libnetfilter_conntrack 1.0.9
libnetfilter_conntrack.h
1/*
2 * (C) 2005-2011 by Pablo Neira Ayuso <pablo@netfilter.org>
3 *
4 * This program is free software; you can redistribute it and/or modify it
5 * under the terms of the GNU General Public License as published by
6 * the Free Software Foundation; either version 2 of the License, or
7 * (at your option) any later version.
8 */
9
10#ifndef _LIBNETFILTER_CONNTRACK_H_
11#define _LIBNETFILTER_CONNTRACK_H_
12
13#include <stdbool.h>
14#include <netinet/in.h>
15#include <libnfnetlink/linux_nfnetlink.h>
16#include <libnfnetlink/libnfnetlink.h>
17#include <libnetfilter_conntrack/linux_nfnetlink_conntrack.h>
18#include <libnetfilter_conntrack/linux_nf_conntrack_common.h>
19
20#ifdef __cplusplus
21extern "C" {
22#endif
23
24enum {
25 CONNTRACK = NFNL_SUBSYS_CTNETLINK,
26 EXPECT = NFNL_SUBSYS_CTNETLINK_EXP
27};
28
29/*
30 * Subscribe to all possible conntrack event groups. Use this
31 * flag in case that you want to catch up all the possible
32 * events. Do not use this flag for dumping or any other
33 * similar operation.
34 */
35#define NFCT_ALL_CT_GROUPS (NF_NETLINK_CONNTRACK_NEW|NF_NETLINK_CONNTRACK_UPDATE|NF_NETLINK_CONNTRACK_DESTROY)
36
37struct nfct_handle;
38
39/*
40 * [Open|close] a conntrack handler
41 */
42extern struct nfct_handle *nfct_open(uint8_t, unsigned);
43extern struct nfct_handle *nfct_open_nfnl(struct nfnl_handle *nfnlh,
44 uint8_t subsys_id,
45 unsigned int subscriptions);
46extern int nfct_close(struct nfct_handle *cth);
47
48extern int nfct_fd(struct nfct_handle *cth);
49extern const struct nfnl_handle *nfct_nfnlh(struct nfct_handle *cth);
50
51/*
52 * NEW libnetfilter_conntrack API
53 */
54
55/* high level API */
56
57#include <sys/types.h>
58
59/* conntrack object */
60struct nf_conntrack;
61
62/* conntrack attributes */
63enum nf_conntrack_attr {
64 ATTR_ORIG_IPV4_SRC = 0, /* u32 bits */
65 ATTR_IPV4_SRC = ATTR_ORIG_IPV4_SRC, /* alias */
66 ATTR_ORIG_IPV4_DST, /* u32 bits */
67 ATTR_IPV4_DST = ATTR_ORIG_IPV4_DST, /* alias */
68 ATTR_REPL_IPV4_SRC, /* u32 bits */
69 ATTR_REPL_IPV4_DST, /* u32 bits */
70 ATTR_ORIG_IPV6_SRC = 4, /* u128 bits */
71 ATTR_IPV6_SRC = ATTR_ORIG_IPV6_SRC, /* alias */
72 ATTR_ORIG_IPV6_DST, /* u128 bits */
73 ATTR_IPV6_DST = ATTR_ORIG_IPV6_DST, /* alias */
74 ATTR_REPL_IPV6_SRC, /* u128 bits */
75 ATTR_REPL_IPV6_DST, /* u128 bits */
76 ATTR_ORIG_PORT_SRC = 8, /* u16 bits */
77 ATTR_PORT_SRC = ATTR_ORIG_PORT_SRC, /* alias */
78 ATTR_ORIG_PORT_DST, /* u16 bits */
79 ATTR_PORT_DST = ATTR_ORIG_PORT_DST, /* alias */
80 ATTR_REPL_PORT_SRC, /* u16 bits */
81 ATTR_REPL_PORT_DST, /* u16 bits */
82 ATTR_ICMP_TYPE = 12, /* u8 bits */
83 ATTR_ICMP_CODE, /* u8 bits */
84 ATTR_ICMP_ID, /* u16 bits */
85 ATTR_ORIG_L3PROTO, /* u8 bits */
86 ATTR_L3PROTO = ATTR_ORIG_L3PROTO, /* alias */
87 ATTR_REPL_L3PROTO = 16, /* u8 bits */
88 ATTR_ORIG_L4PROTO, /* u8 bits */
89 ATTR_L4PROTO = ATTR_ORIG_L4PROTO, /* alias */
90 ATTR_REPL_L4PROTO, /* u8 bits */
91 ATTR_TCP_STATE, /* u8 bits */
92 ATTR_SNAT_IPV4 = 20, /* u32 bits */
93 ATTR_DNAT_IPV4, /* u32 bits */
94 ATTR_SNAT_PORT, /* u16 bits */
95 ATTR_DNAT_PORT, /* u16 bits */
96 ATTR_TIMEOUT = 24, /* u32 bits */
97 ATTR_MARK, /* u32 bits */
98 ATTR_ORIG_COUNTER_PACKETS, /* u64 bits */
99 ATTR_REPL_COUNTER_PACKETS, /* u64 bits */
100 ATTR_ORIG_COUNTER_BYTES = 28, /* u64 bits */
101 ATTR_REPL_COUNTER_BYTES, /* u64 bits */
102 ATTR_USE, /* u32 bits */
103 ATTR_ID, /* u32 bits */
104 ATTR_STATUS = 32, /* u32 bits */
105 ATTR_TCP_FLAGS_ORIG, /* u8 bits */
106 ATTR_TCP_FLAGS_REPL, /* u8 bits */
107 ATTR_TCP_MASK_ORIG, /* u8 bits */
108 ATTR_TCP_MASK_REPL = 36, /* u8 bits */
109 ATTR_MASTER_IPV4_SRC, /* u32 bits */
110 ATTR_MASTER_IPV4_DST, /* u32 bits */
111 ATTR_MASTER_IPV6_SRC, /* u128 bits */
112 ATTR_MASTER_IPV6_DST = 40, /* u128 bits */
113 ATTR_MASTER_PORT_SRC, /* u16 bits */
114 ATTR_MASTER_PORT_DST, /* u16 bits */
115 ATTR_MASTER_L3PROTO, /* u8 bits */
116 ATTR_MASTER_L4PROTO = 44, /* u8 bits */
117 ATTR_SECMARK, /* u32 bits */
118 ATTR_ORIG_NAT_SEQ_CORRECTION_POS, /* u32 bits */
119 ATTR_ORIG_NAT_SEQ_OFFSET_BEFORE, /* u32 bits */
120 ATTR_ORIG_NAT_SEQ_OFFSET_AFTER = 48, /* u32 bits */
121 ATTR_REPL_NAT_SEQ_CORRECTION_POS, /* u32 bits */
122 ATTR_REPL_NAT_SEQ_OFFSET_BEFORE, /* u32 bits */
123 ATTR_REPL_NAT_SEQ_OFFSET_AFTER, /* u32 bits */
124 ATTR_SCTP_STATE = 52, /* u8 bits */
125 ATTR_SCTP_VTAG_ORIG, /* u32 bits */
126 ATTR_SCTP_VTAG_REPL, /* u32 bits */
127 ATTR_HELPER_NAME, /* string (30 bytes max) */
128 ATTR_DCCP_STATE = 56, /* u8 bits */
129 ATTR_DCCP_ROLE, /* u8 bits */
130 ATTR_DCCP_HANDSHAKE_SEQ, /* u64 bits */
131 ATTR_TCP_WSCALE_ORIG, /* u8 bits */
132 ATTR_TCP_WSCALE_REPL = 60, /* u8 bits */
133 ATTR_ZONE, /* u16 bits */
134 ATTR_SECCTX, /* string */
135 ATTR_TIMESTAMP_START, /* u64 bits, linux >= 2.6.38 */
136 ATTR_TIMESTAMP_STOP = 64, /* u64 bits, linux >= 2.6.38 */
137 ATTR_HELPER_INFO, /* variable length */
138 ATTR_CONNLABELS, /* variable length */
139 ATTR_CONNLABELS_MASK, /* variable length */
140 ATTR_ORIG_ZONE = 68, /* u16 bits */
141 ATTR_REPL_ZONE, /* u16 bits */
142 ATTR_SNAT_IPV6, /* u128 bits */
143 ATTR_DNAT_IPV6, /* u128 bits */
144 ATTR_SYNPROXY_ISN = 72, /* u32 bits */
145 ATTR_SYNPROXY_ITS, /* u32 bits */
146 ATTR_SYNPROXY_TSOFF, /* u32 bits */
147 ATTR_MAX
148};
149
150/* conntrack attribute groups */
151enum nf_conntrack_attr_grp {
152 ATTR_GRP_ORIG_IPV4 = 0, /* struct nfct_attr_grp_ipv4 */
153 ATTR_GRP_REPL_IPV4, /* struct nfct_attr_grp_ipv4 */
154 ATTR_GRP_ORIG_IPV6, /* struct nfct_attr_grp_ipv6 */
155 ATTR_GRP_REPL_IPV6, /* struct nfct_attr_grp_ipv6 */
156 ATTR_GRP_ORIG_PORT = 4, /* struct nfct_attr_grp_port */
157 ATTR_GRP_REPL_PORT, /* struct nfct_attr_grp_port */
158 ATTR_GRP_ICMP, /* struct nfct_attr_grp_icmp */
159 ATTR_GRP_MASTER_IPV4, /* struct nfct_attr_grp_ipv4 */
160 ATTR_GRP_MASTER_IPV6 = 8, /* struct nfct_attr_grp_ipv6 */
161 ATTR_GRP_MASTER_PORT, /* struct nfct_attr_grp_port */
162 ATTR_GRP_ORIG_COUNTERS, /* struct nfct_attr_grp_ctrs */
163 ATTR_GRP_REPL_COUNTERS, /* struct nfct_attr_grp_ctrs */
164 ATTR_GRP_ORIG_ADDR_SRC = 12, /* union nfct_attr_grp_addr */
165 ATTR_GRP_ORIG_ADDR_DST, /* union nfct_attr_grp_addr */
166 ATTR_GRP_REPL_ADDR_SRC, /* union nfct_attr_grp_addr */
167 ATTR_GRP_REPL_ADDR_DST, /* union nfct_attr_grp_addr */
168 ATTR_GRP_MAX
169};
170
172 uint32_t src, dst;
173};
174
176 uint32_t src[4], dst[4];
177};
178
180 uint16_t sport, dport;
181};
182
184 uint16_t id;
185 uint8_t code, type;
186};
187
189 uint64_t packets;
190 uint64_t bytes;
191};
192
194 uint32_t ip;
195 uint32_t ip6[4];
196 uint32_t addr[4];
197};
198
199/* message type */
200enum nf_conntrack_msg_type {
201 NFCT_T_UNKNOWN = 0,
202
203 NFCT_T_NEW_BIT = 0,
204 NFCT_T_NEW = (1 << NFCT_T_NEW_BIT),
205
206 NFCT_T_UPDATE_BIT = 1,
207 NFCT_T_UPDATE = (1 << NFCT_T_UPDATE_BIT),
208
209 NFCT_T_DESTROY_BIT = 2,
210 NFCT_T_DESTROY = (1 << NFCT_T_DESTROY_BIT),
211
212 NFCT_T_ALL = NFCT_T_NEW | NFCT_T_UPDATE | NFCT_T_DESTROY,
213
214 NFCT_T_ERROR_BIT = 31,
215 NFCT_T_ERROR = (1 << NFCT_T_ERROR_BIT),
216};
217
218/* constructor / destructor */
219extern struct nf_conntrack *nfct_new(void);
220extern void nfct_destroy(struct nf_conntrack *ct);
221
222/* clone */
223struct nf_conntrack *nfct_clone(const struct nf_conntrack *ct);
224
225/* object size */
226extern __attribute__((deprecated)) size_t nfct_sizeof(const struct nf_conntrack *ct);
227
228/* maximum object size */
229extern __attribute__((deprecated)) size_t nfct_maxsize(void);
230
231/* set option */
232enum {
233 NFCT_SOPT_UNDO_SNAT,
234 NFCT_SOPT_UNDO_DNAT,
235 NFCT_SOPT_UNDO_SPAT,
236 NFCT_SOPT_UNDO_DPAT,
237 NFCT_SOPT_SETUP_ORIGINAL,
238 NFCT_SOPT_SETUP_REPLY,
239 __NFCT_SOPT_MAX,
240};
241#define NFCT_SOPT_MAX (__NFCT_SOPT_MAX - 1)
242
243/* get option */
244enum {
245 NFCT_GOPT_IS_SNAT,
246 NFCT_GOPT_IS_DNAT,
247 NFCT_GOPT_IS_SPAT,
248 NFCT_GOPT_IS_DPAT,
249 __NFCT_GOPT_MAX,
250};
251#define NFCT_GOPT_MAX (__NFCT_GOPT_MAX - 1)
252
253extern int nfct_setobjopt(struct nf_conntrack *ct, unsigned int option);
254extern int nfct_getobjopt(const struct nf_conntrack *ct, unsigned int option);
255
256/* register / unregister callback */
257
258extern int nfct_callback_register(struct nfct_handle *h,
259 enum nf_conntrack_msg_type type,
260 int (*cb)(enum nf_conntrack_msg_type type,
261 struct nf_conntrack *ct,
262 void *data),
263 void *data);
264
265extern void nfct_callback_unregister(struct nfct_handle *h);
266
267/* register / unregister callback: extended version including netlink header */
268
269extern int nfct_callback_register2(struct nfct_handle *h,
270 enum nf_conntrack_msg_type type,
271 int (*cb)(const struct nlmsghdr *nlh,
272 enum nf_conntrack_msg_type type,
273 struct nf_conntrack *ct,
274 void *data),
275 void *data);
276
277extern void nfct_callback_unregister2(struct nfct_handle *h);
278
279/* callback verdict */
280enum {
281 NFCT_CB_FAILURE = -1, /* failure */
282 NFCT_CB_STOP = 0, /* stop the query */
283 NFCT_CB_CONTINUE = 1, /* keep iterating through data */
284 NFCT_CB_STOLEN = 2, /* like continue, but ct is not freed */
285};
286
287/* bitmask setter/getter */
288struct nfct_bitmask;
289
290struct nfct_bitmask *nfct_bitmask_new(unsigned int maxbit);
291struct nfct_bitmask *nfct_bitmask_clone(const struct nfct_bitmask *);
292unsigned int nfct_bitmask_maxbit(const struct nfct_bitmask *);
293
294void nfct_bitmask_set_bit(struct nfct_bitmask *, unsigned int bit);
295int nfct_bitmask_test_bit(const struct nfct_bitmask *, unsigned int bit);
296void nfct_bitmask_unset_bit(struct nfct_bitmask *, unsigned int bit);
297void nfct_bitmask_destroy(struct nfct_bitmask *);
298void nfct_bitmask_clear(struct nfct_bitmask *);
299bool nfct_bitmask_equal(const struct nfct_bitmask *, const struct nfct_bitmask *);
300
301/* connlabel name <-> bit translation mapping */
302struct nfct_labelmap;
303
304const char *nfct_labels_get_path(void);
305struct nfct_labelmap *nfct_labelmap_new(const char *mapfile);
306void nfct_labelmap_destroy(struct nfct_labelmap *map);
307const char *nfct_labelmap_get_name(struct nfct_labelmap *m, unsigned int bit);
308int nfct_labelmap_get_bit(struct nfct_labelmap *m, const char *name);
309
310/* setter */
311extern void nfct_set_attr(struct nf_conntrack *ct,
312 const enum nf_conntrack_attr type,
313 const void *value);
314
315extern void nfct_set_attr_u8(struct nf_conntrack *ct,
316 const enum nf_conntrack_attr type,
317 uint8_t value);
318
319extern void nfct_set_attr_u16(struct nf_conntrack *ct,
320 const enum nf_conntrack_attr type,
321 uint16_t value);
322
323extern void nfct_set_attr_u32(struct nf_conntrack *ct,
324 const enum nf_conntrack_attr type,
325 uint32_t value);
326
327extern void nfct_set_attr_u64(struct nf_conntrack *ct,
328 const enum nf_conntrack_attr type,
329 uint64_t value);
330
331extern void nfct_set_attr_l(struct nf_conntrack *ct,
332 const enum nf_conntrack_attr type,
333 const void *value,
334 size_t len);
335
336/* getter */
337extern const void *nfct_get_attr(const struct nf_conntrack *ct,
338 const enum nf_conntrack_attr type);
339
340extern uint8_t nfct_get_attr_u8(const struct nf_conntrack *ct,
341 const enum nf_conntrack_attr type);
342
343extern uint16_t nfct_get_attr_u16(const struct nf_conntrack *ct,
344 const enum nf_conntrack_attr type);
345
346extern uint32_t nfct_get_attr_u32(const struct nf_conntrack *ct,
347 const enum nf_conntrack_attr type);
348
349extern uint64_t nfct_get_attr_u64(const struct nf_conntrack *ct,
350 const enum nf_conntrack_attr type);
351
352/* checker */
353extern int nfct_attr_is_set(const struct nf_conntrack *ct,
354 const enum nf_conntrack_attr type);
355
356extern int nfct_attr_is_set_array(const struct nf_conntrack *ct,
357 const enum nf_conntrack_attr *type_array,
358 int size);
359
360/* unsetter */
361extern int nfct_attr_unset(struct nf_conntrack *ct,
362 const enum nf_conntrack_attr type);
363
364/* group setter */
365extern void nfct_set_attr_grp(struct nf_conntrack *ct,
366 const enum nf_conntrack_attr_grp type,
367 const void *value);
368/* group getter */
369extern int nfct_get_attr_grp(const struct nf_conntrack *ct,
370 const enum nf_conntrack_attr_grp type,
371 void *data);
372
373/* group checker */
374extern int nfct_attr_grp_is_set(const struct nf_conntrack *ct,
375 const enum nf_conntrack_attr_grp type);
376
377/* unsetter */
378extern int nfct_attr_grp_unset(struct nf_conntrack *ct,
379 const enum nf_conntrack_attr_grp type);
380
381/* print */
382
383/* output type */
384enum {
385 NFCT_O_PLAIN,
386 NFCT_O_DEFAULT = NFCT_O_PLAIN,
387 NFCT_O_XML,
388 NFCT_O_MAX
389};
390
391/* output flags */
392enum {
393 NFCT_OF_SHOW_LAYER3_BIT = 0,
394 NFCT_OF_SHOW_LAYER3 = (1 << NFCT_OF_SHOW_LAYER3_BIT),
395
396 NFCT_OF_TIME_BIT = 1,
397 NFCT_OF_TIME = (1 << NFCT_OF_TIME_BIT),
398
399 NFCT_OF_ID_BIT = 2,
400 NFCT_OF_ID = (1 << NFCT_OF_ID_BIT),
401
402 NFCT_OF_TIMESTAMP_BIT = 3,
403 NFCT_OF_TIMESTAMP = (1 << NFCT_OF_TIMESTAMP_BIT),
404};
405
406extern int nfct_snprintf(char *buf,
407 unsigned int size,
408 const struct nf_conntrack *ct,
409 const unsigned int msg_type,
410 const unsigned int out_type,
411 const unsigned int out_flags);
412
413extern int nfct_snprintf_labels(char *buf,
414 unsigned int size,
415 const struct nf_conntrack *ct,
416 const unsigned int msg_type,
417 const unsigned int out_type,
418 const unsigned int out_flags,
419 struct nfct_labelmap *map);
420
421/* comparison */
422extern int nfct_compare(const struct nf_conntrack *ct1,
423 const struct nf_conntrack *ct2);
424
425enum {
426 NFCT_CMP_ALL = 0,
427 NFCT_CMP_ORIG = (1 << 0),
428 NFCT_CMP_REPL = (1 << 1),
429 NFCT_CMP_TIMEOUT_EQ = (1 << 2),
430 NFCT_CMP_TIMEOUT_GT = (1 << 3),
431 NFCT_CMP_TIMEOUT_GE = (NFCT_CMP_TIMEOUT_EQ | NFCT_CMP_TIMEOUT_GT),
432 NFCT_CMP_TIMEOUT_LT = (1 << 4),
433 NFCT_CMP_TIMEOUT_LE = (NFCT_CMP_TIMEOUT_EQ | NFCT_CMP_TIMEOUT_LT),
434 NFCT_CMP_MASK = (1 << 5),
435 NFCT_CMP_STRICT = (1 << 6),
436};
437
438extern int nfct_cmp(const struct nf_conntrack *ct1,
439 const struct nf_conntrack *ct2,
440 unsigned int flags);
441
442
443/* query */
444enum nf_conntrack_query {
445 NFCT_Q_CREATE,
446 NFCT_Q_UPDATE,
447 NFCT_Q_DESTROY,
448 NFCT_Q_GET,
449 NFCT_Q_FLUSH,
450 NFCT_Q_DUMP,
451 NFCT_Q_DUMP_RESET,
452 NFCT_Q_CREATE_UPDATE,
453 NFCT_Q_DUMP_FILTER,
454 NFCT_Q_DUMP_FILTER_RESET,
455 NFCT_Q_FLUSH_FILTER,
456};
457
458extern int nfct_query(struct nfct_handle *h,
459 const enum nf_conntrack_query query,
460 const void *data);
461
462extern int nfct_send(struct nfct_handle *h,
463 const enum nf_conntrack_query query,
464 const void *data);
465
466extern int nfct_catch(struct nfct_handle *h);
467
468/* copy */
469enum {
470 NFCT_CP_ALL = 0,
471 NFCT_CP_ORIG = (1 << 0),
472 NFCT_CP_REPL = (1 << 1),
473 NFCT_CP_META = (1 << 2),
474 NFCT_CP_OVERRIDE = (1 << 3),
475};
476
477extern void nfct_copy(struct nf_conntrack *dest,
478 const struct nf_conntrack *source,
479 unsigned int flags);
480
481extern void nfct_copy_attr(struct nf_conntrack *ct1,
482 const struct nf_conntrack *ct2,
483 const enum nf_conntrack_attr type);
484
485/* event filtering */
486
487struct nfct_filter;
488
489extern struct nfct_filter *nfct_filter_create(void);
490extern void nfct_filter_destroy(struct nfct_filter *filter);
491
493 uint16_t proto;
494 uint16_t state;
495};
497 uint32_t addr;
498 uint32_t mask;
499};
501 uint32_t addr[4];
502 uint32_t mask[4];
503};
504
505enum nfct_filter_attr {
506 NFCT_FILTER_L4PROTO = 0, /* uint32_t */
507 NFCT_FILTER_L4PROTO_STATE, /* struct nfct_filter_proto */
508 NFCT_FILTER_SRC_IPV4, /* struct nfct_filter_ipv4 */
509 NFCT_FILTER_DST_IPV4, /* struct nfct_filter_ipv4 */
510 NFCT_FILTER_SRC_IPV6, /* struct nfct_filter_ipv6 */
511 NFCT_FILTER_DST_IPV6, /* struct nfct_filter_ipv6 */
512 NFCT_FILTER_MARK, /* struct nfct_filter_dump_mark */
513 NFCT_FILTER_MAX
514};
515
516extern void nfct_filter_add_attr(struct nfct_filter *filter,
517 const enum nfct_filter_attr attr,
518 const void *value);
519
520extern void nfct_filter_add_attr_u32(struct nfct_filter *filter,
521 const enum nfct_filter_attr attr,
522 const uint32_t value);
523
524enum nfct_filter_logic {
525 NFCT_FILTER_LOGIC_POSITIVE,
526 NFCT_FILTER_LOGIC_NEGATIVE,
527 NFCT_FILTER_LOGIC_MAX
528};
529
530extern int nfct_filter_set_logic(struct nfct_filter *filter,
531 const enum nfct_filter_attr attr,
532 const enum nfct_filter_logic logic);
533
534extern int nfct_filter_attach(int fd, struct nfct_filter *filter);
535extern int nfct_filter_detach(int fd);
536
537/* dump filtering */
538
539struct nfct_filter_dump;
540
542 uint32_t val;
543 uint32_t mask;
544};
545
546enum nfct_filter_dump_attr {
547 NFCT_FILTER_DUMP_MARK = 0, /* struct nfct_filter_dump_mark */
548 NFCT_FILTER_DUMP_L3NUM, /* uint8_t */
549 NFCT_FILTER_DUMP_STATUS, /* struct nfct_filter_dump_mark */
550 NFCT_FILTER_DUMP_MAX
551};
552
553struct nfct_filter_dump *nfct_filter_dump_create(void);
554
555void nfct_filter_dump_destroy(struct nfct_filter_dump *filter);
556
557void nfct_filter_dump_set_attr(struct nfct_filter_dump *filter_dump,
558 const enum nfct_filter_dump_attr type,
559 const void *data);
560
561void nfct_filter_dump_set_attr_u8(struct nfct_filter_dump *filter_dump,
562 const enum nfct_filter_dump_attr type,
563 uint8_t data);
564
565/* low level API: netlink functions */
566
567extern __attribute__((deprecated)) int
568nfct_build_conntrack(struct nfnl_subsys_handle *ssh,
569 void *req,
570 size_t size,
571 uint16_t type,
572 uint16_t flags,
573 const struct nf_conntrack *ct);
574
575extern __attribute__((deprecated))
576int nfct_parse_conntrack(enum nf_conntrack_msg_type msg,
577 const struct nlmsghdr *nlh,
578 struct nf_conntrack *ct);
579
580extern __attribute__((deprecated))
581int nfct_build_query(struct nfnl_subsys_handle *ssh,
582 const enum nf_conntrack_query query,
583 const void *data,
584 void *req,
585 unsigned int size);
586
587/* New low level API: netlink functions */
588
589extern int nfct_nlmsg_build(struct nlmsghdr *nlh, const struct nf_conntrack *ct);
590extern int nfct_nlmsg_build_filter(struct nlmsghdr *nlh, const struct nfct_filter_dump *filter_dump);
591extern int nfct_nlmsg_parse(const struct nlmsghdr *nlh, struct nf_conntrack *ct);
592extern int nfct_payload_parse(const void *payload, size_t payload_len, uint16_t l3num, struct nf_conntrack *ct);
593
594/*
595 * NEW expectation API
596 */
597
598/* expectation object */
599struct nf_expect;
600
601/* expect attributes */
602enum nf_expect_attr {
603 ATTR_EXP_MASTER = 0, /* pointer to conntrack object */
604 ATTR_EXP_EXPECTED, /* pointer to conntrack object */
605 ATTR_EXP_MASK, /* pointer to conntrack object */
606 ATTR_EXP_TIMEOUT, /* u32 bits */
607 ATTR_EXP_ZONE, /* u16 bits */
608 ATTR_EXP_FLAGS, /* u32 bits */
609 ATTR_EXP_HELPER_NAME, /* string (16 bytes max) */
610 ATTR_EXP_CLASS, /* u32 bits */
611 ATTR_EXP_NAT_TUPLE, /* pointer to conntrack object */
612 ATTR_EXP_NAT_DIR, /* u8 bits */
613 ATTR_EXP_FN, /* string */
614 ATTR_EXP_MAX
615};
616
617/* constructor / destructor */
618extern struct nf_expect *nfexp_new(void);
619extern void nfexp_destroy(struct nf_expect *exp);
620
621/* clone */
622extern struct nf_expect *nfexp_clone(const struct nf_expect *exp);
623
624/* object size */
625extern size_t nfexp_sizeof(const struct nf_expect *exp);
626
627/* maximum object size */
628extern size_t nfexp_maxsize(void);
629
630/* register / unregister callback */
631
632extern int nfexp_callback_register(struct nfct_handle *h,
633 enum nf_conntrack_msg_type type,
634 int (*cb)(enum nf_conntrack_msg_type type,
635 struct nf_expect *exp,
636 void *data),
637 void *data);
638
639extern void nfexp_callback_unregister(struct nfct_handle *h);
640
641/* register / unregister callback: extended version including netlink header */
642extern int nfexp_callback_register2(struct nfct_handle *h,
643 enum nf_conntrack_msg_type type,
644 int (*cb)(const struct nlmsghdr *nlh,
645 enum nf_conntrack_msg_type type,
646 struct nf_expect *exp,
647 void *data),
648 void *data);
649
650extern void nfexp_callback_unregister2(struct nfct_handle *h);
651
652/* setter */
653extern void nfexp_set_attr(struct nf_expect *exp,
654 const enum nf_expect_attr type,
655 const void *value);
656
657extern void nfexp_set_attr_u8(struct nf_expect *exp,
658 const enum nf_expect_attr type,
659 uint8_t value);
660
661extern void nfexp_set_attr_u16(struct nf_expect *exp,
662 const enum nf_expect_attr type,
663 uint16_t value);
664
665extern void nfexp_set_attr_u32(struct nf_expect *exp,
666 const enum nf_expect_attr type,
667 uint32_t value);
668
669/* getter */
670extern const void *nfexp_get_attr(const struct nf_expect *exp,
671 const enum nf_expect_attr type);
672
673extern uint8_t nfexp_get_attr_u8(const struct nf_expect *exp,
674 const enum nf_expect_attr type);
675
676extern uint16_t nfexp_get_attr_u16(const struct nf_expect *exp,
677 const enum nf_expect_attr type);
678
679extern uint32_t nfexp_get_attr_u32(const struct nf_expect *exp,
680 const enum nf_expect_attr type);
681
682/* checker */
683extern int nfexp_attr_is_set(const struct nf_expect *exp,
684 const enum nf_expect_attr type);
685
686/* unsetter */
687extern int nfexp_attr_unset(struct nf_expect *exp,
688 const enum nf_expect_attr type);
689
690/* query */
691extern int nfexp_query(struct nfct_handle *h,
692 const enum nf_conntrack_query qt,
693 const void *data);
694
695/* print */
696extern int nfexp_snprintf(char *buf,
697 unsigned int size,
698 const struct nf_expect *exp,
699 const unsigned int msg_type,
700 const unsigned int out_type,
701 const unsigned int out_flags);
702
703/* compare */
704extern int nfexp_cmp(const struct nf_expect *exp1,
705 const struct nf_expect *exp2,
706 unsigned int flags);
707
708extern int nfexp_send(struct nfct_handle *h,
709 const enum nf_conntrack_query qt,
710 const void *data);
711
712extern int nfexp_catch(struct nfct_handle *h);
713
714/* low level API */
715extern __attribute__((deprecated))
716int nfexp_build_expect(struct nfnl_subsys_handle *ssh,
717 void *req,
718 size_t size,
719 uint16_t type,
720 uint16_t flags,
721 const struct nf_expect *exp);
722
723extern __attribute__((deprecated))
724int nfexp_parse_expect(enum nf_conntrack_msg_type type,
725 const struct nlmsghdr *nlh,
726 struct nf_expect *exp);
727
728extern __attribute__((deprecated))
729int nfexp_build_query(struct nfnl_subsys_handle *ssh,
730 const enum nf_conntrack_query qt,
731 const void *data,
732 void *buffer,
733 unsigned int size);
734
735/* New low level API: netlink functions */
736
737extern int nfexp_nlmsg_build(struct nlmsghdr *nlh, const struct nf_expect *exp);
738extern int nfexp_nlmsg_parse(const struct nlmsghdr *nlh, struct nf_expect *exp);
739
740/*
741 * TCP flags
742 */
743
744/* Window scaling is advertised by the sender */
745#define IP_CT_TCP_FLAG_WINDOW_SCALE 0x01
746
747/* SACK is permitted by the sender */
748#define IP_CT_TCP_FLAG_SACK_PERM 0x02
749
750/* This sender sent FIN first */
751#define IP_CT_TCP_FLAG_CLOSE_INIT 0x04
752
753/* Be liberal in window checking */
754#define IP_CT_TCP_FLAG_BE_LIBERAL 0x08
755
756/* WARNING: do not use these constants in new applications, we keep them here
757 * to avoid breaking backward compatibility. */
758#define NFCT_DIR_ORIGINAL 0
759#define NFCT_DIR_REPLY 1
760#define NFCT_DIR_MAX NFCT_DIR_REPLY+1
761
762/* xt_helper uses a length size of 30 bytes, however, no helper name in
763 * the tree has exceeded 16 bytes length. Since 2.6.29, the maximum
764 * length accepted is 16 bytes, this limit is enforced during module load. */
765#define NFCT_HELPER_NAME_MAX 16
766
767#ifdef __cplusplus
768}
769#endif
770
771#endif /* _LIBNETFILTER_CONNTRACK_H_ */
void nfexp_callback_unregister(struct nfct_handle *h)
Definition: expect/api.c:198
void nfexp_callback_unregister2(struct nfct_handle *h)
Definition: expect/api.c:273
int nfct_callback_register(struct nfct_handle *h, enum nf_conntrack_msg_type type, int(*cb)(enum nf_conntrack_msg_type type, struct nf_conntrack *ct, void *data), void *data)
int nfexp_callback_register2(struct nfct_handle *h, enum nf_conntrack_msg_type type, int(*cb)(const struct nlmsghdr *nlh, enum nf_conntrack_msg_type type, struct nf_expect *exp, void *data), void *data)
Definition: expect/api.c:232
struct nfct_handle * nfct_open(uint8_t, unsigned)
Definition: main.c:84
void nfct_callback_unregister2(struct nfct_handle *h)
int nfct_close(struct nfct_handle *cth)
Definition: main.c:105
void nfct_callback_unregister(struct nfct_handle *h)
int nfct_callback_register2(struct nfct_handle *h, enum nf_conntrack_msg_type type, int(*cb)(const struct nlmsghdr *nlh, enum nf_conntrack_msg_type type, struct nf_conntrack *ct, void *data), void *data)
int nfexp_callback_register(struct nfct_handle *h, enum nf_conntrack_msg_type type, int(*cb)(enum nf_conntrack_msg_type type, struct nf_expect *exp, void *data), void *data)
Definition: expect/api.c:158
int nfct_fd(struct nfct_handle *cth)
Definition: main.c:144
void nfct_filter_destroy(struct nfct_filter *filter)
int nfct_filter_detach(int fd)
int nfct_filter_set_logic(struct nfct_filter *filter, const enum nfct_filter_attr attr, const enum nfct_filter_logic logic)
int nfct_filter_attach(int fd, struct nfct_filter *filter)
void nfct_filter_add_attr_u32(struct nfct_filter *filter, const enum nfct_filter_attr attr, const uint32_t value)
void nfct_filter_add_attr(struct nfct_filter *filter, const enum nfct_filter_attr attr, const void *value)
struct nfct_filter * nfct_filter_create(void)
int nfexp_catch(struct nfct_handle *h)
Definition: expect/api.c:760
int nfct_send(struct nfct_handle *h, const enum nf_conntrack_query query, const void *data)
int nfct_catch(struct nfct_handle *h)
int nfexp_send(struct nfct_handle *h, const enum nf_conntrack_query qt, const void *data)
Definition: expect/api.c:727
int nfexp_query(struct nfct_handle *h, const enum nf_conntrack_query qt, const void *data)
Definition: expect/api.c:695
int nfct_query(struct nfct_handle *h, const enum nf_conntrack_query query, const void *data)
size_t nfct_sizeof(const struct nf_conntrack *ct)
int nfct_snprintf_labels(char *buf, unsigned int size, const struct nf_conntrack *ct, const unsigned int msg_type, const unsigned int out_type, const unsigned int out_flags, struct nfct_labelmap *map)
void nfct_set_attr_u32(struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint32_t value)
void nfct_destroy(struct nf_conntrack *ct)
Definition: conntrack/api.c:93
void nfct_copy_attr(struct nf_conntrack *ct1, const struct nf_conntrack *ct2, const enum nf_conntrack_attr type)
void nfct_set_attr(struct nf_conntrack *ct, const enum nf_conntrack_attr type, const void *value)
int nfct_attr_grp_unset(struct nf_conntrack *ct, const enum nf_conntrack_attr_grp type)
uint64_t nfct_get_attr_u64(const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
int nfct_setobjopt(struct nf_conntrack *ct, unsigned int option)
int nfct_get_attr_grp(const struct nf_conntrack *ct, const enum nf_conntrack_attr_grp type, void *data)
void nfct_set_attr_grp(struct nf_conntrack *ct, const enum nf_conntrack_attr_grp type, const void *value)
const void * nfct_get_attr(const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
int nfct_attr_is_set_array(const struct nf_conntrack *ct, const enum nf_conntrack_attr *type_array, int size)
int nfct_attr_unset(struct nf_conntrack *ct, const enum nf_conntrack_attr type)
void nfct_copy(struct nf_conntrack *dest, const struct nf_conntrack *source, unsigned int flags)
uint16_t nfct_get_attr_u16(const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
int nfct_attr_grp_is_set(const struct nf_conntrack *ct, const enum nf_conntrack_attr_grp type)
int nfct_cmp(const struct nf_conntrack *ct1, const struct nf_conntrack *ct2, unsigned int flags)
void nfct_set_attr_u16(struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint16_t value)
uint32_t nfct_get_attr_u32(const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
void nfct_set_attr_u8(struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint8_t value)
void nfct_set_attr_u64(struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint64_t value)
void nfct_set_attr_l(struct nf_conntrack *ct, const enum nf_conntrack_attr type, const void *value, size_t len)
int nfct_snprintf(char *buf, unsigned int size, const struct nf_conntrack *ct, const unsigned int msg_type, const unsigned int out_type, const unsigned int out_flags)
size_t nfct_maxsize(void)
int nfct_attr_is_set(const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
int nfct_getobjopt(const struct nf_conntrack *ct, unsigned int option)
int nfct_compare(const struct nf_conntrack *ct1, const struct nf_conntrack *ct2)
uint8_t nfct_get_attr_u8(const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
struct nf_conntrack * nfct_new(void)
Definition: conntrack/api.c:76
struct nf_conntrack * nfct_clone(const struct nf_conntrack *ct)
void nfct_filter_dump_set_attr_u8(struct nfct_filter_dump *filter_dump, const enum nfct_filter_dump_attr type, uint8_t data)
struct nfct_filter_dump * nfct_filter_dump_create(void)
void nfct_filter_dump_destroy(struct nfct_filter_dump *filter)
void nfct_filter_dump_set_attr(struct nfct_filter_dump *filter_dump, const enum nfct_filter_dump_attr type, const void *data)
void nfexp_set_attr_u32(struct nf_expect *exp, const enum nf_expect_attr type, uint32_t value)
Definition: expect/api.c:357
struct nf_expect * nfexp_new(void)
Definition: expect/api.c:29
uint32_t nfexp_get_attr_u32(const struct nf_expect *exp, const enum nf_expect_attr type)
Definition: expect/api.c:431
size_t nfexp_sizeof(const struct nf_expect *exp)
Definition: expect/api.c:57
const void * nfexp_get_attr(const struct nf_expect *exp, const enum nf_expect_attr type)
Definition: expect/api.c:372
void nfexp_set_attr_u16(struct nf_expect *exp, const enum nf_expect_attr type, uint16_t value)
Definition: expect/api.c:344
void nfexp_set_attr(struct nf_expect *exp, const enum nf_expect_attr type, const void *value)
Definition: expect/api.c:309
int nfexp_cmp(const struct nf_expect *exp1, const struct nf_expect *exp2, unsigned int flags)
Definition: expect/api.c:127
uint16_t nfexp_get_attr_u16(const struct nf_expect *exp, const enum nf_expect_attr type)
Definition: expect/api.c:415
void nfexp_set_attr_u8(struct nf_expect *exp, const enum nf_expect_attr type, uint8_t value)
Definition: expect/api.c:331
uint8_t nfexp_get_attr_u8(const struct nf_expect *exp, const enum nf_expect_attr type)
Definition: expect/api.c:399
int nfexp_snprintf(char *buf, unsigned int size, const struct nf_expect *exp, const unsigned int msg_type, const unsigned int out_type, const unsigned int out_flags)
Definition: expect/api.c:802
void nfexp_destroy(struct nf_expect *exp)
Definition: expect/api.c:46
int nfexp_attr_unset(struct nf_expect *exp, const enum nf_expect_attr type)
Definition: expect/api.c:466
struct nf_expect * nfexp_clone(const struct nf_expect *exp)
Definition: expect/api.c:89
int nfexp_attr_is_set(const struct nf_expect *exp, const enum nf_expect_attr type)
Definition: expect/api.c:446
size_t nfexp_maxsize(void)
Definition: expect/api.c:77
const char * nfct_labels_get_path(void)
void nfct_labelmap_destroy(struct nfct_labelmap *map)
const char * nfct_labelmap_get_name(struct nfct_labelmap *m, unsigned int bit)
struct nfct_labelmap * nfct_labelmap_new(const char *mapfile)
int nfct_labelmap_get_bit(struct nfct_labelmap *m, const char *name)
int nfexp_build_query(struct nfnl_subsys_handle *ssh, const enum nf_conntrack_query qt, const void *data, void *buffer, unsigned int size)
Definition: expect/api.c:609
int nfct_parse_conntrack(enum nf_conntrack_msg_type type, const struct nlmsghdr *nlh, struct nf_conntrack *ct)
int nfexp_build_expect(struct nfnl_subsys_handle *ssh, void *req, size_t size, uint16_t type, uint16_t flags, const struct nf_expect *exp)
Definition: expect/api.c:505
int nfct_build_conntrack(struct nfnl_subsys_handle *ssh, void *req, size_t size, uint16_t type, uint16_t flags, const struct nf_conntrack *ct)
int nfexp_parse_expect(enum nf_conntrack_msg_type type, const struct nlmsghdr *nlh, struct nf_expect *exp)
Definition: expect/api.c:659
int nfct_build_query(struct nfnl_subsys_handle *ssh, const enum nf_conntrack_query qt, const void *data, void *buffer, unsigned int size)