[deliverable/linux.git] / include / linux / netfilter / nf_conntrack_common.h

#ifndef _NF_CONNTRACK_COMMON_H
#define _NF_CONNTRACK_COMMON_H
/* Connection state tracking for netfilter.  This is separated from,
   but required by, the NAT layer; it can also be used by an iptables
   extension. */
enum ip_conntrack_info {
	/* Part of an established connection (either direction). */
	IP_CT_ESTABLISHED,

	/* Like NEW, but related to an existing connection, or ICMP error
	   (in either direction). */
	IP_CT_RELATED,

	/* Started a new connection to track (only
           IP_CT_DIR_ORIGINAL); may be a retransmission. */
	IP_CT_NEW,

	/* >= this indicates reply direction */
	IP_CT_IS_REPLY,

	IP_CT_ESTABLISHED_REPLY = IP_CT_ESTABLISHED + IP_CT_IS_REPLY,
	IP_CT_RELATED_REPLY = IP_CT_RELATED + IP_CT_IS_REPLY,
	IP_CT_NEW_REPLY = IP_CT_NEW + IP_CT_IS_REPLY,	
	/* Number of distinct IP_CT types (no NEW in reply dirn). */
	IP_CT_NUMBER = IP_CT_IS_REPLY * 2 - 1
};

/* Bitset representing status of connection. */
enum ip_conntrack_status {
	/* It's an expected connection: bit 0 set.  This bit never changed */
	IPS_EXPECTED_BIT = 0,
	IPS_EXPECTED = (1 << IPS_EXPECTED_BIT),

	/* We've seen packets both ways: bit 1 set.  Can be set, not unset. */
	IPS_SEEN_REPLY_BIT = 1,
	IPS_SEEN_REPLY = (1 << IPS_SEEN_REPLY_BIT),

	/* Conntrack should never be early-expired. */
	IPS_ASSURED_BIT = 2,
	IPS_ASSURED = (1 << IPS_ASSURED_BIT),

	/* Connection is confirmed: originating packet has left box */
	IPS_CONFIRMED_BIT = 3,
	IPS_CONFIRMED = (1 << IPS_CONFIRMED_BIT),

	/* Connection needs src nat in orig dir.  This bit never changed. */
	IPS_SRC_NAT_BIT = 4,
	IPS_SRC_NAT = (1 << IPS_SRC_NAT_BIT),

	/* Connection needs dst nat in orig dir.  This bit never changed. */
	IPS_DST_NAT_BIT = 5,
	IPS_DST_NAT = (1 << IPS_DST_NAT_BIT),

	/* Both together. */
	IPS_NAT_MASK = (IPS_DST_NAT | IPS_SRC_NAT),

	/* Connection needs TCP sequence adjusted. */
	IPS_SEQ_ADJUST_BIT = 6,
	IPS_SEQ_ADJUST = (1 << IPS_SEQ_ADJUST_BIT),

	/* NAT initialization bits. */
	IPS_SRC_NAT_DONE_BIT = 7,
	IPS_SRC_NAT_DONE = (1 << IPS_SRC_NAT_DONE_BIT),

	IPS_DST_NAT_DONE_BIT = 8,
	IPS_DST_NAT_DONE = (1 << IPS_DST_NAT_DONE_BIT),

	/* Both together */
	IPS_NAT_DONE_MASK = (IPS_DST_NAT_DONE | IPS_SRC_NAT_DONE),

	/* Connection is dying (removed from lists), can not be unset. */
	IPS_DYING_BIT = 9,
	IPS_DYING = (1 << IPS_DYING_BIT),

	/* Connection has fixed timeout. */
	IPS_FIXED_TIMEOUT_BIT = 10,
	IPS_FIXED_TIMEOUT = (1 << IPS_FIXED_TIMEOUT_BIT),

	/* Conntrack is a template */
	IPS_TEMPLATE_BIT = 11,
	IPS_TEMPLATE = (1 << IPS_TEMPLATE_BIT),

	/* Conntrack is a fake untracked entry */
	IPS_UNTRACKED_BIT = 12,
	IPS_UNTRACKED = (1 << IPS_UNTRACKED_BIT),

	/* Conntrack got a helper explicitly attached via CT target. */
	IPS_HELPER_BIT = 13,
	IPS_HELPER = (1 << IPS_HELPER_BIT),
};

/* Connection tracking event types */
enum ip_conntrack_events {
	IPCT_NEW,		/* new conntrack */
	IPCT_RELATED,		/* related conntrack */
	IPCT_DESTROY,		/* destroyed conntrack */
	IPCT_REPLY,		/* connection has seen two-way traffic */
	IPCT_ASSURED,		/* connection status has changed to assured */
	IPCT_PROTOINFO,		/* protocol information has changed */
	IPCT_HELPER,		/* new helper has been set */
	IPCT_MARK,		/* new mark has been set */
	IPCT_NATSEQADJ,		/* NAT is doing sequence adjustment */
	IPCT_SECMARK,		/* new security mark has been set */
};

enum ip_conntrack_expect_events {
	IPEXP_NEW,		/* new expectation */
	IPEXP_DESTROY,		/* destroyed expectation */
};

/* expectation flags */
#define NF_CT_EXPECT_PERMANENT		0x1
#define NF_CT_EXPECT_INACTIVE		0x2
#define NF_CT_EXPECT_USERSPACE		0x4

#ifdef __KERNEL__
struct ip_conntrack_stat {
	unsigned int searched;
	unsigned int found;
	unsigned int new;
	unsigned int invalid;
	unsigned int ignore;
	unsigned int delete;
	unsigned int delete_list;
	unsigned int insert;
	unsigned int insert_failed;
	unsigned int drop;
	unsigned int early_drop;
	unsigned int error;
	unsigned int expect_new;
	unsigned int expect_create;
	unsigned int expect_delete;
	unsigned int search_restart;
};

/* call to create an explicit dependency on nf_conntrack. */
extern void need_conntrack(void);

#endif /* __KERNEL__ */

#endif /* _NF_CONNTRACK_COMMON_H */
Commit	Line	Data
9fb9cbb1 YK	1	#ifndef _NF_CONNTRACK_COMMON_H
	2	#define _NF_CONNTRACK_COMMON_H
	3	/* Connection state tracking for netfilter. This is separated from,
	4	but required by, the NAT layer; it can also be used by an iptables
	5	extension. */
d94d9fee	6	enum ip_conntrack_info {
9fb9cbb1 YK	7	/* Part of an established connection (either direction). */
	8	IP_CT_ESTABLISHED,
	9
	10	/* Like NEW, but related to an existing connection, or ICMP error
	11	(in either direction). */
	12	IP_CT_RELATED,
	13
	14	/* Started a new connection to track (only
	15	IP_CT_DIR_ORIGINAL); may be a retransmission. */
	16	IP_CT_NEW,
	17
	18	/* >= this indicates reply direction */
	19	IP_CT_IS_REPLY,
	20
fb048833 ED	21	IP_CT_ESTABLISHED_REPLY = IP_CT_ESTABLISHED + IP_CT_IS_REPLY,
	22	IP_CT_RELATED_REPLY = IP_CT_RELATED + IP_CT_IS_REPLY,
	23	IP_CT_NEW_REPLY = IP_CT_NEW + IP_CT_IS_REPLY,
9fb9cbb1 YK	24	/* Number of distinct IP_CT types (no NEW in reply dirn). */
	25	IP_CT_NUMBER = IP_CT_IS_REPLY * 2 - 1
	26	};
	27
	28	/* Bitset representing status of connection. */
	29	enum ip_conntrack_status {
	30	/* It's an expected connection: bit 0 set. This bit never changed */
	31	IPS_EXPECTED_BIT = 0,
	32	IPS_EXPECTED = (1 << IPS_EXPECTED_BIT),
	33
	34	/* We've seen packets both ways: bit 1 set. Can be set, not unset. */
	35	IPS_SEEN_REPLY_BIT = 1,
	36	IPS_SEEN_REPLY = (1 << IPS_SEEN_REPLY_BIT),
	37
	38	/* Conntrack should never be early-expired. */
	39	IPS_ASSURED_BIT = 2,
	40	IPS_ASSURED = (1 << IPS_ASSURED_BIT),
	41
	42	/* Connection is confirmed: originating packet has left box */
	43	IPS_CONFIRMED_BIT = 3,
	44	IPS_CONFIRMED = (1 << IPS_CONFIRMED_BIT),
	45
	46	/* Connection needs src nat in orig dir. This bit never changed. */
	47	IPS_SRC_NAT_BIT = 4,
	48	IPS_SRC_NAT = (1 << IPS_SRC_NAT_BIT),
	49
	50	/* Connection needs dst nat in orig dir. This bit never changed. */
	51	IPS_DST_NAT_BIT = 5,
	52	IPS_DST_NAT = (1 << IPS_DST_NAT_BIT),
	53
	54	/* Both together. */
	55	IPS_NAT_MASK = (IPS_DST_NAT \| IPS_SRC_NAT),
	56
	57	/* Connection needs TCP sequence adjusted. */
	58	IPS_SEQ_ADJUST_BIT = 6,
	59	IPS_SEQ_ADJUST = (1 << IPS_SEQ_ADJUST_BIT),
	60
	61	/* NAT initialization bits. */
	62	IPS_SRC_NAT_DONE_BIT = 7,
	63	IPS_SRC_NAT_DONE = (1 << IPS_SRC_NAT_DONE_BIT),
	64
	65	IPS_DST_NAT_DONE_BIT = 8,
	66	IPS_DST_NAT_DONE = (1 << IPS_DST_NAT_DONE_BIT),
	67
	68	/* Both together */
	69	IPS_NAT_DONE_MASK = (IPS_DST_NAT_DONE \| IPS_SRC_NAT_DONE),
	70
	71	/* Connection is dying (removed from lists), can not be unset. */
	72	IPS_DYING_BIT = 9,
	73	IPS_DYING = (1 << IPS_DYING_BIT),
997ae831 EL	74
	75	/* Connection has fixed timeout. */
	76	IPS_FIXED_TIMEOUT_BIT = 10,
	77	IPS_FIXED_TIMEOUT = (1 << IPS_FIXED_TIMEOUT_BIT),
b2a15a60 PM	78
	79	/* Conntrack is a template */
	80	IPS_TEMPLATE_BIT = 11,
	81	IPS_TEMPLATE = (1 << IPS_TEMPLATE_BIT),
5bfddbd4 ED	82
	83	/* Conntrack is a fake untracked entry */
	84	IPS_UNTRACKED_BIT = 12,
	85	IPS_UNTRACKED = (1 << IPS_UNTRACKED_BIT),
6714cf54 PNA	86
	87	/* Conntrack got a helper explicitly attached via CT target. */
	88	IPS_HELPER_BIT = 13,
	89	IPS_HELPER = (1 << IPS_HELPER_BIT),
9fb9cbb1 YK	90	};
9fb9cbb1 YK	91
0cebe4b4 PM	92	/* Connection tracking event types */
	93	enum ip_conntrack_events {
	94	IPCT_NEW, /* new conntrack */
	95	IPCT_RELATED, /* related conntrack */
	96	IPCT_DESTROY, /* destroyed conntrack */
	97	IPCT_REPLY, /* connection has seen two-way traffic */
	98	IPCT_ASSURED, /* connection status has changed to assured */
	99	IPCT_PROTOINFO, /* protocol information has changed */
	100	IPCT_HELPER, /* new helper has been set */
	101	IPCT_MARK, /* new mark has been set */
	102	IPCT_NATSEQADJ, /* NAT is doing sequence adjustment */
	103	IPCT_SECMARK, /* new security mark has been set */
	104	};
	105
	106	enum ip_conntrack_expect_events {
	107	IPEXP_NEW, /* new expectation */
ebbf41df	108	IPEXP_DESTROY, /* destroyed expectation */
0cebe4b4 PM	109	};
0cebe4b4 PM	110
8b008faf PNA	111	/* expectation flags */
	112	#define NF_CT_EXPECT_PERMANENT 0x1
	113	#define NF_CT_EXPECT_INACTIVE 0x2
bc01befd	114	#define NF_CT_EXPECT_USERSPACE 0x4
8b008faf	115
9fb9cbb1	116	#ifdef __KERNEL__
d94d9fee	117	struct ip_conntrack_stat {
9fb9cbb1 YK	118	unsigned int searched;
	119	unsigned int found;
	120	unsigned int new;
	121	unsigned int invalid;
	122	unsigned int ignore;
	123	unsigned int delete;
	124	unsigned int delete_list;
	125	unsigned int insert;
	126	unsigned int insert_failed;
	127	unsigned int drop;
	128	unsigned int early_drop;
	129	unsigned int error;
	130	unsigned int expect_new;
	131	unsigned int expect_create;
	132	unsigned int expect_delete;
af740b2c	133	unsigned int search_restart;
9fb9cbb1 YK	134	};
9fb9cbb1 YK	135
2e4e6a17 HW	136	/* call to create an explicit dependency on nf_conntrack. */
	137	extern void need_conntrack(void);
	138
9fb9cbb1 YK	139	#endif /* __KERNEL__ */
	140
	141	#endif /* _NF_CONNTRACK_COMMON_H */