/*
 * simco_defs_ext.h
 *
 * Copyright (C) 2005, Ranch Networks, Inc.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA
 *
 * Author : Srivatsa Chivukula <srivatsa@ranchnetworks.com>
 *
 */

#ifndef _SIMCO_DEFS_EXT_H_
#define _SIMCO_DEFS_EXT_H_

/* Message sub-types for 0x01 (request) and 0x02 (positive reply) */
#define SUB_FRC_MSG      0xe1  /*  (FRC) dynamic firewall rule create */
#define SUB_FRD_MSG      0xe2  /*  (FRD) dynamic firewall rule delete */
#define SUB_FRL_MSG      0xe3  /*  (FRL) list all dynamic firewall rules */
#define SUB_FRS_MSG      0xe4  /*  (FRS) dynamic firewall rule status */

/* Message sub-types for 0x03 (negative reply message) */
/*      Replies concerning firewall rules configuration */
#define SUB_FCF_MSG     0xf1 /*  firewall rule create failed */
#define SUB_FDF_MSG     0xf2 /*  firewall rule delete failed */
#define SUB_FFL_MSG     0xf3 /*  failed to return firewall rules list */
#define SUB_WAP_MSG     0xf4 /*  wrong action parameter */
#define SUB_WSP_MSG     0xf5 /*  wrong syslog parameter */
#define SUB_WSZ_MSG     0xf6 /*  wrong source zone id */
#define SUB_WDZ_MSG     0xf7 /*  wrong destination zone id */
#define SUB_WPV_MSG     0xf8 /*  wrong protocol value */
#define SUB_WTP_MSG     0xf9 /*  wrong TOS parameter */
#define SUB_WFP_MSG     0xfa /*  wrong IP fragmentation parameter */
#define SUB_WDS_MSG     0xfb /*  wrong Destination Self parameter */
#define SUB_WIO_MSG     0xfc /*  wrong IP options attribute */
#define SUB_WTO_MSG     0xfd /*  wrong TCP flags/options attribute */
#define SUB_WIC_MSG     0xfe /*  wrong ICMP types attribute */
#define SUB_RNE_MSG     0xff /*  rule number already exists */

/*  The SIMCO Payload Attribute */
#define PAY_FRC_ATT     0x0101  /*  fw rule create            64 bits */
#define PAY_FIF_ATT     0x0102  /*  fw ip options flags       32 bits */
#define PAY_FTF_ATT     0x0103  /*  fw tcp flags/option       32 bits */
#define PAY_FIO_ATT     0x0104  /*  fw ICMP option            32 bits */
#define PAY_FPR_ATT     0x0105  /*  fw packets rate           32 bits */
#define PAY_FRJ_ATT     0x0106  /*  reject code               32 bits */
#define PAY_FIP_ATT     0x0107  /*  forward/copy IP address   32 bits */
#define PAY_FEC_ATT     0x0108  /*  fw extended capabilities  64 bits */

/*  Firewall Rule Create Attribute */
#define FWC_DNY_FLG     0x01  /*  deny, this action will force to silently drop all packets matching this rule */
#define FWC_ALW_FLG     0x02  /*  allow, the packets will go through */
#define FWC_CNT_FLG     0x03  /*  count, this action won't affect the traffic and will only increment byte and packet counters */
#define FWC_PSS_FLG     0x04  /*  IP pass through, the action will route the packets without enforcing any firewall/NAT rules */
#define FWC_RJT_FLG     0x05  /*  reject, this action will drop the [packets and will send a reject code back to the sender. The reject code are described in Reject codes parameter. */
#define FWC_CPY_FLG     0x06  /*  copy, this action will copy all packets matching the rule to a specified destination */
#define FWC_FWD_FLG     0x07  /*  forward, this action will divert the packets to a specified IP address */

#define FWC_DLG_FLG     0x00  /*  don't send a log message for this rule */
#define FWC_SLG_FLG     0x01  /*  send a syslog message for every packet that matches this rule. */
#define FWC_SSG_FLG     0x02  /*  send a syslog message only for a first and a last packets of a session. This value is only applicable for action "allow" and must be set to 0x0 for any other actions. */

#define FWC_MIP_MSK     0x80  /*  match IP fragmentation flag in the packets if set, else ignore */

#define FWC_SDU_MSK     0x40  /*  flag is set and a midllebox will be filtering packets based on destination IP address equal to middlebox self IP address */

/* Firewall rule IP options attribute */
#define FIO_LIG_MSK_C   0xC0000000  /*    LSRR - ignore */
#define FIO_LFS_MSK     0x40000000  /*    LSRR - filter if set */
#define FIO_LNS_MSK     0x80000000  /*    LSRR - filter if not set */

#define FIO_SIG_MSK_C   0x30000000  /*    SSRR - ignore */
#define FIO_SFS_MSK     0x10000000  /*    SSRR - filter if set */
#define FIO_SNS_MSK     0x20000000  /*    SSRR - filter if not set */

#define FIO_RIG_MSK_C   0x0C000000  /*    RR - ignore */
#define FIO_RFS_MSK     0x04000000  /*    RR - filter if set */
#define FIO_RNS_MSK     0x08000000  /*    RR - filter if not set */

#define FIO_TIG_MSK_C   0x03000000  /*    TS - ignore */
#define FIO_TFS_MSK     0x01000000  /*    TS - filter if set */
#define FIO_TNS_MSK     0x02000000  /*    TS - filter if not set */

/* Firewall rule TCP flags and options attribute */
#define FTF_FIG_MSK_C   0xC0000000  /*    FIN - ignore */
#define FTF_FFS_MSK     0x40000000  /*    FIN - filter if set */
#define FTF_FNS_MSK     0x80000000  /*    FIN - filter if not set */

#define FTF_SIG_MSK_C   0x30000000  /*    SYN - ignore */
#define FTF_SFS_MSK     0x10000000  /*    SYN - filter if set */
#define FTF_SNS_MSK     0x20000000  /*    SYN - filter if not set */

#define FTF_RIG_MSK_C   0x0C000000  /*    RST - ignore */
#define FTF_RFS_MSK     0x04000000  /*    RST - filter if set */
#define FTF_RNS_MSK     0x08000000  /*    RST - filter if not set */

#define FTF_PIG_MSK_C   0x03000000  /*    PSH - ignore */
#define FTF_PFS_MSK     0x01000000  /*    PSH - filter if set */
#define FTF_PNS_MSK     0x02000000  /*    PSH - filter if not set */

#define FTF_AIG_MSK_C   0x00C00000  /*    ACK - ignore */
#define FTF_AFS_MSK     0x00400000  /*    ACK - filter if set */
#define FTF_ANS_MSK     0x00800000  /*    ACK - filter if not set */

#define FTF_UIG_MSK_C   0x00300000  /*    URG - ignore */
#define FTF_UFS_MSK     0x00100000  /*    URG - filter if set */
#define FTF_UNS_MSK     0x00200000  /*    URG - filter if not set */

#define FTF_MIG_MSK_C   0x000C0000  /*    MSS - ignore */
#define FTF_MFS_MSK     0x00040000  /*    MSS - filter if set */
#define FTF_MNS_MSK     0x00080000  /*    MSS - filter if not set */

#define FTF_WIG_MSK_C   0x00030000  /*    WS - ignore */
#define FTF_WFS_MSK     0x00010000  /*    WS - filter if set */
#define FTF_WNS_MSK     0x00020000  /*    WS - filter if not set */

#define FTF_KIG_MSK_C   0x0000C000  /*    SAK - ignore */
#define FTF_KFS_MSK     0x00004000  /*    SAK - filter if set */
#define FTF_KNS_MSK     0x00008000  /*    SAK - filter if not set */

#define FTF_TIG_MSK_C   0x00003000  /*    TS - ignore */
#define FTF_TFS_MSK     0x00001000  /*    TS - filter if set */
#define FTF_TNS_MSK     0x00002000  /*    TS - filter if not set */

#define FTF_CIG_MSK_C   0x00000C00  /*    CC - ignore */
#define FTF_CFS_MSK     0x00000400  /*    CC - filter if set */
#define FTF_CNS_MSK     0x00000800  /*    CC - filter if not set */

/*  Firewall rule ICMP types attribute */
#define FIC_ER_MSK     0x8000  /*  ER - echo reply */
#define FIC_AA_MSK     0x4000  /*  AA - alternative host address */
#define FIC_PP_MSK     0x2000  /*  PP - parameter problem */
#define FIC_IR_MSK     0x1000  /*  IR - information reply */
#define FIC_DU_MSK     0x0800  /*  DU - destination unreachable */
#define FIC_EO_MSK     0x0400  /*  EO - echo message */
#define FIC_TS_MSK     0x0200  /*  TS - timestamp */
#define FIC_AR_MSK     0x0100  /*  AR - address mask request */
#define FIC_SQ_MSK     0x0080  /*  SQ - source quench */
#define FIC_RA_MSK     0x0040  /*  RA - router advertisement */
#define FIC_TM_MSK     0x0020  /*  TM - time reply */
#define FIC_MR_MSK     0x0010  /*  MR - address mask reply */
#define FIC_RD_MSK     0x0008  /*  RD - redirect */
#define FIC_RS_MSK     0x0004  /*  RS - router selection */
#define FIC_RQ_MSK     0x0002  /*  IR - information request */

/*  Firewall reject code attribute */
#define FRC_BAN_FLG     0x00  /*  Bad Net */
#define FRC_BAH_FLG     0x01  /*  Bad Host */
#define FRC_BAP_FLG     0x02  /*  Bad Protocol */
#define FRC_BPO_FLG     0x03  /*  Bad Port */
#define FRC_IDD_FLG     0x04  /*  IP DF Drop */     
#define FRC_SRF_FLG     0x05  /*  Src Route Failed */
#define FRC_UKN_FLG     0x06  /*  Unknown Net */
#define FRC_UKH_FLG     0x07  /*  Unknown Host */
#define FRC_SHI_FLG     0x08  /*  Src Host Isolated */
#define FRC_PNA_FLG     0x09  /*  Prohibited Net access */
#define FRC_PHA_FLG     0x0A  /*  Prohibited Host access */
#define FRC_BTN_FLG     0x0B  /*  Bad TOS for Net */
#define FRC_BTH_FLG     0x0C  /*  Bad TOS for Host */
#define FRC_PFL_FLG     0x0D  /*  Packet Filtering */
#define FRC_HPV_FLG     0x0E  /*  Host Precedence Violation */
#define FRC_PCE_FLG     0x0F  /*  Precedence Cutoff in Effect */

#define FRC_SRS_FLG    0x100  /*  Send Reset */

/*  Extended Capabilities attribute */
#define ECP_F_MSK     0x80  /*  F   : if the bit is set the box supports extended firewall capabilities */
#define ECP_B_MSK     0x40  /*  B   : if the bit is set the middlebox can support per flow bandwidth management and traffic shaping. */
#define ECP_H_MSK     0x20  /*  H   : if the bit is set the middlebox can support health monitoring of any IP addressable device on the network. */


/* Macros to set bit flags; n=int and c=char fields */
#define FW_FLG_SET_IPFRAG(c)     (c |= FWC_MIP_MSK)
#define FW_FLG_CLR_IPFRAG(c)     (c &= ~FWC_MIP_MSK)
#define FW_FLG_ISSET_IPFRAG(c)   (c & FWC_MIP_MSK)

#define FW_FLG_SET_DSTSELF(c)    (c |= FWC_SDU_MSK)
#define FW_FLG_CLR_DSTSELF(c)    (c &= ~FWC_SDU_MSK)
#define FW_FLG_ISSET_DSTSELF(c)  (c & FWC_SDU_MSK)

#define IP_OPT_SET_LSRR(n)       (n |= FIO_LFS_MSK)
#define IP_OPT_NSET_LSRR(n)      (n |= FIO_LNS_MSK)
#define IP_OPT_CLR_LSRR(n)       (n &= ~FIO_LIG_MSK_C)
#define IP_OPT_ISSET_LSRR(n)     (n & FIO_LFS_MSK)
#define IP_OPT_ISNSET_LSRR(n)    (n & FIO_LNS_MSK)

#define IP_OPT_SET_SSRR(n)       (n |= FIO_SFS_MSK)
#define IP_OPT_NSET_SSRR(n)      (n |= FIO_SNS_MSK)
#define IP_OPT_CLR_SSRR(n)       (n &= ~FIO_SIG_MSK_C)
#define IP_OPT_ISSET_SSRR(n)     (n & FIO_SFS_MSK)
#define IP_OPT_ISNSET_SSRR(n)    (n & FIO_SNS_MSK)

#define IP_OPT_SET_RR(n)         (n |= FIO_RFS_MSK)
#define IP_OPT_NSET_RR(n)        (n |= FIO_RNS_MSK)
#define IP_OPT_CLR_RR(n)         (n &= ~FIO_RIG_MSK_C)
#define IP_OPT_ISSET_RR(n)       (n & FIO_RFS_MSK)
#define IP_OPT_ISNSET_RR(n)      (n & FIO_RNS_MSK)

#define IP_OPT_SET_TS(n)         (n |= FIO_TFS_MSK)
#define IP_OPT_NSET_TS(n)        (n |= FIO_TNS_MSK)
#define IP_OPT_CLR_TS(n)         (n &= ~FIO_TIG_MSK_C)
#define IP_OPT_ISSET_TS(n)       (n & FIO_TFS_MSK)
#define IP_OPT_ISNSET_TS(n)      (n & FIO_TNS_MSK)

#define TCP_FLG_SET_SYN(n)       (n |= FTF_SFS_MSK)
#define TCP_FLG_NSET_SYN(n)      (n |= FTF_SNS_MSK)
#define TCP_FLG_CLR_SYN(n)       (n &= ~FTF_SIG_MSK_C)
#define TCP_FLG_ISSET_SYN(n)     (n & FTF_SFS_MSK)
#define TCP_FLG_ISNSET_SYN(n)    (n & FTF_SNS_MSK)

#define TCP_FLG_SET_RST(n)       (n |= FTF_RFS_MSK)
#define TCP_FLG_NSET_RST(n)      (n |= FTF_RNS_MSK)
#define TCP_FLG_CLR_RST(n)       (n &= ~FTF_RIG_MSK_C)
#define TCP_FLG_ISSET_RST(n)     (n & FTF_RFS_MSK)
#define TCP_FLG_ISNSET_RST(n)    (n & FTF_RNS_MSK)

#define TCP_FLG_SET_PSH(n)       (n |= FTF_PFS_MSK)
#define TCP_FLG_NSET_PSH(n)      (n |= FTF_PNS_MSK)
#define TCP_FLG_CLR_PSH(n)       (n &= ~FTF_PIG_MSK_C)
#define TCP_FLG_ISSET_PSH(n)     (n & FTF_PFS_MSK)
#define TCP_FLG_ISNSET_PSH(n)    (n & FTF_PNS_MSK)

#define TCP_FLG_SET_ACK(n)       (n |= FTF_AFS_MSK)
#define TCP_FLG_NSET_ACK(n)      (n |= FTF_ANS_MSK)
#define TCP_FLG_CLR_ACK(n)       (n &= ~FTF_AIG_MSK_C)
#define TCP_FLG_ISSET_ACK(n)     (n & FTF_AFS_MSK)
#define TCP_FLG_ISNSET_ACK(n)    (n & FTF_ANS_MSK)

#define TCP_FLG_SET_URG(n)       (n |= FTF_UFS_MSK)
#define TCP_FLG_NSET_URG(n)      (n |= FTF_UNS_MSK)
#define TCP_FLG_CLR_URG(n)       (n &= ~FTF_UIG_MSK_C)
#define TCP_FLG_ISSET_URG(n)     (n & FTF_UFS_MSK)
#define TCP_FLG_ISNSET_URG(n)    (n & FTF_UNS_MSK)

#define TCP_OPT_SET_MSS(n)       (n |= FTF_MFS_MSK)
#define TCP_OPT_NSET_MSS(n)      (n |= FTF_MNS_MSK)
#define TCP_OPT_CLR_MSS(n)       (n &= ~FTF_MIG_MSK_C)
#define TCP_OPT_ISSET_MSS(n)     (n & FTF_MFS_MSK)
#define TCP_OPT_ISNSET_MSS(n)    (n & FTF_MNS_MSK)

#define TCP_OPT_SET_WS(n)        (n |= FTF_WFS_MSK)
#define TCP_OPT_NSET_WS(n)       (n |= FTF_WNS_MSK)
#define TCP_OPT_CLR_WS(n)        (n &= ~FTF_WIG_MSK_C)
#define TCP_OPT_ISSET_WS(n)      (n & FTF_WFS_MSK)
#define TCP_OPT_ISNSET_WS(n)     (n & FTF_WNS_MSK)

#define TCP_OPT_SET_SAK(n)       (n |= FTF_KFS_MSK)
#define TCP_OPT_NSET_SAK(n)      (n |= FTF_KNS_MSK)
#define TCP_OPT_CLR_SAK(n)       (n &= ~FTF_KIG_MSK_C)
#define TCP_OPT_ISSET_SAK(n)     (n & FTF_KFS_MSK)
#define TCP_OPT_ISNSET_SAK(n)    (n & FTF_KNS_MSK)

#define TCP_OPT_SET_TS(n)        (n |= FTF_TFS_MSK)
#define TCP_OPT_NSET_TS(n)       (n |= FTF_TNS_MSK)
#define TCP_OPT_CLR_TS(n)        (n &= ~FTF_TIG_MSK_C)
#define TCP_OPT_ISSET_TS(n)      (n & FTF_TFS_MSK)
#define TCP_OPT_ISNSET_TS(n)     (n & FTF_TNS_MSK)

#define TCP_OPT_SET_CC(n)        (n |= FTF_CFS_MSK)
#define TCP_OPT_NSET_CC(n)       (n |= FTF_CNS_MSK)
#define TCP_OPT_CLR_CC(n)        (n &= ~FTF_CIG_MSK_C)
#define TCP_OPT_ISSET_CC(n)      (n & FTF_CFS_MSK)
#define TCP_OPT_ISNSET_CC(n)     (n & FTF_CNS_MSK)

#define ICMP_TYP_SET_ER(n)       (n |= FIC_ER_MSK)
#define ICMP_TYP_CLR_ER(n)       (n &= ~FIC_ER_MSK)
#define ICMP_TYP_ISSET_ER(n)     (n & FIC_ER_MSK)

#define ICMP_TYP_SET_AA(n)       (n |= FIC_AA_MSK)
#define ICMP_TYP_CLR_AA(n)       (n &= ~FIC_AA_MSK)
#define ICMP_TYP_ISSET_AA(n)     (n & FIC_AA_MSK)

#define ICMP_TYP_SET_PP(n)       (n |= FIC_PP_MSK)
#define ICMP_TYP_CLR_PP(n)       (n &= ~FIC_PP_MSK)
#define ICMP_TYP_ISSET_PP(n)     (n & FIC_PP_MSK)

#define ICMP_TYP_SET_IR(n)       (n |= FIC_IR_MSK)
#define ICMP_TYP_CLR_IR(n)       (n &= ~FIC_IR_MSK)
#define ICMP_TYP_ISSET_IR(n)     (n & FIC_IR_MSK)

#define ICMP_TYP_SET_DU(n)       (n |= FIC_DU_MSK)
#define ICMP_TYP_CLR_DU(n)       (n &= ~FIC_DU_MSK)
#define ICMP_TYP_ISSET_DU(n)     (n & FIC_DU_MSK)

#define ICMP_TYP_SET_EO(n)       (n |= FIC_EO_MSK)
#define ICMP_TYP_CLR_EO(n)       (n &= ~FIC_EO_MSK)
#define ICMP_TYP_ISSET_EO(n)     (n & FIC_EO_MSK)

#define ICMP_TYP_SET_TS(n)       (n |= FIC_TS_MSK)
#define ICMP_TYP_CLR_TS(n)       (n &= ~FIC_TS_MSK)
#define ICMP_TYP_ISSET_TS(n)     (n & FIC_TS_MSK)

#define ICMP_TYP_SET_AR(n)       (n |= FIC_AR_MSK)
#define ICMP_TYP_CLR_AR(n)       (n &= ~FIC_AR_MSK)
#define ICMP_TYP_ISSET_AR(n)     (n & FIC_AR_MSK)

#define ICMP_TYP_SET_SQ(n)       (n |= FIC_SQ_MSK)
#define ICMP_TYP_CLR_SQ(n)       (n &= ~FIC_SQ_MSK)
#define ICMP_TYP_ISSET_SQ(n)     (n & FIC_SQ_MSK)

#define ICMP_TYP_SET_RA(n)       (n |= FIC_RA_MSK)
#define ICMP_TYP_CLR_RA(n)       (n &= ~FIC_RA_MSK)
#define ICMP_TYP_ISSET_RA(n)     (n & FIC_RA_MSK)

#define ICMP_TYP_SET_TM(n)       (n |= FIC_TM_MSK)
#define ICMP_TYP_CLR_TM(n)       (n &= ~FIC_TM_MSK)
#define ICMP_TYP_ISSET_TM(n)     (n & FIC_TM_MSK)

#define ICMP_TYP_SET_MR(n)       (n |= FIC_MR_MSK)
#define ICMP_TYP_CLR_MR(n)       (n &= ~FIC_MR_MSK)
#define ICMP_TYP_ISSET_MR(n)     (n & FIC_MR_MSK)

#define ICMP_TYP_SET_RD(n)       (n |= FIC_RD_MSK)
#define ICMP_TYP_CLR_RD(n)       (n &= ~FIC_RD_MSK)
#define ICMP_TYP_ISSET_RD(n)     (n & FIC_RD_MSK)

#define ICMP_TYP_SET_RS(n)       (n |= FIC_RS_MSK)
#define ICMP_TYP_CLR_RS(n)       (n &= ~FIC_RS_MSK)
#define ICMP_TYP_ISSET_RS(n)     (n & FIC_RS_MSK)

#define ICMP_TYP_SET_RQ(n)       (n |= FIC_RQ_MSK)
#define ICMP_TYP_CLR_RQ(n)       (n &= ~FIC_RQ_MSK)
#define ICMP_TYP_ISSET_RQ(n)     (n & FIC_RQ_MSK)


#endif /* _SIMCO_DEFS_EXT_H_ */
