/*
 * Copyright (c) 1993 Daniel Boulet
 * Copyright (c) 1994 Ugen J.S.Antsilevich
 * Copyright (c) 2002 Luigi Rizzo, Universita` di Pisa
 * Copyright (c) 2015 - 2018 The DragonFly Project.  All rights reserved.
 *
 * This code is derived from software contributed to The DragonFly Project
 * by Bill Yuan <bycn82@dragonflybsd.org>
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 * 3. Neither the name of The DragonFly Project nor the names of its
 *    contributors may be used to endorse or promote products derived
 *    from this software without specific, prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 */

#ifndef _IP_FW3_H_
#define _IP_FW3_H_

/*
 * _IPFW2_H is from ipfw/ip_fw2.h, both cannot be included past this
 * point but we need both the IPFW2_LOADED and IPFW3_LOADED macros
 */
#ifndef _IPFW2_H


#include <net/bpf.h>


#define NEED1(msg)  {if (ac < 1) errx(EX_USAGE, msg);}
#define NEED2(msg)  {if (ac < 2) errx(EX_USAGE, msg);}
#define NEED(c, n, msg) {if (c < n) errx(EX_USAGE, msg);}

#define NEXT_ARG	ac--; if(ac > 0){av++;}
#define NEXT_ARG1 	(*ac)--; if(*ac > 0){(*av)++;}
#define SWAP_ARG				\
do { 						\
	if (ac > 2 && isdigit(*(av[1]))) {	\
		char *p = av[1];		\
		av[1] = av[2];			\
		av[2] = p;			\
	}					\
} while (0)

#define IPFW_RULE_SIZE_MAX	255	/* unit: uint32_t */

/*
 * type of the keyword, it indecates the position of the keyword in the rule
 *      BEFORE ACTION FROM TO FILTER OTHER
 */
#define NONE            0
#define BEFORE          1
#define ACTION          2
#define PROTO           3
#define FROM            4
#define TO              5
#define FILTER          6
#define AFTER           7

#define NOT_IN_USE      0
#define IN_USE          1

#define	SIZE_OF_IPFWINSN	8
#define	LEN_OF_IPFWINSN		2
#define	IPFW_DEFAULT_RULE	65535
#define	IPFW_DEFAULT_SET	0
#define	IPFW_ALL_SETS		0

/*
 * Template for instructions.
 *
 * ipfw_insn is used for all instructions which require no operands,
 * a single 16-bit value (arg1), or a couple of 8-bit values.
 *
 * For other instructions which require different/larger arguments
 * we have derived structures, ipfw_insn_*.
 *
 * The size of the instruction (in 32-bit words) is in the low
 * 6 bits of "len". The 2 remaining bits are used to implement
 * NOT and OR on individual instructions. Given a type, you can
 * compute the length to be put in "len" using F_INSN_SIZE(t)
 *
 * F_NOT	negates the match result of the instruction.
 *
 * F_OR		is used to build or blocks. By default, instructions
 *		are evaluated as part of a logical AND. An "or" block
 *		{ X or Y or Z } contains F_OR set in all but the last
 *		instruction of the block. A match will cause the code
 *		to skip past the last instruction of the block.
 *
 * NOTA BENE: in a couple of places we assume that
 *	sizeof(ipfw_insn) == sizeof(uint32_t)
 * this needs to be fixed.
 *
 */

#define	F_NOT		0x80
#define	F_OR		0x40
#define	F_LEN_MASK	0x3f
#define	F_LEN(cmd)	((cmd)->len & F_LEN_MASK)

typedef struct	_ipfw_insn {	/* template for instructions */
	uint8_t		opcode;
	uint8_t		len;	/* numer of 32-byte words */
	uint16_t	arg1;

	uint8_t		module;
	uint8_t		arg3;
	uint16_t	arg2;
} ipfw_insn;

#define ACTION_PTR(rule)	\
	(ipfw_insn *)((uint32_t *)((rule)->cmd) + ((rule)->act_ofs))

/*
 * The F_INSN_SIZE(type) computes the size, in 4-byte words, of
 * a given type.
 */
#define	F_INSN_SIZE(t)	((sizeof (t))/sizeof(uint32_t))

#define MTAG_IPFW	1148380143	/* IPFW-tagged cookie */

/*
 * This is used to store an array of 16-bit entries (ports etc.)
 */
typedef struct	_ipfw_insn_u16 {
	ipfw_insn o;
	uint16_t ports[2];	/* there may be more */
} ipfw_insn_u16;

/*
 * This is used to store an array of 32-bit entries
 * (uid, single IPv4 addresses etc.)
 */
typedef struct	_ipfw_insn_u32 {
	ipfw_insn o;
	uint32_t d[1];	/* one or more */
} ipfw_insn_u32;

/*
 * This is used to store IP addr-mask pairs.
 */
typedef struct	_ipfw_insn_ip {
	ipfw_insn o;
	struct in_addr	addr;
	struct in_addr	mask;
} ipfw_insn_ip;

/*
 * This is used to forward to a given address (ip)
 */
typedef struct  _ipfw_insn_sa {
	ipfw_insn o;
	struct sockaddr_in sa;
} ipfw_insn_sa;

/*
 * This is used for MAC addr-mask pairs.
 */
typedef struct	_ipfw_insn_mac {
	ipfw_insn o;
	u_char addr[12];	/* dst[6] + src[6] */
	u_char mask[12];	/* dst[6] + src[6] */
} ipfw_insn_mac;

/*
 * This is used for interface match rules (recv xx, xmit xx)
 */
typedef struct	_ipfw_insn_if {
	ipfw_insn o;
	union {
		struct in_addr ip;
		int glob;
	} p;
	char name[IFNAMSIZ];
} ipfw_insn_if;

/*
 * This is used for pipe and queue actions, which need to store
 * a single pointer (which can have different size on different
 * architectures.
 */
typedef struct	_ipfw_insn_pipe {
	ipfw_insn	o;
	void		*pipe_ptr;
} ipfw_insn_pipe;

/*
 * This is used for limit rules.
 */
typedef struct	_ipfw_insn_limit {
	ipfw_insn o;
	uint8_t _pad;
	uint8_t limit_mask;	/* combination of DYN_* below	*/
#define	DYN_SRC_ADDR	0x1
#define	DYN_SRC_PORT	0x2
#define	DYN_DST_ADDR	0x4
#define	DYN_DST_PORT	0x8

	uint16_t conn_limit;
} ipfw_insn_limit;

/*
 * This is used for bpf filtering.
 */
typedef struct _ipfw_insn_bpf {
	ipfw_insn o;
	char bf_str[128];
	u_int bf_len;
	struct bpf_insn bf_insn[1];
} ipfw_insn_bpf;

/*
 * Here we have the structure representing an ipfw rule.
 *
 * It starts with a general area (with link fields and counters)
 * followed by an array of one or more instructions, which the code
 * accesses as an array of 32-bit values.
 *
 * Given a rule pointer  r:
 *
 *  r->cmd		is the start of the first instruction.
 *  ACTION_PTR(r)	is the start of the first action (things to do
 *			once a rule matched).
 *
 * When assembling instruction, remember the following:
 *
 *  + if a rule has a "keep-state" (or "limit") option, then the
 *	first instruction (at r->cmd) MUST BE an O_PROBE_STATE
 *  + if a rule has a "log" option, then the first action
 *	(at ACTION_PTR(r)) MUST be O_LOG
 *
 * NOTE: we use a simple linked list of rules because we never need
 * 	to delete a rule without scanning the list. We do not use
 *	queue(3) macros for portability and readability.
 */

struct ip_fw {
	struct ip_fw	*next;		/* linked list of rules		*/
	struct ip_fw	*next_rule;	/* ptr to next [skipto] rule	*/
	uint16_t	act_ofs;	/* offset of action in 32-bit units */
	uint16_t	cmd_len;	/* # of 32-bit words in cmd	*/
	uint16_t	rulenum;	/* rule number			*/
	uint8_t		set;		/* rule set (0..31)		*/
	uint8_t		flags;		/* IPFW_USR_F_			*/

	/* These fields are present in all rules.			*/
	uint64_t	pcnt;		/* Packet counter		*/
	uint64_t	bcnt;		/* Byte counter			*/
	uint32_t	timestamp;	/* tv_sec of last match		*/

	struct ip_fw 	*sibling;	/* pointer to the rule in next CPU */

	ipfw_insn	cmd[1];		/* storage for commands		*/
};
#define LEN_FW3 sizeof(struct ip_fw)

#define IPFW_RULE_F_INVALID	0x1
#define IPFW_RULE_F_STATE	0x2

#define RULESIZE(rule) (sizeof(struct ip_fw) + (rule)->cmd_len * 4 - SIZE_OF_IPFWINSN)

/*
 * This structure is used as a flow mask and a flow id for various
 * parts of the code.
 */
struct ipfw_flow_id {
	uint32_t	dst_ip;
	uint32_t	src_ip;
	uint16_t	dst_port;
	uint16_t	src_port;
	uint8_t		proto;
	uint8_t		flags;	/* protocol-specific flags */
};


/* ip_fw3_chk/ip_fw_chk_ptr return values */
#define IP_FW_PASS	0
#define IP_FW_DENY	1
#define IP_FW_DIVERT	2
#define IP_FW_TEE	3
#define IP_FW_DUMMYNET	4
#define IP_FW_NAT	5
#define IP_FW_ROUTE	6

/* ip_fw3_chk controller values */
#define IP_FW_CTL_NO		0
#define IP_FW_CTL_DONE		1
#define IP_FW_CTL_AGAIN		2
#define IP_FW_CTL_NEXT		3
#define IP_FW_CTL_NAT		4
#define IP_FW_CTL_LOOP		5
#define IP_FW_CTL_CHK_STATE	6

#define IP_FW_NOT_MATCH		0
#define IP_FW_MATCH		1

/*
 * arguments for calling ip_fw3_chk() and dummynet_io(). We put them
 * all into a structure because this way it is easier and more
 * efficient to pass variables around and extend the interface.
 */
struct ip_fw_args {
	struct mbuf	*m;		/* the mbuf chain		*/
	struct ifnet	*oif;		/* output interface		*/
	struct ip_fw	*rule;		/* matching rule		*/
	struct ether_header *eh;	/* for bridged packets		*/

	struct ipfw_flow_id f_id;	/* grabbed from IP header	*/

	/*
	 * Depend on the return value of ip_fw3_chk/ip_fw_chk_ptr
	 * 'cookie' field may save following information:
	 *
	 * IP_FW_DUMMYNET
	 *   The pipe or queue number
	 */
	uint32_t	cookie;
};

struct ipfw_ioc_rule {
	uint16_t	act_ofs;	/* offset of action in 32-bit units */
	uint16_t	cmd_len;	/* # of 32-bit words in cmd	*/
	uint16_t	rulenum;	/* rule number			*/
	uint8_t		set;		/* rule set (0..31)		*/
	uint8_t         insert;         /* insert or append     	*/

	/* Rule set information */
	uint32_t	sets;	/* disabled rule sets		*/

	/* Statistics */
	uint64_t	pcnt;		/* Packet counter		*/
	uint64_t	bcnt;		/* Byte counter			*/
	uint32_t	timestamp;	/* tv_sec of last match		*/

	ipfw_insn	cmd[1];		/* storage for commands		*/
};

#define IOC_RULESIZE(rule)	\
	(sizeof(struct ipfw_ioc_rule) + (rule)->cmd_len * 4 - SIZE_OF_IPFWINSN)


/* IP_FW_X header/opcodes */
typedef struct _ip_fw_x_header {
	uint16_t opcode;	/* Operation opcode */
	uint16_t _pad;   	/* Opcode version */
} ip_fw_x_header;

/* IP_FW3 opcodes */
#define IP_FW_ADD		50   /* add a firewall rule to chain */
#define IP_FW_DEL		51   /* delete a firewall rule from chain */
#define IP_FW_FLUSH		52   /* flush firewall rule chain */
#define IP_FW_ZERO		53   /* clear single/all firewall counter(s) */
#define IP_FW_GET		54   /* get entire firewall rule chain */
#define IP_FW_RESETLOG		55   /* reset logging counters */

#define IP_FW_STATE_ADD		56   /* add one state */
#define IP_FW_STATE_DEL		57   /* delete states of one rulenum */
#define IP_FW_STATE_FLUSH	58   /* flush all states */
#define IP_FW_STATE_GET		59   /* get all states */

#define IP_DUMMYNET_CONFIGURE	60   /* add/configure a dummynet pipe */
#define IP_DUMMYNET_DEL		61   /* delete a dummynet pipe from chain */
#define IP_DUMMYNET_FLUSH	62   /* flush dummynet */
#define IP_DUMMYNET_GET		64   /* get entire dummynet pipes */

#define IP_FW_MODULE		67  /* get modules names */

#define IP_FW_NAT_ADD		68   /* add/config a nat rule */
#define IP_FW_NAT_DEL		69   /* delete a nat rule */
#define IP_FW_NAT_FLUSH		70   /* get configuration of a nat rule */
#define IP_FW_NAT_GET		71   /* get config of a nat rule */
#define IP_FW_NAT_GET_RECORD	72   /* get nat record of a nat rule */

#define IP_FW_TABLE_CREATE	73	/* table_create 	*/
#define IP_FW_TABLE_DELETE	74	/* table_delete 	*/
#define IP_FW_TABLE_APPEND	75	/* table_append 	*/
#define IP_FW_TABLE_REMOVE	76	/* table_remove 	*/
#define IP_FW_TABLE_LIST	77	/* table_list 		*/
#define IP_FW_TABLE_FLUSH	78	/* table_flush 		*/
#define IP_FW_TABLE_SHOW	79	/* table_show 		*/
#define IP_FW_TABLE_TEST	80	/* table_test 		*/
#define IP_FW_TABLE_RENAME	81	/* rename a table 	*/

/* opcodes for ipfw3sync */
#define IP_FW_SYNC_SHOW_CONF	82	/* show sync config */
#define IP_FW_SYNC_SHOW_STATUS	83	/* show edge & centre running status */

#define IP_FW_SYNC_EDGE_CONF	84	/* config sync edge */
#define IP_FW_SYNC_EDGE_START	85	/* start the edge */
#define IP_FW_SYNC_EDGE_STOP	86	/* stop the edge */
#define IP_FW_SYNC_EDGE_TEST	87	/* test sync edge */
#define IP_FW_SYNC_EDGE_CLEAR	88	/* stop and clear the edge */

#define IP_FW_SYNC_CENTRE_CONF	89	/* config sync centre */
#define IP_FW_SYNC_CENTRE_START	90	/* start the centre */
#define IP_FW_SYNC_CENTRE_STOP	91	/* stop the centre */
#define IP_FW_SYNC_CENTRE_TEST	92	/* test sync centre */
#define IP_FW_SYNC_CENTRE_CLEAR	93	/* stop and clear the centre */

#define IP_FW_SET_GET		95	/* get the set config */
#define IP_FW_SET_MOVE_RULE	96	/* move a rule to set */
#define IP_FW_SET_MOVE_SET	97	/* move all rules from set a to b */
#define IP_FW_SET_SWAP		98	/* swap 2 sets	*/
#define IP_FW_SET_TOGGLE	99	/* enable/disable a set	*/
#define IP_FW_SET_FLUSH		100	/* flush the rule of the set */

#endif /* _IPFW2_H */
#ifdef _KERNEL

#include <net/netisr2.h>

int     ip_fw3_sockopt(struct sockopt *);

extern int ip_fw3_loaded;

#define	IPFW3_LOADED	(ip_fw3_loaded)

#ifdef IPFIREWALL3_DEBUG
#define IPFW3_DEBUG1(str)		\
do { 					\
	kprintf(str); 			\
} while (0)
#define IPFW3_DEBUG(fmt, ...)		\
do { 					\
	kprintf(fmt, __VA_ARGS__); 	\
} while (0)
#else
#define IPFW3_DEBUG1(str)		((void)0)
#define IPFW3_DEBUG(fmt, ...)		((void)0)
#endif

typedef int	ip_fw_ctl_t(struct sockopt *);
typedef int	ip_fw_chk_t(struct ip_fw_args *);
typedef struct mbuf *ip_fw_dn_io_t(struct mbuf *, int, int, struct ip_fw_args *);
typedef void *ip_fw_log_t(struct mbuf *m, struct ether_header *eh, uint16_t id);

#ifndef _IPFW2_H

int	ip_fw_sockopt(struct sockopt *);

struct sockopt;
struct dn_flow_set;


extern ip_fw_chk_t	*ip_fw_chk_ptr;
extern ip_fw_ctl_t	*ip_fw_ctl_x_ptr;
extern ip_fw_dn_io_t	*ip_fw_dn_io_ptr;


#define	IPFW_TABLES_MAX		32
#define	IPFW_USR_F_NORULE	0x01
#define	IPFW_CFGCPUID		0
#define	IPFW_CFGPORT		netisr_cpuport(IPFW_CFGCPUID)
#define	IPFW_ASSERT_CFGPORT(msgport)				\
	KASSERT((msgport) == IPFW_CFGPORT, ("not IPFW CFGPORT"))


/* root of place holding all information, per-cpu */
struct ipfw3_context {
	struct ip_fw			*rules;    /* rules*/
	struct ip_fw			*default_rule;  /* default rule*/
	struct ipfw3_state_context	*state_ctx;
	struct ipfw3_table_context	*table_ctx;

	/* each bit represents a disabled set, 0 is the default set */
	uint32_t			sets;
};
#define LEN_FW3_CTX sizeof(struct ipfw3_context)

struct ipfw3_module{
	int 	type;
	int 	id;
	char 	name[20];
};


/*
 * Definitions for IP option names.
 */
#define	IP_FW_IPOPT_LSRR	0x01
#define	IP_FW_IPOPT_SSRR	0x02
#define	IP_FW_IPOPT_RR		0x04
#define	IP_FW_IPOPT_TS		0x08

/*
 * Definitions for TCP option names.
 */
#define	IP_FW_TCPOPT_MSS	0x01
#define	IP_FW_TCPOPT_WINDOW	0x02
#define	IP_FW_TCPOPT_SACK	0x04
#define	IP_FW_TCPOPT_TS		0x08
#define	IP_FW_TCPOPT_CC		0x10

#define	ICMP_REJECT_RST		0x100	/* fake ICMP code (send a TCP RST) */

#define MATCH_REVERSE	0
#define MATCH_FORWARD	1
#define MATCH_NONE	2
#define MATCH_UNKNOWN	3

#define L3HDR(T, ip) ((T *)((uint32_t *)(ip) + (ip)->ip_hl))


typedef void (*filter_func)(int *cmd_ctl,int *cmd_val,struct ip_fw_args **args,
			struct ip_fw **f,ipfw_insn *cmd, uint16_t ip_len);

void	check_accept(int *cmd_ctl, int *cmd_val, struct ip_fw_args **args,
		struct ip_fw **f, ipfw_insn *cmd, uint16_t ip_len);
void	check_deny(int *cmd_ctl, int *cmd_val, struct ip_fw_args **args,
		struct ip_fw **f, ipfw_insn *cmd, uint16_t ip_len);

void    ip_fw3_register_module(int module_id,char *module_name);
int     ip_fw3_unregister_module(int module_id);
void    ip_fw3_register_filter_funcs(int module, int opcode, filter_func func);
void 	ip_fw3_unregister_filter_funcs(int module,filter_func func);

void	init_module(void);
int	ip_fw3_free_rule(struct ip_fw *rule);
int	ip_fw3_chk(struct ip_fw_args *args);
struct mbuf *ip_fw3_dummynet_io(struct mbuf *m, int pipe_nr, int dir, struct ip_fw_args *fwa);
void	add_rule_dispatch(netmsg_t nmsg);
void	ip_fw3_add_rule(struct ipfw_ioc_rule *ioc_rule);
struct ip_fw *ip_fw3_delete_rule(struct ipfw3_context *ctx,
		 struct ip_fw *prev, struct ip_fw *rule);
void	flush_rule_dispatch(netmsg_t nmsg);
void	ip_fw3_ctl_flush_rule(int);
void	delete_rule_dispatch(netmsg_t nmsg);
int	ip_fw3_ctl_delete_rule(struct sockopt *sopt);
void	ip_fw3_clear_counters(struct ip_fw *rule);
void	ip_fw3_zero_entry_dispatch(netmsg_t nmsg);
int	ip_fw3_ctl_zero_entry(int rulenum, int log_only);
int	ip_fw3_ctl_add_rule(struct sockopt *sopt);
int	ip_fw3_ctl_get_modules(struct sockopt *sopt);
int	ip_fw3_ctl_get_rules(struct sockopt *sopt);
int	ip_fw3_ctl_x(struct sockopt *sopt);
int	ip_fw3_ctl(struct sockopt *sopt);
int	ip_fw3_ctl_sockopt(struct sockopt *sopt);
int	ip_fw3_check_in(void *arg, struct mbuf **m0, struct ifnet *ifp, int dir);
int	ip_fw3_check_out(void *arg, struct mbuf **m0, struct ifnet *ifp, int dir);
void	ip_fw3_hook(void);
void	ip_fw3_dehook(void);
void	ip_fw3_sysctl_enable_dispatch(netmsg_t nmsg);
void	ctx_init_dispatch(netmsg_t nmsg);
void	init_dispatch(netmsg_t nmsg);
int	ip_fw3_init(void);
void	fini_dispatch(netmsg_t nmsg);
int	ip_fw3_fini(void);

#endif /* _KERNEL */
#endif /* _IPFW2_H */
#endif /* _IP_FW3_H_ */