1 //==========================================================================
3 // include/netinet6/ip6_fw.h
5 //==========================================================================
6 //####BSDCOPYRIGHTBEGIN####
8 // -------------------------------------------
10 // Portions of this software may have been derived from OpenBSD,
11 // FreeBSD or other sources, and are covered by the appropriate
12 // copyright disclaimers included herein.
14 // Portions created by Red Hat are
15 // Copyright (C) 2002 Red Hat, Inc. All Rights Reserved.
17 // -------------------------------------------
19 //####BSDCOPYRIGHTEND####
20 //==========================================================================
22 /* $KAME: ip6_fw.h,v 1.9 2001/08/01 04:29:57 sumikawa Exp $ */
25 * Copyright (C) 1998, 1999, 2000 and 2001 WIDE Project.
26 * All rights reserved.
28 * Redistribution and use in source and binary forms, with or without
29 * modification, are permitted provided that the following conditions
31 * 1. Redistributions of source code must retain the above copyright
32 * notice, this list of conditions and the following disclaimer.
33 * 2. Redistributions in binary form must reproduce the above copyright
34 * notice, this list of conditions and the following disclaimer in the
35 * documentation and/or other materials provided with the distribution.
36 * 3. Neither the name of the project nor the names of its contributors
37 * may be used to endorse or promote products derived from this software
38 * without specific prior written permission.
40 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
41 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
43 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
44 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
45 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
46 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
48 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
49 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
54 * Copyright (c) 1993 Daniel Boulet
55 * Copyright (c) 1994 Ugen J.S.Antsilevich
57 * Redistribution and use in source forms, with and without modification,
58 * are permitted provided that this entire comment appears intact.
60 * Redistribution in binary form may occur without any restrictions.
61 * Obviously, it would be nice if you gave credit where credit is due
62 * but requiring it would be too onerous.
64 * This software is provided ``AS IS'' without any warranties of any kind.
74 * This union structure identifies an interface, either explicitly
75 * by name or implicitly by IP address. The flags IP_FW_F_IIFNAME
76 * and IP_FW_F_OIFNAME say how to interpret this structure. An
77 * interface unit number of -1 matches any unit number, while an
78 * IP address of 0.0.0.0 indicates matches any interface.
80 * The receive and transmit interfaces are only compared against the
81 * the packet if the corresponding bit (IP_FW_F_IIFACE or IP_FW_F_OIFACE)
82 * is set. Note some packets lack a receive or transmit interface
83 * (in which case the missing "interface" never matches).
87 struct in6_addr fu_via_ip6; /* Specified by IPv6 address */
88 struct { /* Specified by interface name */
89 #define IP6FW_IFNLEN IFNAMSIZ
90 char name[IP6FW_IFNLEN];
91 short unit; /* -1 means match any unit */
96 * Format of an IP firewall descriptor
98 * fw_src, fw_dst, fw_smsk, fw_dmsk are always stored in network byte order.
99 * fw_flg and fw_n*p are stored in host byte order (of course).
100 * Port numbers are stored in HOST byte order.
101 * Warning: setsockopt() will fail if sizeof(struct ip_fw) > MLEN (108)
105 u_long fw_pcnt,fw_bcnt; /* Packet and byte counters */
106 struct in6_addr fw_src, fw_dst; /* Source and destination IPv6 addr */
107 struct in6_addr fw_smsk, fw_dmsk; /* Mask for src and dest IPv6 addr */
108 u_short fw_number; /* Rule number */
109 u_short fw_flg; /* Flags word */
110 #define IPV6_FW_MAX_PORTS 10 /* A reasonable maximum */
111 u_int fw_ipflg; /* IP flags word */
112 u_short fw_pts[IPV6_FW_MAX_PORTS]; /* Array of port numbers to match */
113 u_char fw_ip6opt,fw_ip6nopt; /* IPv6 options set/unset */
114 u_char fw_tcpf,fw_tcpnf; /* TCP flags set/unset */
115 #define IPV6_FW_ICMPTYPES_DIM (256 / (sizeof(unsigned) * 8))
116 unsigned fw_icmp6types[IPV6_FW_ICMPTYPES_DIM]; /* ICMP types bitmap */
117 long timestamp; /* timestamp (tv_sec) of last match */
118 union ip6_fw_if fw_in_if, fw_out_if;/* Incoming and outgoing interfaces */
120 u_short fu_divert_port; /* Divert/tee port (options IP6DIVERT) */
121 u_short fu_skipto_rule; /* SKIPTO command rule number */
122 u_short fu_reject_code; /* REJECT response code */
124 u_char fw_prot; /* IPv6 protocol */
125 u_char fw_nports; /* N'of src ports and # of dst ports */
126 /* in ports array (dst ports follow */
127 /* src ports; max of 10 ports in all; */
128 /* count of 0 means match all ports) */
131 #define IPV6_FW_GETNSRCP(rule) ((rule)->fw_nports & 0x0f)
132 #define IPV6_FW_SETNSRCP(rule, n) do { \
133 (rule)->fw_nports &= ~0x0f; \
134 (rule)->fw_nports |= (n); \
136 #define IPV6_FW_GETNDSTP(rule) ((rule)->fw_nports >> 4)
137 #define IPV6_FW_SETNDSTP(rule, n) do { \
138 (rule)->fw_nports &= ~0xf0; \
139 (rule)->fw_nports |= (n) << 4;\
142 #define fw_divert_port fw_un.fu_divert_port
143 #define fw_skipto_rule fw_un.fu_skipto_rule
144 #define fw_reject_code fw_un.fu_reject_code
146 struct ip6_fw_chain {
147 LIST_ENTRY(ip6_fw_chain) chain;
152 * Values for "flags" field .
154 #define IPV6_FW_F_IN 0x0001 /* Check inbound packets */
155 #define IPV6_FW_F_OUT 0x0002 /* Check outbound packets */
156 #define IPV6_FW_F_IIFACE 0x0004 /* Apply inbound interface test */
157 #define IPV6_FW_F_OIFACE 0x0008 /* Apply outbound interface test */
159 #define IPV6_FW_F_COMMAND 0x0070 /* Mask for type of chain entry: */
160 #define IPV6_FW_F_DENY 0x0000 /* This is a deny rule */
161 #define IPV6_FW_F_REJECT 0x0010 /* Deny and send a response packet */
162 #define IPV6_FW_F_ACCEPT 0x0020 /* This is an accept rule */
163 #define IPV6_FW_F_COUNT 0x0030 /* This is a count rule */
164 #define IPV6_FW_F_DIVERT 0x0040 /* This is a divert rule */
165 #define IPV6_FW_F_TEE 0x0050 /* This is a tee rule */
166 #define IPV6_FW_F_SKIPTO 0x0060 /* This is a skipto rule */
168 #define IPV6_FW_F_PRN 0x0080 /* Print if this rule matches */
170 #define IPV6_FW_F_SRNG 0x0100 /* The first two src ports are a min *
171 * and max range (stored in host byte *
174 #define IPV6_FW_F_DRNG 0x0200 /* The first two dst ports are a min *
175 * and max range (stored in host byte *
178 #define IPV6_FW_F_IIFNAME 0x0400 /* In interface by name/unit (not IP) */
179 #define IPV6_FW_F_OIFNAME 0x0800 /* Out interface by name/unit (not IP) */
181 #define IPV6_FW_F_INVSRC 0x1000 /* Invert sense of src check */
182 #define IPV6_FW_F_INVDST 0x2000 /* Invert sense of dst check */
184 #define IPV6_FW_F_FRAG 0x4000 /* Fragment */
186 #define IPV6_FW_F_ICMPBIT 0x8000 /* ICMP type bitmap is valid */
188 #define IPV6_FW_F_MASK 0xFFFF /* All possible flag bits mask */
191 * Flags for the 'fw_ipflg' field, for comparing values of ip and its protocols. */
192 #define IPV6_FW_IF_TCPEST 0x00000020 /* established TCP connection */
193 #define IPV6_FW_IF_TCPMSK 0x00000020 /* mask of all TCP values */
196 * For backwards compatibility with rules specifying "via iface" but
197 * not restricted to only "in" or "out" packets, we define this combination
198 * of bits to represent this configuration.
201 #define IF6_FW_F_VIAHACK (IPV6_FW_F_IN|IPV6_FW_F_OUT|IPV6_FW_F_IIFACE|IPV6_FW_F_OIFACE)
204 * Definitions for REJECT response codes.
205 * Values less than 256 correspond to ICMP unreachable codes.
207 #define IPV6_FW_REJECT_RST 0x0100 /* TCP packets: send RST */
210 * Definitions for IPv6 option names.
212 #define IPV6_FW_IP6OPT_HOPOPT 0x01
213 #define IPV6_FW_IP6OPT_ROUTE 0x02
214 #define IPV6_FW_IP6OPT_FRAG 0x04
215 #define IPV6_FW_IP6OPT_ESP 0x08
216 #define IPV6_FW_IP6OPT_AH 0x10
217 #define IPV6_FW_IP6OPT_NONXT 0x20
218 #define IPV6_FW_IP6OPT_OPTS 0x40
221 * Definitions for TCP flags.
223 #define IPV6_FW_TCPF_FIN TH_FIN
224 #define IPV6_FW_TCPF_SYN TH_SYN
225 #define IPV6_FW_TCPF_RST TH_RST
226 #define IPV6_FW_TCPF_PSH TH_PUSH
227 #define IPV6_FW_TCPF_ACK TH_ACK
228 #define IPV6_FW_TCPF_URG TH_URG
231 * Main firewall chains definitions and global var's definitions.
236 * Function definitions.
238 void ip6_fw_init(void);
242 typedef int ip6_fw_chk_t __P((struct ip6_hdr**, struct ifnet*, struct mbuf**));
243 typedef int ip6_fw_ctl_t __P((int, struct mbuf**));
244 extern ip6_fw_chk_t *ip6_fw_chk_ptr;
245 extern ip6_fw_ctl_t *ip6_fw_ctl_ptr;
246 #if defined(__FreeBSD__) && __FreeBSD__ >= 4
247 extern int ip6_fw_enable;
252 #endif /* _IP6_FW_H */