12f7a50533
There are good reasons to supports helpers in user-space instead:
* Rapid connection tracking helper development, as developing code
in user-space is usually faster.
* Reliability: A buggy helper does not crash the kernel. Moreover,
we can monitor the helper process and restart it in case of problems.
* Security: Avoid complex string matching and mangling in kernel-space
running in privileged mode. Going further, we can even think about
running user-space helpers as a non-root process.
* Extensibility: It allows the development of very specific helpers (most
likely non-standard proprietary protocols) that are very likely not to be
accepted for mainline inclusion in the form of kernel-space connection
tracking helpers.
This patch adds the infrastructure to allow the implementation of
user-space conntrack helpers by means of the new nfnetlink subsystem
`nfnetlink_cthelper' and the existing queueing infrastructure
(nfnetlink_queue).
I had to add the new hook NF_IP6_PRI_CONNTRACK_HELPER to register
ipv[4|6]_helper which results from splitting ipv[4|6]_confirm into
two pieces. This change is required not to break NAT sequence
adjustment and conntrack confirmation for traffic that is enqueued
to our user-space conntrack helpers.
Basic operation, in a few steps:
1) Register user-space helper by means of `nfct':
nfct helper add ftp inet tcp
[ It must be a valid existing helper supported by conntrack-tools ]
2) Add rules to enable the FTP user-space helper which is
used to track traffic going to TCP port 21.
For locally generated packets:
iptables -I OUTPUT -t raw -p tcp --dport 21 -j CT --helper ftp
For non-locally generated packets:
iptables -I PREROUTING -t raw -p tcp --dport 21 -j CT --helper ftp
3) Run the test conntrackd in helper mode (see example files under
doc/helper/conntrackd.conf
conntrackd
4) Generate FTP traffic going, if everything is OK, then conntrackd
should create expectations (you can check that with `conntrack':
conntrack -E expect
[NEW] 301 proto=6 src=192.168.1.136 dst=130.89.148.12 sport=0 dport=54037 mask-src=255.255.255.255 mask-dst=255.255.255.255 sport=0 dport=65535 master-src=192.168.1.136 master-dst=130.89.148.12 sport=57127 dport=21 class=0 helper=ftp
[DESTROY] 301 proto=6 src=192.168.1.136 dst=130.89.148.12 sport=0 dport=54037 mask-src=255.255.255.255 mask-dst=255.255.255.255 sport=0 dport=65535 master-src=192.168.1.136 master-dst=130.89.148.12 sport=57127 dport=21 class=0 helper=ftp
This confirms that our test helper is receiving packets including the
conntrack information, and adding expectations in kernel-space.
The user-space helper can also store its private tracking information
in the conntrack structure in the kernel via the CTA_HELP_INFO. The
kernel will consider this a binary blob whose layout is unknown. This
information will be included in the information that is transfered
to user-space via glue code that integrates nfnetlink_queue and
ctnetlink.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
97 lines
3 KiB
C
97 lines
3 KiB
C
#ifndef _NFNETLINK_H
|
|
#define _NFNETLINK_H
|
|
#include <linux/types.h>
|
|
#include <linux/netfilter/nfnetlink_compat.h>
|
|
|
|
enum nfnetlink_groups {
|
|
NFNLGRP_NONE,
|
|
#define NFNLGRP_NONE NFNLGRP_NONE
|
|
NFNLGRP_CONNTRACK_NEW,
|
|
#define NFNLGRP_CONNTRACK_NEW NFNLGRP_CONNTRACK_NEW
|
|
NFNLGRP_CONNTRACK_UPDATE,
|
|
#define NFNLGRP_CONNTRACK_UPDATE NFNLGRP_CONNTRACK_UPDATE
|
|
NFNLGRP_CONNTRACK_DESTROY,
|
|
#define NFNLGRP_CONNTRACK_DESTROY NFNLGRP_CONNTRACK_DESTROY
|
|
NFNLGRP_CONNTRACK_EXP_NEW,
|
|
#define NFNLGRP_CONNTRACK_EXP_NEW NFNLGRP_CONNTRACK_EXP_NEW
|
|
NFNLGRP_CONNTRACK_EXP_UPDATE,
|
|
#define NFNLGRP_CONNTRACK_EXP_UPDATE NFNLGRP_CONNTRACK_EXP_UPDATE
|
|
NFNLGRP_CONNTRACK_EXP_DESTROY,
|
|
#define NFNLGRP_CONNTRACK_EXP_DESTROY NFNLGRP_CONNTRACK_EXP_DESTROY
|
|
__NFNLGRP_MAX,
|
|
};
|
|
#define NFNLGRP_MAX (__NFNLGRP_MAX - 1)
|
|
|
|
/* General form of address family dependent message.
|
|
*/
|
|
struct nfgenmsg {
|
|
__u8 nfgen_family; /* AF_xxx */
|
|
__u8 version; /* nfnetlink version */
|
|
__be16 res_id; /* resource id */
|
|
};
|
|
|
|
#define NFNETLINK_V0 0
|
|
|
|
/* netfilter netlink message types are split in two pieces:
|
|
* 8 bit subsystem, 8bit operation.
|
|
*/
|
|
|
|
#define NFNL_SUBSYS_ID(x) ((x & 0xff00) >> 8)
|
|
#define NFNL_MSG_TYPE(x) (x & 0x00ff)
|
|
|
|
/* No enum here, otherwise __stringify() trick of MODULE_ALIAS_NFNL_SUBSYS()
|
|
* won't work anymore */
|
|
#define NFNL_SUBSYS_NONE 0
|
|
#define NFNL_SUBSYS_CTNETLINK 1
|
|
#define NFNL_SUBSYS_CTNETLINK_EXP 2
|
|
#define NFNL_SUBSYS_QUEUE 3
|
|
#define NFNL_SUBSYS_ULOG 4
|
|
#define NFNL_SUBSYS_OSF 5
|
|
#define NFNL_SUBSYS_IPSET 6
|
|
#define NFNL_SUBSYS_ACCT 7
|
|
#define NFNL_SUBSYS_CTNETLINK_TIMEOUT 8
|
|
#define NFNL_SUBSYS_CTHELPER 9
|
|
#define NFNL_SUBSYS_COUNT 10
|
|
|
|
#ifdef __KERNEL__
|
|
|
|
#include <linux/netlink.h>
|
|
#include <linux/capability.h>
|
|
#include <net/netlink.h>
|
|
|
|
struct nfnl_callback {
|
|
int (*call)(struct sock *nl, struct sk_buff *skb,
|
|
const struct nlmsghdr *nlh,
|
|
const struct nlattr * const cda[]);
|
|
int (*call_rcu)(struct sock *nl, struct sk_buff *skb,
|
|
const struct nlmsghdr *nlh,
|
|
const struct nlattr * const cda[]);
|
|
const struct nla_policy *policy; /* netlink attribute policy */
|
|
const u_int16_t attr_count; /* number of nlattr's */
|
|
};
|
|
|
|
struct nfnetlink_subsystem {
|
|
const char *name;
|
|
__u8 subsys_id; /* nfnetlink subsystem ID */
|
|
__u8 cb_count; /* number of callbacks */
|
|
const struct nfnl_callback *cb; /* callback for individual types */
|
|
};
|
|
|
|
extern int nfnetlink_subsys_register(const struct nfnetlink_subsystem *n);
|
|
extern int nfnetlink_subsys_unregister(const struct nfnetlink_subsystem *n);
|
|
|
|
extern int nfnetlink_has_listeners(struct net *net, unsigned int group);
|
|
extern int nfnetlink_send(struct sk_buff *skb, struct net *net, u32 pid, unsigned int group,
|
|
int echo, gfp_t flags);
|
|
extern int nfnetlink_set_err(struct net *net, u32 pid, u32 group, int error);
|
|
extern int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u_int32_t pid, int flags);
|
|
|
|
extern void nfnl_lock(void);
|
|
extern void nfnl_unlock(void);
|
|
|
|
#define MODULE_ALIAS_NFNL_SUBSYS(subsys) \
|
|
MODULE_ALIAS("nfnetlink-subsys-" __stringify(subsys))
|
|
|
|
#endif /* __KERNEL__ */
|
|
#endif /* _NFNETLINK_H */
|