17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * Copyright (C) 1995-2001 by Darren Reed. 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * See the IPFILTER.LICENCE file for details on licencing. 57c478bd9Sstevel@tonic-gate * 67c478bd9Sstevel@tonic-gate * @(#)ip_state.h 1.3 1/12/96 (C) 1995 Darren Reed 7ab25eeb5Syz * $Id: ip_state.h,v 2.68.2.5 2005/08/11 19:58:04 darrenr Exp $ 87663b816Sml * 9*231bdc74SZdenek Kotala * Copyright 2010 Sun Microsystems, Inc. All rights reserved. 107663b816Sml * Use is subject to license terms. 117c478bd9Sstevel@tonic-gate */ 127663b816Sml 137c478bd9Sstevel@tonic-gate #ifndef __IP_STATE_H__ 147c478bd9Sstevel@tonic-gate #define __IP_STATE_H__ 157c478bd9Sstevel@tonic-gate 16ab25eeb5Syz #if defined(__STDC__) || defined(__GNUC__) || defined(_AIX51) 177c478bd9Sstevel@tonic-gate # define SIOCDELST _IOW('r', 61, struct ipfobj) 187c478bd9Sstevel@tonic-gate #else 197c478bd9Sstevel@tonic-gate # define SIOCDELST _IOW(r, 61, struct ipfobj) 207c478bd9Sstevel@tonic-gate #endif 217c478bd9Sstevel@tonic-gate 227c478bd9Sstevel@tonic-gate struct ipscan; 237c478bd9Sstevel@tonic-gate 247c478bd9Sstevel@tonic-gate #ifndef IPSTATE_SIZE 257c478bd9Sstevel@tonic-gate # define IPSTATE_SIZE 5737 267c478bd9Sstevel@tonic-gate #endif 277c478bd9Sstevel@tonic-gate #ifndef IPSTATE_MAX 28*231bdc74SZdenek Kotala # define IPSTATE_MAX 50000 /* Maximum number of states held */ 297c478bd9Sstevel@tonic-gate #endif 307c478bd9Sstevel@tonic-gate 317c478bd9Sstevel@tonic-gate #define PAIRS(s1,d1,s2,d2) ((((s1) == (s2)) && ((d1) == (d2))) ||\ 327c478bd9Sstevel@tonic-gate (((s1) == (d2)) && ((d1) == (s2)))) 337c478bd9Sstevel@tonic-gate #define IPPAIR(s1,d1,s2,d2) PAIRS((s1).s_addr, (d1).s_addr, \ 347c478bd9Sstevel@tonic-gate (s2).s_addr, (d2).s_addr) 357c478bd9Sstevel@tonic-gate 367c478bd9Sstevel@tonic-gate 377c478bd9Sstevel@tonic-gate typedef struct ipstate { 387c478bd9Sstevel@tonic-gate ipfmutex_t is_lock; 397c478bd9Sstevel@tonic-gate struct ipstate *is_next; 407c478bd9Sstevel@tonic-gate struct ipstate **is_pnext; 417c478bd9Sstevel@tonic-gate struct ipstate *is_hnext; 427c478bd9Sstevel@tonic-gate struct ipstate **is_phnext; 437c478bd9Sstevel@tonic-gate struct ipstate **is_me; 447c478bd9Sstevel@tonic-gate void *is_ifp[4]; 457c478bd9Sstevel@tonic-gate void *is_sync; 467c478bd9Sstevel@tonic-gate struct nat *is_nat[2]; 477c478bd9Sstevel@tonic-gate frentry_t *is_rule; 487c478bd9Sstevel@tonic-gate struct ipftq *is_tqehead[2]; 49ab25eeb5Syz struct ipscan *is_isc; 507c478bd9Sstevel@tonic-gate U_QUAD_T is_pkts[4]; 517c478bd9Sstevel@tonic-gate U_QUAD_T is_bytes[4]; 52ab25eeb5Syz U_QUAD_T is_icmppkts[4]; 537c478bd9Sstevel@tonic-gate struct ipftqent is_sti; 547c478bd9Sstevel@tonic-gate u_int is_frage[2]; 557c478bd9Sstevel@tonic-gate int is_ref; /* reference count */ 567c478bd9Sstevel@tonic-gate int is_isninc[2]; 577c478bd9Sstevel@tonic-gate u_short is_sumd[2]; 587c478bd9Sstevel@tonic-gate i6addr_t is_src; 597c478bd9Sstevel@tonic-gate i6addr_t is_dst; 607c478bd9Sstevel@tonic-gate u_int is_pass; 617c478bd9Sstevel@tonic-gate u_char is_p; /* Protocol */ 627c478bd9Sstevel@tonic-gate u_char is_v; 637c478bd9Sstevel@tonic-gate u_32_t is_hv; 647c478bd9Sstevel@tonic-gate u_32_t is_tag; 657663b816Sml u_32_t is_opt[2]; /* packet options set */ 667663b816Sml /* in both directions */ 677663b816Sml u_32_t is_optmsk[2]; /* " " mask */ 687663b816Sml /* in both directions */ 697c478bd9Sstevel@tonic-gate u_short is_sec; /* security options set */ 707c478bd9Sstevel@tonic-gate u_short is_secmsk; /* " " mask */ 717c478bd9Sstevel@tonic-gate u_short is_auth; /* authentication options set */ 727c478bd9Sstevel@tonic-gate u_short is_authmsk; /* " " mask */ 737c478bd9Sstevel@tonic-gate union { 747c478bd9Sstevel@tonic-gate icmpinfo_t is_ics; 757c478bd9Sstevel@tonic-gate tcpinfo_t is_ts; 767c478bd9Sstevel@tonic-gate udpinfo_t is_us; 777c478bd9Sstevel@tonic-gate greinfo_t is_ug; 787c478bd9Sstevel@tonic-gate } is_ps; 797c478bd9Sstevel@tonic-gate u_32_t is_flags; 807c478bd9Sstevel@tonic-gate int is_flx[2][2]; 817c478bd9Sstevel@tonic-gate u_32_t is_rulen; /* rule number when created */ 827c478bd9Sstevel@tonic-gate u_32_t is_s0[2]; 837c478bd9Sstevel@tonic-gate u_short is_smsk[2]; 847c478bd9Sstevel@tonic-gate char is_group[FR_GROUPLEN]; 857c478bd9Sstevel@tonic-gate char is_sbuf[2][16]; 867c478bd9Sstevel@tonic-gate char is_ifname[4][LIFNAMSIZ]; 877c478bd9Sstevel@tonic-gate } ipstate_t; 887c478bd9Sstevel@tonic-gate 897c478bd9Sstevel@tonic-gate #define is_die is_sti.tqe_die 907c478bd9Sstevel@tonic-gate #define is_state is_sti.tqe_state 917c478bd9Sstevel@tonic-gate #define is_saddr is_src.in4.s_addr 927c478bd9Sstevel@tonic-gate #define is_daddr is_dst.in4.s_addr 937c478bd9Sstevel@tonic-gate #define is_icmp is_ps.is_ics 947c478bd9Sstevel@tonic-gate #define is_type is_icmp.ici_type 957c478bd9Sstevel@tonic-gate #define is_code is_icmp.ici_code 967c478bd9Sstevel@tonic-gate #define is_tcp is_ps.is_ts 977c478bd9Sstevel@tonic-gate #define is_udp is_ps.is_us 987c478bd9Sstevel@tonic-gate #define is_send is_tcp.ts_data[0].td_end 997c478bd9Sstevel@tonic-gate #define is_dend is_tcp.ts_data[1].td_end 1007c478bd9Sstevel@tonic-gate #define is_maxswin is_tcp.ts_data[0].td_maxwin 1017c478bd9Sstevel@tonic-gate #define is_maxdwin is_tcp.ts_data[1].td_maxwin 1027c478bd9Sstevel@tonic-gate #define is_maxsend is_tcp.ts_data[0].td_maxend 1037c478bd9Sstevel@tonic-gate #define is_maxdend is_tcp.ts_data[1].td_maxend 1047c478bd9Sstevel@tonic-gate #define is_swinscale is_tcp.ts_data[0].td_winscale 1057c478bd9Sstevel@tonic-gate #define is_dwinscale is_tcp.ts_data[1].td_winscale 1067c478bd9Sstevel@tonic-gate #define is_swinflags is_tcp.ts_data[0].td_winflags 1077c478bd9Sstevel@tonic-gate #define is_dwinflags is_tcp.ts_data[1].td_winflags 1087c478bd9Sstevel@tonic-gate #define is_sport is_tcp.ts_sport 1097c478bd9Sstevel@tonic-gate #define is_dport is_tcp.ts_dport 1107c478bd9Sstevel@tonic-gate #define is_ifpin is_ifp[0] 1117c478bd9Sstevel@tonic-gate #define is_ifpout is_ifp[2] 1127c478bd9Sstevel@tonic-gate #define is_gre is_ps.is_ug 113ab25eeb5Syz #define is_call is_gre.gs_call 1147c478bd9Sstevel@tonic-gate 1157c478bd9Sstevel@tonic-gate #define IS_WSPORT SI_W_SPORT /* 0x00100 */ 1167c478bd9Sstevel@tonic-gate #define IS_WDPORT SI_W_DPORT /* 0x00200 */ 1177c478bd9Sstevel@tonic-gate #define IS_WSADDR SI_W_SADDR /* 0x00400 */ 1187c478bd9Sstevel@tonic-gate #define IS_WDADDR SI_W_DADDR /* 0x00800 */ 1197c478bd9Sstevel@tonic-gate #define IS_NEWFR SI_NEWFR /* 0x01000 */ 1207c478bd9Sstevel@tonic-gate #define IS_CLONE SI_CLONE /* 0x02000 */ 1217c478bd9Sstevel@tonic-gate #define IS_CLONED SI_CLONED /* 0x04000 */ 1227c478bd9Sstevel@tonic-gate #define IS_TCPFSM 0x10000 1237c478bd9Sstevel@tonic-gate #define IS_STRICT 0x20000 1247c478bd9Sstevel@tonic-gate #define IS_ISNSYN 0x40000 1257c478bd9Sstevel@tonic-gate #define IS_ISNACK 0x80000 126ab25eeb5Syz #define IS_STATESYNC 0x100000 1277c478bd9Sstevel@tonic-gate /* 1287c478bd9Sstevel@tonic-gate * IS_SC flags are for scan-operations that need to be recognised in state. 1297c478bd9Sstevel@tonic-gate */ 1307c478bd9Sstevel@tonic-gate #define IS_SC_CLIENT 0x10000000 1317c478bd9Sstevel@tonic-gate #define IS_SC_SERVER 0x20000000 1327c478bd9Sstevel@tonic-gate #define IS_SC_MATCHC 0x40000000 1337c478bd9Sstevel@tonic-gate #define IS_SC_MATCHS 0x80000000 1347c478bd9Sstevel@tonic-gate #define IS_SC_MATCHALL (IS_SC_MATCHC|IS_SC_MATCHC) 1357c478bd9Sstevel@tonic-gate #define IS_SC_ALL (IS_SC_MATCHC|IS_SC_MATCHC|IS_SC_CLIENT|IS_SC_SERVER) 1367c478bd9Sstevel@tonic-gate 1377c478bd9Sstevel@tonic-gate /* 1387c478bd9Sstevel@tonic-gate * Flags that can be passed into fr_addstate 1397c478bd9Sstevel@tonic-gate */ 1407c478bd9Sstevel@tonic-gate #define IS_INHERITED 0x0fffff00 1417c478bd9Sstevel@tonic-gate 1427c478bd9Sstevel@tonic-gate #define TH_OPENING (TH_SYN|TH_ACK) 1437c478bd9Sstevel@tonic-gate /* 1447c478bd9Sstevel@tonic-gate * is_flags: 1457c478bd9Sstevel@tonic-gate * Bits 0 - 3 are use as a mask with the current packet's bits to check for 1467c478bd9Sstevel@tonic-gate * whether it is short, tcp/udp, a fragment or the presence of IP options. 1477c478bd9Sstevel@tonic-gate * Bits 4 - 7 are set from the initial packet and contain what the packet 1487c478bd9Sstevel@tonic-gate * anded with bits 0-3 must match. 1497c478bd9Sstevel@tonic-gate * Bits 8,9 are used to indicate wildcard source/destination port matching. 1507c478bd9Sstevel@tonic-gate * Bits 10,11 are reserved for other wildcard flag compatibility. 1517c478bd9Sstevel@tonic-gate * Bits 12,13 are for scaning. 1527c478bd9Sstevel@tonic-gate */ 1537c478bd9Sstevel@tonic-gate 1547c478bd9Sstevel@tonic-gate typedef struct ipstate_save { 1557c478bd9Sstevel@tonic-gate void *ips_next; 1567c478bd9Sstevel@tonic-gate struct ipstate ips_is; 1577c478bd9Sstevel@tonic-gate struct frentry ips_fr; 1587c478bd9Sstevel@tonic-gate } ipstate_save_t; 1597c478bd9Sstevel@tonic-gate 1607c478bd9Sstevel@tonic-gate #define ips_rule ips_is.is_rule 1617c478bd9Sstevel@tonic-gate 1627c478bd9Sstevel@tonic-gate 1637c478bd9Sstevel@tonic-gate typedef struct ipslog { 1647c478bd9Sstevel@tonic-gate U_QUAD_T isl_pkts[4]; 1657c478bd9Sstevel@tonic-gate U_QUAD_T isl_bytes[4]; 1667c478bd9Sstevel@tonic-gate i6addr_t isl_src; 1677c478bd9Sstevel@tonic-gate i6addr_t isl_dst; 1687c478bd9Sstevel@tonic-gate u_32_t isl_tag; 1697c478bd9Sstevel@tonic-gate u_short isl_type; 1707c478bd9Sstevel@tonic-gate union { 1717c478bd9Sstevel@tonic-gate u_short isl_filler[2]; 1727c478bd9Sstevel@tonic-gate u_short isl_ports[2]; 1737c478bd9Sstevel@tonic-gate u_short isl_icmp; 1747c478bd9Sstevel@tonic-gate } isl_ps; 1757c478bd9Sstevel@tonic-gate u_char isl_v; 1767c478bd9Sstevel@tonic-gate u_char isl_p; 1777c478bd9Sstevel@tonic-gate u_char isl_flags; 1787c478bd9Sstevel@tonic-gate u_char isl_state[2]; 1797c478bd9Sstevel@tonic-gate u_32_t isl_rulen; 1807c478bd9Sstevel@tonic-gate char isl_group[FR_GROUPLEN]; 1817c478bd9Sstevel@tonic-gate } ipslog_t; 1827c478bd9Sstevel@tonic-gate 1837c478bd9Sstevel@tonic-gate #define isl_sport isl_ps.isl_ports[0] 1847c478bd9Sstevel@tonic-gate #define isl_dport isl_ps.isl_ports[1] 1857c478bd9Sstevel@tonic-gate #define isl_itype isl_ps.isl_icmp 1867c478bd9Sstevel@tonic-gate 1877c478bd9Sstevel@tonic-gate #define ISL_NEW 0 1887c478bd9Sstevel@tonic-gate #define ISL_CLONE 1 1897c478bd9Sstevel@tonic-gate #define ISL_EXPIRE 0xffff 1907c478bd9Sstevel@tonic-gate #define ISL_FLUSH 0xfffe 1917c478bd9Sstevel@tonic-gate #define ISL_REMOVE 0xfffd 1927c478bd9Sstevel@tonic-gate #define ISL_INTERMEDIATE 0xfffc 1937c478bd9Sstevel@tonic-gate #define ISL_KILLED 0xfffb 1947c478bd9Sstevel@tonic-gate #define ISL_ORPHAN 0xfffa 1957c478bd9Sstevel@tonic-gate 1967c478bd9Sstevel@tonic-gate 1977c478bd9Sstevel@tonic-gate typedef struct ips_stat { 1987c478bd9Sstevel@tonic-gate u_long iss_hits; 1997c478bd9Sstevel@tonic-gate u_long iss_miss; 2007c478bd9Sstevel@tonic-gate u_long iss_max; 2017c478bd9Sstevel@tonic-gate u_long iss_maxref; 2027c478bd9Sstevel@tonic-gate u_long iss_tcp; 2037c478bd9Sstevel@tonic-gate u_long iss_udp; 2047c478bd9Sstevel@tonic-gate u_long iss_icmp; 2057c478bd9Sstevel@tonic-gate u_long iss_nomem; 2067c478bd9Sstevel@tonic-gate u_long iss_expire; 2077c478bd9Sstevel@tonic-gate u_long iss_fin; 2087c478bd9Sstevel@tonic-gate u_long iss_active; 2097c478bd9Sstevel@tonic-gate u_long iss_logged; 2107c478bd9Sstevel@tonic-gate u_long iss_logfail; 2117c478bd9Sstevel@tonic-gate u_long iss_inuse; 2127c478bd9Sstevel@tonic-gate u_long iss_wild; 2137c478bd9Sstevel@tonic-gate u_long iss_killed; 2147c478bd9Sstevel@tonic-gate u_long iss_ticks; 2157c478bd9Sstevel@tonic-gate u_long iss_bucketfull; 2167c478bd9Sstevel@tonic-gate int iss_statesize; 2177c478bd9Sstevel@tonic-gate int iss_statemax; 2187c478bd9Sstevel@tonic-gate ipstate_t **iss_table; 2197c478bd9Sstevel@tonic-gate ipstate_t *iss_list; 2207c478bd9Sstevel@tonic-gate u_long *iss_bucketlen; 2215b48165cSJohn Ojemann u_int iss_orphans; 2227c478bd9Sstevel@tonic-gate } ips_stat_t; 2237c478bd9Sstevel@tonic-gate 22452239d04San typedef struct port_pair { 22552239d04San uint16_t pp_sport; 22652239d04San uint16_t pp_dport; 22752239d04San } port_pair_t; 22852239d04San 229f4b3ec61Sdh extern int fr_stateinit __P((ipf_stack_t *)); 2307c478bd9Sstevel@tonic-gate extern ipstate_t *fr_addstate __P((fr_info_t *, ipstate_t **, u_int)); 2317c478bd9Sstevel@tonic-gate extern frentry_t *fr_checkstate __P((struct fr_info *, u_32_t *)); 2327c478bd9Sstevel@tonic-gate extern ipstate_t *fr_stlookup __P((fr_info_t *, tcphdr_t *, ipftq_t **)); 233f4b3ec61Sdh extern void fr_statesync __P((int, int, void *, char *, ipf_stack_t *)); 234f4b3ec61Sdh extern void fr_timeoutstate __P((ipf_stack_t *)); 2357c478bd9Sstevel@tonic-gate extern int fr_tcp_age __P((struct ipftqent *, struct fr_info *, 2367c478bd9Sstevel@tonic-gate struct ipftq *, int)); 2377c478bd9Sstevel@tonic-gate extern int fr_tcpinwindow __P((struct fr_info *, struct tcpdata *, 238ab25eeb5Syz struct tcpdata *, tcphdr_t *, int)); 239f4b3ec61Sdh extern void fr_stateunload __P((ipf_stack_t *)); 240f4b3ec61Sdh extern void ipstate_log __P((struct ipstate *, u_int, ipf_stack_t *)); 241f4b3ec61Sdh extern int fr_state_ioctl __P((caddr_t, ioctlcmd_t, int, int, void *, ipf_stack_t *)); 242f4b3ec61Sdh extern void fr_stinsert __P((struct ipstate *, int, ipf_stack_t *)); 243f4b3ec61Sdh extern void fr_sttab_init __P((struct ipftq *, ipf_stack_t *)); 2447c478bd9Sstevel@tonic-gate extern void fr_sttab_destroy __P((struct ipftq *)); 2457c478bd9Sstevel@tonic-gate extern void fr_updatestate __P((fr_info_t *, ipstate_t *, ipftq_t *)); 24690b0a856Sjojemann extern void fr_statederef __P((ipstate_t **, ipf_stack_t *)); 247f4b3ec61Sdh extern void fr_setstatequeue __P((ipstate_t *, int, ipf_stack_t *)); 248ea8244dcSJohn Ojemann extern int fr_delstate __P((ipstate_t *, int, ipf_stack_t *)); 249e8d569f4SAlexandr Nedvedicky #if SOLARIS2 >= 10 250e8d569f4SAlexandr Nedvedicky extern void fr_stateifindexsync __P((void *, void *, ipf_stack_t *)); 251e8d569f4SAlexandr Nedvedicky #endif 2527c478bd9Sstevel@tonic-gate 2537c478bd9Sstevel@tonic-gate #endif /* __IP_STATE_H__ */ 254