/* ****************************************************************************** * INTERPEAK INTERNAL API HEADER FILE * * Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipfirewall_h.h,v $ $Revision: 1.67.10.5 $ * $Source: /home/interpeak/CVSRoot/ipfirewall/src/ipfirewall_h.h,v $ * $Author: hxu0 $ $Date: 2013-12-03 06:40:10 $ * $State: Exp $ $Locker: $ * * INTERPEAK_COPYRIGHT_STRING * Design and implementation by Markus Carlstedt ****************************************************************************** */ #ifndef IPFIREWALL_H_H #define IPFIREWALL_H_H /* **************************************************************************** * 1 DESCRIPTION **************************************************************************** * Internal header file. */ /* **************************************************************************** * 2 CONFIGURATION **************************************************************************** */ #ifdef IPFIREWALL #include "ipfirewall_config.h" #endif /* **************************************************************************** * 3 INCLUDE FILES **************************************************************************** */ #ifdef IPFIREWALL #include #include #include #include #include #include #include #endif #if defined(IPNET) #include "ipnet_h.h" #include "ipnet_eth.h" #ifdef IPCOM_USE_INET6 #include "ipnet_icmp6.h" #endif #elif defined(IPLITE) #include "iplite_h.h" #endif #ifdef IPFIREWALL_C #ifdef IPTCP #include "iptcp.h" #include "iptcp_h.h" #endif #endif #ifdef __cplusplus extern "C" { #endif /* **************************************************************************** * 4 DEFINES **************************************************************************** */ /* *=========================================================================== * SYSLOG_FACILITY *=========================================================================== */ #ifdef IPFIREWALL_C #ifdef IPCOM_SYSLOG_FACILITY #undef IPCOM_SYSLOG_FACILITY #endif #define IPCOM_SYSLOG_FACILITY IPCOM_LOG_IPFIREWALL #endif /* #ifdef IPFIREWALL_C */ /* *=========================================================================== * SYSLOG_PRIORITY *=========================================================================== */ #ifdef IPFIREWALL_C #ifdef IPCOM_SYSLOG_PRIORITY #undef IPCOM_SYSLOG_PRIORITY #endif #ifdef IP_DEBUG #define IPCOM_SYSLOG_PRIORITY IPCOM_LOG_DEBUG #else #define IPCOM_SYSLOG_PRIORITY IPCOM_LOG_WARNING #endif #endif /* #ifdef IPFIREWALL_C */ /* *=========================================================================== * ICMPv4 types and codes *=========================================================================== */ #define IPFIREWALL_ICMPV4_TYPE_DST_UNREACH 3 #define IPFIREWALL_ICMPV4_CODE_DST_UNREACH_NET 0 /* *=========================================================================== * ICMPv6 types and codes *=========================================================================== */ #define IPFIREWALL_ICMPV6_TYPE_DST_UNREACH 1 #define IPFIREWALL_ICMPV6_CODE_DST_UNREACH_NOROUTE 0 /* *=========================================================================== * MAC filter address length *=========================================================================== */ #define IPFIREWALL_MAC_ADDRESS_LEN 6 /* *=========================================================================== * MAC filter header length *=========================================================================== */ #define IPFIREWALL_MAC_HEADER_LEN 14 /* *=========================================================================== * LLC filter header length *=========================================================================== */ #define IPFIREWALL_LLC_HEADER_LEN 3 /* *=========================================================================== * SNAP filter vendor length *=========================================================================== */ #define IPFIREWALL_SNAP_VENDOR_LEN 3 /* *=========================================================================== * MAC 802.3 max frame length *=========================================================================== */ #define IPFIREWALL_MAC_802_3_MAX_LEN 1522 /* *=========================================================================== * IPFIREWALL_MAX_IP_LOG_ENTRIES *=========================================================================== * */ #define IPFIREWALL_MAX_IP_LOG_ENTRIES 100 /* *=========================================================================== * IPFIREWALL_MAX_MAC_LOG_ENTRIES *=========================================================================== * */ #define IPFIREWALL_MAX_MAC_LOG_ENTRIES 100 /* *=========================================================================== * IPFIREWALL_MAX_RULES *=========================================================================== * */ #define IPFIREWALL_MAX_IP_RULES 100 /* *=========================================================================== * IPFIREWALL_MAC_MAX_RULES *=========================================================================== * */ #define IPFIREWALL_MAX_MAC_RULES 100 /* *=========================================================================== * Rule "port" keyword operators *=========================================================================== */ #define IPFIREWALL_OP_EQ 0 #define IPFIREWALL_OP_NE 1 #define IPFIREWALL_OP_LT 2 #define IPFIREWALL_OP_GT 3 #define IPFIREWALL_OP_LE 4 #define IPFIREWALL_OP_GE 5 #define IPFIREWALL_OP_OUTRANGE 6 #define IPFIREWALL_OP_INRANGE 7 /* *=========================================================================== * Rule "keep state" keyword operators *=========================================================================== */ #define KEEP_STATE 1 #define KEEP_IFSTATE 2 #define KEEP_STATE_LIMITED 4 #define KEEP_IPSECSTATE 8 /* *=========================================================================== * TCP flags *=========================================================================== */ #define IPFIREWALL_TCPFLAG_URGENT 0x0020 #define IPFIREWALL_TCPFLAG_ACK 0x0010 #define IPFIREWALL_TCPFLAG_PUSH 0x0008 #define IPFIREWALL_TCPFLAG_RESET 0x0004 #define IPFIREWALL_TCPFLAG_SYN 0x0002 #define IPFIREWALL_TCPFLAG_FIN 0x0001 /* *=========================================================================== * IPFIREWALL_CTRL_XXX *=========================================================================== * Defines the available firewall control commands used to pass data to and * from the the firewall kernel. * */ #define IPFIREWALL_CTRL_ENABLE 0 #define IPFIREWALL_CTRL_DISABLE 1 #define IPFIREWALL_CTRL_ADD_RULE 2 #define IPFIREWALL_CTRL_DEL_RULE 3 #define IPFIREWALL_CTRL_FLUSH_RULES 4 #define IPFIREWALL_CTRL_GET_RULE_INPUT 5 #define IPFIREWALL_CTRL_GET_RULE_OUTPUT 6 #define IPFIREWALL_CTRL_GET_INFO 7 #define IPFIREWALL_CTRL_CLEAR_STATS 8 #define IPFIREWALL_CTRL_FLUSH_STATES 9 #define IPFIREWALL_CTRL_GET_STATE 10 #define IPFIREWALL_CTRL_FLUSH_LOG 11 #define IPFIREWALL_CTRL_GET_LOG 12 #define IPFIREWALL_CTRL_FLUSH_USERDEFS 13 #define IPFIREWALL_CTRL_GET_USERDEF 14 #define IPFIREWALL_CTRL_FLUSH_GROUP 15 /* MAC filter codes */ #define IPFIREWALL_CTRL_ADD_MAC_RULE 16 #define IPFIREWALL_CTRL_DEL_MAC_RULE 17 #define IPFIREWALL_CTRL_GET_MAC_RULE_INPUT 18 #define IPFIREWALL_CTRL_GET_MAC_RULE_OUTPUT 19 #define IPFIREWALL_CTRL_FLUSH_MAC_GROUP 20 #define IPFIREWALL_CTRL_FLUSH_MAC_RULES 21 #define IPFIREWALL_CTRL_FLUSH_MAC_LOG 22 #define IPFIREWALL_CTRL_GET_MAC_LOG 23 /* *=========================================================================== * IPFIREWALL_MAX_RULE_ARGS *=========================================================================== * Defines the maximum number of arguments in a firewall rule string * */ #define IPFIREWALL_MAX_RULE_ARGS 16 /* *=========================================================================== * IPFIREWALL_MS_PER_SEC/MIN/HOUR/DAY *=========================================================================== * */ #define IPFIREWALL_MS_PER_SEC 1000 #define IPFIREWALL_MS_PER_MIN 60000 #define IPFIREWALL_MS_PER_HOUR 3600000 #define IPFIREWALL_MS_PER_DAY 86400000 /* *=========================================================================== * IPFIREWALL_ADDR_TYPE_NOT_LOCAL *=========================================================================== * */ #ifdef IPNET #define IPFIREWALL_ADDR_TYPE_NOT_LOCAL IPNET_ADDR_TYPE_NOT_LOCAL #elif defined(IPLITE) #define IPFIREWALL_ADDR_TYPE_NOT_LOCAL IPLITE_ADDR_TYPE_NOT_LOCAL #endif /* *=========================================================================== * IPFIREWALL_TIMEOUT_SCHEDULE / CANCEL *=========================================================================== * */ #ifdef IPNET #define IPFIREWALL_TIMEOUT_SCHEDULE(msec, handler, cookie, tmo_p) \ ipnet_timeout_schedule(msec, (Ipnet_timeout_handler) handler, cookie, tmo_p) #define IPFIREWALL_TIMEOUT_CANCEL(tmo) ipnet_timeout_cancel(tmo) #define IPFIREWALL_TIMEOUT_UNTIL(tmo) (ipnet_timeout_msec_until(tmo)/1000) #ifdef IPCOM_USE_INET #define IPFIREWALL_IPV4_GET_ADDR_TYPE(addr, vrindex, netif) ipnet_ip4_get_addr_type(addr, vrindex, (Ipnet_netif *)netif) #endif #ifdef IPCOM_USE_INET6 #define IPFIREWALL_IPV6_GET_ADDR_TYPE(addr, vrindex, netif) ipnet_ip6_get_addr_type(addr, vrindex, (Ipnet_netif *)netif) #endif #elif defined(IPLITE) #define IPFIREWALL_TIMEOUT_SCHEDULE(msec, handler, cookie, tmo_p) \ iplite_timeout_schedule(msec, (Iplite_timeout_handler) handler, cookie, tmo_p) #define IPFIREWALL_TIMEOUT_CANCEL(tmo) iplite_timeout_cancel(tmo) #define IPFIREWALL_TIMEOUT_UNTIL(tmo) (iplite_timeout_msec_until(tmo)/1000) #ifdef IPCOM_USE_INET #define IPFIREWALL_IP4_GET_ADDR_TYPE(addr, vrindex, netif) iplite_ip4_get_addr_type((Iplite_netif *)netif, *addr) #endif #ifdef IPCOM_USE_INET6 #define IPFIREWALL_IP6_GET_ADDR_TYPE(addr, vrindex, netif) iplite_ip6_get_addr_type((Iplite_netif *)netif, (struct Ip_in6_addr *)addr) #endif #endif /* *=========================================================================== * IPFIREWALL_IF_NAMETONETIF *=========================================================================== * */ #ifdef IPNET #define IPFIREWALL_IF_NAMETONETIF(ifname) (Ipcom_netif *)ipnet_if_nametonetif(ipnet_get_effective_vr(), ifname) #elif defined(IPLITE) #define IPFIREWALL_IF_NAMETONETIF(ifname) (Ipcom_netif *)iplite_if_nametonetif(ifname) #endif /* *=========================================================================== * IPFIREWALL_TEST_INTERFACE *=========================================================================== * Test interface against rule */ #define IPFIREWALL_TEST_INTERFACE(not, ruleif, pktif) \ { \ if (ruleif == pktif) \ { \ if (not) \ continue; \ } \ else if (!not) \ continue; \ } \ /* *=========================================================================== * IPFIREWALL_TEST_SAP *=========================================================================== * Test 802.3 sap against rule */ #define IPFIREWALL_TEST_SAP(not, rulesap, pktsap) \ { \ if (rulesap == pktsap) \ { \ if (not) \ continue; \ } \ else if (!not) \ continue; \ } \ /* *=========================================================================== * IPFIREWALL_TEST_SNAP *=========================================================================== * Test 802.2 snap against rule */ #define IPFIREWALL_TEST_SNAP(not, rulesnap, pktsnap) \ { \ if (rulesnap == pktsnap) \ { \ if (not) \ continue; \ } \ else if (!not) \ continue; \ } \ /* *=========================================================================== * IPFIREWALL_TEST_SNAP_VENDOR *=========================================================================== * Test 802.2 snap against rule */ #define IPFIREWALL_TEST_SNAP_VENDOR(not, rulevendor, pktvendor) \ { \ if (((Ip_u8 *)rulevendor)[0] == (((Ip_u8 *)pktvendor)[0]) && \ ((Ip_u8 *)rulevendor)[1] == (((Ip_u8 *)pktvendor)[1]) && \ ((Ip_u8 *)rulevendor)[2] == (((Ip_u8 *)pktvendor)[2])) \ { \ if (not) \ continue; \ } \ else if (!not) \ continue; \ } \ /* **************************************************************************** * 5 TYPES **************************************************************************** */ /* *=========================================================================== * Ipfirewall_stats *=========================================================================== */ typedef struct Ipfirewall_stats_struct { #ifdef IPFIREWALL_USE_IP_FILTER Ip_u32 in_block; Ip_u32 in_pass; Ip_u32 in_nomatch; Ip_u32 out_block; Ip_u32 out_pass; Ip_u32 out_nomatch; Ip_u32 invalid; Ip_u32 in_logged_block; Ip_u32 in_logged_pass; Ip_u32 out_logged_block; Ip_u32 out_logged_pass; Ip_u32 log_failures; Ip_u32 states_added; Ip_u32 states_expired; Ip_u32 state_hits; Ip_u32 state_failures; #endif #ifdef IPFIREWALL_USE_MAC_FILTER Ip_u32 mac_in_block; Ip_u32 mac_in_pass; Ip_u32 mac_in_nomatch; Ip_u32 mac_out_block; Ip_u32 mac_out_pass; Ip_u32 mac_out_nomatch; Ip_u32 mac_invalid; Ip_u32 mac_in_logged_block; Ip_u32 mac_in_logged_pass; Ip_u32 mac_out_logged_block; Ip_u32 mac_out_logged_pass; Ip_u32 mac_log_failures; #endif } Ipfirewall_stats; /* *=========================================================================== * Ipfirewall_configuration *=========================================================================== */ typedef struct Ipfirewall_configuration_struct { Ip_s32 timeout_icmp; /* icmp timeout */ Ip_s32 timeout_udp; /* udp timeout */ Ip_s32 timeout_tcp; /* tcp timeout */ Ip_s32 timeout_other; /* tcp other */ Ip_s32 max_states; /* max number of state entries */ } Ipfirewall_config; /* *=========================================================================== * Ipfirewall_data_inner *=========================================================================== */ struct Ipfirewall_data_inner { Ip_bool enabled; /* Enabled */ #ifdef IPFIREWALL_USE_IP_FILTER Ip_u32 num_head_rules; Ip_u32 num_out_rules; Ip_u32 num_in_rules; Ip_u32 num_states; #endif /* #ifdef IPFIREWALL_USE_IP_FILTER */ #ifdef IPFIREWALL_USE_MAC_FILTER Ip_u32 mac_num_head_rules; Ip_u32 mac_num_out_rules; Ip_u32 mac_num_in_rules; #endif /* #ifdef IPFIREWALL_USE_MAC_FILTER */ Ipfirewall_stats stats; /* Statistics */ Ipfirewall_config config; /* Configuration */ #ifdef IPNET Ipnet_timeout *tmo; /* Timeout handle */ #elif defined(IPLITE) Iplite_timeout *tmo; /* Timeout handle */ #endif Ip_u32 sec_count; /* Seconds counter */ }; /* *=========================================================================== * Ipfirewall_data *=========================================================================== */ typedef struct Ipfirewall_data_struct { #ifdef IPFIREWALL_USE_IP_FILTER Ipcom_list head_rule_input; /* Rule list input */ Ipcom_list head_rule_output; /* Rule list output*/ Ipcom_list head_state; /* State list */ Ipcom_list head_log; /* Log list */ #ifdef IPFIREWALL_USE_IP_STATEFUL #ifdef IPCOM_USE_INET Ipcom_hash *hash_v4; /* Hash table for v4 state entries */ #endif #ifdef IPCOM_USE_INET6 Ipcom_hash *hash_v6; /* Hash table for v6 state entries */ #endif #endif /* #ifdef IPFIREWALL_USE_IP_STATEFUL */ #endif /* #ifdef IPFIREWALL_USE_IP_FILTER */ #ifdef IPFIREWALL_USE_MAC_FILTER Ipcom_list mac_head_rule_input; /* Rule list */ Ipcom_list mac_head_rule_output;/* Rule list */ Ipcom_list mac_head_log; /* Log list */ #endif /* #ifdef IPFIREWALL_USE_MAC_FILTER */ #ifdef IPFIREWALL_USE_USERDEF Ipcom_list head_user; /* User defined list */ #endif struct Ipfirewall_data_inner inner; } Ipfirewall_data; /* *=========================================================================== * Ipfirewall_addr *=========================================================================== */ typedef struct Ipfirewall_addr_struct { union { #ifdef IPCOM_USE_INET Ip_u32 v4; /* Network endian */ #endif #ifdef IPCOM_USE_INET6 Ip_u32 v6[4]; /* Network endian */ #endif } addr; union { #ifdef IPCOM_USE_INET Ip_u32 v4; /* Network endian */ #endif #ifdef IPCOM_USE_INET6 Ip_u32 v6[4]; /* Network endian */ #endif } mask; } Ipfirewall_addr; /* *=========================================================================== * Ipfirewall_rule_inner *=========================================================================== */ struct Ipfirewall_rule_inner { int group_no; /* Group number */ /* 20 */ #ifdef IPFIREWALL_USE_IP_FILTER Ipfirewall_addr src; /* source address and mask */ /* 28 */ #endif Ip_u8 in; /* direction: incoming or outgoing */ Ip_u8 family; /* IP_AF_INET or IP_AF_INET6 */ Ip_u8 on; /* "on" (optional) */ #ifdef IPFIREWALL_PHYSICAL_IF_SUPPORT Ip_u8 on_phys; /* "on if phys if (optional) "*/ #endif Ip_u8 proto; /* "proto"(optional) */ /* 29 */ Ip_u8 from; /* "from" (optional) */ Ip_u8 src_me; /* 'me' source address */ Ip_u8 src_not; /* NOT source address */ Ip_u8 src_any; /* any source address */ /* 30 */ Ip_u8 group_head; /* TRUE if head of group */ Ip_u8 dst_me; /* 'me' destination address */ Ip_u8 dst_not; /* NOT destination address */ Ip_u8 dst_any; /* any destination address */ /* 31 */ Ip_u8 tos; /* "tos"(optional) */ Ip_u8 ttl; /* "ttl" (optional) */ Ip_u8 mac_type; /* MAC frame type (optional) */ Ip_u8 log; /* "log" (optional) */ /* 32 */ Ip_u8 on_not; /* "on !" (optional) */ Ip_u8 to; /* "to" (optional) */ Ip_u8 quick; /* "quick" (optional) */ Ip_u8 block; /* action: block or pass */ #ifdef IPFIREWALL_USE_IP_FILTER Ip_u8 ipopt; /* "ipopts" (optional) */ Ip_u8 frag; /* "frag" (optional) */ Ip_u8 flags; /* "flags" (optional) */ Ip_u8 keep_state; /* "keep state" (optional) */ Ip_u8 with; /* "with" (optional) */ Ip_u8 with_no; /* "with no" (optional) */ Ip_u8 r_rst; /* "return-rst" (optional) */ Ip_u8 r_icmp; /* "return-icmp" (optional) */ Ip_u8 icmp_type; /* "icmp-type" (optional) */ Ip_u8 icmp_code; /* "code" (optional) */ Ip_u8 src_port; /* "port" (optional) */ Ip_u8 dst_port; /* "port" (optional) */ Ipfirewall_addr dst; /* destination address and mask */ #endif /* #ifdef IPFIREWALL_USE_IP_FILTER */ Ip_u8 ifname[IP_IFNAMSIZ]; /* interface name */ #ifdef IPFIREWALL_PHYSICAL_IF_SUPPORT Ip_u8 phys_ifname[IP_IFNAMSIZ]; /* physical interface name */ #endif Ip_u8 userdef; /* userdef */ Ip_u8 limit; /* limit */ Ip_u16 the_mac_type_n; /* MAC frame type value (network endian) */ Ip_u8 frame_802_2; /* MAC frame is an 802.3 frame type */ Ip_u8 dsap; /* 802.3 dsap */ Ip_u8 dsap_not; /* Invert dsap rule */ Ip_u8 the_dsap_n; /* The dsap value */ Ip_u8 ssap; /* 802.3 ssap */ Ip_u8 ssap_not; /* Invert ssap rule */ Ip_u8 the_ssap_n; /* The ssap value */ Ip_u8 snap_vendor; /* The SNAP vendor code */ Ip_u8 snap_vendor_not; /* Invert SNAP vendor rule */ Ip_u8 the_snap_vendor_n[IPFIREWALL_SNAP_VENDOR_LEN]; /* The SNAP vendor value (network endian) */ Ip_u8 snap_type; /* 802.3 snap type */ Ip_u8 snap_type_not; /* Invert snap type rule */ Ip_u16 the_snap_type_n; /* The SNAP value (network endian) */ Ip_u8 tcpudp; /* "tcp/udp" */ Ip_u8 protocol; /* protocol number */ Ip_u8 spare; Ip_u8 log_first; /* "first" (optional) */ Ip_u8 icmp_num; /* icmp type */ Ip_u8 code; /* icmp code */ Ip_u8 r_icmp_as_dest; /* "return-icmp-as-dest" (optional) */ Ip_u8 r_icmp_c; /* "return-icmp" code */ Ip_u8 mac; /* A MAC filter rule */ Ip_u8 limit_not; /* invert limit rule */ Ip_u8 limit_period; /* limit period */ Ip_u8 ttl_val; /* ttl value */ Ip_u8 src_op; /* source port operator */ Ip_u8 dst_op; /* destination port operator */ Ip_u8 tos_mask; /* tos mask */ Ip_u8 tos_val; /* tos value */ Ip_u16 src_port_lo; /* port low limit in case of '<>' or '><' operator */ Ip_u16 src_port_hi; /* port number or port high limit in case of '<>' or '><' operator */ Ip_u16 dst_port_lo; /* port low limit in case of '<>' or '><' operator */ Ip_u16 dst_port_hi; /* port number or port high limit in case of '<>' or '><' operator */ Ip_u16 tcp_flags; /* tcp flags */ Ip_u16 tcp_mask; /* tcp flags mask */ Ip_u32 pflags; /* "pflags" (optional) */ Ip_u32 pktflags; Ip_u32 pktflags_mask; Ip_u32 limit_num; /* limit number */ Ip_u32 burst_num; /* burst number */ #ifdef IPFIREWALL_USE_MAC_FILTER Ip_u8 mac_dst[IPFIREWALL_MAC_ADDRESS_LEN]; /* MAC destination address */ Ip_u8 mac_dst_mask[IPFIREWALL_MAC_ADDRESS_LEN]; /* MAC destination mask */ Ip_u8 mac_src[IPFIREWALL_MAC_ADDRESS_LEN]; /* MAC source address */ Ip_u8 mac_src_mask[IPFIREWALL_MAC_ADDRESS_LEN]; /* MAC source mask */ #endif /* #ifdef IPFIREWALL_USE_MAC_FILTER */ #ifdef IPFIREWALL_USE_USERDEF Ip_u8 userdef_id[IPFIREWALL_USERDEF_ID_SIZE]; /* user defined function id */ char userdef_param[IPFIREWALL_USERDEF_PARAM_SIZE]; /* user defined function parameter */ #endif /* Keep this the last before the non-fixed */ int align_adjust; /* Alignment adjustment */ /* Non-fixed members... */ Ip_u32 ifindex; /* Interface index */ #ifdef IPFIREWALL_PHYSICAL_IF_SUPPORT Ip_u32 physical_ifindex; /* Interface index */ #endif int rule_no; /* Rule number in this group */ Ip_u16 log_hit; /* Log hit */ Ip_u16 limit_first; /* Boolean */ Ip_u32 limit_level; /* Current bucket level */ Ip_u32 limit_ms; /* Timeout is millisec */ }; /* *=========================================================================== * Ipfirewall_rule *=========================================================================== */ typedef struct Ipfirewall_rule_struct { Ipcom_list list_rule; /* List (must be first) */ /* 16 */ struct Ipfirewall_rule_inner inner; #ifdef IPNET Ipnet_timeout *limit_tmo; /* Timeout handle */ #elif defined(IPLITE) Iplite_timeout *limit_tmo; /* Timeout handle */ #endif #ifdef IPFIREWALL_USE_USERDEF Ipfirewall_userdef_match user_match; /* User defined match function */ Ipfirewall_userdef_check user_check; /* User defined check function */ Ipfirewall_userdef_destroy user_destroy; /* User defined destroy function */ void *userdef_cookie; /* User defined function cookie */ void *userdef_info; /* User defined info */ unsigned int userdef_info_size; /* User defined info length */ #endif /* #ifdef IPFIREWALL_USE_USERDEF */ } Ipfirewall_rule; /* *=========================================================================== * Ipfirewall_packet *=========================================================================== */ typedef struct Ipfirewall_packet_struct { Ip_u8 version; Ip_u32 ifindex; Ip_u8 protocol; Ip_u8 is_frag; Ip_u8 first_frag; union network { #ifdef IPCOM_USE_INET Ipcom_ip_header *ip4; #endif #ifdef IPCOM_USE_INET6 Ipcom_ip6_header *ip6; #endif } net; union transport { Ipcom_icmp_header *icmp; Ipcom_udp_header *udp; Ipcom_tcp_header *tcp; } tsp; Ip_u16 hlen; #ifdef IPIPSEC2 Ip_u32 ipsec_addr[4]; /* Ipsec gateway */ #endif } Ipfirewall_packet; /* *=========================================================================== * Ipfirewall_log_inner *=========================================================================== */ struct Ipfirewall_log_inner { Ip_s32 tv_sec; /* Time when packet was sent/received */ Ip_s32 tv_usec; Ip_u8 ifname[IP_IFNAMSIZ]; /* Interface name */ int group_no; /* Group number that matched */ int rule_no; /* Rule number that matched */ Ip_u8 version; /* IP_AF_INET or IP_AF_INET6 */ Ip_u8 protocol; /* IP protocol */ Ip_u8 is_frag; Ip_u8 first_frag; Ip_u16 h_len; Ip_u16 ip_len; Ip_u16 tcp_flags; Ip_u8 icmp_type; Ip_u8 icmp_code; union { #ifdef IPCOM_USE_INET struct Ip_in_addr addr4; #endif #ifdef IPCOM_USE_INET6 struct Ip_in6_addr addr6; #endif } src_n; union { #ifdef IPCOM_USE_INET struct Ip_in_addr addr4; #endif #ifdef IPCOM_USE_INET6 struct Ip_in6_addr addr6; #endif } dst_n; Ip_u16 src_port_n; Ip_u16 dst_port_n; Ip_u8 block; }; /* *=========================================================================== * Ipfirewall_log *=========================================================================== */ typedef struct Ipfirewall_log_struct { Ipcom_list list_log; struct Ipfirewall_log_inner inner; } Ipfirewall_log; /* *=========================================================================== * Ipfirewall_mac_log_inner *=========================================================================== */ struct Ipfirewall_mac_log_inner { Ip_s32 tv_sec; /* Time when packet was sent/received */ Ip_s32 tv_usec; Ip_u8 ifname[IP_IFNAMSIZ]; /* Interface name */ int group_no; /* Group number that matched */ int rule_no; /* Rule number that matched */ Ip_u8 dst[IPFIREWALL_MAC_ADDRESS_LEN]; /* Destination address */ Ip_u8 src[IPFIREWALL_MAC_ADDRESS_LEN]; /* Source address */ Ip_u16 type_n; /* Frame type */ Ip_s32 length; /* Frame length exclusive header */ Ip_u8 frame[64]; /* Log length */ Ip_u8 block; }; /* *=========================================================================== * Ipfirewall_mac_log *=========================================================================== */ typedef struct Ipfirewall_mac_log_struct { Ipcom_list list_log; struct Ipfirewall_mac_log_inner inner; } Ipfirewall_mac_log; /* *=========================================================================== * Ipfirewall_state_inner *=========================================================================== */ struct Ipfirewall_state_inner { Ip_u32 sec_start; /* Time until timeout */ Ip_u32 sec_tmo; /* Timeout for this state */ int group_no; /* Rule group that generated this entry */ int rule_no; /* Rule number that generated this entry */ Ip_u8 version; /* IP_AF_INET or IP_AF_INET6 */ Ip_u8 protocol; /* IP protocol */ Ip_u8 in; /* 1 = incoming rule. 0 = outgoing rule. */ Ip_u8 estab; /* 1 = tcp session established. */ union { #ifdef IPCOM_USE_INET struct Ip_in_addr addr4; #endif #ifdef IPCOM_USE_INET6 struct Ip_in6_addr addr6; #endif } src_n; union { #ifdef IPCOM_USE_INET struct Ip_in_addr addr4; #endif #ifdef IPCOM_USE_INET6 struct Ip_in6_addr addr6; #endif } dst_n; Ip_u16 src_port_n; Ip_u16 dst_port_n; Ip_u32 ifindex; #ifdef IPIPSEC2 Ip_u32 ipsec_addr[4]; /* Ipsec gateway */ #endif }; /* *=========================================================================== * Ipfirewall_state *=========================================================================== */ typedef struct Ipfirewall_state_struct { Ipcom_list list_state; /* List */ #ifdef IPNET Ipnet_timeout *tmo; /* Timeout handle */ #elif defined(IPLITE) Iplite_timeout *tmo; /* Timeout handle */ #endif void * fr; struct Ipfirewall_state_inner inner; struct Ipfirewall_rule *fw_rule; } Ipfirewall_state; /* *=========================================================================== * Ipfirewall_user_inner *=========================================================================== */ struct Ipfirewall_user_inner { char identifier[IPFIREWALL_USERDEF_ID_SIZE]; /* Identifier */ }; /* *=========================================================================== * Ipfirewall_user *=========================================================================== */ typedef struct Ipfirewall_user_struct { Ipcom_list list_user; /* List */ Ipfirewall_userdef_match match; Ipfirewall_userdef_check check; Ipfirewall_userdef_destroy destroy; void *cookie; struct Ipfirewall_user_inner inner; } Ipfirewall_user; /* *=========================================================================== * Ipfirewall_hash_key_v4 *=========================================================================== */ #ifdef IPCOM_USE_INET typedef struct Ipfirewall_hash_key_v4_struct { Ip_u32 src_n; Ip_u32 dst_n; Ip_u16 src_port_n; Ip_u16 dst_port_n; Ip_u8 protocol; Ip_u32 ifindex; Ip_u32 ipsec_addr[4]; } Ipfirewall_hash_key_v4; #endif /* *=========================================================================== * Ipfirewall_hash_key_v6 *=========================================================================== */ #ifdef IPCOM_USE_INET6 typedef struct Ipfirewall_hash_key_v6_struct { Ip_u32 src_n[4]; Ip_u32 dst_n[4]; Ip_u16 src_port_n; Ip_u16 dst_port_n; Ip_u8 protocol; Ip_u32 ifindex; Ip_u32 ipsec_addr[4]; } Ipfirewall_hash_key_v6; #endif /* *=========================================================================== * Ipfirewall_ctrl *=========================================================================== */ typedef struct Ipfirewall_ctrl_struct { Ip_s32 cmd; /* Control command */ Ip_u32 seqno; /* Optional sequence number */ union { struct Ipfirewall_data_inner info; struct Ipfirewall_rule_inner rule_info; #ifdef IPFIREWALL_USE_USERDEF struct Ipfirewall_user_inner user_info; #endif #ifdef IPFIREWALL_USE_IP_FILTER struct Ipfirewall_state_inner state_info; struct Ipfirewall_log_inner log_info; #endif #ifdef IPFIREWALL_USE_MAC_FILTER struct Ipfirewall_mac_log_inner mac_log_info; #endif } type; /* Optional type */ } Ipfirewall_ctrl; /* **************************************************************************** * 6 FUNCTIONS **************************************************************************** */ IP_EXTERN IP_GLOBAL Ipfirewall_data *ipfirewall; IP_GLOBAL int ipfirewall_cmd_ipfirewall(int argc, char **argv); #if IPCOM_USE_FILE != IPCOM_FILE_NONE IP_GLOBAL Ip_s32 ipfirewall_add_rule_file(Ip_bool mac_rule, Ip_s32 family, char *filename, Ip_bool silent); #endif IP_GLOBAL Ip_s32 ipfirewall_mac_internal_get_rule(Ipfirewall_ctrl *ctrl, Ip_socklen_t *lenp, Ip_bool in); IP_GLOBAL Ip_s32 ipfirewall_mac_internal_get_log(Ipfirewall_ctrl *ctrl, Ip_socklen_t *lenp); IP_GLOBAL Ip_s32 ipfirewall_internal_get_rule(Ipfirewall_ctrl *ctrl, Ip_socklen_t *lenp, Ip_bool in); IP_GLOBAL Ip_s32 ipfirewall_internal_get_log(Ipfirewall_ctrl *ctrl, Ip_socklen_t *lenp); IP_GLOBAL Ip_s32 ipfirewall_internal_get_state(Ipfirewall_ctrl *ctrl, Ip_socklen_t *lenp); IP_GLOBAL Ip_s32 ipfirewall_internal_flush_states(void); IP_GLOBAL Ip_s32 ipfirewall_internal_flush_one_state(Ipfirewall_rule *fw_rule); IP_GLOBAL void ipfirewall_clean_state(Ipfirewall_state *fw_state); #ifdef IPCOM_USE_INET IP_GLOBAL Ip_u32 ipfirewall_obj_hash_v4(Ipfirewall_state *fw_state); IP_GLOBAL Ip_u32 ipfirewall_key_hash_v4(Ipfirewall_hash_key_v4 *fw_key); IP_GLOBAL Ip_bool ipfirewall_cmp_hash_v4(Ipfirewall_state *fw_state, Ipfirewall_hash_key_v4 *fw_key); IP_GLOBAL void ipfirewall_get_frag4_info(Ipcom_ip_header *ip4, Ipcom_pkt *pkt, Ip_u32 mtu, Ip_u8 *is_frag, Ip_u8 *first_frag); #endif #ifdef IPCOM_USE_INET6 IP_GLOBAL Ip_u32 ipfirewall_obj_hash_v6(Ipfirewall_state *fw_state); IP_GLOBAL Ip_u32 ipfirewall_key_hash_v6(Ipfirewall_hash_key_v6 *fw_key); IP_GLOBAL Ip_bool ipfirewall_cmp_hash_v6(Ipfirewall_state *fw_state, Ipfirewall_hash_key_v6 *fw_key); IP_GLOBAL Ip_s32 ipfirewall_get_frag6_info(Ipcom_ip6_header *ip6, Ipcom_pkt *pkt, Ip_u32 mtu, Ip_u8 *is_frag, Ip_u8 *first_frag, Ip_u8 *protocol, Ip_u16 *hlen); #endif IP_GLOBAL Ip_u32 ipfirewall_compare_limit(Ipfirewall_rule *fw_rule); IP_GLOBAL Ip_s32 ipfirewall_match_interface(Ipfirewall_rule *fw_rule, Ipcom_netif *netif); #ifdef __cplusplus } #endif #endif /* **************************************************************************** * END OF FILE **************************************************************************** */