1 /* 2 * Connection state tracking for netfilter. This is separated from, 3 * but required by, the (future) NAT layer; it can also be used by an iptables 4 * extension. 5 * 6 * 16 Dec 2003: Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp> 7 * - generalize L3 protocol dependent part. 8 * 9 * Derived from include/linux/netfiter_ipv4/ip_conntrack.h 10 */ 11 12 #ifndef _NF_CONNTRACK_H 13 #define _NF_CONNTRACK_H 14 15 #include <linux/netfilter/nf_conntrack_common.h> 16 17 #include <linux/bitops.h> 18 #include <linux/compiler.h> 19 #include <linux/atomic.h> 20 21 #include <linux/netfilter/nf_conntrack_tcp.h> 22 #include <linux/netfilter/nf_conntrack_dccp.h> 23 #include <linux/netfilter/nf_conntrack_sctp.h> 24 #include <linux/netfilter/nf_conntrack_proto_gre.h> 25 #include <net/netfilter/ipv6/nf_conntrack_icmpv6.h> 26 27 #include <net/netfilter/nf_conntrack_tuple.h> 28 29 /* per conntrack: protocol private data */ 30 union nf_conntrack_proto { 31 /* insert conntrack proto private data here */ 32 struct nf_ct_dccp dccp; 33 struct ip_ct_sctp sctp; 34 struct ip_ct_tcp tcp; 35 struct nf_ct_gre gre; 36 }; 37 38 union nf_conntrack_expect_proto { 39 /* insert expect proto private data here */ 40 }; 41 42 /* Add protocol helper include file here */ 43 #include <linux/netfilter/nf_conntrack_ftp.h> 44 #include <linux/netfilter/nf_conntrack_pptp.h> 45 #include <linux/netfilter/nf_conntrack_h323.h> 46 #include <linux/netfilter/nf_conntrack_sane.h> 47 #include <linux/netfilter/nf_conntrack_sip.h> 48 49 /* per conntrack: application helper private data */ 50 union nf_conntrack_help { 51 /* insert conntrack helper private data (master) here */ 52 #if defined(CONFIG_NF_CONNTRACK_FTP) || defined(CONFIG_NF_CONNTRACK_FTP_MODULE) 53 struct nf_ct_ftp_master ct_ftp_info; 54 #endif 55 #if defined(CONFIG_NF_CONNTRACK_PPTP) || \ 56 defined(CONFIG_NF_CONNTRACK_PPTP_MODULE) 57 struct nf_ct_pptp_master ct_pptp_info; 58 #endif 59 #if defined(CONFIG_NF_CONNTRACK_H323) || \ 60 defined(CONFIG_NF_CONNTRACK_H323_MODULE) 61 struct nf_ct_h323_master ct_h323_info; 62 #endif 63 #if defined(CONFIG_NF_CONNTRACK_SANE) || \ 64 defined(CONFIG_NF_CONNTRACK_SANE_MODULE) 65 struct nf_ct_sane_master ct_sane_info; 66 #endif 67 #if defined(CONFIG_NF_CONNTRACK_SIP) || defined(CONFIG_NF_CONNTRACK_SIP_MODULE) 68 struct nf_ct_sip_master ct_sip_info; 69 #endif 70 }; 71 72 #include <linux/types.h> 73 #include <linux/skbuff.h> 74 #include <linux/timer.h> 75 76 #ifdef CONFIG_NETFILTER_DEBUG 77 #define NF_CT_ASSERT(x) WARN_ON(!(x)) 78 #else 79 #define NF_CT_ASSERT(x) 80 #endif 81 82 struct nf_conntrack_helper; 83 84 /* Must be kept in sync with the classes defined by helpers */ 85 #define NF_CT_MAX_EXPECT_CLASSES 4 86 87 /* nf_conn feature for connections that have a helper */ 88 struct nf_conn_help { 89 /* Helper. if any */ 90 struct nf_conntrack_helper __rcu *helper; 91 92 union nf_conntrack_help help; 93 94 struct hlist_head expectations; 95 96 /* Current number of expected connections */ 97 u8 expecting[NF_CT_MAX_EXPECT_CLASSES]; 98 }; 99 100 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h> 101 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h> 102 103 struct nf_conn { 104 /* Usage count in here is 1 for hash table/destruct timer, 1 per skb, 105 plus 1 for any connection(s) we are `master' for */ 106 struct nf_conntrack ct_general; 107 108 spinlock_t lock; 109 110 /* XXX should I move this to the tail ? - Y.K */ 111 /* These are my tuples; original and reply */ 112 struct nf_conntrack_tuple_hash tuplehash[IP_CT_DIR_MAX]; 113 114 /* Have we seen traffic both ways yet? (bitset) */ 115 unsigned long status; 116 117 /* If we were expected by an expectation, this will be it */ 118 struct nf_conn *master; 119 120 /* Timer function; drops refcnt when it goes off. */ 121 struct timer_list timeout; 122 123 #if defined(CONFIG_NF_CONNTRACK_MARK) 124 u_int32_t mark; 125 #endif 126 127 #ifdef CONFIG_NF_CONNTRACK_SECMARK 128 u_int32_t secmark; 129 #endif 130 131 /* Extensions */ 132 struct nf_ct_ext *ext; 133 #ifdef CONFIG_NET_NS 134 struct net *ct_net; 135 #endif 136 137 /* Storage reserved for other modules, must be the last member */ 138 union nf_conntrack_proto proto; 139 }; 140 141 static inline struct nf_conn * 142 nf_ct_tuplehash_to_ctrack(const struct nf_conntrack_tuple_hash *hash) 143 { 144 return container_of(hash, struct nf_conn, 145 tuplehash[hash->tuple.dst.dir]); 146 } 147 148 static inline u_int16_t nf_ct_l3num(const struct nf_conn *ct) 149 { 150 return ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num; 151 } 152 153 static inline u_int8_t nf_ct_protonum(const struct nf_conn *ct) 154 { 155 return ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum; 156 } 157 158 #define nf_ct_tuple(ct, dir) (&(ct)->tuplehash[dir].tuple) 159 160 /* get master conntrack via master expectation */ 161 #define master_ct(conntr) (conntr->master) 162 163 extern struct net init_net; 164 165 static inline struct net *nf_ct_net(const struct nf_conn *ct) 166 { 167 return read_pnet(&ct->ct_net); 168 } 169 170 /* Alter reply tuple (maybe alter helper). */ 171 extern void 172 nf_conntrack_alter_reply(struct nf_conn *ct, 173 const struct nf_conntrack_tuple *newreply); 174 175 /* Is this tuple taken? (ignoring any belonging to the given 176 conntrack). */ 177 extern int 178 nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple, 179 const struct nf_conn *ignored_conntrack); 180 181 /* Return conntrack_info and tuple hash for given skb. */ 182 static inline struct nf_conn * 183 nf_ct_get(const struct sk_buff *skb, enum ip_conntrack_info *ctinfo) 184 { 185 *ctinfo = skb->nfctinfo; 186 return (struct nf_conn *)skb->nfct; 187 } 188 189 /* decrement reference count on a conntrack */ 190 static inline void nf_ct_put(struct nf_conn *ct) 191 { 192 NF_CT_ASSERT(ct); 193 nf_conntrack_put(&ct->ct_general); 194 } 195 196 /* Protocol module loading */ 197 extern int nf_ct_l3proto_try_module_get(unsigned short l3proto); 198 extern void nf_ct_l3proto_module_put(unsigned short l3proto); 199 200 /* 201 * Allocate a hashtable of hlist_head (if nulls == 0), 202 * or hlist_nulls_head (if nulls == 1) 203 */ 204 extern void *nf_ct_alloc_hashtable(unsigned int *sizep, int nulls); 205 206 extern void nf_ct_free_hashtable(void *hash, unsigned int size); 207 208 extern struct nf_conntrack_tuple_hash * 209 __nf_conntrack_find(struct net *net, u16 zone, 210 const struct nf_conntrack_tuple *tuple); 211 212 extern int nf_conntrack_hash_check_insert(struct nf_conn *ct); 213 extern void nf_ct_delete_from_lists(struct nf_conn *ct); 214 extern void nf_ct_insert_dying_list(struct nf_conn *ct); 215 216 extern void nf_conntrack_flush_report(struct net *net, u32 pid, int report); 217 218 extern bool nf_ct_get_tuplepr(const struct sk_buff *skb, 219 unsigned int nhoff, u_int16_t l3num, 220 struct nf_conntrack_tuple *tuple); 221 extern bool nf_ct_invert_tuplepr(struct nf_conntrack_tuple *inverse, 222 const struct nf_conntrack_tuple *orig); 223 224 extern void __nf_ct_refresh_acct(struct nf_conn *ct, 225 enum ip_conntrack_info ctinfo, 226 const struct sk_buff *skb, 227 unsigned long extra_jiffies, 228 int do_acct); 229 230 /* Refresh conntrack for this many jiffies and do accounting */ 231 static inline void nf_ct_refresh_acct(struct nf_conn *ct, 232 enum ip_conntrack_info ctinfo, 233 const struct sk_buff *skb, 234 unsigned long extra_jiffies) 235 { 236 __nf_ct_refresh_acct(ct, ctinfo, skb, extra_jiffies, 1); 237 } 238 239 /* Refresh conntrack for this many jiffies */ 240 static inline void nf_ct_refresh(struct nf_conn *ct, 241 const struct sk_buff *skb, 242 unsigned long extra_jiffies) 243 { 244 __nf_ct_refresh_acct(ct, 0, skb, extra_jiffies, 0); 245 } 246 247 extern bool __nf_ct_kill_acct(struct nf_conn *ct, 248 enum ip_conntrack_info ctinfo, 249 const struct sk_buff *skb, 250 int do_acct); 251 252 /* kill conntrack and do accounting */ 253 static inline bool nf_ct_kill_acct(struct nf_conn *ct, 254 enum ip_conntrack_info ctinfo, 255 const struct sk_buff *skb) 256 { 257 return __nf_ct_kill_acct(ct, ctinfo, skb, 1); 258 } 259 260 /* kill conntrack without accounting */ 261 static inline bool nf_ct_kill(struct nf_conn *ct) 262 { 263 return __nf_ct_kill_acct(ct, 0, NULL, 0); 264 } 265 266 /* These are for NAT. Icky. */ 267 extern s16 (*nf_ct_nat_offset)(const struct nf_conn *ct, 268 enum ip_conntrack_dir dir, 269 u32 seq); 270 271 /* Fake conntrack entry for untracked connections */ 272 DECLARE_PER_CPU(struct nf_conn, nf_conntrack_untracked); 273 static inline struct nf_conn *nf_ct_untracked_get(void) 274 { 275 return &__raw_get_cpu_var(nf_conntrack_untracked); 276 } 277 extern void nf_ct_untracked_status_or(unsigned long bits); 278 279 /* Iterate over all conntracks: if iter returns true, it's deleted. */ 280 extern void 281 nf_ct_iterate_cleanup(struct net *net, int (*iter)(struct nf_conn *i, void *data), void *data); 282 extern void nf_conntrack_free(struct nf_conn *ct); 283 extern struct nf_conn * 284 nf_conntrack_alloc(struct net *net, u16 zone, 285 const struct nf_conntrack_tuple *orig, 286 const struct nf_conntrack_tuple *repl, 287 gfp_t gfp); 288 289 static inline int nf_ct_is_template(const struct nf_conn *ct) 290 { 291 return test_bit(IPS_TEMPLATE_BIT, &ct->status); 292 } 293 294 /* It's confirmed if it is, or has been in the hash table. */ 295 static inline int nf_ct_is_confirmed(struct nf_conn *ct) 296 { 297 return test_bit(IPS_CONFIRMED_BIT, &ct->status); 298 } 299 300 static inline int nf_ct_is_dying(struct nf_conn *ct) 301 { 302 return test_bit(IPS_DYING_BIT, &ct->status); 303 } 304 305 static inline int nf_ct_is_untracked(const struct nf_conn *ct) 306 { 307 return test_bit(IPS_UNTRACKED_BIT, &ct->status); 308 } 309 310 /* Packet is received from loopback */ 311 static inline bool nf_is_loopback_packet(const struct sk_buff *skb) 312 { 313 return skb->dev && skb->skb_iif && skb->dev->flags & IFF_LOOPBACK; 314 } 315 316 struct kernel_param; 317 318 extern int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp); 319 extern unsigned int nf_conntrack_htable_size; 320 extern unsigned int nf_conntrack_max; 321 extern unsigned int nf_conntrack_hash_rnd; 322 void init_nf_conntrack_hash_rnd(void); 323 324 #define NF_CT_STAT_INC(net, count) \ 325 __this_cpu_inc((net)->ct.stat->count) 326 #define NF_CT_STAT_INC_ATOMIC(net, count) \ 327 do { \ 328 local_bh_disable(); \ 329 __this_cpu_inc((net)->ct.stat->count); \ 330 local_bh_enable(); \ 331 } while (0) 332 333 #define MODULE_ALIAS_NFCT_HELPER(helper) \ 334 MODULE_ALIAS("nfct-helper-" helper) 335 336 #endif /* _NF_CONNTRACK_H */ 337