nf_conntrack.h 9.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323
  1. /*
  2. * Connection state tracking for netfilter. This is separated from,
  3. * but required by, the (future) NAT layer; it can also be used by an iptables
  4. * extension.
  5. *
  6. * 16 Dec 2003: Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp>
  7. * - generalize L3 protocol dependent part.
  8. *
  9. * Derived from include/linux/netfiter_ipv4/ip_conntrack.h
  10. */
  11. #ifndef _NF_CONNTRACK_H
  12. #define _NF_CONNTRACK_H
  13. #include <linux/netfilter/nf_conntrack_common.h>
  14. #ifdef __KERNEL__
  15. #include <linux/bitops.h>
  16. #include <linux/compiler.h>
  17. #include <asm/atomic.h>
  18. #include <linux/netfilter/nf_conntrack_tcp.h>
  19. #include <linux/netfilter/nf_conntrack_sctp.h>
  20. #include <linux/netfilter/nf_conntrack_proto_gre.h>
  21. #include <net/netfilter/ipv4/nf_conntrack_icmp.h>
  22. #include <net/netfilter/ipv6/nf_conntrack_icmpv6.h>
  23. #include <net/netfilter/nf_conntrack_tuple.h>
  24. /* per conntrack: protocol private data */
  25. union nf_conntrack_proto {
  26. /* insert conntrack proto private data here */
  27. struct ip_ct_sctp sctp;
  28. struct ip_ct_tcp tcp;
  29. struct ip_ct_icmp icmp;
  30. struct nf_ct_icmpv6 icmpv6;
  31. struct nf_ct_gre gre;
  32. };
  33. union nf_conntrack_expect_proto {
  34. /* insert expect proto private data here */
  35. };
  36. /* Add protocol helper include file here */
  37. #include <linux/netfilter/nf_conntrack_ftp.h>
  38. #include <linux/netfilter/nf_conntrack_pptp.h>
  39. #include <linux/netfilter/nf_conntrack_h323.h>
  40. #include <linux/netfilter/nf_conntrack_sane.h>
  41. /* per conntrack: application helper private data */
  42. union nf_conntrack_help {
  43. /* insert conntrack helper private data (master) here */
  44. struct nf_ct_ftp_master ct_ftp_info;
  45. struct nf_ct_pptp_master ct_pptp_info;
  46. struct nf_ct_h323_master ct_h323_info;
  47. struct nf_ct_sane_master ct_sane_info;
  48. };
  49. #include <linux/types.h>
  50. #include <linux/skbuff.h>
  51. #include <linux/timer.h>
  52. #ifdef CONFIG_NETFILTER_DEBUG
  53. #define NF_CT_ASSERT(x) \
  54. do { \
  55. if (!(x)) \
  56. /* Wooah! I'm tripping my conntrack in a frenzy of \
  57. netplay... */ \
  58. printk("NF_CT_ASSERT: %s:%i(%s)\n", \
  59. __FILE__, __LINE__, __FUNCTION__); \
  60. } while(0)
  61. #else
  62. #define NF_CT_ASSERT(x)
  63. #endif
  64. struct nf_conntrack_helper;
  65. /* nf_conn feature for connections that have a helper */
  66. struct nf_conn_help {
  67. /* Helper. if any */
  68. struct nf_conntrack_helper *helper;
  69. union nf_conntrack_help help;
  70. /* Current number of expected connections */
  71. unsigned int expecting;
  72. };
  73. #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
  74. #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
  75. struct nf_conn
  76. {
  77. /* Usage count in here is 1 for hash table/destruct timer, 1 per skb,
  78. plus 1 for any connection(s) we are `master' for */
  79. struct nf_conntrack ct_general;
  80. /* XXX should I move this to the tail ? - Y.K */
  81. /* These are my tuples; original and reply */
  82. struct nf_conntrack_tuple_hash tuplehash[IP_CT_DIR_MAX];
  83. /* Have we seen traffic both ways yet? (bitset) */
  84. unsigned long status;
  85. /* If we were expected by an expectation, this will be it */
  86. struct nf_conn *master;
  87. /* Timer function; drops refcnt when it goes off. */
  88. struct timer_list timeout;
  89. #ifdef CONFIG_NF_CT_ACCT
  90. /* Accounting Information (same cache line as other written members) */
  91. struct ip_conntrack_counter counters[IP_CT_DIR_MAX];
  92. #endif
  93. /* Unique ID that identifies this conntrack*/
  94. unsigned int id;
  95. /* features - nat, helper, ... used by allocating system */
  96. u_int32_t features;
  97. #if defined(CONFIG_NF_CONNTRACK_MARK)
  98. u_int32_t mark;
  99. #endif
  100. #ifdef CONFIG_NF_CONNTRACK_SECMARK
  101. u_int32_t secmark;
  102. #endif
  103. /* Storage reserved for other modules: */
  104. union nf_conntrack_proto proto;
  105. /* features dynamically at the end: helper, nat (both optional) */
  106. char data[0];
  107. };
  108. static inline struct nf_conn *
  109. nf_ct_tuplehash_to_ctrack(const struct nf_conntrack_tuple_hash *hash)
  110. {
  111. return container_of(hash, struct nf_conn,
  112. tuplehash[hash->tuple.dst.dir]);
  113. }
  114. /* get master conntrack via master expectation */
  115. #define master_ct(conntr) (conntr->master)
  116. /* Alter reply tuple (maybe alter helper). */
  117. extern void
  118. nf_conntrack_alter_reply(struct nf_conn *conntrack,
  119. const struct nf_conntrack_tuple *newreply);
  120. /* Is this tuple taken? (ignoring any belonging to the given
  121. conntrack). */
  122. extern int
  123. nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
  124. const struct nf_conn *ignored_conntrack);
  125. /* Return conntrack_info and tuple hash for given skb. */
  126. static inline struct nf_conn *
  127. nf_ct_get(const struct sk_buff *skb, enum ip_conntrack_info *ctinfo)
  128. {
  129. *ctinfo = skb->nfctinfo;
  130. return (struct nf_conn *)skb->nfct;
  131. }
  132. /* decrement reference count on a conntrack */
  133. static inline void nf_ct_put(struct nf_conn *ct)
  134. {
  135. NF_CT_ASSERT(ct);
  136. nf_conntrack_put(&ct->ct_general);
  137. }
  138. /* Protocol module loading */
  139. extern int nf_ct_l3proto_try_module_get(unsigned short l3proto);
  140. extern void nf_ct_l3proto_module_put(unsigned short l3proto);
  141. extern struct nf_conntrack_tuple_hash *
  142. __nf_conntrack_find(const struct nf_conntrack_tuple *tuple,
  143. const struct nf_conn *ignored_conntrack);
  144. extern void nf_conntrack_hash_insert(struct nf_conn *ct);
  145. extern void nf_conntrack_flush(void);
  146. extern struct nf_conntrack_helper *
  147. nf_ct_helper_find_get( const struct nf_conntrack_tuple *tuple);
  148. extern void nf_ct_helper_put(struct nf_conntrack_helper *helper);
  149. extern struct nf_conntrack_helper *
  150. __nf_conntrack_helper_find_byname(const char *name);
  151. extern int nf_ct_invert_tuplepr(struct nf_conntrack_tuple *inverse,
  152. const struct nf_conntrack_tuple *orig);
  153. extern void __nf_ct_refresh_acct(struct nf_conn *ct,
  154. enum ip_conntrack_info ctinfo,
  155. const struct sk_buff *skb,
  156. unsigned long extra_jiffies,
  157. int do_acct);
  158. /* Refresh conntrack for this many jiffies and do accounting */
  159. static inline void nf_ct_refresh_acct(struct nf_conn *ct,
  160. enum ip_conntrack_info ctinfo,
  161. const struct sk_buff *skb,
  162. unsigned long extra_jiffies)
  163. {
  164. __nf_ct_refresh_acct(ct, ctinfo, skb, extra_jiffies, 1);
  165. }
  166. /* Refresh conntrack for this many jiffies */
  167. static inline void nf_ct_refresh(struct nf_conn *ct,
  168. const struct sk_buff *skb,
  169. unsigned long extra_jiffies)
  170. {
  171. __nf_ct_refresh_acct(ct, 0, skb, extra_jiffies, 0);
  172. }
  173. /* These are for NAT. Icky. */
  174. /* Update TCP window tracking data when NAT mangles the packet */
  175. extern void nf_conntrack_tcp_update(struct sk_buff *skb,
  176. unsigned int dataoff,
  177. struct nf_conn *conntrack,
  178. int dir);
  179. /* Call me when a conntrack is destroyed. */
  180. extern void (*nf_conntrack_destroyed)(struct nf_conn *conntrack);
  181. /* Fake conntrack entry for untracked connections */
  182. extern struct nf_conn nf_conntrack_untracked;
  183. extern int nf_ct_no_defrag;
  184. /* Iterate over all conntracks: if iter returns true, it's deleted. */
  185. extern void
  186. nf_ct_iterate_cleanup(int (*iter)(struct nf_conn *i, void *data), void *data);
  187. extern void nf_conntrack_free(struct nf_conn *ct);
  188. extern struct nf_conn *
  189. nf_conntrack_alloc(const struct nf_conntrack_tuple *orig,
  190. const struct nf_conntrack_tuple *repl);
  191. /* It's confirmed if it is, or has been in the hash table. */
  192. static inline int nf_ct_is_confirmed(struct nf_conn *ct)
  193. {
  194. return test_bit(IPS_CONFIRMED_BIT, &ct->status);
  195. }
  196. static inline int nf_ct_is_dying(struct nf_conn *ct)
  197. {
  198. return test_bit(IPS_DYING_BIT, &ct->status);
  199. }
  200. extern unsigned int nf_conntrack_htable_size;
  201. extern int nf_conntrack_checksum;
  202. extern atomic_t nf_conntrack_count;
  203. extern int nf_conntrack_max;
  204. DECLARE_PER_CPU(struct ip_conntrack_stat, nf_conntrack_stat);
  205. #define NF_CT_STAT_INC(count) (__get_cpu_var(nf_conntrack_stat).count++)
  206. #define NF_CT_STAT_INC_ATOMIC(count) \
  207. do { \
  208. local_bh_disable(); \
  209. __get_cpu_var(nf_conntrack_stat).count++; \
  210. local_bh_enable(); \
  211. } while (0)
  212. /* no helper, no nat */
  213. #define NF_CT_F_BASIC 0
  214. /* for helper */
  215. #define NF_CT_F_HELP 1
  216. /* for nat. */
  217. #define NF_CT_F_NAT 2
  218. #define NF_CT_F_NUM 4
  219. extern int
  220. nf_conntrack_register_cache(u_int32_t features, const char *name, size_t size);
  221. extern void
  222. nf_conntrack_unregister_cache(u_int32_t features);
  223. /* valid combinations:
  224. * basic: nf_conn, nf_conn .. nf_conn_help
  225. * nat: nf_conn .. nf_conn_nat, nf_conn .. nf_conn_nat .. nf_conn help
  226. */
  227. #ifdef CONFIG_NF_NAT_NEEDED
  228. static inline struct nf_conn_nat *nfct_nat(const struct nf_conn *ct)
  229. {
  230. unsigned int offset = sizeof(struct nf_conn);
  231. if (!(ct->features & NF_CT_F_NAT))
  232. return NULL;
  233. offset = ALIGN(offset, __alignof__(struct nf_conn_nat));
  234. return (struct nf_conn_nat *) ((void *)ct + offset);
  235. }
  236. static inline struct nf_conn_help *nfct_help(const struct nf_conn *ct)
  237. {
  238. unsigned int offset = sizeof(struct nf_conn);
  239. if (!(ct->features & NF_CT_F_HELP))
  240. return NULL;
  241. if (ct->features & NF_CT_F_NAT) {
  242. offset = ALIGN(offset, __alignof__(struct nf_conn_nat));
  243. offset += sizeof(struct nf_conn_nat);
  244. }
  245. offset = ALIGN(offset, __alignof__(struct nf_conn_help));
  246. return (struct nf_conn_help *) ((void *)ct + offset);
  247. }
  248. #else /* No NAT */
  249. static inline struct nf_conn_help *nfct_help(const struct nf_conn *ct)
  250. {
  251. unsigned int offset = sizeof(struct nf_conn);
  252. if (!(ct->features & NF_CT_F_HELP))
  253. return NULL;
  254. offset = ALIGN(offset, __alignof__(struct nf_conn_help));
  255. return (struct nf_conn_help *) ((void *)ct + offset);
  256. }
  257. #endif /* CONFIG_NF_NAT_NEEDED */
  258. #endif /* __KERNEL__ */
  259. #endif /* _NF_CONNTRACK_H */