int main() { int ret; struct nfct_handle *h; struct nf_conntrack *ct; ct = nfct_new(); if (!ct) { perror("nfct_new"); return 0; } nfct_set_attr_u8(ct, ATTR_L3PROTO, AF_INET); nfct_set_attr_u32(ct, ATTR_IPV4_SRC, inet_addr("1.1.1.1")); nfct_set_attr_u32(ct, ATTR_IPV4_DST, inet_addr("2.2.2.2")); nfct_set_attr_u8(ct, ATTR_L4PROTO, IPPROTO_TCP); nfct_set_attr_u16(ct, ATTR_PORT_SRC, htons(20)); nfct_set_attr_u16(ct, ATTR_PORT_DST, htons(10)); h = nfct_open(CONNTRACK, 0); if (!h) { perror("nfct_open"); return -1; } ret = nfct_query(h, NFCT_Q_DESTROY, ct); printf("TEST: delete conntrack (%d)(%s)\n", ret, strerror(errno)); if (ret == -1) exit(EXIT_FAILURE); nfct_close(h); }
static PyObject* ForwardingRule_new(PyTypeObject *type, PyObject *args, PyObject *kwds) { ForwardingRule *self; self = (ForwardingRule*) type->tp_alloc(type, 0); if (self != NULL) { self->is_active = 0; self->done_init = 0; self->prev = NULL; self->next = NULL; memset(self->counter, 0, sizeof(uint32_t) * 4); if ((self->dict = PyDict_New()) == NULL) { Py_DECREF(self); return NULL; } if ((self->conntrack = nfct_new()) == NULL) { Py_DECREF(self->dict); Py_DECREF(self); PyErr_NoMemory(); return NULL; } nfct_set_attr_u8(self->conntrack, ATTR_ORIG_L3PROTO, AF_INET); nfct_set_attr_u8(self->conntrack, ATTR_ORIG_L4PROTO, IPPROTO_UDP); } return (PyObject*) self; }
static int test_cmp_attr32(int attr, bool at1, bool at2, uint32_t v1, uint32_t v2, unsigned int flags) { struct nf_conntrack *ct1 = nfct_new(); struct nf_conntrack *ct2 = nfct_new(); int ret; if (at1) nfct_set_attr_u32(ct1, attr, v1); if (at2) nfct_set_attr_u32(ct2, attr, v2); ret = nfct_cmp(ct1, ct2, NFCT_CMP_ALL | flags); nfct_destroy(ct1); nfct_destroy(ct2); return ret; }
/* So, this packet has hit the connection tracking matching code. Mangle it, and change the expectation to match the new version. */ static unsigned int nf_nat_rpc(struct pkt_buff *pkt, int dir, struct nf_expect *exp, uint8_t proto, uint32_t *port_ptr) { const struct nf_conntrack *expected; struct nf_conntrack *nat_tuple; uint16_t initial_port, port; expected = nfexp_get_attr(exp, ATTR_EXP_EXPECTED); nat_tuple = nfct_new(); if (nat_tuple == NULL) return NF_ACCEPT; initial_port = nfct_get_attr_u16(expected, ATTR_PORT_DST); nfexp_set_attr_u32(exp, ATTR_EXP_NAT_DIR, !dir); /* libnetfilter_conntrack needs this */ nfct_set_attr_u8(nat_tuple, ATTR_L3PROTO, AF_INET); nfct_set_attr_u32(nat_tuple, ATTR_IPV4_SRC, 0); nfct_set_attr_u32(nat_tuple, ATTR_IPV4_DST, 0); nfct_set_attr_u8(nat_tuple, ATTR_L4PROTO, proto); nfct_set_attr_u16(nat_tuple, ATTR_PORT_DST, 0); /* When you see the packet, we need to NAT it the same as the * this one. */ nfexp_set_attr(exp, ATTR_EXP_FN, "nat-follow-master"); /* Try to get same port: if not, try to change it. */ for (port = ntohs(initial_port); port != 0; port++) { int ret; nfct_set_attr_u16(nat_tuple, ATTR_PORT_SRC, htons(port)); nfexp_set_attr(exp, ATTR_EXP_NAT_TUPLE, nat_tuple); ret = cthelper_add_expect(exp); if (ret == 0) break; else if (ret != -EBUSY) { port = 0; break; } } nfct_destroy(nat_tuple); if (port == 0) return NF_DROP; *port_ptr = htonl(port); return NF_ACCEPT; }
int main(void) { int ret; struct nfct_handle *h; struct nf_conntrack *expected; struct nf_expect *exp; expected = nfct_new(); if (!expected) { perror("nfct_new"); exit(EXIT_FAILURE); } nfct_set_attr_u8(expected, ATTR_L3PROTO, AF_INET); nfct_set_attr_u32(expected, ATTR_IPV4_SRC, inet_addr("1.1.1.1")); nfct_set_attr_u32(expected, ATTR_IPV4_DST, inet_addr("2.2.2.2")); nfct_set_attr_u8(expected, ATTR_L4PROTO, IPPROTO_TCP); nfct_set_attr_u16(expected, ATTR_PORT_SRC, 0); nfct_set_attr_u16(expected, ATTR_PORT_DST, htons(10241)); exp = nfexp_new(); if (!exp) { perror("nfexp_new"); nfct_destroy(expected); exit(EXIT_FAILURE); } nfexp_set_attr(exp, ATTR_EXP_EXPECTED, expected); h = nfct_open(EXPECT, 0); if (!h) { perror("nfct_open"); nfct_destroy(expected); return -1; } ret = nfexp_query(h, NFCT_Q_DESTROY, exp); printf("TEST: delete expectation "); if (ret == -1) printf("(%d)(%s)\n", ret, strerror(errno)); else printf("(OK)\n"); nfct_close(h); nfct_destroy(expected); ret == -1 ? exit(EXIT_FAILURE) : exit(EXIT_SUCCESS); }
int get_incoming_mark(union mysockaddr *peer_addr, struct all_addr *local_addr, int istcp, unsigned int *markp) { struct nf_conntrack *ct; struct nfct_handle *h; gotit = 0; if ((ct = nfct_new())) { nfct_set_attr_u8(ct, ATTR_L4PROTO, istcp ? IPPROTO_TCP : IPPROTO_UDP); nfct_set_attr_u16(ct, ATTR_PORT_DST, htons(daemon->port)); #ifdef HAVE_IPV6 if (peer_addr->sa.sa_family == AF_INET6) { nfct_set_attr_u8(ct, ATTR_L3PROTO, AF_INET6); nfct_set_attr(ct, ATTR_IPV6_SRC, peer_addr->in6.sin6_addr.s6_addr); nfct_set_attr_u16(ct, ATTR_PORT_SRC, peer_addr->in6.sin6_port); nfct_set_attr(ct, ATTR_IPV6_DST, local_addr->addr.addr6.s6_addr); } else #endif { nfct_set_attr_u8(ct, ATTR_L3PROTO, AF_INET); nfct_set_attr_u32(ct, ATTR_IPV4_SRC, peer_addr->in.sin_addr.s_addr); nfct_set_attr_u16(ct, ATTR_PORT_SRC, peer_addr->in.sin_port); nfct_set_attr_u32(ct, ATTR_IPV4_DST, local_addr->addr.addr4.s_addr); } if ((h = nfct_open(CONNTRACK, 0))) { nfct_callback_register(h, NFCT_T_ALL, callback, (void *)markp); if (nfct_query(h, NFCT_Q_GET, ct) == -1) { static int warned = 0; if (!warned) { my_syslog(LOG_ERR, _("Conntrack connection mark retrieval failed: %s"), strerror(errno)); warned = 1; } } nfct_close(h); } nfct_destroy(ct); } return gotit; }
int __callback(struct nlmsghdr *nlh, struct nfattr *nfa[], void *data) { int ret = NFNL_CB_STOP; unsigned int type; struct nf_conntrack *ct; int len = nlh->nlmsg_len; struct __data_container *container = data; len -= NLMSG_LENGTH(sizeof(struct nfgenmsg)); if (len < 0) return NFNL_CB_CONTINUE; type = __parse_message_type(nlh); if (!(type & container->type)) return NFNL_CB_CONTINUE; ct = nfct_new(); if (!ct) return NFNL_CB_CONTINUE; __parse_conntrack(nlh, (const struct nfattr **)nfa, ct); if (container->h->cb) ret = container->h->cb(type, ct, container->data); else if (container->h->cb2) ret = container->h->cb2(nlh, type, ct, container->data); switch(ret) { case NFCT_CB_FAILURE: free(ct); ret = NFNL_CB_FAILURE; break; case NFCT_CB_STOP: free(ct); ret = NFNL_CB_STOP; break; case NFCT_CB_CONTINUE: free(ct); ret = NFNL_CB_CONTINUE; break; case NFCT_CB_STOLEN: ret = NFNL_CB_CONTINUE; break; } return ret; }
static int data_cb(const struct nlmsghdr *nlh, void *data) { struct nf_conntrack *ct; char buf[4096]; ct = nfct_new(); if (ct == NULL) return MNL_CB_OK; nfct_nlmsg_parse(nlh, ct); nfct_snprintf(buf, sizeof(buf), ct, NFCT_T_UNKNOWN, NFCT_O_DEFAULT, 0); printf("%s\n", buf); nfct_destroy(ct); return MNL_CB_OK; }
/* if the handle has no callback, check for existence, otherwise, update */ int nl_get_conntrack(struct nfct_handle *h, const struct nf_conntrack *ct) { int ret = 1; struct nf_conntrack *tmp; tmp = nfct_new(); if (tmp == NULL) return -1; /* use the original tuple to check if it is there */ nfct_copy(tmp, ct, NFCT_CP_ORIG); if (nfct_query(h, NFCT_Q_GET, tmp) == -1) ret = (errno == ENOENT) ? 0 : -1; nfct_destroy(tmp); return ret; }
int main() { int ret; struct nfct_handle *h; struct nf_conntrack *ct; ct = nfct_new(); if (!ct) { perror("nfct_new"); return 0; } nfct_set_attr_u8(ct, ATTR_L3PROTO, AF_INET); nfct_set_attr_u32(ct, ATTR_IPV4_SRC, inet_addr("1.1.1.1")); nfct_set_attr_u32(ct, ATTR_IPV4_DST, inet_addr("2.2.2.2")); nfct_set_attr_u8(ct, ATTR_L4PROTO, IPPROTO_TCP); nfct_set_attr_u16(ct, ATTR_PORT_SRC, htons(20)); nfct_set_attr_u16(ct, ATTR_PORT_DST, htons(10)); nfct_setobjopt(ct, NFCT_SOPT_SETUP_REPLY); nfct_set_attr_u8(ct, ATTR_TCP_STATE, TCP_CONNTRACK_LISTEN); nfct_set_attr_u32(ct, ATTR_TIMEOUT, 100); nfct_set_attr_u32(ct, ATTR_SNAT_IPV4, inet_addr("8.8.8.8")); h = nfct_open(CONNTRACK, 0); if (!h) { perror("nfct_open"); return -1; } ret = nfct_query(h, NFCT_Q_CREATE, ct); printf("TEST: create conntrack (%d)(%s)\n", ret, strerror(errno)); if (ret == -1) exit(EXIT_FAILURE); nfct_close(h); }
static int data_cb(const struct nlmsghdr *nlh, void *data) { struct nf_conntrack *ct; struct data_cb_s * d = (struct data_cb_s*) data; struct sockaddr_in* ext4 = (struct sockaddr_in*) d->ext; ct = nfct_new(); if (ct == NULL) return MNL_CB_OK; nfct_nlmsg_parse(nlh, ct); if (data) { ext4->sin_addr.s_addr = nfct_get_attr_u32(ct, ATTR_REPL_IPV4_DST); ext4->sin_port = nfct_get_attr_u16(ct, ATTR_REPL_PORT_DST); } d->found = 1; nfct_destroy(ct); return MNL_CB_OK; }
int main(void) { int ret, i; struct nf_conntrack *ct, *ct2, *tmp; struct nf_expect *exp, *tmp_exp; char data[256]; const char *val; int status; struct nfct_bitmask *b, *b2; srand(time(NULL)); /* initialize fake data for testing purposes */ for (i=0; i<sizeof(data); i++) data[i] = 0x01; ct = nfct_new(); if (!ct) { perror("nfct_new"); return 0; } tmp = nfct_new(); if (!tmp) { perror("nfct_new"); return 0; } printf("== test set API ==\n"); ret = fork(); if (ret == 0) { for (i=0; i<ATTR_MAX; i++) nfct_set_attr(ct, i, data); exit(0); } else { wait(&status); eval_sigterm(status); } b = nfct_bitmask_new(rand() & 0xffff); assert(b); b2 = nfct_bitmask_new(rand() & 0xffff); assert(b2); for (i=0; i<ATTR_MAX; i++) { switch (i) { case ATTR_CONNLABELS: nfct_set_attr(ct, i, b); break; case ATTR_CONNLABELS_MASK: nfct_set_attr(ct, i, b2); break; default: nfct_set_attr(ct, i, data); break; } } printf("== test get API ==\n"); ret = fork(); if (ret == 0) { for (i=0; i<ATTR_MAX; i++) nfct_get_attr(ct, i); exit(0); } else { wait(&status); eval_sigterm(status); } printf("== validate set API ==\n"); ret = fork(); if (ret == 0) { for (i=0; i<ATTR_MAX; i++) { if (attr_is_readonly(i)) continue; switch(i) { /* These attributes require special handling */ case ATTR_HELPER_INFO: nfct_set_attr_l(ct, i, data, sizeof(data)); break; case ATTR_CONNLABELS: case ATTR_CONNLABELS_MASK: /* already set above */ break; default: data[0] = (uint8_t) i; nfct_set_attr(ct, i, data); } val = nfct_get_attr(ct, i); switch (i) { case ATTR_CONNLABELS: assert((void *) val == b); continue; case ATTR_CONNLABELS_MASK: assert((void *) val == b2); continue; } if (val[0] != data[0]) { printf("ERROR: set/get operations don't match " "for attribute %d (%x != %x)\n", i, val[0], data[0]); } } exit(0); } else { wait(&status); eval_sigterm(status); } printf("== test copy API ==\n"); ret = fork(); if (ret == 0) { for (i=0; i<ATTR_MAX; i++) nfct_copy_attr(tmp, ct, i); exit(0); } else { wait(&status); eval_sigterm(status); } ret = fork(); if (ret == 0) { test_nfct_cmp_api(tmp, ct); exit(0); } else { wait(&status); eval_sigterm(status); } exp = nfexp_new(); if (!exp) { perror("nfexp_new"); return 0; } tmp_exp = nfexp_new(); if (!tmp_exp) { perror("nfexp_new"); return 0; } printf("== test expect set API ==\n"); ret = fork(); if (ret == 0) { for (i=0; i<ATTR_EXP_MAX; i++) nfexp_set_attr(exp, i, data); exit(0); } else { wait(&status); eval_sigterm(status); } for (i=0; i<ATTR_EXP_MAX; i++) nfexp_set_attr(exp, i, data); printf("== test expect get API ==\n"); ret = fork(); if (ret == 0) { for (i=0; i<ATTR_EXP_MAX; i++) nfexp_get_attr(exp, i); exit(0); } else { wait(&status); eval_sigterm(status); } printf("== validate expect set API ==\n"); ret = fork(); if (ret == 0) { for (i=0; i<ATTR_EXP_MAX; i++) { data[0] = (uint8_t) i; nfexp_set_attr(exp, i, data); val = nfexp_get_attr(exp, i); if (val[0] != data[0]) { printf("ERROR: set/get operations don't match " "for attribute %d (%x != %x)\n", i, val[0], data[0]); } } exit(0); } else { wait(&status); eval_sigterm(status); } ret = fork(); if (ret == 0) { test_nfexp_cmp_api(tmp_exp, exp); exit(0); } else { wait(&status); eval_sigterm(status); } ct2 = nfct_new(); if (!ct2) { perror("nfct_new"); return 0; } printf("== test set grp API ==\n"); ret = fork(); if (ret == 0) { for (i=0; i<ATTR_GRP_MAX; i++) nfct_set_attr_grp(ct2, i, data); exit(0); } else { wait(&status); eval_sigterm(status); } for (i=0; i<ATTR_GRP_MAX; i++) nfct_set_attr_grp(ct2, i, data); printf("== test get grp API ==\n"); ret = fork(); if (ret == 0) { char buf[32]; /* IPv6 group address is 16 bytes * 2 */ for (i=0; i<ATTR_GRP_MAX; i++) nfct_get_attr_grp(ct2, i, buf); exit(0); } else { wait(&status); eval_sigterm(status); } printf("== validate set grp API ==\n"); ret = fork(); if (ret == 0) { for (i=0; i<ATTR_GRP_MAX; i++) { char buf[32]; /* IPv6 group address is 16 bytes */ data[0] = (uint8_t) i; nfct_set_attr_grp(ct2, i, data); nfct_get_attr_grp(ct2, i, buf); /* These attributes cannot be set, ignore them. */ switch(i) { case ATTR_GRP_ORIG_COUNTERS: case ATTR_GRP_REPL_COUNTERS: case ATTR_GRP_ORIG_ADDR_SRC: case ATTR_GRP_ORIG_ADDR_DST: case ATTR_GRP_REPL_ADDR_SRC: case ATTR_GRP_REPL_ADDR_DST: continue; } if (buf[0] != data[0]) { printf("ERROR: set/get operations don't match " "for attribute %d (%x != %x)\n", i, buf[0], data[0]); } } exit(0); } else { wait(&status); eval_sigterm(status); } nfct_destroy(ct2); printf("== destroy cloned ct entry ==\n"); nfct_destroy(ct); nfct_destroy(tmp); nfexp_destroy(exp); nfexp_destroy(tmp_exp); printf("OK\n"); test_nfct_bitmask(); return EXIT_SUCCESS; }
static void test_nfct_bitmask(void) { struct nfct_bitmask *a, *b; unsigned short int maxb, i; struct nf_conntrack *ct1, *ct2; printf("== test nfct_bitmask_* API ==\n"); maxb = rand() & 0xffff; a = nfct_bitmask_new(maxb); assert(!nfct_bitmask_test_bit(a, maxb + 32)); nfct_bitmask_set_bit(a, maxb + 32); assert(!nfct_bitmask_test_bit(a, maxb + 32)); for (i = 0; i <= maxb; i++) assert(!nfct_bitmask_test_bit(a, i)); for (i = 0; i <= maxb; i++) { if (rand() & 1) { assert(!nfct_bitmask_test_bit(a, i)); continue; } nfct_bitmask_set_bit(a, i); assert(nfct_bitmask_test_bit(a, i)); } b = nfct_bitmask_clone(a); assert(b); for (i = 0; i <= maxb; i++) { if (nfct_bitmask_test_bit(a, i)) assert(nfct_bitmask_test_bit(b, i)); else assert(!nfct_bitmask_test_bit(b, i)); } nfct_bitmask_destroy(a); for (i = 0; i <= maxb; i++) { if (rand() & 1) continue; nfct_bitmask_unset_bit(b, i); assert(!nfct_bitmask_test_bit(b, i)); } /* nfct_bitmask_clear() */ for (i = 0; i < maxb; i++) { nfct_bitmask_set_bit(b, i); assert(nfct_bitmask_test_bit(b, i)); nfct_bitmask_clear(b); assert(!nfct_bitmask_test_bit(b, i)); } for (i = 0; i < maxb; i++) nfct_bitmask_set_bit(b, i); nfct_bitmask_clear(b); for (i = 0; i < maxb; i++) assert(!nfct_bitmask_test_bit(b, i)); /* nfct_bitmask_equal() */ for (i = 0; i < maxb / 32 * 32; i += 32) { a = nfct_bitmask_new(i); assert(!nfct_bitmask_equal(a, b)); nfct_bitmask_destroy(a); } a = nfct_bitmask_clone(b); assert(nfct_bitmask_equal(a, b)); for (i = 0; i < maxb; i++) { if (nfct_bitmask_test_bit(a, i)) { nfct_bitmask_unset_bit(a, i); assert(!nfct_bitmask_equal(a, b)); nfct_bitmask_set_bit(a, i); } else { nfct_bitmask_set_bit(a, i); assert(!nfct_bitmask_equal(a, b)); nfct_bitmask_unset_bit(a, i); } assert(nfct_bitmask_equal(a, b)); } nfct_bitmask_destroy(a); nfct_bitmask_destroy(b); ct1 = nfct_new(); ct2 = nfct_new(); maxb = rand() & 0xff; maxb += 128; maxb /= 2; a = nfct_bitmask_new(maxb * 2); b = nfct_bitmask_new(maxb); nfct_set_attr(ct1, ATTR_CONNLABELS, a); nfct_set_attr(ct2, ATTR_CONNLABELS, b); assert(nfct_cmp(ct1, ct2, NFCT_CMP_ALL) == 1); nfct_bitmask_set_bit(a, maxb); nfct_bitmask_set_bit(b, maxb); assert(nfct_cmp(ct1, ct2, NFCT_CMP_ALL) == 1); nfct_bitmask_set_bit(a, maxb * 2); assert(nfct_cmp(ct1, ct2, NFCT_CMP_ALL) == 0); nfct_destroy(ct1); nfct_destroy(ct2); printf("OK\n"); }
int main(void) { int ret; struct nfct_handle *h; struct nf_conntrack *master, *expected, *mask, *nat; struct nf_expect *exp; /* * Step 1: Setup master conntrack */ master = nfct_new(); if (!master) { perror("nfct_new"); exit(EXIT_FAILURE); } nfct_set_attr_u8(master, ATTR_L3PROTO, AF_INET); nfct_set_attr_u32(master, ATTR_IPV4_SRC, inet_addr("1.1.1.1")); nfct_set_attr_u32(master, ATTR_IPV4_DST, inet_addr("2.2.2.2")); nfct_set_attr_u8(master, ATTR_L4PROTO, IPPROTO_TCP); nfct_set_attr_u16(master, ATTR_PORT_SRC, htons(1025)); nfct_set_attr_u16(master, ATTR_PORT_DST, htons(21)); nfct_setobjopt(master, NFCT_SOPT_SETUP_REPLY); nfct_set_attr_u8(master, ATTR_TCP_STATE, TCP_CONNTRACK_ESTABLISHED); nfct_set_attr_u32(master, ATTR_TIMEOUT, 200); nfct_set_attr(master, ATTR_HELPER_NAME, "ftp"); h = nfct_open(CONNTRACK, 0); if (!h) { perror("nfct_open"); nfct_destroy(master); return -1; } ret = nfct_query(h, NFCT_Q_CREATE, master); printf("TEST: add master conntrack "); if (ret == -1) printf("(%d)(%s)\n", ret, strerror(errno)); else printf("(OK)\n"); nfct_close(h); expected = nfct_new(); if (!expected) { perror("nfct_new"); exit(EXIT_FAILURE); } nfct_set_attr_u8(expected, ATTR_L3PROTO, AF_INET); nfct_set_attr_u32(expected, ATTR_IPV4_SRC, inet_addr("1.1.1.1")); nfct_set_attr_u32(expected, ATTR_IPV4_DST, inet_addr("2.2.2.2")); nfct_set_attr_u8(expected, ATTR_L4PROTO, IPPROTO_TCP); nfct_set_attr_u16(expected, ATTR_PORT_SRC, 0); nfct_set_attr_u16(expected, ATTR_PORT_DST, htons(10241)); mask = nfct_new(); if (!mask) { perror("nfct_new"); nfct_destroy(master); nfct_destroy(expected); exit(EXIT_FAILURE); } nfct_set_attr_u8(mask, ATTR_L3PROTO, AF_INET); nfct_set_attr_u32(mask, ATTR_IPV4_SRC, 0xffffffff); nfct_set_attr_u32(mask, ATTR_IPV4_DST, 0xffffffff); nfct_set_attr_u8(mask, ATTR_L4PROTO, IPPROTO_TCP); nfct_set_attr_u16(mask, ATTR_PORT_SRC, 0x0000); nfct_set_attr_u16(mask, ATTR_PORT_DST, 0xffff); nat = nfct_new(); if (!nat) { perror("nfct_new"); nfct_destroy(mask); nfct_destroy(master); nfct_destroy(expected); exit(EXIT_FAILURE); } nfct_set_attr_u8(nat, ATTR_L3PROTO, AF_INET); nfct_set_attr_u32(nat, ATTR_IPV4_SRC, inet_addr("3.3.3.3")); nfct_set_attr_u32(nat, ATTR_IPV4_DST, 0); nfct_set_attr_u8(nat, ATTR_L4PROTO, IPPROTO_TCP); nfct_set_attr_u16(nat, ATTR_PORT_SRC, 12345); nfct_set_attr_u16(nat, ATTR_PORT_DST, 0); /* * Step 2: Setup expectation */ exp = nfexp_new(); if (!exp) { perror("nfexp_new"); nfct_destroy(master); nfct_destroy(expected); nfct_destroy(mask); exit(EXIT_FAILURE); } nfexp_set_attr(exp, ATTR_EXP_MASTER, master); nfexp_set_attr(exp, ATTR_EXP_EXPECTED, expected); nfexp_set_attr(exp, ATTR_EXP_MASK, mask); nfexp_set_attr(exp, ATTR_EXP_NAT_TUPLE, nat); nfexp_set_attr_u32(exp, ATTR_EXP_NAT_DIR, 0); nfexp_set_attr_u32(exp, ATTR_EXP_TIMEOUT, 200); nfct_destroy(master); nfct_destroy(expected); nfct_destroy(mask); nfct_destroy(nat); h = nfct_open(EXPECT, 0); if (!h) { perror("nfct_open"); return -1; } ret = nfexp_query(h, NFCT_Q_CREATE, exp); printf("TEST: create expectation "); if (ret == -1) printf("(%d)(%s)\n", ret, strerror(errno)); else printf("(OK)\n"); nfct_close(h); ret == -1 ? exit(EXIT_FAILURE) : exit(EXIT_SUCCESS); }
int main(void) { int ret, i; struct nf_conntrack *ct, *ct2, *tmp; struct nf_expect *exp, *tmp_exp; char data[256]; const char *val; int status; /* initialize fake data for testing purposes */ for (i=0; i<sizeof(data); i++) data[i] = 0x01; ct = nfct_new(); if (!ct) { perror("nfct_new"); return 0; } tmp = nfct_new(); if (!tmp) { perror("nfct_new"); return 0; } printf("== test set API ==\n"); ret = fork(); if (ret == 0) { for (i=0; i<ATTR_MAX; i++) nfct_set_attr(ct, i, data); exit(0); } else { wait(&status); eval_sigterm(status); } for (i=0; i<ATTR_MAX; i++) nfct_set_attr(ct, i, data); printf("== test get API ==\n"); ret = fork(); if (ret == 0) { for (i=0; i<ATTR_MAX; i++) nfct_get_attr(ct, i); exit(0); } else { wait(&status); eval_sigterm(status); } printf("== validate set API ==\n"); ret = fork(); if (ret == 0) { for (i=0; i<ATTR_MAX; i++) { /* These attributes cannot be set, ignore them. */ switch(i) { case ATTR_ORIG_COUNTER_PACKETS: case ATTR_REPL_COUNTER_PACKETS: case ATTR_ORIG_COUNTER_BYTES: case ATTR_REPL_COUNTER_BYTES: case ATTR_USE: case ATTR_SECCTX: case ATTR_TIMESTAMP_START: case ATTR_TIMESTAMP_STOP: continue; /* These attributes require special handling */ case ATTR_HELPER_INFO: nfct_set_attr_l(ct, i, data, sizeof(data)); break; default: data[0] = (uint8_t) i; nfct_set_attr(ct, i, data); } val = nfct_get_attr(ct, i); if (val[0] != data[0]) { printf("ERROR: set/get operations don't match " "for attribute %d (%x != %x)\n", i, val[0], data[0]); } } exit(0); } else { wait(&status); eval_sigterm(status); } printf("== test copy API ==\n"); ret = fork(); if (ret == 0) { for (i=0; i<ATTR_MAX; i++) nfct_copy_attr(tmp, ct, i); exit(0); } else { wait(&status); eval_sigterm(status); } printf("== test cmp API ==\n"); ret = fork(); if (ret == 0) { nfct_cmp(tmp, ct, NFCT_CMP_ALL); exit(0); } else { wait(&status); eval_sigterm(status); } exp = nfexp_new(); if (!exp) { perror("nfexp_new"); return 0; } tmp_exp = nfexp_new(); if (!tmp_exp) { perror("nfexp_new"); return 0; } printf("== test expect set API ==\n"); ret = fork(); if (ret == 0) { for (i=0; i<ATTR_EXP_MAX; i++) nfexp_set_attr(exp, i, data); exit(0); } else { wait(&status); eval_sigterm(status); } for (i=0; i<ATTR_EXP_MAX; i++) nfexp_set_attr(exp, i, data); printf("== test expect get API ==\n"); ret = fork(); if (ret == 0) { for (i=0; i<ATTR_EXP_MAX; i++) nfexp_get_attr(exp, i); exit(0); } else { wait(&status); eval_sigterm(status); } printf("== validate expect set API ==\n"); ret = fork(); if (ret == 0) { for (i=0; i<ATTR_EXP_MAX; i++) { data[0] = (uint8_t) i; nfexp_set_attr(exp, i, data); val = nfexp_get_attr(exp, i); if (val[0] != data[0]) { printf("ERROR: set/get operations don't match " "for attribute %d (%x != %x)\n", i, val[0], data[0]); } } exit(0); } else { wait(&status); eval_sigterm(status); } /* XXX: missing nfexp_copy API. */ memcpy(tmp_exp, exp, nfexp_maxsize()); printf("== test expect cmp API ==\n"); ret = fork(); if (ret == 0) { nfexp_cmp(tmp_exp, exp, 0); exit(0); } else { wait(&status); eval_sigterm(status); } ct2 = nfct_clone(ct); assert(ct2); assert(nfct_cmp(ct, ct2, NFCT_CMP_ALL) == 1); nfct_destroy(ct2); ct2 = nfct_new(); if (!ct2) { perror("nfct_new"); return 0; } printf("== test set grp API ==\n"); ret = fork(); if (ret == 0) { for (i=0; i<ATTR_GRP_MAX; i++) nfct_set_attr_grp(ct2, i, data); exit(0); } else { wait(&status); eval_sigterm(status); } for (i=0; i<ATTR_GRP_MAX; i++) nfct_set_attr_grp(ct2, i, data); printf("== test get grp API ==\n"); ret = fork(); if (ret == 0) { char buf[32]; /* IPv6 group address is 16 bytes * 2 */ for (i=0; i<ATTR_GRP_MAX; i++) nfct_get_attr_grp(ct2, i, buf); exit(0); } else { wait(&status); eval_sigterm(status); } printf("== validate set grp API ==\n"); ret = fork(); if (ret == 0) { for (i=0; i<ATTR_GRP_MAX; i++) { char buf[32]; /* IPv6 group address is 16 bytes */ data[0] = (uint8_t) i; nfct_set_attr_grp(ct2, i, data); nfct_get_attr_grp(ct2, i, buf); /* These attributes cannot be set, ignore them. */ switch(i) { case ATTR_GRP_ORIG_COUNTERS: case ATTR_GRP_REPL_COUNTERS: case ATTR_GRP_ORIG_ADDR_SRC: case ATTR_GRP_ORIG_ADDR_DST: case ATTR_GRP_REPL_ADDR_SRC: case ATTR_GRP_REPL_ADDR_DST: continue; } if (buf[0] != data[0]) { printf("ERROR: set/get operations don't match " "for attribute %d (%x != %x)\n", i, buf[0], data[0]); } } exit(0); } else { wait(&status); eval_sigterm(status); } nfct_destroy(ct2); printf("== destroy cloned ct entry ==\n"); nfct_destroy(ct); nfct_destroy(tmp); nfexp_destroy(exp); nfexp_destroy(tmp_exp); printf("OK\n"); return EXIT_SUCCESS; }
int main(void) { struct mnl_socket *nl; struct nlmsghdr *nlh; struct nfgenmsg *nfh; char buf[MNL_SOCKET_BUFFER_SIZE]; unsigned int seq, portid; struct nf_conntrack *ct; int ret; nl = mnl_socket_open(NETLINK_NETFILTER); if (nl == NULL) { perror("mnl_socket_open"); exit(EXIT_FAILURE); } if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) { perror("mnl_socket_bind"); exit(EXIT_FAILURE); } portid = mnl_socket_get_portid(nl); nlh = mnl_nlmsg_put_header(buf); nlh->nlmsg_type = (NFNL_SUBSYS_CTNETLINK << 8) | IPCTNL_MSG_CT_DELETE; nlh->nlmsg_flags = NLM_F_REQUEST|NLM_F_ACK; nlh->nlmsg_seq = seq = time(NULL); nfh = mnl_nlmsg_put_extra_header(nlh, sizeof(struct nfgenmsg)); nfh->nfgen_family = AF_INET; nfh->version = NFNETLINK_V0; nfh->res_id = 0; ct = nfct_new(); if (ct == NULL) { perror("nfct_new"); return 0; } nfct_set_attr_u8(ct, ATTR_L3PROTO, AF_INET); nfct_set_attr_u32(ct, ATTR_IPV4_SRC, inet_addr("1.1.1.1")); nfct_set_attr_u32(ct, ATTR_IPV4_DST, inet_addr("2.2.2.2")); nfct_set_attr_u8(ct, ATTR_L4PROTO, IPPROTO_TCP); nfct_set_attr_u16(ct, ATTR_PORT_SRC, htons(20)); nfct_set_attr_u16(ct, ATTR_PORT_DST, htons(10)); nfct_nlmsg_build(nlh, ct); ret = mnl_socket_sendto(nl, nlh, nlh->nlmsg_len); if (ret == -1) { perror("mnl_socket_recvfrom"); exit(EXIT_FAILURE); } ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); while (ret > 0) { ret = mnl_cb_run(buf, ret, seq, portid, NULL, NULL); if (ret <= MNL_CB_STOP) break; ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); } if (ret == -1) { perror("mnl_socket_recvfrom"); exit(EXIT_FAILURE); } mnl_socket_close(nl); return 0; }
int get_nat_ext_addr(struct sockaddr* src, struct sockaddr *dst, uint8_t proto, struct sockaddr_storage* ret_ext) { struct mnl_socket *nl; struct nlmsghdr *nlh; struct nfgenmsg *nfh; char buf[MNL_SOCKET_BUFFER_SIZE]; unsigned int seq, portid; struct nf_conntrack *ct; int ret; struct data_cb_s data; if ((!src)&&(!dst)) { return 0; } if (src->sa_family != dst->sa_family) { return 0; } nl = mnl_socket_open(NETLINK_NETFILTER); if (nl == NULL) { // perror("mnl_socket_open"); goto free_nl; } if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) { // perror("mnl_socket_bind"); goto free_nl; } portid = mnl_socket_get_portid(nl); memset(buf, 0, sizeof(buf)); nlh = mnl_nlmsg_put_header(buf); nlh->nlmsg_type = (NFNL_SUBSYS_CTNETLINK << 8) | IPCTNL_MSG_CT_GET; nlh->nlmsg_flags = NLM_F_REQUEST|NLM_F_ACK; nlh->nlmsg_seq = seq = time(NULL); nfh = mnl_nlmsg_put_extra_header(nlh, sizeof(struct nfgenmsg)); nfh->nfgen_family = src->sa_family; nfh->version = NFNETLINK_V0; nfh->res_id = 0; ct = nfct_new(); if (ct == NULL) { goto free_nl; } nfct_set_attr_u8(ct, ATTR_L3PROTO, src->sa_family); if (src->sa_family == AF_INET) { struct sockaddr_in *src4 = (struct sockaddr_in *)src; struct sockaddr_in *dst4 = (struct sockaddr_in *)dst; nfct_set_attr_u32(ct, ATTR_IPV4_SRC, src4->sin_addr.s_addr); nfct_set_attr_u32(ct, ATTR_IPV4_DST, dst4->sin_addr.s_addr); nfct_set_attr_u16(ct, ATTR_PORT_SRC, src4->sin_port); nfct_set_attr_u16(ct, ATTR_PORT_DST, dst4->sin_port); } else if (src->sa_family == AF_INET6) { struct sockaddr_in6 *src6 = (struct sockaddr_in6 *)src; struct sockaddr_in6 *dst6 = (struct sockaddr_in6 *)dst; nfct_set_attr(ct, ATTR_IPV6_SRC, &src6->sin6_addr); nfct_set_attr(ct, ATTR_IPV6_DST, &dst6->sin6_addr); nfct_set_attr_u16(ct, ATTR_PORT_SRC, src6->sin6_port); nfct_set_attr_u16(ct, ATTR_PORT_DST, dst6->sin6_port); } nfct_set_attr_u8(ct, ATTR_L4PROTO, proto); nfct_nlmsg_build(nlh, ct); ret = mnl_socket_sendto(nl, nlh, nlh->nlmsg_len); if (ret == -1) { goto free_ct; } ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); data.ext = ret_ext; data.found = 0; while (ret > 0) { ret = mnl_cb_run(buf, ret, seq, portid, data_cb, &data); if (ret <= MNL_CB_STOP) break; ret = mnl_socket_recvfrom(nl, buf, sizeof(buf)); } free_ct: nfct_destroy(ct); free_nl: mnl_socket_close(nl); return data.found; }