Print this page
OS-7667 IPFilter needs to keep and report state for cloud firewall logging
Portions contributed by: Mike Gerdts <mike.gerdts@joyent.com>

Split Close
Expand all
Collapse all
          --- old/usr/src/uts/common/inet/ipf/netinet/ip_fil.h
          +++ new/usr/src/uts/common/inet/ipf/netinet/ip_fil.h
   1    1  /*
   2    2   * Copyright (C) 1993-2001, 2003 by Darren Reed.
   3    3   *
   4    4   * See the IPFILTER.LICENCE file for details on licencing.
   5    5   *
   6    6   * @(#)ip_fil.h 1.35 6/5/96
   7    7   * $Id: ip_fil.h,v 2.170.2.22 2005/07/16 05:55:35 darrenr Exp $
   8    8   *
   9    9   * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
  10   10   *
  11      - * Copyright (c) 2014, Joyent, Inc.  All rights reserved.
       11 + * Copyright 2019, Joyent, Inc.
  12   12   */
  13   13  
  14   14  #ifndef __IP_FIL_H__
  15   15  #define __IP_FIL_H__
  16   16  
  17   17  #include "netinet/ip_compat.h"
  18   18  #include <sys/zone.h>
       19 +#include <sys/uuid.h>
  19   20  
  20   21  #ifdef  SOLARIS
  21   22  #undef  SOLARIS
  22   23  #endif
  23   24  #if (defined(sun) && (defined(__svr4__) || defined(__SVR4)))
  24   25  #define SOLARIS (1)
  25   26  #else
  26   27  #define SOLARIS (0)
  27   28  #endif
  28   29  
↓ open down ↓ 79 lines elided ↑ open up ↑
 108  109  # define        SIOCIPFITER     _IOWR(r, 92, struct ipfobj)
 109  110  # define        SIOCGENITER     _IOWR(r, 93, struct ipfobj)
 110  111  # define        SIOCGTABL       _IOWR(r, 94, struct ipfobj)
 111  112  # define        SIOCIPFDELTOK   _IOWR(r, 95, int)
 112  113  # define        SIOCLOOKUPITER  _IOWR(r, 96, struct ipfobj)
 113  114  #endif
 114  115  #define SIOCADDFR       SIOCADAFR
 115  116  #define SIOCDELFR       SIOCRMAFR
 116  117  #define SIOCINSFR       SIOCINAFR
 117  118  # define        SIOCIPFZONESET  _IOWR('r', 97, struct ipfzoneobj)
      119 +# define        SIOCIPFCFWCFG   _IOR('r', 98, struct ipfcfwcfg)
      120 +# define        SIOCIPFCFWNEWSZ _IOWR('r', 99, struct ipfcfwcfg)
 118  121  
 119  122  /*
 120  123   * What type of table is getting flushed?
 121  124   */
 122  125  
 123  126  #define NAT_FLUSH       1
 124  127  #define STATE_FLUSH     2
 125  128  
 126  129  /*
 127  130   * What table flush options are available?
↓ open down ↓ 464 lines elided ↑ open up ↑
 592  595           */
 593  596          ipfunc_t fr_func;       /* call this function */
 594  597          int     fr_dsize;
 595  598          int     fr_pps;
 596  599          int     fr_statemax;    /* max reference count */
 597  600          int     fr_flineno;     /* line number from conf file */
 598  601          u_32_t  fr_type;
 599  602          u_32_t  fr_flags;       /* per-rule flags && options (see below) */
 600  603          u_32_t  fr_logtag;      /* user defined log tag # */
 601  604          u_32_t  fr_collect;     /* collection number */
      605 +        uuid_t  fr_uuid;        /* user defined uuid */
 602  606          u_int   fr_arg;         /* misc. numeric arg for rule */ 
 603  607          u_int   fr_loglevel;    /* syslog log facility + priority */
 604  608          u_int   fr_age[2];      /* non-TCP timeouts */
 605  609          u_char  fr_v;
 606  610          u_char  fr_icode;       /* return ICMP code */
 607  611          char    fr_group[FR_GROUPLEN];  /* group to which this rule belongs */
 608  612          char    fr_grhead[FR_GROUPLEN]; /* group # which this rule starts */
 609  613          ipftag_t fr_nattag;
 610  614          char    fr_ifnames[4][LIFNAMSIZ];
 611  615          char    fr_isctag[16];
↓ open down ↓ 108 lines elided ↑ open up ↑
 720  724  #define FR_INQUE        0x08000 /* ingoing packets */
 721  725  #define FR_LOGBODY      0x10000 /* Log the body */
 722  726  #define FR_LOGFIRST     0x20000 /* Log the first byte if state held */
 723  727  #define FR_LOGORBLOCK   0x40000 /* block the packet if it can't be logged */
 724  728  #define FR_DUP          0x80000 /* duplicate packet */
 725  729  #define FR_FRSTRICT     0x100000        /* strict frag. cache */
 726  730  #define FR_STSTRICT     0x200000        /* strict keep state */
 727  731  #define FR_NEWISN       0x400000        /* new ISN for outgoing TCP */
 728  732  #define FR_NOICMPERR    0x800000        /* do not match ICMP errors in state */
 729  733  #define FR_STATESYNC    0x1000000       /* synchronize state to slave */
      734 +#define FR_CFWLOG       0x2000000       /* Global CFW logging enabled */
 730  735  #define FR_NOMATCH      0x8000000       /* no match occured */
 731  736                  /*      0x10000000      FF_LOGPASS */
 732  737                  /*      0x20000000      FF_LOGBLOCK */
 733  738                  /*      0x40000000      FF_LOGNOMATCH */
 734  739                  /*      0x80000000      FF_BLOCKNONIP */
 735  740  #define FR_COPIED       0x40000000      /* copied from user space */
 736  741  #define FR_INACTIVE     0x80000000      /* only used when flush'ing rules */
 737  742  
 738  743  #define FR_RETMASK      (FR_RETICMP|FR_RETRST|FR_FAKEICMP)
 739  744  #define FR_ISBLOCK(x)   (((x) & FR_CMDMASK) == FR_BLOCK)
↓ open down ↓ 135 lines elided ↑ open up ↑
 875  880  #if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199603)) || \
 876  881          (defined(OpenBSD) && (OpenBSD >= 199603))
 877  882  #else
 878  883          u_int   fl_unit;
 879  884  #endif
 880  885          u_32_t  fl_rule;
 881  886          u_32_t  fl_flags;
 882  887          u_32_t  fl_lflags;
 883  888          u_32_t  fl_logtag;
 884  889          ipftag_t        fl_nattag;
      890 +        uuid_t  fl_uuid;
 885  891          u_short fl_plen;        /* extra data after hlen */
 886  892          u_short fl_loglevel;    /* syslog log level */
 887  893          char    fl_group[FR_GROUPLEN];
 888  894          u_char  fl_hlen;        /* length of IP headers saved */
 889  895          u_char  fl_dir;
 890  896          u_char  fl_xxx[2];      /* pad */
 891  897          char    fl_ifname[LIFNAMSIZ];
 892  898  } ipflog_t;
 893  899  
 894  900  #ifndef IPF_LOGGING
↓ open down ↓ 28 lines elided ↑ open up ↑
 923  929  /*
 924  930   * Pathnames for various IP Filter control devices.  Used by LKM
 925  931   * and userland, so defined here.
 926  932   */
 927  933  #define IPNAT_NAME      "/dev/ipnat"
 928  934  #define IPSTATE_NAME    "/dev/ipstate"
 929  935  #define IPAUTH_NAME     "/dev/ipauth"
 930  936  #define IPSYNC_NAME     "/dev/ipsync"
 931  937  #define IPSCAN_NAME     "/dev/ipscan"
 932  938  #define IPLOOKUP_NAME   "/dev/iplookup"
      939 +#define IPFEV_NAME      "/dev/ipfev"
 933  940  
 934  941  #define IPL_LOGIPF      0       /* Minor device #'s for accessing logs */
 935  942  #define IPL_LOGNAT      1
 936  943  #define IPL_LOGSTATE    2
 937  944  #define IPL_LOGAUTH     3
 938  945  #define IPL_LOGSYNC     4
 939  946  #define IPL_LOGSCAN     5
 940  947  #define IPL_LOGLOOKUP   6
 941      -#define IPL_LOGCOUNT    7
 942      -#define IPL_LOGMAX      7
      948 +#define IPL_LOGEV       7
      949 +#define IPL_LOGCOUNT    8
      950 +#define IPL_LOGMAX      8
 943  951  #define IPL_LOGSIZE     (IPL_LOGMAX + 1)
 944  952  #define IPL_LOGALL      -1
 945  953  #define IPL_LOGNONE     -2
 946  954  
 947  955  /*
 948  956   * For SIOCGETFS
 949  957   */
 950  958  typedef struct  friostat        {
 951  959          struct  filterstats     f_st[2];
 952  960          struct  frentry         *f_ipf[2][2];
↓ open down ↓ 220 lines elided ↑ open up ↑
1173 1181  
1174 1182  /*
1175 1183   * ioctl struct for setting what zone further ioctls will act on. ipfz_gz is a
1176 1184   * boolean: set it to 1 to operate on the GZ-controlled stack.
1177 1185   */
1178 1186  typedef struct  ipfzoneobj      {
1179 1187          u_32_t          ipfz_gz;                        /* GZ stack boolean */
1180 1188          char            ipfz_zonename[ZONENAME_MAX];    /* zone to act on */
1181 1189  } ipfzoneobj_t;
1182 1190  
     1191 +/* ioctl to grab CFW logging parameters */
     1192 +typedef struct ipfcfwcfg {
     1193 +        /* CFG => Max event size, NEWSZ => ignored in, like CFG out. */
     1194 +        uint32_t ipfcfwc_maxevsize;
     1195 +        /*
     1196 +         * CFG => Current ring size,
     1197 +         * NEWSZ => New ring size, must be 2^N for 3 <= N <= 31.
     1198 +         */
     1199 +        uint32_t ipfcfwc_evringsize;
     1200 +        /* CFG => Number of event reports, NEWSZ => ignored in, like CFG out. */
     1201 +        uint64_t ipfcfwc_evreports;
     1202 +        /* CFG => Number of event drops, NEWSZ => ignored in, like CFG out. */
     1203 +        uint64_t ipfcfwc_evdrops;
     1204 +} ipfcfwcfg_t;
     1205 +
1183 1206  #if defined(_KERNEL)
1184 1207  /* Set ipfs_zoneid to this if no zone has been set: */
1185 1208  #define IPFS_ZONE_UNSET -2
1186 1209  
1187 1210  typedef struct  ipf_devstate    {
1188 1211          zoneid_t        ipfs_zoneid;
1189 1212          minor_t         ipfs_minor;
1190 1213          boolean_t       ipfs_gz;
1191 1214  } ipf_devstate_t;
1192 1215  #endif
↓ open down ↓ 359 lines elided ↑ open up ↑
1552 1575                                       ipf_stack_t *));
1553 1576  
1554 1577  extern  int     fr_loginit __P((ipf_stack_t *));
1555 1578  extern  int     ipflog_clear __P((minor_t, ipf_stack_t *));
1556 1579  extern  int     ipflog_read __P((minor_t, struct uio *, ipf_stack_t *));
1557 1580  extern  int     ipflog __P((fr_info_t *, u_int));
1558 1581  extern  int     ipllog __P((int, fr_info_t *, void **, size_t *, int *, int,
1559 1582                              ipf_stack_t *));
1560 1583  extern  void    fr_logunload __P((ipf_stack_t *));
1561 1584  
     1585 +/* SmartOS single-FD global-zone state accumulator (see cfw.c) */
     1586 +extern boolean_t ipf_cfwlog_enabled;
     1587 +struct ipstate; /* Ugggh. */
     1588 +extern void ipf_log_cfwlog __P((struct ipstate *, uint_t, ipf_stack_t *));
     1589 +extern void ipf_block_cfwlog __P((frentry_t *, fr_info_t *, ipf_stack_t *));
     1590 +#define IFS_CFWLOG(ifs, fr) ((ifs)->ifs_gz_controlled && ipf_cfwlog_enabled &&\
     1591 +        fr != NULL && ((fr)->fr_flags & FR_CFWLOG))
     1592 +struct cfwev_s; /* See ipf_cfw.h */
     1593 +extern boolean_t ipf_cfwev_consume __P((struct cfwev_s *, boolean_t));
     1594 +/* See cfw.c's ipf_cfwev_consume_many() for details. */
     1595 +typedef uint_t (*cfwmanycb_t) __P((struct cfwev_s *, uint_t, void *));
     1596 +extern uint_t
     1597 +        ipf_cfwev_consume_many __P((uint_t, boolean_t, cfwmanycb_t, void *));
     1598 +extern int ipf_cfwlog_read __P((dev_t, struct uio *, struct cred *));
     1599 +extern int ipf_cfwlog_ioctl __P((dev_t, int, intptr_t, int, cred_t *, int *));
     1600 +#define IPF_CFW_RING_ALLOCATE 0
     1601 +#define IPF_CFW_RING_DESTROY 1
     1602 +extern int ipf_cfw_ring_resize(uint32_t);
     1603 +
1562 1604  extern  frentry_t       *fr_acctpkt __P((fr_info_t *, u_32_t *));
1563 1605  extern  int             fr_copytolog __P((int, char *, int));
1564 1606  extern  u_short         fr_cksum __P((mb_t *, ip_t *, int, void *));
1565 1607  extern  void            fr_deinitialise __P((ipf_stack_t *));
1566 1608  extern  frentry_t       *fr_dolog __P((fr_info_t *, u_32_t *));
1567 1609  extern  frentry_t       *fr_dstgrpmap __P((fr_info_t *, u_32_t *));
1568 1610  extern  void            fr_fixskip __P((frentry_t **, frentry_t *, int));
1569 1611  extern  void            fr_forgetifp __P((void *, ipf_stack_t *));
1570 1612  extern  frentry_t       *fr_getrulen __P((int, char *, u_32_t, 
1571 1613                                            ipf_stack_t *));
↓ open down ↓ 50 lines elided ↑ open up ↑
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX