140d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy#ifndef _NF_CONNTRACK_COMMON_H 240d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy#define _NF_CONNTRACK_COMMON_H 340d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy/* Connection state tracking for netfilter. This is separated from, 440d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy but required by, the NAT layer; it can also be used by an iptables 540d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy extension. */ 6350661a6eb089f3e54e67e022db9e16ea280499fJan Engelhardtenum ip_conntrack_info { 740d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy /* Part of an established connection (either direction). */ 840d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy IP_CT_ESTABLISHED, 940d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy 1040d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy /* Like NEW, but related to an existing connection, or ICMP error 1140d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy (in either direction). */ 1240d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy IP_CT_RELATED, 1340d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy 1440d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy /* Started a new connection to track (only 1540d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy IP_CT_DIR_ORIGINAL); may be a retransmission. */ 1640d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy IP_CT_NEW, 1740d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy 1840d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy /* >= this indicates reply direction */ 1940d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy IP_CT_IS_REPLY, 2040d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy 21dbe77cc974cee656eae37e75039dd1a410a4535bJan Engelhardt IP_CT_ESTABLISHED_REPLY = IP_CT_ESTABLISHED + IP_CT_IS_REPLY, 22dbe77cc974cee656eae37e75039dd1a410a4535bJan Engelhardt IP_CT_RELATED_REPLY = IP_CT_RELATED + IP_CT_IS_REPLY, 23dbe77cc974cee656eae37e75039dd1a410a4535bJan Engelhardt IP_CT_NEW_REPLY = IP_CT_NEW + IP_CT_IS_REPLY, 2440d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy /* Number of distinct IP_CT types (no NEW in reply dirn). */ 2540d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy IP_CT_NUMBER = IP_CT_IS_REPLY * 2 - 1 2640d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy}; 2740d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy 2840d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy/* Bitset representing status of connection. */ 2940d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardyenum ip_conntrack_status { 3040d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy /* It's an expected connection: bit 0 set. This bit never changed */ 3140d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy IPS_EXPECTED_BIT = 0, 3240d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy IPS_EXPECTED = (1 << IPS_EXPECTED_BIT), 3340d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy 3440d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy /* We've seen packets both ways: bit 1 set. Can be set, not unset. */ 3540d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy IPS_SEEN_REPLY_BIT = 1, 3640d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy IPS_SEEN_REPLY = (1 << IPS_SEEN_REPLY_BIT), 3740d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy 3840d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy /* Conntrack should never be early-expired. */ 3940d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy IPS_ASSURED_BIT = 2, 4040d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy IPS_ASSURED = (1 << IPS_ASSURED_BIT), 4140d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy 4240d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy /* Connection is confirmed: originating packet has left box */ 4340d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy IPS_CONFIRMED_BIT = 3, 4440d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy IPS_CONFIRMED = (1 << IPS_CONFIRMED_BIT), 4540d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy 4640d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy /* Connection needs src nat in orig dir. This bit never changed. */ 4740d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy IPS_SRC_NAT_BIT = 4, 4840d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy IPS_SRC_NAT = (1 << IPS_SRC_NAT_BIT), 4940d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy 5040d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy /* Connection needs dst nat in orig dir. This bit never changed. */ 5140d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy IPS_DST_NAT_BIT = 5, 5240d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy IPS_DST_NAT = (1 << IPS_DST_NAT_BIT), 5340d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy 5440d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy /* Both together. */ 5540d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy IPS_NAT_MASK = (IPS_DST_NAT | IPS_SRC_NAT), 5640d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy 5740d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy /* Connection needs TCP sequence adjusted. */ 5840d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy IPS_SEQ_ADJUST_BIT = 6, 5940d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy IPS_SEQ_ADJUST = (1 << IPS_SEQ_ADJUST_BIT), 6040d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy 6140d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy /* NAT initialization bits. */ 6240d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy IPS_SRC_NAT_DONE_BIT = 7, 6340d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy IPS_SRC_NAT_DONE = (1 << IPS_SRC_NAT_DONE_BIT), 6440d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy 6540d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy IPS_DST_NAT_DONE_BIT = 8, 6640d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy IPS_DST_NAT_DONE = (1 << IPS_DST_NAT_DONE_BIT), 6740d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy 6840d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy /* Both together */ 6940d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy IPS_NAT_DONE_MASK = (IPS_DST_NAT_DONE | IPS_SRC_NAT_DONE), 7040d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy 7140d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy /* Connection is dying (removed from lists), can not be unset. */ 7240d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy IPS_DYING_BIT = 9, 7340d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy IPS_DYING = (1 << IPS_DYING_BIT), 7440d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy 7540d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy /* Connection has fixed timeout. */ 7640d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy IPS_FIXED_TIMEOUT_BIT = 10, 7740d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy IPS_FIXED_TIMEOUT = (1 << IPS_FIXED_TIMEOUT_BIT), 789fdbaa71452edaac9d5906716c15937f670341faPatrick McHardy 799fdbaa71452edaac9d5906716c15937f670341faPatrick McHardy /* Conntrack is a template */ 809fdbaa71452edaac9d5906716c15937f670341faPatrick McHardy IPS_TEMPLATE_BIT = 11, 819fdbaa71452edaac9d5906716c15937f670341faPatrick McHardy IPS_TEMPLATE = (1 << IPS_TEMPLATE_BIT), 82dbe77cc974cee656eae37e75039dd1a410a4535bJan Engelhardt 83dbe77cc974cee656eae37e75039dd1a410a4535bJan Engelhardt /* Conntrack is a fake untracked entry */ 84dbe77cc974cee656eae37e75039dd1a410a4535bJan Engelhardt IPS_UNTRACKED_BIT = 12, 85dbe77cc974cee656eae37e75039dd1a410a4535bJan Engelhardt IPS_UNTRACKED = (1 << IPS_UNTRACKED_BIT), 869fdbaa71452edaac9d5906716c15937f670341faPatrick McHardy}; 879fdbaa71452edaac9d5906716c15937f670341faPatrick McHardy 889fdbaa71452edaac9d5906716c15937f670341faPatrick McHardy/* Connection tracking event types */ 899fdbaa71452edaac9d5906716c15937f670341faPatrick McHardyenum ip_conntrack_events { 909fdbaa71452edaac9d5906716c15937f670341faPatrick McHardy IPCT_NEW, /* new conntrack */ 919fdbaa71452edaac9d5906716c15937f670341faPatrick McHardy IPCT_RELATED, /* related conntrack */ 929fdbaa71452edaac9d5906716c15937f670341faPatrick McHardy IPCT_DESTROY, /* destroyed conntrack */ 939fdbaa71452edaac9d5906716c15937f670341faPatrick McHardy IPCT_REPLY, /* connection has seen two-way traffic */ 949fdbaa71452edaac9d5906716c15937f670341faPatrick McHardy IPCT_ASSURED, /* connection status has changed to assured */ 959fdbaa71452edaac9d5906716c15937f670341faPatrick McHardy IPCT_PROTOINFO, /* protocol information has changed */ 969fdbaa71452edaac9d5906716c15937f670341faPatrick McHardy IPCT_HELPER, /* new helper has been set */ 979fdbaa71452edaac9d5906716c15937f670341faPatrick McHardy IPCT_MARK, /* new mark has been set */ 989fdbaa71452edaac9d5906716c15937f670341faPatrick McHardy IPCT_NATSEQADJ, /* NAT is doing sequence adjustment */ 999fdbaa71452edaac9d5906716c15937f670341faPatrick McHardy IPCT_SECMARK, /* new security mark has been set */ 10040d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy}; 10140d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy 1029fdbaa71452edaac9d5906716c15937f670341faPatrick McHardyenum ip_conntrack_expect_events { 1039fdbaa71452edaac9d5906716c15937f670341faPatrick McHardy IPEXP_NEW, /* new expectation */ 104dbe77cc974cee656eae37e75039dd1a410a4535bJan Engelhardt IPEXP_DESTROY, /* destroyed expectation */ 1059fdbaa71452edaac9d5906716c15937f670341faPatrick McHardy}; 106e0bba47e550420e371c97425cc6d39909a6e059bPatrick McHardy 107dbe77cc974cee656eae37e75039dd1a410a4535bJan Engelhardt/* expectation flags */ 108dbe77cc974cee656eae37e75039dd1a410a4535bJan Engelhardt#define NF_CT_EXPECT_PERMANENT 0x1 109dbe77cc974cee656eae37e75039dd1a410a4535bJan Engelhardt#define NF_CT_EXPECT_INACTIVE 0x2 110dbe77cc974cee656eae37e75039dd1a410a4535bJan Engelhardt#define NF_CT_EXPECT_USERSPACE 0x4 111dbe77cc974cee656eae37e75039dd1a410a4535bJan Engelhardt 112dbe77cc974cee656eae37e75039dd1a410a4535bJan Engelhardt 11340d54756cd8a2705e22b36f7aef03bb2c472a10bPatrick McHardy#endif /* _NF_CONNTRACK_COMMON_H */ 114