FreeBSD 14 pf ステートフル・パケットフィルタと synproxy state による
L4 DDoS・VPN境界防御の設計と運用

# ============================================================================
# 1. FreeBSD 14 Production /etc/pf.conf (ap01 Edge Boundary Defense)
# ============================================================================
# ext_if = "vtnet0"
# int_vlan = "vtnet1" # Private VLAN to db01.ok.st (10.0.x.x/24)
# set limit { states 2000000, frags 65536, src-nodes 500000, table-entries 1000000 }
# set optimization aggressive
# set block-policy drop
# set skip on lo0
#
# table <bruteforce> persist counters
# table <bogons_rfc6890> persist file "/etc/pf.bogons.conf"
#
# scrub in on $ext_if all fragment reassemble min-ttl 15 max-mss 1460 random-id
#
# block drop log all
# block drop in quick on $ext_if from <bruteforce>
# block drop in quick on $ext_if from <bogons_rfc6890>
# antispoof quick for { $ext_if, $int_vlan }
#
# # L4 DDoS Protection via synproxy state + Automatic Rate-Based Quarantine
# pass in on $ext_if proto tcp from any to ($ext_if) port { 80, 443 } \
#     flags S/SA synproxy state \
#     (max-src-conn 80, max-src-conn-rate 45/5, overload <bruteforce> flush global)

// ============================================================================
// 2. Rust Edition 2024: Zero-Copy FreeBSD DLT_PFLOG Parser & RFC 1624 Seq Translater
// ============================================================================
#![no_std]
#![forbid(unsafe_code)]

/// Binary representation of FreeBSD 14 `pfloghdr` (sys/net/if_pflog.h)
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct PflogRecord {
    pub hdr_len: u8,
    pub address_family: u8,
    pub action: PfAction,
    pub reason: u8,
    pub rule_number: u32,
    pub direction: PfDirection,
    pub src_ipv4: [u8; 4],
    pub dst_ipv4: [u8; 4],
    pub src_port: u16,
    pub dst_port: u16,
    pub tcp_flags: u8,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum PfAction {
    Pass = 0,
    Drop = 1,
    Scrub = 2,
    SynProxyDrop = 9,
    Unknown = 255,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum PfDirection {
    In = 1,
    Out = 2,
    Unknown = 0,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum ParseError {
    FrameTooShort,
    UnsupportedAddressFamily(u8),
    NotTcpProtocol(u8),
}

/// Parses a raw BPF `DLT_PFLOG` frame (minimum 64-byte pflog header + 20-byte IPv4 + 20-byte TCP)
/// in O(1) time without heap allocation or unsafe pointer casts.
pub const fn parse_pflog_ipv4_tcp(frame: &[u8]) -> Result<PflogRecord, ParseError> {
    if frame.len() < 104 {
        return Err(ParseError::FrameTooShort);
    }
    let hdr_len = frame[0];
    // Word-aligned length in BPF: roundup(hdr_len, 4)
    let ip_offset = ((hdr_len as usize) + 3) & !3usize;
    if ip_offset < 60 || frame.len() < ip_offset + 40 {
        return Err(ParseError::FrameTooShort);
    }

    let af = frame[1];
    if af != 2 {
        // AF_INET on FreeBSD is 2
        return Err(ParseError::UnsupportedAddressFamily(af));
    }

    let action = match frame[2] {
        0 => PfAction::Pass,
        1 => PfAction::Drop,
        2 => PfAction::Scrub,
        9 => PfAction::SynProxyDrop,
        _ => PfAction::Unknown,
    };
    let reason = frame[3];
    let rule_number = u32::from_be_bytes([frame[36], frame[37], frame[38], frame[39]]);
    let direction = match frame[60] {
        1 => PfDirection::In,
        2 => PfDirection::Out,
        _ => PfDirection::Unknown,
    };

    let ip_hdr = &frame[ip_offset..];
    let ihl = ((ip_hdr[0] & 0x0F) as usize) * 4;
    if ihl < 20 || frame.len() < ip_offset + ihl + 14 {
        return Err(ParseError::FrameTooShort);
    }
    let proto = ip_hdr[9];
    if proto != 6 {
        // IPPROTO_TCP == 6
        return Err(ParseError::NotTcpProtocol(proto));
    }

    let src_ipv4 = [ip_hdr[12], ip_hdr[13], ip_hdr[14], ip_hdr[15]];
    let dst_ipv4 = [ip_hdr[16], ip_hdr[17], ip_hdr[18], ip_hdr[19]];
    let tcp_hdr = &frame[ip_offset + ihl..];
    let src_port = u16::from_be_bytes([tcp_hdr[0], tcp_hdr[1]]);
    let dst_port = u16::from_be_bytes([tcp_hdr[2], tcp_hdr[3]]);
    let tcp_flags = tcp_hdr[13];

    Ok(PflogRecord {
        hdr_len,
        address_family: af,
        action,
        reason,
        rule_number,
        direction,
        src_ipv4,
        dst_ipv4,
        src_port,
        dst_port,
        tcp_flags,
    })
}

/// Performs RFC 1624 incremental 16-bit one's complement TCP checksum update
/// when `synproxy state` translates a 32-bit sequence or acknowledgment number by `seqdiff`.
#[inline]
pub const fn translate_synproxy_seq_and_cksum(
    old_seq: u32,
    seqdiff: u32,
    old_check: u16,
) -> (u32, u16) {
    let new_seq = old_seq.wrapping_add(seqdiff);
    let old_hi = (old_seq >> 16) as u16;
    let old_lo = (old_seq & 0xFFFF) as u16;
    let new_hi = (new_seq >> 16) as u16;
    let new_lo = (new_seq & 0xFFFF) as u16;

    // HC' = ~(~HC + ~m_hi + ~m_lo + m'_hi + m'_lo) in 1's complement arithmetic
    let mut sum: u32 = (!old_check as u32)
        + (!old_hi as u32)
        + (!old_lo as u32)
        + (new_hi as u32)
        + (new_lo as u32);
    while (sum >> 16) != 0 {
        sum = (sum & 0xFFFF) + (sum >> 16);
    }
    (new_seq, !(sum as u16))
}