/*      $NetBSD: if_pfsync.h,v 1.4 2018/09/14 05:09:51 maxv Exp $       */
/*      $OpenBSD: if_pfsync.h,v 1.31 2007/05/31 04:11:42 mcbride Exp $  */

/*
 * Copyright (c) 2001 Michael Shalayeff
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR OR HIS RELATIVES BE LIABLE FOR ANY DIRECT,
 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 * SERVICES; LOSS OF MIND, USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
 * THE POSSIBILITY OF SUCH DAMAGE.
 */

#ifndef _NET_IF_PFSYNC_H_
#define _NET_IF_PFSYNC_H_

#define  INADDR_PFSYNC_GROUP     __IPADDR(0xe00000f0)    /* 224.0.0.240 */

#define PFSYNC_ID_LEN   sizeof(u_int64_t)

struct pfsync_tdb {
        u_int32_t       spi;
        union sockaddr_union dst;
        u_int32_t       rpl;
        u_int64_t       cur_bytes;
        u_int8_t        sproto;
        u_int8_t        updates;
        u_int8_t        pad[2];
} __packed;

struct pfsync_state_upd {
        u_int32_t               id[2];
        struct pfsync_state_peer        src;
        struct pfsync_state_peer        dst;
        u_int32_t               creatorid;
        u_int32_t               expire;
        u_int8_t                timeout;
        u_int8_t                updates;
        u_int8_t                pad[6];
} __packed;

struct pfsync_state_del {
        u_int32_t               id[2];
        u_int32_t               creatorid;
        struct {
                u_int8_t        state;
        } src;
        struct {
                u_int8_t        state;
        } dst;
        u_int8_t                pad[2];
} __packed;

struct pfsync_state_upd_req {
        u_int32_t               id[2];
        u_int32_t               creatorid;
        u_int32_t               pad;
} __packed;

struct pfsync_state_clr {
        char                    ifname[IFNAMSIZ];
        u_int32_t               creatorid;
        u_int32_t               pad;
} __packed;

struct pfsync_state_bus {
        u_int32_t               creatorid;
        u_int32_t               endtime;
        u_int8_t                status;
#define PFSYNC_BUS_START        1
#define PFSYNC_BUS_END          2
        u_int8_t                pad[7];
} __packed;

#ifdef _KERNEL

union sc_statep {
        struct pfsync_state     *s;
        struct pfsync_state_upd *u;
        struct pfsync_state_del *d;
        struct pfsync_state_clr *c;
        struct pfsync_state_bus *b;
        struct pfsync_state_upd_req     *r;
};

union sc_tdb_statep {
        struct pfsync_tdb       *t;
};

extern int      pfsync_sync_ok;

struct pfsync_softc {
        struct ifnet             sc_if;
        struct ifnet            *sc_sync_ifp;

        struct ip_moptions       sc_imo;
        struct callout           sc_tmo;
        struct callout           sc_tdb_tmo;
        struct callout           sc_bulk_tmo;
        struct callout           sc_bulkfail_tmo;
        struct in_addr           sc_sync_peer;
        struct in_addr           sc_sendaddr;
        struct mbuf             *sc_mbuf;       /* current cumulative mbuf */
        struct mbuf             *sc_mbuf_net;   /* current cumulative mbuf */
        struct mbuf             *sc_mbuf_tdb;   /* dito for TDB updates */
        union sc_statep          sc_statep;
        union sc_statep          sc_statep_net;
        union sc_tdb_statep      sc_statep_tdb;
        u_int32_t                sc_ureq_received;
        u_int32_t                sc_ureq_sent;
        struct pf_state         *sc_bulk_send_next;
        struct pf_state         *sc_bulk_terminator;
        int                      sc_bulk_tries;
        int                      sc_maxcount;   /* number of states in mtu */
        int                      sc_maxupdates; /* number of updates/state */
};

extern struct pfsync_softc      *pfsyncif;
#endif


struct pfsync_header {
        u_int8_t version;
#define PFSYNC_VERSION  3
        u_int8_t af;
        u_int8_t action;
#define PFSYNC_ACT_CLR          0       /* clear all states */
#define PFSYNC_ACT_INS          1       /* insert state */
#define PFSYNC_ACT_UPD          2       /* update state */
#define PFSYNC_ACT_DEL          3       /* delete state */
#define PFSYNC_ACT_UPD_C        4       /* "compressed" state update */
#define PFSYNC_ACT_DEL_C        5       /* "compressed" state delete */
#define PFSYNC_ACT_INS_F        6       /* insert fragment */
#define PFSYNC_ACT_DEL_F        7       /* delete fragments */
#define PFSYNC_ACT_UREQ         8       /* request "uncompressed" state */
#define PFSYNC_ACT_BUS          9       /* Bulk Update Status */
#define PFSYNC_ACT_TDB_UPD      10      /* TDB replay counter update */
#define PFSYNC_ACT_MAX          11
        u_int8_t count;
        u_int8_t pf_chksum[PF_MD5_DIGEST_LENGTH];
} __packed;

#define PFSYNC_BULKPACKETS      1       /* # of packets per timeout */
#define PFSYNC_MAX_BULKTRIES    12
#define PFSYNC_HDRLEN   sizeof(struct pfsync_header)
#define PFSYNC_ACTIONS \
        "CLR ST", "INS ST", "UPD ST", "DEL ST", \
        "UPD ST COMP", "DEL ST COMP", "INS FR", "DEL FR", \
        "UPD REQ", "BLK UPD STAT", "TDB UPD"

#define PFSYNC_DFLTTL           255

#define PFSYNC_STAT_IPACKETS    0       /* total input packets, IPv4 */
#define PFSYNC_STAT_IPACKETS6   1       /* total input packets, IPv6 */
#define PFSYNC_STAT_BADIF               2       /* not the right interface */
#define PFSYNC_STAT_BADTTL              3       /* TTL is not PFSYNC_DFLTTL */
#define PFSYNC_STAT_HDROPS              4       /* packets shorter than hdr */
#define PFSYNC_STAT_BADVER              5       /* bad (incl unsupp) version */
#define PFSYNC_STAT_BADACT              6       /* bad action */
#define PFSYNC_STAT_BADLEN              7       /* data length does not match */
#define PFSYNC_STAT_BADAUTH             8       /* bad authentication */
#define PFSYNC_STAT_STALE               9       /* stale state */
#define PFSYNC_STAT_BADVAL              10      /* bad values */
#define PFSYNC_STAT_BADSTATE    11      /* insert/lookup failed */
#define PFSYNC_STAT_OPACKETS    12      /* total output packets, IPv4 */
#define PFSYNC_STAT_OPACKETS6   13      /* total output packets, IPv6 */
#define PFSYNC_STAT_ONOMEM              14      /* no memory for an mbuf */
#define PFSYNC_STAT_OERRORS             15      /* ip output error */

#define PFSYNC_NSTATS                   16

/*
 * Configuration structure for SIOCSETPFSYNC SIOCGETPFSYNC
 */
struct pfsyncreq {
        char             pfsyncr_syncdev[IFNAMSIZ];
        struct in_addr   pfsyncr_syncpeer;
        int              pfsyncr_maxupdates;
        int              pfsyncr_authlevel;
};


/* for copies to/from network */
#define pf_state_peer_hton(s,d) do {            \
        (d)->seqlo = htonl((s)->seqlo);         \
        (d)->seqhi = htonl((s)->seqhi);         \
        (d)->seqdiff = htonl((s)->seqdiff);     \
        (d)->max_win = htons((s)->max_win);     \
        (d)->mss = htons((s)->mss);             \
        (d)->state = (s)->state;                \
        (d)->wscale = (s)->wscale;              \
        if ((s)->scrub) {                                               \
                (d)->scrub.pfss_flags =                                 \
                    htons((s)->scrub->pfss_flags & PFSS_TIMESTAMP);     \
                (d)->scrub.pfss_ttl = (s)->scrub->pfss_ttl;             \
                (d)->scrub.pfss_ts_mod = htonl((s)->scrub->pfss_ts_mod);\
                (d)->scrub.scrub_flag = PFSYNC_SCRUB_FLAG_VALID;        \
        }                                                               \
} while (0)

#define pf_state_peer_ntoh(s,d) do {            \
        (d)->seqlo = ntohl((s)->seqlo);         \
        (d)->seqhi = ntohl((s)->seqhi);         \
        (d)->seqdiff = ntohl((s)->seqdiff);     \
        (d)->max_win = ntohs((s)->max_win);     \
        (d)->mss = ntohs((s)->mss);             \
        (d)->state = (s)->state;                \
        (d)->wscale = (s)->wscale;              \
        if ((s)->scrub.scrub_flag == PFSYNC_SCRUB_FLAG_VALID &&         \
            (d)->scrub != NULL) {                                       \
                (d)->scrub->pfss_flags =                                \
                    ntohs((s)->scrub.pfss_flags) & PFSS_TIMESTAMP;      \
                (d)->scrub->pfss_ttl = (s)->scrub.pfss_ttl;             \
                (d)->scrub->pfss_ts_mod = ntohl((s)->scrub.pfss_ts_mod);\
        }                                                               \
} while (0)

#define pf_state_host_hton(s,d) do {                            \
        memcpy(&(d)->addr, &(s)->addr, sizeof((d)->addr));      \
        (d)->port = (s)->port;                                  \
} while (0)

#define pf_state_host_ntoh(s,d) do {                            \
        memcpy(&(d)->addr, &(s)->addr, sizeof((d)->addr));      \
        (d)->port = (s)->port;                                  \
} while (0)

#define pf_state_counter_hton(s,d) do {                         \
        d[0] = htonl((s>>32)&0xffffffff);                       \
        d[1] = htonl(s&0xffffffff);                             \
} while (0)

#define pf_state_counter_ntoh(s,d) do {                         \
        d = ntohl(s[0]);                                        \
        d = d<<32;                                              \
        d += ntohl(s[1]);                                       \
} while (0)

#ifdef _KERNEL
void pfsync_input(struct mbuf *, int, int);
int pfsync_clear_states(u_int32_t, char *);
int pfsync_pack_state(u_int8_t, struct pf_state *, int);
#define pfsync_insert_state(st) do {                            \
        if ((st->rule.ptr->rule_flag & PFRULE_NOSYNC) ||        \
            (st->state_key->proto == IPPROTO_PFSYNC))                   \
                st->sync_flags |= PFSTATE_NOSYNC;               \
        else if (!st->sync_flags)                               \
                pfsync_pack_state(PFSYNC_ACT_INS, (st),         \
                    PFSYNC_FLAG_COMPRESS);                      \
        st->sync_flags &= ~PFSTATE_FROMSYNC;                    \
} while (0)
#define pfsync_update_state(st) do {                            \
        if (!st->sync_flags)                                    \
                pfsync_pack_state(PFSYNC_ACT_UPD, (st),         \
                    PFSYNC_FLAG_COMPRESS);                      \
        st->sync_flags &= ~PFSTATE_FROMSYNC;                    \
} while (0)
#define pfsync_delete_state(st) do {                            \
        if (!st->sync_flags)                                    \
                pfsync_pack_state(PFSYNC_ACT_DEL, (st),         \
                    PFSYNC_FLAG_COMPRESS);                      \
} while (0)
#ifdef NOTYET
int pfsync_update_tdb(struct tdb *, int);
#endif /* NOTYET */
#endif

#endif /* _NET_IF_PFSYNC_H_ */