[net-next-2.6.git] / include / linux / netfilter / nf_conntrack_common.h

#ifndef _NF_CONNTRACK_COMMON_H
#define _NF_CONNTRACK_COMMON_H
/* Connection state tracking for netfilter.  This is separated from,
   but required by, the NAT layer; it can also be used by an iptables
   extension. */
enum ip_conntrack_info {
	/* Part of an established connection (either direction). */
	IP_CT_ESTABLISHED,

	/* Like NEW, but related to an existing connection, or ICMP error
	   (in either direction). */
	IP_CT_RELATED,

	/* Started a new connection to track (only
           IP_CT_DIR_ORIGINAL); may be a retransmission. */
	IP_CT_NEW,

	/* >= this indicates reply direction */
	IP_CT_IS_REPLY,

	/* Number of distinct IP_CT types (no NEW in reply dirn). */
	IP_CT_NUMBER = IP_CT_IS_REPLY * 2 - 1
};

/* Bitset representing status of connection. */
enum ip_conntrack_status {
	/* It's an expected connection: bit 0 set.  This bit never changed */
	IPS_EXPECTED_BIT = 0,
	IPS_EXPECTED = (1 << IPS_EXPECTED_BIT),

	/* We've seen packets both ways: bit 1 set.  Can be set, not unset. */
	IPS_SEEN_REPLY_BIT = 1,
	IPS_SEEN_REPLY = (1 << IPS_SEEN_REPLY_BIT),

	/* Conntrack should never be early-expired. */
	IPS_ASSURED_BIT = 2,
	IPS_ASSURED = (1 << IPS_ASSURED_BIT),

	/* Connection is confirmed: originating packet has left box */
	IPS_CONFIRMED_BIT = 3,
	IPS_CONFIRMED = (1 << IPS_CONFIRMED_BIT),

	/* Connection needs src nat in orig dir.  This bit never changed. */
	IPS_SRC_NAT_BIT = 4,
	IPS_SRC_NAT = (1 << IPS_SRC_NAT_BIT),

	/* Connection needs dst nat in orig dir.  This bit never changed. */
	IPS_DST_NAT_BIT = 5,
	IPS_DST_NAT = (1 << IPS_DST_NAT_BIT),

	/* Both together. */
	IPS_NAT_MASK = (IPS_DST_NAT | IPS_SRC_NAT),

	/* Connection needs TCP sequence adjusted. */
	IPS_SEQ_ADJUST_BIT = 6,
	IPS_SEQ_ADJUST = (1 << IPS_SEQ_ADJUST_BIT),

	/* NAT initialization bits. */
	IPS_SRC_NAT_DONE_BIT = 7,
	IPS_SRC_NAT_DONE = (1 << IPS_SRC_NAT_DONE_BIT),

	IPS_DST_NAT_DONE_BIT = 8,
	IPS_DST_NAT_DONE = (1 << IPS_DST_NAT_DONE_BIT),

	/* Both together */
	IPS_NAT_DONE_MASK = (IPS_DST_NAT_DONE | IPS_SRC_NAT_DONE),

	/* Connection is dying (removed from lists), can not be unset. */
	IPS_DYING_BIT = 9,
	IPS_DYING = (1 << IPS_DYING_BIT),

	/* Connection has fixed timeout. */
	IPS_FIXED_TIMEOUT_BIT = 10,
	IPS_FIXED_TIMEOUT = (1 << IPS_FIXED_TIMEOUT_BIT),

	/* Conntrack is a template */
	IPS_TEMPLATE_BIT = 11,
	IPS_TEMPLATE = (1 << IPS_TEMPLATE_BIT),

	/* Conntrack is a fake untracked entry */
	IPS_UNTRACKED_BIT = 12,
	IPS_UNTRACKED = (1 << IPS_UNTRACKED_BIT),
};

/* Connection tracking event types */
enum ip_conntrack_events {
	IPCT_NEW,		/* new conntrack */
	IPCT_RELATED,		/* related conntrack */
	IPCT_DESTROY,		/* destroyed conntrack */
	IPCT_REPLY,		/* connection has seen two-way traffic */
	IPCT_ASSURED,		/* connection status has changed to assured */
	IPCT_PROTOINFO,		/* protocol information has changed */
	IPCT_HELPER,		/* new helper has been set */
	IPCT_MARK,		/* new mark has been set */
	IPCT_NATSEQADJ,		/* NAT is doing sequence adjustment */
	IPCT_SECMARK,		/* new security mark has been set */
};

enum ip_conntrack_expect_events {
	IPEXP_NEW,		/* new expectation */
};

#ifdef __KERNEL__
struct ip_conntrack_stat {
	unsigned int searched;
	unsigned int found;
	unsigned int new;
	unsigned int invalid;
	unsigned int ignore;
	unsigned int delete;
	unsigned int delete_list;
	unsigned int insert;
	unsigned int insert_failed;
	unsigned int drop;
	unsigned int early_drop;
	unsigned int error;
	unsigned int expect_new;
	unsigned int expect_create;
	unsigned int expect_delete;
	unsigned int search_restart;
};

/* call to create an explicit dependency on nf_conntrack. */
extern void need_conntrack(void);

#endif /* __KERNEL__ */

#endif /* _NF_CONNTRACK_COMMON_H */
Commit	Line	Data
9fb9cbb1 YK	1	#ifndef _NF_CONNTRACK_COMMON_H
	2	#define _NF_CONNTRACK_COMMON_H
	3	/* Connection state tracking for netfilter. This is separated from,
	4	but required by, the NAT layer; it can also be used by an iptables
	5	extension. */
d94d9fee	6	enum ip_conntrack_info {
9fb9cbb1 YK	7	/* Part of an established connection (either direction). */
	8	IP_CT_ESTABLISHED,
	9
	10	/* Like NEW, but related to an existing connection, or ICMP error
	11	(in either direction). */
	12	IP_CT_RELATED,
	13
	14	/* Started a new connection to track (only
	15	IP_CT_DIR_ORIGINAL); may be a retransmission. */
	16	IP_CT_NEW,
	17
	18	/* >= this indicates reply direction */
	19	IP_CT_IS_REPLY,
	20
	21	/* Number of distinct IP_CT types (no NEW in reply dirn). */
	22	IP_CT_NUMBER = IP_CT_IS_REPLY * 2 - 1
	23	};
	24
	25	/* Bitset representing status of connection. */
	26	enum ip_conntrack_status {
	27	/* It's an expected connection: bit 0 set. This bit never changed */
	28	IPS_EXPECTED_BIT = 0,
	29	IPS_EXPECTED = (1 << IPS_EXPECTED_BIT),
	30
	31	/* We've seen packets both ways: bit 1 set. Can be set, not unset. */
	32	IPS_SEEN_REPLY_BIT = 1,
	33	IPS_SEEN_REPLY = (1 << IPS_SEEN_REPLY_BIT),
	34
	35	/* Conntrack should never be early-expired. */
	36	IPS_ASSURED_BIT = 2,
	37	IPS_ASSURED = (1 << IPS_ASSURED_BIT),
	38
	39	/* Connection is confirmed: originating packet has left box */
	40	IPS_CONFIRMED_BIT = 3,
	41	IPS_CONFIRMED = (1 << IPS_CONFIRMED_BIT),
	42
	43	/* Connection needs src nat in orig dir. This bit never changed. */
	44	IPS_SRC_NAT_BIT = 4,
	45	IPS_SRC_NAT = (1 << IPS_SRC_NAT_BIT),
	46
	47	/* Connection needs dst nat in orig dir. This bit never changed. */
	48	IPS_DST_NAT_BIT = 5,
	49	IPS_DST_NAT = (1 << IPS_DST_NAT_BIT),
	50
	51	/* Both together. */
	52	IPS_NAT_MASK = (IPS_DST_NAT \| IPS_SRC_NAT),
	53
	54	/* Connection needs TCP sequence adjusted. */
	55	IPS_SEQ_ADJUST_BIT = 6,
	56	IPS_SEQ_ADJUST = (1 << IPS_SEQ_ADJUST_BIT),
	57
	58	/* NAT initialization bits. */
	59	IPS_SRC_NAT_DONE_BIT = 7,
	60	IPS_SRC_NAT_DONE = (1 << IPS_SRC_NAT_DONE_BIT),
	61
	62	IPS_DST_NAT_DONE_BIT = 8,
	63	IPS_DST_NAT_DONE = (1 << IPS_DST_NAT_DONE_BIT),
	64
	65	/* Both together */
	66	IPS_NAT_DONE_MASK = (IPS_DST_NAT_DONE \| IPS_SRC_NAT_DONE),
	67
	68	/* Connection is dying (removed from lists), can not be unset. */
	69	IPS_DYING_BIT = 9,
	70	IPS_DYING = (1 << IPS_DYING_BIT),
997ae831 EL	71
	72	/* Connection has fixed timeout. */
	73	IPS_FIXED_TIMEOUT_BIT = 10,
	74	IPS_FIXED_TIMEOUT = (1 << IPS_FIXED_TIMEOUT_BIT),
b2a15a60 PM	75
	76	/* Conntrack is a template */
	77	IPS_TEMPLATE_BIT = 11,
	78	IPS_TEMPLATE = (1 << IPS_TEMPLATE_BIT),
5bfddbd4 ED	79
	80	/* Conntrack is a fake untracked entry */
	81	IPS_UNTRACKED_BIT = 12,
	82	IPS_UNTRACKED = (1 << IPS_UNTRACKED_BIT),
9fb9cbb1 YK	83	};
9fb9cbb1 YK	84
0cebe4b4 PM	85	/* Connection tracking event types */
	86	enum ip_conntrack_events {
	87	IPCT_NEW, /* new conntrack */
	88	IPCT_RELATED, /* related conntrack */
	89	IPCT_DESTROY, /* destroyed conntrack */
	90	IPCT_REPLY, /* connection has seen two-way traffic */
	91	IPCT_ASSURED, /* connection status has changed to assured */
	92	IPCT_PROTOINFO, /* protocol information has changed */
	93	IPCT_HELPER, /* new helper has been set */
	94	IPCT_MARK, /* new mark has been set */
	95	IPCT_NATSEQADJ, /* NAT is doing sequence adjustment */
	96	IPCT_SECMARK, /* new security mark has been set */
	97	};
	98
	99	enum ip_conntrack_expect_events {
	100	IPEXP_NEW, /* new expectation */
	101	};
	102
9fb9cbb1	103	#ifdef __KERNEL__
d94d9fee	104	struct ip_conntrack_stat {
9fb9cbb1 YK	105	unsigned int searched;
	106	unsigned int found;
	107	unsigned int new;
	108	unsigned int invalid;
	109	unsigned int ignore;
	110	unsigned int delete;
	111	unsigned int delete_list;
	112	unsigned int insert;
	113	unsigned int insert_failed;
	114	unsigned int drop;
	115	unsigned int early_drop;
	116	unsigned int error;
	117	unsigned int expect_new;
	118	unsigned int expect_create;
	119	unsigned int expect_delete;
af740b2c	120	unsigned int search_restart;
9fb9cbb1 YK	121	};
9fb9cbb1 YK	122
2e4e6a17 HW	123	/* call to create an explicit dependency on nf_conntrack. */
	124	extern void need_conntrack(void);
	125
9fb9cbb1 YK	126	#endif /* __KERNEL__ */
	127
	128	#endif /* _NF_CONNTRACK_COMMON_H */