[NETFILTER]: Add nf_conntrack subsystem.
The existing connection tracking subsystem in netfilter can only
handle ipv4. There were basically two choices present to add
connection tracking support for ipv6. We could either duplicate all
of the ipv4 connection tracking code into an ipv6 counterpart, or (the
choice taken by these patches) we could design a generic layer that
could handle both ipv4 and ipv6 and thus requiring only one sub-protocol
(TCP, UDP, etc.) connection tracking helper module to be written.
In fact nf_conntrack is capable of working with any layer 3
protocol.
The existing ipv4 specific conntrack code could also not deal
with the pecularities of doing connection tracking on ipv6,
which is also cured here. For example, these issues include:
1) ICMPv6 handling, which is used for neighbour discovery in
ipv6 thus some messages such as these should not participate
in connection tracking since effectively they are like ARP
messages
2) fragmentation must be handled differently in ipv6, because
the simplistic "defrag, connection track and NAT, refrag"
(which the existing ipv4 connection tracking does) approach simply
isn't feasible in ipv6
3) ipv6 extension header parsing must occur at the correct spots
before and after connection tracking decisions, and there were
no provisions for this in the existing connection tracking
design
4) ipv6 has no need for stateful NAT
The ipv4 specific conntrack layer is kept around, until all of
the ipv4 specific conntrack helpers are ported over to nf_conntrack
and it is feature complete. Once that occurs, the old conntrack
stuff will get placed into the feature-removal-schedule and we will
fully kill it off 6 months later.
Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
2005-11-09 17:38:16 -07:00
|
|
|
/*
|
|
|
|
* connection tracking helpers.
|
|
|
|
*
|
|
|
|
* 16 Dec 2003: Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp>
|
|
|
|
* - generalize L3 protocol dependent part.
|
|
|
|
*
|
|
|
|
* Derived from include/linux/netfiter_ipv4/ip_conntrack_helper.h
|
|
|
|
*/
|
|
|
|
|
|
|
|
#ifndef _NF_CONNTRACK_HELPER_H
|
|
|
|
#define _NF_CONNTRACK_HELPER_H
|
|
|
|
#include <net/netfilter/nf_conntrack.h>
|
2007-07-07 23:23:42 -06:00
|
|
|
#include <net/netfilter/nf_conntrack_extend.h>
|
2012-06-07 04:11:50 -06:00
|
|
|
#include <net/netfilter/nf_conntrack_expect.h>
|
[NETFILTER]: Add nf_conntrack subsystem.
The existing connection tracking subsystem in netfilter can only
handle ipv4. There were basically two choices present to add
connection tracking support for ipv6. We could either duplicate all
of the ipv4 connection tracking code into an ipv6 counterpart, or (the
choice taken by these patches) we could design a generic layer that
could handle both ipv4 and ipv6 and thus requiring only one sub-protocol
(TCP, UDP, etc.) connection tracking helper module to be written.
In fact nf_conntrack is capable of working with any layer 3
protocol.
The existing ipv4 specific conntrack code could also not deal
with the pecularities of doing connection tracking on ipv6,
which is also cured here. For example, these issues include:
1) ICMPv6 handling, which is used for neighbour discovery in
ipv6 thus some messages such as these should not participate
in connection tracking since effectively they are like ARP
messages
2) fragmentation must be handled differently in ipv6, because
the simplistic "defrag, connection track and NAT, refrag"
(which the existing ipv4 connection tracking does) approach simply
isn't feasible in ipv6
3) ipv6 extension header parsing must occur at the correct spots
before and after connection tracking decisions, and there were
no provisions for this in the existing connection tracking
design
4) ipv6 has no need for stateful NAT
The ipv4 specific conntrack layer is kept around, until all of
the ipv4 specific conntrack helpers are ported over to nf_conntrack
and it is feature complete. Once that occurs, the old conntrack
stuff will get placed into the feature-removal-schedule and we will
fully kill it off 6 months later.
Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
2005-11-09 17:38:16 -07:00
|
|
|
|
|
|
|
struct module;
|
|
|
|
|
2012-05-13 13:44:54 -06:00
|
|
|
enum nf_ct_helper_flags {
|
|
|
|
NF_CT_HELPER_F_USERSPACE = (1 << 0),
|
|
|
|
NF_CT_HELPER_F_CONFIGURED = (1 << 1),
|
|
|
|
};
|
|
|
|
|
2009-03-25 11:44:01 -06:00
|
|
|
#define NF_CT_HELPER_NAME_LEN 16
|
|
|
|
|
2009-11-02 20:26:03 -07:00
|
|
|
struct nf_conntrack_helper {
|
2007-07-07 23:36:46 -06:00
|
|
|
struct hlist_node hnode; /* Internal use. */
|
[NETFILTER]: Add nf_conntrack subsystem.
The existing connection tracking subsystem in netfilter can only
handle ipv4. There were basically two choices present to add
connection tracking support for ipv6. We could either duplicate all
of the ipv4 connection tracking code into an ipv6 counterpart, or (the
choice taken by these patches) we could design a generic layer that
could handle both ipv4 and ipv6 and thus requiring only one sub-protocol
(TCP, UDP, etc.) connection tracking helper module to be written.
In fact nf_conntrack is capable of working with any layer 3
protocol.
The existing ipv4 specific conntrack code could also not deal
with the pecularities of doing connection tracking on ipv6,
which is also cured here. For example, these issues include:
1) ICMPv6 handling, which is used for neighbour discovery in
ipv6 thus some messages such as these should not participate
in connection tracking since effectively they are like ARP
messages
2) fragmentation must be handled differently in ipv6, because
the simplistic "defrag, connection track and NAT, refrag"
(which the existing ipv4 connection tracking does) approach simply
isn't feasible in ipv6
3) ipv6 extension header parsing must occur at the correct spots
before and after connection tracking decisions, and there were
no provisions for this in the existing connection tracking
design
4) ipv6 has no need for stateful NAT
The ipv4 specific conntrack layer is kept around, until all of
the ipv4 specific conntrack helpers are ported over to nf_conntrack
and it is feature complete. Once that occurs, the old conntrack
stuff will get placed into the feature-removal-schedule and we will
fully kill it off 6 months later.
Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
2005-11-09 17:38:16 -07:00
|
|
|
|
2012-01-15 08:34:08 -07:00
|
|
|
char name[NF_CT_HELPER_NAME_LEN]; /* name of the module */
|
[NETFILTER]: Add nf_conntrack subsystem.
The existing connection tracking subsystem in netfilter can only
handle ipv4. There were basically two choices present to add
connection tracking support for ipv6. We could either duplicate all
of the ipv4 connection tracking code into an ipv6 counterpart, or (the
choice taken by these patches) we could design a generic layer that
could handle both ipv4 and ipv6 and thus requiring only one sub-protocol
(TCP, UDP, etc.) connection tracking helper module to be written.
In fact nf_conntrack is capable of working with any layer 3
protocol.
The existing ipv4 specific conntrack code could also not deal
with the pecularities of doing connection tracking on ipv6,
which is also cured here. For example, these issues include:
1) ICMPv6 handling, which is used for neighbour discovery in
ipv6 thus some messages such as these should not participate
in connection tracking since effectively they are like ARP
messages
2) fragmentation must be handled differently in ipv6, because
the simplistic "defrag, connection track and NAT, refrag"
(which the existing ipv4 connection tracking does) approach simply
isn't feasible in ipv6
3) ipv6 extension header parsing must occur at the correct spots
before and after connection tracking decisions, and there were
no provisions for this in the existing connection tracking
design
4) ipv6 has no need for stateful NAT
The ipv4 specific conntrack layer is kept around, until all of
the ipv4 specific conntrack helpers are ported over to nf_conntrack
and it is feature complete. Once that occurs, the old conntrack
stuff will get placed into the feature-removal-schedule and we will
fully kill it off 6 months later.
Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
2005-11-09 17:38:16 -07:00
|
|
|
struct module *me; /* pointer to self */
|
2008-03-25 21:09:15 -06:00
|
|
|
const struct nf_conntrack_expect_policy *expect_policy;
|
[NETFILTER]: Add nf_conntrack subsystem.
The existing connection tracking subsystem in netfilter can only
handle ipv4. There were basically two choices present to add
connection tracking support for ipv6. We could either duplicate all
of the ipv4 connection tracking code into an ipv6 counterpart, or (the
choice taken by these patches) we could design a generic layer that
could handle both ipv4 and ipv6 and thus requiring only one sub-protocol
(TCP, UDP, etc.) connection tracking helper module to be written.
In fact nf_conntrack is capable of working with any layer 3
protocol.
The existing ipv4 specific conntrack code could also not deal
with the pecularities of doing connection tracking on ipv6,
which is also cured here. For example, these issues include:
1) ICMPv6 handling, which is used for neighbour discovery in
ipv6 thus some messages such as these should not participate
in connection tracking since effectively they are like ARP
messages
2) fragmentation must be handled differently in ipv6, because
the simplistic "defrag, connection track and NAT, refrag"
(which the existing ipv4 connection tracking does) approach simply
isn't feasible in ipv6
3) ipv6 extension header parsing must occur at the correct spots
before and after connection tracking decisions, and there were
no provisions for this in the existing connection tracking
design
4) ipv6 has no need for stateful NAT
The ipv4 specific conntrack layer is kept around, until all of
the ipv4 specific conntrack helpers are ported over to nf_conntrack
and it is feature complete. Once that occurs, the old conntrack
stuff will get placed into the feature-removal-schedule and we will
fully kill it off 6 months later.
Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
2005-11-09 17:38:16 -07:00
|
|
|
|
2007-07-07 23:31:32 -06:00
|
|
|
/* Tuple of things we will help (compared against server response) */
|
[NETFILTER]: Add nf_conntrack subsystem.
The existing connection tracking subsystem in netfilter can only
handle ipv4. There were basically two choices present to add
connection tracking support for ipv6. We could either duplicate all
of the ipv4 connection tracking code into an ipv6 counterpart, or (the
choice taken by these patches) we could design a generic layer that
could handle both ipv4 and ipv6 and thus requiring only one sub-protocol
(TCP, UDP, etc.) connection tracking helper module to be written.
In fact nf_conntrack is capable of working with any layer 3
protocol.
The existing ipv4 specific conntrack code could also not deal
with the pecularities of doing connection tracking on ipv6,
which is also cured here. For example, these issues include:
1) ICMPv6 handling, which is used for neighbour discovery in
ipv6 thus some messages such as these should not participate
in connection tracking since effectively they are like ARP
messages
2) fragmentation must be handled differently in ipv6, because
the simplistic "defrag, connection track and NAT, refrag"
(which the existing ipv4 connection tracking does) approach simply
isn't feasible in ipv6
3) ipv6 extension header parsing must occur at the correct spots
before and after connection tracking decisions, and there were
no provisions for this in the existing connection tracking
design
4) ipv6 has no need for stateful NAT
The ipv4 specific conntrack layer is kept around, until all of
the ipv4 specific conntrack helpers are ported over to nf_conntrack
and it is feature complete. Once that occurs, the old conntrack
stuff will get placed into the feature-removal-schedule and we will
fully kill it off 6 months later.
Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
2005-11-09 17:38:16 -07:00
|
|
|
struct nf_conntrack_tuple tuple;
|
2007-07-07 23:31:32 -06:00
|
|
|
|
[NETFILTER]: Add nf_conntrack subsystem.
The existing connection tracking subsystem in netfilter can only
handle ipv4. There were basically two choices present to add
connection tracking support for ipv6. We could either duplicate all
of the ipv4 connection tracking code into an ipv6 counterpart, or (the
choice taken by these patches) we could design a generic layer that
could handle both ipv4 and ipv6 and thus requiring only one sub-protocol
(TCP, UDP, etc.) connection tracking helper module to be written.
In fact nf_conntrack is capable of working with any layer 3
protocol.
The existing ipv4 specific conntrack code could also not deal
with the pecularities of doing connection tracking on ipv6,
which is also cured here. For example, these issues include:
1) ICMPv6 handling, which is used for neighbour discovery in
ipv6 thus some messages such as these should not participate
in connection tracking since effectively they are like ARP
messages
2) fragmentation must be handled differently in ipv6, because
the simplistic "defrag, connection track and NAT, refrag"
(which the existing ipv4 connection tracking does) approach simply
isn't feasible in ipv6
3) ipv6 extension header parsing must occur at the correct spots
before and after connection tracking decisions, and there were
no provisions for this in the existing connection tracking
design
4) ipv6 has no need for stateful NAT
The ipv4 specific conntrack layer is kept around, until all of
the ipv4 specific conntrack helpers are ported over to nf_conntrack
and it is feature complete. Once that occurs, the old conntrack
stuff will get placed into the feature-removal-schedule and we will
fully kill it off 6 months later.
Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
2005-11-09 17:38:16 -07:00
|
|
|
/* Function to call when data passes; return verdict, or -1 to
|
|
|
|
invalidate. */
|
2007-10-15 01:53:15 -06:00
|
|
|
int (*help)(struct sk_buff *skb,
|
[NETFILTER]: Add nf_conntrack subsystem.
The existing connection tracking subsystem in netfilter can only
handle ipv4. There were basically two choices present to add
connection tracking support for ipv6. We could either duplicate all
of the ipv4 connection tracking code into an ipv6 counterpart, or (the
choice taken by these patches) we could design a generic layer that
could handle both ipv4 and ipv6 and thus requiring only one sub-protocol
(TCP, UDP, etc.) connection tracking helper module to be written.
In fact nf_conntrack is capable of working with any layer 3
protocol.
The existing ipv4 specific conntrack code could also not deal
with the pecularities of doing connection tracking on ipv6,
which is also cured here. For example, these issues include:
1) ICMPv6 handling, which is used for neighbour discovery in
ipv6 thus some messages such as these should not participate
in connection tracking since effectively they are like ARP
messages
2) fragmentation must be handled differently in ipv6, because
the simplistic "defrag, connection track and NAT, refrag"
(which the existing ipv4 connection tracking does) approach simply
isn't feasible in ipv6
3) ipv6 extension header parsing must occur at the correct spots
before and after connection tracking decisions, and there were
no provisions for this in the existing connection tracking
design
4) ipv6 has no need for stateful NAT
The ipv4 specific conntrack layer is kept around, until all of
the ipv4 specific conntrack helpers are ported over to nf_conntrack
and it is feature complete. Once that occurs, the old conntrack
stuff will get placed into the feature-removal-schedule and we will
fully kill it off 6 months later.
Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
2005-11-09 17:38:16 -07:00
|
|
|
unsigned int protoff,
|
|
|
|
struct nf_conn *ct,
|
|
|
|
enum ip_conntrack_info conntrackinfo);
|
2006-01-05 13:19:05 -07:00
|
|
|
|
2006-12-02 23:09:41 -07:00
|
|
|
void (*destroy)(struct nf_conn *ct);
|
|
|
|
|
2012-06-07 06:19:42 -06:00
|
|
|
int (*from_nlattr)(struct nlattr *attr, struct nf_conn *ct);
|
2007-09-28 15:37:41 -06:00
|
|
|
int (*to_nlattr)(struct sk_buff *skb, const struct nf_conn *ct);
|
2008-03-25 21:09:15 -06:00
|
|
|
unsigned int expect_class_max;
|
2012-05-13 13:44:54 -06:00
|
|
|
|
|
|
|
unsigned int flags;
|
2017-04-15 17:29:17 -06:00
|
|
|
|
|
|
|
/* For user-space helpers: */
|
|
|
|
unsigned int queue_num;
|
|
|
|
/* length of userspace private data stored in nf_conn_help->data */
|
|
|
|
u16 data_len;
|
[NETFILTER]: Add nf_conntrack subsystem.
The existing connection tracking subsystem in netfilter can only
handle ipv4. There were basically two choices present to add
connection tracking support for ipv6. We could either duplicate all
of the ipv4 connection tracking code into an ipv6 counterpart, or (the
choice taken by these patches) we could design a generic layer that
could handle both ipv4 and ipv6 and thus requiring only one sub-protocol
(TCP, UDP, etc.) connection tracking helper module to be written.
In fact nf_conntrack is capable of working with any layer 3
protocol.
The existing ipv4 specific conntrack code could also not deal
with the pecularities of doing connection tracking on ipv6,
which is also cured here. For example, these issues include:
1) ICMPv6 handling, which is used for neighbour discovery in
ipv6 thus some messages such as these should not participate
in connection tracking since effectively they are like ARP
messages
2) fragmentation must be handled differently in ipv6, because
the simplistic "defrag, connection track and NAT, refrag"
(which the existing ipv4 connection tracking does) approach simply
isn't feasible in ipv6
3) ipv6 extension header parsing must occur at the correct spots
before and after connection tracking decisions, and there were
no provisions for this in the existing connection tracking
design
4) ipv6 has no need for stateful NAT
The ipv4 specific conntrack layer is kept around, until all of
the ipv4 specific conntrack helpers are ported over to nf_conntrack
and it is feature complete. Once that occurs, the old conntrack
stuff will get placed into the feature-removal-schedule and we will
fully kill it off 6 months later.
Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
2005-11-09 17:38:16 -07:00
|
|
|
};
|
|
|
|
|
2017-04-15 17:29:14 -06:00
|
|
|
/* Must be kept in sync with the classes defined by helpers */
|
|
|
|
#define NF_CT_MAX_EXPECT_CLASSES 4
|
|
|
|
|
|
|
|
/* nf_conn feature for connections that have a helper */
|
|
|
|
struct nf_conn_help {
|
|
|
|
/* Helper. if any */
|
|
|
|
struct nf_conntrack_helper __rcu *helper;
|
|
|
|
|
|
|
|
struct hlist_head expectations;
|
|
|
|
|
|
|
|
/* Current number of expected connections */
|
|
|
|
u8 expecting[NF_CT_MAX_EXPECT_CLASSES];
|
|
|
|
|
|
|
|
/* private helper information. */
|
2017-04-15 17:29:15 -06:00
|
|
|
char data[32] __aligned(8);
|
2017-04-15 17:29:14 -06:00
|
|
|
};
|
|
|
|
|
2017-04-15 17:29:15 -06:00
|
|
|
#define NF_CT_HELPER_BUILD_BUG_ON(structsize) \
|
|
|
|
BUILD_BUG_ON((structsize) > FIELD_SIZEOF(struct nf_conn_help, data))
|
|
|
|
|
2013-09-23 12:37:48 -06:00
|
|
|
struct nf_conntrack_helper *__nf_conntrack_helper_find(const char *name,
|
|
|
|
u16 l3num, u8 protonum);
|
2006-11-28 18:34:59 -07:00
|
|
|
|
2013-09-23 12:37:48 -06:00
|
|
|
struct nf_conntrack_helper *nf_conntrack_helper_try_module_get(const char *name,
|
|
|
|
u16 l3num,
|
|
|
|
u8 protonum);
|
2017-05-07 08:01:55 -06:00
|
|
|
void nf_conntrack_helper_put(struct nf_conntrack_helper *helper);
|
|
|
|
|
2016-07-17 21:39:23 -06:00
|
|
|
void nf_ct_helper_init(struct nf_conntrack_helper *helper,
|
|
|
|
u16 l3num, u16 protonum, const char *name,
|
|
|
|
u16 default_port, u16 spec_port, u32 id,
|
|
|
|
const struct nf_conntrack_expect_policy *exp_pol,
|
2017-04-15 17:29:17 -06:00
|
|
|
u32 expect_class_max,
|
2016-07-17 21:39:23 -06:00
|
|
|
int (*help)(struct sk_buff *skb, unsigned int protoff,
|
|
|
|
struct nf_conn *ct,
|
|
|
|
enum ip_conntrack_info ctinfo),
|
|
|
|
int (*from_nlattr)(struct nlattr *attr,
|
|
|
|
struct nf_conn *ct),
|
|
|
|
struct module *module);
|
2010-02-03 09:17:06 -07:00
|
|
|
|
2013-09-23 12:37:48 -06:00
|
|
|
int nf_conntrack_helper_register(struct nf_conntrack_helper *);
|
|
|
|
void nf_conntrack_helper_unregister(struct nf_conntrack_helper *);
|
[NETFILTER]: Add nf_conntrack subsystem.
The existing connection tracking subsystem in netfilter can only
handle ipv4. There were basically two choices present to add
connection tracking support for ipv6. We could either duplicate all
of the ipv4 connection tracking code into an ipv6 counterpart, or (the
choice taken by these patches) we could design a generic layer that
could handle both ipv4 and ipv6 and thus requiring only one sub-protocol
(TCP, UDP, etc.) connection tracking helper module to be written.
In fact nf_conntrack is capable of working with any layer 3
protocol.
The existing ipv4 specific conntrack code could also not deal
with the pecularities of doing connection tracking on ipv6,
which is also cured here. For example, these issues include:
1) ICMPv6 handling, which is used for neighbour discovery in
ipv6 thus some messages such as these should not participate
in connection tracking since effectively they are like ARP
messages
2) fragmentation must be handled differently in ipv6, because
the simplistic "defrag, connection track and NAT, refrag"
(which the existing ipv4 connection tracking does) approach simply
isn't feasible in ipv6
3) ipv6 extension header parsing must occur at the correct spots
before and after connection tracking decisions, and there were
no provisions for this in the existing connection tracking
design
4) ipv6 has no need for stateful NAT
The ipv4 specific conntrack layer is kept around, until all of
the ipv4 specific conntrack helpers are ported over to nf_conntrack
and it is feature complete. Once that occurs, the old conntrack
stuff will get placed into the feature-removal-schedule and we will
fully kill it off 6 months later.
Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
2005-11-09 17:38:16 -07:00
|
|
|
|
2016-07-17 21:39:23 -06:00
|
|
|
int nf_conntrack_helpers_register(struct nf_conntrack_helper *, unsigned int);
|
|
|
|
void nf_conntrack_helpers_unregister(struct nf_conntrack_helper *,
|
|
|
|
unsigned int);
|
|
|
|
|
2013-09-23 12:37:48 -06:00
|
|
|
struct nf_conn_help *nf_ct_helper_ext_add(struct nf_conn *ct,
|
|
|
|
struct nf_conntrack_helper *helper,
|
|
|
|
gfp_t gfp);
|
2007-07-07 23:35:56 -06:00
|
|
|
|
2013-09-23 12:37:48 -06:00
|
|
|
int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl,
|
|
|
|
gfp_t flags);
|
2008-11-18 03:54:05 -07:00
|
|
|
|
2013-09-23 12:37:48 -06:00
|
|
|
void nf_ct_helper_destroy(struct nf_conn *ct);
|
2009-06-13 04:28:22 -06:00
|
|
|
|
2007-07-07 23:23:42 -06:00
|
|
|
static inline struct nf_conn_help *nfct_help(const struct nf_conn *ct)
|
|
|
|
{
|
|
|
|
return nf_ct_ext_find(ct, NF_CT_EXT_HELPER);
|
|
|
|
}
|
2008-01-15 00:48:57 -07:00
|
|
|
|
2012-06-07 04:11:50 -06:00
|
|
|
static inline void *nfct_help_data(const struct nf_conn *ct)
|
|
|
|
{
|
|
|
|
struct nf_conn_help *help;
|
|
|
|
|
|
|
|
help = nf_ct_ext_find(ct, NF_CT_EXT_HELPER);
|
|
|
|
|
|
|
|
return (void *)help->data;
|
|
|
|
}
|
|
|
|
|
2013-09-23 12:37:48 -06:00
|
|
|
int nf_conntrack_helper_pernet_init(struct net *net);
|
|
|
|
void nf_conntrack_helper_pernet_fini(struct net *net);
|
2013-01-21 15:10:30 -07:00
|
|
|
|
2013-09-23 12:37:48 -06:00
|
|
|
int nf_conntrack_helper_init(void);
|
|
|
|
void nf_conntrack_helper_fini(void);
|
2008-01-15 00:48:57 -07:00
|
|
|
|
2013-09-23 12:37:48 -06:00
|
|
|
int nf_conntrack_broadcast_help(struct sk_buff *skb, unsigned int protoff,
|
|
|
|
struct nf_conn *ct,
|
|
|
|
enum ip_conntrack_info ctinfo,
|
|
|
|
unsigned int timeout);
|
2011-01-18 10:12:24 -07:00
|
|
|
|
2012-02-04 19:44:51 -07:00
|
|
|
struct nf_ct_helper_expectfn {
|
|
|
|
struct list_head head;
|
|
|
|
const char *name;
|
|
|
|
void (*expectfn)(struct nf_conn *ct, struct nf_conntrack_expect *exp);
|
|
|
|
};
|
|
|
|
|
2013-02-10 10:56:56 -07:00
|
|
|
__printf(3,4)
|
|
|
|
void nf_ct_helper_log(struct sk_buff *skb, const struct nf_conn *ct,
|
|
|
|
const char *fmt, ...);
|
|
|
|
|
2012-02-04 19:44:51 -07:00
|
|
|
void nf_ct_helper_expectfn_register(struct nf_ct_helper_expectfn *n);
|
|
|
|
void nf_ct_helper_expectfn_unregister(struct nf_ct_helper_expectfn *n);
|
|
|
|
struct nf_ct_helper_expectfn *
|
|
|
|
nf_ct_helper_expectfn_find_by_name(const char *name);
|
|
|
|
struct nf_ct_helper_expectfn *
|
|
|
|
nf_ct_helper_expectfn_find_by_symbol(const void *symbol);
|
|
|
|
|
2012-05-13 13:44:54 -06:00
|
|
|
extern struct hlist_head *nf_ct_helper_hash;
|
|
|
|
extern unsigned int nf_ct_helper_hsize;
|
|
|
|
|
[NETFILTER]: Add nf_conntrack subsystem.
The existing connection tracking subsystem in netfilter can only
handle ipv4. There were basically two choices present to add
connection tracking support for ipv6. We could either duplicate all
of the ipv4 connection tracking code into an ipv6 counterpart, or (the
choice taken by these patches) we could design a generic layer that
could handle both ipv4 and ipv6 and thus requiring only one sub-protocol
(TCP, UDP, etc.) connection tracking helper module to be written.
In fact nf_conntrack is capable of working with any layer 3
protocol.
The existing ipv4 specific conntrack code could also not deal
with the pecularities of doing connection tracking on ipv6,
which is also cured here. For example, these issues include:
1) ICMPv6 handling, which is used for neighbour discovery in
ipv6 thus some messages such as these should not participate
in connection tracking since effectively they are like ARP
messages
2) fragmentation must be handled differently in ipv6, because
the simplistic "defrag, connection track and NAT, refrag"
(which the existing ipv4 connection tracking does) approach simply
isn't feasible in ipv6
3) ipv6 extension header parsing must occur at the correct spots
before and after connection tracking decisions, and there were
no provisions for this in the existing connection tracking
design
4) ipv6 has no need for stateful NAT
The ipv4 specific conntrack layer is kept around, until all of
the ipv4 specific conntrack helpers are ported over to nf_conntrack
and it is feature complete. Once that occurs, the old conntrack
stuff will get placed into the feature-removal-schedule and we will
fully kill it off 6 months later.
Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
2005-11-09 17:38:16 -07:00
|
|
|
#endif /*_NF_CONNTRACK_HELPER_H*/
|