889 lines
22 KiB
C
889 lines
22 KiB
C
/*
|
|
* lib/netfilter/exp_obj.c Conntrack Expectation Object
|
|
*
|
|
* This library is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
* License as published by the Free Software Foundation version 2.1
|
|
* of the License.
|
|
*
|
|
* Copyright (c) 2003-2008 Thomas Graf <tgraf@suug.ch>
|
|
* Copyright (c) 2007 Philip Craig <philipc@snapgear.com>
|
|
* Copyright (c) 2007 Secure Computing Corporation
|
|
* Copyright (c) 2012 Rich Fought <rich.fought@watchguard.com>
|
|
*/
|
|
|
|
#include <sys/types.h>
|
|
#include <netinet/in.h>
|
|
#include <linux/netfilter/nfnetlink_conntrack.h>
|
|
#include <linux/netfilter/nf_conntrack_common.h>
|
|
#include <linux/netfilter/nf_conntrack_tcp.h>
|
|
|
|
#include <netlink-local.h>
|
|
#include <netlink/netfilter/nfnl.h>
|
|
#include <netlink/netfilter/exp.h>
|
|
|
|
// The 32-bit attribute mask in the common object header isn't
|
|
// big enough to handle all attributes of an expectation. So
|
|
// we'll for sure specify optional attributes + parent attributes
|
|
// that are required for valid object comparison. Comparison of
|
|
// these parent attributes will include nested attributes.
|
|
|
|
/** @cond SKIP */
|
|
#define EXP_ATTR_FAMILY (1UL << 0) // 8-bit
|
|
#define EXP_ATTR_TIMEOUT (1UL << 1) // 32-bit
|
|
#define EXP_ATTR_ID (1UL << 2) // 32-bit
|
|
#define EXP_ATTR_HELPER_NAME (1UL << 3) // string
|
|
#define EXP_ATTR_ZONE (1UL << 4) // 16-bit
|
|
#define EXP_ATTR_FLAGS (1UL << 5) // 32-bit
|
|
#define EXP_ATTR_CLASS (1UL << 6) // 32-bit
|
|
#define EXP_ATTR_FN (1UL << 7) // String
|
|
// Tuples
|
|
#define EXP_ATTR_EXPECT_IP_SRC (1UL << 8)
|
|
#define EXP_ATTR_EXPECT_IP_DST (1UL << 9)
|
|
#define EXP_ATTR_EXPECT_L4PROTO_NUM (1UL << 10)
|
|
#define EXP_ATTR_EXPECT_L4PROTO_PORTS (1UL << 11)
|
|
#define EXP_ATTR_EXPECT_L4PROTO_ICMP (1UL << 12)
|
|
#define EXP_ATTR_MASTER_IP_SRC (1UL << 13)
|
|
#define EXP_ATTR_MASTER_IP_DST (1UL << 14)
|
|
#define EXP_ATTR_MASTER_L4PROTO_NUM (1UL << 15)
|
|
#define EXP_ATTR_MASTER_L4PROTO_PORTS (1UL << 16)
|
|
#define EXP_ATTR_MASTER_L4PROTO_ICMP (1UL << 17)
|
|
#define EXP_ATTR_MASK_IP_SRC (1UL << 18)
|
|
#define EXP_ATTR_MASK_IP_DST (1UL << 19)
|
|
#define EXP_ATTR_MASK_L4PROTO_NUM (1UL << 20)
|
|
#define EXP_ATTR_MASK_L4PROTO_PORTS (1UL << 21)
|
|
#define EXP_ATTR_MASK_L4PROTO_ICMP (1UL << 22)
|
|
#define EXP_ATTR_NAT_IP_SRC (1UL << 23)
|
|
#define EXP_ATTR_NAT_IP_DST (1UL << 24)
|
|
#define EXP_ATTR_NAT_L4PROTO_NUM (1UL << 25)
|
|
#define EXP_ATTR_NAT_L4PROTO_PORTS (1UL << 26)
|
|
#define EXP_ATTR_NAT_L4PROTO_ICMP (1UL << 27)
|
|
#define EXP_ATTR_NAT_DIR (1UL << 28)
|
|
/** @endcond */
|
|
|
|
static void exp_free_data(struct nl_object *c)
|
|
{
|
|
struct nfnl_exp *exp = (struct nfnl_exp *) c;
|
|
|
|
if (exp == NULL)
|
|
return;
|
|
|
|
nl_addr_put(exp->exp_expect.src);
|
|
nl_addr_put(exp->exp_expect.dst);
|
|
nl_addr_put(exp->exp_master.src);
|
|
nl_addr_put(exp->exp_master.dst);
|
|
nl_addr_put(exp->exp_mask.src);
|
|
nl_addr_put(exp->exp_mask.dst);
|
|
nl_addr_put(exp->exp_nat.src);
|
|
nl_addr_put(exp->exp_nat.dst);
|
|
|
|
free(exp->exp_fn);
|
|
free(exp->exp_helper_name);
|
|
}
|
|
|
|
static int exp_clone(struct nl_object *_dst, struct nl_object *_src)
|
|
{
|
|
struct nfnl_exp *dst = (struct nfnl_exp *) _dst;
|
|
struct nfnl_exp *src = (struct nfnl_exp *) _src;
|
|
struct nl_addr *addr;
|
|
|
|
// Expectation
|
|
if (src->exp_expect.src) {
|
|
addr = nl_addr_clone(src->exp_expect.src);
|
|
if (!addr)
|
|
return -NLE_NOMEM;
|
|
dst->exp_expect.src = addr;
|
|
}
|
|
|
|
if (src->exp_expect.dst) {
|
|
addr = nl_addr_clone(src->exp_expect.dst);
|
|
if (!addr)
|
|
return -NLE_NOMEM;
|
|
dst->exp_expect.dst = addr;
|
|
}
|
|
|
|
// Master CT
|
|
if (src->exp_master.src) {
|
|
addr = nl_addr_clone(src->exp_master.src);
|
|
if (!addr)
|
|
return -NLE_NOMEM;
|
|
dst->exp_master.src = addr;
|
|
}
|
|
|
|
if (src->exp_master.dst) {
|
|
addr = nl_addr_clone(src->exp_master.dst);
|
|
if (!addr)
|
|
return -NLE_NOMEM;
|
|
dst->exp_master.dst = addr;
|
|
}
|
|
|
|
// Mask
|
|
if (src->exp_mask.src) {
|
|
addr = nl_addr_clone(src->exp_mask.src);
|
|
if (!addr)
|
|
return -NLE_NOMEM;
|
|
dst->exp_mask.src = addr;
|
|
}
|
|
|
|
if (src->exp_mask.dst) {
|
|
addr = nl_addr_clone(src->exp_mask.dst);
|
|
if (!addr)
|
|
return -NLE_NOMEM;
|
|
dst->exp_mask.dst = addr;
|
|
}
|
|
|
|
// NAT
|
|
if (src->exp_nat.src) {
|
|
addr = nl_addr_clone(src->exp_nat.src);
|
|
if (!addr)
|
|
return -NLE_NOMEM;
|
|
dst->exp_nat.src = addr;
|
|
}
|
|
|
|
if (src->exp_nat.dst) {
|
|
addr = nl_addr_clone(src->exp_nat.dst);
|
|
if (!addr)
|
|
return -NLE_NOMEM;
|
|
dst->exp_nat.dst = addr;
|
|
}
|
|
|
|
if (src->exp_fn)
|
|
dst->exp_fn = strdup(src->exp_fn);
|
|
|
|
if (src->exp_helper_name)
|
|
dst->exp_helper_name = strdup(src->exp_helper_name);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static void dump_addr(struct nl_dump_params *p, struct nl_addr *addr, int port)
|
|
{
|
|
char buf[64];
|
|
|
|
if (addr)
|
|
nl_dump(p, "%s", nl_addr2str(addr, buf, sizeof(buf)));
|
|
|
|
if (port)
|
|
nl_dump(p, ":%u ", port);
|
|
else if (addr)
|
|
nl_dump(p, " ");
|
|
}
|
|
|
|
static void dump_icmp(struct nl_dump_params *p, struct nfnl_exp *exp, int tuple)
|
|
{
|
|
if (nfnl_exp_test_icmp(exp, tuple)) {
|
|
|
|
nl_dump(p, "icmp type %d ", nfnl_exp_get_icmp_type(exp, tuple));
|
|
|
|
nl_dump(p, "code %d ", nfnl_exp_get_icmp_code(exp, tuple));
|
|
|
|
nl_dump(p, "id %d ", nfnl_exp_get_icmp_id(exp, tuple));
|
|
}
|
|
}
|
|
|
|
static void exp_dump_tuples(struct nfnl_exp *exp, struct nl_dump_params *p)
|
|
{
|
|
struct nl_addr *tuple_src, *tuple_dst;
|
|
int tuple_sport, tuple_dport;
|
|
int i = 0;
|
|
char buf[64];
|
|
|
|
for (i = NFNL_EXP_TUPLE_EXPECT; i < NFNL_EXP_TUPLE_MAX; i++) {
|
|
tuple_src = NULL;
|
|
tuple_dst = NULL;
|
|
tuple_sport = 0;
|
|
tuple_dport = 0;
|
|
|
|
// Test needed for NAT case
|
|
if (nfnl_exp_test_src(exp, i))
|
|
tuple_src = nfnl_exp_get_src(exp, i);
|
|
if (nfnl_exp_test_dst(exp, i))
|
|
tuple_dst = nfnl_exp_get_dst(exp, i);
|
|
|
|
// Don't have tests for individual ports/types/codes/ids,
|
|
if (nfnl_exp_test_l4protonum(exp, i)) {
|
|
nl_dump(p, "%s ",
|
|
nl_ip_proto2str(nfnl_exp_get_l4protonum(exp, i), buf, sizeof(buf)));
|
|
}
|
|
|
|
if (nfnl_exp_test_ports(exp, i)) {
|
|
tuple_sport = nfnl_exp_get_src_port(exp, i);
|
|
tuple_dport = nfnl_exp_get_dst_port(exp, i);
|
|
}
|
|
|
|
dump_addr(p, tuple_src, tuple_sport);
|
|
dump_addr(p, tuple_dst, tuple_dport);
|
|
dump_icmp(p, exp, 0);
|
|
}
|
|
|
|
if (nfnl_exp_test_nat_dir(exp))
|
|
nl_dump(p, "nat dir %s ", exp->exp_nat_dir);
|
|
|
|
}
|
|
|
|
/* FIXME Compatible with /proc/net/nf_conntrack */
|
|
static void exp_dump_line(struct nl_object *a, struct nl_dump_params *p)
|
|
{
|
|
struct nfnl_exp *exp = (struct nfnl_exp *) a;
|
|
|
|
nl_new_line(p);
|
|
|
|
exp_dump_tuples(exp, p);
|
|
|
|
nl_dump(p, "\n");
|
|
}
|
|
|
|
static void exp_dump_details(struct nl_object *a, struct nl_dump_params *p)
|
|
{
|
|
struct nfnl_exp *exp = (struct nfnl_exp *) a;
|
|
char buf[64];
|
|
int fp = 0;
|
|
|
|
exp_dump_line(a, p);
|
|
|
|
nl_dump(p, " id 0x%x ", exp->exp_id);
|
|
nl_dump_line(p, "family %s ",
|
|
nl_af2str(exp->exp_family, buf, sizeof(buf)));
|
|
|
|
if (nfnl_exp_test_timeout(exp)) {
|
|
uint64_t timeout_ms = nfnl_exp_get_timeout(exp) * 1000UL;
|
|
nl_dump(p, "timeout %s ",
|
|
nl_msec2str(timeout_ms, buf, sizeof(buf)));
|
|
}
|
|
|
|
if (nfnl_exp_test_helper_name(exp))
|
|
nl_dump(p, "helper %s ", exp->exp_helper_name);
|
|
|
|
if (nfnl_exp_test_fn(exp))
|
|
nl_dump(p, "fn %s ", exp->exp_fn);
|
|
|
|
if (nfnl_exp_test_class(exp))
|
|
nl_dump(p, "class %u ", nfnl_exp_get_class(exp));
|
|
|
|
if (nfnl_exp_test_zone(exp))
|
|
nl_dump(p, "zone %u ", nfnl_exp_get_zone(exp));
|
|
|
|
if (nfnl_exp_test_flags(exp))
|
|
nl_dump(p, "<");
|
|
#define PRINT_FLAG(str) \
|
|
{ nl_dump(p, "%s%s", fp++ ? "," : "", (str)); }
|
|
|
|
if (exp->exp_flags & NF_CT_EXPECT_PERMANENT)
|
|
PRINT_FLAG("PERMANENT");
|
|
if (exp->exp_flags & NF_CT_EXPECT_INACTIVE)
|
|
PRINT_FLAG("INACTIVE");
|
|
if (exp->exp_flags & NF_CT_EXPECT_USERSPACE)
|
|
PRINT_FLAG("USERSPACE");
|
|
#undef PRINT_FLAG
|
|
|
|
if (nfnl_exp_test_flags(exp))
|
|
nl_dump(p, ">");
|
|
|
|
nl_dump(p, "\n");
|
|
}
|
|
|
|
static int exp_cmp_l4proto_ports (union nfnl_exp_protodata *a, union nfnl_exp_protodata *b) {
|
|
// Must return 0 for match, 1 for mismatch
|
|
int d = 0;
|
|
d = ( (a->port.src != b->port.src) ||
|
|
(a->port.dst != b->port.dst) );
|
|
|
|
return d;
|
|
}
|
|
|
|
static int exp_cmp_l4proto_icmp (union nfnl_exp_protodata *a, union nfnl_exp_protodata *b) {
|
|
// Must return 0 for match, 1 for mismatch
|
|
int d = 0;
|
|
d = ( (a->icmp.code != b->icmp.code) ||
|
|
(a->icmp.type != b->icmp.type) ||
|
|
(a->icmp.id != b->icmp.id) );
|
|
|
|
return d;
|
|
}
|
|
|
|
static int exp_compare(struct nl_object *_a, struct nl_object *_b,
|
|
uint32_t attrs, int flags)
|
|
{
|
|
struct nfnl_exp *a = (struct nfnl_exp *) _a;
|
|
struct nfnl_exp *b = (struct nfnl_exp *) _b;
|
|
int diff = 0;
|
|
|
|
#define EXP_DIFF(ATTR, EXPR) ATTR_DIFF(attrs, EXP_ATTR_##ATTR, a, b, EXPR)
|
|
#define EXP_DIFF_VAL(ATTR, FIELD) EXP_DIFF(ATTR, a->FIELD != b->FIELD)
|
|
#define EXP_DIFF_STRING(ATTR, FIELD) EXP_DIFF(ATTR, (strcmp(a->FIELD, b->FIELD) != 0))
|
|
#define EXP_DIFF_ADDR(ATTR, FIELD) \
|
|
((flags & LOOSE_COMPARISON) \
|
|
? EXP_DIFF(ATTR, nl_addr_cmp_prefix(a->FIELD, b->FIELD)) \
|
|
: EXP_DIFF(ATTR, nl_addr_cmp(a->FIELD, b->FIELD)))
|
|
#define EXP_DIFF_L4PROTO_PORTS(ATTR, FIELD) \
|
|
EXP_DIFF(ATTR, exp_cmp_l4proto_ports(&(a->FIELD), &(b->FIELD)))
|
|
#define EXP_DIFF_L4PROTO_ICMP(ATTR, FIELD) \
|
|
EXP_DIFF(ATTR, exp_cmp_l4proto_icmp(&(a->FIELD), &(b->FIELD)))
|
|
|
|
diff |= EXP_DIFF_VAL(FAMILY, exp_family);
|
|
diff |= EXP_DIFF_VAL(TIMEOUT, exp_timeout);
|
|
diff |= EXP_DIFF_VAL(ID, exp_id);
|
|
diff |= EXP_DIFF_VAL(ZONE, exp_zone);
|
|
diff |= EXP_DIFF_VAL(CLASS, exp_class);
|
|
diff |= EXP_DIFF_VAL(FLAGS, exp_flags);
|
|
diff |= EXP_DIFF_VAL(NAT_DIR, exp_nat_dir);
|
|
|
|
diff |= EXP_DIFF_STRING(FN, exp_fn);
|
|
diff |= EXP_DIFF_STRING(HELPER_NAME, exp_helper_name);
|
|
|
|
diff |= EXP_DIFF_ADDR(EXPECT_IP_SRC, exp_expect.src);
|
|
diff |= EXP_DIFF_ADDR(EXPECT_IP_DST, exp_expect.dst);
|
|
diff |= EXP_DIFF_VAL(EXPECT_L4PROTO_NUM, exp_expect.proto.l4protonum);
|
|
diff |= EXP_DIFF_L4PROTO_PORTS(EXPECT_L4PROTO_PORTS, exp_expect.proto.l4protodata);
|
|
diff |= EXP_DIFF_L4PROTO_ICMP(EXPECT_L4PROTO_ICMP, exp_expect.proto.l4protodata);
|
|
|
|
diff |= EXP_DIFF_ADDR(MASTER_IP_SRC, exp_master.src);
|
|
diff |= EXP_DIFF_ADDR(MASTER_IP_DST, exp_master.dst);
|
|
diff |= EXP_DIFF_VAL(MASTER_L4PROTO_NUM, exp_master.proto.l4protonum);
|
|
diff |= EXP_DIFF_L4PROTO_PORTS(MASTER_L4PROTO_PORTS, exp_master.proto.l4protodata);
|
|
diff |= EXP_DIFF_L4PROTO_ICMP(MASTER_L4PROTO_ICMP, exp_master.proto.l4protodata);
|
|
|
|
diff |= EXP_DIFF_ADDR(MASK_IP_SRC, exp_mask.src);
|
|
diff |= EXP_DIFF_ADDR(MASK_IP_DST, exp_mask.dst);
|
|
diff |= EXP_DIFF_VAL(MASK_L4PROTO_NUM, exp_mask.proto.l4protonum);
|
|
diff |= EXP_DIFF_L4PROTO_PORTS(MASK_L4PROTO_PORTS, exp_mask.proto.l4protodata);
|
|
diff |= EXP_DIFF_L4PROTO_ICMP(MASK_L4PROTO_ICMP, exp_mask.proto.l4protodata);
|
|
|
|
diff |= EXP_DIFF_ADDR(NAT_IP_SRC, exp_nat.src);
|
|
diff |= EXP_DIFF_ADDR(NAT_IP_DST, exp_nat.dst);
|
|
diff |= EXP_DIFF_VAL(NAT_L4PROTO_NUM, exp_nat.proto.l4protonum);
|
|
diff |= EXP_DIFF_L4PROTO_PORTS(NAT_L4PROTO_PORTS, exp_nat.proto.l4protodata);
|
|
diff |= EXP_DIFF_L4PROTO_ICMP(NAT_L4PROTO_ICMP, exp_nat.proto.l4protodata);
|
|
|
|
#undef EXP_DIFF
|
|
#undef EXP_DIFF_VAL
|
|
#undef EXP_DIFF_STRING
|
|
#undef EXP_DIFF_ADDR
|
|
#undef EXP_DIFF_L4PROTO_PORTS
|
|
#undef EXP_DIFF_L4PROTO_ICMP
|
|
|
|
return diff;
|
|
}
|
|
|
|
// CLI arguments?
|
|
static const struct trans_tbl exp_attrs[] = {
|
|
__ADD(EXP_ATTR_FAMILY, family)
|
|
__ADD(EXP_ATTR_TIMEOUT, timeout)
|
|
__ADD(EXP_ATTR_ID, id)
|
|
__ADD(EXP_ATTR_HELPER_NAME, helpername)
|
|
__ADD(EXP_ATTR_ZONE, zone)
|
|
__ADD(EXP_ATTR_CLASS, class)
|
|
__ADD(EXP_ATTR_FLAGS, flags)
|
|
__ADD(EXP_ATTR_FN, function)
|
|
__ADD(EXP_ATTR_EXPECT_IP_SRC, expectipsrc)
|
|
__ADD(EXP_ATTR_EXPECT_IP_DST, expectipdst)
|
|
__ADD(EXP_ATTR_EXPECT_L4PROTO_NUM, expectprotonum)
|
|
__ADD(EXP_ATTR_EXPECT_L4PROTO_PORTS, expectports)
|
|
__ADD(EXP_ATTR_EXPECT_L4PROTO_ICMP, expecticmp)
|
|
__ADD(EXP_ATTR_MASTER_IP_SRC, masteripsrc)
|
|
__ADD(EXP_ATTR_MASTER_IP_DST, masteripdst)
|
|
__ADD(EXP_ATTR_MASTER_L4PROTO_NUM, masterprotonum)
|
|
__ADD(EXP_ATTR_MASTER_L4PROTO_PORTS, masterports)
|
|
__ADD(EXP_ATTR_MASTER_L4PROTO_ICMP, mastericmp)
|
|
__ADD(EXP_ATTR_MASK_IP_SRC, maskipsrc)
|
|
__ADD(EXP_ATTR_MASK_IP_DST, maskipdst)
|
|
__ADD(EXP_ATTR_MASK_L4PROTO_NUM, maskprotonum)
|
|
__ADD(EXP_ATTR_MASK_L4PROTO_PORTS, maskports)
|
|
__ADD(EXP_ATTR_MASK_L4PROTO_ICMP, maskicmp)
|
|
__ADD(EXP_ATTR_NAT_IP_SRC, natipsrc)
|
|
__ADD(EXP_ATTR_NAT_IP_DST, natipdst)
|
|
__ADD(EXP_ATTR_NAT_L4PROTO_NUM, natprotonum)
|
|
__ADD(EXP_ATTR_NAT_L4PROTO_PORTS, natports)
|
|
__ADD(EXP_ATTR_NAT_L4PROTO_ICMP, naticmp)
|
|
__ADD(EXP_ATTR_NAT_DIR, natdir)
|
|
};
|
|
|
|
static char *exp_attrs2str(int attrs, char *buf, size_t len)
|
|
{
|
|
return __flags2str(attrs, buf, len, exp_attrs, ARRAY_SIZE(exp_attrs));
|
|
}
|
|
|
|
/**
|
|
* @name Allocation/Freeing
|
|
* @{
|
|
*/
|
|
|
|
struct nfnl_exp *nfnl_exp_alloc(void)
|
|
{
|
|
return (struct nfnl_exp *) nl_object_alloc(&exp_obj_ops);
|
|
}
|
|
|
|
void nfnl_exp_get(struct nfnl_exp *exp)
|
|
{
|
|
nl_object_get((struct nl_object *) exp);
|
|
}
|
|
|
|
void nfnl_exp_put(struct nfnl_exp *exp)
|
|
{
|
|
nl_object_put((struct nl_object *) exp);
|
|
}
|
|
|
|
/** @} */
|
|
|
|
/**
|
|
* @name Attributes
|
|
* @{
|
|
*/
|
|
|
|
void nfnl_exp_set_family(struct nfnl_exp *exp, uint8_t family)
|
|
{
|
|
exp->exp_family = family;
|
|
exp->ce_mask |= EXP_ATTR_FAMILY;
|
|
}
|
|
|
|
uint8_t nfnl_exp_get_family(const struct nfnl_exp *exp)
|
|
{
|
|
if (exp->ce_mask & EXP_ATTR_FAMILY)
|
|
return exp->exp_family;
|
|
else
|
|
return AF_UNSPEC;
|
|
}
|
|
|
|
void nfnl_exp_set_flags(struct nfnl_exp *exp, uint32_t flags)
|
|
{
|
|
exp->exp_flags |= flags;
|
|
exp->ce_mask |= EXP_ATTR_FLAGS;
|
|
}
|
|
|
|
int nfnl_exp_test_flags(const struct nfnl_exp *exp)
|
|
{
|
|
return !!(exp->ce_mask & EXP_ATTR_FLAGS);
|
|
}
|
|
|
|
void nfnl_exp_unset_flags(struct nfnl_exp *exp, uint32_t flags)
|
|
{
|
|
exp->exp_flags &= ~flags;
|
|
exp->ce_mask |= EXP_ATTR_FLAGS;
|
|
}
|
|
|
|
uint32_t nfnl_exp_get_flags(const struct nfnl_exp *exp)
|
|
{
|
|
return exp->exp_flags;
|
|
}
|
|
|
|
static const struct trans_tbl flag_table[] = {
|
|
__ADD(IPS_EXPECTED, expected)
|
|
__ADD(IPS_SEEN_REPLY, seen_reply)
|
|
__ADD(IPS_ASSURED, assured)
|
|
};
|
|
|
|
char * nfnl_exp_flags2str(int flags, char *buf, size_t len)
|
|
{
|
|
return __flags2str(flags, buf, len, flag_table,
|
|
ARRAY_SIZE(flag_table));
|
|
}
|
|
|
|
int nfnl_exp_str2flags(const char *name)
|
|
{
|
|
return __str2flags(name, flag_table, ARRAY_SIZE(flag_table));
|
|
}
|
|
|
|
void nfnl_exp_set_timeout(struct nfnl_exp *exp, uint32_t timeout)
|
|
{
|
|
exp->exp_timeout = timeout;
|
|
exp->ce_mask |= EXP_ATTR_TIMEOUT;
|
|
}
|
|
|
|
int nfnl_exp_test_timeout(const struct nfnl_exp *exp)
|
|
{
|
|
return !!(exp->ce_mask & EXP_ATTR_TIMEOUT);
|
|
}
|
|
|
|
uint32_t nfnl_exp_get_timeout(const struct nfnl_exp *exp)
|
|
{
|
|
return exp->exp_timeout;
|
|
}
|
|
|
|
void nfnl_exp_set_id(struct nfnl_exp *exp, uint32_t id)
|
|
{
|
|
exp->exp_id = id;
|
|
exp->ce_mask |= EXP_ATTR_ID;
|
|
}
|
|
|
|
int nfnl_exp_test_id(const struct nfnl_exp *exp)
|
|
{
|
|
return !!(exp->ce_mask & EXP_ATTR_ID);
|
|
}
|
|
|
|
uint32_t nfnl_exp_get_id(const struct nfnl_exp *exp)
|
|
{
|
|
return exp->exp_id;
|
|
}
|
|
|
|
int nfnl_exp_set_helper_name(struct nfnl_exp *exp, void *name)
|
|
{
|
|
free(exp->exp_helper_name);
|
|
exp->exp_helper_name = strdup(name);
|
|
if (!exp->exp_helper_name)
|
|
return -NLE_NOMEM;
|
|
|
|
exp->ce_mask |= EXP_ATTR_HELPER_NAME;
|
|
return 0;
|
|
}
|
|
|
|
int nfnl_exp_test_helper_name(const struct nfnl_exp *exp)
|
|
{
|
|
return !!(exp->ce_mask & EXP_ATTR_HELPER_NAME);
|
|
}
|
|
|
|
const char * nfnl_exp_get_helper_name(const struct nfnl_exp *exp)
|
|
{
|
|
return exp->exp_helper_name;
|
|
}
|
|
|
|
void nfnl_exp_set_zone(struct nfnl_exp *exp, uint16_t zone)
|
|
{
|
|
exp->exp_zone = zone;
|
|
exp->ce_mask |= EXP_ATTR_ZONE;
|
|
}
|
|
|
|
int nfnl_exp_test_zone(const struct nfnl_exp *exp)
|
|
{
|
|
return !!(exp->ce_mask & EXP_ATTR_ZONE);
|
|
}
|
|
|
|
uint16_t nfnl_exp_get_zone(const struct nfnl_exp *exp)
|
|
{
|
|
return exp->exp_zone;
|
|
}
|
|
|
|
void nfnl_exp_set_class(struct nfnl_exp *exp, uint32_t class)
|
|
{
|
|
exp->exp_class = class;
|
|
exp->ce_mask |= EXP_ATTR_CLASS;
|
|
}
|
|
|
|
int nfnl_exp_test_class(const struct nfnl_exp *exp)
|
|
{
|
|
return !!(exp->ce_mask & EXP_ATTR_CLASS);
|
|
}
|
|
|
|
uint32_t nfnl_exp_get_class(const struct nfnl_exp *exp)
|
|
{
|
|
return exp->exp_class;
|
|
}
|
|
|
|
int nfnl_exp_set_fn(struct nfnl_exp *exp, void *fn)
|
|
{
|
|
free(exp->exp_fn);
|
|
exp->exp_fn = strdup(fn);
|
|
if (!exp->exp_fn)
|
|
return -NLE_NOMEM;
|
|
|
|
exp->ce_mask |= EXP_ATTR_FN;
|
|
return 0;
|
|
}
|
|
|
|
int nfnl_exp_test_fn(const struct nfnl_exp *exp)
|
|
{
|
|
return !!(exp->ce_mask & EXP_ATTR_FN);
|
|
}
|
|
|
|
const char * nfnl_exp_get_fn(const struct nfnl_exp *exp)
|
|
{
|
|
return exp->exp_fn;
|
|
}
|
|
|
|
void nfnl_exp_set_nat_dir(struct nfnl_exp *exp, uint32_t nat_dir)
|
|
{
|
|
exp->exp_nat_dir = nat_dir;
|
|
exp->ce_mask |= EXP_ATTR_NAT_DIR;
|
|
}
|
|
|
|
int nfnl_exp_test_nat_dir(const struct nfnl_exp *exp)
|
|
{
|
|
return !!(exp->ce_mask & EXP_ATTR_NAT_DIR);
|
|
}
|
|
|
|
uint32_t nfnl_exp_get_nat_dir(const struct nfnl_exp *exp)
|
|
{
|
|
return exp->exp_nat_dir;
|
|
}
|
|
|
|
#define EXP_GET_TUPLE(e, t) \
|
|
(t == NFNL_EXP_TUPLE_MASTER) ? \
|
|
&(e->exp_master) : \
|
|
(t == NFNL_EXP_TUPLE_MASK) ? \
|
|
&(e->exp_mask) : \
|
|
(t == NFNL_EXP_TUPLE_NAT) ? \
|
|
&(e->exp_nat) : &(exp->exp_expect)
|
|
|
|
static int exp_get_src_attr(int tuple)
|
|
{
|
|
int attr = 0;
|
|
|
|
switch (tuple) {
|
|
case NFNL_EXP_TUPLE_MASTER:
|
|
attr = EXP_ATTR_MASTER_IP_SRC;
|
|
break;
|
|
case NFNL_EXP_TUPLE_MASK:
|
|
attr = EXP_ATTR_MASK_IP_SRC;
|
|
break;
|
|
case NFNL_EXP_TUPLE_NAT:
|
|
attr = EXP_ATTR_NAT_IP_SRC;
|
|
break;
|
|
case NFNL_EXP_TUPLE_EXPECT:
|
|
default :
|
|
attr = EXP_ATTR_EXPECT_IP_SRC;
|
|
}
|
|
|
|
return attr;
|
|
}
|
|
|
|
static int exp_get_dst_attr(int tuple)
|
|
{
|
|
int attr = 0;
|
|
|
|
switch (tuple) {
|
|
case NFNL_EXP_TUPLE_MASTER:
|
|
attr = EXP_ATTR_MASTER_IP_DST;
|
|
break;
|
|
case NFNL_EXP_TUPLE_MASK:
|
|
attr = EXP_ATTR_MASK_IP_DST;
|
|
break;
|
|
case NFNL_EXP_TUPLE_NAT:
|
|
attr = EXP_ATTR_NAT_IP_DST;
|
|
break;
|
|
case NFNL_EXP_TUPLE_EXPECT:
|
|
default :
|
|
attr = EXP_ATTR_EXPECT_IP_DST;
|
|
}
|
|
|
|
return attr;
|
|
}
|
|
|
|
|
|
static int exp_set_addr(struct nfnl_exp *exp, struct nl_addr *addr,
|
|
int attr, struct nl_addr ** exp_addr)
|
|
{
|
|
if (exp->ce_mask & EXP_ATTR_FAMILY) {
|
|
if (addr->a_family != exp->exp_family)
|
|
return -NLE_AF_MISMATCH;
|
|
} else
|
|
nfnl_exp_set_family(exp, addr->a_family);
|
|
|
|
if (*exp_addr)
|
|
nl_addr_put(*exp_addr);
|
|
|
|
nl_addr_get(addr);
|
|
*exp_addr = addr;
|
|
exp->ce_mask |= attr;
|
|
|
|
return 0;
|
|
}
|
|
|
|
int nfnl_exp_set_src(struct nfnl_exp *exp, int tuple, struct nl_addr *addr)
|
|
{
|
|
struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);
|
|
|
|
return exp_set_addr(exp, addr, exp_get_src_attr(tuple), &dir->src);
|
|
}
|
|
|
|
int nfnl_exp_set_dst(struct nfnl_exp *exp, int tuple, struct nl_addr *addr)
|
|
{
|
|
struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);
|
|
|
|
return exp_set_addr(exp, addr, exp_get_dst_attr(tuple), &dir->dst);
|
|
}
|
|
|
|
int nfnl_exp_test_src(const struct nfnl_exp *exp, int tuple)
|
|
{
|
|
return !!(exp->ce_mask & exp_get_src_attr(tuple));
|
|
}
|
|
|
|
int nfnl_exp_test_dst(const struct nfnl_exp *exp, int tuple)
|
|
{
|
|
return !!(exp->ce_mask & exp_get_dst_attr(tuple));
|
|
}
|
|
|
|
struct nl_addr *nfnl_exp_get_src(const struct nfnl_exp *exp, int tuple)
|
|
{
|
|
const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);
|
|
|
|
if (!(exp->ce_mask & exp_get_src_attr(tuple)))
|
|
return NULL;
|
|
return dir->src;
|
|
}
|
|
|
|
struct nl_addr *nfnl_exp_get_dst(const struct nfnl_exp *exp, int tuple)
|
|
{
|
|
const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);
|
|
|
|
if (!(exp->ce_mask & exp_get_dst_attr(tuple)))
|
|
return NULL;
|
|
return dir->dst;
|
|
}
|
|
|
|
static int exp_get_l4protonum_attr(int tuple)
|
|
{
|
|
int attr = 0;
|
|
|
|
switch (tuple) {
|
|
case NFNL_EXP_TUPLE_MASTER:
|
|
attr = EXP_ATTR_MASTER_L4PROTO_NUM;
|
|
break;
|
|
case NFNL_EXP_TUPLE_MASK:
|
|
attr = EXP_ATTR_MASK_L4PROTO_NUM;
|
|
break;
|
|
case NFNL_EXP_TUPLE_NAT:
|
|
attr = EXP_ATTR_NAT_L4PROTO_NUM;
|
|
break;
|
|
case NFNL_EXP_TUPLE_EXPECT:
|
|
default :
|
|
attr = EXP_ATTR_EXPECT_L4PROTO_NUM;
|
|
}
|
|
|
|
return attr;
|
|
}
|
|
|
|
void nfnl_exp_set_l4protonum(struct nfnl_exp *exp, int tuple, uint8_t l4protonum)
|
|
{
|
|
struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);
|
|
|
|
dir->proto.l4protonum = l4protonum;
|
|
exp->ce_mask |= exp_get_l4protonum_attr(tuple);
|
|
}
|
|
|
|
int nfnl_exp_test_l4protonum(const struct nfnl_exp *exp, int tuple)
|
|
{
|
|
return !!(exp->ce_mask & exp_get_l4protonum_attr(tuple));
|
|
}
|
|
|
|
uint8_t nfnl_exp_get_l4protonum(const struct nfnl_exp *exp, int tuple)
|
|
{
|
|
const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);
|
|
return dir->proto.l4protonum;
|
|
}
|
|
|
|
static int exp_get_l4ports_attr(int tuple)
|
|
{
|
|
int attr = 0;
|
|
|
|
switch (tuple) {
|
|
case NFNL_EXP_TUPLE_MASTER:
|
|
attr = EXP_ATTR_MASTER_L4PROTO_PORTS;
|
|
break;
|
|
case NFNL_EXP_TUPLE_MASK:
|
|
attr = EXP_ATTR_MASK_L4PROTO_PORTS;
|
|
break;
|
|
case NFNL_EXP_TUPLE_NAT:
|
|
attr = EXP_ATTR_NAT_L4PROTO_PORTS;
|
|
break;
|
|
case NFNL_EXP_TUPLE_EXPECT:
|
|
default :
|
|
attr = EXP_ATTR_EXPECT_L4PROTO_PORTS;
|
|
}
|
|
|
|
return attr;
|
|
}
|
|
|
|
void nfnl_exp_set_ports(struct nfnl_exp *exp, int tuple, uint16_t srcport, uint16_t dstport)
|
|
{
|
|
struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);
|
|
|
|
dir->proto.l4protodata.port.src = srcport;
|
|
dir->proto.l4protodata.port.dst = dstport;
|
|
|
|
exp->ce_mask |= exp_get_l4ports_attr(tuple);
|
|
}
|
|
|
|
int nfnl_exp_test_ports(const struct nfnl_exp *exp, int tuple)
|
|
{
|
|
return !!(exp->ce_mask & exp_get_l4ports_attr(tuple));
|
|
}
|
|
|
|
uint16_t nfnl_exp_get_src_port(const struct nfnl_exp *exp, int tuple)
|
|
{
|
|
const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);
|
|
return dir->proto.l4protodata.port.src;
|
|
}
|
|
|
|
uint16_t nfnl_exp_get_dst_port(const struct nfnl_exp *exp, int tuple)
|
|
{
|
|
const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);
|
|
|
|
return dir->proto.l4protodata.port.dst;
|
|
}
|
|
|
|
static int exp_get_l4icmp_attr(int tuple)
|
|
{
|
|
int attr = 0;
|
|
|
|
switch (tuple) {
|
|
case NFNL_EXP_TUPLE_MASTER:
|
|
attr = EXP_ATTR_MASTER_L4PROTO_ICMP;
|
|
break;
|
|
case NFNL_EXP_TUPLE_MASK:
|
|
attr = EXP_ATTR_MASK_L4PROTO_ICMP;
|
|
break;
|
|
case NFNL_EXP_TUPLE_NAT:
|
|
attr = EXP_ATTR_NAT_L4PROTO_ICMP;
|
|
break;
|
|
case NFNL_EXP_TUPLE_EXPECT:
|
|
default :
|
|
attr = EXP_ATTR_EXPECT_L4PROTO_ICMP;
|
|
}
|
|
|
|
return attr;
|
|
}
|
|
|
|
void nfnl_exp_set_icmp(struct nfnl_exp *exp, int tuple, uint16_t id, uint8_t type, uint8_t code)
|
|
{
|
|
struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);
|
|
|
|
dir->proto.l4protodata.icmp.id = id;
|
|
dir->proto.l4protodata.icmp.type = type;
|
|
dir->proto.l4protodata.icmp.code = code;
|
|
|
|
exp->ce_mask |= exp_get_l4icmp_attr(tuple);
|
|
}
|
|
|
|
int nfnl_exp_test_icmp(const struct nfnl_exp *exp, int tuple)
|
|
{
|
|
int attr = exp_get_l4icmp_attr(tuple);
|
|
return !!(exp->ce_mask & attr);
|
|
}
|
|
|
|
uint16_t nfnl_exp_get_icmp_id(const struct nfnl_exp *exp, int tuple)
|
|
{
|
|
const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);
|
|
|
|
return dir->proto.l4protodata.icmp.id;
|
|
}
|
|
|
|
uint8_t nfnl_exp_get_icmp_type(const struct nfnl_exp *exp, int tuple)
|
|
{
|
|
const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);
|
|
|
|
return dir->proto.l4protodata.icmp.type;
|
|
}
|
|
|
|
uint8_t nfnl_exp_get_icmp_code(const struct nfnl_exp *exp, int tuple)
|
|
{
|
|
const struct nfnl_exp_dir *dir = EXP_GET_TUPLE(exp, tuple);
|
|
|
|
return dir->proto.l4protodata.icmp.code;
|
|
}
|
|
|
|
/** @} */
|
|
|
|
struct nl_object_ops exp_obj_ops = {
|
|
.oo_name = "netfilter/exp",
|
|
.oo_size = sizeof(struct nfnl_exp),
|
|
.oo_free_data = exp_free_data,
|
|
.oo_clone = exp_clone,
|
|
.oo_dump = {
|
|
[NL_DUMP_LINE] = exp_dump_line,
|
|
[NL_DUMP_DETAILS] = exp_dump_details,
|
|
},
|
|
.oo_compare = exp_compare,
|
|
.oo_attrs2str = exp_attrs2str,
|
|
};
|
|
|
|
/** @} */
|