.2 joerg u_long iss_scan_block; 249 1.2.2.2 joerg u_long iss_state_max; 250 1.2.2.2 joerg u_long iss_state_size; 251 1.2.2.2 joerg u_long iss_states[IPF_TCP_NSTATES]; 252 1.2.2.2 joerg ipstate_t **iss_table; 253 1.2.2.2 joerg u_long iss_tcp_closing; 254 1.2.2.2 joerg u_long iss_tcp_oow; 255 1.2.2.2 joerg u_long iss_tcp_rstadd; 256 1.2.2.2 joerg u_long iss_tcp_toosmall; 257 1.2.2.2 joerg u_long iss_tcp_badopt; 258 1.2.2.2 joerg u_long iss_tcp_fsm; 259 1.2.2.2 joerg u_long iss_tcp_strict; 260 1.2.2.2 joerg ipftq_t *iss_tcptab; 261 1.2.2.2 joerg u_int iss_ticks; 262 1.2.2.2 joerg u_long iss_wild; 263 1.2.2.2 joerg u_long iss_winsack; 264 1.2.2.2 joerg u_int *iss_bucketlen; 265 1.2.2.2 joerg } ips_stat_t; 266 1.2.2.2 joerg 267 1.2.2.2 joerg 268 1.2.2.2 joerg typedef struct ipf_state_softc_s { 269 1.2.2.2 joerg ipfmutex_t ipf_stinsert; 270 1.2.2.2 joerg int ipf_state_logging; 271 1.2.2.2 joerg int ipf_state_lock; 272 1.2.2.2 joerg int ipf_state_doflush; 273 1.2.2.2 joerg u_int ipf_state_inited; 274 1.2.2.2 joerg u_int ipf_state_max; 275 1.2.2.2 joerg u_int ipf_state_maxbucket; 276 1.2.2.2 joerg u_int ipf_state_size; 277 1.2.2.2 joerg u_int ipf_state_wm_freq; 278 1.2.2.2 joerg u_int ipf_state_wm_high; 279 1.2.2.2 joerg u_int ipf_state_wm_low; 280 1.2.2.2 joerg u_int ipf_state_wm_last; 281 1.2.2.2 joerg u_long *ipf_state_seed; 282 1.2.2.2 joerg ipstate_t *ipf_state_list; 283 1.2.2.2 joerg ipstate_t **ipf_state_table; 284 1.2.2.2 joerg ipftuneable_t *ipf_state_tune; 285 1.2.2.2 joerg ipftq_t *ipf_state_usertq; 286 1.2.2.2 joerg ipftq_t ipf_state_pending; 287 1.2.2.2 joerg ipftq_t ipf_state_deletetq; 288 1.2.2.2 joerg ipftq_t ipf_state_udptq; 289 1.2.2.2 joerg ipftq_t ipf_state_udpacktq; 290 1.2.2.2 joerg ipftq_t ipf_state_iptq; 291 1.2.2.2 joerg ipftq_t ipf_state_icmptq; 292 1.2.2.2 joerg ipftq_t ipf_state_icmpacktq; 293 1.2.2.2 joerg ipftq_t ipf_state_tcptq[IPF_TCP_NSTATES]; 294 1.2.2.2 joerg ips_stat_t ipf_state_stats; 295 1.2.2.2 joerg } ipf_state_softc_t; 296 1.2.2.2 joerg 297 1.2.2.2 joerg 298 1.2.2.2 joerg #ifndef _KERNEL 299 1.2.2.2 joerg extern void ipf_state_dump(ipf_main_softc_t *, void *); 300 1.2.2.2 joerg #endif 301 1.2.2.2 joerg extern int ipf_tcp_age(struct ipftqent *, struct fr_info *, 302 1.2.2.2 joerg struct ipftq *, int, int); 303 1.2.2.2 joerg extern int ipf_tcpinwindow(struct fr_info *, struct tcpdata *, 304 1.2.2.2 joerg struct tcpdata *, tcphdr_t *, int); 305 1.2.2.2 joerg 306 1.2.2.2 joerg extern int ipf_state_add(ipf_main_softc_t *, fr_info_t *, 307 1.2.2.2 joerg ipstate_t **, u_int); 308 1.2.2.2 joerg extern frentry_t *ipf_state_check(struct fr_info *, u_32_t *); 309 1.2.2.2 joerg extern void ipf_state_deref(ipf_main_softc_t *, ipstate_t **); 310 1.2.2.2 joerg extern void ipf_state_expire(ipf_main_softc_t *); 311 1.2.2.2 joerg extern int ipf_state_flush(ipf_main_softc_t *, int, int); 312 1.2.2.2 joerg extern ipstate_t *ipf_state_lookup(fr_info_t *, tcphdr_t *, ipftq_t **); 313 1.2.2.2 joerg extern int ipf_state_init(void); 314 1.2.2.2 joerg extern int ipf_state_insert(ipf_main_softc_t *, struct ipstate *, int); 315 1.2.2.2 joerg extern int ipf_state_ioctl(ipf_main_softc_t *, void *, ioctlcmd_t, int, int, void *); 316 1.2.2.2 joerg extern void ipf_state_log(ipf_main_softc_t *, struct ipstate *, u_int); 317 1.2.2.2 joerg extern int ipf_state_matchflush(ipf_main_softc_t *, void *); 318 1.2.2.2 joerg extern int ipf_state_rehash(ipf_main_softc_t *, ipftuneable_t *, ipftuneval_t *); 319 1.2.2.2 joerg extern void ipf_state_setqueue(ipf_main_softc_t *, ipstate_t *, int); 320 1.2.2.2 joerg extern void ipf_state_setpending(ipf_main_softc_t *, ipstate_t *); 321 1.2.2.2 joerg extern int ipf_state_settimeout(struct ipf_main_softc_s *, ipftuneable_t *, ipftuneval_t *); 322 1.2.2.2 joerg extern void ipf_state_sync(ipf_main_softc_t *, void *); 323 1.2.2.2 joerg extern void ipf_state_update(fr_info_t *, ipstate_t *); 324 1.2.2.2 joerg 325 1.2.2.2 joerg extern void ipf_sttab_init(ipf_main_softc_t *, struct ipftq *); 326 1.2.2.2 joerg extern void ipf_sttab_destroy(struct ipftq *); 327 1.2.2.2 joerg extern void ipf_state_setlock(void *, int); 328 1.2.2.2 joerg extern int ipf_state_main_load(void); 329 1.2.2.2 joerg extern int ipf_state_main_unload(void); 330 1.2.2.2 joerg extern void *ipf_state_soft_create(ipf_main_softc_t *); 331 1.2.2.2 joerg extern void ipf_state_soft_destroy(ipf_main_softc_t *, void *); 332 1.2.2.2 joerg extern int ipf_state_soft_init(ipf_main_softc_t *, void *); 333 1.2.2.2 joerg extern int ipf_state_soft_fini(ipf_main_softc_t *, void *); 334 1.2.2.2 joerg extern int ipf_state_main_load(void); 335 1.2.2.2 joerg extern ipftq_t *ipf_state_add_tq(ipf_main_softc_t *, int); 336 1.2.2.2 joerg 337 1.2.2.2 joerg #endif /* _NETINET_IP_STATE_H_ */ 338
Indexes created Sun Oct 19 22:09:57 GMT 2025