libnetfilter_conntrack  1.0.6
expect_create_userspace.c
1 #include <stdio.h>
2 #include <stdlib.h>
3 #include <string.h>
4 #include <errno.h>
5 #include <arpa/inet.h>
6 
7 #include <libnetfilter_conntrack/libnetfilter_conntrack.h>
8 #include <libnetfilter_conntrack/libnetfilter_conntrack_tcp.h>
9 
10 /*
11  * This example shows how to setup a user-space expectation. This requires
12  * a Linux kernel >= 2.6.37.
13  */
14 
15 int main(void)
16 {
17  int ret;
18  struct nfct_handle *h;
19  struct nf_conntrack *master, *expected, *mask;
20  struct nf_expect *exp;
21 
22  /*
23  * Step 1: Setup master conntrack
24  */
25 
26  master = nfct_new();
27  if (!master) {
28  perror("nfct_new");
29  exit(EXIT_FAILURE);
30  }
31 
32  nfct_set_attr_u8(master, ATTR_L3PROTO, AF_INET);
33  nfct_set_attr_u32(master, ATTR_IPV4_SRC, inet_addr("1.1.1.1"));
34  nfct_set_attr_u32(master, ATTR_IPV4_DST, inet_addr("2.2.2.2"));
35 
36  nfct_set_attr_u8(master, ATTR_L4PROTO, IPPROTO_TCP);
37  nfct_set_attr_u16(master, ATTR_PORT_SRC, htons(1025));
38  nfct_set_attr_u16(master, ATTR_PORT_DST, htons(21));
39 
40  nfct_setobjopt(master, NFCT_SOPT_SETUP_REPLY);
41 
42  nfct_set_attr_u8(master, ATTR_TCP_STATE, TCP_CONNTRACK_ESTABLISHED);
43  nfct_set_attr_u32(master, ATTR_TIMEOUT, 200);
44 
45  h = nfct_open(CONNTRACK, 0);
46  if (!h) {
47  perror("nfct_open");
48  nfct_destroy(master);
49  return -1;
50  }
51 
52  /*
53  * In a real scenario in which you want to implement an helper in
54  * user-space with NFQUEUE, the master conntrack does not need to
55  * be created, since it should already exist.
56  */
57  ret = nfct_query(h, NFCT_Q_CREATE, master);
58 
59  printf("TEST: add master conntrack ");
60  if (ret == -1)
61  printf("(%d)(%s)\n", ret, strerror(errno));
62  else
63  printf("(OK)\n");
64 
65  nfct_close(h);
66 
67  expected = nfct_new();
68  if (!expected) {
69  perror("nfct_new");
70  nfct_destroy(master);
71  exit(EXIT_FAILURE);
72  }
73 
74  nfct_set_attr_u8(expected, ATTR_L3PROTO, AF_INET);
75  nfct_set_attr_u32(expected, ATTR_IPV4_SRC, inet_addr("1.1.1.1"));
76  nfct_set_attr_u32(expected, ATTR_IPV4_DST, inet_addr("2.2.2.2"));
77 
78  nfct_set_attr_u8(expected, ATTR_L4PROTO, IPPROTO_TCP);
79  nfct_set_attr_u16(expected, ATTR_PORT_SRC, 0);
80  nfct_set_attr_u16(expected, ATTR_PORT_DST, htons(10241));
81 
82  mask = nfct_new();
83  if (!mask) {
84  perror("nfct_new");
85  nfct_destroy(master);
86  nfct_destroy(expected);
87  exit(EXIT_FAILURE);
88  }
89 
90  nfct_set_attr_u8(mask, ATTR_L3PROTO, AF_INET);
91  nfct_set_attr_u32(mask, ATTR_IPV4_SRC, 0xffffffff);
92  nfct_set_attr_u32(mask, ATTR_IPV4_DST, 0xffffffff);
93 
94  nfct_set_attr_u8(mask, ATTR_L4PROTO, IPPROTO_TCP);
95  nfct_set_attr_u16(mask, ATTR_PORT_SRC, 0x0000);
96  nfct_set_attr_u16(mask, ATTR_PORT_DST, 0xffff);
97 
98  /*
99  * Step 2: Setup expectation
100  */
101 
102  exp = nfexp_new();
103  if (!exp) {
104  perror("nfexp_new");
105  nfct_destroy(master);
106  nfct_destroy(expected);
107  nfct_destroy(mask);
108  exit(EXIT_FAILURE);
109  }
110 
111  nfexp_set_attr(exp, ATTR_EXP_MASTER, master);
112  nfexp_set_attr(exp, ATTR_EXP_EXPECTED, expected);
113  nfexp_set_attr(exp, ATTR_EXP_MASK, mask);
114  nfexp_set_attr_u32(exp, ATTR_EXP_TIMEOUT, 200);
115 
116  nfct_destroy(master);
117  nfct_destroy(expected);
118  nfct_destroy(mask);
119 
120  h = nfct_open(EXPECT, 0);
121  if (!h) {
122  perror("nfct_open");
123  return -1;
124  }
125 
126  ret = nfexp_query(h, NFCT_Q_CREATE, exp);
127 
128  printf("TEST: create expectation ");
129  if (ret == -1)
130  printf("(%d)(%s)\n", ret, strerror(errno));
131  else
132  printf("(OK)\n");
133 
134  nfct_close(h);
135 
136  ret == -1 ? exit(EXIT_FAILURE) : exit(EXIT_SUCCESS);
137 }
void nfexp_set_attr(struct nf_expect *exp, const enum nf_expect_attr type, const void *value)
Definition: expect/api.c:308
void nfct_set_attr_u32(struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint32_t value)
int nfct_query(struct nfct_handle *h, const enum nf_conntrack_query query, const void *data)
void nfexp_set_attr_u32(struct nf_expect *exp, const enum nf_expect_attr type, uint32_t value)
Definition: expect/api.c:356
int nfct_close(struct nfct_handle *cth)
Definition: main.c:105
int nfexp_query(struct nfct_handle *h, const enum nf_conntrack_query qt, const void *data)
Definition: expect/api.c:668
void nfct_destroy(struct nf_conntrack *ct)
Definition: conntrack/api.c:92
int nfct_setobjopt(struct nf_conntrack *ct, unsigned int option)
struct nf_expect * nfexp_new(void)
Definition: expect/api.c:28
void nfct_set_attr_u16(struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint16_t value)
struct nf_conntrack * nfct_new(void)
Definition: conntrack/api.c:75
void nfct_set_attr_u8(struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint8_t value)
struct nfct_handle * nfct_open(uint8_t, unsigned)
Definition: main.c:84