19fb9cbb1SYasuyuki Kozakai /* 29fb9cbb1SYasuyuki Kozakai * Connection state tracking for netfilter. This is separated from, 39fb9cbb1SYasuyuki Kozakai * but required by, the (future) NAT layer; it can also be used by an iptables 49fb9cbb1SYasuyuki Kozakai * extension. 59fb9cbb1SYasuyuki Kozakai * 69fb9cbb1SYasuyuki Kozakai * 16 Dec 2003: Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp> 79fb9cbb1SYasuyuki Kozakai * - generalize L3 protocol dependent part. 89fb9cbb1SYasuyuki Kozakai * 99fb9cbb1SYasuyuki Kozakai * Derived from include/linux/netfiter_ipv4/ip_conntrack.h 109fb9cbb1SYasuyuki Kozakai */ 119fb9cbb1SYasuyuki Kozakai 129fb9cbb1SYasuyuki Kozakai #ifndef _NF_CONNTRACK_H 139fb9cbb1SYasuyuki Kozakai #define _NF_CONNTRACK_H 149fb9cbb1SYasuyuki Kozakai 159fb9cbb1SYasuyuki Kozakai #include <linux/netfilter/nf_conntrack_common.h> 169fb9cbb1SYasuyuki Kozakai 179fb9cbb1SYasuyuki Kozakai #ifdef __KERNEL__ 189fb9cbb1SYasuyuki Kozakai #include <linux/bitops.h> 199fb9cbb1SYasuyuki Kozakai #include <linux/compiler.h> 209fb9cbb1SYasuyuki Kozakai #include <asm/atomic.h> 219fb9cbb1SYasuyuki Kozakai 229fb9cbb1SYasuyuki Kozakai #include <linux/netfilter/nf_conntrack_tcp.h> 232bc78049SPatrick McHardy #include <linux/netfilter/nf_conntrack_dccp.h> 249fb9cbb1SYasuyuki Kozakai #include <linux/netfilter/nf_conntrack_sctp.h> 25f09943feSPatrick McHardy #include <linux/netfilter/nf_conntrack_proto_gre.h> 269fb9cbb1SYasuyuki Kozakai #include <net/netfilter/ipv6/nf_conntrack_icmpv6.h> 279fb9cbb1SYasuyuki Kozakai 289fb9cbb1SYasuyuki Kozakai #include <net/netfilter/nf_conntrack_tuple.h> 299fb9cbb1SYasuyuki Kozakai 309fb9cbb1SYasuyuki Kozakai /* per conntrack: protocol private data */ 319fb9cbb1SYasuyuki Kozakai union nf_conntrack_proto { 329fb9cbb1SYasuyuki Kozakai /* insert conntrack proto private data here */ 332bc78049SPatrick McHardy struct nf_ct_dccp dccp; 349fb9cbb1SYasuyuki Kozakai struct ip_ct_sctp sctp; 359fb9cbb1SYasuyuki Kozakai struct ip_ct_tcp tcp; 36f09943feSPatrick McHardy struct nf_ct_gre gre; 379fb9cbb1SYasuyuki Kozakai }; 389fb9cbb1SYasuyuki Kozakai 399fb9cbb1SYasuyuki Kozakai union nf_conntrack_expect_proto { 409fb9cbb1SYasuyuki Kozakai /* insert expect proto private data here */ 419fb9cbb1SYasuyuki Kozakai }; 429fb9cbb1SYasuyuki Kozakai 439fb9cbb1SYasuyuki Kozakai /* Add protocol helper include file here */ 449fb9cbb1SYasuyuki Kozakai #include <linux/netfilter/nf_conntrack_ftp.h> 45f09943feSPatrick McHardy #include <linux/netfilter/nf_conntrack_pptp.h> 46f587de0eSPatrick McHardy #include <linux/netfilter/nf_conntrack_h323.h> 476fecd198SMichal Schmidt #include <linux/netfilter/nf_conntrack_sane.h> 480f32a40fSPatrick McHardy #include <linux/netfilter/nf_conntrack_sip.h> 499fb9cbb1SYasuyuki Kozakai 509fb9cbb1SYasuyuki Kozakai /* per conntrack: application helper private data */ 519fb9cbb1SYasuyuki Kozakai union nf_conntrack_help { 529fb9cbb1SYasuyuki Kozakai /* insert conntrack helper private data (master) here */ 5355a73324SJozsef Kadlecsik struct nf_ct_ftp_master ct_ftp_info; 54f09943feSPatrick McHardy struct nf_ct_pptp_master ct_pptp_info; 55f587de0eSPatrick McHardy struct nf_ct_h323_master ct_h323_info; 566fecd198SMichal Schmidt struct nf_ct_sane_master ct_sane_info; 570f32a40fSPatrick McHardy struct nf_ct_sip_master ct_sip_info; 589fb9cbb1SYasuyuki Kozakai }; 599fb9cbb1SYasuyuki Kozakai 609fb9cbb1SYasuyuki Kozakai #include <linux/types.h> 619fb9cbb1SYasuyuki Kozakai #include <linux/skbuff.h> 62d7fe0f24SAl Viro #include <linux/timer.h> 639fb9cbb1SYasuyuki Kozakai 649fb9cbb1SYasuyuki Kozakai #ifdef CONFIG_NETFILTER_DEBUG 6555871d04SPatrick McHardy #define NF_CT_ASSERT(x) WARN_ON(!(x)) 669fb9cbb1SYasuyuki Kozakai #else 679fb9cbb1SYasuyuki Kozakai #define NF_CT_ASSERT(x) 689fb9cbb1SYasuyuki Kozakai #endif 699fb9cbb1SYasuyuki Kozakai 709fb9cbb1SYasuyuki Kozakai struct nf_conntrack_helper; 719fb9cbb1SYasuyuki Kozakai 726002f266SPatrick McHardy /* Must be kept in sync with the classes defined by helpers */ 730d0ab037SPatrick McHardy #define NF_CT_MAX_EXPECT_CLASSES 3 746002f266SPatrick McHardy 75dc808fe2SHarald Welte /* nf_conn feature for connections that have a helper */ 76dc808fe2SHarald Welte struct nf_conn_help { 77dc808fe2SHarald Welte /* Helper. if any */ 78dc808fe2SHarald Welte struct nf_conntrack_helper *helper; 79dc808fe2SHarald Welte 80dc808fe2SHarald Welte union nf_conntrack_help help; 81dc808fe2SHarald Welte 82b560580aSPatrick McHardy struct hlist_head expectations; 83b560580aSPatrick McHardy 84dc808fe2SHarald Welte /* Current number of expected connections */ 856002f266SPatrick McHardy u8 expecting[NF_CT_MAX_EXPECT_CLASSES]; 86dc808fe2SHarald Welte }; 87dc808fe2SHarald Welte 889fb9cbb1SYasuyuki Kozakai #include <net/netfilter/ipv4/nf_conntrack_ipv4.h> 89f8eb24a8SPatrick McHardy #include <net/netfilter/ipv6/nf_conntrack_ipv6.h> 90f8eb24a8SPatrick McHardy 91ea781f19SEric Dumazet struct nf_conn { 929fb9cbb1SYasuyuki Kozakai /* Usage count in here is 1 for hash table/destruct timer, 1 per skb, 939fb9cbb1SYasuyuki Kozakai plus 1 for any connection(s) we are `master' for */ 949fb9cbb1SYasuyuki Kozakai struct nf_conntrack ct_general; 959fb9cbb1SYasuyuki Kozakai 96440f0d58SPatrick McHardy spinlock_t lock; 97440f0d58SPatrick McHardy 989fb9cbb1SYasuyuki Kozakai /* XXX should I move this to the tail ? - Y.K */ 999fb9cbb1SYasuyuki Kozakai /* These are my tuples; original and reply */ 1009fb9cbb1SYasuyuki Kozakai struct nf_conntrack_tuple_hash tuplehash[IP_CT_DIR_MAX]; 1019fb9cbb1SYasuyuki Kozakai 1029fb9cbb1SYasuyuki Kozakai /* Have we seen traffic both ways yet? (bitset) */ 1039fb9cbb1SYasuyuki Kozakai unsigned long status; 1049fb9cbb1SYasuyuki Kozakai 105dc808fe2SHarald Welte /* If we were expected by an expectation, this will be it */ 106dc808fe2SHarald Welte struct nf_conn *master; 107dc808fe2SHarald Welte 1089fb9cbb1SYasuyuki Kozakai /* Timer function; drops refcnt when it goes off. */ 1099fb9cbb1SYasuyuki Kozakai struct timer_list timeout; 1109fb9cbb1SYasuyuki Kozakai 1119fb9cbb1SYasuyuki Kozakai #if defined(CONFIG_NF_CONNTRACK_MARK) 1129fb9cbb1SYasuyuki Kozakai u_int32_t mark; 1139fb9cbb1SYasuyuki Kozakai #endif 1149fb9cbb1SYasuyuki Kozakai 1157c9728c3SJames Morris #ifdef CONFIG_NF_CONNTRACK_SECMARK 1167c9728c3SJames Morris u_int32_t secmark; 1177c9728c3SJames Morris #endif 1187c9728c3SJames Morris 119dc808fe2SHarald Welte /* Storage reserved for other modules: */ 120dc808fe2SHarald Welte union nf_conntrack_proto proto; 1219fb9cbb1SYasuyuki Kozakai 122ecfab2c9SYasuyuki Kozakai /* Extensions */ 123ecfab2c9SYasuyuki Kozakai struct nf_ct_ext *ext; 1245a1fb391SAlexey Dobriyan #ifdef CONFIG_NET_NS 1255a1fb391SAlexey Dobriyan struct net *ct_net; 1265a1fb391SAlexey Dobriyan #endif 1279fb9cbb1SYasuyuki Kozakai }; 1289fb9cbb1SYasuyuki Kozakai 1299fb9cbb1SYasuyuki Kozakai static inline struct nf_conn * 1309fb9cbb1SYasuyuki Kozakai nf_ct_tuplehash_to_ctrack(const struct nf_conntrack_tuple_hash *hash) 1319fb9cbb1SYasuyuki Kozakai { 1329fb9cbb1SYasuyuki Kozakai return container_of(hash, struct nf_conn, 1339fb9cbb1SYasuyuki Kozakai tuplehash[hash->tuple.dst.dir]); 1349fb9cbb1SYasuyuki Kozakai } 1359fb9cbb1SYasuyuki Kozakai 1365e8fbe2aSPatrick McHardy static inline u_int16_t nf_ct_l3num(const struct nf_conn *ct) 1375e8fbe2aSPatrick McHardy { 1385e8fbe2aSPatrick McHardy return ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num; 1395e8fbe2aSPatrick McHardy } 1405e8fbe2aSPatrick McHardy 1415e8fbe2aSPatrick McHardy static inline u_int8_t nf_ct_protonum(const struct nf_conn *ct) 1425e8fbe2aSPatrick McHardy { 1435e8fbe2aSPatrick McHardy return ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum; 1445e8fbe2aSPatrick McHardy } 1455e8fbe2aSPatrick McHardy 146f2f3e38cSPablo Neira Ayuso #define nf_ct_tuple(ct, dir) (&(ct)->tuplehash[dir].tuple) 147f2f3e38cSPablo Neira Ayuso 1489fb9cbb1SYasuyuki Kozakai /* get master conntrack via master expectation */ 1499fb9cbb1SYasuyuki Kozakai #define master_ct(conntr) (conntr->master) 1509fb9cbb1SYasuyuki Kozakai 1515a1fb391SAlexey Dobriyan extern struct net init_net; 1525a1fb391SAlexey Dobriyan 1535a1fb391SAlexey Dobriyan static inline struct net *nf_ct_net(const struct nf_conn *ct) 1545a1fb391SAlexey Dobriyan { 1555a1fb391SAlexey Dobriyan #ifdef CONFIG_NET_NS 1565a1fb391SAlexey Dobriyan return ct->ct_net; 1575a1fb391SAlexey Dobriyan #else 1585a1fb391SAlexey Dobriyan return &init_net; 1595a1fb391SAlexey Dobriyan #endif 1605a1fb391SAlexey Dobriyan } 1615a1fb391SAlexey Dobriyan 1629fb9cbb1SYasuyuki Kozakai /* Alter reply tuple (maybe alter helper). */ 1639fb9cbb1SYasuyuki Kozakai extern void 164c88130bcSPatrick McHardy nf_conntrack_alter_reply(struct nf_conn *ct, 1659fb9cbb1SYasuyuki Kozakai const struct nf_conntrack_tuple *newreply); 1669fb9cbb1SYasuyuki Kozakai 1679fb9cbb1SYasuyuki Kozakai /* Is this tuple taken? (ignoring any belonging to the given 1689fb9cbb1SYasuyuki Kozakai conntrack). */ 1699fb9cbb1SYasuyuki Kozakai extern int 1709fb9cbb1SYasuyuki Kozakai nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple, 1719fb9cbb1SYasuyuki Kozakai const struct nf_conn *ignored_conntrack); 1729fb9cbb1SYasuyuki Kozakai 1739fb9cbb1SYasuyuki Kozakai /* Return conntrack_info and tuple hash for given skb. */ 1749fb9cbb1SYasuyuki Kozakai static inline struct nf_conn * 1759fb9cbb1SYasuyuki Kozakai nf_ct_get(const struct sk_buff *skb, enum ip_conntrack_info *ctinfo) 1769fb9cbb1SYasuyuki Kozakai { 1779fb9cbb1SYasuyuki Kozakai *ctinfo = skb->nfctinfo; 1789fb9cbb1SYasuyuki Kozakai return (struct nf_conn *)skb->nfct; 1799fb9cbb1SYasuyuki Kozakai } 1809fb9cbb1SYasuyuki Kozakai 1819fb9cbb1SYasuyuki Kozakai /* decrement reference count on a conntrack */ 1829fb9cbb1SYasuyuki Kozakai static inline void nf_ct_put(struct nf_conn *ct) 1839fb9cbb1SYasuyuki Kozakai { 1849fb9cbb1SYasuyuki Kozakai NF_CT_ASSERT(ct); 1859fb9cbb1SYasuyuki Kozakai nf_conntrack_put(&ct->ct_general); 1869fb9cbb1SYasuyuki Kozakai } 1879fb9cbb1SYasuyuki Kozakai 188b9f78f9fSPablo Neira Ayuso /* Protocol module loading */ 189b9f78f9fSPablo Neira Ayuso extern int nf_ct_l3proto_try_module_get(unsigned short l3proto); 190b9f78f9fSPablo Neira Ayuso extern void nf_ct_l3proto_module_put(unsigned short l3proto); 191b9f78f9fSPablo Neira Ayuso 192ea781f19SEric Dumazet /* 193ea781f19SEric Dumazet * Allocate a hashtable of hlist_head (if nulls == 0), 194ea781f19SEric Dumazet * or hlist_nulls_head (if nulls == 1) 195ea781f19SEric Dumazet */ 196ea781f19SEric Dumazet extern void *nf_ct_alloc_hashtable(unsigned int *sizep, int *vmalloced, int nulls); 197ea781f19SEric Dumazet 198ea781f19SEric Dumazet extern void nf_ct_free_hashtable(void *hash, int vmalloced, unsigned int size); 199ac565e5fSPatrick McHardy 200c1d10adbSPablo Neira Ayuso extern struct nf_conntrack_tuple_hash * 201400dad39SAlexey Dobriyan __nf_conntrack_find(struct net *net, const struct nf_conntrack_tuple *tuple); 202c1d10adbSPablo Neira Ayuso 203c1d10adbSPablo Neira Ayuso extern void nf_conntrack_hash_insert(struct nf_conn *ct); 204dd7669a9SPablo Neira Ayuso extern void nf_ct_delete_from_lists(struct nf_conn *ct); 205dd7669a9SPablo Neira Ayuso extern void nf_ct_insert_dying_list(struct nf_conn *ct); 206c1d10adbSPablo Neira Ayuso 207274d383bSPablo Neira Ayuso extern void nf_conntrack_flush_report(struct net *net, u32 pid, int report); 208c1d10adbSPablo Neira Ayuso 2095f2b4c90SJan Engelhardt extern bool nf_ct_get_tuplepr(const struct sk_buff *skb, 2105f2b4c90SJan Engelhardt unsigned int nhoff, u_int16_t l3num, 211e2a3123fSYasuyuki Kozakai struct nf_conntrack_tuple *tuple); 2125f2b4c90SJan Engelhardt extern bool nf_ct_invert_tuplepr(struct nf_conntrack_tuple *inverse, 2139fb9cbb1SYasuyuki Kozakai const struct nf_conntrack_tuple *orig); 2149fb9cbb1SYasuyuki Kozakai 2159fb9cbb1SYasuyuki Kozakai extern void __nf_ct_refresh_acct(struct nf_conn *ct, 2169fb9cbb1SYasuyuki Kozakai enum ip_conntrack_info ctinfo, 2179fb9cbb1SYasuyuki Kozakai const struct sk_buff *skb, 2189fb9cbb1SYasuyuki Kozakai unsigned long extra_jiffies, 2199fb9cbb1SYasuyuki Kozakai int do_acct); 2209fb9cbb1SYasuyuki Kozakai 2219fb9cbb1SYasuyuki Kozakai /* Refresh conntrack for this many jiffies and do accounting */ 2229fb9cbb1SYasuyuki Kozakai static inline void nf_ct_refresh_acct(struct nf_conn *ct, 2239fb9cbb1SYasuyuki Kozakai enum ip_conntrack_info ctinfo, 2249fb9cbb1SYasuyuki Kozakai const struct sk_buff *skb, 2259fb9cbb1SYasuyuki Kozakai unsigned long extra_jiffies) 2269fb9cbb1SYasuyuki Kozakai { 2279fb9cbb1SYasuyuki Kozakai __nf_ct_refresh_acct(ct, ctinfo, skb, extra_jiffies, 1); 2289fb9cbb1SYasuyuki Kozakai } 2299fb9cbb1SYasuyuki Kozakai 2309fb9cbb1SYasuyuki Kozakai /* Refresh conntrack for this many jiffies */ 2319fb9cbb1SYasuyuki Kozakai static inline void nf_ct_refresh(struct nf_conn *ct, 2329fb9cbb1SYasuyuki Kozakai const struct sk_buff *skb, 2339fb9cbb1SYasuyuki Kozakai unsigned long extra_jiffies) 2349fb9cbb1SYasuyuki Kozakai { 2359fb9cbb1SYasuyuki Kozakai __nf_ct_refresh_acct(ct, 0, skb, extra_jiffies, 0); 2369fb9cbb1SYasuyuki Kozakai } 2379fb9cbb1SYasuyuki Kozakai 2384c889498SDavid S. Miller extern bool __nf_ct_kill_acct(struct nf_conn *ct, 239718d4ad9SFabian Hugelshofer enum ip_conntrack_info ctinfo, 240718d4ad9SFabian Hugelshofer const struct sk_buff *skb, 241718d4ad9SFabian Hugelshofer int do_acct); 242718d4ad9SFabian Hugelshofer 243718d4ad9SFabian Hugelshofer /* kill conntrack and do accounting */ 2444c889498SDavid S. Miller static inline bool nf_ct_kill_acct(struct nf_conn *ct, 245718d4ad9SFabian Hugelshofer enum ip_conntrack_info ctinfo, 246718d4ad9SFabian Hugelshofer const struct sk_buff *skb) 247718d4ad9SFabian Hugelshofer { 2484c889498SDavid S. Miller return __nf_ct_kill_acct(ct, ctinfo, skb, 1); 249718d4ad9SFabian Hugelshofer } 250718d4ad9SFabian Hugelshofer 251718d4ad9SFabian Hugelshofer /* kill conntrack without accounting */ 2524c889498SDavid S. Miller static inline bool nf_ct_kill(struct nf_conn *ct) 253718d4ad9SFabian Hugelshofer { 2544c889498SDavid S. Miller return __nf_ct_kill_acct(ct, 0, NULL, 0); 255718d4ad9SFabian Hugelshofer } 25651091764SPatrick McHardy 2579fb9cbb1SYasuyuki Kozakai /* These are for NAT. Icky. */ 258f9dd09c7SJozsef Kadlecsik extern s16 (*nf_ct_nat_offset)(const struct nf_conn *ct, 259f9dd09c7SJozsef Kadlecsik enum ip_conntrack_dir dir, 260f9dd09c7SJozsef Kadlecsik u32 seq); 2619fb9cbb1SYasuyuki Kozakai 2629fb9cbb1SYasuyuki Kozakai /* Fake conntrack entry for untracked connections */ 2639fb9cbb1SYasuyuki Kozakai extern struct nf_conn nf_conntrack_untracked; 2649fb9cbb1SYasuyuki Kozakai 2659fb9cbb1SYasuyuki Kozakai /* Iterate over all conntracks: if iter returns true, it's deleted. */ 2669fb9cbb1SYasuyuki Kozakai extern void 267400dad39SAlexey Dobriyan nf_ct_iterate_cleanup(struct net *net, int (*iter)(struct nf_conn *i, void *data), void *data); 2689fb9cbb1SYasuyuki Kozakai extern void nf_conntrack_free(struct nf_conn *ct); 2699fb9cbb1SYasuyuki Kozakai extern struct nf_conn * 2705a1fb391SAlexey Dobriyan nf_conntrack_alloc(struct net *net, 2715a1fb391SAlexey Dobriyan const struct nf_conntrack_tuple *orig, 272b891c5a8SPablo Neira Ayuso const struct nf_conntrack_tuple *repl, 273b891c5a8SPablo Neira Ayuso gfp_t gfp); 2749fb9cbb1SYasuyuki Kozakai 275b2a15a60SPatrick McHardy static inline int nf_ct_is_template(const struct nf_conn *ct) 276b2a15a60SPatrick McHardy { 277b2a15a60SPatrick McHardy return test_bit(IPS_TEMPLATE_BIT, &ct->status); 278b2a15a60SPatrick McHardy } 279b2a15a60SPatrick McHardy 2809fb9cbb1SYasuyuki Kozakai /* It's confirmed if it is, or has been in the hash table. */ 2819fb9cbb1SYasuyuki Kozakai static inline int nf_ct_is_confirmed(struct nf_conn *ct) 2829fb9cbb1SYasuyuki Kozakai { 2839fb9cbb1SYasuyuki Kozakai return test_bit(IPS_CONFIRMED_BIT, &ct->status); 2849fb9cbb1SYasuyuki Kozakai } 2859fb9cbb1SYasuyuki Kozakai 2869fb9cbb1SYasuyuki Kozakai static inline int nf_ct_is_dying(struct nf_conn *ct) 2879fb9cbb1SYasuyuki Kozakai { 2889fb9cbb1SYasuyuki Kozakai return test_bit(IPS_DYING_BIT, &ct->status); 2899fb9cbb1SYasuyuki Kozakai } 2909fb9cbb1SYasuyuki Kozakai 291587aa641SPatrick McHardy static inline int nf_ct_is_untracked(const struct sk_buff *skb) 292587aa641SPatrick McHardy { 293587aa641SPatrick McHardy return (skb->nfct == &nf_conntrack_untracked.ct_general); 294587aa641SPatrick McHardy } 295587aa641SPatrick McHardy 296fae718ddSPatrick McHardy extern int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp); 2979fb9cbb1SYasuyuki Kozakai extern unsigned int nf_conntrack_htable_size; 298e478075cSHagen Paul Pfeifer extern unsigned int nf_conntrack_max; 2999fb9cbb1SYasuyuki Kozakai 3000d55af87SAlexey Dobriyan #define NF_CT_STAT_INC(net, count) \ 3014ea7334bSChristoph Lameter __this_cpu_inc((net)->ct.stat->count) 3020d55af87SAlexey Dobriyan #define NF_CT_STAT_INC_ATOMIC(net, count) \ 303c0e912d7SPatrick McHardy do { \ 304c0e912d7SPatrick McHardy local_bh_disable(); \ 3054ea7334bSChristoph Lameter __this_cpu_inc((net)->ct.stat->count); \ 306c0e912d7SPatrick McHardy local_bh_enable(); \ 307c0e912d7SPatrick McHardy } while (0) 3089fb9cbb1SYasuyuki Kozakai 3094dc06f96SPablo Neira Ayuso #define MODULE_ALIAS_NFCT_HELPER(helper) \ 3104dc06f96SPablo Neira Ayuso MODULE_ALIAS("nfct-helper-" helper) 3114dc06f96SPablo Neira Ayuso 3129fb9cbb1SYasuyuki Kozakai #endif /* __KERNEL__ */ 3139fb9cbb1SYasuyuki Kozakai #endif /* _NF_CONNTRACK_H */ 314