libnetfilter_conntrack  1.0.9
libnetfilter_conntrack.h
1 /*
2  * (C) 2005-2011 by Pablo Neira Ayuso <pablo@netfilter.org>
3  *
4  * This program is free software; you can redistribute it and/or modify it
5  * under the terms of the GNU General Public License as published by
6  * the Free Software Foundation; either version 2 of the License, or
7  * (at your option) any later version.
8  */
9 
10 #ifndef _LIBNETFILTER_CONNTRACK_H_
11 #define _LIBNETFILTER_CONNTRACK_H_
12 
13 #include <stdbool.h>
14 #include <netinet/in.h>
15 #include <libnfnetlink/linux_nfnetlink.h>
16 #include <libnfnetlink/libnfnetlink.h>
17 #include <libnetfilter_conntrack/linux_nfnetlink_conntrack.h>
18 #include <libnetfilter_conntrack/linux_nf_conntrack_common.h>
19 
20 #ifdef __cplusplus
21 extern "C" {
22 #endif
23 
24 enum {
25  CONNTRACK = NFNL_SUBSYS_CTNETLINK,
26  EXPECT = NFNL_SUBSYS_CTNETLINK_EXP
27 };
28 
29 /*
30  * Subscribe to all possible conntrack event groups. Use this
31  * flag in case that you want to catch up all the possible
32  * events. Do not use this flag for dumping or any other
33  * similar operation.
34  */
35 #define NFCT_ALL_CT_GROUPS (NF_NETLINK_CONNTRACK_NEW|NF_NETLINK_CONNTRACK_UPDATE|NF_NETLINK_CONNTRACK_DESTROY)
36 
37 struct nfct_handle;
38 
39 /*
40  * [Open|close] a conntrack handler
41  */
42 extern struct nfct_handle *nfct_open(uint8_t, unsigned);
43 extern struct nfct_handle *nfct_open_nfnl(struct nfnl_handle *nfnlh,
44  uint8_t subsys_id,
45  unsigned int subscriptions);
46 extern int nfct_close(struct nfct_handle *cth);
47 
48 extern int nfct_fd(struct nfct_handle *cth);
49 extern const struct nfnl_handle *nfct_nfnlh(struct nfct_handle *cth);
50 
51 /*
52  * NEW libnetfilter_conntrack API
53  */
54 
55 /* high level API */
56 
57 #include <sys/types.h>
58 
59 /* conntrack object */
60 struct nf_conntrack;
61 
62 /* conntrack attributes */
63 enum nf_conntrack_attr {
64  ATTR_ORIG_IPV4_SRC = 0, /* u32 bits */
65  ATTR_IPV4_SRC = ATTR_ORIG_IPV4_SRC, /* alias */
66  ATTR_ORIG_IPV4_DST, /* u32 bits */
67  ATTR_IPV4_DST = ATTR_ORIG_IPV4_DST, /* alias */
68  ATTR_REPL_IPV4_SRC, /* u32 bits */
69  ATTR_REPL_IPV4_DST, /* u32 bits */
70  ATTR_ORIG_IPV6_SRC = 4, /* u128 bits */
71  ATTR_IPV6_SRC = ATTR_ORIG_IPV6_SRC, /* alias */
72  ATTR_ORIG_IPV6_DST, /* u128 bits */
73  ATTR_IPV6_DST = ATTR_ORIG_IPV6_DST, /* alias */
74  ATTR_REPL_IPV6_SRC, /* u128 bits */
75  ATTR_REPL_IPV6_DST, /* u128 bits */
76  ATTR_ORIG_PORT_SRC = 8, /* u16 bits */
77  ATTR_PORT_SRC = ATTR_ORIG_PORT_SRC, /* alias */
78  ATTR_ORIG_PORT_DST, /* u16 bits */
79  ATTR_PORT_DST = ATTR_ORIG_PORT_DST, /* alias */
80  ATTR_REPL_PORT_SRC, /* u16 bits */
81  ATTR_REPL_PORT_DST, /* u16 bits */
82  ATTR_ICMP_TYPE = 12, /* u8 bits */
83  ATTR_ICMP_CODE, /* u8 bits */
84  ATTR_ICMP_ID, /* u16 bits */
85  ATTR_ORIG_L3PROTO, /* u8 bits */
86  ATTR_L3PROTO = ATTR_ORIG_L3PROTO, /* alias */
87  ATTR_REPL_L3PROTO = 16, /* u8 bits */
88  ATTR_ORIG_L4PROTO, /* u8 bits */
89  ATTR_L4PROTO = ATTR_ORIG_L4PROTO, /* alias */
90  ATTR_REPL_L4PROTO, /* u8 bits */
91  ATTR_TCP_STATE, /* u8 bits */
92  ATTR_SNAT_IPV4 = 20, /* u32 bits */
93  ATTR_DNAT_IPV4, /* u32 bits */
94  ATTR_SNAT_PORT, /* u16 bits */
95  ATTR_DNAT_PORT, /* u16 bits */
96  ATTR_TIMEOUT = 24, /* u32 bits */
97  ATTR_MARK, /* u32 bits */
98  ATTR_ORIG_COUNTER_PACKETS, /* u64 bits */
99  ATTR_REPL_COUNTER_PACKETS, /* u64 bits */
100  ATTR_ORIG_COUNTER_BYTES = 28, /* u64 bits */
101  ATTR_REPL_COUNTER_BYTES, /* u64 bits */
102  ATTR_USE, /* u32 bits */
103  ATTR_ID, /* u32 bits */
104  ATTR_STATUS = 32, /* u32 bits */
105  ATTR_TCP_FLAGS_ORIG, /* u8 bits */
106  ATTR_TCP_FLAGS_REPL, /* u8 bits */
107  ATTR_TCP_MASK_ORIG, /* u8 bits */
108  ATTR_TCP_MASK_REPL = 36, /* u8 bits */
109  ATTR_MASTER_IPV4_SRC, /* u32 bits */
110  ATTR_MASTER_IPV4_DST, /* u32 bits */
111  ATTR_MASTER_IPV6_SRC, /* u128 bits */
112  ATTR_MASTER_IPV6_DST = 40, /* u128 bits */
113  ATTR_MASTER_PORT_SRC, /* u16 bits */
114  ATTR_MASTER_PORT_DST, /* u16 bits */
115  ATTR_MASTER_L3PROTO, /* u8 bits */
116  ATTR_MASTER_L4PROTO = 44, /* u8 bits */
117  ATTR_SECMARK, /* u32 bits */
118  ATTR_ORIG_NAT_SEQ_CORRECTION_POS, /* u32 bits */
119  ATTR_ORIG_NAT_SEQ_OFFSET_BEFORE, /* u32 bits */
120  ATTR_ORIG_NAT_SEQ_OFFSET_AFTER = 48, /* u32 bits */
121  ATTR_REPL_NAT_SEQ_CORRECTION_POS, /* u32 bits */
122  ATTR_REPL_NAT_SEQ_OFFSET_BEFORE, /* u32 bits */
123  ATTR_REPL_NAT_SEQ_OFFSET_AFTER, /* u32 bits */
124  ATTR_SCTP_STATE = 52, /* u8 bits */
125  ATTR_SCTP_VTAG_ORIG, /* u32 bits */
126  ATTR_SCTP_VTAG_REPL, /* u32 bits */
127  ATTR_HELPER_NAME, /* string (30 bytes max) */
128  ATTR_DCCP_STATE = 56, /* u8 bits */
129  ATTR_DCCP_ROLE, /* u8 bits */
130  ATTR_DCCP_HANDSHAKE_SEQ, /* u64 bits */
131  ATTR_TCP_WSCALE_ORIG, /* u8 bits */
132  ATTR_TCP_WSCALE_REPL = 60, /* u8 bits */
133  ATTR_ZONE, /* u16 bits */
134  ATTR_SECCTX, /* string */
135  ATTR_TIMESTAMP_START, /* u64 bits, linux >= 2.6.38 */
136  ATTR_TIMESTAMP_STOP = 64, /* u64 bits, linux >= 2.6.38 */
137  ATTR_HELPER_INFO, /* variable length */
138  ATTR_CONNLABELS, /* variable length */
139  ATTR_CONNLABELS_MASK, /* variable length */
140  ATTR_ORIG_ZONE = 68, /* u16 bits */
141  ATTR_REPL_ZONE, /* u16 bits */
142  ATTR_SNAT_IPV6, /* u128 bits */
143  ATTR_DNAT_IPV6, /* u128 bits */
144  ATTR_SYNPROXY_ISN = 72, /* u32 bits */
145  ATTR_SYNPROXY_ITS, /* u32 bits */
146  ATTR_SYNPROXY_TSOFF, /* u32 bits */
147  ATTR_MAX
148 };
149 
150 /* conntrack attribute groups */
151 enum nf_conntrack_attr_grp {
152  ATTR_GRP_ORIG_IPV4 = 0, /* struct nfct_attr_grp_ipv4 */
153  ATTR_GRP_REPL_IPV4, /* struct nfct_attr_grp_ipv4 */
154  ATTR_GRP_ORIG_IPV6, /* struct nfct_attr_grp_ipv6 */
155  ATTR_GRP_REPL_IPV6, /* struct nfct_attr_grp_ipv6 */
156  ATTR_GRP_ORIG_PORT = 4, /* struct nfct_attr_grp_port */
157  ATTR_GRP_REPL_PORT, /* struct nfct_attr_grp_port */
158  ATTR_GRP_ICMP, /* struct nfct_attr_grp_icmp */
159  ATTR_GRP_MASTER_IPV4, /* struct nfct_attr_grp_ipv4 */
160  ATTR_GRP_MASTER_IPV6 = 8, /* struct nfct_attr_grp_ipv6 */
161  ATTR_GRP_MASTER_PORT, /* struct nfct_attr_grp_port */
162  ATTR_GRP_ORIG_COUNTERS, /* struct nfct_attr_grp_ctrs */
163  ATTR_GRP_REPL_COUNTERS, /* struct nfct_attr_grp_ctrs */
164  ATTR_GRP_ORIG_ADDR_SRC = 12, /* union nfct_attr_grp_addr */
165  ATTR_GRP_ORIG_ADDR_DST, /* union nfct_attr_grp_addr */
166  ATTR_GRP_REPL_ADDR_SRC, /* union nfct_attr_grp_addr */
167  ATTR_GRP_REPL_ADDR_DST, /* union nfct_attr_grp_addr */
168  ATTR_GRP_MAX
169 };
170 
172  uint32_t src, dst;
173 };
174 
176  uint32_t src[4], dst[4];
177 };
178 
180  uint16_t sport, dport;
181 };
182 
184  uint16_t id;
185  uint8_t code, type;
186 };
187 
189  uint64_t packets;
190  uint64_t bytes;
191 };
192 
194  uint32_t ip;
195  uint32_t ip6[4];
196  uint32_t addr[4];
197 };
198 
199 /* message type */
200 enum nf_conntrack_msg_type {
201  NFCT_T_UNKNOWN = 0,
202 
203  NFCT_T_NEW_BIT = 0,
204  NFCT_T_NEW = (1 << NFCT_T_NEW_BIT),
205 
206  NFCT_T_UPDATE_BIT = 1,
207  NFCT_T_UPDATE = (1 << NFCT_T_UPDATE_BIT),
208 
209  NFCT_T_DESTROY_BIT = 2,
210  NFCT_T_DESTROY = (1 << NFCT_T_DESTROY_BIT),
211 
212  NFCT_T_ALL = NFCT_T_NEW | NFCT_T_UPDATE | NFCT_T_DESTROY,
213 
214  NFCT_T_ERROR_BIT = 31,
215  NFCT_T_ERROR = (1 << NFCT_T_ERROR_BIT),
216 };
217 
218 /* constructor / destructor */
219 extern struct nf_conntrack *nfct_new(void);
220 extern void nfct_destroy(struct nf_conntrack *ct);
221 
222 /* clone */
223 struct nf_conntrack *nfct_clone(const struct nf_conntrack *ct);
224 
225 /* object size */
226 extern __attribute__((deprecated)) size_t nfct_sizeof(const struct nf_conntrack *ct);
227 
228 /* maximum object size */
229 extern __attribute__((deprecated)) size_t nfct_maxsize(void);
230 
231 /* set option */
232 enum {
233  NFCT_SOPT_UNDO_SNAT,
234  NFCT_SOPT_UNDO_DNAT,
235  NFCT_SOPT_UNDO_SPAT,
236  NFCT_SOPT_UNDO_DPAT,
237  NFCT_SOPT_SETUP_ORIGINAL,
238  NFCT_SOPT_SETUP_REPLY,
239  __NFCT_SOPT_MAX,
240 };
241 #define NFCT_SOPT_MAX (__NFCT_SOPT_MAX - 1)
242 
243 /* get option */
244 enum {
245  NFCT_GOPT_IS_SNAT,
246  NFCT_GOPT_IS_DNAT,
247  NFCT_GOPT_IS_SPAT,
248  NFCT_GOPT_IS_DPAT,
249  __NFCT_GOPT_MAX,
250 };
251 #define NFCT_GOPT_MAX (__NFCT_GOPT_MAX - 1)
252 
253 extern int nfct_setobjopt(struct nf_conntrack *ct, unsigned int option);
254 extern int nfct_getobjopt(const struct nf_conntrack *ct, unsigned int option);
255 
256 /* register / unregister callback */
257 
258 extern int nfct_callback_register(struct nfct_handle *h,
259  enum nf_conntrack_msg_type type,
260  int (*cb)(enum nf_conntrack_msg_type type,
261  struct nf_conntrack *ct,
262  void *data),
263  void *data);
264 
265 extern void nfct_callback_unregister(struct nfct_handle *h);
266 
267 /* register / unregister callback: extended version including netlink header */
268 
269 extern int nfct_callback_register2(struct nfct_handle *h,
270  enum nf_conntrack_msg_type type,
271  int (*cb)(const struct nlmsghdr *nlh,
272  enum nf_conntrack_msg_type type,
273  struct nf_conntrack *ct,
274  void *data),
275  void *data);
276 
277 extern void nfct_callback_unregister2(struct nfct_handle *h);
278 
279 /* callback verdict */
280 enum {
281  NFCT_CB_FAILURE = -1, /* failure */
282  NFCT_CB_STOP = 0, /* stop the query */
283  NFCT_CB_CONTINUE = 1, /* keep iterating through data */
284  NFCT_CB_STOLEN = 2, /* like continue, but ct is not freed */
285 };
286 
287 /* bitmask setter/getter */
288 struct nfct_bitmask;
289 
290 struct nfct_bitmask *nfct_bitmask_new(unsigned int maxbit);
291 struct nfct_bitmask *nfct_bitmask_clone(const struct nfct_bitmask *);
292 unsigned int nfct_bitmask_maxbit(const struct nfct_bitmask *);
293 
294 void nfct_bitmask_set_bit(struct nfct_bitmask *, unsigned int bit);
295 int nfct_bitmask_test_bit(const struct nfct_bitmask *, unsigned int bit);
296 void nfct_bitmask_unset_bit(struct nfct_bitmask *, unsigned int bit);
297 void nfct_bitmask_destroy(struct nfct_bitmask *);
298 void nfct_bitmask_clear(struct nfct_bitmask *);
299 bool nfct_bitmask_equal(const struct nfct_bitmask *, const struct nfct_bitmask *);
300 
301 /* connlabel name <-> bit translation mapping */
302 struct nfct_labelmap;
303 
304 const char *nfct_labels_get_path(void);
305 struct nfct_labelmap *nfct_labelmap_new(const char *mapfile);
306 void nfct_labelmap_destroy(struct nfct_labelmap *map);
307 const char *nfct_labelmap_get_name(struct nfct_labelmap *m, unsigned int bit);
308 int nfct_labelmap_get_bit(struct nfct_labelmap *m, const char *name);
309 
310 /* setter */
311 extern void nfct_set_attr(struct nf_conntrack *ct,
312  const enum nf_conntrack_attr type,
313  const void *value);
314 
315 extern void nfct_set_attr_u8(struct nf_conntrack *ct,
316  const enum nf_conntrack_attr type,
317  uint8_t value);
318 
319 extern void nfct_set_attr_u16(struct nf_conntrack *ct,
320  const enum nf_conntrack_attr type,
321  uint16_t value);
322 
323 extern void nfct_set_attr_u32(struct nf_conntrack *ct,
324  const enum nf_conntrack_attr type,
325  uint32_t value);
326 
327 extern void nfct_set_attr_u64(struct nf_conntrack *ct,
328  const enum nf_conntrack_attr type,
329  uint64_t value);
330 
331 extern void nfct_set_attr_l(struct nf_conntrack *ct,
332  const enum nf_conntrack_attr type,
333  const void *value,
334  size_t len);
335 
336 /* getter */
337 extern const void *nfct_get_attr(const struct nf_conntrack *ct,
338  const enum nf_conntrack_attr type);
339 
340 extern uint8_t nfct_get_attr_u8(const struct nf_conntrack *ct,
341  const enum nf_conntrack_attr type);
342 
343 extern uint16_t nfct_get_attr_u16(const struct nf_conntrack *ct,
344  const enum nf_conntrack_attr type);
345 
346 extern uint32_t nfct_get_attr_u32(const struct nf_conntrack *ct,
347  const enum nf_conntrack_attr type);
348 
349 extern uint64_t nfct_get_attr_u64(const struct nf_conntrack *ct,
350  const enum nf_conntrack_attr type);
351 
352 /* checker */
353 extern int nfct_attr_is_set(const struct nf_conntrack *ct,
354  const enum nf_conntrack_attr type);
355 
356 extern int nfct_attr_is_set_array(const struct nf_conntrack *ct,
357  const enum nf_conntrack_attr *type_array,
358  int size);
359 
360 /* unsetter */
361 extern int nfct_attr_unset(struct nf_conntrack *ct,
362  const enum nf_conntrack_attr type);
363 
364 /* group setter */
365 extern void nfct_set_attr_grp(struct nf_conntrack *ct,
366  const enum nf_conntrack_attr_grp type,
367  const void *value);
368 /* group getter */
369 extern int nfct_get_attr_grp(const struct nf_conntrack *ct,
370  const enum nf_conntrack_attr_grp type,
371  void *data);
372 
373 /* group checker */
374 extern int nfct_attr_grp_is_set(const struct nf_conntrack *ct,
375  const enum nf_conntrack_attr_grp type);
376 
377 /* unsetter */
378 extern int nfct_attr_grp_unset(struct nf_conntrack *ct,
379  const enum nf_conntrack_attr_grp type);
380 
381 /* print */
382 
383 /* output type */
384 enum {
385  NFCT_O_PLAIN,
386  NFCT_O_DEFAULT = NFCT_O_PLAIN,
387  NFCT_O_XML,
388  NFCT_O_MAX
389 };
390 
391 /* output flags */
392 enum {
393  NFCT_OF_SHOW_LAYER3_BIT = 0,
394  NFCT_OF_SHOW_LAYER3 = (1 << NFCT_OF_SHOW_LAYER3_BIT),
395 
396  NFCT_OF_TIME_BIT = 1,
397  NFCT_OF_TIME = (1 << NFCT_OF_TIME_BIT),
398 
399  NFCT_OF_ID_BIT = 2,
400  NFCT_OF_ID = (1 << NFCT_OF_ID_BIT),
401 
402  NFCT_OF_TIMESTAMP_BIT = 3,
403  NFCT_OF_TIMESTAMP = (1 << NFCT_OF_TIMESTAMP_BIT),
404 };
405 
406 extern int nfct_snprintf(char *buf,
407  unsigned int size,
408  const struct nf_conntrack *ct,
409  const unsigned int msg_type,
410  const unsigned int out_type,
411  const unsigned int out_flags);
412 
413 extern int nfct_snprintf_labels(char *buf,
414  unsigned int size,
415  const struct nf_conntrack *ct,
416  const unsigned int msg_type,
417  const unsigned int out_type,
418  const unsigned int out_flags,
419  struct nfct_labelmap *map);
420 
421 /* comparison */
422 extern int nfct_compare(const struct nf_conntrack *ct1,
423  const struct nf_conntrack *ct2);
424 
425 enum {
426  NFCT_CMP_ALL = 0,
427  NFCT_CMP_ORIG = (1 << 0),
428  NFCT_CMP_REPL = (1 << 1),
429  NFCT_CMP_TIMEOUT_EQ = (1 << 2),
430  NFCT_CMP_TIMEOUT_GT = (1 << 3),
431  NFCT_CMP_TIMEOUT_GE = (NFCT_CMP_TIMEOUT_EQ | NFCT_CMP_TIMEOUT_GT),
432  NFCT_CMP_TIMEOUT_LT = (1 << 4),
433  NFCT_CMP_TIMEOUT_LE = (NFCT_CMP_TIMEOUT_EQ | NFCT_CMP_TIMEOUT_LT),
434  NFCT_CMP_MASK = (1 << 5),
435  NFCT_CMP_STRICT = (1 << 6),
436 };
437 
438 extern int nfct_cmp(const struct nf_conntrack *ct1,
439  const struct nf_conntrack *ct2,
440  unsigned int flags);
441 
442 
443 /* query */
444 enum nf_conntrack_query {
445  NFCT_Q_CREATE,
446  NFCT_Q_UPDATE,
447  NFCT_Q_DESTROY,
448  NFCT_Q_GET,
449  NFCT_Q_FLUSH,
450  NFCT_Q_DUMP,
451  NFCT_Q_DUMP_RESET,
452  NFCT_Q_CREATE_UPDATE,
453  NFCT_Q_DUMP_FILTER,
454  NFCT_Q_DUMP_FILTER_RESET,
455  NFCT_Q_FLUSH_FILTER,
456 };
457 
458 extern int nfct_query(struct nfct_handle *h,
459  const enum nf_conntrack_query query,
460  const void *data);
461 
462 extern int nfct_send(struct nfct_handle *h,
463  const enum nf_conntrack_query query,
464  const void *data);
465 
466 extern int nfct_catch(struct nfct_handle *h);
467 
468 /* copy */
469 enum {
470  NFCT_CP_ALL = 0,
471  NFCT_CP_ORIG = (1 << 0),
472  NFCT_CP_REPL = (1 << 1),
473  NFCT_CP_META = (1 << 2),
474  NFCT_CP_OVERRIDE = (1 << 3),
475 };
476 
477 extern void nfct_copy(struct nf_conntrack *dest,
478  const struct nf_conntrack *source,
479  unsigned int flags);
480 
481 extern void nfct_copy_attr(struct nf_conntrack *ct1,
482  const struct nf_conntrack *ct2,
483  const enum nf_conntrack_attr type);
484 
485 /* event filtering */
486 
487 struct nfct_filter;
488 
489 extern struct nfct_filter *nfct_filter_create(void);
490 extern void nfct_filter_destroy(struct nfct_filter *filter);
491 
493  uint16_t proto;
494  uint16_t state;
495 };
497  uint32_t addr;
498  uint32_t mask;
499 };
501  uint32_t addr[4];
502  uint32_t mask[4];
503 };
504 
505 enum nfct_filter_attr {
506  NFCT_FILTER_L4PROTO = 0, /* uint32_t */
507  NFCT_FILTER_L4PROTO_STATE, /* struct nfct_filter_proto */
508  NFCT_FILTER_SRC_IPV4, /* struct nfct_filter_ipv4 */
509  NFCT_FILTER_DST_IPV4, /* struct nfct_filter_ipv4 */
510  NFCT_FILTER_SRC_IPV6, /* struct nfct_filter_ipv6 */
511  NFCT_FILTER_DST_IPV6, /* struct nfct_filter_ipv6 */
512  NFCT_FILTER_MARK, /* struct nfct_filter_dump_mark */
513  NFCT_FILTER_MAX
514 };
515 
516 extern void nfct_filter_add_attr(struct nfct_filter *filter,
517  const enum nfct_filter_attr attr,
518  const void *value);
519 
520 extern void nfct_filter_add_attr_u32(struct nfct_filter *filter,
521  const enum nfct_filter_attr attr,
522  const uint32_t value);
523 
524 enum nfct_filter_logic {
525  NFCT_FILTER_LOGIC_POSITIVE,
526  NFCT_FILTER_LOGIC_NEGATIVE,
527  NFCT_FILTER_LOGIC_MAX
528 };
529 
530 extern int nfct_filter_set_logic(struct nfct_filter *filter,
531  const enum nfct_filter_attr attr,
532  const enum nfct_filter_logic logic);
533 
534 extern int nfct_filter_attach(int fd, struct nfct_filter *filter);
535 extern int nfct_filter_detach(int fd);
536 
537 /* dump filtering */
538 
539 struct nfct_filter_dump;
540 
542  uint32_t val;
543  uint32_t mask;
544 };
545 
546 enum nfct_filter_dump_attr {
547  NFCT_FILTER_DUMP_MARK = 0, /* struct nfct_filter_dump_mark */
548  NFCT_FILTER_DUMP_L3NUM, /* uint8_t */
549  NFCT_FILTER_DUMP_STATUS, /* struct nfct_filter_dump_mark */
550  NFCT_FILTER_DUMP_MAX
551 };
552 
553 struct nfct_filter_dump *nfct_filter_dump_create(void);
554 
555 void nfct_filter_dump_destroy(struct nfct_filter_dump *filter);
556 
557 void nfct_filter_dump_set_attr(struct nfct_filter_dump *filter_dump,
558  const enum nfct_filter_dump_attr type,
559  const void *data);
560 
561 void nfct_filter_dump_set_attr_u8(struct nfct_filter_dump *filter_dump,
562  const enum nfct_filter_dump_attr type,
563  uint8_t data);
564 
565 /* low level API: netlink functions */
566 
567 extern __attribute__((deprecated)) int
568 nfct_build_conntrack(struct nfnl_subsys_handle *ssh,
569  void *req,
570  size_t size,
571  uint16_t type,
572  uint16_t flags,
573  const struct nf_conntrack *ct);
574 
575 extern __attribute__((deprecated))
576 int nfct_parse_conntrack(enum nf_conntrack_msg_type msg,
577  const struct nlmsghdr *nlh,
578  struct nf_conntrack *ct);
579 
580 extern __attribute__((deprecated))
581 int nfct_build_query(struct nfnl_subsys_handle *ssh,
582  const enum nf_conntrack_query query,
583  const void *data,
584  void *req,
585  unsigned int size);
586 
587 /* New low level API: netlink functions */
588 
589 extern int nfct_nlmsg_build(struct nlmsghdr *nlh, const struct nf_conntrack *ct);
590 extern int nfct_nlmsg_build_filter(struct nlmsghdr *nlh, const struct nfct_filter_dump *filter_dump);
591 extern int nfct_nlmsg_parse(const struct nlmsghdr *nlh, struct nf_conntrack *ct);
592 extern int nfct_payload_parse(const void *payload, size_t payload_len, uint16_t l3num, struct nf_conntrack *ct);
593 
594 /*
595  * NEW expectation API
596  */
597 
598 /* expectation object */
599 struct nf_expect;
600 
601 /* expect attributes */
602 enum nf_expect_attr {
603  ATTR_EXP_MASTER = 0, /* pointer to conntrack object */
604  ATTR_EXP_EXPECTED, /* pointer to conntrack object */
605  ATTR_EXP_MASK, /* pointer to conntrack object */
606  ATTR_EXP_TIMEOUT, /* u32 bits */
607  ATTR_EXP_ZONE, /* u16 bits */
608  ATTR_EXP_FLAGS, /* u32 bits */
609  ATTR_EXP_HELPER_NAME, /* string (16 bytes max) */
610  ATTR_EXP_CLASS, /* u32 bits */
611  ATTR_EXP_NAT_TUPLE, /* pointer to conntrack object */
612  ATTR_EXP_NAT_DIR, /* u8 bits */
613  ATTR_EXP_FN, /* string */
614  ATTR_EXP_MAX
615 };
616 
617 /* constructor / destructor */
618 extern struct nf_expect *nfexp_new(void);
619 extern void nfexp_destroy(struct nf_expect *exp);
620 
621 /* clone */
622 extern struct nf_expect *nfexp_clone(const struct nf_expect *exp);
623 
624 /* object size */
625 extern size_t nfexp_sizeof(const struct nf_expect *exp);
626 
627 /* maximum object size */
628 extern size_t nfexp_maxsize(void);
629 
630 /* register / unregister callback */
631 
632 extern int nfexp_callback_register(struct nfct_handle *h,
633  enum nf_conntrack_msg_type type,
634  int (*cb)(enum nf_conntrack_msg_type type,
635  struct nf_expect *exp,
636  void *data),
637  void *data);
638 
639 extern void nfexp_callback_unregister(struct nfct_handle *h);
640 
641 /* register / unregister callback: extended version including netlink header */
642 extern int nfexp_callback_register2(struct nfct_handle *h,
643  enum nf_conntrack_msg_type type,
644  int (*cb)(const struct nlmsghdr *nlh,
645  enum nf_conntrack_msg_type type,
646  struct nf_expect *exp,
647  void *data),
648  void *data);
649 
650 extern void nfexp_callback_unregister2(struct nfct_handle *h);
651 
652 /* setter */
653 extern void nfexp_set_attr(struct nf_expect *exp,
654  const enum nf_expect_attr type,
655  const void *value);
656 
657 extern void nfexp_set_attr_u8(struct nf_expect *exp,
658  const enum nf_expect_attr type,
659  uint8_t value);
660 
661 extern void nfexp_set_attr_u16(struct nf_expect *exp,
662  const enum nf_expect_attr type,
663  uint16_t value);
664 
665 extern void nfexp_set_attr_u32(struct nf_expect *exp,
666  const enum nf_expect_attr type,
667  uint32_t value);
668 
669 /* getter */
670 extern const void *nfexp_get_attr(const struct nf_expect *exp,
671  const enum nf_expect_attr type);
672 
673 extern uint8_t nfexp_get_attr_u8(const struct nf_expect *exp,
674  const enum nf_expect_attr type);
675 
676 extern uint16_t nfexp_get_attr_u16(const struct nf_expect *exp,
677  const enum nf_expect_attr type);
678 
679 extern uint32_t nfexp_get_attr_u32(const struct nf_expect *exp,
680  const enum nf_expect_attr type);
681 
682 /* checker */
683 extern int nfexp_attr_is_set(const struct nf_expect *exp,
684  const enum nf_expect_attr type);
685 
686 /* unsetter */
687 extern int nfexp_attr_unset(struct nf_expect *exp,
688  const enum nf_expect_attr type);
689 
690 /* query */
691 extern int nfexp_query(struct nfct_handle *h,
692  const enum nf_conntrack_query qt,
693  const void *data);
694 
695 /* print */
696 extern int nfexp_snprintf(char *buf,
697  unsigned int size,
698  const struct nf_expect *exp,
699  const unsigned int msg_type,
700  const unsigned int out_type,
701  const unsigned int out_flags);
702 
703 /* compare */
704 extern int nfexp_cmp(const struct nf_expect *exp1,
705  const struct nf_expect *exp2,
706  unsigned int flags);
707 
708 extern int nfexp_send(struct nfct_handle *h,
709  const enum nf_conntrack_query qt,
710  const void *data);
711 
712 extern int nfexp_catch(struct nfct_handle *h);
713 
714 /* low level API */
715 extern __attribute__((deprecated))
716 int nfexp_build_expect(struct nfnl_subsys_handle *ssh,
717  void *req,
718  size_t size,
719  uint16_t type,
720  uint16_t flags,
721  const struct nf_expect *exp);
722 
723 extern __attribute__((deprecated))
724 int nfexp_parse_expect(enum nf_conntrack_msg_type type,
725  const struct nlmsghdr *nlh,
726  struct nf_expect *exp);
727 
728 extern __attribute__((deprecated))
729 int nfexp_build_query(struct nfnl_subsys_handle *ssh,
730  const enum nf_conntrack_query qt,
731  const void *data,
732  void *buffer,
733  unsigned int size);
734 
735 /* New low level API: netlink functions */
736 
737 extern int nfexp_nlmsg_build(struct nlmsghdr *nlh, const struct nf_expect *exp);
738 extern int nfexp_nlmsg_parse(const struct nlmsghdr *nlh, struct nf_expect *exp);
739 
740 /*
741  * TCP flags
742  */
743 
744 /* Window scaling is advertised by the sender */
745 #define IP_CT_TCP_FLAG_WINDOW_SCALE 0x01
746 
747 /* SACK is permitted by the sender */
748 #define IP_CT_TCP_FLAG_SACK_PERM 0x02
749 
750 /* This sender sent FIN first */
751 #define IP_CT_TCP_FLAG_CLOSE_INIT 0x04
752 
753 /* Be liberal in window checking */
754 #define IP_CT_TCP_FLAG_BE_LIBERAL 0x08
755 
756 /* WARNING: do not use these constants in new applications, we keep them here
757  * to avoid breaking backward compatibility. */
758 #define NFCT_DIR_ORIGINAL 0
759 #define NFCT_DIR_REPLY 1
760 #define NFCT_DIR_MAX NFCT_DIR_REPLY+1
761 
762 /* xt_helper uses a length size of 30 bytes, however, no helper name in
763  * the tree has exceeded 16 bytes length. Since 2.6.29, the maximum
764  * length accepted is 16 bytes, this limit is enforced during module load. */
765 #define NFCT_HELPER_NAME_MAX 16
766 
767 #ifdef __cplusplus
768 }
769 #endif
770 
771 #endif /* _LIBNETFILTER_CONNTRACK_H_ */
void nfexp_callback_unregister(struct nfct_handle *h)
Definition: expect/api.c:198
void nfexp_callback_unregister2(struct nfct_handle *h)
Definition: expect/api.c:273
int nfct_callback_register(struct nfct_handle *h, enum nf_conntrack_msg_type type, int(*cb)(enum nf_conntrack_msg_type type, struct nf_conntrack *ct, void *data), void *data)
int nfexp_callback_register2(struct nfct_handle *h, enum nf_conntrack_msg_type type, int(*cb)(const struct nlmsghdr *nlh, enum nf_conntrack_msg_type type, struct nf_expect *exp, void *data), void *data)
Definition: expect/api.c:232
void nfct_callback_unregister2(struct nfct_handle *h)
int nfct_close(struct nfct_handle *cth)
Definition: main.c:105
void nfct_callback_unregister(struct nfct_handle *h)
struct nfct_handle * nfct_open(uint8_t, unsigned)
Definition: main.c:84
int nfct_callback_register2(struct nfct_handle *h, enum nf_conntrack_msg_type type, int(*cb)(const struct nlmsghdr *nlh, enum nf_conntrack_msg_type type, struct nf_conntrack *ct, void *data), void *data)
int nfexp_callback_register(struct nfct_handle *h, enum nf_conntrack_msg_type type, int(*cb)(enum nf_conntrack_msg_type type, struct nf_expect *exp, void *data), void *data)
Definition: expect/api.c:158
int nfct_fd(struct nfct_handle *cth)
Definition: main.c:144
void nfct_filter_destroy(struct nfct_filter *filter)
int nfct_filter_detach(int fd)
int nfct_filter_set_logic(struct nfct_filter *filter, const enum nfct_filter_attr attr, const enum nfct_filter_logic logic)
int nfct_filter_attach(int fd, struct nfct_filter *filter)
void nfct_filter_add_attr_u32(struct nfct_filter *filter, const enum nfct_filter_attr attr, const uint32_t value)
void nfct_filter_add_attr(struct nfct_filter *filter, const enum nfct_filter_attr attr, const void *value)
struct nfct_filter * nfct_filter_create(void)
int nfexp_catch(struct nfct_handle *h)
Definition: expect/api.c:760
int nfct_send(struct nfct_handle *h, const enum nf_conntrack_query query, const void *data)
int nfct_catch(struct nfct_handle *h)
int nfexp_send(struct nfct_handle *h, const enum nf_conntrack_query qt, const void *data)
Definition: expect/api.c:727
int nfexp_query(struct nfct_handle *h, const enum nf_conntrack_query qt, const void *data)
Definition: expect/api.c:695
int nfct_query(struct nfct_handle *h, const enum nf_conntrack_query query, const void *data)
size_t nfct_sizeof(const struct nf_conntrack *ct)
int nfct_snprintf_labels(char *buf, unsigned int size, const struct nf_conntrack *ct, const unsigned int msg_type, const unsigned int out_type, const unsigned int out_flags, struct nfct_labelmap *map)
void nfct_set_attr_u32(struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint32_t value)
void nfct_destroy(struct nf_conntrack *ct)
Definition: conntrack/api.c:93
void nfct_copy_attr(struct nf_conntrack *ct1, const struct nf_conntrack *ct2, const enum nf_conntrack_attr type)
const void * nfct_get_attr(const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
struct nf_conntrack * nfct_new(void)
Definition: conntrack/api.c:76
void nfct_set_attr(struct nf_conntrack *ct, const enum nf_conntrack_attr type, const void *value)
int nfct_attr_grp_unset(struct nf_conntrack *ct, const enum nf_conntrack_attr_grp type)
uint64_t nfct_get_attr_u64(const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
int nfct_setobjopt(struct nf_conntrack *ct, unsigned int option)
int nfct_get_attr_grp(const struct nf_conntrack *ct, const enum nf_conntrack_attr_grp type, void *data)
void nfct_set_attr_grp(struct nf_conntrack *ct, const enum nf_conntrack_attr_grp type, const void *value)
int nfct_attr_is_set_array(const struct nf_conntrack *ct, const enum nf_conntrack_attr *type_array, int size)
int nfct_attr_unset(struct nf_conntrack *ct, const enum nf_conntrack_attr type)
void nfct_copy(struct nf_conntrack *dest, const struct nf_conntrack *source, unsigned int flags)
uint16_t nfct_get_attr_u16(const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
int nfct_attr_grp_is_set(const struct nf_conntrack *ct, const enum nf_conntrack_attr_grp type)
int nfct_cmp(const struct nf_conntrack *ct1, const struct nf_conntrack *ct2, unsigned int flags)
struct nf_conntrack * nfct_clone(const struct nf_conntrack *ct)
void nfct_set_attr_u16(struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint16_t value)
uint32_t nfct_get_attr_u32(const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
void nfct_set_attr_u8(struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint8_t value)
void nfct_set_attr_u64(struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint64_t value)
void nfct_set_attr_l(struct nf_conntrack *ct, const enum nf_conntrack_attr type, const void *value, size_t len)
int nfct_snprintf(char *buf, unsigned int size, const struct nf_conntrack *ct, const unsigned int msg_type, const unsigned int out_type, const unsigned int out_flags)
size_t nfct_maxsize(void)
int nfct_attr_is_set(const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
int nfct_getobjopt(const struct nf_conntrack *ct, unsigned int option)
int nfct_compare(const struct nf_conntrack *ct1, const struct nf_conntrack *ct2)
uint8_t nfct_get_attr_u8(const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
void nfct_filter_dump_set_attr_u8(struct nfct_filter_dump *filter_dump, const enum nfct_filter_dump_attr type, uint8_t data)
void nfct_filter_dump_destroy(struct nfct_filter_dump *filter)
struct nfct_filter_dump * nfct_filter_dump_create(void)
void nfct_filter_dump_set_attr(struct nfct_filter_dump *filter_dump, const enum nfct_filter_dump_attr type, const void *data)
void nfexp_set_attr_u32(struct nf_expect *exp, const enum nf_expect_attr type, uint32_t value)
Definition: expect/api.c:357
struct nf_expect * nfexp_clone(const struct nf_expect *exp)
Definition: expect/api.c:89
uint32_t nfexp_get_attr_u32(const struct nf_expect *exp, const enum nf_expect_attr type)
Definition: expect/api.c:431
size_t nfexp_sizeof(const struct nf_expect *exp)
Definition: expect/api.c:57
void nfexp_set_attr_u16(struct nf_expect *exp, const enum nf_expect_attr type, uint16_t value)
Definition: expect/api.c:344
void nfexp_set_attr(struct nf_expect *exp, const enum nf_expect_attr type, const void *value)
Definition: expect/api.c:309
int nfexp_cmp(const struct nf_expect *exp1, const struct nf_expect *exp2, unsigned int flags)
Definition: expect/api.c:127
uint16_t nfexp_get_attr_u16(const struct nf_expect *exp, const enum nf_expect_attr type)
Definition: expect/api.c:415
void nfexp_set_attr_u8(struct nf_expect *exp, const enum nf_expect_attr type, uint8_t value)
Definition: expect/api.c:331
const void * nfexp_get_attr(const struct nf_expect *exp, const enum nf_expect_attr type)
Definition: expect/api.c:372
uint8_t nfexp_get_attr_u8(const struct nf_expect *exp, const enum nf_expect_attr type)
Definition: expect/api.c:399
int nfexp_snprintf(char *buf, unsigned int size, const struct nf_expect *exp, const unsigned int msg_type, const unsigned int out_type, const unsigned int out_flags)
Definition: expect/api.c:802
struct nf_expect * nfexp_new(void)
Definition: expect/api.c:29
void nfexp_destroy(struct nf_expect *exp)
Definition: expect/api.c:46
int nfexp_attr_unset(struct nf_expect *exp, const enum nf_expect_attr type)
Definition: expect/api.c:466
int nfexp_attr_is_set(const struct nf_expect *exp, const enum nf_expect_attr type)
Definition: expect/api.c:446
size_t nfexp_maxsize(void)
Definition: expect/api.c:77
const char * nfct_labelmap_get_name(struct nfct_labelmap *m, unsigned int bit)
struct nfct_labelmap * nfct_labelmap_new(const char *mapfile)
void nfct_labelmap_destroy(struct nfct_labelmap *map)
const char * nfct_labels_get_path(void)
int nfct_labelmap_get_bit(struct nfct_labelmap *m, const char *name)
int nfexp_build_query(struct nfnl_subsys_handle *ssh, const enum nf_conntrack_query qt, const void *data, void *buffer, unsigned int size)
Definition: expect/api.c:609
int nfct_parse_conntrack(enum nf_conntrack_msg_type type, const struct nlmsghdr *nlh, struct nf_conntrack *ct)
int nfexp_build_expect(struct nfnl_subsys_handle *ssh, void *req, size_t size, uint16_t type, uint16_t flags, const struct nf_expect *exp)
Definition: expect/api.c:505
int nfct_build_conntrack(struct nfnl_subsys_handle *ssh, void *req, size_t size, uint16_t type, uint16_t flags, const struct nf_conntrack *ct)
int nfexp_parse_expect(enum nf_conntrack_msg_type type, const struct nlmsghdr *nlh, struct nf_expect *exp)
Definition: expect/api.c:659
int nfct_build_query(struct nfnl_subsys_handle *ssh, const enum nf_conntrack_query qt, const void *data, void *buffer, unsigned int size)