10#ifndef _LIBNETFILTER_CONNTRACK_H_
11#define _LIBNETFILTER_CONNTRACK_H_
14#include <netinet/in.h>
15#include <libnfnetlink/linux_nfnetlink.h>
16#include <libnfnetlink/libnfnetlink.h>
17#include <libnetfilter_conntrack/linux_nfnetlink_conntrack.h>
18#include <libnetfilter_conntrack/linux_nf_conntrack_common.h>
25 CONNTRACK = NFNL_SUBSYS_CTNETLINK,
26 EXPECT = NFNL_SUBSYS_CTNETLINK_EXP
35#define NFCT_ALL_CT_GROUPS (NF_NETLINK_CONNTRACK_NEW|NF_NETLINK_CONNTRACK_UPDATE|NF_NETLINK_CONNTRACK_DESTROY)
42extern struct nfct_handle *
nfct_open(uint8_t,
unsigned);
43extern struct nfct_handle *nfct_open_nfnl(
struct nfnl_handle *nfnlh,
45 unsigned int subscriptions);
48extern int nfct_fd(
struct nfct_handle *cth);
49extern const struct nfnl_handle *nfct_nfnlh(
struct nfct_handle *cth);
63enum nf_conntrack_attr {
64 ATTR_ORIG_IPV4_SRC = 0,
65 ATTR_IPV4_SRC = ATTR_ORIG_IPV4_SRC,
67 ATTR_IPV4_DST = ATTR_ORIG_IPV4_DST,
70 ATTR_ORIG_IPV6_SRC = 4,
71 ATTR_IPV6_SRC = ATTR_ORIG_IPV6_SRC,
73 ATTR_IPV6_DST = ATTR_ORIG_IPV6_DST,
76 ATTR_ORIG_PORT_SRC = 8,
77 ATTR_PORT_SRC = ATTR_ORIG_PORT_SRC,
79 ATTR_PORT_DST = ATTR_ORIG_PORT_DST,
86 ATTR_L3PROTO = ATTR_ORIG_L3PROTO,
87 ATTR_REPL_L3PROTO = 16,
89 ATTR_L4PROTO = ATTR_ORIG_L4PROTO,
98 ATTR_ORIG_COUNTER_PACKETS,
99 ATTR_REPL_COUNTER_PACKETS,
100 ATTR_ORIG_COUNTER_BYTES = 28,
101 ATTR_REPL_COUNTER_BYTES,
108 ATTR_TCP_MASK_REPL = 36,
109 ATTR_MASTER_IPV4_SRC,
110 ATTR_MASTER_IPV4_DST,
111 ATTR_MASTER_IPV6_SRC,
112 ATTR_MASTER_IPV6_DST = 40,
113 ATTR_MASTER_PORT_SRC,
114 ATTR_MASTER_PORT_DST,
116 ATTR_MASTER_L4PROTO = 44,
118 ATTR_ORIG_NAT_SEQ_CORRECTION_POS,
119 ATTR_ORIG_NAT_SEQ_OFFSET_BEFORE,
120 ATTR_ORIG_NAT_SEQ_OFFSET_AFTER = 48,
121 ATTR_REPL_NAT_SEQ_CORRECTION_POS,
122 ATTR_REPL_NAT_SEQ_OFFSET_BEFORE,
123 ATTR_REPL_NAT_SEQ_OFFSET_AFTER,
124 ATTR_SCTP_STATE = 52,
128 ATTR_DCCP_STATE = 56,
130 ATTR_DCCP_HANDSHAKE_SEQ,
131 ATTR_TCP_WSCALE_ORIG,
132 ATTR_TCP_WSCALE_REPL = 60,
135 ATTR_TIMESTAMP_START,
136 ATTR_TIMESTAMP_STOP = 64,
139 ATTR_CONNLABELS_MASK,
144 ATTR_SYNPROXY_ISN = 72,
151enum nf_conntrack_attr_grp {
152 ATTR_GRP_ORIG_IPV4 = 0,
156 ATTR_GRP_ORIG_PORT = 4,
159 ATTR_GRP_MASTER_IPV4,
160 ATTR_GRP_MASTER_IPV6 = 8,
161 ATTR_GRP_MASTER_PORT,
162 ATTR_GRP_ORIG_COUNTERS,
163 ATTR_GRP_REPL_COUNTERS,
164 ATTR_GRP_ORIG_ADDR_SRC = 12,
165 ATTR_GRP_ORIG_ADDR_DST,
166 ATTR_GRP_REPL_ADDR_SRC,
167 ATTR_GRP_REPL_ADDR_DST,
176 uint32_t src[4], dst[4];
180 uint16_t sport, dport;
200enum nf_conntrack_msg_type {
204 NFCT_T_NEW = (1 << NFCT_T_NEW_BIT),
206 NFCT_T_UPDATE_BIT = 1,
207 NFCT_T_UPDATE = (1 << NFCT_T_UPDATE_BIT),
209 NFCT_T_DESTROY_BIT = 2,
210 NFCT_T_DESTROY = (1 << NFCT_T_DESTROY_BIT),
212 NFCT_T_ALL = NFCT_T_NEW | NFCT_T_UPDATE | NFCT_T_DESTROY,
214 NFCT_T_ERROR_BIT = 31,
215 NFCT_T_ERROR = (1 << NFCT_T_ERROR_BIT),
219extern struct nf_conntrack *
nfct_new(
void);
223struct nf_conntrack *
nfct_clone(
const struct nf_conntrack *ct);
226extern __attribute__((deprecated))
size_t nfct_sizeof(
const struct nf_conntrack *ct);
229extern __attribute__((deprecated))
size_t nfct_maxsize(
void);
237 NFCT_SOPT_SETUP_ORIGINAL,
238 NFCT_SOPT_SETUP_REPLY,
241#define NFCT_SOPT_MAX (__NFCT_SOPT_MAX - 1)
251#define NFCT_GOPT_MAX (__NFCT_GOPT_MAX - 1)
253extern int nfct_setobjopt(
struct nf_conntrack *ct,
unsigned int option);
254extern int nfct_getobjopt(
const struct nf_conntrack *ct,
unsigned int option);
259 enum nf_conntrack_msg_type type,
260 int (*cb)(
enum nf_conntrack_msg_type type,
261 struct nf_conntrack *ct,
270 enum nf_conntrack_msg_type type,
271 int (*cb)(
const struct nlmsghdr *nlh,
272 enum nf_conntrack_msg_type type,
273 struct nf_conntrack *ct,
281 NFCT_CB_FAILURE = -1,
283 NFCT_CB_CONTINUE = 1,
290struct nfct_bitmask *nfct_bitmask_new(
unsigned int maxbit);
291struct nfct_bitmask *nfct_bitmask_clone(
const struct nfct_bitmask *);
292unsigned int nfct_bitmask_maxbit(
const struct nfct_bitmask *);
294void nfct_bitmask_set_bit(
struct nfct_bitmask *,
unsigned int bit);
295int nfct_bitmask_test_bit(
const struct nfct_bitmask *,
unsigned int bit);
296void nfct_bitmask_unset_bit(
struct nfct_bitmask *,
unsigned int bit);
297void nfct_bitmask_destroy(
struct nfct_bitmask *);
298void nfct_bitmask_clear(
struct nfct_bitmask *);
299bool nfct_bitmask_equal(
const struct nfct_bitmask *,
const struct nfct_bitmask *);
312 const enum nf_conntrack_attr type,
316 const enum nf_conntrack_attr type,
320 const enum nf_conntrack_attr type,
324 const enum nf_conntrack_attr type,
328 const enum nf_conntrack_attr type,
332 const enum nf_conntrack_attr type,
337extern const void *
nfct_get_attr(
const struct nf_conntrack *ct,
338 const enum nf_conntrack_attr type);
341 const enum nf_conntrack_attr type);
344 const enum nf_conntrack_attr type);
347 const enum nf_conntrack_attr type);
350 const enum nf_conntrack_attr type);
354 const enum nf_conntrack_attr type);
357 const enum nf_conntrack_attr *type_array,
362 const enum nf_conntrack_attr type);
366 const enum nf_conntrack_attr_grp type,
370 const enum nf_conntrack_attr_grp type,
375 const enum nf_conntrack_attr_grp type);
379 const enum nf_conntrack_attr_grp type);
386 NFCT_O_DEFAULT = NFCT_O_PLAIN,
393 NFCT_OF_SHOW_LAYER3_BIT = 0,
394 NFCT_OF_SHOW_LAYER3 = (1 << NFCT_OF_SHOW_LAYER3_BIT),
396 NFCT_OF_TIME_BIT = 1,
397 NFCT_OF_TIME = (1 << NFCT_OF_TIME_BIT),
400 NFCT_OF_ID = (1 << NFCT_OF_ID_BIT),
402 NFCT_OF_TIMESTAMP_BIT = 3,
403 NFCT_OF_TIMESTAMP = (1 << NFCT_OF_TIMESTAMP_BIT),
408 const struct nf_conntrack *ct,
409 const unsigned int msg_type,
410 const unsigned int out_type,
411 const unsigned int out_flags);
415 const struct nf_conntrack *ct,
416 const unsigned int msg_type,
417 const unsigned int out_type,
418 const unsigned int out_flags,
423 const struct nf_conntrack *ct2);
427 NFCT_CMP_ORIG = (1 << 0),
428 NFCT_CMP_REPL = (1 << 1),
429 NFCT_CMP_TIMEOUT_EQ = (1 << 2),
430 NFCT_CMP_TIMEOUT_GT = (1 << 3),
431 NFCT_CMP_TIMEOUT_GE = (NFCT_CMP_TIMEOUT_EQ | NFCT_CMP_TIMEOUT_GT),
432 NFCT_CMP_TIMEOUT_LT = (1 << 4),
433 NFCT_CMP_TIMEOUT_LE = (NFCT_CMP_TIMEOUT_EQ | NFCT_CMP_TIMEOUT_LT),
434 NFCT_CMP_MASK = (1 << 5),
435 NFCT_CMP_STRICT = (1 << 6),
438extern int nfct_cmp(
const struct nf_conntrack *ct1,
439 const struct nf_conntrack *ct2,
444enum nf_conntrack_query {
452 NFCT_Q_CREATE_UPDATE,
454 NFCT_Q_DUMP_FILTER_RESET,
459 const enum nf_conntrack_query query,
462extern int nfct_send(
struct nfct_handle *h,
463 const enum nf_conntrack_query query,
471 NFCT_CP_ORIG = (1 << 0),
472 NFCT_CP_REPL = (1 << 1),
473 NFCT_CP_META = (1 << 2),
474 NFCT_CP_OVERRIDE = (1 << 3),
477extern void nfct_copy(
struct nf_conntrack *dest,
478 const struct nf_conntrack *source,
482 const struct nf_conntrack *ct2,
483 const enum nf_conntrack_attr type);
505enum nfct_filter_attr {
506 NFCT_FILTER_L4PROTO = 0,
507 NFCT_FILTER_L4PROTO_STATE,
508 NFCT_FILTER_SRC_IPV4,
509 NFCT_FILTER_DST_IPV4,
510 NFCT_FILTER_SRC_IPV6,
511 NFCT_FILTER_DST_IPV6,
518 const enum nfct_filter_attr attr,
522 const enum nfct_filter_attr attr,
523 const uint32_t value);
525enum nfct_filter_logic {
526 NFCT_FILTER_LOGIC_POSITIVE,
527 NFCT_FILTER_LOGIC_NEGATIVE,
528 NFCT_FILTER_LOGIC_MAX
532 const enum nfct_filter_attr attr,
533 const enum nfct_filter_logic logic);
540struct nfct_filter_dump;
547enum nfct_filter_dump_attr {
548 NFCT_FILTER_DUMP_MARK = 0,
549 NFCT_FILTER_DUMP_L3NUM,
550 NFCT_FILTER_DUMP_STATUS,
551 NFCT_FILTER_DUMP_ZONE,
552 NFCT_FILTER_DUMP_TUPLE,
561 const enum nfct_filter_dump_attr type,
565 const enum nfct_filter_dump_attr type,
569 const enum nfct_filter_dump_attr type,
574extern __attribute__((deprecated))
int
580 const struct nf_conntrack *ct);
582extern __attribute__((deprecated))
584 const struct nlmsghdr *nlh,
585 struct nf_conntrack *ct);
587extern __attribute__((deprecated))
589 const enum nf_conntrack_query query,
596extern int nfct_nlmsg_build(
struct nlmsghdr *nlh,
const struct nf_conntrack *ct);
597extern int nfct_nlmsg_build_filter(
struct nlmsghdr *nlh,
const struct nfct_filter_dump *filter_dump);
598extern int nfct_nlmsg_parse(
const struct nlmsghdr *nlh,
struct nf_conntrack *ct);
599extern int nfct_payload_parse(
const void *payload,
size_t payload_len, uint16_t l3num,
struct nf_conntrack *ct);
616 ATTR_EXP_HELPER_NAME,
629extern struct nf_expect *
nfexp_clone(
const struct nf_expect *exp);
640 enum nf_conntrack_msg_type type,
641 int (*cb)(
enum nf_conntrack_msg_type type,
642 struct nf_expect *exp,
650 enum nf_conntrack_msg_type type,
651 int (*cb)(
const struct nlmsghdr *nlh,
652 enum nf_conntrack_msg_type type,
653 struct nf_expect *exp,
661 const enum nf_expect_attr type,
665 const enum nf_expect_attr type,
669 const enum nf_expect_attr type,
673 const enum nf_expect_attr type,
678 const enum nf_expect_attr type);
681 const enum nf_expect_attr type);
684 const enum nf_expect_attr type);
687 const enum nf_expect_attr type);
691 const enum nf_expect_attr type);
695 const enum nf_expect_attr type);
699 const enum nf_conntrack_query qt,
705 const struct nf_expect *exp,
706 const unsigned int msg_type,
707 const unsigned int out_type,
708 const unsigned int out_flags);
711extern int nfexp_cmp(
const struct nf_expect *exp1,
712 const struct nf_expect *exp2,
716 const enum nf_conntrack_query qt,
722extern __attribute__((deprecated))
728 const struct nf_expect *exp);
730extern __attribute__((deprecated))
732 const struct nlmsghdr *nlh,
733 struct nf_expect *exp);
735extern __attribute__((deprecated))
737 const enum nf_conntrack_query qt,
744extern int nfexp_nlmsg_build(
struct nlmsghdr *nlh,
const struct nf_expect *exp);
745extern int nfexp_nlmsg_parse(
const struct nlmsghdr *nlh,
struct nf_expect *exp);
752#define IP_CT_TCP_FLAG_WINDOW_SCALE 0x01
755#define IP_CT_TCP_FLAG_SACK_PERM 0x02
758#define IP_CT_TCP_FLAG_CLOSE_INIT 0x04
761#define IP_CT_TCP_FLAG_BE_LIBERAL 0x08
765#define NFCT_DIR_ORIGINAL 0
766#define NFCT_DIR_REPLY 1
767#define NFCT_DIR_MAX NFCT_DIR_REPLY+1
772#define NFCT_HELPER_NAME_MAX 16
void nfexp_callback_unregister(struct nfct_handle *h)
void nfexp_callback_unregister2(struct nfct_handle *h)
int nfct_callback_register(struct nfct_handle *h, enum nf_conntrack_msg_type type, int(*cb)(enum nf_conntrack_msg_type type, struct nf_conntrack *ct, void *data), void *data)
int nfexp_callback_register2(struct nfct_handle *h, enum nf_conntrack_msg_type type, int(*cb)(const struct nlmsghdr *nlh, enum nf_conntrack_msg_type type, struct nf_expect *exp, void *data), void *data)
struct nfct_handle * nfct_open(uint8_t, unsigned)
void nfct_callback_unregister2(struct nfct_handle *h)
int nfct_close(struct nfct_handle *cth)
void nfct_callback_unregister(struct nfct_handle *h)
int nfct_callback_register2(struct nfct_handle *h, enum nf_conntrack_msg_type type, int(*cb)(const struct nlmsghdr *nlh, enum nf_conntrack_msg_type type, struct nf_conntrack *ct, void *data), void *data)
int nfexp_callback_register(struct nfct_handle *h, enum nf_conntrack_msg_type type, int(*cb)(enum nf_conntrack_msg_type type, struct nf_expect *exp, void *data), void *data)
int nfct_fd(struct nfct_handle *cth)
void nfct_filter_destroy(struct nfct_filter *filter)
int nfct_filter_detach(int fd)
int nfct_filter_set_logic(struct nfct_filter *filter, const enum nfct_filter_attr attr, const enum nfct_filter_logic logic)
int nfct_filter_attach(int fd, struct nfct_filter *filter)
void nfct_filter_add_attr_u32(struct nfct_filter *filter, const enum nfct_filter_attr attr, const uint32_t value)
void nfct_filter_add_attr(struct nfct_filter *filter, const enum nfct_filter_attr attr, const void *value)
struct nfct_filter * nfct_filter_create(void)
int nfexp_catch(struct nfct_handle *h)
int nfct_send(struct nfct_handle *h, const enum nf_conntrack_query query, const void *data)
int nfct_catch(struct nfct_handle *h)
int nfexp_send(struct nfct_handle *h, const enum nf_conntrack_query qt, const void *data)
int nfexp_query(struct nfct_handle *h, const enum nf_conntrack_query qt, const void *data)
int nfct_query(struct nfct_handle *h, const enum nf_conntrack_query query, const void *data)
size_t nfct_sizeof(const struct nf_conntrack *ct)
int nfct_snprintf_labels(char *buf, unsigned int size, const struct nf_conntrack *ct, const unsigned int msg_type, const unsigned int out_type, const unsigned int out_flags, struct nfct_labelmap *map)
void nfct_set_attr_u32(struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint32_t value)
void nfct_destroy(struct nf_conntrack *ct)
void nfct_copy_attr(struct nf_conntrack *ct1, const struct nf_conntrack *ct2, const enum nf_conntrack_attr type)
void nfct_set_attr(struct nf_conntrack *ct, const enum nf_conntrack_attr type, const void *value)
int nfct_attr_grp_unset(struct nf_conntrack *ct, const enum nf_conntrack_attr_grp type)
uint64_t nfct_get_attr_u64(const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
int nfct_setobjopt(struct nf_conntrack *ct, unsigned int option)
int nfct_get_attr_grp(const struct nf_conntrack *ct, const enum nf_conntrack_attr_grp type, void *data)
void nfct_set_attr_grp(struct nf_conntrack *ct, const enum nf_conntrack_attr_grp type, const void *value)
const void * nfct_get_attr(const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
int nfct_attr_is_set_array(const struct nf_conntrack *ct, const enum nf_conntrack_attr *type_array, int size)
int nfct_attr_unset(struct nf_conntrack *ct, const enum nf_conntrack_attr type)
void nfct_copy(struct nf_conntrack *dest, const struct nf_conntrack *source, unsigned int flags)
uint16_t nfct_get_attr_u16(const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
int nfct_attr_grp_is_set(const struct nf_conntrack *ct, const enum nf_conntrack_attr_grp type)
int nfct_cmp(const struct nf_conntrack *ct1, const struct nf_conntrack *ct2, unsigned int flags)
void nfct_set_attr_u16(struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint16_t value)
uint32_t nfct_get_attr_u32(const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
void nfct_set_attr_u8(struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint8_t value)
void nfct_set_attr_u64(struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint64_t value)
void nfct_set_attr_l(struct nf_conntrack *ct, const enum nf_conntrack_attr type, const void *value, size_t len)
int nfct_snprintf(char *buf, unsigned int size, const struct nf_conntrack *ct, const unsigned int msg_type, const unsigned int out_type, const unsigned int out_flags)
size_t nfct_maxsize(void)
int nfct_attr_is_set(const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
int nfct_getobjopt(const struct nf_conntrack *ct, unsigned int option)
int nfct_compare(const struct nf_conntrack *ct1, const struct nf_conntrack *ct2)
uint8_t nfct_get_attr_u8(const struct nf_conntrack *ct, const enum nf_conntrack_attr type)
struct nf_conntrack * nfct_new(void)
struct nf_conntrack * nfct_clone(const struct nf_conntrack *ct)
void nfct_filter_dump_set_attr_u8(struct nfct_filter_dump *filter_dump, const enum nfct_filter_dump_attr type, uint8_t data)
struct nfct_filter_dump * nfct_filter_dump_create(void)
void nfct_filter_dump_destroy(struct nfct_filter_dump *filter)
void nfct_filter_dump_set_attr_u16(struct nfct_filter_dump *filter_dump, const enum nfct_filter_dump_attr type, uint16_t data)
void nfct_filter_dump_set_attr(struct nfct_filter_dump *filter_dump, const enum nfct_filter_dump_attr type, const void *data)
void nfexp_set_attr_u32(struct nf_expect *exp, const enum nf_expect_attr type, uint32_t value)
struct nf_expect * nfexp_new(void)
uint32_t nfexp_get_attr_u32(const struct nf_expect *exp, const enum nf_expect_attr type)
size_t nfexp_sizeof(const struct nf_expect *exp)
const void * nfexp_get_attr(const struct nf_expect *exp, const enum nf_expect_attr type)
void nfexp_set_attr_u16(struct nf_expect *exp, const enum nf_expect_attr type, uint16_t value)
void nfexp_set_attr(struct nf_expect *exp, const enum nf_expect_attr type, const void *value)
int nfexp_cmp(const struct nf_expect *exp1, const struct nf_expect *exp2, unsigned int flags)
uint16_t nfexp_get_attr_u16(const struct nf_expect *exp, const enum nf_expect_attr type)
void nfexp_set_attr_u8(struct nf_expect *exp, const enum nf_expect_attr type, uint8_t value)
uint8_t nfexp_get_attr_u8(const struct nf_expect *exp, const enum nf_expect_attr type)
int nfexp_snprintf(char *buf, unsigned int size, const struct nf_expect *exp, const unsigned int msg_type, const unsigned int out_type, const unsigned int out_flags)
void nfexp_destroy(struct nf_expect *exp)
int nfexp_attr_unset(struct nf_expect *exp, const enum nf_expect_attr type)
struct nf_expect * nfexp_clone(const struct nf_expect *exp)
int nfexp_attr_is_set(const struct nf_expect *exp, const enum nf_expect_attr type)
size_t nfexp_maxsize(void)
const char * nfct_labels_get_path(void)
void nfct_labelmap_destroy(struct nfct_labelmap *map)
const char * nfct_labelmap_get_name(struct nfct_labelmap *m, unsigned int bit)
struct nfct_labelmap * nfct_labelmap_new(const char *mapfile)
int nfct_labelmap_get_bit(struct nfct_labelmap *m, const char *name)
int nfexp_build_query(struct nfnl_subsys_handle *ssh, const enum nf_conntrack_query qt, const void *data, void *buffer, unsigned int size)
int nfct_parse_conntrack(enum nf_conntrack_msg_type type, const struct nlmsghdr *nlh, struct nf_conntrack *ct)
int nfexp_build_expect(struct nfnl_subsys_handle *ssh, void *req, size_t size, uint16_t type, uint16_t flags, const struct nf_expect *exp)
int nfct_build_conntrack(struct nfnl_subsys_handle *ssh, void *req, size_t size, uint16_t type, uint16_t flags, const struct nf_conntrack *ct)
int nfexp_parse_expect(enum nf_conntrack_msg_type type, const struct nlmsghdr *nlh, struct nf_expect *exp)
int nfct_build_query(struct nfnl_subsys_handle *ssh, const enum nf_conntrack_query qt, const void *data, void *buffer, unsigned int size)