Connection Tracking

Interface to linux netfilter connection tracking. More...

Files
file	nf_ctrack.c
	linux Netfilter Connection Tracking

Data Structures
struct	nfct_struct

Typedefs
typedef struct nfct_struct	nfct_struct
	Forward decleration of structure. More...

Enumerations
enum	NF_CTRACK_FLAGS { NFCTRACK_DONE = 1 << 0 }
	Netfilter Ctrack Flags. More...

Functions
uint8_t	nf_ctrack_init (void)
struct nf_conntrack *	nf_ctrack_buildct (uint8_t *pkt)
uint8_t	nf_ctrack_delete (uint8_t *pkt)
uint8_t	nf_ctrack_nat (uint8_t *pkt, uint32_t addr, uint16_t port, uint8_t dnat)
void	nf_ctrack_dump (void)
struct nfct_struct *	nf_ctrack_trace (void)
void	nf_ctrack_endtrace (struct nfct_struct *nfct)
void	nf_ctrack_close (void)

Detailed Description

Interface to linux netfilter connection tracking.

Typedef Documentation

typedef struct nfct_struct nfct_struct

Forward decleration of structure.

Definition at line 205 of file dtsapp.h.

Enumeration Type Documentation

enum NF_CTRACK_FLAGS

Netfilter Ctrack Flags.

Enumerator
NFCTRACK_DONE

Definition at line 44 of file nf_ctrack.c.

                     {
    NFCTRACK_DONE    = 1 << 0
};

Function Documentation

struct nf_conntrack* nf_ctrack_buildct

(

uint8_t *

pkt

)

Definition at line 97 of file nf_ctrack.c.

Referenced by nf_ctrack_delete(), and nf_ctrack_nat().

                                                            {
    struct nf_conntrack *ct;
    struct iphdr *ip = (struct iphdr *)pkt;
    union l4hdr *l4 = (union l4hdr *)(pkt + (ip->ihl * 4));

    if (!(ct = nfct_new())) {
        return (NULL);
    };

    /*Build tuple*/
    nfct_set_attr_u8(ct, ATTR_L3PROTO, PF_INET);
    nfct_set_attr_u32(ct, ATTR_IPV4_SRC, ip->saddr);
    nfct_set_attr_u32(ct, ATTR_IPV4_DST, ip->daddr);
    nfct_set_attr_u8(ct, ATTR_L4PROTO, ip->protocol);
    switch(ip->protocol) {
        case IPPROTO_TCP:
            nfct_set_attr_u16(ct, ATTR_PORT_SRC, l4->tcp.source);
            nfct_set_attr_u16(ct, ATTR_PORT_DST, l4->tcp.dest);
            break;
        case IPPROTO_UDP:
            nfct_set_attr_u16(ct, ATTR_PORT_SRC, l4->udp.source);
            nfct_set_attr_u16(ct, ATTR_PORT_DST, l4->udp.dest);
            break;
        case IPPROTO_ICMP:
            nfct_set_attr_u8(ct, ATTR_ICMP_TYPE, l4->icmp.type);
            nfct_set_attr_u8(ct, ATTR_ICMP_CODE, l4->icmp.code);
            nfct_set_attr_u16(ct, ATTR_ICMP_ID, l4->icmp.un.echo.id);
            /* no break */
        default
                :
            break;
    };

    return (ct);
}

void nf_ctrack_close

(

void

)

Definition at line 285 of file nf_ctrack.c.

References objunref().

Referenced by nf_ctrack_delete(), nf_ctrack_dump(), and nf_ctrack_nat().

                                  {
    if (ctrack) {
        objunref(ctrack);
    }
    ctrack = NULL;
}

uint8_t nf_ctrack_delete

(

uint8_t *

pkt

)

Definition at line 133 of file nf_ctrack.c.

References nf_ctrack_buildct(), nf_ctrack_close(), nf_ctrack_init(), objlock(), and objunlock().

                                              {
    struct nf_conntrack *ct;
    uint8_t unref = 0;
    uint8_t ret = 0;

    if (!ctrack) {
        if (nf_ctrack_init()) {
            return (-1);
        }
        unref = 1;
    }

    ct = nf_ctrack_buildct(pkt);
    objlock(ctrack);
    if (nfct_query(ctrack->nfct, NFCT_Q_DESTROY, ct) < 0) {
        ret = -1;
    }
    objunlock(ctrack);
    nfct_destroy(ct);

    if (unref) {
        nf_ctrack_close();
    }

    return (ret);
}

void nf_ctrack_dump

(

void

)

Definition at line 204 of file nf_ctrack.c.

References nf_ctrack_close(), nf_ctrack_init(), objlock(), and objunlock().

                                 {
    uint32_t family = PF_INET;
    uint8_t unref = 0;

    if (!ctrack) {
        if (nf_ctrack_init()) {
            return;
        }
        unref = 1;
    }

    objlock(ctrack);
    nfct_callback_register(ctrack->nfct, NFCT_T_ALL, nfct_cb, NULL);
    nfct_query(ctrack->nfct, NFCT_Q_DUMP, &family);
    nfct_callback_unregister(ctrack->nfct);
    objunlock(ctrack);

    if (unref) {
        nf_ctrack_close();
    }
}

void nf_ctrack_endtrace

(

struct nfct_struct *

nfct

)

Definition at line 278 of file nf_ctrack.c.

References NFCTRACK_DONE, objunref(), and setflag.

                                                         {
    if (nfct) {
        setflag(nfct, NFCTRACK_DONE);
    }
    objunref(nfct);
}

uint8_t nf_ctrack_init

(

void

)

Definition at line 90 of file nf_ctrack.c.

Referenced by nf_ctrack_delete(), nf_ctrack_dump(), and nf_ctrack_nat().

                                    {
    if (!ctrack && !(ctrack = nf_ctrack_alloc(CONNTRACK, 0))) {
        return (-1);
    }
    return (0);
}

uint8_t nf_ctrack_nat	(	uint8_t *	pkt,
		uint32_t	addr,
		uint16_t	port,
		uint8_t	dnat
	)

Definition at line 160 of file nf_ctrack.c.

References nf_ctrack_buildct(), nf_ctrack_close(), nf_ctrack_init(), objlock(), and objunlock().

                                                                                       {
    struct iphdr *ip = (struct iphdr *)pkt;
    struct nf_conntrack *ct;
    uint8_t unref = 0;
    uint8_t ret = 0;

    if (!ctrack) {
        if (nf_ctrack_init()) {
            return (-1);
        }
        unref = 1;
    }

    ct = nf_ctrack_buildct(pkt);
    nfct_setobjopt(ct, NFCT_SOPT_SETUP_REPLY);

    nfct_set_attr_u32(ct, ATTR_TIMEOUT, 120);
    nfct_set_attr_u32(ct, (dnat) ? ATTR_DNAT_IPV4 : ATTR_SNAT_IPV4, addr);

    switch(ip->protocol) {
        case IPPROTO_TCP:
            nfct_set_attr_u8(ct, ATTR_TCP_STATE, TCP_CONNTRACK_ESTABLISHED);
            /* no break */
        case IPPROTO_UDP:
            if (port) {
                nfct_set_attr_u16(ct, (dnat) ? ATTR_DNAT_PORT : ATTR_SNAT_PORT, port);
            }
            break;
    }

    objlock(ctrack);
    if (nfct_query(ctrack->nfct, NFCT_Q_CREATE_UPDATE, ct) < 0) {
        ret = -1;
    }
    objunlock(ctrack);
    nfct_destroy(ct);

    if (unref) {
        nf_ctrack_close();
    }

    return (ret);
}

struct nfct_struct* nf_ctrack_trace

(

void

)

Definition at line 261 of file nf_ctrack.c.

References framework_mkthread(), objunref(), and THREAD_OPTION_RETURN.

                                          {
    struct nfct_struct *nfct;
    void *thr;

    if (!(nfct = nf_ctrack_alloc(CONNTRACK, NFCT_ALL_CT_GROUPS))) {
        return (NULL);
    }

    if (!(thr = framework_mkthread(nf_ctrack_trace_th, NULL, NULL, nfct, THREAD_OPTION_RETURN))) {
        objunref(nfct);
        return NULL;
    }
    objunref(thr);

    return (nfct);
}