diff options
author | David S. Miller <davem@davemloft.net> | 2009-06-11 23:00:44 -0400 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2009-06-11 23:00:44 -0400 |
commit | adf76cfe24dab32a54e2dd1f51534cea8277f32a (patch) | |
tree | 6935c74a4b7237bd5f95918b3145ac57e0769fca /include | |
parent | 17d0cdfa8f3c09a110061c67421d662b3e149d0a (diff) | |
parent | 24992eacd8a9f4af286bdaaab627b6802ceb8bce (diff) |
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6
Diffstat (limited to 'include')
-rw-r--r-- | include/linux/netfilter/Kbuild | 1 | ||||
-rw-r--r-- | include/linux/netfilter/nf_conntrack_common.h | 69 | ||||
-rw-r--r-- | include/linux/netfilter/nf_conntrack_tcp.h | 3 | ||||
-rw-r--r-- | include/linux/netfilter/nfnetlink.h | 5 | ||||
-rw-r--r-- | include/linux/netfilter/nfnetlink_conntrack.h | 1 | ||||
-rw-r--r-- | include/linux/netfilter/x_tables.h | 6 | ||||
-rw-r--r-- | include/linux/netfilter/xt_NFQUEUE.h | 5 | ||||
-rw-r--r-- | include/linux/netfilter/xt_osf.h | 133 | ||||
-rw-r--r-- | include/linux/netfilter/xt_socket.h | 12 | ||||
-rw-r--r-- | include/net/netfilter/ipv4/nf_conntrack_icmp.h | 11 | ||||
-rw-r--r-- | include/net/netfilter/ipv6/nf_conntrack_icmpv6.h | 7 | ||||
-rw-r--r-- | include/net/netfilter/nf_conntrack.h | 9 | ||||
-rw-r--r-- | include/net/netfilter/nf_conntrack_ecache.h | 113 | ||||
-rw-r--r-- | include/net/netfilter/nf_conntrack_l4proto.h | 4 | ||||
-rw-r--r-- | include/net/netlink.h | 9 |
15 files changed, 270 insertions, 118 deletions
diff --git a/include/linux/netfilter/Kbuild b/include/linux/netfilter/Kbuild index af9d2fb9721..2aea50399c0 100644 --- a/include/linux/netfilter/Kbuild +++ b/include/linux/netfilter/Kbuild | |||
@@ -33,6 +33,7 @@ header-y += xt_limit.h | |||
33 | header-y += xt_mac.h | 33 | header-y += xt_mac.h |
34 | header-y += xt_mark.h | 34 | header-y += xt_mark.h |
35 | header-y += xt_multiport.h | 35 | header-y += xt_multiport.h |
36 | header-y += xt_osf.h | ||
36 | header-y += xt_owner.h | 37 | header-y += xt_owner.h |
37 | header-y += xt_pkttype.h | 38 | header-y += xt_pkttype.h |
38 | header-y += xt_quota.h | 39 | header-y += xt_quota.h |
diff --git a/include/linux/netfilter/nf_conntrack_common.h b/include/linux/netfilter/nf_conntrack_common.h index 885cbe28226..a8248ee422b 100644 --- a/include/linux/netfilter/nf_conntrack_common.h +++ b/include/linux/netfilter/nf_conntrack_common.h | |||
@@ -75,75 +75,6 @@ enum ip_conntrack_status { | |||
75 | IPS_FIXED_TIMEOUT = (1 << IPS_FIXED_TIMEOUT_BIT), | 75 | IPS_FIXED_TIMEOUT = (1 << IPS_FIXED_TIMEOUT_BIT), |
76 | }; | 76 | }; |
77 | 77 | ||
78 | /* Connection tracking event bits */ | ||
79 | enum ip_conntrack_events | ||
80 | { | ||
81 | /* New conntrack */ | ||
82 | IPCT_NEW_BIT = 0, | ||
83 | IPCT_NEW = (1 << IPCT_NEW_BIT), | ||
84 | |||
85 | /* Expected connection */ | ||
86 | IPCT_RELATED_BIT = 1, | ||
87 | IPCT_RELATED = (1 << IPCT_RELATED_BIT), | ||
88 | |||
89 | /* Destroyed conntrack */ | ||
90 | IPCT_DESTROY_BIT = 2, | ||
91 | IPCT_DESTROY = (1 << IPCT_DESTROY_BIT), | ||
92 | |||
93 | /* Timer has been refreshed */ | ||
94 | IPCT_REFRESH_BIT = 3, | ||
95 | IPCT_REFRESH = (1 << IPCT_REFRESH_BIT), | ||
96 | |||
97 | /* Status has changed */ | ||
98 | IPCT_STATUS_BIT = 4, | ||
99 | IPCT_STATUS = (1 << IPCT_STATUS_BIT), | ||
100 | |||
101 | /* Update of protocol info */ | ||
102 | IPCT_PROTOINFO_BIT = 5, | ||
103 | IPCT_PROTOINFO = (1 << IPCT_PROTOINFO_BIT), | ||
104 | |||
105 | /* Volatile protocol info */ | ||
106 | IPCT_PROTOINFO_VOLATILE_BIT = 6, | ||
107 | IPCT_PROTOINFO_VOLATILE = (1 << IPCT_PROTOINFO_VOLATILE_BIT), | ||
108 | |||
109 | /* New helper for conntrack */ | ||
110 | IPCT_HELPER_BIT = 7, | ||
111 | IPCT_HELPER = (1 << IPCT_HELPER_BIT), | ||
112 | |||
113 | /* Update of helper info */ | ||
114 | IPCT_HELPINFO_BIT = 8, | ||
115 | IPCT_HELPINFO = (1 << IPCT_HELPINFO_BIT), | ||
116 | |||
117 | /* Volatile helper info */ | ||
118 | IPCT_HELPINFO_VOLATILE_BIT = 9, | ||
119 | IPCT_HELPINFO_VOLATILE = (1 << IPCT_HELPINFO_VOLATILE_BIT), | ||
120 | |||
121 | /* NAT info */ | ||
122 | IPCT_NATINFO_BIT = 10, | ||
123 | IPCT_NATINFO = (1 << IPCT_NATINFO_BIT), | ||
124 | |||
125 | /* Counter highest bit has been set, unused */ | ||
126 | IPCT_COUNTER_FILLING_BIT = 11, | ||
127 | IPCT_COUNTER_FILLING = (1 << IPCT_COUNTER_FILLING_BIT), | ||
128 | |||
129 | /* Mark is set */ | ||
130 | IPCT_MARK_BIT = 12, | ||
131 | IPCT_MARK = (1 << IPCT_MARK_BIT), | ||
132 | |||
133 | /* NAT sequence adjustment */ | ||
134 | IPCT_NATSEQADJ_BIT = 13, | ||
135 | IPCT_NATSEQADJ = (1 << IPCT_NATSEQADJ_BIT), | ||
136 | |||
137 | /* Secmark is set */ | ||
138 | IPCT_SECMARK_BIT = 14, | ||
139 | IPCT_SECMARK = (1 << IPCT_SECMARK_BIT), | ||
140 | }; | ||
141 | |||
142 | enum ip_conntrack_expect_events { | ||
143 | IPEXP_NEW_BIT = 0, | ||
144 | IPEXP_NEW = (1 << IPEXP_NEW_BIT), | ||
145 | }; | ||
146 | |||
147 | #ifdef __KERNEL__ | 78 | #ifdef __KERNEL__ |
148 | struct ip_conntrack_stat | 79 | struct ip_conntrack_stat |
149 | { | 80 | { |
diff --git a/include/linux/netfilter/nf_conntrack_tcp.h b/include/linux/netfilter/nf_conntrack_tcp.h index b2f384d4261..4352feed237 100644 --- a/include/linux/netfilter/nf_conntrack_tcp.h +++ b/include/linux/netfilter/nf_conntrack_tcp.h | |||
@@ -15,7 +15,8 @@ enum tcp_conntrack { | |||
15 | TCP_CONNTRACK_LAST_ACK, | 15 | TCP_CONNTRACK_LAST_ACK, |
16 | TCP_CONNTRACK_TIME_WAIT, | 16 | TCP_CONNTRACK_TIME_WAIT, |
17 | TCP_CONNTRACK_CLOSE, | 17 | TCP_CONNTRACK_CLOSE, |
18 | TCP_CONNTRACK_LISTEN, | 18 | TCP_CONNTRACK_LISTEN, /* obsolete */ |
19 | #define TCP_CONNTRACK_SYN_SENT2 TCP_CONNTRACK_LISTEN | ||
19 | TCP_CONNTRACK_MAX, | 20 | TCP_CONNTRACK_MAX, |
20 | TCP_CONNTRACK_IGNORE | 21 | TCP_CONNTRACK_IGNORE |
21 | }; | 22 | }; |
diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h index c600083cbdf..bff4d5741d9 100644 --- a/include/linux/netfilter/nfnetlink.h +++ b/include/linux/netfilter/nfnetlink.h | |||
@@ -46,7 +46,8 @@ struct nfgenmsg { | |||
46 | #define NFNL_SUBSYS_CTNETLINK_EXP 2 | 46 | #define NFNL_SUBSYS_CTNETLINK_EXP 2 |
47 | #define NFNL_SUBSYS_QUEUE 3 | 47 | #define NFNL_SUBSYS_QUEUE 3 |
48 | #define NFNL_SUBSYS_ULOG 4 | 48 | #define NFNL_SUBSYS_ULOG 4 |
49 | #define NFNL_SUBSYS_COUNT 5 | 49 | #define NFNL_SUBSYS_OSF 5 |
50 | #define NFNL_SUBSYS_COUNT 6 | ||
50 | 51 | ||
51 | #ifdef __KERNEL__ | 52 | #ifdef __KERNEL__ |
52 | 53 | ||
@@ -75,7 +76,7 @@ extern int nfnetlink_subsys_unregister(const struct nfnetlink_subsystem *n); | |||
75 | 76 | ||
76 | extern int nfnetlink_has_listeners(unsigned int group); | 77 | extern int nfnetlink_has_listeners(unsigned int group); |
77 | extern int nfnetlink_send(struct sk_buff *skb, u32 pid, unsigned group, | 78 | extern int nfnetlink_send(struct sk_buff *skb, u32 pid, unsigned group, |
78 | int echo); | 79 | int echo, gfp_t flags); |
79 | extern void nfnetlink_set_err(u32 pid, u32 group, int error); | 80 | extern void nfnetlink_set_err(u32 pid, u32 group, int error); |
80 | extern int nfnetlink_unicast(struct sk_buff *skb, u_int32_t pid, int flags); | 81 | extern int nfnetlink_unicast(struct sk_buff *skb, u_int32_t pid, int flags); |
81 | 82 | ||
diff --git a/include/linux/netfilter/nfnetlink_conntrack.h b/include/linux/netfilter/nfnetlink_conntrack.h index 1a865e48b8e..ed4ef8d0b11 100644 --- a/include/linux/netfilter/nfnetlink_conntrack.h +++ b/include/linux/netfilter/nfnetlink_conntrack.h | |||
@@ -101,6 +101,7 @@ enum ctattr_protoinfo_dccp { | |||
101 | CTA_PROTOINFO_DCCP_UNSPEC, | 101 | CTA_PROTOINFO_DCCP_UNSPEC, |
102 | CTA_PROTOINFO_DCCP_STATE, | 102 | CTA_PROTOINFO_DCCP_STATE, |
103 | CTA_PROTOINFO_DCCP_ROLE, | 103 | CTA_PROTOINFO_DCCP_ROLE, |
104 | CTA_PROTOINFO_DCCP_HANDSHAKE_SEQ, | ||
104 | __CTA_PROTOINFO_DCCP_MAX, | 105 | __CTA_PROTOINFO_DCCP_MAX, |
105 | }; | 106 | }; |
106 | #define CTA_PROTOINFO_DCCP_MAX (__CTA_PROTOINFO_DCCP_MAX - 1) | 107 | #define CTA_PROTOINFO_DCCP_MAX (__CTA_PROTOINFO_DCCP_MAX - 1) |
diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h index c9efe039dc5..1030b759389 100644 --- a/include/linux/netfilter/x_tables.h +++ b/include/linux/netfilter/x_tables.h | |||
@@ -184,9 +184,10 @@ struct xt_counters_info | |||
184 | * @matchinfo: per-match data | 184 | * @matchinfo: per-match data |
185 | * @fragoff: packet is a fragment, this is the data offset | 185 | * @fragoff: packet is a fragment, this is the data offset |
186 | * @thoff: position of transport header relative to skb->data | 186 | * @thoff: position of transport header relative to skb->data |
187 | * @hotdrop: drop packet if we had inspection problems | 187 | * @hook: hook number given packet came from |
188 | * @family: Actual NFPROTO_* through which the function is invoked | 188 | * @family: Actual NFPROTO_* through which the function is invoked |
189 | * (helpful when match->family == NFPROTO_UNSPEC) | 189 | * (helpful when match->family == NFPROTO_UNSPEC) |
190 | * @hotdrop: drop packet if we had inspection problems | ||
190 | */ | 191 | */ |
191 | struct xt_match_param { | 192 | struct xt_match_param { |
192 | const struct net_device *in, *out; | 193 | const struct net_device *in, *out; |
@@ -194,8 +195,9 @@ struct xt_match_param { | |||
194 | const void *matchinfo; | 195 | const void *matchinfo; |
195 | int fragoff; | 196 | int fragoff; |
196 | unsigned int thoff; | 197 | unsigned int thoff; |
197 | bool *hotdrop; | 198 | unsigned int hooknum; |
198 | u_int8_t family; | 199 | u_int8_t family; |
200 | bool *hotdrop; | ||
199 | }; | 201 | }; |
200 | 202 | ||
201 | /** | 203 | /** |
diff --git a/include/linux/netfilter/xt_NFQUEUE.h b/include/linux/netfilter/xt_NFQUEUE.h index 982a89f7827..2584f4a777d 100644 --- a/include/linux/netfilter/xt_NFQUEUE.h +++ b/include/linux/netfilter/xt_NFQUEUE.h | |||
@@ -15,4 +15,9 @@ struct xt_NFQ_info { | |||
15 | __u16 queuenum; | 15 | __u16 queuenum; |
16 | }; | 16 | }; |
17 | 17 | ||
18 | struct xt_NFQ_info_v1 { | ||
19 | __u16 queuenum; | ||
20 | __u16 queues_total; | ||
21 | }; | ||
22 | |||
18 | #endif /* _XT_NFQ_TARGET_H */ | 23 | #endif /* _XT_NFQ_TARGET_H */ |
diff --git a/include/linux/netfilter/xt_osf.h b/include/linux/netfilter/xt_osf.h new file mode 100644 index 00000000000..fd2272e0959 --- /dev/null +++ b/include/linux/netfilter/xt_osf.h | |||
@@ -0,0 +1,133 @@ | |||
1 | /* | ||
2 | * Copyright (c) 2003+ Evgeniy Polyakov <johnpol@2ka.mxt.ru> | ||
3 | * | ||
4 | * | ||
5 | * This program is free software; you can redistribute it and/or modify | ||
6 | * it under the terms of the GNU General Public License as published by | ||
7 | * the Free Software Foundation; either version 2 of the License, or | ||
8 | * (at your option) any later version. | ||
9 | * | ||
10 | * This program is distributed in the hope that it will be useful, | ||
11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
13 | * GNU General Public License for more details. | ||
14 | * | ||
15 | * You should have received a copy of the GNU General Public License | ||
16 | * along with this program; if not, write to the Free Software | ||
17 | * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA | ||
18 | */ | ||
19 | |||
20 | #ifndef _XT_OSF_H | ||
21 | #define _XT_OSF_H | ||
22 | |||
23 | #define MAXGENRELEN 32 | ||
24 | |||
25 | #define XT_OSF_GENRE (1<<0) | ||
26 | #define XT_OSF_TTL (1<<1) | ||
27 | #define XT_OSF_LOG (1<<2) | ||
28 | #define XT_OSF_INVERT (1<<3) | ||
29 | |||
30 | #define XT_OSF_LOGLEVEL_ALL 0 /* log all matched fingerprints */ | ||
31 | #define XT_OSF_LOGLEVEL_FIRST 1 /* log only the first matced fingerprint */ | ||
32 | #define XT_OSF_LOGLEVEL_ALL_KNOWN 2 /* do not log unknown packets */ | ||
33 | |||
34 | #define XT_OSF_TTL_TRUE 0 /* True ip and fingerprint TTL comparison */ | ||
35 | #define XT_OSF_TTL_LESS 1 /* Check if ip TTL is less than fingerprint one */ | ||
36 | #define XT_OSF_TTL_NOCHECK 2 /* Do not compare ip and fingerprint TTL at all */ | ||
37 | |||
38 | struct xt_osf_info { | ||
39 | char genre[MAXGENRELEN]; | ||
40 | __u32 len; | ||
41 | __u32 flags; | ||
42 | __u32 loglevel; | ||
43 | __u32 ttl; | ||
44 | }; | ||
45 | |||
46 | /* | ||
47 | * Wildcard MSS (kind of). | ||
48 | * It is used to implement a state machine for the different wildcard values | ||
49 | * of the MSS and window sizes. | ||
50 | */ | ||
51 | struct xt_osf_wc { | ||
52 | __u32 wc; | ||
53 | __u32 val; | ||
54 | }; | ||
55 | |||
56 | /* | ||
57 | * This struct represents IANA options | ||
58 | * http://www.iana.org/assignments/tcp-parameters | ||
59 | */ | ||
60 | struct xt_osf_opt { | ||
61 | __u16 kind, length; | ||
62 | struct xt_osf_wc wc; | ||
63 | }; | ||
64 | |||
65 | struct xt_osf_user_finger { | ||
66 | struct xt_osf_wc wss; | ||
67 | |||
68 | __u8 ttl, df; | ||
69 | __u16 ss, mss; | ||
70 | __u16 opt_num; | ||
71 | |||
72 | char genre[MAXGENRELEN]; | ||
73 | char version[MAXGENRELEN]; | ||
74 | char subtype[MAXGENRELEN]; | ||
75 | |||
76 | /* MAX_IPOPTLEN is maximum if all options are NOPs or EOLs */ | ||
77 | struct xt_osf_opt opt[MAX_IPOPTLEN]; | ||
78 | }; | ||
79 | |||
80 | struct xt_osf_nlmsg { | ||
81 | struct xt_osf_user_finger f; | ||
82 | struct iphdr ip; | ||
83 | struct tcphdr tcp; | ||
84 | }; | ||
85 | |||
86 | /* Defines for IANA option kinds */ | ||
87 | |||
88 | enum iana_options { | ||
89 | OSFOPT_EOL = 0, /* End of options */ | ||
90 | OSFOPT_NOP, /* NOP */ | ||
91 | OSFOPT_MSS, /* Maximum segment size */ | ||
92 | OSFOPT_WSO, /* Window scale option */ | ||
93 | OSFOPT_SACKP, /* SACK permitted */ | ||
94 | OSFOPT_SACK, /* SACK */ | ||
95 | OSFOPT_ECHO, | ||
96 | OSFOPT_ECHOREPLY, | ||
97 | OSFOPT_TS, /* Timestamp option */ | ||
98 | OSFOPT_POCP, /* Partial Order Connection Permitted */ | ||
99 | OSFOPT_POSP, /* Partial Order Service Profile */ | ||
100 | |||
101 | /* Others are not used in the current OSF */ | ||
102 | OSFOPT_EMPTY = 255, | ||
103 | }; | ||
104 | |||
105 | /* | ||
106 | * Initial window size option state machine: multiple of mss, mtu or | ||
107 | * plain numeric value. Can also be made as plain numeric value which | ||
108 | * is not a multiple of specified value. | ||
109 | */ | ||
110 | enum xt_osf_window_size_options { | ||
111 | OSF_WSS_PLAIN = 0, | ||
112 | OSF_WSS_MSS, | ||
113 | OSF_WSS_MTU, | ||
114 | OSF_WSS_MODULO, | ||
115 | OSF_WSS_MAX, | ||
116 | }; | ||
117 | |||
118 | /* | ||
119 | * Add/remove fingerprint from the kernel. | ||
120 | */ | ||
121 | enum xt_osf_msg_types { | ||
122 | OSF_MSG_ADD, | ||
123 | OSF_MSG_REMOVE, | ||
124 | OSF_MSG_MAX, | ||
125 | }; | ||
126 | |||
127 | enum xt_osf_attr_type { | ||
128 | OSF_ATTR_UNSPEC, | ||
129 | OSF_ATTR_FINGER, | ||
130 | OSF_ATTR_MAX, | ||
131 | }; | ||
132 | |||
133 | #endif /* _XT_OSF_H */ | ||
diff --git a/include/linux/netfilter/xt_socket.h b/include/linux/netfilter/xt_socket.h new file mode 100644 index 00000000000..6f475b8ff34 --- /dev/null +++ b/include/linux/netfilter/xt_socket.h | |||
@@ -0,0 +1,12 @@ | |||
1 | #ifndef _XT_SOCKET_H | ||
2 | #define _XT_SOCKET_H | ||
3 | |||
4 | enum { | ||
5 | XT_SOCKET_TRANSPARENT = 1 << 0, | ||
6 | }; | ||
7 | |||
8 | struct xt_socket_mtinfo1 { | ||
9 | __u8 flags; | ||
10 | }; | ||
11 | |||
12 | #endif /* _XT_SOCKET_H */ | ||
diff --git a/include/net/netfilter/ipv4/nf_conntrack_icmp.h b/include/net/netfilter/ipv4/nf_conntrack_icmp.h deleted file mode 100644 index 3dd22cff23e..00000000000 --- a/include/net/netfilter/ipv4/nf_conntrack_icmp.h +++ /dev/null | |||
@@ -1,11 +0,0 @@ | |||
1 | #ifndef _NF_CONNTRACK_ICMP_H | ||
2 | #define _NF_CONNTRACK_ICMP_H | ||
3 | /* ICMP tracking. */ | ||
4 | #include <asm/atomic.h> | ||
5 | |||
6 | struct ip_ct_icmp | ||
7 | { | ||
8 | /* Optimization: when number in == number out, forget immediately. */ | ||
9 | atomic_t count; | ||
10 | }; | ||
11 | #endif /* _NF_CONNTRACK_ICMP_H */ | ||
diff --git a/include/net/netfilter/ipv6/nf_conntrack_icmpv6.h b/include/net/netfilter/ipv6/nf_conntrack_icmpv6.h index 86591afda29..67edd50a398 100644 --- a/include/net/netfilter/ipv6/nf_conntrack_icmpv6.h +++ b/include/net/netfilter/ipv6/nf_conntrack_icmpv6.h | |||
@@ -9,7 +9,6 @@ | |||
9 | 9 | ||
10 | #ifndef _NF_CONNTRACK_ICMPV6_H | 10 | #ifndef _NF_CONNTRACK_ICMPV6_H |
11 | #define _NF_CONNTRACK_ICMPV6_H | 11 | #define _NF_CONNTRACK_ICMPV6_H |
12 | #include <asm/atomic.h> | ||
13 | 12 | ||
14 | #ifndef ICMPV6_NI_QUERY | 13 | #ifndef ICMPV6_NI_QUERY |
15 | #define ICMPV6_NI_QUERY 139 | 14 | #define ICMPV6_NI_QUERY 139 |
@@ -18,10 +17,4 @@ | |||
18 | #define ICMPV6_NI_REPLY 140 | 17 | #define ICMPV6_NI_REPLY 140 |
19 | #endif | 18 | #endif |
20 | 19 | ||
21 | struct nf_ct_icmpv6 | ||
22 | { | ||
23 | /* Optimization: when number in == number out, forget immediately. */ | ||
24 | atomic_t count; | ||
25 | }; | ||
26 | |||
27 | #endif /* _NF_CONNTRACK_ICMPV6_H */ | 20 | #endif /* _NF_CONNTRACK_ICMPV6_H */ |
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h index 6c3f964de9e..ecc79f95907 100644 --- a/include/net/netfilter/nf_conntrack.h +++ b/include/net/netfilter/nf_conntrack.h | |||
@@ -23,7 +23,6 @@ | |||
23 | #include <linux/netfilter/nf_conntrack_dccp.h> | 23 | #include <linux/netfilter/nf_conntrack_dccp.h> |
24 | #include <linux/netfilter/nf_conntrack_sctp.h> | 24 | #include <linux/netfilter/nf_conntrack_sctp.h> |
25 | #include <linux/netfilter/nf_conntrack_proto_gre.h> | 25 | #include <linux/netfilter/nf_conntrack_proto_gre.h> |
26 | #include <net/netfilter/ipv4/nf_conntrack_icmp.h> | ||
27 | #include <net/netfilter/ipv6/nf_conntrack_icmpv6.h> | 26 | #include <net/netfilter/ipv6/nf_conntrack_icmpv6.h> |
28 | 27 | ||
29 | #include <net/netfilter/nf_conntrack_tuple.h> | 28 | #include <net/netfilter/nf_conntrack_tuple.h> |
@@ -34,8 +33,6 @@ union nf_conntrack_proto { | |||
34 | struct nf_ct_dccp dccp; | 33 | struct nf_ct_dccp dccp; |
35 | struct ip_ct_sctp sctp; | 34 | struct ip_ct_sctp sctp; |
36 | struct ip_ct_tcp tcp; | 35 | struct ip_ct_tcp tcp; |
37 | struct ip_ct_icmp icmp; | ||
38 | struct nf_ct_icmpv6 icmpv6; | ||
39 | struct nf_ct_gre gre; | 36 | struct nf_ct_gre gre; |
40 | }; | 37 | }; |
41 | 38 | ||
@@ -96,6 +93,8 @@ struct nf_conn { | |||
96 | plus 1 for any connection(s) we are `master' for */ | 93 | plus 1 for any connection(s) we are `master' for */ |
97 | struct nf_conntrack ct_general; | 94 | struct nf_conntrack ct_general; |
98 | 95 | ||
96 | spinlock_t lock; | ||
97 | |||
99 | /* XXX should I move this to the tail ? - Y.K */ | 98 | /* XXX should I move this to the tail ? - Y.K */ |
100 | /* These are my tuples; original and reply */ | 99 | /* These are my tuples; original and reply */ |
101 | struct nf_conntrack_tuple_hash tuplehash[IP_CT_DIR_MAX]; | 100 | struct nf_conntrack_tuple_hash tuplehash[IP_CT_DIR_MAX]; |
@@ -144,6 +143,8 @@ static inline u_int8_t nf_ct_protonum(const struct nf_conn *ct) | |||
144 | return ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum; | 143 | return ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum; |
145 | } | 144 | } |
146 | 145 | ||
146 | #define nf_ct_tuple(ct, dir) (&(ct)->tuplehash[dir].tuple) | ||
147 | |||
147 | /* get master conntrack via master expectation */ | 148 | /* get master conntrack via master expectation */ |
148 | #define master_ct(conntr) (conntr->master) | 149 | #define master_ct(conntr) (conntr->master) |
149 | 150 | ||
@@ -201,7 +202,7 @@ __nf_conntrack_find(struct net *net, const struct nf_conntrack_tuple *tuple); | |||
201 | 202 | ||
202 | extern void nf_conntrack_hash_insert(struct nf_conn *ct); | 203 | extern void nf_conntrack_hash_insert(struct nf_conn *ct); |
203 | 204 | ||
204 | extern void nf_conntrack_flush(struct net *net, u32 pid, int report); | 205 | extern void nf_conntrack_flush_report(struct net *net, u32 pid, int report); |
205 | 206 | ||
206 | extern bool nf_ct_get_tuplepr(const struct sk_buff *skb, | 207 | extern bool nf_ct_get_tuplepr(const struct sk_buff *skb, |
207 | unsigned int nhoff, u_int16_t l3num, | 208 | unsigned int nhoff, u_int16_t l3num, |
diff --git a/include/net/netfilter/nf_conntrack_ecache.h b/include/net/netfilter/nf_conntrack_ecache.h index 0ff0dc69ca4..1afb907e015 100644 --- a/include/net/netfilter/nf_conntrack_ecache.h +++ b/include/net/netfilter/nf_conntrack_ecache.h | |||
@@ -6,11 +6,55 @@ | |||
6 | #define _NF_CONNTRACK_ECACHE_H | 6 | #define _NF_CONNTRACK_ECACHE_H |
7 | #include <net/netfilter/nf_conntrack.h> | 7 | #include <net/netfilter/nf_conntrack.h> |
8 | 8 | ||
9 | #include <linux/notifier.h> | ||
10 | #include <linux/interrupt.h> | 9 | #include <linux/interrupt.h> |
11 | #include <net/net_namespace.h> | 10 | #include <net/net_namespace.h> |
12 | #include <net/netfilter/nf_conntrack_expect.h> | 11 | #include <net/netfilter/nf_conntrack_expect.h> |
13 | 12 | ||
13 | /* Connection tracking event bits */ | ||
14 | enum ip_conntrack_events | ||
15 | { | ||
16 | /* New conntrack */ | ||
17 | IPCT_NEW_BIT = 0, | ||
18 | IPCT_NEW = (1 << IPCT_NEW_BIT), | ||
19 | |||
20 | /* Expected connection */ | ||
21 | IPCT_RELATED_BIT = 1, | ||
22 | IPCT_RELATED = (1 << IPCT_RELATED_BIT), | ||
23 | |||
24 | /* Destroyed conntrack */ | ||
25 | IPCT_DESTROY_BIT = 2, | ||
26 | IPCT_DESTROY = (1 << IPCT_DESTROY_BIT), | ||
27 | |||
28 | /* Status has changed */ | ||
29 | IPCT_STATUS_BIT = 3, | ||
30 | IPCT_STATUS = (1 << IPCT_STATUS_BIT), | ||
31 | |||
32 | /* Update of protocol info */ | ||
33 | IPCT_PROTOINFO_BIT = 4, | ||
34 | IPCT_PROTOINFO = (1 << IPCT_PROTOINFO_BIT), | ||
35 | |||
36 | /* New helper for conntrack */ | ||
37 | IPCT_HELPER_BIT = 5, | ||
38 | IPCT_HELPER = (1 << IPCT_HELPER_BIT), | ||
39 | |||
40 | /* Mark is set */ | ||
41 | IPCT_MARK_BIT = 6, | ||
42 | IPCT_MARK = (1 << IPCT_MARK_BIT), | ||
43 | |||
44 | /* NAT sequence adjustment */ | ||
45 | IPCT_NATSEQADJ_BIT = 7, | ||
46 | IPCT_NATSEQADJ = (1 << IPCT_NATSEQADJ_BIT), | ||
47 | |||
48 | /* Secmark is set */ | ||
49 | IPCT_SECMARK_BIT = 8, | ||
50 | IPCT_SECMARK = (1 << IPCT_SECMARK_BIT), | ||
51 | }; | ||
52 | |||
53 | enum ip_conntrack_expect_events { | ||
54 | IPEXP_NEW_BIT = 0, | ||
55 | IPEXP_NEW = (1 << IPEXP_NEW_BIT), | ||
56 | }; | ||
57 | |||
14 | #ifdef CONFIG_NF_CONNTRACK_EVENTS | 58 | #ifdef CONFIG_NF_CONNTRACK_EVENTS |
15 | struct nf_conntrack_ecache { | 59 | struct nf_conntrack_ecache { |
16 | struct nf_conn *ct; | 60 | struct nf_conn *ct; |
@@ -24,9 +68,13 @@ struct nf_ct_event { | |||
24 | int report; | 68 | int report; |
25 | }; | 69 | }; |
26 | 70 | ||
27 | extern struct atomic_notifier_head nf_conntrack_chain; | 71 | struct nf_ct_event_notifier { |
28 | extern int nf_conntrack_register_notifier(struct notifier_block *nb); | 72 | int (*fcn)(unsigned int events, struct nf_ct_event *item); |
29 | extern int nf_conntrack_unregister_notifier(struct notifier_block *nb); | 73 | }; |
74 | |||
75 | extern struct nf_ct_event_notifier *nf_conntrack_event_cb; | ||
76 | extern int nf_conntrack_register_notifier(struct nf_ct_event_notifier *nb); | ||
77 | extern void nf_conntrack_unregister_notifier(struct nf_ct_event_notifier *nb); | ||
30 | 78 | ||
31 | extern void nf_ct_deliver_cached_events(const struct nf_conn *ct); | 79 | extern void nf_ct_deliver_cached_events(const struct nf_conn *ct); |
32 | extern void __nf_ct_event_cache_init(struct nf_conn *ct); | 80 | extern void __nf_ct_event_cache_init(struct nf_conn *ct); |
@@ -52,13 +100,23 @@ nf_conntrack_event_report(enum ip_conntrack_events event, | |||
52 | u32 pid, | 100 | u32 pid, |
53 | int report) | 101 | int report) |
54 | { | 102 | { |
55 | struct nf_ct_event item = { | 103 | struct nf_ct_event_notifier *notify; |
56 | .ct = ct, | 104 | |
57 | .pid = pid, | 105 | rcu_read_lock(); |
58 | .report = report | 106 | notify = rcu_dereference(nf_conntrack_event_cb); |
59 | }; | 107 | if (notify == NULL) |
60 | if (nf_ct_is_confirmed(ct) && !nf_ct_is_dying(ct)) | 108 | goto out_unlock; |
61 | atomic_notifier_call_chain(&nf_conntrack_chain, event, &item); | 109 | |
110 | if (nf_ct_is_confirmed(ct) && !nf_ct_is_dying(ct)) { | ||
111 | struct nf_ct_event item = { | ||
112 | .ct = ct, | ||
113 | .pid = pid, | ||
114 | .report = report | ||
115 | }; | ||
116 | notify->fcn(event, &item); | ||
117 | } | ||
118 | out_unlock: | ||
119 | rcu_read_unlock(); | ||
62 | } | 120 | } |
63 | 121 | ||
64 | static inline void | 122 | static inline void |
@@ -73,9 +131,13 @@ struct nf_exp_event { | |||
73 | int report; | 131 | int report; |
74 | }; | 132 | }; |
75 | 133 | ||
76 | extern struct atomic_notifier_head nf_ct_expect_chain; | 134 | struct nf_exp_event_notifier { |
77 | extern int nf_ct_expect_register_notifier(struct notifier_block *nb); | 135 | int (*fcn)(unsigned int events, struct nf_exp_event *item); |
78 | extern int nf_ct_expect_unregister_notifier(struct notifier_block *nb); | 136 | }; |
137 | |||
138 | extern struct nf_exp_event_notifier *nf_expect_event_cb; | ||
139 | extern int nf_ct_expect_register_notifier(struct nf_exp_event_notifier *nb); | ||
140 | extern void nf_ct_expect_unregister_notifier(struct nf_exp_event_notifier *nb); | ||
79 | 141 | ||
80 | static inline void | 142 | static inline void |
81 | nf_ct_expect_event_report(enum ip_conntrack_expect_events event, | 143 | nf_ct_expect_event_report(enum ip_conntrack_expect_events event, |
@@ -83,12 +145,23 @@ nf_ct_expect_event_report(enum ip_conntrack_expect_events event, | |||
83 | u32 pid, | 145 | u32 pid, |
84 | int report) | 146 | int report) |
85 | { | 147 | { |
86 | struct nf_exp_event item = { | 148 | struct nf_exp_event_notifier *notify; |
87 | .exp = exp, | 149 | |
88 | .pid = pid, | 150 | rcu_read_lock(); |
89 | .report = report | 151 | notify = rcu_dereference(nf_expect_event_cb); |
90 | }; | 152 | if (notify == NULL) |
91 | atomic_notifier_call_chain(&nf_ct_expect_chain, event, &item); | 153 | goto out_unlock; |
154 | |||
155 | { | ||
156 | struct nf_exp_event item = { | ||
157 | .exp = exp, | ||
158 | .pid = pid, | ||
159 | .report = report | ||
160 | }; | ||
161 | notify->fcn(event, &item); | ||
162 | } | ||
163 | out_unlock: | ||
164 | rcu_read_unlock(); | ||
92 | } | 165 | } |
93 | 166 | ||
94 | static inline void | 167 | static inline void |
diff --git a/include/net/netfilter/nf_conntrack_l4proto.h b/include/net/netfilter/nf_conntrack_l4proto.h index ba32ed7bdab..3767fb41e54 100644 --- a/include/net/netfilter/nf_conntrack_l4proto.h +++ b/include/net/netfilter/nf_conntrack_l4proto.h | |||
@@ -59,11 +59,11 @@ struct nf_conntrack_l4proto | |||
59 | const struct nf_conntrack_tuple *); | 59 | const struct nf_conntrack_tuple *); |
60 | 60 | ||
61 | /* Print out the private part of the conntrack. */ | 61 | /* Print out the private part of the conntrack. */ |
62 | int (*print_conntrack)(struct seq_file *s, const struct nf_conn *); | 62 | int (*print_conntrack)(struct seq_file *s, struct nf_conn *); |
63 | 63 | ||
64 | /* convert protoinfo to nfnetink attributes */ | 64 | /* convert protoinfo to nfnetink attributes */ |
65 | int (*to_nlattr)(struct sk_buff *skb, struct nlattr *nla, | 65 | int (*to_nlattr)(struct sk_buff *skb, struct nlattr *nla, |
66 | const struct nf_conn *ct); | 66 | struct nf_conn *ct); |
67 | /* Calculate protoinfo nlattr size */ | 67 | /* Calculate protoinfo nlattr size */ |
68 | int (*nlattr_size)(void); | 68 | int (*nlattr_size)(void); |
69 | 69 | ||
diff --git a/include/net/netlink.h b/include/net/netlink.h index eddb50289d6..007bdb07dab 100644 --- a/include/net/netlink.h +++ b/include/net/netlink.h | |||
@@ -940,6 +940,15 @@ static inline u64 nla_get_u64(const struct nlattr *nla) | |||
940 | } | 940 | } |
941 | 941 | ||
942 | /** | 942 | /** |
943 | * nla_get_be64 - return payload of __be64 attribute | ||
944 | * @nla: __be64 netlink attribute | ||
945 | */ | ||
946 | static inline __be64 nla_get_be64(const struct nlattr *nla) | ||
947 | { | ||
948 | return *(__be64 *) nla_data(nla); | ||
949 | } | ||
950 | |||
951 | /** | ||
943 | * nla_get_flag - return payload of flag attribute | 952 | * nla_get_flag - return payload of flag attribute |
944 | * @nla: flag netlink attribute | 953 | * @nla: flag netlink attribute |
945 | */ | 954 | */ |