libnl  3.5.0
ct_obj.c
1 /* SPDX-License-Identifier: LGPL-2.1-only */
2 /*
3  * lib/netfilter/ct_obj.c Conntrack Object
4  *
5  * This library is free software; you can redistribute it and/or
6  * modify it under the terms of the GNU Lesser General Public
7  * License as published by the Free Software Foundation version 2.1
8  * of the License.
9  *
10  * Copyright (c) 2003-2008 Thomas Graf <tgraf@suug.ch>
11  * Copyright (c) 2007 Philip Craig <philipc@snapgear.com>
12  * Copyright (c) 2007 Secure Computing Corporation
13  */
14 
15 #include <sys/types.h>
16 #include <linux/netfilter/nfnetlink_conntrack.h>
17 #include <linux/netfilter/nf_conntrack_common.h>
18 #include <linux/netfilter/nf_conntrack_tcp.h>
19 
20 #include <netlink-private/netlink.h>
21 #include <netlink/netfilter/nfnl.h>
22 #include <netlink/netfilter/ct.h>
23 
24 /** @cond SKIP */
25 #define CT_ATTR_FAMILY (1UL << 0)
26 #define CT_ATTR_PROTO (1UL << 1)
27 
28 #define CT_ATTR_TCP_STATE (1UL << 2)
29 
30 #define CT_ATTR_STATUS (1UL << 3)
31 #define CT_ATTR_TIMEOUT (1UL << 4)
32 #define CT_ATTR_MARK (1UL << 5)
33 #define CT_ATTR_USE (1UL << 6)
34 #define CT_ATTR_ID (1UL << 7)
35 
36 #define CT_ATTR_ORIG_SRC (1UL << 8)
37 #define CT_ATTR_ORIG_DST (1UL << 9)
38 #define CT_ATTR_ORIG_SRC_PORT (1UL << 10)
39 #define CT_ATTR_ORIG_DST_PORT (1UL << 11)
40 #define CT_ATTR_ORIG_ICMP_ID (1UL << 12)
41 #define CT_ATTR_ORIG_ICMP_TYPE (1UL << 13)
42 #define CT_ATTR_ORIG_ICMP_CODE (1UL << 14)
43 #define CT_ATTR_ORIG_PACKETS (1UL << 15)
44 #define CT_ATTR_ORIG_BYTES (1UL << 16)
45 
46 #define CT_ATTR_REPL_SRC (1UL << 17)
47 #define CT_ATTR_REPL_DST (1UL << 18)
48 #define CT_ATTR_REPL_SRC_PORT (1UL << 19)
49 #define CT_ATTR_REPL_DST_PORT (1UL << 20)
50 #define CT_ATTR_REPL_ICMP_ID (1UL << 21)
51 #define CT_ATTR_REPL_ICMP_TYPE (1UL << 22)
52 #define CT_ATTR_REPL_ICMP_CODE (1UL << 23)
53 #define CT_ATTR_REPL_PACKETS (1UL << 24)
54 #define CT_ATTR_REPL_BYTES (1UL << 25)
55 #define CT_ATTR_TIMESTAMP (1UL << 26)
56 #define CT_ATTR_ZONE (1UL << 27)
57 /** @endcond */
58 
59 static void ct_free_data(struct nl_object *c)
60 {
61  struct nfnl_ct *ct = (struct nfnl_ct *) c;
62 
63  if (ct == NULL)
64  return;
65 
66  nl_addr_put(ct->ct_orig.src);
67  nl_addr_put(ct->ct_orig.dst);
68  nl_addr_put(ct->ct_repl.src);
69  nl_addr_put(ct->ct_repl.dst);
70 }
71 
72 static int ct_clone(struct nl_object *_dst, struct nl_object *_src)
73 {
74  struct nfnl_ct *dst = (struct nfnl_ct *) _dst;
75  struct nfnl_ct *src = (struct nfnl_ct *) _src;
76  struct nl_addr *addr;
77 
78  if (src->ct_orig.src) {
79  addr = nl_addr_clone(src->ct_orig.src);
80  if (!addr)
81  return -NLE_NOMEM;
82  dst->ct_orig.src = addr;
83  }
84 
85  if (src->ct_orig.dst) {
86  addr = nl_addr_clone(src->ct_orig.dst);
87  if (!addr)
88  return -NLE_NOMEM;
89  dst->ct_orig.dst = addr;
90  }
91 
92  if (src->ct_repl.src) {
93  addr = nl_addr_clone(src->ct_repl.src);
94  if (!addr)
95  return -NLE_NOMEM;
96  dst->ct_repl.src = addr;
97  }
98 
99  if (src->ct_repl.dst) {
100  addr = nl_addr_clone(src->ct_repl.dst);
101  if (!addr)
102  return -NLE_NOMEM;
103  dst->ct_repl.dst = addr;
104  }
105 
106  return 0;
107 }
108 
109 static void dump_addr(struct nl_dump_params *p, struct nl_addr *addr, int port)
110 {
111  char buf[64];
112 
113  if (addr)
114  nl_dump(p, "%s", nl_addr2str(addr, buf, sizeof(buf)));
115 
116  if (port)
117  nl_dump(p, ":%u ", port);
118  else if (addr)
119  nl_dump(p, " ");
120 }
121 
122 static void dump_icmp(struct nl_dump_params *p, struct nfnl_ct *ct, int reply)
123 {
124  if (nfnl_ct_test_icmp_type(ct, reply))
125  nl_dump(p, "icmp type %d ", nfnl_ct_get_icmp_type(ct, reply));
126 
127  if (nfnl_ct_test_icmp_code(ct, reply))
128  nl_dump(p, "code %d ", nfnl_ct_get_icmp_code(ct, reply));
129 
130  if (nfnl_ct_test_icmp_id(ct, reply))
131  nl_dump(p, "id %d ", nfnl_ct_get_icmp_id(ct, reply));
132 }
133 
134 static void ct_dump_tuples(struct nfnl_ct *ct, struct nl_dump_params *p)
135 {
136  struct nl_addr *orig_src, *orig_dst, *reply_src, *reply_dst;
137  int orig_sport = 0, orig_dport = 0, reply_sport = 0, reply_dport = 0;
138  int sync = 0;
139 
140  orig_src = nfnl_ct_get_src(ct, 0);
141  orig_dst = nfnl_ct_get_dst(ct, 0);
142  reply_src = nfnl_ct_get_src(ct, 1);
143  reply_dst = nfnl_ct_get_dst(ct, 1);
144 
145  if (nfnl_ct_test_src_port(ct, 0))
146  orig_sport = nfnl_ct_get_src_port(ct, 0);
147 
148  if (nfnl_ct_test_dst_port(ct, 0))
149  orig_dport = nfnl_ct_get_dst_port(ct, 0);
150 
151  if (nfnl_ct_test_src_port(ct, 1))
152  reply_sport = nfnl_ct_get_src_port(ct, 1);
153 
154  if (nfnl_ct_test_dst_port(ct, 1))
155  reply_dport = nfnl_ct_get_dst_port(ct, 1);
156 
157  if (orig_src && orig_dst && reply_src && reply_dst &&
158  orig_sport == reply_dport && orig_dport == reply_sport &&
159  !nl_addr_cmp(orig_src, reply_dst) &&
160  !nl_addr_cmp(orig_dst, reply_src))
161  sync = 1;
162 
163  dump_addr(p, orig_src, orig_sport);
164  nl_dump(p, sync ? "<-> " : "-> ");
165  dump_addr(p, orig_dst, orig_dport);
166  dump_icmp(p, ct, 0);
167 
168  if (!sync) {
169  dump_addr(p, reply_src, reply_sport);
170  nl_dump(p, "<- ");
171  dump_addr(p, reply_dst, reply_dport);
172  dump_icmp(p, ct, 1);
173  }
174 }
175 
176 /* Compatible with /proc/net/nf_conntrack */
177 static void ct_dump_line(struct nl_object *a, struct nl_dump_params *p)
178 {
179  struct nfnl_ct *ct = (struct nfnl_ct *) a;
180  char buf[64];
181 
182  nl_new_line(p);
183 
184  if (nfnl_ct_test_proto(ct))
185  nl_dump(p, "%s ",
186  nl_ip_proto2str(nfnl_ct_get_proto(ct), buf, sizeof(buf)));
187 
188  if (nfnl_ct_test_tcp_state(ct))
189  nl_dump(p, "%s ",
190  nfnl_ct_tcp_state2str(nfnl_ct_get_tcp_state(ct),
191  buf, sizeof(buf)));
192 
193  ct_dump_tuples(ct, p);
194 
195  if (nfnl_ct_test_mark(ct) && nfnl_ct_get_mark(ct))
196  nl_dump(p, "mark %u ", nfnl_ct_get_mark(ct));
197 
198  if (nfnl_ct_test_zone(ct))
199  nl_dump(p, "zone %hu ", nfnl_ct_get_zone(ct));
200 
201  if (nfnl_ct_test_timestamp(ct)) {
202  const struct nfnl_ct_timestamp *tstamp = nfnl_ct_get_timestamp(ct);
203  int64_t delta_time = tstamp->stop - tstamp->start;
204 
205  if (delta_time > 0)
206  delta_time /= NSEC_PER_SEC;
207  else
208  delta_time = 0;
209  nl_dump(p, "delta-time %llu ", delta_time);
210  }
211 
212  nl_dump(p, "\n");
213 }
214 
215 static void ct_dump_details(struct nl_object *a, struct nl_dump_params *p)
216 {
217  struct nfnl_ct *ct = (struct nfnl_ct *) a;
218  char buf[64];
219  int fp = 0;
220 
221  ct_dump_line(a, p);
222 
223  nl_dump(p, " id 0x%x ", ct->ct_id);
224  nl_dump_line(p, "family %s ",
225  nl_af2str(ct->ct_family, buf, sizeof(buf)));
226 
227  if (nfnl_ct_test_use(ct))
228  nl_dump(p, "refcnt %u ", nfnl_ct_get_use(ct));
229 
230  if (nfnl_ct_test_timeout(ct)) {
231  uint64_t timeout_ms = nfnl_ct_get_timeout(ct) * 1000UL;
232  nl_dump(p, "timeout %s ",
233  nl_msec2str(timeout_ms, buf, sizeof(buf)));
234  }
235 
236  if (ct->ct_status)
237  nl_dump(p, "<");
238 
239 #define PRINT_FLAG(str) \
240  { nl_dump(p, "%s%s", fp++ ? "," : "", (str)); }
241 
242  if (ct->ct_status & IPS_EXPECTED)
243  PRINT_FLAG("EXPECTED");
244  if (!(ct->ct_status & IPS_SEEN_REPLY))
245  PRINT_FLAG("NOREPLY");
246  if (ct->ct_status & IPS_ASSURED)
247  PRINT_FLAG("ASSURED");
248  if (!(ct->ct_status & IPS_CONFIRMED))
249  PRINT_FLAG("NOTSENT");
250  if (ct->ct_status & IPS_SRC_NAT)
251  PRINT_FLAG("SNAT");
252  if (ct->ct_status & IPS_DST_NAT)
253  PRINT_FLAG("DNAT");
254  if (ct->ct_status & IPS_SEQ_ADJUST)
255  PRINT_FLAG("SEQADJUST");
256  if (!(ct->ct_status & IPS_SRC_NAT_DONE))
257  PRINT_FLAG("SNAT_INIT");
258  if (!(ct->ct_status & IPS_DST_NAT_DONE))
259  PRINT_FLAG("DNAT_INIT");
260  if (ct->ct_status & IPS_DYING)
261  PRINT_FLAG("DYING");
262  if (ct->ct_status & IPS_FIXED_TIMEOUT)
263  PRINT_FLAG("FIXED_TIMEOUT");
264 #undef PRINT_FLAG
265 
266  if (ct->ct_status)
267  nl_dump(p, ">");
268  nl_dump(p, "\n");
269 }
270 
271 static void ct_dump_stats(struct nl_object *a, struct nl_dump_params *p)
272 {
273  struct nfnl_ct *ct = (struct nfnl_ct *) a;
274  double res;
275  char *unit;
276  uint64_t packets;
277  const char * const names[] = {"rx", "tx"};
278  int i;
279 
280  ct_dump_details(a, p);
281 
282  if (!nfnl_ct_test_bytes(ct, 0) ||
283  !nfnl_ct_test_packets(ct, 0) ||
284  !nfnl_ct_test_bytes(ct, 1) ||
285  !nfnl_ct_test_packets(ct, 1))
286  {
287  nl_dump_line(p, " Statistics are not available.\n");
288  nl_dump_line(p, " Please set sysctl net.netfilter.nf_conntrack_acct=1\n");
289  nl_dump_line(p, " (Require kernel 2.6.27)\n");
290  return;
291  }
292 
293  nl_dump_line(p, " # packets volume\n");
294  for (i=0; i<=1; i++) {
295  res = nl_cancel_down_bytes(nfnl_ct_get_bytes(ct, i), &unit);
296  packets = nfnl_ct_get_packets(ct, i);
297  nl_dump_line(p, " %s %10" PRIu64 " %7.2f %s\n", names[i], packets, res, unit);
298  }
299 }
300 
301 static uint64_t ct_compare(struct nl_object *_a, struct nl_object *_b,
302  uint64_t attrs, int flags)
303 {
304  struct nfnl_ct *a = (struct nfnl_ct *) _a;
305  struct nfnl_ct *b = (struct nfnl_ct *) _b;
306  uint64_t diff = 0;
307 
308 #define CT_DIFF(ATTR, EXPR) ATTR_DIFF(attrs, CT_ATTR_##ATTR, a, b, EXPR)
309 #define CT_DIFF_VAL(ATTR, FIELD) CT_DIFF(ATTR, a->FIELD != b->FIELD)
310 #define CT_DIFF_ADDR(ATTR, FIELD) \
311  ((flags & LOOSE_COMPARISON) \
312  ? CT_DIFF(ATTR, nl_addr_cmp_prefix(a->FIELD, b->FIELD)) \
313  : CT_DIFF(ATTR, nl_addr_cmp(a->FIELD, b->FIELD)))
314 
315  diff |= CT_DIFF_VAL(FAMILY, ct_family);
316  diff |= CT_DIFF_VAL(PROTO, ct_proto);
317  diff |= CT_DIFF_VAL(TCP_STATE, ct_protoinfo.tcp.state);
318  diff |= CT_DIFF_VAL(TIMEOUT, ct_timeout);
319  diff |= CT_DIFF_VAL(MARK, ct_mark);
320  diff |= CT_DIFF_VAL(USE, ct_use);
321  diff |= CT_DIFF_VAL(ID, ct_id);
322  diff |= CT_DIFF_ADDR(ORIG_SRC, ct_orig.src);
323  diff |= CT_DIFF_ADDR(ORIG_DST, ct_orig.dst);
324  diff |= CT_DIFF_VAL(ORIG_SRC_PORT, ct_orig.proto.port.src);
325  diff |= CT_DIFF_VAL(ORIG_DST_PORT, ct_orig.proto.port.dst);
326  diff |= CT_DIFF_VAL(ORIG_ICMP_ID, ct_orig.proto.icmp.id);
327  diff |= CT_DIFF_VAL(ORIG_ICMP_TYPE, ct_orig.proto.icmp.type);
328  diff |= CT_DIFF_VAL(ORIG_ICMP_CODE, ct_orig.proto.icmp.code);
329  diff |= CT_DIFF_VAL(ORIG_PACKETS, ct_orig.packets);
330  diff |= CT_DIFF_VAL(ORIG_BYTES, ct_orig.bytes);
331  diff |= CT_DIFF_ADDR(REPL_SRC, ct_repl.src);
332  diff |= CT_DIFF_ADDR(REPL_DST, ct_repl.dst);
333  diff |= CT_DIFF_VAL(REPL_SRC_PORT, ct_repl.proto.port.src);
334  diff |= CT_DIFF_VAL(REPL_DST_PORT, ct_repl.proto.port.dst);
335  diff |= CT_DIFF_VAL(REPL_ICMP_ID, ct_repl.proto.icmp.id);
336  diff |= CT_DIFF_VAL(REPL_ICMP_TYPE, ct_repl.proto.icmp.type);
337  diff |= CT_DIFF_VAL(REPL_ICMP_CODE, ct_repl.proto.icmp.code);
338  diff |= CT_DIFF_VAL(REPL_PACKETS, ct_repl.packets);
339  diff |= CT_DIFF_VAL(REPL_BYTES, ct_repl.bytes);
340 
341  if (flags & LOOSE_COMPARISON)
342  diff |= CT_DIFF(STATUS, (a->ct_status ^ b->ct_status) &
343  b->ct_status_mask);
344  else
345  diff |= CT_DIFF(STATUS, a->ct_status != b->ct_status);
346 
347 #undef CT_DIFF
348 #undef CT_DIFF_VAL
349 #undef CT_DIFF_ADDR
350 
351  return diff;
352 }
353 
354 static const struct trans_tbl ct_attrs[] = {
355  __ADD(CT_ATTR_FAMILY, family),
356  __ADD(CT_ATTR_PROTO, proto),
357  __ADD(CT_ATTR_TCP_STATE, tcpstate),
358  __ADD(CT_ATTR_STATUS, status),
359  __ADD(CT_ATTR_TIMEOUT, timeout),
360  __ADD(CT_ATTR_MARK, mark),
361  __ADD(CT_ATTR_USE, use),
362  __ADD(CT_ATTR_ID, id),
363  __ADD(CT_ATTR_ORIG_SRC, origsrc),
364  __ADD(CT_ATTR_ORIG_DST, origdst),
365  __ADD(CT_ATTR_ORIG_SRC_PORT, origsrcport),
366  __ADD(CT_ATTR_ORIG_DST_PORT, origdstport),
367  __ADD(CT_ATTR_ORIG_ICMP_ID, origicmpid),
368  __ADD(CT_ATTR_ORIG_ICMP_TYPE, origicmptype),
369  __ADD(CT_ATTR_ORIG_ICMP_CODE, origicmpcode),
370  __ADD(CT_ATTR_ORIG_PACKETS, origpackets),
371  __ADD(CT_ATTR_ORIG_BYTES, origbytes),
372  __ADD(CT_ATTR_REPL_SRC, replysrc),
373  __ADD(CT_ATTR_REPL_DST, replydst),
374  __ADD(CT_ATTR_REPL_SRC_PORT, replysrcport),
375  __ADD(CT_ATTR_REPL_DST_PORT, replydstport),
376  __ADD(CT_ATTR_REPL_ICMP_ID, replyicmpid),
377  __ADD(CT_ATTR_REPL_ICMP_TYPE, replyicmptype),
378  __ADD(CT_ATTR_REPL_ICMP_CODE, replyicmpcode),
379  __ADD(CT_ATTR_REPL_PACKETS, replypackets),
380  __ADD(CT_ATTR_REPL_BYTES, replybytes),
381 };
382 
383 static char *ct_attrs2str(int attrs, char *buf, size_t len)
384 {
385  return __flags2str(attrs, buf, len, ct_attrs, ARRAY_SIZE(ct_attrs));
386 }
387 
388 /**
389  * @name Allocation/Freeing
390  * @{
391  */
392 
393 struct nfnl_ct *nfnl_ct_alloc(void)
394 {
395  return (struct nfnl_ct *) nl_object_alloc(&ct_obj_ops);
396 }
397 
398 void nfnl_ct_get(struct nfnl_ct *ct)
399 {
400  nl_object_get((struct nl_object *) ct);
401 }
402 
403 void nfnl_ct_put(struct nfnl_ct *ct)
404 {
405  nl_object_put((struct nl_object *) ct);
406 }
407 
408 /** @} */
409 
410 /**
411  * @name Attributes
412  * @{
413  */
414 
415 void nfnl_ct_set_family(struct nfnl_ct *ct, uint8_t family)
416 {
417  ct->ct_family = family;
418  ct->ce_mask |= CT_ATTR_FAMILY;
419 }
420 
421 uint8_t nfnl_ct_get_family(const struct nfnl_ct *ct)
422 {
423  if (ct->ce_mask & CT_ATTR_FAMILY)
424  return ct->ct_family;
425  else
426  return AF_UNSPEC;
427 }
428 
429 void nfnl_ct_set_proto(struct nfnl_ct *ct, uint8_t proto)
430 {
431  ct->ct_proto = proto;
432  ct->ce_mask |= CT_ATTR_PROTO;
433 }
434 
435 int nfnl_ct_test_proto(const struct nfnl_ct *ct)
436 {
437  return !!(ct->ce_mask & CT_ATTR_PROTO);
438 }
439 
440 uint8_t nfnl_ct_get_proto(const struct nfnl_ct *ct)
441 {
442  return ct->ct_proto;
443 }
444 
445 void nfnl_ct_set_tcp_state(struct nfnl_ct *ct, uint8_t state)
446 {
447  ct->ct_protoinfo.tcp.state = state;
448  ct->ce_mask |= CT_ATTR_TCP_STATE;
449 }
450 
451 int nfnl_ct_test_tcp_state(const struct nfnl_ct *ct)
452 {
453  return !!(ct->ce_mask & CT_ATTR_TCP_STATE);
454 }
455 
456 uint8_t nfnl_ct_get_tcp_state(const struct nfnl_ct *ct)
457 {
458  return ct->ct_protoinfo.tcp.state;
459 }
460 
461 static const struct trans_tbl tcp_states[] = {
462  __ADD(TCP_CONNTRACK_NONE,NONE),
463  __ADD(TCP_CONNTRACK_SYN_SENT,SYN_SENT),
464  __ADD(TCP_CONNTRACK_SYN_RECV,SYN_RECV),
465  __ADD(TCP_CONNTRACK_ESTABLISHED,ESTABLISHED),
466  __ADD(TCP_CONNTRACK_FIN_WAIT,FIN_WAIT),
467  __ADD(TCP_CONNTRACK_CLOSE_WAIT,CLOSE_WAIT),
468  __ADD(TCP_CONNTRACK_LAST_ACK,LAST_ACK),
469  __ADD(TCP_CONNTRACK_TIME_WAIT,TIME_WAIT),
470  __ADD(TCP_CONNTRACK_CLOSE,CLOSE),
471  __ADD(TCP_CONNTRACK_LISTEN,LISTEN),
472 };
473 
474 char *nfnl_ct_tcp_state2str(uint8_t state, char *buf, size_t len)
475 {
476  return __type2str(state, buf, len, tcp_states, ARRAY_SIZE(tcp_states));
477 }
478 
479 int nfnl_ct_str2tcp_state(const char *name)
480 {
481  return __str2type(name, tcp_states, ARRAY_SIZE(tcp_states));
482 }
483 
484 void nfnl_ct_set_status(struct nfnl_ct *ct, uint32_t status)
485 {
486  ct->ct_status_mask |= status;
487  ct->ct_status |= status;
488  ct->ce_mask |= CT_ATTR_STATUS;
489 }
490 
491 void nfnl_ct_unset_status(struct nfnl_ct *ct, uint32_t status)
492 {
493  ct->ct_status_mask |= status;
494  ct->ct_status &= ~status;
495  ct->ce_mask |= CT_ATTR_STATUS;
496 }
497 
498 int nfnl_ct_test_status(const struct nfnl_ct *ct)
499 {
500  return !!(ct->ce_mask & CT_ATTR_STATUS);
501 }
502 
503 uint32_t nfnl_ct_get_status(const struct nfnl_ct *ct)
504 {
505  return ct->ct_status;
506 }
507 
508 static const struct trans_tbl status_flags[] = {
509  __ADD(IPS_EXPECTED, expected),
510  __ADD(IPS_SEEN_REPLY, seen_reply),
511  __ADD(IPS_ASSURED, assured),
512  __ADD(IPS_CONFIRMED, confirmed),
513  __ADD(IPS_SRC_NAT, snat),
514  __ADD(IPS_DST_NAT, dnat),
515  __ADD(IPS_SEQ_ADJUST, seqadjust),
516  __ADD(IPS_SRC_NAT_DONE, snat_done),
517  __ADD(IPS_DST_NAT_DONE, dnat_done),
518  __ADD(IPS_DYING, dying),
519  __ADD(IPS_FIXED_TIMEOUT, fixed_timeout),
520 };
521 
522 char * nfnl_ct_status2str(int flags, char *buf, size_t len)
523 {
524  return __flags2str(flags, buf, len, status_flags,
525  ARRAY_SIZE(status_flags));
526 }
527 
528 int nfnl_ct_str2status(const char *name)
529 {
530  return __str2flags(name, status_flags, ARRAY_SIZE(status_flags));
531 }
532 
533 void nfnl_ct_set_timeout(struct nfnl_ct *ct, uint32_t timeout)
534 {
535  ct->ct_timeout = timeout;
536  ct->ce_mask |= CT_ATTR_TIMEOUT;
537 }
538 
539 int nfnl_ct_test_timeout(const struct nfnl_ct *ct)
540 {
541  return !!(ct->ce_mask & CT_ATTR_TIMEOUT);
542 }
543 
544 uint32_t nfnl_ct_get_timeout(const struct nfnl_ct *ct)
545 {
546  return ct->ct_timeout;
547 }
548 
549 void nfnl_ct_set_mark(struct nfnl_ct *ct, uint32_t mark)
550 {
551  ct->ct_mark = mark;
552  ct->ce_mask |= CT_ATTR_MARK;
553 }
554 
555 int nfnl_ct_test_mark(const struct nfnl_ct *ct)
556 {
557  return !!(ct->ce_mask & CT_ATTR_MARK);
558 }
559 
560 uint32_t nfnl_ct_get_mark(const struct nfnl_ct *ct)
561 {
562  return ct->ct_mark;
563 }
564 
565 void nfnl_ct_set_use(struct nfnl_ct *ct, uint32_t use)
566 {
567  ct->ct_use = use;
568  ct->ce_mask |= CT_ATTR_USE;
569 }
570 
571 int nfnl_ct_test_use(const struct nfnl_ct *ct)
572 {
573  return !!(ct->ce_mask & CT_ATTR_USE);
574 }
575 
576 uint32_t nfnl_ct_get_use(const struct nfnl_ct *ct)
577 {
578  return ct->ct_use;
579 }
580 
581 void nfnl_ct_set_id(struct nfnl_ct *ct, uint32_t id)
582 {
583  ct->ct_id = id;
584  ct->ce_mask |= CT_ATTR_ID;
585 }
586 
587 int nfnl_ct_test_id(const struct nfnl_ct *ct)
588 {
589  return !!(ct->ce_mask & CT_ATTR_ID);
590 }
591 
592 uint32_t nfnl_ct_get_id(const struct nfnl_ct *ct)
593 {
594  return ct->ct_id;
595 }
596 
597 void nfnl_ct_set_zone(struct nfnl_ct *ct, uint16_t zone)
598 {
599  ct->ct_zone = zone;
600  ct->ce_mask |= CT_ATTR_ZONE;
601 }
602 
603 int nfnl_ct_test_zone(const struct nfnl_ct *ct)
604 {
605  return !!(ct->ce_mask & CT_ATTR_ZONE);
606 }
607 
608 uint16_t nfnl_ct_get_zone(const struct nfnl_ct *ct)
609 {
610  return ct->ct_zone;
611 }
612 
613 static int ct_set_addr(struct nfnl_ct *ct, struct nl_addr *addr,
614  int attr, struct nl_addr ** ct_addr)
615 {
616  if (ct->ce_mask & CT_ATTR_FAMILY) {
617  if (addr->a_family != ct->ct_family)
618  return -NLE_AF_MISMATCH;
619  } else
620  nfnl_ct_set_family(ct, addr->a_family);
621 
622  if (*ct_addr)
623  nl_addr_put(*ct_addr);
624 
625  nl_addr_get(addr);
626  *ct_addr = addr;
627  ct->ce_mask |= attr;
628 
629  return 0;
630 }
631 
632 int nfnl_ct_set_src(struct nfnl_ct *ct, int repl, struct nl_addr *addr)
633 {
634  struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
635  int attr = repl ? CT_ATTR_REPL_SRC : CT_ATTR_ORIG_SRC;
636  return ct_set_addr(ct, addr, attr, &dir->src);
637 }
638 
639 int nfnl_ct_set_dst(struct nfnl_ct *ct, int repl, struct nl_addr *addr)
640 {
641  struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
642  int attr = repl ? CT_ATTR_REPL_DST : CT_ATTR_ORIG_DST;
643  return ct_set_addr(ct, addr, attr, &dir->dst);
644 }
645 
646 struct nl_addr *nfnl_ct_get_src(const struct nfnl_ct *ct, int repl)
647 {
648  const struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
649  int attr = repl ? CT_ATTR_REPL_SRC : CT_ATTR_ORIG_SRC;
650  if (!(ct->ce_mask & attr))
651  return NULL;
652  return dir->src;
653 }
654 
655 struct nl_addr *nfnl_ct_get_dst(const struct nfnl_ct *ct, int repl)
656 {
657  const struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
658  int attr = repl ? CT_ATTR_REPL_DST : CT_ATTR_ORIG_DST;
659  if (!(ct->ce_mask & attr))
660  return NULL;
661  return dir->dst;
662 }
663 
664 void nfnl_ct_set_src_port(struct nfnl_ct *ct, int repl, uint16_t port)
665 {
666  struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
667  int attr = repl ? CT_ATTR_REPL_SRC_PORT : CT_ATTR_ORIG_SRC_PORT;
668 
669  dir->proto.port.src = port;
670  ct->ce_mask |= attr;
671 }
672 
673 int nfnl_ct_test_src_port(const struct nfnl_ct *ct, int repl)
674 {
675  int attr = repl ? CT_ATTR_REPL_SRC_PORT : CT_ATTR_ORIG_SRC_PORT;
676  return !!(ct->ce_mask & attr);
677 }
678 
679 uint16_t nfnl_ct_get_src_port(const struct nfnl_ct *ct, int repl)
680 {
681  const struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
682 
683  return dir->proto.port.src;
684 }
685 
686 void nfnl_ct_set_dst_port(struct nfnl_ct *ct, int repl, uint16_t port)
687 {
688  struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
689  int attr = repl ? CT_ATTR_REPL_DST_PORT : CT_ATTR_ORIG_DST_PORT;
690 
691  dir->proto.port.dst = port;
692  ct->ce_mask |= attr;
693 }
694 
695 int nfnl_ct_test_dst_port(const struct nfnl_ct *ct, int repl)
696 {
697  int attr = repl ? CT_ATTR_REPL_DST_PORT : CT_ATTR_ORIG_DST_PORT;
698  return !!(ct->ce_mask & attr);
699 }
700 
701 uint16_t nfnl_ct_get_dst_port(const struct nfnl_ct *ct, int repl)
702 {
703  const struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
704 
705  return dir->proto.port.dst;
706 }
707 
708 void nfnl_ct_set_icmp_id(struct nfnl_ct *ct, int repl, uint16_t id)
709 {
710  struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
711  int attr = repl ? CT_ATTR_REPL_ICMP_ID : CT_ATTR_ORIG_ICMP_ID;
712 
713  dir->proto.icmp.id = id;
714  ct->ce_mask |= attr;
715 }
716 
717 int nfnl_ct_test_icmp_id(const struct nfnl_ct *ct, int repl)
718 {
719  int attr = repl ? CT_ATTR_REPL_ICMP_ID : CT_ATTR_ORIG_ICMP_ID;
720  return !!(ct->ce_mask & attr);
721 }
722 
723 uint16_t nfnl_ct_get_icmp_id(const struct nfnl_ct *ct, int repl)
724 {
725  const struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
726 
727  return dir->proto.icmp.id;
728 }
729 
730 void nfnl_ct_set_icmp_type(struct nfnl_ct *ct, int repl, uint8_t type)
731 {
732  struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
733  int attr = repl ? CT_ATTR_REPL_ICMP_TYPE : CT_ATTR_ORIG_ICMP_TYPE;
734 
735  dir->proto.icmp.type = type;
736  ct->ce_mask |= attr;
737 }
738 
739 int nfnl_ct_test_icmp_type(const struct nfnl_ct *ct, int repl)
740 {
741  int attr = repl ? CT_ATTR_REPL_ICMP_TYPE : CT_ATTR_ORIG_ICMP_TYPE;
742  return !!(ct->ce_mask & attr);
743 }
744 
745 uint8_t nfnl_ct_get_icmp_type(const struct nfnl_ct *ct, int repl)
746 {
747  const struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
748 
749  return dir->proto.icmp.type;
750 }
751 
752 void nfnl_ct_set_icmp_code(struct nfnl_ct *ct, int repl, uint8_t code)
753 {
754  struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
755  int attr = repl ? CT_ATTR_REPL_ICMP_CODE : CT_ATTR_ORIG_ICMP_CODE;
756 
757  dir->proto.icmp.code = code;
758  ct->ce_mask |= attr;
759 }
760 
761 int nfnl_ct_test_icmp_code(const struct nfnl_ct *ct, int repl)
762 {
763  int attr = repl ? CT_ATTR_REPL_ICMP_CODE : CT_ATTR_ORIG_ICMP_CODE;
764  return !!(ct->ce_mask & attr);
765 }
766 
767 uint8_t nfnl_ct_get_icmp_code(const struct nfnl_ct *ct, int repl)
768 {
769  const struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
770 
771  return dir->proto.icmp.code;
772 }
773 
774 void nfnl_ct_set_packets(struct nfnl_ct *ct, int repl, uint64_t packets)
775 {
776  struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
777  int attr = repl ? CT_ATTR_REPL_PACKETS : CT_ATTR_ORIG_PACKETS;
778 
779  dir->packets = packets;
780  ct->ce_mask |= attr;
781 }
782 
783 int nfnl_ct_test_packets(const struct nfnl_ct *ct, int repl)
784 {
785  int attr = repl ? CT_ATTR_REPL_PACKETS : CT_ATTR_ORIG_PACKETS;
786  return !!(ct->ce_mask & attr);
787 }
788 
789 uint64_t nfnl_ct_get_packets(const struct nfnl_ct *ct, int repl)
790 {
791  const struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
792 
793  return dir->packets;
794 }
795 
796 void nfnl_ct_set_bytes(struct nfnl_ct *ct, int repl, uint64_t bytes)
797 {
798  struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
799  int attr = repl ? CT_ATTR_REPL_BYTES : CT_ATTR_ORIG_BYTES;
800 
801  dir->bytes = bytes;
802  ct->ce_mask |= attr;
803 }
804 
805 int nfnl_ct_test_bytes(const struct nfnl_ct *ct, int repl)
806 {
807  int attr = repl ? CT_ATTR_REPL_BYTES : CT_ATTR_ORIG_BYTES;
808  return !!(ct->ce_mask & attr);
809 }
810 
811 uint64_t nfnl_ct_get_bytes(const struct nfnl_ct *ct, int repl)
812 {
813  const struct nfnl_ct_dir *dir = repl ? &ct->ct_repl : &ct->ct_orig;
814 
815  return dir->bytes;
816 }
817 
818 void nfnl_ct_set_timestamp(struct nfnl_ct *ct, uint64_t start, uint64_t stop)
819 {
820  ct->ct_tstamp.start = start;
821  ct->ct_tstamp.stop = stop;
822  ct->ce_mask |= CT_ATTR_TIMESTAMP;
823 }
824 
825 int nfnl_ct_test_timestamp(const struct nfnl_ct *ct)
826 {
827  return !!(ct->ce_mask & CT_ATTR_TIMESTAMP);
828 }
829 
830 const struct nfnl_ct_timestamp *nfnl_ct_get_timestamp(const struct nfnl_ct *ct)
831 {
832  return &ct->ct_tstamp;
833 }
834 
835 /** @} */
836 
837 struct nl_object_ops ct_obj_ops = {
838  .oo_name = "netfilter/ct",
839  .oo_size = sizeof(struct nfnl_ct),
840  .oo_free_data = ct_free_data,
841  .oo_clone = ct_clone,
842  .oo_dump = {
843  [NL_DUMP_LINE] = ct_dump_line,
844  [NL_DUMP_DETAILS] = ct_dump_details,
845  [NL_DUMP_STATS] = ct_dump_stats,
846  },
847  .oo_compare = ct_compare,
848  .oo_attrs2str = ct_attrs2str,
849 };
850 
851 /** @} */
struct nl_addr * nl_addr_clone(const struct nl_addr *addr)
Clone existing abstract address object.
Definition: addr.c:494
Dump object briefly on one line.
Definition: types.h:22
void nl_new_line(struct nl_dump_params *params)
Handle a new line while dumping.
Definition: utils.c:913
int nl_addr_cmp(const struct nl_addr *a, const struct nl_addr *b)
Compare abstract addresses.
Definition: addr.c:586
struct nl_object * nl_object_alloc(struct nl_object_ops *ops)
Allocate a new object of kind specified by the operations handle.
Definition: object.c:55
void nl_object_get(struct nl_object *obj)
Acquire a reference on a object.
Definition: object.c:205
char * nl_msec2str(uint64_t msec, char *buf, size_t len)
Convert milliseconds to a character string.
Definition: utils.c:595
struct nl_addr * nl_addr_get(struct nl_addr *addr)
Increase the reference counter of an abstract address.
Definition: addr.c:524
Dump all attributes but no statistics.
Definition: types.h:23
double nl_cancel_down_bytes(unsigned long long l, char **unit)
Cancel down a byte counter.
Definition: utils.c:170
void nl_object_put(struct nl_object *obj)
Release a reference from an object.
Definition: object.c:216
void nl_addr_put(struct nl_addr *addr)
Decrease the reference counter of an abstract address.
Definition: addr.c:540
Dumping parameters.
Definition: types.h:33
void nl_dump(struct nl_dump_params *params, const char *fmt,...)
Dump a formatted character string.
Definition: utils.c:962
Dump all attributes including statistics.
Definition: types.h:24
char * nl_addr2str(const struct nl_addr *addr, char *buf, size_t size)
Convert abstract address object to character string.
Definition: addr.c:1000