1107 lines
36 KiB
C
1107 lines
36 KiB
C
/*
|
|
******************************************************************************
|
|
* INTERPEAK INTERNAL API HEADER FILE
|
|
*
|
|
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipfirewall_h.h,v $ $Revision: 1.67.10.5 $
|
|
* $Source: /home/interpeak/CVSRoot/ipfirewall/src/ipfirewall_h.h,v $
|
|
* $Author: hxu0 $ $Date: 2013-12-03 06:40:10 $
|
|
* $State: Exp $ $Locker: $
|
|
*
|
|
* INTERPEAK_COPYRIGHT_STRING
|
|
* Design and implementation by Markus Carlstedt <markus@interpeak.se>
|
|
******************************************************************************
|
|
*/
|
|
|
|
#ifndef IPFIREWALL_H_H
|
|
#define IPFIREWALL_H_H
|
|
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 1 DESCRIPTION
|
|
****************************************************************************
|
|
* Internal header file.
|
|
*/
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 2 CONFIGURATION
|
|
****************************************************************************
|
|
*/
|
|
|
|
#ifdef IPFIREWALL
|
|
#include "ipfirewall_config.h"
|
|
#endif
|
|
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 3 INCLUDE FILES
|
|
****************************************************************************
|
|
*/
|
|
|
|
#ifdef IPFIREWALL
|
|
#include <ipcom_type.h>
|
|
#include <ipcom_cstyle.h>
|
|
#include <ipcom_os.h>
|
|
#include <ipcom_tmo.h>
|
|
#include <ipcom_sock.h>
|
|
#include <ipcom_hash.h>
|
|
#include <ipcom_pqueue.h>
|
|
#endif
|
|
|
|
#if defined(IPNET)
|
|
#include "ipnet_h.h"
|
|
#include "ipnet_eth.h"
|
|
#ifdef IPCOM_USE_INET6
|
|
#include "ipnet_icmp6.h"
|
|
#endif
|
|
#elif defined(IPLITE)
|
|
#include "iplite_h.h"
|
|
#endif
|
|
|
|
#ifdef IPFIREWALL_C
|
|
#ifdef IPTCP
|
|
#include "iptcp.h"
|
|
#include "iptcp_h.h"
|
|
#endif
|
|
#endif
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 4 DEFINES
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
*===========================================================================
|
|
* SYSLOG_FACILITY
|
|
*===========================================================================
|
|
*/
|
|
#ifdef IPFIREWALL_C
|
|
#ifdef IPCOM_SYSLOG_FACILITY
|
|
#undef IPCOM_SYSLOG_FACILITY
|
|
#endif
|
|
#define IPCOM_SYSLOG_FACILITY IPCOM_LOG_IPFIREWALL
|
|
#endif /* #ifdef IPFIREWALL_C */
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* SYSLOG_PRIORITY
|
|
*===========================================================================
|
|
*/
|
|
#ifdef IPFIREWALL_C
|
|
#ifdef IPCOM_SYSLOG_PRIORITY
|
|
#undef IPCOM_SYSLOG_PRIORITY
|
|
#endif
|
|
#ifdef IP_DEBUG
|
|
#define IPCOM_SYSLOG_PRIORITY IPCOM_LOG_DEBUG
|
|
#else
|
|
#define IPCOM_SYSLOG_PRIORITY IPCOM_LOG_WARNING
|
|
#endif
|
|
#endif /* #ifdef IPFIREWALL_C */
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ICMPv4 types and codes
|
|
*===========================================================================
|
|
*/
|
|
#define IPFIREWALL_ICMPV4_TYPE_DST_UNREACH 3
|
|
#define IPFIREWALL_ICMPV4_CODE_DST_UNREACH_NET 0
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ICMPv6 types and codes
|
|
*===========================================================================
|
|
*/
|
|
#define IPFIREWALL_ICMPV6_TYPE_DST_UNREACH 1
|
|
#define IPFIREWALL_ICMPV6_CODE_DST_UNREACH_NOROUTE 0
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* MAC filter address length
|
|
*===========================================================================
|
|
*/
|
|
#define IPFIREWALL_MAC_ADDRESS_LEN 6
|
|
|
|
/*
|
|
*===========================================================================
|
|
* MAC filter header length
|
|
*===========================================================================
|
|
*/
|
|
#define IPFIREWALL_MAC_HEADER_LEN 14
|
|
|
|
/*
|
|
*===========================================================================
|
|
* LLC filter header length
|
|
*===========================================================================
|
|
*/
|
|
#define IPFIREWALL_LLC_HEADER_LEN 3
|
|
|
|
/*
|
|
*===========================================================================
|
|
* SNAP filter vendor length
|
|
*===========================================================================
|
|
*/
|
|
#define IPFIREWALL_SNAP_VENDOR_LEN 3
|
|
|
|
/*
|
|
*===========================================================================
|
|
* MAC 802.3 max frame length
|
|
*===========================================================================
|
|
*/
|
|
#define IPFIREWALL_MAC_802_3_MAX_LEN 1522
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPFIREWALL_MAX_IP_LOG_ENTRIES
|
|
*===========================================================================
|
|
*
|
|
*/
|
|
#define IPFIREWALL_MAX_IP_LOG_ENTRIES 100
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPFIREWALL_MAX_MAC_LOG_ENTRIES
|
|
*===========================================================================
|
|
*
|
|
*/
|
|
#define IPFIREWALL_MAX_MAC_LOG_ENTRIES 100
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPFIREWALL_MAX_RULES
|
|
*===========================================================================
|
|
*
|
|
*/
|
|
#define IPFIREWALL_MAX_IP_RULES 100
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPFIREWALL_MAC_MAX_RULES
|
|
*===========================================================================
|
|
*
|
|
*/
|
|
#define IPFIREWALL_MAX_MAC_RULES 100
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Rule "port" keyword operators
|
|
*===========================================================================
|
|
*/
|
|
#define IPFIREWALL_OP_EQ 0
|
|
#define IPFIREWALL_OP_NE 1
|
|
#define IPFIREWALL_OP_LT 2
|
|
#define IPFIREWALL_OP_GT 3
|
|
#define IPFIREWALL_OP_LE 4
|
|
#define IPFIREWALL_OP_GE 5
|
|
#define IPFIREWALL_OP_OUTRANGE 6
|
|
#define IPFIREWALL_OP_INRANGE 7
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Rule "keep state" keyword operators
|
|
*===========================================================================
|
|
*/
|
|
#define KEEP_STATE 1
|
|
#define KEEP_IFSTATE 2
|
|
#define KEEP_STATE_LIMITED 4
|
|
#define KEEP_IPSECSTATE 8
|
|
|
|
/*
|
|
*===========================================================================
|
|
* TCP flags
|
|
*===========================================================================
|
|
*/
|
|
#define IPFIREWALL_TCPFLAG_URGENT 0x0020
|
|
#define IPFIREWALL_TCPFLAG_ACK 0x0010
|
|
#define IPFIREWALL_TCPFLAG_PUSH 0x0008
|
|
#define IPFIREWALL_TCPFLAG_RESET 0x0004
|
|
#define IPFIREWALL_TCPFLAG_SYN 0x0002
|
|
#define IPFIREWALL_TCPFLAG_FIN 0x0001
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPFIREWALL_CTRL_XXX
|
|
*===========================================================================
|
|
* Defines the available firewall control commands used to pass data to and
|
|
* from the the firewall kernel.
|
|
*
|
|
*/
|
|
#define IPFIREWALL_CTRL_ENABLE 0
|
|
#define IPFIREWALL_CTRL_DISABLE 1
|
|
|
|
#define IPFIREWALL_CTRL_ADD_RULE 2
|
|
#define IPFIREWALL_CTRL_DEL_RULE 3
|
|
#define IPFIREWALL_CTRL_FLUSH_RULES 4
|
|
#define IPFIREWALL_CTRL_GET_RULE_INPUT 5
|
|
#define IPFIREWALL_CTRL_GET_RULE_OUTPUT 6
|
|
|
|
#define IPFIREWALL_CTRL_GET_INFO 7
|
|
#define IPFIREWALL_CTRL_CLEAR_STATS 8
|
|
|
|
#define IPFIREWALL_CTRL_FLUSH_STATES 9
|
|
#define IPFIREWALL_CTRL_GET_STATE 10
|
|
|
|
#define IPFIREWALL_CTRL_FLUSH_LOG 11
|
|
#define IPFIREWALL_CTRL_GET_LOG 12
|
|
|
|
#define IPFIREWALL_CTRL_FLUSH_USERDEFS 13
|
|
#define IPFIREWALL_CTRL_GET_USERDEF 14
|
|
|
|
#define IPFIREWALL_CTRL_FLUSH_GROUP 15
|
|
|
|
/* MAC filter codes */
|
|
#define IPFIREWALL_CTRL_ADD_MAC_RULE 16
|
|
#define IPFIREWALL_CTRL_DEL_MAC_RULE 17
|
|
|
|
#define IPFIREWALL_CTRL_GET_MAC_RULE_INPUT 18
|
|
#define IPFIREWALL_CTRL_GET_MAC_RULE_OUTPUT 19
|
|
#define IPFIREWALL_CTRL_FLUSH_MAC_GROUP 20
|
|
#define IPFIREWALL_CTRL_FLUSH_MAC_RULES 21
|
|
|
|
#define IPFIREWALL_CTRL_FLUSH_MAC_LOG 22
|
|
#define IPFIREWALL_CTRL_GET_MAC_LOG 23
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPFIREWALL_MAX_RULE_ARGS
|
|
*===========================================================================
|
|
* Defines the maximum number of arguments in a firewall rule string
|
|
*
|
|
*/
|
|
#define IPFIREWALL_MAX_RULE_ARGS 16
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPFIREWALL_MS_PER_SEC/MIN/HOUR/DAY
|
|
*===========================================================================
|
|
*
|
|
*/
|
|
|
|
#define IPFIREWALL_MS_PER_SEC 1000
|
|
#define IPFIREWALL_MS_PER_MIN 60000
|
|
#define IPFIREWALL_MS_PER_HOUR 3600000
|
|
#define IPFIREWALL_MS_PER_DAY 86400000
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPFIREWALL_ADDR_TYPE_NOT_LOCAL
|
|
*===========================================================================
|
|
*
|
|
*/
|
|
#ifdef IPNET
|
|
#define IPFIREWALL_ADDR_TYPE_NOT_LOCAL IPNET_ADDR_TYPE_NOT_LOCAL
|
|
#elif defined(IPLITE)
|
|
#define IPFIREWALL_ADDR_TYPE_NOT_LOCAL IPLITE_ADDR_TYPE_NOT_LOCAL
|
|
#endif
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPFIREWALL_TIMEOUT_SCHEDULE / CANCEL
|
|
*===========================================================================
|
|
*
|
|
*/
|
|
#ifdef IPNET
|
|
#define IPFIREWALL_TIMEOUT_SCHEDULE(msec, handler, cookie, tmo_p) \
|
|
ipnet_timeout_schedule(msec, (Ipnet_timeout_handler) handler, cookie, tmo_p)
|
|
#define IPFIREWALL_TIMEOUT_CANCEL(tmo) ipnet_timeout_cancel(tmo)
|
|
#define IPFIREWALL_TIMEOUT_UNTIL(tmo) (ipnet_timeout_msec_until(tmo)/1000)
|
|
#ifdef IPCOM_USE_INET
|
|
#define IPFIREWALL_IPV4_GET_ADDR_TYPE(addr, vrindex, netif) ipnet_ip4_get_addr_type(addr, vrindex, (Ipnet_netif *)netif)
|
|
#endif
|
|
#ifdef IPCOM_USE_INET6
|
|
#define IPFIREWALL_IPV6_GET_ADDR_TYPE(addr, vrindex, netif) ipnet_ip6_get_addr_type(addr, vrindex, (Ipnet_netif *)netif)
|
|
#endif
|
|
#elif defined(IPLITE)
|
|
#define IPFIREWALL_TIMEOUT_SCHEDULE(msec, handler, cookie, tmo_p) \
|
|
iplite_timeout_schedule(msec, (Iplite_timeout_handler) handler, cookie, tmo_p)
|
|
#define IPFIREWALL_TIMEOUT_CANCEL(tmo) iplite_timeout_cancel(tmo)
|
|
#define IPFIREWALL_TIMEOUT_UNTIL(tmo) (iplite_timeout_msec_until(tmo)/1000)
|
|
#ifdef IPCOM_USE_INET
|
|
#define IPFIREWALL_IP4_GET_ADDR_TYPE(addr, vrindex, netif) iplite_ip4_get_addr_type((Iplite_netif *)netif, *addr)
|
|
#endif
|
|
#ifdef IPCOM_USE_INET6
|
|
#define IPFIREWALL_IP6_GET_ADDR_TYPE(addr, vrindex, netif) iplite_ip6_get_addr_type((Iplite_netif *)netif, (struct Ip_in6_addr *)addr)
|
|
#endif
|
|
#endif
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPFIREWALL_IF_NAMETONETIF
|
|
*===========================================================================
|
|
*
|
|
*/
|
|
#ifdef IPNET
|
|
#define IPFIREWALL_IF_NAMETONETIF(ifname) (Ipcom_netif *)ipnet_if_nametonetif(ipnet_get_effective_vr(), ifname)
|
|
#elif defined(IPLITE)
|
|
#define IPFIREWALL_IF_NAMETONETIF(ifname) (Ipcom_netif *)iplite_if_nametonetif(ifname)
|
|
#endif
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPFIREWALL_TEST_INTERFACE
|
|
*===========================================================================
|
|
* Test interface against rule
|
|
*/
|
|
#define IPFIREWALL_TEST_INTERFACE(not, ruleif, pktif) \
|
|
{ \
|
|
if (ruleif == pktif) \
|
|
{ \
|
|
if (not) \
|
|
continue; \
|
|
} \
|
|
else if (!not) \
|
|
continue; \
|
|
} \
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPFIREWALL_TEST_SAP
|
|
*===========================================================================
|
|
* Test 802.3 sap against rule
|
|
*/
|
|
#define IPFIREWALL_TEST_SAP(not, rulesap, pktsap) \
|
|
{ \
|
|
if (rulesap == pktsap) \
|
|
{ \
|
|
if (not) \
|
|
continue; \
|
|
} \
|
|
else if (!not) \
|
|
continue; \
|
|
} \
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPFIREWALL_TEST_SNAP
|
|
*===========================================================================
|
|
* Test 802.2 snap against rule
|
|
*/
|
|
#define IPFIREWALL_TEST_SNAP(not, rulesnap, pktsnap) \
|
|
{ \
|
|
if (rulesnap == pktsnap) \
|
|
{ \
|
|
if (not) \
|
|
continue; \
|
|
} \
|
|
else if (!not) \
|
|
continue; \
|
|
} \
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPFIREWALL_TEST_SNAP_VENDOR
|
|
*===========================================================================
|
|
* Test 802.2 snap against rule
|
|
*/
|
|
#define IPFIREWALL_TEST_SNAP_VENDOR(not, rulevendor, pktvendor) \
|
|
{ \
|
|
if (((Ip_u8 *)rulevendor)[0] == (((Ip_u8 *)pktvendor)[0]) && \
|
|
((Ip_u8 *)rulevendor)[1] == (((Ip_u8 *)pktvendor)[1]) && \
|
|
((Ip_u8 *)rulevendor)[2] == (((Ip_u8 *)pktvendor)[2])) \
|
|
{ \
|
|
if (not) \
|
|
continue; \
|
|
} \
|
|
else if (!not) \
|
|
continue; \
|
|
} \
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 5 TYPES
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Ipfirewall_stats
|
|
*===========================================================================
|
|
*/
|
|
typedef struct Ipfirewall_stats_struct
|
|
{
|
|
#ifdef IPFIREWALL_USE_IP_FILTER
|
|
Ip_u32 in_block;
|
|
Ip_u32 in_pass;
|
|
Ip_u32 in_nomatch;
|
|
Ip_u32 out_block;
|
|
Ip_u32 out_pass;
|
|
Ip_u32 out_nomatch;
|
|
Ip_u32 invalid;
|
|
Ip_u32 in_logged_block;
|
|
Ip_u32 in_logged_pass;
|
|
Ip_u32 out_logged_block;
|
|
Ip_u32 out_logged_pass;
|
|
Ip_u32 log_failures;
|
|
Ip_u32 states_added;
|
|
Ip_u32 states_expired;
|
|
Ip_u32 state_hits;
|
|
Ip_u32 state_failures;
|
|
#endif
|
|
#ifdef IPFIREWALL_USE_MAC_FILTER
|
|
Ip_u32 mac_in_block;
|
|
Ip_u32 mac_in_pass;
|
|
Ip_u32 mac_in_nomatch;
|
|
Ip_u32 mac_out_block;
|
|
Ip_u32 mac_out_pass;
|
|
Ip_u32 mac_out_nomatch;
|
|
Ip_u32 mac_invalid;
|
|
Ip_u32 mac_in_logged_block;
|
|
Ip_u32 mac_in_logged_pass;
|
|
Ip_u32 mac_out_logged_block;
|
|
Ip_u32 mac_out_logged_pass;
|
|
Ip_u32 mac_log_failures;
|
|
#endif
|
|
}
|
|
Ipfirewall_stats;
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Ipfirewall_configuration
|
|
*===========================================================================
|
|
*/
|
|
typedef struct Ipfirewall_configuration_struct
|
|
{
|
|
Ip_s32 timeout_icmp; /* icmp timeout */
|
|
Ip_s32 timeout_udp; /* udp timeout */
|
|
Ip_s32 timeout_tcp; /* tcp timeout */
|
|
Ip_s32 timeout_other; /* tcp other */
|
|
Ip_s32 max_states; /* max number of state entries */
|
|
}
|
|
Ipfirewall_config;
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Ipfirewall_data_inner
|
|
*===========================================================================
|
|
*/
|
|
struct Ipfirewall_data_inner
|
|
{
|
|
Ip_bool enabled; /* Enabled */
|
|
#ifdef IPFIREWALL_USE_IP_FILTER
|
|
Ip_u32 num_head_rules;
|
|
Ip_u32 num_out_rules;
|
|
Ip_u32 num_in_rules;
|
|
Ip_u32 num_states;
|
|
#endif /* #ifdef IPFIREWALL_USE_IP_FILTER */
|
|
#ifdef IPFIREWALL_USE_MAC_FILTER
|
|
Ip_u32 mac_num_head_rules;
|
|
Ip_u32 mac_num_out_rules;
|
|
Ip_u32 mac_num_in_rules;
|
|
#endif /* #ifdef IPFIREWALL_USE_MAC_FILTER */
|
|
Ipfirewall_stats stats; /* Statistics */
|
|
Ipfirewall_config config; /* Configuration */
|
|
#ifdef IPNET
|
|
Ipnet_timeout *tmo; /* Timeout handle */
|
|
#elif defined(IPLITE)
|
|
Iplite_timeout *tmo; /* Timeout handle */
|
|
#endif
|
|
Ip_u32 sec_count; /* Seconds counter */
|
|
};
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Ipfirewall_data
|
|
*===========================================================================
|
|
*/
|
|
typedef struct Ipfirewall_data_struct
|
|
{
|
|
#ifdef IPFIREWALL_USE_IP_FILTER
|
|
Ipcom_list head_rule_input; /* Rule list input */
|
|
Ipcom_list head_rule_output; /* Rule list output*/
|
|
Ipcom_list head_state; /* State list */
|
|
Ipcom_list head_log; /* Log list */
|
|
#ifdef IPFIREWALL_USE_IP_STATEFUL
|
|
#ifdef IPCOM_USE_INET
|
|
Ipcom_hash *hash_v4; /* Hash table for v4 state entries */
|
|
#endif
|
|
#ifdef IPCOM_USE_INET6
|
|
Ipcom_hash *hash_v6; /* Hash table for v6 state entries */
|
|
#endif
|
|
#endif /* #ifdef IPFIREWALL_USE_IP_STATEFUL */
|
|
#endif /* #ifdef IPFIREWALL_USE_IP_FILTER */
|
|
#ifdef IPFIREWALL_USE_MAC_FILTER
|
|
Ipcom_list mac_head_rule_input; /* Rule list */
|
|
Ipcom_list mac_head_rule_output;/* Rule list */
|
|
Ipcom_list mac_head_log; /* Log list */
|
|
#endif /* #ifdef IPFIREWALL_USE_MAC_FILTER */
|
|
#ifdef IPFIREWALL_USE_USERDEF
|
|
Ipcom_list head_user; /* User defined list */
|
|
#endif
|
|
struct Ipfirewall_data_inner inner;
|
|
}
|
|
Ipfirewall_data;
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Ipfirewall_addr
|
|
*===========================================================================
|
|
*/
|
|
typedef struct Ipfirewall_addr_struct
|
|
{
|
|
union
|
|
{
|
|
#ifdef IPCOM_USE_INET
|
|
Ip_u32 v4; /* Network endian */
|
|
#endif
|
|
#ifdef IPCOM_USE_INET6
|
|
Ip_u32 v6[4]; /* Network endian */
|
|
#endif
|
|
} addr;
|
|
union
|
|
{
|
|
#ifdef IPCOM_USE_INET
|
|
Ip_u32 v4; /* Network endian */
|
|
#endif
|
|
#ifdef IPCOM_USE_INET6
|
|
Ip_u32 v6[4]; /* Network endian */
|
|
#endif
|
|
} mask;
|
|
}
|
|
Ipfirewall_addr;
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Ipfirewall_rule_inner
|
|
*===========================================================================
|
|
*/
|
|
struct Ipfirewall_rule_inner
|
|
{
|
|
int group_no; /* Group number */
|
|
/* 20 */
|
|
#ifdef IPFIREWALL_USE_IP_FILTER
|
|
Ipfirewall_addr src; /* source address and mask */
|
|
/* 28 */
|
|
#endif
|
|
Ip_u8 in; /* direction: incoming or outgoing */
|
|
Ip_u8 family; /* IP_AF_INET or IP_AF_INET6 */
|
|
Ip_u8 on; /* "on" (optional) */
|
|
#ifdef IPFIREWALL_PHYSICAL_IF_SUPPORT
|
|
Ip_u8 on_phys; /* "on if phys if (optional) "*/
|
|
#endif
|
|
Ip_u8 proto; /* "proto"(optional) */
|
|
/* 29 */
|
|
Ip_u8 from; /* "from" (optional) */
|
|
Ip_u8 src_me; /* 'me' source address */
|
|
Ip_u8 src_not; /* NOT source address */
|
|
Ip_u8 src_any; /* any source address */
|
|
/* 30 */
|
|
Ip_u8 group_head; /* TRUE if head of group */
|
|
Ip_u8 dst_me; /* 'me' destination address */
|
|
Ip_u8 dst_not; /* NOT destination address */
|
|
Ip_u8 dst_any; /* any destination address */
|
|
/* 31 */
|
|
Ip_u8 tos; /* "tos"(optional) */
|
|
Ip_u8 ttl; /* "ttl" (optional) */
|
|
Ip_u8 mac_type; /* MAC frame type (optional) */
|
|
Ip_u8 log; /* "log" (optional) */
|
|
/* 32 */
|
|
Ip_u8 on_not; /* "on !" (optional) */
|
|
Ip_u8 to; /* "to" (optional) */
|
|
Ip_u8 quick; /* "quick" (optional) */
|
|
Ip_u8 block; /* action: block or pass */
|
|
#ifdef IPFIREWALL_USE_IP_FILTER
|
|
Ip_u8 ipopt; /* "ipopts" (optional) */
|
|
Ip_u8 frag; /* "frag" (optional) */
|
|
Ip_u8 flags; /* "flags" (optional) */
|
|
Ip_u8 keep_state; /* "keep state" (optional) */
|
|
|
|
Ip_u8 with; /* "with" (optional) */
|
|
Ip_u8 with_no; /* "with no" (optional) */
|
|
Ip_u8 r_rst; /* "return-rst" (optional) */
|
|
Ip_u8 r_icmp; /* "return-icmp" (optional) */
|
|
|
|
Ip_u8 icmp_type; /* "icmp-type" (optional) */
|
|
Ip_u8 icmp_code; /* "code" (optional) */
|
|
Ip_u8 src_port; /* "port" (optional) */
|
|
Ip_u8 dst_port; /* "port" (optional) */
|
|
|
|
Ipfirewall_addr dst; /* destination address and mask */
|
|
#endif /* #ifdef IPFIREWALL_USE_IP_FILTER */
|
|
|
|
Ip_u8 ifname[IP_IFNAMSIZ]; /* interface name */
|
|
#ifdef IPFIREWALL_PHYSICAL_IF_SUPPORT
|
|
Ip_u8 phys_ifname[IP_IFNAMSIZ]; /* physical interface name */
|
|
#endif
|
|
|
|
Ip_u8 userdef; /* userdef */
|
|
Ip_u8 limit; /* limit */
|
|
Ip_u16 the_mac_type_n; /* MAC frame type value (network endian) */
|
|
Ip_u8 frame_802_2; /* MAC frame is an 802.3 frame type */
|
|
|
|
Ip_u8 dsap; /* 802.3 dsap */
|
|
Ip_u8 dsap_not; /* Invert dsap rule */
|
|
Ip_u8 the_dsap_n; /* The dsap value */
|
|
|
|
Ip_u8 ssap; /* 802.3 ssap */
|
|
Ip_u8 ssap_not; /* Invert ssap rule */
|
|
Ip_u8 the_ssap_n; /* The ssap value */
|
|
|
|
Ip_u8 snap_vendor; /* The SNAP vendor code */
|
|
Ip_u8 snap_vendor_not; /* Invert SNAP vendor rule */
|
|
Ip_u8 the_snap_vendor_n[IPFIREWALL_SNAP_VENDOR_LEN]; /* The SNAP vendor value (network endian) */
|
|
|
|
Ip_u8 snap_type; /* 802.3 snap type */
|
|
Ip_u8 snap_type_not; /* Invert snap type rule */
|
|
Ip_u16 the_snap_type_n; /* The SNAP value (network endian) */
|
|
|
|
Ip_u8 tcpudp; /* "tcp/udp" */
|
|
Ip_u8 protocol; /* protocol number */
|
|
Ip_u8 spare;
|
|
Ip_u8 log_first; /* "first" (optional) */
|
|
|
|
Ip_u8 icmp_num; /* icmp type */
|
|
Ip_u8 code; /* icmp code */
|
|
Ip_u8 r_icmp_as_dest; /* "return-icmp-as-dest" (optional) */
|
|
Ip_u8 r_icmp_c; /* "return-icmp" code */
|
|
Ip_u8 mac; /* A MAC filter rule */
|
|
Ip_u8 limit_not; /* invert limit rule */
|
|
Ip_u8 limit_period; /* limit period */
|
|
Ip_u8 ttl_val; /* ttl value */
|
|
|
|
Ip_u8 src_op; /* source port operator */
|
|
Ip_u8 dst_op; /* destination port operator */
|
|
Ip_u8 tos_mask; /* tos mask */
|
|
Ip_u8 tos_val; /* tos value */
|
|
|
|
Ip_u16 src_port_lo; /* port low limit in case of '<>' or '><' operator */
|
|
Ip_u16 src_port_hi; /* port number or port high limit in case of '<>' or '><' operator */
|
|
|
|
Ip_u16 dst_port_lo; /* port low limit in case of '<>' or '><' operator */
|
|
Ip_u16 dst_port_hi; /* port number or port high limit in case of '<>' or '><' operator */
|
|
|
|
Ip_u16 tcp_flags; /* tcp flags */
|
|
Ip_u16 tcp_mask; /* tcp flags mask */
|
|
|
|
Ip_u32 pflags; /* "pflags" (optional) */
|
|
Ip_u32 pktflags;
|
|
Ip_u32 pktflags_mask;
|
|
|
|
Ip_u32 limit_num; /* limit number */
|
|
Ip_u32 burst_num; /* burst number */
|
|
|
|
#ifdef IPFIREWALL_USE_MAC_FILTER
|
|
Ip_u8 mac_dst[IPFIREWALL_MAC_ADDRESS_LEN]; /* MAC destination address */
|
|
Ip_u8 mac_dst_mask[IPFIREWALL_MAC_ADDRESS_LEN]; /* MAC destination mask */
|
|
Ip_u8 mac_src[IPFIREWALL_MAC_ADDRESS_LEN]; /* MAC source address */
|
|
Ip_u8 mac_src_mask[IPFIREWALL_MAC_ADDRESS_LEN]; /* MAC source mask */
|
|
#endif /* #ifdef IPFIREWALL_USE_MAC_FILTER */
|
|
|
|
#ifdef IPFIREWALL_USE_USERDEF
|
|
Ip_u8 userdef_id[IPFIREWALL_USERDEF_ID_SIZE]; /* user defined function id */
|
|
char userdef_param[IPFIREWALL_USERDEF_PARAM_SIZE]; /* user defined function parameter */
|
|
#endif
|
|
|
|
/* Keep this the last before the non-fixed */
|
|
int align_adjust; /* Alignment adjustment */
|
|
/* Non-fixed members... */
|
|
Ip_u32 ifindex; /* Interface index */
|
|
#ifdef IPFIREWALL_PHYSICAL_IF_SUPPORT
|
|
Ip_u32 physical_ifindex; /* Interface index */
|
|
#endif
|
|
int rule_no; /* Rule number in this group */
|
|
Ip_u16 log_hit; /* Log hit */
|
|
Ip_u16 limit_first; /* Boolean */
|
|
Ip_u32 limit_level; /* Current bucket level */
|
|
Ip_u32 limit_ms; /* Timeout is millisec */
|
|
};
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Ipfirewall_rule
|
|
*===========================================================================
|
|
*/
|
|
typedef struct Ipfirewall_rule_struct
|
|
{
|
|
Ipcom_list list_rule; /* List (must be first) */
|
|
/* 16 */
|
|
|
|
struct Ipfirewall_rule_inner inner;
|
|
|
|
#ifdef IPNET
|
|
Ipnet_timeout *limit_tmo; /* Timeout handle */
|
|
#elif defined(IPLITE)
|
|
Iplite_timeout *limit_tmo; /* Timeout handle */
|
|
#endif
|
|
|
|
#ifdef IPFIREWALL_USE_USERDEF
|
|
Ipfirewall_userdef_match user_match; /* User defined match function */
|
|
Ipfirewall_userdef_check user_check; /* User defined check function */
|
|
Ipfirewall_userdef_destroy user_destroy; /* User defined destroy function */
|
|
void *userdef_cookie; /* User defined function cookie */
|
|
void *userdef_info; /* User defined info */
|
|
unsigned int userdef_info_size; /* User defined info length */
|
|
#endif /* #ifdef IPFIREWALL_USE_USERDEF */
|
|
}
|
|
Ipfirewall_rule;
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Ipfirewall_packet
|
|
*===========================================================================
|
|
*/
|
|
typedef struct Ipfirewall_packet_struct
|
|
{
|
|
Ip_u8 version;
|
|
Ip_u32 ifindex;
|
|
Ip_u8 protocol;
|
|
Ip_u8 is_frag;
|
|
Ip_u8 first_frag;
|
|
union network
|
|
{
|
|
#ifdef IPCOM_USE_INET
|
|
Ipcom_ip_header *ip4;
|
|
#endif
|
|
#ifdef IPCOM_USE_INET6
|
|
Ipcom_ip6_header *ip6;
|
|
#endif
|
|
} net;
|
|
union transport
|
|
{
|
|
Ipcom_icmp_header *icmp;
|
|
Ipcom_udp_header *udp;
|
|
Ipcom_tcp_header *tcp;
|
|
} tsp;
|
|
Ip_u16 hlen;
|
|
#ifdef IPIPSEC2
|
|
Ip_u32 ipsec_addr[4]; /* Ipsec gateway */
|
|
#endif
|
|
}
|
|
Ipfirewall_packet;
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Ipfirewall_log_inner
|
|
*===========================================================================
|
|
*/
|
|
struct Ipfirewall_log_inner
|
|
{
|
|
Ip_s32 tv_sec; /* Time when packet was sent/received */
|
|
Ip_s32 tv_usec;
|
|
Ip_u8 ifname[IP_IFNAMSIZ]; /* Interface name */
|
|
int group_no; /* Group number that matched */
|
|
int rule_no; /* Rule number that matched */
|
|
Ip_u8 version; /* IP_AF_INET or IP_AF_INET6 */
|
|
Ip_u8 protocol; /* IP protocol */
|
|
Ip_u8 is_frag;
|
|
Ip_u8 first_frag;
|
|
Ip_u16 h_len;
|
|
Ip_u16 ip_len;
|
|
Ip_u16 tcp_flags;
|
|
Ip_u8 icmp_type;
|
|
Ip_u8 icmp_code;
|
|
union
|
|
{
|
|
#ifdef IPCOM_USE_INET
|
|
struct Ip_in_addr addr4;
|
|
#endif
|
|
#ifdef IPCOM_USE_INET6
|
|
struct Ip_in6_addr addr6;
|
|
#endif
|
|
}
|
|
src_n;
|
|
union
|
|
{
|
|
#ifdef IPCOM_USE_INET
|
|
struct Ip_in_addr addr4;
|
|
#endif
|
|
#ifdef IPCOM_USE_INET6
|
|
struct Ip_in6_addr addr6;
|
|
#endif
|
|
}
|
|
dst_n;
|
|
Ip_u16 src_port_n;
|
|
Ip_u16 dst_port_n;
|
|
Ip_u8 block;
|
|
};
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Ipfirewall_log
|
|
*===========================================================================
|
|
*/
|
|
typedef struct Ipfirewall_log_struct
|
|
{
|
|
Ipcom_list list_log;
|
|
struct Ipfirewall_log_inner inner;
|
|
}
|
|
Ipfirewall_log;
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Ipfirewall_mac_log_inner
|
|
*===========================================================================
|
|
*/
|
|
struct Ipfirewall_mac_log_inner
|
|
{
|
|
Ip_s32 tv_sec; /* Time when packet was sent/received */
|
|
Ip_s32 tv_usec;
|
|
Ip_u8 ifname[IP_IFNAMSIZ]; /* Interface name */
|
|
int group_no; /* Group number that matched */
|
|
int rule_no; /* Rule number that matched */
|
|
Ip_u8 dst[IPFIREWALL_MAC_ADDRESS_LEN]; /* Destination address */
|
|
Ip_u8 src[IPFIREWALL_MAC_ADDRESS_LEN]; /* Source address */
|
|
Ip_u16 type_n; /* Frame type */
|
|
Ip_s32 length; /* Frame length exclusive header */
|
|
Ip_u8 frame[64]; /* Log length */
|
|
Ip_u8 block;
|
|
};
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Ipfirewall_mac_log
|
|
*===========================================================================
|
|
*/
|
|
typedef struct Ipfirewall_mac_log_struct
|
|
{
|
|
Ipcom_list list_log;
|
|
struct Ipfirewall_mac_log_inner inner;
|
|
}
|
|
Ipfirewall_mac_log;
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Ipfirewall_state_inner
|
|
*===========================================================================
|
|
*/
|
|
struct Ipfirewall_state_inner
|
|
{
|
|
Ip_u32 sec_start; /* Time until timeout */
|
|
Ip_u32 sec_tmo; /* Timeout for this state */
|
|
int group_no; /* Rule group that generated this entry */
|
|
int rule_no; /* Rule number that generated this entry */
|
|
Ip_u8 version; /* IP_AF_INET or IP_AF_INET6 */
|
|
Ip_u8 protocol; /* IP protocol */
|
|
Ip_u8 in; /* 1 = incoming rule. 0 = outgoing rule. */
|
|
Ip_u8 estab; /* 1 = tcp session established. */
|
|
union
|
|
{
|
|
#ifdef IPCOM_USE_INET
|
|
struct Ip_in_addr addr4;
|
|
#endif
|
|
#ifdef IPCOM_USE_INET6
|
|
struct Ip_in6_addr addr6;
|
|
#endif
|
|
}
|
|
src_n;
|
|
union
|
|
{
|
|
#ifdef IPCOM_USE_INET
|
|
struct Ip_in_addr addr4;
|
|
#endif
|
|
#ifdef IPCOM_USE_INET6
|
|
struct Ip_in6_addr addr6;
|
|
#endif
|
|
}
|
|
dst_n;
|
|
Ip_u16 src_port_n;
|
|
Ip_u16 dst_port_n;
|
|
Ip_u32 ifindex;
|
|
#ifdef IPIPSEC2
|
|
Ip_u32 ipsec_addr[4]; /* Ipsec gateway */
|
|
#endif
|
|
};
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Ipfirewall_state
|
|
*===========================================================================
|
|
*/
|
|
typedef struct Ipfirewall_state_struct
|
|
{
|
|
Ipcom_list list_state; /* List */
|
|
#ifdef IPNET
|
|
Ipnet_timeout *tmo; /* Timeout handle */
|
|
#elif defined(IPLITE)
|
|
Iplite_timeout *tmo; /* Timeout handle */
|
|
#endif
|
|
void * fr;
|
|
struct Ipfirewall_state_inner inner;
|
|
struct Ipfirewall_rule *fw_rule;
|
|
}
|
|
Ipfirewall_state;
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Ipfirewall_user_inner
|
|
*===========================================================================
|
|
*/
|
|
struct Ipfirewall_user_inner
|
|
{
|
|
char identifier[IPFIREWALL_USERDEF_ID_SIZE]; /* Identifier */
|
|
};
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Ipfirewall_user
|
|
*===========================================================================
|
|
*/
|
|
typedef struct Ipfirewall_user_struct
|
|
{
|
|
Ipcom_list list_user; /* List */
|
|
Ipfirewall_userdef_match match;
|
|
Ipfirewall_userdef_check check;
|
|
Ipfirewall_userdef_destroy destroy;
|
|
void *cookie;
|
|
struct Ipfirewall_user_inner inner;
|
|
}
|
|
Ipfirewall_user;
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Ipfirewall_hash_key_v4
|
|
*===========================================================================
|
|
*/
|
|
#ifdef IPCOM_USE_INET
|
|
typedef struct Ipfirewall_hash_key_v4_struct
|
|
{
|
|
Ip_u32 src_n;
|
|
Ip_u32 dst_n;
|
|
Ip_u16 src_port_n;
|
|
Ip_u16 dst_port_n;
|
|
Ip_u8 protocol;
|
|
Ip_u32 ifindex;
|
|
Ip_u32 ipsec_addr[4];
|
|
}
|
|
Ipfirewall_hash_key_v4;
|
|
#endif
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Ipfirewall_hash_key_v6
|
|
*===========================================================================
|
|
*/
|
|
#ifdef IPCOM_USE_INET6
|
|
typedef struct Ipfirewall_hash_key_v6_struct
|
|
{
|
|
Ip_u32 src_n[4];
|
|
Ip_u32 dst_n[4];
|
|
Ip_u16 src_port_n;
|
|
Ip_u16 dst_port_n;
|
|
Ip_u8 protocol;
|
|
Ip_u32 ifindex;
|
|
Ip_u32 ipsec_addr[4];
|
|
}
|
|
Ipfirewall_hash_key_v6;
|
|
#endif
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* Ipfirewall_ctrl
|
|
*===========================================================================
|
|
*/
|
|
typedef struct Ipfirewall_ctrl_struct
|
|
{
|
|
Ip_s32 cmd; /* Control command */
|
|
Ip_u32 seqno; /* Optional sequence number */
|
|
union
|
|
{
|
|
struct Ipfirewall_data_inner info;
|
|
struct Ipfirewall_rule_inner rule_info;
|
|
#ifdef IPFIREWALL_USE_USERDEF
|
|
struct Ipfirewall_user_inner user_info;
|
|
#endif
|
|
#ifdef IPFIREWALL_USE_IP_FILTER
|
|
struct Ipfirewall_state_inner state_info;
|
|
struct Ipfirewall_log_inner log_info;
|
|
#endif
|
|
#ifdef IPFIREWALL_USE_MAC_FILTER
|
|
struct Ipfirewall_mac_log_inner mac_log_info;
|
|
#endif
|
|
}
|
|
type; /* Optional type */
|
|
}
|
|
Ipfirewall_ctrl;
|
|
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 6 FUNCTIONS
|
|
****************************************************************************
|
|
*/
|
|
|
|
IP_EXTERN IP_GLOBAL Ipfirewall_data *ipfirewall;
|
|
|
|
IP_GLOBAL int ipfirewall_cmd_ipfirewall(int argc, char **argv);
|
|
|
|
#if IPCOM_USE_FILE != IPCOM_FILE_NONE
|
|
IP_GLOBAL Ip_s32 ipfirewall_add_rule_file(Ip_bool mac_rule, Ip_s32 family, char *filename, Ip_bool silent);
|
|
#endif
|
|
|
|
IP_GLOBAL Ip_s32 ipfirewall_mac_internal_get_rule(Ipfirewall_ctrl *ctrl, Ip_socklen_t *lenp, Ip_bool in);
|
|
IP_GLOBAL Ip_s32 ipfirewall_mac_internal_get_log(Ipfirewall_ctrl *ctrl, Ip_socklen_t *lenp);
|
|
|
|
IP_GLOBAL Ip_s32 ipfirewall_internal_get_rule(Ipfirewall_ctrl *ctrl, Ip_socklen_t *lenp, Ip_bool in);
|
|
IP_GLOBAL Ip_s32 ipfirewall_internal_get_log(Ipfirewall_ctrl *ctrl, Ip_socklen_t *lenp);
|
|
IP_GLOBAL Ip_s32 ipfirewall_internal_get_state(Ipfirewall_ctrl *ctrl, Ip_socklen_t *lenp);
|
|
IP_GLOBAL Ip_s32 ipfirewall_internal_flush_states(void);
|
|
IP_GLOBAL Ip_s32 ipfirewall_internal_flush_one_state(Ipfirewall_rule *fw_rule);
|
|
IP_GLOBAL void ipfirewall_clean_state(Ipfirewall_state *fw_state);
|
|
|
|
#ifdef IPCOM_USE_INET
|
|
IP_GLOBAL Ip_u32 ipfirewall_obj_hash_v4(Ipfirewall_state *fw_state);
|
|
IP_GLOBAL Ip_u32 ipfirewall_key_hash_v4(Ipfirewall_hash_key_v4 *fw_key);
|
|
IP_GLOBAL Ip_bool ipfirewall_cmp_hash_v4(Ipfirewall_state *fw_state, Ipfirewall_hash_key_v4 *fw_key);
|
|
IP_GLOBAL void ipfirewall_get_frag4_info(Ipcom_ip_header *ip4, Ipcom_pkt *pkt, Ip_u32 mtu, Ip_u8 *is_frag, Ip_u8 *first_frag);
|
|
#endif
|
|
|
|
#ifdef IPCOM_USE_INET6
|
|
IP_GLOBAL Ip_u32 ipfirewall_obj_hash_v6(Ipfirewall_state *fw_state);
|
|
IP_GLOBAL Ip_u32 ipfirewall_key_hash_v6(Ipfirewall_hash_key_v6 *fw_key);
|
|
IP_GLOBAL Ip_bool ipfirewall_cmp_hash_v6(Ipfirewall_state *fw_state, Ipfirewall_hash_key_v6 *fw_key);
|
|
IP_GLOBAL Ip_s32 ipfirewall_get_frag6_info(Ipcom_ip6_header *ip6, Ipcom_pkt *pkt, Ip_u32 mtu, Ip_u8 *is_frag,
|
|
Ip_u8 *first_frag, Ip_u8 *protocol, Ip_u16 *hlen);
|
|
#endif
|
|
|
|
IP_GLOBAL Ip_u32 ipfirewall_compare_limit(Ipfirewall_rule *fw_rule);
|
|
IP_GLOBAL Ip_s32 ipfirewall_match_interface(Ipfirewall_rule *fw_rule, Ipcom_netif *netif);
|
|
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|
|
|
|
#endif
|
|
|
|
/*
|
|
****************************************************************************
|
|
* END OF FILE
|
|
****************************************************************************
|
|
*/
|