release/src-rt/linux/linux-2.6/include/net/netfilter/nf_conntrack.h

   1 /*
   2  * Connection state tracking for netfilter.  This is separated from,
   3  * but required by, the (future) NAT layer; it can also be used by an iptables
   4  * extension.
   5  *
   6  * 16 Dec 2003: Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp>
   7  *      - generalize L3 protocol dependent part.
   8  *
   9  * Derived from include/linux/netfiter_ipv4/ip_conntrack.h
  10  */
  11
  12 #ifndef _NF_CONNTRACK_H
  13 #define _NF_CONNTRACK_H
  14
  15 #include <linux/netfilter/nf_conntrack_common.h>
  16
  17 #ifdef __KERNEL__
  18
  19 #if defined(CONFIG_BCM_NAT) || defined(CONFIG_BCM_NAT_MODULE)
  20 #define BCM_FASTNAT_DENY        1
  21 #endif
  22
  23 #include <linux/bitops.h>
  24 #include <linux/compiler.h>
  25 #include <asm/atomic.h>
  26
  27 #include <linux/netfilter/nf_conntrack_tcp.h>
  28 #include <linux/netfilter/nf_conntrack_sctp.h>
  29 #include <linux/netfilter/nf_conntrack_proto_gre.h>
  30 #include <net/netfilter/ipv4/nf_conntrack_icmp.h>
  31 #include <net/netfilter/ipv6/nf_conntrack_icmpv6.h>
  32
  33 #include <net/netfilter/nf_conntrack_tuple.h>
  34
  35 #if defined(CONFIG_NETFILTER_XT_MATCH_LAYER7) || \
  36     defined(CONFIG_NETFILTER_XT_MATCH_LAYER7_MODULE)
  37 struct ip_ct_layer7
  38 {
  39         /*
  40          * e.g. "http". NULL before decision. "unknown" after decision
  41          * if no match.
  42          */
  43         char *app_proto;
  44         /*
  45          * application layer data so far. NULL after match decision.
  46          */
  47         char *app_data;
  48         unsigned int app_data_len;
  49 };
  50 #endif
  51
  52 /* per conntrack: protocol private data */
  53 union nf_conntrack_proto {
  54         /* insert conntrack proto private data here */
  55         struct ip_ct_sctp sctp;
  56         struct ip_ct_tcp tcp;
  57         struct ip_ct_icmp icmp;
  58         struct nf_ct_icmpv6 icmpv6;
  59         struct nf_ct_gre gre;
  60 };
  61
  62 union nf_conntrack_expect_proto {
  63         /* insert expect proto private data here */
  64 };
  65
  66 /* Add protocol helper include file here */
  67 #include <linux/netfilter/nf_conntrack_ftp.h>
  68 #include <linux/netfilter/nf_conntrack_pptp.h>
  69 #include <linux/netfilter/nf_conntrack_h323.h>
  70 #include <linux/netfilter/nf_conntrack_sane.h>
  71 #include <linux/netfilter/nf_conntrack_sip.h>
  72 #include <linux/netfilter/nf_conntrack_autofw.h>
  73
  74 /* per conntrack: application helper private data */
  75 union nf_conntrack_help {
  76         /* insert conntrack helper private data (master) here */
  77         struct nf_ct_ftp_master ct_ftp_info;
  78         struct nf_ct_pptp_master ct_pptp_info;
  79         struct nf_ct_h323_master ct_h323_info;
  80         struct nf_ct_sane_master ct_sane_info;
  81         struct nf_ct_sip_master ct_sip_info;
  82         struct nf_ct_autofw_master ct_autofw_info;
  83 };
  84
  85 #include <linux/types.h>
  86 #include <linux/skbuff.h>
  87 #include <linux/timer.h>
  88
  89 #ifdef CONFIG_NETFILTER_DEBUG
  90 #define NF_CT_ASSERT(x)                                                 \
  91 do {                                                                    \
  92         if (!(x))                                                       \
  93                 /* Wooah!  I'm tripping my conntrack in a frenzy of     \
  94                    netplay... */                                        \
  95                 printk("NF_CT_ASSERT: %s:%i(%s)\n",                     \
  96                        __FILE__, __LINE__, __FUNCTION__);               \
  97 } while(0)
  98 #else
  99 #define NF_CT_ASSERT(x)
 100 #endif
 101
 102 struct nf_conntrack_helper;
 103
 104 /* Must be kept in sync with the classes defined by helpers */
 105 #define NF_CT_MAX_EXPECT_CLASSES        4
 106
 107 /* nf_conn feature for connections that have a helper */
 108 struct nf_conn_help {
 109         /* Helper. if any */
 110         struct nf_conntrack_helper *helper;
 111
 112         union nf_conntrack_help help;
 113
 114         /* Current number of expected connections */
 115         u8 expecting[NF_CT_MAX_EXPECT_CLASSES];
 116 };
 117
 118 #ifdef HNDCTF
 119 #define CTF_FLAGS_CACHED        (1 << 31)       /* Indicates cached connection */
 120 #define CTF_FLAGS_EXCLUDED      (1 << 30)
 121 #define CTF_FLAGS_REPLY_CACHED  (1 << 1)
 122 #define CTF_FLAGS_ORG_CACHED    (1 << 0)
 123 #endif
 124
 125 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
 126 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
 127
 128 struct nf_conn
 129 {
 130         /* Usage count in here is 1 for hash table/destruct timer, 1 per skb,
 131            plus 1 for any connection(s) we are `master' for */
 132         struct nf_conntrack ct_general;
 133
 134         /* XXX should I move this to the tail ? - Y.K */
 135         /* These are my tuples; original and reply */
 136         struct nf_conntrack_tuple_hash tuplehash[IP_CT_DIR_MAX];
 137
 138         /* Have we seen traffic both ways yet? (bitset) */
 139         unsigned long status;
 140
 141         /* If we were expected by an expectation, this will be it */
 142         struct nf_conn *master;
 143
 144         /* Timer function; drops refcnt when it goes off. */
 145         struct timer_list timeout;
 146
 147 #ifdef CONFIG_NF_CT_ACCT
 148         /* Accounting Information (same cache line as other written members) */
 149         struct ip_conntrack_counter counters[IP_CT_DIR_MAX];
 150 #endif
 151
 152         /* Unique ID that identifies this conntrack*/
 153         unsigned int id;
 154
 155         /* features - nat, helper, ... used by allocating system */
 156         u_int32_t features;
 157
 158 #if defined(CONFIG_NF_CONNTRACK_MARK)
 159         u_int32_t mark;
 160 #endif
 161
 162 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 163         u_int32_t secmark;
 164 #endif
 165
 166 #ifdef HNDCTF
 167         /* Timeout for the connection */
 168         u_int32_t expire_jiffies;
 169
 170         /* Flags for connection attributes */
 171         u_int32_t ctf_flags;
 172 #endif /* HNDCTF */
 173
 174         u_int32_t ipp2p;
 175         /* Storage reserved for other modules: */
 176         union nf_conntrack_proto proto;
 177
 178 #if defined(CONFIG_IP_NF_TARGET_BCOUNT) || defined(CONFIG_IP_NF_TARGET_BCOUNT_MODULE)
 179         u_int32_t bcount;
 180 #endif
 181 #if defined(CONFIG_IP_NF_TARGET_MACSAVE) || defined(CONFIG_IP_NF_TARGET_MACSAVE_MODULE)
 182         unsigned char macsave[6];
 183 #endif
 184
 185 #if defined(CONFIG_NETFILTER_XT_MATCH_LAYER7) || \
 186     defined(CONFIG_NETFILTER_XT_MATCH_LAYER7_MODULE)
 187         struct ip_ct_layer7 layer7;
 188 #endif
 189
 190         /* features dynamically at the end: helper, nat (both optional) */
 191         char data[0];
 192 };
 193
 194 static inline struct nf_conn *
 195 nf_ct_tuplehash_to_ctrack(const struct nf_conntrack_tuple_hash *hash)
 196 {
 197         return container_of(hash, struct nf_conn,
 198                             tuplehash[hash->tuple.dst.dir]);
 199 }
 200
 201 static inline u_int16_t nf_ct_l3num(const struct nf_conn *ct)
 202 {
 203         return ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
 204 }
 205
 206 static inline u_int8_t nf_ct_protonum(const struct nf_conn *ct)
 207 {
 208         return ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum;
 209 }
 210
 211 /* get master conntrack via master expectation */
 212 #define master_ct(conntr) (conntr->master)
 213
 214 /* Alter reply tuple (maybe alter helper). */
 215 extern void
 216 nf_conntrack_alter_reply(struct nf_conn *conntrack,
 217                          const struct nf_conntrack_tuple *newreply);
 218
 219 /* Is this tuple taken? (ignoring any belonging to the given
 220    conntrack). */
 221 extern int
 222 nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
 223                          const struct nf_conn *ignored_conntrack);
 224
 225 /* Return conntrack_info and tuple hash for given skb. */
 226 static inline struct nf_conn *
 227 nf_ct_get(const struct sk_buff *skb, enum ip_conntrack_info *ctinfo)
 228 {
 229         *ctinfo = skb->nfctinfo;
 230         return (struct nf_conn *)skb->nfct;
 231 }
 232
 233 /* decrement reference count on a conntrack */
 234 static inline void nf_ct_put(struct nf_conn *ct)
 235 {
 236         NF_CT_ASSERT(ct);
 237         nf_conntrack_put(&ct->ct_general);
 238 }
 239
 240 /* Protocol module loading */
 241 extern int nf_ct_l3proto_try_module_get(unsigned short l3proto);
 242 extern void nf_ct_l3proto_module_put(unsigned short l3proto);
 243
 244 extern struct nf_conntrack_tuple_hash *
 245 __nf_conntrack_find(const struct nf_conntrack_tuple *tuple);
 246
 247 extern void nf_conntrack_hash_insert(struct nf_conn *ct);
 248
 249 extern void nf_conntrack_flush(void);
 250
 251 extern int nf_ct_invert_tuplepr(struct nf_conntrack_tuple *inverse,
 252                                 const struct nf_conntrack_tuple *orig);
 253
 254 extern void __nf_ct_refresh_acct(struct nf_conn *ct,
 255                                  enum ip_conntrack_info ctinfo,
 256                                  const struct sk_buff *skb,
 257                                  unsigned long extra_jiffies,
 258                                  int do_acct);
 259
 260 /* Refresh conntrack for this many jiffies and do accounting */
 261 static inline void nf_ct_refresh_acct(struct nf_conn *ct,
 262                                       enum ip_conntrack_info ctinfo,
 263                                       const struct sk_buff *skb,
 264                                       unsigned long extra_jiffies)
 265 {
 266         __nf_ct_refresh_acct(ct, ctinfo, skb, extra_jiffies, 1);
 267 }
 268
 269 /* Refresh conntrack for this many jiffies */
 270 static inline void nf_ct_refresh(struct nf_conn *ct,
 271                                  const struct sk_buff *skb,
 272                                  unsigned long extra_jiffies)
 273 {
 274         __nf_ct_refresh_acct(ct, 0, skb, extra_jiffies, 0);
 275 }
 276
 277 /* These are for NAT.  Icky. */
 278 extern s16 (*nf_ct_nat_offset)(const struct nf_conn *ct,
 279                                enum ip_conntrack_dir dir,
 280                                u32 seq);
 281
 282 /* Call me when a conntrack is destroyed. */
 283 extern void (*nf_conntrack_destroyed)(struct nf_conn *conntrack);
 284
 285 /* Fake conntrack entry for untracked connections */
 286 extern struct nf_conn nf_conntrack_untracked;
 287
 288 extern int nf_ct_no_defrag;
 289
 290 /* Iterate over all conntracks: if iter returns true, it's deleted. */
 291 extern void
 292 nf_ct_iterate_cleanup(int (*iter)(struct nf_conn *i, void *data), void *data);
 293 extern void nf_conntrack_free(struct nf_conn *ct);
 294 extern struct nf_conn *
 295 nf_conntrack_alloc(const struct nf_conntrack_tuple *orig,
 296                    const struct nf_conntrack_tuple *repl);
 297
 298 /* It's confirmed if it is, or has been in the hash table. */
 299 static inline int nf_ct_is_confirmed(struct nf_conn *ct)
 300 {
 301         return test_bit(IPS_CONFIRMED_BIT, &ct->status);
 302 }
 303
 304 static inline int nf_ct_is_dying(struct nf_conn *ct)
 305 {
 306         return test_bit(IPS_DYING_BIT, &ct->status);
 307 }
 308
 309 static inline int nf_ct_is_untracked(const struct sk_buff *skb)
 310 {
 311         return (skb->nfct == &nf_conntrack_untracked.ct_general);
 312 }
 313
 314 extern unsigned int nf_conntrack_htable_size;
 315 extern int nf_conntrack_checksum;
 316 extern atomic_t nf_conntrack_count;
 317 extern int nf_conntrack_max;
 318
 319 DECLARE_PER_CPU(struct ip_conntrack_stat, nf_conntrack_stat);
 320 #define NF_CT_STAT_INC(count) (__get_cpu_var(nf_conntrack_stat).count++)
 321 #define NF_CT_STAT_INC_ATOMIC(count)                    \
 322 do {                                                    \
 323         local_bh_disable();                             \
 324         __get_cpu_var(nf_conntrack_stat).count++;       \
 325         local_bh_enable();                              \
 326 } while (0)
 327
 328 /* no helper, no nat */
 329 #define NF_CT_F_BASIC   0
 330 /* for helper */
 331 #define NF_CT_F_HELP    1
 332 /* for nat. */
 333 #define NF_CT_F_NAT     2
 334 #define NF_CT_F_NUM     4
 335
 336 extern int
 337 nf_conntrack_register_cache(u_int32_t features, const char *name, size_t size);
 338 extern void
 339 nf_conntrack_unregister_cache(u_int32_t features);
 340
 341 /* valid combinations:
 342  * basic: nf_conn, nf_conn .. nf_conn_help
 343  * nat: nf_conn .. nf_conn_nat, nf_conn .. nf_conn_nat .. nf_conn help
 344  */
 345 #ifdef CONFIG_NF_NAT_NEEDED
 346 static inline struct nf_conn_nat *nfct_nat(const struct nf_conn *ct)
 347 {
 348         unsigned int offset = sizeof(struct nf_conn);
 349
 350         if (!(ct->features & NF_CT_F_NAT))
 351                 return NULL;
 352
 353         offset = ALIGN(offset, __alignof__(struct nf_conn_nat));
 354         return (struct nf_conn_nat *) ((void *)ct + offset);
 355 }
 356
 357 static inline struct nf_conn_help *nfct_help(const struct nf_conn *ct)
 358 {
 359         unsigned int offset = sizeof(struct nf_conn);
 360
 361         if (!(ct->features & NF_CT_F_HELP))
 362                 return NULL;
 363         if (ct->features & NF_CT_F_NAT) {
 364                 offset = ALIGN(offset, __alignof__(struct nf_conn_nat));
 365                 offset += sizeof(struct nf_conn_nat);
 366         }
 367
 368         offset = ALIGN(offset, __alignof__(struct nf_conn_help));
 369         return (struct nf_conn_help *) ((void *)ct + offset);
 370 }
 371 #else /* No NAT */
 372 static inline struct nf_conn_help *nfct_help(const struct nf_conn *ct)
 373 {
 374         unsigned int offset = sizeof(struct nf_conn);
 375
 376         if (!(ct->features & NF_CT_F_HELP))
 377                 return NULL;
 378
 379         offset = ALIGN(offset, __alignof__(struct nf_conn_help));
 380         return (struct nf_conn_help *) ((void *)ct + offset);
 381 }
 382 #endif /* CONFIG_NF_NAT_NEEDED */
 383 #endif /* __KERNEL__ */
 384 #endif /* _NF_CONNTRACK_H */