update

[l4.git] / l4 / pkg / linux-26-headers / include / linux / netfilter / nf_conntrack_common.h

diff --git a/l4/pkg/linux-26-headers/include/linux/netfilter/nf_conntrack_common.h b/l4/pkg/linux-26-headers/include/linux/netfilter/nf_conntrack_common.h
index 885cbe282260dcb2658f9e8fe680b066809d3fbe..7f038b5128a05132e68cc075f0b698ce4718cb74 100644 (file)
--- a/l4/pkg/linux-26-headers/include/linux/netfilter/nf_conntrack_common.h
+++ b/l4/pkg/linux-26-headers/include/linux/netfilter/nf_conntrack_common.h
@@ -3,8 +3,7 @@
 /* Connection state tracking for netfilter.  This is separated from,
    but required by, the NAT layer; it can also be used by an iptables
    extension. */
-enum ip_conntrack_info
-{
+enum ip_conntrack_info {
        /* Part of an established connection (either direction). */
        IP_CT_ESTABLISHED,
 
@@ -19,6 +18,9 @@ enum ip_conntrack_info
        /* >= this indicates reply direction */
        IP_CT_IS_REPLY,
 
+       IP_CT_ESTABLISHED_REPLY = IP_CT_ESTABLISHED + IP_CT_IS_REPLY,
+       IP_CT_RELATED_REPLY = IP_CT_RELATED + IP_CT_IS_REPLY,
+       IP_CT_NEW_REPLY = IP_CT_NEW + IP_CT_IS_REPLY,   
        /* Number of distinct IP_CT types (no NEW in reply dirn). */
        IP_CT_NUMBER = IP_CT_IS_REPLY * 2 - 1
 };
@@ -73,100 +75,44 @@ enum ip_conntrack_status {
        /* Connection has fixed timeout. */
        IPS_FIXED_TIMEOUT_BIT = 10,
        IPS_FIXED_TIMEOUT = (1 << IPS_FIXED_TIMEOUT_BIT),
-};
-
-/* Connection tracking event bits */
-enum ip_conntrack_events
-{
-       /* New conntrack */
-       IPCT_NEW_BIT = 0,
-       IPCT_NEW = (1 << IPCT_NEW_BIT),
-
-       /* Expected connection */
-       IPCT_RELATED_BIT = 1,
-       IPCT_RELATED = (1 << IPCT_RELATED_BIT),
-
-       /* Destroyed conntrack */
-       IPCT_DESTROY_BIT = 2,
-       IPCT_DESTROY = (1 << IPCT_DESTROY_BIT),
-
-       /* Timer has been refreshed */
-       IPCT_REFRESH_BIT = 3,
-       IPCT_REFRESH = (1 << IPCT_REFRESH_BIT),
-
-       /* Status has changed */
-       IPCT_STATUS_BIT = 4,
-       IPCT_STATUS = (1 << IPCT_STATUS_BIT),
-
-       /* Update of protocol info */
-       IPCT_PROTOINFO_BIT = 5,
-       IPCT_PROTOINFO = (1 << IPCT_PROTOINFO_BIT),
-
-       /* Volatile protocol info */
-       IPCT_PROTOINFO_VOLATILE_BIT = 6,
-       IPCT_PROTOINFO_VOLATILE = (1 << IPCT_PROTOINFO_VOLATILE_BIT),
 
-       /* New helper for conntrack */
-       IPCT_HELPER_BIT = 7,
-       IPCT_HELPER = (1 << IPCT_HELPER_BIT),
+       /* Conntrack is a template */
+       IPS_TEMPLATE_BIT = 11,
+       IPS_TEMPLATE = (1 << IPS_TEMPLATE_BIT),
 
-       /* Update of helper info */
-       IPCT_HELPINFO_BIT = 8,
-       IPCT_HELPINFO = (1 << IPCT_HELPINFO_BIT),
+       /* Conntrack is a fake untracked entry */
+       IPS_UNTRACKED_BIT = 12,
+       IPS_UNTRACKED = (1 << IPS_UNTRACKED_BIT),
 
-       /* Volatile helper info */
-       IPCT_HELPINFO_VOLATILE_BIT = 9,
-       IPCT_HELPINFO_VOLATILE = (1 << IPCT_HELPINFO_VOLATILE_BIT),
-
-       /* NAT info */
-       IPCT_NATINFO_BIT = 10,
-       IPCT_NATINFO = (1 << IPCT_NATINFO_BIT),
-
-       /* Counter highest bit has been set, unused */
-       IPCT_COUNTER_FILLING_BIT = 11,
-       IPCT_COUNTER_FILLING = (1 << IPCT_COUNTER_FILLING_BIT),
-
-       /* Mark is set */
-       IPCT_MARK_BIT = 12,
-       IPCT_MARK = (1 << IPCT_MARK_BIT),
-
-       /* NAT sequence adjustment */
-       IPCT_NATSEQADJ_BIT = 13,
-       IPCT_NATSEQADJ = (1 << IPCT_NATSEQADJ_BIT),
-
-       /* Secmark is set */
-       IPCT_SECMARK_BIT = 14,
-       IPCT_SECMARK = (1 << IPCT_SECMARK_BIT),
+       /* Conntrack got a helper explicitly attached via CT target. */
+       IPS_HELPER_BIT = 13,
+       IPS_HELPER = (1 << IPS_HELPER_BIT),
 };
 
-enum ip_conntrack_expect_events {
-       IPEXP_NEW_BIT = 0,
-       IPEXP_NEW = (1 << IPEXP_NEW_BIT),
+/* Connection tracking event types */
+enum ip_conntrack_events {
+       IPCT_NEW,               /* new conntrack */
+       IPCT_RELATED,           /* related conntrack */
+       IPCT_DESTROY,           /* destroyed conntrack */
+       IPCT_REPLY,             /* connection has seen two-way traffic */
+       IPCT_ASSURED,           /* connection status has changed to assured */
+       IPCT_PROTOINFO,         /* protocol information has changed */
+       IPCT_HELPER,            /* new helper has been set */
+       IPCT_MARK,              /* new mark has been set */
+       IPCT_NATSEQADJ,         /* NAT is doing sequence adjustment */
+       IPCT_SECMARK,           /* new security mark has been set */
+       IPCT_LABEL,             /* new connlabel has been set */
 };
 
-#ifdef __KERNEL__
-struct ip_conntrack_stat
-{
-       unsigned int searched;
-       unsigned int found;
-       unsigned int new;
-       unsigned int invalid;
-       unsigned int ignore;
-       unsigned int delete;
-       unsigned int delete_list;
-       unsigned int insert;
-       unsigned int insert_failed;
-       unsigned int drop;
-       unsigned int early_drop;
-       unsigned int error;
-       unsigned int expect_new;
-       unsigned int expect_create;
-       unsigned int expect_delete;
+enum ip_conntrack_expect_events {
+       IPEXP_NEW,              /* new expectation */
+       IPEXP_DESTROY,          /* destroyed expectation */
 };
 
-/* call to create an explicit dependency on nf_conntrack. */
-extern void need_conntrack(void);
+/* expectation flags */
+#define NF_CT_EXPECT_PERMANENT         0x1
+#define NF_CT_EXPECT_INACTIVE          0x2
+#define NF_CT_EXPECT_USERSPACE         0x4
 
-#endif /* __KERNEL__ */
 
 #endif /* _NF_CONNTRACK_COMMON_H */