1*f4b3ec61Sdh /* 2*f4b3ec61Sdh * Copyright (C) 1993-2001, 2003 by Darren Reed. 3*f4b3ec61Sdh * 4*f4b3ec61Sdh * See the IPFILTER.LICENCE file for details on licencing. 5*f4b3ec61Sdh * 6*f4b3ec61Sdh * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 7*f4b3ec61Sdh * Use is subject to license terms. 8*f4b3ec61Sdh */ 9*f4b3ec61Sdh 10*f4b3ec61Sdh #pragma ident "%Z%%M% %I% %E% SMI" 11*f4b3ec61Sdh 12*f4b3ec61Sdh #ifndef __IPF_STACK_H__ 13*f4b3ec61Sdh #define __IPF_STACK_H__ 14*f4b3ec61Sdh 15*f4b3ec61Sdh /* FIXME: appears needed for ip_proxy.h - tcpseq */ 16*f4b3ec61Sdh #include <net/route.h> 17*f4b3ec61Sdh #include <netinet/in.h> 18*f4b3ec61Sdh #include <netinet/in_systm.h> 19*f4b3ec61Sdh #include <netinet/ip.h> 20*f4b3ec61Sdh #include <netinet/ip_var.h> 21*f4b3ec61Sdh #include <netinet/tcp.h> 22*f4b3ec61Sdh #include <netinet/udp.h> 23*f4b3ec61Sdh #include <netinet/ip_icmp.h> 24*f4b3ec61Sdh #include <netinet/tcpip.h> 25*f4b3ec61Sdh 26*f4b3ec61Sdh #include "ip_compat.h" 27*f4b3ec61Sdh #include "ip_fil.h" 28*f4b3ec61Sdh #include "ip_nat.h" 29*f4b3ec61Sdh #include "ip_frag.h" 30*f4b3ec61Sdh #include "ip_state.h" 31*f4b3ec61Sdh #include "ip_proxy.h" 32*f4b3ec61Sdh #include "ip_auth.h" 33*f4b3ec61Sdh #include "ip_lookup.h" 34*f4b3ec61Sdh #include "ip_pool.h" 35*f4b3ec61Sdh #include "ip_htable.h" 36*f4b3ec61Sdh #include <net/radix.h> 37*f4b3ec61Sdh #include <sys/neti.h> 38*f4b3ec61Sdh #include <sys/hook.h> 39*f4b3ec61Sdh 40*f4b3ec61Sdh /* 41*f4b3ec61Sdh * IPF stack instances 42*f4b3ec61Sdh */ 43*f4b3ec61Sdh struct ipf_stack { 44*f4b3ec61Sdh netstack_t *ifs_netstack; 45*f4b3ec61Sdh 46*f4b3ec61Sdh /* ipf module */ 47*f4b3ec61Sdh fr_info_t ifs_frcache[2][8]; 48*f4b3ec61Sdh 49*f4b3ec61Sdh filterstats_t ifs_frstats[2]; 50*f4b3ec61Sdh frentry_t *ifs_ipfilter[2][2]; 51*f4b3ec61Sdh frentry_t *ifs_ipfilter6[2][2]; 52*f4b3ec61Sdh frentry_t *ifs_ipacct6[2][2]; 53*f4b3ec61Sdh frentry_t *ifs_ipacct[2][2]; 54*f4b3ec61Sdh #if 0 /* not used */ 55*f4b3ec61Sdh frentry_t *ifs_ipnatrules[2][2]; 56*f4b3ec61Sdh #endif 57*f4b3ec61Sdh frgroup_t *ifs_ipfgroups[IPL_LOGSIZE][2]; 58*f4b3ec61Sdh int ifs_fr_refcnt; 59*f4b3ec61Sdh /* 60*f4b3ec61Sdh * For fr_running: 61*f4b3ec61Sdh * 0 == loading, 1 = running, -1 = disabled, -2 = unloading 62*f4b3ec61Sdh */ 63*f4b3ec61Sdh int ifs_fr_running; 64*f4b3ec61Sdh int ifs_fr_flags; 65*f4b3ec61Sdh int ifs_fr_active; 66*f4b3ec61Sdh int ifs_fr_control_forwarding; 67*f4b3ec61Sdh int ifs_fr_update_ipid; 68*f4b3ec61Sdh #if 0 69*f4b3ec61Sdh ushort_t ifs_fr_ip_id; 70*f4b3ec61Sdh #endif 71*f4b3ec61Sdh int ifs_fr_chksrc; 72*f4b3ec61Sdh int ifs_fr_minttl; 73*f4b3ec61Sdh int ifs_fr_icmpminfragmtu; 74*f4b3ec61Sdh int ifs_fr_pass; 75*f4b3ec61Sdh ulong_t ifs_fr_frouteok[2]; 76*f4b3ec61Sdh ulong_t ifs_fr_userifqs; 77*f4b3ec61Sdh ulong_t ifs_fr_badcoalesces[2]; 78*f4b3ec61Sdh uchar_t ifs_ipf_iss_secret[32]; 79*f4b3ec61Sdh timeout_id_t ifs_fr_timer_id; 80*f4b3ec61Sdh #if 0 81*f4b3ec61Sdh timeout_id_t ifs_synctimeoutid; 82*f4b3ec61Sdh #endif 83*f4b3ec61Sdh int ifs_ipf_locks_done; 84*f4b3ec61Sdh 85*f4b3ec61Sdh ipftoken_t *ifs_ipftokenhead; 86*f4b3ec61Sdh ipftoken_t **ifs_ipftokentail; 87*f4b3ec61Sdh 88*f4b3ec61Sdh ipfmutex_t ifs_ipl_mutex; 89*f4b3ec61Sdh ipfmutex_t ifs_ipf_authmx; 90*f4b3ec61Sdh ipfmutex_t ifs_ipf_rw; 91*f4b3ec61Sdh ipfmutex_t ifs_ipf_timeoutlock; 92*f4b3ec61Sdh ipfrwlock_t ifs_ipf_mutex; 93*f4b3ec61Sdh ipfrwlock_t ifs_ipf_global; 94*f4b3ec61Sdh ipfrwlock_t ifs_ipf_frcache; 95*f4b3ec61Sdh ipfrwlock_t ifs_ip_poolrw; 96*f4b3ec61Sdh ipfrwlock_t ifs_ipf_frag; 97*f4b3ec61Sdh ipfrwlock_t ifs_ipf_state; 98*f4b3ec61Sdh ipfrwlock_t ifs_ipf_nat; 99*f4b3ec61Sdh ipfrwlock_t ifs_ipf_natfrag; 100*f4b3ec61Sdh ipfmutex_t ifs_ipf_nat_new; 101*f4b3ec61Sdh ipfmutex_t ifs_ipf_natio; 102*f4b3ec61Sdh ipfrwlock_t ifs_ipf_auth; 103*f4b3ec61Sdh ipfmutex_t ifs_ipf_stinsert; 104*f4b3ec61Sdh ipfrwlock_t ifs_ipf_ipidfrag; 105*f4b3ec61Sdh ipfrwlock_t ifs_ipf_tokens; 106*f4b3ec61Sdh kcondvar_t ifs_iplwait; 107*f4b3ec61Sdh kcondvar_t ifs_ipfauthwait; 108*f4b3ec61Sdh 109*f4b3ec61Sdh ipftuneable_t *ifs_ipf_tuneables; 110*f4b3ec61Sdh ipftuneable_t *ifs_ipf_tunelist; 111*f4b3ec61Sdh 112*f4b3ec61Sdh /* ip_fil_solaris.c */ 113*f4b3ec61Sdh hook_t ifs_ipfhook_in; 114*f4b3ec61Sdh hook_t ifs_ipfhook_out; 115*f4b3ec61Sdh hook_t ifs_ipfhook_loop_in; 116*f4b3ec61Sdh hook_t ifs_ipfhook_loop_out; 117*f4b3ec61Sdh hook_t ifs_ipfhook_nicevents; 118*f4b3ec61Sdh 119*f4b3ec61Sdh /* flags to indicate whether hooks are registered. */ 120*f4b3ec61Sdh boolean_t ifs_hook4_physical_in; 121*f4b3ec61Sdh boolean_t ifs_hook4_physical_out; 122*f4b3ec61Sdh boolean_t ifs_hook4_nic_events; 123*f4b3ec61Sdh boolean_t ifs_hook4_loopback_in; 124*f4b3ec61Sdh boolean_t ifs_hook4_loopback_out; 125*f4b3ec61Sdh boolean_t ifs_hook6_physical_in; 126*f4b3ec61Sdh boolean_t ifs_hook6_physical_out; 127*f4b3ec61Sdh boolean_t ifs_hook6_nic_events; 128*f4b3ec61Sdh boolean_t ifs_hook6_loopback_in; 129*f4b3ec61Sdh boolean_t ifs_hook6_loopback_out; 130*f4b3ec61Sdh 131*f4b3ec61Sdh int ifs_ipf_loopback; 132*f4b3ec61Sdh net_data_t ifs_ipf_ipv4; 133*f4b3ec61Sdh net_data_t ifs_ipf_ipv6; 134*f4b3ec61Sdh 135*f4b3ec61Sdh /* ip_auth.c */ 136*f4b3ec61Sdh int ifs_fr_authsize; 137*f4b3ec61Sdh int ifs_fr_authused; 138*f4b3ec61Sdh int ifs_fr_defaultauthage; 139*f4b3ec61Sdh int ifs_fr_auth_lock; 140*f4b3ec61Sdh int ifs_fr_auth_init; 141*f4b3ec61Sdh fr_authstat_t ifs_fr_authstats; 142*f4b3ec61Sdh frauth_t *ifs_fr_auth; 143*f4b3ec61Sdh mb_t **ifs_fr_authpkts; 144*f4b3ec61Sdh int ifs_fr_authstart; 145*f4b3ec61Sdh int ifs_fr_authend; 146*f4b3ec61Sdh int ifs_fr_authnext; 147*f4b3ec61Sdh frauthent_t *ifs_fae_list; 148*f4b3ec61Sdh frentry_t *ifs_ipauth; 149*f4b3ec61Sdh frentry_t *ifs_fr_authlist; 150*f4b3ec61Sdh 151*f4b3ec61Sdh /* ip_frag.c */ 152*f4b3ec61Sdh ipfr_t *ifs_ipfr_list; 153*f4b3ec61Sdh ipfr_t **ifs_ipfr_tail; 154*f4b3ec61Sdh ipfr_t **ifs_ipfr_heads; 155*f4b3ec61Sdh 156*f4b3ec61Sdh ipfr_t *ifs_ipfr_natlist; 157*f4b3ec61Sdh ipfr_t **ifs_ipfr_nattail; 158*f4b3ec61Sdh ipfr_t **ifs_ipfr_nattab; 159*f4b3ec61Sdh 160*f4b3ec61Sdh ipfr_t *ifs_ipfr_ipidlist; 161*f4b3ec61Sdh ipfr_t **ifs_ipfr_ipidtail; 162*f4b3ec61Sdh ipfr_t **ifs_ipfr_ipidtab; 163*f4b3ec61Sdh 164*f4b3ec61Sdh ipfrstat_t ifs_ipfr_stats; 165*f4b3ec61Sdh int ifs_ipfr_inuse; 166*f4b3ec61Sdh int ifs_ipfr_size; 167*f4b3ec61Sdh 168*f4b3ec61Sdh int ifs_fr_ipfrttl; 169*f4b3ec61Sdh int ifs_fr_frag_lock; 170*f4b3ec61Sdh int ifs_fr_frag_init; 171*f4b3ec61Sdh ulong_t ifs_fr_ticks; 172*f4b3ec61Sdh 173*f4b3ec61Sdh frentry_t ifs_frblock; 174*f4b3ec61Sdh 175*f4b3ec61Sdh /* ip_htable.c */ 176*f4b3ec61Sdh iphtable_t *ifs_ipf_htables[IPL_LOGSIZE]; 177*f4b3ec61Sdh ulong_t ifs_ipht_nomem[IPL_LOGSIZE]; 178*f4b3ec61Sdh ulong_t ifs_ipf_nhtables[IPL_LOGSIZE]; 179*f4b3ec61Sdh ulong_t ifs_ipf_nhtnodes[IPL_LOGSIZE]; 180*f4b3ec61Sdh 181*f4b3ec61Sdh /* ip_log.c */ 182*f4b3ec61Sdh iplog_t **ifs_iplh[IPL_LOGSIZE]; 183*f4b3ec61Sdh iplog_t *ifs_iplt[IPL_LOGSIZE]; 184*f4b3ec61Sdh iplog_t *ifs_ipll[IPL_LOGSIZE]; 185*f4b3ec61Sdh int ifs_iplused[IPL_LOGSIZE]; 186*f4b3ec61Sdh fr_info_t ifs_iplcrc[IPL_LOGSIZE]; 187*f4b3ec61Sdh int ifs_ipl_suppress; 188*f4b3ec61Sdh int ifs_ipl_buffer_sz; 189*f4b3ec61Sdh int ifs_ipl_logmax; 190*f4b3ec61Sdh int ifs_ipl_logall; 191*f4b3ec61Sdh int ifs_ipl_log_init; 192*f4b3ec61Sdh int ifs_ipl_logsize; 193*f4b3ec61Sdh 194*f4b3ec61Sdh /* ip_lookup.c */ 195*f4b3ec61Sdh ip_pool_stat_t ifs_ippoolstat; 196*f4b3ec61Sdh int ifs_ip_lookup_inited; 197*f4b3ec61Sdh 198*f4b3ec61Sdh /* ip_nat.c */ 199*f4b3ec61Sdh /* nat_table[0] -> hashed list sorted by inside (ip, port) */ 200*f4b3ec61Sdh /* nat_table[1] -> hashed list sorted by outside (ip, port) */ 201*f4b3ec61Sdh nat_t **ifs_nat_table[2]; 202*f4b3ec61Sdh nat_t *ifs_nat_instances; 203*f4b3ec61Sdh ipnat_t *ifs_nat_list; 204*f4b3ec61Sdh uint_t ifs_ipf_nattable_sz; 205*f4b3ec61Sdh uint_t ifs_ipf_nattable_max; 206*f4b3ec61Sdh uint_t ifs_ipf_natrules_sz; 207*f4b3ec61Sdh uint_t ifs_ipf_rdrrules_sz; 208*f4b3ec61Sdh uint_t ifs_ipf_hostmap_sz; 209*f4b3ec61Sdh uint_t ifs_fr_nat_maxbucket; 210*f4b3ec61Sdh uint_t ifs_fr_nat_maxbucket_reset; 211*f4b3ec61Sdh uint32_t ifs_nat_masks; 212*f4b3ec61Sdh uint32_t ifs_rdr_masks; 213*f4b3ec61Sdh ipnat_t **ifs_nat_rules; 214*f4b3ec61Sdh ipnat_t **ifs_rdr_rules; 215*f4b3ec61Sdh hostmap_t **ifs_maptable; 216*f4b3ec61Sdh hostmap_t *ifs_ipf_hm_maplist; 217*f4b3ec61Sdh 218*f4b3ec61Sdh ipftq_t ifs_nat_tqb[IPF_TCP_NSTATES]; 219*f4b3ec61Sdh ipftq_t ifs_nat_udptq; 220*f4b3ec61Sdh ipftq_t ifs_nat_icmptq; 221*f4b3ec61Sdh ipftq_t ifs_nat_iptq; 222*f4b3ec61Sdh ipftq_t *ifs_nat_utqe; 223*f4b3ec61Sdh int ifs_nat_logging; 224*f4b3ec61Sdh ulong_t ifs_fr_defnatage; 225*f4b3ec61Sdh ulong_t ifs_fr_defnatipage; 226*f4b3ec61Sdh ulong_t ifs_fr_defnaticmpage; 227*f4b3ec61Sdh natstat_t ifs_nat_stats; 228*f4b3ec61Sdh int ifs_fr_nat_lock; 229*f4b3ec61Sdh int ifs_fr_nat_init; 230*f4b3ec61Sdh 231*f4b3ec61Sdh /* ip_pool.c */ 232*f4b3ec61Sdh ip_pool_stat_t ifs_ipoolstat; 233*f4b3ec61Sdh ip_pool_t *ifs_ip_pool_list[IPL_LOGSIZE]; 234*f4b3ec61Sdh 235*f4b3ec61Sdh /* ip_proxy.c */ 236*f4b3ec61Sdh ap_session_t *ifs_ap_sess_list; 237*f4b3ec61Sdh aproxy_t *ifs_ap_proxylist; 238*f4b3ec61Sdh aproxy_t *ifs_ap_proxies; /* copy of lcl_ap_proxies */ 239*f4b3ec61Sdh 240*f4b3ec61Sdh /* ip_state.c */ 241*f4b3ec61Sdh ipstate_t **ifs_ips_table; 242*f4b3ec61Sdh ulong_t *ifs_ips_seed; 243*f4b3ec61Sdh int ifs_ips_num; 244*f4b3ec61Sdh ulong_t ifs_ips_last_force_flush; 245*f4b3ec61Sdh ips_stat_t ifs_ips_stats; 246*f4b3ec61Sdh 247*f4b3ec61Sdh ulong_t ifs_fr_tcpidletimeout; 248*f4b3ec61Sdh ulong_t ifs_fr_tcpclosewait; 249*f4b3ec61Sdh ulong_t ifs_fr_tcplastack; 250*f4b3ec61Sdh ulong_t ifs_fr_tcptimeout; 251*f4b3ec61Sdh ulong_t ifs_fr_tcpclosed; 252*f4b3ec61Sdh ulong_t ifs_fr_tcphalfclosed; 253*f4b3ec61Sdh ulong_t ifs_fr_udptimeout; 254*f4b3ec61Sdh ulong_t ifs_fr_udpacktimeout; 255*f4b3ec61Sdh ulong_t ifs_fr_icmptimeout; 256*f4b3ec61Sdh ulong_t ifs_fr_icmpacktimeout; 257*f4b3ec61Sdh int ifs_fr_statemax; 258*f4b3ec61Sdh int ifs_fr_statesize; 259*f4b3ec61Sdh int ifs_fr_state_doflush; 260*f4b3ec61Sdh int ifs_fr_state_lock; 261*f4b3ec61Sdh int ifs_fr_state_maxbucket; 262*f4b3ec61Sdh int ifs_fr_state_maxbucket_reset; 263*f4b3ec61Sdh int ifs_fr_state_init; 264*f4b3ec61Sdh ipftq_t ifs_ips_tqtqb[IPF_TCP_NSTATES]; 265*f4b3ec61Sdh ipftq_t ifs_ips_udptq; 266*f4b3ec61Sdh ipftq_t ifs_ips_udpacktq; 267*f4b3ec61Sdh ipftq_t ifs_ips_iptq; 268*f4b3ec61Sdh ipftq_t ifs_ips_icmptq; 269*f4b3ec61Sdh ipftq_t ifs_ips_icmpacktq; 270*f4b3ec61Sdh ipftq_t *ifs_ips_utqe; 271*f4b3ec61Sdh int ifs_ipstate_logging; 272*f4b3ec61Sdh ipstate_t *ifs_ips_list; 273*f4b3ec61Sdh ulong_t ifs_fr_iptimeout; 274*f4b3ec61Sdh 275*f4b3ec61Sdh /* radix.c */ 276*f4b3ec61Sdh int ifs_max_keylen; 277*f4b3ec61Sdh struct radix_mask *ifs_rn_mkfreelist; 278*f4b3ec61Sdh struct radix_node_head *ifs_mask_rnhead; 279*f4b3ec61Sdh char *ifs_addmask_key; 280*f4b3ec61Sdh char *ifs_rn_zeros; 281*f4b3ec61Sdh char *ifs_rn_ones; 282*f4b3ec61Sdh #ifdef KERNEL 283*f4b3ec61Sdh /* kstats for inbound and outbound */ 284*f4b3ec61Sdh kstat_t *ifs_kstatp[2]; 285*f4b3ec61Sdh #endif 286*f4b3ec61Sdh }; 287*f4b3ec61Sdh 288*f4b3ec61Sdh #endif /* __IPF_STACK_H__ */ 289