[net-next-2.6.git] / include / linux / netfilter / nf_conntrack_common.h

#ifndef _NF_CONNTRACK_COMMON_H
#define _NF_CONNTRACK_COMMON_H
/* Connection state tracking for netfilter.  This is separated from,
   but required by, the NAT layer; it can also be used by an iptables
   extension. */
enum ip_conntrack_info {
	/* Part of an established connection (either direction). */
	IP_CT_ESTABLISHED,

	/* Like NEW, but related to an existing connection, or ICMP error
	   (in either direction). */
	IP_CT_RELATED,

	/* Started a new connection to track (only
           IP_CT_DIR_ORIGINAL); may be a retransmission. */
	IP_CT_NEW,

	/* >= this indicates reply direction */
	IP_CT_IS_REPLY,

	/* Number of distinct IP_CT types (no NEW in reply dirn). */
	IP_CT_NUMBER = IP_CT_IS_REPLY * 2 - 1
};

/* Bitset representing status of connection. */
enum ip_conntrack_status {
	/* It's an expected connection: bit 0 set.  This bit never changed */
	IPS_EXPECTED_BIT = 0,
	IPS_EXPECTED = (1 << IPS_EXPECTED_BIT),

	/* We've seen packets both ways: bit 1 set.  Can be set, not unset. */
	IPS_SEEN_REPLY_BIT = 1,
	IPS_SEEN_REPLY = (1 << IPS_SEEN_REPLY_BIT),

	/* Conntrack should never be early-expired. */
	IPS_ASSURED_BIT = 2,
	IPS_ASSURED = (1 << IPS_ASSURED_BIT),

	/* Connection is confirmed: originating packet has left box */
	IPS_CONFIRMED_BIT = 3,
	IPS_CONFIRMED = (1 << IPS_CONFIRMED_BIT),

	/* Connection needs src nat in orig dir.  This bit never changed. */
	IPS_SRC_NAT_BIT = 4,
	IPS_SRC_NAT = (1 << IPS_SRC_NAT_BIT),

	/* Connection needs dst nat in orig dir.  This bit never changed. */
	IPS_DST_NAT_BIT = 5,
	IPS_DST_NAT = (1 << IPS_DST_NAT_BIT),

	/* Both together. */
	IPS_NAT_MASK = (IPS_DST_NAT | IPS_SRC_NAT),

	/* Connection needs TCP sequence adjusted. */
	IPS_SEQ_ADJUST_BIT = 6,
	IPS_SEQ_ADJUST = (1 << IPS_SEQ_ADJUST_BIT),

	/* NAT initialization bits. */
	IPS_SRC_NAT_DONE_BIT = 7,
	IPS_SRC_NAT_DONE = (1 << IPS_SRC_NAT_DONE_BIT),

	IPS_DST_NAT_DONE_BIT = 8,
	IPS_DST_NAT_DONE = (1 << IPS_DST_NAT_DONE_BIT),

	/* Both together */
	IPS_NAT_DONE_MASK = (IPS_DST_NAT_DONE | IPS_SRC_NAT_DONE),

	/* Connection is dying (removed from lists), can not be unset. */
	IPS_DYING_BIT = 9,
	IPS_DYING = (1 << IPS_DYING_BIT),

	/* Connection has fixed timeout. */
	IPS_FIXED_TIMEOUT_BIT = 10,
	IPS_FIXED_TIMEOUT = (1 << IPS_FIXED_TIMEOUT_BIT),

	/* Conntrack is a template */
	IPS_TEMPLATE_BIT = 11,
	IPS_TEMPLATE = (1 << IPS_TEMPLATE_BIT),
};

/* Connection tracking event types */
enum ip_conntrack_events {
	IPCT_NEW,		/* new conntrack */
	IPCT_RELATED,		/* related conntrack */
	IPCT_DESTROY,		/* destroyed conntrack */
	IPCT_REPLY,		/* connection has seen two-way traffic */
	IPCT_ASSURED,		/* connection status has changed to assured */
	IPCT_PROTOINFO,		/* protocol information has changed */
	IPCT_HELPER,		/* new helper has been set */
	IPCT_MARK,		/* new mark has been set */
	IPCT_NATSEQADJ,		/* NAT is doing sequence adjustment */
	IPCT_SECMARK,		/* new security mark has been set */
};

enum ip_conntrack_expect_events {
	IPEXP_NEW,		/* new expectation */
};

#ifdef __KERNEL__
struct ip_conntrack_stat {
	unsigned int searched;
	unsigned int found;
	unsigned int new;
	unsigned int invalid;
	unsigned int ignore;
	unsigned int delete;
	unsigned int delete_list;
	unsigned int insert;
	unsigned int insert_failed;
	unsigned int drop;
	unsigned int early_drop;
	unsigned int error;
	unsigned int expect_new;
	unsigned int expect_create;
	unsigned int expect_delete;
};

/* call to create an explicit dependency on nf_conntrack. */
extern void need_conntrack(void);

#endif /* __KERNEL__ */

#endif /* _NF_CONNTRACK_COMMON_H */
Commit	Line	Data
9fb9cbb1 YK	1	#ifndef _NF_CONNTRACK_COMMON_H
	2	#define _NF_CONNTRACK_COMMON_H
	3	/* Connection state tracking for netfilter. This is separated from,
	4	but required by, the NAT layer; it can also be used by an iptables
	5	extension. */
d94d9fee	6	enum ip_conntrack_info {
9fb9cbb1 YK	7	/* Part of an established connection (either direction). */
	8	IP_CT_ESTABLISHED,
	9
	10	/* Like NEW, but related to an existing connection, or ICMP error
	11	(in either direction). */
	12	IP_CT_RELATED,
	13
	14	/* Started a new connection to track (only
	15	IP_CT_DIR_ORIGINAL); may be a retransmission. */
	16	IP_CT_NEW,
	17
	18	/* >= this indicates reply direction */
	19	IP_CT_IS_REPLY,
	20
	21	/* Number of distinct IP_CT types (no NEW in reply dirn). */
	22	IP_CT_NUMBER = IP_CT_IS_REPLY * 2 - 1
	23	};
	24
	25	/* Bitset representing status of connection. */
	26	enum ip_conntrack_status {
	27	/* It's an expected connection: bit 0 set. This bit never changed */
	28	IPS_EXPECTED_BIT = 0,
	29	IPS_EXPECTED = (1 << IPS_EXPECTED_BIT),
	30
	31	/* We've seen packets both ways: bit 1 set. Can be set, not unset. */
	32	IPS_SEEN_REPLY_BIT = 1,
	33	IPS_SEEN_REPLY = (1 << IPS_SEEN_REPLY_BIT),
	34
	35	/* Conntrack should never be early-expired. */
	36	IPS_ASSURED_BIT = 2,
	37	IPS_ASSURED = (1 << IPS_ASSURED_BIT),
	38
	39	/* Connection is confirmed: originating packet has left box */
	40	IPS_CONFIRMED_BIT = 3,
	41	IPS_CONFIRMED = (1 << IPS_CONFIRMED_BIT),
	42
	43	/* Connection needs src nat in orig dir. This bit never changed. */
	44	IPS_SRC_NAT_BIT = 4,
	45	IPS_SRC_NAT = (1 << IPS_SRC_NAT_BIT),
	46
	47	/* Connection needs dst nat in orig dir. This bit never changed. */
	48	IPS_DST_NAT_BIT = 5,
	49	IPS_DST_NAT = (1 << IPS_DST_NAT_BIT),
	50
	51	/* Both together. */
	52	IPS_NAT_MASK = (IPS_DST_NAT \| IPS_SRC_NAT),
	53
	54	/* Connection needs TCP sequence adjusted. */
	55	IPS_SEQ_ADJUST_BIT = 6,
	56	IPS_SEQ_ADJUST = (1 << IPS_SEQ_ADJUST_BIT),
	57
	58	/* NAT initialization bits. */
	59	IPS_SRC_NAT_DONE_BIT = 7,
	60	IPS_SRC_NAT_DONE = (1 << IPS_SRC_NAT_DONE_BIT),
	61
	62	IPS_DST_NAT_DONE_BIT = 8,
	63	IPS_DST_NAT_DONE = (1 << IPS_DST_NAT_DONE_BIT),
	64
	65	/* Both together */
	66	IPS_NAT_DONE_MASK = (IPS_DST_NAT_DONE \| IPS_SRC_NAT_DONE),
	67
	68	/* Connection is dying (removed from lists), can not be unset. */
	69	IPS_DYING_BIT = 9,
	70	IPS_DYING = (1 << IPS_DYING_BIT),
997ae831 EL	71
	72	/* Connection has fixed timeout. */
	73	IPS_FIXED_TIMEOUT_BIT = 10,
	74	IPS_FIXED_TIMEOUT = (1 << IPS_FIXED_TIMEOUT_BIT),
b2a15a60 PM	75
	76	/* Conntrack is a template */
	77	IPS_TEMPLATE_BIT = 11,
	78	IPS_TEMPLATE = (1 << IPS_TEMPLATE_BIT),
9fb9cbb1 YK	79	};
9fb9cbb1 YK	80
0cebe4b4 PM	81	/* Connection tracking event types */
	82	enum ip_conntrack_events {
	83	IPCT_NEW, /* new conntrack */
	84	IPCT_RELATED, /* related conntrack */
	85	IPCT_DESTROY, /* destroyed conntrack */
	86	IPCT_REPLY, /* connection has seen two-way traffic */
	87	IPCT_ASSURED, /* connection status has changed to assured */
	88	IPCT_PROTOINFO, /* protocol information has changed */
	89	IPCT_HELPER, /* new helper has been set */
	90	IPCT_MARK, /* new mark has been set */
	91	IPCT_NATSEQADJ, /* NAT is doing sequence adjustment */
	92	IPCT_SECMARK, /* new security mark has been set */
	93	};
	94
	95	enum ip_conntrack_expect_events {
	96	IPEXP_NEW, /* new expectation */
	97	};
	98
9fb9cbb1	99	#ifdef __KERNEL__
d94d9fee	100	struct ip_conntrack_stat {
9fb9cbb1 YK	101	unsigned int searched;
	102	unsigned int found;
	103	unsigned int new;
	104	unsigned int invalid;
	105	unsigned int ignore;
	106	unsigned int delete;
	107	unsigned int delete_list;
	108	unsigned int insert;
	109	unsigned int insert_failed;
	110	unsigned int drop;
	111	unsigned int early_drop;
	112	unsigned int error;
	113	unsigned int expect_new;
	114	unsigned int expect_create;
	115	unsigned int expect_delete;
	116	};
	117
2e4e6a17 HW	118	/* call to create an explicit dependency on nf_conntrack. */
	119	extern void need_conntrack(void);
	120
9fb9cbb1 YK	121	#endif /* __KERNEL__ */
	122
	123	#endif /* _NF_CONNTRACK_COMMON_H */