blob: d4f02eb0c66cdfe98b1af484afb4137c7e18a52f [file] [log] [blame]
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -08001/*
2 * Connection state tracking for netfilter. This is separated from,
3 * but required by, the (future) NAT layer; it can also be used by an iptables
4 * extension.
5 *
6 * 16 Dec 2003: Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp>
7 * - generalize L3 protocol dependent part.
8 *
9 * Derived from include/linux/netfiter_ipv4/ip_conntrack.h
10 */
11
12#ifndef _NF_CONNTRACK_H
13#define _NF_CONNTRACK_H
14
15#include <linux/netfilter/nf_conntrack_common.h>
16
17#ifdef __KERNEL__
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080018#include <linux/bitops.h>
19#include <linux/compiler.h>
20#include <asm/atomic.h>
21
22#include <linux/netfilter/nf_conntrack_tcp.h>
23#include <linux/netfilter/nf_conntrack_sctp.h>
Patrick McHardyf09943f2006-12-02 22:09:41 -080024#include <linux/netfilter/nf_conntrack_proto_gre.h>
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080025#include <net/netfilter/ipv4/nf_conntrack_icmp.h>
26#include <net/netfilter/ipv6/nf_conntrack_icmpv6.h>
27
28#include <net/netfilter/nf_conntrack_tuple.h>
29
30/* per conntrack: protocol private data */
31union nf_conntrack_proto {
32 /* insert conntrack proto private data here */
33 struct ip_ct_sctp sctp;
34 struct ip_ct_tcp tcp;
35 struct ip_ct_icmp icmp;
36 struct nf_ct_icmpv6 icmpv6;
Patrick McHardyf09943f2006-12-02 22:09:41 -080037 struct nf_ct_gre gre;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080038};
39
40union nf_conntrack_expect_proto {
41 /* insert expect proto private data here */
42};
43
44/* Add protocol helper include file here */
45#include <linux/netfilter/nf_conntrack_ftp.h>
Patrick McHardyf09943f2006-12-02 22:09:41 -080046#include <linux/netfilter/nf_conntrack_pptp.h>
Patrick McHardyf587de02006-12-02 22:08:46 -080047#include <linux/netfilter/nf_conntrack_h323.h>
Michal Schmidt6fecd192007-02-07 15:05:12 -080048#include <linux/netfilter/nf_conntrack_sane.h>
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080049
50/* per conntrack: application helper private data */
51union nf_conntrack_help {
52 /* insert conntrack helper private data (master) here */
Jozsef Kadlecsik55a73322006-12-02 22:07:44 -080053 struct nf_ct_ftp_master ct_ftp_info;
Patrick McHardyf09943f2006-12-02 22:09:41 -080054 struct nf_ct_pptp_master ct_pptp_info;
Patrick McHardyf587de02006-12-02 22:08:46 -080055 struct nf_ct_h323_master ct_h323_info;
Michal Schmidt6fecd192007-02-07 15:05:12 -080056 struct nf_ct_sane_master ct_sane_info;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080057};
58
59#include <linux/types.h>
60#include <linux/skbuff.h>
Al Virod7fe0f22006-12-03 23:15:30 -050061#include <linux/timer.h>
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080062
63#ifdef CONFIG_NETFILTER_DEBUG
64#define NF_CT_ASSERT(x) \
65do { \
66 if (!(x)) \
67 /* Wooah! I'm tripping my conntrack in a frenzy of \
68 netplay... */ \
69 printk("NF_CT_ASSERT: %s:%i(%s)\n", \
70 __FILE__, __LINE__, __FUNCTION__); \
71} while(0)
72#else
73#define NF_CT_ASSERT(x)
74#endif
75
76struct nf_conntrack_helper;
77
Harald Weltedc808fe2006-03-20 17:56:32 -080078/* nf_conn feature for connections that have a helper */
79struct nf_conn_help {
80 /* Helper. if any */
81 struct nf_conntrack_helper *helper;
82
83 union nf_conntrack_help help;
84
Patrick McHardyb5605802007-07-07 22:35:56 -070085 struct hlist_head expectations;
86
Harald Weltedc808fe2006-03-20 17:56:32 -080087 /* Current number of expected connections */
88 unsigned int expecting;
89};
90
91
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080092#include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
Patrick McHardyf8eb24a2006-11-29 02:35:15 +010093#include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
94
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -080095struct nf_conn
96{
97 /* Usage count in here is 1 for hash table/destruct timer, 1 per skb,
98 plus 1 for any connection(s) we are `master' for */
99 struct nf_conntrack ct_general;
100
101 /* XXX should I move this to the tail ? - Y.K */
102 /* These are my tuples; original and reply */
103 struct nf_conntrack_tuple_hash tuplehash[IP_CT_DIR_MAX];
104
105 /* Have we seen traffic both ways yet? (bitset) */
106 unsigned long status;
107
Harald Weltedc808fe2006-03-20 17:56:32 -0800108 /* If we were expected by an expectation, this will be it */
109 struct nf_conn *master;
110
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800111 /* Timer function; drops refcnt when it goes off. */
112 struct timer_list timeout;
113
114#ifdef CONFIG_NF_CT_ACCT
115 /* Accounting Information (same cache line as other written members) */
116 struct ip_conntrack_counter counters[IP_CT_DIR_MAX];
117#endif
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800118
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800119 /* Unique ID that identifies this conntrack*/
120 unsigned int id;
121
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800122#if defined(CONFIG_NF_CONNTRACK_MARK)
123 u_int32_t mark;
124#endif
125
James Morris7c9728c2006-06-09 00:31:46 -0700126#ifdef CONFIG_NF_CONNTRACK_SECMARK
127 u_int32_t secmark;
128#endif
129
Harald Weltedc808fe2006-03-20 17:56:32 -0800130 /* Storage reserved for other modules: */
131 union nf_conntrack_proto proto;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800132
Yasuyuki Kozakaiecfab2c2007-07-07 22:23:21 -0700133 /* Extensions */
134 struct nf_ct_ext *ext;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800135};
136
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800137static inline struct nf_conn *
138nf_ct_tuplehash_to_ctrack(const struct nf_conntrack_tuple_hash *hash)
139{
140 return container_of(hash, struct nf_conn,
141 tuplehash[hash->tuple.dst.dir]);
142}
143
144/* get master conntrack via master expectation */
145#define master_ct(conntr) (conntr->master)
146
147/* Alter reply tuple (maybe alter helper). */
148extern void
149nf_conntrack_alter_reply(struct nf_conn *conntrack,
150 const struct nf_conntrack_tuple *newreply);
151
152/* Is this tuple taken? (ignoring any belonging to the given
153 conntrack). */
154extern int
155nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
156 const struct nf_conn *ignored_conntrack);
157
158/* Return conntrack_info and tuple hash for given skb. */
159static inline struct nf_conn *
160nf_ct_get(const struct sk_buff *skb, enum ip_conntrack_info *ctinfo)
161{
162 *ctinfo = skb->nfctinfo;
163 return (struct nf_conn *)skb->nfct;
164}
165
166/* decrement reference count on a conntrack */
167static inline void nf_ct_put(struct nf_conn *ct)
168{
169 NF_CT_ASSERT(ct);
170 nf_conntrack_put(&ct->ct_general);
171}
172
Pablo Neira Ayusob9f78f92006-03-22 13:56:08 -0800173/* Protocol module loading */
174extern int nf_ct_l3proto_try_module_get(unsigned short l3proto);
175extern void nf_ct_l3proto_module_put(unsigned short l3proto);
176
Patrick McHardyac565e52007-07-07 22:30:08 -0700177extern struct hlist_head *nf_ct_alloc_hashtable(int *sizep, int *vmalloced);
178extern void nf_ct_free_hashtable(struct hlist_head *hash, int vmalloced,
179 int size);
180
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800181extern struct nf_conntrack_tuple_hash *
182__nf_conntrack_find(const struct nf_conntrack_tuple *tuple,
183 const struct nf_conn *ignored_conntrack);
184
185extern void nf_conntrack_hash_insert(struct nf_conn *ct);
186
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800187extern void nf_conntrack_flush(void);
188
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800189extern int nf_ct_invert_tuplepr(struct nf_conntrack_tuple *inverse,
190 const struct nf_conntrack_tuple *orig);
191
192extern void __nf_ct_refresh_acct(struct nf_conn *ct,
193 enum ip_conntrack_info ctinfo,
194 const struct sk_buff *skb,
195 unsigned long extra_jiffies,
196 int do_acct);
197
198/* Refresh conntrack for this many jiffies and do accounting */
199static inline void nf_ct_refresh_acct(struct nf_conn *ct,
200 enum ip_conntrack_info ctinfo,
201 const struct sk_buff *skb,
202 unsigned long extra_jiffies)
203{
204 __nf_ct_refresh_acct(ct, ctinfo, skb, extra_jiffies, 1);
205}
206
207/* Refresh conntrack for this many jiffies */
208static inline void nf_ct_refresh(struct nf_conn *ct,
209 const struct sk_buff *skb,
210 unsigned long extra_jiffies)
211{
212 __nf_ct_refresh_acct(ct, 0, skb, extra_jiffies, 0);
213}
214
215/* These are for NAT. Icky. */
216/* Update TCP window tracking data when NAT mangles the packet */
217extern void nf_conntrack_tcp_update(struct sk_buff *skb,
218 unsigned int dataoff,
219 struct nf_conn *conntrack,
220 int dir);
221
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800222/* Fake conntrack entry for untracked connections */
223extern struct nf_conn nf_conntrack_untracked;
224
225extern int nf_ct_no_defrag;
226
227/* Iterate over all conntracks: if iter returns true, it's deleted. */
228extern void
229nf_ct_iterate_cleanup(int (*iter)(struct nf_conn *i, void *data), void *data);
230extern void nf_conntrack_free(struct nf_conn *ct);
231extern struct nf_conn *
232nf_conntrack_alloc(const struct nf_conntrack_tuple *orig,
233 const struct nf_conntrack_tuple *repl);
234
235/* It's confirmed if it is, or has been in the hash table. */
236static inline int nf_ct_is_confirmed(struct nf_conn *ct)
237{
238 return test_bit(IPS_CONFIRMED_BIT, &ct->status);
239}
240
241static inline int nf_ct_is_dying(struct nf_conn *ct)
242{
243 return test_bit(IPS_DYING_BIT, &ct->status);
244}
245
Patrick McHardy587aa642007-03-14 16:37:25 -0700246static inline int nf_ct_is_untracked(const struct sk_buff *skb)
247{
248 return (skb->nfct == &nf_conntrack_untracked.ct_general);
249}
250
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800251extern unsigned int nf_conntrack_htable_size;
Patrick McHardy39a27a32006-05-29 18:23:54 -0700252extern int nf_conntrack_checksum;
Patrick McHardyf8eb24a2006-11-29 02:35:15 +0100253extern atomic_t nf_conntrack_count;
254extern int nf_conntrack_max;
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800255
Patrick McHardyf8eb24a2006-11-29 02:35:15 +0100256DECLARE_PER_CPU(struct ip_conntrack_stat, nf_conntrack_stat);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800257#define NF_CT_STAT_INC(count) (__get_cpu_var(nf_conntrack_stat).count++)
Patrick McHardyc0e912d2007-02-12 11:13:43 -0800258#define NF_CT_STAT_INC_ATOMIC(count) \
259do { \
260 local_bh_disable(); \
261 __get_cpu_var(nf_conntrack_stat).count++; \
262 local_bh_enable(); \
263} while (0)
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800264
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800265extern int
Harald Weltedc808fe2006-03-20 17:56:32 -0800266nf_conntrack_register_cache(u_int32_t features, const char *name, size_t size);
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800267extern void
268nf_conntrack_unregister_cache(u_int32_t features);
269
Yasuyuki Kozakai9fb9cbb2005-11-09 16:38:16 -0800270#endif /* __KERNEL__ */
271#endif /* _NF_CONNTRACK_H */