/*      $OpenBSD: pfctl_parser.h,v 1.123 2026/02/03 10:25:28 sashan Exp $ */

/*
 * Copyright (c) 2001 Daniel Hartmeier
 * Copyright (c) 2002 - 2013 Henning Brauer <henning@openbsd.org>
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 *    - Redistributions of source code must retain the above copyright
 *      notice, this list of conditions and the following disclaimer.
 *    - Redistributions in binary form must reproduce the above
 *      copyright notice, this list of conditions and the following
 *      disclaimer in the documentation and/or other materials provided
 *      with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 *
 */

#ifndef _PFCTL_PARSER_H_
#define _PFCTL_PARSER_H_

#define PF_OSFP_FILE            "/etc/pf.os"

#define PF_OPT_DISABLE          0x00001
#define PF_OPT_ENABLE           0x00002
#define PF_OPT_VERBOSE          0x00004
#define PF_OPT_NOACTION         0x00008
#define PF_OPT_QUIET            0x00010
#define PF_OPT_CLRRULECTRS      0x00020
#define PF_OPT_USEDNS           0x00040
#define PF_OPT_VERBOSE2         0x00080
#define PF_OPT_DUMMYACTION      0x00100
#define PF_OPT_DEBUG            0x00200
#define PF_OPT_SHOWALL          0x00400
#define PF_OPT_OPTIMIZE         0x00800
#define PF_OPT_NODNS            0x01000
#define PF_OPT_RECURSE          0x04000
#define PF_OPT_PORTNAMES        0x08000
#define PF_OPT_IGNFAIL          0x10000
#define PF_OPT_CALLSHOW         0x20000

#define PF_TH_ALL               0xFF

#define PF_NAT_PROXY_PORT_LOW   50001
#define PF_NAT_PROXY_PORT_HIGH  65535

#define PF_OPTIMIZE_BASIC       0x0001
#define PF_OPTIMIZE_PROFILE     0x0002

#define FCNT_NAMES { \
        "searches", \
        "inserts", \
        "removals", \
        NULL \
}

struct pfr_buffer;      /* forward definition */

struct pfctl_statelim {
        struct pfioc_statelim           ioc;
        RBT_ENTRY(pfctl_statelim)       entry;
};

RBT_HEAD(pfctl_statelim_ids, pfctl_statelim);
RBT_HEAD(pfctl_statelim_nms, pfctl_statelim);

struct pfctl_sourcelim {
        struct pfioc_sourcelim          ioc;
        RBT_ENTRY(pfctl_sourcelim)      entry;
};

RBT_HEAD(pfctl_sourcelim_ids, pfctl_sourcelim);
RBT_HEAD(pfctl_sourcelim_nms, pfctl_sourcelim);

struct pfctl {
        int dev;
        int opts;
        int optimize;
        int asd;                        /* anchor stack depth */
        int bn;                         /* brace number */
        int brace;
        int tdirty;                     /* kernel dirty */
#define PFCTL_ANCHOR_STACK_DEPTH 64
        struct pf_anchor *astack[PFCTL_ANCHOR_STACK_DEPTH];
        struct pfioc_queue *pqueue;
        struct pfr_buffer *trans;
        struct pf_anchor *anchor, *alast;
        struct pfr_ktablehead pfr_ktlast;
        const char *ruleset;

        struct pfctl_statelim_ids statelim_ids;
        struct pfctl_statelim_nms statelim_nms;
        struct pfctl_sourcelim_ids sourcelim_ids;
        struct pfctl_sourcelim_nms sourcelim_nms;

        /* 'set foo' options */
        u_int32_t        timeout[PFTM_MAX];
        u_int32_t        limit[PF_LIMIT_MAX];
        u_int32_t        debug;
        u_int32_t        hostid;
        u_int32_t        reassemble;
        u_int8_t         syncookies;
        u_int8_t         syncookieswat[2];      /* lowat, hiwat */
        char            *ifname;

        u_int8_t         timeout_set[PFTM_MAX];
        u_int8_t         limit_set[PF_LIMIT_MAX];
        u_int8_t         debug_set;
        u_int8_t         hostid_set;
        u_int8_t         ifname_set;
        u_int8_t         reass_set;
        u_int8_t         syncookies_set;
        u_int8_t         syncookieswat_set;
};

struct node_if {
        char                     ifname[IFNAMSIZ];
        u_int8_t                 not;
        u_int8_t                 dynamic; /* antispoof */
        u_int8_t                 use_rdomain;
        u_int                    ifa_flags;
        int                      rdomain;
        struct node_if          *next;
        struct node_if          *tail;
};

struct node_host {
        struct pf_addr_wrap      addr;
        struct pf_addr           bcast;
        struct pf_addr           peer;
        sa_family_t              af;
        u_int8_t                 not;
        u_int32_t                ifindex;       /* link-local IPv6 addrs */
        u_int16_t                weight;        /* load balancing weight */
        char                    *ifname;
        u_int                    ifa_flags;
        struct node_host        *next;
        struct node_host        *tail;
};
void    freehostlist(struct node_host *);

struct node_os {
        char                    *os;
        pf_osfp_t                fingerprint;
        struct node_os          *next;
        struct node_os          *tail;
};

struct node_queue_bw {
        u_int64_t       bw_absolute;
        u_int16_t       bw_percent;
};

struct node_hfsc_sc {
        struct node_queue_bw    m1;     /* slope of 1st segment; bps */
        u_int                   d;      /* x-projection of m1; msec */
        struct node_queue_bw    m2;     /* slope of 2nd segment; bps */
        u_int8_t                used;
};

struct node_hfsc_opts {
        struct node_hfsc_sc     realtime;
        struct node_hfsc_sc     linkshare;
        struct node_hfsc_sc     upperlimit;
        int                     flags;
};

struct node_queue_opt {
        int                      qtype;
        union {
                struct priq_opts        priq_opts;
                struct node_hfsc_opts   hfsc_opts;
        }                        data;
};

SIMPLEQ_HEAD(node_tinithead, node_tinit);
struct node_tinit {     /* table initializer */
        SIMPLEQ_ENTRY(node_tinit)        entries;
        struct node_host                *host;
        char                            *file;
};


/* optimizer created tables */
struct pf_opt_tbl {
        char                     pt_name[PF_TABLE_NAME_SIZE];
        int                      pt_rulecount;
        int                      pt_generated;
        u_int32_t                pt_flags;
        u_int32_t                pt_refcnt;
        struct node_tinithead    pt_nodes;
        struct pfr_buffer       *pt_buf;
};

/* optimizer pf_rule container */
struct pf_opt_rule {
        struct pf_rule           por_rule;
        struct pf_opt_tbl       *por_src_tbl;
        struct pf_opt_tbl       *por_dst_tbl;
        u_int64_t                por_profile_count;
        TAILQ_ENTRY(pf_opt_rule) por_entry;
        TAILQ_ENTRY(pf_opt_rule) por_skip_entry[PF_SKIP_COUNT];
};

TAILQ_HEAD(pf_opt_queue, pf_opt_rule);

extern TAILQ_HEAD(pf_qihead, pfctl_qsitem) qspecs, rootqs;
struct pfctl_qsitem {
        TAILQ_ENTRY(pfctl_qsitem)        entries;
        struct pf_queuespec              qs;
        struct pf_qihead                 children;
        int                              matches;
};

struct pfctl_watermarks {
        u_int32_t       hi;
        u_int32_t       lo;
};

struct pfr_uktable;

void             copy_satopfaddr(struct pf_addr *, struct sockaddr *);

int     pfctl_rules(int, char *, int, int, char *, struct pfr_buffer *);
int     pfctl_optimize_ruleset(struct pfctl *, struct pf_ruleset *);
int     pf_opt_create_table(struct pfctl *, struct pf_opt_tbl *);
int     add_opt_table(struct pfctl *, struct pf_opt_tbl **, sa_family_t,
            struct pf_rule_addr *, char *);

void    pfctl_add_rule(struct pfctl *, struct pf_rule *);

int     pfctl_add_statelim(struct pfctl *, struct pfctl_statelim *);
struct pfctl_statelim *
        pfctl_get_statelim_id(struct pfctl *, uint32_t);
struct pfctl_statelim *
        pfctl_get_statelim_nm(struct pfctl *, const char *);
int     pfctl_add_sourcelim(struct pfctl *, struct pfctl_sourcelim *);
struct pfctl_sourcelim *
        pfctl_get_sourcelim_id(struct pfctl *, uint32_t);
struct pfctl_sourcelim *
        pfctl_get_sourcelim_nm(struct pfctl *, const char *);

int     pfctl_set_timeout(struct pfctl *, const char *, int, int);
int     pfctl_set_reassembly(struct pfctl *, int, int);
int     pfctl_set_syncookies(struct pfctl *, u_int8_t,
            struct pfctl_watermarks *);
int     pfctl_set_optimization(struct pfctl *, const char *);
int     pfctl_set_limit(struct pfctl *, const char *, unsigned int);
int     pfctl_set_logif(struct pfctl *, char *);
void    pfctl_set_hostid(struct pfctl *, u_int32_t);
int     pfctl_set_debug(struct pfctl *, char *);
int     pfctl_set_interface_flags(struct pfctl *, char *, int, int);

int     parse_config(char *, struct pfctl *);
int     parse_flags(char *);
int     pfctl_load_anchors(int, struct pfctl *);

int     pfctl_load_queues(struct pfctl *);
int     pfctl_add_queue(struct pfctl *, struct pf_queuespec *);
struct pfctl_qsitem *   pfctl_find_queue(char *, struct pf_qihead *);

void    print_pool(struct pf_pool *, u_int16_t, u_int16_t, sa_family_t, int, int);
void    print_src_node(struct pf_src_node *, int);
void    print_statelim(const struct pfioc_statelim *);
void    print_sourcelim(const struct pfioc_sourcelim *);
void    print_rule(struct pfctl *pf, struct pf_rule *, const char *, int);
void    print_tabledef(const char *, int, int, struct node_tinithead *);
void    print_status(struct pf_status *, struct pfctl_watermarks *, int);
void    print_queuespec(struct pf_queuespec *);

int     pfctl_define_table(char *, int, int, const char *, struct pfr_buffer *,
            u_int32_t, struct pfr_uktable *);
void    pfctl_expand_label_nr(struct pf_rule *, unsigned int);

void             pfctl_clear_fingerprints(int, int);
int              pfctl_file_fingerprints(int, int, const char *);
pf_osfp_t        pfctl_get_fingerprint(const char *);
int              pfctl_load_fingerprints(int, int);
char            *pfctl_lookup_fingerprint(pf_osfp_t, char *, size_t);
void             pfctl_show_fingerprints(int);

struct icmptypeent {
        const char *name;
        u_int8_t type;
};

struct icmpcodeent {
        const char *name;
        u_int8_t type;
        u_int8_t code;
};

const struct icmptypeent *geticmptypebynumber(u_int8_t, u_int8_t);
const struct icmptypeent *geticmptypebyname(char *, u_int8_t);
const struct icmpcodeent *geticmpcodebynumber(u_int8_t, u_int8_t, u_int8_t);
const struct icmpcodeent *geticmpcodebyname(u_long, char *, u_int8_t);

int                       string_to_loglevel(const char *);
const char               *loglevel_to_string(int);

struct pf_timeout {
        const char      *name;
        int              timeout;
};

extern const struct pf_timeout pf_timeouts[];

void                     set_ipmask(struct node_host *, int);
int                      check_netmask(struct node_host *, sa_family_t);
int                      unmask(struct pf_addr *);
struct node_host        *gen_dynnode(struct node_host *, sa_family_t);
void                     ifa_load(void);
unsigned int             ifa_nametoindex(const char *);
char                    *ifa_indextoname(unsigned int, char *);
struct node_host        *ifa_exists(const char *);
struct node_host        *ifa_lookup(const char *, int);
struct node_host        *host(const char *, int);

int                      append_addr(struct pfr_buffer *, char *, int, int);
int                      append_addr_host(struct pfr_buffer *,
                            struct node_host *, int, int);
int                      pfr_ktable_compare(struct pfr_ktable *,
                            struct pfr_ktable *);
RB_PROTOTYPE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);

#endif /* _PFCTL_PARSER_H_ */