libnetfilter_conntrack 1.1.0
expect_create_userspace.c
1#include <stdio.h>
2#include <stdlib.h>
3#include <string.h>
4#include <errno.h>
5#include <arpa/inet.h>
6
7#include <libnetfilter_conntrack/libnetfilter_conntrack.h>
8#include <libnetfilter_conntrack/libnetfilter_conntrack_tcp.h>
9
10/*
11 * This example shows how to setup a user-space expectation. This requires
12 * a Linux kernel >= 2.6.37.
13 */
14
15int main(void)
16{
17 int ret;
18 struct nfct_handle *h;
19 struct nf_conntrack *master, *expected, *mask;
20 struct nf_expect *exp;
21
22 /*
23 * Step 1: Setup master conntrack
24 */
25
26 master = nfct_new();
27 if (!master) {
28 perror("nfct_new");
29 exit(EXIT_FAILURE);
30 }
31
32 nfct_set_attr_u8(master, ATTR_L3PROTO, AF_INET);
33 nfct_set_attr_u32(master, ATTR_IPV4_SRC, inet_addr("1.1.1.1"));
34 nfct_set_attr_u32(master, ATTR_IPV4_DST, inet_addr("2.2.2.2"));
35
36 nfct_set_attr_u8(master, ATTR_L4PROTO, IPPROTO_TCP);
37 nfct_set_attr_u16(master, ATTR_PORT_SRC, htons(1025));
38 nfct_set_attr_u16(master, ATTR_PORT_DST, htons(21));
39
40 nfct_setobjopt(master, NFCT_SOPT_SETUP_REPLY);
41
42 nfct_set_attr_u8(master, ATTR_TCP_STATE, TCP_CONNTRACK_ESTABLISHED);
43 nfct_set_attr_u32(master, ATTR_TIMEOUT, 200);
44
45 h = nfct_open(CONNTRACK, 0);
46 if (!h) {
47 perror("nfct_open");
48 nfct_destroy(master);
49 return -1;
50 }
51
52 /*
53 * In a real scenario in which you want to implement an helper in
54 * user-space with NFQUEUE, the master conntrack does not need to
55 * be created, since it should already exist.
56 */
57 ret = nfct_query(h, NFCT_Q_CREATE, master);
58
59 printf("TEST: add master conntrack ");
60 if (ret == -1)
61 printf("(%d)(%s)\n", ret, strerror(errno));
62 else
63 printf("(OK)\n");
64
65 nfct_close(h);
66
67 expected = nfct_new();
68 if (!expected) {
69 perror("nfct_new");
70 nfct_destroy(master);
71 exit(EXIT_FAILURE);
72 }
73
74 nfct_set_attr_u8(expected, ATTR_L3PROTO, AF_INET);
75 nfct_set_attr_u32(expected, ATTR_IPV4_SRC, inet_addr("1.1.1.1"));
76 nfct_set_attr_u32(expected, ATTR_IPV4_DST, inet_addr("2.2.2.2"));
77
78 nfct_set_attr_u8(expected, ATTR_L4PROTO, IPPROTO_TCP);
79 nfct_set_attr_u16(expected, ATTR_PORT_SRC, 0);
80 nfct_set_attr_u16(expected, ATTR_PORT_DST, htons(10241));
81
82 mask = nfct_new();
83 if (!mask) {
84 perror("nfct_new");
85 nfct_destroy(master);
86 nfct_destroy(expected);
87 exit(EXIT_FAILURE);
88 }
89
90 nfct_set_attr_u8(mask, ATTR_L3PROTO, AF_INET);
91 nfct_set_attr_u32(mask, ATTR_IPV4_SRC, 0xffffffff);
92 nfct_set_attr_u32(mask, ATTR_IPV4_DST, 0xffffffff);
93
94 nfct_set_attr_u8(mask, ATTR_L4PROTO, IPPROTO_TCP);
95 nfct_set_attr_u16(mask, ATTR_PORT_SRC, 0x0000);
96 nfct_set_attr_u16(mask, ATTR_PORT_DST, 0xffff);
97
98 /*
99 * Step 2: Setup expectation
100 */
101
102 exp = nfexp_new();
103 if (!exp) {
104 perror("nfexp_new");
105 nfct_destroy(master);
106 nfct_destroy(expected);
107 nfct_destroy(mask);
108 exit(EXIT_FAILURE);
109 }
110
111 nfexp_set_attr(exp, ATTR_EXP_MASTER, master);
112 nfexp_set_attr(exp, ATTR_EXP_EXPECTED, expected);
113 nfexp_set_attr(exp, ATTR_EXP_MASK, mask);
114 nfexp_set_attr_u32(exp, ATTR_EXP_TIMEOUT, 200);
115
116 nfct_destroy(master);
117 nfct_destroy(expected);
118 nfct_destroy(mask);
119
120 h = nfct_open(EXPECT, 0);
121 if (!h) {
122 perror("nfct_open");
123 return -1;
124 }
125
126 ret = nfexp_query(h, NFCT_Q_CREATE, exp);
127
128 printf("TEST: create expectation ");
129 if (ret == -1)
130 printf("(%d)(%s)\n", ret, strerror(errno));
131 else
132 printf("(OK)\n");
133
134 nfct_close(h);
135
136 ret == -1 ? exit(EXIT_FAILURE) : exit(EXIT_SUCCESS);
137}
struct nfct_handle * nfct_open(uint8_t, unsigned)
Definition main.c:84
int nfct_close(struct nfct_handle *cth)
Definition main.c:105
int nfexp_query(struct nfct_handle *h, const enum nf_conntrack_query qt, const void *data)
Definition expect/api.c:695
int nfct_query(struct nfct_handle *h, const enum nf_conntrack_query query, const void *data)
void nfct_set_attr_u32(struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint32_t value)
void nfct_destroy(struct nf_conntrack *ct)
int nfct_setobjopt(struct nf_conntrack *ct, unsigned int option)
void nfct_set_attr_u16(struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint16_t value)
void nfct_set_attr_u8(struct nf_conntrack *ct, const enum nf_conntrack_attr type, uint8_t value)
struct nf_conntrack * nfct_new(void)
void nfexp_set_attr_u32(struct nf_expect *exp, const enum nf_expect_attr type, uint32_t value)
Definition expect/api.c:357
struct nf_expect * nfexp_new(void)
Definition expect/api.c:29
void nfexp_set_attr(struct nf_expect *exp, const enum nf_expect_attr type, const void *value)
Definition expect/api.c:309