/*-
* Copyright (c) 2009-2020 The NetBSD Foundation, Inc.
* All rights reserved.
*
* This material is based upon work partially supported by The
* NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
* TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
* BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
#ifndef _NPF_CONN_H_
#define _NPF_CONN_H_
#if !defined(_KERNEL) && !defined(_NPF_STANDALONE)
#error "kernel-level header only"
#endif
#include <sys/types.h>
#include "npf_impl.h"
#if defined(__NPF_CONN_PRIVATE)
/*
* The main connection tracking structure.
*/
struct npf_conn {
/*
* Protocol, address length, the interface ID (if zero,
* then the state is global) and connection flags.
*/
uint16_t c_proto;
uint16_t c_alen;
unsigned c_ifid;
unsigned c_flags;
/* Matching rule flags and ID. */
unsigned c_retfl;
uint64_t c_rid;
/*
* Entry in the connection database/list. The entry is
* protected by npf_t::conn_lock.
*/
union {
npf_conn_t * c_next;
LIST_ENTRY(npf_conn) c_entry;
};
/* Associated rule procedure or NAT (if any). */
npf_rproc_t * c_rproc;
npf_nat_t * c_nat;
/*
* The Reference count and the last activity time (used to
* calculate expiration time). Note: *unsigned* 32-bit integer
* as a timestamp is sufficient for us.
*/
unsigned c_refcnt;
uint32_t c_atime;
/* The protocol state and lock. */
kmutex_t c_lock;
npf_state_t c_state;
/*
* Connection "forwards" and "backwards" keys. They are accessed
* as npf_connkey_t, see below and npf_conn_getkey().
*/
uint32_t c_keys[];
};
typedef struct {
int connkey_interface;
int connkey_direction;
} npf_conn_params_t;
#endif
/*
* Connection key interface.
*
* See the key layout description in the npf_connkey.c source file.
*/
#define NPF_CONNKEY_V4WORDS (2 + ((sizeof(struct in_addr) * 2) >> 2))
#define NPF_CONNKEY_V6WORDS (2 + ((sizeof(struct in6_addr) * 2) >> 2))
#define NPF_CONNKEY_MAXWORDS (NPF_CONNKEY_V6WORDS)
#define NPF_CONNKEY_ALEN(key) (((key)->ck_key[0] >> 28) << 2)
#define NPF_CONNKEY_LEN(key) (8 + (NPF_CONNKEY_ALEN(key) * 2))
typedef struct npf_connkey {
/* Warning: ck_key has a variable length -- see above. */
uint32_t ck_key[NPF_CONNKEY_MAXWORDS];
} npf_connkey_t;
unsigned npf_conn_conkey(const npf_cache_t *, npf_connkey_t *,
const unsigned, const npf_flow_t);
npf_connkey_t * npf_conn_getforwkey(npf_conn_t *);
npf_connkey_t * npf_conn_getbackkey(npf_conn_t *, unsigned);
void npf_conn_adjkey(npf_connkey_t *, const npf_addr_t *,
const uint16_t, const unsigned);
unsigned npf_connkey_setkey(npf_connkey_t *, unsigned, unsigned,
const void *, const uint16_t *, const npf_flow_t);
void npf_connkey_getkey(const npf_connkey_t *, unsigned *,
unsigned *, npf_addr_t *, uint16_t *);
unsigned npf_connkey_import(npf_t *, const nvlist_t *, npf_connkey_t *);
nvlist_t * npf_connkey_export(npf_t *, const npf_connkey_t *);
void npf_connkey_print(const npf_connkey_t *);
/*
* Connection tracking interface.
*/
void npf_conn_init(npf_t *);
void npf_conn_fini(npf_t *);
void npf_conn_tracking(npf_t *, bool);
void npf_conn_load(npf_t *, npf_conndb_t *, bool);
npf_conn_t * npf_conn_lookup(const npf_cache_t *, const unsigned, npf_flow_t *);
npf_conn_t * npf_conn_inspect(npf_cache_t *, const unsigned, int *);
npf_conn_t * npf_conn_establish(npf_cache_t *, const unsigned, bool);
void npf_conn_release(npf_conn_t *);
void npf_conn_destroy(npf_t *, npf_conn_t *);
void npf_conn_expire(npf_conn_t *);
bool npf_conn_pass(const npf_conn_t *, npf_match_info_t *,
npf_rproc_t **);
void npf_conn_setpass(npf_conn_t *, const npf_match_info_t *,
npf_rproc_t *);
int npf_conn_setnat(const npf_cache_t *, npf_conn_t *,
npf_nat_t *, unsigned);
npf_nat_t * npf_conn_getnat(const npf_conn_t *);
bool npf_conn_expired(npf_t *, const npf_conn_t *, uint64_t);
void npf_conn_remove(npf_conndb_t *, npf_conn_t *);
void npf_conn_worker(npf_t *);
int npf_conn_import(npf_t *, npf_conndb_t *, const nvlist_t *,
npf_ruleset_t *);
int npf_conn_find(npf_t *, const nvlist_t *, nvlist_t *);
void npf_conn_print(npf_conn_t *);
/*
* Connection database (aka state table) interface.
*/
void npf_conndb_sysinit(npf_t *);
void npf_conndb_sysfini(npf_t *);
npf_conndb_t * npf_conndb_create(void);
void npf_conndb_destroy(npf_conndb_t *);
npf_conn_t * npf_conndb_lookup(npf_t *, const npf_connkey_t *, npf_flow_t *);
bool npf_conndb_insert(npf_conndb_t *, const npf_connkey_t *,
npf_conn_t *, npf_flow_t);
npf_conn_t * npf_conndb_remove(npf_conndb_t *, npf_connkey_t *);
void npf_conndb_enqueue(npf_conndb_t *, npf_conn_t *);
npf_conn_t * npf_conndb_getlist(npf_conndb_t *);
npf_conn_t * npf_conndb_getnext(npf_conndb_t *, npf_conn_t *);
int npf_conndb_export(npf_t *, nvlist_t *);
void npf_conndb_gc(npf_t *, npf_conndb_t *, bool, bool);
#endif /* _NPF_CONN_H_ */