openharmony/third_party_libnl
1
0
Fork 0
mirror of https://gitee.com/openharmony/third_party_libnl synced 2024-11-24 10:39:53 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge branch 'master' of https://github.com/rmfought/libnl

Browse Source
This commit is contained in:
Thomas Graf 2012-10-26 12:48:22 +02:00
commit 609b47961b
18 changed files with 2705 additions and 193 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/Makefile.am
View File

@ -16,6 +16,7 @@ nobase_libnlinclude_HEADERS = \
netlink/netfilter/nfnl.h \
netlink/netfilter/queue.h \
netlink/netfilter/queue_msg.h \
netlink/netfilter/exp.h \
netlink/addr.h \
netlink/attr.h \
netlink/cache-api.h \

62
include/linux/netfilter/nfnetlink.h
View File

@ -1,16 +1,7 @@
#ifndef _NFNETLINK_H
#define _NFNETLINK_H
#include <linux/types.h>
#ifndef __KERNEL__
/* nfnetlink groups: Up to 32 maximum - backwards compatibility for userspace */
#define NF_NETLINK_CONNTRACK_NEW 0x00000001
#define NF_NETLINK_CONNTRACK_UPDATE 0x00000002
#define NF_NETLINK_CONNTRACK_DESTROY 0x00000004
#define NF_NETLINK_CONNTRACK_EXP_NEW 0x00000008
#define NF_NETLINK_CONNTRACK_EXP_UPDATE 0x00000010
#define NF_NETLINK_CONNTRACK_EXP_DESTROY 0x00000020
#endif
#include <linux/netfilter/nfnetlink_compat.h>
enum nfnetlink_groups {
NFNLGRP_NONE,
@ -34,8 +25,8 @@ enum nfnetlink_groups {
/* General form of address family dependent message.
*/
struct nfgenmsg {
u_int8_t nfgen_family; /* AF_xxx */
u_int8_t version; /* nfnetlink version */
__u8 nfgen_family; /* AF_xxx */
__u8 version; /* nfnetlink version */
__be16 res_id; /* resource id */
};
@ -55,6 +46,51 @@ struct nfgenmsg {
#define NFNL_SUBSYS_CTNETLINK_EXP 2
#define NFNL_SUBSYS_QUEUE 3
#define NFNL_SUBSYS_ULOG 4
#define NFNL_SUBSYS_COUNT 5
#define NFNL_SUBSYS_OSF 5
#define NFNL_SUBSYS_IPSET 6
#define NFNL_SUBSYS_ACCT 7
#define NFNL_SUBSYS_CTNETLINK_TIMEOUT 8
#define NFNL_SUBSYS_CTHELPER 9
#define NFNL_SUBSYS_COUNT 10
#ifdef __KERNEL__
#include <linux/netlink.h>
#include <linux/capability.h>
#include <net/netlink.h>
struct nfnl_callback {
int (*call)(struct sock *nl, struct sk_buff *skb,
const struct nlmsghdr *nlh,
const struct nlattr * const cda[]);
int (*call_rcu)(struct sock *nl, struct sk_buff *skb,
const struct nlmsghdr *nlh,
const struct nlattr * const cda[]);
const struct nla_policy *policy; /* netlink attribute policy */
const u_int16_t attr_count; /* number of nlattr's */
};
struct nfnetlink_subsystem {
const char *name;
__u8 subsys_id; /* nfnetlink subsystem ID */
__u8 cb_count; /* number of callbacks */
const struct nfnl_callback *cb; /* callback for individual types */
};
extern int nfnetlink_subsys_register(const struct nfnetlink_subsystem *n);
extern int nfnetlink_subsys_unregister(const struct nfnetlink_subsystem *n);
extern int nfnetlink_has_listeners(struct net *net, unsigned int group);
extern int nfnetlink_send(struct sk_buff *skb, struct net *net, u32 pid, unsigned int group,
int echo, gfp_t flags);
extern int nfnetlink_set_err(struct net *net, u32 pid, u32 group, int error);
extern int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u_int32_t pid, int flags);
extern void nfnl_lock(void);
extern void nfnl_unlock(void);
#define MODULE_ALIAS_NFNL_SUBSYS(subsys) \
MODULE_ALIAS("nfnetlink-subsys-" __stringify(subsys))
#endif /* __KERNEL__ */
#endif /* _NFNETLINK_H */

112
include/linux/netfilter/nfnetlink_conntrack.h
View File

@ -7,6 +7,8 @@ enum cntl_msg_types {
IPCTNL_MSG_CT_GET,
IPCTNL_MSG_CT_DELETE,
IPCTNL_MSG_CT_GET_CTRZERO,
IPCTNL_MSG_CT_GET_STATS_CPU,
IPCTNL_MSG_CT_GET_STATS,
IPCTNL_MSG_MAX
};
@ -15,6 +17,7 @@ enum ctnl_exp_msg_types {
IPCTNL_MSG_EXP_NEW,
IPCTNL_MSG_EXP_GET,
IPCTNL_MSG_EXP_DELETE,
IPCTNL_MSG_EXP_GET_STATS_CPU,
IPCTNL_MSG_EXP_MAX
};
@ -36,6 +39,14 @@ enum ctattr_type {
CTA_USE,
CTA_ID,
CTA_NAT_DST,
CTA_TUPLE_MASTER,
CTA_NAT_SEQ_ADJ_ORIG,
CTA_NAT_SEQ_ADJ_REPLY,
CTA_SECMARK, /* obsolete */
CTA_ZONE,
CTA_SECCTX,
CTA_TIMESTAMP,
CTA_MARK_MASK,
__CTA_MAX
};
#define CTA_MAX (__CTA_MAX - 1)
@ -76,6 +87,8 @@ enum ctattr_l4proto {
enum ctattr_protoinfo {
CTA_PROTOINFO_UNSPEC,
CTA_PROTOINFO_TCP,
CTA_PROTOINFO_DCCP,
CTA_PROTOINFO_SCTP,
__CTA_PROTOINFO_MAX
};
#define CTA_PROTOINFO_MAX (__CTA_PROTOINFO_MAX - 1)
@ -91,16 +104,42 @@ enum ctattr_protoinfo_tcp {
};
#define CTA_PROTOINFO_TCP_MAX (__CTA_PROTOINFO_TCP_MAX - 1)
enum ctattr_protoinfo_dccp {
CTA_PROTOINFO_DCCP_UNSPEC,
CTA_PROTOINFO_DCCP_STATE,
CTA_PROTOINFO_DCCP_ROLE,
CTA_PROTOINFO_DCCP_HANDSHAKE_SEQ,
__CTA_PROTOINFO_DCCP_MAX,
};
#define CTA_PROTOINFO_DCCP_MAX (__CTA_PROTOINFO_DCCP_MAX - 1)
enum ctattr_protoinfo_sctp {
CTA_PROTOINFO_SCTP_UNSPEC,
CTA_PROTOINFO_SCTP_STATE,
CTA_PROTOINFO_SCTP_VTAG_ORIGINAL,
CTA_PROTOINFO_SCTP_VTAG_REPLY,
__CTA_PROTOINFO_SCTP_MAX
};
#define CTA_PROTOINFO_SCTP_MAX (__CTA_PROTOINFO_SCTP_MAX - 1)
enum ctattr_counters {
CTA_COUNTERS_UNSPEC,
CTA_COUNTERS_PACKETS, /* old 64bit counters */
CTA_COUNTERS_BYTES, /* old 64bit counters */
CTA_COUNTERS32_PACKETS,
CTA_COUNTERS32_BYTES,
CTA_COUNTERS_PACKETS, /* 64bit counters */
CTA_COUNTERS_BYTES, /* 64bit counters */
CTA_COUNTERS32_PACKETS, /* old 32bit counters, unused */
CTA_COUNTERS32_BYTES, /* old 32bit counters, unused */
__CTA_COUNTERS_MAX
};
#define CTA_COUNTERS_MAX (__CTA_COUNTERS_MAX - 1)
enum ctattr_tstamp {
CTA_TIMESTAMP_UNSPEC,
CTA_TIMESTAMP_START,
CTA_TIMESTAMP_STOP,
__CTA_TIMESTAMP_MAX
};
#define CTA_TIMESTAMP_MAX (__CTA_TIMESTAMP_MAX - 1)
enum ctattr_nat {
CTA_NAT_UNSPEC,
CTA_NAT_MINIP,
@ -118,6 +157,15 @@ enum ctattr_protonat {
};
#define CTA_PROTONAT_MAX (__CTA_PROTONAT_MAX - 1)
enum ctattr_natseq {
CTA_NAT_SEQ_UNSPEC,
CTA_NAT_SEQ_CORRECTION_POS,
CTA_NAT_SEQ_OFFSET_BEFORE,
CTA_NAT_SEQ_OFFSET_AFTER,
__CTA_NAT_SEQ_MAX
};
#define CTA_NAT_SEQ_MAX (__CTA_NAT_SEQ_MAX - 1)
enum ctattr_expect {
CTA_EXPECT_UNSPEC,
CTA_EXPECT_MASTER,
@ -126,15 +174,71 @@ enum ctattr_expect {
CTA_EXPECT_TIMEOUT,
CTA_EXPECT_ID,
CTA_EXPECT_HELP_NAME,
CTA_EXPECT_ZONE,
CTA_EXPECT_FLAGS,
CTA_EXPECT_CLASS,
CTA_EXPECT_NAT,
CTA_EXPECT_FN,
__CTA_EXPECT_MAX
};
#define CTA_EXPECT_MAX (__CTA_EXPECT_MAX - 1)
enum ctattr_expect_nat {
CTA_EXPECT_NAT_UNSPEC,
CTA_EXPECT_NAT_DIR,
CTA_EXPECT_NAT_TUPLE,
__CTA_EXPECT_NAT_MAX
};
#define CTA_EXPECT_NAT_MAX (__CTA_EXPECT_NAT_MAX - 1)
enum ctattr_help {
CTA_HELP_UNSPEC,
CTA_HELP_NAME,
CTA_HELP_INFO,
__CTA_HELP_MAX
};
#define CTA_HELP_MAX (__CTA_HELP_MAX - 1)
enum ctattr_secctx {
CTA_SECCTX_UNSPEC,
CTA_SECCTX_NAME,
__CTA_SECCTX_MAX
};
#define CTA_SECCTX_MAX (__CTA_SECCTX_MAX - 1)
enum ctattr_stats_cpu {
CTA_STATS_UNSPEC,
CTA_STATS_SEARCHED,
CTA_STATS_FOUND,
CTA_STATS_NEW,
CTA_STATS_INVALID,
CTA_STATS_IGNORE,
CTA_STATS_DELETE,
CTA_STATS_DELETE_LIST,
CTA_STATS_INSERT,
CTA_STATS_INSERT_FAILED,
CTA_STATS_DROP,
CTA_STATS_EARLY_DROP,
CTA_STATS_ERROR,
CTA_STATS_SEARCH_RESTART,
__CTA_STATS_MAX,
};
#define CTA_STATS_MAX (__CTA_STATS_MAX - 1)
enum ctattr_stats_global {
CTA_STATS_GLOBAL_UNSPEC,
CTA_STATS_GLOBAL_ENTRIES,
__CTA_STATS_GLOBAL_MAX,
};
#define CTA_STATS_GLOBAL_MAX (__CTA_STATS_GLOBAL_MAX - 1)
enum ctattr_expect_stats {
CTA_STATS_EXP_UNSPEC,
CTA_STATS_EXP_NEW,
CTA_STATS_EXP_CREATE,
CTA_STATS_EXP_DELETE,
__CTA_STATS_EXP_MAX,
};
#define CTA_STATS_EXP_MAX (__CTA_STATS_EXP_MAX - 1)
#endif /* _IPCONNTRACK_NETLINK_H */

44
include/linux/netfilter/nfnetlink_log.h
View File

@ -5,10 +5,6 @@
* and not any kind of function definitions. It is shared between kernel and
* userspace. Don't put kernel specific stuff in here */
#ifndef aligned_be64
#define aligned_be64 u_int64_t __attribute__((aligned(8)))
#endif
#include <linux/types.h>
#include <linux/netfilter/nfnetlink.h>
@ -21,30 +17,30 @@ enum nfulnl_msg_types {
struct nfulnl_msg_packet_hdr {
__be16 hw_protocol; /* hw protocol (network order) */
u_int8_t hook; /* netfilter hook */
u_int8_t _pad;
__u8 hook; /* netfilter hook */
__u8 _pad;
};
struct nfulnl_msg_packet_hw {
__be16 hw_addrlen;
u_int16_t _pad;
u_int8_t hw_addr[8];
__u16 _pad;
__u8 hw_addr[8];
};
struct nfulnl_msg_packet_timestamp {
aligned_be64 sec;
aligned_be64 usec;
__aligned_be64 sec;
__aligned_be64 usec;
};
enum nfulnl_attr_type {
NFULA_UNSPEC,
NFULA_PACKET_HDR,
NFULA_MARK, /* u_int32_t nfmark */
NFULA_MARK, /* __u32 nfmark */
NFULA_TIMESTAMP, /* nfulnl_msg_packet_timestamp */
NFULA_IFINDEX_INDEV, /* u_int32_t ifindex */
NFULA_IFINDEX_OUTDEV, /* u_int32_t ifindex */
NFULA_IFINDEX_PHYSINDEV, /* u_int32_t ifindex */
NFULA_IFINDEX_PHYSOUTDEV, /* u_int32_t ifindex */
NFULA_IFINDEX_INDEV, /* __u32 ifindex */
NFULA_IFINDEX_OUTDEV, /* __u32 ifindex */
NFULA_IFINDEX_PHYSINDEV, /* __u32 ifindex */
NFULA_IFINDEX_PHYSOUTDEV, /* __u32 ifindex */
NFULA_HWADDR, /* nfulnl_msg_packet_hw */
NFULA_PAYLOAD, /* opaque data payload */
NFULA_PREFIX, /* string prefix */
@ -52,6 +48,9 @@ enum nfulnl_attr_type {
NFULA_SEQ, /* instance-local sequence number */
NFULA_SEQ_GLOBAL, /* global sequence number */
NFULA_GID, /* group id of socket */
NFULA_HWTYPE, /* hardware type */
NFULA_HWHEADER, /* hardware header */
NFULA_HWLEN, /* hardware header length */
__NFULA_MAX
};
@ -66,23 +65,23 @@ enum nfulnl_msg_config_cmds {
};
struct nfulnl_msg_config_cmd {
u_int8_t command; /* nfulnl_msg_config_cmds */
__u8 command; /* nfulnl_msg_config_cmds */
} __attribute__ ((packed));
struct nfulnl_msg_config_mode {
__be32 copy_range;
u_int8_t copy_mode;
u_int8_t _pad;
__u8 copy_mode;
__u8 _pad;
} __attribute__ ((packed));
enum nfulnl_attr_config {
NFULA_CFG_UNSPEC,
NFULA_CFG_CMD, /* nfulnl_msg_config_cmd */
NFULA_CFG_MODE, /* nfulnl_msg_config_mode */
NFULA_CFG_NLBUFSIZ, /* u_int32_t buffer size */
NFULA_CFG_TIMEOUT, /* u_int32_t in 1/100 s */
NFULA_CFG_QTHRESH, /* u_int32_t */
NFULA_CFG_FLAGS, /* u_int16_t */
NFULA_CFG_NLBUFSIZ, /* __u32 buffer size */
NFULA_CFG_TIMEOUT, /* __u32 in 1/100 s */
NFULA_CFG_QTHRESH, /* __u32 */
NFULA_CFG_FLAGS, /* __u16 */
__NFULA_CFG_MAX
};
#define NFULA_CFG_MAX (__NFULA_CFG_MAX -1)
@ -90,6 +89,7 @@ enum nfulnl_attr_config {
#define NFULNL_COPY_NONE 0x00
#define NFULNL_COPY_META 0x01
#define NFULNL_COPY_PACKET 0x02
/* 0xff is reserved, don't use it for new copy modes. */
#define NFULNL_CFG_F_SEQ 0x0001
#define NFULNL_CFG_F_SEQ_GLOBAL 0x0002

42
include/linux/netfilter/nfnetlink_queue.h
View File

@ -4,14 +4,11 @@
#include <linux/types.h>
#include <linux/netfilter/nfnetlink.h>
#ifndef aligned_be64
#define aligned_be64 u_int64_t __attribute__((aligned(8)))
#endif
enum nfqnl_msg_types {
NFQNL_MSG_PACKET, /* packet from kernel to userspace */
NFQNL_MSG_VERDICT, /* verdict from userspace to kernel */
NFQNL_MSG_CONFIG, /* connect to a particular queue */
NFQNL_MSG_VERDICT_BATCH, /* batchv from userspace to kernel */
NFQNL_MSG_MAX
};
@ -19,32 +16,34 @@ enum nfqnl_msg_types {
struct nfqnl_msg_packet_hdr {
__be32 packet_id; /* unique ID of packet in queue */
__be16 hw_protocol; /* hw protocol (network order) */
u_int8_t hook; /* netfilter hook */
__u8 hook; /* netfilter hook */
} __attribute__ ((packed));
struct nfqnl_msg_packet_hw {
__be16 hw_addrlen;
u_int16_t _pad;
u_int8_t hw_addr[8];
__u16 _pad;
__u8 hw_addr[8];
};
struct nfqnl_msg_packet_timestamp {
aligned_be64 sec;
aligned_be64 usec;
__aligned_be64 sec;
__aligned_be64 usec;
};
enum nfqnl_attr_type {
NFQA_UNSPEC,
NFQA_PACKET_HDR,
NFQA_VERDICT_HDR, /* nfqnl_msg_verdict_hrd */
NFQA_MARK, /* u_int32_t nfmark */
NFQA_MARK, /* __u32 nfmark */
NFQA_TIMESTAMP, /* nfqnl_msg_packet_timestamp */
NFQA_IFINDEX_INDEV, /* u_int32_t ifindex */
NFQA_IFINDEX_OUTDEV, /* u_int32_t ifindex */
NFQA_IFINDEX_PHYSINDEV, /* u_int32_t ifindex */
NFQA_IFINDEX_PHYSOUTDEV, /* u_int32_t ifindex */
NFQA_IFINDEX_INDEV, /* __u32 ifindex */
NFQA_IFINDEX_OUTDEV, /* __u32 ifindex */
NFQA_IFINDEX_PHYSINDEV, /* __u32 ifindex */
NFQA_IFINDEX_PHYSOUTDEV, /* __u32 ifindex */
NFQA_HWADDR, /* nfqnl_msg_packet_hw */
NFQA_PAYLOAD, /* opaque data payload */
NFQA_CT, /* nf_conntrack_netlink.h */
NFQA_CT_INFO, /* enum ip_conntrack_info */
__NFQA_MAX
};
@ -65,8 +64,8 @@ enum nfqnl_msg_config_cmds {
};
struct nfqnl_msg_config_cmd {
u_int8_t command; /* nfqnl_msg_config_cmds */
u_int8_t _pad;
__u8 command; /* nfqnl_msg_config_cmds */
__u8 _pad;
__be16 pf; /* AF_xxx for PF_[UN]BIND */
};
@ -78,7 +77,7 @@ enum nfqnl_config_mode {
struct nfqnl_msg_config_params {
__be32 copy_range;
u_int8_t copy_mode; /* enum nfqnl_config_mode */
__u8 copy_mode; /* enum nfqnl_config_mode */
} __attribute__ ((packed));
@ -86,9 +85,16 @@ enum nfqnl_attr_config {
NFQA_CFG_UNSPEC,
NFQA_CFG_CMD, /* nfqnl_msg_config_cmd */
NFQA_CFG_PARAMS, /* nfqnl_msg_config_params */
NFQA_CFG_QUEUE_MAXLEN, /* u_int32_t */
NFQA_CFG_QUEUE_MAXLEN, /* __u32 */
NFQA_CFG_MASK, /* identify which flags to change */
NFQA_CFG_FLAGS, /* value of these flags (__u32) */
__NFQA_CFG_MAX
};
#define NFQA_CFG_MAX (__NFQA_CFG_MAX-1)
/* Flags for NFQA_CFG_FLAGS */
#define NFQA_CFG_F_FAIL_OPEN (1 << 0)
#define NFQA_CFG_F_CONNTRACK (1 << 1)
#define NFQA_CFG_F_MAX (1 << 2)
#endif /* _NFNETLINK_QUEUE_H */

44
include/netlink-types.h
View File

@ -784,6 +784,50 @@ struct nfnl_ct {
struct nfnl_ct_dir ct_repl;
};
union nfnl_exp_protodata {
struct {
uint16_t src;
uint16_t dst;
} port;
struct {
uint16_t id;
uint8_t type;
uint8_t code;
} icmp;
};
// Allow for different master/expect l4 protocols
struct nfnl_exp_proto
{
uint8_t l4protonum;
union nfnl_exp_protodata l4protodata;
};
struct nfnl_exp_dir {
struct nl_addr * src;
struct nl_addr * dst;
struct nfnl_exp_proto proto;
};
struct nfnl_exp {
NLHDR_COMMON
uint8_t exp_family;
uint32_t exp_timeout;
uint32_t exp_id;
uint16_t exp_zone;
uint32_t exp_class;
uint32_t exp_flags;
char * exp_helper_name;
char * exp_fn;
uint8_t exp_nat_dir;
struct nfnl_exp_dir exp_expect;
struct nfnl_exp_dir exp_master;
struct nfnl_exp_dir exp_mask;
struct nfnl_exp_dir exp_nat;
};
struct nfnl_log {
NLHDR_COMMON

42
include/netlink/cli/exp.h Normal file
View File

@ -0,0 +1,42 @@
/*
* netlink/cli/exp.h CLI Expectation Helper
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation version 2.1
* of the License.
*
* Copyright (c) 2012 Rich Fought <Rich.Fought@watchguard.com>
* Copyright (c) 2008-2009 Thomas Graf <tgraf@suug.ch>
*/
#ifndef __NETLINK_CLI_EXP_H_
#define __NETLINK_CLI_EXP_H_
#include <netlink/netfilter/exp.h>
#include <linux/netfilter/nf_conntrack_common.h>
extern struct nfnl_exp *nl_cli_exp_alloc(void);
extern struct nl_cache *nl_cli_exp_alloc_cache(struct nl_sock *);
extern void nl_cli_exp_parse_family(struct nfnl_exp *, char *);
extern void nl_cli_exp_parse_timeout(struct nfnl_exp *, char *);
extern void nl_cli_exp_parse_id(struct nfnl_exp *, char *);
extern void nl_cli_exp_parse_helper_name(struct nfnl_exp *, char *);
extern void nl_cli_exp_parse_zone(struct nfnl_exp *, char *);
extern void nl_cli_exp_parse_flags(struct nfnl_exp *, char *);
extern void nl_cli_exp_parse_class(struct nfnl_exp *, char *);
extern void nl_cli_exp_parse_nat_dir(struct nfnl_exp *, char *);
extern void nl_cli_exp_parse_fn(struct nfnl_exp *, char *);
extern void nl_cli_exp_parse_src(struct nfnl_exp *, int, char *);
extern void nl_cli_exp_parse_dst(struct nfnl_exp *, int, char *);
extern void nl_cli_exp_parse_l4protonum(struct nfnl_exp *, int, char *);
extern void nl_cli_exp_parse_src_port(struct nfnl_exp *, int, char *);
extern void nl_cli_exp_parse_dst_port(struct nfnl_exp *, int, char *);
extern void nl_cli_exp_parse_icmp_id(struct nfnl_exp *, int, char *);
extern void nl_cli_exp_parse_icmp_type(struct nfnl_exp *, int, char *);
extern void nl_cli_exp_parse_icmp_code(struct nfnl_exp *, int, char *);
#endif

129
include/netlink/netfilter/exp.h Normal file
View File

@ -0,0 +1,129 @@
/*
* netlink/netfilter/exp.h Conntrack Expectation
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation version 2.1
* of the License.
*
* Copyright (c) 2003-2008 Thomas Graf <tgraf@suug.ch>
* Copyright (c) 2007 Philip Craig <philipc@snapgear.com>
* Copyright (c) 2007 Secure Computing Corporation
* Copyright (c) 2012 Rich Fought <rich.fought@watchguard.com>
*/
#ifndef NETLINK_EXP_H_
#define NETLINK_EXP_H_
#include <netlink/netlink.h>
#include <netlink/addr.h>
#include <netlink/cache.h>
#include <netlink/msg.h>
#include <linux/version.h>
#ifdef __cplusplus
extern "C" {
#endif
struct nfnl_exp;
enum nfnl_exp_tuples {
NFNL_EXP_TUPLE_EXPECT,
NFNL_EXP_TUPLE_MASTER,
NFNL_EXP_TUPLE_MASK,
NFNL_EXP_TUPLE_NAT,
NFNL_EXP_TUPLE_MAX
};
extern struct nl_object_ops exp_obj_ops;
extern struct nfnl_exp * nfnl_exp_alloc(void);
extern int nfnl_exp_alloc_cache(struct nl_sock *, struct nl_cache **);
extern int nfnlmsg_exp_group(struct nlmsghdr *);
extern int nfnlmsg_exp_parse(struct nlmsghdr *, struct nfnl_exp **);
extern void nfnl_exp_get(struct nfnl_exp *);
extern void nfnl_exp_put(struct nfnl_exp *);
extern int nfnl_exp_dump_request(struct nl_sock *);
extern int nfnl_exp_build_add_request(const struct nfnl_exp *, int,
struct nl_msg **);
extern int nfnl_exp_add(struct nl_sock *, const struct nfnl_exp *, int);
extern int nfnl_exp_build_delete_request(const struct nfnl_exp *, int,
struct nl_msg **);
extern int nfnl_exp_del(struct nl_sock *, const struct nfnl_exp *, int);
extern int nfnl_exp_build_query_request(const struct nfnl_exp *, int,
struct nl_msg **);
extern int nfnl_exp_query(struct nl_sock *, const struct nfnl_exp *, int);
extern void nfnl_exp_set_family(struct nfnl_exp *, uint8_t);
extern uint8_t nfnl_exp_get_family(const struct nfnl_exp *);
extern void nfnl_exp_set_timeout(struct nfnl_exp *, uint32_t);
extern int nfnl_exp_test_timeout(const struct nfnl_exp *);
extern uint32_t nfnl_exp_get_timeout(const struct nfnl_exp *);
extern void nfnl_exp_set_id(struct nfnl_exp *, uint32_t);
extern int nfnl_exp_test_id(const struct nfnl_exp *);
extern uint32_t nfnl_exp_get_id(const struct nfnl_exp *);
extern int nfnl_exp_set_helper_name(struct nfnl_exp *, void *);
extern int nfnl_exp_test_helper_name(const struct nfnl_exp *);
extern const char * nfnl_exp_get_helper_name(const struct nfnl_exp *);
extern void nfnl_exp_set_zone(struct nfnl_exp *, uint16_t);
extern int nfnl_exp_test_zone(const struct nfnl_exp *);
extern uint16_t nfnl_exp_get_zone(const struct nfnl_exp *);
extern void nfnl_exp_set_flags(struct nfnl_exp *, uint32_t);
extern int nfnl_exp_test_flags(const struct nfnl_exp *);
extern uint32_t nfnl_exp_get_flags(const struct nfnl_exp *);
extern void nfnl_exp_set_class(struct nfnl_exp *, uint32_t);
extern int nfnl_exp_test_class(const struct nfnl_exp *);
extern uint32_t nfnl_exp_get_class(const struct nfnl_exp *);
extern int nfnl_exp_set_fn(struct nfnl_exp *, void *);
extern int nfnl_exp_test_fn(const struct nfnl_exp *);
extern const char * nfnl_exp_get_fn(const struct nfnl_exp *);
extern void nfnl_exp_set_nat_dir(struct nfnl_exp *, uint8_t);
extern int nfnl_exp_test_nat_dir(const struct nfnl_exp *);
extern uint8_t nfnl_exp_get_nat_dir(const struct nfnl_exp *);
// The int argument specifies which nfnl_exp_dir (expect, master, mask or nat)
// Expectation objects only use orig, not reply
extern int nfnl_exp_set_src(struct nfnl_exp *, int, struct nl_addr *);
extern int nfnl_exp_test_src(const struct nfnl_exp *, int);
extern struct nl_addr * nfnl_exp_get_src(const struct nfnl_exp *, int);
extern int nfnl_exp_set_dst(struct nfnl_exp *, int, struct nl_addr *);
extern int nfnl_exp_test_dst(const struct nfnl_exp *, int);
extern struct nl_addr * nfnl_exp_get_dst(const struct nfnl_exp *, int);
extern void nfnl_exp_set_l4protonum(struct nfnl_exp *, int, uint8_t);
extern int nfnl_exp_test_l4protonum(const struct nfnl_exp *, int);
extern uint8_t nfnl_exp_get_l4protonum(const struct nfnl_exp *, int);
extern void nfnl_exp_set_ports(struct nfnl_exp *, int, uint16_t, uint16_t);
extern int nfnl_exp_test_ports(const struct nfnl_exp *, int);
extern uint16_t nfnl_exp_get_src_port(const struct nfnl_exp *, int);
extern uint16_t nfnl_exp_get_dst_port(const struct nfnl_exp *, int);
extern void nfnl_exp_set_icmp(struct nfnl_exp *, int, uint16_t, uint8_t, uint8_t);
extern int nfnl_exp_test_icmp(const struct nfnl_exp *, int);
extern uint16_t nfnl_exp_get_icmp_id(const struct nfnl_exp *, int);
extern uint8_t nfnl_exp_get_icmp_type(const struct nfnl_exp *, int);
extern uint8_t nfnl_exp_get_icmp_code(const struct nfnl_exp *, int);
#ifdef __cplusplus
}
#endif
#endif

3
lib/Makefile.am
View File

@ -29,7 +29,8 @@ libnl_nf_3_la_SOURCES = \
netfilter/ct.c netfilter/ct_obj.c netfilter/log.c \
netfilter/log_msg.c netfilter/log_msg_obj.c netfilter/log_obj.c \
netfilter/netfilter.c netfilter/nfnl.c netfilter/queue.c \
netfilter/queue_msg.c netfilter/queue_msg_obj.c netfilter/queue_obj.c
netfilter/queue_msg.c netfilter/queue_msg_obj.c netfilter/queue_obj.c \
netfilter/exp.c netfilter/exp_obj.c
CLEANFILES = \
route/pktloc_grammar.c route/pktloc_grammar.h \

617
lib/netfilter/exp.c Normal file
View File

@ -0,0 +1,617 @@
/*
* lib/netfilter/exp.c Conntrack Expectation
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation version 2.1
* of the License.
*
* Copyright (c) 2003-2008 Thomas Graf <tgraf@suug.ch>
* Copyright (c) 2007 Philip Craig <philipc@snapgear.com>
* Copyright (c) 2007 Secure Computing Corporation
* Copyright (c= 2008 Patrick McHardy <kaber@trash.net>
* Copyright (c) 2012 Rich Fought <rich.fought@watchguard.com>
*/
/**
* @ingroup nfnl
* @defgroup exp Expectation
* @brief
* @{
*/
#include <byteswap.h>
#include <sys/types.h>
#include <linux/netfilter/nfnetlink_conntrack.h>
#include <netlink-local.h>
#include <netlink/attr.h>
#include <netlink/netfilter/nfnl.h>
#include <netlink/netfilter/exp.h>
static struct nl_cache_ops nfnl_exp_ops;
static struct nla_policy exp_policy[CTA_EXPECT_MAX+1] = {
[CTA_EXPECT_MASTER] = { .type = NLA_NESTED },
[CTA_EXPECT_TUPLE] = { .type = NLA_NESTED },
[CTA_EXPECT_MASK] = { .type = NLA_NESTED },
[CTA_EXPECT_TIMEOUT] = { .type = NLA_U32 },
[CTA_EXPECT_ID] = { .type = NLA_U32 },
[CTA_EXPECT_HELP_NAME] = { .type = NLA_STRING },
[CTA_EXPECT_ZONE] = { .type = NLA_U16 },
[CTA_EXPECT_FLAGS] = { .type = NLA_U32 }, // Added in kernel 2.6.37
[CTA_EXPECT_CLASS] = { .type = NLA_U32 }, // Added in kernel 3.5
[CTA_EXPECT_NAT] = { .type = NLA_NESTED }, // Added in kernel 3.5
[CTA_EXPECT_FN] = { .type = NLA_STRING }, // Added in kernel 3.5
};
static struct nla_policy exp_tuple_policy[CTA_TUPLE_MAX+1] = {
[CTA_TUPLE_IP] = { .type = NLA_NESTED },
[CTA_TUPLE_PROTO] = { .type = NLA_NESTED },
};
static struct nla_policy exp_ip_policy[CTA_IP_MAX+1] = {
[CTA_IP_V4_SRC] = { .type = NLA_U32 },
[CTA_IP_V4_DST] = { .type = NLA_U32 },
[CTA_IP_V6_SRC] = { .minlen = 16 },
[CTA_IP_V6_DST] = { .minlen = 16 },
};
static struct nla_policy exp_proto_policy[CTA_PROTO_MAX+1] = {
[CTA_PROTO_NUM] = { .type = NLA_U8 },
[CTA_PROTO_SRC_PORT] = { .type = NLA_U16 },
[CTA_PROTO_DST_PORT] = { .type = NLA_U16 },
[CTA_PROTO_ICMP_ID] = { .type = NLA_U16 },
[CTA_PROTO_ICMP_TYPE] = { .type = NLA_U8 },
[CTA_PROTO_ICMP_CODE] = { .type = NLA_U8 },
[CTA_PROTO_ICMPV6_ID] = { .type = NLA_U16 },
[CTA_PROTO_ICMPV6_TYPE] = { .type = NLA_U8 },
[CTA_PROTO_ICMPV6_CODE] = { .type = NLA_U8 },
};
static struct nla_policy exp_nat_policy[CTA_EXPECT_NAT_MAX+1] = {
[CTA_EXPECT_NAT_DIR] = { .type = NLA_U8 },
[CTA_EXPECT_NAT_TUPLE] = { .type = NLA_NESTED },
};
static int exp_parse_ip(struct nfnl_exp *exp, int tuple, struct nlattr *attr)
{
struct nlattr *tb[CTA_IP_MAX+1];
struct nl_addr *addr;
int err;
err = nla_parse_nested(tb, CTA_IP_MAX, attr, exp_ip_policy);
if (err < 0)
goto errout;
if (tb[CTA_IP_V4_SRC]) {
addr = nl_addr_alloc_attr(tb[CTA_IP_V4_SRC], AF_INET);
if (addr == NULL)
goto errout_enomem;
err = nfnl_exp_set_src(exp, tuple, addr);
nl_addr_put(addr);
if (err < 0)
goto errout;
}
if (tb[CTA_IP_V4_DST]) {
addr = nl_addr_alloc_attr(tb[CTA_IP_V4_DST], AF_INET);
if (addr == NULL)
goto errout_enomem;
err = nfnl_exp_set_dst(exp, tuple, addr);
nl_addr_put(addr);
if (err < 0)
goto errout;
}
if (tb[CTA_IP_V6_SRC]) {
addr = nl_addr_alloc_attr(tb[CTA_IP_V6_SRC], AF_INET6);
if (addr == NULL)
goto errout_enomem;
err = nfnl_exp_set_src(exp, tuple, addr);
nl_addr_put(addr);
if (err < 0)
goto errout;
}
if (tb[CTA_IP_V6_DST]) {
addr = nl_addr_alloc_attr(tb[CTA_IP_V6_DST], AF_INET6);
if (addr == NULL)
goto errout_enomem;
err = nfnl_exp_set_dst(exp, tuple, addr);
nl_addr_put(addr);
if (err < 0)
goto errout;
}
return 0;
errout_enomem:
err = -NLE_NOMEM;
errout:
return err;
}
static int exp_parse_proto(struct nfnl_exp *exp, int tuple, struct nlattr *attr)
{
struct nlattr *tb[CTA_PROTO_MAX+1];
int err;
uint16_t srcport = 0, dstport = 0, icmpid = 0;
uint8_t icmptype = 0, icmpcode = 0;
err = nla_parse_nested(tb, CTA_PROTO_MAX, attr, exp_proto_policy);
if (err < 0)
return err;
if (tb[CTA_PROTO_NUM])
nfnl_exp_set_l4protonum(exp, tuple, nla_get_u8(tb[CTA_PROTO_NUM]));
if (tb[CTA_PROTO_SRC_PORT])
srcport = ntohs(nla_get_u16(tb[CTA_PROTO_SRC_PORT]));
if (tb[CTA_PROTO_DST_PORT])
dstport = ntohs(nla_get_u16(tb[CTA_PROTO_DST_PORT]));
if (tb[CTA_PROTO_SRC_PORT] || tb[CTA_PROTO_DST_PORT])
nfnl_exp_set_ports(exp, tuple, srcport, dstport);
if (tb[CTA_PROTO_ICMP_ID])
icmpid = ntohs(nla_get_u16(tb[CTA_PROTO_ICMP_ID]));
if (tb[CTA_PROTO_ICMP_TYPE])
icmptype = nla_get_u8(tb[CTA_PROTO_ICMP_TYPE]);
if (tb[CTA_PROTO_ICMP_CODE])
icmpcode = nla_get_u8(tb[CTA_PROTO_ICMP_CODE]);
if (tb[CTA_PROTO_ICMP_ID] || tb[CTA_PROTO_ICMP_TYPE] || tb[CTA_PROTO_ICMP_CODE])
nfnl_exp_set_icmp(exp, tuple, icmpid, icmptype, icmpcode);
return 0;
}
static int exp_parse_tuple(struct nfnl_exp *exp, int tuple, struct nlattr *attr)
{
struct nlattr *tb[CTA_TUPLE_MAX+1];
int err;
err = nla_parse_nested(tb, CTA_TUPLE_MAX, attr, exp_tuple_policy);
if (err < 0)
return err;
if (tb[CTA_TUPLE_IP]) {
err = exp_parse_ip(exp, tuple, tb[CTA_TUPLE_IP]);
if (err < 0)
return err;
}
if (tb[CTA_TUPLE_PROTO]) {
err = exp_parse_proto(exp, tuple, tb[CTA_TUPLE_PROTO]);
if (err < 0)
return err;
}
return 0;
}
static int exp_parse_nat(struct nfnl_exp *exp, struct nlattr *attr)
{
struct nlattr *tb[CTA_EXPECT_NAT_MAX+1];
int err;
err = nla_parse_nested(tb, CTA_EXPECT_NAT_MAX, attr, exp_nat_policy);
if (err < 0)
return err;
if (tb[CTA_EXPECT_NAT_DIR])
nfnl_exp_set_nat_dir(exp, nla_get_u8(tb[CTA_EXPECT_NAT_DIR]));
if (tb[CTA_EXPECT_NAT_TUPLE]) {
err = exp_parse_tuple(exp, NFNL_EXP_TUPLE_NAT, tb[CTA_EXPECT_NAT_TUPLE]);
if (err < 0)
return err;
}
return 0;
}
int nfnlmsg_exp_group(struct nlmsghdr *nlh)
{
switch (nfnlmsg_subtype(nlh)) {
case IPCTNL_MSG_EXP_NEW:
if (nlh->nlmsg_flags & (NLM_F_CREATE|NLM_F_EXCL))
return NFNLGRP_CONNTRACK_EXP_NEW;
else
return NFNLGRP_CONNTRACK_EXP_UPDATE;
case IPCTNL_MSG_EXP_DELETE:
return NFNLGRP_CONNTRACK_EXP_DESTROY;
default:
return NFNLGRP_NONE;
}
}
int nfnlmsg_exp_parse(struct nlmsghdr *nlh, struct nfnl_exp **result)
{
struct nfnl_exp *exp;
struct nlattr *tb[CTA_MAX+1];
int err;
exp = nfnl_exp_alloc();
if (!exp)
return -NLE_NOMEM;
exp->ce_msgtype = nlh->nlmsg_type;
err = nlmsg_parse(nlh, sizeof(struct nfgenmsg), tb, CTA_EXPECT_MAX,
exp_policy);
if (err < 0)
goto errout;
nfnl_exp_set_family(exp, nfnlmsg_family(nlh));
if (tb[CTA_EXPECT_TUPLE]) {
err = exp_parse_tuple(exp, NFNL_EXP_TUPLE_EXPECT, tb[CTA_EXPECT_TUPLE]);
if (err < 0)
goto errout;
}
if (tb[CTA_EXPECT_MASTER]) {
err = exp_parse_tuple(exp, NFNL_EXP_TUPLE_MASTER, tb[CTA_EXPECT_MASTER]);
if (err < 0)
goto errout;
}
if (tb[CTA_EXPECT_MASK]) {
err = exp_parse_tuple(exp, NFNL_EXP_TUPLE_MASK, tb[CTA_EXPECT_MASK]);
if (err < 0)
goto errout;
}
if (tb[CTA_EXPECT_NAT]) {
err = exp_parse_nat(exp, tb[CTA_EXPECT_MASK]);
if (err < 0)
goto errout;
}
if (tb[CTA_EXPECT_CLASS])
nfnl_exp_set_class(exp, ntohl(nla_get_u32(tb[CTA_EXPECT_CLASS])));
if (tb[CTA_EXPECT_FN])
nfnl_exp_set_fn(exp, nla_data(tb[CTA_EXPECT_FN]));
if (tb[CTA_EXPECT_TIMEOUT])
nfnl_exp_set_timeout(exp, ntohl(nla_get_u32(tb[CTA_EXPECT_TIMEOUT])));
if (tb[CTA_EXPECT_ID])
nfnl_exp_set_id(exp, ntohl(nla_get_u32(tb[CTA_EXPECT_ID])));
if (tb[CTA_EXPECT_HELP_NAME])
nfnl_exp_set_helper_name(exp, nla_data(tb[CTA_EXPECT_HELP_NAME]));
if (tb[CTA_EXPECT_ZONE])
nfnl_exp_set_zone(exp, ntohs(nla_get_u16(tb[CTA_EXPECT_ZONE])));
if (tb[CTA_EXPECT_FLAGS])
nfnl_exp_set_flags(exp, ntohl(nla_get_u32(tb[CTA_EXPECT_FLAGS])));
*result = exp;
return 0;
errout:
nfnl_exp_put(exp);
return err;
}
static int exp_msg_parser(struct nl_cache_ops *ops, struct sockaddr_nl *who,
struct nlmsghdr *nlh, struct nl_parser_param *pp)
{
struct nfnl_exp *exp;
int err;
if ((err = nfnlmsg_exp_parse(nlh, &exp)) < 0)
goto errout;
err = pp->pp_cb((struct nl_object *) exp, pp);
errout:
nfnl_exp_put(exp);
return err;
}
int nfnl_exp_dump_request(struct nl_sock *sk)
{
return nfnl_send_simple(sk, NFNL_SUBSYS_CTNETLINK_EXP, IPCTNL_MSG_EXP_GET,
NLM_F_DUMP, AF_UNSPEC, 0);
}
static int exp_request_update(struct nl_cache *cache, struct nl_sock *sk)
{
return nfnl_exp_dump_request(sk);
}
static int exp_get_tuple_attr(int tuple)
{
int attr = 0;
switch (tuple) {
case CTA_EXPECT_MASTER:
attr = NFNL_EXP_TUPLE_MASTER;
break;
case CTA_EXPECT_MASK:
attr = NFNL_EXP_TUPLE_MASK;
break;
case CTA_EXPECT_NAT:
attr = NFNL_EXP_TUPLE_NAT;
break;
case CTA_EXPECT_TUPLE:
default :
attr = NFNL_EXP_TUPLE_EXPECT;
break;
}
return attr;
}
static int nfnl_exp_build_tuple(struct nl_msg *msg, const struct nfnl_exp *exp,
int cta)
{
struct nlattr *tuple, *ip, *proto;
struct nl_addr *addr;
int family;
family = nfnl_exp_get_family(exp);
int type = exp_get_tuple_attr(cta);
tuple = nla_nest_start(msg, cta);
if (!tuple)
goto nla_put_failure;
ip = nla_nest_start(msg, CTA_TUPLE_IP);
if (!ip)
goto nla_put_failure;
addr = nfnl_exp_get_src(exp, type);
if (addr)
NLA_PUT_ADDR(msg,
family == AF_INET ? CTA_IP_V4_SRC : CTA_IP_V6_SRC,
addr);
addr = nfnl_exp_get_dst(exp, type);
if (addr)
NLA_PUT_ADDR(msg,
family == AF_INET ? CTA_IP_V4_DST : CTA_IP_V6_DST,
addr);
nla_nest_end(msg, ip);
proto = nla_nest_start(msg, CTA_TUPLE_PROTO);
if (!proto)
goto nla_put_failure;
if (nfnl_exp_test_l4protonum(exp, type))
NLA_PUT_U8(msg, CTA_PROTO_NUM, nfnl_exp_get_l4protonum(exp, type));
if (nfnl_exp_test_ports(exp, type)) {
NLA_PUT_U16(msg, CTA_PROTO_SRC_PORT,
htons(nfnl_exp_get_src_port(exp, type)));
NLA_PUT_U16(msg, CTA_PROTO_DST_PORT,
htons(nfnl_exp_get_dst_port(exp, type)));
}
if (nfnl_exp_test_icmp(exp, type)) {
NLA_PUT_U16(msg, CTA_PROTO_ICMP_ID,
htons(nfnl_exp_get_icmp_id(exp, type)));
NLA_PUT_U8(msg, CTA_PROTO_ICMP_TYPE,
nfnl_exp_get_icmp_type(exp, type));
NLA_PUT_U8(msg, CTA_PROTO_ICMP_CODE,
nfnl_exp_get_icmp_code(exp, type));
}
nla_nest_end(msg, proto);
nla_nest_end(msg, tuple);
return 0;
nla_put_failure:
return -NLE_MSGSIZE;
}
static int nfnl_exp_build_nat(struct nl_msg *msg, const struct nfnl_exp *exp)
{
struct nlattr *nat;
int err;
nat = nla_nest_start(msg, CTA_EXPECT_NAT);
if (nfnl_exp_test_nat_dir(exp)) {
NLA_PUT_U8(msg, CTA_EXPECT_NAT_DIR,
nfnl_exp_get_nat_dir(exp));
}
if ((err = nfnl_exp_build_tuple(msg, exp, CTA_EXPECT_NAT_TUPLE)) < 0)
goto nla_put_failure;
nla_nest_end(msg, nat);
return 0;
nla_put_failure:
return -NLE_MSGSIZE;
}
static int nfnl_exp_build_message(const struct nfnl_exp *exp, int cmd, int flags,
struct nl_msg **result)
{
struct nl_msg *msg;
int err;
msg = nfnlmsg_alloc_simple(NFNL_SUBSYS_CTNETLINK_EXP, cmd, flags,
nfnl_exp_get_family(exp), 0);
if (msg == NULL)
return -NLE_NOMEM;
if ((err = nfnl_exp_build_tuple(msg, exp, CTA_EXPECT_TUPLE)) < 0)
goto err_out;
if ((err = nfnl_exp_build_tuple(msg, exp, CTA_EXPECT_MASTER)) < 0)
goto err_out;
if ((err = nfnl_exp_build_tuple(msg, exp, CTA_EXPECT_MASK)) < 0)
goto err_out;
if (nfnl_exp_test_src(exp, NFNL_EXP_TUPLE_NAT)) {
if ((err = nfnl_exp_build_nat(msg, exp)) < 0)
goto err_out;
}
if (nfnl_exp_test_class(exp))
NLA_PUT_U32(msg, CTA_EXPECT_CLASS, htonl(nfnl_exp_get_class(exp)));
if (nfnl_exp_test_fn(exp))
NLA_PUT_STRING(msg, CTA_EXPECT_FN, nfnl_exp_get_fn(exp));
if (nfnl_exp_test_id(exp))
NLA_PUT_U32(msg, CTA_EXPECT_ID, htonl(nfnl_exp_get_id(exp)));
if (nfnl_exp_test_timeout(exp))
NLA_PUT_U32(msg, CTA_EXPECT_TIMEOUT, htonl(nfnl_exp_get_timeout(exp)));
if (nfnl_exp_test_helper_name(exp))
NLA_PUT_STRING(msg, CTA_EXPECT_HELP_NAME, nfnl_exp_get_helper_name(exp));
if (nfnl_exp_test_zone(exp))
NLA_PUT_U16(msg, CTA_EXPECT_ZONE, htons(nfnl_exp_get_zone(exp)));
if (nfnl_exp_test_flags(exp))
NLA_PUT_U32(msg, CTA_EXPECT_FLAGS, htonl(nfnl_exp_get_flags(exp)));
*result = msg;
return 0;
nla_put_failure:
err_out:
nlmsg_free(msg);
return err;
}
int nfnl_exp_build_add_request(const struct nfnl_exp *exp, int flags,
struct nl_msg **result)
{
return nfnl_exp_build_message(exp, IPCTNL_MSG_EXP_NEW, flags, result);
}
int nfnl_exp_add(struct nl_sock *sk, const struct nfnl_exp *exp, int flags)
{
struct nl_msg *msg;
int err;
if ((err = nfnl_exp_build_add_request(exp, flags, &msg)) < 0)
return err;
err = nl_send_auto_complete(sk, msg);
nlmsg_free(msg);
if (err < 0)
return err;
return wait_for_ack(sk);
}
int nfnl_exp_build_delete_request(const struct nfnl_exp *exp, int flags,
struct nl_msg **result)
{
return nfnl_exp_build_message(exp, IPCTNL_MSG_EXP_DELETE, flags, result);
}
int nfnl_exp_del(struct nl_sock *sk, const struct nfnl_exp *exp, int flags)
{
struct nl_msg *msg;
int err;
if ((err = nfnl_exp_build_delete_request(exp, flags, &msg)) < 0)
return err;
err = nl_send_auto_complete(sk, msg);
nlmsg_free(msg);
if (err < 0)
return err;
return wait_for_ack(sk);
}
int nfnl_exp_build_query_request(const struct nfnl_exp *exp, int flags,
struct nl_msg **result)
{
return nfnl_exp_build_message(exp, IPCTNL_MSG_EXP_GET, flags, result);
}
int nfnl_exp_query(struct nl_sock *sk, const struct nfnl_exp *exp, int flags)
{
struct nl_msg *msg;
int err;
if ((err = nfnl_exp_build_query_request(exp, flags, &msg)) < 0)
return err;
err = nl_send_auto_complete(sk, msg);
nlmsg_free(msg);
if (err < 0)
return err;
return wait_for_ack(sk);
}
/**
* @name Cache Management
* @{
*/
/**
* Build a expectation cache holding all expectations currently in the kernel
* @arg sk Netlink socket.
* @arg result Pointer to store resulting cache.
*
* Allocates a new cache, initializes it properly and updates it to
* contain all expectations currently in the kernel.
*
* @return 0 on success or a negative error code.
*/
int nfnl_exp_alloc_cache(struct nl_sock *sk, struct nl_cache **result)
{
return nl_cache_alloc_and_fill(&nfnl_exp_ops, sk, result);
}
/** @} */
/**
* @name Expectation Addition
* @{
*/
/** @} */
static struct nl_af_group exp_groups[] = {
{ AF_UNSPEC, NFNLGRP_CONNTRACK_EXP_NEW },
{ AF_UNSPEC, NFNLGRP_CONNTRACK_EXP_UPDATE },
{ AF_UNSPEC, NFNLGRP_CONNTRACK_EXP_DESTROY },
{ END_OF_GROUP_LIST },
};
#define NFNLMSG_EXP_TYPE(type) NFNLMSG_TYPE(NFNL_SUBSYS_CTNETLINK_EXP, (type))
static struct nl_cache_ops nfnl_exp_ops = {
.co_name = "netfilter/exp",
.co_hdrsize = NFNL_HDRLEN,
.co_msgtypes = {
{ NFNLMSG_EXP_TYPE(IPCTNL_MSG_EXP_NEW), NL_ACT_NEW, "new" },
{ NFNLMSG_EXP_TYPE(IPCTNL_MSG_EXP_GET), NL_ACT_GET, "get" },
{ NFNLMSG_EXP_TYPE(IPCTNL_MSG_EXP_DELETE), NL_ACT_DEL, "del" },
END_OF_MSGTYPES_LIST,
},
.co_protocol = NETLINK_NETFILTER,
.co_groups = exp_groups,
.co_request_update = exp_request_update,
.co_msg_parser = exp_msg_parser,
.co_obj_ops = &exp_obj_ops,
};
static void __init exp_init(void)
{
nl_cache_mngt_register(&nfnl_exp_ops);
}
static void __exit exp_exit(void)
{
nl_cache_mngt_unregister(&nfnl_exp_ops);
}
/** @} */

888
lib/netfilter/exp_obj.c Normal file
View File

@ -0,0 +1,888 @@
/*
* lib/netfilter/exp_obj.c Conntrack Expectation Object
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation version 2.1
* of the License.
*
* Copyright (c) 2003-2008 Thomas Graf <tgraf@suug.ch>
* Copyright (c) 2007 Philip Craig <philipc@snapgear.com>
* Copyright (c) 2007 Secure Computing Corporation
* Copyright (c) 2012 Rich Fought <rich.fought@watchguard.com>
*/
#include <sys/types.h>
#include <netinet/in.h>
#include <linux/netfilter/nfnetlink_conntrack.h>
#include <linux/netfilter/nf_conntrack_common.h>
#include <linux/netfilter/nf_conntrack_tcp.h>
#include <netlink-local.h>
#include <netlink/netfilter/nfnl.h>
#include <netlink/netfilter/exp.h>
// The 32-bit attribute mask in the common object header isn't
// big enough to handle all attributes of an expectation. So
// we'll for sure specify optional attributes + parent attributes
// that are required for valid object comparison. Comparison of
// these parent attributes will include nested attributes.
/** @cond SKIP */
#define EXP_ATTR_FAMILY (1UL << 0) // 8-bit
#define EXP_ATTR_TIMEOUT (1UL << 1) // 32-bit
#define EXP_ATTR_ID (1UL << 2) // 32-bit
#define EXP_ATTR_HELPER_NAME (1UL << 3) // string
#define EXP_ATTR_ZONE (1UL << 4) // 16-bit
#define EXP_ATTR_FLAGS (1UL << 5) // 32-bit
#define EXP_ATTR_CLASS (1UL << 6) // 32-bit
#define EXP_ATTR_FN (1UL << 7) // String
// Tuples
#define EXP_ATTR_EXPECT_IP_SRC (1UL << 8)
#define EXP_ATTR_EXPECT_IP_DST (1UL << 9)
#define EXP_ATTR_EXPECT_L4PROTO_NUM (1UL << 10)
#define EXP_ATTR_EXPECT_L4PROTO_PORTS (1UL << 11)
#define EXP_ATTR_EXPECT_L4PROTO_ICMP (1UL << 12)
#define EXP_ATTR_MASTER_IP_SRC (1UL << 13)
#define EXP_ATTR_MASTER_IP_DST (1UL << 14)
#define EXP_ATTR_MASTER_L4PROTO_NUM (1UL << 15)
#define EXP_ATTR_MASTER_L4PROTO_PORTS (1UL << 16)
#define EXP_ATTR_MASTER_L4PROTO_ICMP (1UL << 17)
#define EXP_ATTR_MASK_IP_SRC (1UL << 18)
#define EXP_ATTR_MASK_IP_DST (1UL << 19)
#define EXP_ATTR_MASK_L4PROTO_NUM (1UL << 20)
#define EXP_ATTR_MASK_L4PROTO_PORTS (1UL << 21)
#define EXP_ATTR_MASK_L4PROTO_ICMP (1UL << 22)
#define EXP_ATTR_NAT_IP_SRC (1UL << 23)
#define EXP_ATTR_NAT_IP_DST (1UL << 24)
#define EXP_ATTR_NAT_L4PROTO_NUM (1UL << 25)
#define EXP_ATTR_NAT_L4PROTO_PORTS (1UL << 26)
#define EXP_ATTR_NAT_L4PROTO_ICMP (1UL << 27)
#define EXP_ATTR_NAT_DIR (1UL << 28)
/** @endcond */
static void exp_free_data(struct nl_object *c)
{
struct nfnl_exp *exp = (struct nfnl_exp *) c;
if (exp == NULL)
return;
nl_addr_put(exp->exp_expect.src);
nl_addr_put(exp->exp_expect.dst);
nl_addr_put(exp->exp_master.src);
nl_addr_put(exp->exp_master.dst);
nl_addr_put(exp->exp_mask.src);
nl_addr_put(exp->exp_mask.dst);
nl_addr_put(exp->exp_nat.src);
nl_addr_put(exp->exp_nat.dst);
free(exp->exp_fn);
free(exp->exp_helper_name);
}
static int exp_clone(struct nl_object *_dst, struct nl_object *_src)
{
struct nfnl_exp *dst = (struct nfnl_exp *) _dst;
struct nfnl_exp *src = (struct nfnl_exp *) _src;
struct nl_addr *addr;
// Expectation
if (src->exp_expect.src) {
addr = nl_addr_clone(src->exp_expect.src);
if (!addr)
return -NLE_NOMEM;
dst->exp_expect.src = addr;
}
if (src->exp_expect.dst) {
addr = nl_addr_clone(src->exp_expect.dst);
if (!addr)
return -NLE_NOMEM;
dst->exp_expect.dst = addr;
}
// Master CT
if (src->exp_master.src) {
addr = nl_addr_clone(src->exp_master.src);
if (!addr)
return -NLE_NOMEM;
dst->exp_master.src = addr;
}
if (src->exp_master.dst) {
addr = nl_addr_clone(src->exp_master.dst);
if (!addr)
return -NLE_NOMEM;
dst->exp_master.dst = addr;
}
// Mask
if (src->exp_mask.src) {
addr = nl_addr_clone(src->exp_mask.src);
if (!addr)
return -NLE_NOMEM;
dst->exp_mask.src = addr;
}
if (src->exp_mask.dst) {
addr = nl_addr_clone(src->exp_mask.dst);
if (!addr)
return -NLE_NOMEM;
dst->exp_mask.dst = addr;
}
// NAT
if (src->exp_nat.src) {
addr = nl_addr_clone(src->exp_nat.src);
if (!addr)
return -NLE_NOMEM;
dst->exp_nat.src = addr;
}
if (src->exp_nat.dst) {
addr = nl_addr_clone(src->exp_nat.dst);
if (!addr)
return -NLE_NOMEM;
dst->exp_nat.dst = addr;
}
if (src->exp_fn)
dst->exp_fn = strdup(src->exp_fn);
if (src->exp_helper_name)
dst->exp_helper_name = strdup(src->exp_helper_name);
return 0;
}
static void dump_addr(struct nl_dump_params *p, struct nl_addr *addr, int port)
{
char buf[64];
if (addr)
nl_dump(p, "%s", nl_addr2str(addr, buf, sizeof(buf)));
if (port)
nl_dump(p, ":%u ", port);
else if (addr)
nl_dump(p, " ");
}
static void dump_icmp(struct nl_dump_params *p, struct nfnl_exp *exp, int tuple)
{
if (nfnl_exp_test_icmp(exp, tuple)) {
nl_dump(p, "icmp type %d ", nfnl_exp_get_icmp_type(exp, tuple));
nl_dump(p, "code %d ", nfnl_exp_get_icmp_code(exp, tuple));
nl_dump(p, "id %d ", nfnl_exp_get_icmp_id(exp, tuple));
}
}
static void exp_dump_tuples(struct nfnl_exp *exp, struct nl_dump_params *p)
{
struct nl_addr *tuple_src, *tuple_dst;
int tuple_sport, tuple_dport;
int i = 0;
char buf[64];
for (i = NFNL_EXP_TUPLE_EXPECT; i < NFNL_EXP_TUPLE_MAX; i++) {
tuple_src = NULL;
tuple_dst = NULL;
tuple_sport = 0;
tuple_dport = 0;
// Test needed for NAT case
if (nfnl_exp_test_src(exp, i))
tuple_src = nfnl_exp_get_src(exp, i);
if (nfnl_exp_test_dst(exp, i))
tuple_dst = nfnl_exp_get_dst(exp, i);
// Don't have tests for individual ports/types/codes/ids,
if (nfnl_exp_test_l4protonum(exp, i)) {
nl_dump(p, "%s ",
nl_ip_proto2str(nfnl_exp_get_l4protonum(exp, i), buf, sizeof(buf)));
}
if (nfnl_exp_test_ports(exp, i)) {
tuple_sport = nfnl_exp_get_src_port(exp, i);
tuple_dport = nfnl_exp_get_dst_port(exp, i);
}
dump_addr(p, tuple_src, tuple_sport);
dump_addr(p, tuple_dst, tuple_dport);
dump_icmp(p, exp, 0);
}
if (nfnl_exp_test_nat_dir(exp))
nl_dump(p, "nat dir %s ", exp->exp_nat_dir);
}
/* FIXME Compatible with /proc/net/nf_conntrack */
static void exp_dump_line(struct nl_object *a, struct nl_dump_params *p)
{
struct nfnl_exp *exp = (struct nfnl_exp *) a;
nl_new_line(p);
exp_dump_tuples(exp, p);
nl_dump(p, "\n");
}
static void exp_dump_details(struct nl_object *a, struct nl_dump_params *p)
{
struct nfnl_exp *exp = (struct nfnl_exp *) a;
char buf[64];
int fp = 0;
exp_dump_line(a, p);
nl_dump(p, " id 0x%x ", exp->exp_id);
nl_dump_line(p, "family %s ",
nl_af2str(exp->exp_family, buf, sizeof(buf)));
if (nfnl_exp_test_timeout(exp)) {
uint64_t timeout_ms = nfnl_exp_get_timeout(exp) * 1000UL;
nl_dump(p, "timeout %s ",
nl_msec2str(timeout_ms, buf, sizeof(buf)));
}
if (nfnl_exp_test_helper_name(exp))
nl_dump(p, "helper %s ", exp->exp_helper_name);
if (nfnl_exp_test_fn(exp))
nl_dump(p, "fn %s ", exp->exp_fn);
if (nfnl_exp_test_class(exp))
nl_dump(p, "class %u ", nfnl_exp_get_class(exp));
if (nfnl_exp_test_zone(exp))
nl_dump(p, "zone %u ", nfnl_exp_get_zone(exp));
if (nfnl_exp_test_flags(exp))
nl_dump(p, "<");
#define PRINT_FLAG(str) \
{ nl_dump(p, "%s%s", fp++ ? "," : "", (str)); }
if (exp->exp_flags & NF_CT_EXPECT_PERMANENT)
PRINT_FLAG("PERMANENT");
if (exp->exp_flags & NF_CT_EXPECT_INACTIVE)
PRINT_FLAG("INACTIVE");
if (exp->exp_flags & NF_CT_EXPECT_USERSPACE)
PRINT_FLAG("USERSPACE");
#undef PRINT_FLAG
if (nfnl_exp_test_flags(exp))
nl_dump(p, ">");
nl_dump(p, "\n");
}
static int exp_cmp_l4proto_ports (union nfnl_exp_protodata *a, union nfnl_exp_protodata *b) {
// Must return 0 for match, 1 for mismatch
int d = 0;
d = ( (a->port.src != b->port.src) ||
(a->port.dst != b->port.dst) );
return d;
}
static int exp_cmp_l4proto_icmp (union nfnl_exp_protodata *a, union nfnl_exp_protodata *b) {
// Must return 0 for match, 1 for mismatch
int d = 0;
d = ( (a->icmp.code != b->icmp.code) ||
(a->icmp.type != b->icmp.type) ||
(a->icmp.id != b->icmp.id) );
return d;
}
static int exp_compare(struct nl_object *_a, struct nl_object *_b,
uint32_t attrs, int flags)
{
struct nfnl_exp *a = (struct nfnl_exp *) _a;
struct nfnl_exp *b = (struct nfnl_exp *) _b;
int diff = 0;
#define EXP_DIFF(ATTR, EXPR) ATTR_DIFF(attrs, EXP_ATTR_##ATTR, a, b, EXPR)
#define EXP_DIFF_VAL(ATTR, FIELD) EXP_DIFF(ATTR, a->FIELD != b->FIELD)
#define EXP_DIFF_STRING(ATTR, FIELD) EXP_DIFF(ATTR, (strcmp(a->FIELD, b->FIELD) != 0))
#define EXP_DIFF_ADDR(ATTR, FIELD) \
((flags & LOOSE_COMPARISON) \
? EXP_DIFF(ATTR, nl_addr_cmp_prefix(a->FIELD, b->FIELD)) \
: EXP_DIFF(ATTR, nl_addr_cmp(a->FIELD, b->FIELD)))
#define EXP_DIFF_L4PROTO_PORTS(ATTR, FIELD) \
EXP_DIFF(ATTR, exp_cmp_l4proto_ports(&(a->FIELD), &(b->FIELD)))
#define EXP_DIFF_L4PROTO_ICMP(ATTR, FIELD) \
EXP_DIFF(ATTR, exp_cmp_l4proto_icmp(&(a->FIELD), &(b->FIELD)))
diff |= EXP_DIFF_VAL(FAMILY, exp_family);
diff |= EXP_DIFF_VAL(TIMEOUT, exp_timeout);
diff |= EXP_DIFF_VAL(ID, exp_id);
diff |= EXP_DIFF_VAL(ZONE, exp_zone);
diff |= EXP_DIFF_VAL(CLASS, exp_class);
diff |= EXP_DIFF_VAL(FLAGS, exp_flags);
diff |= EXP_DIFF_VAL(NAT_DIR, exp_nat_dir);
diff |= EXP_DIFF_STRING(FN, exp_fn);
diff |= EXP_DIFF_STRING(HELPER_NAME, exp_helper_name);
diff |= EXP_DIFF_ADDR(EXPECT_IP_SRC, exp_expect.src);
diff |= EXP_DIFF_ADDR(EXPECT_IP_DST, exp_expect.dst);
diff |= EXP_DIFF_VAL(EXPECT_L4PROTO_NUM, exp_expect.proto.l4protonum);
diff |= EXP_DIFF_L4PROTO_PORTS(EXPECT_L4PROTO_PORTS, exp_expect.proto.l4protodata);
diff |= EXP_DIFF_L4PROTO_ICMP(EXPECT_L4PROTO_ICMP, exp_expect.proto.l4protodata);
diff |= EXP_DIFF_ADDR(MASTER_IP_SRC, exp_master.src);
diff |= EXP_DIFF_ADDR(MASTER_IP_DST, exp_master.dst);
diff |= EXP_DIFF_VAL(MASTER_L4PROTO_NUM, exp_master.proto.l4protonum);
diff |= EXP_DIFF_L4PROTO_PORTS(MASTER_L4PROTO_PORTS, exp_master.proto.l4protodata);
diff |= EXP_DIFF_L4PROTO_ICMP(MASTER_L4PROTO_ICMP, exp_master.proto.l4protodata);
diff |= EXP_DIFF_ADDR(MASK_IP_SRC, exp_mask.src);
diff |= EXP_DIFF_ADDR(MASK_IP_DST, exp_mask.dst);
diff |= EXP_DIFF_VAL(MASK_L4PROTO_NUM, exp_mask.proto.l4protonum);
diff |= EXP_DIFF_L4PROTO_PORTS(MASK_L4PROTO_PORTS, exp_mask.proto.l4protodata);
diff |= EXP_DIFF_L4PROTO_ICMP(MASK_L4PROTO_ICMP, exp_mask.proto.l4protodata);
diff |= EXP_DIFF_ADDR(NAT_IP_SRC, exp_nat.src);
diff |= EXP_DIFF_ADDR(NAT_IP_DST, exp_nat.dst);
diff |= EXP_DIFF_VAL(NAT_L4PROTO_NUM, exp_nat.proto.l4protonum);
diff |= EXP_DIFF_L4PROTO_PORTS(NAT_L4PROTO_PORTS, exp_nat.proto.l4protodata);
diff |= EXP_DIFF_L4PROTO_ICMP(NAT_L4PROTO_ICMP, exp_nat.proto.l4protodata);
#undef EXP_DIFF
#undef EXP_DIFF_VAL
#undef EXP_DIFF_STRING
#undef EXP_DIFF_ADDR
#undef EXP_DIFF_L4PROTO_PORTS
#undef EXP_DIFF_L4PROTO_ICMP
return diff;
}
// CLI arguments?
static const struct trans_tbl exp_attrs[] = {
__ADD(EXP_ATTR_FAMILY, family)
__ADD(EXP_ATTR_TIMEOUT, timeout)
__ADD(EXP_ATTR_ID, id)
__ADD(EXP_ATTR_HELPER_NAME, helpername)
__ADD(EXP_ATTR_ZONE, zone)
__ADD(EXP_ATTR_CLASS, class)
__ADD(EXP_ATTR_FLAGS, flags)
__ADD(EXP_ATTR_FN, function)
__ADD(EXP_ATTR_EXPECT_IP_SRC, expectipsrc)
__ADD(EXP_ATTR_EXPECT_IP_DST, expectipdst)
__ADD(EXP_ATTR_EXPECT_L4PROTO_NUM, expectprotonum)
__ADD(EXP_ATTR_EXPECT_L4PROTO_PORTS, expectports)
__ADD(EXP_ATTR_EXPECT_L4PROTO_ICMP, expecticmp)
__ADD(EXP_ATTR_MASTER_IP_SRC, masteripsrc)
__ADD(EXP_ATTR_MASTER_IP_DST, masteripdst)
__ADD(EXP_ATTR_MASTER_L4PROTO_NUM, masterprotonum)
__ADD(EXP_ATTR_MASTER_L4PROTO_PORTS, masterports)
__ADD(EXP_ATTR_MASTER_L4PROTO_ICMP, mastericmp)
__ADD(EXP_ATTR_MASK_IP_SRC, maskipsrc)
__ADD(EXP_ATTR_MASK_IP_DST, maskipdst)
__ADD(EXP_ATTR_MASK_L4PROTO_NUM, maskprotonum)
__ADD(EXP_ATTR_MASK_L4PROTO_PORTS, maskports)
__ADD(EXP_ATTR_MASK_L4PROTO_ICMP, maskicmp)
__ADD(EXP_ATTR_NAT_IP_SRC, natipsrc)
__ADD(EXP_ATTR_NAT_IP_DST, natipdst)
__ADD(EXP_ATTR_NAT_L4PROTO_NUM, natprotonum)
__ADD(EXP_ATTR_NAT_L4PROTO_PORTS, natports)
__ADD(EXP_ATTR_NAT_L4PROTO_ICMP, naticmp)
__ADD(EXP_ATTR_NAT_DIR, natdir)
};
static char *exp_attrs2str(int attrs, char *buf, size_t len)
{
return __flags2str(attrs, buf, len, exp_attrs, ARRAY_SIZE(exp_attrs));
}
/**
* @name Allocation/Freeing
* @{
*/
struct nfnl_exp *nfnl_exp_alloc(void)
{
return (struct nfnl_exp *) nl_object_alloc(&exp_obj_ops);
}
void nfnl_exp_get(struct nfnl_exp *exp)
{
nl_object_get((struct nl_object *) exp);
}
void nfnl_exp_put(struct nfnl_exp *exp)
{
nl_object_put((struct nl_object *) exp);
}
/** @} */
/**
* @name Attributes
* @{
*/
void nfnl_exp_set_family(struct nfnl_exp *exp, uint8_t family)
{
exp->exp_family = family;
exp->ce_mask |= EXP_ATTR_FAMILY;
}
uint8_t nfnl_exp_get_family(const struct nfnl_exp *exp)
{
if (exp->ce_mask & EXP_ATTR_FAMILY)
return exp->exp_family;
else
return AF_UNSPEC;
}
void nfnl_exp_set_flags(struct nfnl_exp *exp, uint32_t flags)
{
exp->exp_flags |= flags;
exp->ce_mask |= EXP_ATTR_FLAGS;
}
int nfnl_exp_test_flags(const struct nfnl_exp *exp)
{
return !!(exp->ce_mask & EXP_ATTR_FLAGS);
}
void nfnl_exp_unset_flags(struct nfnl_exp *exp, uint32_t flags)
{
exp->exp_flags &= ~flags;
exp->ce_mask |= EXP_ATTR_FLAGS;
}
uint32_t nfnl_exp_get_flags(const struct nfnl_exp *exp)
{
return exp->exp_flags;
}
static const struct trans_tbl flag_table[] = {
__ADD(IPS_EXPECTED, expected)
__ADD(IPS_SEEN_REPLY, seen_reply)
__ADD(IPS_ASSURED, assured)
};
char * nfnl_exp_flags2str(int flags, char *buf, size_t len)
{
return __flags2str(flags, buf, len, flag_table,
ARRAY_SIZE(flag_table));
}
int nfnl_exp_str2flags(const char *name)
{
return __str2flags(name, flag_table, ARRAY_SIZE(flag_table));
}
void nfnl_exp_set_timeout(struct nfnl_exp *exp, uint32_t timeout)
{
exp->exp_timeout = timeout;
exp->ce_mask |= EXP_ATTR_TIMEOUT;
}
int nfnl_exp_test_timeout(const struct nfnl_exp *exp)
{
return !!(exp->ce_mask & EXP_ATTR_TIMEOUT);
}
uint32_t nfnl_exp_get_timeout(const struct nfnl_exp *exp)
{
return exp->exp_timeout;
}
void nfnl_exp_set_id(struct nfnl_exp *exp, uint32_t id)
{
exp->exp_id = id;
exp->ce_mask |= EXP_ATTR_ID;
}
int nfnl_exp_test_id(const struct nfnl_exp *exp)
{
return !!(exp->ce_mask & EXP_ATTR_ID);
}
uint32_t nfnl_exp_get_id(const struct nfnl_exp *exp)
{
return exp->exp_id;
}
int nfnl_exp_set_helper_name(struct nfnl_exp *exp, void *name)
{
free(exp->exp_helper_name);
exp->exp_helper_name = strdup(name);
if (!exp->exp_helper_name)
return -NLE_NOMEM;
exp->ce_mask |= EXP_ATTR_HELPER_NAME;
return 0;
}
int nfnl_exp_test_helper_name(const struct nfnl_exp *exp)
{
return !!(exp->ce_mask & EXP_ATTR_HELPER_NAME);
}
const char * nfnl_exp_get_helper_name(const struct nfnl_exp *exp)
{
return exp->exp_helper_name;
}
void nfnl_exp_set_zone(struct nfnl_exp *exp, uint16_t zone)
{
exp->exp_zone = zone;
exp->ce_mask |= EXP_ATTR_ZONE;
}
int nfnl_exp_test_zone(const struct nfnl_exp *exp)
{
return !!(exp->ce_mask & EXP_ATTR_ZONE);
}
uint16_t nfnl_exp_get_zone(const struct nfnl_exp *exp)
{
return exp->exp_zone;
}
void nfnl_exp_set_class(struct nfnl_exp *exp, uint32_t class)
{
exp->exp_class = class;
exp->ce_mask |= EXP_ATTR_CLASS;
}
int nfnl_exp_test_class(const struct nfnl_exp *exp)
{
return !!(exp->ce_mask & EXP_ATTR_CLASS);
}
uint32_t nfnl_exp_get_class(const struct nfnl_exp *exp)
{
return exp->exp_class;
}
int nfnl_exp_set_fn(struct nfnl_exp *exp, void *fn)
{
free(exp->exp_fn);
exp->exp_fn = strdup(fn);
if (!exp->exp_fn)
return -NLE_NOMEM;
exp->ce_mask |= EXP_ATTR_FN;
return 0;
}
int nfnl_exp_test_fn(const struct nfnl_exp *exp)
{
return !!(exp->ce_mask & EXP_ATTR_FN);
}
const char * nfnl_exp_get_fn(const struct nfnl_exp *exp)
{
return exp->exp_fn;
}
void nfnl_exp_set_nat_dir(struct nfnl_exp *exp, uint8_t nat_dir)
{
exp->exp_nat_dir = nat_dir;
exp->ce_mask |= EXP_ATTR_NAT_DIR;
}
int nfnl_exp_test_nat_dir(const struct nfnl_exp *exp)
{
return !!(exp->ce_mask & EXP_ATTR_NAT_DIR);
}
uint8_t nfnl_exp_get_nat_dir(const struct nfnl_exp *exp)
{
return exp->exp_nat_dir;
}
#define EXP_GET_TUPLE(e, t) \
(t == NFNL_EXP_TUPLE_MASTER) ? \
&(e->exp_master) : \
(t == NFNL_EXP_TUPLE_MASK) ? \
&(e->exp_mask) : \
(t == NFNL_EXP_TUPLE_NAT) ? \
&(e->exp_nat) : &(exp->exp_expect)
static int exp_get_src_attr(int tuple)
{
int attr = 0;
switch (tuple) {
case NFNL_EXP_TUPLE_MASTER:
attr = EXP_ATTR_MASTER_IP_SRC;
break;
case NFNL_EXP_TUPLE_MASK:
attr = EXP_ATTR_MASK_IP_SRC;
break;
case NFNL_EXP_TUPLE_NAT:
attr = EXP_ATTR_NAT_IP_SRC;
break;
case NFNL_EXP_TUPLE_EXPECT:
default :
attr = EXP_ATTR_EXPECT_IP_SRC;
}
return attr;
}
static int exp_get_dst_attr(int tuple)
{
int attr = 0;
switch (tuple) {
case NFNL_EXP_TUPLE_MASTER:
attr = EXP_ATTR_MASTER_IP_DST;
break;
case NFNL_EXP_TUPLE_MASK:
attr = EXP_ATTR_MASK_IP_DST;
break;
case NFNL_EXP_TUPLE_NAT:
attr = EXP_ATTR_NAT_IP_DST;
break;
case NFNL_EXP_TUPLE_EXPECT:
default :
attr = EXP_ATTR_EXPECT_IP_DST;
}
return attr;
}
static int exp_set_addr(struct nfnl_exp *exp, struct nl_addr *addr,
int attr, struct nl_addr ** exp_addr)
{
if (exp->ce_mask & EXP_ATTR_FAMILY) {
if (addr->a_family != exp->exp_family)
return -NLE_AF_MISMATCH;
} else
nfnl_exp_set_family(exp, addr->a_family);
if (*exp_addr)
nl_addr_put(*exp_addr);
nl_addr_get(addr);
*exp_addr = addr;
exp->ce_mask |= attr;
return 0;
}
int nfnl_exp_set_src(struct nfnl_exp *exp, int tuple, struct nl_addr *addr)
{
struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);
return exp_set_addr(exp, addr, exp_get_src_attr(tuple), &dir->src);
}
int nfnl_exp_set_dst(struct nfnl_exp *exp, int tuple, struct nl_addr *addr)
{
struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);
return exp_set_addr(exp, addr, exp_get_dst_attr(tuple), &dir->dst);
}
int nfnl_exp_test_src(const struct nfnl_exp *exp, int tuple)
{
return !!(exp->ce_mask & exp_get_src_attr(tuple));
}
int nfnl_exp_test_dst(const struct nfnl_exp *exp, int tuple)
{
return !!(exp->ce_mask & exp_get_dst_attr(tuple));
}
struct nl_addr *nfnl_exp_get_src(const struct nfnl_exp *exp, int tuple)
{
const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);
if (!(exp->ce_mask & exp_get_src_attr(tuple)))
return NULL;
return dir->src;
}
struct nl_addr *nfnl_exp_get_dst(const struct nfnl_exp *exp, int tuple)
{
const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);
if (!(exp->ce_mask & exp_get_dst_attr(tuple)))
return NULL;
return dir->dst;
}
static int exp_get_l4protonum_attr(int tuple)
{
int attr = 0;
switch (tuple) {
case NFNL_EXP_TUPLE_MASTER:
attr = EXP_ATTR_MASTER_L4PROTO_NUM;
break;
case NFNL_EXP_TUPLE_MASK:
attr = EXP_ATTR_MASK_L4PROTO_NUM;
break;
case NFNL_EXP_TUPLE_NAT:
attr = EXP_ATTR_NAT_L4PROTO_NUM;
break;
case NFNL_EXP_TUPLE_EXPECT:
default :
attr = EXP_ATTR_EXPECT_L4PROTO_NUM;
}
return attr;
}
void nfnl_exp_set_l4protonum(struct nfnl_exp *exp, int tuple, uint8_t l4protonum)
{
struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);
dir->proto.l4protonum = l4protonum;
exp->ce_mask |= exp_get_l4protonum_attr(tuple);
}
int nfnl_exp_test_l4protonum(const struct nfnl_exp *exp, int tuple)
{
return !!(exp->ce_mask & exp_get_l4protonum_attr(tuple));
}
uint8_t nfnl_exp_get_l4protonum(const struct nfnl_exp *exp, int tuple)
{
const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);
return dir->proto.l4protonum;
}
static int exp_get_l4ports_attr(int tuple)
{
int attr = 0;
switch (tuple) {
case NFNL_EXP_TUPLE_MASTER:
attr = EXP_ATTR_MASTER_L4PROTO_PORTS;
break;
case NFNL_EXP_TUPLE_MASK:
attr = EXP_ATTR_MASK_L4PROTO_PORTS;
break;
case NFNL_EXP_TUPLE_NAT:
attr = EXP_ATTR_NAT_L4PROTO_PORTS;
break;
case NFNL_EXP_TUPLE_EXPECT:
default :
attr = EXP_ATTR_EXPECT_L4PROTO_PORTS;
}
return attr;
}
void nfnl_exp_set_ports(struct nfnl_exp *exp, int tuple, uint16_t srcport, uint16_t dstport)
{
struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);
dir->proto.l4protodata.port.src = srcport;
dir->proto.l4protodata.port.dst = dstport;
exp->ce_mask |= exp_get_l4ports_attr(tuple);
}
int nfnl_exp_test_ports(const struct nfnl_exp *exp, int tuple)
{
return !!(exp->ce_mask & exp_get_l4ports_attr(tuple));
}
uint16_t nfnl_exp_get_src_port(const struct nfnl_exp *exp, int tuple)
{
const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);
return dir->proto.l4protodata.port.src;
}
uint16_t nfnl_exp_get_dst_port(const struct nfnl_exp *exp, int tuple)
{
const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);
return dir->proto.l4protodata.port.dst;
}
static int exp_get_l4icmp_attr(int tuple)
{
int attr = 0;
switch (tuple) {
case NFNL_EXP_TUPLE_MASTER:
attr = EXP_ATTR_MASTER_L4PROTO_ICMP;
break;
case NFNL_EXP_TUPLE_MASK:
attr = EXP_ATTR_MASK_L4PROTO_ICMP;
break;
case NFNL_EXP_TUPLE_NAT:
attr = EXP_ATTR_NAT_L4PROTO_ICMP;
break;
case NFNL_EXP_TUPLE_EXPECT:
default :
attr = EXP_ATTR_EXPECT_L4PROTO_ICMP;
}
return attr;
}
void nfnl_exp_set_icmp(struct nfnl_exp *exp, int tuple, uint16_t id, uint8_t type, uint8_t code)
{
struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);
dir->proto.l4protodata.icmp.id = id;
dir->proto.l4protodata.icmp.type = type;
dir->proto.l4protodata.icmp.code = code;
exp->ce_mask |= exp_get_l4icmp_attr(tuple);
}
int nfnl_exp_test_icmp(const struct nfnl_exp *exp, int tuple)
{
int attr = exp_get_l4icmp_attr(tuple);
return !!(exp->ce_mask & attr);
}
uint16_t nfnl_exp_get_icmp_id(const struct nfnl_exp *exp, int tuple)
{
const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);
return dir->proto.l4protodata.icmp.id;
}
uint8_t nfnl_exp_get_icmp_type(const struct nfnl_exp *exp, int tuple)
{
const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);
return dir->proto.l4protodata.icmp.type;
}
uint8_t nfnl_exp_get_icmp_code(const struct nfnl_exp *exp, int tuple)
{
const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);
return dir->proto.l4protodata.icmp.code;
}
/** @} */
struct nl_object_ops exp_obj_ops = {
.oo_name = "netfilter/exp",
.oo_size = sizeof(struct nfnl_exp),
.oo_free_data = exp_free_data,
.oo_clone = exp_clone,
.oo_dump = {
[NL_DUMP_LINE] = exp_dump_line,
[NL_DUMP_DETAILS] = exp_dump_details,
},
.oo_compare = exp_compare,
.oo_attrs2str = exp_attrs2str,
};
/** @} */

3
src/.gitignore vendored
View File

@ -1,5 +1,8 @@
genl-ctrl-list
nf-ct-list
nf-exp-list
nf-exp-add
nf-exp-delete
nf-log
nf-monitor
nl-addr-add

5
src/Makefile.am
View File

@ -22,6 +22,7 @@ sbin_PROGRAMS = \
noinst_PROGRAMS = \
nf-ct-list nf-log nf-queue nf-monitor \
nf-exp-list nf-exp-add nf-exp-delete \
nl-addr-add nl-addr-delete nl-addr-list \
nl-link-set nl-link-stats \
nl-link-ifindex2name nl-link-name2ifindex \
@ -44,6 +45,10 @@ nf_log_SOURCES = nf-log.c
nf_queue_SOURCES = nf-queue.c
nf_monitor_SOURCES = nf-monitor.c
nf_exp_list_SOURCES = nf-exp-list.c
nf_exp_add_SOURCES = nf-exp-add.c
nf_exp_delete_SOURCES = nf-exp-delete.c
nl_addr_add_SOURCES = nl-addr-add.c
nl_addr_delete_SOURCES = nl-addr-delete.c
nl_addr_list_SOURCES = nl-addr-list.c

2
src/lib/Makefile.am
View File

@ -38,6 +38,6 @@ libnl_cli_3_la_LIBADD = ${top_builddir}/lib/libnl-3.la \
libnl_cli_3_la_SOURCES = \
utils.c addr.c ct.c link.c neigh.c rule.c route.c \
tc.c qdisc.c class.c cls.c
tc.c qdisc.c class.c cls.c exp.c
# cls/ematch_syntax.c cls/ematch_grammar.c cls/ematch.c
# cls/pktloc_syntax.c cls/pktloc_grammar.c cls/utils.c

165
src/lib/exp.c Normal file
View File

@ -0,0 +1,165 @@
/*
* src/lib/exp.c CLI Expectation Helpers
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation version 2.1
* of the License.
*
* Copyright (c) 2008-2009 Thomas Graf <tgraf@suug.ch>
* Copyright (c) 2012 Rich Fought <rich.fought@watchguard.com>
*/
/**
* @ingroup cli
* @defgroup cli_exp Expectation Tracking
*
* @{
*/
#include <netlink/cli/utils.h>
#include <netlink/cli/exp.h>
struct nfnl_exp *nl_cli_exp_alloc(void)
{
struct nfnl_exp *exp;
exp = nfnl_exp_alloc();
if (!exp)
nl_cli_fatal(ENOMEM, "Unable to allocate expectation object");
return exp;
}
struct nl_cache *nl_cli_exp_alloc_cache(struct nl_sock *sk)
{
return nl_cli_alloc_cache(sk, "expectation", nfnl_exp_alloc_cache);
}
void nl_cli_exp_parse_family(struct nfnl_exp *exp, char *arg)
{
int family;
if ((family = nl_str2af(arg)) == AF_UNSPEC)
nl_cli_fatal(EINVAL,
"Unable to nl_cli_exp_parse family \"%s\": %s",
arg, nl_geterror(NLE_INVAL));
nfnl_exp_set_family(exp, family);
}
void nl_cli_exp_parse_timeout(struct nfnl_exp *exp, char *arg)
{
uint32_t timeout = nl_cli_parse_u32(arg);
nfnl_exp_set_timeout(exp, timeout);
}
void nl_cli_exp_parse_id(struct nfnl_exp *exp, char *arg)
{
uint32_t id = nl_cli_parse_u32(arg);
nfnl_exp_set_id(exp, id);
}
void nl_cli_exp_parse_helper_name(struct nfnl_exp *exp, char *arg)
{
nfnl_exp_set_helper_name(exp, arg);
}
void nl_cli_exp_parse_zone(struct nfnl_exp *exp, char *arg)
{
uint32_t zone = nl_cli_parse_u32(arg);
nfnl_exp_set_zone(exp, zone);
}
void nl_cli_exp_parse_flags(struct nfnl_exp *exp, char *arg)
{
uint32_t flags = nl_cli_parse_u32(arg);
nfnl_exp_set_flags(exp, flags);
}
void nl_cli_exp_parse_class(struct nfnl_exp *exp, char *arg)
{
uint32_t class = nl_cli_parse_u32(arg);
nfnl_exp_set_class(exp, class);
}
void nl_cli_exp_parse_nat_dir(struct nfnl_exp *exp, char *arg)
{
uint32_t nat_dir = nl_cli_parse_u32(arg);
nfnl_exp_set_nat_dir(exp, nat_dir);
}
void nl_cli_exp_parse_fn(struct nfnl_exp *exp, char *arg)
{
nfnl_exp_set_fn(exp, arg);
}
void nl_cli_exp_parse_src(struct nfnl_exp *exp, int tuple, char *arg)
{
int err;
struct nl_addr *a = nl_cli_addr_parse(arg, nfnl_exp_get_family(exp));
if ((err = nfnl_exp_set_src(exp, tuple, a)) < 0)
nl_cli_fatal(err, "Unable to set source address: %s",
nl_geterror(err));
}
void nl_cli_exp_parse_dst(struct nfnl_exp *exp, int tuple, char *arg)
{
int err;
struct nl_addr *a = nl_cli_addr_parse(arg, nfnl_exp_get_family(exp));
if ((err = nfnl_exp_set_dst(exp, tuple, a)) < 0)
nl_cli_fatal(err, "Unable to set destination address: %s",
nl_geterror(err));
}
void nl_cli_exp_parse_l4protonum(struct nfnl_exp *exp, int tuple, char *arg)
{
int l4protonum;
if ((l4protonum = nl_str2ip_proto(arg)) < 0)
nl_cli_fatal(l4protonum,
"Unable to nl_cli_exp_parse protocol \"%s\": %s",
arg, nl_geterror(l4protonum));
nfnl_exp_set_l4protonum(exp, tuple, l4protonum);
}
void nl_cli_exp_parse_src_port(struct nfnl_exp *exp, int tuple, char *arg)
{
uint32_t sport = nl_cli_parse_u32(arg);
uint16_t dport = nfnl_exp_get_dst_port(exp, tuple);
nfnl_exp_set_ports(exp, tuple, sport, dport);
}
void nl_cli_exp_parse_dst_port(struct nfnl_exp *exp, int tuple, char *arg)
{
uint32_t dport = nl_cli_parse_u32(arg);
uint16_t sport = nfnl_exp_get_src_port(exp, tuple);
nfnl_exp_set_ports(exp, tuple, sport, dport);
}
void nl_cli_exp_parse_icmp_id(struct nfnl_exp *exp, int tuple, char *arg)
{
uint32_t id = nl_cli_parse_u32(arg);
uint8_t type = nfnl_exp_get_icmp_type(exp, tuple);
uint8_t code = nfnl_exp_get_icmp_code(exp, tuple);
nfnl_exp_set_icmp(exp, tuple, id, type, code);
}
void nl_cli_exp_parse_icmp_type(struct nfnl_exp *exp, int tuple, char *arg)
{
uint32_t type = nl_cli_parse_u32(arg);
uint16_t id = nfnl_exp_get_icmp_id(exp, tuple);
uint8_t code = nfnl_exp_get_icmp_code(exp, tuple);
nfnl_exp_set_icmp(exp, tuple, id, type, code);
}
void nl_cli_exp_parse_icmp_code(struct nfnl_exp *exp, int tuple, char *arg)
{
uint32_t code = nl_cli_parse_u32(arg);
uint16_t id = nfnl_exp_get_icmp_id(exp, tuple);
uint8_t type = nfnl_exp_get_icmp_type(exp, tuple);
nfnl_exp_set_icmp(exp, tuple, id, type, code);
}
/** @} */

169
src/nf-exp-add.c Normal file
View File

@ -0,0 +1,169 @@
/*
* src/nf-exp-add.c Create an expectation
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation version 2.1
* of the License.
*
* Copyright (c) 2003-2009 Thomas Graf <tgraf@suug.ch>
* Copyright (c) 2007 Philip Craig <philipc@snapgear.com>
* Copyright (c) 2007 Secure Computing Corporation
* Copyright (c) 2012 Rich Fought <rich.fought@watchguard.com>
*
*/
#include <netlink/cli/utils.h>
#include <netlink/cli/exp.h>
static int quiet = 0;
static void print_usage(void)
{
printf(
"Usage: nf-exp-list [OPTION]... [CONNTRACK ENTRY]\n"
"\n"
"Options\n"
" --replace Replace the address if it exists.\n"
" -q, --quiet Do not print informal notifications.\n"
" -h, --help Show this help\n"
" -v, --version Show versioning information\n"
"\n"
"Expectation Selection\n"
" -i, --id=NUM Identifier\n"
" --expect-proto=PROTOCOL Expectation protocol\n"
" --expect-src=ADDR Expectation source address\n"
" --expect-sport=PORT Expectation source port\n"
" --expect-dst=ADDR Expectation destination address\n"
" --expect-dport=PORT Expectation destination port\n"
" --master-proto=PROTOCOL Master conntrack protocol\n"
" --master-src=ADDR Master conntrack source address\n"
" --master-sport=PORT Master conntrack source port\n"
" --master-dst=ADDR Master conntrack destination address\n"
" --master-dport=PORT Master conntrack destination port\n"
" --mask-proto=PROTOCOL Mask protocol\n"
" --mask-src=ADDR Mask source address\n"
" --mask-sport=PORT Mask source port\n"
" --mask-dst=ADDR Mask destination address\n"
" --mask-dport=PORT Mask destination port\n"
" -F, --family=FAMILY Address family\n"
" --timeout=NUM Timeout value\n"
" --helper=STRING Helper Name\n"
" --flags Flags (Kernel 2.6.37)\n"
);
exit(0);
}
int main(int argc, char *argv[])
{
struct nl_sock *sock;
struct nfnl_exp *exp;
struct nl_dump_params params = {
.dp_type = NL_DUMP_LINE,
.dp_fd = stdout,
};
int err, nlflags = NLM_F_CREATE;
exp = nl_cli_exp_alloc();
for (;;) {
int c, optidx = 0;
enum {
ARG_MARK = 270,
ARG_TCP_STATE = 271,
ARG_EXPECT_PROTO,
ARG_EXPECT_SRC,
ARG_EXPECT_SPORT,
ARG_EXPECT_DST,
ARG_EXPECT_DPORT,
ARG_MASTER_PROTO,
ARG_MASTER_SRC,
ARG_MASTER_SPORT,
ARG_MASTER_DST,
ARG_MASTER_DPORT,
ARG_MASK_PROTO,
ARG_MASK_SRC,
ARG_MASK_SPORT,
ARG_MASK_DST,
ARG_MASK_DPORT,
ARG_TIMEOUT,
ARG_HELPER_NAME,
ARG_REPLACE,
ARG_FLAGS,
};
static struct option long_opts[] = {
{ "replace", 1, 0, ARG_REPLACE },
{ "quiet", 0, 0, 'q' },
{ "help", 0, 0, 'h' },
{ "version", 0, 0, 'v' },
{ "id", 1, 0, 'i' },
{ "expect-proto", 1, 0, ARG_EXPECT_PROTO },
{ "expect-src", 1, 0, ARG_EXPECT_SRC },
{ "expect-sport", 1, 0, ARG_EXPECT_SPORT },
{ "expect-dst", 1, 0, ARG_EXPECT_DST },
{ "expect-dport", 1, 0, ARG_EXPECT_DPORT },
{ "master-proto", 1, 0, ARG_MASTER_PROTO },
{ "master-src", 1, 0, ARG_MASTER_SRC },
{ "master-sport", 1, 0, ARG_MASTER_SPORT },
{ "master-dst", 1, 0, ARG_MASTER_DST },
{ "master-dport", 1, 0, ARG_MASTER_DPORT },
{ "mask-proto", 1, 0, ARG_MASK_PROTO },
{ "mask-src", 1, 0, ARG_MASK_SRC },
{ "mask-sport", 1, 0, ARG_MASK_SPORT },
{ "mask-dst", 1, 0, ARG_MASK_DST },
{ "mask-dport", 1, 0, ARG_MASK_DPORT },
{ "family", 1, 0, 'F' },
{ "timeout", 1, 0, ARG_TIMEOUT },
{ "helper", 1, 0, ARG_HELPER_NAME },
{ "flags", 1, 0, ARG_FLAGS},
{ 0, 0, 0, 0 }
};
c = getopt_long(argc, argv, "46f:hvi:p:F:", long_opts, &optidx);
if (c == -1)
break;
switch (c) {
case '?': exit(NLE_INVAL);
case ARG_REPLACE: nlflags |= NLM_F_REPLACE; break;
case 'q': quiet = 1; break;
case '4': nfnl_exp_set_family(exp, AF_INET); break;
case '6': nfnl_exp_set_family(exp, AF_INET6); break;
case 'h': print_usage(); break;
case 'v': nl_cli_print_version(); break;
case 'i': nl_cli_exp_parse_id(exp, optarg); break;
case ARG_EXPECT_PROTO: nl_cli_exp_parse_l4protonum(exp, NFNL_EXP_TUPLE_EXPECT, optarg); break;
case ARG_EXPECT_SRC: nl_cli_exp_parse_src(exp, NFNL_EXP_TUPLE_EXPECT, optarg); break;
case ARG_EXPECT_SPORT: nl_cli_exp_parse_src_port(exp, NFNL_EXP_TUPLE_EXPECT, optarg); break;
case ARG_EXPECT_DST: nl_cli_exp_parse_dst(exp, NFNL_EXP_TUPLE_EXPECT, optarg); break;
case ARG_EXPECT_DPORT: nl_cli_exp_parse_dst_port(exp, NFNL_EXP_TUPLE_EXPECT, optarg); break;
case ARG_MASTER_PROTO: nl_cli_exp_parse_l4protonum(exp, NFNL_EXP_TUPLE_MASTER, optarg); break;
case ARG_MASTER_SRC: nl_cli_exp_parse_src(exp, NFNL_EXP_TUPLE_MASTER, optarg); break;
case ARG_MASTER_SPORT: nl_cli_exp_parse_src_port(exp, NFNL_EXP_TUPLE_MASTER, optarg); break;
case ARG_MASTER_DST: nl_cli_exp_parse_dst(exp, NFNL_EXP_TUPLE_MASTER, optarg); break;
case ARG_MASTER_DPORT: nl_cli_exp_parse_dst_port(exp, NFNL_EXP_TUPLE_MASTER, optarg); break;
case ARG_MASK_PROTO: nl_cli_exp_parse_l4protonum(exp, NFNL_EXP_TUPLE_MASK, optarg); break;
case ARG_MASK_SRC: nl_cli_exp_parse_src(exp, NFNL_EXP_TUPLE_MASK, optarg); break;
case ARG_MASK_SPORT: nl_cli_exp_parse_src_port(exp, NFNL_EXP_TUPLE_MASK, optarg); break;
case ARG_MASK_DST: nl_cli_exp_parse_dst(exp, NFNL_EXP_TUPLE_MASK, optarg); break;
case ARG_MASK_DPORT: nl_cli_exp_parse_dst_port(exp, NFNL_EXP_TUPLE_MASK, optarg); break;
case 'F': nl_cli_exp_parse_family(exp, optarg); break;
case ARG_TIMEOUT: nl_cli_exp_parse_timeout(exp, optarg); break;
case ARG_HELPER_NAME: nl_cli_exp_parse_helper_name(exp, optarg); break;
case ARG_FLAGS: nl_cli_exp_parse_flags(exp, optarg); break;
}
}
sock = nl_cli_alloc_socket();
nl_cli_connect(sock, NETLINK_NETFILTER);
if ((err = nfnl_exp_add(sock, exp, nlflags)) < 0)
nl_cli_fatal(err, "Unable to add expectation: %s", nl_geterror(err));
if (!quiet) {
printf("Added ");
nl_object_dump(OBJ_CAST(exp), &params);
}
return 0;
}

165
src/nf-exp-delete.c Normal file
View File

@ -0,0 +1,165 @@
/*
* src/nf-exp-delete.c Delete an expectation
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation version 2.1
* of the License.
*
* Copyright (c) 2003-2009 Thomas Graf <tgraf@suug.ch>
* Copyright (c) 2007 Philip Craig <philipc@snapgear.com>
* Copyright (c) 2007 Secure Computing Corporation
* Copyright (c) 2012 Rich Fought <rich.fought@watchguard.com>
*/
#include <netlink/cli/utils.h>
#include <netlink/cli/exp.h>
static int quiet = 0;
static void print_usage(void)
{
printf(
"Usage: nf-exp-list [OPTION]... [CONNTRACK ENTRY]\n"
"\n"
"Options\n"
" --replace Replace the address if it exists.\n"
" -q, --quiet Do not print informal notifications.\n"
" -h, --help Show this help\n"
" -v, --version Show versioning information\n"
"\n"
"Expectation Selection\n"
" -i, --id=NUM Identifier\n"
" --expect-proto=PROTOCOL Expectation protocol\n"
" --expect-src=ADDR Expectation source address\n"
" --expect-sport=PORT Expectation source port\n"
" --expect-dst=ADDR Expectation destination address\n"
" --expect-dport=PORT Expectation destination port\n"
" --master-proto=PROTOCOL Master conntrack protocol\n"
" --master-src=ADDR Master conntrack source address\n"
" --master-sport=PORT Master conntrack source port\n"
" --master-dst=ADDR Master conntrack destination address\n"
" --master-dport=PORT Master conntrack destination port\n"
" --mask-proto=PROTOCOL Mask protocol\n"
" --mask-src=ADDR Mask source address\n"
" --mask-sport=PORT Mask source port\n"
" --mask-dst=ADDR Mask destination address\n"
" --mask-dport=PORT Mask destination port\n"
" -F, --family=FAMILY Address family\n"
" --timeout=NUM Timeout value\n"
" --helper=STRING Helper Name\n"
" --flags Flags\n"
);
exit(0);
}
int main(int argc, char *argv[])
{
struct nl_sock *sock;
struct nfnl_exp *exp;
struct nl_dump_params params = {
.dp_type = NL_DUMP_LINE,
.dp_fd = stdout,
};
int err, nlflags = 0;
exp = nl_cli_exp_alloc();
for (;;) {
int c, optidx = 0;
enum {
ARG_MARK = 270,
ARG_TCP_STATE = 271,
ARG_EXPECT_PROTO,
ARG_EXPECT_SRC,
ARG_EXPECT_SPORT,
ARG_EXPECT_DST,
ARG_EXPECT_DPORT,
ARG_MASTER_PROTO,
ARG_MASTER_SRC,
ARG_MASTER_SPORT,
ARG_MASTER_DST,
ARG_MASTER_DPORT,
ARG_MASK_PROTO,
ARG_MASK_SRC,
ARG_MASK_SPORT,
ARG_MASK_DST,
ARG_MASK_DPORT,
ARG_TIMEOUT,
ARG_HELPER_NAME,
ARG_FLAGS,
};
static struct option long_opts[] = {
{ "quiet", 0, 0, 'q' },
{ "help", 0, 0, 'h' },
{ "version", 0, 0, 'v' },
{ "id", 1, 0, 'i' },
{ "expect-proto", 1, 0, ARG_EXPECT_PROTO },
{ "expect-src", 1, 0, ARG_EXPECT_SRC },
{ "expect-sport", 1, 0, ARG_EXPECT_SPORT },
{ "expect-dst", 1, 0, ARG_EXPECT_DST },
{ "expect-dport", 1, 0, ARG_EXPECT_DPORT },
{ "master-proto", 1, 0, ARG_MASTER_PROTO },
{ "master-src", 1, 0, ARG_MASTER_SRC },
{ "master-sport", 1, 0, ARG_MASTER_SPORT },
{ "master-dst", 1, 0, ARG_MASTER_DST },
{ "master-dport", 1, 0, ARG_MASTER_DPORT },
{ "mask-proto", 1, 0, ARG_MASK_PROTO },
{ "mask-src", 1, 0, ARG_MASK_SRC },
{ "mask-sport", 1, 0, ARG_MASK_SPORT },
{ "mask-dst", 1, 0, ARG_MASK_DST },
{ "mask-dport", 1, 0, ARG_MASK_DPORT },
{ "family", 1, 0, 'F' },
{ "timeout", 1, 0, ARG_TIMEOUT },
{ "helper", 1, 0, ARG_HELPER_NAME },
{ "flags", 1, 0, ARG_FLAGS},
{ 0, 0, 0, 0 }
};
c = getopt_long(argc, argv, "46f:hvi:p:F:", long_opts, &optidx);
if (c == -1)
break;
switch (c) {
case '?': exit(NLE_INVAL);
case 'q': quiet = 1; break;
case '4': nfnl_exp_set_family(exp, AF_INET); break;
case '6': nfnl_exp_set_family(exp, AF_INET6); break;
case 'h': print_usage(); break;
case 'v': nl_cli_print_version(); break;
case 'i': nl_cli_exp_parse_id(exp, optarg); break;
case ARG_EXPECT_PROTO: nl_cli_exp_parse_l4protonum(exp, NFNL_EXP_TUPLE_EXPECT, optarg); break;
case ARG_EXPECT_SRC: nl_cli_exp_parse_src(exp, NFNL_EXP_TUPLE_EXPECT, optarg); break;
case ARG_EXPECT_SPORT: nl_cli_exp_parse_src_port(exp, NFNL_EXP_TUPLE_EXPECT, optarg); break;
case ARG_EXPECT_DST: nl_cli_exp_parse_dst(exp, NFNL_EXP_TUPLE_EXPECT, optarg); break;
case ARG_EXPECT_DPORT: nl_cli_exp_parse_dst_port(exp, NFNL_EXP_TUPLE_EXPECT, optarg); break;
case ARG_MASTER_PROTO: nl_cli_exp_parse_l4protonum(exp, NFNL_EXP_TUPLE_MASTER, optarg); break;
case ARG_MASTER_SRC: nl_cli_exp_parse_src(exp, NFNL_EXP_TUPLE_MASTER, optarg); break;
case ARG_MASTER_SPORT: nl_cli_exp_parse_src_port(exp, NFNL_EXP_TUPLE_MASTER, optarg); break;
case ARG_MASTER_DST: nl_cli_exp_parse_dst(exp, NFNL_EXP_TUPLE_MASTER, optarg); break;
case ARG_MASTER_DPORT: nl_cli_exp_parse_dst_port(exp, NFNL_EXP_TUPLE_MASTER, optarg); break;
case ARG_MASK_PROTO: nl_cli_exp_parse_l4protonum(exp, NFNL_EXP_TUPLE_MASK, optarg); break;
case ARG_MASK_SRC: nl_cli_exp_parse_src(exp, NFNL_EXP_TUPLE_MASK, optarg); break;
case ARG_MASK_SPORT: nl_cli_exp_parse_src_port(exp, NFNL_EXP_TUPLE_MASK, optarg); break;
case ARG_MASK_DST: nl_cli_exp_parse_dst(exp, NFNL_EXP_TUPLE_MASK, optarg); break;
case ARG_MASK_DPORT: nl_cli_exp_parse_dst_port(exp, NFNL_EXP_TUPLE_MASK, optarg); break;
case 'F': nl_cli_exp_parse_family(exp, optarg); break;
case ARG_TIMEOUT: nl_cli_exp_parse_timeout(exp, optarg); break;
case ARG_HELPER_NAME: nl_cli_exp_parse_helper_name(exp, optarg); break;
case ARG_FLAGS: nl_cli_exp_parse_flags(exp, optarg); break;
}
}
sock = nl_cli_alloc_socket();
nl_cli_connect(sock, NETLINK_NETFILTER);
if ((err = nfnl_exp_del(sock, exp, nlflags)) < 0)
nl_cli_fatal(err, "Unable to delete expectation: %s", nl_geterror(err));
if (!quiet) {
printf("Deleted ");
nl_object_dump(OBJ_CAST(exp), &params);
}
return 0;
}

137
src/nf-exp-list.c Normal file
View File

@ -0,0 +1,137 @@
/*
* src/nf-exp-list.c List Expectation Entries
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation version 2.1
* of the License.
*
* Copyright (c) 2003-2009 Thomas Graf <tgraf@suug.ch>
* Copyright (c) 2007 Philip Craig <philipc@snapgear.com>
* Copyright (c) 2007 Secure Computing Corporation
* Copyright (c) 2012 Rich Fought <rich.fought@watchguard.com>
*/
#include <netlink/cli/utils.h>
#include <netlink/cli/exp.h>
static void print_usage(void)
{
printf(
"Usage: nf-exp-list [OPTION]... [EXPECTATION ENTRY]\n"
"\n"
"Options\n"
" -f, --format=TYPE Output format { brief | details }\n"
" -h, --help Show this help\n"
" -v, --version Show versioning information\n"
"\n"
"Expectation Selection\n"
" -i, --id=NUM Identifier\n"
" --expect-proto=PROTOCOL Expectation protocol\n"
" --expect-src=ADDR Expectation source address\n"
" --expect-sport=PORT Expectation source port\n"
" --expect-dst=ADDR Expectation destination address\n"
" --expect-dport=PORT Expectation destination port\n"
" --master-proto=PROTOCOL Master conntrack protocol\n"
" --master-src=ADDR Master conntrack source address\n"
" --master-sport=PORT Master conntrack source port\n"
" --master-dst=ADDR Master conntrack destination address\n"
" --master-dport=PORT Master conntrack destination port\n"
" -F, --family=FAMILY Address family\n"
" --timeout=NUM Timeout value\n"
" --helper=STRING Helper Name\n"
//" --flags Flags\n"
);
exit(0);
}
int main(int argc, char *argv[])
{
struct nl_sock *sock;
struct nl_cache *exp_cache;
struct nfnl_exp *exp;
struct nl_dump_params params = {
.dp_type = NL_DUMP_LINE,
.dp_fd = stdout,
};
exp = nl_cli_exp_alloc();
for (;;) {
int c, optidx = 0;
enum {
ARG_MARK = 270,
ARG_TCP_STATE = 271,
ARG_EXPECT_PROTO,
ARG_EXPECT_SRC,
ARG_EXPECT_SPORT,
ARG_EXPECT_DST,
ARG_EXPECT_DPORT,
ARG_MASTER_PROTO,
ARG_MASTER_SRC,
ARG_MASTER_SPORT,
ARG_MASTER_DST,
ARG_MASTER_DPORT,
ARG_TIMEOUT,
ARG_HELPER_NAME,
ARG_FLAGS,
};
static struct option long_opts[] = {
{ "format", 1, 0, 'f' },
{ "help", 0, 0, 'h' },
{ "version", 0, 0, 'v' },
{ "id", 1, 0, 'i' },
{ "expect-proto", 1, 0, ARG_EXPECT_PROTO },
{ "expect-src", 1, 0, ARG_EXPECT_SRC },
{ "expect-sport", 1, 0, ARG_EXPECT_SPORT },
{ "expect-dst", 1, 0, ARG_EXPECT_DST },
{ "expect-dport", 1, 0, ARG_EXPECT_DPORT },
{ "master-proto", 1, 0, ARG_MASTER_PROTO },
{ "master-src", 1, 0, ARG_MASTER_SRC },
{ "master-sport", 1, 0, ARG_MASTER_SPORT },
{ "master-dst", 1, 0, ARG_MASTER_DST },
{ "master-dport", 1, 0, ARG_MASTER_DPORT },
{ "family", 1, 0, 'F' },
{ "timeout", 1, 0, ARG_TIMEOUT },
{ "helper", 1, 0, ARG_HELPER_NAME },
{ "flags", 1, 0, ARG_FLAGS},
{ 0, 0, 0, 0 }
};
c = getopt_long(argc, argv, "46f:hvi:p:F:", long_opts, &optidx);
if (c == -1)
break;
switch (c) {
case '?': exit(NLE_INVAL);
case '4': nfnl_exp_set_family(exp, AF_INET); break;
case '6': nfnl_exp_set_family(exp, AF_INET6); break;
case 'f': params.dp_type = nl_cli_parse_dumptype(optarg); break;
case 'h': print_usage(); break;
case 'v': nl_cli_print_version(); break;
case 'i': nl_cli_exp_parse_id(exp, optarg); break;
case ARG_EXPECT_PROTO: nl_cli_exp_parse_l4protonum(exp, NFNL_EXP_TUPLE_EXPECT, optarg); break;
case ARG_EXPECT_SRC: nl_cli_exp_parse_src(exp, NFNL_EXP_TUPLE_EXPECT, optarg); break;
case ARG_EXPECT_SPORT: nl_cli_exp_parse_src_port(exp, NFNL_EXP_TUPLE_EXPECT, optarg); break;
case ARG_EXPECT_DST: nl_cli_exp_parse_dst(exp, NFNL_EXP_TUPLE_EXPECT, optarg); break;
case ARG_EXPECT_DPORT: nl_cli_exp_parse_dst_port(exp, NFNL_EXP_TUPLE_EXPECT, optarg); break;
case ARG_MASTER_PROTO: nl_cli_exp_parse_l4protonum(exp, NFNL_EXP_TUPLE_MASTER, optarg); break;
case ARG_MASTER_SRC: nl_cli_exp_parse_src(exp, NFNL_EXP_TUPLE_MASTER, optarg); break;
case ARG_MASTER_SPORT: nl_cli_exp_parse_src_port(exp, NFNL_EXP_TUPLE_MASTER, optarg); break;
case ARG_MASTER_DST: nl_cli_exp_parse_dst(exp, NFNL_EXP_TUPLE_MASTER, optarg); break;
case ARG_MASTER_DPORT: nl_cli_exp_parse_dst_port(exp, NFNL_EXP_TUPLE_MASTER, optarg); break;
case 'F': nl_cli_exp_parse_family(exp, optarg); break;
case ARG_TIMEOUT: nl_cli_exp_parse_timeout(exp, optarg); break;
case ARG_HELPER_NAME: nl_cli_exp_parse_helper_name(exp, optarg); break;
case ARG_FLAGS: nl_cli_exp_parse_flags(exp, optarg); break;
}
}
sock = nl_cli_alloc_socket();
nl_cli_connect(sock, NETLINK_NETFILTER);
exp_cache = nl_cli_exp_alloc_cache(sock);
nl_cache_dump_filter(exp_cache, &params, OBJ_CAST(exp));
return 0;
}