1/*
2 * Copyright (c) 2008-2013 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28/*
29 * Copyright (c) 1993 Daniel Boulet
30 * Copyright (c) 1994 Ugen J.S.Antsilevich
31 *
32 * Redistribution and use in source forms, with and without modification,
33 * are permitted provided that this entire comment appears intact.
34 *
35 * Redistribution in binary form may occur without any restrictions.
36 * Obviously, it would be nice if you gave credit where credit is due
37 * but requiring it would be too onerous.
38 *
39 * This software is provided ``AS IS'' without any warranties of any kind.
40 *
41 */
42
43#ifndef _IP_FW_H
44#define _IP_FW_H
45#ifdef __APPLE_API_OBSOLETE
46
47#include <sys/appleapiopts.h>
48
49#ifdef IPFW2
50#include <netinet/ip_fw2.h>
51#else /* !IPFW2, good old ipfw */
52
53#include <sys/queue.h>
54#include <sys/types.h> /* u_ types */
55
56#define IP_FW_CURRENT_API_VERSION 20 /* Version of this API */
57
58
59/*
60 * This union structure identifies an interface, either explicitly
61 * by name or implicitly by IP address. The flags IP_FW_F_IIFNAME
62 * and IP_FW_F_OIFNAME say how to interpret this structure. An
63 * interface unit number of -1 matches any unit number, while an
64 * IP address of 0.0.0.0 indicates matches any interface.
65 *
66 * The receive and transmit interfaces are only compared against the
67 * the packet if the corresponding bit (IP_FW_F_IIFACE or IP_FW_F_OIFACE)
68 * is set. Note some packets lack a receive or transmit interface
69 * (in which case the missing "interface" never matches).
70 */
71
72union ip_fw_if {
73 struct in_addr fu_via_ip; /* Specified by IP address */
74 struct { /* Specified by interface name */
75#define FW_IFNLEN 10 /* need room ! was IFNAMSIZ */
76 char name[FW_IFNLEN];
77 short unit; /* -1 means match any unit */
78 } fu_via_if;
79};
80
81/*
82 * Format of an IP firewall descriptor
83 *
84 * fw_src, fw_dst, fw_smsk, fw_dmsk are always stored in network byte order.
85 * fw_flg and fw_n*p are stored in host byte order (of course).
86 * Port numbers are stored in HOST byte order.
87 */
88
89struct ip_fw {
90 u_int32_t version; /* Version of this structure. Should always be */
91 /* set to IP_FW_CURRENT_API_VERSION by clients. */
92 void *context; /* Context that is usable by user processes to */
93 /* identify this rule. */
94 u_int64_t fw_pcnt,fw_bcnt; /* Packet and byte counters */
95 struct in_addr fw_src, fw_dst; /* Source and destination IP addr */
96 struct in_addr fw_smsk, fw_dmsk; /* Mask for src and dest IP addr */
97 u_short fw_number; /* Rule number */
98 u_int fw_flg; /* Flags word */
99#define IP_FW_MAX_PORTS 10 /* A reasonable maximum */
100 union {
101 u_short fw_pts[IP_FW_MAX_PORTS]; /* Array of port numbers to match */
102#define IP_FW_ICMPTYPES_MAX 128
103#define IP_FW_ICMPTYPES_DIM (IP_FW_ICMPTYPES_MAX / (sizeof(unsigned) * 8))
104 unsigned fw_icmptypes[IP_FW_ICMPTYPES_DIM]; /* ICMP types bitmap */
105 } fw_uar;
106 u_int fw_ipflg; /* IP flags word */
107 u_char fw_ipopt,fw_ipnopt; /* IP options set/unset */
108 u_char fw_tcpopt,fw_tcpnopt; /* TCP options set/unset */
109 u_char fw_tcpf,fw_tcpnf; /* TCP flags set/unset */
110 long timestamp; /* timestamp (tv_sec) of last match */
111 union ip_fw_if fw_in_if, fw_out_if; /* Incoming and outgoing interfaces */
112 union {
113 u_short fu_divert_port; /* Divert/tee port (options IPDIVERT) */
114 u_short fu_pipe_nr; /* queue number (option DUMMYNET) */
115 u_short fu_skipto_rule; /* SKIPTO command rule number */
116 u_short fu_reject_code; /* REJECT response code */
117 struct sockaddr_in fu_fwd_ip;
118 } fw_un;
119 u_char fw_prot; /* IP protocol */
120 /*
121 * N'of src ports and # of dst ports in ports array (dst ports
122 * follow src ports; max of 10 ports in all; count of 0 means
123 * match all ports)
124 */
125 u_char fw_nports;
126 void *pipe_ptr; /* flow_set ptr for dummynet pipe */
127 void *next_rule_ptr ; /* next rule in case of match */
128 uid_t fw_uid; /* uid to match */
129 int fw_logamount; /* amount to log */
130 u_int64_t fw_loghighest; /* highest number packet to log */
131};
132
133/*
134 * extended ipfw structure... some fields in the original struct
135 * can be used to pass parameters up/down, namely pointers
136 * void *pipe_ptr
137 * void *next_rule_ptr
138 * some others can be used to pass parameters down, namely counters etc.
139 * u_int64_t fw_pcnt,fw_bcnt;
140 * long timestamp;
141 */
142
143struct ip_fw_ext { /* extended structure */
144 struct ip_fw rule; /* must be at offset 0 */
145 long dont_match_prob; /* 0x7fffffff means 1.0, always fail */
146 u_int dyn_type; /* type for dynamic rule */
147};
148
149#define IP_FW_GETNSRCP(rule) ((rule)->fw_nports & 0x0f)
150#define IP_FW_SETNSRCP(rule, n) do { \
151 (rule)->fw_nports &= ~0x0f; \
152 (rule)->fw_nports |= (n); \
153 } while (0)
154#define IP_FW_GETNDSTP(rule) ((rule)->fw_nports >> 4)
155#define IP_FW_SETNDSTP(rule, n) do { \
156 (rule)->fw_nports &= ~0xf0; \
157 (rule)->fw_nports |= (n) << 4;\
158 } while (0)
159
160#define fw_divert_port fw_un.fu_divert_port
161#define fw_skipto_rule fw_un.fu_skipto_rule
162#define fw_reject_code fw_un.fu_reject_code
163#define fw_pipe_nr fw_un.fu_pipe_nr
164#define fw_fwd_ip fw_un.fu_fwd_ip
165
166struct ip_fw_chain {
167 LIST_ENTRY(ip_fw_chain) next;
168 struct ip_fw *rule;
169};
170
171/*
172 * Flow mask/flow id for each queue.
173 */
174struct ipfw_flow_id {
175 u_int32_t dst_ip, src_ip ;
176 u_int16_t dst_port, src_port ;
177 u_int8_t proto ;
178 u_int8_t flags ; /* protocol-specific flags */
179} ;
180
181/*
182 * dynamic ipfw rule
183 */
184struct ipfw_dyn_rule {
185 struct ipfw_dyn_rule *next ;
186
187 struct ipfw_flow_id id ;
188 struct ipfw_flow_id mask ;
189 struct ip_fw_chain *chain ; /* pointer to parent rule */
190 u_int32_t type ; /* rule type */
191 u_int32_t expire ; /* expire time */
192 u_int64_t pcnt, bcnt; /* match counters */
193 u_int32_t bucket ; /* which bucket in hash table */
194 u_int32_t state ; /* state of this rule (typ. a */
195 /* combination of TCP flags) */
196} ;
197
198/*
199 * Values for "flags" field .
200 */
201#define IP_FW_F_COMMAND 0x000000ff /* Mask for type of chain entry: */
202#define IP_FW_F_DENY 0x00000000 /* This is a deny rule */
203#define IP_FW_F_REJECT 0x00000001 /* Deny and send a response packet */
204#define IP_FW_F_ACCEPT 0x00000002 /* This is an accept rule */
205#define IP_FW_F_COUNT 0x00000003 /* This is a count rule */
206#define IP_FW_F_DIVERT 0x00000004 /* This is a divert rule */
207#define IP_FW_F_TEE 0x00000005 /* This is a tee rule */
208#define IP_FW_F_SKIPTO 0x00000006 /* This is a skipto rule */
209#define IP_FW_F_FWD 0x00000007 /* This is a "change forwarding address" rule */
210#define IP_FW_F_PIPE 0x00000008 /* This is a dummynet rule */
211#define IP_FW_F_QUEUE 0x00000009 /* This is a dummynet queue */
212
213#define IP_FW_F_IN 0x00000100 /* Check inbound packets */
214#define IP_FW_F_OUT 0x00000200 /* Check outbound packets */
215#define IP_FW_F_IIFACE 0x00000400 /* Apply inbound interface test */
216#define IP_FW_F_OIFACE 0x00000800 /* Apply outbound interface test */
217
218#define IP_FW_F_PRN 0x00001000 /* Print if this rule matches */
219
220#define IP_FW_F_SRNG 0x00002000 /* The first two src ports are a min *
221 * and max range (stored in host byte *
222 * order). */
223
224#define IP_FW_F_DRNG 0x00004000 /* The first two dst ports are a min *
225 * and max range (stored in host byte *
226 * order). */
227
228#define IP_FW_F_FRAG 0x00008000 /* Fragment */
229
230#define IP_FW_F_IIFNAME 0x00010000 /* In interface by name/unit (not IP) */
231#define IP_FW_F_OIFNAME 0x00020000 /* Out interface by name/unit (not IP) */
232
233#define IP_FW_F_INVSRC 0x00040000 /* Invert sense of src check */
234#define IP_FW_F_INVDST 0x00080000 /* Invert sense of dst check */
235
236#define IP_FW_F_ICMPBIT 0x00100000 /* ICMP type bitmap is valid */
237
238#define IP_FW_F_UID 0x00200000 /* filter by uid */
239
240#define IP_FW_F_RND_MATCH 0x00800000 /* probabilistic rule match */
241#define IP_FW_F_SMSK 0x01000000 /* src-port + mask */
242#define IP_FW_F_DMSK 0x02000000 /* dst-port + mask */
243#define IP_FW_BRIDGED 0x04000000 /* only match bridged packets */
244#define IP_FW_F_KEEP_S 0x08000000 /* keep state */
245#define IP_FW_F_CHECK_S 0x10000000 /* check state */
246
247#define IP_FW_F_SME 0x20000000 /* source = me */
248#define IP_FW_F_DME 0x40000000 /* destination = me */
249
250#define IP_FW_F_MASK 0x7FFFFFFF /* All possible flag bits mask */
251
252/*
253 * Flags for the 'fw_ipflg' field, for comparing values of ip and its protocols.
254 */
255#define IP_FW_IF_TCPEST 0x00000020 /* established TCP connection */
256#define IP_FW_IF_TCPMSK 0x00000020 /* mask of all TCP values */
257
258/*
259 * For backwards compatibility with rules specifying "via iface" but
260 * not restricted to only "in" or "out" packets, we define this combination
261 * of bits to represent this configuration.
262 */
263
264#define IF_FW_F_VIAHACK (IP_FW_F_IN|IP_FW_F_OUT|IP_FW_F_IIFACE|IP_FW_F_OIFACE)
265
266/*
267 * Definitions for REJECT response codes.
268 * Values less than 256 correspond to ICMP unreachable codes.
269 */
270#define IP_FW_REJECT_RST 0x0100 /* TCP packets: send RST */
271
272/*
273 * Definitions for IP option names.
274 */
275#define IP_FW_IPOPT_LSRR 0x01
276#define IP_FW_IPOPT_SSRR 0x02
277#define IP_FW_IPOPT_RR 0x04
278#define IP_FW_IPOPT_TS 0x08
279
280/*
281 * Definitions for TCP option names.
282 */
283#define IP_FW_TCPOPT_MSS 0x01
284#define IP_FW_TCPOPT_WINDOW 0x02
285#define IP_FW_TCPOPT_SACK 0x04
286#define IP_FW_TCPOPT_TS 0x08
287#define IP_FW_TCPOPT_CC 0x10
288
289/*
290 * Definitions for TCP flags.
291 */
292#define IP_FW_TCPF_FIN TH_FIN
293#define IP_FW_TCPF_SYN TH_SYN
294#define IP_FW_TCPF_RST TH_RST
295#define IP_FW_TCPF_PSH TH_PUSH
296#define IP_FW_TCPF_ACK TH_ACK
297#define IP_FW_TCPF_URG TH_URG
298
299/*
300 * Main firewall chains definitions and global var's definitions.
301 */
302#ifdef BSD_KERNEL_PRIVATE
303
304#define IP_FW_PORT_DYNT_FLAG 0x10000
305#define IP_FW_PORT_TEE_FLAG 0x20000
306#define IP_FW_PORT_DENY_FLAG 0x40000
307
308/*
309 * Function definitions.
310 */
311void ip_fw_init(void);
312
313/* Firewall hooks */
314struct ip;
315struct sockopt;
316typedef int ip_fw_chk_t(struct ip **, int, struct ifnet *, u_int16_t *,
317 struct mbuf **, struct ip_fw_chain **, struct sockaddr_in **);
318typedef int ip_fw_ctl_t(struct sockopt *);
319extern ip_fw_chk_t *ip_fw_chk_ptr;
320extern ip_fw_ctl_t *ip_fw_ctl_ptr;
321extern int fw_one_pass;
322extern int fw_enable;
323#define IPFW_LOADED (ip_fw_chk_ptr != NULL)
324extern struct ipfw_flow_id last_pkt ;
325#endif /* BSD_KERNEL_PRIVATE */
326
327#endif /* !IPFW2 */
328#endif /* __APPLE_API_OBSOLETE */
329#endif /* _IP_FW_H */
330