wolfip/wolfip-filter.h at master · wolfSSL/wolfip · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
#ifndef WOLFIP_FILTER_H
#define WOLFIP_FILTER_H

#include <stdint.h>

struct wolfIP;

enum wolfIP_filter_reason {
    WOLFIP_FILT_BINDING = 0,
    WOLFIP_FILT_DISSOCIATE = 1,
    WOLFIP_FILT_LISTENING = 2,
    WOLFIP_FILT_STOP_LISTENING = 3,
    WOLFIP_FILT_CONNECTING = 4,
    WOLFIP_FILT_ACCEPTING = 5,
    WOLFIP_FILT_CLOSED = 6,
    WOLFIP_FILT_REMOTE_RESET = 7,
    WOLFIP_FILT_RECEIVING = 8,
    WOLFIP_FILT_SENDING = 9,
    WOLFIP_FILT_ADDR_UNREACHABLE = 10,
    WOLFIP_FILT_PORT_UNREACHABLE = 11,
    WOLFIP_FILT_INBOUND_ERR = 12,
    WOLFIP_FILT_OUTBOUND_ERR = 13,
    WOLFIP_FILT_CLOSE_WAIT = 14
};

#define WOLFIP_FILT_MASK(reason) (1U << (reason))

#define WOLFIP_FILTER_PROTO_ETH  0x008f
#define WOLFIP_FILTER_PROTO_IP   0x0800
#define WOLFIP_FILTER_PROTO_TCP  0x0006
#define WOLFIP_FILTER_PROTO_UDP  0x0011
#define WOLFIP_FILTER_PROTO_ICMP 0x0001

struct wolfIP_filter_metadata {
    uint8_t src_mac[6];
    uint8_t dst_mac[6];
    uint16_t eth_type;
    uint32_t src_ip;
    uint32_t dst_ip;
    uint16_t ip_proto;
    union {
        struct {
            uint16_t src_port;
            uint16_t dst_port;
            uint8_t flags;
        } tcp;
        struct {
            uint16_t src_port;
            uint16_t dst_port;
        } udp;
        struct {
            uint8_t type;
            uint8_t code;
        } icmp;
    } l4;
};

struct wolfIP_filter_event {
    enum wolfIP_filter_reason reason;
    struct wolfIP *stack;
    unsigned int if_idx;
    uint32_t length;
    const void *buffer;
    struct wolfIP_filter_metadata meta;
};

typedef int (*wolfIP_filter_cb)(void *arg, const struct wolfIP_filter_event *event);

/*
 * Install the filter callback. The callback is only consulted for the
 * reasons selected in the reason masks; a reason bit left clear in a
 * configured mask means the stack silently allows that traffic (no
 * callback, no error). To keep a freshly installed filter from failing
 * open, a callback installed without any explicit mask configuration
 * since the last uninstall is consulted for all reasons until the first
 * explicit mask configuration (wolfIP_filter_set_mask() or any per-proto
 * setter, including an explicit zero); afterwards only the configured
 * reasons are consulted. Passing a NULL callback uninstalls it and resets
 * this all-reasons default (masks keep their values).
 */
void wolfIP_filter_set_callback(wolfIP_filter_cb cb, void *arg);

/*
 * Select the reasons the callback is consulted for (all protocols). Any
 * call — including an explicit zero — counts as an explicit mask
 * configuration and ends the all-reasons default of a freshly installed
 * callback. Once configured, an all-zero mask disables all notifications
 * and silently allows every packet and socket event. Per-proto masks
 * (eth/ip/tcp/udp/icmp) take precedence over this one when non-zero.
 */
void wolfIP_filter_set_mask(uint32_t mask);
void wolfIP_filter_set_eth_mask(uint32_t mask);
void wolfIP_filter_set_ip_mask(uint32_t mask);
void wolfIP_filter_set_tcp_mask(uint32_t mask);
void wolfIP_filter_set_udp_mask(uint32_t mask);
void wolfIP_filter_set_icmp_mask(uint32_t mask);
uint32_t wolfIP_filter_get_mask(void);

#endif /* WOLFIP_FILTER_H */