1
2
3
4
5
6
7
8
9
10
11
12#ifndef _NF_CONNTRACK_H
13#define _NF_CONNTRACK_H
14
15#include <linux/netfilter/nf_conntrack_common.h>
16
17#include <linux/bitops.h>
18#include <linux/compiler.h>
19#include <linux/atomic.h>
20
21#include <linux/netfilter/nf_conntrack_tcp.h>
22#include <linux/netfilter/nf_conntrack_dccp.h>
23#include <linux/netfilter/nf_conntrack_sctp.h>
24#include <linux/netfilter/nf_conntrack_proto_gre.h>
25#include <net/netfilter/ipv6/nf_conntrack_icmpv6.h>
26
27#include <net/netfilter/nf_conntrack_tuple.h>
28
29
30union nf_conntrack_proto {
31
32 struct nf_ct_dccp dccp;
33 struct ip_ct_sctp sctp;
34 struct ip_ct_tcp tcp;
35 struct nf_ct_gre gre;
36};
37
38union nf_conntrack_expect_proto {
39
40};
41
42#include <linux/types.h>
43#include <linux/skbuff.h>
44#include <linux/timer.h>
45
46#ifdef CONFIG_NETFILTER_DEBUG
47#define NF_CT_ASSERT(x) WARN_ON(!(x))
48#else
49#define NF_CT_ASSERT(x)
50#endif
51
52struct nf_conntrack_helper;
53
54
55#define NF_CT_MAX_EXPECT_CLASSES 4
56
57
58struct nf_conn_help {
59
60 struct nf_conntrack_helper __rcu *helper;
61
62 struct hlist_head expectations;
63
64
65 u8 expecting[NF_CT_MAX_EXPECT_CLASSES];
66
67
68 char data[];
69};
70
71#include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
72#include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
73
74struct nf_conn {
75
76
77 struct nf_conntrack ct_general;
78
79 spinlock_t lock;
80
81
82
83 struct nf_conntrack_tuple_hash tuplehash[IP_CT_DIR_MAX];
84
85
86 unsigned long status;
87
88
89 struct nf_conn *master;
90
91
92 struct timer_list timeout;
93
94#if defined(CONFIG_NF_CONNTRACK_MARK)
95 u_int32_t mark;
96#endif
97
98#ifdef CONFIG_NF_CONNTRACK_SECMARK
99 u_int32_t secmark;
100#endif
101
102
103 struct nf_ct_ext *ext;
104#ifdef CONFIG_NET_NS
105 struct net *ct_net;
106#endif
107
108
109 union nf_conntrack_proto proto;
110};
111
112static inline struct nf_conn *
113nf_ct_tuplehash_to_ctrack(const struct nf_conntrack_tuple_hash *hash)
114{
115 return container_of(hash, struct nf_conn,
116 tuplehash[hash->tuple.dst.dir]);
117}
118
119static inline u_int16_t nf_ct_l3num(const struct nf_conn *ct)
120{
121 return ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
122}
123
124static inline u_int8_t nf_ct_protonum(const struct nf_conn *ct)
125{
126 return ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum;
127}
128
129#define nf_ct_tuple(ct, dir) (&(ct)->tuplehash[dir].tuple)
130
131
132#define master_ct(conntr) (conntr->master)
133
134extern struct net init_net;
135
136static inline struct net *nf_ct_net(const struct nf_conn *ct)
137{
138 return read_pnet(&ct->ct_net);
139}
140
141
142extern void
143nf_conntrack_alter_reply(struct nf_conn *ct,
144 const struct nf_conntrack_tuple *newreply);
145
146
147
148extern int
149nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
150 const struct nf_conn *ignored_conntrack);
151
152
153static inline struct nf_conn *
154nf_ct_get(const struct sk_buff *skb, enum ip_conntrack_info *ctinfo)
155{
156 *ctinfo = skb->nfctinfo;
157 return (struct nf_conn *)skb->nfct;
158}
159
160
161static inline void nf_ct_put(struct nf_conn *ct)
162{
163 NF_CT_ASSERT(ct);
164 nf_conntrack_put(&ct->ct_general);
165}
166
167
168extern int nf_ct_l3proto_try_module_get(unsigned short l3proto);
169extern void nf_ct_l3proto_module_put(unsigned short l3proto);
170
171
172
173
174
175extern void *nf_ct_alloc_hashtable(unsigned int *sizep, int nulls);
176
177extern void nf_ct_free_hashtable(void *hash, unsigned int size);
178
179extern struct nf_conntrack_tuple_hash *
180__nf_conntrack_find(struct net *net, u16 zone,
181 const struct nf_conntrack_tuple *tuple);
182
183extern int nf_conntrack_hash_check_insert(struct nf_conn *ct);
184extern void nf_ct_delete_from_lists(struct nf_conn *ct);
185extern void nf_ct_dying_timeout(struct nf_conn *ct);
186
187extern void nf_conntrack_flush_report(struct net *net, u32 portid, int report);
188
189extern bool nf_ct_get_tuplepr(const struct sk_buff *skb,
190 unsigned int nhoff, u_int16_t l3num,
191 struct nf_conntrack_tuple *tuple);
192extern bool nf_ct_invert_tuplepr(struct nf_conntrack_tuple *inverse,
193 const struct nf_conntrack_tuple *orig);
194
195extern void __nf_ct_refresh_acct(struct nf_conn *ct,
196 enum ip_conntrack_info ctinfo,
197 const struct sk_buff *skb,
198 unsigned long extra_jiffies,
199 int do_acct);
200
201
202static inline void nf_ct_refresh_acct(struct nf_conn *ct,
203 enum ip_conntrack_info ctinfo,
204 const struct sk_buff *skb,
205 unsigned long extra_jiffies)
206{
207 __nf_ct_refresh_acct(ct, ctinfo, skb, extra_jiffies, 1);
208}
209
210
211static inline void nf_ct_refresh(struct nf_conn *ct,
212 const struct sk_buff *skb,
213 unsigned long extra_jiffies)
214{
215 __nf_ct_refresh_acct(ct, 0, skb, extra_jiffies, 0);
216}
217
218extern bool __nf_ct_kill_acct(struct nf_conn *ct,
219 enum ip_conntrack_info ctinfo,
220 const struct sk_buff *skb,
221 int do_acct);
222
223
224static inline bool nf_ct_kill_acct(struct nf_conn *ct,
225 enum ip_conntrack_info ctinfo,
226 const struct sk_buff *skb)
227{
228 return __nf_ct_kill_acct(ct, ctinfo, skb, 1);
229}
230
231
232static inline bool nf_ct_kill(struct nf_conn *ct)
233{
234 return __nf_ct_kill_acct(ct, 0, NULL, 0);
235}
236
237
238extern s16 (*nf_ct_nat_offset)(const struct nf_conn *ct,
239 enum ip_conntrack_dir dir,
240 u32 seq);
241
242
243DECLARE_PER_CPU(struct nf_conn, nf_conntrack_untracked);
244static inline struct nf_conn *nf_ct_untracked_get(void)
245{
246 return &__raw_get_cpu_var(nf_conntrack_untracked);
247}
248extern void nf_ct_untracked_status_or(unsigned long bits);
249
250
251extern void
252nf_ct_iterate_cleanup(struct net *net, int (*iter)(struct nf_conn *i, void *data), void *data);
253extern void nf_conntrack_free(struct nf_conn *ct);
254extern struct nf_conn *
255nf_conntrack_alloc(struct net *net, u16 zone,
256 const struct nf_conntrack_tuple *orig,
257 const struct nf_conntrack_tuple *repl,
258 gfp_t gfp);
259
260static inline int nf_ct_is_template(const struct nf_conn *ct)
261{
262 return test_bit(IPS_TEMPLATE_BIT, &ct->status);
263}
264
265
266static inline int nf_ct_is_confirmed(struct nf_conn *ct)
267{
268 return test_bit(IPS_CONFIRMED_BIT, &ct->status);
269}
270
271static inline int nf_ct_is_dying(struct nf_conn *ct)
272{
273 return test_bit(IPS_DYING_BIT, &ct->status);
274}
275
276static inline int nf_ct_is_untracked(const struct nf_conn *ct)
277{
278 return test_bit(IPS_UNTRACKED_BIT, &ct->status);
279}
280
281
282static inline bool nf_is_loopback_packet(const struct sk_buff *skb)
283{
284 return skb->dev && skb->skb_iif && skb->dev->flags & IFF_LOOPBACK;
285}
286
287struct kernel_param;
288
289extern int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp);
290extern unsigned int nf_conntrack_htable_size;
291extern unsigned int nf_conntrack_max;
292extern unsigned int nf_conntrack_hash_rnd;
293void init_nf_conntrack_hash_rnd(void);
294
295#define NF_CT_STAT_INC(net, count) __this_cpu_inc((net)->ct.stat->count)
296#define NF_CT_STAT_INC_ATOMIC(net, count) this_cpu_inc((net)->ct.stat->count)
297
298#define MODULE_ALIAS_NFCT_HELPER(helper) \
299 MODULE_ALIAS("nfct-helper-" helper)
300
301#endif
302