vserver 1.9.3

[linux-2.6.git] / include / linux / netfilter_ipv4 / ip_conntrack.h

diff --git a/include/linux/netfilter_ipv4/ip_conntrack.h b/include/linux/netfilter_ipv4/ip_conntrack.h
index 1974f16..989f1cf 100644 (file)
--- a/include/linux/netfilter_ipv4/ip_conntrack.h
+++ b/include/linux/netfilter_ipv4/ip_conntrack.h
@@ -51,10 +51,12 @@ enum ip_conntrack_status {
 
 #include <linux/netfilter_ipv4/ip_conntrack_tcp.h>
 #include <linux/netfilter_ipv4/ip_conntrack_icmp.h>
+#include <linux/netfilter_ipv4/ip_conntrack_sctp.h>
 
 /* per conntrack: protocol private data */
 union ip_conntrack_proto {
        /* insert conntrack proto private data here */
+       struct ip_ct_sctp sctp;
        struct ip_ct_tcp tcp;
        struct ip_ct_icmp icmp;
 };
@@ -156,6 +158,12 @@ struct ip_conntrack_expect
        union ip_conntrack_expect_help help;
 };
 
+struct ip_conntrack_counter
+{
+       u_int64_t packets;
+       u_int64_t bytes;
+};
+
 struct ip_conntrack_helper;
 
 struct ip_conntrack
@@ -164,15 +172,17 @@ struct ip_conntrack
            plus 1 for any connection(s) we are `master' for */
        struct nf_conntrack ct_general;
 
-       /* These are my tuples; original and reply */
-       struct ip_conntrack_tuple_hash tuplehash[IP_CT_DIR_MAX];
-
        /* Have we seen traffic both ways yet? (bitset) */
        unsigned long status;
 
        /* Timer function; drops refcnt when it goes off. */
        struct timer_list timeout;
 
+#ifdef CONFIG_IP_NF_CT_ACCT
+       /* Accounting Information (same cache line as other written members) */
+       struct ip_conntrack_counter counters[IP_CT_DIR_MAX];
+#endif
+
        /* If we're expecting another related connection, this will be
            in expected linked list */
        struct list_head sibling_list;
@@ -186,12 +196,7 @@ struct ip_conntrack
        /* Helper, if any. */
        struct ip_conntrack_helper *helper;
 
-       /* Our various nf_ct_info structs specify *what* relation this
-           packet has to the conntrack */
-       struct nf_ct_info infos[IP_CT_NUMBER];
-
        /* Storage reserved for other modules: */
-
        union ip_conntrack_proto proto;
 
        union ip_conntrack_help help;
@@ -207,6 +212,9 @@ struct ip_conntrack
        } nat;
 #endif /* CONFIG_IP_NF_NAT_NEEDED */
 
+       /* Traversed often, so hopefully in different cacheline to top */
+       /* These are my tuples; original and reply */
+       struct ip_conntrack_tuple_hash tuplehash[IP_CT_DIR_MAX];
 };
 
 /* get master conntrack via master expectation */
@@ -225,8 +233,12 @@ ip_conntrack_tuple_taken(const struct ip_conntrack_tuple *tuple,
                         const struct ip_conntrack *ignored_conntrack);
 
 /* Return conntrack_info and tuple hash for given skb. */
-extern struct ip_conntrack *
-ip_conntrack_get(struct sk_buff *skb, enum ip_conntrack_info *ctinfo);
+static inline struct ip_conntrack *
+ip_conntrack_get(const struct sk_buff *skb, enum ip_conntrack_info *ctinfo)
+{
+       *ctinfo = skb->nfctinfo;
+       return (struct ip_conntrack *)skb->nfct;
+}
 
 /* decrement reference count on a conntrack */
 extern inline void ip_conntrack_put(struct ip_conntrack *ct);
@@ -245,16 +257,24 @@ extern int invert_tuplepr(struct ip_conntrack_tuple *inverse,
                          const struct ip_conntrack_tuple *orig);
 
 /* Refresh conntrack for this many jiffies */
-extern void ip_ct_refresh(struct ip_conntrack *ct,
-                         unsigned long extra_jiffies);
+extern void ip_ct_refresh_acct(struct ip_conntrack *ct,
+                              enum ip_conntrack_info ctinfo,
+                              const struct sk_buff *skb,
+                              unsigned long extra_jiffies);
 
 /* These are for NAT.  Icky. */
+/* Update TCP window tracking data when NAT mangles the packet */
+extern int ip_conntrack_tcp_update(struct sk_buff *skb,
+                                  struct ip_conntrack *conntrack,
+                                  int dir);
+
 /* Call me when a conntrack is destroyed. */
 extern void (*ip_conntrack_destroyed)(struct ip_conntrack *conntrack);
 
 /* Fake conntrack entry for untracked connections */
 extern struct ip_conntrack ip_conntrack_untracked;
 
+extern int ip_ct_no_defrag;
 /* Returns new sk_buff, or NULL */
 struct sk_buff *
 ip_ct_gather_frags(struct sk_buff *skb);
@@ -271,6 +291,27 @@ static inline int is_confirmed(struct ip_conntrack *ct)
 }
 
 extern unsigned int ip_conntrack_htable_size;
+ 
+struct ip_conntrack_stat
+{
+       unsigned int searched;
+       unsigned int found;
+       unsigned int new;
+       unsigned int invalid;
+       unsigned int ignore;
+       unsigned int delete;
+       unsigned int delete_list;
+       unsigned int insert;
+       unsigned int insert_failed;
+       unsigned int drop;
+       unsigned int early_drop;
+       unsigned int error;
+       unsigned int expect_new;
+       unsigned int expect_create;
+       unsigned int expect_delete;
+};
+
+#define CONNTRACK_STAT_INC(count) (__get_cpu_var(ip_conntrack_stat).count++)
 
 /* eg. PROVIDES_CONNTRACK(ftp); */
 #define PROVIDES_CONNTRACK(name)                        \