1 /* $NetBSD: npf_conn.h,v 1.8 2014/12/20 16:19:43 rmind Exp $ */ 2 3 /*- 4 * Copyright (c) 2009-2014 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 #ifndef _NPF_CONN_H_ 33 #define _NPF_CONN_H_ 34 35 #if !defined(_KERNEL) 36 #error "kernel-level header only" 37 #endif 38 39 #include <sys/types.h> 40 41 #include "npf_impl.h" 42 43 typedef struct npf_connkey npf_connkey_t; 44 45 #if defined(__NPF_CONN_PRIVATE) 46 47 #include <sys/rbtree.h> 48 49 /* 50 * See npf_conn_conkey() function for the key layout description. 51 */ 52 #define NPF_CONN_NKEYWORDS (2 + ((sizeof(npf_addr_t) * 2) >> 2)) 53 #define NPF_CONN_MAXKEYLEN (NPF_CONN_NKEYWORDS * sizeof(uint32_t)) 54 #define NPF_CONN_GETALEN(key) ((key)->ck_key[0] & 0xffff) 55 #define NPF_CONN_KEYLEN(key) (8 + (2 * NPF_CONN_GETALEN(key))) 56 57 struct npf_connkey { 58 /* Entry node and back-pointer to the actual connection. */ 59 rb_node_t ck_rbnode; 60 uint32_t ck_key[NPF_CONN_NKEYWORDS]; 61 npf_conn_t * ck_backptr; 62 }; 63 64 /* 65 * The main connection tracking structure. 66 */ 67 68 struct npf_conn { 69 /* 70 * Connection "forwards" and "backwards" entries, plus the 71 * interface ID (if zero, then the state is global). 72 */ 73 npf_connkey_t c_forw_entry; 74 npf_connkey_t c_back_entry; 75 u_int c_proto; 76 u_int c_ifid; 77 78 /* Flags and entry in the connection database or G/C list. */ 79 u_int c_flags; 80 npf_conn_t * c_next; 81 82 /* Associated rule procedure or NAT (if any). */ 83 npf_rproc_t * c_rproc; 84 npf_nat_t * c_nat; 85 86 /* 87 * The protocol state, reference count and the last activity 88 * time (used to calculate expiration time). 89 */ 90 kmutex_t c_lock; 91 npf_state_t c_state; 92 u_int c_refcnt; 93 struct timespec c_atime; 94 }; 95 96 #endif 97 98 /* 99 * Connection tracking interface. 100 */ 101 void npf_conn_sysinit(void); 102 void npf_conn_sysfini(void); 103 void npf_conn_tracking(bool); 104 void npf_conn_load(npf_conndb_t *, bool); 105 106 unsigned npf_conn_conkey(const npf_cache_t *, npf_connkey_t *, bool); 107 npf_conn_t * npf_conn_lookup(const npf_cache_t *, const int, bool *); 108 npf_conn_t * npf_conn_inspect(npf_cache_t *, const int, int *); 109 npf_conn_t * npf_conn_establish(npf_cache_t *, int, bool); 110 void npf_conn_release(npf_conn_t *); 111 void npf_conn_expire(npf_conn_t *); 112 bool npf_conn_pass(const npf_conn_t *, npf_rproc_t **); 113 void npf_conn_setpass(npf_conn_t *, npf_rproc_t *); 114 int npf_conn_setnat(const npf_cache_t *, npf_conn_t *, 115 npf_nat_t *, u_int); 116 npf_nat_t * npf_conn_getnat(npf_conn_t *, const int, bool *); 117 void npf_conn_gc(npf_conndb_t *, bool, bool); 118 int npf_conn_import(npf_conndb_t *, prop_dictionary_t, 119 npf_ruleset_t *); 120 prop_dictionary_t npf_conn_export(const npf_conn_t *); 121 void npf_conn_print(const npf_conn_t *); 122 123 /* 124 * Connection database (aka state table) interface. 125 */ 126 npf_conndb_t * npf_conndb_create(void); 127 void npf_conndb_destroy(npf_conndb_t *); 128 129 npf_conn_t * npf_conndb_lookup(npf_conndb_t *, const npf_connkey_t *, 130 bool *); 131 bool npf_conndb_insert(npf_conndb_t *, npf_connkey_t *, 132 npf_conn_t *); 133 npf_conn_t * npf_conndb_remove(npf_conndb_t *, const npf_connkey_t *); 134 135 void npf_conndb_enqueue(npf_conndb_t *, npf_conn_t *); 136 void npf_conndb_dequeue(npf_conndb_t *, npf_conn_t *, 137 npf_conn_t *); 138 npf_conn_t * npf_conndb_getlist(npf_conndb_t *); 139 void npf_conndb_settail(npf_conndb_t *, npf_conn_t *); 140 int npf_conndb_export(prop_array_t); 141 142 #endif /* _NPF_CONN_H_ */ 143