blob: 0ceea1e921bc6e2dc0d18ab6d2d41c92086ad29b (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
|
/*
* Copyright (C) 1993-2001, 2003 by Darren Reed.
*
* See the IPFILTER.LICENCE file for details on licencing.
*
* Copyright 2009 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*
* Copyright 2018 Joyent, Inc. All rights reserved.
*/
#ifndef __IPF_STACK_H__
#define __IPF_STACK_H__
/* FIXME: appears needed for ip_proxy.h - tcpseq */
#include <net/route.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netinet/ip_var.h>
#include <netinet/tcp.h>
#include <netinet/udp.h>
#include <netinet/ip_icmp.h>
#include <netinet/tcpip.h>
#include "ip_compat.h"
#include "ip_fil.h"
#include "ip_nat.h"
#include "ip_frag.h"
#include "ip_state.h"
#include "ip_proxy.h"
#include "ip_auth.h"
#include "ip_lookup.h"
#include "ip_pool.h"
#include "ip_htable.h"
#include <net/radix.h>
#include <sys/neti.h>
#include <sys/hook.h>
/*
* IPF stack instances
*/
struct ipf_stack {
struct ipf_stack *ifs_next;
struct ipf_stack **ifs_pnext;
struct ipf_stack *ifs_gz_cont_ifs;
netid_t ifs_netid;
zoneid_t ifs_zone;
boolean_t ifs_gz_controlled;
/* ipf module */
fr_info_t ifs_frcache[2][8];
filterstats_t ifs_frstats[2];
frentry_t *ifs_ipfilter[2][2];
frentry_t *ifs_ipfilter6[2][2];
frentry_t *ifs_ipacct6[2][2];
frentry_t *ifs_ipacct[2][2];
#if 0 /* not used */
frentry_t *ifs_ipnatrules[2][2];
#endif
frgroup_t *ifs_ipfgroups[IPL_LOGSIZE][2];
int ifs_fr_refcnt;
/*
* For fr_running:
* 0 == loading, 1 = running, -1 = disabled, -2 = unloading
*/
int ifs_fr_running;
int ifs_fr_flags;
int ifs_fr_active;
int ifs_fr_control_forwarding;
int ifs_fr_update_ipid;
#if 0
ushort_t ifs_fr_ip_id;
#endif
int ifs_fr_chksrc;
int ifs_fr_minttl;
int ifs_fr_icmpminfragmtu;
int ifs_fr_pass;
ulong_t ifs_fr_frouteok[2];
ulong_t ifs_fr_userifqs;
ulong_t ifs_fr_badcoalesces[2];
uchar_t ifs_ipf_iss_secret[32];
timeout_id_t ifs_fr_timer_id;
#if 0
timeout_id_t ifs_synctimeoutid;
#endif
int ifs_ipf_locks_done;
ipftoken_t *ifs_ipftokenhead;
ipftoken_t **ifs_ipftokentail;
ipfmutex_t ifs_ipl_mutex;
ipfmutex_t ifs_ipf_authmx;
ipfmutex_t ifs_ipf_rw;
ipfmutex_t ifs_ipf_timeoutlock;
ipfrwlock_t ifs_ipf_mutex;
ipfrwlock_t ifs_ipf_global;
ipfrwlock_t ifs_ipf_frcache;
ipfrwlock_t ifs_ip_poolrw;
ipfrwlock_t ifs_ipf_frag;
ipfrwlock_t ifs_ipf_state;
ipfrwlock_t ifs_ipf_nat;
ipfrwlock_t ifs_ipf_natfrag;
ipfmutex_t ifs_ipf_nat_new;
ipfmutex_t ifs_ipf_natio;
ipfrwlock_t ifs_ipf_auth;
ipfmutex_t ifs_ipf_stinsert;
ipfrwlock_t ifs_ipf_ipidfrag;
ipfrwlock_t ifs_ipf_tokens;
kcondvar_t ifs_iplwait;
kcondvar_t ifs_ipfauthwait;
ipftuneable_t *ifs_ipf_tuneables;
ipftuneable_t *ifs_ipf_tunelist;
/* ip_fil_solaris.c */
hook_t *ifs_ipfhook4_in;
hook_t *ifs_ipfhook4_out;
hook_t *ifs_ipfhook4_loop_in;
hook_t *ifs_ipfhook4_loop_out;
hook_t *ifs_ipfhook4_nicevents;
hook_t *ifs_ipfhook6_in;
hook_t *ifs_ipfhook6_out;
hook_t *ifs_ipfhook6_loop_in;
hook_t *ifs_ipfhook6_loop_out;
hook_t *ifs_ipfhook6_nicevents;
hook_t *ifs_ipfhookviona_in;
hook_t *ifs_ipfhookviona_out;
/* flags to indicate whether hooks are registered. */
boolean_t ifs_hook4_physical_in;
boolean_t ifs_hook4_physical_out;
boolean_t ifs_hook4_nic_events;
boolean_t ifs_hook4_loopback_in;
boolean_t ifs_hook4_loopback_out;
boolean_t ifs_hook6_physical_in;
boolean_t ifs_hook6_physical_out;
boolean_t ifs_hook6_nic_events;
boolean_t ifs_hook6_loopback_in;
boolean_t ifs_hook6_loopback_out;
boolean_t ifs_hookviona_physical_in;
boolean_t ifs_hookviona_physical_out;
int ifs_ipf_loopback;
net_handle_t ifs_ipf_ipv4;
net_handle_t ifs_ipf_ipv6;
net_handle_t ifs_ipf_viona;
/* ip_auth.c */
int ifs_fr_authsize;
int ifs_fr_authused;
int ifs_fr_defaultauthage;
int ifs_fr_auth_lock;
int ifs_fr_auth_init;
fr_authstat_t ifs_fr_authstats;
frauth_t *ifs_fr_auth;
mb_t **ifs_fr_authpkts;
int ifs_fr_authstart;
int ifs_fr_authend;
int ifs_fr_authnext;
frauthent_t *ifs_fae_list;
frentry_t *ifs_ipauth;
frentry_t *ifs_fr_authlist;
/* ip_frag.c */
ipfr_t *ifs_ipfr_list;
ipfr_t **ifs_ipfr_tail;
ipfr_t **ifs_ipfr_heads;
ipfr_t *ifs_ipfr_natlist;
ipfr_t **ifs_ipfr_nattail;
ipfr_t **ifs_ipfr_nattab;
ipfr_t *ifs_ipfr_ipidlist;
ipfr_t **ifs_ipfr_ipidtail;
ipfr_t **ifs_ipfr_ipidtab;
ipfrstat_t ifs_ipfr_stats;
int ifs_ipfr_inuse;
int ifs_ipfr_size;
int ifs_fr_ipfrttl;
int ifs_fr_frag_lock;
int ifs_fr_frag_init;
ulong_t ifs_fr_ticks;
frentry_t ifs_frblock;
/* ip_htable.c */
iphtable_t *ifs_ipf_htables[IPL_LOGSIZE];
ulong_t ifs_ipht_nomem[IPL_LOGSIZE];
ulong_t ifs_ipf_nhtables[IPL_LOGSIZE];
ulong_t ifs_ipf_nhtnodes[IPL_LOGSIZE];
/* ip_log.c */
iplog_t **ifs_iplh[IPL_LOGSIZE];
iplog_t *ifs_iplt[IPL_LOGSIZE];
iplog_t *ifs_ipll[IPL_LOGSIZE];
int ifs_iplused[IPL_LOGSIZE];
fr_info_t ifs_iplcrc[IPL_LOGSIZE];
int ifs_ipl_suppress;
int ifs_ipl_buffer_sz;
int ifs_ipl_logmax;
int ifs_ipl_logall;
int ifs_ipl_log_init;
int ifs_ipl_logsize;
/* ip_lookup.c */
ip_pool_stat_t ifs_ippoolstat;
int ifs_ip_lookup_inited;
/* ip_nat.c */
/* nat_table[0] -> hashed list sorted by inside (ip, port) */
/* nat_table[1] -> hashed list sorted by outside (ip, port) */
nat_t **ifs_nat_table[2];
nat_t *ifs_nat_instances;
ipnat_t *ifs_nat_list;
uint_t ifs_ipf_nattable_sz;
uint_t ifs_ipf_nattable_max;
uint_t ifs_ipf_natrules_sz;
uint_t ifs_ipf_rdrrules_sz;
uint_t ifs_ipf_hostmap_sz;
uint_t ifs_fr_nat_maxbucket;
uint_t ifs_fr_nat_maxbucket_reset;
uint32_t ifs_nat_masks;
uint32_t ifs_rdr_masks;
uint32_t ifs_nat6_masks[4];
uint32_t ifs_rdr6_masks[4];
ipnat_t **ifs_nat_rules;
ipnat_t **ifs_rdr_rules;
hostmap_t **ifs_maptable;
hostmap_t *ifs_ipf_hm_maplist;
ipftq_t ifs_nat_tqb[IPF_TCP_NSTATES];
ipftq_t ifs_nat_udptq;
ipftq_t ifs_nat_icmptq;
ipftq_t ifs_nat_iptq;
ipftq_t *ifs_nat_utqe;
int ifs_nat_logging;
ulong_t ifs_fr_defnatage;
ulong_t ifs_fr_defnatipage;
ulong_t ifs_fr_defnaticmpage;
natstat_t ifs_nat_stats;
int ifs_fr_nat_lock;
int ifs_fr_nat_init;
uint_t ifs_nat_flush_level_hi;
uint_t ifs_nat_flush_level_lo;
ulong_t ifs_nat_last_force_flush;
int ifs_nat_doflush;
/* ip_pool.c */
ip_pool_stat_t ifs_ipoolstat;
ip_pool_t *ifs_ip_pool_list[IPL_LOGSIZE];
/* ip_proxy.c */
ap_session_t *ifs_ap_sess_list;
aproxy_t *ifs_ap_proxylist;
aproxy_t *ifs_ap_proxies; /* copy of lcl_ap_proxies */
/* ip_state.c */
ipstate_t **ifs_ips_table;
ulong_t *ifs_ips_seed;
int ifs_ips_num;
ulong_t ifs_ips_last_force_flush;
uint_t ifs_state_flush_level_hi;
uint_t ifs_state_flush_level_lo;
ips_stat_t ifs_ips_stats;
ulong_t ifs_fr_tcpidletimeout;
ulong_t ifs_fr_tcpclosewait;
ulong_t ifs_fr_tcplastack;
ulong_t ifs_fr_tcptimeout;
ulong_t ifs_fr_tcpclosed;
ulong_t ifs_fr_tcphalfclosed;
ulong_t ifs_fr_udptimeout;
ulong_t ifs_fr_udpacktimeout;
ulong_t ifs_fr_icmptimeout;
ulong_t ifs_fr_icmpacktimeout;
int ifs_fr_statemax;
int ifs_fr_statesize;
int ifs_fr_state_doflush;
int ifs_fr_state_lock;
int ifs_fr_state_maxbucket;
int ifs_fr_state_maxbucket_reset;
int ifs_fr_state_init;
int ifs_fr_enable_active;
ipftq_t ifs_ips_tqtqb[IPF_TCP_NSTATES];
ipftq_t ifs_ips_udptq;
ipftq_t ifs_ips_udpacktq;
ipftq_t ifs_ips_iptq;
ipftq_t ifs_ips_icmptq;
ipftq_t ifs_ips_icmpacktq;
ipftq_t ifs_ips_deletetq;
ipftq_t *ifs_ips_utqe;
int ifs_ipstate_logging;
ipstate_t *ifs_ips_list;
ulong_t ifs_fr_iptimeout;
/* radix.c */
int ifs_max_keylen;
struct radix_mask *ifs_rn_mkfreelist;
struct radix_node_head *ifs_mask_rnhead;
char *ifs_addmask_key;
char *ifs_rn_zeros;
char *ifs_rn_ones;
#ifdef KERNEL
/* kstats for inbound and outbound */
kstat_t *ifs_kstatp[2];
#endif
};
#endif /* __IPF_STACK_H__ */
|
