Start splitting pfvar.h into internal and external parts.
- Provide pf_altq.h that has only stuff needed for ALTQ. - Start pf.h, that would have all constant values and eventually non-kernel structures. - Build ALTQ w/o pfvar.h, include if_var.h, that before came via pollution. - Build tcpdump w/o pfvar.h. Sponsored by: Netflix Sponsored by: Nginx, Inc.
This commit is contained in:
Gleb Smirnoff
parent
61a3ac6e27
commit
9dae57e134
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=257186
@ -56,7 +56,7 @@ struct rtentry;
|
||||
#include "gencode.h"
|
||||
#ifdef HAVE_NET_PFVAR_H
|
||||
#include <net/if.h>
|
||||
#include <net/pfvar.h>
|
||||
#include <net/pf.h>
|
||||
#include <net/if_pflog.h>
|
||||
#endif
|
||||
#include "ieee80211.h"
|
||||
|
||||
@ -54,9 +54,12 @@
|
||||
#endif
|
||||
|
||||
#include <net/if.h>
|
||||
#include <net/if_var.h>
|
||||
#include <netinet/in.h>
|
||||
|
||||
#include <net/pfvar.h>
|
||||
#include <net/pf.h>
|
||||
#include <net/pf_altq.h>
|
||||
#include <net/pf_mtag.h>
|
||||
#include <altq/altq.h>
|
||||
#include <altq/altq_cbq.h>
|
||||
#ifdef ALTQ3_COMPAT
|
||||
|
||||
@ -55,6 +55,7 @@
|
||||
#include <netinet/ip6.h>
|
||||
#endif
|
||||
|
||||
#include <altq/if_altq.h>
|
||||
#include <altq/altq.h>
|
||||
#ifdef ALTQ3_COMPAT
|
||||
#include <altq/altq_conf.h>
|
||||
|
||||
@ -66,9 +66,12 @@
|
||||
#endif /* ALTQ3_COMPAT */
|
||||
|
||||
#include <net/if.h>
|
||||
#include <net/if_var.h>
|
||||
#include <netinet/in.h>
|
||||
|
||||
#include <net/pfvar.h>
|
||||
#include <net/pf.h>
|
||||
#include <net/pf_altq.h>
|
||||
#include <net/pf_mtag.h>
|
||||
#include <altq/altq.h>
|
||||
#include <altq/altq_hfsc.h>
|
||||
#ifdef ALTQ3_COMPAT
|
||||
|
||||
@ -51,9 +51,12 @@
|
||||
#include <sys/queue.h>
|
||||
|
||||
#include <net/if.h>
|
||||
#include <net/if_var.h>
|
||||
#include <netinet/in.h>
|
||||
|
||||
#include <net/pfvar.h>
|
||||
#include <net/pf.h>
|
||||
#include <net/pf_altq.h>
|
||||
#include <net/pf_mtag.h>
|
||||
#include <altq/altq.h>
|
||||
#ifdef ALTQ3_COMPAT
|
||||
#include <altq/altq_conf.h>
|
||||
|
||||
@ -86,6 +86,7 @@
|
||||
#endif /* ALTQ3_COMPAT */
|
||||
|
||||
#include <net/if.h>
|
||||
#include <net/if_var.h>
|
||||
|
||||
#include <netinet/in.h>
|
||||
#include <netinet/in_systm.h>
|
||||
@ -94,7 +95,9 @@
|
||||
#include <netinet/ip6.h>
|
||||
#endif
|
||||
|
||||
#include <net/pfvar.h>
|
||||
#include <net/pf.h>
|
||||
#include <net/pf_altq.h>
|
||||
#include <net/pf_mtag.h>
|
||||
#include <altq/altq.h>
|
||||
#include <altq/altq_red.h>
|
||||
#ifdef ALTQ3_COMPAT
|
||||
|
||||
@ -81,6 +81,7 @@
|
||||
#endif
|
||||
|
||||
#include <net/if.h>
|
||||
#include <net/if_var.h>
|
||||
|
||||
#include <netinet/in.h>
|
||||
#include <netinet/in_systm.h>
|
||||
@ -89,7 +90,8 @@
|
||||
#include <netinet/ip6.h>
|
||||
#endif
|
||||
|
||||
#include <net/pfvar.h>
|
||||
#include <net/pf.h>
|
||||
#include <net/pf_altq.h>
|
||||
#include <altq/altq.h>
|
||||
#include <altq/altq_cdnr.h>
|
||||
#include <altq/altq_red.h>
|
||||
|
||||
@ -59,12 +59,14 @@
|
||||
#endif
|
||||
|
||||
#include <net/if.h>
|
||||
#include <net/if_var.h>
|
||||
#ifdef ALTQ3_COMPAT
|
||||
#include <netinet/in.h>
|
||||
#include <netinet/in_systm.h>
|
||||
#include <netinet/ip.h>
|
||||
#endif
|
||||
|
||||
#include <altq/if_altq.h>
|
||||
#include <altq/altq.h>
|
||||
#include <altq/altq_rmclass.h>
|
||||
#include <altq/altq_rmclass_debug.h>
|
||||
|
||||
@ -49,6 +49,7 @@
|
||||
#include <sys/queue.h>
|
||||
|
||||
#include <net/if.h>
|
||||
#include <net/if_var.h>
|
||||
#include <net/if_dl.h>
|
||||
#include <net/if_types.h>
|
||||
#ifdef __FreeBSD__
|
||||
@ -64,7 +65,8 @@
|
||||
#include <netinet/tcp.h>
|
||||
#include <netinet/udp.h>
|
||||
|
||||
#include <net/pfvar.h>
|
||||
#include <net/pf.h>
|
||||
#include <net/pf_altq.h>
|
||||
#include <altq/altq.h>
|
||||
#ifdef ALTQ3_COMPAT
|
||||
#include <altq/altq_conf.h>
|
||||
|
||||
152
sys/net/pf.h
Normal file
152
sys/net/pf.h
Normal file
@ -0,0 +1,152 @@
|
||||
/*
|
||||
* Copyright (c) 2001 Daniel Hartmeier
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* - Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* - Redistributions in binary form must reproduce the above
|
||||
* copyright notice, this list of conditions and the following
|
||||
* disclaimer in the documentation and/or other materials provided
|
||||
* with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
||||
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
||||
* COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
|
||||
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
|
||||
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
|
||||
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
|
||||
* ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
||||
* POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
* $OpenBSD: pfvar.h,v 1.282 2009/01/29 15:12:28 pyr Exp $
|
||||
* $FreeBSD$
|
||||
*/
|
||||
|
||||
#ifndef _NET_PF_H_
|
||||
#define _NET_PFAR_H_
|
||||
|
||||
#define PF_TCPS_PROXY_SRC ((TCP_NSTATES)+0)
|
||||
#define PF_TCPS_PROXY_DST ((TCP_NSTATES)+1)
|
||||
|
||||
#define PF_MD5_DIGEST_LENGTH 16
|
||||
#ifdef MD5_DIGEST_LENGTH
|
||||
#if PF_MD5_DIGEST_LENGTH != MD5_DIGEST_LENGTH
|
||||
#error
|
||||
#endif
|
||||
#endif
|
||||
|
||||
enum { PF_INOUT, PF_IN, PF_OUT };
|
||||
enum { PF_PASS, PF_DROP, PF_SCRUB, PF_NOSCRUB, PF_NAT, PF_NONAT,
|
||||
PF_BINAT, PF_NOBINAT, PF_RDR, PF_NORDR, PF_SYNPROXY_DROP, PF_DEFER };
|
||||
enum { PF_RULESET_SCRUB, PF_RULESET_FILTER, PF_RULESET_NAT,
|
||||
PF_RULESET_BINAT, PF_RULESET_RDR, PF_RULESET_MAX };
|
||||
enum { PF_OP_NONE, PF_OP_IRG, PF_OP_EQ, PF_OP_NE, PF_OP_LT,
|
||||
PF_OP_LE, PF_OP_GT, PF_OP_GE, PF_OP_XRG, PF_OP_RRG };
|
||||
enum { PF_DEBUG_NONE, PF_DEBUG_URGENT, PF_DEBUG_MISC, PF_DEBUG_NOISY };
|
||||
enum { PF_CHANGE_NONE, PF_CHANGE_ADD_HEAD, PF_CHANGE_ADD_TAIL,
|
||||
PF_CHANGE_ADD_BEFORE, PF_CHANGE_ADD_AFTER,
|
||||
PF_CHANGE_REMOVE, PF_CHANGE_GET_TICKET };
|
||||
enum { PF_GET_NONE, PF_GET_CLR_CNTR };
|
||||
enum { PF_SK_WIRE, PF_SK_STACK, PF_SK_BOTH };
|
||||
|
||||
/*
|
||||
* Note about PFTM_*: real indices into pf_rule.timeout[] come before
|
||||
* PFTM_MAX, special cases afterwards. See pf_state_expires().
|
||||
*/
|
||||
enum { PFTM_TCP_FIRST_PACKET, PFTM_TCP_OPENING, PFTM_TCP_ESTABLISHED,
|
||||
PFTM_TCP_CLOSING, PFTM_TCP_FIN_WAIT, PFTM_TCP_CLOSED,
|
||||
PFTM_UDP_FIRST_PACKET, PFTM_UDP_SINGLE, PFTM_UDP_MULTIPLE,
|
||||
PFTM_ICMP_FIRST_PACKET, PFTM_ICMP_ERROR_REPLY,
|
||||
PFTM_OTHER_FIRST_PACKET, PFTM_OTHER_SINGLE,
|
||||
PFTM_OTHER_MULTIPLE, PFTM_FRAG, PFTM_INTERVAL,
|
||||
PFTM_ADAPTIVE_START, PFTM_ADAPTIVE_END, PFTM_SRC_NODE,
|
||||
PFTM_TS_DIFF, PFTM_MAX, PFTM_PURGE, PFTM_UNLINKED,
|
||||
PFTM_UNTIL_PACKET };
|
||||
|
||||
/* PFTM default values */
|
||||
#define PFTM_TCP_FIRST_PACKET_VAL 120 /* First TCP packet */
|
||||
#define PFTM_TCP_OPENING_VAL 30 /* No response yet */
|
||||
#define PFTM_TCP_ESTABLISHED_VAL 24*60*60/* Established */
|
||||
#define PFTM_TCP_CLOSING_VAL 15 * 60 /* Half closed */
|
||||
#define PFTM_TCP_FIN_WAIT_VAL 45 /* Got both FINs */
|
||||
#define PFTM_TCP_CLOSED_VAL 90 /* Got a RST */
|
||||
#define PFTM_UDP_FIRST_PACKET_VAL 60 /* First UDP packet */
|
||||
#define PFTM_UDP_SINGLE_VAL 30 /* Unidirectional */
|
||||
#define PFTM_UDP_MULTIPLE_VAL 60 /* Bidirectional */
|
||||
#define PFTM_ICMP_FIRST_PACKET_VAL 20 /* First ICMP packet */
|
||||
#define PFTM_ICMP_ERROR_REPLY_VAL 10 /* Got error response */
|
||||
#define PFTM_OTHER_FIRST_PACKET_VAL 60 /* First packet */
|
||||
#define PFTM_OTHER_SINGLE_VAL 30 /* Unidirectional */
|
||||
#define PFTM_OTHER_MULTIPLE_VAL 60 /* Bidirectional */
|
||||
#define PFTM_FRAG_VAL 30 /* Fragment expire */
|
||||
#define PFTM_INTERVAL_VAL 10 /* Expire interval */
|
||||
#define PFTM_SRC_NODE_VAL 0 /* Source tracking */
|
||||
#define PFTM_TS_DIFF_VAL 30 /* Allowed TS diff */
|
||||
|
||||
enum { PF_NOPFROUTE, PF_FASTROUTE, PF_ROUTETO, PF_DUPTO, PF_REPLYTO };
|
||||
enum { PF_LIMIT_STATES, PF_LIMIT_SRC_NODES, PF_LIMIT_FRAGS,
|
||||
PF_LIMIT_TABLE_ENTRIES, PF_LIMIT_MAX };
|
||||
#define PF_POOL_IDMASK 0x0f
|
||||
enum { PF_POOL_NONE, PF_POOL_BITMASK, PF_POOL_RANDOM,
|
||||
PF_POOL_SRCHASH, PF_POOL_ROUNDROBIN };
|
||||
enum { PF_ADDR_ADDRMASK, PF_ADDR_NOROUTE, PF_ADDR_DYNIFTL,
|
||||
PF_ADDR_TABLE, PF_ADDR_URPFFAILED,
|
||||
PF_ADDR_RANGE };
|
||||
#define PF_POOL_TYPEMASK 0x0f
|
||||
#define PF_POOL_STICKYADDR 0x20
|
||||
#define PF_WSCALE_FLAG 0x80
|
||||
#define PF_WSCALE_MASK 0x0f
|
||||
|
||||
#define PF_LOG 0x01
|
||||
#define PF_LOG_ALL 0x02
|
||||
#define PF_LOG_SOCKET_LOOKUP 0x04
|
||||
|
||||
/* Reasons code for passing/dropping a packet */
|
||||
#define PFRES_MATCH 0 /* Explicit match of a rule */
|
||||
#define PFRES_BADOFF 1 /* Bad offset for pull_hdr */
|
||||
#define PFRES_FRAG 2 /* Dropping following fragment */
|
||||
#define PFRES_SHORT 3 /* Dropping short packet */
|
||||
#define PFRES_NORM 4 /* Dropping by normalizer */
|
||||
#define PFRES_MEMORY 5 /* Dropped due to lacking mem */
|
||||
#define PFRES_TS 6 /* Bad TCP Timestamp (RFC1323) */
|
||||
#define PFRES_CONGEST 7 /* Congestion (of ipintrq) */
|
||||
#define PFRES_IPOPTIONS 8 /* IP option */
|
||||
#define PFRES_PROTCKSUM 9 /* Protocol checksum invalid */
|
||||
#define PFRES_BADSTATE 10 /* State mismatch */
|
||||
#define PFRES_STATEINS 11 /* State insertion failure */
|
||||
#define PFRES_MAXSTATES 12 /* State limit */
|
||||
#define PFRES_SRCLIMIT 13 /* Source node/conn limit */
|
||||
#define PFRES_SYNPROXY 14 /* SYN proxy */
|
||||
#define PFRES_MAX 15 /* total+1 */
|
||||
|
||||
#define PFRES_NAMES { \
|
||||
"match", \
|
||||
"bad-offset", \
|
||||
"fragment", \
|
||||
"short", \
|
||||
"normalize", \
|
||||
"memory", \
|
||||
"bad-timestamp", \
|
||||
"congestion", \
|
||||
"ip-option", \
|
||||
"proto-cksum", \
|
||||
"state-mismatch", \
|
||||
"state-insert", \
|
||||
"state-limit", \
|
||||
"src-limit", \
|
||||
"synproxy", \
|
||||
NULL \
|
||||
}
|
||||
|
||||
#define PF_TABLE_NAME_SIZE 32
|
||||
#define PF_QNAME_SIZE 64
|
||||
|
||||
#endif /* _NET_PF_H_ */
|
||||
99
sys/net/pf_altq.h
Normal file
99
sys/net/pf_altq.h
Normal file
@ -0,0 +1,99 @@
|
||||
/*
|
||||
* Copyright (c) 2001 Daniel Hartmeier
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* - Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* - Redistributions in binary form must reproduce the above
|
||||
* copyright notice, this list of conditions and the following
|
||||
* disclaimer in the documentation and/or other materials provided
|
||||
* with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
||||
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
||||
* COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
|
||||
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
|
||||
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
|
||||
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
|
||||
* ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
||||
* POSSIBILITY OF SUCH DAMAGE.
|
||||
*
|
||||
* $OpenBSD: pfvar.h,v 1.282 2009/01/29 15:12:28 pyr Exp $
|
||||
* $FreeBSD$
|
||||
*/
|
||||
|
||||
#ifndef _NET_PF_ALTQ_H_
|
||||
#define _NET_PF_ALTQ_H_
|
||||
|
||||
struct cbq_opts {
|
||||
u_int minburst;
|
||||
u_int maxburst;
|
||||
u_int pktsize;
|
||||
u_int maxpktsize;
|
||||
u_int ns_per_byte;
|
||||
u_int maxidle;
|
||||
int minidle;
|
||||
u_int offtime;
|
||||
int flags;
|
||||
};
|
||||
|
||||
struct priq_opts {
|
||||
int flags;
|
||||
};
|
||||
|
||||
struct hfsc_opts {
|
||||
/* real-time service curve */
|
||||
u_int rtsc_m1; /* slope of the 1st segment in bps */
|
||||
u_int rtsc_d; /* the x-projection of m1 in msec */
|
||||
u_int rtsc_m2; /* slope of the 2nd segment in bps */
|
||||
/* link-sharing service curve */
|
||||
u_int lssc_m1;
|
||||
u_int lssc_d;
|
||||
u_int lssc_m2;
|
||||
/* upper-limit service curve */
|
||||
u_int ulsc_m1;
|
||||
u_int ulsc_d;
|
||||
u_int ulsc_m2;
|
||||
int flags;
|
||||
};
|
||||
|
||||
struct pf_altq {
|
||||
char ifname[IFNAMSIZ];
|
||||
|
||||
void *altq_disc; /* discipline-specific state */
|
||||
TAILQ_ENTRY(pf_altq) entries;
|
||||
|
||||
/* scheduler spec */
|
||||
uint8_t scheduler; /* scheduler type */
|
||||
uint16_t tbrsize; /* tokenbucket regulator size */
|
||||
uint32_t ifbandwidth; /* interface bandwidth */
|
||||
|
||||
/* queue spec */
|
||||
char qname[PF_QNAME_SIZE]; /* queue name */
|
||||
char parent[PF_QNAME_SIZE]; /* parent name */
|
||||
uint32_t parent_qid; /* parent queue id */
|
||||
uint32_t bandwidth; /* queue bandwidth */
|
||||
uint8_t priority; /* priority */
|
||||
uint8_t local_flags; /* dynamic interface */
|
||||
#define PFALTQ_FLAG_IF_REMOVED 0x01
|
||||
|
||||
uint16_t qlimit; /* queue size limit */
|
||||
uint16_t flags; /* misc flags */
|
||||
union {
|
||||
struct cbq_opts cbq_opts;
|
||||
struct priq_opts priq_opts;
|
||||
struct hfsc_opts hfsc_opts;
|
||||
} pq_u;
|
||||
|
||||
uint32_t qid; /* return value */
|
||||
};
|
||||
|
||||
#endif /* _NET_PF_ALTQ_H_ */
|
||||
181
sys/net/pfvar.h
181
sys/net/pfvar.h
@ -41,84 +41,10 @@
|
||||
#include <net/radix.h>
|
||||
#include <netinet/in.h>
|
||||
|
||||
#include <net/pf.h>
|
||||
#include <net/pf_altq.h>
|
||||
#include <net/pf_mtag.h>
|
||||
|
||||
#define PF_TCPS_PROXY_SRC ((TCP_NSTATES)+0)
|
||||
#define PF_TCPS_PROXY_DST ((TCP_NSTATES)+1)
|
||||
|
||||
#define PF_MD5_DIGEST_LENGTH 16
|
||||
#ifdef MD5_DIGEST_LENGTH
|
||||
#if PF_MD5_DIGEST_LENGTH != MD5_DIGEST_LENGTH
|
||||
#error
|
||||
#endif
|
||||
#endif
|
||||
|
||||
enum { PF_INOUT, PF_IN, PF_OUT };
|
||||
enum { PF_PASS, PF_DROP, PF_SCRUB, PF_NOSCRUB, PF_NAT, PF_NONAT,
|
||||
PF_BINAT, PF_NOBINAT, PF_RDR, PF_NORDR, PF_SYNPROXY_DROP, PF_DEFER };
|
||||
enum { PF_RULESET_SCRUB, PF_RULESET_FILTER, PF_RULESET_NAT,
|
||||
PF_RULESET_BINAT, PF_RULESET_RDR, PF_RULESET_MAX };
|
||||
enum { PF_OP_NONE, PF_OP_IRG, PF_OP_EQ, PF_OP_NE, PF_OP_LT,
|
||||
PF_OP_LE, PF_OP_GT, PF_OP_GE, PF_OP_XRG, PF_OP_RRG };
|
||||
enum { PF_DEBUG_NONE, PF_DEBUG_URGENT, PF_DEBUG_MISC, PF_DEBUG_NOISY };
|
||||
enum { PF_CHANGE_NONE, PF_CHANGE_ADD_HEAD, PF_CHANGE_ADD_TAIL,
|
||||
PF_CHANGE_ADD_BEFORE, PF_CHANGE_ADD_AFTER,
|
||||
PF_CHANGE_REMOVE, PF_CHANGE_GET_TICKET };
|
||||
enum { PF_GET_NONE, PF_GET_CLR_CNTR };
|
||||
enum { PF_SK_WIRE, PF_SK_STACK, PF_SK_BOTH };
|
||||
|
||||
/*
|
||||
* Note about PFTM_*: real indices into pf_rule.timeout[] come before
|
||||
* PFTM_MAX, special cases afterwards. See pf_state_expires().
|
||||
*/
|
||||
enum { PFTM_TCP_FIRST_PACKET, PFTM_TCP_OPENING, PFTM_TCP_ESTABLISHED,
|
||||
PFTM_TCP_CLOSING, PFTM_TCP_FIN_WAIT, PFTM_TCP_CLOSED,
|
||||
PFTM_UDP_FIRST_PACKET, PFTM_UDP_SINGLE, PFTM_UDP_MULTIPLE,
|
||||
PFTM_ICMP_FIRST_PACKET, PFTM_ICMP_ERROR_REPLY,
|
||||
PFTM_OTHER_FIRST_PACKET, PFTM_OTHER_SINGLE,
|
||||
PFTM_OTHER_MULTIPLE, PFTM_FRAG, PFTM_INTERVAL,
|
||||
PFTM_ADAPTIVE_START, PFTM_ADAPTIVE_END, PFTM_SRC_NODE,
|
||||
PFTM_TS_DIFF, PFTM_MAX, PFTM_PURGE, PFTM_UNLINKED,
|
||||
PFTM_UNTIL_PACKET };
|
||||
|
||||
/* PFTM default values */
|
||||
#define PFTM_TCP_FIRST_PACKET_VAL 120 /* First TCP packet */
|
||||
#define PFTM_TCP_OPENING_VAL 30 /* No response yet */
|
||||
#define PFTM_TCP_ESTABLISHED_VAL 24*60*60/* Established */
|
||||
#define PFTM_TCP_CLOSING_VAL 15 * 60 /* Half closed */
|
||||
#define PFTM_TCP_FIN_WAIT_VAL 45 /* Got both FINs */
|
||||
#define PFTM_TCP_CLOSED_VAL 90 /* Got a RST */
|
||||
#define PFTM_UDP_FIRST_PACKET_VAL 60 /* First UDP packet */
|
||||
#define PFTM_UDP_SINGLE_VAL 30 /* Unidirectional */
|
||||
#define PFTM_UDP_MULTIPLE_VAL 60 /* Bidirectional */
|
||||
#define PFTM_ICMP_FIRST_PACKET_VAL 20 /* First ICMP packet */
|
||||
#define PFTM_ICMP_ERROR_REPLY_VAL 10 /* Got error response */
|
||||
#define PFTM_OTHER_FIRST_PACKET_VAL 60 /* First packet */
|
||||
#define PFTM_OTHER_SINGLE_VAL 30 /* Unidirectional */
|
||||
#define PFTM_OTHER_MULTIPLE_VAL 60 /* Bidirectional */
|
||||
#define PFTM_FRAG_VAL 30 /* Fragment expire */
|
||||
#define PFTM_INTERVAL_VAL 10 /* Expire interval */
|
||||
#define PFTM_SRC_NODE_VAL 0 /* Source tracking */
|
||||
#define PFTM_TS_DIFF_VAL 30 /* Allowed TS diff */
|
||||
|
||||
enum { PF_NOPFROUTE, PF_FASTROUTE, PF_ROUTETO, PF_DUPTO, PF_REPLYTO };
|
||||
enum { PF_LIMIT_STATES, PF_LIMIT_SRC_NODES, PF_LIMIT_FRAGS,
|
||||
PF_LIMIT_TABLE_ENTRIES, PF_LIMIT_MAX };
|
||||
#define PF_POOL_IDMASK 0x0f
|
||||
enum { PF_POOL_NONE, PF_POOL_BITMASK, PF_POOL_RANDOM,
|
||||
PF_POOL_SRCHASH, PF_POOL_ROUNDROBIN };
|
||||
enum { PF_ADDR_ADDRMASK, PF_ADDR_NOROUTE, PF_ADDR_DYNIFTL,
|
||||
PF_ADDR_TABLE, PF_ADDR_URPFFAILED,
|
||||
PF_ADDR_RANGE };
|
||||
#define PF_POOL_TYPEMASK 0x0f
|
||||
#define PF_POOL_STICKYADDR 0x20
|
||||
#define PF_WSCALE_FLAG 0x80
|
||||
#define PF_WSCALE_MASK 0x0f
|
||||
|
||||
#define PF_LOG 0x01
|
||||
#define PF_LOG_ALL 0x02
|
||||
#define PF_LOG_SOCKET_LOOKUP 0x04
|
||||
|
||||
struct pf_addr {
|
||||
union {
|
||||
struct in_addr v4;
|
||||
@ -134,8 +60,6 @@ struct pf_addr {
|
||||
#define addr32 pfa.addr32
|
||||
};
|
||||
|
||||
#define PF_TABLE_NAME_SIZE 32
|
||||
|
||||
#define PFI_AFLAG_NETWORK 0x01
|
||||
#define PFI_AFLAG_BROADCAST 0x02
|
||||
#define PFI_AFLAG_PEER 0x04
|
||||
@ -564,7 +488,6 @@ struct pf_rule {
|
||||
union pf_rule_ptr skip[PF_SKIP_COUNT];
|
||||
#define PF_RULE_LABEL_SIZE 64
|
||||
char label[PF_RULE_LABEL_SIZE];
|
||||
#define PF_QNAME_SIZE 64
|
||||
char ifname[IFNAMSIZ];
|
||||
char qname[PF_QNAME_SIZE];
|
||||
char pqname[PF_QNAME_SIZE];
|
||||
@ -1195,43 +1118,6 @@ struct pf_pdesc {
|
||||
#define PF_DPORT_RANGE 0x01 /* Dest port uses range */
|
||||
#define PF_RPORT_RANGE 0x02 /* RDR'ed port uses range */
|
||||
|
||||
/* Reasons code for passing/dropping a packet */
|
||||
#define PFRES_MATCH 0 /* Explicit match of a rule */
|
||||
#define PFRES_BADOFF 1 /* Bad offset for pull_hdr */
|
||||
#define PFRES_FRAG 2 /* Dropping following fragment */
|
||||
#define PFRES_SHORT 3 /* Dropping short packet */
|
||||
#define PFRES_NORM 4 /* Dropping by normalizer */
|
||||
#define PFRES_MEMORY 5 /* Dropped due to lacking mem */
|
||||
#define PFRES_TS 6 /* Bad TCP Timestamp (RFC1323) */
|
||||
#define PFRES_CONGEST 7 /* Congestion (of ipintrq) */
|
||||
#define PFRES_IPOPTIONS 8 /* IP option */
|
||||
#define PFRES_PROTCKSUM 9 /* Protocol checksum invalid */
|
||||
#define PFRES_BADSTATE 10 /* State mismatch */
|
||||
#define PFRES_STATEINS 11 /* State insertion failure */
|
||||
#define PFRES_MAXSTATES 12 /* State limit */
|
||||
#define PFRES_SRCLIMIT 13 /* Source node/conn limit */
|
||||
#define PFRES_SYNPROXY 14 /* SYN proxy */
|
||||
#define PFRES_MAX 15 /* total+1 */
|
||||
|
||||
#define PFRES_NAMES { \
|
||||
"match", \
|
||||
"bad-offset", \
|
||||
"fragment", \
|
||||
"short", \
|
||||
"normalize", \
|
||||
"memory", \
|
||||
"bad-timestamp", \
|
||||
"congestion", \
|
||||
"ip-option", \
|
||||
"proto-cksum", \
|
||||
"state-mismatch", \
|
||||
"state-insert", \
|
||||
"state-limit", \
|
||||
"src-limit", \
|
||||
"synproxy", \
|
||||
NULL \
|
||||
}
|
||||
|
||||
/* Counters for other things we want to keep track of */
|
||||
#define LCNT_STATES 0 /* states */
|
||||
#define LCNT_SRCSTATES 1 /* max-src-states */
|
||||
@ -1322,69 +1208,6 @@ struct pf_status {
|
||||
u_int8_t pf_chksum[PF_MD5_DIGEST_LENGTH];
|
||||
};
|
||||
|
||||
struct cbq_opts {
|
||||
u_int minburst;
|
||||
u_int maxburst;
|
||||
u_int pktsize;
|
||||
u_int maxpktsize;
|
||||
u_int ns_per_byte;
|
||||
u_int maxidle;
|
||||
int minidle;
|
||||
u_int offtime;
|
||||
int flags;
|
||||
};
|
||||
|
||||
struct priq_opts {
|
||||
int flags;
|
||||
};
|
||||
|
||||
struct hfsc_opts {
|
||||
/* real-time service curve */
|
||||
u_int rtsc_m1; /* slope of the 1st segment in bps */
|
||||
u_int rtsc_d; /* the x-projection of m1 in msec */
|
||||
u_int rtsc_m2; /* slope of the 2nd segment in bps */
|
||||
/* link-sharing service curve */
|
||||
u_int lssc_m1;
|
||||
u_int lssc_d;
|
||||
u_int lssc_m2;
|
||||
/* upper-limit service curve */
|
||||
u_int ulsc_m1;
|
||||
u_int ulsc_d;
|
||||
u_int ulsc_m2;
|
||||
int flags;
|
||||
};
|
||||
|
||||
struct pf_altq {
|
||||
char ifname[IFNAMSIZ];
|
||||
|
||||
void *altq_disc; /* discipline-specific state */
|
||||
TAILQ_ENTRY(pf_altq) entries;
|
||||
|
||||
/* scheduler spec */
|
||||
u_int8_t scheduler; /* scheduler type */
|
||||
u_int16_t tbrsize; /* tokenbucket regulator size */
|
||||
u_int32_t ifbandwidth; /* interface bandwidth */
|
||||
|
||||
/* queue spec */
|
||||
char qname[PF_QNAME_SIZE]; /* queue name */
|
||||
char parent[PF_QNAME_SIZE]; /* parent name */
|
||||
u_int32_t parent_qid; /* parent queue id */
|
||||
u_int32_t bandwidth; /* queue bandwidth */
|
||||
u_int8_t priority; /* priority */
|
||||
u_int8_t local_flags; /* dynamic interface */
|
||||
#define PFALTQ_FLAG_IF_REMOVED 0x01
|
||||
|
||||
u_int16_t qlimit; /* queue size limit */
|
||||
u_int16_t flags; /* misc flags */
|
||||
union {
|
||||
struct cbq_opts cbq_opts;
|
||||
struct priq_opts priq_opts;
|
||||
struct hfsc_opts hfsc_opts;
|
||||
} pq_u;
|
||||
|
||||
u_int32_t qid; /* return value */
|
||||
};
|
||||
|
||||
struct pf_divert {
|
||||
union {
|
||||
struct in_addr ipv4;
|
||||
|
||||
Loading…
Reference in New Issue
Block a user