10 #ifndef _LIBNETFILTER_CONNTRACK_H_
11 #define _LIBNETFILTER_CONNTRACK_H_
14 #include <netinet/in.h>
15 #include <libnfnetlink/linux_nfnetlink.h>
16 #include <libnfnetlink/libnfnetlink.h>
17 #include <libnetfilter_conntrack/linux_nfnetlink_conntrack.h>
18 #include <libnetfilter_conntrack/linux_nf_conntrack_common.h>
25 CONNTRACK = NFNL_SUBSYS_CTNETLINK,
26 EXPECT = NFNL_SUBSYS_CTNETLINK_EXP
35 #define NFCT_ALL_CT_GROUPS (NF_NETLINK_CONNTRACK_NEW|NF_NETLINK_CONNTRACK_UPDATE|NF_NETLINK_CONNTRACK_DESTROY)
42 extern struct nfct_handle *
nfct_open(uint8_t,
unsigned);
43 extern struct nfct_handle *nfct_open_nfnl(
struct nfnl_handle *nfnlh,
45 unsigned int subscriptions);
46 extern int nfct_close(
struct nfct_handle *cth);
48 extern int nfct_fd(
struct nfct_handle *cth);
49 extern const struct nfnl_handle *nfct_nfnlh(
struct nfct_handle *cth);
57 #include <sys/types.h>
63 enum nf_conntrack_attr {
64 ATTR_ORIG_IPV4_SRC = 0,
65 ATTR_IPV4_SRC = ATTR_ORIG_IPV4_SRC,
67 ATTR_IPV4_DST = ATTR_ORIG_IPV4_DST,
70 ATTR_ORIG_IPV6_SRC = 4,
71 ATTR_IPV6_SRC = ATTR_ORIG_IPV6_SRC,
73 ATTR_IPV6_DST = ATTR_ORIG_IPV6_DST,
76 ATTR_ORIG_PORT_SRC = 8,
77 ATTR_PORT_SRC = ATTR_ORIG_PORT_SRC,
79 ATTR_PORT_DST = ATTR_ORIG_PORT_DST,
86 ATTR_L3PROTO = ATTR_ORIG_L3PROTO,
87 ATTR_REPL_L3PROTO = 16,
89 ATTR_L4PROTO = ATTR_ORIG_L4PROTO,
98 ATTR_ORIG_COUNTER_PACKETS,
99 ATTR_REPL_COUNTER_PACKETS,
100 ATTR_ORIG_COUNTER_BYTES = 28,
101 ATTR_REPL_COUNTER_BYTES,
108 ATTR_TCP_MASK_REPL = 36,
109 ATTR_MASTER_IPV4_SRC,
110 ATTR_MASTER_IPV4_DST,
111 ATTR_MASTER_IPV6_SRC,
112 ATTR_MASTER_IPV6_DST = 40,
113 ATTR_MASTER_PORT_SRC,
114 ATTR_MASTER_PORT_DST,
116 ATTR_MASTER_L4PROTO = 44,
118 ATTR_ORIG_NAT_SEQ_CORRECTION_POS,
119 ATTR_ORIG_NAT_SEQ_OFFSET_BEFORE,
120 ATTR_ORIG_NAT_SEQ_OFFSET_AFTER = 48,
121 ATTR_REPL_NAT_SEQ_CORRECTION_POS,
122 ATTR_REPL_NAT_SEQ_OFFSET_BEFORE,
123 ATTR_REPL_NAT_SEQ_OFFSET_AFTER,
124 ATTR_SCTP_STATE = 52,
128 ATTR_DCCP_STATE = 56,
130 ATTR_DCCP_HANDSHAKE_SEQ,
131 ATTR_TCP_WSCALE_ORIG,
132 ATTR_TCP_WSCALE_REPL = 60,
135 ATTR_TIMESTAMP_START,
136 ATTR_TIMESTAMP_STOP = 64,
139 ATTR_CONNLABELS_MASK,
144 ATTR_SYNPROXY_ISN = 72,
151 enum nf_conntrack_attr_grp {
152 ATTR_GRP_ORIG_IPV4 = 0,
156 ATTR_GRP_ORIG_PORT = 4,
159 ATTR_GRP_MASTER_IPV4,
160 ATTR_GRP_MASTER_IPV6 = 8,
161 ATTR_GRP_MASTER_PORT,
162 ATTR_GRP_ORIG_COUNTERS,
163 ATTR_GRP_REPL_COUNTERS,
164 ATTR_GRP_ORIG_ADDR_SRC = 12,
165 ATTR_GRP_ORIG_ADDR_DST,
166 ATTR_GRP_REPL_ADDR_SRC,
167 ATTR_GRP_REPL_ADDR_DST,
176 uint32_t src[4], dst[4];
180 uint16_t sport, dport;
200 enum nf_conntrack_msg_type {
204 NFCT_T_NEW = (1 << NFCT_T_NEW_BIT),
206 NFCT_T_UPDATE_BIT = 1,
207 NFCT_T_UPDATE = (1 << NFCT_T_UPDATE_BIT),
209 NFCT_T_DESTROY_BIT = 2,
210 NFCT_T_DESTROY = (1 << NFCT_T_DESTROY_BIT),
212 NFCT_T_ALL = NFCT_T_NEW | NFCT_T_UPDATE | NFCT_T_DESTROY,
214 NFCT_T_ERROR_BIT = 31,
215 NFCT_T_ERROR = (1 << NFCT_T_ERROR_BIT),
219 extern struct nf_conntrack *
nfct_new(
void);
223 struct nf_conntrack *
nfct_clone(
const struct nf_conntrack *ct);
226 extern __attribute__((deprecated))
size_t nfct_sizeof(
const struct nf_conntrack *ct);
229 extern __attribute__((deprecated))
size_t nfct_maxsize(
void);
237 NFCT_SOPT_SETUP_ORIGINAL,
238 NFCT_SOPT_SETUP_REPLY,
241 #define NFCT_SOPT_MAX (__NFCT_SOPT_MAX - 1)
251 #define NFCT_GOPT_MAX (__NFCT_GOPT_MAX - 1)
253 extern int nfct_setobjopt(
struct nf_conntrack *ct,
unsigned int option);
254 extern int nfct_getobjopt(
const struct nf_conntrack *ct,
unsigned int option);
259 enum nf_conntrack_msg_type type,
260 int (*cb)(
enum nf_conntrack_msg_type type,
261 struct nf_conntrack *ct,
270 enum nf_conntrack_msg_type type,
271 int (*cb)(
const struct nlmsghdr *nlh,
272 enum nf_conntrack_msg_type type,
273 struct nf_conntrack *ct,
281 NFCT_CB_FAILURE = -1,
283 NFCT_CB_CONTINUE = 1,
290 struct nfct_bitmask *nfct_bitmask_new(
unsigned int maxbit);
291 struct nfct_bitmask *nfct_bitmask_clone(
const struct nfct_bitmask *);
292 unsigned int nfct_bitmask_maxbit(
const struct nfct_bitmask *);
294 void nfct_bitmask_set_bit(
struct nfct_bitmask *,
unsigned int bit);
295 int nfct_bitmask_test_bit(
const struct nfct_bitmask *,
unsigned int bit);
296 void nfct_bitmask_unset_bit(
struct nfct_bitmask *,
unsigned int bit);
297 void nfct_bitmask_destroy(
struct nfct_bitmask *);
298 void nfct_bitmask_clear(
struct nfct_bitmask *);
299 bool nfct_bitmask_equal(
const struct nfct_bitmask *,
const struct nfct_bitmask *);
312 const enum nf_conntrack_attr type,
316 const enum nf_conntrack_attr type,
320 const enum nf_conntrack_attr type,
324 const enum nf_conntrack_attr type,
328 const enum nf_conntrack_attr type,
332 const enum nf_conntrack_attr type,
337 extern const void *
nfct_get_attr(
const struct nf_conntrack *ct,
338 const enum nf_conntrack_attr type);
341 const enum nf_conntrack_attr type);
344 const enum nf_conntrack_attr type);
347 const enum nf_conntrack_attr type);
350 const enum nf_conntrack_attr type);
354 const enum nf_conntrack_attr type);
357 const enum nf_conntrack_attr *type_array,
362 const enum nf_conntrack_attr type);
366 const enum nf_conntrack_attr_grp type,
370 const enum nf_conntrack_attr_grp type,
375 const enum nf_conntrack_attr_grp type);
379 const enum nf_conntrack_attr_grp type);
386 NFCT_O_DEFAULT = NFCT_O_PLAIN,
393 NFCT_OF_SHOW_LAYER3_BIT = 0,
394 NFCT_OF_SHOW_LAYER3 = (1 << NFCT_OF_SHOW_LAYER3_BIT),
396 NFCT_OF_TIME_BIT = 1,
397 NFCT_OF_TIME = (1 << NFCT_OF_TIME_BIT),
400 NFCT_OF_ID = (1 << NFCT_OF_ID_BIT),
402 NFCT_OF_TIMESTAMP_BIT = 3,
403 NFCT_OF_TIMESTAMP = (1 << NFCT_OF_TIMESTAMP_BIT),
408 const struct nf_conntrack *ct,
409 const unsigned int msg_type,
410 const unsigned int out_type,
411 const unsigned int out_flags);
415 const struct nf_conntrack *ct,
416 const unsigned int msg_type,
417 const unsigned int out_type,
418 const unsigned int out_flags,
423 const struct nf_conntrack *ct2);
427 NFCT_CMP_ORIG = (1 << 0),
428 NFCT_CMP_REPL = (1 << 1),
429 NFCT_CMP_TIMEOUT_EQ = (1 << 2),
430 NFCT_CMP_TIMEOUT_GT = (1 << 3),
431 NFCT_CMP_TIMEOUT_GE = (NFCT_CMP_TIMEOUT_EQ | NFCT_CMP_TIMEOUT_GT),
432 NFCT_CMP_TIMEOUT_LT = (1 << 4),
433 NFCT_CMP_TIMEOUT_LE = (NFCT_CMP_TIMEOUT_EQ | NFCT_CMP_TIMEOUT_LT),
434 NFCT_CMP_MASK = (1 << 5),
435 NFCT_CMP_STRICT = (1 << 6),
438 extern int nfct_cmp(
const struct nf_conntrack *ct1,
439 const struct nf_conntrack *ct2,
444 enum nf_conntrack_query {
452 NFCT_Q_CREATE_UPDATE,
454 NFCT_Q_DUMP_FILTER_RESET,
459 const enum nf_conntrack_query query,
462 extern int nfct_send(
struct nfct_handle *h,
463 const enum nf_conntrack_query query,
471 NFCT_CP_ORIG = (1 << 0),
472 NFCT_CP_REPL = (1 << 1),
473 NFCT_CP_META = (1 << 2),
474 NFCT_CP_OVERRIDE = (1 << 3),
477 extern void nfct_copy(
struct nf_conntrack *dest,
478 const struct nf_conntrack *source,
482 const struct nf_conntrack *ct2,
483 const enum nf_conntrack_attr type);
505 enum nfct_filter_attr {
506 NFCT_FILTER_L4PROTO = 0,
507 NFCT_FILTER_L4PROTO_STATE,
508 NFCT_FILTER_SRC_IPV4,
509 NFCT_FILTER_DST_IPV4,
510 NFCT_FILTER_SRC_IPV6,
511 NFCT_FILTER_DST_IPV6,
517 const enum nfct_filter_attr attr,
521 const enum nfct_filter_attr attr,
522 const uint32_t value);
524 enum nfct_filter_logic {
525 NFCT_FILTER_LOGIC_POSITIVE,
526 NFCT_FILTER_LOGIC_NEGATIVE,
527 NFCT_FILTER_LOGIC_MAX
531 const enum nfct_filter_attr attr,
532 const enum nfct_filter_logic logic);
539 struct nfct_filter_dump;
546 enum nfct_filter_dump_attr {
547 NFCT_FILTER_DUMP_MARK = 0,
548 NFCT_FILTER_DUMP_L3NUM,
549 NFCT_FILTER_DUMP_STATUS,
558 const enum nfct_filter_dump_attr type,
562 const enum nfct_filter_dump_attr type,
567 extern __attribute__((deprecated))
int
573 const struct nf_conntrack *ct);
575 extern __attribute__((deprecated))
577 const struct nlmsghdr *nlh,
578 struct nf_conntrack *ct);
580 extern __attribute__((deprecated))
582 const enum nf_conntrack_query query,
589 extern int nfct_nlmsg_build(
struct nlmsghdr *nlh,
const struct nf_conntrack *ct);
590 extern int nfct_nlmsg_build_filter(
struct nlmsghdr *nlh,
const struct nfct_filter_dump *filter_dump);
591 extern int nfct_nlmsg_parse(
const struct nlmsghdr *nlh,
struct nf_conntrack *ct);
592 extern int nfct_payload_parse(
const void *payload,
size_t payload_len, uint16_t l3num,
struct nf_conntrack *ct);
602 enum nf_expect_attr {
609 ATTR_EXP_HELPER_NAME,
618 extern struct nf_expect *
nfexp_new(
void);
622 extern struct nf_expect *
nfexp_clone(
const struct nf_expect *exp);
625 extern size_t nfexp_sizeof(
const struct nf_expect *exp);
633 enum nf_conntrack_msg_type type,
634 int (*cb)(
enum nf_conntrack_msg_type type,
635 struct nf_expect *exp,
643 enum nf_conntrack_msg_type type,
644 int (*cb)(
const struct nlmsghdr *nlh,
645 enum nf_conntrack_msg_type type,
646 struct nf_expect *exp,
654 const enum nf_expect_attr type,
658 const enum nf_expect_attr type,
662 const enum nf_expect_attr type,
666 const enum nf_expect_attr type,
671 const enum nf_expect_attr type);
674 const enum nf_expect_attr type);
677 const enum nf_expect_attr type);
680 const enum nf_expect_attr type);
684 const enum nf_expect_attr type);
688 const enum nf_expect_attr type);
692 const enum nf_conntrack_query qt,
698 const struct nf_expect *exp,
699 const unsigned int msg_type,
700 const unsigned int out_type,
701 const unsigned int out_flags);
704 extern int nfexp_cmp(
const struct nf_expect *exp1,
705 const struct nf_expect *exp2,
709 const enum nf_conntrack_query qt,
715 extern __attribute__((deprecated))
721 const struct nf_expect *exp);
723 extern __attribute__((deprecated))
725 const struct nlmsghdr *nlh,
726 struct nf_expect *exp);
728 extern __attribute__((deprecated))
730 const enum nf_conntrack_query qt,
737 extern int nfexp_nlmsg_build(
struct nlmsghdr *nlh,
const struct nf_expect *exp);
738 extern int nfexp_nlmsg_parse(
const struct nlmsghdr *nlh,
struct nf_expect *exp);
745 #define IP_CT_TCP_FLAG_WINDOW_SCALE 0x01
748 #define IP_CT_TCP_FLAG_SACK_PERM 0x02
751 #define IP_CT_TCP_FLAG_CLOSE_INIT 0x04
754 #define IP_CT_TCP_FLAG_BE_LIBERAL 0x08
758 #define NFCT_DIR_ORIGINAL 0
759 #define NFCT_DIR_REPLY 1
760 #define NFCT_DIR_MAX NFCT_DIR_REPLY+1
765 #define NFCT_HELPER_NAME_MAX 16
void nfexp_callback_unregister(struct nfct_handle *h)
void nfexp_callback_unregister2(struct nfct_handle *h)
int nfct_callback_register(struct nfct_handle *h, enum nf_conntrack_msg_type type, int(*cb)(enum nf_conntrack_msg_type type, struct nf_conntrack *ct, void *data), void *data)
int nfexp_callback_register2(struct nfct_handle *h, enum nf_conntrack_msg_type type, int(*cb)(const struct nlmsghdr *nlh, enum nf_conntrack_msg_type type, struct nf_expect *exp, void *data), void *data)
void nfct_callback_unregister2(struct nfct_handle *h)
int nfct_close(struct nfct_handle *cth)
void nfct_callback_unregister(struct nfct_handle *h)
struct nfct_handle * nfct_open(uint8_t, unsigned)
int nfct_callback_register2(struct nfct_handle *h, enum nf_conntrack_msg_type type, int(*cb)(const struct nlmsghdr *nlh, enum nf_conntrack_msg_type type, struct nf_conntrack *ct, void *data), void *data)
int nfexp_callback_register(struct nfct_handle *h, enum nf_conntrack_msg_type type, int(*cb)(enum nf_conntrack_msg_type type, struct nf_expect *exp, void *data), void *data)
int nfct_fd(struct nfct_handle *cth)
void nfct_filter_destroy(struct nfct_filter *filter)
int nfct_filter_detach(int fd)
int nfct_filter_set_logic(struct nfct_filter *filter, const enum nfct_filter_attr attr, const enum nfct_filter_logic logic)
int nfct_filter_attach(int fd, struct nfct_filter *filter)
void nfct_filter_add_attr_u32(struct nfct_filter *filter, const enum nfct_filter_attr attr, const uint32_t value)
void nfct_filter_add_attr(struct nfct_filter *filter, const enum nfct_filter_attr attr, const void *value)
struct nfct_filter * nfct_filter_create(void)
int nfexp_catch(struct nfct_handle *h)
int nfct_send(struct nfct_handle *h, const enum nf_conntrack_query query, const void *data)
int nfct_catch(struct nfct_handle *h)
int nfexp_send(struct nfct_handle *h, const enum nf_conntrack_query qt, const void *data)
int nfexp_query(struct nfct_handle *h, const enum nf_conntrack_query qt, const void *data)
int nfct_query(struct nfct_handle *h, const enum nf_conntrack_query query, const void *data)
size_t nfct_sizeof(const struct nf_conntrack *ct)
int nfct_snprintf_labels(char *buf, unsigned int size, const struct nf_conntrack *ct, const unsigned int msg_type, const unsigned int out_type, const unsigned int out_flags, struct nfct_labelmap *map)
void nfct_set_attr_u32(struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint32_t value)
void nfct_destroy(struct nf_conntrack *ct)
void nfct_copy_attr(struct nf_conntrack *ct1, const struct nf_conntrack *ct2, const enum nf_conntrack_attr type)
const void * nfct_get_attr(const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
struct nf_conntrack * nfct_new(void)
void nfct_set_attr(struct nf_conntrack *ct, const enum nf_conntrack_attr type, const void *value)
int nfct_attr_grp_unset(struct nf_conntrack *ct, const enum nf_conntrack_attr_grp type)
uint64_t nfct_get_attr_u64(const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
int nfct_setobjopt(struct nf_conntrack *ct, unsigned int option)
int nfct_get_attr_grp(const struct nf_conntrack *ct, const enum nf_conntrack_attr_grp type, void *data)
void nfct_set_attr_grp(struct nf_conntrack *ct, const enum nf_conntrack_attr_grp type, const void *value)
int nfct_attr_is_set_array(const struct nf_conntrack *ct, const enum nf_conntrack_attr *type_array, int size)
int nfct_attr_unset(struct nf_conntrack *ct, const enum nf_conntrack_attr type)
void nfct_copy(struct nf_conntrack *dest, const struct nf_conntrack *source, unsigned int flags)
uint16_t nfct_get_attr_u16(const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
int nfct_attr_grp_is_set(const struct nf_conntrack *ct, const enum nf_conntrack_attr_grp type)
int nfct_cmp(const struct nf_conntrack *ct1, const struct nf_conntrack *ct2, unsigned int flags)
struct nf_conntrack * nfct_clone(const struct nf_conntrack *ct)
void nfct_set_attr_u16(struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint16_t value)
uint32_t nfct_get_attr_u32(const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
void nfct_set_attr_u8(struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint8_t value)
void nfct_set_attr_u64(struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint64_t value)
void nfct_set_attr_l(struct nf_conntrack *ct, const enum nf_conntrack_attr type, const void *value, size_t len)
int nfct_snprintf(char *buf, unsigned int size, const struct nf_conntrack *ct, const unsigned int msg_type, const unsigned int out_type, const unsigned int out_flags)
size_t nfct_maxsize(void)
int nfct_attr_is_set(const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
int nfct_getobjopt(const struct nf_conntrack *ct, unsigned int option)
int nfct_compare(const struct nf_conntrack *ct1, const struct nf_conntrack *ct2)
uint8_t nfct_get_attr_u8(const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
void nfct_filter_dump_set_attr_u8(struct nfct_filter_dump *filter_dump, const enum nfct_filter_dump_attr type, uint8_t data)
void nfct_filter_dump_destroy(struct nfct_filter_dump *filter)
struct nfct_filter_dump * nfct_filter_dump_create(void)
void nfct_filter_dump_set_attr(struct nfct_filter_dump *filter_dump, const enum nfct_filter_dump_attr type, const void *data)
void nfexp_set_attr_u32(struct nf_expect *exp, const enum nf_expect_attr type, uint32_t value)
struct nf_expect * nfexp_clone(const struct nf_expect *exp)
uint32_t nfexp_get_attr_u32(const struct nf_expect *exp, const enum nf_expect_attr type)
size_t nfexp_sizeof(const struct nf_expect *exp)
void nfexp_set_attr_u16(struct nf_expect *exp, const enum nf_expect_attr type, uint16_t value)
void nfexp_set_attr(struct nf_expect *exp, const enum nf_expect_attr type, const void *value)
int nfexp_cmp(const struct nf_expect *exp1, const struct nf_expect *exp2, unsigned int flags)
uint16_t nfexp_get_attr_u16(const struct nf_expect *exp, const enum nf_expect_attr type)
void nfexp_set_attr_u8(struct nf_expect *exp, const enum nf_expect_attr type, uint8_t value)
const void * nfexp_get_attr(const struct nf_expect *exp, const enum nf_expect_attr type)
uint8_t nfexp_get_attr_u8(const struct nf_expect *exp, const enum nf_expect_attr type)
int nfexp_snprintf(char *buf, unsigned int size, const struct nf_expect *exp, const unsigned int msg_type, const unsigned int out_type, const unsigned int out_flags)
struct nf_expect * nfexp_new(void)
void nfexp_destroy(struct nf_expect *exp)
int nfexp_attr_unset(struct nf_expect *exp, const enum nf_expect_attr type)
int nfexp_attr_is_set(const struct nf_expect *exp, const enum nf_expect_attr type)
size_t nfexp_maxsize(void)
const char * nfct_labelmap_get_name(struct nfct_labelmap *m, unsigned int bit)
struct nfct_labelmap * nfct_labelmap_new(const char *mapfile)
void nfct_labelmap_destroy(struct nfct_labelmap *map)
const char * nfct_labels_get_path(void)
int nfct_labelmap_get_bit(struct nfct_labelmap *m, const char *name)
int nfexp_build_query(struct nfnl_subsys_handle *ssh, const enum nf_conntrack_query qt, const void *data, void *buffer, unsigned int size)
int nfct_parse_conntrack(enum nf_conntrack_msg_type type, const struct nlmsghdr *nlh, struct nf_conntrack *ct)
int nfexp_build_expect(struct nfnl_subsys_handle *ssh, void *req, size_t size, uint16_t type, uint16_t flags, const struct nf_expect *exp)
int nfct_build_conntrack(struct nfnl_subsys_handle *ssh, void *req, size_t size, uint16_t type, uint16_t flags, const struct nf_conntrack *ct)
int nfexp_parse_expect(enum nf_conntrack_msg_type type, const struct nlmsghdr *nlh, struct nf_expect *exp)
int nfct_build_query(struct nfnl_subsys_handle *ssh, const enum nf_conntrack_query qt, const void *data, void *buffer, unsigned int size)