1 /*
   2  * Copyright (C) 1993-2001, 2003 by Darren Reed.
   3  *
   4  * See the IPFILTER.LICENCE file for details on licencing.
   5  *
   6  * @(#)ip_fil.h 1.35 6/5/96
   7  * $Id: ip_fil.h,v 2.170.2.22 2005/07/16 05:55:35 darrenr Exp $
   8  *
   9  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
  10  *
  11  * Copyright (c) 2014, Joyent, Inc.  All rights reserved.
  12  */
  13 
  14 #ifndef __IP_FIL_H__
  15 #define __IP_FIL_H__
  16 
  17 #include "netinet/ip_compat.h"
  18 #include <sys/zone.h>
  19 
  20 #ifndef SOLARIS
  21 # define SOLARIS (defined(sun) && (defined(__svr4__) || defined(__SVR4)))
  22 #endif
  23 
  24 #ifndef __P
  25 # ifdef __STDC__
  26 #  define       __P(x)  x
  27 # else
  28 #  define       __P(x)  ()
  29 # endif
  30 #endif
  31 
  32 #if defined(__STDC__) || defined(__GNUC__) || defined(_AIX51)
  33 # define        SIOCADAFR       _IOW('r', 60, struct ipfobj)
  34 # define        SIOCRMAFR       _IOW('r', 61, struct ipfobj)
  35 # define        SIOCSETFF       _IOW('r', 62, u_int)
  36 # define        SIOCGETFF       _IOR('r', 63, u_int)
  37 # define        SIOCGETFS       _IOWR('r', 64, struct ipfobj)
  38 # define        SIOCIPFFL       _IOWR('r', 65, int)
  39 # define        SIOCIPFFB       _IOR('r', 66, int)
  40 # define        SIOCADIFR       _IOW('r', 67, struct ipfobj)
  41 # define        SIOCRMIFR       _IOW('r', 68, struct ipfobj)
  42 # define        SIOCSWAPA       _IOR('r', 69, u_int)
  43 # define        SIOCINAFR       _IOW('r', 70, struct ipfobj)
  44 # define        SIOCINIFR       _IOW('r', 71, struct ipfobj)
  45 # define        SIOCFRENB       _IOW('r', 72, u_int)
  46 # define        SIOCFRSYN       _IOW('r', 73, u_int)
  47 # define        SIOCFRZST       _IOWR('r', 74, struct ipfobj)
  48 # define        SIOCZRLST       _IOWR('r', 75, struct ipfobj)
  49 # define        SIOCAUTHW       _IOWR('r', 76, struct ipfobj)
  50 # define        SIOCAUTHR       _IOWR('r', 77, struct ipfobj)
  51 # define        SIOCATHST       _IOWR('r', 78, struct ipfobj)
  52 # define        SIOCSTLCK       _IOWR('r', 79, u_int)
  53 # define        SIOCSTPUT       _IOWR('r', 80, struct ipfobj)
  54 # define        SIOCSTGET       _IOWR('r', 81, struct ipfobj)
  55 # define        SIOCSTGSZ       _IOWR('r', 82, struct ipfobj)
  56 # define        SIOCGFRST       _IOWR('r', 83, struct ipfobj)
  57 # define        SIOCSETLG       _IOWR('r', 84, int)
  58 # define        SIOCGETLG       _IOWR('r', 85, int)
  59 # define        SIOCFUNCL       _IOWR('r', 86, struct ipfunc_resolve)
  60 # define        SIOCIPFGETNEXT  _IOWR('r', 87, struct ipfobj)
  61 # define        SIOCIPFGET      _IOWR('r', 88, struct ipfobj)
  62 # define        SIOCIPFSET      _IOWR('r', 89, struct ipfobj)
  63 # define        SIOCIPFL6       _IOWR('r', 90, int)
  64 # define        SIOCIPFLP       _IOWR('r', 91, int)
  65 # define        SIOCIPFITER     _IOWR('r', 92, struct ipfobj)
  66 # define        SIOCGENITER     _IOWR('r', 93, struct ipfobj)
  67 # define        SIOCGTABL       _IOWR('r', 94, struct ipfobj)
  68 # define        SIOCIPFDELTOK   _IOWR('r', 95, int)
  69 # define        SIOCLOOKUPITER  _IOWR('r', 96, struct ipfobj)
  70 #else
  71 # define        SIOCADAFR       _IOW(r, 60, struct ipfobj)
  72 # define        SIOCRMAFR       _IOW(r, 61, struct ipfobj)
  73 # define        SIOCSETFF       _IOW(r, 62, u_int)
  74 # define        SIOCGETFF       _IOR(r, 63, u_int)
  75 # define        SIOCGETFS       _IOWR(r, 64, struct ipfobj)
  76 # define        SIOCIPFFL       _IOWR(r, 65, int)
  77 # define        SIOCIPFFB       _IOR(r, 66, int)
  78 # define        SIOCADIFR       _IOW(r, 67, struct ipfobj)
  79 # define        SIOCRMIFR       _IOW(r, 68, struct ipfobj)
  80 # define        SIOCSWAPA       _IOR(r, 69, u_int)
  81 # define        SIOCINAFR       _IOW(r, 70, struct ipfobj)
  82 # define        SIOCINIFR       _IOW(r, 71, struct ipfobj)
  83 # define        SIOCFRENB       _IOW(r, 72, u_int)
  84 # define        SIOCFRSYN       _IOW(r, 73, u_int)
  85 # define        SIOCFRZST       _IOWR(r, 74, struct ipfobj)
  86 # define        SIOCZRLST       _IOWR(r, 75, struct ipfobj)
  87 # define        SIOCAUTHW       _IOWR(r, 76, struct ipfobj)
  88 # define        SIOCAUTHR       _IOWR(r, 77, struct ipfobj)
  89 # define        SIOCATHST       _IOWR(r, 78, struct ipfobj)
  90 # define        SIOCSTLCK       _IOWR(r, 79, u_int)
  91 # define        SIOCSTPUT       _IOWR(r, 80, struct ipfobj)
  92 # define        SIOCSTGET       _IOWR(r, 81, struct ipfobj)
  93 # define        SIOCSTGSZ       _IOWR(r, 82, struct ipfobj)
  94 # define        SIOCGFRST       _IOWR(r, 83, struct ipfobj)
  95 # define        SIOCSETLG       _IOWR(r, 84, int)
  96 # define        SIOCGETLG       _IOWR(r, 85, int)
  97 # define        SIOCFUNCL       _IOWR(r, 86, struct ipfunc_resolve)
  98 # define        SIOCIPFGETNEXT  _IOWR(r, 87, struct ipfobj)
  99 # define        SIOCIPFGET      _IOWR(r, 88, struct ipfobj)
 100 # define        SIOCIPFSET      _IOWR(r, 89, struct ipfobj)
 101 # define        SIOCIPFL6       _IOWR(r, 90, int)
 102 # define        SIOCIPFLP       _IOWR(r, 91, int)
 103 # define        SIOCIPFITER     _IOWR(r, 92, struct ipfobj)
 104 # define        SIOCGENITER     _IOWR(r, 93, struct ipfobj)
 105 # define        SIOCGTABL       _IOWR(r, 94, struct ipfobj)
 106 # define        SIOCIPFDELTOK   _IOWR(r, 95, int)
 107 # define        SIOCLOOKUPITER  _IOWR(r, 96, struct ipfobj)
 108 #endif
 109 #define SIOCADDFR       SIOCADAFR
 110 #define SIOCDELFR       SIOCRMAFR
 111 #define SIOCINSFR       SIOCINAFR
 112 # define        SIOCIPFZONESET  _IOWR('r', 97, struct ipfzoneobj)
 113 
 114 /*
 115  * What type of table is getting flushed?
 116  */
 117 
 118 #define NAT_FLUSH       1
 119 #define STATE_FLUSH     2
 120 
 121 /*
 122  * What table flush options are available?
 123  */
 124 
 125 #define FLUSH_LIST      0
 126 #define FLUSH_TABLE_ALL         1       /* Flush entire table */
 127 #define FLUSH_TABLE_CLOSING     2       /* Flush "closing" entries" */
 128 #define FLUSH_TABLE_EXTRA       3       /* Targetted flush: almost closed, long idle */
 129 
 130 #define VALID_TABLE_FLUSH_OPT(x)        ((x) >= 1 && (x) <= 3)
 131 
 132 /*
 133  * Define the default hi and lo watermarks used when flushing the
 134  * tables.  The values represent percent full of respective tables.
 135  */
 136 
 137 #define NAT_FLUSH_HI    95
 138 #define NAT_FLUSH_LO    75
 139 
 140 #define ST_FLUSH_HI     95
 141 #define ST_FLUSH_LO     75
 142 
 143 /*
 144  * How full are the tables?
 145  */
 146 
 147 #define NAT_TAB_WATER_LEVEL(x)  ((x)->ifs_nat_stats.ns_inuse * 100 \
 148                                 / (x)->ifs_ipf_nattable_max)
 149 
 150 #define ST_TAB_WATER_LEVEL(x)   ((x)->ifs_ips_num * 100 \
 151                                 / (x)->ifs_fr_statemax)
 152 
 153 struct ipscan;
 154 struct ifnet;
 155 
 156 typedef struct ipf_stack ipf_stack_t;
 157 typedef struct fr_info fr_info_t;
 158 
 159 typedef int     (* lookupfunc_t) __P((void *, int, void *, fr_info_t *, ipf_stack_t *));
 160 
 161 /*
 162  * i6addr is used as a container for both IPv4 and IPv6 addresses, as well
 163  * as other types of objects, depending on its qualifier.
 164  */
 165 #ifdef  USE_INET6
 166 typedef union   i6addr  {
 167         u_32_t  i6[4];
 168         struct  in_addr in4;
 169         struct  in6_addr in6;
 170         void    *vptr[2];
 171         lookupfunc_t    lptr[2];
 172 } i6addr_t;
 173 #define in6_addr8       in6.s6_addr
 174 #else
 175 typedef union   i6addr  {
 176         u_32_t  i6[4];
 177         struct  in_addr in4;
 178         void    *vptr[2];
 179         lookupfunc_t    lptr[2];
 180 } i6addr_t;
 181 #endif
 182 
 183 #define in4_addr        in4.s_addr
 184 #define iplookupnum     i6[0]
 185 #define iplookuptype    i6[1]
 186 /*
 187  * NOTE: These DO overlap the above on 64bit systems and this IS recognised.
 188  */
 189 #define iplookupptr     vptr[0]
 190 #define iplookupfunc    lptr[1]
 191 
 192 #define I60(x)  (((i6addr_t *)(x))->i6[0])
 193 #define I61(x)  (((i6addr_t *)(x))->i6[1])
 194 #define I62(x)  (((i6addr_t *)(x))->i6[2])
 195 #define I63(x)  (((i6addr_t *)(x))->i6[3])
 196 #define HI60(x) ntohl(((i6addr_t *)(x))->i6[0])
 197 #define HI61(x) ntohl(((i6addr_t *)(x))->i6[1])
 198 #define HI62(x) ntohl(((i6addr_t *)(x))->i6[2])
 199 #define HI63(x) ntohl(((i6addr_t *)(x))->i6[3])
 200 
 201 #define IP6_EQ(a,b)     ((I63(a) == I63(b)) && (I62(a) == I62(b)) && \
 202                          (I61(a) == I61(b)) && (I60(a) == I60(b)))
 203 #define IP6_NEQ(a,b)    ((I63(a) != I63(b)) || (I62(a) != I62(b)) || \
 204                          (I61(a) != I61(b)) || (I60(a) != I60(b)))
 205 #define IP6_ISZERO(a)   ((I60(a) | I61(a) | I62(a) | I63(a)) == 0)
 206 #define IP6_NOTZERO(a)  ((I60(a) | I61(a) | I62(a) | I63(a)) != 0)
 207 #define IP6_ISONES(a)   ((I63(a) == 0xffffffff) && (I62(a) == 0xffffffff) && \
 208                          (I61(a) == 0xffffffff) && (I60(a) == 0xffffffff))
 209 #define IP6_GT(a,b)     (ntohl(HI60(a)) > ntohl(HI60(b)) || \
 210                          (HI60(a) == HI60(b) && \
 211                           (ntohl(HI61(a)) > ntohl(HI61(b)) || \
 212                            (HI61(a) == HI61(b) && \
 213                             (ntohl(HI62(a)) > ntohl(HI62(b)) || \
 214                              (HI62(a) == HI62(b) && \
 215                               ntohl(HI63(a)) > ntohl(HI63(b))))))))
 216 #define IP6_LT(a,b)     (ntohl(HI60(a)) < ntohl(HI60(b)) || \
 217                          (HI60(a) == HI60(b) && \
 218                           (ntohl(HI61(a)) < ntohl(HI61(b)) || \
 219                            (HI61(a) == HI61(b) && \
 220                             (ntohl(HI62(a)) < ntohl(HI62(b)) || \
 221                              (HI62(a) == HI62(b) && \
 222                               ntohl(HI63(a)) < ntohl(HI63(b))))))))
 223 #define NLADD(n,x)      htonl(ntohl(n) + (x))
 224 #define IP6_INC(a)      \
 225                 { i6addr_t *_i6 = (i6addr_t *)(a); \
 226                   _i6->i6[3] = NLADD(_i6->i6[3], 1); \
 227                   if (_i6->i6[3] == 0) { \
 228                         _i6->i6[2] = NLADD(_i6->i6[2], 1); \
 229                         if (_i6->i6[2] == 0) { \
 230                                 _i6->i6[1] = NLADD(_i6->i6[1], 1); \
 231                                 if (_i6->i6[1] == 0) { \
 232                                         _i6->i6[0] = NLADD(_i6->i6[0], 1); \
 233                                 } \
 234                         } \
 235                   } \
 236                 }
 237 #define IP6_ADD(a,x,d)  \
 238                 { i6addr_t *_s = (i6addr_t *)(a); \
 239                   i6addr_t *_d = (i6addr_t *)(d); \
 240                   _d->i6[3] = NLADD(_s->i6[3], x); \
 241                   if (ntohl(_d->i6[3]) < ntohl(_s->i6[3])) { \
 242                         _d->i6[2] = NLADD(_d->i6[2], 1); \
 243                         if (ntohl(_d->i6[2]) < ntohl(_s->i6[2])) { \
 244                                 _d->i6[1] = NLADD(_d->i6[1], 1); \
 245                                 if (ntohl(_d->i6[1]) < ntohl(_s->i6[1])) { \
 246                                         _d->i6[0] = NLADD(_d->i6[0], 1); \
 247                                 } \
 248                         } \
 249                   } \
 250                 }
 251 #define IP6_AND(a,b,d)  { i6addr_t *_s1 = (i6addr_t *)(a); \
 252                           i6addr_t *_s2 = (i6addr_t *)(b); \
 253                           i6addr_t *_d = (i6addr_t *)(d); \
 254                           _d->i6[0] = _s1->i6[0] & _s2->i6[0]; \
 255                           _d->i6[1] = _s1->i6[1] & _s2->i6[1]; \
 256                           _d->i6[2] = _s1->i6[2] & _s2->i6[2]; \
 257                           _d->i6[3] = _s1->i6[3] & _s2->i6[3]; \
 258                         }
 259 #define IP6_MASKEQ(a,m,b) \
 260                         (((I60(a) & I60(m)) == I60(b)) && \
 261                          ((I61(a) & I61(m)) == I61(b)) && \
 262                          ((I62(a) & I62(m)) == I62(b)) && \
 263                          ((I63(a) & I63(m)) == I63(b)))
 264 #define IP6_MASKNEQ(a,m,b) \
 265                         (((I60(a) & I60(m)) != I60(b)) || \
 266                          ((I61(a) & I61(m)) != I61(b)) || \
 267                          ((I62(a) & I62(m)) != I62(b)) || \
 268                          ((I63(a) & I63(m)) != I63(b)))
 269 #define IP6_MERGE(a,b,c) \
 270                         { i6addr_t *_d, *_s1, *_s2; \
 271                           _d = (i6addr_t *)(a); \
 272                           _s1 = (i6addr_t *)(b); \
 273                           _s2 = (i6addr_t *)(c); \
 274                           _d->i6[0] |= _s1->i6[0] & ~_s2->i6[0]; \
 275                           _d->i6[1] |= _s1->i6[1] & ~_s2->i6[1]; \
 276                           _d->i6[2] |= _s1->i6[2] & ~_s2->i6[2]; \
 277                           _d->i6[3] |= _s1->i6[3] & ~_s2->i6[3]; \
 278                         }
 279 
 280 
 281 typedef struct  fr_ip   {
 282         u_32_t  fi_v:4;         /* IP version */
 283         u_32_t  fi_xx:4;        /* spare */
 284         u_32_t  fi_tos:8;       /* IP packet TOS */
 285         u_32_t  fi_ttl:8;       /* IP packet TTL */
 286         u_32_t  fi_p:8;         /* IP packet protocol */
 287         u_32_t  fi_optmsk;      /* bitmask composed from IP options */
 288         i6addr_t fi_src;        /* source address from packet */
 289         i6addr_t fi_dst;        /* destination address from packet */
 290         u_short fi_secmsk;      /* bitmask composed from IP security options */
 291         u_short fi_auth;        /* authentication code from IP sec. options */
 292         u_32_t  fi_flx;         /* packet flags */
 293         u_32_t  fi_tcpmsk;      /* TCP options set/reset */
 294         u_32_t  fi_res1;        /* RESERVED */
 295 } fr_ip_t;
 296 
 297 /*
 298  * For use in fi_flx
 299  */
 300 #define FI_TCPUDP       0x0001  /* TCP/UCP implied comparison*/
 301 #define FI_OPTIONS      0x0002
 302 #define FI_FRAG         0x0004
 303 #define FI_SHORT        0x0008
 304 #define FI_NATED        0x0010
 305 #define FI_MULTICAST    0x0020
 306 #define FI_BROADCAST    0x0040
 307 #define FI_MBCAST       0x0080
 308 #define FI_STATE        0x0100
 309 #define FI_BADNAT       0x0200
 310 #define FI_BAD          0x0400
 311 #define FI_OOW          0x0800  /* Out of state window, else match */
 312 #define FI_ICMPERR      0x1000
 313 #define FI_FRAGBODY     0x2000
 314 #define FI_BADSRC       0x4000
 315 #define FI_LOWTTL       0x8000
 316 #define FI_CMP          0xcf03  /* Not FI_FRAG,FI_NATED,FI_FRAGTAIL,broadcast */
 317 #define FI_ICMPCMP      0x0003  /* Flags we can check for ICMP error packets */
 318 #define FI_WITH         0xeffe  /* Not FI_TCPUDP */
 319 #define FI_V6EXTHDR     0x10000
 320 #define FI_COALESCE     0x20000
 321 #define FI_ICMPQUERY    0x40000
 322 #define FI_NEWNAT       0x80000
 323 #define FI_MOREFRAG     0x100000
 324 #define FI_NEG_OOW      0x10000000      /* packet underflows TCP window */
 325 #define FI_NOCKSUM      0x20000000      /* don't do a L4 checksum validation */
 326 #define FI_DONTCACHE    0x40000000      /* don't cache the result */
 327 #define FI_IGNORE       0x80000000
 328 
 329 #define fi_saddr        fi_src.in4.s_addr
 330 #define fi_daddr        fi_dst.in4.s_addr
 331 #define fi_srcnum       fi_src.iplookupnum
 332 #define fi_dstnum       fi_dst.iplookupnum
 333 #define fi_srctype      fi_src.iplookuptype
 334 #define fi_dsttype      fi_dst.iplookuptype
 335 #define fi_srcptr       fi_src.iplookupptr
 336 #define fi_dstptr       fi_dst.iplookupptr
 337 #define fi_srcfunc      fi_src.iplookupfunc
 338 #define fi_dstfunc      fi_dst.iplookupfunc
 339 
 340 
 341 /*
 342  * These are both used by the state and NAT code to indicate that one port or
 343  * the other should be treated as a wildcard.
 344  * NOTE: When updating, check bit masks in ip_state.h and update there too.
 345  */
 346 #define SI_W_SPORT      0x00000100
 347 #define SI_W_DPORT      0x00000200
 348 #define SI_WILDP        (SI_W_SPORT|SI_W_DPORT)
 349 #define SI_W_SADDR      0x00000400
 350 #define SI_W_DADDR      0x00000800
 351 #define SI_WILDA        (SI_W_SADDR|SI_W_DADDR)
 352 #define SI_NEWFR        0x00001000
 353 #define SI_CLONE        0x00002000
 354 #define SI_CLONED       0x00004000
 355 
 356 
 357 
 358 
 359 struct  fr_info {
 360         void    *fin_ifp;               /* interface packet is `on' */
 361         fr_ip_t fin_fi;         /* IP Packet summary */
 362         union   {
 363                 u_short fid_16[2];      /* TCP/UDP ports, ICMP code/type */
 364                 u_32_t  fid_32;
 365         } fin_dat;
 366         int     fin_out;                /* in or out ? 1 == out, 0 == in */
 367         int     fin_rev;                /* state only: 1 = reverse */
 368         u_short fin_hlen;               /* length of IP header in bytes */
 369         u_char  fin_tcpf;               /* TCP header flags (SYN, ACK, etc) */
 370         u_char  fin_icode;              /* ICMP error to return */
 371         u_32_t  fin_rule;               /* rule # last matched */
 372         char    fin_group[FR_GROUPLEN]; /* group number, -1 for none */
 373         struct  frentry *fin_fr;        /* last matching rule */
 374         void    *fin_dp;                /* start of data past IP header */
 375         int     fin_dlen;               /* length of data portion of packet */
 376         int     fin_plen;
 377         int     fin_ipoff;              /* # bytes from buffer start to hdr */
 378         u_32_t  fin_id;                 /* IP packet id field */
 379         u_short fin_off;
 380         int     fin_depth;              /* Group nesting depth */
 381         int     fin_error;              /* Error code to return */
 382         u_int   fin_pktnum;
 383         void    *fin_nattag;
 384         union {
 385                 ip_t    *fip_ip;
 386 #ifdef  USE_INET6
 387                 ip6_t   *fip_ip6;
 388 #endif
 389         } fin_ipu;
 390         mb_t    **fin_mp;               /* pointer to pointer to mbuf */
 391         mb_t    *fin_m;                 /* pointer to mbuf */
 392 #ifdef  MENTAT
 393         mb_t    *fin_qfm;               /* pointer to mblk where pkt starts */
 394         void    *fin_qpi;
 395         ipf_stack_t *fin_ifs;
 396 #endif
 397 #ifdef  __sgi
 398         void    *fin_hbuf;
 399 #endif
 400 };
 401 
 402 #define fin_ip          fin_ipu.fip_ip
 403 #define fin_ip6         fin_ipu.fip_ip6
 404 #define fin_v           fin_fi.fi_v
 405 #define fin_p           fin_fi.fi_p
 406 #define fin_flx         fin_fi.fi_flx
 407 #define fin_optmsk      fin_fi.fi_optmsk
 408 #define fin_secmsk      fin_fi.fi_secmsk
 409 #define fin_auth        fin_fi.fi_auth
 410 #define fin_src         fin_fi.fi_src.in4
 411 #define fin_saddr       fin_fi.fi_saddr
 412 #define fin_dst         fin_fi.fi_dst.in4
 413 #define fin_daddr       fin_fi.fi_daddr
 414 #define fin_data        fin_dat.fid_16
 415 #define fin_sport       fin_dat.fid_16[0]
 416 #define fin_dport       fin_dat.fid_16[1]
 417 #define fin_ports       fin_dat.fid_32
 418 
 419 #ifdef  USE_INET6
 420 # define        fin_src6        fin_fi.fi_src
 421 # define        fin_dst6        fin_fi.fi_dst
 422 # define        fin_dstip6      fin_fi.fi_dst.in6
 423 # define        fin_srcip6      fin_fi.fi_src.in6
 424 #endif
 425 
 426 #define IPF_IN  0
 427 #define IPF_OUT 1
 428 
 429 typedef struct frentry  *(*ipfunc_t) __P((fr_info_t *, u_32_t *));
 430 typedef int             (*ipfuncinit_t) __P((struct frentry *,
 431                                              ipf_stack_t *));
 432 
 433 typedef struct  ipfunc_resolve  {
 434         char            ipfu_name[32];
 435         ipfunc_t        ipfu_addr;
 436         ipfuncinit_t    ipfu_init;
 437 } ipfunc_resolve_t;
 438 
 439 /*
 440  * Size for compares on fr_info structures
 441  */
 442 #define FI_CSIZE        offsetof(fr_info_t, fin_icode)
 443 #define FI_LCSIZE       offsetof(fr_info_t, fin_dp)
 444 
 445 /*
 446  * Size for copying cache fr_info structure
 447  */
 448 #define FI_COPYSIZE     offsetof(fr_info_t, fin_dp)
 449 
 450 /*
 451  * Structure for holding IPFilter's tag information
 452  */
 453 #define IPFTAG_LEN      16
 454 typedef struct  {
 455         union   {
 456                 u_32_t  iptu_num[4];
 457                 char    iptu_tag[IPFTAG_LEN];
 458         } ipt_un;
 459         int     ipt_not;
 460 } ipftag_t;
 461 
 462 #define ipt_tag ipt_un.iptu_tag
 463 #define ipt_num ipt_un.iptu_num
 464 
 465 
 466 /*
 467  * This structure is used to hold information about the next hop for where
 468  * to forward a packet.
 469  */
 470 typedef struct  frdest  {
 471         void    *fd_ifp;
 472         i6addr_t        fd_ip6;
 473         char    fd_ifname[LIFNAMSIZ];
 474 } frdest_t;
 475 
 476 #define fd_ip   fd_ip6.in4
 477 
 478 
 479 /*
 480  * This structure holds information about a port comparison.
 481  */
 482 typedef struct  frpcmp  {
 483         int     frp_cmp;        /* data for port comparisons */
 484         u_short frp_port;       /* top port for <> and >< */
 485         u_short frp_top;        /* top port for <> and >< */
 486 } frpcmp_t;
 487 
 488 #define FR_NONE 0
 489 #define FR_EQUAL 1
 490 #define FR_NEQUAL 2
 491 #define FR_LESST 3
 492 #define FR_GREATERT 4
 493 #define FR_LESSTE 5
 494 #define FR_GREATERTE 6
 495 #define FR_OUTRANGE 7
 496 #define FR_INRANGE 8
 497 #define FR_INCRANGE 9
 498 
 499 /*
 500  * Structure containing all the relevant TCP things that can be checked in
 501  * a filter rule.
 502  */
 503 typedef struct  frtuc   {
 504         u_char          ftu_tcpfm;      /* tcp flags mask */
 505         u_char          ftu_tcpf;       /* tcp flags */
 506         frpcmp_t        ftu_src;
 507         frpcmp_t        ftu_dst;
 508 } frtuc_t;
 509 
 510 #define ftu_scmp        ftu_src.frp_cmp
 511 #define ftu_dcmp        ftu_dst.frp_cmp
 512 #define ftu_sport       ftu_src.frp_port
 513 #define ftu_dport       ftu_dst.frp_port
 514 #define ftu_stop        ftu_src.frp_top
 515 #define ftu_dtop        ftu_dst.frp_top
 516 
 517 #define FR_TCPFMAX      0x3f
 518 
 519 /*
 520  * This structure makes up what is considered to be the IPFilter specific
 521  * matching components of a filter rule, as opposed to the data structures
 522  * used to define the result which are in frentry_t and not here.
 523  */
 524 typedef struct  fripf   {
 525         fr_ip_t fri_ip;
 526         fr_ip_t fri_mip;        /* mask structure */
 527 
 528         u_short fri_icmpm;              /* data for ICMP packets (mask) */
 529         u_short fri_icmp;
 530 
 531         frtuc_t fri_tuc;
 532         int     fri_satype;             /* addres type */
 533         int     fri_datype;             /* addres type */
 534         int     fri_sifpidx;            /* doing dynamic addressing */
 535         int     fri_difpidx;            /* index into fr_ifps[] to use when */
 536 } fripf_t;
 537 
 538 #define fri_dstnum      fri_ip.fi_dstnum
 539 #define fri_srcnum      fri_mip.fi_srcnum
 540 #define fri_dstptr      fri_ip.fi_dstptr
 541 #define fri_srcptr      fri_mip.fi_srcptr
 542 
 543 #define FRI_NORMAL      0       /* Normal address */
 544 #define FRI_DYNAMIC     1       /* dynamic address */
 545 #define FRI_LOOKUP      2       /* address is a pool # */
 546 #define FRI_RANGE       3       /* address/mask is a range */
 547 #define FRI_NETWORK     4       /* network address from if */
 548 #define FRI_BROADCAST   5       /* broadcast address from if */
 549 #define FRI_PEERADDR    6       /* Peer address for P-to-P */
 550 #define FRI_NETMASKED   7       /* network address with netmask from if */
 551 
 552 
 553 typedef struct  frentry * (* frentfunc_t) __P((fr_info_t *));
 554 
 555 typedef struct  frentry {
 556         ipfmutex_t      fr_lock;
 557         struct  frentry *fr_next;
 558         struct  frentry **fr_grp;
 559         struct  ipscan  *fr_isc;
 560         void    *fr_ifas[4];
 561         void    *fr_ptr;        /* for use with fr_arg */
 562         char    *fr_comment;    /* text comment for rule */
 563         int     fr_ref;         /* reference count - for grouping */
 564         int     fr_statecnt;    /* state count - for limit rules */
 565         /*
 566          * These are only incremented when a packet  matches this rule and
 567          * it is the last match
 568          */
 569         U_QUAD_T        fr_hits;
 570         U_QUAD_T        fr_bytes;
 571 
 572         /*
 573          * For PPS rate limiting
 574          */
 575         struct timeval  fr_lastpkt;
 576         int             fr_curpps;
 577 
 578         union   {
 579                 void            *fru_data;
 580                 caddr_t         fru_caddr;
 581                 fripf_t         *fru_ipf;
 582                 frentfunc_t     fru_func;
 583         } fr_dun;
 584 
 585         /*
 586          * Fields after this may not change whilst in the kernel.
 587          */
 588         ipfunc_t fr_func;       /* call this function */
 589         int     fr_dsize;
 590         int     fr_pps;
 591         int     fr_statemax;    /* max reference count */
 592         int     fr_flineno;     /* line number from conf file */
 593         u_32_t  fr_type;
 594         u_32_t  fr_flags;       /* per-rule flags && options (see below) */
 595         u_32_t  fr_logtag;      /* user defined log tag # */
 596         u_32_t  fr_collect;     /* collection number */
 597         u_int   fr_arg;         /* misc. numeric arg for rule */ 
 598         u_int   fr_loglevel;    /* syslog log facility + priority */
 599         u_int   fr_age[2];      /* non-TCP timeouts */
 600         u_char  fr_v;
 601         u_char  fr_icode;       /* return ICMP code */
 602         char    fr_group[FR_GROUPLEN];  /* group to which this rule belongs */
 603         char    fr_grhead[FR_GROUPLEN]; /* group # which this rule starts */
 604         ipftag_t fr_nattag;
 605         char    fr_ifnames[4][LIFNAMSIZ];
 606         char    fr_isctag[16];
 607         frdest_t fr_tifs[2];    /* "to"/"reply-to" interface */
 608         frdest_t fr_dif;        /* duplicate packet interface */
 609         /*
 610          * This must be last and will change after loaded into the kernel.
 611          */
 612         u_int   fr_cksum;       /* checksum on filter rules for performance */
 613 } frentry_t;
 614 
 615 #define fr_caddr        fr_dun.fru_caddr
 616 #define fr_data         fr_dun.fru_data
 617 #define fr_dfunc        fr_dun.fru_func
 618 #define fr_ipf          fr_dun.fru_ipf
 619 #define fr_ip           fr_ipf->fri_ip
 620 #define fr_mip          fr_ipf->fri_mip
 621 #define fr_icmpm        fr_ipf->fri_icmpm
 622 #define fr_icmp         fr_ipf->fri_icmp
 623 #define fr_tuc          fr_ipf->fri_tuc
 624 #define fr_satype       fr_ipf->fri_satype
 625 #define fr_datype       fr_ipf->fri_datype
 626 #define fr_sifpidx      fr_ipf->fri_sifpidx
 627 #define fr_difpidx      fr_ipf->fri_difpidx
 628 #define fr_proto        fr_ip.fi_p
 629 #define fr_mproto       fr_mip.fi_p
 630 #define fr_ttl          fr_ip.fi_ttl
 631 #define fr_mttl         fr_mip.fi_ttl
 632 #define fr_tos          fr_ip.fi_tos
 633 #define fr_mtos         fr_mip.fi_tos
 634 #define fr_tcpfm        fr_tuc.ftu_tcpfm
 635 #define fr_tcpf         fr_tuc.ftu_tcpf
 636 #define fr_scmp         fr_tuc.ftu_scmp
 637 #define fr_dcmp         fr_tuc.ftu_dcmp
 638 #define fr_dport        fr_tuc.ftu_dport
 639 #define fr_sport        fr_tuc.ftu_sport
 640 #define fr_stop         fr_tuc.ftu_stop
 641 #define fr_dtop         fr_tuc.ftu_dtop
 642 #define fr_dst          fr_ip.fi_dst.in4
 643 #define fr_daddr        fr_ip.fi_dst.in4.s_addr
 644 #define fr_src          fr_ip.fi_src.in4
 645 #define fr_saddr        fr_ip.fi_src.in4.s_addr
 646 #define fr_dmsk         fr_mip.fi_dst.in4
 647 #define fr_dmask        fr_mip.fi_dst.in4.s_addr
 648 #define fr_smsk         fr_mip.fi_src.in4
 649 #define fr_smask        fr_mip.fi_src.in4.s_addr
 650 #define fr_dstnum       fr_ip.fi_dstnum
 651 #define fr_srcnum       fr_ip.fi_srcnum
 652 #define fr_dsttype      fr_ip.fi_dsttype
 653 #define fr_srctype      fr_ip.fi_srctype
 654 #define fr_dstptr       fr_mip.fi_dstptr
 655 #define fr_srcptr       fr_mip.fi_srcptr
 656 #define fr_dstfunc      fr_mip.fi_dstfunc
 657 #define fr_srcfunc      fr_mip.fi_srcfunc
 658 #define fr_optbits      fr_ip.fi_optmsk
 659 #define fr_optmask      fr_mip.fi_optmsk
 660 #define fr_secbits      fr_ip.fi_secmsk
 661 #define fr_secmask      fr_mip.fi_secmsk
 662 #define fr_authbits     fr_ip.fi_auth
 663 #define fr_authmask     fr_mip.fi_auth
 664 #define fr_flx          fr_ip.fi_flx
 665 #define fr_mflx         fr_mip.fi_flx
 666 #define fr_ifname       fr_ifnames[0]
 667 #define fr_oifname      fr_ifnames[2]
 668 #define fr_ifa          fr_ifas[0]
 669 #define fr_oifa         fr_ifas[2]
 670 #define fr_tif          fr_tifs[0]
 671 #define fr_rif          fr_tifs[1]
 672 
 673 #define FR_NOLOGTAG     0
 674 
 675 #define FR_CMPSIZ       (sizeof(struct frentry) - \
 676                          offsetof(struct frentry, fr_func))
 677 
 678 /*
 679  * fr_type
 680  */
 681 #define FR_T_NONE       0
 682 #define FR_T_IPF        1       /* IPF structures */
 683 #define FR_T_BPFOPC     2       /* BPF opcode */
 684 #define FR_T_CALLFUNC   3       /* callout to function in fr_func only */
 685 #define FR_T_COMPIPF    4       /* compiled C code */
 686 #define FR_T_BUILTIN    0x80000000      /* rule is in kernel space */
 687 
 688 /*
 689  * fr_flags
 690  */
 691 #define FR_CALL         0x00000 /* call rule */
 692 #define FR_BLOCK        0x00001 /* do not allow packet to pass */
 693 #define FR_PASS         0x00002 /* allow packet to pass */
 694 #define FR_AUTH         0x00003 /* use authentication */
 695 #define FR_PREAUTH      0x00004 /* require preauthentication */
 696 #define FR_ACCOUNT      0x00005 /* Accounting rule */
 697 #define FR_SKIP         0x00006 /* skip rule */
 698 #define FR_DIVERT       0x00007 /* divert rule */
 699 #define FR_CMDMASK      0x0000f
 700 #define FR_LOG          0x00010 /* Log */
 701 #define FR_LOGB         0x00011 /* Log-fail */
 702 #define FR_LOGP         0x00012 /* Log-pass */
 703 #define FR_LOGMASK      (FR_LOG|FR_CMDMASK)
 704 #define FR_CALLNOW      0x00020 /* call another function (fr_func) if matches */
 705 #define FR_NOTSRCIP     0x00040
 706 #define FR_NOTDSTIP     0x00080
 707 #define FR_QUICK        0x00100 /* match & stop processing list */
 708 #define FR_KEEPFRAG     0x00200 /* keep fragment information */
 709 #define FR_KEEPSTATE    0x00400 /* keep `connection' state information */
 710 #define FR_FASTROUTE    0x00800 /* bypass normal routing */
 711 #define FR_RETRST       0x01000 /* Return TCP RST packet - reset connection */
 712 #define FR_RETICMP      0x02000 /* Return ICMP unreachable packet */
 713 #define FR_FAKEICMP     0x03000 /* Return ICMP unreachable with fake source */
 714 #define FR_OUTQUE       0x04000 /* outgoing packets */
 715 #define FR_INQUE        0x08000 /* ingoing packets */
 716 #define FR_LOGBODY      0x10000 /* Log the body */
 717 #define FR_LOGFIRST     0x20000 /* Log the first byte if state held */
 718 #define FR_LOGORBLOCK   0x40000 /* block the packet if it can't be logged */
 719 #define FR_DUP          0x80000 /* duplicate packet */
 720 #define FR_FRSTRICT     0x100000        /* strict frag. cache */
 721 #define FR_STSTRICT     0x200000        /* strict keep state */
 722 #define FR_NEWISN       0x400000        /* new ISN for outgoing TCP */
 723 #define FR_NOICMPERR    0x800000        /* do not match ICMP errors in state */
 724 #define FR_STATESYNC    0x1000000       /* synchronize state to slave */
 725 #define FR_NOMATCH      0x8000000       /* no match occured */
 726                 /*      0x10000000      FF_LOGPASS */
 727                 /*      0x20000000      FF_LOGBLOCK */
 728                 /*      0x40000000      FF_LOGNOMATCH */
 729                 /*      0x80000000      FF_BLOCKNONIP */
 730 #define FR_COPIED       0x40000000      /* copied from user space */
 731 #define FR_INACTIVE     0x80000000      /* only used when flush'ing rules */
 732 
 733 #define FR_RETMASK      (FR_RETICMP|FR_RETRST|FR_FAKEICMP)
 734 #define FR_ISBLOCK(x)   (((x) & FR_CMDMASK) == FR_BLOCK)
 735 #define FR_ISPASS(x)    (((x) & FR_CMDMASK) == FR_PASS)
 736 #define FR_ISAUTH(x)    (((x) & FR_CMDMASK) == FR_AUTH)
 737 #define FR_ISPREAUTH(x) (((x) & FR_CMDMASK) == FR_PREAUTH)
 738 #define FR_ISACCOUNT(x) (((x) & FR_CMDMASK) == FR_ACCOUNT)
 739 #define FR_ISSKIP(x)    (((x) & FR_CMDMASK) == FR_SKIP)
 740 #define FR_ISNOMATCH(x) ((x) & FR_NOMATCH)
 741 #define FR_INOUT        (FR_INQUE|FR_OUTQUE)
 742 
 743 /*
 744  * recognized flags for SIOCGETFF and SIOCSETFF, and get put in fr_flags
 745  */
 746 #define FF_LOGPASS      0x10000000
 747 #define FF_LOGBLOCK     0x20000000
 748 #define FF_LOGNOMATCH   0x40000000
 749 #define FF_LOGGING      (FF_LOGPASS|FF_LOGBLOCK|FF_LOGNOMATCH)
 750 #define FF_BLOCKNONIP   0x80000000      /* Solaris2 Only */
 751 
 752 
 753 /*
 754  * Structure that passes information on what/how to flush to the kernel.
 755  */
 756 typedef struct  ipfflush        {
 757         int     ipflu_how;
 758         int     ipflu_arg;
 759 } ipfflush_t;
 760 
 761 
 762 /*
 763  *
 764  */
 765 typedef struct  ipfgetctl       {
 766         u_int   ipfg_min;       /* min value */
 767         u_int   ipfg_current;   /* current value */
 768         u_int   ipfg_max;       /* max value */
 769         u_int   ipfg_default;   /* default value */
 770         u_int   ipfg_steps;     /* value increments */
 771         char    ipfg_name[40];  /* tag name for this control */
 772 } ipfgetctl_t;
 773 
 774 typedef struct  ipfsetctl       {
 775         int     ipfs_which;     /* 0 = min 1 = current 2 = max 3 = default */
 776         u_int   ipfs_value;     /* min value */
 777         char    ipfs_name[40];  /* tag name for this control */
 778 } ipfsetctl_t;
 779 
 780 
 781 /*
 782  * Some of the statistics below are in their own counters, but most are kept
 783  * in this single structure so that they can all easily be collected and
 784  * copied back as required.
 785  *
 786  * NOTE: when changing, keep in sync with kstats (below).
 787  */
 788 typedef struct  filterstats {
 789         u_long  fr_pass;        /* packets allowed */
 790         u_long  fr_block;       /* packets denied */
 791         u_long  fr_nom;         /* packets which don't match any rule */
 792         u_long  fr_short;       /* packets which are short */
 793         u_long  fr_ppkl;        /* packets allowed and logged */
 794         u_long  fr_bpkl;        /* packets denied and logged */
 795         u_long  fr_npkl;        /* packets unmatched and logged */
 796         u_long  fr_pkl;         /* packets logged */
 797         u_long  fr_skip;        /* packets to be logged but buffer full */
 798         u_long  fr_ret;         /* packets for which a return is sent */
 799         u_long  fr_acct;        /* packets for which counting was performed */
 800         u_long  fr_bnfr;        /* bad attempts to allocate fragment state */
 801         u_long  fr_nfr;         /* new fragment state kept */
 802         u_long  fr_cfr;         /* add new fragment state but complete pkt */
 803         u_long  fr_bads;        /* bad attempts to allocate packet state */
 804         u_long  fr_ads;         /* new packet state kept */
 805         u_long  fr_chit;        /* cached hit */
 806         u_long  fr_tcpbad;      /* TCP checksum check failures */
 807         u_long  fr_pull[2];     /* good and bad pullup attempts */
 808         u_long  fr_badsrc;      /* source received doesn't match route */
 809         u_long  fr_badttl;      /* TTL in packet doesn't reach minimum */
 810         u_long  fr_bad;         /* bad IP packets to the filter */
 811         u_long  fr_ipv6;        /* IPv6 packets in/out */
 812         u_long  fr_ppshit;      /* dropped because of pps ceiling */
 813         u_long  fr_ipud;        /* IP id update failures */
 814 } filterstats_t;
 815 
 816 /*
 817  * kstat "copy" of the above - keep in sync!
 818  * also keep in sync with initialisation code in solaris.c, ipf_kstat_init().
 819  */
 820 typedef struct  filter_kstats {
 821         kstat_named_t   fks_pass;       /* see above for comments */
 822         kstat_named_t   fks_block;
 823         kstat_named_t   fks_nom;
 824         kstat_named_t   fks_short;
 825         kstat_named_t   fks_ppkl;
 826         kstat_named_t   fks_bpkl;
 827         kstat_named_t   fks_npkl;
 828         kstat_named_t   fks_pkl;
 829         kstat_named_t   fks_skip;
 830         kstat_named_t   fks_ret;
 831         kstat_named_t   fks_acct;
 832         kstat_named_t   fks_bnfr;
 833         kstat_named_t   fks_nfr;
 834         kstat_named_t   fks_cfr;
 835         kstat_named_t   fks_bads;
 836         kstat_named_t   fks_ads;
 837         kstat_named_t   fks_chit;
 838         kstat_named_t   fks_tcpbad;
 839         kstat_named_t   fks_pull[2];
 840         kstat_named_t   fks_badsrc;
 841         kstat_named_t   fks_badttl;
 842         kstat_named_t   fks_bad;
 843         kstat_named_t   fks_ipv6;
 844         kstat_named_t   fks_ppshit;
 845         kstat_named_t   fks_ipud;
 846 } filter_kstats_t;
 847 
 848 /*
 849  * Log structure.  Each packet header logged is prepended by one of these.
 850  * Following this in the log records read from the device will be an ipflog
 851  * structure which is then followed by any packet data.
 852  */
 853 typedef struct  iplog   {
 854         u_32_t          ipl_magic;
 855         u_int           ipl_count;
 856         struct  timeval ipl_time;
 857         size_t          ipl_dsize;
 858         struct  iplog   *ipl_next;
 859 } iplog_t;
 860 
 861 #define ipl_sec         ipl_time.tv_sec
 862 #define ipl_usec        ipl_time.tv_usec
 863 
 864 #define IPL_MAGIC       0x49504c4d      /* 'IPLM' */
 865 #define IPL_MAGIC_NAT   0x49504c4e      /* 'IPLN' */
 866 #define IPL_MAGIC_STATE 0x49504c53      /* 'IPLS' */
 867 #define IPLOG_SIZE      sizeof(iplog_t)
 868 
 869 typedef struct  ipflog  {
 870 #if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199603)) || \
 871         (defined(OpenBSD) && (OpenBSD >= 199603))
 872 #else
 873         u_int   fl_unit;
 874 #endif
 875         u_32_t  fl_rule;
 876         u_32_t  fl_flags;
 877         u_32_t  fl_lflags;
 878         u_32_t  fl_logtag;
 879         ipftag_t        fl_nattag;
 880         u_short fl_plen;        /* extra data after hlen */
 881         u_short fl_loglevel;    /* syslog log level */
 882         char    fl_group[FR_GROUPLEN];
 883         u_char  fl_hlen;        /* length of IP headers saved */
 884         u_char  fl_dir;
 885         u_char  fl_xxx[2];      /* pad */
 886         char    fl_ifname[LIFNAMSIZ];
 887 } ipflog_t;
 888 
 889 #ifndef IPF_LOGGING
 890 # define        IPF_LOGGING     0
 891 #endif
 892 #ifndef IPF_DEFAULT_PASS
 893 # define        IPF_DEFAULT_PASS        FR_PASS
 894 #endif
 895 
 896 #define DEFAULT_IPFLOGSIZE      8192
 897 #ifndef IPFILTER_LOGSIZE
 898 # define        IPFILTER_LOGSIZE        DEFAULT_IPFLOGSIZE
 899 #else
 900 # if IPFILTER_LOGSIZE < DEFAULT_IPFLOGSIZE
 901 #  error IPFILTER_LOGSIZE too small.  Must be >= DEFAULT_IPFLOGSIZE
 902 # endif
 903 #endif
 904 
 905 #define IPF_OPTCOPY     0x07ff00        /* bit mask of copied options */
 906 
 907 /*
 908  * Device filenames for reading log information.  Use ipf on Solaris2 because
 909  * ipl is already a name used by something else.
 910  */
 911 #ifndef IPL_NAME
 912 # if    SOLARIS
 913 #  define       IPL_NAME        "/dev/ipf"
 914 # else
 915 #  define       IPL_NAME        "/dev/ipl"
 916 # endif
 917 #endif
 918 /*
 919  * Pathnames for various IP Filter control devices.  Used by LKM
 920  * and userland, so defined here.
 921  */
 922 #define IPNAT_NAME      "/dev/ipnat"
 923 #define IPSTATE_NAME    "/dev/ipstate"
 924 #define IPAUTH_NAME     "/dev/ipauth"
 925 #define IPSYNC_NAME     "/dev/ipsync"
 926 #define IPSCAN_NAME     "/dev/ipscan"
 927 #define IPLOOKUP_NAME   "/dev/iplookup"
 928 
 929 #define IPL_LOGIPF      0       /* Minor device #'s for accessing logs */
 930 #define IPL_LOGNAT      1
 931 #define IPL_LOGSTATE    2
 932 #define IPL_LOGAUTH     3
 933 #define IPL_LOGSYNC     4
 934 #define IPL_LOGSCAN     5
 935 #define IPL_LOGLOOKUP   6
 936 #define IPL_LOGCOUNT    7
 937 #define IPL_LOGMAX      7
 938 #define IPL_LOGSIZE     (IPL_LOGMAX + 1)
 939 #define IPL_LOGALL      -1
 940 #define IPL_LOGNONE     -2
 941 
 942 /*
 943  * For SIOCGETFS
 944  */
 945 typedef struct  friostat        {
 946         struct  filterstats     f_st[2];
 947         struct  frentry         *f_ipf[2][2];
 948         struct  frentry         *f_acct[2][2];
 949         struct  frentry         *f_ipf6[2][2];
 950         struct  frentry         *f_acct6[2][2];
 951         struct  frentry         *f_auth;
 952         struct  frgroup         *f_groups[IPL_LOGSIZE][2];
 953         u_long  f_froute[2];
 954         u_long  f_ticks;
 955         int     f_locks[IPL_LOGMAX];
 956         size_t  f_kmutex_sz;
 957         size_t  f_krwlock_sz;
 958         int     f_defpass;      /* default pass - from fr_pass */
 959         int     f_active;       /* 1 or 0 - active rule set */
 960         int     f_running;      /* 1 if running, else 0 */
 961         int     f_logging;      /* 1 if enabled, else 0 */
 962         int     f_features;
 963         char    f_version[32];  /* version string */
 964 } friostat_t;
 965 
 966 #define f_fin           f_ipf[0]
 967 #define f_fin6          f_ipf6[0]
 968 #define f_fout          f_ipf[1]
 969 #define f_fout6         f_ipf6[1]
 970 #define f_acctin        f_acct[0]
 971 #define f_acctin6       f_acct6[0]
 972 #define f_acctout       f_acct[1]
 973 #define f_acctout6      f_acct6[1]
 974 
 975 #define IPF_FEAT_LKM            0x001
 976 #define IPF_FEAT_LOG            0x002
 977 #define IPF_FEAT_LOOKUP         0x004
 978 #define IPF_FEAT_BPF            0x008
 979 #define IPF_FEAT_COMPILED       0x010
 980 #define IPF_FEAT_CKSUM          0x020
 981 #define IPF_FEAT_SYNC           0x040
 982 #define IPF_FEAT_SCAN           0x080
 983 #define IPF_FEAT_IPV6           0x100
 984 
 985 typedef struct  optlist {
 986         u_short ol_val;
 987         int     ol_bit;
 988 } optlist_t;
 989 
 990 
 991 /*
 992  * Group list structure.
 993  */
 994 typedef struct frgroup {
 995         struct  frgroup *fg_next;
 996         struct  frentry *fg_head;
 997         struct  frentry *fg_start;
 998         u_32_t  fg_flags;
 999         int     fg_ref;
1000         char    fg_name[FR_GROUPLEN];
1001 } frgroup_t;
1002 
1003 #define FG_NAME(g)      (*(g)->fg_name == '\0' ? "" : (g)->fg_name)
1004 
1005 
1006 /*
1007  * Used by state and NAT tables
1008  */
1009 typedef struct icmpinfo {
1010         u_short ici_id;
1011         u_short ici_seq;
1012         u_char  ici_type;
1013 } icmpinfo_t;
1014 
1015 typedef struct udpinfo {
1016         u_short us_sport;
1017         u_short us_dport;
1018 } udpinfo_t;
1019 
1020 
1021 typedef struct  tcpdata {
1022         u_32_t  td_end;
1023         u_32_t  td_maxend;
1024         u_32_t  td_maxwin;
1025         u_32_t  td_winscale;
1026         u_32_t  td_maxseg;
1027         int     td_winflags;
1028 } tcpdata_t;
1029 
1030 #define TCP_WSCALE_MAX          14
1031 
1032 #define TCP_WSCALE_SEEN         0x00000001
1033 #define TCP_WSCALE_FIRST        0x00000002
1034 #define TCP_SACK_PERMIT         0x00000004
1035 
1036 
1037 typedef struct tcpinfo {
1038         u_short ts_sport;
1039         u_short ts_dport;
1040         tcpdata_t ts_data[2];
1041 } tcpinfo_t;
1042 
1043 
1044 /*
1045  * Structures to define a GRE header as seen in a packet.
1046  */
1047 struct  grebits {
1048         u_32_t  grb_C:1;
1049         u_32_t  grb_R:1;
1050         u_32_t  grb_K:1;
1051         u_32_t  grb_S:1;
1052         u_32_t  grb_s:1;
1053         u_32_t  grb_recur:1;
1054         u_32_t  grb_A:1;
1055         u_32_t  grb_flags:3;
1056         u_32_t  grb_ver:3;
1057         u_short grb_ptype;
1058 };
1059 
1060 typedef struct  grehdr  {
1061         union   {
1062                 struct  grebits gru_bits;
1063                 u_short gru_flags;
1064         } gr_un;
1065         u_short gr_len;
1066         u_short gr_call;
1067 } grehdr_t;
1068 
1069 #define gr_flags        gr_un.gru_flags
1070 #define gr_bits         gr_un.gru_bits
1071 #define gr_ptype        gr_bits.grb_ptype
1072 #define gr_C            gr_bits.grb_C
1073 #define gr_R            gr_bits.grb_R
1074 #define gr_K            gr_bits.grb_K
1075 #define gr_S            gr_bits.grb_S
1076 #define gr_s            gr_bits.grb_s
1077 #define gr_recur        gr_bits.grb_recur
1078 #define gr_A            gr_bits.grb_A
1079 #define gr_ver          gr_bits.grb_ver
1080 
1081 /*
1082  * GRE information tracked by "keep state"
1083  */
1084 typedef struct  greinfo {
1085         u_short gs_call[2];
1086         u_short gs_flags;
1087         u_short gs_ptype;
1088 } greinfo_t;
1089 
1090 #define GRE_REV(x)      ((ntohs(x) >> 13) & 7)
1091 
1092 
1093 /*
1094  * Format of an Authentication header
1095  */
1096 typedef struct  authhdr {
1097         u_char  ah_next;
1098         u_char  ah_plen;
1099         u_short ah_reserved;
1100         u_32_t  ah_spi;
1101         u_32_t  ah_seq;
1102         /* Following the sequence number field is 0 or more bytes of */
1103         /* authentication data, as specified by ah_plen - RFC 2402.  */
1104 } authhdr_t;
1105 
1106 
1107 /*
1108  * Timeout tail queue list member
1109  */
1110 typedef struct  ipftqent        {
1111         struct ipftqent **tqe_pnext;
1112         struct ipftqent *tqe_next;
1113         struct  ipftq   *tqe_ifq;
1114         void    *tqe_parent;            /* pointer back to NAT/state struct */
1115         u_long  tqe_die;                /* when this entriy is to die */
1116         u_long  tqe_touched;
1117         int     tqe_flags;
1118         int     tqe_state[2];           /* current state of this entry */
1119 } ipftqent_t;
1120 
1121 #define TQE_RULEBASED   0x00000001
1122 
1123 
1124 /*
1125  * Timeout tail queue head for IPFilter
1126  */
1127 typedef struct  ipftq   {
1128         ipfmutex_t      ifq_lock;
1129         u_int   ifq_ttl;
1130         ipftqent_t      *ifq_head;
1131         ipftqent_t      **ifq_tail;
1132         struct  ipftq   *ifq_next;
1133         struct  ipftq   **ifq_pnext;
1134         int     ifq_ref;
1135         u_int   ifq_flags;
1136 } ipftq_t;
1137 
1138 #define IFQF_USER       0x01            /* User defined aging */
1139 #define IFQF_DELETE     0x02            /* Marked for deletion */
1140 #define IFQF_PROXY      0x04            /* Timeout queue in use by a proxy */
1141 
1142 #define IPF_HZ_MULT     1
1143 #define IPF_HZ_DIVIDE   2               /* How many times a second ipfilter */
1144                                         /* checks its timeout queues.       */
1145 #define IPF_TTLVAL(x)   (((x) / IPF_HZ_MULT) * IPF_HZ_DIVIDE)
1146 
1147 /*
1148  * Structure to define address for pool lookups.
1149  */
1150 typedef struct  {
1151         u_char          adf_len;
1152         sa_family_t     adf_family;
1153         i6addr_t        adf_addr;
1154 } addrfamily_t;
1155 
1156 
1157 /*
1158  * Object structure description.  For passing through in ioctls.
1159  */
1160 typedef struct  ipfobj  {
1161         u_32_t  ipfo_rev;               /* IPFilter version number */
1162         u_32_t  ipfo_size;              /* size of object at ipfo_ptr */
1163         void    *ipfo_ptr;              /* pointer to object */
1164         int     ipfo_type;              /* type of object being pointed to */
1165         int     ipfo_offset;            /* bytes from ipfo_ptr where to start */
1166         u_char  ipfo_xxxpad[32];        /* reserved for future use */
1167 } ipfobj_t;
1168 
1169 /*
1170  * ioctl struct for setting what zone further ioctls will act on. ipfz_gz is a
1171  * boolean: set it to 1 to operate on the GZ-controlled stack.
1172  */
1173 typedef struct  ipfzoneobj      {
1174         u_32_t          ipfz_gz;                        /* GZ stack boolean */
1175         char            ipfz_zonename[ZONENAME_MAX];    /* zone to act on */
1176 } ipfzoneobj_t;
1177 
1178 #if defined(_KERNEL)
1179 /* Set ipfs_zoneid to this if no zone has been set: */
1180 #define IPFS_ZONE_UNSET -2
1181 
1182 typedef struct  ipf_devstate    {
1183         zoneid_t        ipfs_zoneid;
1184         minor_t         ipfs_minor;
1185         boolean_t       ipfs_gz;
1186 } ipf_devstate_t;
1187 #endif
1188 
1189 #define IPFOBJ_FRENTRY          0       /* struct frentry */
1190 #define IPFOBJ_IPFSTAT          1       /* struct friostat */
1191 #define IPFOBJ_IPFINFO          2       /* struct fr_info */
1192 #define IPFOBJ_AUTHSTAT         3       /* struct fr_authstat */
1193 #define IPFOBJ_FRAGSTAT         4       /* struct ipfrstat */
1194 #define IPFOBJ_IPNAT            5       /* struct ipnat */
1195 #define IPFOBJ_NATSTAT          6       /* struct natstat */
1196 #define IPFOBJ_STATESAVE        7       /* struct ipstate_save */
1197 #define IPFOBJ_NATSAVE          8       /* struct nat_save */
1198 #define IPFOBJ_NATLOOKUP        9       /* struct natlookup */
1199 #define IPFOBJ_IPSTATE          10      /* struct ipstate */
1200 #define IPFOBJ_STATESTAT        11      /* struct ips_stat */
1201 #define IPFOBJ_FRAUTH           12      /* struct frauth */
1202 #define IPFOBJ_TUNEABLE         13      /* struct ipftune */
1203 #define IPFOBJ_NAT              14      /* struct nat */
1204 #define IPFOBJ_IPFITER          15      /* struct ipfruleiter */
1205 #define IPFOBJ_GENITER          16      /* struct ipfgeniter */
1206 #define IPFOBJ_GTABLE           17      /* struct ipftable */
1207 #define IPFOBJ_LOOKUPITER       18      /* struct ipflookupiter */
1208 #define IPFOBJ_COUNT            19      /* How many #defines are above this? */
1209 
1210 
1211 typedef union   ipftunevalptr   {
1212         void    *ipftp_void;
1213         u_long  *ipftp_long;
1214         u_int   *ipftp_int;
1215         u_short *ipftp_short;
1216         u_char  *ipftp_char;
1217 } ipftunevalptr_t;
1218 
1219 typedef struct  ipftuneable     {
1220         ipftunevalptr_t ipft_una;
1221         char            *ipft_name;
1222         u_long          ipft_min;
1223         u_long          ipft_max;
1224         int             ipft_sz;
1225         int             ipft_flags;
1226         struct ipftuneable *ipft_next;
1227 } ipftuneable_t;
1228 
1229 #define ipft_addr       ipft_una.ipftp_void
1230 #define ipft_plong      ipft_una.ipftp_long
1231 #define ipft_pint       ipft_una.ipftp_int
1232 #define ipft_pshort     ipft_una.ipftp_short
1233 #define ipft_pchar      ipft_una.ipftp_char
1234 
1235 #define IPFT_RDONLY     1       /* read-only */
1236 #define IPFT_WRDISABLED 2       /* write when disabled only */
1237 
1238 typedef union   ipftuneval      {
1239         u_long  ipftu_long;
1240         u_int   ipftu_int;
1241         u_short ipftu_short;
1242         u_char  ipftu_char;
1243 } ipftuneval_t;
1244 
1245 typedef struct  ipftune {
1246         void            *ipft_cookie;
1247         ipftuneval_t    ipft_un;
1248         u_long          ipft_min;
1249         u_long          ipft_max;
1250         int             ipft_sz;
1251         int             ipft_flags;
1252         char            ipft_name[80];
1253 } ipftune_t;
1254 
1255 #define ipft_vlong      ipft_un.ipftu_long
1256 #define ipft_vint       ipft_un.ipftu_int
1257 #define ipft_vshort     ipft_un.ipftu_short
1258 #define ipft_vchar      ipft_un.ipftu_char
1259 
1260 /*
1261  * ipfruleiter is iterator structure used for filter rules.
1262  */
1263 typedef struct  ipfruleiter {
1264         int             iri_ver;
1265         int             iri_inout;
1266         char            iri_group[FR_GROUPLEN];
1267         int             iri_active;
1268         int             iri_nrules;
1269         frentry_t       *iri_rule;
1270 } ipfruleiter_t;
1271 
1272 /* Values for iri_inout  */
1273 #define F_IN    0
1274 #define F_OUT   1
1275 #define F_ACIN  2
1276 #define F_ACOUT 3
1277 
1278 /*
1279  * ipfgeniter is generic iterator structure used for nat rules,
1280  * hostmap entries and nat table entries.
1281  */
1282 typedef struct  ipfgeniter {
1283         int     igi_type;       /* type of data we're looking at */
1284         int     igi_nitems;
1285         void    *igi_data;
1286 } ipfgeniter_t;
1287 
1288 #define IPFGENITER_IPF          0
1289 #define IPFGENITER_NAT          1
1290 #define IPFGENITER_IPNAT        2
1291 #define IPFGENITER_FRAG         3
1292 #define IPFGENITER_AUTH         4
1293 #define IPFGENITER_STATE        5
1294 #define IPFGENITER_NATFRAG      6
1295 #define IPFGENITER_HOSTMAP      7
1296 #define IPFGENITER_LOOKUP       8
1297 
1298 typedef struct  ipftable {
1299         int     ita_type;
1300         void    *ita_table;
1301 } ipftable_t;
1302 
1303 typedef struct ipftoken {
1304         struct ipftoken *ipt_next;
1305         struct ipftoken **ipt_pnext;
1306         void            *ipt_ctx;
1307         void            *ipt_data;
1308         u_long          ipt_die;
1309         int             ipt_type;
1310         int             ipt_uid;
1311         int             ipt_subtype;
1312         int             ipt_alive;
1313 } ipftoken_t;
1314 
1315 
1316 /*
1317  * sync commands
1318  */
1319 #define IPFSYNC_RESYNC  0
1320 #define IPFSYNC_NEWIFP  1
1321 #define IPFSYNC_OLDIFP  2
1322 
1323 
1324 /*
1325 ** HPUX Port
1326 */
1327 #ifdef __hpux
1328 /* HP-UX locking sequence deadlock detection module lock MAJOR ID */
1329 # define        IPF_SMAJ        0       /* temp assignment XXX, not critical */
1330 #endif
1331 
1332 #if !defined(CDEV_MAJOR) && defined (__FreeBSD_version) && \
1333     (__FreeBSD_version >= 220000)
1334 # define        CDEV_MAJOR      79
1335 #endif
1336 
1337 /*
1338  * Post NetBSD 1.2 has the PFIL interface for packet filters.  This turns
1339  * on those hooks.  We don't need any special mods in non-IP Filter code
1340  * with this!
1341  */
1342 #if (defined(NetBSD) && (NetBSD > 199609) && (NetBSD <= 1991011)) || \
1343     (defined(NetBSD1_2) && NetBSD1_2 > 1) || \
1344     (defined(__FreeBSD__) && (__FreeBSD_version >= 500043))
1345 # if (NetBSD >= 199905)
1346 #  define PFIL_HOOKS
1347 # endif
1348 # ifdef PFIL_HOOKS
1349 #  define NETBSD_PF
1350 # endif
1351 #endif
1352 
1353 #ifndef _KERNEL
1354 extern  int     fr_check __P((struct ip *, int, void *, int, mb_t **, ipf_stack_t *));
1355 extern  int     (*fr_checkp) __P((ip_t *, int, void *, int, mb_t **, ipf_stack_t *));
1356 extern  int     ipf_log __P((void));
1357 extern  struct  ifnet *get_unit __P((char *, int, ipf_stack_t *));
1358 extern  char    *get_ifname __P((struct ifnet *));
1359 # if defined(__NetBSD__) || defined(__OpenBSD__) || \
1360           (_BSDI_VERSION >= 199701) || (__FreeBSD_version >= 300000)
1361 extern  int     frrequest __P((int, u_long, caddr_t, int, int, ipf_stack_t *));
1362 # else
1363 extern  int     iplioctl __P((int, ioctlcmd_t, caddr_t, int));
1364 # endif
1365 extern  int     iplopen __P((dev_t, int));
1366 extern  int     iplclose __P((dev_t, int));
1367 extern  void    m_freem __P((mb_t *));
1368 #else /* #ifndef _KERNEL */
1369 extern  phy_if_t        get_unit __P((char *, int, ipf_stack_t *));
1370 # if defined(__NetBSD__) && defined(PFIL_HOOKS)
1371 extern  void    ipfilterattach __P((int));
1372 # endif
1373 extern  int     ipl_enable __P((void));
1374 extern  int     ipl_disable __P((void));
1375 # ifdef MENTAT
1376 extern  int     fr_check __P((struct ip *, int, void *, int, void *,
1377                               mblk_t **, ipf_stack_t *));
1378 #  if SOLARIS
1379 #   if SOLARIS2 >= 7
1380 extern  int     iplioctl __P((dev_t, int, intptr_t, int, cred_t *, int *));
1381 #   else
1382 extern  int     iplioctl __P((dev_t, int, int *, int, cred_t *, int *));
1383 #   endif
1384 #   if SOLARIS2 >= 10 && defined(_KERNEL)
1385 extern  int     fr_make_rst __P((fr_info_t *));
1386 extern  int     fr_make_icmp __P((fr_info_t *));
1387 extern  void    fr_calc_chksum __P((fr_info_t *, mb_t *));
1388 extern  ipf_stack_t *ipf_find_stack(const zoneid_t, ipf_devstate_t *);
1389 #   endif
1390 extern  int     iplopen __P((dev_t *, int, int, cred_t *));
1391 extern  int     iplclose __P((dev_t, int, int, cred_t *));
1392 extern  int     iplread __P((dev_t, uio_t *, cred_t *));
1393 extern  int     iplwrite __P((dev_t, uio_t *, cred_t *));
1394 #  endif
1395 #  ifdef __hpux
1396 extern  int     iplopen __P((dev_t, int, intptr_t, int));
1397 extern  int     iplclose __P((dev_t, int, int));
1398 extern  int     iplioctl __P((dev_t, int, caddr_t, int));
1399 extern  int     iplread __P((dev_t, uio_t *));
1400 extern  int     iplwrite __P((dev_t, uio_t *));
1401 extern  int     iplselect __P((dev_t, int));
1402 #  endif
1403 extern  int     ipfsync __P((ipf_stack_t *));
1404 extern  int     fr_qout __P((queue_t *, mblk_t *));
1405 # else /* MENTAT */
1406 extern  int     fr_check __P((struct ip *, int, void *, int, mb_t **, ipf_stack_t *));
1407 extern  int     (*fr_checkp) __P((ip_t *, int, void *, int, mb_t **, ipf_stack_t *));
1408 extern  size_t  mbufchainlen __P((mb_t *));
1409 #  ifdef        __sgi
1410 #   include <sys/cred.h>
1411 extern  int     iplioctl __P((dev_t, int, caddr_t, int, cred_t *, int *));
1412 extern  int     iplopen __P((dev_t *, int, int, cred_t *));
1413 extern  int     iplclose __P((dev_t, int, int, cred_t *));
1414 extern  int     iplread __P((dev_t, uio_t *, cred_t *));
1415 extern  int     iplwrite __P((dev_t, uio_t *, cred_t *));
1416 extern  int     ipfsync __P((ipf_stack_t *));
1417 extern  int     ipfilter_sgi_attach __P((void));
1418 extern  void    ipfilter_sgi_detach __P((void));
1419 extern  void    ipfilter_sgi_intfsync __P((void));
1420 #  else
1421 #   ifdef       IPFILTER_LKM
1422 extern  int     iplidentify __P((char *));
1423 #   endif
1424 #   if (_BSDI_VERSION >= 199510) || (__FreeBSD_version >= 220000) || \
1425       (NetBSD >= 199511) || defined(__OpenBSD__)
1426 #    if defined(__NetBSD__) || (_BSDI_VERSION >= 199701) || \
1427        defined(__OpenBSD__) || (__FreeBSD_version >= 300000)
1428 #     if (__FreeBSD_version >= 500024)
1429 #      if (__FreeBSD_version >= 502116)
1430 extern  int     iplioctl __P((struct cdev*, u_long, caddr_t, int, struct thread *));
1431 #      else
1432 extern  int     iplioctl __P((dev_t, u_long, caddr_t, int, struct thread *));
1433 #      endif /* __FreeBSD_version >= 502116 */
1434 #     else
1435 extern  int     iplioctl __P((dev_t, u_long, caddr_t, int, struct proc *));
1436 #     endif /* __FreeBSD_version >= 500024 */
1437 #    else
1438 extern  int     iplioctl __P((dev_t, int, caddr_t, int, struct proc *));
1439 #    endif
1440 #    if (__FreeBSD_version >= 500024)
1441 #      if (__FreeBSD_version >= 502116)
1442 extern  int     iplopen __P((struct cdev*, int, int, struct thread *));
1443 extern  int     iplclose __P((struct cdev*, int, int, struct thread *));
1444 #      else
1445 extern  int     iplopen __P((dev_t, int, int, struct thread *));
1446 extern  int     iplclose __P((dev_t, int, int, struct thread *));
1447 #      endif /* __FreeBSD_version >= 502116 */
1448 #    else
1449 extern  int     iplopen __P((dev_t, int, int, struct proc *));
1450 extern  int     iplclose __P((dev_t, int, int, struct proc *));
1451 #    endif /* __FreeBSD_version >= 500024 */
1452 #   else
1453 #    ifdef linux
1454 extern  int     iplioctl __P((struct inode *, struct file *, u_int, u_long));
1455 #    else
1456 extern  int     iplopen __P((dev_t, int));
1457 extern  int     iplclose __P((dev_t, int));
1458 extern  int     iplioctl __P((dev_t, int, caddr_t, int));
1459 #    endif
1460 #   endif /* (_BSDI_VERSION >= 199510) */
1461 #   if  BSD >= 199306
1462 #      if (__FreeBSD_version >= 502116)
1463 extern  int     iplread __P((struct cdev*, struct uio *, int));
1464 extern  int     iplwrite __P((struct cdev*, struct uio *, int));
1465 #      else
1466 extern  int     iplread __P((dev_t, struct uio *, int));
1467 extern  int     iplwrite __P((dev_t, struct uio *, int));
1468 #      endif /* __FreeBSD_version >= 502116 */
1469 #   else
1470 #    ifndef linux
1471 extern  int     iplread __P((dev_t, struct uio *));
1472 extern  int     iplwrite __P((dev_t, struct uio *));
1473 #    endif
1474 #   endif /* BSD >= 199306 */
1475 #  endif /* __ sgi */
1476 # endif /* MENTAT */
1477 
1478 #endif /* #ifndef _KERNEL */
1479 
1480 extern  char    *memstr __P((char *, char *, int, int));
1481 extern  int     count4bits __P((u_32_t));
1482 extern  int     count6bits __P((u_32_t *));
1483 extern  int     frrequest __P((int, ioctlcmd_t, caddr_t, int, int, ipf_stack_t *));
1484 extern  char    *getifname __P((struct ifnet *));
1485 extern  int     iplattach __P((ipf_stack_t *));
1486 extern  int     ipldetach __P((ipf_stack_t *));
1487 extern  u_short ipf_cksum __P((u_short *, int));
1488 extern  int     copyinptr __P((void *, void *, size_t));
1489 extern  int     copyoutptr __P((void *, void *, size_t));
1490 extern  int     fr_fastroute __P((mb_t *, mb_t **, fr_info_t *, frdest_t *));
1491 extern  int     fr_inobj __P((void *, void *, int));
1492 extern  int     fr_inobjsz __P((void *, void *, int, int));
1493 extern  int     fr_ioctlswitch __P((int, void *, ioctlcmd_t, int, int, void *,
1494                                     ipf_stack_t *));
1495 extern  int     fr_ipftune __P((ioctlcmd_t, void *, ipf_stack_t *));
1496 extern  int     fr_outobj __P((void *, void *, int));
1497 extern  int     fr_outobjsz __P((void *, void *, int, int));
1498 extern  void    *fr_pullup __P((mb_t *, fr_info_t *, int));
1499 extern  void    fr_resolvedest __P((struct frdest *, int, ipf_stack_t *));
1500 extern  int     fr_resolvefunc __P((void *));
1501 extern  void    *fr_resolvenic __P((char *, int, ipf_stack_t *));
1502 extern  int     fr_send_icmp_err __P((int, fr_info_t *, int));
1503 extern  int     fr_send_reset __P((fr_info_t *));
1504 #if  (__FreeBSD_version < 490000) || !defined(_KERNEL)
1505 extern  int     ppsratecheck __P((struct timeval *, int *, int));
1506 #endif
1507 extern  ipftq_t *fr_addtimeoutqueue __P((ipftq_t **, u_int, ipf_stack_t *));
1508 extern  void    fr_deletequeueentry __P((ipftqent_t *));
1509 extern  int     fr_deletetimeoutqueue __P((ipftq_t *));
1510 extern  void    fr_freetimeoutqueue __P((ipftq_t *, ipf_stack_t *));
1511 extern  void    fr_movequeue __P((ipftqent_t *, ipftq_t *, ipftq_t *,
1512                                   ipf_stack_t *));
1513 extern  void    fr_queueappend __P((ipftqent_t *, ipftq_t *, void *,
1514                                     ipf_stack_t *));
1515 extern  void    fr_queueback __P((ipftqent_t *, ipf_stack_t *));
1516 extern  void    fr_queuefront __P((ipftqent_t *));
1517 extern  void    fr_checkv4sum __P((fr_info_t *));
1518 extern  int     fr_checkl4sum __P((fr_info_t *));
1519 extern  int     fr_ifpfillv4addr __P((int, struct sockaddr_in *,
1520                                       struct sockaddr_in *, struct in_addr *,
1521                                       struct in_addr *));
1522 extern  int     fr_coalesce __P((fr_info_t *));
1523 #ifdef  USE_INET6
1524 extern  void    fr_checkv6sum __P((fr_info_t *));
1525 extern  int     fr_ifpfillv6addr __P((int, struct sockaddr_in6 *,
1526                                       struct sockaddr_in6 *, struct in_addr *,
1527                                       struct in_addr *));
1528 #endif
1529 
1530 #define IPFILTER_COMPAT
1531 extern  int     fr_incomptrans __P((ipfobj_t *, void *));
1532 extern  int     fr_outcomptrans __P((ipfobj_t *, void *));
1533 
1534 extern  int             fr_addipftune __P((ipftuneable_t *, ipf_stack_t *));
1535 extern  int             fr_delipftune __P((ipftuneable_t *, ipf_stack_t *));
1536 
1537 extern  int     frflush __P((minor_t, int, int, ipf_stack_t *));
1538 extern  void    frsync __P((int, int, void *, char *, ipf_stack_t *));
1539 #if SOLARIS2 >= 10
1540 extern  void    fr_ifindexsync __P((void *, void *, ipf_stack_t *));
1541 #endif
1542 extern  frgroup_t *fr_addgroup __P((char *, void *, u_32_t, minor_t, int,
1543                                     ipf_stack_t *));
1544 extern  int     fr_derefrule __P((frentry_t **, ipf_stack_t *));
1545 extern  void    fr_delgroup __P((char *, minor_t, int, ipf_stack_t *));
1546 extern  frgroup_t *fr_findgroup __P((char *, minor_t, int, frgroup_t ***,
1547                                      ipf_stack_t *));
1548 
1549 extern  int     fr_loginit __P((ipf_stack_t *));
1550 extern  int     ipflog_clear __P((minor_t, ipf_stack_t *));
1551 extern  int     ipflog_read __P((minor_t, struct uio *, ipf_stack_t *));
1552 extern  int     ipflog __P((fr_info_t *, u_int));
1553 extern  int     ipllog __P((int, fr_info_t *, void **, size_t *, int *, int,
1554                             ipf_stack_t *));
1555 extern  void    fr_logunload __P((ipf_stack_t *));
1556 
1557 extern  frentry_t       *fr_acctpkt __P((fr_info_t *, u_32_t *));
1558 extern  int             fr_copytolog __P((int, char *, int));
1559 extern  u_short         fr_cksum __P((mb_t *, ip_t *, int, void *));
1560 extern  void            fr_deinitialise __P((ipf_stack_t *));
1561 extern  frentry_t       *fr_dolog __P((fr_info_t *, u_32_t *));
1562 extern  frentry_t       *fr_dstgrpmap __P((fr_info_t *, u_32_t *));
1563 extern  void            fr_fixskip __P((frentry_t **, frentry_t *, int));
1564 extern  void            fr_forgetifp __P((void *, ipf_stack_t *));
1565 extern  frentry_t       *fr_getrulen __P((int, char *, u_32_t, 
1566                                           ipf_stack_t *));
1567 extern  void            fr_getstat __P((struct friostat *, ipf_stack_t *));
1568 extern  int             fr_ifpaddr __P((int, int, void *,
1569                                         struct in_addr *, struct in_addr *,
1570                                         ipf_stack_t *));
1571 extern  int             fr_initialise __P((ipf_stack_t *));
1572 extern  int             fr_lock __P((caddr_t, int *));
1573 extern  int             fr_makefrip __P((int, ip_t *, fr_info_t *));
1574 extern  int             fr_matchtag __P((ipftag_t *, ipftag_t *));
1575 extern  int             fr_matchicmpqueryreply __P((int, icmpinfo_t *,
1576                                                     struct icmp *, int));
1577 extern  u_32_t          fr_newisn __P((fr_info_t *));
1578 extern  u_short         fr_nextipid __P((fr_info_t *));
1579 extern  int             fr_rulen __P((int, frentry_t *, ipf_stack_t *));
1580 extern  int             fr_scanlist __P((fr_info_t *, u_32_t));
1581 extern  frentry_t       *fr_srcgrpmap __P((fr_info_t *, u_32_t *));
1582 extern  int             fr_tcpudpchk __P((fr_info_t *, frtuc_t *));
1583 extern  int             fr_verifysrc __P((fr_info_t *fin));
1584 extern  int             fr_zerostats __P((char *, ipf_stack_t *));
1585 extern  ipftoken_t      *ipf_findtoken __P((int, int, void *, ipf_stack_t *));
1586 extern  int             ipf_getnextrule __P((ipftoken_t *, void *,
1587                                              ipf_stack_t *));
1588 extern  void            ipf_expiretokens __P((ipf_stack_t *));
1589 extern  void            ipf_freetoken __P((ipftoken_t *, ipf_stack_t *));
1590 extern  int             ipf_deltoken __P((int, int, void *, ipf_stack_t *));
1591 extern  int             ipf_genericiter __P((void *, int, void *, ipf_stack_t *));
1592 extern  int             ipf_extraflush __P((int, ipftq_t *, ipftq_t *, ipf_stack_t *));
1593 extern  int             ipf_flushclosing __P((int, int, ipftq_t *, ipftq_t *, ipf_stack_t *));
1594 extern  int             ipf_earlydrop __P((int, ipftq_t *, int, ipf_stack_t *));
1595 
1596 #ifndef ipf_random
1597 extern  u_32_t          ipf_random __P((void));
1598 #endif
1599 
1600 #if defined(_KERNEL)
1601 extern  int     fr_setzoneid __P((ipf_devstate_t *, void *));
1602 #endif
1603 
1604 extern  char    ipfilter_version[];
1605 #ifdef  USE_INET6
1606 extern  int     icmptoicmp6types[ICMP_MAXTYPE+1];
1607 extern  int     icmptoicmp6unreach[ICMP_MAX_UNREACH];
1608 extern  int     icmpreplytype6[ICMP6_MAXTYPE + 1];
1609 #endif
1610 extern  int     icmpreplytype4[ICMP_MAXTYPE + 1];
1611 extern  frentry_t *ipfrule_match __P((fr_info_t *));
1612 
1613 extern void     ipftuneable_alloc(ipf_stack_t *);
1614 extern void     ipftuneable_free(ipf_stack_t *);
1615 
1616 #endif  /* __IP_FIL_H__ */