/* $NetBSD: pfil.h,v 1.22 2003/06/23 12:57:08 martin Exp $ */
/*-
* SPDX-License-Identifier: BSD-3-Clause
*
* Copyright (c) 2019 Gleb Smirnoff <glebius@FreeBSD.org>
* Copyright (c) 1996 Matthew R. Green
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. The name of the author may not be used to endorse or promote products
* derived from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
* AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/
#ifndef _NET_PFIL_H_
#define _NET_PFIL_H_
#include <sys/ioccom.h>
enum pfil_types {
PFIL_TYPE_IP4,
PFIL_TYPE_IP6,
PFIL_TYPE_ETHERNET,
};
#define MAXPFILNAME 64
struct pfilioc_head {
char pio_name[MAXPFILNAME];
int pio_nhooksin;
int pio_nhooksout;
enum pfil_types pio_type;
};
struct pfilioc_hook {
char pio_module[MAXPFILNAME];
char pio_ruleset[MAXPFILNAME];
int pio_flags;
enum pfil_types pio_type;
};
struct pfilioc_list {
u_int pio_nheads;
u_int pio_nhooks;
struct pfilioc_head *pio_heads;
struct pfilioc_hook *pio_hooks;
};
struct pfilioc_link {
char pio_name[MAXPFILNAME];
char pio_module[MAXPFILNAME];
char pio_ruleset[MAXPFILNAME];
int pio_flags;
};
#define PFILDEV "pfil"
#define PFILIOC_LISTHEADS _IOWR('P', 1, struct pfilioc_list)
#define PFILIOC_LISTHOOKS _IOWR('P', 2, struct pfilioc_list)
#define PFILIOC_LINK _IOW('P', 3, struct pfilioc_link)
#define PFIL_IN 0x00010000
#define PFIL_OUT 0x00020000
#define PFIL_FWD 0x00040000
#define PFIL_DIR(f) ((f) & (PFIL_IN|PFIL_OUT))
#define PFIL_HEADPTR 0x00100000
#define PFIL_HOOKPTR 0x00200000
#define PFIL_APPEND 0x00400000
#define PFIL_UNLINK 0x00800000
#ifdef _KERNEL
struct mbuf;
struct ifnet;
struct inpcb;
typedef enum {
PFIL_PASS = 0,
PFIL_DROPPED,
PFIL_CONSUMED,
PFIL_REALLOCED,
} pfil_return_t;
typedef pfil_return_t (*pfil_mbuf_chk_t)(struct mbuf **, struct ifnet *, int,
void *, struct inpcb *);
typedef pfil_return_t (*pfil_mem_chk_t)(void *, u_int, int, struct ifnet *,
void *, struct mbuf **);
/*
* A pfil head is created by a packet intercept point.
*
* A pfil hook is created by a packet filter.
*
* Hooks are chained on heads. Historically some hooking happens
* automatically, e.g. ipfw(4), pf(4) and ipfilter(4) would register
* theirselves on IPv4 and IPv6 input/output.
*/
typedef struct pfil_hook * pfil_hook_t;
typedef struct pfil_head * pfil_head_t;
/*
* Give us a chance to modify pfil_xxx_args structures in future.
*/
#define PFIL_VERSION 2
/* Argument structure used by packet filters to register themselves. */
struct pfil_hook_args {
int pa_version;
int pa_flags;
enum pfil_types pa_type;
pfil_mbuf_chk_t pa_mbuf_chk;
pfil_mem_chk_t pa_mem_chk;
void *pa_ruleset;
const char *pa_modname;
const char *pa_rulname;
};
/* Public functions for pfil hook management by packet filters. */
pfil_hook_t pfil_add_hook(struct pfil_hook_args *);
void pfil_remove_hook(pfil_hook_t);
/* Argument structure used by ioctl() and packet filters to set filters. */
struct pfil_link_args {
int pa_version;
int pa_flags;
union {
const char *pa_headname;
pfil_head_t pa_head;
};
union {
struct {
const char *pa_modname;
const char *pa_rulname;
};
pfil_hook_t pa_hook;
};
};
/* Public function to configure filter chains. Used by ioctl() and filters. */
int pfil_link(struct pfil_link_args *);
/* Argument structure used by inspection points to register themselves. */
struct pfil_head_args {
int pa_version;
int pa_flags;
enum pfil_types pa_type;
const char *pa_headname;
};
/* Public functions for pfil head management by inspection points. */
pfil_head_t pfil_head_register(struct pfil_head_args *);
void pfil_head_unregister(pfil_head_t);
/* Public functions to run the packet inspection by inspection points. */
int pfil_mem_in(struct pfil_head *, void *, u_int, struct ifnet *,
struct mbuf **);
int pfil_mem_out(struct pfil_head *, void *, u_int, struct ifnet *,
struct mbuf **);
int pfil_mbuf_in(struct pfil_head *, struct mbuf **, struct ifnet *,
struct inpcb *inp);
int pfil_mbuf_out(struct pfil_head *, struct mbuf **, struct ifnet *,
struct inpcb *inp);
int pfil_mbuf_fwd(struct pfil_head *, struct mbuf **, struct ifnet *,
struct inpcb *);
/*
* Minimally exposed structure to avoid function call in case of absence
* of any filters by protocols and macros to do the check.
*/
struct _pfil_head {
int head_nhooksin;
int head_nhooksout;
};
#define PFIL_HOOKED_IN(p) (((struct _pfil_head *)(p))->head_nhooksin > 0)
#define PFIL_HOOKED_OUT(p) (((struct _pfil_head *)(p))->head_nhooksout > 0)
#endif /* _KERNEL */
#endif /* _NET_PFIL_H_ */
plain