1 /* 2 * (C) 2005-2011 by Pablo Neira Ayuso <pablo@netfilter.org> 3 * 4 * This program is free software; you can redistribute it and/or modify it 5 * under the terms of the GNU General Public License as published by 6 * the Free Software Foundation; either version 2 of the License, or 7 * (at your option) any later version. 8 */ 9 10 #ifndef _LIBNETFILTER_CONNTRACK_H_ 11 #define _LIBNETFILTER_CONNTRACK_H_ 12 13 #include <stdbool.h> 14 #include <netinet/in.h> 15 #include <libnfnetlink/linux_nfnetlink.h> 16 #include <libnfnetlink/libnfnetlink.h> 17 #include <libnetfilter_conntrack/linux_nfnetlink_conntrack.h> 18 19 #ifdef __cplusplus 20 extern "C" { 21 #endif 22 23 enum { 24 CONNTRACK = NFNL_SUBSYS_CTNETLINK, 25 EXPECT = NFNL_SUBSYS_CTNETLINK_EXP 26 }; 27 28 /* 29 * Subscribe to all possible conntrack event groups. Use this 30 * flag in case that you want to catch up all the possible 31 * events. Do not use this flag for dumping or any other 32 * similar operation. 33 */ 34 #define NFCT_ALL_CT_GROUPS (NF_NETLINK_CONNTRACK_NEW|NF_NETLINK_CONNTRACK_UPDATE|NF_NETLINK_CONNTRACK_DESTROY) 35 36 struct nfct_handle; 37 38 /* 39 * [Open|close] a conntrack handler 40 */ 41 extern struct nfct_handle *nfct_open(uint8_t, unsigned); 42 extern struct nfct_handle *nfct_open_nfnl(struct nfnl_handle *nfnlh, 43 uint8_t subsys_id, 44 unsigned int subscriptions); 45 extern int nfct_close(struct nfct_handle *cth); 46 47 extern int nfct_fd(struct nfct_handle *cth); 48 extern const struct nfnl_handle *nfct_nfnlh(struct nfct_handle *cth); 49 50 /* 51 * NEW libnetfilter_conntrack API 52 */ 53 54 /* high level API */ 55 56 #include <sys/types.h> 57 58 /* conntrack object */ 59 struct nf_conntrack; 60 61 /* conntrack attributes */ 62 enum nf_conntrack_attr { 63 ATTR_ORIG_IPV4_SRC = 0, /* u32 bits */ 64 ATTR_IPV4_SRC = ATTR_ORIG_IPV4_SRC, /* alias */ 65 ATTR_ORIG_IPV4_DST, /* u32 bits */ 66 ATTR_IPV4_DST = ATTR_ORIG_IPV4_DST, /* alias */ 67 ATTR_REPL_IPV4_SRC, /* u32 bits */ 68 ATTR_REPL_IPV4_DST, /* u32 bits */ 69 ATTR_ORIG_IPV6_SRC = 4, /* u128 bits */ 70 ATTR_IPV6_SRC = ATTR_ORIG_IPV6_SRC, /* alias */ 71 ATTR_ORIG_IPV6_DST, /* u128 bits */ 72 ATTR_IPV6_DST = ATTR_ORIG_IPV6_DST, /* alias */ 73 ATTR_REPL_IPV6_SRC, /* u128 bits */ 74 ATTR_REPL_IPV6_DST, /* u128 bits */ 75 ATTR_ORIG_PORT_SRC = 8, /* u16 bits */ 76 ATTR_PORT_SRC = ATTR_ORIG_PORT_SRC, /* alias */ 77 ATTR_ORIG_PORT_DST, /* u16 bits */ 78 ATTR_PORT_DST = ATTR_ORIG_PORT_DST, /* alias */ 79 ATTR_REPL_PORT_SRC, /* u16 bits */ 80 ATTR_REPL_PORT_DST, /* u16 bits */ 81 ATTR_ICMP_TYPE = 12, /* u8 bits */ 82 ATTR_ICMP_CODE, /* u8 bits */ 83 ATTR_ICMP_ID, /* u16 bits */ 84 ATTR_ORIG_L3PROTO, /* u8 bits */ 85 ATTR_L3PROTO = ATTR_ORIG_L3PROTO, /* alias */ 86 ATTR_REPL_L3PROTO = 16, /* u8 bits */ 87 ATTR_ORIG_L4PROTO, /* u8 bits */ 88 ATTR_L4PROTO = ATTR_ORIG_L4PROTO, /* alias */ 89 ATTR_REPL_L4PROTO, /* u8 bits */ 90 ATTR_TCP_STATE, /* u8 bits */ 91 ATTR_SNAT_IPV4 = 20, /* u32 bits */ 92 ATTR_DNAT_IPV4, /* u32 bits */ 93 ATTR_SNAT_PORT, /* u16 bits */ 94 ATTR_DNAT_PORT, /* u16 bits */ 95 ATTR_TIMEOUT = 24, /* u32 bits */ 96 ATTR_MARK, /* u32 bits */ 97 ATTR_ORIG_COUNTER_PACKETS, /* u64 bits */ 98 ATTR_REPL_COUNTER_PACKETS, /* u64 bits */ 99 ATTR_ORIG_COUNTER_BYTES = 28, /* u64 bits */ 100 ATTR_REPL_COUNTER_BYTES, /* u64 bits */ 101 ATTR_USE, /* u32 bits */ 102 ATTR_ID, /* u32 bits */ 103 ATTR_STATUS = 32, /* u32 bits */ 104 ATTR_TCP_FLAGS_ORIG, /* u8 bits */ 105 ATTR_TCP_FLAGS_REPL, /* u8 bits */ 106 ATTR_TCP_MASK_ORIG, /* u8 bits */ 107 ATTR_TCP_MASK_REPL = 36, /* u8 bits */ 108 ATTR_MASTER_IPV4_SRC, /* u32 bits */ 109 ATTR_MASTER_IPV4_DST, /* u32 bits */ 110 ATTR_MASTER_IPV6_SRC, /* u128 bits */ 111 ATTR_MASTER_IPV6_DST = 40, /* u128 bits */ 112 ATTR_MASTER_PORT_SRC, /* u16 bits */ 113 ATTR_MASTER_PORT_DST, /* u16 bits */ 114 ATTR_MASTER_L3PROTO, /* u8 bits */ 115 ATTR_MASTER_L4PROTO = 44, /* u8 bits */ 116 ATTR_SECMARK, /* u32 bits */ 117 ATTR_ORIG_NAT_SEQ_CORRECTION_POS, /* u32 bits */ 118 ATTR_ORIG_NAT_SEQ_OFFSET_BEFORE, /* u32 bits */ 119 ATTR_ORIG_NAT_SEQ_OFFSET_AFTER = 48, /* u32 bits */ 120 ATTR_REPL_NAT_SEQ_CORRECTION_POS, /* u32 bits */ 121 ATTR_REPL_NAT_SEQ_OFFSET_BEFORE, /* u32 bits */ 122 ATTR_REPL_NAT_SEQ_OFFSET_AFTER, /* u32 bits */ 123 ATTR_SCTP_STATE = 52, /* u8 bits */ 124 ATTR_SCTP_VTAG_ORIG, /* u32 bits */ 125 ATTR_SCTP_VTAG_REPL, /* u32 bits */ 126 ATTR_HELPER_NAME, /* string (30 bytes max) */ 127 ATTR_DCCP_STATE = 56, /* u8 bits */ 128 ATTR_DCCP_ROLE, /* u8 bits */ 129 ATTR_DCCP_HANDSHAKE_SEQ, /* u64 bits */ 130 ATTR_TCP_WSCALE_ORIG, /* u8 bits */ 131 ATTR_TCP_WSCALE_REPL = 60, /* u8 bits */ 132 ATTR_ZONE, /* u16 bits */ 133 ATTR_SECCTX, /* string */ 134 ATTR_TIMESTAMP_START, /* u64 bits, linux >= 2.6.38 */ 135 ATTR_TIMESTAMP_STOP = 64, /* u64 bits, linux >= 2.6.38 */ 136 ATTR_HELPER_INFO, /* variable length */ 137 ATTR_CONNLABELS, /* variable length */ 138 ATTR_CONNLABELS_MASK, /* variable length */ 139 ATTR_ORIG_ZONE, /* u16 bits */ 140 ATTR_REPL_ZONE, /* u16 bits */ 141 ATTR_SNAT_IPV6, /* u128 bits */ 142 ATTR_DNAT_IPV6, /* u128 bits */ 143 ATTR_MAX 144 }; 145 146 /* conntrack attribute groups */ 147 enum nf_conntrack_attr_grp { 148 ATTR_GRP_ORIG_IPV4 = 0, /* struct nfct_attr_grp_ipv4 */ 149 ATTR_GRP_REPL_IPV4, /* struct nfct_attr_grp_ipv4 */ 150 ATTR_GRP_ORIG_IPV6, /* struct nfct_attr_grp_ipv6 */ 151 ATTR_GRP_REPL_IPV6, /* struct nfct_attr_grp_ipv6 */ 152 ATTR_GRP_ORIG_PORT = 4, /* struct nfct_attr_grp_port */ 153 ATTR_GRP_REPL_PORT, /* struct nfct_attr_grp_port */ 154 ATTR_GRP_ICMP, /* struct nfct_attr_grp_icmp */ 155 ATTR_GRP_MASTER_IPV4, /* struct nfct_attr_grp_ipv4 */ 156 ATTR_GRP_MASTER_IPV6 = 8, /* struct nfct_attr_grp_ipv6 */ 157 ATTR_GRP_MASTER_PORT, /* struct nfct_attr_grp_port */ 158 ATTR_GRP_ORIG_COUNTERS, /* struct nfct_attr_grp_ctrs */ 159 ATTR_GRP_REPL_COUNTERS, /* struct nfct_attr_grp_ctrs */ 160 ATTR_GRP_ORIG_ADDR_SRC = 12, /* union nfct_attr_grp_addr */ 161 ATTR_GRP_ORIG_ADDR_DST, /* union nfct_attr_grp_addr */ 162 ATTR_GRP_REPL_ADDR_SRC, /* union nfct_attr_grp_addr */ 163 ATTR_GRP_REPL_ADDR_DST, /* union nfct_attr_grp_addr */ 164 ATTR_GRP_MAX 165 }; 166 167 struct nfct_attr_grp_ipv4 { 168 uint32_t src, dst; 169 }; 170 171 struct nfct_attr_grp_ipv6 { 172 uint32_t src[4], dst[4]; 173 }; 174 175 struct nfct_attr_grp_port { 176 uint16_t sport, dport; 177 }; 178 179 struct nfct_attr_grp_icmp { 180 uint16_t id; 181 uint8_t code, type; 182 }; 183 184 struct nfct_attr_grp_ctrs { 185 uint64_t packets; 186 uint64_t bytes; 187 }; 188 189 union nfct_attr_grp_addr { 190 uint32_t ip; 191 uint32_t ip6[4]; 192 uint32_t addr[4]; 193 }; 194 195 /* message type */ 196 enum nf_conntrack_msg_type { 197 NFCT_T_UNKNOWN = 0, 198 199 NFCT_T_NEW_BIT = 0, 200 NFCT_T_NEW = (1 << NFCT_T_NEW_BIT), 201 202 NFCT_T_UPDATE_BIT = 1, 203 NFCT_T_UPDATE = (1 << NFCT_T_UPDATE_BIT), 204 205 NFCT_T_DESTROY_BIT = 2, 206 NFCT_T_DESTROY = (1 << NFCT_T_DESTROY_BIT), 207 208 NFCT_T_ALL = NFCT_T_NEW | NFCT_T_UPDATE | NFCT_T_DESTROY, 209 210 NFCT_T_ERROR_BIT = 31, 211 NFCT_T_ERROR = (1 << NFCT_T_ERROR_BIT), 212 }; 213 214 /* constructor / destructor */ 215 extern struct nf_conntrack *nfct_new(void); 216 extern void nfct_destroy(struct nf_conntrack *ct); 217 218 /* clone */ 219 struct nf_conntrack *nfct_clone(const struct nf_conntrack *ct); 220 221 /* object size */ 222 extern __attribute__((deprecated)) size_t nfct_sizeof(const struct nf_conntrack *ct); 223 224 /* maximum object size */ 225 extern __attribute__((deprecated)) size_t nfct_maxsize(void); 226 227 /* set option */ 228 enum { 229 NFCT_SOPT_UNDO_SNAT, 230 NFCT_SOPT_UNDO_DNAT, 231 NFCT_SOPT_UNDO_SPAT, 232 NFCT_SOPT_UNDO_DPAT, 233 NFCT_SOPT_SETUP_ORIGINAL, 234 NFCT_SOPT_SETUP_REPLY, 235 __NFCT_SOPT_MAX, 236 }; 237 #define NFCT_SOPT_MAX (__NFCT_SOPT_MAX - 1) 238 239 /* get option */ 240 enum { 241 NFCT_GOPT_IS_SNAT, 242 NFCT_GOPT_IS_DNAT, 243 NFCT_GOPT_IS_SPAT, 244 NFCT_GOPT_IS_DPAT, 245 __NFCT_GOPT_MAX, 246 }; 247 #define NFCT_GOPT_MAX (__NFCT_GOPT_MAX - 1) 248 249 extern int nfct_setobjopt(struct nf_conntrack *ct, unsigned int option); 250 extern int nfct_getobjopt(const struct nf_conntrack *ct, unsigned int option); 251 252 /* register / unregister callback */ 253 254 extern int nfct_callback_register(struct nfct_handle *h, 255 enum nf_conntrack_msg_type type, 256 int (*cb)(enum nf_conntrack_msg_type type, 257 struct nf_conntrack *ct, 258 void *data), 259 void *data); 260 261 extern void nfct_callback_unregister(struct nfct_handle *h); 262 263 /* register / unregister callback: extended version including netlink header */ 264 265 extern int nfct_callback_register2(struct nfct_handle *h, 266 enum nf_conntrack_msg_type type, 267 int (*cb)(const struct nlmsghdr *nlh, 268 enum nf_conntrack_msg_type type, 269 struct nf_conntrack *ct, 270 void *data), 271 void *data); 272 273 extern void nfct_callback_unregister2(struct nfct_handle *h); 274 275 /* callback verdict */ 276 enum { 277 NFCT_CB_FAILURE = -1, /* failure */ 278 NFCT_CB_STOP = 0, /* stop the query */ 279 NFCT_CB_CONTINUE = 1, /* keep iterating through data */ 280 NFCT_CB_STOLEN = 2, /* like continue, but ct is not freed */ 281 }; 282 283 /* bitmask setter/getter */ 284 struct nfct_bitmask; 285 286 struct nfct_bitmask *nfct_bitmask_new(unsigned int maxbit); 287 struct nfct_bitmask *nfct_bitmask_clone(const struct nfct_bitmask *); 288 unsigned int nfct_bitmask_maxbit(const struct nfct_bitmask *); 289 290 void nfct_bitmask_set_bit(struct nfct_bitmask *, unsigned int bit); 291 int nfct_bitmask_test_bit(const struct nfct_bitmask *, unsigned int bit); 292 void nfct_bitmask_unset_bit(struct nfct_bitmask *, unsigned int bit); 293 void nfct_bitmask_destroy(struct nfct_bitmask *); 294 void nfct_bitmask_clear(struct nfct_bitmask *); 295 bool nfct_bitmask_equal(const struct nfct_bitmask *, const struct nfct_bitmask *); 296 297 /* connlabel name <-> bit translation mapping */ 298 struct nfct_labelmap; 299 300 const char *nfct_labels_get_path(void); 301 struct nfct_labelmap *nfct_labelmap_new(const char *mapfile); 302 void nfct_labelmap_destroy(struct nfct_labelmap *map); 303 const char *nfct_labelmap_get_name(struct nfct_labelmap *m, unsigned int bit); 304 int nfct_labelmap_get_bit(struct nfct_labelmap *m, const char *name); 305 306 /* setter */ 307 extern void nfct_set_attr(struct nf_conntrack *ct, 308 const enum nf_conntrack_attr type, 309 const void *value); 310 311 extern void nfct_set_attr_u8(struct nf_conntrack *ct, 312 const enum nf_conntrack_attr type, 313 uint8_t value); 314 315 extern void nfct_set_attr_u16(struct nf_conntrack *ct, 316 const enum nf_conntrack_attr type, 317 uint16_t value); 318 319 extern void nfct_set_attr_u32(struct nf_conntrack *ct, 320 const enum nf_conntrack_attr type, 321 uint32_t value); 322 323 extern void nfct_set_attr_u64(struct nf_conntrack *ct, 324 const enum nf_conntrack_attr type, 325 uint64_t value); 326 327 extern void nfct_set_attr_l(struct nf_conntrack *ct, 328 const enum nf_conntrack_attr type, 329 const void *value, 330 size_t len); 331 332 /* getter */ 333 extern const void *nfct_get_attr(const struct nf_conntrack *ct, 334 const enum nf_conntrack_attr type); 335 336 extern uint8_t nfct_get_attr_u8(const struct nf_conntrack *ct, 337 const enum nf_conntrack_attr type); 338 339 extern uint16_t nfct_get_attr_u16(const struct nf_conntrack *ct, 340 const enum nf_conntrack_attr type); 341 342 extern uint32_t nfct_get_attr_u32(const struct nf_conntrack *ct, 343 const enum nf_conntrack_attr type); 344 345 extern uint64_t nfct_get_attr_u64(const struct nf_conntrack *ct, 346 const enum nf_conntrack_attr type); 347 348 /* checker */ 349 extern int nfct_attr_is_set(const struct nf_conntrack *ct, 350 const enum nf_conntrack_attr type); 351 352 extern int nfct_attr_is_set_array(const struct nf_conntrack *ct, 353 const enum nf_conntrack_attr *type_array, 354 int size); 355 356 /* unsetter */ 357 extern int nfct_attr_unset(struct nf_conntrack *ct, 358 const enum nf_conntrack_attr type); 359 360 /* group setter */ 361 extern void nfct_set_attr_grp(struct nf_conntrack *ct, 362 const enum nf_conntrack_attr_grp type, 363 const void *value); 364 /* group getter */ 365 extern int nfct_get_attr_grp(const struct nf_conntrack *ct, 366 const enum nf_conntrack_attr_grp type, 367 void *data); 368 369 /* group checker */ 370 extern int nfct_attr_grp_is_set(const struct nf_conntrack *ct, 371 const enum nf_conntrack_attr_grp type); 372 373 /* unsetter */ 374 extern int nfct_attr_grp_unset(struct nf_conntrack *ct, 375 const enum nf_conntrack_attr_grp type); 376 377 /* print */ 378 379 /* output type */ 380 enum { 381 NFCT_O_PLAIN, 382 NFCT_O_DEFAULT = NFCT_O_PLAIN, 383 NFCT_O_XML, 384 NFCT_O_MAX 385 }; 386 387 /* output flags */ 388 enum { 389 NFCT_OF_SHOW_LAYER3_BIT = 0, 390 NFCT_OF_SHOW_LAYER3 = (1 << NFCT_OF_SHOW_LAYER3_BIT), 391 392 NFCT_OF_TIME_BIT = 1, 393 NFCT_OF_TIME = (1 << NFCT_OF_TIME_BIT), 394 395 NFCT_OF_ID_BIT = 2, 396 NFCT_OF_ID = (1 << NFCT_OF_ID_BIT), 397 398 NFCT_OF_TIMESTAMP_BIT = 3, 399 NFCT_OF_TIMESTAMP = (1 << NFCT_OF_TIMESTAMP_BIT), 400 }; 401 402 extern int nfct_snprintf(char *buf, 403 unsigned int size, 404 const struct nf_conntrack *ct, 405 const unsigned int msg_type, 406 const unsigned int out_type, 407 const unsigned int out_flags); 408 409 extern int nfct_snprintf_labels(char *buf, 410 unsigned int size, 411 const struct nf_conntrack *ct, 412 const unsigned int msg_type, 413 const unsigned int out_type, 414 const unsigned int out_flags, 415 struct nfct_labelmap *map); 416 417 /* comparison */ 418 extern int nfct_compare(const struct nf_conntrack *ct1, 419 const struct nf_conntrack *ct2); 420 421 enum { 422 NFCT_CMP_ALL = 0, 423 NFCT_CMP_ORIG = (1 << 0), 424 NFCT_CMP_REPL = (1 << 1), 425 NFCT_CMP_TIMEOUT_EQ = (1 << 2), 426 NFCT_CMP_TIMEOUT_GT = (1 << 3), 427 NFCT_CMP_TIMEOUT_GE = (NFCT_CMP_TIMEOUT_EQ | NFCT_CMP_TIMEOUT_GT), 428 NFCT_CMP_TIMEOUT_LT = (1 << 4), 429 NFCT_CMP_TIMEOUT_LE = (NFCT_CMP_TIMEOUT_EQ | NFCT_CMP_TIMEOUT_LT), 430 NFCT_CMP_MASK = (1 << 5), 431 NFCT_CMP_STRICT = (1 << 6), 432 }; 433 434 extern int nfct_cmp(const struct nf_conntrack *ct1, 435 const struct nf_conntrack *ct2, 436 unsigned int flags); 437 438 439 /* query */ 440 enum nf_conntrack_query { 441 NFCT_Q_CREATE, 442 NFCT_Q_UPDATE, 443 NFCT_Q_DESTROY, 444 NFCT_Q_GET, 445 NFCT_Q_FLUSH, 446 NFCT_Q_DUMP, 447 NFCT_Q_DUMP_RESET, 448 NFCT_Q_CREATE_UPDATE, 449 NFCT_Q_DUMP_FILTER, 450 NFCT_Q_DUMP_FILTER_RESET, 451 }; 452 453 extern int nfct_query(struct nfct_handle *h, 454 const enum nf_conntrack_query query, 455 const void *data); 456 457 extern int nfct_send(struct nfct_handle *h, 458 const enum nf_conntrack_query query, 459 const void *data); 460 461 extern int nfct_catch(struct nfct_handle *h); 462 463 /* copy */ 464 enum { 465 NFCT_CP_ALL = 0, 466 NFCT_CP_ORIG = (1 << 0), 467 NFCT_CP_REPL = (1 << 1), 468 NFCT_CP_META = (1 << 2), 469 NFCT_CP_OVERRIDE = (1 << 3), 470 }; 471 472 extern void nfct_copy(struct nf_conntrack *dest, 473 const struct nf_conntrack *source, 474 unsigned int flags); 475 476 extern void nfct_copy_attr(struct nf_conntrack *ct1, 477 const struct nf_conntrack *ct2, 478 const enum nf_conntrack_attr type); 479 480 /* event filtering */ 481 482 struct nfct_filter; 483 484 extern struct nfct_filter *nfct_filter_create(void); 485 extern void nfct_filter_destroy(struct nfct_filter *filter); 486 487 struct nfct_filter_proto { 488 uint16_t proto; 489 uint16_t state; 490 }; 491 struct nfct_filter_ipv4 { 492 uint32_t addr; 493 uint32_t mask; 494 }; 495 struct nfct_filter_ipv6 { 496 uint32_t addr[4]; 497 uint32_t mask[4]; 498 }; 499 500 enum nfct_filter_attr { 501 NFCT_FILTER_L4PROTO = 0, /* uint32_t */ 502 NFCT_FILTER_L4PROTO_STATE, /* struct nfct_filter_proto */ 503 NFCT_FILTER_SRC_IPV4, /* struct nfct_filter_ipv4 */ 504 NFCT_FILTER_DST_IPV4, /* struct nfct_filter_ipv4 */ 505 NFCT_FILTER_SRC_IPV6, /* struct nfct_filter_ipv6 */ 506 NFCT_FILTER_DST_IPV6, /* struct nfct_filter_ipv6 */ 507 NFCT_FILTER_MARK, /* struct nfct_filter_dump_mark */ 508 NFCT_FILTER_MAX 509 }; 510 511 extern void nfct_filter_add_attr(struct nfct_filter *filter, 512 const enum nfct_filter_attr attr, 513 const void *value); 514 515 extern void nfct_filter_add_attr_u32(struct nfct_filter *filter, 516 const enum nfct_filter_attr attr, 517 const uint32_t value); 518 519 enum nfct_filter_logic { 520 NFCT_FILTER_LOGIC_POSITIVE, 521 NFCT_FILTER_LOGIC_NEGATIVE, 522 NFCT_FILTER_LOGIC_MAX 523 }; 524 525 extern int nfct_filter_set_logic(struct nfct_filter *filter, 526 const enum nfct_filter_attr attr, 527 const enum nfct_filter_logic logic); 528 529 extern int nfct_filter_attach(int fd, struct nfct_filter *filter); 530 extern int nfct_filter_detach(int fd); 531 532 /* dump filtering */ 533 534 struct nfct_filter_dump; 535 536 struct nfct_filter_dump_mark { 537 uint32_t val; 538 uint32_t mask; 539 }; 540 541 enum nfct_filter_dump_attr { 542 NFCT_FILTER_DUMP_MARK = 0, /* struct nfct_filter_dump_mark */ 543 NFCT_FILTER_DUMP_L3NUM, /* uint8_t */ 544 NFCT_FILTER_DUMP_MAX 545 }; 546 547 struct nfct_filter_dump *nfct_filter_dump_create(void); 548 549 void nfct_filter_dump_destroy(struct nfct_filter_dump *filter); 550 551 void nfct_filter_dump_set_attr(struct nfct_filter_dump *filter_dump, 552 const enum nfct_filter_dump_attr type, 553 const void *data); 554 555 void nfct_filter_dump_set_attr_u8(struct nfct_filter_dump *filter_dump, 556 const enum nfct_filter_dump_attr type, 557 uint8_t data); 558 559 /* low level API: netlink functions */ 560 561 extern __attribute__((deprecated)) int 562 nfct_build_conntrack(struct nfnl_subsys_handle *ssh, 563 void *req, 564 size_t size, 565 uint16_t type, 566 uint16_t flags, 567 const struct nf_conntrack *ct); 568 569 extern __attribute__((deprecated)) 570 int nfct_parse_conntrack(enum nf_conntrack_msg_type msg, 571 const struct nlmsghdr *nlh, 572 struct nf_conntrack *ct); 573 574 extern __attribute__((deprecated)) 575 int nfct_build_query(struct nfnl_subsys_handle *ssh, 576 const enum nf_conntrack_query query, 577 const void *data, 578 void *req, 579 unsigned int size); 580 581 /* New low level API: netlink functions */ 582 583 extern int nfct_nlmsg_build(struct nlmsghdr *nlh, const struct nf_conntrack *ct); 584 extern int nfct_nlmsg_parse(const struct nlmsghdr *nlh, struct nf_conntrack *ct); 585 extern int nfct_payload_parse(const void *payload, size_t payload_len, uint16_t l3num, struct nf_conntrack *ct); 586 587 /* 588 * NEW expectation API 589 */ 590 591 /* expectation object */ 592 struct nf_expect; 593 594 /* expect attributes */ 595 enum nf_expect_attr { 596 ATTR_EXP_MASTER = 0, /* pointer to conntrack object */ 597 ATTR_EXP_EXPECTED, /* pointer to conntrack object */ 598 ATTR_EXP_MASK, /* pointer to conntrack object */ 599 ATTR_EXP_TIMEOUT, /* u32 bits */ 600 ATTR_EXP_ZONE, /* u16 bits */ 601 ATTR_EXP_FLAGS, /* u32 bits */ 602 ATTR_EXP_HELPER_NAME, /* string (16 bytes max) */ 603 ATTR_EXP_CLASS, /* u32 bits */ 604 ATTR_EXP_NAT_TUPLE, /* pointer to conntrack object */ 605 ATTR_EXP_NAT_DIR, /* u8 bits */ 606 ATTR_EXP_FN, /* string */ 607 ATTR_EXP_MAX 608 }; 609 610 /* constructor / destructor */ 611 extern struct nf_expect *nfexp_new(void); 612 extern void nfexp_destroy(struct nf_expect *exp); 613 614 /* clone */ 615 extern struct nf_expect *nfexp_clone(const struct nf_expect *exp); 616 617 /* object size */ 618 extern size_t nfexp_sizeof(const struct nf_expect *exp); 619 620 /* maximum object size */ 621 extern size_t nfexp_maxsize(void); 622 623 /* register / unregister callback */ 624 625 extern int nfexp_callback_register(struct nfct_handle *h, 626 enum nf_conntrack_msg_type type, 627 int (*cb)(enum nf_conntrack_msg_type type, 628 struct nf_expect *exp, 629 void *data), 630 void *data); 631 632 extern void nfexp_callback_unregister(struct nfct_handle *h); 633 634 /* register / unregister callback: extended version including netlink header */ 635 extern int nfexp_callback_register2(struct nfct_handle *h, 636 enum nf_conntrack_msg_type type, 637 int (*cb)(const struct nlmsghdr *nlh, 638 enum nf_conntrack_msg_type type, 639 struct nf_expect *exp, 640 void *data), 641 void *data); 642 643 extern void nfexp_callback_unregister2(struct nfct_handle *h); 644 645 /* setter */ 646 extern void nfexp_set_attr(struct nf_expect *exp, 647 const enum nf_expect_attr type, 648 const void *value); 649 650 extern void nfexp_set_attr_u8(struct nf_expect *exp, 651 const enum nf_expect_attr type, 652 uint8_t value); 653 654 extern void nfexp_set_attr_u16(struct nf_expect *exp, 655 const enum nf_expect_attr type, 656 uint16_t value); 657 658 extern void nfexp_set_attr_u32(struct nf_expect *exp, 659 const enum nf_expect_attr type, 660 uint32_t value); 661 662 /* getter */ 663 extern const void *nfexp_get_attr(const struct nf_expect *exp, 664 const enum nf_expect_attr type); 665 666 extern uint8_t nfexp_get_attr_u8(const struct nf_expect *exp, 667 const enum nf_expect_attr type); 668 669 extern uint16_t nfexp_get_attr_u16(const struct nf_expect *exp, 670 const enum nf_expect_attr type); 671 672 extern uint32_t nfexp_get_attr_u32(const struct nf_expect *exp, 673 const enum nf_expect_attr type); 674 675 /* checker */ 676 extern int nfexp_attr_is_set(const struct nf_expect *exp, 677 const enum nf_expect_attr type); 678 679 /* unsetter */ 680 extern int nfexp_attr_unset(struct nf_expect *exp, 681 const enum nf_expect_attr type); 682 683 /* query */ 684 extern int nfexp_query(struct nfct_handle *h, 685 const enum nf_conntrack_query qt, 686 const void *data); 687 688 /* print */ 689 extern int nfexp_snprintf(char *buf, 690 unsigned int size, 691 const struct nf_expect *exp, 692 const unsigned int msg_type, 693 const unsigned int out_type, 694 const unsigned int out_flags); 695 696 /* compare */ 697 extern int nfexp_cmp(const struct nf_expect *exp1, 698 const struct nf_expect *exp2, 699 unsigned int flags); 700 701 extern int nfexp_send(struct nfct_handle *h, 702 const enum nf_conntrack_query qt, 703 const void *data); 704 705 extern int nfexp_catch(struct nfct_handle *h); 706 707 /* low level API */ 708 extern __attribute__((deprecated)) 709 int nfexp_build_expect(struct nfnl_subsys_handle *ssh, 710 void *req, 711 size_t size, 712 uint16_t type, 713 uint16_t flags, 714 const struct nf_expect *exp); 715 716 extern __attribute__((deprecated)) 717 int nfexp_parse_expect(enum nf_conntrack_msg_type type, 718 const struct nlmsghdr *nlh, 719 struct nf_expect *exp); 720 721 extern __attribute__((deprecated)) 722 int nfexp_build_query(struct nfnl_subsys_handle *ssh, 723 const enum nf_conntrack_query qt, 724 const void *data, 725 void *buffer, 726 unsigned int size); 727 728 /* New low level API: netlink functions */ 729 730 extern int nfexp_nlmsg_build(struct nlmsghdr *nlh, const struct nf_expect *exp); 731 extern int nfexp_nlmsg_parse(const struct nlmsghdr *nlh, struct nf_expect *exp); 732 733 /* Bitset representing status of connection. Taken from ip_conntrack.h 734 * 735 * Note: For backward compatibility this shouldn't ever change 736 * in kernel space. 737 */ 738 enum ip_conntrack_status { 739 /* It's an expected connection: bit 0 set. This bit never changed */ 740 IPS_EXPECTED_BIT = 0, 741 IPS_EXPECTED = (1 << IPS_EXPECTED_BIT), 742 743 /* We've seen packets both ways: bit 1 set. Can be set, not unset. */ 744 IPS_SEEN_REPLY_BIT = 1, 745 IPS_SEEN_REPLY = (1 << IPS_SEEN_REPLY_BIT), 746 747 /* Conntrack should never be early-expired. */ 748 IPS_ASSURED_BIT = 2, 749 IPS_ASSURED = (1 << IPS_ASSURED_BIT), 750 751 /* Connection is confirmed: originating packet has left box */ 752 IPS_CONFIRMED_BIT = 3, 753 IPS_CONFIRMED = (1 << IPS_CONFIRMED_BIT), 754 755 /* Connection needs src nat in orig dir. This bit never changed. */ 756 IPS_SRC_NAT_BIT = 4, 757 IPS_SRC_NAT = (1 << IPS_SRC_NAT_BIT), 758 759 /* Connection needs dst nat in orig dir. This bit never changed. */ 760 IPS_DST_NAT_BIT = 5, 761 IPS_DST_NAT = (1 << IPS_DST_NAT_BIT), 762 763 /* Both together. */ 764 IPS_NAT_MASK = (IPS_DST_NAT | IPS_SRC_NAT), 765 766 /* Connection needs TCP sequence adjusted. */ 767 IPS_SEQ_ADJUST_BIT = 6, 768 IPS_SEQ_ADJUST = (1 << IPS_SEQ_ADJUST_BIT), 769 770 /* NAT initialization bits. */ 771 IPS_SRC_NAT_DONE_BIT = 7, 772 IPS_SRC_NAT_DONE = (1 << IPS_SRC_NAT_DONE_BIT), 773 774 IPS_DST_NAT_DONE_BIT = 8, 775 IPS_DST_NAT_DONE = (1 << IPS_DST_NAT_DONE_BIT), 776 777 /* Both together */ 778 IPS_NAT_DONE_MASK = (IPS_DST_NAT_DONE | IPS_SRC_NAT_DONE), 779 780 /* Connection is dying (removed from lists), can not be unset. */ 781 IPS_DYING_BIT = 9, 782 IPS_DYING = (1 << IPS_DYING_BIT), 783 784 /* Connection has fixed timeout. */ 785 IPS_FIXED_TIMEOUT_BIT = 10, 786 IPS_FIXED_TIMEOUT = (1 << IPS_FIXED_TIMEOUT_BIT), 787 788 /* Conntrack is a template */ 789 IPS_TEMPLATE_BIT = 11, 790 IPS_TEMPLATE = (1 << IPS_TEMPLATE_BIT), 791 792 /* Conntrack is a fake untracked entry */ 793 IPS_UNTRACKED_BIT = 12, 794 IPS_UNTRACKED = (1 << IPS_UNTRACKED_BIT), 795 }; 796 797 /* expectation flags */ 798 #define NF_CT_EXPECT_PERMANENT 0x1 799 #define NF_CT_EXPECT_INACTIVE 0x2 800 #define NF_CT_EXPECT_USERSPACE 0x4 801 802 /* 803 * TCP flags 804 */ 805 806 /* Window scaling is advertised by the sender */ 807 #define IP_CT_TCP_FLAG_WINDOW_SCALE 0x01 808 809 /* SACK is permitted by the sender */ 810 #define IP_CT_TCP_FLAG_SACK_PERM 0x02 811 812 /* This sender sent FIN first */ 813 #define IP_CT_TCP_FLAG_CLOSE_INIT 0x04 814 815 /* Be liberal in window checking */ 816 #define IP_CT_TCP_FLAG_BE_LIBERAL 0x08 817 818 /* WARNING: do not use these constants in new applications, we keep them here 819 * to avoid breaking backward compatibility. */ 820 #define NFCT_DIR_ORIGINAL 0 821 #define NFCT_DIR_REPLY 1 822 #define NFCT_DIR_MAX NFCT_DIR_REPLY+1 823 824 /* xt_helper uses a length size of 30 bytes, however, no helper name in 825 * the tree has exceeded 16 bytes length. Since 2.6.29, the maximum 826 * length accepted is 16 bytes, this limit is enforced during module load. */ 827 #define NFCT_HELPER_NAME_MAX 16 828 829 #ifdef __cplusplus 830 } 831 #endif 832 833 #endif /* _LIBNETFILTER_CONNTRACK_H_ */ 834