Home | History | Annotate | Line # | Download | only in npf
npf_conn.h revision 1.5.2.2 
      1 /*	$NetBSD: npf_conn.h,v 1.5.2.2 2014/08/10 06:56:16 tls Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 2009-2014 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This material is based upon work partially supported by The
      8  * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  *
     19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     29  * POSSIBILITY OF SUCH DAMAGE.
     30  */
     31 
     32 #ifndef _NPF_CONN_H_
     33 #define _NPF_CONN_H_
     34 
     35 #if !defined(_KERNEL)
     36 #error "kernel-level header only"
     37 #endif
     38 
     39 #include <sys/types.h>
     40 
     41 #include "npf_impl.h"
     42 
     43 typedef struct npf_connkey npf_connkey_t;
     44 
     45 #if defined(__NPF_CONN_PRIVATE)
     46 
     47 #include <sys/rbtree.h>
     48 
     49 /*
     50  * See npf_conn_key() function for the description key layout.
     51  */
     52 #define	NPF_CONN_NKEYWORDS	(2 + ((sizeof(npf_addr_t) * 2) >> 2))
     53 #define	NPF_CONN_MAXKEYLEN	(NPF_CONN_NKEYWORDS * sizeof(uint32_t))
     54 #define	NPF_CONN_GETALEN(key)	((key)->ck_key[0] & 0xffff)
     55 #define	NPF_CONN_KEYLEN(key)	(8 + (2 * NPF_CONN_GETALEN(key)))
     56 
     57 struct npf_connkey {
     58 	/* Entry node and back-pointer to the actual connection. */
     59 	rb_node_t		ck_rbnode;
     60 	uint32_t		ck_key[NPF_CONN_NKEYWORDS];
     61 	npf_conn_t *		ck_backptr;
     62 };
     63 
     64 /*
     65  * The main connection tracking structure.
     66  */
     67 
     68 struct npf_conn {
     69 	/*
     70 	 * Connection "forwards" and "backwards" entries, plus the
     71 	 * interface ID (if zero, then the state is global).
     72 	 */
     73 	npf_connkey_t		c_forw_entry;
     74 	npf_connkey_t		c_back_entry;
     75 	u_int			c_proto;
     76 	u_int			c_ifid;
     77 
     78 	/* Flags and entry in the connection database or G/C list. */
     79 	u_int			c_flags;
     80 	npf_conn_t *		c_next;
     81 
     82 	/* Associated rule procedure or NAT (if any). */
     83 	npf_rproc_t *		c_rproc;
     84 	npf_nat_t *		c_nat;
     85 
     86 	/*
     87 	 * The protocol state, reference count and the last activity
     88 	 * time (used to calculate expiration time).
     89 	 */
     90 	kmutex_t		c_lock;
     91 	npf_state_t		c_state;
     92 	u_int			c_refcnt;
     93 	struct timespec		c_atime;
     94 };
     95 
     96 #endif
     97 
     98 /*
     99  * Connection tracking interface.
    100  */
    101 void		npf_conn_sysinit(void);
    102 void		npf_conn_sysfini(void);
    103 void		npf_conn_tracking(bool);
    104 void		npf_conn_load(npf_conndb_t *, bool);
    105 
    106 unsigned	npf_conn_conkey(const npf_cache_t *, npf_connkey_t *, bool);
    107 npf_conn_t *	npf_conn_lookup(const npf_cache_t *, const int, bool *);
    108 npf_conn_t *	npf_conn_inspect(npf_cache_t *, const int, int *);
    109 npf_conn_t *	npf_conn_establish(npf_cache_t *, int, bool);
    110 void		npf_conn_release(npf_conn_t *);
    111 void		npf_conn_expire(npf_conn_t *);
    112 bool		npf_conn_pass(const npf_conn_t *, npf_rproc_t **);
    113 void		npf_conn_setpass(npf_conn_t *, npf_rproc_t *);
    114 int		npf_conn_setnat(const npf_cache_t *, npf_conn_t *,
    115 		    npf_nat_t *, u_int);
    116 npf_nat_t *	npf_conn_retnat(npf_conn_t *, const int, bool *);
    117 void		npf_conn_gc(npf_conndb_t *, bool, bool);
    118 int		npf_conn_export(prop_array_t);
    119 int		npf_conn_import(npf_conndb_t *, prop_dictionary_t,
    120 		    npf_ruleset_t *);
    121 void		npf_conn_print(const npf_conn_t *);
    122 
    123 /*
    124  * Connection database (aka state table) interface.
    125  */
    126 npf_conndb_t *	npf_conndb_create(void);
    127 void		npf_conndb_destroy(npf_conndb_t *);
    128 
    129 npf_conn_t *	npf_conndb_lookup(npf_conndb_t *, const npf_connkey_t *,
    130 		    bool *);
    131 bool		npf_conndb_insert(npf_conndb_t *, npf_connkey_t *,
    132 		    npf_conn_t *);
    133 npf_conn_t *	npf_conndb_remove(npf_conndb_t *, const npf_connkey_t *);
    134 
    135 void		npf_conndb_enqueue(npf_conndb_t *, npf_conn_t *);
    136 void		npf_conndb_dequeue(npf_conndb_t *, npf_conn_t *,
    137 		    npf_conn_t *);
    138 npf_conn_t *	npf_conndb_getlist(npf_conndb_t *);
    139 void		npf_conndb_settail(npf_conndb_t *, npf_conn_t *);
    140 
    141 #endif	/* _NPF_CONN_H_ */
    142