LXR linux/include/linux/netfilter/nf_conntrack

   1#ifndef _NF_CONNTRACK_COMMON_H
   2#define _NF_CONNTRACK_COMMON_H
   3/* Connection state tracking for netfilter.  This is separated from,
   4   but required by, the NAT layer; it can also be used by an iptables
   5   extension. */
   6enum ip_conntrack_info
   7{
   8        /* Part of an established connection (either direction). */
   9        IP_CT_ESTABLISHED,
  10
  11        /* Like NEW, but related to an existing connection, or ICMP error
  12           (in either direction). */
  13        IP_CT_RELATED,
  14
  15        /* Started a new connection to track (only
  16           IP_CT_DIR_ORIGINAL); may be a retransmission. */
  17        IP_CT_NEW,
  18
  19        /* >= this indicates reply direction */
  20        IP_CT_IS_REPLY,
  21
  22        /* Number of distinct IP_CT types (no NEW in reply dirn). */
  23        IP_CT_NUMBER = IP_CT_IS_REPLY * 2 - 1
  24};
  25
  26/* Bitset representing status of connection. */
  27enum ip_conntrack_status {
  28        /* It's an expected connection: bit 0 set.  This bit never changed */
  29        IPS_EXPECTED_BIT = 0,
  30        IPS_EXPECTED = (1 << IPS_EXPECTED_BIT),
  31
  32        /* We've seen packets both ways: bit 1 set.  Can be set, not unset. */
  33        IPS_SEEN_REPLY_BIT = 1,
  34        IPS_SEEN_REPLY = (1 << IPS_SEEN_REPLY_BIT),
  35
  36        /* Conntrack should never be early-expired. */
  37        IPS_ASSURED_BIT = 2,
  38        IPS_ASSURED = (1 << IPS_ASSURED_BIT),
  39
  40        /* Connection is confirmed: originating packet has left box */
  41        IPS_CONFIRMED_BIT = 3,
  42        IPS_CONFIRMED = (1 << IPS_CONFIRMED_BIT),
  43
  44        /* Connection needs src nat in orig dir.  This bit never changed. */
  45        IPS_SRC_NAT_BIT = 4,
  46        IPS_SRC_NAT = (1 << IPS_SRC_NAT_BIT),
  47
  48        /* Connection needs dst nat in orig dir.  This bit never changed. */
  49        IPS_DST_NAT_BIT = 5,
  50        IPS_DST_NAT = (1 << IPS_DST_NAT_BIT),
  51
  52        /* Both together. */
  53        IPS_NAT_MASK = (IPS_DST_NAT | IPS_SRC_NAT),
  54
  55        /* Connection needs TCP sequence adjusted. */
  56        IPS_SEQ_ADJUST_BIT = 6,
  57        IPS_SEQ_ADJUST = (1 << IPS_SEQ_ADJUST_BIT),
  58
  59        /* NAT initialization bits. */
  60        IPS_SRC_NAT_DONE_BIT = 7,
  61        IPS_SRC_NAT_DONE = (1 << IPS_SRC_NAT_DONE_BIT),
  62
  63        IPS_DST_NAT_DONE_BIT = 8,
  64        IPS_DST_NAT_DONE = (1 << IPS_DST_NAT_DONE_BIT),
  65
  66        /* Both together */
  67        IPS_NAT_DONE_MASK = (IPS_DST_NAT_DONE | IPS_SRC_NAT_DONE),
  68
  69        /* Connection is dying (removed from lists), can not be unset. */
  70        IPS_DYING_BIT = 9,
  71        IPS_DYING = (1 << IPS_DYING_BIT),
  72
  73        /* Connection has fixed timeout. */
  74        IPS_FIXED_TIMEOUT_BIT = 10,
  75        IPS_FIXED_TIMEOUT = (1 << IPS_FIXED_TIMEOUT_BIT),
  76};
  77
  78#ifdef __KERNEL__
  79struct ip_conntrack_stat
  80{
  81        unsigned int searched;
  82        unsigned int found;
  83        unsigned int new;
  84        unsigned int invalid;
  85        unsigned int ignore;
  86        unsigned int delete;
  87        unsigned int delete_list;
  88        unsigned int insert;
  89        unsigned int insert_failed;
  90        unsigned int drop;
  91        unsigned int early_drop;
  92        unsigned int error;
  93        unsigned int expect_new;
  94        unsigned int expect_create;
  95        unsigned int expect_delete;
  96};
  97
  98/* call to create an explicit dependency on nf_conntrack. */
  99extern void need_conntrack(void);
 100
 101#endif /* __KERNEL__ */
 102
 103#endif /* _NF_CONNTRACK_COMMON_H */
 104