17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate  * Copyright (C) 1993-2001, 2003 by Darren Reed.
37c478bd9Sstevel@tonic-gate  *
47c478bd9Sstevel@tonic-gate  * See the IPFILTER.LICENCE file for details on licencing.
57c478bd9Sstevel@tonic-gate  *
6ab25eeb5Syz  * @(#)ip_fil.h	1.35 6/5/96
7ab25eeb5Syz  * $Id: ip_fil.h,v 2.170.2.22 2005/07/16 05:55:35 darrenr Exp $
87c478bd9Sstevel@tonic-gate  *
9de22af4eSJohn Ojemann  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
1094bdecd9SRob Gulewich  *
1194bdecd9SRob Gulewich  * Copyright (c) 2014, Joyent, Inc.  All rights reserved.
127c478bd9Sstevel@tonic-gate  */
137c478bd9Sstevel@tonic-gate 
147c478bd9Sstevel@tonic-gate #ifndef	__IP_FIL_H__
157c478bd9Sstevel@tonic-gate #define	__IP_FIL_H__
167c478bd9Sstevel@tonic-gate 
17ab25eeb5Syz #include "netinet/ip_compat.h"
1894bdecd9SRob Gulewich #include <sys/zone.h>
19ab25eeb5Syz 
20*ae7a42b1SToomas Soome #ifdef	SOLARIS
21*ae7a42b1SToomas Soome #undef	SOLARIS
22*ae7a42b1SToomas Soome #endif
23*ae7a42b1SToomas Soome #if (defined(sun) && (defined(__svr4__) || defined(__SVR4)))
24*ae7a42b1SToomas Soome #define	SOLARIS	(1)
25*ae7a42b1SToomas Soome #else
26*ae7a42b1SToomas Soome #define	SOLARIS	(0)
277c478bd9Sstevel@tonic-gate #endif
287c478bd9Sstevel@tonic-gate 
297c478bd9Sstevel@tonic-gate #ifndef	__P
307c478bd9Sstevel@tonic-gate # ifdef	__STDC__
317c478bd9Sstevel@tonic-gate #  define	__P(x)	x
327c478bd9Sstevel@tonic-gate # else
337c478bd9Sstevel@tonic-gate #  define	__P(x)	()
347c478bd9Sstevel@tonic-gate # endif
357c478bd9Sstevel@tonic-gate #endif
367c478bd9Sstevel@tonic-gate 
37ab25eeb5Syz #if defined(__STDC__) || defined(__GNUC__) || defined(_AIX51)
387c478bd9Sstevel@tonic-gate # define	SIOCADAFR	_IOW('r', 60, struct ipfobj)
397c478bd9Sstevel@tonic-gate # define	SIOCRMAFR	_IOW('r', 61, struct ipfobj)
407c478bd9Sstevel@tonic-gate # define	SIOCSETFF	_IOW('r', 62, u_int)
417c478bd9Sstevel@tonic-gate # define	SIOCGETFF	_IOR('r', 63, u_int)
427c478bd9Sstevel@tonic-gate # define	SIOCGETFS	_IOWR('r', 64, struct ipfobj)
437c478bd9Sstevel@tonic-gate # define	SIOCIPFFL	_IOWR('r', 65, int)
447c478bd9Sstevel@tonic-gate # define	SIOCIPFFB	_IOR('r', 66, int)
457c478bd9Sstevel@tonic-gate # define	SIOCADIFR	_IOW('r', 67, struct ipfobj)
467c478bd9Sstevel@tonic-gate # define	SIOCRMIFR	_IOW('r', 68, struct ipfobj)
477c478bd9Sstevel@tonic-gate # define	SIOCSWAPA	_IOR('r', 69, u_int)
487c478bd9Sstevel@tonic-gate # define	SIOCINAFR	_IOW('r', 70, struct ipfobj)
497c478bd9Sstevel@tonic-gate # define	SIOCINIFR	_IOW('r', 71, struct ipfobj)
507c478bd9Sstevel@tonic-gate # define	SIOCFRENB	_IOW('r', 72, u_int)
517c478bd9Sstevel@tonic-gate # define	SIOCFRSYN	_IOW('r', 73, u_int)
527c478bd9Sstevel@tonic-gate # define	SIOCFRZST	_IOWR('r', 74, struct ipfobj)
537c478bd9Sstevel@tonic-gate # define	SIOCZRLST	_IOWR('r', 75, struct ipfobj)
547c478bd9Sstevel@tonic-gate # define	SIOCAUTHW	_IOWR('r', 76, struct ipfobj)
557c478bd9Sstevel@tonic-gate # define	SIOCAUTHR	_IOWR('r', 77, struct ipfobj)
567c478bd9Sstevel@tonic-gate # define	SIOCATHST	_IOWR('r', 78, struct ipfobj)
577c478bd9Sstevel@tonic-gate # define	SIOCSTLCK	_IOWR('r', 79, u_int)
587c478bd9Sstevel@tonic-gate # define	SIOCSTPUT	_IOWR('r', 80, struct ipfobj)
597c478bd9Sstevel@tonic-gate # define	SIOCSTGET	_IOWR('r', 81, struct ipfobj)
607c478bd9Sstevel@tonic-gate # define	SIOCSTGSZ	_IOWR('r', 82, struct ipfobj)
617c478bd9Sstevel@tonic-gate # define	SIOCGFRST	_IOWR('r', 83, struct ipfobj)
627c478bd9Sstevel@tonic-gate # define	SIOCSETLG	_IOWR('r', 84, int)
637c478bd9Sstevel@tonic-gate # define	SIOCGETLG	_IOWR('r', 85, int)
647c478bd9Sstevel@tonic-gate # define	SIOCFUNCL	_IOWR('r', 86, struct ipfunc_resolve)
657c478bd9Sstevel@tonic-gate # define	SIOCIPFGETNEXT	_IOWR('r', 87, struct ipfobj)
667c478bd9Sstevel@tonic-gate # define	SIOCIPFGET	_IOWR('r', 88, struct ipfobj)
677c478bd9Sstevel@tonic-gate # define	SIOCIPFSET	_IOWR('r', 89, struct ipfobj)
687663b816Sml # define	SIOCIPFL6	_IOWR('r', 90, int)
69381a2a9aSdr # define	SIOCIPFLP	_IOWR('r', 91, int)
70f4b3ec61Sdh # define	SIOCIPFITER	_IOWR('r', 92, struct ipfobj)
71f4b3ec61Sdh # define	SIOCGENITER	_IOWR('r', 93, struct ipfobj)
72f4b3ec61Sdh # define	SIOCGTABL	_IOWR('r', 94, struct ipfobj)
73f4b3ec61Sdh # define	SIOCIPFDELTOK	_IOWR('r', 95, int)
74f4b3ec61Sdh # define	SIOCLOOKUPITER	_IOWR('r', 96, struct ipfobj)
757c478bd9Sstevel@tonic-gate #else
767c478bd9Sstevel@tonic-gate # define	SIOCADAFR	_IOW(r, 60, struct ipfobj)
777c478bd9Sstevel@tonic-gate # define	SIOCRMAFR	_IOW(r, 61, struct ipfobj)
787c478bd9Sstevel@tonic-gate # define	SIOCSETFF	_IOW(r, 62, u_int)
797c478bd9Sstevel@tonic-gate # define	SIOCGETFF	_IOR(r, 63, u_int)
807c478bd9Sstevel@tonic-gate # define	SIOCGETFS	_IOWR(r, 64, struct ipfobj)
817c478bd9Sstevel@tonic-gate # define	SIOCIPFFL	_IOWR(r, 65, int)
827c478bd9Sstevel@tonic-gate # define	SIOCIPFFB	_IOR(r, 66, int)
837c478bd9Sstevel@tonic-gate # define	SIOCADIFR	_IOW(r, 67, struct ipfobj)
847c478bd9Sstevel@tonic-gate # define	SIOCRMIFR	_IOW(r, 68, struct ipfobj)
857c478bd9Sstevel@tonic-gate # define	SIOCSWAPA	_IOR(r, 69, u_int)
867c478bd9Sstevel@tonic-gate # define	SIOCINAFR	_IOW(r, 70, struct ipfobj)
877c478bd9Sstevel@tonic-gate # define	SIOCINIFR	_IOW(r, 71, struct ipfobj)
887c478bd9Sstevel@tonic-gate # define	SIOCFRENB	_IOW(r, 72, u_int)
897c478bd9Sstevel@tonic-gate # define	SIOCFRSYN	_IOW(r, 73, u_int)
907c478bd9Sstevel@tonic-gate # define	SIOCFRZST	_IOWR(r, 74, struct ipfobj)
917c478bd9Sstevel@tonic-gate # define	SIOCZRLST	_IOWR(r, 75, struct ipfobj)
927c478bd9Sstevel@tonic-gate # define	SIOCAUTHW	_IOWR(r, 76, struct ipfobj)
937c478bd9Sstevel@tonic-gate # define	SIOCAUTHR	_IOWR(r, 77, struct ipfobj)
947c478bd9Sstevel@tonic-gate # define	SIOCATHST	_IOWR(r, 78, struct ipfobj)
957c478bd9Sstevel@tonic-gate # define	SIOCSTLCK	_IOWR(r, 79, u_int)
967c478bd9Sstevel@tonic-gate # define	SIOCSTPUT	_IOWR(r, 80, struct ipfobj)
977c478bd9Sstevel@tonic-gate # define	SIOCSTGET	_IOWR(r, 81, struct ipfobj)
987c478bd9Sstevel@tonic-gate # define	SIOCSTGSZ	_IOWR(r, 82, struct ipfobj)
997c478bd9Sstevel@tonic-gate # define	SIOCGFRST	_IOWR(r, 83, struct ipfobj)
1007c478bd9Sstevel@tonic-gate # define	SIOCSETLG	_IOWR(r, 84, int)
1017c478bd9Sstevel@tonic-gate # define	SIOCGETLG	_IOWR(r, 85, int)
1027c478bd9Sstevel@tonic-gate # define	SIOCFUNCL	_IOWR(r, 86, struct ipfunc_resolve)
1037c478bd9Sstevel@tonic-gate # define	SIOCIPFGETNEXT	_IOWR(r, 87, struct ipfobj)
1047c478bd9Sstevel@tonic-gate # define	SIOCIPFGET	_IOWR(r, 88, struct ipfobj)
1057c478bd9Sstevel@tonic-gate # define	SIOCIPFSET	_IOWR(r, 89, struct ipfobj)
1067663b816Sml # define	SIOCIPFL6	_IOWR(r, 90, int)
107381a2a9aSdr # define	SIOCIPFLP	_IOWR(r, 91, int)
108f4b3ec61Sdh # define	SIOCIPFITER	_IOWR(r, 92, struct ipfobj)
109f4b3ec61Sdh # define	SIOCGENITER	_IOWR(r, 93, struct ipfobj)
110f4b3ec61Sdh # define	SIOCGTABL	_IOWR(r, 94, struct ipfobj)
111f4b3ec61Sdh # define	SIOCIPFDELTOK	_IOWR(r, 95, int)
112f4b3ec61Sdh # define	SIOCLOOKUPITER	_IOWR(r, 96, struct ipfobj)
1137c478bd9Sstevel@tonic-gate #endif
1147c478bd9Sstevel@tonic-gate #define	SIOCADDFR	SIOCADAFR
1157c478bd9Sstevel@tonic-gate #define	SIOCDELFR	SIOCRMAFR
1167c478bd9Sstevel@tonic-gate #define	SIOCINSFR	SIOCINAFR
11794bdecd9SRob Gulewich # define	SIOCIPFZONESET	_IOWR('r', 97, struct ipfzoneobj)
1187c478bd9Sstevel@tonic-gate 
119ea8244dcSJohn Ojemann /*
120ea8244dcSJohn Ojemann  * What type of table is getting flushed?
121ea8244dcSJohn Ojemann  */
122ea8244dcSJohn Ojemann 
123ea8244dcSJohn Ojemann #define	NAT_FLUSH	1
124ea8244dcSJohn Ojemann #define	STATE_FLUSH	2
125ea8244dcSJohn Ojemann 
126ea8244dcSJohn Ojemann /*
127ea8244dcSJohn Ojemann  * What table flush options are available?
128ea8244dcSJohn Ojemann  */
129ea8244dcSJohn Ojemann 
130ea8244dcSJohn Ojemann #define	FLUSH_LIST	0
131ea8244dcSJohn Ojemann #define	FLUSH_TABLE_ALL		1	/* Flush entire table */
132ea8244dcSJohn Ojemann #define	FLUSH_TABLE_CLOSING	2	/* Flush "closing" entries" */
133ea8244dcSJohn Ojemann #define	FLUSH_TABLE_EXTRA	3	/* Targetted flush: almost closed, long idle */
134ea8244dcSJohn Ojemann 
135ea8244dcSJohn Ojemann #define	VALID_TABLE_FLUSH_OPT(x)	((x) >= 1 && (x) <= 3)
136ea8244dcSJohn Ojemann 
137ea8244dcSJohn Ojemann /*
138ea8244dcSJohn Ojemann  * Define the default hi and lo watermarks used when flushing the
139ea8244dcSJohn Ojemann  * tables.  The values represent percent full of respective tables.
140ea8244dcSJohn Ojemann  */
141ea8244dcSJohn Ojemann 
142ea8244dcSJohn Ojemann #define NAT_FLUSH_HI	95
143ea8244dcSJohn Ojemann #define NAT_FLUSH_LO	75
144ea8244dcSJohn Ojemann 
145ea8244dcSJohn Ojemann #define ST_FLUSH_HI	95
146ea8244dcSJohn Ojemann #define ST_FLUSH_LO	75
147ea8244dcSJohn Ojemann 
148ea8244dcSJohn Ojemann /*
149ea8244dcSJohn Ojemann  * How full are the tables?
150ea8244dcSJohn Ojemann  */
151ea8244dcSJohn Ojemann 
152ea8244dcSJohn Ojemann #define NAT_TAB_WATER_LEVEL(x)	((x)->ifs_nat_stats.ns_inuse * 100 \
153ea8244dcSJohn Ojemann 				/ (x)->ifs_ipf_nattable_max)
154ea8244dcSJohn Ojemann 
155ea8244dcSJohn Ojemann #define ST_TAB_WATER_LEVEL(x)	((x)->ifs_ips_num * 100 \
156ea8244dcSJohn Ojemann 				/ (x)->ifs_fr_statemax)
1577c478bd9Sstevel@tonic-gate 
1587c478bd9Sstevel@tonic-gate struct ipscan;
1597c478bd9Sstevel@tonic-gate struct ifnet;
1607c478bd9Sstevel@tonic-gate 
161f4b3ec61Sdh typedef struct ipf_stack ipf_stack_t;
162de22af4eSJohn Ojemann typedef struct fr_info fr_info_t;
163f4b3ec61Sdh 
164de22af4eSJohn Ojemann typedef	int	(* lookupfunc_t) __P((void *, int, void *, fr_info_t *, ipf_stack_t *));
1657c478bd9Sstevel@tonic-gate 
1667c478bd9Sstevel@tonic-gate /*
1677c478bd9Sstevel@tonic-gate  * i6addr is used as a container for both IPv4 and IPv6 addresses, as well
1687c478bd9Sstevel@tonic-gate  * as other types of objects, depending on its qualifier.
1697c478bd9Sstevel@tonic-gate  */
1707c478bd9Sstevel@tonic-gate #ifdef	USE_INET6
1717c478bd9Sstevel@tonic-gate typedef	union	i6addr	{
1727c478bd9Sstevel@tonic-gate 	u_32_t	i6[4];
1737c478bd9Sstevel@tonic-gate 	struct	in_addr	in4;
1747c478bd9Sstevel@tonic-gate 	struct	in6_addr in6;
1757c478bd9Sstevel@tonic-gate 	void	*vptr[2];
1767c478bd9Sstevel@tonic-gate 	lookupfunc_t	lptr[2];
1777c478bd9Sstevel@tonic-gate } i6addr_t;
178d6c23f6fSyx #define	in6_addr8	in6.s6_addr
1797c478bd9Sstevel@tonic-gate #else
1807c478bd9Sstevel@tonic-gate typedef	union	i6addr	{
1817c478bd9Sstevel@tonic-gate 	u_32_t	i6[4];
1827c478bd9Sstevel@tonic-gate 	struct	in_addr	in4;
1837c478bd9Sstevel@tonic-gate 	void	*vptr[2];
1847c478bd9Sstevel@tonic-gate 	lookupfunc_t	lptr[2];
1857c478bd9Sstevel@tonic-gate } i6addr_t;
1867c478bd9Sstevel@tonic-gate #endif
187ab25eeb5Syz 
188d6c23f6fSyx #define	in4_addr	in4.s_addr
1897c478bd9Sstevel@tonic-gate #define	iplookupnum	i6[0]
1907c478bd9Sstevel@tonic-gate #define	iplookuptype	i6[1]
1917c478bd9Sstevel@tonic-gate /*
1927c478bd9Sstevel@tonic-gate  * NOTE: These DO overlap the above on 64bit systems and this IS recognised.
1937c478bd9Sstevel@tonic-gate  */
1947c478bd9Sstevel@tonic-gate #define	iplookupptr	vptr[0]
1957c478bd9Sstevel@tonic-gate #define	iplookupfunc	lptr[1]
1967c478bd9Sstevel@tonic-gate 
1977c478bd9Sstevel@tonic-gate #define	I60(x)	(((i6addr_t *)(x))->i6[0])
1987c478bd9Sstevel@tonic-gate #define	I61(x)	(((i6addr_t *)(x))->i6[1])
1997c478bd9Sstevel@tonic-gate #define	I62(x)	(((i6addr_t *)(x))->i6[2])
2007c478bd9Sstevel@tonic-gate #define	I63(x)	(((i6addr_t *)(x))->i6[3])
2017c478bd9Sstevel@tonic-gate #define	HI60(x)	ntohl(((i6addr_t *)(x))->i6[0])
2027c478bd9Sstevel@tonic-gate #define	HI61(x)	ntohl(((i6addr_t *)(x))->i6[1])
2037c478bd9Sstevel@tonic-gate #define	HI62(x)	ntohl(((i6addr_t *)(x))->i6[2])
2047c478bd9Sstevel@tonic-gate #define	HI63(x)	ntohl(((i6addr_t *)(x))->i6[3])
2057c478bd9Sstevel@tonic-gate 
2067c478bd9Sstevel@tonic-gate #define	IP6_EQ(a,b)	((I63(a) == I63(b)) && (I62(a) == I62(b)) && \
2077c478bd9Sstevel@tonic-gate 			 (I61(a) == I61(b)) && (I60(a) == I60(b)))
2087c478bd9Sstevel@tonic-gate #define	IP6_NEQ(a,b)	((I63(a) != I63(b)) || (I62(a) != I62(b)) || \
2097c478bd9Sstevel@tonic-gate 			 (I61(a) != I61(b)) || (I60(a) != I60(b)))
210d6c23f6fSyx #define	IP6_ISZERO(a)   ((I60(a) | I61(a) | I62(a) | I63(a)) == 0)
2117c478bd9Sstevel@tonic-gate #define IP6_NOTZERO(a)  ((I60(a) | I61(a) | I62(a) | I63(a)) != 0)
212d6c23f6fSyx #define	IP6_ISONES(a)	((I63(a) == 0xffffffff) && (I62(a) == 0xffffffff) && \
213d6c23f6fSyx 			 (I61(a) == 0xffffffff) && (I60(a) == 0xffffffff))
214d6c23f6fSyx #define	IP6_GT(a,b)	(ntohl(HI60(a)) > ntohl(HI60(b)) || \
215d6c23f6fSyx 			 (HI60(a) == HI60(b) && \
216d6c23f6fSyx 			  (ntohl(HI61(a)) > ntohl(HI61(b)) || \
217d6c23f6fSyx 			   (HI61(a) == HI61(b) && \
218d6c23f6fSyx 			    (ntohl(HI62(a)) > ntohl(HI62(b)) || \
219d6c23f6fSyx 			     (HI62(a) == HI62(b) && \
220d6c23f6fSyx 			      ntohl(HI63(a)) > ntohl(HI63(b))))))))
221d6c23f6fSyx #define	IP6_LT(a,b)	(ntohl(HI60(a)) < ntohl(HI60(b)) || \
222d6c23f6fSyx 			 (HI60(a) == HI60(b) && \
223d6c23f6fSyx 			  (ntohl(HI61(a)) < ntohl(HI61(b)) || \
224d6c23f6fSyx 			   (HI61(a) == HI61(b) && \
225d6c23f6fSyx 			    (ntohl(HI62(a)) < ntohl(HI62(b)) || \
226d6c23f6fSyx 			     (HI62(a) == HI62(b) && \
227d6c23f6fSyx 			      ntohl(HI63(a)) < ntohl(HI63(b))))))))
2287c478bd9Sstevel@tonic-gate #define	NLADD(n,x)	htonl(ntohl(n) + (x))
2297c478bd9Sstevel@tonic-gate #define	IP6_INC(a)	\
2307c478bd9Sstevel@tonic-gate 		{ i6addr_t *_i6 = (i6addr_t *)(a); \
231d6c23f6fSyx 		  _i6->i6[3] = NLADD(_i6->i6[3], 1); \
232d6c23f6fSyx 		  if (_i6->i6[3] == 0) { \
233d6c23f6fSyx 			_i6->i6[2] = NLADD(_i6->i6[2], 1); \
234d6c23f6fSyx 			if (_i6->i6[2] == 0) { \
235d6c23f6fSyx 				_i6->i6[1] = NLADD(_i6->i6[1], 1); \
236d6c23f6fSyx 				if (_i6->i6[1] == 0) { \
237d6c23f6fSyx 					_i6->i6[0] = NLADD(_i6->i6[0], 1); \
2387c478bd9Sstevel@tonic-gate 				} \
2397c478bd9Sstevel@tonic-gate 			} \
2407c478bd9Sstevel@tonic-gate 		  } \
2417c478bd9Sstevel@tonic-gate 		}
2427c478bd9Sstevel@tonic-gate #define	IP6_ADD(a,x,d)	\
2437c478bd9Sstevel@tonic-gate 		{ i6addr_t *_s = (i6addr_t *)(a); \
2447c478bd9Sstevel@tonic-gate 		  i6addr_t *_d = (i6addr_t *)(d); \
245d6c23f6fSyx 		  _d->i6[3] = NLADD(_s->i6[3], x); \
246d6c23f6fSyx 		  if (ntohl(_d->i6[3]) < ntohl(_s->i6[3])) { \
247d6c23f6fSyx 			_d->i6[2] = NLADD(_d->i6[2], 1); \
248d6c23f6fSyx 			if (ntohl(_d->i6[2]) < ntohl(_s->i6[2])) { \
249d6c23f6fSyx 				_d->i6[1] = NLADD(_d->i6[1], 1); \
250d6c23f6fSyx 				if (ntohl(_d->i6[1]) < ntohl(_s->i6[1])) { \
251d6c23f6fSyx 					_d->i6[0] = NLADD(_d->i6[0], 1); \
2527c478bd9Sstevel@tonic-gate 				} \
2537c478bd9Sstevel@tonic-gate 			} \
2547c478bd9Sstevel@tonic-gate 		  } \
2557c478bd9Sstevel@tonic-gate 		}
2567c478bd9Sstevel@tonic-gate #define	IP6_AND(a,b,d)	{ i6addr_t *_s1 = (i6addr_t *)(a); \
257d6c23f6fSyx 			  i6addr_t *_s2 = (i6addr_t *)(b); \
2587c478bd9Sstevel@tonic-gate 			  i6addr_t *_d = (i6addr_t *)(d); \
2597c478bd9Sstevel@tonic-gate 			  _d->i6[0] = _s1->i6[0] & _s2->i6[0]; \
2607c478bd9Sstevel@tonic-gate 			  _d->i6[1] = _s1->i6[1] & _s2->i6[1]; \
2617c478bd9Sstevel@tonic-gate 			  _d->i6[2] = _s1->i6[2] & _s2->i6[2]; \
2627c478bd9Sstevel@tonic-gate 			  _d->i6[3] = _s1->i6[3] & _s2->i6[3]; \
2637c478bd9Sstevel@tonic-gate 			}
264d6c23f6fSyx #define	IP6_MASKEQ(a,m,b) \
265d6c23f6fSyx 			(((I60(a) & I60(m)) == I60(b)) && \
266d6c23f6fSyx 			 ((I61(a) & I61(m)) == I61(b)) && \
267d6c23f6fSyx 			 ((I62(a) & I62(m)) == I62(b)) && \
268d6c23f6fSyx 			 ((I63(a) & I63(m)) == I63(b)))
269d6c23f6fSyx #define	IP6_MASKNEQ(a,m,b) \
270d6c23f6fSyx 			(((I60(a) & I60(m)) != I60(b)) || \
271d6c23f6fSyx 			 ((I61(a) & I61(m)) != I61(b)) || \
272d6c23f6fSyx 			 ((I62(a) & I62(m)) != I62(b)) || \
273d6c23f6fSyx 			 ((I63(a) & I63(m)) != I63(b)))
2747c478bd9Sstevel@tonic-gate #define	IP6_MERGE(a,b,c) \
2757c478bd9Sstevel@tonic-gate 			{ i6addr_t *_d, *_s1, *_s2; \
2767c478bd9Sstevel@tonic-gate 			  _d = (i6addr_t *)(a); \
2777c478bd9Sstevel@tonic-gate 			  _s1 = (i6addr_t *)(b); \
2787c478bd9Sstevel@tonic-gate 			  _s2 = (i6addr_t *)(c); \
2797c478bd9Sstevel@tonic-gate 			  _d->i6[0] |= _s1->i6[0] & ~_s2->i6[0]; \
2807c478bd9Sstevel@tonic-gate 			  _d->i6[1] |= _s1->i6[1] & ~_s2->i6[1]; \
2817c478bd9Sstevel@tonic-gate 			  _d->i6[2] |= _s1->i6[2] & ~_s2->i6[2]; \
282d6c23f6fSyx 			  _d->i6[3] |= _s1->i6[3] & ~_s2->i6[3]; \
2837c478bd9Sstevel@tonic-gate 			}
2847c478bd9Sstevel@tonic-gate 
2857c478bd9Sstevel@tonic-gate 
2867c478bd9Sstevel@tonic-gate typedef	struct	fr_ip	{
2877c478bd9Sstevel@tonic-gate 	u_32_t	fi_v:4;		/* IP version */
2887c478bd9Sstevel@tonic-gate 	u_32_t	fi_xx:4;	/* spare */
2897c478bd9Sstevel@tonic-gate 	u_32_t	fi_tos:8;	/* IP packet TOS */
2907c478bd9Sstevel@tonic-gate 	u_32_t	fi_ttl:8;	/* IP packet TTL */
2917c478bd9Sstevel@tonic-gate 	u_32_t	fi_p:8;		/* IP packet protocol */
2927c478bd9Sstevel@tonic-gate 	u_32_t	fi_optmsk;	/* bitmask composed from IP options */
2937c478bd9Sstevel@tonic-gate 	i6addr_t fi_src;	/* source address from packet */
2947c478bd9Sstevel@tonic-gate 	i6addr_t fi_dst;	/* destination address from packet */
2957c478bd9Sstevel@tonic-gate 	u_short	fi_secmsk;	/* bitmask composed from IP security options */
2967c478bd9Sstevel@tonic-gate 	u_short	fi_auth;	/* authentication code from IP sec. options */
2977c478bd9Sstevel@tonic-gate 	u_32_t	fi_flx;		/* packet flags */
2987c478bd9Sstevel@tonic-gate 	u_32_t	fi_tcpmsk;	/* TCP options set/reset */
2997c478bd9Sstevel@tonic-gate 	u_32_t	fi_res1;	/* RESERVED */
3007c478bd9Sstevel@tonic-gate } fr_ip_t;
3017c478bd9Sstevel@tonic-gate 
3027c478bd9Sstevel@tonic-gate /*
3037c478bd9Sstevel@tonic-gate  * For use in fi_flx
3047c478bd9Sstevel@tonic-gate  */
30543412a42SDarren Reed #define	FI_TCPUDP	0x0001	/* TCP/UCP implied comparison*/
30643412a42SDarren Reed #define	FI_OPTIONS	0x0002
3077c478bd9Sstevel@tonic-gate #define	FI_FRAG		0x0004
3087c478bd9Sstevel@tonic-gate #define	FI_SHORT	0x0008
3097c478bd9Sstevel@tonic-gate #define	FI_NATED	0x0010
31043412a42SDarren Reed #define	FI_MULTICAST	0x0020
31143412a42SDarren Reed #define	FI_BROADCAST	0x0040
3127c478bd9Sstevel@tonic-gate #define	FI_MBCAST	0x0080
3137c478bd9Sstevel@tonic-gate #define	FI_STATE	0x0100
3147c478bd9Sstevel@tonic-gate #define	FI_BADNAT	0x0200
3157c478bd9Sstevel@tonic-gate #define	FI_BAD		0x0400
3167c478bd9Sstevel@tonic-gate #define	FI_OOW		0x0800	/* Out of state window, else match */
3177c478bd9Sstevel@tonic-gate #define	FI_ICMPERR	0x1000
318ab25eeb5Syz #define	FI_FRAGBODY	0x2000
3197c478bd9Sstevel@tonic-gate #define	FI_BADSRC	0x4000
3207c478bd9Sstevel@tonic-gate #define	FI_LOWTTL	0x8000
321bb1d9de5SJohn Ojemann #define	FI_CMP		0xcf03	/* Not FI_FRAG,FI_NATED,FI_FRAGTAIL,broadcast */
322ab25eeb5Syz #define	FI_ICMPCMP	0x0003	/* Flags we can check for ICMP error packets */
3237c478bd9Sstevel@tonic-gate #define	FI_WITH		0xeffe	/* Not FI_TCPUDP */
3247c478bd9Sstevel@tonic-gate #define	FI_V6EXTHDR	0x10000
3257c478bd9Sstevel@tonic-gate #define	FI_COALESCE	0x20000
326d6c23f6fSyx #define	FI_ICMPQUERY	0x40000
3275b48165cSJohn Ojemann #define	FI_NEWNAT	0x80000
32872680cf5SDarren Reed #define	FI_MOREFRAG	0x100000
32940cdc2e8SAlexandr Nedvedicky #define FI_NEG_OOW	0x10000000	/* packet underflows TCP window */
3307c478bd9Sstevel@tonic-gate #define	FI_NOCKSUM	0x20000000	/* don't do a L4 checksum validation */
3317c478bd9Sstevel@tonic-gate #define	FI_DONTCACHE	0x40000000	/* don't cache the result */
3327c478bd9Sstevel@tonic-gate #define	FI_IGNORE	0x80000000
3337c478bd9Sstevel@tonic-gate 
3347c478bd9Sstevel@tonic-gate #define	fi_saddr	fi_src.in4.s_addr
3357c478bd9Sstevel@tonic-gate #define	fi_daddr	fi_dst.in4.s_addr
3367c478bd9Sstevel@tonic-gate #define	fi_srcnum	fi_src.iplookupnum
3377c478bd9Sstevel@tonic-gate #define	fi_dstnum	fi_dst.iplookupnum
3387c478bd9Sstevel@tonic-gate #define	fi_srctype	fi_src.iplookuptype
3397c478bd9Sstevel@tonic-gate #define	fi_dsttype	fi_dst.iplookuptype
3407c478bd9Sstevel@tonic-gate #define	fi_srcptr	fi_src.iplookupptr
3417c478bd9Sstevel@tonic-gate #define	fi_dstptr	fi_dst.iplookupptr
3427c478bd9Sstevel@tonic-gate #define	fi_srcfunc	fi_src.iplookupfunc
3437c478bd9Sstevel@tonic-gate #define	fi_dstfunc	fi_dst.iplookupfunc
3447c478bd9Sstevel@tonic-gate 
3457c478bd9Sstevel@tonic-gate 
3467c478bd9Sstevel@tonic-gate /*
3477c478bd9Sstevel@tonic-gate  * These are both used by the state and NAT code to indicate that one port or
3487c478bd9Sstevel@tonic-gate  * the other should be treated as a wildcard.
3497c478bd9Sstevel@tonic-gate  * NOTE: When updating, check bit masks in ip_state.h and update there too.
3507c478bd9Sstevel@tonic-gate  */
3517c478bd9Sstevel@tonic-gate #define	SI_W_SPORT	0x00000100
3527c478bd9Sstevel@tonic-gate #define	SI_W_DPORT	0x00000200
3537c478bd9Sstevel@tonic-gate #define	SI_WILDP	(SI_W_SPORT|SI_W_DPORT)
3547c478bd9Sstevel@tonic-gate #define	SI_W_SADDR	0x00000400
3557c478bd9Sstevel@tonic-gate #define	SI_W_DADDR	0x00000800
3567c478bd9Sstevel@tonic-gate #define	SI_WILDA	(SI_W_SADDR|SI_W_DADDR)
3577c478bd9Sstevel@tonic-gate #define	SI_NEWFR	0x00001000
3587c478bd9Sstevel@tonic-gate #define	SI_CLONE	0x00002000
3597c478bd9Sstevel@tonic-gate #define	SI_CLONED	0x00004000
3607c478bd9Sstevel@tonic-gate 
3617c478bd9Sstevel@tonic-gate 
362f4b3ec61Sdh 
363f4b3ec61Sdh 
364de22af4eSJohn Ojemann struct	fr_info	{
3657c478bd9Sstevel@tonic-gate 	void	*fin_ifp;		/* interface packet is `on' */
366ab25eeb5Syz 	fr_ip_t	fin_fi;		/* IP Packet summary */
3677c478bd9Sstevel@tonic-gate 	union	{
3687c478bd9Sstevel@tonic-gate 		u_short	fid_16[2];	/* TCP/UDP ports, ICMP code/type */
3697c478bd9Sstevel@tonic-gate 		u_32_t	fid_32;
3707c478bd9Sstevel@tonic-gate 	} fin_dat;
3717c478bd9Sstevel@tonic-gate 	int	fin_out;		/* in or out ? 1 == out, 0 == in */
3727c478bd9Sstevel@tonic-gate 	int	fin_rev;		/* state only: 1 = reverse */
3737c478bd9Sstevel@tonic-gate 	u_short	fin_hlen;		/* length of IP header in bytes */
3747c478bd9Sstevel@tonic-gate 	u_char	fin_tcpf;		/* TCP header flags (SYN, ACK, etc) */
3757c478bd9Sstevel@tonic-gate 	u_char	fin_icode;		/* ICMP error to return */
3767c478bd9Sstevel@tonic-gate 	u_32_t	fin_rule;		/* rule # last matched */
3777c478bd9Sstevel@tonic-gate 	char	fin_group[FR_GROUPLEN];	/* group number, -1 for none */
3787c478bd9Sstevel@tonic-gate 	struct	frentry *fin_fr;	/* last matching rule */
3797c478bd9Sstevel@tonic-gate 	void	*fin_dp;		/* start of data past IP header */
3807c478bd9Sstevel@tonic-gate 	int	fin_dlen;		/* length of data portion of packet */
3817c478bd9Sstevel@tonic-gate 	int	fin_plen;
382ab25eeb5Syz 	int	fin_ipoff;		/* # bytes from buffer start to hdr */
3837663b816Sml 	u_32_t	fin_id;			/* IP packet id field */
3847c478bd9Sstevel@tonic-gate 	u_short	fin_off;
3857c478bd9Sstevel@tonic-gate 	int	fin_depth;		/* Group nesting depth */
3867c478bd9Sstevel@tonic-gate 	int	fin_error;		/* Error code to return */
38733f2fefdSDarren Reed 	u_int	fin_pktnum;
3887c478bd9Sstevel@tonic-gate 	void	*fin_nattag;
389d6c23f6fSyx 	union {
390d6c23f6fSyx 		ip_t	*fip_ip;
391d6c23f6fSyx #ifdef	USE_INET6
392d6c23f6fSyx 		ip6_t	*fip_ip6;
393d6c23f6fSyx #endif
394d6c23f6fSyx 	} fin_ipu;
3957c478bd9Sstevel@tonic-gate 	mb_t	**fin_mp;		/* pointer to pointer to mbuf */
3967c478bd9Sstevel@tonic-gate 	mb_t	*fin_m;			/* pointer to mbuf */
3977c478bd9Sstevel@tonic-gate #ifdef	MENTAT
3987c478bd9Sstevel@tonic-gate 	mb_t	*fin_qfm;		/* pointer to mblk where pkt starts */
399ab25eeb5Syz 	void	*fin_qpi;
400f4b3ec61Sdh 	ipf_stack_t *fin_ifs;
401ab25eeb5Syz #endif
402ab25eeb5Syz #ifdef	__sgi
403ab25eeb5Syz 	void	*fin_hbuf;
4047c478bd9Sstevel@tonic-gate #endif
405de22af4eSJohn Ojemann };
4067c478bd9Sstevel@tonic-gate 
407d6c23f6fSyx #define	fin_ip		fin_ipu.fip_ip
408d6c23f6fSyx #define	fin_ip6		fin_ipu.fip_ip6
4097c478bd9Sstevel@tonic-gate #define	fin_v		fin_fi.fi_v
4107c478bd9Sstevel@tonic-gate #define	fin_p		fin_fi.fi_p
4117c478bd9Sstevel@tonic-gate #define	fin_flx		fin_fi.fi_flx
4127c478bd9Sstevel@tonic-gate #define	fin_optmsk	fin_fi.fi_optmsk
4137c478bd9Sstevel@tonic-gate #define	fin_secmsk	fin_fi.fi_secmsk
4147c478bd9Sstevel@tonic-gate #define	fin_auth	fin_fi.fi_auth
4157c478bd9Sstevel@tonic-gate #define	fin_src		fin_fi.fi_src.in4
4167c478bd9Sstevel@tonic-gate #define	fin_saddr	fin_fi.fi_saddr
4177c478bd9Sstevel@tonic-gate #define	fin_dst		fin_fi.fi_dst.in4
4187c478bd9Sstevel@tonic-gate #define	fin_daddr	fin_fi.fi_daddr
4197c478bd9Sstevel@tonic-gate #define	fin_data	fin_dat.fid_16
4207c478bd9Sstevel@tonic-gate #define	fin_sport	fin_dat.fid_16[0]
4217c478bd9Sstevel@tonic-gate #define	fin_dport	fin_dat.fid_16[1]
4227c478bd9Sstevel@tonic-gate #define	fin_ports	fin_dat.fid_32
4237c478bd9Sstevel@tonic-gate 
424d6c23f6fSyx #ifdef	USE_INET6
425d6c23f6fSyx # define	fin_src6	fin_fi.fi_src
426d6c23f6fSyx # define	fin_dst6	fin_fi.fi_dst
427d6c23f6fSyx # define	fin_dstip6	fin_fi.fi_dst.in6
428d6c23f6fSyx # define	fin_srcip6	fin_fi.fi_src.in6
429d6c23f6fSyx #endif
430d6c23f6fSyx 
4317c478bd9Sstevel@tonic-gate #define	IPF_IN	0
4327c478bd9Sstevel@tonic-gate #define	IPF_OUT	1
4337c478bd9Sstevel@tonic-gate 
4347c478bd9Sstevel@tonic-gate typedef	struct frentry	*(*ipfunc_t) __P((fr_info_t *, u_32_t *));
435f4b3ec61Sdh typedef	int		(*ipfuncinit_t) __P((struct frentry *,
436f4b3ec61Sdh 					     ipf_stack_t *));
4377c478bd9Sstevel@tonic-gate 
4387c478bd9Sstevel@tonic-gate typedef	struct	ipfunc_resolve	{
4397c478bd9Sstevel@tonic-gate 	char		ipfu_name[32];
4407c478bd9Sstevel@tonic-gate 	ipfunc_t	ipfu_addr;
4417c478bd9Sstevel@tonic-gate 	ipfuncinit_t	ipfu_init;
4427c478bd9Sstevel@tonic-gate } ipfunc_resolve_t;
4437c478bd9Sstevel@tonic-gate 
4447c478bd9Sstevel@tonic-gate /*
4457c478bd9Sstevel@tonic-gate  * Size for compares on fr_info structures
4467c478bd9Sstevel@tonic-gate  */
4477c478bd9Sstevel@tonic-gate #define	FI_CSIZE	offsetof(fr_info_t, fin_icode)
4487c478bd9Sstevel@tonic-gate #define	FI_LCSIZE	offsetof(fr_info_t, fin_dp)
4497c478bd9Sstevel@tonic-gate 
4507c478bd9Sstevel@tonic-gate /*
4517c478bd9Sstevel@tonic-gate  * Size for copying cache fr_info structure
4527c478bd9Sstevel@tonic-gate  */
4537c478bd9Sstevel@tonic-gate #define	FI_COPYSIZE	offsetof(fr_info_t, fin_dp)
4547c478bd9Sstevel@tonic-gate 
4557c478bd9Sstevel@tonic-gate /*
456ab25eeb5Syz  * Structure for holding IPFilter's tag information
4577c478bd9Sstevel@tonic-gate  */
458ab25eeb5Syz #define	IPFTAG_LEN	16
4597c478bd9Sstevel@tonic-gate typedef	struct	{
4607c478bd9Sstevel@tonic-gate 	union	{
4617c478bd9Sstevel@tonic-gate 		u_32_t	iptu_num[4];
462ab25eeb5Syz 		char	iptu_tag[IPFTAG_LEN];
4637c478bd9Sstevel@tonic-gate 	} ipt_un;
4647c478bd9Sstevel@tonic-gate 	int	ipt_not;
4657c478bd9Sstevel@tonic-gate } ipftag_t;
4667c478bd9Sstevel@tonic-gate 
4677c478bd9Sstevel@tonic-gate #define	ipt_tag	ipt_un.iptu_tag
4687c478bd9Sstevel@tonic-gate #define	ipt_num	ipt_un.iptu_num
4697c478bd9Sstevel@tonic-gate 
4707c478bd9Sstevel@tonic-gate 
4717c478bd9Sstevel@tonic-gate /*
4727c478bd9Sstevel@tonic-gate  * This structure is used to hold information about the next hop for where
4737c478bd9Sstevel@tonic-gate  * to forward a packet.
4747c478bd9Sstevel@tonic-gate  */
4757c478bd9Sstevel@tonic-gate typedef	struct	frdest	{
4767c478bd9Sstevel@tonic-gate 	void	*fd_ifp;
4777c478bd9Sstevel@tonic-gate 	i6addr_t	fd_ip6;
4787c478bd9Sstevel@tonic-gate 	char	fd_ifname[LIFNAMSIZ];
4797c478bd9Sstevel@tonic-gate } frdest_t;
4807c478bd9Sstevel@tonic-gate 
4817c478bd9Sstevel@tonic-gate #define	fd_ip	fd_ip6.in4
4827c478bd9Sstevel@tonic-gate 
4837c478bd9Sstevel@tonic-gate 
4847c478bd9Sstevel@tonic-gate /*
4857c478bd9Sstevel@tonic-gate  * This structure holds information about a port comparison.
4867c478bd9Sstevel@tonic-gate  */
4877c478bd9Sstevel@tonic-gate typedef	struct	frpcmp	{
4887c478bd9Sstevel@tonic-gate 	int	frp_cmp;	/* data for port comparisons */
4897c478bd9Sstevel@tonic-gate 	u_short	frp_port;	/* top port for <> and >< */
4907c478bd9Sstevel@tonic-gate 	u_short	frp_top;	/* top port for <> and >< */
4917c478bd9Sstevel@tonic-gate } frpcmp_t;
4927c478bd9Sstevel@tonic-gate 
4937c478bd9Sstevel@tonic-gate #define FR_NONE 0
4947c478bd9Sstevel@tonic-gate #define FR_EQUAL 1
4957c478bd9Sstevel@tonic-gate #define FR_NEQUAL 2
4967c478bd9Sstevel@tonic-gate #define FR_LESST 3
4977c478bd9Sstevel@tonic-gate #define FR_GREATERT 4
4987c478bd9Sstevel@tonic-gate #define FR_LESSTE 5
4997c478bd9Sstevel@tonic-gate #define FR_GREATERTE 6
5007c478bd9Sstevel@tonic-gate #define FR_OUTRANGE 7
5017c478bd9Sstevel@tonic-gate #define FR_INRANGE 8
5027c478bd9Sstevel@tonic-gate #define FR_INCRANGE 9
5037c478bd9Sstevel@tonic-gate 
5047c478bd9Sstevel@tonic-gate /*
5057c478bd9Sstevel@tonic-gate  * Structure containing all the relevant TCP things that can be checked in
5067c478bd9Sstevel@tonic-gate  * a filter rule.
5077c478bd9Sstevel@tonic-gate  */
5087c478bd9Sstevel@tonic-gate typedef	struct	frtuc	{
5097c478bd9Sstevel@tonic-gate 	u_char		ftu_tcpfm;	/* tcp flags mask */
5107c478bd9Sstevel@tonic-gate 	u_char		ftu_tcpf;	/* tcp flags */
5117c478bd9Sstevel@tonic-gate 	frpcmp_t	ftu_src;
5127c478bd9Sstevel@tonic-gate 	frpcmp_t	ftu_dst;
5137c478bd9Sstevel@tonic-gate } frtuc_t;
5147c478bd9Sstevel@tonic-gate 
5157c478bd9Sstevel@tonic-gate #define	ftu_scmp	ftu_src.frp_cmp
5167c478bd9Sstevel@tonic-gate #define	ftu_dcmp	ftu_dst.frp_cmp
5177c478bd9Sstevel@tonic-gate #define	ftu_sport	ftu_src.frp_port
5187c478bd9Sstevel@tonic-gate #define	ftu_dport	ftu_dst.frp_port
5197c478bd9Sstevel@tonic-gate #define	ftu_stop	ftu_src.frp_top
5207c478bd9Sstevel@tonic-gate #define	ftu_dtop	ftu_dst.frp_top
5217c478bd9Sstevel@tonic-gate 
5227c478bd9Sstevel@tonic-gate #define	FR_TCPFMAX	0x3f
5237c478bd9Sstevel@tonic-gate 
5247c478bd9Sstevel@tonic-gate /*
5257c478bd9Sstevel@tonic-gate  * This structure makes up what is considered to be the IPFilter specific
5267c478bd9Sstevel@tonic-gate  * matching components of a filter rule, as opposed to the data structures
5277c478bd9Sstevel@tonic-gate  * used to define the result which are in frentry_t and not here.
5287c478bd9Sstevel@tonic-gate  */
5297c478bd9Sstevel@tonic-gate typedef	struct	fripf	{
530ab25eeb5Syz 	fr_ip_t	fri_ip;
531ab25eeb5Syz 	fr_ip_t	fri_mip;	/* mask structure */
5327c478bd9Sstevel@tonic-gate 
5337c478bd9Sstevel@tonic-gate 	u_short	fri_icmpm;		/* data for ICMP packets (mask) */
5347c478bd9Sstevel@tonic-gate 	u_short	fri_icmp;
5357c478bd9Sstevel@tonic-gate 
5367c478bd9Sstevel@tonic-gate 	frtuc_t	fri_tuc;
5377c478bd9Sstevel@tonic-gate 	int	fri_satype;		/* addres type */
5387c478bd9Sstevel@tonic-gate 	int	fri_datype;		/* addres type */
5397c478bd9Sstevel@tonic-gate 	int	fri_sifpidx;		/* doing dynamic addressing */
5407c478bd9Sstevel@tonic-gate 	int	fri_difpidx;		/* index into fr_ifps[] to use when */
5417c478bd9Sstevel@tonic-gate } fripf_t;
5427c478bd9Sstevel@tonic-gate 
5437c478bd9Sstevel@tonic-gate #define	fri_dstnum	fri_ip.fi_dstnum
5447c478bd9Sstevel@tonic-gate #define	fri_srcnum	fri_mip.fi_srcnum
5457c478bd9Sstevel@tonic-gate #define	fri_dstptr	fri_ip.fi_dstptr
5467c478bd9Sstevel@tonic-gate #define	fri_srcptr	fri_mip.fi_srcptr
5477c478bd9Sstevel@tonic-gate 
5487c478bd9Sstevel@tonic-gate #define	FRI_NORMAL	0	/* Normal address */
5497c478bd9Sstevel@tonic-gate #define	FRI_DYNAMIC	1	/* dynamic address */
5507c478bd9Sstevel@tonic-gate #define	FRI_LOOKUP	2	/* address is a pool # */
5517c478bd9Sstevel@tonic-gate #define	FRI_RANGE	3	/* address/mask is a range */
5527c478bd9Sstevel@tonic-gate #define	FRI_NETWORK	4	/* network address from if */
5537c478bd9Sstevel@tonic-gate #define	FRI_BROADCAST	5	/* broadcast address from if */
5547c478bd9Sstevel@tonic-gate #define	FRI_PEERADDR	6	/* Peer address for P-to-P */
5557c478bd9Sstevel@tonic-gate #define	FRI_NETMASKED	7	/* network address with netmask from if */
5567c478bd9Sstevel@tonic-gate 
5577c478bd9Sstevel@tonic-gate 
5587c478bd9Sstevel@tonic-gate typedef	struct	frentry	* (* frentfunc_t) __P((fr_info_t *));
5597c478bd9Sstevel@tonic-gate 
5607c478bd9Sstevel@tonic-gate typedef	struct	frentry {
5617c478bd9Sstevel@tonic-gate 	ipfmutex_t	fr_lock;
5627c478bd9Sstevel@tonic-gate 	struct	frentry	*fr_next;
5637c478bd9Sstevel@tonic-gate 	struct	frentry	**fr_grp;
5647c478bd9Sstevel@tonic-gate 	struct	ipscan	*fr_isc;
5657c478bd9Sstevel@tonic-gate 	void	*fr_ifas[4];
5667c478bd9Sstevel@tonic-gate 	void	*fr_ptr;	/* for use with fr_arg */
5677c478bd9Sstevel@tonic-gate 	char	*fr_comment;	/* text comment for rule */
5687c478bd9Sstevel@tonic-gate 	int	fr_ref;		/* reference count - for grouping */
5697c478bd9Sstevel@tonic-gate 	int	fr_statecnt;	/* state count - for limit rules */
5707c478bd9Sstevel@tonic-gate 	/*
5717c478bd9Sstevel@tonic-gate 	 * These are only incremented when a packet  matches this rule and
5727c478bd9Sstevel@tonic-gate 	 * it is the last match
5737c478bd9Sstevel@tonic-gate 	 */
5747c478bd9Sstevel@tonic-gate 	U_QUAD_T	fr_hits;
5757c478bd9Sstevel@tonic-gate 	U_QUAD_T	fr_bytes;
5767c478bd9Sstevel@tonic-gate 
5777c478bd9Sstevel@tonic-gate 	/*
5787c478bd9Sstevel@tonic-gate 	 * For PPS rate limiting
5797c478bd9Sstevel@tonic-gate 	 */
5807c478bd9Sstevel@tonic-gate 	struct timeval	fr_lastpkt;
5817c478bd9Sstevel@tonic-gate 	int		fr_curpps;
5827c478bd9Sstevel@tonic-gate 
5837c478bd9Sstevel@tonic-gate 	union	{
5847c478bd9Sstevel@tonic-gate 		void		*fru_data;
5857c478bd9Sstevel@tonic-gate 		caddr_t		fru_caddr;
5867c478bd9Sstevel@tonic-gate 		fripf_t		*fru_ipf;
5877c478bd9Sstevel@tonic-gate 		frentfunc_t	fru_func;
5887c478bd9Sstevel@tonic-gate 	} fr_dun;
5897c478bd9Sstevel@tonic-gate 
5907c478bd9Sstevel@tonic-gate 	/*
5917c478bd9Sstevel@tonic-gate 	 * Fields after this may not change whilst in the kernel.
5927c478bd9Sstevel@tonic-gate 	 */
5937c478bd9Sstevel@tonic-gate 	ipfunc_t fr_func; 	/* call this function */
5947c478bd9Sstevel@tonic-gate 	int	fr_dsize;
5957c478bd9Sstevel@tonic-gate 	int	fr_pps;
5967c478bd9Sstevel@tonic-gate 	int	fr_statemax;	/* max reference count */
5977c478bd9Sstevel@tonic-gate 	int	fr_flineno;	/* line number from conf file */
5987c478bd9Sstevel@tonic-gate 	u_32_t	fr_type;
5997c478bd9Sstevel@tonic-gate 	u_32_t	fr_flags;	/* per-rule flags && options (see below) */
6007c478bd9Sstevel@tonic-gate 	u_32_t	fr_logtag;	/* user defined log tag # */
6017c478bd9Sstevel@tonic-gate 	u_32_t	fr_collect;	/* collection number */
6027c478bd9Sstevel@tonic-gate 	u_int	fr_arg;		/* misc. numeric arg for rule */
6037c478bd9Sstevel@tonic-gate 	u_int	fr_loglevel;	/* syslog log facility + priority */
6047c478bd9Sstevel@tonic-gate 	u_int	fr_age[2];	/* non-TCP timeouts */
6057c478bd9Sstevel@tonic-gate 	u_char	fr_v;
6067c478bd9Sstevel@tonic-gate 	u_char	fr_icode;	/* return ICMP code */
6077c478bd9Sstevel@tonic-gate 	char	fr_group[FR_GROUPLEN];	/* group to which this rule belongs */
6087c478bd9Sstevel@tonic-gate 	char	fr_grhead[FR_GROUPLEN];	/* group # which this rule starts */
609ab25eeb5Syz 	ipftag_t fr_nattag;
6107c478bd9Sstevel@tonic-gate 	char	fr_ifnames[4][LIFNAMSIZ];
6117c478bd9Sstevel@tonic-gate 	char	fr_isctag[16];
612ab25eeb5Syz 	frdest_t fr_tifs[2];	/* "to"/"reply-to" interface */
613ab25eeb5Syz 	frdest_t fr_dif;	/* duplicate packet interface */
6147c478bd9Sstevel@tonic-gate 	/*
6157c478bd9Sstevel@tonic-gate 	 * This must be last and will change after loaded into the kernel.
6167c478bd9Sstevel@tonic-gate 	 */
6177c478bd9Sstevel@tonic-gate 	u_int	fr_cksum;	/* checksum on filter rules for performance */
6187c478bd9Sstevel@tonic-gate } frentry_t;
6197c478bd9Sstevel@tonic-gate 
6207c478bd9Sstevel@tonic-gate #define	fr_caddr	fr_dun.fru_caddr
6217c478bd9Sstevel@tonic-gate #define	fr_data		fr_dun.fru_data
6227c478bd9Sstevel@tonic-gate #define	fr_dfunc	fr_dun.fru_func
6237c478bd9Sstevel@tonic-gate #define	fr_ipf		fr_dun.fru_ipf
6247c478bd9Sstevel@tonic-gate #define	fr_ip		fr_ipf->fri_ip
6257c478bd9Sstevel@tonic-gate #define	fr_mip		fr_ipf->fri_mip
6267c478bd9Sstevel@tonic-gate #define	fr_icmpm	fr_ipf->fri_icmpm
6277c478bd9Sstevel@tonic-gate #define	fr_icmp		fr_ipf->fri_icmp
6287c478bd9Sstevel@tonic-gate #define	fr_tuc		fr_ipf->fri_tuc
6297c478bd9Sstevel@tonic-gate #define	fr_satype	fr_ipf->fri_satype
6307c478bd9Sstevel@tonic-gate #define	fr_datype	fr_ipf->fri_datype
6317c478bd9Sstevel@tonic-gate #define	fr_sifpidx	fr_ipf->fri_sifpidx
6327c478bd9Sstevel@tonic-gate #define	fr_difpidx	fr_ipf->fri_difpidx
6337c478bd9Sstevel@tonic-gate #define	fr_proto	fr_ip.fi_p
6347c478bd9Sstevel@tonic-gate #define	fr_mproto	fr_mip.fi_p
6357c478bd9Sstevel@tonic-gate #define	fr_ttl		fr_ip.fi_ttl
6367c478bd9Sstevel@tonic-gate #define	fr_mttl		fr_mip.fi_ttl
6377c478bd9Sstevel@tonic-gate #define	fr_tos		fr_ip.fi_tos
6387c478bd9Sstevel@tonic-gate #define	fr_mtos		fr_mip.fi_tos
6397c478bd9Sstevel@tonic-gate #define	fr_tcpfm	fr_tuc.ftu_tcpfm
6407c478bd9Sstevel@tonic-gate #define	fr_tcpf		fr_tuc.ftu_tcpf
6417c478bd9Sstevel@tonic-gate #define	fr_scmp		fr_tuc.ftu_scmp
6427c478bd9Sstevel@tonic-gate #define	fr_dcmp		fr_tuc.ftu_dcmp
6437c478bd9Sstevel@tonic-gate #define	fr_dport	fr_tuc.ftu_dport
6447c478bd9Sstevel@tonic-gate #define	fr_sport	fr_tuc.ftu_sport
6457c478bd9Sstevel@tonic-gate #define	fr_stop		fr_tuc.ftu_stop
6467c478bd9Sstevel@tonic-gate #define	fr_dtop		fr_tuc.ftu_dtop
6477c478bd9Sstevel@tonic-gate #define	fr_dst		fr_ip.fi_dst.in4
6487c478bd9Sstevel@tonic-gate #define	fr_daddr	fr_ip.fi_dst.in4.s_addr
6497c478bd9Sstevel@tonic-gate #define	fr_src		fr_ip.fi_src.in4
6507c478bd9Sstevel@tonic-gate #define	fr_saddr	fr_ip.fi_src.in4.s_addr
6517c478bd9Sstevel@tonic-gate #define	fr_dmsk		fr_mip.fi_dst.in4
6527c478bd9Sstevel@tonic-gate #define	fr_dmask	fr_mip.fi_dst.in4.s_addr
6537c478bd9Sstevel@tonic-gate #define	fr_smsk		fr_mip.fi_src.in4
6547c478bd9Sstevel@tonic-gate #define	fr_smask	fr_mip.fi_src.in4.s_addr
6557c478bd9Sstevel@tonic-gate #define	fr_dstnum	fr_ip.fi_dstnum
6567c478bd9Sstevel@tonic-gate #define	fr_srcnum	fr_ip.fi_srcnum
6577c478bd9Sstevel@tonic-gate #define	fr_dsttype	fr_ip.fi_dsttype
6587c478bd9Sstevel@tonic-gate #define	fr_srctype	fr_ip.fi_srctype
6597c478bd9Sstevel@tonic-gate #define	fr_dstptr	fr_mip.fi_dstptr
6607c478bd9Sstevel@tonic-gate #define	fr_srcptr	fr_mip.fi_srcptr
6617c478bd9Sstevel@tonic-gate #define	fr_dstfunc	fr_mip.fi_dstfunc
6627c478bd9Sstevel@tonic-gate #define	fr_srcfunc	fr_mip.fi_srcfunc
6637c478bd9Sstevel@tonic-gate #define	fr_optbits	fr_ip.fi_optmsk
6647c478bd9Sstevel@tonic-gate #define	fr_optmask	fr_mip.fi_optmsk
6657c478bd9Sstevel@tonic-gate #define	fr_secbits	fr_ip.fi_secmsk
6667c478bd9Sstevel@tonic-gate #define	fr_secmask	fr_mip.fi_secmsk
6677c478bd9Sstevel@tonic-gate #define	fr_authbits	fr_ip.fi_auth
6687c478bd9Sstevel@tonic-gate #define	fr_authmask	fr_mip.fi_auth
6697c478bd9Sstevel@tonic-gate #define	fr_flx		fr_ip.fi_flx
6707c478bd9Sstevel@tonic-gate #define	fr_mflx		fr_mip.fi_flx
6717c478bd9Sstevel@tonic-gate #define	fr_ifname	fr_ifnames[0]
6727c478bd9Sstevel@tonic-gate #define	fr_oifname	fr_ifnames[2]
6737c478bd9Sstevel@tonic-gate #define	fr_ifa		fr_ifas[0]
6747c478bd9Sstevel@tonic-gate #define	fr_oifa		fr_ifas[2]
6757c478bd9Sstevel@tonic-gate #define	fr_tif		fr_tifs[0]
6767c478bd9Sstevel@tonic-gate #define	fr_rif		fr_tifs[1]
6777c478bd9Sstevel@tonic-gate 
6787c478bd9Sstevel@tonic-gate #define	FR_NOLOGTAG	0
6797c478bd9Sstevel@tonic-gate 
6807c478bd9Sstevel@tonic-gate #define	FR_CMPSIZ	(sizeof(struct frentry) - \
681ab25eeb5Syz 			 offsetof(struct frentry, fr_func))
6827c478bd9Sstevel@tonic-gate 
6837c478bd9Sstevel@tonic-gate /*
6847c478bd9Sstevel@tonic-gate  * fr_type
6857c478bd9Sstevel@tonic-gate  */
6867c478bd9Sstevel@tonic-gate #define	FR_T_NONE	0
6877c478bd9Sstevel@tonic-gate #define	FR_T_IPF	1	/* IPF structures */
6887c478bd9Sstevel@tonic-gate #define	FR_T_BPFOPC	2	/* BPF opcode */
6897c478bd9Sstevel@tonic-gate #define	FR_T_CALLFUNC	3	/* callout to function in fr_func only */
6907c478bd9Sstevel@tonic-gate #define	FR_T_COMPIPF	4	/* compiled C code */
6917c478bd9Sstevel@tonic-gate #define	FR_T_BUILTIN	0x80000000	/* rule is in kernel space */
6927c478bd9Sstevel@tonic-gate 
6937c478bd9Sstevel@tonic-gate /*
6947c478bd9Sstevel@tonic-gate  * fr_flags
6957c478bd9Sstevel@tonic-gate  */
6967c478bd9Sstevel@tonic-gate #define	FR_CALL		0x00000	/* call rule */
6977c478bd9Sstevel@tonic-gate #define	FR_BLOCK	0x00001	/* do not allow packet to pass */
6987c478bd9Sstevel@tonic-gate #define	FR_PASS		0x00002	/* allow packet to pass */
6997c478bd9Sstevel@tonic-gate #define	FR_AUTH		0x00003	/* use authentication */
7007c478bd9Sstevel@tonic-gate #define	FR_PREAUTH	0x00004	/* require preauthentication */
7017c478bd9Sstevel@tonic-gate #define	FR_ACCOUNT	0x00005	/* Accounting rule */
7027c478bd9Sstevel@tonic-gate #define	FR_SKIP		0x00006	/* skip rule */
7037c478bd9Sstevel@tonic-gate #define	FR_DIVERT	0x00007	/* divert rule */
7047c478bd9Sstevel@tonic-gate #define	FR_CMDMASK	0x0000f
7057c478bd9Sstevel@tonic-gate #define	FR_LOG		0x00010	/* Log */
7067c478bd9Sstevel@tonic-gate #define	FR_LOGB		0x00011	/* Log-fail */
7077c478bd9Sstevel@tonic-gate #define	FR_LOGP		0x00012	/* Log-pass */
7087c478bd9Sstevel@tonic-gate #define	FR_LOGMASK	(FR_LOG|FR_CMDMASK)
7097c478bd9Sstevel@tonic-gate #define	FR_CALLNOW	0x00020	/* call another function (fr_func) if matches */
7107c478bd9Sstevel@tonic-gate #define	FR_NOTSRCIP	0x00040
7117c478bd9Sstevel@tonic-gate #define	FR_NOTDSTIP	0x00080
7127c478bd9Sstevel@tonic-gate #define	FR_QUICK	0x00100	/* match & stop processing list */
7137c478bd9Sstevel@tonic-gate #define	FR_KEEPFRAG	0x00200	/* keep fragment information */
7147c478bd9Sstevel@tonic-gate #define	FR_KEEPSTATE	0x00400	/* keep `connection' state information */
7157c478bd9Sstevel@tonic-gate #define	FR_FASTROUTE	0x00800	/* bypass normal routing */
7167c478bd9Sstevel@tonic-gate #define	FR_RETRST	0x01000	/* Return TCP RST packet - reset connection */
7177c478bd9Sstevel@tonic-gate #define	FR_RETICMP	0x02000	/* Return ICMP unreachable packet */
7187c478bd9Sstevel@tonic-gate #define	FR_FAKEICMP	0x03000	/* Return ICMP unreachable with fake source */
7197c478bd9Sstevel@tonic-gate #define	FR_OUTQUE	0x04000	/* outgoing packets */
7207c478bd9Sstevel@tonic-gate #define	FR_INQUE	0x08000	/* ingoing packets */
7217c478bd9Sstevel@tonic-gate #define	FR_LOGBODY	0x10000	/* Log the body */
7227c478bd9Sstevel@tonic-gate #define	FR_LOGFIRST	0x20000	/* Log the first byte if state held */
7237c478bd9Sstevel@tonic-gate #define	FR_LOGORBLOCK	0x40000	/* block the packet if it can't be logged */
7247c478bd9Sstevel@tonic-gate #define	FR_DUP		0x80000	/* duplicate packet */
7257c478bd9Sstevel@tonic-gate #define	FR_FRSTRICT	0x100000	/* strict frag. cache */
7267c478bd9Sstevel@tonic-gate #define	FR_STSTRICT	0x200000	/* strict keep state */
7277c478bd9Sstevel@tonic-gate #define	FR_NEWISN	0x400000	/* new ISN for outgoing TCP */
7287c478bd9Sstevel@tonic-gate #define	FR_NOICMPERR	0x800000	/* do not match ICMP errors in state */
729ab25eeb5Syz #define	FR_STATESYNC	0x1000000	/* synchronize state to slave */
7307c478bd9Sstevel@tonic-gate #define	FR_NOMATCH	0x8000000	/* no match occured */
7317c478bd9Sstevel@tonic-gate 		/*	0x10000000 	FF_LOGPASS */
7327c478bd9Sstevel@tonic-gate 		/*	0x20000000 	FF_LOGBLOCK */
7337c478bd9Sstevel@tonic-gate 		/*	0x40000000 	FF_LOGNOMATCH */
7347c478bd9Sstevel@tonic-gate 		/*	0x80000000 	FF_BLOCKNONIP */
7357c478bd9Sstevel@tonic-gate #define	FR_COPIED	0x40000000	/* copied from user space */
7367c478bd9Sstevel@tonic-gate #define	FR_INACTIVE	0x80000000	/* only used when flush'ing rules */
7377c478bd9Sstevel@tonic-gate 
7387c478bd9Sstevel@tonic-gate #define	FR_RETMASK	(FR_RETICMP|FR_RETRST|FR_FAKEICMP)
7397c478bd9Sstevel@tonic-gate #define	FR_ISBLOCK(x)	(((x) & FR_CMDMASK) == FR_BLOCK)
7407c478bd9Sstevel@tonic-gate #define	FR_ISPASS(x)	(((x) & FR_CMDMASK) == FR_PASS)
7417c478bd9Sstevel@tonic-gate #define	FR_ISAUTH(x)	(((x) & FR_CMDMASK) == FR_AUTH)
7427c478bd9Sstevel@tonic-gate #define	FR_ISPREAUTH(x)	(((x) & FR_CMDMASK) == FR_PREAUTH)
7437c478bd9Sstevel@tonic-gate #define	FR_ISACCOUNT(x)	(((x) & FR_CMDMASK) == FR_ACCOUNT)
7447c478bd9Sstevel@tonic-gate #define	FR_ISSKIP(x)	(((x) & FR_CMDMASK) == FR_SKIP)
7457c478bd9Sstevel@tonic-gate #define	FR_ISNOMATCH(x)	((x) & FR_NOMATCH)
7467c478bd9Sstevel@tonic-gate #define	FR_INOUT	(FR_INQUE|FR_OUTQUE)
7477c478bd9Sstevel@tonic-gate 
7487c478bd9Sstevel@tonic-gate /*
7497c478bd9Sstevel@tonic-gate  * recognized flags for SIOCGETFF and SIOCSETFF, and get put in fr_flags
7507c478bd9Sstevel@tonic-gate  */
7517c478bd9Sstevel@tonic-gate #define	FF_LOGPASS	0x10000000
7527c478bd9Sstevel@tonic-gate #define	FF_LOGBLOCK	0x20000000
7537c478bd9Sstevel@tonic-gate #define	FF_LOGNOMATCH	0x40000000
7547c478bd9Sstevel@tonic-gate #define	FF_LOGGING	(FF_LOGPASS|FF_LOGBLOCK|FF_LOGNOMATCH)
7557c478bd9Sstevel@tonic-gate #define	FF_BLOCKNONIP	0x80000000	/* Solaris2 Only */
7567c478bd9Sstevel@tonic-gate 
7577c478bd9Sstevel@tonic-gate 
7587c478bd9Sstevel@tonic-gate /*
7597c478bd9Sstevel@tonic-gate  * Structure that passes information on what/how to flush to the kernel.
7607c478bd9Sstevel@tonic-gate  */
7617c478bd9Sstevel@tonic-gate typedef	struct	ipfflush	{
7627c478bd9Sstevel@tonic-gate 	int	ipflu_how;
7637c478bd9Sstevel@tonic-gate 	int	ipflu_arg;
7647c478bd9Sstevel@tonic-gate } ipfflush_t;
7657c478bd9Sstevel@tonic-gate 
7667c478bd9Sstevel@tonic-gate 
7677c478bd9Sstevel@tonic-gate /*
7687c478bd9Sstevel@tonic-gate  *
7697c478bd9Sstevel@tonic-gate  */
7707c478bd9Sstevel@tonic-gate typedef	struct	ipfgetctl	{
7717c478bd9Sstevel@tonic-gate 	u_int	ipfg_min;	/* min value */
7727c478bd9Sstevel@tonic-gate 	u_int	ipfg_current;	/* current value */
7737c478bd9Sstevel@tonic-gate 	u_int	ipfg_max;	/* max value */
7747c478bd9Sstevel@tonic-gate 	u_int	ipfg_default;	/* default value */
7757c478bd9Sstevel@tonic-gate 	u_int	ipfg_steps;	/* value increments */
7767c478bd9Sstevel@tonic-gate 	char	ipfg_name[40];	/* tag name for this control */
7777c478bd9Sstevel@tonic-gate } ipfgetctl_t;
7787c478bd9Sstevel@tonic-gate 
7797c478bd9Sstevel@tonic-gate typedef	struct	ipfsetctl	{
7807c478bd9Sstevel@tonic-gate 	int	ipfs_which;	/* 0 = min 1 = current 2 = max 3 = default */
7817c478bd9Sstevel@tonic-gate 	u_int	ipfs_value;	/* min value */
7827c478bd9Sstevel@tonic-gate 	char	ipfs_name[40];	/* tag name for this control */
7837c478bd9Sstevel@tonic-gate } ipfsetctl_t;
7847c478bd9Sstevel@tonic-gate 
7857c478bd9Sstevel@tonic-gate 
7867c478bd9Sstevel@tonic-gate /*
7877c478bd9Sstevel@tonic-gate  * Some of the statistics below are in their own counters, but most are kept
7887c478bd9Sstevel@tonic-gate  * in this single structure so that they can all easily be collected and
7897c478bd9Sstevel@tonic-gate  * copied back as required.
790e0b463afSschuster  *
791e0b463afSschuster  * NOTE: when changing, keep in sync with kstats (below).
7927c478bd9Sstevel@tonic-gate  */
7937c478bd9Sstevel@tonic-gate typedef	struct	filterstats {
7947c478bd9Sstevel@tonic-gate 	u_long	fr_pass;	/* packets allowed */
7957c478bd9Sstevel@tonic-gate 	u_long	fr_block;	/* packets denied */
7967c478bd9Sstevel@tonic-gate 	u_long	fr_nom;		/* packets which don't match any rule */
7977c478bd9Sstevel@tonic-gate 	u_long	fr_short;	/* packets which are short */
7987c478bd9Sstevel@tonic-gate 	u_long	fr_ppkl;	/* packets allowed and logged */
7997c478bd9Sstevel@tonic-gate 	u_long	fr_bpkl;	/* packets denied and logged */
8007c478bd9Sstevel@tonic-gate 	u_long	fr_npkl;	/* packets unmatched and logged */
8017c478bd9Sstevel@tonic-gate 	u_long	fr_pkl;		/* packets logged */
8027c478bd9Sstevel@tonic-gate 	u_long	fr_skip;	/* packets to be logged but buffer full */
8037c478bd9Sstevel@tonic-gate 	u_long	fr_ret;		/* packets for which a return is sent */
8047c478bd9Sstevel@tonic-gate 	u_long	fr_acct;	/* packets for which counting was performed */
8057c478bd9Sstevel@tonic-gate 	u_long	fr_bnfr;	/* bad attempts to allocate fragment state */
8067c478bd9Sstevel@tonic-gate 	u_long	fr_nfr;		/* new fragment state kept */
8077c478bd9Sstevel@tonic-gate 	u_long	fr_cfr;		/* add new fragment state but complete pkt */
8087c478bd9Sstevel@tonic-gate 	u_long	fr_bads;	/* bad attempts to allocate packet state */
8097c478bd9Sstevel@tonic-gate 	u_long	fr_ads;		/* new packet state kept */
8107c478bd9Sstevel@tonic-gate 	u_long	fr_chit;	/* cached hit */
8117c478bd9Sstevel@tonic-gate 	u_long	fr_tcpbad;	/* TCP checksum check failures */
8127c478bd9Sstevel@tonic-gate 	u_long	fr_pull[2];	/* good and bad pullup attempts */
8137c478bd9Sstevel@tonic-gate 	u_long	fr_badsrc;	/* source received doesn't match route */
8147c478bd9Sstevel@tonic-gate 	u_long	fr_badttl;	/* TTL in packet doesn't reach minimum */
8157c478bd9Sstevel@tonic-gate 	u_long	fr_bad;		/* bad IP packets to the filter */
8167c478bd9Sstevel@tonic-gate 	u_long	fr_ipv6;	/* IPv6 packets in/out */
8177c478bd9Sstevel@tonic-gate 	u_long	fr_ppshit;	/* dropped because of pps ceiling */
8187c478bd9Sstevel@tonic-gate 	u_long	fr_ipud;	/* IP id update failures */
8197c478bd9Sstevel@tonic-gate } filterstats_t;
8207c478bd9Sstevel@tonic-gate 
821e0b463afSschuster /*
822e0b463afSschuster  * kstat "copy" of the above - keep in sync!
823e0b463afSschuster  * also keep in sync with initialisation code in solaris.c, ipf_kstat_init().
824e0b463afSschuster  */
825e0b463afSschuster typedef struct  filter_kstats {
826e0b463afSschuster 	kstat_named_t   fks_pass;	/* see above for comments */
827e0b463afSschuster 	kstat_named_t   fks_block;
828e0b463afSschuster 	kstat_named_t   fks_nom;
829e0b463afSschuster 	kstat_named_t   fks_short;
830e0b463afSschuster 	kstat_named_t   fks_ppkl;
831e0b463afSschuster 	kstat_named_t   fks_bpkl;
832e0b463afSschuster 	kstat_named_t   fks_npkl;
833e0b463afSschuster 	kstat_named_t   fks_pkl;
834e0b463afSschuster 	kstat_named_t   fks_skip;
835e0b463afSschuster 	kstat_named_t   fks_ret;
836e0b463afSschuster 	kstat_named_t   fks_acct;
837e0b463afSschuster 	kstat_named_t   fks_bnfr;
838e0b463afSschuster 	kstat_named_t   fks_nfr;
839e0b463afSschuster 	kstat_named_t   fks_cfr;
840e0b463afSschuster 	kstat_named_t   fks_bads;
841e0b463afSschuster 	kstat_named_t   fks_ads;
842e0b463afSschuster 	kstat_named_t   fks_chit;
843e0b463afSschuster 	kstat_named_t   fks_tcpbad;
844e0b463afSschuster 	kstat_named_t   fks_pull[2];
845e0b463afSschuster 	kstat_named_t   fks_badsrc;
846e0b463afSschuster 	kstat_named_t   fks_badttl;
847e0b463afSschuster 	kstat_named_t   fks_bad;
848e0b463afSschuster 	kstat_named_t   fks_ipv6;
849e0b463afSschuster 	kstat_named_t   fks_ppshit;
850e0b463afSschuster 	kstat_named_t   fks_ipud;
851e0b463afSschuster } filter_kstats_t;
852e0b463afSschuster 
8537c478bd9Sstevel@tonic-gate /*
8547c478bd9Sstevel@tonic-gate  * Log structure.  Each packet header logged is prepended by one of these.
8557c478bd9Sstevel@tonic-gate  * Following this in the log records read from the device will be an ipflog
8567c478bd9Sstevel@tonic-gate  * structure which is then followed by any packet data.
8577c478bd9Sstevel@tonic-gate  */
8587c478bd9Sstevel@tonic-gate typedef	struct	iplog	{
8597c478bd9Sstevel@tonic-gate 	u_32_t		ipl_magic;
8607c478bd9Sstevel@tonic-gate 	u_int		ipl_count;
861ab25eeb5Syz 	struct	timeval	ipl_time;
8627c478bd9Sstevel@tonic-gate 	size_t		ipl_dsize;
8637c478bd9Sstevel@tonic-gate 	struct	iplog	*ipl_next;
8647c478bd9Sstevel@tonic-gate } iplog_t;
8657c478bd9Sstevel@tonic-gate 
866ab25eeb5Syz #define	ipl_sec		ipl_time.tv_sec
867ab25eeb5Syz #define	ipl_usec	ipl_time.tv_usec
8687c478bd9Sstevel@tonic-gate 
8697c478bd9Sstevel@tonic-gate #define IPL_MAGIC	0x49504c4d	/* 'IPLM' */
870ab25eeb5Syz #define IPL_MAGIC_NAT	0x49504c4e	/* 'IPLN' */
871