libnetfilter_conntrack.h
/*
* (C) 2005-2011 by Pablo Neira Ayuso <pablo@netfilter.org>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*/
#ifndef _LIBNETFILTER_CONNTRACK_H_
#define _LIBNETFILTER_CONNTRACK_H_
#include <stdbool.h>
#include <netinet/in.h>
#include <libnfnetlink/linux_nfnetlink.h>
#include <libnfnetlink/libnfnetlink.h>
#include <libnetfilter_conntrack/linux_nfnetlink_conntrack.h>
#include <libnetfilter_conntrack/linux_nf_conntrack_common.h>
#ifdef __cplusplus
extern "C" {
#endif
enum {
CONNTRACK = NFNL_SUBSYS_CTNETLINK,
EXPECT = NFNL_SUBSYS_CTNETLINK_EXP
};
/*
* Subscribe to all possible conntrack event groups. Use this
* flag in case that you want to catch up all the possible
* events. Do not use this flag for dumping or any other
* similar operation.
*/
#define NFCT_ALL_CT_GROUPS (NF_NETLINK_CONNTRACK_NEW|NF_NETLINK_CONNTRACK_UPDATE|NF_NETLINK_CONNTRACK_DESTROY)
struct nfct_handle;
/*
* [Open|close] a conntrack handler
*/
extern struct nfct_handle *nfct_open(uint8_t, unsigned);
extern struct nfct_handle *nfct_open_nfnl(struct nfnl_handle *nfnlh,
uint8_t subsys_id,
unsigned int subscriptions);
extern int nfct_close(struct nfct_handle *cth);
extern int nfct_fd(struct nfct_handle *cth);
extern const struct nfnl_handle *nfct_nfnlh(struct nfct_handle *cth);
/*
* NEW libnetfilter_conntrack API
*/
/* high level API */
#include <sys/types.h>
/* conntrack object */
struct nf_conntrack;
/* conntrack attributes */
enum nf_conntrack_attr {
ATTR_ORIG_IPV4_SRC = 0, /* u32 bits */
ATTR_IPV4_SRC = ATTR_ORIG_IPV4_SRC, /* alias */
ATTR_ORIG_IPV4_DST, /* u32 bits */
ATTR_IPV4_DST = ATTR_ORIG_IPV4_DST, /* alias */
ATTR_REPL_IPV4_SRC, /* u32 bits */
ATTR_REPL_IPV4_DST, /* u32 bits */
ATTR_ORIG_IPV6_SRC = 4, /* u128 bits */
ATTR_IPV6_SRC = ATTR_ORIG_IPV6_SRC, /* alias */
ATTR_ORIG_IPV6_DST, /* u128 bits */
ATTR_IPV6_DST = ATTR_ORIG_IPV6_DST, /* alias */
ATTR_REPL_IPV6_SRC, /* u128 bits */
ATTR_REPL_IPV6_DST, /* u128 bits */
ATTR_ORIG_PORT_SRC = 8, /* u16 bits */
ATTR_PORT_SRC = ATTR_ORIG_PORT_SRC, /* alias */
ATTR_ORIG_PORT_DST, /* u16 bits */
ATTR_PORT_DST = ATTR_ORIG_PORT_DST, /* alias */
ATTR_REPL_PORT_SRC, /* u16 bits */
ATTR_REPL_PORT_DST, /* u16 bits */
ATTR_ICMP_TYPE = 12, /* u8 bits */
ATTR_ICMP_CODE, /* u8 bits */
ATTR_ICMP_ID, /* u16 bits */
ATTR_ORIG_L3PROTO, /* u8 bits */
ATTR_L3PROTO = ATTR_ORIG_L3PROTO, /* alias */
ATTR_REPL_L3PROTO = 16, /* u8 bits */
ATTR_ORIG_L4PROTO, /* u8 bits */
ATTR_L4PROTO = ATTR_ORIG_L4PROTO, /* alias */
ATTR_REPL_L4PROTO, /* u8 bits */
ATTR_TCP_STATE, /* u8 bits */
ATTR_SNAT_IPV4 = 20, /* u32 bits */
ATTR_DNAT_IPV4, /* u32 bits */
ATTR_SNAT_PORT, /* u16 bits */
ATTR_DNAT_PORT, /* u16 bits */
ATTR_TIMEOUT = 24, /* u32 bits */
ATTR_MARK, /* u32 bits */
ATTR_ORIG_COUNTER_PACKETS, /* u64 bits */
ATTR_REPL_COUNTER_PACKETS, /* u64 bits */
ATTR_ORIG_COUNTER_BYTES = 28, /* u64 bits */
ATTR_REPL_COUNTER_BYTES, /* u64 bits */
ATTR_USE, /* u32 bits */
ATTR_ID, /* u32 bits */
ATTR_STATUS = 32, /* u32 bits */
ATTR_TCP_FLAGS_ORIG, /* u8 bits */
ATTR_TCP_FLAGS_REPL, /* u8 bits */
ATTR_TCP_MASK_ORIG, /* u8 bits */
ATTR_TCP_MASK_REPL = 36, /* u8 bits */
ATTR_MASTER_IPV4_SRC, /* u32 bits */
ATTR_MASTER_IPV4_DST, /* u32 bits */
ATTR_MASTER_IPV6_SRC, /* u128 bits */
ATTR_MASTER_IPV6_DST = 40, /* u128 bits */
ATTR_MASTER_PORT_SRC, /* u16 bits */
ATTR_MASTER_PORT_DST, /* u16 bits */
ATTR_MASTER_L3PROTO, /* u8 bits */
ATTR_MASTER_L4PROTO = 44, /* u8 bits */
ATTR_SECMARK, /* u32 bits */
ATTR_ORIG_NAT_SEQ_CORRECTION_POS, /* u32 bits */
ATTR_ORIG_NAT_SEQ_OFFSET_BEFORE, /* u32 bits */
ATTR_ORIG_NAT_SEQ_OFFSET_AFTER = 48, /* u32 bits */
ATTR_REPL_NAT_SEQ_CORRECTION_POS, /* u32 bits */
ATTR_REPL_NAT_SEQ_OFFSET_BEFORE, /* u32 bits */
ATTR_REPL_NAT_SEQ_OFFSET_AFTER, /* u32 bits */
ATTR_SCTP_STATE = 52, /* u8 bits */
ATTR_SCTP_VTAG_ORIG, /* u32 bits */
ATTR_SCTP_VTAG_REPL, /* u32 bits */
ATTR_HELPER_NAME, /* string (30 bytes max) */
ATTR_DCCP_STATE = 56, /* u8 bits */
ATTR_DCCP_ROLE, /* u8 bits */
ATTR_DCCP_HANDSHAKE_SEQ, /* u64 bits */
ATTR_TCP_WSCALE_ORIG, /* u8 bits */
ATTR_TCP_WSCALE_REPL = 60, /* u8 bits */
ATTR_ZONE, /* u16 bits */
ATTR_SECCTX, /* string */
ATTR_TIMESTAMP_START, /* u64 bits, linux >= 2.6.38 */
ATTR_TIMESTAMP_STOP = 64, /* u64 bits, linux >= 2.6.38 */
ATTR_HELPER_INFO, /* variable length */
ATTR_CONNLABELS, /* variable length */
ATTR_CONNLABELS_MASK, /* variable length */
ATTR_ORIG_ZONE = 68, /* u16 bits */
ATTR_REPL_ZONE, /* u16 bits */
ATTR_SNAT_IPV6, /* u128 bits */
ATTR_DNAT_IPV6, /* u128 bits */
ATTR_SYNPROXY_ISN = 72, /* u32 bits */
ATTR_SYNPROXY_ITS, /* u32 bits */
ATTR_SYNPROXY_TSOFF, /* u32 bits */
ATTR_TIMESTAMP_EVENT, /* u64 bits */
ATTR_MAX
};
/* conntrack attribute groups */
enum nf_conntrack_attr_grp {
ATTR_GRP_ORIG_IPV4 = 0, /* struct nfct_attr_grp_ipv4 */
ATTR_GRP_REPL_IPV4, /* struct nfct_attr_grp_ipv4 */
ATTR_GRP_ORIG_IPV6, /* struct nfct_attr_grp_ipv6 */
ATTR_GRP_REPL_IPV6, /* struct nfct_attr_grp_ipv6 */
ATTR_GRP_ORIG_PORT = 4, /* struct nfct_attr_grp_port */
ATTR_GRP_REPL_PORT, /* struct nfct_attr_grp_port */
ATTR_GRP_ICMP, /* struct nfct_attr_grp_icmp */
ATTR_GRP_MASTER_IPV4, /* struct nfct_attr_grp_ipv4 */
ATTR_GRP_MASTER_IPV6 = 8, /* struct nfct_attr_grp_ipv6 */
ATTR_GRP_MASTER_PORT, /* struct nfct_attr_grp_port */
ATTR_GRP_ORIG_COUNTERS, /* struct nfct_attr_grp_ctrs */
ATTR_GRP_REPL_COUNTERS, /* struct nfct_attr_grp_ctrs */
ATTR_GRP_ORIG_ADDR_SRC = 12, /* union nfct_attr_grp_addr */
ATTR_GRP_ORIG_ADDR_DST, /* union nfct_attr_grp_addr */
ATTR_GRP_REPL_ADDR_SRC, /* union nfct_attr_grp_addr */
ATTR_GRP_REPL_ADDR_DST, /* union nfct_attr_grp_addr */
ATTR_GRP_MAX
};
struct nfct_attr_grp_ipv4 {
uint32_t src, dst;
};
struct nfct_attr_grp_ipv6 {
uint32_t src[4], dst[4];
};
struct nfct_attr_grp_port {
uint16_t sport, dport;
};
struct nfct_attr_grp_icmp {
uint16_t id;
uint8_t code, type;
};
struct nfct_attr_grp_ctrs {
uint64_t packets;
uint64_t bytes;
};
union nfct_attr_grp_addr {
uint32_t ip;
uint32_t ip6[4];
uint32_t addr[4];
};
/* message type */
enum nf_conntrack_msg_type {
NFCT_T_UNKNOWN = 0,
NFCT_T_NEW_BIT = 0,
NFCT_T_NEW = (1 << NFCT_T_NEW_BIT),
NFCT_T_UPDATE_BIT = 1,
NFCT_T_UPDATE = (1 << NFCT_T_UPDATE_BIT),
NFCT_T_DESTROY_BIT = 2,
NFCT_T_DESTROY = (1 << NFCT_T_DESTROY_BIT),
NFCT_T_ALL = NFCT_T_NEW | NFCT_T_UPDATE | NFCT_T_DESTROY,
NFCT_T_ERROR_BIT = 31,
NFCT_T_ERROR = (1 << NFCT_T_ERROR_BIT),
};
/* constructor / destructor */
extern struct nf_conntrack *nfct_new(void);
extern void nfct_destroy(struct nf_conntrack *ct);
/* clone */
struct nf_conntrack *nfct_clone(const struct nf_conntrack *ct);
/* object size */
extern __attribute__((deprecated)) size_t nfct_sizeof(const struct nf_conntrack *ct);
/* maximum object size */
extern __attribute__((deprecated)) size_t nfct_maxsize(void);
/* set option */
enum {
NFCT_SOPT_UNDO_SNAT,
NFCT_SOPT_UNDO_DNAT,
NFCT_SOPT_UNDO_SPAT,
NFCT_SOPT_UNDO_DPAT,
NFCT_SOPT_SETUP_ORIGINAL,
NFCT_SOPT_SETUP_REPLY,
__NFCT_SOPT_MAX,
};
#define NFCT_SOPT_MAX (__NFCT_SOPT_MAX - 1)
/* get option */
enum {
NFCT_GOPT_IS_SNAT,
NFCT_GOPT_IS_DNAT,
NFCT_GOPT_IS_SPAT,
NFCT_GOPT_IS_DPAT,
__NFCT_GOPT_MAX,
};
#define NFCT_GOPT_MAX (__NFCT_GOPT_MAX - 1)
extern int nfct_setobjopt(struct nf_conntrack *ct, unsigned int option);
extern int nfct_getobjopt(const struct nf_conntrack *ct, unsigned int option);
/* register / unregister callback */
extern int nfct_callback_register(struct nfct_handle *h,
enum nf_conntrack_msg_type type,
int (*cb)(enum nf_conntrack_msg_type type,
struct nf_conntrack *ct,
void *data),
void *data);
extern void nfct_callback_unregister(struct nfct_handle *h);
/* register / unregister callback: extended version including netlink header */
extern int nfct_callback_register2(struct nfct_handle *h,
enum nf_conntrack_msg_type type,
int (*cb)(const struct nlmsghdr *nlh,
enum nf_conntrack_msg_type type,
struct nf_conntrack *ct,
void *data),
void *data);
extern void nfct_callback_unregister2(struct nfct_handle *h);
/* callback verdict */
enum {
NFCT_CB_FAILURE = -1, /* failure */
NFCT_CB_STOP = 0, /* stop the query */
NFCT_CB_CONTINUE = 1, /* keep iterating through data */
NFCT_CB_STOLEN = 2, /* like continue, but ct is not freed */
};
/* bitmask setter/getter */
struct nfct_bitmask;
struct nfct_bitmask *nfct_bitmask_new(unsigned int maxbit);
struct nfct_bitmask *nfct_bitmask_clone(const struct nfct_bitmask *);
unsigned int nfct_bitmask_maxbit(const struct nfct_bitmask *);
void nfct_bitmask_set_bit(struct nfct_bitmask *, unsigned int bit);
int nfct_bitmask_test_bit(const struct nfct_bitmask *, unsigned int bit);
void nfct_bitmask_unset_bit(struct nfct_bitmask *, unsigned int bit);
void nfct_bitmask_destroy(struct nfct_bitmask *);
void nfct_bitmask_clear(struct nfct_bitmask *);
bool nfct_bitmask_equal(const struct nfct_bitmask *, const struct nfct_bitmask *);
/* connlabel name <-> bit translation mapping */
struct nfct_labelmap;
const char *nfct_labels_get_path(void);
struct nfct_labelmap *nfct_labelmap_new(const char *mapfile);
void nfct_labelmap_destroy(struct nfct_labelmap *map);
const char *nfct_labelmap_get_name(struct nfct_labelmap *m, unsigned int bit);
int nfct_labelmap_get_bit(struct nfct_labelmap *m, const char *name);
/* setter */
extern void nfct_set_attr(struct nf_conntrack *ct,
const enum nf_conntrack_attr type,
const void *value);
extern void nfct_set_attr_u8(struct nf_conntrack *ct,
const enum nf_conntrack_attr type,
uint8_t value);
extern void nfct_set_attr_u16(struct nf_conntrack *ct,
const enum nf_conntrack_attr type,
uint16_t value);
extern void nfct_set_attr_u32(struct nf_conntrack *ct,
const enum nf_conntrack_attr type,
uint32_t value);
extern void nfct_set_attr_u64(struct nf_conntrack *ct,
const enum nf_conntrack_attr type,
uint64_t value);
extern void nfct_set_attr_l(struct nf_conntrack *ct,
const enum nf_conntrack_attr type,
const void *value,
size_t len);
/* getter */
extern const void *nfct_get_attr(const struct nf_conntrack *ct,
const enum nf_conntrack_attr type);
extern uint8_t nfct_get_attr_u8(const struct nf_conntrack *ct,
const enum nf_conntrack_attr type);
extern uint16_t nfct_get_attr_u16(const struct nf_conntrack *ct,
const enum nf_conntrack_attr type);
extern uint32_t nfct_get_attr_u32(const struct nf_conntrack *ct,
const enum nf_conntrack_attr type);
extern uint64_t nfct_get_attr_u64(const struct nf_conntrack *ct,
const enum nf_conntrack_attr type);
/* checker */
extern int nfct_attr_is_set(const struct nf_conntrack *ct,
const enum nf_conntrack_attr type);
extern int nfct_attr_is_set_array(const struct nf_conntrack *ct,
const enum nf_conntrack_attr *type_array,
int size);
/* unsetter */
extern int nfct_attr_unset(struct nf_conntrack *ct,
const enum nf_conntrack_attr type);
/* group setter */
extern void nfct_set_attr_grp(struct nf_conntrack *ct,
const enum nf_conntrack_attr_grp type,
const void *value);
/* group getter */
extern int nfct_get_attr_grp(const struct nf_conntrack *ct,
const enum nf_conntrack_attr_grp type,
void *data);
/* group checker */
extern int nfct_attr_grp_is_set(const struct nf_conntrack *ct,
const enum nf_conntrack_attr_grp type);
/* unsetter */
extern int nfct_attr_grp_unset(struct nf_conntrack *ct,
const enum nf_conntrack_attr_grp type);
/* print */
/* output type */
enum {
NFCT_O_PLAIN,
NFCT_O_DEFAULT = NFCT_O_PLAIN,
NFCT_O_XML,
NFCT_O_MAX
};
/* output flags */
enum {
NFCT_OF_SHOW_LAYER3_BIT = 0,
NFCT_OF_SHOW_LAYER3 = (1 << NFCT_OF_SHOW_LAYER3_BIT),
NFCT_OF_TIME_BIT = 1,
NFCT_OF_TIME = (1 << NFCT_OF_TIME_BIT),
NFCT_OF_ID_BIT = 2,
NFCT_OF_ID = (1 << NFCT_OF_ID_BIT),
NFCT_OF_TIMESTAMP_BIT = 3,
NFCT_OF_TIMESTAMP = (1 << NFCT_OF_TIMESTAMP_BIT),
};
extern int nfct_snprintf(char *buf,
unsigned int size,
const struct nf_conntrack *ct,
const unsigned int msg_type,
const unsigned int out_type,
const unsigned int out_flags);
extern int nfct_snprintf_labels(char *buf,
unsigned int size,
const struct nf_conntrack *ct,
const unsigned int msg_type,
const unsigned int out_type,
const unsigned int out_flags,
struct nfct_labelmap *map);
/* comparison */
extern int nfct_compare(const struct nf_conntrack *ct1,
const struct nf_conntrack *ct2);
enum {
NFCT_CMP_ALL = 0,
NFCT_CMP_ORIG = (1 << 0),
NFCT_CMP_REPL = (1 << 1),
NFCT_CMP_TIMEOUT_EQ = (1 << 2),
NFCT_CMP_TIMEOUT_GT = (1 << 3),
NFCT_CMP_TIMEOUT_GE = (NFCT_CMP_TIMEOUT_EQ | NFCT_CMP_TIMEOUT_GT),
NFCT_CMP_TIMEOUT_LT = (1 << 4),
NFCT_CMP_TIMEOUT_LE = (NFCT_CMP_TIMEOUT_EQ | NFCT_CMP_TIMEOUT_LT),
NFCT_CMP_MASK = (1 << 5),
NFCT_CMP_STRICT = (1 << 6),
};
extern int nfct_cmp(const struct nf_conntrack *ct1,
const struct nf_conntrack *ct2,
unsigned int flags);
/* query */
enum nf_conntrack_query {
NFCT_Q_CREATE,
NFCT_Q_UPDATE,
NFCT_Q_DESTROY,
NFCT_Q_GET,
NFCT_Q_FLUSH,
NFCT_Q_DUMP,
NFCT_Q_DUMP_RESET,
NFCT_Q_CREATE_UPDATE,
NFCT_Q_DUMP_FILTER,
NFCT_Q_DUMP_FILTER_RESET,
NFCT_Q_FLUSH_FILTER,
};
extern int nfct_query(struct nfct_handle *h,
const enum nf_conntrack_query query,
const void *data);
extern int nfct_send(struct nfct_handle *h,
const enum nf_conntrack_query query,
const void *data);
extern int nfct_catch(struct nfct_handle *h);
/* copy */
enum {
NFCT_CP_ALL = 0,
NFCT_CP_ORIG = (1 << 0),
NFCT_CP_REPL = (1 << 1),
NFCT_CP_META = (1 << 2),
NFCT_CP_OVERRIDE = (1 << 3),
};
extern void nfct_copy(struct nf_conntrack *dest,
const struct nf_conntrack *source,
unsigned int flags);
extern void nfct_copy_attr(struct nf_conntrack *ct1,
const struct nf_conntrack *ct2,
const enum nf_conntrack_attr type);
/* event filtering */
struct nfct_filter;
extern struct nfct_filter *nfct_filter_create(void);
extern void nfct_filter_destroy(struct nfct_filter *filter);
struct nfct_filter_proto {
uint16_t proto;
uint16_t state;
};
struct nfct_filter_ipv4 {
uint32_t addr;
uint32_t mask;
};
struct nfct_filter_ipv6 {
uint32_t addr[4];
uint32_t mask[4];
};
enum nfct_filter_attr {
NFCT_FILTER_L4PROTO = 0, /* uint32_t */
NFCT_FILTER_L4PROTO_STATE, /* struct nfct_filter_proto */
NFCT_FILTER_SRC_IPV4, /* struct nfct_filter_ipv4 */
NFCT_FILTER_DST_IPV4, /* struct nfct_filter_ipv4 */
NFCT_FILTER_SRC_IPV6, /* struct nfct_filter_ipv6 */
NFCT_FILTER_DST_IPV6, /* struct nfct_filter_ipv6 */
NFCT_FILTER_MARK, /* struct nfct_filter_dump_mark */
NFCT_FILTER_ZONE, /* uint16_t */
NFCT_FILTER_MAX
};
extern void nfct_filter_add_attr(struct nfct_filter *filter,
const enum nfct_filter_attr attr,
const void *value);
extern void nfct_filter_add_attr_u32(struct nfct_filter *filter,
const enum nfct_filter_attr attr,
const uint32_t value);
enum nfct_filter_logic {
NFCT_FILTER_LOGIC_POSITIVE,
NFCT_FILTER_LOGIC_NEGATIVE,
NFCT_FILTER_LOGIC_MAX
};
extern int nfct_filter_set_logic(struct nfct_filter *filter,
const enum nfct_filter_attr attr,
const enum nfct_filter_logic logic);
extern int nfct_filter_attach(int fd, struct nfct_filter *filter);
extern int nfct_filter_detach(int fd);
/* dump filtering */
struct nfct_filter_dump;
struct nfct_filter_dump_mark {
uint32_t val;
uint32_t mask;
};
enum nfct_filter_dump_attr {
NFCT_FILTER_DUMP_MARK = 0, /* struct nfct_filter_dump_mark */
NFCT_FILTER_DUMP_L3NUM, /* uint8_t */
NFCT_FILTER_DUMP_STATUS, /* struct nfct_filter_dump_mark */
NFCT_FILTER_DUMP_ZONE, /* uint16_t */
NFCT_FILTER_DUMP_TUPLE,
NFCT_FILTER_DUMP_MAX
};
struct nfct_filter_dump *nfct_filter_dump_create(void);
void nfct_filter_dump_destroy(struct nfct_filter_dump *filter);
void nfct_filter_dump_set_attr(struct nfct_filter_dump *filter_dump,
const enum nfct_filter_dump_attr type,
const void *data);
void nfct_filter_dump_set_attr_u8(struct nfct_filter_dump *filter_dump,
const enum nfct_filter_dump_attr type,
uint8_t data);
void nfct_filter_dump_set_attr_u16(struct nfct_filter_dump *filter_dump,
const enum nfct_filter_dump_attr type,
uint16_t data);
/* low level API: netlink functions */
extern __attribute__((deprecated)) int
nfct_build_conntrack(struct nfnl_subsys_handle *ssh,
void *req,
size_t size,
uint16_t type,
uint16_t flags,
const struct nf_conntrack *ct);
extern __attribute__((deprecated))
int nfct_parse_conntrack(enum nf_conntrack_msg_type msg,
const struct nlmsghdr *nlh,
struct nf_conntrack *ct);
extern __attribute__((deprecated))
int nfct_build_query(struct nfnl_subsys_handle *ssh,
const enum nf_conntrack_query query,
const void *data,
void *req,
unsigned int size);
/* New low level API: netlink functions */
extern int nfct_nlmsg_build(struct nlmsghdr *nlh, const struct nf_conntrack *ct);
extern int nfct_nlmsg_build_filter(struct nlmsghdr *nlh, const struct nfct_filter_dump *filter_dump);
extern int nfct_nlmsg_parse(const struct nlmsghdr *nlh, struct nf_conntrack *ct);
extern int nfct_payload_parse(const void *payload, size_t payload_len, uint16_t l3num, struct nf_conntrack *ct);
/*
* NEW expectation API
*/
/* expectation object */
struct nf_expect;
/* expect attributes */
enum nf_expect_attr {
ATTR_EXP_MASTER = 0, /* pointer to conntrack object */
ATTR_EXP_EXPECTED, /* pointer to conntrack object */
ATTR_EXP_MASK, /* pointer to conntrack object */
ATTR_EXP_TIMEOUT, /* u32 bits */
ATTR_EXP_ZONE, /* u16 bits */
ATTR_EXP_FLAGS, /* u32 bits */
ATTR_EXP_HELPER_NAME, /* string (16 bytes max) */
ATTR_EXP_CLASS, /* u32 bits */
ATTR_EXP_NAT_TUPLE, /* pointer to conntrack object */
ATTR_EXP_NAT_DIR, /* u8 bits */
ATTR_EXP_FN, /* string */
ATTR_EXP_MAX
};
/* constructor / destructor */
extern struct nf_expect *nfexp_new(void);
extern void nfexp_destroy(struct nf_expect *exp);
/* clone */
extern struct nf_expect *nfexp_clone(const struct nf_expect *exp);
/* object size */
extern size_t nfexp_sizeof(const struct nf_expect *exp);
/* maximum object size */
extern size_t nfexp_maxsize(void);
/* register / unregister callback */
extern int nfexp_callback_register(struct nfct_handle *h,
enum nf_conntrack_msg_type type,
int (*cb)(enum nf_conntrack_msg_type type,
struct nf_expect *exp,
void *data),
void *data);
extern void nfexp_callback_unregister(struct nfct_handle *h);
/* register / unregister callback: extended version including netlink header */
extern int nfexp_callback_register2(struct nfct_handle *h,
enum nf_conntrack_msg_type type,
int (*cb)(const struct nlmsghdr *nlh,
enum nf_conntrack_msg_type type,
struct nf_expect *exp,
void *data),
void *data);
extern void nfexp_callback_unregister2(struct nfct_handle *h);
/* setter */
extern void nfexp_set_attr(struct nf_expect *exp,
const enum nf_expect_attr type,
const void *value);
extern void nfexp_set_attr_u8(struct nf_expect *exp,
const enum nf_expect_attr type,
uint8_t value);
extern void nfexp_set_attr_u16(struct nf_expect *exp,
const enum nf_expect_attr type,
uint16_t value);
extern void nfexp_set_attr_u32(struct nf_expect *exp,
const enum nf_expect_attr type,
uint32_t value);
/* getter */
extern const void *nfexp_get_attr(const struct nf_expect *exp,
const enum nf_expect_attr type);
extern uint8_t nfexp_get_attr_u8(const struct nf_expect *exp,
const enum nf_expect_attr type);
extern uint16_t nfexp_get_attr_u16(const struct nf_expect *exp,
const enum nf_expect_attr type);
extern uint32_t nfexp_get_attr_u32(const struct nf_expect *exp,
const enum nf_expect_attr type);
/* checker */
extern int nfexp_attr_is_set(const struct nf_expect *exp,
const enum nf_expect_attr type);
/* unsetter */
extern int nfexp_attr_unset(struct nf_expect *exp,
const enum nf_expect_attr type);
/* query */
extern int nfexp_query(struct nfct_handle *h,
const enum nf_conntrack_query qt,
const void *data);
/* print */
extern int nfexp_snprintf(char *buf,
unsigned int size,
const struct nf_expect *exp,
const unsigned int msg_type,
const unsigned int out_type,
const unsigned int out_flags);
/* compare */
extern int nfexp_cmp(const struct nf_expect *exp1,
const struct nf_expect *exp2,
unsigned int flags);
extern int nfexp_send(struct nfct_handle *h,
const enum nf_conntrack_query qt,
const void *data);
extern int nfexp_catch(struct nfct_handle *h);
/* low level API */
extern __attribute__((deprecated))
int nfexp_build_expect(struct nfnl_subsys_handle *ssh,
void *req,
size_t size,
uint16_t type,
uint16_t flags,
const struct nf_expect *exp);
extern __attribute__((deprecated))
int nfexp_parse_expect(enum nf_conntrack_msg_type type,
const struct nlmsghdr *nlh,
struct nf_expect *exp);
extern __attribute__((deprecated))
int nfexp_build_query(struct nfnl_subsys_handle *ssh,
const enum nf_conntrack_query qt,
const void *data,
void *buffer,
unsigned int size);
/* New low level API: netlink functions */
extern int nfexp_nlmsg_build(struct nlmsghdr *nlh, const struct nf_expect *exp);
extern int nfexp_nlmsg_parse(const struct nlmsghdr *nlh, struct nf_expect *exp);
/*
* TCP flags
*/
/* Window scaling is advertised by the sender */
#define IP_CT_TCP_FLAG_WINDOW_SCALE 0x01
/* SACK is permitted by the sender */
#define IP_CT_TCP_FLAG_SACK_PERM 0x02
/* This sender sent FIN first */
#define IP_CT_TCP_FLAG_CLOSE_INIT 0x04
/* Be liberal in window checking */
#define IP_CT_TCP_FLAG_BE_LIBERAL 0x08
/* WARNING: do not use these constants in new applications, we keep them here
* to avoid breaking backward compatibility. */
#define NFCT_DIR_ORIGINAL 0
#define NFCT_DIR_REPLY 1
#define NFCT_DIR_MAX NFCT_DIR_REPLY+1
/* xt_helper uses a length size of 30 bytes, however, no helper name in
* the tree has exceeded 16 bytes length. Since 2.6.29, the maximum
* length accepted is 16 bytes, this limit is enforced during module load. */
#define NFCT_HELPER_NAME_MAX 16
#ifdef __cplusplus
}
#endif
#endif /* _LIBNETFILTER_CONNTRACK_H_ */
nfexp_callback_unregister
void nfexp_callback_unregister(struct nfct_handle *h)
Definition expect/api.c:198
nfexp_callback_unregister2
void nfexp_callback_unregister2(struct nfct_handle *h)
Definition expect/api.c:273
nfct_callback_register
int nfct_callback_register(struct nfct_handle *h, enum nf_conntrack_msg_type type, int(*cb)(enum nf_conntrack_msg_type type, struct nf_conntrack *ct, void *data), void *data)
Definition conntrack/api.c:224
nfexp_callback_register2
int nfexp_callback_register2(struct nfct_handle *h, enum nf_conntrack_msg_type type, int(*cb)(const struct nlmsghdr *nlh, enum nf_conntrack_msg_type type, struct nf_expect *exp, void *data), void *data)
Definition expect/api.c:232
nfct_open
struct nfct_handle * nfct_open(uint8_t, unsigned)
Definition main.c:84
nfct_callback_unregister2
void nfct_callback_unregister2(struct nfct_handle *h)
Definition conntrack/api.c:338
nfct_close
int nfct_close(struct nfct_handle *cth)
Definition main.c:105
nfct_callback_unregister
void nfct_callback_unregister(struct nfct_handle *h)
Definition conntrack/api.c:264
nfct_callback_register2
int nfct_callback_register2(struct nfct_handle *h, enum nf_conntrack_msg_type type, int(*cb)(const struct nlmsghdr *nlh, enum nf_conntrack_msg_type type, struct nf_conntrack *ct, void *data), void *data)
Definition conntrack/api.c:298
nfexp_callback_register
int nfexp_callback_register(struct nfct_handle *h, enum nf_conntrack_msg_type type, int(*cb)(enum nf_conntrack_msg_type type, struct nf_expect *exp, void *data), void *data)
Definition expect/api.c:158
nfct_fd
int nfct_fd(struct nfct_handle *cth)
Definition main.c:144
nfct_filter_destroy
void nfct_filter_destroy(struct nfct_filter *filter)
Definition conntrack/api.c:1377
nfct_filter_detach
int nfct_filter_detach(int fd)
Definition conntrack/api.c:1480
nfct_filter_set_logic
int nfct_filter_set_logic(struct nfct_filter *filter, const enum nfct_filter_attr attr, const enum nfct_filter_logic logic)
Definition conntrack/api.c:1439
nfct_filter_attach
int nfct_filter_attach(int fd, struct nfct_filter *filter)
Definition conntrack/api.c:1467
nfct_filter_add_attr_u32
void nfct_filter_add_attr_u32(struct nfct_filter *filter, const enum nfct_filter_attr attr, const uint32_t value)
Definition conntrack/api.c:1417
nfct_filter_add_attr
void nfct_filter_add_attr(struct nfct_filter *filter, const enum nfct_filter_attr attr, const void *value)
Definition conntrack/api.c:1393
nfct_filter_create
struct nfct_filter * nfct_filter_create(void)
Definition conntrack/api.c:1364
nfexp_catch
int nfexp_catch(struct nfct_handle *h)
Definition expect/api.c:760
nfct_send
int nfct_send(struct nfct_handle *h, const enum nf_conntrack_query query, const void *data)
Definition conntrack/api.c:1023
nfct_catch
int nfct_catch(struct nfct_handle *h)
Definition conntrack/api.c:1057
nfexp_send
int nfexp_send(struct nfct_handle *h, const enum nf_conntrack_query qt, const void *data)
Definition expect/api.c:727
nfexp_query
int nfexp_query(struct nfct_handle *h, const enum nf_conntrack_query qt, const void *data)
Definition expect/api.c:695
nfct_query
int nfct_query(struct nfct_handle *h, const enum nf_conntrack_query query, const void *data)
Definition conntrack/api.c:991
nfct_sizeof
size_t nfct_sizeof(const struct nf_conntrack *ct)
Definition conntrack/api.c:114
nfct_snprintf_labels
int nfct_snprintf_labels(char *buf, unsigned int size, const struct nf_conntrack *ct, const unsigned int msg_type, const unsigned int out_type, const unsigned int out_flags, struct nfct_labelmap *map)
Definition conntrack/api.c:1141
nfct_set_attr_u32
void nfct_set_attr_u32(struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint32_t value)
Definition conntrack/api.c:439
nfct_destroy
void nfct_destroy(struct nf_conntrack *ct)
Definition conntrack/api.c:93
nfct_copy_attr
void nfct_copy_attr(struct nf_conntrack *ct1, const struct nf_conntrack *ct2, const enum nf_conntrack_attr type)
Definition conntrack/api.c:1337
nfct_set_attr
void nfct_set_attr(struct nf_conntrack *ct, const enum nf_conntrack_attr type, const void *value)
Definition conntrack/api.c:399
nfct_attr_grp_unset
int nfct_attr_grp_unset(struct nf_conntrack *ct, const enum nf_conntrack_attr_grp type)
Definition conntrack/api.c:731
nfct_get_attr_u64
uint64_t nfct_get_attr_u64(const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
Definition conntrack/api.c:544
nfct_setobjopt
int nfct_setobjopt(struct nf_conntrack *ct, unsigned int option)
Definition conntrack/api.c:169
nfct_get_attr_grp
int nfct_get_attr_grp(const struct nf_conntrack *ct, const enum nf_conntrack_attr_grp type, void *data)
Definition conntrack/api.c:655
nfct_set_attr_grp
void nfct_set_attr_grp(struct nf_conntrack *ct, const enum nf_conntrack_attr_grp type, const void *value)
Definition conntrack/api.c:630
nfct_get_attr
const void * nfct_get_attr(const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
Definition conntrack/api.c:467
nfct_attr_is_set_array
int nfct_attr_is_set_array(const struct nf_conntrack *ct, const enum nf_conntrack_attr *type_array, int size)
Definition conntrack/api.c:580
nfct_attr_unset
int nfct_attr_unset(struct nf_conntrack *ct, const enum nf_conntrack_attr type)
Definition conntrack/api.c:607
nfct_copy
void nfct_copy(struct nf_conntrack *dest, const struct nf_conntrack *source, unsigned int flags)
Definition conntrack/api.c:1247
nfct_get_attr_u16
uint16_t nfct_get_attr_u16(const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
Definition conntrack/api.c:512
nfct_attr_grp_is_set
int nfct_attr_grp_is_set(const struct nf_conntrack *ct, const enum nf_conntrack_attr_grp type)
Definition conntrack/api.c:695
nfct_cmp
int nfct_cmp(const struct nf_conntrack *ct1, const struct nf_conntrack *ct2, unsigned int flags)
Definition conntrack/api.c:1212
nfct_set_attr_u16
void nfct_set_attr_u16(struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint16_t value)
Definition conntrack/api.c:426
nfct_get_attr_u32
uint32_t nfct_get_attr_u32(const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
Definition conntrack/api.c:528
nfct_set_attr_u8
void nfct_set_attr_u8(struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint8_t value)
Definition conntrack/api.c:413
nfct_set_attr_u64
void nfct_set_attr_u64(struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint64_t value)
Definition conntrack/api.c:452
nfct_set_attr_l
void nfct_set_attr_l(struct nf_conntrack *ct, const enum nf_conntrack_attr type, const void *value, size_t len)
Definition conntrack/api.c:370
nfct_snprintf
int nfct_snprintf(char *buf, unsigned int size, const struct nf_conntrack *ct, const unsigned int msg_type, const unsigned int out_type, const unsigned int out_flags)
Definition conntrack/api.c:1113
nfct_maxsize
size_t nfct_maxsize(void)
Definition conntrack/api.c:136
nfct_attr_is_set
int nfct_attr_is_set(const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
Definition conntrack/api.c:559
nfct_getobjopt
int nfct_getobjopt(const struct nf_conntrack *ct, unsigned int option)
Definition conntrack/api.c:189
nfct_compare
int nfct_compare(const struct nf_conntrack *ct1, const struct nf_conntrack *ct2)
Definition conntrack/api.c:1166
nfct_get_attr_u8
uint8_t nfct_get_attr_u8(const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
Definition conntrack/api.c:496
nfct_new
struct nf_conntrack * nfct_new(void)
Definition conntrack/api.c:76
nfct_clone
struct nf_conntrack * nfct_clone(const struct nf_conntrack *ct)
Definition conntrack/api.c:148
nfct_filter_dump_set_attr_u8
void nfct_filter_dump_set_attr_u8(struct nfct_filter_dump *filter_dump, const enum nfct_filter_dump_attr type, uint8_t data)
Definition conntrack/api.c:1549
nfct_filter_dump_create
struct nfct_filter_dump * nfct_filter_dump_create(void)
Definition conntrack/api.c:1503
nfct_filter_dump_destroy
void nfct_filter_dump_destroy(struct nfct_filter_dump *filter)
Definition conntrack/api.c:1514
nfct_filter_dump_set_attr_u16
void nfct_filter_dump_set_attr_u16(struct nfct_filter_dump *filter_dump, const enum nfct_filter_dump_attr type, uint16_t data)
Definition conntrack/api.c:1562
nfct_filter_dump_set_attr
void nfct_filter_dump_set_attr(struct nfct_filter_dump *filter_dump, const enum nfct_filter_dump_attr type, const void *data)
Definition conntrack/api.c:1527
nfexp_set_attr_u32
void nfexp_set_attr_u32(struct nf_expect *exp, const enum nf_expect_attr type, uint32_t value)
Definition expect/api.c:357
nfexp_new
struct nf_expect * nfexp_new(void)
Definition expect/api.c:29
nfexp_get_attr_u32
uint32_t nfexp_get_attr_u32(const struct nf_expect *exp, const enum nf_expect_attr type)
Definition expect/api.c:431
nfexp_sizeof
size_t nfexp_sizeof(const struct nf_expect *exp)
Definition expect/api.c:57
nfexp_get_attr
const void * nfexp_get_attr(const struct nf_expect *exp, const enum nf_expect_attr type)
Definition expect/api.c:372
nfexp_set_attr_u16
void nfexp_set_attr_u16(struct nf_expect *exp, const enum nf_expect_attr type, uint16_t value)
Definition expect/api.c:344
nfexp_set_attr
void nfexp_set_attr(struct nf_expect *exp, const enum nf_expect_attr type, const void *value)
Definition expect/api.c:309
nfexp_cmp
int nfexp_cmp(const struct nf_expect *exp1, const struct nf_expect *exp2, unsigned int flags)
Definition expect/api.c:127
nfexp_get_attr_u16
uint16_t nfexp_get_attr_u16(const struct nf_expect *exp, const enum nf_expect_attr type)
Definition expect/api.c:415
nfexp_set_attr_u8
void nfexp_set_attr_u8(struct nf_expect *exp, const enum nf_expect_attr type, uint8_t value)
Definition expect/api.c:331
nfexp_get_attr_u8
uint8_t nfexp_get_attr_u8(const struct nf_expect *exp, const enum nf_expect_attr type)
Definition expect/api.c:399
nfexp_snprintf
int nfexp_snprintf(char *buf, unsigned int size, const struct nf_expect *exp, const unsigned int msg_type, const unsigned int out_type, const unsigned int out_flags)
Definition expect/api.c:802
nfexp_destroy
void nfexp_destroy(struct nf_expect *exp)
Definition expect/api.c:46
nfexp_attr_unset
int nfexp_attr_unset(struct nf_expect *exp, const enum nf_expect_attr type)
Definition expect/api.c:466
nfexp_clone
struct nf_expect * nfexp_clone(const struct nf_expect *exp)
Definition expect/api.c:89
nfexp_attr_is_set
int nfexp_attr_is_set(const struct nf_expect *exp, const enum nf_expect_attr type)
Definition expect/api.c:446
nfexp_maxsize
size_t nfexp_maxsize(void)
Definition expect/api.c:77
nfct_labels_get_path
const char * nfct_labels_get_path(void)
Definition conntrack/api.c:1585
nfct_labelmap_destroy
void nfct_labelmap_destroy(struct nfct_labelmap *map)
Definition conntrack/api.c:1638
nfct_labelmap_get_name
const char * nfct_labelmap_get_name(struct nfct_labelmap *m, unsigned int bit)
Definition conntrack/api.c:1600
nfct_labelmap_new
struct nfct_labelmap * nfct_labelmap_new(const char *mapfile)
Definition conntrack/api.c:1626
nfct_labelmap_get_bit
int nfct_labelmap_get_bit(struct nfct_labelmap *m, const char *name)
Definition conntrack/api.c:1613
nfexp_build_query
int nfexp_build_query(struct nfnl_subsys_handle *ssh, const enum nf_conntrack_query qt, const void *data, void *buffer, unsigned int size)
Definition expect/api.c:609
nfct_parse_conntrack
int nfct_parse_conntrack(enum nf_conntrack_msg_type type, const struct nlmsghdr *nlh, struct nf_conntrack *ct)
Definition conntrack/api.c:955
nfexp_build_expect
int nfexp_build_expect(struct nfnl_subsys_handle *ssh, void *req, size_t size, uint16_t type, uint16_t flags, const struct nf_expect *exp)
Definition expect/api.c:505
nfct_build_conntrack
int nfct_build_conntrack(struct nfnl_subsys_handle *ssh, void *req, size_t size, uint16_t type, uint16_t flags, const struct nf_conntrack *ct)
Definition conntrack/api.c:771
nfexp_parse_expect
int nfexp_parse_expect(enum nf_conntrack_msg_type type, const struct nlmsghdr *nlh, struct nf_expect *exp)
Definition expect/api.c:659
nfct_build_query
int nfct_build_query(struct nfnl_subsys_handle *ssh, const enum nf_conntrack_query qt, const void *data, void *buffer, unsigned int size)
Definition conntrack/api.c:905
nfct_attr_grp_ctrs
Definition libnetfilter_conntrack.h:189
nfct_attr_grp_icmp
Definition libnetfilter_conntrack.h:184
nfct_attr_grp_ipv4
Definition libnetfilter_conntrack.h:172
nfct_attr_grp_ipv6
Definition libnetfilter_conntrack.h:176
nfct_attr_grp_port
Definition libnetfilter_conntrack.h:180
nfct_filter_dump_mark
Definition libnetfilter_conntrack.h:543
nfct_filter_ipv4
Definition libnetfilter_conntrack.h:497
nfct_filter_ipv6
Definition libnetfilter_conntrack.h:501
nfct_filter_proto
Definition libnetfilter_conntrack.h:493
nfct_labelmap
Definition labels.c:17
nfct_attr_grp_addr
Definition libnetfilter_conntrack.h:194