/* ipfirewall.h - Public API of Wind River Firewall */

/*
 ******************************************************************************
 *                     INTERPEAK API HEADER FILE
 *
 *   Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipfirewall.h,v $ $Revision: 1.41 $
 *   $Source: /home/interpeak/CVSRoot/ipfirewall/include/ipfirewall.h,v $
 *   $Author: ulf $ $Date: 2010-09-09 08:55:27 $
 *   $State: Exp $ $Locker:  $
 *
 *   INTERPEAK_COPYRIGHT_STRING
 *     Design and implementation by Markus Carlstedt <markus@interpeak.se>
 ******************************************************************************
 */

#ifndef IPFIREWALL_H
#define IPFIREWALL_H


/*
 ****************************************************************************
 * 1                    DESCRIPTION
 ****************************************************************************
 * Public header file.
 */

/*
DESCRIPTION
This library contains the APIs used for configuration of Wind River Firewall.
*/

/*
 ****************************************************************************
 * 2                    CONFIGURATION
 ****************************************************************************
 */

#include "ipfirewall_config.h"


/*
 ****************************************************************************
 * 3                    INCLUDE FILES
 ****************************************************************************
 */

#include <ipcom_type.h>
#include <ipcom_cstyle.h>
#include <ipcom_sock.h>
#include <ipcom_netif.h>

#ifdef __cplusplus
extern "C" {
#endif


/*
 ****************************************************************************
 * 4                    DEFINES
 ****************************************************************************
 */

/*
 *===========================================================================
 *                         release
 *===========================================================================
 */

#define IPFIREWALL_RELEASE 60701


/*
 *===========================================================================
 *                      IPFIREWALL_USERDEF_ID_SIZE
 *===========================================================================
 * The maximum length of the user defined function identifier
 *
 */
#define IPFIREWALL_USERDEF_ID_SIZE  32

/*
 *===========================================================================
 *                      IPFIREWALL_USERDEF_PARAM_SIZE
 *===========================================================================
 * The maximum length of the user defined function parameter string
 *
 */
#define IPFIREWALL_USERDEF_PARAM_SIZE  64


/*
 *===========================================================================
 *                      IPFIREWALL_USERDEF_INFO_SIZE
 *===========================================================================
 * The length of the user defined information buffer size
 *
 */
#define IPFIREWALL_USERDEF_INFO_SIZE  256


/*
 *===========================================================================
 *                      IPFIREWALL_USERDEF_EXAMPLE_ID
 *===========================================================================
 * User defined function identifier for the user defined exampl.
 */
#define IPFIREWALL_USERDEF_EXAMPLE_ID   "userdef_example"


/*
 *===========================================================================
 *                      IPFIREWALL_HTTP_FILTER_ID
 *===========================================================================
 * User defined function identifier for the HTTP filter.
 */
#define IPFIREWALL_HTTP_FILTER_ID       "http_filter"


/*
 ****************************************************************************
 * 5                    TYPES
 ****************************************************************************
 */

/*
 *===========================================================================
 *                         Ipfirewall_userdef_match
 *===========================================================================
 * Description: User defined match function
 *
 * Parameters:  pkt - pointer to the ipcom packet
 *              cookie - a cookie set at registration.
 *              info - user defined info buffer
 *
 * Returns:     1 = rule matched.
 *              0 = rule did not match.
 *
 */
typedef int (* Ipfirewall_userdef_match) (Ipcom_pkt *pkt, void *cookie, void *info);

/*
 *===========================================================================
 *                         Ipfirewall_userdef_check
 *===========================================================================
 * Description: User defined check function (optional)
 *
 *              cookie - a cookie set at registration.
 *              info - parameter string specified in the rule syntax
 *              infolen - length if user defined info buffer
 *
 * Returns:     1 = rule parameters accepted
 *              0 = rule parameters not accepted
 *
 */
typedef int (* Ipfirewall_userdef_check) (void *cookie, void *info, unsigned int infolen);


/*
 *===========================================================================
 *                         Ipfirewall_userdef_destroy
 *===========================================================================
 * Description: User defined destroy function (optional)
 *
 *              cookie - a cookie set at registration.
 *              info - parameter string specified in the rule syntax
 *              infolen - length if user defined info buffer
 *
 * Returns:
 *
 */
typedef void (* Ipfirewall_userdef_destroy) (void *cookie, void *info, unsigned int infolen);


/*
 ****************************************************************************
 * 6                    FUNCTIONS
 ****************************************************************************
 */

IP_PUBLIC Ip_s32 ipfirewall_mac_input_hook(Ipcom_netif *netif, Ipcom_pkt *pkt);
IP_PUBLIC Ip_s32 ipfirewall_mac_output_hook(Ipcom_netif *netif, Ipcom_pkt *pkt);
IP_PUBLIC Ip_s32 ipfirewall_input_hook(Ipcom_netif *netif, Ipcom_pkt *pkt);
IP_PUBLIC Ip_s32 ipfirewall_output_hook(Ipcom_netif *netif, Ipcom_pkt *pkt);
IP_PUBLIC int ipfirewall_userdef_match(Ipcom_pkt *pkt, void *cookie, void *info);
IP_PUBLIC int ipfirewall_userdef_check(void *cookie, void *info, unsigned int infolen);
IP_PUBLIC void ipfirewall_userdef_destroy(void *cookie, void *info, unsigned int infolen);
IP_PUBLIC Ip_s32 ipfirewall_getsockopt(void *sock, int optname, void *optval, Ip_socklen_t *optlen);
IP_PUBLIC Ip_s32 ipfirewall_setsockopt(void *sock, int optname, IP_CONST void *optval,Ip_socklen_t optlen);
IP_PUBLIC int ipfirewall_http_match(Ipcom_pkt *pkt, void *cookie, void *info);
IP_PUBLIC int ipfirewall_http_check(void *cookie, void *info, unsigned int infolen);
IP_PUBLIC void ipfirewall_http_destroy(void *cookie, void *info, unsigned int infolen);


/*******************************************************************************
*
* ipfirewall_enable - enable firewall
*
* The 'ipfirewall_enable()' routine enables the firewall. When enabled, each
* incoming and outgoing packet is matched against the current ruleset.
*
* RETURNS: \is
* \i 'IPCOM_SUCCESS' or one of the following errors:
* \i 'IPCOM_ERR_ALREADY_OPEN'
* Firewall was already enabled.
* \i 'IPCOM_ERR_FAILED'
* Failed to enable the firewall.
* \i 'IPCOM_ERR_NO_MEMORY'
* Out of memory.
* \ie
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_enable(void);


/*******************************************************************************
*
* ipfirewall_disable - disable firewall
*
* The ipfirewall_disable() routine disables the firewall. When disabled, packet
* matching against the current ruleset is skipped.
*
* RETURNS: \is
* \i 'IPCOM_SUCCESS' or one of the following errors:
* \i 'IPCOM_ERR_ALREADY_CLOSED'
* Firewall was already disabled.
* \i 'IPCOM_ERR_FAILED'
* Failed to disable the firewall.
* \i 'IPCOM_ERR_NO_MEMORY'
* Out of memory.
* \ie
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_disable(void);


/*******************************************************************************
*
* ipfirewall_add_rule - add an IP filter rule
*
* The ipfirewall_add_rule() routine adds an IP filter rule to the current
* ruleset.
*
* Parameters:
* \is
* \i <family>
* The Internet address family that the IP filter rule applies to.
* Set to IP_AF_INET or IP_AF_INET6.
* \i <rule>
* The rule to add.
* \ie
*
* RETURNS: \is
* \i 'IPCOM_SUCCESS' or one of the following errors:
* \i 'IPCOM_ERR_FAILED'
* Failed to add the rule.
* \i 'IPCOM_ERR_NO_MEMORY'
* Out of memory.
* \ie
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_add_rule
(
    Ip_s32 family,
    const char *rule
);


/*******************************************************************************
*
* ipfirewall_remove_rule - remove an IP filter rule
*
* The ipfirewall_remove_rule() routine removes an IP filer rule from the current
* ruleset
*
* Parameters:
* \is
* \i <family>
* The Internet address family that the IP filter rule applies to.
* Set to IP_AF_INET or IP_AF_INET6.
* \i <rule>
* The rule to remove.
* \ie
*
* RETURNS: \is
* \i 'IPCOM_SUCCESS' or one of the following errors:
* \i 'IPCOM_ERR_FAILED'
* Failed to add the rule.
* \i 'IPCOM_ERR_NO_MEMORY'
* Out of memory.
* \ie
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_remove_rule
(
    Ip_s32 family,
    const char *rule
);


/*******************************************************************************
*
* ipfirewall_flush_rules - remove all IP filter rules
*
* The ipfirewall_flush_rules() routine flushes all IP filter rules in the
* current ruleset.
*
* RETURNS: \is
* \i 'IPCOM_SUCCESS' or the following error:
* \i 'IPCOM_ERR_FAILED'
* Failed to flush rules.
* \ie
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_flush_rules(void);


/*******************************************************************************
*
* ipfirewall_flush_group - remove all rules in a group
*
* This routine removes all rules in the current <group>.
*
* Parameter:
* \is
* \i <group>
* The group to flush rules in.
* \ie
*
* RETURNS: 'IPCOM_SUCCESS', or the following error:
* \is
* \i 'IPCOM_ERR_FAILED'
* Failed to flush rules in the <group>.
* \ie
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_flush_group
(
    Ip_s32 group
);


/*******************************************************************************
*
* ipfirewall_flush_states - remove all active states
*
* The ipfirewall_flush_states() routine removes all active states added by
* stateful IP filter rules.
*
* RETURNS: \is
* \i 'IPCOM_SUCCESS' or the following error:
* \i 'IPCOM_ERR_FAILED'
* Failed to flush states.
* \ie
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_flush_states(void);


/*******************************************************************************
*
* ipfirewall_flush_log - remove all entries in the IP filter log
*
* The ipfirewall_flush_log() routine removes all entries in the IP filter log.
*
* RETURNS: \is
* \i 'IPCOM_SUCCESS' or the following error:
* \i 'IPCOM_ERR_FAILED'
* Failed to flush log.
* \ie
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_flush_log(void);


/*******************************************************************************
*
* ipfirewall_mac_add_rule - add a MAC filter rule
*
* The ipfirewall_mac_add_rule() routine adds a MAC filter rule to the current
* ruleset
*
* Parameters:
* \is
* \i <rule>
* The rule to add.
* \ie
*
* RETURNS: \is
* \i 'IPCOM_SUCCESS' or one of the following errors:
* \i 'IPCOM_ERR_FAILED'
* Failed to add the rule.
* \i 'IPCOM_ERR_NO_MEMORY'
* Out of memory.
* \ie
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_mac_add_rule
(
    const char *rule
);


/*******************************************************************************
*
* ipfirewall_mac_remove_rule - remove a MAC filter rule
*
* The ipfirewall_mac_remove_rule() routine removes a MAC filer rule from the
* current ruleset
*
* Parameters:
* \is
* \i <rule>
* The rule to remmove.
* \ie
*
* RETURNS: \is
* \i 'IPCOM_SUCCESS' or one of the following errors:
* \i 'IPCOM_ERR_FAILED'
* Failed to add the rule.
* \i 'IPCOM_ERR_NO_MEMORY'
* Out of memory.
* \ie
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_mac_remove_rule
(
    const char *rule
);


/*******************************************************************************
*
* ipfirewall_mac_flush_rules - remove all MAC filter rules
*
* The ipfirewall_mac_flush_rules() routine removes all MAC filter rules in the
* current ruleset.
*
* RETURNS: \is
* \i 'IPCOM_SUCCESS' or the following error:
* \i 'IPCOM_ERR_FAILED'
* Failed to flush rules.
* \ie
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_mac_flush_rules(void);



/*******************************************************************************
*
* ipfirewall_mac_flush_group - remove all MAC filter rules in a group
*
* The ipfirewall_mac_flush_rules() routine removes all MAC filter rules in a
* specified group.
*
* Parameter:
* \is
* \i <group>
* The group from which the MAC filter rules are to be removed.
* \ie
*
* RETURNS: \is
* \i 'IPCOM_SUCCESS' or the following error:
* \i 'IPCOM_ERR_FAILED'
* Failed to flush rules in the group
* \ie
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_mac_flush_group
(
    Ip_s32 group
);


/*******************************************************************************
*
* ipfirewall_mac_flush_log - remove all entries in the MAC filter log
*
* The ipfirewall_mac_flush_log() routine removes all entries in the MAC filter
* log.
*
* RETURNS: \is
* \i 'IPCOM_SUCCESS' or the following error:
* \i 'IPCOM_ERR_FAILED'
* Failed to flush log.
* \ie
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_mac_flush_log(void);


/*******************************************************************************
*
* ipfirewall_flush_userdefs - remove all user-defined routines
*
* The ipfirewall_flush_userdefs() routine removes all registered user-defined
* routines.
*
* RETURNS: \is
* \i 'IPCOM_SUCCESS' or the following error:
* \i 'IPCOM_ERR_FAILED'
* Failed to flush user-defined routines.
* \ie
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_flush_userdefs(void);


/*******************************************************************************
*
* ipfirewall_register_userdef - register a user-defined function
*
* This routine registers a user-defined function for use with the <userdef> rule
* parameter. Before a user-defined function can be specified in a rule it must
* be registered with this routine.
*
* Parameters:
* \is
* \i <id>
* An identifier for the user-defined function.
* \i <match>
* A pointer to a user-defined match routine.
* \i <check>
* A pointer to a user-defined check routine (optional).
* \i <destroy>
* A pointer to a user-defined destroy routine (optional).
* \i <cookie>
* A cookie that will be supplied in the calls to the user-defined function's
* match, destroy and check routines.
* \ie
*
* RETURNS: Either 'IPCOM_SUCCESS' or an error code (see 'ipcom_err.h').
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_register_userdef
(
    IP_CONST char *id,
    Ipfirewall_userdef_match match,
    Ipfirewall_userdef_check check,
    Ipfirewall_userdef_destroy destroy,
    void *cookie
);


/*******************************************************************************
*
* ipfirewall_unregister_userdef - deregister a user-defined function
*
* This routine deregisters a user-defined routine.
*
* Parameter:
* \is
* \i <id>
* Identifier of the user-defined function.
* \ie
*
* RETURNS: Either 'IPCOM_SUCCESS' or an error code (see 'ipcom_err.h').
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_unregister_userdef
(
    IP_CONST char *id
);


/*******************************************************************************
*
* ipfirewall_http_add_filter - add an HTTP filter
*
* This routine adds an HTTP filter.
*
* Parameter:
* \is
* \i <id>
* The ID of the HTTP filter to add.
* \ie
*
* RETURNS: Either 'IPCOM_SUCCESS' or an error code (see 'ipcom_err.h').
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_http_add_filter
(
    const char *id
);

/*******************************************************************************
*
* ipfirewall_http_remove_filter - remove an HTTP filter
*
* This routine removes an HTTP filter, if there is no IP filter rule that refers
* to the filter. It fails if there is. To remove an IP filter rule, use
* ipfirewall_remove_rule().
*
* Parameter:
* \is
* \i <id>
* The ID of the HTTP filter to remove.
* \ie
*
* RETURNS: Either 'IPCOM_SUCCESS' or an error code (see 'ipcom_err.h').
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_http_remove_filter
(
    const char *id
);


/*******************************************************************************
*
* ipfirewall_http_insert_url_filter - add a URL or keyword to an HTTP filter
*
* This routine adds a URL or keyword to an HTTP filter.
*
* Parameters:
* \is
* \i <id>
* The ID of the HTTP filter.
* \i <url>
* The URL path or keyword.
* \i <keyword>
* Set to 'IP_TRUE' for keyword.
* \ie
*
* RETURNS: Either 'IPCOM_SUCCESS' or an error code (see 'ipcom_err.h').
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_http_insert_url_filter
(
    const char *id,
    const char *url,
    Ip_bool keyword
);


/*******************************************************************************
*
* ipfirewall_http_insert_proxy_filter - set proxy filter in an HTTP filter
*
* This routine inserts the proxy filter into an HTTP filter.
*
* Parameter:
* \is
* \i <id>
* The ID of the HTTP filter.
* \ie
*
* RETURNS: Either 'IPCOM_SUCCESS' or an error code (see 'ipcom_err.h').
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_http_insert_proxy_filter
(
    const char *id
);


/*******************************************************************************
*
* ipfirewall_http_insert_cookie_filter - set cookie filter in an HTTP filter
*
* This routine inserts the cookie filter into an HTTP filter.
*
* Parameter:
* \is
* \i <id>
* The ID of the HTTP filter.
* \ie
*
* RETURNS: Either 'IPCOM_SUCCESS' or an error code (see 'ipcom_err.h').
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_http_insert_cookie_filter
(
    const char *id
);


/*******************************************************************************
*
* ipfirewall_http_insert_java_filter - set Java filter in an HTTP filter
*
* This routine inserts the java filter into an HTTP filter.
*
* Parameter:
* \is
* \i <id>
* The ID of the HTTP filter.
* \ie
*
* RETURNS: Either 'IPCOM_SUCCESS' or an error code (see 'ipcom_err.h').
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_http_insert_java_filter
(
    const char *id
);


/*******************************************************************************
*
* ipfirewall_http_insert_activex_filter - set ActiveX filter in an HTTP filter
*
* This routine inserts the ActiveX filter into an HTTP filter.
*
* Parameters
* \is
* \i <id>
* The ID of the HTTP filter.
* \ie
*
* RETURNS: Either 'IPCOM_SUCCESS' or an error code (see 'ipcom_err.h').
*
* ERRNO:
*/
IP_PUBLIC Ip_err ipfirewall_http_insert_activex_filter
(
    const char *id
);


#ifdef __cplusplus
}
#endif

#endif


/*
 ****************************************************************************
 *                      END OF FILE
 ****************************************************************************
 */