1 /*	$OpenBSD: relayd.h,v 1.280 2026/06/03 19:26:56 rsadowski Exp $	*/
2 
3 /*
4  * Copyright (c) 2006 - 2016 Reyk Floeter <reyk@openbsd.org>
5  * Copyright (c) 2006, 2007 Pierre-Yves Ritschard <pyr@openbsd.org>
6  * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
7  *
8  * Permission to use, copy, modify, and distribute this software for any
9  * purpose with or without fee is hereby granted, provided that the above
10  * copyright notice and this permission notice appear in all copies.
11  *
12  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19  */
20 
21 #ifndef RELAYD_H
22 #define RELAYD_H
23 
24 #include <sys/types.h>
25 #include <sys/socket.h>
26 #include <sys/queue.h>
27 #include <sys/tree.h>
28 #include <sys/time.h>
29 #include <sys/un.h>
30 
31 #include <net/if.h>
32 #include <net/pfvar.h>
33 
34 #include <stdarg.h>
35 #include <limits.h>
36 #include <siphash.h>
37 #include <event.h>
38 #include <imsg.h>
39 
40 #include <openssl/ssl.h>
41 #include <tls.h>
42 
43 #ifndef nitems
44 #define	nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
45 #endif
46 
47 #define CONF_FILE		"/etc/relayd.conf"
48 #define RELAYD_SOCKET		"/var/run/relayd.sock"
49 #define PF_SOCKET		"/dev/pf"
50 #define RELAYD_USER		"_relayd"
51 #define RELAYD_ANCHOR		"relayd"
52 #define RELAYD_SERVERNAME	"OpenBSD relayd"
53 #define CHECK_TIMEOUT		200
54 #define CHECK_INTERVAL		10
55 #define EMPTY_TABLE		UINT_MAX
56 #define EMPTY_ID		UINT_MAX
57 #define LABEL_NAME_SIZE		1024
58 #define TAG_NAME_SIZE		64
59 #define TABLE_NAME_SIZE		64
60 #define	RT_LABEL_SIZE		32
61 #define MAX_NAME_SIZE		64
62 #define SRV_MAX_VIRTS		16
63 #define TLS_NAME_SIZE		512
64 #define TLS_CERT_HASH_SIZE	128
65 #define RELAY_MAX_PREFETCH	256
66 #define RELAY_MIN_PREFETCHED	32
67 
68 #define FD_RESERVE		5
69 
70 #define RELAY_MAX_BACKLOG	512
71 #define RELAY_TIMEOUT		600
72 #define RELAY_CACHESIZE		-1	/* use default size */
73 #define RELAY_NUMPROC		3
74 #define RELAY_MAXHOSTS		32
75 #define RELAY_MAXHEADERLENGTH	131072
76 #define RELAY_DEFHEADERLENGTH	8192
77 #define RELAY_STATINTERVAL	60
78 #define RELAY_BACKLOG		10
79 #define RELAY_MAXLOOKUPLEVELS	5
80 #define RELAY_OUTOF_FD_RETRIES	5
81 #define RELAY_MAX_HASH_RETRIES	5
82 #define RELAY_TLS_PRIV_TIMEOUT	1000	/* wait 1sec for the ca */
83 
84 #define CONFIG_RELOAD		0x00
85 #define CONFIG_TABLES		0x01
86 #define CONFIG_RDRS		0x02
87 #define CONFIG_RELAYS		0x04
88 #define CONFIG_PROTOS		0x08
89 #define CONFIG_ROUTES		0x10
90 #define CONFIG_RTS		0x20
91 #define CONFIG_CA_ENGINE	0x40
92 #define CONFIG_CERTS		0x80
93 #define CONFIG_ALL		0xff
94 
95 #define SMALL_READ_BUF_SIZE	1024
96 #define ICMP_BUF_SIZE		64
97 #define ICMP_RCVBUF_SIZE	262144
98 
99 #define AGENTX_RECONNECT_TIMEOUT	{ 3, 0 }	/* sec, usec */
100 
101 #define PROC_PARENT_SOCK_FILENO	3
102 #define PROC_MAX_INSTANCES	32
103 
104 #if DEBUG > 1
105 #define DPRINTF		log_debug
106 #define DEBUG_CERT	1
107 #else
108 #define DPRINTF(x...)	do {} while(0)
109 #endif
110 
111 /* Used for DNS request ID randomization */
112 struct shuffle {
113 	u_int16_t	 id_shuffle[65536];
114 	int		 isindex;
115 };
116 
117 typedef u_int32_t objid_t;
118 
119 struct ctl_status {
120 	objid_t		 id;
121 	int		 up;
122 	int		 retry_cnt;
123 	u_long		 check_cnt;
124 	u_int16_t	 he;
125 };
126 
127 struct ctl_id {
128 	objid_t		 id;
129 	char		 name[MAX_NAME_SIZE];
130 };
131 
132 struct ctl_relaytable {
133 	objid_t		 id;
134 	objid_t		 relayid;
135 	int		 mode;
136 	u_int32_t	 flags;
137 };
138 
139 enum fd_type {
140 	RELAY_FD_CERT		= 1,
141 	RELAY_FD_CACERT		= 2,
142 	RELAY_FD_CAFILE		= 3,
143 	RELAY_FD_KEY		= 4,
144 	RELAY_FD_OCSP		= 5,
145 	RELAY_FD_CLIENTCACERT	= 6
146 };
147 
148 struct ctl_relayfd {
149 	objid_t		 id;
150 	objid_t		 relayid;
151 	enum fd_type	 type;
152 };
153 
154 struct ctl_script {
155 	objid_t		 host;
156 	int		 retval;
157 	struct timeval	 timeout;
158 	char		 name[HOST_NAME_MAX+1];
159 	char		 path[PATH_MAX];
160 };
161 
162 struct ctl_demote {
163 	char		 group[IFNAMSIZ];
164 	int		 level;
165 };
166 
167 struct ctl_icmp_event {
168 	struct relayd		*env;
169 	int			 s;
170 	int			 af;
171 	int			 last_up;
172 	struct event		 ev;
173 	struct timeval		 tv_start;
174 };
175 
176 struct ctl_tcp_event {
177 	int			 s;
178 	struct ibuf		*buf;
179 	struct host		*host;
180 	struct table		*table;
181 	struct timeval		 tv_start;
182 	struct event		 ev;
183 	int			(*validate_read)(struct ctl_tcp_event *);
184 	int			(*validate_close)(struct ctl_tcp_event *);
185 
186 	struct tls		*tls;
187 };
188 
189 enum direction {
190 	RELAY_DIR_INVALID	= -1,
191 	RELAY_DIR_ANY		=  0,
192 	RELAY_DIR_REQUEST	=  1,
193 	RELAY_DIR_RESPONSE	=  2
194 };
195 
196 enum relay_state {
197 	STATE_INIT,
198 	STATE_PENDING,
199 	STATE_PRECONNECT,
200 	STATE_CONNECTED,
201 	STATE_CLOSED,
202 	STATE_DONE
203 };
204 
205 struct ctl_relay_event {
206 	int			 s;
207 	in_port_t		 port;
208 	struct sockaddr_storage	 ss;
209 	struct bufferevent	*bev;
210 	struct evbuffer		*output;
211 	struct ctl_relay_event	*dst;
212 	struct rsession		*con;
213 
214 	struct tls		*tls;
215 	struct tls_config	*tls_cfg;
216 	struct tls		*tls_ctx;
217 
218 	uint8_t			*tlscert;
219 	size_t			 tlscert_len;
220 
221 	off_t			 splicelen;
222 	off_t			 toread;
223 	size_t			 headerlen;
224 	int			 line;
225 	int			 done;
226 	int			 timedout;
227 	enum relay_state	 state;
228 	enum direction		 dir;
229 
230 	/* protocol-specific descriptor */
231 	void			*desc;
232 };
233 
234 enum httpchunk {
235 	TOREAD_UNLIMITED		= -1,
236 	TOREAD_HTTP_HEADER		= -2,
237 	TOREAD_HTTP_CHUNK_LENGTH	= -3,
238 	TOREAD_HTTP_CHUNK_TRAILER	= -4
239 };
240 
241 struct ctl_natlook {
242 	objid_t			 id;
243 	int			 proc;
244 
245 	struct sockaddr_storage	 src;
246 	struct sockaddr_storage	 dst;
247 	struct sockaddr_storage	 rsrc;
248 	struct sockaddr_storage	 rdst;
249 	in_port_t		 rsport;
250 	in_port_t		 rdport;
251 	int			 in;
252 	int			 proto;
253 };
254 
255 struct ctl_bindany {
256 	objid_t			 bnd_id;
257 	int			 bnd_proc;
258 
259 	struct sockaddr_storage	 bnd_ss;
260 	in_port_t		 bnd_port;
261 	int			 bnd_proto;
262 };
263 
264 struct ctl_keyop {
265 	char			 cko_hash[TLS_CERT_HASH_SIZE];
266 	int			 cko_proc;
267 	int			 cko_flen;
268 	int			 cko_tlen;
269 	int			 cko_padding;
270 	u_int			 cko_cookie;
271 };
272 
273 struct ctl_stats {
274 	objid_t			 id;
275 	int			 proc;
276 
277 	u_int64_t		 interval;
278 	u_int64_t		 cnt;
279 	u_int32_t		 tick;
280 	u_int32_t		 avg;
281 	u_int32_t		 last;
282 	u_int32_t		 avg_hour;
283 	u_int32_t		 last_hour;
284 	u_int32_t		 avg_day;
285 	u_int32_t		 last_day;
286 };
287 
288 enum key_option {
289 	KEY_OPTION_NONE		= 0,
290 	KEY_OPTION_APPEND,
291 	KEY_OPTION_SET,
292 	KEY_OPTION_REMOVE,
293 	KEY_OPTION_HASH,
294 	KEY_OPTION_LOG,
295 	KEY_OPTION_STRIP
296 };
297 
298 enum key_type {
299 	KEY_TYPE_NONE		= 0,
300 	KEY_TYPE_COOKIE,
301 	KEY_TYPE_HEADER,
302 	KEY_TYPE_PATH,
303 	KEY_TYPE_QUERY,
304 	KEY_TYPE_URL,
305 	KEY_TYPE_MAX
306 };
307 
308 struct ctl_kvlen {
309 	ssize_t		 key;
310 	ssize_t		 value;
311 };
312 
313 struct ctl_rule {
314 	struct ctl_kvlen kvlen[KEY_TYPE_MAX];
315 };
316 
317 enum digest_type {
318 	DIGEST_NONE		= 0,
319 	DIGEST_SHA1		= 1,
320 	DIGEST_MD5		= 2
321 };
322 
323 TAILQ_HEAD(kvlist, kv);
324 RB_HEAD(kvtree, kv);
325 
326 struct kv {
327 	char			*kv_key;
328 	char			*kv_value;
329 
330 	enum key_type		 kv_type;
331 	enum key_option		 kv_option;
332 	enum digest_type	 kv_digest;
333 
334 #define KV_FLAG_MACRO		 0x01
335 #define KV_FLAG_INVALID		 0x02
336 #define KV_FLAG_GLOBBING	 0x04
337 	u_int8_t		 kv_flags;
338 
339 	struct kvlist		 kv_children;
340 	struct kv		*kv_parent;
341 	TAILQ_ENTRY(kv)		 kv_entry;
342 
343 	RB_ENTRY(kv)		 kv_node;
344 
345 	/* A few pointers used by the rule actions */
346 	struct kv		*kv_match;
347 	struct kvtree		*kv_matchtree;
348 
349 	TAILQ_ENTRY(kv)		 kv_match_entry;
350 	TAILQ_ENTRY(kv)		 kv_rule_entry;
351 	TAILQ_ENTRY(kv)		 kv_action_entry;
352 };
353 
354 struct portrange {
355 	in_port_t		 val[2];
356 	u_int8_t		 op;
357 };
358 
359 struct address {
360 	objid_t			 rdrid;
361 	struct sockaddr_storage	 ss;
362 	int			 ipproto;
363 	struct portrange	 port;
364 	char			 ifname[IFNAMSIZ];
365 	TAILQ_ENTRY(address)	 entry;
366 };
367 TAILQ_HEAD(addresslist, address);
368 
369 union hashkey {
370 	/* Simplified version of pf_poolhashkey */
371 	u_int32_t		 data[4];
372 	SIPHASH_KEY		 siphashkey;
373 };
374 
375 #define F_DISABLE		0x00000001
376 #define F_BACKUP		0x00000002
377 #define F_USED			0x00000004
378 #define F_DOWN			0x00000008
379 #define F_ADD			0x00000010
380 #define F_DEL			0x00000020
381 #define F_CHANGED		0x00000040
382 #define F_STICKY		0x00000080
383 #define F_CHECK_DONE		0x00000100
384 #define F_ACTIVE_RULESET	0x00000200
385 #define F_CHECK_SENT		0x00000400
386 #define F_TLS			0x00000800
387 #define F_NATLOOK		0x00001000
388 #define F_DEMOTE		0x00002000
389 #define F_LOOKUP_PATH		0x00004000
390 #define F_DEMOTED		0x00008000
391 #define F_UDP			0x00010000
392 #define F_RETURN		0x00020000
393 #define F_AGENTX		0x00040000
394 #define F_NEEDPF		0x00080000
395 #define F_PORT			0x00100000
396 #define F_TLSCLIENT		0x00200000
397 #define F_NEEDRT		0x00400000
398 #define F_MATCH			0x00800000
399 #define F_DIVERT		0x01000000
400 #define F_SCRIPT		0x02000000
401 #define F_TLSINSPECT		0x04000000
402 #define F_HASHKEY		0x08000000
403 #define F_AGENTX_TRAPONLY	0x10000000
404 #define F_PFLOG			0x20000000
405 #define F_PROXYV1		0x40000000
406 #define F_PROXYV2		0x80000000
407 
408 #define F_BITS								\
409 	"\10\01DISABLE\02BACKUP\03USED\04DOWN\05ADD\06DEL\07CHANGED"	\
410 	"\10STICKY-ADDRESS\11CHECK_DONE\12ACTIVE_RULESET\13CHECK_SENT"	\
411 	"\14TLS\15NAT_LOOKUP\16DEMOTE\17LOOKUP_PATH\20DEMOTED\21UDP"	\
412 	"\22RETURN\23TRAP\24NEEDPF\25PORT\26TLS_CLIENT\27NEEDRT"	\
413 	"\30MATCH\31DIVERT\32SCRIPT\33TLS_INSPECT\34HASHKEY"		\
414 	"\35AGENTX_TRAPONLY"
415 
416 enum forwardmode {
417 	FWD_NORMAL		= 0,
418 	FWD_ROUTE,
419 	FWD_TRANS
420 };
421 
422 struct host_config {
423 	objid_t			 id;
424 	objid_t			 parentid;
425 	objid_t			 tableid;
426 	int			 retry;
427 	char			 name[HOST_NAME_MAX+1];
428 	struct sockaddr_storage	 ss;
429 	int			 ttl;
430 	int			 priority;
431 };
432 
433 struct host {
434 	TAILQ_ENTRY(host)	 entry;
435 	TAILQ_ENTRY(host)	 globalentry;
436 	SLIST_ENTRY(host)	 child;
437 	SLIST_HEAD(,host)	 children;
438 	struct host_config	 conf;
439 	u_int32_t		 flags;
440 	char			*tablename;
441 	int			 up;
442 	int			 last_up;
443 	u_long			 check_cnt;
444 	u_long			 up_cnt;
445 	int			 retry_cnt;
446 	int			 idx;
447 	u_int16_t		 he;
448 	int			 code;
449 	struct ctl_tcp_event	 cte;
450 };
451 TAILQ_HEAD(hostlist, host);
452 
453 enum host_error {
454 	HCE_NONE		= 0,
455 	HCE_ABORT,
456 	HCE_INTERVAL_TIMEOUT,
457 	HCE_ICMP_OK,
458 	HCE_ICMP_READ_TIMEOUT,
459 	HCE_ICMP_WRITE_TIMEOUT,
460 	HCE_TCP_SOCKET_ERROR,
461 	HCE_TCP_SOCKET_LIMIT,
462 	HCE_TCP_SOCKET_OPTION,
463 	HCE_TCP_CONNECT_FAIL,
464 	HCE_TCP_CONNECT_TIMEOUT,
465 	HCE_TCP_CONNECT_OK,
466 	HCE_TCP_WRITE_TIMEOUT,
467 	HCE_TCP_WRITE_FAIL,
468 	HCE_TCP_READ_TIMEOUT,
469 	HCE_TCP_READ_FAIL,
470 	HCE_SCRIPT_OK,
471 	HCE_SCRIPT_FAIL,
472 	HCE_TLS_CONNECT_ERROR,
473 	HCE_TLS_CONNECT_FAIL,
474 	HCE_TLS_CONNECT_OK,
475 	HCE_TLS_CONNECT_TIMEOUT,
476 	HCE_TLS_READ_TIMEOUT,
477 	HCE_TLS_WRITE_TIMEOUT,
478 	HCE_TLS_READ_ERROR,
479 	HCE_TLS_WRITE_ERROR,
480 	HCE_SEND_EXPECT_FAIL,
481 	HCE_SEND_EXPECT_OK,
482 	HCE_HTTP_CODE_ERROR,
483 	HCE_HTTP_CODE_FAIL,
484 	HCE_HTTP_CODE_OK,
485 	HCE_HTTP_DIGEST_ERROR,
486 	HCE_HTTP_DIGEST_FAIL,
487 	HCE_HTTP_DIGEST_OK,
488 };
489 
490 enum host_status {
491 	HOST_DOWN	= -1,
492 	HOST_UNKNOWN	= 0,
493 	HOST_UP		= 1
494 };
495 #define HOST_ISUP(x)	(x == HOST_UP)
496 
497 struct table_config {
498 	objid_t			 id;
499 	objid_t			 rdrid;
500 	u_int32_t		 flags;
501 	int			 check;
502 	char			 demote_group[IFNAMSIZ];
503 	char			 ifname[IFNAMSIZ];
504 	struct timeval		 timeout;
505 	in_port_t		 port;
506 	int			 retcode;
507 	int			 skip_cnt;
508 	char			 name[TABLE_NAME_SIZE];
509 	size_t			 name_len;
510 	char			 path[PATH_MAX];
511 	unsigned char		 exbinbuf[128];
512 	char			 exbuf[256];
513 	char			 digest[41]; /* length of sha1 digest * 2 */
514 	u_int8_t		 digest_type;
515 	enum forwardmode	 fwdmode;
516 };
517 
518 struct table {
519 	TAILQ_ENTRY(table)	 entry;
520 	struct table_config	 conf;
521 	int			 up;
522 	int			 skipped;
523 	struct hostlist		 hosts;
524 	struct tls_config	*tls_cfg;
525 	struct ibuf		*sendbinbuf;
526 	char			*sendbuf;
527 };
528 TAILQ_HEAD(tablelist, table);
529 
530 enum table_check {
531 	CHECK_NOCHECK		= 0,
532 	CHECK_ICMP		= 1,
533 	CHECK_TCP		= 2,
534 	CHECK_HTTP_CODE		= 3,
535 	CHECK_HTTP_DIGEST	= 4,
536 	CHECK_BINSEND_EXPECT	= 5,
537 	CHECK_SEND_EXPECT	= 6,
538 	CHECK_SCRIPT		= 7
539 };
540 
541 struct rdr_config {
542 	objid_t			 id;
543 	u_int32_t		 flags;
544 	in_port_t		 port;
545 	objid_t			 table_id;
546 	objid_t			 backup_id;
547 	int			 mode;
548 	union hashkey		 key;
549 	char			 name[PF_TABLE_NAME_SIZE];
550 	char			 tag[PF_TAG_NAME_SIZE];
551 	struct timeval		 timeout;
552 };
553 
554 struct rdr {
555 	TAILQ_ENTRY(rdr)	 entry;
556 	struct rdr_config	 conf;
557 	struct addresslist	 virts;
558 	struct table		*table;
559 	struct table		*backup; /* use this if no host up */
560 	struct ctl_stats	 stats;
561 };
562 TAILQ_HEAD(rdrlist, rdr);
563 
564 struct rsession {
565 	objid_t				 se_id;
566 	objid_t				 se_relayid;
567 	struct sockaddr_storage		 se_sockname;
568 	struct ctl_relay_event		 se_in;
569 	struct ctl_relay_event		 se_out;
570 	void				*se_priv;
571 	SIPHASH_CTX			 se_siphashctx;
572 	struct relay_table		*se_table;
573 	struct relay_table		*se_table0;
574 	struct event			 se_ev;
575 	struct timeval			 se_timeout;
576 	struct timeval			 se_tv_start;
577 	struct timeval			 se_tv_last;
578 	struct event			 se_inflightevt;
579 	int				 se_done;
580 	int				 se_retry;
581 	int				 se_retrycount;
582 	int				 se_connectcount;
583 	int				 se_haslog;
584 	struct evbuffer			*se_log;
585 	struct relay			*se_relay;
586 	struct ctl_natlook		*se_cnl;
587 	int				 se_bnds;
588 	u_int16_t			 se_tag;
589 	u_int16_t			 se_label;
590 
591 	int				 se_cid;
592 	pid_t				 se_pid;
593 	SPLAY_ENTRY(rsession)		 se_nodes;
594 	TAILQ_ENTRY(rsession)		 se_entry;
595 };
596 SPLAY_HEAD(session_tree, rsession);
597 TAILQ_HEAD(sessionlist, rsession);
598 
599 enum prototype {
600 	RELAY_PROTO_TCP		= 0,
601 	RELAY_PROTO_HTTP,
602 	RELAY_PROTO_DNS
603 };
604 
605 enum relay_result {
606 	RES_DROP		= 0,
607 	RES_PASS		= 1,
608 	RES_FAIL		= -1,
609 	RES_BAD			= -2,
610 	RES_INTERNAL		= -3
611 };
612 
613 enum rule_action {
614 	RULE_ACTION_MATCH	= 0,
615 	RULE_ACTION_PASS,
616 	RULE_ACTION_BLOCK
617 };
618 
619 struct rule_addr {
620 	struct sockaddr_storage		 addr;
621 	u_int8_t			 addr_mask;
622 	int				 addr_port;
623 };
624 
625 #define RELAY_ADDR_EQ(_a, _b)						\
626 	((_a)->addr_mask == (_b)->addr_mask &&				\
627 	sockaddr_cmp((struct sockaddr *)&(_a)->addr,			\
628 	(struct sockaddr *)&(_b)->addr, (_a)->addr_mask) == 0)
629 
630 #define RELAY_ADDR_CMP(_a, _b)						\
631 	sockaddr_cmp((struct sockaddr *)&(_a)->addr,			\
632 	(struct sockaddr *)(_b), (_a)->addr_mask)
633 
634 #define RELAY_ADDR_NEQ(_a, _b)						\
635 	((_a)->addr_mask != (_b)->addr_mask ||				\
636 	sockaddr_cmp((struct sockaddr *)&(_a)->addr,			\
637 	(struct sockaddr *)&(_b)->addr, (_a)->addr_mask) != 0)
638 
639 #define RELAY_AF_NEQ(_a, _b)						\
640 	(((_a) != AF_UNSPEC) && ((_b) != AF_UNSPEC) &&			\
641 	((_a) != (_b)))
642 
643 struct relay_rule {
644 	objid_t			 rule_id;
645 	objid_t			 rule_protoid;
646 
647 	u_int			 rule_action;
648 #define RULE_SKIP_PROTO		 0
649 #define RULE_SKIP_DIR		 1
650 #define RULE_SKIP_AF		 2
651 #define RULE_SKIP_SRC		 3
652 #define RULE_SKIP_DST		 4
653 #define RULE_SKIP_METHOD	 5
654 #define RULE_SKIP_COUNT		 6
655 	struct relay_rule	*rule_skip[RULE_SKIP_COUNT];
656 
657 #define RULE_FLAG_QUICK		0x01
658 	u_int8_t		 rule_flags;
659 
660 	int			 rule_label;
661 	int			 rule_tag;
662 	int			 rule_tagged;
663 	enum direction		 rule_dir;
664 	u_int			 rule_proto;
665 	int			 rule_af;
666 	struct rule_addr	 rule_src;
667 	struct rule_addr	 rule_dst;
668 	struct relay_table	*rule_table;
669 
670 	u_int			 rule_method;
671 	char			 rule_labelname[LABEL_NAME_SIZE];
672 	char			 rule_tablename[TABLE_NAME_SIZE];
673 	char			 rule_taggedname[TAG_NAME_SIZE];
674 	char			 rule_tagname[TAG_NAME_SIZE];
675 
676 	struct ctl_rule		 rule_ctl;
677 	struct kv		 rule_kv[KEY_TYPE_MAX];
678 	struct kvlist		 rule_kvlist;
679 
680 	TAILQ_ENTRY(relay_rule)	 rule_entry;
681 };
682 TAILQ_HEAD(relay_rules, relay_rule);
683 
684 #define TCPFLAG_NODELAY		0x01
685 #define TCPFLAG_NNODELAY	0x02
686 #define TCPFLAG_SACK		0x04
687 #define TCPFLAG_NSACK		0x08
688 #define TCPFLAG_BUFSIZ		0x10
689 #define TCPFLAG_IPTTL		0x20
690 #define TCPFLAG_IPMINTTL	0x40
691 #define TCPFLAG_NSPLICE		0x80
692 #define TCPFLAG_DEFAULT		0x00
693 
694 #define TCPFLAG_BITS						\
695 	"\10\01NODELAY\02NO_NODELAY\03SACK\04NO_SACK"		\
696 	"\05SOCKET_BUFFER_SIZE\06IP_TTL\07IP_MINTTL\10NO_SPLICE"
697 
698 #define TLSFLAG_SSLV3				0x01
699 #define TLSFLAG_TLSV1_0				0x02
700 #define TLSFLAG_TLSV1_1				0x04
701 #define TLSFLAG_TLSV1_2				0x08
702 #define TLSFLAG_TLSV1_3				0x10
703 #define TLSFLAG_TLSV1				0x1e
704 #define TLSFLAG_VERSION				0x1f
705 #define TLSFLAG_CIPHER_SERVER_PREF		0x20
706 #define TLSFLAG_CLIENT_RENEG			0x40
707 #define TLSFLAG_DEFAULT				\
708 	(TLSFLAG_TLSV1_2|TLSFLAG_TLSV1_3|TLSFLAG_CIPHER_SERVER_PREF)
709 
710 #define TLSFLAG_BITS						\
711 	"\06\01sslv3\02tlsv1.0\03tlsv1.1\04tlsv1.2\05tlsv1.3"	\
712 	"\06cipher-server-preference\07client-renegotiation"
713 
714 #define TLSCIPHERS_DEFAULT	"HIGH:!aNULL"
715 #define TLSECDHECURVES_DEFAULT	"default"
716 #define TLSDHPARAM_DEFAULT	"none"
717 
718 struct relay_ticket_key {
719 	uint32_t	tt_keyrev;
720 	unsigned char	tt_key[TLS_TICKET_KEY_SIZE];
721 };
722 #define	TLS_SESSION_LIFETIME	(2 * 3600)
723 
724 #define HTTPFLAG_WEBSOCKETS	0x01
725 
726 struct keyname {
727 	TAILQ_ENTRY(keyname)	 entry;
728 	char			*name;
729 	char			 certificate[PATH_MAX];
730 	char			 key[PATH_MAX];
731 	char			 ocsp[PATH_MAX];
732 };
733 TAILQ_HEAD(keynamelist, keyname);
734 
735 struct protocol {
736 	objid_t			 id;
737 	u_int32_t		 flags;
738 	u_int8_t		 tcpflags;
739 	int			 tcpbufsiz;
740 	int			 tcpbacklog;
741 	u_int8_t		 tcpipttl;
742 	u_int8_t		 tcpipminttl;
743 	size_t			 httpheaderlen;
744 	int			 httpflags;
745 	u_int8_t		 tlsflags;
746 	char			 tlsciphers[768];
747 	char			 tlsdhparams[128];
748 	char			 tlsecdhecurves[128];
749 	char			 tlsca[PATH_MAX];
750 	char			 tlscacert[PATH_MAX];
751 	char			 tlscakey[PATH_MAX];
752 	char			*tlscapass;
753 	char			 tlsclientca[PATH_MAX];
754 	struct keynamelist	 tlscerts;
755 	char			 name[MAX_NAME_SIZE];
756 	int			 tickets;
757 	enum prototype		 type;
758 	char			*style;
759 
760 	int			(*cmp)(struct rsession *, struct rsession *);
761 	void			*(*validate)(struct rsession *, struct relay *,
762 				    struct sockaddr_storage *,
763 				    u_int8_t *, size_t);
764 	int			(*request)(struct rsession *);
765 	void			(*close)(struct rsession *);
766 
767 	struct relay_rules	 rules;
768 	int			 rulecount;
769 
770 	TAILQ_ENTRY(protocol)	 entry;
771 };
772 TAILQ_HEAD(protolist, protocol);
773 
774 struct relay_table {
775 	struct table		*rlt_table;
776 	u_int32_t		 rlt_flags;
777 	int			 rlt_mode;
778 	u_int32_t		 rlt_index;
779 	struct host		*rlt_host[RELAY_MAXHOSTS];
780 	int			 rlt_nhosts;
781 	TAILQ_ENTRY(relay_table) rlt_entry;
782 };
783 TAILQ_HEAD(relaytables, relay_table);
784 
785 struct ca_pkey {
786 	char			 pkey_hash[TLS_CERT_HASH_SIZE];
787 	EVP_PKEY		*pkey;
788 	TAILQ_ENTRY(ca_pkey)	 pkey_entry;
789 };
790 TAILQ_HEAD(ca_pkeylist, ca_pkey);
791 
792 struct relay_cert {
793 	objid_t			 cert_id;
794 	objid_t			 cert_relayid;
795 	int			 cert_fd;
796 	int			 cert_key_fd;
797 	int			 cert_ocsp_fd;
798 	EVP_PKEY		*cert_pkey;
799 	TAILQ_ENTRY(relay_cert)	 cert_entry;
800 };
801 TAILQ_HEAD(relaycertlist, relay_cert);
802 
803 struct relay_config {
804 	objid_t			 id;
805 	u_int32_t		 flags;
806 	objid_t			 proto;
807 	char			 name[HOST_NAME_MAX+1];
808 	in_port_t		 port;
809 	in_port_t		 dstport;
810 	int			 dstretry;
811 	struct sockaddr_storage	 ss;
812 	struct sockaddr_storage	 dstss;
813 	struct sockaddr_storage	 dstaf;
814 	struct timeval		 timeout;
815 	enum forwardmode	 fwdmode;
816 	union hashkey		 hashkey;
817 	off_t			 tls_cakey_len;
818 };
819 
820 struct relay {
821 	TAILQ_ENTRY(relay)	 rl_entry;
822 	struct relay_config	 rl_conf;
823 
824 	int			 rl_up;
825 	struct protocol		*rl_proto;
826 	int			 rl_s;
827 	struct bufferevent	*rl_bev;
828 
829 	int			 rl_dsts;
830 	struct bufferevent	*rl_dstbev;
831 
832 	struct relaytables	 rl_tables;
833 
834 	struct event		 rl_ev;
835 	struct event		 rl_evt;
836 
837 	struct tls_config	*rl_tls_cfg;
838 	struct tls_config	*rl_tls_client_cfg;
839 	struct tls		*rl_tls_ctx;
840 
841 	int			 rl_tls_ca_fd;
842 	int			 rl_tls_cacert_fd;
843 	int			 rl_tls_client_ca_fd;
844 	EVP_PKEY		*rl_tls_pkey;
845 	X509			*rl_tls_cacertx509;
846 	char			*rl_tls_cakey;
847 	EVP_PKEY		*rl_tls_capkey;
848 
849 	struct ctl_stats	 rl_stats[PROC_MAX_INSTANCES + 1];
850 
851 	struct session_tree	 rl_sessions;
852 };
853 TAILQ_HEAD(relaylist, relay);
854 
855 enum dstmode {
856 	RELAY_DSTMODE_LOADBALANCE = 0,
857 	RELAY_DSTMODE_ROUNDROBIN,
858 	RELAY_DSTMODE_HASH,
859 	RELAY_DSTMODE_SRCHASH,
860 	RELAY_DSTMODE_LEASTSTATES,
861 	RELAY_DSTMODE_RANDOM
862 };
863 #define RELAY_DSTMODE_DEFAULT		RELAY_DSTMODE_ROUNDROBIN
864 
865 struct netroute_config {
866 	objid_t			 id;
867 	struct sockaddr_storage	 ss;
868 	int			 prefixlen;
869 	objid_t			 routerid;
870 };
871 
872 struct netroute {
873 	struct netroute_config	 nr_conf;
874 
875 	TAILQ_ENTRY(netroute)	 nr_entry;
876 	TAILQ_ENTRY(netroute)	 nr_route;
877 
878 	struct router		*nr_router;
879 };
880 TAILQ_HEAD(netroutelist, netroute);
881 
882 struct router_config {
883 	objid_t			 id;
884 	u_int32_t		 flags;
885 	char			 name[HOST_NAME_MAX+1];
886 	char			 label[RT_LABEL_SIZE];
887 	int			 nroutes;
888 	objid_t			 gwtable;
889 	in_port_t		 gwport;
890 	int			 rtable;
891 	int			 af;
892 };
893 
894 struct router {
895 	struct router_config	 rt_conf;
896 
897 	struct table		*rt_gwtable;
898 	struct netroutelist	 rt_netroutes;
899 
900 	TAILQ_ENTRY(router)	 rt_entry;
901 };
902 TAILQ_HEAD(routerlist, router);
903 
904 struct ctl_netroute {
905 	int			up;
906 	struct host_config	host;
907 	struct netroute_config	nr;
908 	struct router_config	rt;
909 };
910 
911 /* initially control.h */
912 struct control_sock {
913 	const char	*cs_name;
914 	struct event	 cs_ev;
915 	struct event	 cs_evt;
916 	int		 cs_fd;
917 	int		 cs_restricted;
918 	void		*cs_env;
919 
920 	TAILQ_ENTRY(control_sock) cs_entry;
921 };
922 TAILQ_HEAD(control_socks, control_sock);
923 
924 struct imsgev {
925 	struct imsgbuf		 ibuf;
926 	void			(*handler)(int, short, void *);
927 	struct event		 ev;
928 	struct privsep_proc	*proc;
929 	void			*data;
930 	short			 events;
931 };
932 
933 #define IMSG_SIZE_CHECK(imsg, p) do {				\
934 	if (IMSG_DATA_SIZE(imsg) < sizeof(*p))			\
935 		fatalx("bad length imsg received");		\
936 } while (0)
937 #define IMSG_DATA_SIZE(imsg)	((imsg)->hdr.len - IMSG_HEADER_SIZE)
938 
939 struct ctl_conn {
940 	TAILQ_ENTRY(ctl_conn)	 entry;
941 	u_int8_t		 flags;
942 	u_int			 waiting;
943 #define CTL_CONN_NOTIFY		 0x01
944 	struct imsgev		 iev;
945 
946 };
947 TAILQ_HEAD(ctl_connlist, ctl_conn);
948 
949 enum imsg_type {
950 	IMSG_NONE,
951 	IMSG_CTL_OK,		/* answer to relayctl requests */
952 	IMSG_CTL_FAIL,
953 	IMSG_CTL_VERBOSE,
954 	IMSG_CTL_PROCFD,
955 	IMSG_CTL_END,
956 	IMSG_CTL_RDR,
957 	IMSG_CTL_TABLE,
958 	IMSG_CTL_HOST,
959 	IMSG_CTL_RELAY,
960 	IMSG_CTL_SESSION,
961 	IMSG_CTL_ROUTER,
962 	IMSG_CTL_NETROUTE,
963 	IMSG_CTL_TABLE_CHANGED,
964 	IMSG_CTL_PULL_RULESET,
965 	IMSG_CTL_PUSH_RULESET,
966 	IMSG_CTL_SHOW_SUM,	/* relayctl requests */
967 	IMSG_CTL_RDR_ENABLE,
968 	IMSG_CTL_RDR_DISABLE,
969 	IMSG_CTL_TABLE_ENABLE,
970 	IMSG_CTL_TABLE_DISABLE,
971 	IMSG_CTL_HOST_ENABLE,
972 	IMSG_CTL_HOST_DISABLE,
973 	IMSG_CTL_SHUTDOWN,
974 	IMSG_CTL_START,
975 	IMSG_CTL_RELOAD,
976 	IMSG_CTL_RESET,
977 	IMSG_CTL_POLL,
978 	IMSG_CTL_NOTIFY,
979 	IMSG_CTL_RDR_STATS,
980 	IMSG_CTL_RELAY_STATS,
981 	IMSG_RDR_ENABLE,	/* notifies from pfe to hce */
982 	IMSG_RDR_DISABLE,
983 	IMSG_TABLE_ENABLE,
984 	IMSG_TABLE_DISABLE,
985 	IMSG_HOST_ENABLE,
986 	IMSG_HOST_DISABLE,
987 	IMSG_HOST_STATUS,	/* notifies from hce to pfe */
988 	IMSG_SYNC,
989 	IMSG_NATLOOK,
990 	IMSG_DEMOTE,
991 	IMSG_STATISTICS,
992 	IMSG_SCRIPT,
993 	IMSG_AGENTXSOCK,
994 	IMSG_BINDANY,
995 	IMSG_RTMSG,		/* from pfe to parent */
996 	IMSG_CFG_TABLE,		/* configuration from parent */
997 	IMSG_CFG_HOST,
998 	IMSG_CFG_RDR,
999 	IMSG_CFG_VIRT,
1000 	IMSG_CFG_ROUTER,
1001 	IMSG_CFG_ROUTE,
1002 	IMSG_CFG_PROTO,
1003 	IMSG_CFG_RULE,
1004 	IMSG_CFG_RELAY,
1005 	IMSG_CFG_RELAY_TABLE,
1006 	IMSG_CFG_RELAY_CERT,
1007 	IMSG_CFG_RELAY_FD,
1008 	IMSG_CFG_DONE,
1009 	IMSG_CA_PRIVENC,
1010 	IMSG_CA_PRIVDEC,
1011 	IMSG_SESS_PUBLISH,	/* from relay to pfe */
1012 	IMSG_SESS_UNPUBLISH,
1013 	IMSG_TLSTICKET_REKEY
1014 };
1015 
1016 enum privsep_procid {
1017 	PROC_ALL	= -1,
1018 	PROC_PARENT	= 0,
1019 	PROC_HCE,
1020 	PROC_RELAY,
1021 	PROC_PFE,
1022 	PROC_CA,
1023 	PROC_MAX
1024 };
1025 extern enum privsep_procid privsep_process;
1026 
1027 /* Attach the control socket to the following process */
1028 #define PROC_CONTROL	PROC_PFE
1029 
1030 struct privsep_pipes {
1031 	int				*pp_pipes[PROC_MAX];
1032 };
1033 
1034 struct privsep {
1035 	struct privsep_pipes		*ps_pipes[PROC_MAX];
1036 	struct privsep_pipes		*ps_pp;
1037 
1038 	struct imsgev			*ps_ievs[PROC_MAX];
1039 	const char			*ps_title[PROC_MAX];
1040 	u_int8_t			 ps_what[PROC_MAX];
1041 
1042 	u_int				 ps_instances[PROC_MAX];
1043 	u_int				 ps_instance;
1044 
1045 	struct control_sock		 ps_csock;
1046 	struct control_socks		 ps_rcsocks;
1047 
1048 	/* Event and signal handlers */
1049 	struct event			 ps_evsigint;
1050 	struct event			 ps_evsigterm;
1051 	struct event			 ps_evsigchld;
1052 	struct event			 ps_evsighup;
1053 	struct event			 ps_evsigpipe;
1054 	struct event			 ps_evsigusr1;
1055 
1056 	int				 ps_noaction;
1057 	struct passwd			*ps_pw;
1058 	struct relayd			*ps_env;
1059 };
1060 
1061 struct privsep_proc {
1062 	const char		*p_title;
1063 	enum privsep_procid	 p_id;
1064 	int			(*p_cb)(int, struct privsep_proc *,
1065 				    struct imsg *);
1066 	void			(*p_init)(struct privsep *,
1067 				    struct privsep_proc *);
1068 	const char		*p_chroot;
1069 	struct privsep		*p_ps;
1070 	void			(*p_shutdown)(void);
1071 	struct passwd		*p_pw;
1072 };
1073 
1074 struct privsep_fd {
1075 	enum privsep_procid		 pf_procid;
1076 	unsigned int			 pf_instance;
1077 };
1078 
1079 struct relayd_config {
1080 	char			 tls_sid[SSL_MAX_SID_CTX_LENGTH];
1081 	char			 agentx_path[sizeof(((struct sockaddr_un *)NULL)->sun_path)];
1082 	char			 agentx_context[32];
1083 	struct timeval		 interval;
1084 	struct timeval		 timeout;
1085 	struct timeval		 statinterval;
1086 	u_int16_t		 prefork_relay;
1087 	u_int16_t		 opts;
1088 	u_int32_t		 flags;
1089 };
1090 
1091 struct pfdata {
1092 	int			 dev;
1093 	struct pf_anchor	*anchor;
1094 	struct pfioc_trans	 pft;
1095 	struct pfioc_trans_e	 pfte;
1096 	u_int8_t		 pfused;
1097 };
1098 
1099 struct relayd {
1100 	struct relayd_config	 sc_conf;
1101 	const char		*sc_conffile;
1102 	struct pfdata		*sc_pf;
1103 	int			 sc_rtsock;
1104 	int			 sc_rtseq;
1105 	int			 sc_tablecount;
1106 	int			 sc_rdrcount;
1107 	int			 sc_protocount;
1108 	int			 sc_relaycount;
1109 	int			 sc_routercount;
1110 	int			 sc_routecount;
1111 	struct table		 sc_empty_table;
1112 	struct protocol		 sc_proto_default;
1113 	struct event		 sc_ev;
1114 	struct tablelist	*sc_tables;
1115 	struct hostlist		 sc_hosts;
1116 	struct rdrlist		*sc_rdrs;
1117 	struct protolist	*sc_protos;
1118 	struct relaylist	*sc_relays;
1119 	struct routerlist	*sc_rts;
1120 	struct netroutelist	*sc_routes;
1121 	struct ca_pkeylist	*sc_pkeys;
1122 	struct relaycertlist	*sc_certs;
1123 	struct sessionlist	 sc_sessions;
1124 	char			 sc_demote_group[IFNAMSIZ];
1125 	u_int16_t		 sc_id;
1126 	int			 sc_rtable;
1127 
1128 	struct event		 sc_statev;
1129 
1130 	struct event		 sc_agentxev;
1131 
1132 	int			 sc_has_icmp;
1133 	int			 sc_has_icmp6;
1134 	struct ctl_icmp_event	 sc_icmp_send;
1135 	struct ctl_icmp_event	 sc_icmp_recv;
1136 	struct ctl_icmp_event	 sc_icmp6_send;
1137 	struct ctl_icmp_event	 sc_icmp6_recv;
1138 
1139 	struct relay_ticket_key	 sc_ticket;
1140 
1141 	struct privsep		*sc_ps;
1142 	int			 sc_reload;
1143 };
1144 
1145 #define RELAYD_OPT_VERBOSE		0x01
1146 #define RELAYD_OPT_NOACTION		0x04
1147 #define RELAYD_OPT_LOGUPDATE		0x08
1148 #define RELAYD_OPT_LOGHOSTCHECK		0x10
1149 #define RELAYD_OPT_LOGCON		0x20
1150 #define RELAYD_OPT_LOGCONERR		0x40
1151 
1152 /* control.c */
1153 int	 control_init(struct privsep *, struct control_sock *);
1154 int	 control_listen(struct control_sock *);
1155 void	 control_cleanup(struct control_sock *);
1156 void	 control_dispatch_imsg(int, short, void *);
1157 void	 control_imsg_forward(struct privsep *ps, struct imsg *);
1158 struct ctl_conn	*
1159 	 control_connbyfd(int);
1160 
1161 /* parse.y */
1162 int	 parse_config(const char *, struct relayd *);
1163 int	 load_config(const char *, struct relayd *);
1164 int	 cmdline_symset(char *);
1165 
1166 /* util.c */
1167 const char *host_error(enum host_error);
1168 const char *host_status(enum host_status);
1169 const char *table_check(enum table_check);
1170 #ifdef DEBUG
1171 const char *relay_state(enum relay_state);
1172 #endif
1173 const char *print_availability(u_long, u_long);
1174 const char *print_host(struct sockaddr_storage *, char *, size_t);
1175 const char *print_time(struct timeval *, struct timeval *, char *, size_t);
1176 const char *printb_flags(const u_int32_t, const char *);
1177 void	 getmonotime(struct timeval *);
1178 struct ibuf	*string2binary(const char *);
1179 void		 print_hex(uint8_t *, off_t, size_t);
1180 void		 print_debug(const char *, ...);
1181 
1182 /* pfe.c */
1183 void	 pfe(struct privsep *, struct privsep_proc *);
1184 void	 show(struct ctl_conn *);
1185 void	 show_sessions(struct ctl_conn *);
1186 int	 enable_rdr(struct ctl_conn *, struct ctl_id *);
1187 int	 enable_table(struct ctl_conn *, struct ctl_id *);
1188 int	 enable_host(struct ctl_conn *, struct ctl_id *, struct host *);
1189 int	 disable_rdr(struct ctl_conn *, struct ctl_id *);
1190 int	 disable_table(struct ctl_conn *, struct ctl_id *);
1191 int	 disable_host(struct ctl_conn *, struct ctl_id *, struct host *);
1192 
1193 /* pfe_filter.c */
1194 void	 init_tables(struct relayd *);
1195 void	 flush_table(struct relayd *, struct rdr *);
1196 void	 sync_table(struct relayd *, struct rdr *, struct table *);
1197 void	 sync_ruleset(struct relayd *, struct rdr *, int);
1198 void	 flush_rulesets(struct relayd *);
1199 int	 natlook(struct relayd *, struct ctl_natlook *);
1200 u_int64_t
1201 	 check_table(struct relayd *, struct rdr *, struct table *);
1202 
1203 /* pfe_route.c */
1204 void	 init_routes(struct relayd *);
1205 void	 sync_routes(struct relayd *, struct router *);
1206 int	 pfe_route(struct relayd *, struct ctl_netroute *);
1207 
1208 /* hce.c */
1209 void	 hce(struct privsep *, struct privsep_proc *);
1210 void	 hce_notify_done(struct host *, enum host_error);
1211 
1212 /* relay.c */
1213 void	 relay(struct privsep *, struct privsep_proc *);
1214 int	 relay_privinit(struct relay *);
1215 int	 relay_session_cmp(struct rsession *, struct rsession *);
1216 void	 relay_close(struct rsession *, const char *, int);
1217 int	 relay_reset_event(struct rsession *, struct ctl_relay_event *);
1218 void	 relay_natlook(int, short, void *);
1219 void	 relay_session(struct rsession *);
1220 int	 relay_from_table(struct rsession *);
1221 int	 relay_socket_af(struct sockaddr_storage *, in_port_t);
1222 in_port_t
1223 	 relay_socket_getport(struct sockaddr_storage *);
1224 int	 relay_cmp_af(struct sockaddr_storage *,
1225 	    struct sockaddr_storage *);
1226 void	 relay_write(struct bufferevent *, void *);
1227 void	 relay_read(struct bufferevent *, void *);
1228 int	 relay_splice(struct ctl_relay_event *);
1229 int	 relay_splicelen(struct ctl_relay_event *);
1230 int	 relay_spliceadjust(struct ctl_relay_event *);
1231 void	 relay_error(struct bufferevent *, short, void *);
1232 int	 relay_preconnect(struct rsession *);
1233 int	 relay_connect(struct rsession *);
1234 void	 relay_connected(int, short, void *);
1235 void	 relay_bindanyreq(struct rsession *, in_port_t, int);
1236 void	 relay_bindany(int, short, void *);
1237 void	 relay_dump(struct ctl_relay_event *, const void *, size_t);
1238 int	 relay_bufferevent_add(struct event *, int);
1239 int	 relay_bufferevent_print(struct ctl_relay_event *, const char *);
1240 int	 relay_bufferevent_write_buffer(struct ctl_relay_event *,
1241 	    struct evbuffer *);
1242 int	 relay_bufferevent_write_chunk(struct ctl_relay_event *,
1243 	    struct evbuffer *, size_t);
1244 int	 relay_bufferevent_write(struct ctl_relay_event *,
1245 	    void *, size_t);
1246 int	 relay_test(struct protocol *, struct ctl_relay_event *);
1247 void	 relay_calc_skip_steps(struct relay_rules *);
1248 void	 relay_match(struct kvlist *, struct kv *, struct kv *,
1249 	    struct kvtree *);
1250 void	 relay_session_publish(struct rsession *);
1251 void	 relay_session_unpublish(struct rsession *);
1252 
1253 SPLAY_PROTOTYPE(session_tree, rsession, se_nodes, relay_session_cmp);
1254 
1255 /* relay_http.c */
1256 void	 relay_http(struct relayd *);
1257 void	 relay_http_init(struct relay *);
1258 void	 relay_abort_http(struct rsession *, u_int, const char *,
1259 	    u_int16_t);
1260 void	 relay_read_http(struct bufferevent *, void *);
1261 void	 relay_close_http(struct rsession *);
1262 u_int	 relay_httpmethod_byname(const char *);
1263 const char
1264 	*relay_httpmethod_byid(u_int);
1265 const char
1266 	*relay_httperror_byid(u_int);
1267 int	 relay_http_priv_init(struct rsession *);
1268 int	 relay_httpdesc_init(struct ctl_relay_event *);
1269 ssize_t	 relay_http_time(time_t, char *, size_t);
1270 
1271 /* relay_udp.c */
1272 void	 relay_udp_privinit(struct relay *);
1273 void	 relay_udp_init(struct relayd *, struct relay *);
1274 int	 relay_udp_bind(struct sockaddr_storage *, in_port_t,
1275 	    struct protocol *);
1276 void	 relay_udp_server(int, short, void *);
1277 
1278 /* check_icmp.c */
1279 void	 icmp_init(struct relayd *);
1280 void	 schedule_icmp(struct relayd *, struct host *);
1281 void	 check_icmp(struct relayd *, struct timeval *);
1282 
1283 /* check_tcp.c */
1284 void	 check_tcp(struct ctl_tcp_event *);
1285 
1286 /* check_tls.c */
1287 void	 check_tls(struct ctl_tcp_event *);
1288 
1289 /* check_script.c */
1290 void	 check_script(struct relayd *, struct host *);
1291 void	 script_done(struct relayd *, struct ctl_script *);
1292 int	 script_exec(struct relayd *, struct ctl_script *);
1293 
1294 /* ssl.c */
1295 char	*ssl_load_key(struct relayd *, const char *, off_t *, char *);
1296 uint8_t *ssl_update_certificate(const uint8_t *, size_t, EVP_PKEY *,
1297 	    EVP_PKEY *, X509 *, size_t *);
1298 int	 ssl_load_pkey(char *, off_t, X509 **, EVP_PKEY **);
1299 
1300 /* ca.c */
1301 void	 ca(struct privsep *, struct privsep_proc *);
1302 void	 ca_engine_init(struct relayd *);
1303 void	 hash_x509(X509 *cert, char *hash, size_t hashlen);
1304 
1305 /* relayd.c */
1306 struct host	*host_find(struct relayd *, objid_t);
1307 struct table	*table_find(struct relayd *, objid_t);
1308 struct rdr	*rdr_find(struct relayd *, objid_t);
1309 struct netroute	*route_find(struct relayd *, objid_t);
1310 struct router	*router_find(struct relayd *, objid_t);
1311 struct host	*host_findbyname(struct relayd *, const char *);
1312 struct table	*table_findbyname(struct relayd *, const char *);
1313 struct table	*table_findbyconf(struct relayd *, struct table *);
1314 struct rdr	*rdr_findbyname(struct relayd *, const char *);
1315 void		 event_again(struct event *, int, short,
1316 		    void (*)(int, short, void *),
1317 		    struct timeval *, struct timeval *, void *);
1318 struct relay	*relay_find(struct relayd *, objid_t);
1319 struct protocol	*proto_find(struct relayd *, objid_t);
1320 struct rsession	*session_find(struct relayd *, objid_t);
1321 struct relay	*relay_findbyname(struct relayd *, const char *);
1322 struct relay	*relay_findbyaddr(struct relayd *, struct relay_config *);
1323 EVP_PKEY	*pkey_find(struct relayd *, char *hash);
1324 struct ca_pkey	*pkey_add(struct relayd *, EVP_PKEY *, char *hash);
1325 struct relay_cert *cert_add(struct relayd *, objid_t);
1326 struct relay_cert *cert_find(struct relayd *, objid_t);
1327 char		*relay_load_fd(int, off_t *);
1328 int		 relay_load_certfiles(struct relayd *, struct relay *,
1329 		    const struct keyname *);
1330 int		 expand_string(char *, size_t, const char *, const char *);
1331 void		 translate_string(char *);
1332 void		 purge_key(char **, off_t);
1333 void		 purge_table(struct relayd *, struct tablelist *,
1334 		    struct table *);
1335 void		 purge_relay(struct relayd *, struct relay *);
1336 char		*digeststr(enum digest_type, const u_int8_t *, size_t, char *);
1337 const char	*canonicalize_host(const char *, char *, size_t);
1338 int		 parse_url(const char *, char **, char **, char **);
1339 int		 map6to4(struct sockaddr_storage *);
1340 int		 map4to6(struct sockaddr_storage *, struct sockaddr_storage *);
1341 void		 imsg_event_add(struct imsgev *);
1342 int		 imsg_compose_event(struct imsgev *, u_int16_t, u_int32_t,
1343 		    pid_t, int, void *, u_int16_t);
1344 void		 socket_rlimit(int);
1345 char		*get_string(u_int8_t *, size_t);
1346 void		*get_data(u_int8_t *, size_t);
1347 int		 sockaddr_cmp(struct sockaddr *, struct sockaddr *, int);
1348 struct in6_addr *prefixlen2mask6(u_int8_t, u_int32_t *);
1349 u_int32_t	 prefixlen2mask(u_int8_t);
1350 int		 accept_reserve(int, struct sockaddr *, socklen_t *, int,
1351 		     volatile int *);
1352 struct kv	*kv_add(struct kvtree *, char *, char *, int);
1353 int		 kv_set(struct kv *, char *, ...)
1354 				__attribute__((__format__ (printf, 2, 3)));
1355 int		 kv_setkey(struct kv *, char *, ...)
1356 				__attribute__((__format__ (printf, 2, 3)));
1357 void		 kv_delete(struct kvtree *, struct kv *);
1358 void		 kv_purge(struct kvtree *);
1359 void		 kv_free(struct kv *);
1360 struct kv	*kv_inherit(struct kv *, struct kv *);
1361 void		 relay_log(struct rsession *, char *);
1362 int		 kv_log(struct rsession *, struct kv *, u_int16_t,
1363 		     enum direction);
1364 struct kv	*kv_find(struct kvtree *, struct kv *);
1365 struct kv	*kv_find_value(struct kvtree *, char *, const char *,
1366 		     const char *);
1367 int		 kv_cmp(struct kv *, struct kv *);
1368 int		 rule_add(struct protocol *, struct relay_rule *, const char
1369 		     *);
1370 void		 rule_delete(struct relay_rules *, struct relay_rule *);
1371 void		 rule_free(struct relay_rule *);
1372 struct relay_rule
1373 		*rule_inherit(struct relay_rule *);
1374 void		 rule_settable(struct relay_rules *, struct relay_table *);
1375 RB_PROTOTYPE(kvtree, kv, kv_node, kv_cmp);
1376 
1377 /* carp.c */
1378 int	 carp_demote_init(char *, int);
1379 void	 carp_demote_shutdown(void);
1380 int	 carp_demote_get(char *);
1381 int	 carp_demote_set(char *, int);
1382 int	 carp_demote_reset(char *, int);
1383 
1384 /* name2id.c */
1385 u_int16_t	 label_name2id(const char *);
1386 const char	*label_id2name(u_int16_t);
1387 void		 label_unref(u_int16_t);
1388 void		 label_ref(u_int16_t);
1389 u_int16_t	 tag_name2id(const char *);
1390 const char	*tag_id2name(u_int16_t);
1391 void		 tag_unref(u_int16_t);
1392 void		 tag_ref(u_int16_t);
1393 
1394 /* agentx_control.c */
1395 void	 agentx_init(struct relayd *);
1396 void	 agentx_setsock(struct relayd *, enum privsep_procid);
1397 void	 agentx_getsock(struct imsg *);
1398 void	 snmp_hosttrap(struct relayd *, struct table *, struct host *);
1399 
1400 /* shuffle.c */
1401 void		shuffle_init(struct shuffle *);
1402 u_int16_t	shuffle_generate16(struct shuffle *);
1403 
1404 /* proc.c */
1405 enum privsep_procid
1406 	    proc_getid(struct privsep_proc *, unsigned int, const char *);
1407 int	 proc_flush_imsg(struct privsep *, enum privsep_procid, int);
1408 void	 proc_init(struct privsep *, struct privsep_proc *, unsigned int, int,
1409 	    int, char **, enum privsep_procid);
1410 void	 proc_kill(struct privsep *);
1411 void	 proc_connect(struct privsep *);
1412 void	 proc_dispatch(int, short event, void *);
1413 void	 proc_run(struct privsep *, struct privsep_proc *,
1414 	    struct privsep_proc *, unsigned int,
1415 	    void (*)(struct privsep *, struct privsep_proc *, void *), void *);
1416 void	 proc_range(struct privsep *, enum privsep_procid, int *, int *);
1417 int	 proc_compose_imsg(struct privsep *, enum privsep_procid, int,
1418 	    u_int16_t, u_int32_t, int, void *, u_int16_t);
1419 int	 proc_compose(struct privsep *, enum privsep_procid,
1420 	    uint16_t, void *, uint16_t);
1421 int	 proc_composev_imsg(struct privsep *, enum privsep_procid, int,
1422 	    u_int16_t, u_int32_t, int, const struct iovec *, int);
1423 int	 proc_composev(struct privsep *, enum privsep_procid,
1424 	    uint16_t, const struct iovec *, int);
1425 int	 proc_forward_imsg(struct privsep *, struct imsg *,
1426 	    enum privsep_procid, int);
1427 struct imsgbuf *
1428 	 proc_ibuf(struct privsep *, enum privsep_procid, int);
1429 struct imsgev *
1430 	 proc_iev(struct privsep *, enum privsep_procid, int);
1431 void	 imsg_event_add(struct imsgev *);
1432 int	 imsg_compose_event(struct imsgev *, uint16_t, uint32_t,
1433 	    pid_t, int, void *, uint16_t);
1434 int	 imsg_composev_event(struct imsgev *, uint16_t, uint32_t,
1435 	    pid_t, int, const struct iovec *, int);
1436 
1437 /* config.c */
1438 int	 config_init(struct relayd *);
1439 void	 config_purge(struct relayd *, u_int);
1440 int	 config_setreset(struct relayd *, u_int);
1441 int	 config_getreset(struct relayd *, struct imsg *);
1442 int	 config_getcfg(struct relayd *, struct imsg *);
1443 int	 config_settable(struct relayd *, struct table *);
1444 int	 config_gettable(struct relayd *, struct imsg *);
1445 int	 config_gethost(struct relayd *, struct imsg *);
1446 int	 config_setrdr(struct relayd *, struct rdr *);
1447 int	 config_getrdr(struct relayd *, struct imsg *);
1448 int	 config_getvirt(struct relayd *, struct imsg *);
1449 int	 config_setrt(struct relayd *, struct router *);
1450 int	 config_getrt(struct relayd *, struct imsg *);
1451 int	 config_getroute(struct relayd *, struct imsg *);
1452 int	 config_setproto(struct relayd *, struct protocol *);
1453 int	 config_getproto(struct relayd *, struct imsg *);
1454 int	 config_setrule(struct relayd *, struct protocol *);
1455 int	 config_getrule(struct relayd *, struct imsg *);
1456 int	 config_setrelay(struct relayd *, struct relay *);
1457 int	 config_getrelay(struct relayd *, struct imsg *);
1458 int	 config_getrelaytable(struct relayd *, struct imsg *);
1459 int	 config_getrelayfd(struct relayd *, struct imsg *);
1460 
1461 /* proxy_protocol.c */
1462 int	proxy_protocol_v1(struct rsession *, struct evbuffer *);
1463 int	proxy_protocol_v2(struct rsession *, struct evbuffer *);
1464 
1465 #endif /* RELAYD_H */