include/net/netfilter/nf_conntrack_synproxy.h

   1 #ifndef _NF_CONNTRACK_SYNPROXY_H
   2 #define _NF_CONNTRACK_SYNPROXY_H
   3
   4 #include <net/netns/generic.h>
   5
   6 struct nf_conn_synproxy {
   7         u32     isn;
   8         u32     its;
   9         u32     tsoff;
  10 };
  11
  12 static inline struct nf_conn_synproxy *nfct_synproxy(const struct nf_conn *ct)
  13 {
  14 #if IS_ENABLED(CONFIG_NETFILTER_SYNPROXY)
  15         return nf_ct_ext_find(ct, NF_CT_EXT_SYNPROXY);
  16 #else
  17         return NULL;
  18 #endif
  19 }
  20
  21 static inline struct nf_conn_synproxy *nfct_synproxy_ext_add(struct nf_conn *ct)
  22 {
  23 #if IS_ENABLED(CONFIG_NETFILTER_SYNPROXY)
  24         return nf_ct_ext_add(ct, NF_CT_EXT_SYNPROXY, GFP_ATOMIC);
  25 #else
  26         return NULL;
  27 #endif
  28 }
  29
  30 static inline bool nf_ct_add_synproxy(struct nf_conn *ct,
  31                                       const struct nf_conn *tmpl)
  32 {
  33         if (tmpl && nfct_synproxy(tmpl)) {
  34                 if (!nfct_seqadj_ext_add(ct))
  35                         return false;
  36
  37                 if (!nfct_synproxy_ext_add(ct))
  38                         return false;
  39         }
  40
  41         return true;
  42 }
  43
  44 struct synproxy_stats {
  45         unsigned int                    syn_received;
  46         unsigned int                    cookie_invalid;
  47         unsigned int                    cookie_valid;
  48         unsigned int                    cookie_retrans;
  49         unsigned int                    conn_reopened;
  50 };
  51
  52 struct synproxy_net {
  53         struct nf_conn                  *tmpl;
  54         struct synproxy_stats __percpu  *stats;
  55         unsigned int                    hook_ref4;
  56         unsigned int                    hook_ref6;
  57 };
  58
  59 extern unsigned int synproxy_net_id;
  60 static inline struct synproxy_net *synproxy_pernet(struct net *net)
  61 {
  62         return net_generic(net, synproxy_net_id);
  63 }
  64
  65 struct synproxy_options {
  66         u8                              options;
  67         u8                              wscale;
  68         u16                             mss;
  69         u32                             tsval;
  70         u32                             tsecr;
  71 };
  72
  73 struct tcphdr;
  74 struct xt_synproxy_info;
  75 bool synproxy_parse_options(const struct sk_buff *skb, unsigned int doff,
  76                             const struct tcphdr *th,
  77                             struct synproxy_options *opts);
  78 unsigned int synproxy_options_size(const struct synproxy_options *opts);
  79 void synproxy_build_options(struct tcphdr *th,
  80                             const struct synproxy_options *opts);
  81
  82 void synproxy_init_timestamp_cookie(const struct xt_synproxy_info *info,
  83                                     struct synproxy_options *opts);
  84 void synproxy_check_timestamp_cookie(struct synproxy_options *opts);
  85
  86 unsigned int synproxy_tstamp_adjust(struct sk_buff *skb, unsigned int protoff,
  87                                     struct tcphdr *th, struct nf_conn *ct,
  88                                     enum ip_conntrack_info ctinfo,
  89                                     const struct nf_conn_synproxy *synproxy);
  90
  91 #endif /* _NF_CONNTRACK_SYNPROXY_H */